biome-plugin-suitescript 0.1.1 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +157 -27
- package/biome-manifest.json +261 -7
- package/configs/all.json +29 -0
- package/configs/minimal.json +14 -0
- package/configs/recommended.json +20 -0
- package/dist/cli/analyze.js +33 -3
- package/dist/lib/define.js +35 -5
- package/dist/lib/headers.js +12 -0
- package/dist/lib/module-calls.js +65 -0
- package/dist/lib/module-script-types.js +76 -0
- package/dist/lib/options.js +35 -0
- package/dist/lib/required-options.js +14 -0
- package/dist/lib/script-side.js +83 -0
- package/dist/lib/script-types.js +37 -14
- package/dist/lib/suiteql.js +16 -0
- package/dist/lib/suitescript.js +23 -0
- package/dist/lib/typings-data.js +4327 -0
- package/dist/lib/typings.js +2 -0
- package/dist/rules/logRequireDetails.js +4 -0
- package/dist/rules/logRequireTitle.js +1 -0
- package/dist/rules/noAuthorizationHeaderInInternalRequest.js +24 -0
- package/dist/rules/noBeforeSubmitRecordReload.js +19 -0
- package/dist/rules/noBlockedHttpsHeader.js +32 -0
- package/dist/rules/noBlockedResponseHeader.js +35 -0
- package/dist/rules/noBrowserGlobals.js +25 -0
- package/dist/rules/noClientLog.js +14 -0
- package/dist/rules/noConflictingClientScriptProps.js +36 -0
- package/dist/rules/noDynamicRequire.js +23 -0
- package/dist/rules/noDynamicSuiteQL.js +29 -0
- package/dist/rules/noEmptyEntryPoints.js +19 -0
- package/dist/rules/noExtraDeps.js +16 -0
- package/dist/rules/noExtraParams.js +17 -0
- package/dist/rules/noGlobalShadowing.js +38 -0
- package/dist/rules/noHardcodedAuthPasswords.js +27 -0
- package/dist/rules/noHardcodedSecrets.js +43 -0
- package/dist/rules/noHeaderUnderscores.js +23 -0
- package/dist/rules/noInnerHtml.js +41 -0
- package/dist/rules/noInsecureCookie.js +27 -0
- package/dist/rules/noInsecureHttpsUrl.js +20 -0
- package/dist/rules/noInvalidDefine.js +47 -0
- package/dist/rules/noInvalidEnumMember.js +24 -0
- package/dist/rules/noLocationHeader.js +20 -0
- package/dist/rules/noLogModule.js +8 -2
- package/dist/rules/noMapReduceSearchResults.js +33 -0
- package/dist/rules/noMissingModules.js +29 -0
- package/dist/rules/noModuleScopeApiCalls.js +49 -0
- package/dist/rules/noMultipleDefine.js +14 -0
- package/dist/rules/noNativeIterators.js +19 -0
- package/dist/rules/noPositionalOptions.js +26 -0
- package/dist/rules/noPostMessageWildcard.js +15 -0
- package/dist/rules/noPublicFileUpload.js +20 -0
- package/dist/rules/noQueryColumnFieldAndFormula.js +19 -0
- package/dist/rules/noRecordInLoop.js +34 -0
- package/dist/rules/noRequireInsteadOfDefine.js +25 -0
- package/dist/rules/noSecretKeyGuidAndSecret.js +16 -0
- package/dist/rules/noSensitiveBrowserStorage.js +24 -0
- package/dist/rules/noStackInResponse.js +21 -0
- package/dist/rules/noSuiteQLSelectStar.js +18 -0
- package/dist/rules/noSuiteQLSystemNoteJoin.js +19 -0
- package/dist/rules/noSuiteQLTypeInSearch.js +41 -0
- package/dist/rules/noSuiteScript1Api.js +84 -0
- package/dist/rules/noUnknownModuleMember.js +23 -0
- package/dist/rules/noUnknownOptions.js +31 -0
- package/dist/rules/noUnsupportedServerWidgetFieldType.js +40 -0
- package/dist/rules/noWeakHash.js +17 -0
- package/dist/rules/noWildcardCors.js +16 -0
- package/dist/rules/noWrongScriptTypeModules.js +30 -0
- package/dist/rules/requireClientValidateReturn.js +27 -0
- package/dist/rules/requireCustpagePrefix.js +23 -0
- package/dist/rules/requireEachReturn.js +38 -0
- package/dist/rules/requireLogModule.js +25 -0
- package/dist/rules/requireOptions.js +26 -0
- package/dist/rules/requireOrderByForPagedSuiteQL.js +17 -0
- package/dist/rules/requireQueryOptions.js +53 -0
- package/dist/rules/requireServerResponseOptions.js +33 -0
- package/dist/rules/requireServerWidgetOptions.js +37 -0
- package/package.json +3 -1
- package/dist/rules/noExtraModules.js +0 -23
package/README.md
CHANGED
|
@@ -15,17 +15,33 @@ npm i -D @biomejs/biome biome-plugin-suitescript
|
|
|
15
15
|
|
|
16
16
|
## Use
|
|
17
17
|
|
|
18
|
+
Extend one of the three configs. Each turns on the matching plugin preset, Biome's own recommended rules and the
|
|
19
|
+
native Biome rules that Oracle's documentation or agent skills ask for, and declares the SuiteScript globals
|
|
20
|
+
(`define`, `require`, `log`, `util`):
|
|
21
|
+
|
|
18
22
|
```jsonc
|
|
19
23
|
// biome.json
|
|
20
24
|
{
|
|
21
|
-
"extends": ["biome-plugin-suitescript/configs/
|
|
25
|
+
"extends": ["biome-plugin-suitescript/configs/recommended"],
|
|
22
26
|
"plugins": [
|
|
23
|
-
"biome-plugin-suitescript/
|
|
24
|
-
"biome-plugin-suitescript/noLogModule" // add individual rules on top of a preset
|
|
27
|
+
"biome-plugin-suitescript/noLogModule" // add individual rules on top
|
|
25
28
|
]
|
|
26
29
|
}
|
|
27
30
|
```
|
|
28
31
|
|
|
32
|
+
| Config | Enables |
|
|
33
|
+
| ---------------------------------------------- | ------------------------------------------------------------------------------------ |
|
|
34
|
+
| `biome-plugin-suitescript/configs/minimal` | `presets/minimal`, Biome's recommended rules (with `noUnusedFunctionParameters` off) |
|
|
35
|
+
| `biome-plugin-suitescript/configs/recommended` | `presets/recommended`, plus the native rules marked :green_circle: below |
|
|
36
|
+
| `biome-plugin-suitescript/configs/all` | `presets/all`, plus every native rule marked below |
|
|
37
|
+
|
|
38
|
+
The plugin presets (`biome-plugin-suitescript/presets/<name>`) alone only list this package's rules, because a
|
|
39
|
+
Biome plugin preset cannot enable native rules. Use them in `plugins` if you want to choose the native rules
|
|
40
|
+
yourself. `configs/suitescript2` only declares the globals.
|
|
41
|
+
|
|
42
|
+
Biome's `noUnusedFunctionParameters` is off in all three configs: a `define()` callback takes one parameter per
|
|
43
|
+
dependency (`noExtraParams`), so a module loaded for its side effects would otherwise be reported.
|
|
44
|
+
|
|
29
45
|
Run the tag checker beside `biome check` (see [Tag checker](#tag-checker)):
|
|
30
46
|
|
|
31
47
|
```sh
|
|
@@ -36,44 +52,156 @@ npx biome-plugin-suitescript check
|
|
|
36
52
|
|
|
37
53
|
Each rule has one fixed severity: `error` for things that fail at runtime or on upload, `warn` for conventions.
|
|
38
54
|
Biome plugins cannot be reconfigured per project, so you choose by enabling rules, scoping them, or generating one.
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
|
45
|
-
|
|
|
46
|
-
| `
|
|
47
|
-
| `
|
|
48
|
-
| `
|
|
49
|
-
| `
|
|
50
|
-
| `
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
|
55
|
-
|
|
|
56
|
-
| `
|
|
57
|
-
| `
|
|
58
|
-
| `
|
|
55
|
+
Rules are sorted by source tier, then severity, then preset, then name. How a rule's tier and place in a preset are
|
|
56
|
+
decided is in [docs/rule-priority.md](docs/rule-priority.md).
|
|
57
|
+
|
|
58
|
+
<!-- rules-table:start -->
|
|
59
|
+
|
|
60
|
+
| Rule | Severity | Presets | Description | Rule source |
|
|
61
|
+
| ---------------------------------------- | -------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
62
|
+
| `noBrowserGlobals` | error | :green_circle::large_blue_circle: | No `document`, `window`, `localStorage`, `XMLHttpRequest`, `alert`, `navigator`, `URLSearchParams` or `fetch` in server scripts | Tier 1: [SAFE guide](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/SKILL.md) · Tier 3: [Oracle help: FAQ](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_N3917921.html) |
|
|
63
|
+
| `noGlobalShadowing` | error | :green_circle::large_blue_circle: | No variable named `log` or `util` other than the N/log, N/util module itself | Tier 1: [upgrade skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-upgrade/SKILL.md) |
|
|
64
|
+
| `noMissingModules` | error | :green_circle::large_blue_circle: | A module used (`record.load()`) must be loaded in `define`/`import` (`log` and `util` are globals) | Tier 0: [ADR 0006](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0006-log-is-a-global-with-two-opposite-styles.md) · Tier 1: [upgrade skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-upgrade/SKILL.md), [learning skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-learning/SKILL.md) |
|
|
65
|
+
| `noModuleScopeApiCalls` | error | :green_circle::large_blue_circle: | No `N/` API calls while the `define` callback runs; initialize from entry points (calls that only build an object, `createColumn`, `createFilter`, `createSort` and `createSetting`, are skipped) | Tier 1: [SAFE guide](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/SKILL.md) |
|
|
66
|
+
| `noNativeIterators` | error | :green_circle::large_blue_circle: | No generator functions or `Symbol.iterator` (GraalJS) | Tier 1: [SAFE guide](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/SKILL.md) |
|
|
67
|
+
| `noSuiteQLTypeInSearch` | error | :green_circle::large_blue_circle: | No SuiteQL abbreviation (`PurchOrd`) as the `type` of `search.create` | Tier 1: [SAFE guide](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/SKILL.md) |
|
|
68
|
+
| `noSuiteScript1Api` | error | :green_circle::large_blue_circle: | No `nlapi*`/`nlobj*` or 1.0-only methods (`getFieldValue`, `getLineItemValue`, `e.getCode()`) | Tier 1: [upgrade skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-upgrade/SKILL.md) |
|
|
69
|
+
| `noHardcodedSecrets` | error | :key: | No string literal assigned to `password`, `secret`, `apiKey`, .... **Opt-in, in no preset: it guesses from names, so it can misfire on look-alike names** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) · Tier 3: [Oracle help: security considerations](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_159804448843.html) |
|
|
70
|
+
| `noDynamicRequire` | warn | :green_circle::large_blue_circle: | `require()` takes string literal module names, not expressions | Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) · Tier 4: [acdvs `no-dynamic-require`](https://github.com/acdvs/eslint-plugin-amd/blob/main/lib/rules/no-dynamic-require.ts) |
|
|
71
|
+
| `noDynamicSuiteQL` | warn | :green_circle::large_blue_circle: | `runSuiteQL` queries use `?` placeholders, not concatenation or template literals (calls that pass `params` are skipped) | Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
72
|
+
| `noInnerHtml` | warn | :green_circle::large_blue_circle: | No non-static value assigned to `innerHTML`/`outerHTML` or passed to `insertAdjacentHTML`/`document.write` (client scripts) | Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
73
|
+
| `noPostMessageWildcard` | warn | :green_circle::large_blue_circle: | No `'*'` target origin in `postMessage` | Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
74
|
+
| `noWildcardCors` | warn | :green_circle::large_blue_circle: | No `Access-Control-Allow-Origin: *` response header | Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
75
|
+
| `requireEachReturn` | warn | :green_circle::large_blue_circle: | A `.run().each` or `.iterator().each` callback returns a value (`true` to continue) | Tier 1: [upgrade skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-upgrade/SKILL.md), [learning skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-learning/SKILL.md) |
|
|
76
|
+
| `noRecordInLoop` | warn | :large_blue_circle: | No `record.load`, `query.runSuiteQL` or `search.create` inside loops or `forEach`/`each`/`map` callbacks | Tier 1: [SAFE guide](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/SKILL.md) |
|
|
77
|
+
| `requireLogModule` | warn | :large_blue_circle: | A used `log.*` needs `N/log` loaded (the upgrade skill recommends it; the global needs no loading) | Tier 0: [ADR 0006](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0006-log-is-a-global-with-two-opposite-styles.md) · Tier 1: [upgrade skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-upgrade/SKILL.md), [learning skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-suitescript-learning/SKILL.md) |
|
|
78
|
+
| `noInsecureCookie` | warn | :key: | A literal `Set-Cookie` value has `HttpOnly`, `Secure` and `SameSite`. **Opt-in, in no preset: only literal values are checked, and we have not confirmed a Suitelet may set `Set-Cookie`** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
79
|
+
| `noLocationHeader` | warn | :key: | No `Location` header built from a variable; use `N/redirect`. **Opt-in, in no preset: the value may already be validated, and the skill's references still set `Location` after sanitising it** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
80
|
+
| `noPublicFileUpload` | warn | :key: | No `isOnline: true` (public file). **Opt-in, in no preset: public assets legitimately set `isOnline`** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill: file upload](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/references/07-file-upload-download.md) |
|
|
81
|
+
| `noSensitiveBrowserStorage` | warn | :key: | No token- or password-named key in `localStorage`/`sessionStorage.setItem`. **Opt-in, in no preset: it guesses from the key name** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
82
|
+
| `noStackInResponse` | warn | :key: | No `.stack` inside `response.write`/`writeLine` arguments. **Opt-in, in no preset: a stack returned from a RESTlet is not detected, and the skill's own logging example includes `e.stack`** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
83
|
+
| `noSuiteQLSelectStar` | warn | :key: | No `SELECT *` in a literal SuiteQL query. **Opt-in, in no preset: the guide itself recommends a `SELECT * ... ROWNUM <= 1` probe, and only literal queries are seen** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [SAFE guide: performance](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/references/03-performance-optimization.md) |
|
|
84
|
+
| `noSuiteQLSystemNoteJoin` | warn | :key: | No `JOIN SystemNote` in a literal SuiteQL query. **Opt-in, in no preset: a tightly filtered join is fine, and only literal queries are seen** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [SAFE guide](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-sdf-safe-guide/SKILL.md) |
|
|
85
|
+
| `noWeakHash` | warn | :key: | No `HashAlg.MD5` or `HashAlg.SHA1`. **Opt-in, in no preset: it cannot tell a security use from a vendor integration that requires MD5 or SHA-1, and the type definitions list only `SHA256` and `SHA512` for `crypto.HashAlg`, so the member names come from the skill alone** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md) · Tier 1: [OWASP skill](https://github.com/oracle/netsuite-suitecloud-sdk/blob/master/packages/agent-skills/netsuite-owasp-secure-coding/SKILL.md) |
|
|
86
|
+
| `noAuthorizationHeaderInInternalRequest` | error | :green_circle::large_blue_circle: | No `Authorization` header in `https.requestRestlet`/`requestSuitelet`/`requestSuiteTalkRest` | Tier 2: [headintheclouddev `N/https`](https://github.com/headintheclouddev/typings-suitescript-2.0/blob/master/N/https.d.ts) · Tier 3: [Oracle help: https.requestRestlet](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_159139340774.html) |
|
|
87
|
+
| `noPositionalOptions` | error | :green_circle::large_blue_circle: | No literal passed where a module function takes an options object (`record.load('customer', 1)`) | Tier 2: [headintheclouddev `N/*`](https://github.com/headintheclouddev/typings-suitescript-2.0/tree/master/N) |
|
|
88
|
+
| `noSecretKeyGuidAndSecret` | error | :green_circle::large_blue_circle: | `https.createSecretKey` takes `guid` or `secret`, not both | Tier 2: [headintheclouddev `N/https`](https://github.com/headintheclouddev/typings-suitescript-2.0/blob/master/N/https.d.ts) · Tier 3: [Oracle help: https.createSecretKey](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4418247967.html) |
|
|
89
|
+
| `noUnknownModuleMember` | error | :green_circle::large_blue_circle: | Only members the type definitions export are read from an `N/` module (`record.loadRecord` is not one) | Tier 2: [headintheclouddev `N/*`](https://github.com/headintheclouddev/typings-suitescript-2.0/tree/master/N) |
|
|
90
|
+
| `noUnsupportedServerWidgetFieldType` | error | :green_circle::large_blue_circle: | No `DATETIME` in `addField` and no unsupported type in `List.addColumn` | Tier 2: [headintheclouddev `N/ui/serverWidget`](https://github.com/headintheclouddev/typings-suitescript-2.0/blob/master/N/ui/serverWidget.d.ts) · Tier 3: [Oracle help: serverWidget.FieldType](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4332671056.html) |
|
|
91
|
+
| `requireOptions` | error | :green_circle::large_blue_circle: | Every required option of a module function (`record.load`, `search.create`, `email.send`, ...) is present | Tier 2: [headintheclouddev `N/*`](https://github.com/headintheclouddev/typings-suitescript-2.0/tree/master/N) |
|
|
92
|
+
| `requireQueryOptions` | error | :green_circle::large_blue_circle: | Required `createColumn`/`createCondition`/`createSort` options (`fieldId` or `formula`, `type` with `formula`, ...) are present | Tier 2: [headintheclouddev `N/query`](https://github.com/headintheclouddev/typings-suitescript-2.0/blob/master/N/query.d.ts) · Tier 3: [Oracle help: Query.createColumn](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1510780373.html) |
|
|
93
|
+
| `requireServerResponseOptions` | error | :green_circle::large_blue_circle: | Required `response.setHeader`/`write`/`writeFile`/... options are present | Tier 2: [headintheclouddev `N/http`](https://github.com/headintheclouddev/typings-suitescript-2.0/blob/master/N/http.d.ts) · Tier 3: [Oracle help: ServerResponse](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4567652689.html) |
|
|
94
|
+
| `requireServerWidgetOptions` | error | :green_circle::large_blue_circle: | Required `addField`/`addButton`/`addSublist`/`addColumn`/... options (`id`, `label`, `type`, ...) are present | Tier 2: [headintheclouddev `N/ui/serverWidget`](https://github.com/headintheclouddev/typings-suitescript-2.0/blob/master/N/ui/serverWidget.d.ts) · Tier 3: [Oracle help: N/ui/serverWidget](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4321345532.html) |
|
|
95
|
+
| `noInvalidEnumMember` | warn | :large_blue_circle: | A member of a module enum (`record.Type.CUSTOMR`) is one the type definitions list | Tier 2: [headintheclouddev `N/*`](https://github.com/headintheclouddev/typings-suitescript-2.0/tree/master/N) |
|
|
96
|
+
| `noUnknownOptions` | warn | :large_blue_circle: | No option the type definitions do not list for a module function (`record.load({ typ: 'x' })`) | Tier 2: [headintheclouddev `N/*`](https://github.com/headintheclouddev/typings-suitescript-2.0/tree/master/N) |
|
|
97
|
+
| `entryPoints` | error | :green_circle::large_blue_circle: | Returned entry points must belong to one script type and include its required ones | Tier 3: [Oracle help: entry point validation](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4527904430.html), [Oracle help: validation errors](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4503568059.html) · Tier 4: [acdvs `entry-points`](https://github.com/acdvs/eslint-plugin-suitescript/blob/master/lib/rules/entry-points.ts), [btonasse `entry-points`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/entry-points.js) |
|
|
98
|
+
| `noBeforeSubmitRecordReload` | error | :green_circle::large_blue_circle: | No `record.load`/`submitFields`/`delete` of `context.newRecord.id` inside `beforeSubmit` | Tier 3: [Oracle help: script architecture](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/subsect_0804042112.html) |
|
|
99
|
+
| `noBlockedResponseHeader` | error | :green_circle::large_blue_circle: | No header NetSuite blocks on a Suitelet response (`Location`, `Server`, `Date`, ...) | Tier 3: [Oracle help: N/https](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4418229131.html) |
|
|
100
|
+
| `noConflictingClientScriptProps` | error | :green_circle::large_blue_circle: | Do not set both `clientScriptFileId` and `clientScriptModulePath` on a form | Tier 3: [Oracle help: Form.clientScriptModulePath](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4625445350.html) |
|
|
101
|
+
| `noInsecureHttpsUrl` | error | :green_circle::large_blue_circle: | No `http://` URL passed to `https.*` (N/https refuses plain HTTP) | Tier 3: [Oracle help: N/https](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4418229131.html) |
|
|
102
|
+
| `noMultipleDefine` | error | :green_circle::large_blue_circle: | A script calls `define()` only once | Tier 3: [Oracle help: entry point validation](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4527904430.html), [Oracle help: validation errors](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4503568059.html) |
|
|
103
|
+
| `noQueryColumnFieldAndFormula` | error | :green_circle::large_blue_circle: | A query column cannot set both `fieldId` and `formula` | Tier 3: [Oracle help: Column.fieldId](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1510788976.html), [Oracle help: Column.formula](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_1510789062.html) |
|
|
104
|
+
| `noRequireInsteadOfDefine` | error | :green_circle::large_blue_circle: | A script uses `define()`, not a top-level `require([...], cb)` | Tier 3: [Oracle help: invalid script example](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4527901694.html) |
|
|
105
|
+
| `noWrongScriptTypeModules` | error | :green_circle::large_blue_circle: | No client-only module (`N/currentRecord`, `N/ui/dialog`) in a server script, or a server-only one in a client script | Tier 3: [Oracle help: SuiteScript 2.1 modules](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4220488571.html) |
|
|
106
|
+
| `logRequireTitle` | warn | :green_circle::large_blue_circle: | `log.debug/audit/error/emergency({...})` needs `title` | Tier 0: [ADR 0002](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0002-options-are-separate-rules.md) · Tier 3: [Oracle help: log.debug](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4430385329.html) · Tier 4: [acdvs `log-args`](https://github.com/acdvs/eslint-plugin-suitescript/blob/master/lib/rules/log-args.ts), [btonasse `log-args`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/log-args.js) |
|
|
107
|
+
| `noBlockedHttpsHeader` | warn | :green_circle::large_blue_circle: | No header NetSuite discards from an `https.*` request (`Host`, `Content-Length`, ...) | Tier 3: [Oracle help: N/https](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4418229131.html) |
|
|
108
|
+
| `noEmptyEntryPoints` | warn | :green_circle::large_blue_circle: | A returned entry point with an empty body | Tier 3: [Oracle help: script architecture](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/subsect_0804042112.html) |
|
|
109
|
+
| `noHardcodedAuthPasswords` | warn | :green_circle::large_blue_circle: | No string literal passed as a password to `auth.changePassword`/`changeEmail` | Tier 3: [Oracle help: security considerations](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_159804448843.html), [Oracle help: auth.changePassword](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4298157647.html) |
|
|
110
|
+
| `noHeaderUnderscores` | warn | :green_circle::large_blue_circle: | No underscore in a custom `https.*` header name | Tier 3: [Oracle help: N/https](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4418229131.html) |
|
|
111
|
+
| `requireClientValidateReturn` | warn | :green_circle::large_blue_circle: | `saveRecord` and `validate*` return a value (only a body with no `return <value>` is flagged) | Tier 3: [Oracle help: saveRecord](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4410693749.html), [Oracle help: validateField](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4410693152.html) |
|
|
112
|
+
| `requireCustpagePrefix` | warn | :green_circle::large_blue_circle: | The `id` of a UI object added to an existing page (`context.form.addField`, ...) starts with `custpage` | Tier 3: [Oracle help: N/ui/serverWidget](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4321345532.html) |
|
|
113
|
+
| `requireOrderByForPagedSuiteQL` | warn | :green_circle::large_blue_circle: | A literal `runSuiteQLPaged` query has an `ORDER BY` | Tier 3: [Oracle help: query.runSuiteQLPaged](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_157960586441.html) |
|
|
114
|
+
| `noClientLog` | warn | :large_blue_circle: | `log.*` is ignored in client scripts attached to a form; use `console` | Tier 3: [Oracle help: N/log](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4574548135.html) |
|
|
115
|
+
| `noMapReduceSearchResults` | warn | :large_blue_circle: | `getInputData` returns the search object, not `getRange()` results | Tier 3: [Oracle help: map/reduce best practices](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_0801064715.html) |
|
|
116
|
+
| `noLogModule` | warn | :key: | Opt-in style: use the global `log`, not `N/log` (the opposite of `requireLogModule`). **Opt-in, in no preset: the opposite style to `requireLogModule`; enable only one** | Tier 0: [ADR 0005](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0005-guessing-rules-are-in-no-preset.md), [ADR 0006](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0006-log-is-a-global-with-two-opposite-styles.md) · Tier 3: [Oracle help: log object](https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/section_4387812838.html) · Tier 4: [acdvs `no-log-module`](https://github.com/acdvs/eslint-plugin-suitescript/blob/master/lib/rules/no-log-module.ts), [btonasse `no-log-module`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/no-log-module.js) |
|
|
117
|
+
| `noExtraParams` | error | :white_circle::green_circle::large_blue_circle: | More callback parameters than dependencies (the extra parameters are always `undefined`) | Tier 4: [btonasse `no-extra-modules`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/no-extra-modules.js), [acdvs `no-extra-params`](https://github.com/acdvs/eslint-plugin-amd/blob/main/lib/rules/no-extra-params.ts) |
|
|
118
|
+
| `noInvalidModules` | error | :white_circle::green_circle::large_blue_circle: | Unknown `N/...` modules | Tier 4: [acdvs `no-invalid-modules`](https://github.com/acdvs/eslint-plugin-suitescript/blob/master/lib/rules/no-invalid-modules.ts), [btonasse `no-invalid-modules`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/no-invalid-modules.js) |
|
|
119
|
+
| `noAmdName` | error | :green_circle::large_blue_circle: | No module id as the first `define` argument (fixable) | Tier 4: [btonasse `no-amd-name`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/no-amd-name.js), [acdvs `no-name`](https://github.com/acdvs/eslint-plugin-amd/blob/main/lib/rules/no-name.ts) |
|
|
120
|
+
| `noInvalidDefine` | error | :green_circle::large_blue_circle: | `define()` has one of the valid AMD shapes (a function or object factory, an optional name and dependency array) | Tier 4: [acdvs `no-invalid-define`](https://github.com/acdvs/eslint-plugin-amd/blob/main/lib/rules/no-invalid-define.ts) |
|
|
121
|
+
| `noModuleExtensions` | error | :green_circle::large_blue_circle: | No `.js` in `define` dependency names (fixable) | Tier 4: [btonasse `no-module-extensions`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/no-module-extensions.js), [acdvs `no-module-extensions`](https://github.com/acdvs/eslint-plugin-amd/blob/main/lib/rules/no-module-extensions.ts) |
|
|
122
|
+
| `noExtraDeps` | warn | :white_circle::green_circle::large_blue_circle: | More dependencies than callback parameters (the extra modules load but are unused) | Tier 4: [btonasse `no-extra-modules`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/no-extra-modules.js), [acdvs `no-extra-deps`](https://github.com/acdvs/eslint-plugin-amd/blob/main/lib/rules/no-extra-deps.ts) |
|
|
123
|
+
| `moduleVars` | warn | :green_circle::large_blue_circle: | Conventional identifier per `N/` module (`N/record` → `record`) | Tier 4: [acdvs `module-vars`](https://github.com/acdvs/eslint-plugin-suitescript/blob/master/lib/rules/module-vars.ts), [btonasse `module-vars`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/module-vars.js) |
|
|
124
|
+
| `logRequireDetails` | warn | :large_blue_circle: | ...needs `details` (Oracle marks it optional, so this house style is in `all` only) | Tier 0: [ADR 0002](https://github.com/nemchik/biome-plugin-suitescript/blob/main/docs/adr/0002-options-are-separate-rules.md) · Tier 4: [acdvs `log-args`](https://github.com/acdvs/eslint-plugin-suitescript/blob/master/lib/rules/log-args.ts), [btonasse `log-args`](https://github.com/btonasse/eslint-plugin-suitescript/blob/master/lib/rules/log-args.js) |
|
|
125
|
+
| `noGlobalEval` (Biome) | error | :green_circle::large_blue_circle: | No `eval()` (Oracle's OWASP skill: "Never use `eval`") | Tier 5: [Biome `noGlobalEval`](https://biomejs.dev/linter/rules/no-global-eval/) |
|
|
126
|
+
| `noImpliedEval` (Biome) | error | :green_circle::large_blue_circle: | No `new Function()` or string-form `setTimeout`/`setInterval` (OWASP skill) | Tier 5: [Biome `noImpliedEval`](https://biomejs.dev/linter/rules/no-implied-eval/) |
|
|
127
|
+
| `noVar` (Biome) | warn | :large_blue_circle: | Use `const`/`let`, not `var` (upgrade skill: "Modernize JavaScript") | Tier 5: [Biome `noVar`](https://biomejs.dev/linter/rules/no-var/) |
|
|
128
|
+
| `useConst` (Biome) | warn | :large_blue_circle: | Use `const` for never-reassigned bindings (upgrade skill) | Tier 5: [Biome `useConst`](https://biomejs.dev/linter/rules/use-const/) |
|
|
129
|
+
| `useForOf` (Biome) | warn | :large_blue_circle: | Use `for...of` where the index is only used to read (upgrade skill) | Tier 5: [Biome `useForOf`](https://biomejs.dev/linter/rules/use-for-of/) |
|
|
130
|
+
| `useIncludes` (Biome) | warn | :large_blue_circle: | Use `includes`, not `indexOf` (upgrade skill; needs type information, so it may report nothing) | Tier 5: [Biome `useIncludes`](https://biomejs.dev/linter/rules/use-includes/) |
|
|
131
|
+
| `useTemplate` (Biome) | warn | :large_blue_circle: | Use template literals, not string concatenation (upgrade skill) | Tier 5: [Biome `useTemplate`](https://biomejs.dev/linter/rules/use-template/) |
|
|
132
|
+
|
|
133
|
+
<!-- rules-table:end -->
|
|
134
|
+
|
|
135
|
+
Presets: :white_circle: `minimal` · :green_circle: `recommended` · :large_blue_circle: `all` (a superset of
|
|
136
|
+
`recommended`) · :key: in no preset, add the rule yourself (see [Opt-in rules](#opt-in-rules-and-typings)).
|
|
137
|
+
|
|
138
|
+
Rule source tiers: **Tier 0** a decision recorded as an ADR that overrides every source (it does not change where a
|
|
139
|
+
rule sorts) · **Tier 1** Oracle's SuiteCloud SDK agent skills · **Tier 2** type definitions · **Tier 3** Oracle
|
|
140
|
+
documentation · **Tier 4** SuiteScript-specific rules from other sources · **Tier 5** generic JavaScript rules (the native
|
|
141
|
+
Biome rules above). When sources conflict, the lower tier number wins. The table lists only the native Biome rules that a
|
|
142
|
+
Tier 1, 2 or 3 source asks for; Biome's other recommended rules are enabled by the configs too.
|
|
143
|
+
|
|
144
|
+
`noAmdName`, `noExtraDeps`, `noExtraParams`, `noModuleExtensions`, `noInvalidDefine` and `noDynamicRequire` only look
|
|
145
|
+
at `define()` and `require()` calls. The rest cover `import` too.
|
|
59
146
|
|
|
60
147
|
Suppress a diagnostic with `// biome-ignore lint/plugin: reason`.
|
|
61
148
|
|
|
149
|
+
### Opt-in rules and typings
|
|
150
|
+
|
|
151
|
+
The rules marked :key: are in no preset, because each one guesses and may misfire. Add the ones you want to
|
|
152
|
+
`plugins` yourself, for example `"biome-plugin-suitescript/noHardcodedSecrets"`. The reason each is left out is in
|
|
153
|
+
the table. `noHardcodedSecrets` matches names (`password`, `passwd`, `pwd`, `secret`, `apiKey`, `clientSecret`,
|
|
154
|
+
`tokenSecret`, `consumerSecret`, exact match only) rather than knowing a value is a credential. Oracle says "Don't
|
|
155
|
+
hard-code any passwords in scripts." Biome's `noSecrets`, which matches known token formats and high-entropy strings
|
|
156
|
+
instead, is not enabled in any config: on a real-world SuiteScript codebase (286 files) it reported 282 times, nearly
|
|
157
|
+
all false positives (log messages, NetSuite URLs, minified vendor files). Enable it yourself if you want it.
|
|
158
|
+
|
|
159
|
+
The rules assume you type-check against [`@hitc/netsuite-types`](https://github.com/headintheclouddev/typings-suitescript-2.0)
|
|
160
|
+
(the repository is named `typings-suitescript-2.0` but the typings are written for SuiteScript 2.1; the repository was
|
|
161
|
+
never renamed). They are credited as Tier 2 where a rule follows them, and they already reject wrong option names, missing parameters and positional-argument calls to N/ methods (their
|
|
162
|
+
signatures take an options object). For plain JavaScript projects, which get nothing from the typings, five rules
|
|
163
|
+
generated from the typings cover module-level functions and enums: `requireOptions`, `noUnknownOptions`,
|
|
164
|
+
`noPositionalOptions`, `noInvalidEnumMember` and `noUnknownModuleMember`. They resolve `record` in `record.load(...)`
|
|
165
|
+
from the `define()` or `import` binding, so they only fire on an `N/` module you loaded. Instance methods
|
|
166
|
+
(`rec.setValue`, `form.addField`) need the receiver's type, so only the hand-written `require*Options` rules look at
|
|
167
|
+
those, by name. The typings can lag a NetSuite release, so `noUnknownModuleMember` can report a member Oracle added
|
|
168
|
+
recently; refresh the data with `npm run sync-typings` after updating `@hitc/netsuite-types`.
|
|
169
|
+
|
|
170
|
+
### Logging and `N/log`
|
|
171
|
+
|
|
172
|
+
Oracle's help center says "NetSuite loads the log Object by default for all script types. You do not need to load it
|
|
173
|
+
manually", so `noMissingModules` leaves `log` (and `util`) alone. Oracle's two skills disagree: the upgrade skill says
|
|
174
|
+
the global exists but loading it is recommended, the learning skill says it is not global (the higher-ranked upgrade
|
|
175
|
+
skill and the documentation win). Two opposite styles are therefore available, and you should enable only one:
|
|
176
|
+
`requireLogModule` (in `all`) wants `N/log` loaded whenever `log.*` is used, following the upgrade skill's
|
|
177
|
+
recommendation; `noLogModule` (opt-in) wants the global.
|
|
178
|
+
|
|
179
|
+
### Native Biome rules
|
|
180
|
+
|
|
181
|
+
Rules Biome already ships are not reimplemented. `configs/recommended` enables `noGlobalEval` and `noImpliedEval` for
|
|
182
|
+
Oracle's OWASP skill, and `configs/all` adds the "Modernize JavaScript" rules from the upgrade skill
|
|
183
|
+
(`noVar`, `useConst`, `useTemplate`, `useIncludes`, `useForOf`). `noImpliedEval` and `useIncludes` are Biome nursery
|
|
184
|
+
rules, which may change or be renamed in a Biome release. `noBrowserGlobals` flags `alert` only in server scripts,
|
|
185
|
+
which Biome's `noAlert` cannot do because it has no notion of a script type.
|
|
186
|
+
|
|
62
187
|
### `entryPoints` and script types
|
|
63
188
|
|
|
64
189
|
Biome plugins cannot read comments, so the script type is **inferred from what the module returns**
|
|
65
190
|
(`beforeLoad` → User Event, `onRequest` → Suitelet, ...). The rule reports mixed entry points
|
|
66
191
|
(`pageInit` with `execute`) and missing required ones (Map/Reduce needs `getInputData` and `map` or `reduce`).
|
|
67
192
|
Modules that return no distinctive entry point are libraries and are ignored. Generic names such as
|
|
68
|
-
`get`, `post`, `map` and `run` alone never make a module a script.
|
|
193
|
+
`get`, `post`, `map` and `run` alone never make a module a script. `noWrongScriptTypeModules` follows Oracle's
|
|
194
|
+
"Supported Script Types" table, except for `N/ui/message`: the table lists it as client-only, but Suitelets and user
|
|
195
|
+
event `beforeLoad` scripts load it to build the message `Form.addPageInitMessage` shows, as Oracle's own FAQ sample
|
|
196
|
+
does.
|
|
69
197
|
|
|
70
198
|
### Choosing what to enforce
|
|
71
199
|
|
|
72
200
|
- **Pick rules.** `log-args`' two options are the separate `logRequireTitle` / `logRequireDetails` rules.
|
|
73
|
-
- **Scope with `includes`.** For example,
|
|
201
|
+
- **Scope with `includes`.** For example, keep `noRecordInLoop` away from Map/Reduce `map` files:
|
|
74
202
|
|
|
75
203
|
```jsonc
|
|
76
|
-
{ "path": "biome-plugin-suitescript/
|
|
204
|
+
{ "path": "biome-plugin-suitescript/noRecordInLoop", "includes": ["src/**", "!src/**/map-reduce/**"] }
|
|
77
205
|
```
|
|
78
206
|
- **Custom module identifiers.** Generate a rule with your own mapping (and omit `moduleVars`):
|
|
79
207
|
|
|
@@ -94,10 +222,12 @@ npx biome-plugin-suitescript check "src/**/*.ts" # or explicit globs
|
|
|
94
222
|
npx biome-plugin-suitescript check --format github # text (default) | json | github
|
|
95
223
|
```
|
|
96
224
|
|
|
97
|
-
It reports
|
|
225
|
+
It reports (the `@NApiVersion` and `@NScriptType` checks follow the `api-version` and `script-type` rules of both
|
|
226
|
+
[acdvs](https://github.com/acdvs/eslint-plugin-suitescript) and [btonasse](https://github.com/btonasse/eslint-plugin-suitescript)'s ESLint plugins):
|
|
98
227
|
|
|
99
228
|
- `@NApiVersion` other than `2.1` (2.0, 2.x, 1.0 and invalid values), or missing when the file is a script.
|
|
100
229
|
- `@NScriptType` with no or an invalid value, or missing when the returned entry points imply one.
|
|
230
|
+
- A module from the wrong side of the declared script type (for example `N/file` in a client script), or one the declared type does not support at all (`N/http`, `N/https`, `N/llm` and `N/sftp` in a custom tool; custom modules in a bundle installation script).
|
|
101
231
|
- A declared script type that does not match the returned entry points, or lacks its required ones.
|
|
102
232
|
|
|
103
233
|
Files with no tags and no implied entry points (libraries) are skipped. For scripts still on 1.0, 2.0 or 2.x, the
|