feat(move): Move view functions (compiler implementation) - Linter Warning (#11444)

# Description of change

Linter warning implementation

This change gates the Iota view-function suggestion lint behind
`--lint`.

`ViewFunctionVisitor` is no longer included in the default Iota linter
set, so normal builds do not emit warnings for functions that could be
annotated with` #[view]`. The visitor now only runs at `LintLevel::All`,
which is enabled through the existing `--lint` flag.

## Links to any relevant issues
fixes #11413

---------

Co-authored-by: BigB <51323441+bingyanglin@users.noreply.github.com>

Author: lollobene

external-crates/move/crates/move-compiler/src/iota_mode/linters/mod.rs

@@ -25,6 +25,7 @@ pub mod public_mut_tx_context;
 pub mod public_random;
 pub mod self_transfer;
 pub mod share_owned;
+pub mod view_function;
 
 pub const TRANSFER_MOD_NAME: &str = "transfer";
 pub const TRANSFER_FUN: &str = "transfer";
@@ -73,6 +74,7 @@ pub const PUBLIC_RANDOM_FILTER_NAME: &str = "public_random";
 pub const MISSING_KEY_FILTER_NAME: &str = "missing_key";
 pub const FREEZING_CAPABILITY_FILTER_NAME: &str = "freezing_capability";
 pub const PREFER_MUTABLE_TX_CONTEXT_FILTER_NAME: &str = "prefer_mut_tx_context";
+pub const VIEW_FUNCTION_FILTER_NAME: &str = "view_function";
 
 pub const RANDOM_MOD_NAME: &str = "random";
 pub const RANDOM_STRUCT_NAME: &str = "Random";
@@ -92,6 +94,7 @@ pub enum LinterDiagnosticCode {
     MissingKey,
     FreezingCapability,
     PreferMutableTxContext,
+    ViewFunction,
 }
 
 pub fn known_filters() -> (Option<Symbol>, Vec<WarningFilter>) {
@@ -157,6 +160,12 @@ pub fn known_filters() -> (Option<Symbol>, Vec<WarningFilter>) {
             LinterDiagnosticCode::PreferMutableTxContext as u8,
             Some(PREFER_MUTABLE_TX_CONTEXT_FILTER_NAME),
         ),
+        WarningFilter::code(
+            Some(LINT_WARNING_PREFIX),
+            LinterDiagnosticCategory::Iota as u8,
+            LinterDiagnosticCode::ViewFunction as u8,
+            Some(VIEW_FUNCTION_FILTER_NAME),
+        ),
     ];
 
     (Some(ALLOW_ATTR_CATEGORY.into()), filters)
@@ -178,6 +187,7 @@ pub fn linter_visitors(level: LintLevel) -> Vec<Visitor> {
         LintLevel::All => {
             let mut visitors = linter_visitors(LintLevel::Default);
             visitors.extend([
+                view_function::ViewFunctionVisitor.visitor(),
                 freezing_capability::WarnFreezeCapability.visitor(),
                 public_mut_tx_context::PreferMutableTxContext.visitor(),
             ]);

external-crates/move/crates/move-compiler/src/iota_mode/linters/view_function.rs

@@ -0,0 +1,56 @@
+// Copyright (c) 2026 IOTA Stiftung
+// SPDX-License-Identifier: Apache-2.0
+
+//! Warns when a function satisfies view constraints but is not annotated with
+//! `#[view]`.
+
+use super::{LINT_WARNING_PREFIX, LinterDiagnosticCategory, LinterDiagnosticCode};
+use crate::{
+    diag,
+    diagnostics::codes::{DiagnosticInfo, Severity, custom},
+    expansion::ast::ModuleIdent,
+    iota_mode::{known_attributes::view::ViewAttribute, typing::is_valid_view_signature},
+    parser::ast::FunctionName,
+    shared::Identifier,
+    typing::{ast as T, visitor::simple_visitor},
+};
+
+const VIEW_FUNCTION_DIAG: DiagnosticInfo = custom(
+    LINT_WARNING_PREFIX,
+    Severity::Warning,
+    LinterDiagnosticCategory::Iota as u8,
+    LinterDiagnosticCode::ViewFunction as u8,
+    "function can be marked '#[view]'",
+);
+
+simple_visitor!(
+    ViewFunctionVisitor,
+    fn visit_function_custom(
+        &mut self,
+        _module: ModuleIdent,
+        fname: FunctionName,
+        fdef: &T::Function,
+    ) -> bool {
+        if fdef.attributes.is_test_or_test_only() {
+            return false;
+        }
+
+        if fdef.attributes.get_(&ViewAttribute.into()).is_some() {
+            return false;
+        }
+
+        if !is_valid_view_signature(&fdef.visibility, &fdef.signature) {
+            return false;
+        }
+
+        let msg = format!(
+            "Function '{}' satisfies view constraints and can be annotated with '#[view]'",
+            fname
+        );
+        let mut d = diag!(VIEW_FUNCTION_DIAG, (fname.loc(), msg));
+        d.add_note("Add '#[view]' to make the function explicitly callable as a view function.");
+        self.add_diag(d);
+
+        true
+    }
+);

external-crates/move/crates/move-compiler/src/iota_mode/typing.rs

@@ -622,6 +622,23 @@ fn view_signature(
     view_return_ty(context, view_loc, name, return_type);
 }
 
+pub(crate) fn is_valid_view_signature(
+    visibility: &Visibility,
+    signature: &FunctionSignature,
+) -> bool {
+    let FunctionSignature {
+        type_parameters: _,
+        parameters,
+        return_type,
+    } = signature;
+
+    is_valid_view_visibility(visibility)
+        && is_valid_view_return_ty(return_type)
+        && parameters
+            .iter()
+            .all(|(mutability, _, param_ty)| is_valid_view_param_ty(mutability, param_ty))
+}
+
 fn is_valid_view_visibility(visibility: &Visibility) -> bool {
     matches!(visibility, Visibility::Public(_))
 }
@@ -683,6 +700,12 @@ fn view_return_ty(context: &mut Context, view_loc: Loc, name: FunctionName, retu
     }
 }
 
+fn is_valid_view_return_ty(return_type: &Type) -> bool {
+    !matches!(return_type.value, Type_::Unit)
+        && !contains_reference_ty(return_type)
+        && !contains_view_unsafe_by_value_ty(return_type)
+}
+
 /// A valid view param type is
 /// - A primitive (including strings and non-object structs)
 /// - A vector of primitives (including nested vectors)
@@ -742,6 +765,12 @@ fn view_param_ty(
     }
 }
 
+fn is_valid_view_param_ty(mutability: &Mutability, param_ty: &Type) -> bool {
+    !matches!(mutability, Mutability::Mut(_))
+        && !contains_mutable_reference_ty(param_ty)
+        && !contains_view_unsafe_by_value_ty(param_ty)
+}
+
 fn contains_reference_ty(ty: &Type) -> bool {
     contains_reference_ty_where(ty, |_| true)
 }

external-crates/move/crates/move-compiler/tests/iota_mode/linter/collection_equality.snap

@@ -5,6 +5,15 @@ info:
   edition: legacy
   lint: true
 ---
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:17:16
+   │
+17 │     public fun bag_eq(bag1: &Bag, bag2: &Bag): bool {
+   │                ^^^^^^ Function 'bag_eq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:18:14
    │
@@ -14,6 +23,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::bag::Bag' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:21:16
+   │
+21 │     public fun obj_bag_neq(bag1: &ObjectBag, bag2: &ObjectBag): bool {
+   │                ^^^^^^^^^^^ Function 'obj_bag_neq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:22:14
    │
@@ -23,6 +41,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::object_bag::ObjectBag' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:25:16
+   │
+25 │     public fun table_eq(table1: &Table<u64, u64>, table2: &Table<u64, u64>): bool {
+   │                ^^^^^^^^ Function 'table_eq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:26:16
    │
@@ -32,6 +59,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::table::Table' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:29:16
+   │
+29 │     public fun obj_table_eq<K: copy + drop + store, V: key + store>(
+   │                ^^^^^^^^^^^^ Function 'obj_table_eq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:33:20
    │
@@ -41,6 +77,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::object_table::ObjectTable' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:36:16
+   │
+36 │     public fun linked_table_neq(table1: &LinkedTable<u64, u64>, table2: &LinkedTable<u64, u64>): bool {
+   │                ^^^^^^^^^^^^^^^^ Function 'linked_table_neq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:37:16
    │
@@ -50,6 +95,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::linked_table::LinkedTable' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:40:16
+   │
+40 │     public fun table_vec_eq(table1: &TableVec<u64>, table2: &TableVec<u64>): bool {
+   │                ^^^^^^^^^^^^ Function 'table_vec_eq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:41:16
    │
@@ -59,6 +113,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::table_vec::TableVec' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:44:16
+   │
+44 │     public fun vec_map_eq(vec1: &VecMap<u64, u64>, vec2: &VecMap<u64, u64>): bool {
+   │                ^^^^^^^^^^ Function 'vec_map_eq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:45:14
    │
@@ -68,6 +131,15 @@ warning[Lint W99005]: possibly useless collections compare
    = Equality for collections of type 'iota::vec_map::VecMap' IS NOT a structural check based on content
    = This warning can be suppressed with '#[allow(lint(collection_equality))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
 
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/collection_equality.move:48:16
+   │
+48 │     public fun vec_set_eq(vec1: &VecSet<u64>, vec2: &VecSet<u64>): bool {
+   │                ^^^^^^^^^^ Function 'vec_set_eq' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
 warning[Lint W99005]: possibly useless collections compare
    ┌─ tests/iota_mode/linter/collection_equality.move:49:14
    │

external-crates/move/crates/move-compiler/tests/iota_mode/linter/custom_state_change.snap

@@ -43,3 +43,12 @@ warning[Lint W99002]: potentially unenforceable custom transfer/share/freeze pol
    │
    = A custom freeze policy for a given type is implemented through calling the private 'freeze_object' function variant in the module defining this type
    = This warning can be suppressed with '#[allow(lint(custom_state_change))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/custom_state_change.move:42:16
+   │
+42 │     public fun sender(_: &TxContext): address {
+   │                ^^^^^^ Function 'sender' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')

external-crates/move/crates/move-compiler/tests/iota_mode/linter/false_positive_share_owned.snap

@@ -38,3 +38,12 @@ warning[Lint W99000]: possible owned object share
    │         Potential abort from a (potentially) owned object created by a different transaction.
    │
    = This warning can be suppressed with '#[allow(lint(share_owned))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/false_positive_share_owned.move:48:16
+   │
+48 │     public fun sender(_: &TxContext): address {
+   │                ^^^^^^ Function 'sender' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')

external-crates/move/crates/move-compiler/tests/iota_mode/linter/self_transfer.snap

@@ -43,3 +43,12 @@ warning[Lint W99001]: non-composable transfer to sender
    │         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Transfer of an object to transaction sender address
    │
    = This warning can be suppressed with '#[allow(lint(self_transfer))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/self_transfer.move:72:16
+   │
+72 │     public fun sender(_: &TxContext): address {
+   │                ^^^^^^ Function 'sender' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')

external-crates/move/crates/move-compiler/tests/iota_mode/linter/true_negative_share_owned.snap

@@ -5,4 +5,11 @@ info:
   edition: legacy
   lint: true
 ---
-
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/true_negative_share_owned.move:79:16
+   │
+79 │     public fun sender(_: &TxContext): address {
+   │                ^^^^^^ Function 'sender' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')

external-crates/move/crates/move-compiler/tests/iota_mode/linter/true_positive_share_owned.snap

@@ -38,3 +38,12 @@ warning[Lint W99000]: possible owned object share
    │         Potential abort from a (potentially) owned object created by a different transaction.
    │
    = This warning can be suppressed with '#[allow(lint(share_owned))]' applied to the 'module' or module member ('const', 'fun', or 'struct')
+
+warning[Lint W99010]: function can be marked '#[view]'
+   ┌─ tests/iota_mode/linter/true_positive_share_owned.move:48:16
+   │
+48 │     public fun sender(_: &TxContext): address {
+   │                ^^^^^^ Function 'sender' satisfies view constraints and can be annotated with '#[view]'
+   │
+   = Add '#[view]' to make the function explicitly callable as a view function.
+   = This warning can be suppressed with '#[allow(lint(view_function))]' applied to the 'module' or module member ('const', 'fun', or 'struct')