biome-plugin-suitescript 0.1.1 → 0.3.0

package/biome-manifest.json

@@ -3,30 +3,122 @@
   "configs": [
     {
       "suitescript2": "./configs/suitescript2.json"
+    },
+    {
+      "minimal": "./configs/minimal.json"
+    },
+    {
+      "recommended": "./configs/recommended.json"
+    },
+    {
+      "all": "./configs/all.json"
     }
   ],
   "plugins": {
     "presets": {
       "all": [
         "noAmdName",
-        "noExtraModules",
+        "noExtraDeps",
+        "noExtraParams",
+        "noInvalidDefine",
         "noInvalidModules",
         "noModuleExtensions",
+        "noMultipleDefine",
+        "noRequireInsteadOfDefine",
+        "noDynamicRequire",
         "moduleVars",
         "logRequireTitle",
+        "entryPoints",
+        "noMissingModules",
+        "noGlobalShadowing",
+        "noDynamicSuiteQL",
+        "noSuiteScript1Api",
+        "noModuleScopeApiCalls",
+        "noNativeIterators",
+        "noWrongScriptTypeModules",
+        "noBrowserGlobals",
+        "noInsecureHttpsUrl",
+        "noBeforeSubmitRecordReload",
+        "noEmptyEntryPoints",
+        "requireCustpagePrefix",
+        "noHeaderUnderscores",
+        "noQueryColumnFieldAndFormula",
+        "requireClientValidateReturn",
+        "noPostMessageWildcard",
+        "noInnerHtml",
+        "noWildcardCors",
+        "noSuiteQLTypeInSearch",
+        "requireEachReturn",
+        "noAuthorizationHeaderInInternalRequest",
+        "noBlockedResponseHeader",
+        "noBlockedHttpsHeader",
+        "requireOptions",
+        "noPositionalOptions",
+        "noUnknownModuleMember",
+        "requireServerWidgetOptions",
+        "requireQueryOptions",
+        "requireServerResponseOptions",
+        "noConflictingClientScriptProps",
+        "noUnsupportedServerWidgetFieldType",
+        "noHardcodedAuthPasswords",
+        "noSecretKeyGuidAndSecret",
+        "requireOrderByForPagedSuiteQL",
         "logRequireDetails",
-        "noLogModule",
-        "entryPoints"
+        "noUnknownOptions",
+        "noInvalidEnumMember",
+        "requireLogModule",
+        "noRecordInLoop",
+        "noMapReduceSearchResults",
+        "noClientLog"
       ],
-      "minimal": ["noExtraModules", "noInvalidModules"],
+      "minimal": ["noExtraDeps", "noExtraParams", "noInvalidModules"],
       "recommended": [
         "noAmdName",
-        "noExtraModules",
+        "noExtraDeps",
+        "noExtraParams",
+        "noInvalidDefine",
         "noInvalidModules",
         "noModuleExtensions",
+        "noMultipleDefine",
+        "noRequireInsteadOfDefine",
+        "noDynamicRequire",
         "moduleVars",
         "logRequireTitle",
-        "logRequireDetails"
+        "entryPoints",
+        "noMissingModules",
+        "noGlobalShadowing",
+        "noDynamicSuiteQL",
+        "noSuiteScript1Api",
+        "noModuleScopeApiCalls",
+        "noNativeIterators",
+        "noWrongScriptTypeModules",
+        "noBrowserGlobals",
+        "noInsecureHttpsUrl",
+        "noBeforeSubmitRecordReload",
+        "noEmptyEntryPoints",
+        "requireCustpagePrefix",
+        "noHeaderUnderscores",
+        "noQueryColumnFieldAndFormula",
+        "requireClientValidateReturn",
+        "noPostMessageWildcard",
+        "noInnerHtml",
+        "noWildcardCors",
+        "noSuiteQLTypeInSearch",
+        "requireEachReturn",
+        "noAuthorizationHeaderInInternalRequest",
+        "noBlockedResponseHeader",
+        "noBlockedHttpsHeader",
+        "requireOptions",
+        "noPositionalOptions",
+        "noUnknownModuleMember",
+        "requireServerWidgetOptions",
+        "requireQueryOptions",
+        "requireServerResponseOptions",
+        "noConflictingClientScriptProps",
+        "noUnsupportedServerWidgetFieldType",
+        "noHardcodedAuthPasswords",
+        "noSecretKeyGuidAndSecret",
+        "requireOrderByForPagedSuiteQL"
       ]
     },
     "rules": [
@@ -46,16 +138,178 @@
         "noAmdName": "./dist/rules/noAmdName.grit"
       },
       {
-        "noExtraModules": "./dist/rules/noExtraModules.js"
+        "noAuthorizationHeaderInInternalRequest": "./dist/rules/noAuthorizationHeaderInInternalRequest.js"
+      },
+      {
+        "noBeforeSubmitRecordReload": "./dist/rules/noBeforeSubmitRecordReload.js"
+      },
+      {
+        "noBlockedHttpsHeader": "./dist/rules/noBlockedHttpsHeader.js"
+      },
+      {
+        "noBlockedResponseHeader": "./dist/rules/noBlockedResponseHeader.js"
+      },
+      {
+        "noBrowserGlobals": "./dist/rules/noBrowserGlobals.js"
+      },
+      {
+        "noClientLog": "./dist/rules/noClientLog.js"
+      },
+      {
+        "noConflictingClientScriptProps": "./dist/rules/noConflictingClientScriptProps.js"
+      },
+      {
+        "noDynamicRequire": "./dist/rules/noDynamicRequire.js"
+      },
+      {
+        "noDynamicSuiteQL": "./dist/rules/noDynamicSuiteQL.js"
+      },
+      {
+        "noEmptyEntryPoints": "./dist/rules/noEmptyEntryPoints.js"
+      },
+      {
+        "noExtraDeps": "./dist/rules/noExtraDeps.js"
+      },
+      {
+        "noExtraParams": "./dist/rules/noExtraParams.js"
+      },
+      {
+        "noGlobalShadowing": "./dist/rules/noGlobalShadowing.js"
+      },
+      {
+        "noHardcodedAuthPasswords": "./dist/rules/noHardcodedAuthPasswords.js"
+      },
+      {
+        "noHardcodedSecrets": "./dist/rules/noHardcodedSecrets.js"
+      },
+      {
+        "noHeaderUnderscores": "./dist/rules/noHeaderUnderscores.js"
+      },
+      {
+        "noInnerHtml": "./dist/rules/noInnerHtml.js"
+      },
+      {
+        "noInsecureCookie": "./dist/rules/noInsecureCookie.js"
+      },
+      {
+        "noInsecureHttpsUrl": "./dist/rules/noInsecureHttpsUrl.js"
+      },
+      {
+        "noInvalidDefine": "./dist/rules/noInvalidDefine.js"
+      },
+      {
+        "noInvalidEnumMember": "./dist/rules/noInvalidEnumMember.js"
       },
       {
         "noInvalidModules": "./dist/rules/noInvalidModules.js"
       },
+      {
+        "noLocationHeader": "./dist/rules/noLocationHeader.js"
+      },
       {
         "noLogModule": "./dist/rules/noLogModule.js"
       },
+      {
+        "noMapReduceSearchResults": "./dist/rules/noMapReduceSearchResults.js"
+      },
+      {
+        "noMissingModules": "./dist/rules/noMissingModules.js"
+      },
       {
         "noModuleExtensions": "./dist/rules/noModuleExtensions.grit"
+      },
+      {
+        "noModuleScopeApiCalls": "./dist/rules/noModuleScopeApiCalls.js"
+      },
+      {
+        "noMultipleDefine": "./dist/rules/noMultipleDefine.js"
+      },
+      {
+        "noNativeIterators": "./dist/rules/noNativeIterators.js"
+      },
+      {
+        "noPositionalOptions": "./dist/rules/noPositionalOptions.js"
+      },
+      {
+        "noPostMessageWildcard": "./dist/rules/noPostMessageWildcard.js"
+      },
+      {
+        "noPublicFileUpload": "./dist/rules/noPublicFileUpload.js"
+      },
+      {
+        "noQueryColumnFieldAndFormula": "./dist/rules/noQueryColumnFieldAndFormula.js"
+      },
+      {
+        "noRecordInLoop": "./dist/rules/noRecordInLoop.js"
+      },
+      {
+        "noRequireInsteadOfDefine": "./dist/rules/noRequireInsteadOfDefine.js"
+      },
+      {
+        "noSecretKeyGuidAndSecret": "./dist/rules/noSecretKeyGuidAndSecret.js"
+      },
+      {
+        "noSensitiveBrowserStorage": "./dist/rules/noSensitiveBrowserStorage.js"
+      },
+      {
+        "noStackInResponse": "./dist/rules/noStackInResponse.js"
+      },
+      {
+        "noSuiteQLSelectStar": "./dist/rules/noSuiteQLSelectStar.js"
+      },
+      {
+        "noSuiteQLSystemNoteJoin": "./dist/rules/noSuiteQLSystemNoteJoin.js"
+      },
+      {
+        "noSuiteQLTypeInSearch": "./dist/rules/noSuiteQLTypeInSearch.js"
+      },
+      {
+        "noSuiteScript1Api": "./dist/rules/noSuiteScript1Api.js"
+      },
+      {
+        "noUnknownModuleMember": "./dist/rules/noUnknownModuleMember.js"
+      },
+      {
+        "noUnknownOptions": "./dist/rules/noUnknownOptions.js"
+      },
+      {
+        "noUnsupportedServerWidgetFieldType": "./dist/rules/noUnsupportedServerWidgetFieldType.js"
+      },
+      {
+        "noWeakHash": "./dist/rules/noWeakHash.js"
+      },
+      {
+        "noWildcardCors": "./dist/rules/noWildcardCors.js"
+      },
+      {
+        "noWrongScriptTypeModules": "./dist/rules/noWrongScriptTypeModules.js"
+      },
+      {
+        "requireClientValidateReturn": "./dist/rules/requireClientValidateReturn.js"
+      },
+      {
+        "requireCustpagePrefix": "./dist/rules/requireCustpagePrefix.js"
+      },
+      {
+        "requireEachReturn": "./dist/rules/requireEachReturn.js"
+      },
+      {
+        "requireLogModule": "./dist/rules/requireLogModule.js"
+      },
+      {
+        "requireOptions": "./dist/rules/requireOptions.js"
+      },
+      {
+        "requireOrderByForPagedSuiteQL": "./dist/rules/requireOrderByForPagedSuiteQL.js"
+      },
+      {
+        "requireQueryOptions": "./dist/rules/requireQueryOptions.js"
+      },
+      {
+        "requireServerResponseOptions": "./dist/rules/requireServerResponseOptions.js"
+      },
+      {
+        "requireServerWidgetOptions": "./dist/rules/requireServerWidgetOptions.js"
       }
     ]
   },

package/configs/all.json

@@ -0,0 +1,29 @@
+{
+  "javascript": {
+    "globals": ["define", "require", "log", "util"]
+  },
+  "linter": {
+    "rules": {
+      "correctness": {
+        "noUnusedFunctionParameters": "off"
+      },
+      "nursery": {
+        "noImpliedEval": "error",
+        "useIncludes": "warn"
+      },
+      "preset": "recommended",
+      "security": {
+        "noGlobalEval": "error"
+      },
+      "style": {
+        "useConst": "warn",
+        "useForOf": "warn",
+        "useTemplate": "warn"
+      },
+      "suspicious": {
+        "noVar": "warn"
+      }
+    }
+  },
+  "plugins": ["biome-plugin-suitescript/presets/all"]
+}

package/configs/minimal.json

@@ -0,0 +1,14 @@
+{
+  "javascript": {
+    "globals": ["define", "require", "log", "util"]
+  },
+  "linter": {
+    "rules": {
+      "correctness": {
+        "noUnusedFunctionParameters": "off"
+      },
+      "preset": "recommended"
+    }
+  },
+  "plugins": ["biome-plugin-suitescript/presets/minimal"]
+}

package/configs/recommended.json

@@ -0,0 +1,20 @@
+{
+  "javascript": {
+    "globals": ["define", "require", "log", "util"]
+  },
+  "linter": {
+    "rules": {
+      "correctness": {
+        "noUnusedFunctionParameters": "off"
+      },
+      "nursery": {
+        "noImpliedEval": "error"
+      },
+      "preset": "recommended",
+      "security": {
+        "noGlobalEval": "error"
+      }
+    }
+  },
+  "plugins": ["biome-plugin-suitescript/presets/recommended"]
+}

package/dist/cli/analyze.js

@@ -1,6 +1,7 @@
 // Node-only analysis of a single SuiteScript source file (ESTree via oxc-parser).
 import { parseSync, } from "oxc-parser";
 import { declaredProblems, inferredProblems, inferScriptType, typeByName, } from "../lib/inference.js";
+import { misplacedModule, sideOf, unsupportedModule, } from "../lib/module-script-types.js";
 const API_VERSION = "2.1";
 const UPGRADABLE = new Set(["1.0", "2.0", "2.x"]);
 function isCallback(node) {
@@ -97,6 +98,7 @@ function exportedNames(node) {
 }
 function inspectProgram(program) {
     let isScript = false;
+    const modules = [];
     const returned = [];
     let opaque = false;
     // Only trust `returned` when an inline define() callback or ES syntax was seen;
@@ -106,8 +108,11 @@ function inspectProgram(program) {
         if (node.type === "ImportDeclaration" ||
             node.type === "ExportNamedDeclaration")
             known = true;
-        if (node.type === "ImportDeclaration" && /^N(\/|$)/.test(node.source.value))
+        if (node.type === "ImportDeclaration" &&
+            /^N(\/|$)/.test(node.source.value)) {
             isScript = true;
+            modules.push(node.source.value);
+        }
         if (node.type === "ExportNamedDeclaration")
             returned.push(...exportedNames(node));
         if (node.type === "ExpressionStatement" &&
@@ -115,6 +120,14 @@ function inspectProgram(program) {
             const call = node.expression;
             if (call.callee.type === "Identifier" && call.callee.name === "define") {
                 isScript = true;
+                const dependencies = call.arguments.at(-2);
+                if (dependencies?.type === "ArrayExpression") {
+                    for (const element of dependencies.elements) {
+                        if (element?.type === "Literal" &&
+                            typeof element.value === "string")
+                            modules.push(element.value);
+                    }
+                }
                 const callback = call.arguments.at(-1);
                 if (isCallback(callback)) {
                     const names = amdReturnedNames(callback);
@@ -132,7 +145,11 @@ function inspectProgram(program) {
             }
         }
     }
-    return { isScript, returned: opaque || !known ? undefined : returned };
+    return {
+        isScript,
+        modules,
+        returned: opaque || !known ? undefined : returned,
+    };
 }
 function findTag(comments, name) {
     const pattern = new RegExp(`${name}(?:[ \\t]+(\\S+))?`);
@@ -182,7 +199,7 @@ export function analyzeSource(filename, source) {
     }
     const apiVersion = findTag(parsed.comments, "@NApiVersion");
     const scriptType = findTag(parsed.comments, "@NScriptType");
-    const { isScript, returned } = inspectProgram(parsed.program);
+    const { isScript, modules, returned } = inspectProgram(parsed.program);
     const inferred = isScript && returned ? inferScriptType(returned) : undefined;
     // Not a script: no tags and nothing that implies an entry point.
     if (!apiVersion && !scriptType && !inferred)
@@ -223,5 +240,18 @@ export function analyzeSource(filename, source) {
         for (const message of problems)
             report("entryPoints", message, scriptType?.offset ?? 0);
     }
+    // The declared type wins; otherwise fall back to what the entry points imply.
+    const declaredType = declared ? typeByName(declared) : undefined;
+    const side = sideOf(declaredType ? [declaredType] : (inferred?.types ?? []));
+    const single = declaredType ??
+        (inferred?.types.length === 1 ? inferred.types[0] : undefined);
+    if (side || single) {
+        for (const module of modules) {
+            const message = (side && misplacedModule(side, module)) ||
+                (single && unsupportedModule(single.name, module));
+            if (message)
+                report("modules", message, scriptType?.offset ?? 0);
+        }
+    }
     return { diagnostics, upgrade };
 }

package/dist/lib/define.js

@@ -8,11 +8,38 @@ export function stringValue(node) {
         return undefined;
     return node.text.slice(1, -1);
 }
+/**
+ * The array literal a variable is initialised with, for `var dependencies = [...]`
+ * followed by `define(dependencies, ...)`. The first matching declaration in the
+ * file wins; a variable that is not an array literal is not resolved.
+ */
+function declaredArray(from, name) {
+    const root = [...from.ancestors()].at(-1);
+    const visit = (node) => {
+        if (node.kind === "JS_VARIABLE_DECLARATOR") {
+            const children = node.children();
+            const id = children.find((c) => c.kind === "JS_IDENTIFIER_BINDING");
+            const init = children.find((c) => c.kind === "JS_INITIALIZER_CLAUSE");
+            const value = init?.children()[0];
+            if (id?.text === name && value?.kind === "JS_ARRAY_EXPRESSION") {
+                return value;
+            }
+        }
+        for (const child of node.children()) {
+            const found = visit(child);
+            if (found)
+                return found;
+        }
+        return undefined;
+    };
+    return root ? visit(root) : undefined;
+}
 /**
  * Parses an AMD `define([...], function (...) {})` call.
  *
- * Returns undefined unless `call` is `define(...)` with a dependency array
- * followed by a function callback (the optional leading module id is allowed).
+ * Returns undefined unless `call` is `define(...)` with a dependency array (a
+ * literal, or a variable initialised with one) followed by a function callback (the
+ * optional leading module id is allowed).
  */
 export function parseDefine(call) {
     if (call.callee?.text !== "define")
@@ -20,11 +47,14 @@ export function parseDefine(call) {
     const args = call.arguments?.children()[0]?.children() ?? [];
     if (args.length < 2 || args.length > 3)
         return undefined;
-    const deps = args[args.length - 2];
+    const given = args[args.length - 2];
     const callback = args[args.length - 1];
-    if (!deps || !callback)
+    if (!given || !callback)
         return undefined;
-    if (deps.kind !== "JS_ARRAY_EXPRESSION")
+    const deps = given.kind === "JS_IDENTIFIER_EXPRESSION"
+        ? declaredArray(call, given.text)
+        : given;
+    if (deps?.kind !== "JS_ARRAY_EXPRESSION")
         return undefined;
     if (!FUNCTION_KINDS.includes(callback.kind))
         return undefined;

package/dist/lib/headers.js

@@ -0,0 +1,12 @@
+import { optionsObject, propertyValue, stringValue } from "./options.js";
+/** The header name and value nodes of `x.setHeader({ name, value })` or `addHeader`. */
+export function headerCall(call) {
+    if (!/\.(setHeader|addHeader)$/.test(call.callee?.text ?? ""))
+        return undefined;
+    const options = optionsObject(call);
+    const nameNode = options && propertyValue(options, "name");
+    const name = stringValue(nameNode)?.toLowerCase();
+    if (!options || !nameNode || !name)
+        return undefined;
+    return { name, nameNode, value: propertyValue(options, "value") };
+}

package/dist/lib/module-calls.js

@@ -0,0 +1,65 @@
+import { dependencies } from "./biome-modules.js";
+import { parseDefine, stringValue } from "./define.js";
+import { isFunction } from "./script-side.js";
+import { TYPINGS } from "./typings-data.js";
+const has = (object, key) => Object.hasOwn(object, key);
+/**
+ * The N/ module a receiver expression (`record` in `record.load`) is bound to by a
+ * define() callback parameter or an import. A local variable or parameter of the
+ * same name shadows it, and a global resolves to nothing.
+ */
+export function moduleOfReceiver(receiver, model) {
+    if (receiver.kind !== "JS_IDENTIFIER_EXPRESSION")
+        return undefined;
+    const reference = receiver.children()[0];
+    if (reference?.kind !== "JS_REFERENCE_IDENTIFIER")
+        return undefined;
+    const declaration = model.binding(reference)?.syntax();
+    if (!declaration)
+        return undefined;
+    const nearestFunction = declaration.ancestors().find(isFunction);
+    for (const ancestor of declaration.ancestors()) {
+        if (ancestor.kind === "JS_IMPORT") {
+            return dependencies(ancestor).find((d) => d.param?.text === declaration.text)?.name;
+        }
+        if (ancestor.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(ancestor);
+            if (def && nearestFunction?.text === def.callback.text) {
+                const index = def.params.findIndex((p) => p?.text === declaration.text);
+                return index >= 0 ? stringValue(def.elements[index]) : undefined;
+            }
+        }
+    }
+    return undefined;
+}
+/** The generated data for a module, if there is any. */
+export function typingsOf(module) {
+    return module && has(TYPINGS, module) ? TYPINGS[module] : undefined;
+}
+/** A call to a function of a loaded N/ module that the type definitions describe. */
+export function moduleCall(call, model) {
+    let callee = call.callee;
+    if (callee?.kind !== "JS_STATIC_MEMBER_EXPRESSION")
+        return undefined;
+    if (callee.children()[1]?.text === "promise") {
+        const inner = callee.children()[0];
+        if (inner?.kind !== "JS_STATIC_MEMBER_EXPRESSION")
+            return undefined;
+        callee = inner;
+    }
+    const [object, member] = callee.children();
+    if (!object || !member)
+        return undefined;
+    const module = moduleOfReceiver(object, model);
+    const typings = typingsOf(module);
+    if (!module || !typings || !has(typings.functions, member.text)) {
+        return undefined;
+    }
+    return {
+        alternatives: typings.functions[member.text],
+        callee: callee.text,
+        fn: member.text,
+        module,
+        typings,
+    };
+}

package/dist/lib/module-script-types.js

@@ -0,0 +1,76 @@
+// Which side of NetSuite a script type runs on, and the N/ modules that only
+// work on one side. From the "Supported Script Types" column of Oracle's SuiteScript
+// module reference; loading a module on the wrong side fails at runtime.
+// N/ui/message is not listed although the table marks it client-only. No agent
+// skill requires it to be client-only: the SAFE guide's complete Suitelet sample
+// (references/appendices/appendix-ncache-sample.md) loads it and passes
+// message.Type to Form.addPageInitMessage. The type definitions accept a message
+// there too (N/ui/serverWidget.d.ts). And Oracle's Form.addPageInitMessage page
+// (Suitelets and user event beforeLoad) and FAQ sample build the message on the
+// server. Only show() and hide() need a browser.
+// Pure logic shared by the Biome rules and the CLI.
+export const CLIENT_ONLY_MODULES = new Set([
+    "N/currentRecord",
+    "N/portlet",
+    "N/ui/dialog",
+]);
+export const SERVER_ONLY_MODULES = new Set([
+    "N/auth",
+    "N/cache",
+    "N/certificateControl",
+    "N/compress",
+    "N/config",
+    "N/crypto",
+    "N/crypto/certificate",
+    "N/dataset",
+    "N/documentCapture",
+    "N/encode",
+    "N/error",
+    "N/file",
+    "N/https/clientCertificate",
+    "N/keyControl",
+    "N/llm",
+    "N/machineTranslation",
+    "N/pgp",
+    "N/piremoval",
+    "N/plugin",
+    "N/redirect",
+    "N/render",
+    "N/sftp",
+    "N/task",
+    "N/task/accounting/recognition",
+    "N/ui/serverWidget",
+    "N/workbook",
+    "N/workflow",
+]);
+/** The side shared by every candidate script type, or undefined when unknown or mixed. */
+export function sideOf(types) {
+    if (types.length === 0)
+        return undefined;
+    const clients = types.filter((t) => t.name === "ClientScript").length;
+    if (clients === types.length)
+        return "client";
+    return clients === 0 ? "server" : undefined;
+}
+/** A message when `module` cannot be loaded by a script on `side`. */
+export function misplacedModule(side, module) {
+    if (side === "server" && CLIENT_ONLY_MODULES.has(module))
+        return `${module} is only available in client scripts.`;
+    if (side === "client" && SERVER_ONLY_MODULES.has(module))
+        return `${module} is only available in server scripts.`;
+    return undefined;
+}
+const CUSTOM_TOOL_UNSUPPORTED = new Set([
+    "N/http",
+    "N/https",
+    "N/llm",
+    "N/sftp",
+]);
+/** A message when a single script type cannot load `module` at all. */
+export function unsupportedModule(scriptType, module) {
+    if (scriptType === "CustomTool" && CUSTOM_TOOL_UNSUPPORTED.has(module))
+        return `${module} is not supported in custom tool scripts.`;
+    if (scriptType === "BundleInstallationScript" && !/^N(\/|$)/.test(module))
+        return "Custom modules are not supported in bundle installation scripts.";
+    return undefined;
+}