@n8n/eslint-plugin-community-nodes 0.10.0 → 0.12.0

package/src/rules/index.ts

@@ -6,14 +6,19 @@ import { CredentialDocumentationUrlRule } from './credential-documentation-url.j
 import { CredentialPasswordFieldRule } from './credential-password-field.js';
 import { CredentialTestRequiredRule } from './credential-test-required.js';
 import { IconValidationRule } from './icon-validation.js';
+import { MissingPairedItemRule } from './missing-paired-item.js';
 import { NoCredentialReuseRule } from './no-credential-reuse.js';
 import { NoDeprecatedWorkflowFunctionsRule } from './no-deprecated-workflow-functions.js';
+import { NoForbiddenLifecycleScriptsRule } from './no-forbidden-lifecycle-scripts.js';
 import { NoHttpRequestWithManualAuthRule } from './no-http-request-with-manual-auth.js';
 import { NoRestrictedGlobalsRule } from './no-restricted-globals.js';
 import { NoRestrictedImportsRule } from './no-restricted-imports.js';
 import { NodeClassDescriptionIconMissingRule } from './node-class-description-icon-missing.js';
+import { NodeConnectionTypeLiteralRule } from './node-connection-type-literal.js';
 import { NodeUsableAsToolRule } from './node-usable-as-tool.js';
+import { OptionsSortedAlphabeticallyRule } from './options-sorted-alphabetically.js';
 import { PackageNameConventionRule } from './package-name-convention.js';
+import { RequireContinueOnFailRule } from './require-continue-on-fail.js';
 import { ResourceOperationPatternRule } from './resource-operation-pattern.js';
 
 export const rules = {
@@ -23,13 +28,18 @@ export const rules = {
 	'credential-password-field': CredentialPasswordFieldRule,
 	'no-deprecated-workflow-functions': NoDeprecatedWorkflowFunctionsRule,
 	'node-usable-as-tool': NodeUsableAsToolRule,
+	'options-sorted-alphabetically': OptionsSortedAlphabeticallyRule,
 	'package-name-convention': PackageNameConventionRule,
 	'credential-test-required': CredentialTestRequiredRule,
 	'no-credential-reuse': NoCredentialReuseRule,
+	'no-forbidden-lifecycle-scripts': NoForbiddenLifecycleScriptsRule,
 	'no-http-request-with-manual-auth': NoHttpRequestWithManualAuthRule,
 	'icon-validation': IconValidationRule,
 	'resource-operation-pattern': ResourceOperationPatternRule,
 	'credential-documentation-url': CredentialDocumentationUrlRule,
 	'node-class-description-icon-missing': NodeClassDescriptionIconMissingRule,
 	'cred-class-field-icon-missing': CredClassFieldIconMissingRule,
+	'node-connection-type-literal': NodeConnectionTypeLiteralRule,
+	'missing-paired-item': MissingPairedItemRule,
+	'require-continue-on-fail': RequireContinueOnFailRule,
 } satisfies Record<string, AnyRuleModule>;

package/src/rules/missing-paired-item.test.ts

@@ -0,0 +1,229 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { MissingPairedItemRule } from './missing-paired-item.js';
+
+const ruleTester = new RuleTester();
+
+ruleTester.run('missing-paired-item', MissingPairedItemRule, {
+	valid: [
+		{
+			name: 'object with json and pairedItem in execute()',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 }, pairedItem: { item: 0 } }]];
+	}
+}`,
+		},
+		{
+			name: 'object with json and pairedItem as number shorthand',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 }, pairedItem: 0 }]];
+	}
+}`,
+		},
+		{
+			name: 'non-node-type class is ignored',
+			filename: 'MyNode.node.ts',
+			code: `
+class Helper {
+	async execute() {
+		return [[{ json: { id: 1 } }]];
+	}
+}`,
+		},
+		{
+			name: 'non-.node.ts file is ignored',
+			filename: 'utils.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 } }]];
+	}
+}`,
+		},
+		{
+			name: 'object outside execute() is ignored',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async someHelper() {
+		return { json: { id: 1 } };
+	}
+}`,
+		},
+		{
+			name: 'object without json property is ignored',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const options = { url: 'https://api.example.com', method: 'GET' };
+		return [[{ json: options, pairedItem: { item: 0 } }]];
+	}
+}`,
+		},
+		{
+			name: 'object with unrecognized keys is not INodeExecutionData',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const config = { json: true, indent: 2, spaces: 4 };
+		return this.process(config);
+	}
+}`,
+		},
+		{
+			name: 'class extending Node base class with pairedItem',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode extends Node {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 }, pairedItem: { item: 0 } }]];
+	}
+}`,
+		},
+		{
+			name: 'spread element in object is allowed',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ ...baseItem, json: { id: 1 } }]];
+	}
+}`,
+		},
+		{
+			name: 'object inside constructExecutionMetaData is allowed',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const executionData = this.helpers.constructExecutionMetaData(
+			[{ json: { success: true } }],
+			{ itemData: { item: i } },
+		);
+		return [executionData];
+	}
+}`,
+		},
+		{
+			name: 'object with computed property key is not INodeExecutionData',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const obj = { json: data, [dynamicKey]: value };
+		return [[obj]];
+	}
+}`,
+		},
+	],
+	invalid: [
+		{
+			name: 'missing pairedItem in return statement',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 } }]];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }],
+		},
+		{
+			name: 'missing pairedItem in .map() callback',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const items = this.getInputData();
+		return [items.map((item, index) => ({ json: item.json }))];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }],
+		},
+		{
+			name: 'missing pairedItem in .push() call',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const returnData = [];
+		returnData.push({ json: { result: true } });
+		return [returnData];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }],
+		},
+		{
+			name: 'multiple objects missing pairedItem',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		const returnData = [];
+		returnData.push({ json: { a: 1 } });
+		returnData.push({ json: { b: 2 } });
+		return [returnData];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }, { messageId: 'missingPairedItem' }],
+		},
+		{
+			name: 'object with json and binary but no pairedItem',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 }, binary: { data: binaryData } }]];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }],
+		},
+		{
+			name: 'object with json and executionStatus but no pairedItem',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode implements INodeType {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 }, executionStatus: 'success' }]];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }],
+		},
+		{
+			name: 'class extending Node base class missing pairedItem',
+			filename: 'MyNode.node.ts',
+			code: `
+class MyNode extends Node {
+	description = {};
+	async execute() {
+		return [[{ json: { id: 1 } }]];
+	}
+}`,
+			errors: [{ messageId: 'missingPairedItem' }],
+		},
+	],
+});

package/src/rules/missing-paired-item.ts

@@ -0,0 +1,149 @@
+/**
+ * Flags object literals with a `json` property but no `pairedItem` property
+ * inside `execute()` methods of `INodeType` classes.
+ *
+ * Missing `pairedItem` breaks downstream item-referencing expressions like
+ * `$('NodeName').item`. This rule catches the three most common patterns:
+ *
+ * - Object literals in `.map()` callbacks
+ * - Object literals passed to `.push()` calls
+ * - Object literals in return statements (typically `return [[{ json }]]`)
+ *
+ * Only flags object literals directly — variable references are skipped since
+ * their shape cannot be determined without type resolution.
+ */
+
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+
+import {
+	createRule,
+	findObjectProperty,
+	isFileType,
+	isNodeTypeClass,
+	isThisHelpersMethodCall,
+} from '../utils/index.js';
+
+/**
+ * Checks whether the object is inside an array argument to
+ * `this.helpers.constructExecutionMetaData()`, which adds pairedItem
+ * via the second argument's `itemData` property.
+ */
+function isInsideConstructExecutionMetaData(node: TSESTree.ObjectExpression): boolean {
+	// Pattern: constructExecutionMetaData([{ json: ... }], { itemData: ... })
+	// Walk up: ObjectExpression -> ArrayExpression -> CallExpression
+	const parent = node.parent;
+	if (parent?.type !== AST_NODE_TYPES.ArrayExpression) return false;
+
+	const grandparent = parent.parent;
+	if (grandparent?.type !== AST_NODE_TYPES.CallExpression) return false;
+
+	// Check it's the first argument
+	if (grandparent.arguments[0] !== parent) return false;
+
+	return isThisHelpersMethodCall(grandparent, 'constructExecutionMetaData');
+}
+
+export const MissingPairedItemRule = createRule({
+	name: 'missing-paired-item',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Require pairedItem on INodeExecutionData objects in execute() methods to preserve item linking.',
+		},
+		messages: {
+			missingPairedItem:
+				'Missing pairedItem on INodeExecutionData object. Add `pairedItem: { item: index }` to preserve item linking. See https://docs.n8n.io/integrations/creating-nodes/build/reference/paired-items/',
+		},
+		schema: [],
+		hasSuggestions: false,
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!isFileType(context.filename, '.node.ts')) {
+			return {};
+		}
+
+		let inNodeTypeClass = false;
+		let inExecuteMethod = false;
+
+		return {
+			ClassDeclaration(node) {
+				if (isNodeTypeClass(node)) {
+					inNodeTypeClass = true;
+				}
+			},
+
+			'ClassDeclaration:exit'() {
+				inNodeTypeClass = false;
+				inExecuteMethod = false;
+			},
+
+			MethodDefinition(node: TSESTree.MethodDefinition) {
+				if (
+					inNodeTypeClass &&
+					node.key.type === AST_NODE_TYPES.Identifier &&
+					node.key.name === 'execute'
+				) {
+					inExecuteMethod = true;
+				}
+			},
+
+			'MethodDefinition:exit'(node: TSESTree.MethodDefinition) {
+				if (
+					inExecuteMethod &&
+					node.key.type === AST_NODE_TYPES.Identifier &&
+					node.key.name === 'execute'
+				) {
+					inExecuteMethod = false;
+				}
+			},
+
+			ObjectExpression(node: TSESTree.ObjectExpression) {
+				if (!inExecuteMethod) return;
+
+				const hasJson = findObjectProperty(node, 'json') !== null;
+				if (!hasJson) return;
+
+				const hasPairedItem = findObjectProperty(node, 'pairedItem') !== null;
+				if (hasPairedItem) return;
+
+				// Skip if inside constructExecutionMetaData() — it adds pairedItem via itemData
+				if (isInsideConstructExecutionMetaData(node)) return;
+
+				// Skip if the object contains spread elements — they may already provide pairedItem
+				const hasSpread = node.properties.some(
+					(prop) => prop.type === AST_NODE_TYPES.SpreadElement,
+				);
+				if (hasSpread) return;
+
+				// Only flag if this looks like an INodeExecutionData object literal —
+				// must have `json` and optionally `binary`/`error`, nothing unexpected.
+				// Objects with many unrelated keys are likely not INodeExecutionData.
+				const knownKeys = new Set([
+					'json',
+					'binary',
+					'error',
+					'pairedItem',
+					'executionStatus',
+					'metadata',
+					'evaluationData',
+					'redaction',
+					'sendMessage',
+					'index',
+				]);
+				const allPropertiesKnown = node.properties.every(
+					(prop) =>
+						prop.type === AST_NODE_TYPES.Property &&
+						prop.key.type === AST_NODE_TYPES.Identifier &&
+						knownKeys.has(prop.key.name),
+				);
+
+				if (!allPropertiesKnown) return;
+
+				context.report({ node, messageId: 'missingPairedItem' });
+			},
+		};
+	},
+});

package/src/rules/no-forbidden-lifecycle-scripts.test.ts

@@ -0,0 +1,103 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { NoForbiddenLifecycleScriptsRule } from './no-forbidden-lifecycle-scripts.js';
+
+const ruleTester = new RuleTester();
+
+ruleTester.run('no-forbidden-lifecycle-scripts', NoForbiddenLifecycleScriptsRule, {
+	valid: [
+		{
+			name: 'no scripts field',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "version": "1.0.0" }',
+		},
+		{
+			name: 'only safe scripts',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "build": "tsc", "test": "jest", "dev": "nodemon" } }',
+		},
+		{
+			name: 'non-package.json file is ignored',
+			filename: 'some-config.json',
+			code: '{ "scripts": { "prepare": "npm run build" } }',
+		},
+		{
+			name: 'empty scripts object',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": {} }',
+		},
+	],
+	invalid: [
+		{
+			name: 'prepare script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "prepare": "npm run build" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'prepare' } }],
+		},
+		{
+			name: 'preinstall script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "preinstall": "node setup.js" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'preinstall' } }],
+		},
+		{
+			name: 'install script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "install": "node install.js" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'install' } }],
+		},
+		{
+			name: 'postinstall script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "postinstall": "node setup.js" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'postinstall' } }],
+		},
+		{
+			name: 'prepublish script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "prepublish": "npm run build" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'prepublish' } }],
+		},
+		{
+			name: 'preprepare script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "preprepare": "echo prep" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'preprepare' } }],
+		},
+		{
+			name: 'postprepare script is forbidden',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "postprepare": "echo done" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'postprepare' } }],
+		},
+		{
+			name: 'multiple forbidden scripts report separate errors',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "prepare": "npm run build", "postinstall": "node setup.js" } }',
+			errors: [
+				{ messageId: 'forbiddenScript', data: { scriptName: 'prepare' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'postinstall' } },
+			],
+		},
+		{
+			name: 'mix of allowed and forbidden scripts — only forbidden reported',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "build": "tsc", "prepare": "npm run build", "test": "jest" } }',
+			errors: [{ messageId: 'forbiddenScript', data: { scriptName: 'prepare' } }],
+		},
+		{
+			name: 'all seven forbidden scripts present',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "scripts": { "prepare": "a", "preinstall": "b", "install": "c", "postinstall": "d", "prepublish": "e", "preprepare": "f", "postprepare": "g" } }',
+			errors: [
+				{ messageId: 'forbiddenScript', data: { scriptName: 'prepare' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'preinstall' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'install' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'postinstall' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'prepublish' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'preprepare' } },
+				{ messageId: 'forbiddenScript', data: { scriptName: 'postprepare' } },
+			],
+		},
+	],
+});

package/src/rules/no-forbidden-lifecycle-scripts.ts

@@ -0,0 +1,69 @@
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+
+import { createRule, findJsonProperty } from '../utils/index.js';
+
+const FORBIDDEN_SCRIPTS = [
+	'prepare',
+	'preinstall',
+	'install',
+	'postinstall',
+	'prepublish',
+	'preprepare',
+	'postprepare',
+];
+
+export const NoForbiddenLifecycleScriptsRule = createRule({
+	name: 'no-forbidden-lifecycle-scripts',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Ban lifecycle scripts (prepare, preinstall, postinstall, etc.) in community node packages',
+		},
+		messages: {
+			forbiddenScript:
+				'Lifecycle script "{{ scriptName }}" is not allowed in community node packages. These scripts execute arbitrary code during installation.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!context.filename.endsWith('package.json')) {
+			return {};
+		}
+
+		return {
+			ObjectExpression(node: TSESTree.ObjectExpression) {
+				// Only process the root object, not nested ones
+				if (node.parent?.type === AST_NODE_TYPES.Property) {
+					return;
+				}
+
+				const scriptsProp = findJsonProperty(node, 'scripts');
+				if (!scriptsProp || scriptsProp.value.type !== AST_NODE_TYPES.ObjectExpression) {
+					return;
+				}
+
+				for (const property of scriptsProp.value.properties) {
+					if (property.type !== AST_NODE_TYPES.Property) continue;
+
+					const key =
+						property.key.type === AST_NODE_TYPES.Identifier
+							? property.key.name
+							: property.key.type === AST_NODE_TYPES.Literal
+								? String(property.key.value)
+								: null;
+
+					if (key !== null && FORBIDDEN_SCRIPTS.includes(key)) {
+						context.report({
+							node: property,
+							messageId: 'forbiddenScript',
+							data: { scriptName: key },
+						});
+					}
+				}
+			},
+		};
+	},
+});