feat(boundaries): package name as tag punning (#10151)

### Description

Allows a package name to be used as a tag ([tag
punning](https://en.wikipedia.org/wiki/Type_punning)). We're adding this
feature to help users define an explicit set of packages that their
package can be imported by. Combined with the ability to define package
rules in a package `turbo.json` (next PR after this, coming soon), and
code owner restrictions, this will permit package owners to control who
can import their package.

### Testing Instructions

Added test in `boundaries_tags` fixture

Author: NicholasLYang

crates/turborepo-errors/src/lib.rs

@@ -113,6 +113,12 @@ impl<T: Deserializable> Deserializable for Spanned<T> {
     }
 }
 
+impl Spanned<String> {
+    pub fn as_str(&self) -> &str {
+        self.value.as_str()
+    }
+}
+
 impl<T> Spanned<T> {
     pub fn new(t: T) -> Self {
         Self {

crates/turborepo-lib/src/boundaries/mod.rs

@@ -41,6 +41,14 @@ use crate::{
 
 #[derive(Clone, Debug, Error, Diagnostic)]
 pub enum SecondaryDiagnostic {
+    #[error("package `{package} is defined here")]
+    PackageDefinedHere {
+        package: String,
+        #[label]
+        package_span: Option<SourceSpan>,
+        #[source_code]
+        package_text: NamedSource<String>,
+    },
     #[error("consider adding one of the following tags listed here")]
     Allowlist {
         #[label]
@@ -59,6 +67,17 @@ pub enum SecondaryDiagnostic {
 
 #[derive(Clone, Debug, Error, Diagnostic)]
 pub enum BoundariesDiagnostic {
+    #[error("Tag `{tag}` cannot share the same name as package `{package}`")]
+    TagSharesPackageName {
+        tag: String,
+        package: String,
+        #[label("tag defined here")]
+        tag_span: Option<SourceSpan>,
+        #[source_code]
+        tag_text: NamedSource<String>,
+        #[related]
+        secondary: [SecondaryDiagnostic; 1],
+    },
     #[error("Path `{path}` is not valid UTF-8. Turborepo only supports UTF-8 paths.")]
     InvalidPath { path: String },
     #[error(
@@ -320,6 +339,7 @@ impl Run {
             if let Some(tag_rules) = tag_rules {
                 result.diagnostics.extend(self.check_package_tags(
                     PackageNode::Workspace(package_name.clone()),
+                    &package_info.package_json,
                     tags,
                     tag_rules,
                 )?);

crates/turborepo-lib/src/boundaries/tags.rs

@@ -1,25 +1,30 @@
 use std::collections::{HashMap, HashSet};
 
-use tracing::warn;
+use miette::NamedSource;
 use turborepo_errors::Spanned;
-use turborepo_repository::package_graph::{PackageName, PackageNode};
+use turborepo_repository::{
+    package_graph::{PackageName, PackageNode},
+    package_json::PackageJson,
+};
 
 use crate::{
     boundaries::{config::Rule, BoundariesDiagnostic, Error, Permissions, SecondaryDiagnostic},
     run::Run,
-    turbo_json::TurboJson,
 };
 
 pub type ProcessedRulesMap = HashMap<String, ProcessedRule>;
 
 pub struct ProcessedRule {
+    span: Spanned<()>,
     dependencies: Option<ProcessedPermissions>,
     dependents: Option<ProcessedPermissions>,
 }
 
-impl From<Rule> for ProcessedRule {
-    fn from(rule: Rule) -> Self {
+impl From<Spanned<Rule>> for ProcessedRule {
+    fn from(rule: Spanned<Rule>) -> Self {
+        let (rule, span) = rule.split();
         Self {
+            span,
             dependencies: rule
                 .dependencies
                 .map(|dependencies| dependencies.into_inner().into()),
@@ -56,30 +61,6 @@ impl Run {
             .and_then(|turbo_json| turbo_json.tags.as_ref())
     }
 
-    pub(crate) fn get_package_tags(&self) -> HashMap<PackageName, Spanned<Vec<Spanned<String>>>> {
-        let mut package_tags = HashMap::new();
-        for (package, _) in self.pkg_dep_graph().packages() {
-            if let Ok(TurboJson {
-                tags: Some(tags),
-                boundaries,
-                ..
-            }) = self.turbo_json_loader().load(package)
-            {
-                if boundaries.as_ref().is_some_and(|b| b.tags.is_some())
-                    && !matches!(package, PackageName::Root)
-                {
-                    warn!(
-                        "Boundaries rules can only be defined in the root turbo.json. Any rules \
-                         defined in a package's turbo.json will be ignored."
-                    )
-                }
-                package_tags.insert(package.clone(), tags.clone());
-            }
-        }
-
-        package_tags
-    }
-
     pub(crate) fn get_processed_rules_map(&self) -> Option<ProcessedRulesMap> {
         self.root_turbo_json()
             .boundaries
@@ -88,7 +69,7 @@ impl Run {
             .map(|tags| {
                 tags.as_inner()
                     .iter()
-                    .map(|(k, v)| (k.clone(), v.as_inner().clone().into()))
+                    .map(|(k, v)| (k.clone(), v.clone().into()))
                     .collect()
             })
     }
@@ -99,14 +80,43 @@ impl Run {
     fn validate_relation(
         &self,
         package_name: &PackageName,
+        package_json: &PackageJson,
         relation_package_name: &PackageName,
         tags: Option<&Spanned<Vec<Spanned<String>>>>,
         allow_list: Option<&Spanned<HashSet<String>>>,
         deny_list: Option<&Spanned<HashSet<String>>>,
     ) -> Result<Option<BoundariesDiagnostic>, Error> {
-        // If there is no allow list, then we vacuously have a tag in the allow list
-        let mut has_tag_in_allowlist = allow_list.is_none();
+        // We allow "punning" the package name as a tag, so if the allow list contains
+        // the package name, then we have a tag in the allow list
+        // Likewise, if the allow list is empty, then we vacuously have a tag in the
+        // allow list
+        let mut has_tag_in_allowlist =
+            allow_list.is_none_or(|allow_list| allow_list.contains(relation_package_name.as_str()));
         let tags_span = tags.map(|tags| tags.to(())).unwrap_or_default();
+        if let Some(deny_list) = deny_list {
+            if deny_list.contains(relation_package_name.as_str()) {
+                let (span, text) = package_json
+                    .name
+                    .as_ref()
+                    .map(|name| name.span_and_text("turbo.json"))
+                    .unwrap_or_else(|| (None, NamedSource::new("package.json", String::new())));
+                let deny_list_spanned = deny_list.to(());
+                let (deny_list_span, deny_list_text) =
+                    deny_list_spanned.span_and_text("turbo.json");
+
+                return Ok(Some(BoundariesDiagnostic::DeniedTag {
+                    source_package_name: package_name.clone(),
+                    package_name: relation_package_name.clone(),
+                    tag: relation_package_name.to_string(),
+                    span,
+                    text,
+                    secondary: [SecondaryDiagnostic::Denylist {
+                        span: deny_list_span,
+                        text: deny_list_text,
+                    }],
+                }));
+            }
+        }
 
         for tag in tags.into_iter().flatten().flatten() {
             if let Some(allow_list) = allow_list {
@@ -170,10 +180,34 @@ impl Run {
     pub(crate) fn check_package_tags(
         &self,
         pkg: PackageNode,
+        package_json: &PackageJson,
         current_package_tags: &Spanned<Vec<Spanned<String>>>,
         tags_rules: &ProcessedRulesMap,
     ) -> Result<Vec<BoundariesDiagnostic>, Error> {
         let mut diagnostics = Vec::new();
+
+        // We don't allow tags to share the same name as the package because
+        // we allow package names to be used as a tag
+        if let Some(rule) = tags_rules.get(pkg.as_package_name().as_str()) {
+            let (tag_span, tag_text) = rule.span.span_and_text("turbo.json");
+            let (package_span, package_text) = package_json
+                .name
+                .as_ref()
+                .map(|name| name.span_and_text("package.json"))
+                .unwrap_or_else(|| (None, NamedSource::new("package.json", "".into())));
+            diagnostics.push(BoundariesDiagnostic::TagSharesPackageName {
+                tag: pkg.as_package_name().to_string(),
+                package: pkg.as_package_name().to_string(),
+                tag_span,
+                tag_text,
+                secondary: [SecondaryDiagnostic::PackageDefinedHere {
+                    package: pkg.as_package_name().to_string(),
+                    package_span,
+                    package_text,
+                }],
+            });
+        }
+
         for tag in current_package_tags.iter() {
             if let Some(rule) = tags_rules.get(tag.as_inner()) {
                 if let Some(dependency_permissions) = &rule.dependencies {
@@ -186,6 +220,7 @@ impl Run {
 
                         diagnostics.extend(self.validate_relation(
                             pkg.as_package_name(),
+                            package_json,
                             dependency.as_package_name(),
                             dependency_tags,
                             dependency_permissions.allow.as_ref(),
@@ -202,6 +237,7 @@ impl Run {
                         let dependent_tags = self.load_package_tags(dependent.as_package_name());
                         diagnostics.extend(self.validate_relation(
                             pkg.as_package_name(),
+                            package_json,
                             dependent.as_package_name(),
                             dependent_tags,
                             dependent_permissions.allow.as_ref(),

crates/turborepo-lib/src/commands/prune.rs

@@ -307,7 +307,11 @@ impl<'a> Prune<'a> {
             };
             trace!(
                 "target: {}",
-                info.package_json.name.as_deref().unwrap_or_default()
+                info.package_json
+                    .name
+                    .as_ref()
+                    .map(|name| name.as_str())
+                    .unwrap_or_default()
             );
             trace!("workspace package.json: {}", &info.package_json_path);
             trace!(

crates/turborepo-lib/src/engine/builder.rs

@@ -760,7 +760,7 @@ mod test {
                 $(
                     let path = $root.join_components(&["packages", $name, "package.json"]);
                     let dependencies = Some($deps.iter().map(|dep: &&str| (dep.to_string(), "workspace:*".to_string())).collect());
-                    let package_json = PackageJson { name: Some($name.to_string()), dependencies, ..Default::default() };
+                    let package_json = PackageJson { name: Some(Spanned::new($name.to_string())), dependencies, ..Default::default() };
                     _map.insert(path, package_json);
                 )+
                 _map

crates/turborepo-lib/src/engine/mod.rs

@@ -638,7 +638,7 @@ mod test {
                     };
 
                     let package = PackageJson {
-                        name: Some(name.to_string()),
+                        name: Some(Spanned::new(name.to_string())),
                         scripts,
                         ..Default::default()
                     };

crates/turborepo-lib/src/query/boundaries.rs

@@ -92,6 +92,14 @@ impl From<BoundariesDiagnostic> for Diagnostic {
                 import: None,
                 reason: None,
             },
+            BoundariesDiagnostic::TagSharesPackageName { tag, tag_span, .. } => Diagnostic {
+                message,
+                path: None,
+                start: tag_span.map(|span| span.offset()),
+                end: tag_span.map(|span| span.offset() + span.len()),
+                import: None,
+                reason: Some(tag),
+            },
         }
     }
 }

crates/turborepo-lib/src/run/scope/filter.rs

@@ -713,6 +713,7 @@ mod test {
     use tempfile::TempDir;
     use test_case::test_case;
     use turbopath::{AbsoluteSystemPathBuf, AnchoredSystemPathBuf, RelativeUnixPathBuf};
+    use turborepo_errors::Spanned;
     use turborepo_repository::{
         change_mapper::PackageInclusionReason,
         discovery::PackageDiscovery,
@@ -806,7 +807,7 @@ mod test {
                         RelativeUnixPathBuf::new(format!("{package_path}/package.json")).unwrap(),
                     ),
                     PackageJson {
-                        name: Some(name.to_string()),
+                        name: Some(Spanned::new(name.to_string())),
                         dependencies: dependencies.get(name).map(|v| {
                             v.iter()
                                 .map(|name| (name.to_string(), "*".to_string()))

crates/turborepo-lsp/src/lib.rs

@@ -325,7 +325,7 @@ impl LanguageServer for Backend {
             let package_json_name = if repo_root.contains(&wd.package_json) {
                 Some("//")
             } else {
-                package_json.name.as_deref()
+                package_json.name.as_ref().map(|name| name.as_str())
             };
 
             // todo: use jsonc_ast instead of text search
@@ -613,7 +613,7 @@ impl LanguageServer for Backend {
             .iter()
             .flat_map(|p| p.scripts.keys().map(move |k| (p.name.clone(), k)))
             .map(|(package, s)| CompletionItem {
-                label: format!("{}#{}", package.unwrap_or_default(), s),
+                label: format!("{}#{}", package.unwrap_or_default().into_inner(), s),
                 kind: Some(CompletionItemKind::FIELD),
                 ..Default::default()
             });
@@ -708,7 +708,7 @@ impl Backend {
                     {
                         Some("//".to_string())
                     } else {
-                        package_json.name
+                        package_json.name.map(|name| name.into_inner())
                     };
                     Some(
                         package_json

crates/turborepo-repository/src/package_graph/builder.rs

@@ -237,7 +237,8 @@ impl<'a, T: PackageDiscovery> BuildState<'a, ResolvedPackageManager, T> {
         let name = PackageName::Other(
             json.name
                 .clone()
-                .ok_or(Error::PackageJsonMissingName(package_json_path))?,
+                .ok_or(Error::PackageJsonMissingName(package_json_path))?
+                .into_inner(),
         );
         let entry = PackageInfo {
             package_json: json,
@@ -590,6 +591,8 @@ impl PackageInfo {
 mod test {
     use std::assert_matches::assert_matches;
 
+    use turborepo_errors::Spanned;
+
     use super::*;
 
     struct MockDiscovery;
@@ -617,7 +620,7 @@ mod test {
         let builder = PackageGraphBuilder::new(
             &root,
             PackageJson {
-                name: Some("root".into()),
+                name: Some(Spanned::new("root".into())),
                 ..Default::default()
             },
         )
@@ -627,14 +630,14 @@ mod test {
             map.insert(
                 root.join_component("a"),
                 PackageJson {
-                    name: Some("foo".into()),
+                    name: Some(Spanned::new("foo".into())),
                     ..Default::default()
                 },
             );
             map.insert(
                 root.join_component("b"),
                 PackageJson {
-                    name: Some("foo".into()),
+                    name: Some(Spanned::new("foo".into())),
                     ..Default::default()
                 },
             );

crates/turborepo-repository/src/package_graph/mod.rs

@@ -70,7 +70,10 @@ pub struct PackageInfo {
 
 impl PackageInfo {
     pub fn package_name(&self) -> Option<String> {
-        self.package_json.name.clone()
+        self.package_json
+            .name
+            .as_ref()
+            .map(|name| name.as_inner().clone())
     }
 
     pub fn package_json_path(&self) -> &AnchoredSystemPath {
@@ -156,7 +159,7 @@ impl PackageGraph {
             if matches!(package_name, PackageName::Root) {
                 continue;
             }
-            let name = info.package_json.name.as_deref();
+            let name = info.package_json.name.as_ref().map(|name| name.as_str());
             match name {
                 Some("") | None => {
                     let package_json_path = self.repo_root.resolve(info.package_json_path());
@@ -620,6 +623,7 @@ mod test {
     use std::assert_matches::assert_matches;
 
     use serde_json::json;
+    use turborepo_errors::Spanned;
 
     use super::*;
     use crate::discovery::PackageDiscovery;
@@ -649,7 +653,7 @@ mod test {
         let pkg_graph = PackageGraph::builder(
             &root,
             PackageJson {
-                name: Some("my-package".to_owned()),
+                name: Some(Spanned::new("my-package".to_owned())),
                 ..Default::default()
             },
         )