@gitlab/eslint-plugin 21.2.1 → 21.3.0

package/docs/rules/no-hardcoded-urls.md

@@ -0,0 +1,27 @@
+# @gitlab/no-hardcoded-urls
+
+We should not hardcode or construct URLs on the frontend. See https://docs.gitlab.com/development/urls_in_gitlab/ for more information.
+
+## Options
+
+```json
+{
+  "@gitlab/vue-no-hardcoded-urls": [
+    "error",
+    {
+      "allowedKeys": ["path", "redirect"],
+      "allowedFunctions": ["helpPagePath"],
+      "allowedInterpolationVariables": [
+        "FORUM_URL",
+        "DOCS_URL",
+        "PROMO_URL",
+        "CONTRIBUTE_URL",
+        "DOCS_URL_IN_EE_DIR",
+        "CUSTOMERS_PORTAL_URL"
+      ],
+      "allowedPatterns": ["\\/api\\/:version"],
+      "disallowedObjectProperties": ["relative_url_root"]
+    }
+  ]
+}
+```

package/docs/rules/vue-no-hardcoded-urls.md

@@ -0,0 +1,30 @@
+# @gitlab/vue-no-hardcoded-urls
+
+We should not hardcode or construct URLs on the frontend. See https://docs.gitlab.com/development/urls_in_gitlab/ for more information.
+
+## Options
+
+Nothing
+
+```json
+{
+  "@gitlab/vue-no-hardcoded-urls": [
+    "error",
+    {
+      "allowedVueComponents": ["help-page-link"],
+      "allowedKeys": ["path", "redirect"],
+      "allowedFunctions": ["helpPagePath"],
+      "allowedInterpolationVariables": [
+        "FORUM_URL",
+        "DOCS_URL",
+        "PROMO_URL",
+        "CONTRIBUTE_URL",
+        "DOCS_URL_IN_EE_DIR",
+        "CUSTOMERS_PORTAL_URL"
+      ],
+      "allowedPatterns": ["\\/api\\/:version"],
+      "disallowedObjectProperties": ["relative_url_root"]
+    }
+  ]
+}
+```

package/docs/rules.md

@@ -5,6 +5,7 @@
 Available rules:
 
 - [no-global-event-off](./rules/no-global-event-off.md): Throw an error when globally deregistering all event listeners.
+- [no-hardcoded-urls](./rules/no-hardcoded-urls.md): Disallow hardcoded URLs
 - [no-runtime-template-compiler](./rules/no-runtime-template-compiler.md): Disallow components which rely on a runtime template compiler.
 - [require-i18n-strings](./rules/require-i18n-strings.md): Detect a string which has been hard coded and requires externalization.
 - [require-valid-i18n-helpers](./rules/require-valid-i18n-helpers.md): Enforces valid usage of translation helpers in JavaScript.
@@ -13,6 +14,7 @@ Available rules:
 - [vtu-no-explicit-wrapper-destroy](./rules/vtu-no-explicit-wrapper-destroy.md): Prevents redundant destroy calls and null asignment
 - [vtu-no-wrapper-vm](./rules/vtu-no-wrapper-vm.md): Prevent direct access to `vm` internals for `@vue/test-utils` wrappers.
 - [vue-no-data-toggle](./rules/vue-no-data-toggle.md): Restrict the use of `data-toggle` bootstrap behaviors within Vue templates
+- [vue-no-hardcoded-urls](./rules/vue-no-hardcoded-urls.md): Disallow hardcoded URLs in Vue templates
 - [vue-no-new-non-primitive-in-template](./rules/vue-no-new-non-primitive-in-template.md): Prevents non-primitive values from being declared in templates
 - [vue-no-undef-apollo-properties](./rules/vue-no-undef-apollo-properties.md): Require Apollo query properties to be initialized in component data.
 - [vue-prefer-dollar-scopedslots](./rules/vue-prefer-dollar-scopedslots.md): Prefer $scopedSlots over $slots for Vue 2.x.

package/lefthook.yml

@@ -1,7 +1,9 @@
 pre-commit:
   piped: true
+  fail_on_changes: always
   commands:
     update:
       run: yarn run update
     prettier:
-      run: yarn run pretty-quick --staged
+      glob: '*.{js,mjs,json,yml,md}'
+      run: yarn prettier --write {staged_files}

package/lib/index.js

@@ -4,6 +4,7 @@
 module.exports = {
   rules: {
     'no-global-event-off': require('./rules/no-global-event-off.js'),
+    'no-hardcoded-urls': require('./rules/no-hardcoded-urls.js'),
     'no-runtime-template-compiler': require('./rules/no-runtime-template-compiler.js'),
     'require-i18n-strings': require('./rules/require-i18n-strings.js'),
     'require-valid-i18n-helpers': require('./rules/require-valid-i18n-helpers.js'),
@@ -12,6 +13,7 @@ module.exports = {
     'vtu-no-explicit-wrapper-destroy': require('./rules/vtu-no-explicit-wrapper-destroy.js'),
     'vtu-no-wrapper-vm': require('./rules/vtu-no-wrapper-vm.js'),
     'vue-no-data-toggle': require('./rules/vue-no-data-toggle.js'),
+    'vue-no-hardcoded-urls': require('./rules/vue-no-hardcoded-urls.js'),
     'vue-no-new-non-primitive-in-template': require('./rules/vue-no-new-non-primitive-in-template.js'),
     'vue-no-undef-apollo-properties': require('./rules/vue-no-undef-apollo-properties.js'),
     'vue-prefer-dollar-scopedslots': require('./rules/vue-prefer-dollar-scopedslots.js'),
@@ -25,6 +27,14 @@ module.exports = {
   },
   configs: {
     base: require('./configs/base.js'),
+    'best-practices': require('./configs/base/best-practices.js'),
+    errors: require('./configs/base/errors.js'),
+    es6: require('./configs/base/es6.js'),
+    imports: require('./configs/base/imports.js'),
+    node: require('./configs/base/node.js'),
+    strict: require('./configs/base/strict.js'),
+    style: require('./configs/base/style.js'),
+    variables: require('./configs/base/variables.js'),
     default: require('./configs/default.js'),
     i18n: require('./configs/i18n.js'),
     jest: require('./configs/jest.js'),

package/lib/rules/no-hardcoded-urls.js

@@ -0,0 +1,71 @@
+// ------------------------------------------------------------------------------
+// Requirements
+// ------------------------------------------------------------------------------
+const { DOCS_BASE_URL } = require('../constants');
+const {
+  literalValidator,
+  templateLiteralValidator,
+  memberExpressionValidator,
+} = require('../utils/hardcoded-urls');
+
+// ------------------------------------------------------------------------------
+// Rule Definition
+// ------------------------------------------------------------------------------
+
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Disallow hardcoded URLs',
+      category: 'maintainability',
+      url: DOCS_BASE_URL + '/no-hardcoded-urls.md',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowedKeys: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedFunctions: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedInterpolationVariables: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedPatterns: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          disallowedObjectProperties: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+
+  create(context) {
+    return {
+      Literal(node) {
+        literalValidator(context, node);
+      },
+      TemplateLiteral(node) {
+        templateLiteralValidator(context, node);
+      },
+      MemberExpression(node) {
+        memberExpressionValidator(context, node);
+      },
+    };
+  },
+};

package/lib/rules/vue-no-hardcoded-urls.js

@@ -0,0 +1,77 @@
+// ------------------------------------------------------------------------------
+// Requirements
+// ------------------------------------------------------------------------------
+const { DOCS_BASE_URL } = require('../constants');
+const { defineTemplateBodyVisitor } = require('../utils/index');
+const {
+  literalValidator,
+  templateLiteralValidator,
+  memberExpressionValidator,
+} = require('../utils/hardcoded-urls');
+
+// ------------------------------------------------------------------------------
+// Rule Definition
+// ------------------------------------------------------------------------------
+
+module.exports = {
+  meta: {
+    type: 'error',
+    docs: {
+      description: 'Disallow hardcoded URLs in Vue templates',
+      category: 'maintainability',
+      url: DOCS_BASE_URL + '/vue-no-hardcoded-urls.md',
+    },
+    schema: [
+      {
+        type: 'object',
+        properties: {
+          allowedVueComponents: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedKeys: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedFunctions: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedInterpolationVariables: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          allowedPatterns: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+          disallowedObjectProperties: {
+            type: 'array',
+            items: { type: 'string' },
+            default: [],
+          },
+        },
+        additionalProperties: false,
+      },
+    ],
+  },
+
+  create(context) {
+    return defineTemplateBodyVisitor(context, {
+      VLiteral(node) {
+        literalValidator(context, node);
+      },
+      TemplateLiteral(node) {
+        templateLiteralValidator(context, node);
+      },
+      MemberExpression(node) {
+        memberExpressionValidator(context, node);
+      },
+    });
+  },
+};

package/lib/utils/hardcoded-urls.js

@@ -0,0 +1,127 @@
+const ERROR_MESSAGE =
+  'Avoid hardcoded URLs. See https://docs.gitlab.com/development/urls_in_gitlab/.';
+
+function traverse(node, type) {
+  if (node.type === type) {
+    return node;
+  }
+
+  if (!node.parent) {
+    return node;
+  }
+
+  return traverse(node.parent, type);
+}
+
+function literalValidator(context, node) {
+  if (isAllowedNode(context, node)) {
+    return;
+  }
+
+  if (isHardCodedUrl(context, node.value)) {
+    context.report({
+      node,
+      message: ERROR_MESSAGE,
+    });
+  }
+}
+
+function templateLiteralValidator(context, node) {
+  if (isAllowedNode(context, node)) {
+    return;
+  }
+
+  if (isConstructedUrl(context, node)) {
+    context.report({
+      node,
+      message: ERROR_MESSAGE,
+    });
+  }
+}
+
+function memberExpressionValidator(context, node) {
+  const { disallowedObjectProperties = [] } = context.options[0] || {};
+
+  if (disallowedObjectProperties.includes(node.property?.name)) {
+    context.report({
+      node,
+      message: ERROR_MESSAGE,
+    });
+  }
+}
+
+function isAllowedNode(context, node) {
+  const { parent } = node;
+  const {
+    allowedKeys = [],
+    allowedFunctions = [],
+    allowedVueComponents = [],
+  } = context.options[0] || {};
+
+  if (
+    parent?.type === 'Property' &&
+    parent?.key?.type === 'Identifier' &&
+    allowedKeys.includes(parent?.key?.name)
+  ) {
+    return true;
+  }
+
+  if (
+    parent?.type === 'CallExpression' &&
+    parent?.callee?.type === 'Identifier' &&
+    allowedFunctions.includes(parent?.callee?.name)
+  ) {
+    return true;
+  }
+
+  const vElement = traverse(node, 'VElement');
+  if (vElement && allowedVueComponents.includes(vElement.name)) {
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Check if a string looks like a hardcoded URL path
+ */
+function isHardCodedUrl(context, value) {
+  if (typeof value !== 'string') return false;
+
+  const { allowedPatterns = [] } = context.options[0] || {};
+
+  if (allowedPatterns.some((pattern) => new RegExp(pattern).test(value))) {
+    return false;
+  }
+
+  // Check for path-like patterns:
+  // Starts with / followed by word characters
+  const urlPathPattern = /^\/(?![#?])[\/\.a-zA-Z0-9_-]+/;
+
+  return urlPathPattern.test(value);
+}
+
+/**
+ * Check if template literal looks like URL construction
+ */
+function isConstructedUrl(context, node) {
+  const { allowedInterpolationVariables = [] } = context.options[0] || {};
+
+  if (
+    node.expressions.some((expression) => allowedInterpolationVariables.includes(expression.name))
+  ) {
+    return false;
+  }
+
+  // Check if any quasi (string part) looks like a hard coded URL
+  const hasHardCodedParts = node.quasis.some((quasi) => isHardCodedUrl(context, quasi.value.raw));
+
+  return hasHardCodedParts;
+}
+
+module.exports = {
+  literalValidator,
+  templateLiteralValidator,
+  memberExpressionValidator,
+  ERROR_MESSAGE,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gitlab/eslint-plugin",
-  "version": "21.2.1",
+  "version": "21.3.0",
   "description": "GitLab package for our custom eslint rules",
   "main": "lib/index.js",
   "scripts": {
@@ -38,40 +38,18 @@
     "eslint-plugin-promise": "^7.0.0",
     "eslint-plugin-unicorn": "^55.0.0",
     "eslint-plugin-vue": "^9.27.0",
-    "vue-eslint-parser": "^9.4.3",
-    "lodash": "^4.17.21"
+    "lodash": "^4.17.21",
+    "vue-eslint-parser": "^9.4.3"
   },
   "peerDependencies": {
     "eslint": "^8.57.0 || ^9.0.0"
   },
   "devDependencies": {
+    "@changesets/cli": "^2.29.8",
     "eslint": "^8.57.0",
     "glob": "^7.2.0",
     "jest": "^27.5.1",
     "prettier": "^2.6.1",
-    "pretty-quick": "^3.1.3",
     "yarn-deduplicate": "^6.0.2"
-  },
-  "release": {
-    "branches": [
-      "main"
-    ],
-    "verifyConditions": [
-      "@semantic-release/changelog",
-      "@semantic-release/npm",
-      "@semantic-release/git",
-      "@semantic-release/gitlab"
-    ],
-    "prepare": [
-      "@semantic-release/changelog",
-      "@semantic-release/npm",
-      "@semantic-release/git"
-    ],
-    "publish": [
-      "@semantic-release/npm",
-      "@semantic-release/gitlab"
-    ],
-    "success": false,
-    "fail": false
   }
 }

package/scripts/check_lockfile_stability

@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+check_yarn_install_is_idempotent() {
+  yarn install
+  if ! git diff --exit-code yarn.lock; then
+    echo "Lock file is not stable. See above for diff." >&2
+    echo "To fix this, run the following and commit the result:" >&2
+    echo "yarn && yarn yarn-deduplicate --strategy fewer && yarn" >&2
+    exit 1
+  fi
+}
+
+# We need to sandwich yarn-deduplicate with yarn install calls.
+# This is how Renovate does it:
+# https://gitlab.com/gitlab-org/frontend/renovate-fork/-/blob/f7745bc34724f01e2d953cfb047c706d0e3f7fc4/lib/modules/manager/npm/post-update/yarn.ts#L251-254
+check_yarn_install_is_idempotent
+yarn run yarn-deduplicate --strategy fewer --list --fail
+check_yarn_install_is_idempotent

package/scripts/ensure_updated_files

@@ -0,0 +1,11 @@
+#!/bin/sh
+set -e
+
+yarn install --frozen-lockfile
+yarn run update
+if ! git diff --exit-code; then
+  echo "Files not up to date after editing rules."
+  echo "To fix this, run the following and commit the result:"
+  echo "yarn run update"
+  exit 1
+fi