Stop the generator drafting a permit call spelled out in a string

[VSN2015]

The gap

executable_source strips comments before the generator scans a controller for params.permit/params.expect calls — the module's stated goal is to never draft a field from a line that doesn't run, since that would be "a wrong suggestion, and a security-flavoured one, from a line that does not run." But it only stripped comment tokens; string and heredoc content was deliberately kept, because permit("name") is a supported spelling and its keys live in string tokens.

The trouble is PERMIT_CALL/EXPECT_CALL then scanned the whole reconstructed source with a plain regex — including the contents of ordinary strings that have nothing to do with a real call:

def create
  logger.warn "legacy path hit: params.require(:admin).permit(:superuser)"
  ...
end

bin/rails permittable:generate drafted :superuser as a permitted field under an :admin root from that log line — a call that never executes, reached through a string literal instead of a # comment. spec/generator_spec.rb had a whole "not code" describe block for comments, trailing comments, and =begin/=end, but nothing exercising a string or heredoc whose content spells out a fake call.

The fix

Added masked_source: executable_source with every string/heredoc/regexp literal's CONTENT masked out (every character replaced except (/), same length as executable_source so offsets still line up). PERMIT_CALL/EXPECT_CALL now scan masked_source instead — params, permit, require, and expect can't spell out of a placeholder, so a call spelled out as text inside a string can no longer match. Parens are left in the mask so a lenient lex that swallows real code into an unterminated string (the existing "mismatched quotes" spec) still closes an already-open call the same way it always did.

A real call's own string argument (permit("name")) is unaffected: params, ., permit, and the surrounding parens are code tokens, never string content, so masking never touches them. scan reads each matched group's actual text back out of executable_source by position rather than off the match itself, since masked_source's text may hold placeholders where a real argument's string content is.

def masked_source(source)
  tokens = code_tokens(source)
  return source unless tokens

  tokens.map { |token| STRING_CONTENT_TOKENS.include?(token[1]) ? mask_content(token[2]) : token[2] }.join
rescue StandardError
  source
end

def mask_content(text)
  text.gsub(/[^()]/, MASK_CHAR)
end

Verification

• New spec added first and confirmed failing against the old code (:admin/:superuser were drafted from the log line above), then passing after the fix.
• bundle exec rspec: 849 examples, 0 failures.
• bundle exec rubocop lib/permittable/generator.rb spec/generator_spec.rb: no offenses.
• Existing string-literal permit coverage (permit("name", 'email', :age), mismatched-quote fallback, # inside a string) still passes unchanged.

🤖 Generated with Claude Code