biome-plugin-suitescript 0.1.1 → 0.3.0

package/dist/rules/noUnsupportedServerWidgetFieldType.js

@@ -0,0 +1,40 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue } from "../lib/options.js";
+const COLUMN_UNSUPPORTED = new Set([
+    "CHECKBOX",
+    "DATETIME",
+    "DATETIMETZ",
+    "FILE",
+    "HELP",
+    "INLINEHTML",
+    "LABEL",
+    "MULTISELECT",
+    "SELECT",
+    "RADIO",
+]);
+// Oracle (serverWidget.FieldType): "The DATETIME field type is not supported with
+// addField methods, you must specify DATETIMETZ." The type definitions
+// (N/ui/serverWidget.d.ts) have no DATETIME member in FieldType at all. Oracle also
+// says "The CHECKBOX, DATETIME,
+// DATETIMETZ, FILE, HELP, INLINEHTML, LABEL, MULTISELECT, SELECT, and RADIO field
+// types are not supported with List.addColumn(options)." Sublist.addField has its
+// own list but needs the receiver's type, so it is not checked.
+export const noUnsupportedServerWidgetFieldType = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const method = /\.(addField|addColumn)$/.exec(node.callee?.text ?? "")?.[1];
+        if (!method)
+            return;
+        const options = optionsObject(node);
+        const type = options && propertyValue(options, "type");
+        const member = /(^|\.)FieldType\.(\w+)$/.exec(type?.text ?? "")?.[2];
+        if (!type || !member)
+            return;
+        if ((method === "addField" && member === "DATETIME") ||
+            (method === "addColumn" && COLUMN_UNSUPPORTED.has(member))) {
+            registerDiagnostic(type, "error", method === "addField"
+                ? "DATETIME is not supported by addField; use DATETIMETZ."
+                : `${member} is not supported by List.addColumn.`);
+        }
+    },
+});

package/dist/rules/noWeakHash.js

@@ -0,0 +1,17 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+// Tier 0: docs/adr/0005-guessing-rules-are-in-no-preset.md.
+// Oracle's OWASP skill: "MD5 and SHA-1 are cryptographically broken" and "Use
+// SHA-256 as the minimum hashing algorithm. MD5 and SHA-1 are broken and must
+// never be used for security-sensitive operations." LOW CONFIDENCE, so no preset
+// includes it: it cannot tell a security use from a vendor integration that
+// requires MD5 or SHA-1. The type definitions (N/crypto.d.ts) list only SHA256 and
+// SHA512 in crypto.HashAlg, so the MD5 and SHA1 member names come from the skill
+// alone; the skill outranks the type definitions, so the rule stays.
+export const noWeakHash = defineRule({
+    query: ast("JS_STATIC_MEMBER_EXPRESSION"),
+    run(node) {
+        if (/(^|\.)HashAlg\.(MD5|SHA1)$/.test(node.text)) {
+            registerDiagnostic(node, "warning", "MD5 and SHA-1 are broken; use SHA-256 or stronger for security-sensitive hashing.");
+        }
+    },
+});

package/dist/rules/noWildcardCors.js

@@ -0,0 +1,16 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { headerCall } from "../lib/headers.js";
+import { stringValue } from "../lib/options.js";
+// Oracle's OWASP skill: "Setting `Access-Control-Allow-Origin: *` allows any
+// website to make cross-origin requests to the RESTlet, enabling data theft from
+// authenticated sessions", and "Use explicit CORS origin allowlist (never `*`)".
+export const noWildcardCors = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const header = headerCall(node);
+        if (header?.name === "access-control-allow-origin" &&
+            stringValue(header.value) === "*") {
+            registerDiagnostic(header.value ?? node, "warning", "Do not allow every origin with Access-Control-Allow-Origin: *; list the allowed origins.");
+        }
+    },
+});

package/dist/rules/noWrongScriptTypeModules.js

@@ -0,0 +1,30 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { dependencies } from "../lib/biome-modules.js";
+import { misplacedModule, sideOf, unsupportedModule, } from "../lib/module-script-types.js";
+import { inferredTypes } from "../lib/script-side.js";
+// Loading a client-only module in a server script (or the reverse), or a module
+// a script type does not support, fails at runtime. The type comes from the
+// entry points the module returns, so libraries and uninferable modules are
+// never flagged. The lists follow Oracle's "Supported Script Types" table, except
+// N/ui/message, which the table marks client-only but which server scripts load to
+// build the message that Form.addPageInitMessage shows (see module-script-types.ts).
+export const noWrongScriptTypeModules = defineRule({
+    query: ast("JS_CALL_EXPRESSION", "JS_IMPORT"),
+    run(node) {
+        const deps = dependencies(node);
+        if (deps.length === 0)
+            return;
+        const types = inferredTypes(node);
+        if (!types)
+            return;
+        const side = sideOf(types);
+        const single = types.length === 1 ? types[0]?.name : undefined;
+        for (const { name, nameNode } of deps) {
+            const message = name &&
+                ((side && misplacedModule(side, name)) ||
+                    (single && unsupportedModule(single, name)));
+            if (message && nameNode)
+                registerDiagnostic(nameNode, "error", message);
+        }
+    },
+});

package/dist/rules/requireClientValidateReturn.js

@@ -0,0 +1,27 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { descendants, functionName, scriptSide } from "../lib/script-side.js";
+const VALIDATORS = [
+    "saveRecord",
+    "validateField",
+    "validateLine",
+    "validateInsert",
+    "validateDelete",
+];
+// Oracle: saveRecord and validateField return "true ... false otherwise". Only a
+// body with no `return <value>` at all is flagged; code paths are not analysed.
+export const requireClientValidateReturn = defineRule({
+    query: ast("JS_FUNCTION_DECLARATION", "JS_FUNCTION_EXPRESSION", "JS_ARROW_FUNCTION_EXPRESSION", "JS_METHOD_OBJECT_MEMBER"),
+    run(node) {
+        const name = functionName(node);
+        if (!name || !VALIDATORS.includes(name))
+            return;
+        const body = node.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        if (!body || scriptSide(node) !== "client")
+            return;
+        for (const d of descendants(body)) {
+            if (d.kind === "JS_RETURN_STATEMENT" && d.children().length > 0)
+                return;
+        }
+        registerDiagnostic(node, "warning", `'${name}' must return true or false.`);
+    },
+});

package/dist/rules/requireCustpagePrefix.js

@@ -0,0 +1,23 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { optionsObject, propertyValue } from "../lib/options.js";
+// Receiver `context.form` (or `scriptContext.form`) is the form of the page being
+// loaded, an existing NetSuite page. Forms made with serverWidget.createForm are
+// standalone pages, and Oracle's own samples use unprefixed ids on them.
+const ADDERS = /\.form\.(addField|addButton|addSublist|addTab|addSubtab|addCredentialField|addSecretKeyField)$/;
+// Oracle (N/ui/serverWidget): "When you add a UI object to an existing NetSuite
+// page, to minimize the occurrence of field/object name conflicts, the internal ID
+// that references the object must be prefixed with custpage." Only a string
+// literal `id` is checked.
+export const requireCustpagePrefix = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!ADDERS.test(node.callee?.text ?? ""))
+            return;
+        const options = optionsObject(node);
+        const id = options && propertyValue(options, "id");
+        if (id?.kind === "JS_STRING_LITERAL_EXPRESSION" &&
+            !/^['"]custpage/.test(id.text)) {
+            registerDiagnostic(id, "warning", "The id of a UI object added to an existing page must start with 'custpage'.");
+        }
+    },
+});

package/dist/rules/requireEachReturn.js

@@ -0,0 +1,38 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { callArguments } from "../lib/options.js";
+import { isFunction } from "../lib/script-side.js";
+const EACH = /\.(run|iterator)\(\)\.each$/;
+/** Whether a function body returns a value, ignoring nested functions. */
+function returnsValue(node) {
+    for (const child of node.children()) {
+        if (isFunction(child))
+            continue;
+        if (child.kind === "JS_RETURN_STATEMENT" && child.children()[0])
+            return true;
+        if (returnsValue(child))
+            return true;
+    }
+    return false;
+}
+// Oracle's upgrade skill: "`.each()` callback must return `true` to continue
+// (stops on `false`)". A callback that never returns a value stops after the first
+// row without an error. Only `.run().each` and `.iterator().each` are checked. A
+// block body must return some value; an expression body that is a call (such as
+// `ids.push(id)`) returns whatever the call does, which is not `true`.
+export const requireEachReturn = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!EACH.test(node.callee?.text ?? ""))
+            return;
+        const callback = callArguments(node)[0];
+        if (!callback || !isFunction(callback))
+            return;
+        const body = callback.children().find((c) => c.kind === "JS_FUNCTION_BODY");
+        const flagged = body
+            ? !returnsValue(body)
+            : callback.children().at(-1)?.kind === "JS_CALL_EXPRESSION";
+        if (flagged) {
+            registerDiagnostic(callback, "warning", "The each() callback must return true to continue to the next row.");
+        }
+    },
+});

package/dist/rules/requireLogModule.js

@@ -0,0 +1,25 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { inSuiteScriptModule } from "../lib/suitescript.js";
+// Tier 0: docs/adr/0006-log-is-a-global-with-two-opposite-styles.md.
+// Load N/log when you call log.*. Oracle's upgrade skill says `log` is global but
+// "explicitly including it in `define()` makes dependencies clearer and is
+// recommended", and that practice is what this rule enforces. The help center's
+// "NetSuite loads the log Object by default for all script types. You do not need
+// to load it manually" is why noMissingModules leaves `log` alone. The learning
+// skill's "not globally available" loses: the documentation and the higher-ranked
+// upgrade skill both say it is global. This is the opposite style to noLogModule,
+// so enable only one of them.
+export const requireLogModule = defineRule({
+    query: semantic("JS_REFERENCE_IDENTIFIER"),
+    run(node, { model }) {
+        if (node.text !== "log" || model.binding(node))
+            return;
+        const member = node.parent?.parent;
+        if (member?.kind !== "JS_STATIC_MEMBER_EXPRESSION" ||
+            member.children()[0]?.text !== "log")
+            return;
+        if (!inSuiteScriptModule(node))
+            return;
+        registerDiagnostic(node, "warning", "'log' is used but N/log is not loaded.");
+    },
+});

package/dist/rules/requireOptions.js

@@ -0,0 +1,26 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleCall } from "../lib/module-calls.js";
+import { definedOptions } from "../lib/required-options.js";
+// The type definitions (Tier 2) say which options each module-level function
+// requires, and a missing one makes the call fail at runtime (Oracle's method
+// pages list it as SSS_MISSING_REQD_ARGUMENT). The receiver is resolved from the
+// define() or import binding, so `record.load` is checked only when `record` is
+// N/record. Only an options object literal without a spread is checked, and a
+// function with several call shapes passes when any shape is satisfied.
+export const requireOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const call = moduleCall(node, model);
+        if (!call || call.alternatives === 0)
+            return;
+        const defined = definedOptions(node);
+        if (!defined)
+            return;
+        const missing = call.alternatives
+            .map(([required]) => required.filter((name) => !defined.has(name)))
+            .sort((a, b) => a.length - b.length)[0];
+        for (const name of missing ?? []) {
+            registerDiagnostic(node, "error", `${call.callee}() needs the '${name}' option.`);
+        }
+    },
+});

package/dist/rules/requireOrderByForPagedSuiteQL.js

@@ -0,0 +1,17 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { staticSuiteql } from "../lib/suiteql.js";
+// Oracle (query.runSuiteQLPaged): "You must specify a sorting order in the query
+// definition when using this method to avoid duplicate or missing results. The
+// query definition must provide a unique and unambiguous sorting order with a
+// specified precedence." Only a query built from literals can be checked.
+export const requireOrderByForPagedSuiteQL = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        if (!/(^|\.)runSuiteQLPaged(\.promise)?$/.test(node.callee?.text ?? ""))
+            return;
+        const sql = staticSuiteql(node);
+        if (sql && !/\bORDER\s+BY\b/i.test(sql)) {
+            registerDiagnostic(node, "warning", "A paged SuiteQL query needs an ORDER BY to avoid duplicate or missing results.");
+        }
+    },
+});

package/dist/rules/requireQueryOptions.js

@@ -0,0 +1,53 @@
+import { defineRule, registerDiagnostic, semantic, } from "@biomejs/runtime/plugin";
+import { moduleOfReceiver } from "../lib/module-calls.js";
+import { MODULES } from "../lib/modules.js";
+import { definedOptions } from "../lib/required-options.js";
+// Oracle (N/query, Query.createColumn and createCondition): "options.fieldId:
+// required if options.formula is not used" and "options.type: required if
+// options.formula is used"; createCondition's `operator` is required and
+// createSort's `column` is required. The type definitions (N/query.d.ts) outrank
+// the page and give a formula-only condition its own overload without `operator`,
+// so `operator` is required only when there is no `formula`. They type `type?` as
+// optional with the formula, but their own comment says "Required if options.formula
+// is used", which agrees with the page. Only an options object literal without a
+// spread is checked. A receiver bound to another module is skipped:
+// `search.createColumn({ name })` is N/search, which takes different options. When
+// the binding cannot be resolved, a receiver named like another module's
+// conventional identifier (`search`) is skipped too.
+export const requireQueryOptions = defineRule({
+    query: semantic("JS_CALL_EXPRESSION"),
+    run(node, { model }) {
+        const callee = node.callee?.text ?? "";
+        const method = /(^|\.)(createColumn|createCondition|createSort)$/.exec(callee)?.[2];
+        if (!method)
+            return;
+        const receiver = node.callee?.children()[0];
+        const module = receiver && moduleOfReceiver(receiver, model);
+        if (module && module !== "N/query")
+            return;
+        const conventional = Object.entries(MODULES).find(([, identifier]) => identifier === receiver?.text)?.[0];
+        if (!module && conventional && conventional !== "N/query")
+            return;
+        const defined = definedOptions(node);
+        if (!defined)
+            return;
+        const problems = [];
+        if (method === "createSort") {
+            if (!defined.has("column"))
+                problems.push("needs the 'column' option");
+        }
+        else {
+            if (!defined.has("fieldId") && !defined.has("formula"))
+                problems.push("needs a 'fieldId' or a 'formula' option");
+            if (defined.has("formula") && !defined.has("type"))
+                problems.push("needs the 'type' option when it uses 'formula'");
+            if (method === "createCondition" &&
+                !defined.has("operator") &&
+                !defined.has("formula"))
+                problems.push("needs the 'operator' option");
+        }
+        for (const problem of problems) {
+            registerDiagnostic(node, "error", `${method}() ${problem}.`);
+        }
+    },
+});

package/dist/rules/requireServerResponseOptions.js

@@ -0,0 +1,33 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { definedOptions } from "../lib/required-options.js";
+const REQUIRED = {
+    addHeader: ["name", "value"],
+    getHeader: ["name"],
+    renderPdf: ["xmlString"],
+    sendRedirect: ["type", "identifier"],
+    setHeader: ["name", "value"],
+    write: ["output"],
+    writeFile: ["file"],
+    writeLine: ["output"],
+    writePage: ["pageObject"],
+};
+// Oracle (ServerResponse method pages): each method lists its required options and
+// throws SSS_MISSING_REQD_ARGUMENT without them. The type definitions
+// (N/http.d.ts) require the same options. Only calls on a receiver named
+// like a response, with an options object literal and no spread, are checked.
+export const requireServerResponseOptions = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const match = /response\.(\w+)$/i.exec(node.callee?.text ?? "");
+        const method = match?.[1];
+        const required = method && REQUIRED[method];
+        const defined = required && definedOptions(node);
+        if (!required || !defined)
+            return;
+        for (const name of required) {
+            if (!defined.has(name)) {
+                registerDiagnostic(node, "error", `${method}() needs the '${name}' option.`);
+            }
+        }
+    },
+});

package/dist/rules/requireServerWidgetOptions.js

@@ -0,0 +1,37 @@
+import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
+import { definedOptions } from "../lib/required-options.js";
+const LABELLED = ["id", "label"];
+const REQUIRED = {
+    addButton: ["label"],
+    addColumn: [...LABELLED, "type"],
+    addCredentialField: [...LABELLED, "restrictToDomains", "restrictToScriptIds"],
+    addField: [...LABELLED, "type"],
+    addFieldGroup: LABELLED,
+    addSecretKeyField: LABELLED,
+    addSublist: [...LABELLED, "type"],
+    addSubtab: LABELLED,
+    addTab: LABELLED,
+};
+// Oracle (N/ui/serverWidget method pages): each add method lists the options it
+// requires and throws SSS_MISSING_REQD_ARGUMENT without them. The type definitions
+// (N/ui/serverWidget.d.ts) outrank the pages and disagree on two methods: they make
+// addButton's `id` optional and addSecretKeyField's `restrictToScriptIds`
+// optional, where the pages require both, so those two follow the type
+// definitions. The receiver cannot
+// be typed, so a method of the same name on another object can misfire. Only an
+// options object literal without a spread is checked.
+export const requireServerWidgetOptions = defineRule({
+    query: ast("JS_CALL_EXPRESSION"),
+    run(node) {
+        const method = /\.(\w+)$/.exec(node.callee?.text ?? "")?.[1];
+        const required = method && REQUIRED[method];
+        const defined = required && definedOptions(node);
+        if (!required || !defined)
+            return;
+        for (const name of required) {
+            if (!defined.has(name)) {
+                registerDiagnostic(node, "error", `${method}() needs the '${name}' option.`);
+            }
+        }
+    },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "biome-plugin-suitescript",
-  "version": "0.1.1",
+  "version": "0.3.0",
   "description": "Biome lint plugins and a tag checker for NetSuite SuiteScript 2.1, ported from eslint-plugin-suitescript.",
   "keywords": [
     "biome-plugin",
@@ -41,7 +41,9 @@
     "format": "biome check --write",
     "lint": "biome lint",
     "prepack": "npm run build",
+    "readme": "node scripts/rules-table.ts",
     "sync-modules": "node scripts/sync-modules.ts",
+    "sync-typings": "node scripts/sync-typings.ts",
     "pretest": "npm run build",
     "test": "node --test test/*.test.ts",
     "typecheck": "tsc"

package/dist/rules/noExtraModules.js

@@ -1,23 +0,0 @@
-import { ast, defineRule, registerDiagnostic } from "@biomejs/runtime/plugin";
-import { parseDefine } from "../lib/define.js";
-export const noExtraModules = defineRule({
-    query: ast("JS_CALL_EXPRESSION"),
-    run(node) {
-        const def = parseDefine(node);
-        if (!def)
-            return;
-        const names = def.elements;
-        const params = def.params;
-        if (names.length > params.length) {
-            for (const extra of names.slice(params.length)) {
-                registerDiagnostic(extra, "error", `Excess module name ${extra.text}.`);
-            }
-        }
-        else if (params.length > names.length) {
-            for (const extra of params.slice(names.length)) {
-                if (extra)
-                    registerDiagnostic(extra, "error", `Excess module identifier '${extra.text}'.`);
-            }
-        }
-    },
-});