@n8n/eslint-plugin-community-nodes 0.26.0 → 0.27.0

package/src/rules/require-homepage.test.ts

@@ -0,0 +1,80 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { RequireHomepageRule } from './require-homepage.js';
+
+const ruleTester = new RuleTester();
+
+ruleTester.run('require-homepage', RequireHomepageRule, {
+	valid: [
+		{
+			name: 'homepage with an https url',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "homepage": "https://example.com" }',
+		},
+		{
+			name: 'homepage with a repository url and path',
+			filename: 'package.json',
+			code: '{ "homepage": "https://github.com/acme/n8n-nodes-example#readme" }',
+		},
+		{
+			name: 'non-package.json file is ignored',
+			filename: 'some-config.json',
+			code: '{ "name": "n8n-nodes-example" }',
+		},
+		{
+			name: 'nested objects are not checked',
+			filename: 'package.json',
+			code: '{ "homepage": "https://example.com", "config": { "nested": "value" } }',
+		},
+	],
+	invalid: [
+		{
+			name: 'missing homepage field entirely',
+			filename: 'package.json',
+			code: '{ "name": "n8n-nodes-example", "version": "1.0.0" }',
+			errors: [{ messageId: 'homepageMissing' }],
+		},
+		{
+			name: 'empty package.json object',
+			filename: 'package.json',
+			code: '{}',
+			errors: [{ messageId: 'homepageMissing' }],
+		},
+		{
+			name: 'empty homepage string',
+			filename: 'package.json',
+			code: '{ "homepage": "" }',
+			errors: [{ messageId: 'homepageInvalid' }],
+		},
+		{
+			name: 'whitespace-only homepage string',
+			filename: 'package.json',
+			code: '{ "homepage": "   " }',
+			errors: [{ messageId: 'homepageInvalid' }],
+		},
+		{
+			name: 'homepage without a protocol',
+			filename: 'package.json',
+			code: '{ "homepage": "example.com" }',
+			errors: [{ messageId: 'homepageInvalid' }],
+		},
+		{
+			name: 'placeholder homepage value',
+			filename: 'package.json',
+			code: '{ "homepage": "TODO" }',
+			errors: [{ messageId: 'homepageInvalid' }],
+		},
+		{
+			name: 'non-string homepage value',
+			filename: 'package.json',
+			code: '{ "homepage": 123 }',
+			errors: [{ messageId: 'homepageInvalid' }],
+		},
+		{
+			name: 'null homepage value',
+			filename: 'package.json',
+			code: '{ "homepage": null }',
+			errors: [{ messageId: 'homepageInvalid' }],
+		},
+	],
+});

package/src/rules/require-homepage.ts

@@ -0,0 +1,59 @@
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+
+import { createRule, findJsonProperty, getTopLevelObjectInJson } from '../utils/index.js';
+
+function isValidUrl(value: string): boolean {
+	try {
+		new URL(value);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+export const RequireHomepageRule = createRule({
+	name: 'require-homepage',
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description: 'Require a "homepage" field with a valid URL in package.json',
+		},
+		messages: {
+			homepageMissing: 'package.json must have a "homepage" field.',
+			homepageInvalid: 'The "homepage" field must be a valid URL (e.g. "https://example.com").',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!context.filename.endsWith('package.json')) {
+			return {};
+		}
+
+		return {
+			ObjectExpression(node: TSESTree.ObjectExpression) {
+				const root = getTopLevelObjectInJson(node);
+				if (!root) {
+					return;
+				}
+
+				const homepageProp = findJsonProperty(root, 'homepage');
+				if (!homepageProp) {
+					context.report({ node: root, messageId: 'homepageMissing' });
+					return;
+				}
+
+				const homepageValue = homepageProp.value;
+				const isValidHomepage =
+					homepageValue.type === AST_NODE_TYPES.Literal &&
+					typeof homepageValue.value === 'string' &&
+					isValidUrl(homepageValue.value);
+
+				if (!isValidHomepage) {
+					context.report({ node: homepageProp, messageId: 'homepageInvalid' });
+				}
+			},
+		};
+	},
+});

package/src/rules/webhook-lifecycle-complete.ts

@@ -5,11 +5,10 @@ import {
 	findClassProperty,
 	findObjectProperty,
 	isNodeTypeClass,
+	WEBHOOK_LIFECYCLE_METHODS,
+	type WebhookLifecycleMethod,
 } from '../utils/index.js';
 
-const REQUIRED_METHODS = ['checkExists', 'create', 'delete'] as const;
-type RequiredMethod = (typeof REQUIRED_METHODS)[number];
-
 /**
  * Returns true if the description declares webhook endpoints, indicating the
  * node is a webhook-based trigger that needs a complete lifecycle.
@@ -39,8 +38,8 @@ function isMethodProperty(property: TSESTree.ObjectLiteralElement, name: string)
 	);
 }
 
-function findMissingMethods(group: TSESTree.ObjectExpression): RequiredMethod[] {
-	return REQUIRED_METHODS.filter(
+function findMissingMethods(group: TSESTree.ObjectExpression): WebhookLifecycleMethod[] {
+	return WEBHOOK_LIFECYCLE_METHODS.filter(
 		(method) => !group.properties.some((property) => isMethodProperty(property, method)),
 	);
 }

package/src/utils/constants.ts

@@ -0,0 +1,21 @@
+import type { WebhookSetupMethodNames } from 'n8n-workflow';
+
+export type WebhookLifecycleMethod = WebhookSetupMethodNames;
+
+/**
+ * n8n's canonical webhook lifecycle method names (`WebhookSetupMethodNames`) are
+ * a type, so they can't be iterated at lint time. This object mirrors them as a
+ * runtime value; the `satisfies Record<WebhookSetupMethodNames, true>` ties it to
+ * the source of truth — adding, removing, or renaming a method upstream breaks
+ * type-checking here until this list is updated.
+ */
+const LIFECYCLE_METHOD_SET = {
+	checkExists: true,
+	create: true,
+	delete: true,
+} as const satisfies Record<WebhookSetupMethodNames, true>;
+
+/** The webhook trigger lifecycle methods, in the order n8n invokes them. */
+export const WEBHOOK_LIFECYCLE_METHODS = Object.keys(
+	LIFECYCLE_METHOD_SET,
+) as readonly WebhookLifecycleMethod[];

package/src/utils/credential-fields.ts

@@ -0,0 +1,57 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+import { findObjectProperty, getBooleanLiteralValue } from './ast-utils.js';
+
+const SENSITIVE_PATTERNS = [
+	'password',
+	'secret',
+	'token',
+	'cert',
+	'passphrase',
+	'apikey',
+	'secretkey',
+	'privatekey',
+	'authkey',
+];
+
+const NON_SENSITIVE_PATTERNS = ['url', 'pub', 'id'];
+
+/**
+ * Whether a name looks like it holds a secret. A name is sensitive when it
+ * contains a sensitive pattern (or a caller-supplied `extra` one) and none of
+ * the `exclusions`. Exclusions win, so under the default set `tokenUrl` and
+ * `secretId` are not sensitive even though they contain `token`/`secret`.
+ *
+ * - Credential-field masking uses the default exclusions (a field named
+ *   `tokenUrl` is a URL, not a secret to mask).
+ * - Pass `exclusions: []` to match on the raw patterns alone, e.g. when a
+ *   second gate (like a value heuristic) already guards against false positives.
+ * - Pass `extra` to add caller-specific patterns without widening the shared set.
+ */
+export function isSensitiveName(
+	name: string,
+	options: { extra?: string[]; exclusions?: string[] } = {},
+): boolean {
+	const { extra = [], exclusions = NON_SENSITIVE_PATTERNS } = options;
+	const lowerName = name.toLowerCase();
+
+	if (exclusions.some((pattern) => lowerName.includes(pattern))) {
+		return false;
+	}
+
+	return [...SENSITIVE_PATTERNS, ...extra].some((pattern) => lowerName.includes(pattern));
+}
+
+/** Whether the credential field element sets `typeOptions: { password: true }`. */
+export function hasPasswordTypeOption(element: TSESTree.ObjectExpression): boolean {
+	const typeOptionsProperty = findObjectProperty(element, 'typeOptions');
+
+	if (typeOptionsProperty?.value.type !== TSESTree.AST_NODE_TYPES.ObjectExpression) {
+		return false;
+	}
+
+	const passwordProperty = findObjectProperty(typeOptionsProperty.value, 'password');
+	const passwordValue = passwordProperty ? getBooleanLiteralValue(passwordProperty.value) : null;
+
+	return passwordValue === true;
+}

package/src/utils/file-utils.ts

@@ -238,6 +238,29 @@ export function findNodeSourceFilesOnDisk(packageJsonPath: string): string[] {
 	return findFilesRecursively(nodesDir, (fileName) => fileName.endsWith('.node.ts'));
 }
 
+/**
+ * Recursively finds files matching `matches` within the given subdirectories of
+ * the package (relative to its `package.json`). Missing subdirectories are
+ * skipped. Returns absolute paths.
+ */
+export function findFilesInPackageDirs(
+	packageJsonPath: string,
+	dirs: string[],
+	matches: (fileName: string) => boolean,
+): string[] {
+	const packageDir = dirname(packageJsonPath);
+	const results: string[] = [];
+
+	for (const dir of dirs) {
+		const fullPath = safeJoinPath(packageDir, dir);
+		if (existsSync(fullPath)) {
+			results.push(...findFilesRecursively(fullPath, matches));
+		}
+	}
+
+	return results;
+}
+
 export function areAllCredentialUsagesTestedByNodes(
 	credentialName: string,
 	packageDir: string,

package/src/utils/index.ts

@@ -1,3 +1,5 @@
 export * from './ast-utils.js';
+export * from './credential-fields.js';
+export * from './constants.js';
 export * from './file-utils.js';
 export * from './rule-creator.js';