@sap/eslint-plugin-cds 2.4.1 → 2.6.0

package/lib/rules/auth-valid-restrict-to.js

@@ -1,86 +1,131 @@
-const { splitEntityName, validateObject, validateString } = require("../utils/ruleHelpers");
+const { isEmptyString, isStringInArray, findFuzzy, isEmptyObject } = require('../utils/rules')
 
-const VALID_PSEUDO_ROLES = ["authenticated-user", "system-user", "any"];
+const VALID_PSEUDO_ROLES = ['authenticated-user', 'system-user', 'any']
 
 module.exports = {
   meta: {
+    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
     docs: {
-      description: '`@restrict.to` must have valid values',
-      category: "Model Validation",
-      recommended: true,
-      version: "2.4.1",
+      description: '`@restrict.to` must have valid values.',
+      category: 'Model Validation',
+      recommended: true
     },
-    severity: "warn",
     hasSuggestions: true,
     messages: {
-      InvalidItem: `Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?`,
-      ReplaceItemWith: `Replace '{{invalid}}' with '{{candidates}}'`,
+      InvalidItem: "Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?",
+      ReplaceItemWith: "Replace '{{invalid}}' with '{{candidates}}'"
     },
+    type: 'problem',
+    model: 'inferred'
   },
-  create(context) {
-    const { model } = context.cds;
-
+  create (context) {
     return {
-      entity: check_restrict_to,
-    };
+      entity: checkRestrictTo
+    }
 
-    function check_restrict_to(e) {
-      const reports = [];
+    function checkRestrictTo (e) {
+      const USER_ROLES = []
+      const model = context.getModel()
 
-      const USER_ROLES = [];
-      model.foreach('entity', e => {
-        if (e["@restrict"]) {
-          e["@restrict"].forEach(p => {
+      model.foreach('entity', (e) => {
+        if (e['@restrict']) {
+          e['@restrict'].forEach((p) => {
             if (p.to) {
               switch (typeof p.to) {
-                case "string":
+                case 'string':
                   if (p.to !== p.to.toLowerCase() && !USER_ROLES.includes(p.to)) {
-                    USER_ROLES.push(p.to);
+                    USER_ROLES.push(p.to)
                   }
-                  break;
-                case "object":
+                  break
+                case 'object':
                   for (const r in p.to) {
                     if (r !== r.toLowerCase() && !USER_ROLES.includes(r)) {
-                      USER_ROLES.push(r);
-                    } 
+                      USER_ROLES.push(r)
+                    }
                   }
               }
             }
           })
         }
-      });  
-      const ROLES = USER_ROLES.concat(VALID_PSEUDO_ROLES);
+      })
+      const ROLES = USER_ROLES.concat(VALID_PSEUDO_ROLES)
 
-      if (e["@restrict"]) {
-        const { prefix } = splitEntityName(e);
-        const prefixSplit = prefix.split(".");
-        const serviceName = prefixSplit[prefixSplit.length - 1];
-        let services = model.services;
+      if (e['@restrict']) {
+        const node = context.getNode(e)
+        const file = e.$location.file
 
-        // For hierachies, check whether service restriction exists
-        let grantAllTo;
-        Object.values(services).map((s) => {
-          if (s.name === serviceName && s['@requires']) {
-            grantAllTo = s['@requires'];
-          }
-        });
+        // TODO: For hierachies, check whether service restriction exists
+        // const { prefix } = splitDefName(e)
+        // const prefixSplit = prefix.split('.')
+        // const serviceName = prefixSplit[prefixSplit.length - 1]
+        // const services = model.services
+        // let grantAllTo;
+        // Object.values(services).map((s) => {
+        //   if (s.name === serviceName && s['@requires']) {
+        //     grantAllTo = s['@requires'];
+        //   }
+        // })
 
-        for (const entry of e["@restrict"]) {
+        for (const entry of e['@restrict']) {
           if (Object.keys(entry).includes('to')) {
-            switch (typeof entry.to) {
-              case "string": {
-                const isPseudoRole = entry.to && (entry.to === entry.to.toLowerCase());
-                validateString(reports, context, e, {key: 'to', name: 'role'}, entry.to, ROLES, isPseudoRole);
-                break;
+            const toValue = entry.to
+
+            switch (typeof toValue) {
+              case 'string': {
+                if (isEmptyString(toValue)) {
+                  context.report({
+                    message: `Missing role on ${e.name} for \`@restrict.to\`.`,
+                    node,
+                    file
+                  })
+                } else {
+                  const isPseudoRole = entry.to && entry.to === entry.to.toLowerCase()
+                  if (!isStringInArray(toValue, ROLES, isPseudoRole)) {
+                    const candidates = findFuzzy(toValue, ROLES.sort())
+                    context.report({
+                      messageId: 'InvalidItem',
+                      data: { invalid: toValue, candidates },
+                      node,
+                      file
+                    })
+                  }
+                }
+                break
               }
-              case "object":
-                validateObject(reports, context, e, {key: 'to', name: 'roles'}, entry.to, ROLES);
-                break;
+
+              case 'object':
+                if (isEmptyObject(toValue)) {
+                  context.report({
+                    message: `Missing roles on ${e.name} for \`@restrict.to\`.`,
+                    node,
+                    file
+                  })
+                } else {
+                  if (toValue.includes('any')) {
+                    context.report({
+                      messageId: 'InvalidItem',
+                      data: { invalid: `[${toValue}]`, candidates: ['["any"]'] },
+                      node,
+                      file
+                    })
+                  }
+                  toValue.forEach((value) => {
+                    if (!ROLES.includes(value)) {
+                      const candidates = findFuzzy(value, ROLES.sort())
+                      context.report({
+                        messageId: 'InvalidItem',
+                        data: { invalid: value, candidates },
+                        node,
+                        file
+                      })
+                    }
+                  })
+                }
+                break
             }
           }
         }
       }
-      return reports.length > 0 ? reports : undefined;
     }
-  },
-};
+  }
+}

package/lib/rules/auth-valid-restrict-where.js

@@ -1,80 +1,90 @@
-const { splitEntityName, validateObject, validateString } = require("../utils/ruleHelpers");
+const cds = require('@sap/cds')
 
-const VALID_PSEUDO_ROLES = ["authenticated-user", "system-user", "any"];
+const VALID_PSEUDO_ROLES = ['authenticated-user', 'system-user', 'any']
 
 module.exports = {
   meta: {
+    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
     docs: {
-      description: '`@restrict.where` must have valid values',
-      category: "Model Validation",
-      recommended: true,
-      version: "2.4.1",
+      description: '`@restrict.where` must have valid values.',
+      category: 'Model Validation',
+      recommended: true
     },
-    severity: "error",
+    severity: 'error',
     hasSuggestions: true,
     messages: {
-      InvalidItem: `Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?`,
-      ReplaceItemWith: `Replace '{{invalid}}' with '{{candidates}}'`,
+      InvalidItem: "Invalid item '{{invalid}}'. Did you mean '{{candidates}}'?",
+      ReplaceItemWith: "Replace '{{invalid}}' with '{{candidates}}'"
     },
+    type: 'problem',
+    model: 'inferred'
   },
-  create(context) {
-    const { model } = context.cds;
+  create (context) {
+    const model = context.getModel()
 
     return {
-      entity: check_restrict_grant,
-    };
+      entity: checkRestrictGrant
+    }
 
-    function check_restrict_grant(e) {
-      const reports = [];
+    function checkRestrictGrant (e) {
+      const USER_ROLES = []
 
-      const USER_ROLES = [];
-      model.foreach("entity", (e) => {
-        if (e["@restrict"]) {
-          e["@restrict"].forEach((p) => {
+      model.foreach('entity', (e) => {
+        if (e['@restrict']) {
+          e['@restrict'].forEach((p) => {
             if (p.to) {
               switch (typeof p.to) {
-                case "string":
+                case 'string':
                   if (p.to !== p.to.toLowerCase() && !USER_ROLES.includes(p.to)) {
-                    USER_ROLES.push(p.to);
+                    USER_ROLES.push(p.to)
                   }
-                  break;
-                case "object":
+                  break
+                case 'object':
                   for (const r in p.to) {
                     if (r !== r.toLowerCase() && !USER_ROLES.includes(r)) {
-                      USER_ROLES.push(r);
+                      USER_ROLES.push(r)
                     }
                   }
               }
             }
-          });
+          })
         }
-      });
-      const ROLES = USER_ROLES.concat(VALID_PSEUDO_ROLES);
+      })
+      const ROLES = USER_ROLES.concat(VALID_PSEUDO_ROLES)
 
-      if (e["@restrict"]) {
-        for (const entry of e["@restrict"]) {
-          const whereValues = entry.where;
-          if (whereValues && typeof whereValues === "string") {
-            let cxn;
+      if (e['@restrict']) {
+        const node = context.getNode(e)
+        const file = e.$location.file
+        for (const entry of e['@restrict']) {
+          const whereValues = entry.where
+          if (whereValues && typeof whereValues === 'string') {
+            let cxn
             try {
-              cxn = context.cds.parse.expr(entry.where);
+              cxn = cds.parse.expr(entry.where)
             } catch (err) {
-              reports.push(`Invalid \`where\` expression, CDS compilation failed.`);
+              context.report({
+                message: 'Invalid `where` expression, CDS compilation failed.',
+                node,
+                file
+              })
             }
             if (cxn && cxn.xpr) {
-              const operator = cxn.xpr[1];
-              const role = cxn.xpr[2].ref;
-              if (operator === "=") {
-                const isValidRole = (role == '$user') || ROLES.includes(role);
+              const operator = cxn.xpr[1]
+              const role = cxn.xpr[2].ref
+              if (operator === '=') {
+                const isValidRole = role === '$user' || ROLES.includes(role)
                 if (!isValidRole) {
-                  reports.push(`Invalid \`where\` expression, role \`${role}\` not found.`);
+                  context.report({
+                    message: `Invalid \`where\` expression, role ${role} not found.`,
+                    node,
+                    file
+                  })
                 }
               }
             }
           }
         }
       }
-      return reports.length > 0 ? reports : undefined;
     }
-  },
-};
+  }
+}

package/lib/rules/extension-restrictions.js

@@ -0,0 +1,69 @@
+const cds = requireMtx()
+
+const { dirname } = require('path')
+
+const rule = module.exports = {
+  meta: {
+    docs: {
+      description: 'Extensions must not violate restrictions set by the extended SaaS app.',
+      category: 'Model Validation',
+      recommended: true
+    },
+    hasSuggestions: false,
+    type: 'problem',
+    model: 'parsed'
+  },
+  mtxApi: () => {
+    if (!cds) return // no mtxs lib installed
+    if (!cds.xt?.linter) return // too old mtxs
+    return cds.xt.linter
+  },
+  create (context) {
+    if (!rule.mtxApi()) return // no mtxs lib installed
+
+    return () => {
+      const extModel = context.getModel()
+      if (!extModel) return
+
+      const base = baseModel(context)
+      if (!base) return
+
+      const file = context.getFilename()
+      const findings = rule.mtxApi().lint(extModel, base.model, base.env)
+      for (const finding of findings) {
+        context.report({
+          message: finding.message,
+          node: context.getNode(finding.element),
+          file
+        })
+      }
+    }
+  }
+}
+
+function baseModel (context) {
+  let dir = context.getFilename()
+  do {
+    dir = dirname(dir)
+    const projEnv = cds.env.for('cds', dir)
+    if (!projEnv.extends) continue
+    const files = cds.resolve(projEnv.extends, { root: dir }) // resolve local base model
+    if (files?.length) {
+      const model = cds.load(files, { sync: true })
+      // env of SaaS app is needed for extension rules
+      const env = cds.env.for('cds', dirname(files[0]))
+      return { env, model }
+    }
+  } while (dir && dir !== cds.root && dir.length > 1)
+}
+
+/** @returns { import('@sap/cds/apis/cds') } */
+function requireMtx () {
+  const cds = require('@sap/cds')
+  try {
+    const pkg = require.resolve('@sap/cds-mtxs', { paths: [cds.root, __dirname] })
+    return require(pkg)
+  } catch (e) {
+    if (e.code !== 'MODULE_NOT_FOUND') throw e
+  }
+}

package/lib/rules/index.js

@@ -0,0 +1,27 @@
+const Cache = require('../utils/Cache')
+const { createRule } = require('../api')
+
+const rules = {
+  'assoc2many-ambiguous-key': () => createRule(require('./assoc2many-ambiguous-key')),
+  'auth-no-empty-restrictions': () => createRule(require('./auth-no-empty-restrictions')),
+  'auth-use-requires': () => createRule(require('./auth-use-requires')),
+  'auth-valid-restrict-grant': () => createRule(require('./auth-valid-restrict-grant')),
+  'auth-valid-restrict-keys': () => createRule(require('./auth-valid-restrict-keys')),
+  'auth-valid-restrict-to': () => createRule(require('./auth-valid-restrict-to')),
+  'auth-valid-restrict-where': () => createRule(require('./auth-valid-restrict-where')),
+  'latest-cds-version': () => createRule(require('./latest-cds-version')),
+  'min-node-version': () => createRule(require('./min-node-version')),
+  'no-db-keywords': () => createRule(require('./no-db-keywords')),
+  'no-dollar-prefixed-names': () => createRule(require('./no-dollar-prefixed-names')),
+  'no-join-on-draft': () => createRule(require('./no-join-on-draft')),
+  'require-2many-oncond': () => createRule(require('./require-2many-oncond')),
+  'sql-cast-suggestion': () => createRule(require('./sql-cast-suggestion')),
+  'start-elements-lowercase': () => createRule(require('./start-elements-lowercase')),
+  'start-entities-uppercase': () => createRule(require('./start-entities-uppercase')),
+  'valid-csv-header': () => createRule(require('./valid-csv-header')),
+  'extension-restrictions': () => createRule(require('./extension-restrictions'))
+}
+
+Cache.set('rules', rules)
+
+module.exports = rules

package/lib/rules/latest-cds-version.js

@@ -1,42 +1,44 @@
-const cp = require("child_process");
-const semver = require("semver");
+const cp = require('child_process')
+const semver = require('semver')
 
 module.exports = {
   meta: {
+    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
     docs: {
-      description: "Checks whether the latest `@sap/cds` version is being used.",
-      category: "Environment",
-      version: "1.0.4",
+      description: 'Checks whether the latest `@sap/cds` version is being used.'
     },
-    type: "suggestion",
+    type: 'suggestion',
     hasSuggestions: true,
     messages: {
-      latestCDSVersion: `A newer CDS version is available!`,
+      latestCDSVersion: 'A newer CDS version is available!'
     },
+    severity: 'off',
+    model: 'none'
   },
   create: function (context) {
-    return { all: check_latest_cds_version };
+    return checkLatestCdsVersion
 
-    function check_latest_cds_version() {
-      let cdsVersions;
-      let e = context.cds.environment;
+    function checkLatestCdsVersion () {
+      let cdsVersions
+      let e = context.getEnvironment()
       if (!e) {
         e = cp
-          .execSync(`npm outdated @sap/cds --json`, {
+          .execSync('npm outdated @sap/cds --json', {
             cwd: process.cwd(),
-            stdio: "pipe",
+            stdio: 'pipe'
           })
-          .toString();
+          .toString()
       }
-      if (e && e["@sap/cds"]) {
-        cdsVersions = e["@sap/cds"];
+      if (e && e['@sap/cds']) {
+        cdsVersions = e['@sap/cds']
         // If current cds version is not the latest
         if (Object.keys(cdsVersions).length !== 0 && !semver.satisfies(cdsVersions.latest, cdsVersions.current)) {
-          return {
-            messageId: "latestCDSVersion",
-          };
+          context.report({
+            messageId: 'latestCDSVersion',
+            node: context.getNode()
+          })
         }
       }
     }
-  },
-};
+  }
+}

package/lib/rules/min-node-version.js

@@ -1,47 +1,48 @@
-const path = require("path");
-const semver = require("semver");
+const path = require('path')
+const semver = require('semver')
 
 module.exports = {
   meta: {
+    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
     docs: {
-      description: `Checks whether the minimum Node.js version required by \`@sap/cds\` is achieved.`,
-      category: "Environment",
-      recommended: true,
-      version: "1.0.0",
+      description: 'Checks whether the minimum Node.js version required by `@sap/cds` is achieved.'
     },
-    severity: "error",
-    type: "problem",
+    severity: 'off',
+    type: 'problem',
+    model: 'none'
   },
   create: function (context) {
-    return { all: check_min_node_version }
+    return checkMinNodeVersion
 
-    function check_min_node_version() {
-      const e = context.cds.environment;
-      let nodeVersion, nodeVersionCDS;
+    function checkMinNodeVersion () {
+      const e = context.getEnvironment()
+      let nodeVersion, nodeVersionCDS
       if (!e) {
         // Get current and required node versions
         try {
-          const CDSPath = require.resolve("@sap/cds/package.json", {
-            paths: [path.dirname(context.filePath)],
-          });
-          const jsonCDS = require(CDSPath);
-          nodeVersion = process.version;
-          nodeVersionCDS = jsonCDS.engines.node;
+          const CDSPath = require.resolve('@sap/cds/package.json', {
+            paths: [path.dirname('.')]
+          })
+          const jsonCDS = require(CDSPath)
+          nodeVersion = process.version
+          nodeVersionCDS = jsonCDS.engines.node
         } catch (err) {
           // Do not throw
         }
       } else {
-        nodeVersion = e.nodeVersion;
-        nodeVersionCDS = e.nodeVersionCDS;
+        nodeVersion = e.nodeVersion
+        nodeVersionCDS = e.nodeVersionCDS
       }
       if (
         nodeVersion &&
         nodeVersionCDS &&
         !semver.satisfies(nodeVersion, nodeVersionCDS, { loose: true })
       ) {
-        return `CDS minimum node version of ${nodeVersionCDS} required, found ${nodeVersion}!`;
+        context.report({
+          message: `CDS minimum node version of ${nodeVersionCDS} required, found ${nodeVersion}!`,
+          node: context.getNode()
+        })
       }
     }
-
-  },
-};
+  }
+}

package/lib/rules/no-db-keywords.js

@@ -1,44 +1,36 @@
+const cds = require('@sap/cds')
+
 module.exports = {
   meta: {
+    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
     docs: {
-      description: `Avoid using reserved SQL keywords.`,
-      category: "Model Validation", //> values are specific for cds lint
-      recommended: true,
-      version: "2.1.0",
+      description: 'Avoid using reserved SQL keywords.',
+      recommended: true
     },
-    severity: "error" //> convenience option by cds.lint
+    type: 'problem'
   },
-  create(context) {
-    const { cds } = context //> specific for cds lint
-    const { db = { kind: "sql" } } = cds.env.requires
+  create (context) {
+    const { db = { kind: 'sql' } } = cds.env.requires
 
-    return { //> return standard eslint visitor callbacks registered to CSN kinds, types, ...
-      entity: check_name_is_not_reserved,
-      element: check_name_is_not_reserved
+    return {
+      // > return standard eslint visitor callbacks registered to CSN kinds, types, ...
+      entity: checkNameIsNotReserved,
+      element: checkNameIsNotReserved
     }
 
-    function check_name_is_not_reserved(d) {
-      if (d.name in RESERVED) {
+    function checkNameIsNotReserved (d) {
+      if (RESERVED.includes(d.name.toUpperCase())) {
         // Do not blame in case of external services
-        let srv = d._service || (d.parent && d.parent._service)
-        if (srv && srv["@cds.external"]) return
-
-        // Do blame
-        return `'${d.name}' is a reserved keyword in ${db.kind.toUpperCase()}` //> convenience options by cds lint
+        const srv = d._service || (d.parent && d.parent._service)
+        if (srv && srv['@cds.external']) return
+        context.report({
+          message: `'${d.name}' is a reserved keyword in ${db.kind.toUpperCase()}`,
+          node: context.getNode(d)
+        })
       }
     }
-  },
-};
+  }
+}
 
 // REVISIT: Replace by compiler-provided check
-const RESERVED = {
-  ORDER: 1,
-  Order: 1,
-  order: 1,
-  GROUP: 1,
-  Group: 1,
-  group: 1,
-  LIMIT: 1,
-  Limit: 1,
-  limit: 1,
-};
+const RESERVED = cds.compile.to.sql.sqlite ? cds.compile.to.sql.sqlite.keywords : ['ORDER', 'GROUP', 'LIMIT']

package/lib/rules/no-dollar-prefixed-names.js

@@ -1,21 +1,24 @@
 module.exports = {
   meta: {
+    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
     docs: {
-      description: `Names must not start with $ to avoid possible shadowing of reserved variables.`,
-      category: "Model Validation",
-      recommended: true,
-      version: "2.3.3",
+      description: 'Names must not start with $ to avoid possible shadowing of reserved variables.',
+      recommended: true
     },
-    severity: "warn",
+    type: 'problem'
   },
-  create(context) {
-    return { element: _check };
+  create (context) {
+    return { element: _check }
 
-    function _check(d) {
-      // Do not blame in case of external services
-      let srv = d._service || (d.parent && d.parent._service);
-      if (srv && srv["@cds.external"]) return;
-      return d.name.startsWith("$") ? [`“${d.name}” is prefixed with a dollar sign ($)`] : undefined;
+    function _check (d) {
+      const srv = d._service || (d.parent && d.parent._service)
+      if (srv && srv['@cds.external']) return
+      if (d.name.startsWith('$')) {
+        context.report({
+          message: `'${d.name}' is prefixed with a dollar sign ($)`,
+          node: context.getNode(d)
+        })
+      }
     }
-  },
-};
+  }
+}