@cmssy/eslint-plugin 12.13.0 → 12.14.1

package/dist/index.cjs

@@ -96,6 +96,11 @@ var editRouteProviderParity = {
 };
 var SERVER_MODULES = [/^@cmssy\/next\/server$/];
 var SERVER_SYMBOLS = /* @__PURE__ */ new Set(["defineCmssyConfig"]);
+var SERVER_ENV_NAME = "CMSSY_[A-Z0-9_]+";
+var SERVER_ENV = new RegExp(`^${SERVER_ENV_NAME}$`);
+var SERVER_ENV_READ = new RegExp(
+  `\\bprocess\\s*\\.\\s*env\\s*(?:\\.\\s*${SERVER_ENV_NAME}|\\[\\s*["'\`]${SERVER_ENV_NAME}["'\`]\\s*\\])`
+);
 var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
 var aliasCache = /* @__PURE__ */ new Map();
 function stripJsonComments(text) {
@@ -223,7 +228,25 @@ function valueImports(code) {
     ...withoutTypes.matchAll(/(?:from|import)\s*["']([^"']+)["']/g)
   ].map(([, specifier]) => specifier ?? "");
 }
+function readsServerEnv(code) {
+  return SERVER_ENV_READ.test(code);
+}
+function serverEnvName(node) {
+  const member = node;
+  const env = member.object;
+  if (env?.type !== "MemberExpression" || env.computed) return null;
+  if (env.object?.type !== "Identifier" || env.object.name !== "process") {
+    return null;
+  }
+  if (env.property?.type !== "Identifier" || env.property.name !== "env") {
+    return null;
+  }
+  const property = member.property;
+  const name = member.computed ? typeof property?.value === "string" ? property.value : null : property?.type === "Identifier" ? property.name ?? null : null;
+  return name && SERVER_ENV.test(name) ? name : null;
+}
 function importsServerConfig(code) {
+  if (readsServerEnv(code)) return true;
   if (SERVER_MODULES.some(
     (pattern) => valueImports(code).some((s) => pattern.test(s))
   )) {
@@ -290,7 +313,7 @@ var noServerConfigInClient = {
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow a client component from importing values that read the cmssy server config"
+      description: "Disallow a client component from importing values that read the cmssy server config, or reading a CMSSY_* variable itself"
     },
     schema: [
       {
@@ -305,8 +328,9 @@ var noServerConfigInClient = {
       }
     ],
     messages: {
-      reachesConfig: 'This client component pulls the cmssy config into the browser bundle, where server env does not exist - the page will fail at runtime with "missing required configuration".\n  {{chain}}\nImport the type instead (types are erased), or move the value into a module that does not touch the config.',
-      reachesConfigFromEntry: "This module is loaded in the browser, so it pulls the cmssy config there, where server env does not exist.\n  {{chain}}\nImport the type instead (types are erased), or load the value with a dynamic import inside the function that needs it."
+      reachesConfig: 'This client component pulls the cmssy config into the browser bundle, where server env does not exist - the page fails at runtime with "missing required configuration", or reads whatever the config falls back to, which is usually "".\n  {{chain}}\nImport the type instead (types are erased), or move the value into a module that does not touch the config.',
+      reachesConfigFromEntry: "This module is loaded in the browser, so it pulls the cmssy config there, where server env does not exist.\n  {{chain}}\nImport the type instead (types are erased), or load the value with a dynamic import inside the function that needs it.",
+      readsServerEnv: "{{name}} is read here and this module runs in the browser, where it is undefined - the bundler only inlines NEXT_PUBLIC_* names, and a draft secret must never be one.\nRead it in a server component and pass the value down as a prop."
     }
   },
   create(context) {
@@ -318,6 +342,11 @@ var noServerConfigInClient = {
     if (!client && !entry) return {};
     const messageId = client ? "reachesConfig" : "reachesConfigFromEntry";
     return {
+      MemberExpression(node) {
+        const name = serverEnvName(node);
+        if (!name) return;
+        context.report({ node, messageId: "readsServerEnv", data: { name } });
+      },
       ImportDeclaration(node) {
         const typed = node;
         const onlyTypes = typed.importKind === "type" || node.specifiers.length > 0 && node.specifiers.every(

package/dist/index.js

@@ -88,6 +88,11 @@ var editRouteProviderParity = {
 };
 var SERVER_MODULES = [/^@cmssy\/next\/server$/];
 var SERVER_SYMBOLS = /* @__PURE__ */ new Set(["defineCmssyConfig"]);
+var SERVER_ENV_NAME = "CMSSY_[A-Z0-9_]+";
+var SERVER_ENV = new RegExp(`^${SERVER_ENV_NAME}$`);
+var SERVER_ENV_READ = new RegExp(
+  `\\bprocess\\s*\\.\\s*env\\s*(?:\\.\\s*${SERVER_ENV_NAME}|\\[\\s*["'\`]${SERVER_ENV_NAME}["'\`]\\s*\\])`
+);
 var EXTENSIONS = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs"];
 var aliasCache = /* @__PURE__ */ new Map();
 function stripJsonComments(text) {
@@ -215,7 +220,25 @@ function valueImports(code) {
     ...withoutTypes.matchAll(/(?:from|import)\s*["']([^"']+)["']/g)
   ].map(([, specifier]) => specifier ?? "");
 }
+function readsServerEnv(code) {
+  return SERVER_ENV_READ.test(code);
+}
+function serverEnvName(node) {
+  const member = node;
+  const env = member.object;
+  if (env?.type !== "MemberExpression" || env.computed) return null;
+  if (env.object?.type !== "Identifier" || env.object.name !== "process") {
+    return null;
+  }
+  if (env.property?.type !== "Identifier" || env.property.name !== "env") {
+    return null;
+  }
+  const property = member.property;
+  const name = member.computed ? typeof property?.value === "string" ? property.value : null : property?.type === "Identifier" ? property.name ?? null : null;
+  return name && SERVER_ENV.test(name) ? name : null;
+}
 function importsServerConfig(code) {
+  if (readsServerEnv(code)) return true;
   if (SERVER_MODULES.some(
     (pattern) => valueImports(code).some((s) => pattern.test(s))
   )) {
@@ -282,7 +305,7 @@ var noServerConfigInClient = {
   meta: {
     type: "problem",
     docs: {
-      description: "Disallow a client component from importing values that read the cmssy server config"
+      description: "Disallow a client component from importing values that read the cmssy server config, or reading a CMSSY_* variable itself"
     },
     schema: [
       {
@@ -297,8 +320,9 @@ var noServerConfigInClient = {
       }
     ],
     messages: {
-      reachesConfig: 'This client component pulls the cmssy config into the browser bundle, where server env does not exist - the page will fail at runtime with "missing required configuration".\n  {{chain}}\nImport the type instead (types are erased), or move the value into a module that does not touch the config.',
-      reachesConfigFromEntry: "This module is loaded in the browser, so it pulls the cmssy config there, where server env does not exist.\n  {{chain}}\nImport the type instead (types are erased), or load the value with a dynamic import inside the function that needs it."
+      reachesConfig: 'This client component pulls the cmssy config into the browser bundle, where server env does not exist - the page fails at runtime with "missing required configuration", or reads whatever the config falls back to, which is usually "".\n  {{chain}}\nImport the type instead (types are erased), or move the value into a module that does not touch the config.',
+      reachesConfigFromEntry: "This module is loaded in the browser, so it pulls the cmssy config there, where server env does not exist.\n  {{chain}}\nImport the type instead (types are erased), or load the value with a dynamic import inside the function that needs it.",
+      readsServerEnv: "{{name}} is read here and this module runs in the browser, where it is undefined - the bundler only inlines NEXT_PUBLIC_* names, and a draft secret must never be one.\nRead it in a server component and pass the value down as a prop."
     }
   },
   create(context) {
@@ -310,6 +334,11 @@ var noServerConfigInClient = {
     if (!client && !entry) return {};
     const messageId = client ? "reachesConfig" : "reachesConfigFromEntry";
     return {
+      MemberExpression(node) {
+        const name = serverEnvName(node);
+        if (!name) return;
+        context.report({ node, messageId: "readsServerEnv", data: { name } });
+      },
       ImportDeclaration(node) {
         const typed = node;
         const onlyTypes = typed.importKind === "type" || node.specifiers.length > 0 && node.specifiers.every(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmssy/eslint-plugin",
-  "version": "12.13.0",
+  "version": "12.14.1",
   "description": "Catches the cmssy wiring mistakes that a build cannot: server config dragged into a client bundle, a provider the editor route never gets.",
   "keywords": [
     "cmssy",