@n8n/eslint-plugin-community-nodes 0.26.0 → 0.28.0

package/src/plugin.ts

@@ -24,6 +24,7 @@ const configs = {
 			'@n8n/community-nodes/no-restricted-globals': 'error',
 			'@n8n/community-nodes/no-restricted-imports': 'error',
 			'@n8n/community-nodes/credential-password-field': 'error',
+			'@n8n/community-nodes/credential-unnecessary-password': 'warn',
 			'@n8n/community-nodes/n8n-object-validation': 'error',
 			'@n8n/community-nodes/no-deprecated-workflow-functions': 'error',
 			'@n8n/community-nodes/no-emoji-in-options': 'error',
@@ -32,10 +33,13 @@ const configs = {
 			'@n8n/community-nodes/credential-test-required': 'error',
 			'@n8n/community-nodes/no-credential-reuse': 'error',
 			'@n8n/community-nodes/no-dangerous-functions': 'error',
+			'@n8n/community-nodes/no-dead-files': 'warn',
 			'@n8n/community-nodes/no-forbidden-lifecycle-scripts': 'error',
+			'@n8n/community-nodes/no-hardcoded-secrets': 'error',
 			'@n8n/community-nodes/no-http-request-with-manual-auth': 'error',
 			'@n8n/community-nodes/no-overrides-field': 'error',
 			'@n8n/community-nodes/no-runtime-dependencies': 'error',
+			'@n8n/community-nodes/no-silent-error-swallowing': 'error',
 			'@n8n/community-nodes/no-template-placeholders': 'error',
 			'@n8n/community-nodes/icon-validation': 'error',
 			'@n8n/community-nodes/icon-prefer-themed-variants': 'warn',
@@ -48,6 +52,8 @@ const configs = {
 			'@n8n/community-nodes/missing-paired-item': 'error',
 			'@n8n/community-nodes/no-builder-hint-leakage': 'error',
 			'@n8n/community-nodes/node-registration-complete': 'warn',
+			'@n8n/community-nodes/require-files-array': 'warn',
+			'@n8n/community-nodes/require-homepage': 'warn',
 			'@n8n/community-nodes/require-node-api-error': 'error',
 			'@n8n/community-nodes/require-node-description-fields': 'error',
 			'@n8n/community-nodes/require-version': 'error',
@@ -66,6 +72,7 @@ const configs = {
 		rules: {
 			'@n8n/community-nodes/ai-node-package-json': 'error',
 			'@n8n/community-nodes/credential-password-field': 'error',
+			'@n8n/community-nodes/credential-unnecessary-password': 'warn',
 			'@n8n/community-nodes/n8n-object-validation': 'error',
 			'@n8n/community-nodes/no-deprecated-workflow-functions': 'error',
 			'@n8n/community-nodes/no-emoji-in-options': 'error',
@@ -74,10 +81,13 @@ const configs = {
 			'@n8n/community-nodes/credential-test-required': 'error',
 			'@n8n/community-nodes/no-credential-reuse': 'error',
 			'@n8n/community-nodes/no-dangerous-functions': 'error',
+			'@n8n/community-nodes/no-dead-files': 'warn',
 			'@n8n/community-nodes/no-forbidden-lifecycle-scripts': 'error',
+			'@n8n/community-nodes/no-hardcoded-secrets': 'error',
 			'@n8n/community-nodes/no-http-request-with-manual-auth': 'error',
 			'@n8n/community-nodes/no-overrides-field': 'error',
 			'@n8n/community-nodes/no-runtime-dependencies': 'error',
+			'@n8n/community-nodes/no-silent-error-swallowing': 'error',
 			'@n8n/community-nodes/no-template-placeholders': 'error',
 			'@n8n/community-nodes/icon-validation': 'error',
 			'@n8n/community-nodes/icon-prefer-themed-variants': 'warn',
@@ -90,6 +100,8 @@ const configs = {
 			'@n8n/community-nodes/missing-paired-item': 'error',
 			'@n8n/community-nodes/no-builder-hint-leakage': 'error',
 			'@n8n/community-nodes/node-registration-complete': 'warn',
+			'@n8n/community-nodes/require-files-array': 'warn',
+			'@n8n/community-nodes/require-homepage': 'warn',
 			'@n8n/community-nodes/require-node-api-error': 'error',
 			'@n8n/community-nodes/require-node-description-fields': 'error',
 			'@n8n/community-nodes/require-version': 'error',

package/src/rules/credential-password-field.ts

@@ -6,47 +6,11 @@ import {
 	findClassProperty,
 	findObjectProperty,
 	getStringLiteralValue,
-	getBooleanLiteralValue,
+	isSensitiveName,
+	hasPasswordTypeOption,
 	createRule,
 } from '../utils/index.js';
 
-const SENSITIVE_PATTERNS = [
-	'password',
-	'secret',
-	'token',
-	'cert',
-	'passphrase',
-	'apikey',
-	'secretkey',
-	'privatekey',
-	'authkey',
-];
-
-const NON_SENSITIVE_PATTERNS = ['url', 'pub', 'id'];
-
-function isSensitiveFieldName(name: string): boolean {
-	const lowerName = name.toLowerCase();
-
-	if (NON_SENSITIVE_PATTERNS.some((pattern) => lowerName.includes(pattern))) {
-		return false;
-	}
-
-	return SENSITIVE_PATTERNS.some((pattern) => lowerName.includes(pattern));
-}
-
-function hasPasswordTypeOption(element: TSESTree.ObjectExpression): boolean {
-	const typeOptionsProperty = findObjectProperty(element, 'typeOptions');
-
-	if (typeOptionsProperty?.value.type !== TSESTree.AST_NODE_TYPES.ObjectExpression) {
-		return false;
-	}
-
-	const passwordProperty = findObjectProperty(typeOptionsProperty.value, 'password');
-	const passwordValue = passwordProperty ? getBooleanLiteralValue(passwordProperty.value) : null;
-
-	return passwordValue === true;
-}
-
 function createPasswordFix(
 	element: TSESTree.ObjectExpression,
 	typeOptionsProperty: TSESTree.Property | null,
@@ -87,7 +51,7 @@ export const CredentialPasswordFieldRule = createRule({
 	meta: {
 		type: 'problem',
 		docs: {
-			description: 'Ensure credential fields with sensitive names have typeOptions.password = true',
+			description: 'Ensure fields with sensitive names have typeOptions.password = true',
 		},
 		messages: {
 			missingPasswordOption:
@@ -120,7 +84,7 @@ export const CredentialPasswordFieldRule = createRule({
 					const nameProperty = findObjectProperty(element, 'name');
 					const fieldName = nameProperty ? getStringLiteralValue(nameProperty.value) : null;
 
-					if (!fieldName || !isSensitiveFieldName(fieldName)) {
+					if (!fieldName || !isSensitiveName(fieldName)) {
 						continue;
 					}
 

package/src/rules/credential-unnecessary-password.test.ts

@@ -0,0 +1,105 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+
+import { CredentialUnnecessaryPasswordRule } from './credential-unnecessary-password.js';
+
+const ruleTester = new RuleTester();
+
+function createCredentialCode(properties: string[]): string {
+	return `
+import type { ICredentialType, INodeProperties } from 'n8n-workflow';
+
+export class TestCredential implements ICredentialType {
+	name = 'testApi';
+	displayName = 'Test API';
+
+	properties: INodeProperties[] = [
+${properties.map((prop) => `\t\t${prop}`).join(',\n')},
+	];
+}`;
+}
+
+function createProperty(
+	displayName: string,
+	name: string,
+	options: { password?: boolean } = {},
+): string {
+	const typeOptionsStr =
+		options.password !== undefined ? `\n\t\t\ttypeOptions: { password: ${options.password} },` : '';
+
+	return `{
+			displayName: '${displayName}',
+			name: '${name}',
+			type: 'string',
+			default: '',${typeOptionsStr}
+		}`;
+}
+
+function createRegularClass(): string {
+	return `
+export class RegularClass {
+	properties = [
+		{
+			name: 'region',
+			type: 'string',
+			typeOptions: { password: true },
+		},
+	];
+}`;
+}
+
+ruleTester.run('credential-unnecessary-password', CredentialUnnecessaryPasswordRule, {
+	valid: [
+		{
+			name: 'non-sensitive field without password option',
+			code: createCredentialCode([createProperty('Region', 'region')]),
+		},
+		{
+			name: 'non-sensitive field with password: false',
+			code: createCredentialCode([createProperty('Base URL', 'baseUrl', { password: false })]),
+		},
+		{
+			name: 'sensitive field correctly masked',
+			code: createCredentialCode([createProperty('API Key', 'apiKey', { password: true })]),
+		},
+		{
+			name: 'masked field with a sensitive marker is left alone even when its name contains a non-sensitive substring',
+			code: createCredentialCode([
+				// 'androidToken' contains the non-sensitive substring 'id' but is a real secret
+				createProperty('Android Token', 'androidToken', { password: true }),
+				createProperty('Token URL', 'tokenUrl', { password: true }),
+			]),
+		},
+		{
+			name: 'class does not implement ICredentialType',
+			code: createRegularClass(),
+		},
+	],
+	invalid: [
+		{
+			name: 'region field should not use password option',
+			code: createCredentialCode([createProperty('Region', 'region', { password: true })]),
+			errors: [{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'region' } }],
+		},
+		{
+			name: 'URL field should not use password option',
+			code: createCredentialCode([createProperty('Base URL', 'baseUrl', { password: true })]),
+			errors: [{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'baseUrl' } }],
+		},
+		{
+			name: 'ID field should not use password option',
+			code: createCredentialCode([createProperty('Client ID', 'clientId', { password: true })]),
+			errors: [{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'clientId' } }],
+		},
+		{
+			name: 'multiple non-sensitive masked fields are each flagged',
+			code: createCredentialCode([
+				createProperty('Region', 'region', { password: true }),
+				createProperty('Host', 'host', { password: true }),
+			]),
+			errors: [
+				{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'region' } },
+				{ messageId: 'unnecessaryPasswordOption', data: { fieldName: 'host' } },
+			],
+		},
+	],
+});

package/src/rules/credential-unnecessary-password.ts

@@ -0,0 +1,72 @@
+import { TSESTree } from '@typescript-eslint/utils';
+
+import {
+	isCredentialTypeClass,
+	findClassProperty,
+	findObjectProperty,
+	getStringLiteralValue,
+	isSensitiveName,
+	hasPasswordTypeOption,
+	createRule,
+} from '../utils/index.js';
+
+export const CredentialUnnecessaryPasswordRule = createRule({
+	name: 'credential-unnecessary-password',
+	meta: {
+		type: 'suggestion',
+		docs: {
+			description:
+				'Warn when a credential field with no sensitive name uses typeOptions.password = true',
+		},
+		messages: {
+			unnecessaryPasswordOption:
+				"Field '{{ fieldName }}' does not appear to be sensitive but uses 'typeOptions: { password: true }'. Remove it unless the field holds a secret",
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		return {
+			ClassDeclaration(node) {
+				if (!isCredentialTypeClass(node)) {
+					return;
+				}
+
+				const propertiesProperty = findClassProperty(node, 'properties');
+				if (
+					!propertiesProperty?.value ||
+					propertiesProperty.value.type !== TSESTree.AST_NODE_TYPES.ArrayExpression
+				) {
+					return;
+				}
+
+				for (const element of propertiesProperty.value.elements) {
+					if (element?.type !== TSESTree.AST_NODE_TYPES.ObjectExpression) {
+						continue;
+					}
+
+					const nameProperty = findObjectProperty(element, 'name');
+					const fieldName = nameProperty ? getStringLiteralValue(nameProperty.value) : null;
+
+					if (!fieldName || !hasPasswordTypeOption(element)) {
+						continue;
+					}
+
+					// Only flag a masked field when its name carries no sensitive marker at all.
+					// We check with `exclusions: []` (raw patterns, no URL/ID/pub exclusions) so a
+					// real secret like `androidToken` — non-sensitive under the default exclusions
+					// only because it contains the substring `id` — is not wrongly flagged.
+					// Reported without a fix: removing masking could still be wrong for an
+					// unlisted secret name, so the author confirms.
+					if (!isSensitiveName(fieldName, { exclusions: [] })) {
+						context.report({
+							node: element,
+							messageId: 'unnecessaryPasswordOption',
+							data: { fieldName },
+						});
+					}
+				}
+			},
+		};
+	},
+});

package/src/rules/index.ts

@@ -6,6 +6,7 @@ import { CredClassOAuth2NamingRule } from './cred-class-oauth2-naming.js';
 import { CredentialDocumentationUrlRule } from './credential-documentation-url.js';
 import { CredentialPasswordFieldRule } from './credential-password-field.js';
 import { CredentialTestRequiredRule } from './credential-test-required.js';
+import { CredentialUnnecessaryPasswordRule } from './credential-unnecessary-password.js';
 import { IconPreferThemedVariantsRule } from './icon-prefer-themed-variants.js';
 import { IconValidationRule } from './icon-validation.js';
 import { MissingPairedItemRule } from './missing-paired-item.js';
@@ -13,20 +14,25 @@ import { N8nObjectValidationRule } from './n8n-object-validation.js';
 import { NoBuilderHintLeakageRule } from './no-builder-hint-leakage.js';
 import { NoCredentialReuseRule } from './no-credential-reuse.js';
 import { NoDangerousFunctionsRule } from './no-dangerous-functions.js';
+import { NoDeadFilesRule } from './no-dead-files.js';
 import { NoDeprecatedWorkflowFunctionsRule } from './no-deprecated-workflow-functions.js';
 import { NoEmojiInOptionsRule } from './no-emoji-in-options.js';
 import { NoForbiddenLifecycleScriptsRule } from './no-forbidden-lifecycle-scripts.js';
+import { NoHardcodedSecretsRule } from './no-hardcoded-secrets.js';
 import { NoHttpRequestWithManualAuthRule } from './no-http-request-with-manual-auth.js';
 import { NoOverridesFieldRule } from './no-overrides-field.js';
 import { NoRestrictedGlobalsRule } from './no-restricted-globals.js';
 import { NoRestrictedImportsRule } from './no-restricted-imports.js';
 import { NoRuntimeDependenciesRule } from './no-runtime-dependencies.js';
+import { NoSilentErrorSwallowingRule } from './no-silent-error-swallowing.js';
 import { NoTemplatePlaceholdersRule } from './no-template-placeholders.js';
 import { NodeClassDescriptionIconMissingRule } from './node-class-description-icon-missing.js';
 import { NodeConnectionTypeLiteralRule } from './node-connection-type-literal.js';
 import { NodeRegistrationCompleteRule } from './node-registration-complete.js';
 import { NodeUsableAsToolRule } from './node-usable-as-tool.js';
 import { PackageNameConventionRule } from './package-name-convention.js';
+import { RequireFilesArrayRule } from './require-files-array.js';
+import { RequireHomepageRule } from './require-homepage.js';
 import { RequireNodeApiErrorRule } from './require-node-api-error.js';
 import { RequireNodeDescriptionFieldsRule } from './require-node-description-fields.js';
 import { RequireVersionRule } from './require-version.js';
@@ -48,12 +54,16 @@ export const rules = {
 	'node-usable-as-tool': NodeUsableAsToolRule,
 	'package-name-convention': PackageNameConventionRule,
 	'credential-test-required': CredentialTestRequiredRule,
+	'credential-unnecessary-password': CredentialUnnecessaryPasswordRule,
 	'no-credential-reuse': NoCredentialReuseRule,
 	'no-dangerous-functions': NoDangerousFunctionsRule,
+	'no-dead-files': NoDeadFilesRule,
 	'no-forbidden-lifecycle-scripts': NoForbiddenLifecycleScriptsRule,
+	'no-hardcoded-secrets': NoHardcodedSecretsRule,
 	'no-http-request-with-manual-auth': NoHttpRequestWithManualAuthRule,
 	'no-overrides-field': NoOverridesFieldRule,
 	'no-runtime-dependencies': NoRuntimeDependenciesRule,
+	'no-silent-error-swallowing': NoSilentErrorSwallowingRule,
 	'no-template-placeholders': NoTemplatePlaceholdersRule,
 	'icon-validation': IconValidationRule,
 	'icon-prefer-themed-variants': IconPreferThemedVariantsRule,
@@ -68,6 +78,8 @@ export const rules = {
 	'missing-paired-item': MissingPairedItemRule,
 	'no-builder-hint-leakage': NoBuilderHintLeakageRule,
 	'n8n-object-validation': N8nObjectValidationRule,
+	'require-files-array': RequireFilesArrayRule,
+	'require-homepage': RequireHomepageRule,
 	'require-node-api-error': RequireNodeApiErrorRule,
 	'require-node-description-fields': RequireNodeDescriptionFieldsRule,
 	'require-version': RequireVersionRule,

package/src/rules/no-dead-files.test.ts

@@ -0,0 +1,128 @@
+import { RuleTester } from '@typescript-eslint/rule-tester';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { isDeadFileName, NoDeadFilesRule } from './no-dead-files.js';
+import * as fileUtils from '../utils/file-utils.js';
+
+vi.mock('../utils/file-utils.js', async () => {
+	const actual = await vi.importActual('../utils/file-utils.js');
+	return {
+		...actual,
+		findFilesInPackageDirs: vi.fn(),
+	};
+});
+
+const mockFindFilesInPackageDirs = vi.mocked(fileUtils.findFilesInPackageDirs);
+
+const packageJsonPath = '/tmp/package.json';
+
+const ruleTester = new RuleTester();
+
+function setup(deadFiles: string[]): void {
+	mockFindFilesInPackageDirs.mockReturnValue(deadFiles);
+}
+
+afterEach(() => {
+	vi.clearAllMocks();
+});
+
+// Default: no dead files on disk.
+setup([]);
+
+ruleTester.run('no-dead-files', NoDeadFilesRule, {
+	valid: [
+		{
+			name: 'package with no dead files',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example", "n8n": { "nodes": ["dist/nodes/Foo/Foo.node.js"] } }',
+		},
+		{
+			name: 'non-package.json file is ignored',
+			filename: 'some-config.json',
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/nodes/Foo/Foo.node.ts.bak']);
+			},
+		},
+	],
+	invalid: [
+		{
+			name: 'single backup file is reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/nodes/Foo/Foo.node.ts.bak']);
+			},
+			errors: [
+				{
+					messageId: 'deadFileFound',
+					data: { file: 'nodes/Foo/Foo.node.ts.bak' },
+				},
+			],
+		},
+		{
+			name: 'multiple dead files are each reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup([
+					'/tmp/nodes/Foo/Foo.node.ts.backup',
+					'/tmp/nodes/Foo/test.js',
+					'/tmp/nodes/Bar/Bar.node.ts:Zone.Identifier',
+				]);
+			},
+			errors: [
+				{ messageId: 'deadFileFound', data: { file: 'nodes/Foo/Foo.node.ts.backup' } },
+				{ messageId: 'deadFileFound', data: { file: 'nodes/Foo/test.js' } },
+				{ messageId: 'deadFileFound', data: { file: 'nodes/Bar/Bar.node.ts:Zone.Identifier' } },
+			],
+		},
+		{
+			name: 'stray test.ts file is reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/nodes/test.ts']);
+			},
+			errors: [{ messageId: 'deadFileFound', data: { file: 'nodes/test.ts' } }],
+		},
+		{
+			name: 'dead file in credentials directory is reported',
+			filename: packageJsonPath,
+			code: '{ "name": "n8n-nodes-example" }',
+			before() {
+				setup(['/tmp/credentials/MyApi.credentials.ts.bak']);
+			},
+			errors: [
+				{ messageId: 'deadFileFound', data: { file: 'credentials/MyApi.credentials.ts.bak' } },
+			],
+		},
+	],
+});
+
+describe('isDeadFileName', () => {
+	it.each([
+		'Foo.node.ts.backup',
+		'notes.backup',
+		'Foo.node.ts.bak',
+		'archive.bak',
+		'Zone.Identifier',
+		'Foo.node.ts:Zone.Identifier',
+		'test.js',
+		'test.ts',
+	])('flags %s as a dead file', (fileName) => {
+		expect(isDeadFileName(fileName)).toBe(true);
+	});
+
+	it.each([
+		'Foo.node.ts',
+		'Foo.node.js',
+		'index.ts',
+		'test.json',
+		'mytest.js',
+		'backup.ts',
+		'GenericFunctions.ts',
+	])('does not flag %s', (fileName) => {
+		expect(isDeadFileName(fileName)).toBe(false);
+	});
+});

package/src/rules/no-dead-files.ts

@@ -0,0 +1,71 @@
+import type { TSESTree } from '@typescript-eslint/utils';
+import { AST_NODE_TYPES } from '@typescript-eslint/utils';
+import * as path from 'node:path';
+
+import { createRule, findFilesInPackageDirs } from '../utils/index.js';
+
+// Package subdirectories that ship in the published artifact and should stay clean.
+const SCAN_DIRS = ['nodes', 'credentials'];
+
+const DEAD_FILE_MATCHERS: Array<(fileName: string) => boolean> = [
+	(fileName) => fileName.endsWith('.backup'),
+	(fileName) => fileName.endsWith('.bak'),
+	// Windows "mark of the web" ADS files, extracted as literal filenames on
+	// filesystems without alternate data streams (e.g. `Foo.node.ts:Zone.Identifier`).
+	(fileName) => fileName.endsWith('Zone.Identifier'),
+	(fileName) => fileName === 'test.js',
+	(fileName) => fileName === 'test.ts',
+];
+
+/**
+ * Returns true if the given filename looks like a leftover backup, editor, or
+ * test-artifact file that should not ship with a community node.
+ */
+export function isDeadFileName(fileName: string): boolean {
+	return DEAD_FILE_MATCHERS.some((matches) => matches(fileName));
+}
+
+export const NoDeadFilesRule = createRule({
+	name: 'no-dead-files',
+	meta: {
+		type: 'problem',
+		docs: {
+			description:
+				'Disallow leftover backup, editor, and test-artifact files in the `nodes/` and `credentials/` directories of a community node package',
+		},
+		messages: {
+			deadFileFound:
+				'Remove the leftover file "{{ file }}". Backup, editor, and test-artifact files should not be published with a community node.',
+		},
+		schema: [],
+	},
+	defaultOptions: [],
+	create(context) {
+		if (!context.filename.endsWith('package.json')) {
+			return {};
+		}
+
+		return {
+			ObjectExpression(node: TSESTree.ObjectExpression) {
+				// Only inspect the root object of the package.json file, so the scan runs once.
+				if (node.parent?.type !== AST_NODE_TYPES.ExpressionStatement) {
+					return;
+				}
+
+				const packageDir = path.dirname(context.filename);
+
+				for (const deadFile of findFilesInPackageDirs(
+					context.filename,
+					SCAN_DIRS,
+					isDeadFileName,
+				)) {
+					context.report({
+						node,
+						messageId: 'deadFileFound',
+						data: { file: path.relative(packageDir, deadFile) },
+					});
+				}
+			},
+		};
+	},
+});