biome-plugin-suitescript 0.2.0 → 0.4.0

package/biome-manifest.json

@@ -3,59 +3,122 @@
   "configs": [
     {
       "suitescript2": "./configs/suitescript2.json"
+    },
+    {
+      "minimal": "./configs/minimal.json"
+    },
+    {
+      "recommended": "./configs/recommended.json"
+    },
+    {
+      "all": "./configs/all.json"
     }
   ],
   "plugins": {
     "presets": {
       "all": [
         "noAmdName",
-        "noExtraModules",
+        "noExtraDeps",
+        "noExtraParams",
+        "noInvalidDefine",
         "noInvalidModules",
         "noModuleExtensions",
+        "noMultipleDefine",
+        "noRequireInsteadOfDefine",
+        "noDynamicRequire",
         "moduleVars",
         "logRequireTitle",
-        "logRequireDetails",
+        "entryPoints",
         "noMissingModules",
         "noGlobalShadowing",
-        "noEval",
         "noDynamicSuiteQL",
         "noSuiteScript1Api",
         "noModuleScopeApiCalls",
+        "noNativeIterators",
         "noWrongScriptTypeModules",
         "noBrowserGlobals",
-        "noUserEventContextSave",
         "noInsecureHttpsUrl",
-        "entryPoints",
-        "noRecordInLoop",
-        "noNativeIterators",
         "noBeforeSubmitRecordReload",
         "noEmptyEntryPoints",
-        "noMapReduceSearchResults",
         "requireCustpagePrefix",
         "noHeaderUnderscores",
         "noQueryColumnFieldAndFormula",
         "requireClientValidateReturn",
+        "noPostMessageWildcard",
+        "noInnerHtml",
+        "noWildcardCors",
+        "noSuiteQLTypeInSearch",
+        "requireEachReturn",
+        "noAuthorizationHeaderInInternalRequest",
+        "noBlockedResponseHeader",
+        "noBlockedHttpsHeader",
+        "requireOptions",
+        "noPositionalOptions",
+        "noUnknownModuleMember",
+        "requireServerWidgetOptions",
+        "requireQueryOptions",
+        "requireServerResponseOptions",
+        "noConflictingClientScriptProps",
+        "noUnsupportedServerWidgetFieldType",
+        "noHardcodedAuthPasswords",
+        "noSecretKeyGuidAndSecret",
+        "requireOrderByForPagedSuiteQL",
+        "logRequireDetails",
+        "noUnknownOptions",
+        "noInvalidEnumMember",
+        "requireLogModule",
+        "noRecordInLoop",
+        "noMapReduceSearchResults",
         "noClientLog"
       ],
-      "minimal": ["noExtraModules", "noInvalidModules"],
+      "minimal": ["noExtraDeps", "noExtraParams", "noInvalidModules"],
       "recommended": [
         "noAmdName",
-        "noExtraModules",
+        "noExtraDeps",
+        "noExtraParams",
+        "noInvalidDefine",
         "noInvalidModules",
         "noModuleExtensions",
+        "noMultipleDefine",
+        "noRequireInsteadOfDefine",
+        "noDynamicRequire",
         "moduleVars",
         "logRequireTitle",
-        "logRequireDetails",
+        "entryPoints",
         "noMissingModules",
         "noGlobalShadowing",
-        "noEval",
         "noDynamicSuiteQL",
         "noSuiteScript1Api",
         "noModuleScopeApiCalls",
+        "noNativeIterators",
         "noWrongScriptTypeModules",
         "noBrowserGlobals",
-        "noUserEventContextSave",
-        "noInsecureHttpsUrl"
+        "noInsecureHttpsUrl",
+        "noBeforeSubmitRecordReload",
+        "noEmptyEntryPoints",
+        "requireCustpagePrefix",
+        "noHeaderUnderscores",
+        "noQueryColumnFieldAndFormula",
+        "requireClientValidateReturn",
+        "noPostMessageWildcard",
+        "noInnerHtml",
+        "noWildcardCors",
+        "noSuiteQLTypeInSearch",
+        "requireEachReturn",
+        "noAuthorizationHeaderInInternalRequest",
+        "noBlockedResponseHeader",
+        "noBlockedHttpsHeader",
+        "requireOptions",
+        "noPositionalOptions",
+        "noUnknownModuleMember",
+        "requireServerWidgetOptions",
+        "requireQueryOptions",
+        "requireServerResponseOptions",
+        "noConflictingClientScriptProps",
+        "noUnsupportedServerWidgetFieldType",
+        "noHardcodedAuthPasswords",
+        "noSecretKeyGuidAndSecret",
+        "requireOrderByForPagedSuiteQL"
       ]
     },
     "rules": [
@@ -74,15 +137,30 @@
       {
         "noAmdName": "./dist/rules/noAmdName.grit"
       },
+      {
+        "noAuthorizationHeaderInInternalRequest": "./dist/rules/noAuthorizationHeaderInInternalRequest.js"
+      },
       {
         "noBeforeSubmitRecordReload": "./dist/rules/noBeforeSubmitRecordReload.js"
       },
+      {
+        "noBlockedHttpsHeader": "./dist/rules/noBlockedHttpsHeader.js"
+      },
+      {
+        "noBlockedResponseHeader": "./dist/rules/noBlockedResponseHeader.js"
+      },
       {
         "noBrowserGlobals": "./dist/rules/noBrowserGlobals.js"
       },
       {
         "noClientLog": "./dist/rules/noClientLog.js"
       },
+      {
+        "noConflictingClientScriptProps": "./dist/rules/noConflictingClientScriptProps.js"
+      },
+      {
+        "noDynamicRequire": "./dist/rules/noDynamicRequire.js"
+      },
       {
         "noDynamicSuiteQL": "./dist/rules/noDynamicSuiteQL.js"
       },
@@ -90,26 +168,44 @@
         "noEmptyEntryPoints": "./dist/rules/noEmptyEntryPoints.js"
       },
       {
-        "noEval": "./dist/rules/noEval.js"
+        "noExtraDeps": "./dist/rules/noExtraDeps.js"
       },
       {
-        "noExtraModules": "./dist/rules/noExtraModules.js"
+        "noExtraParams": "./dist/rules/noExtraParams.js"
       },
       {
         "noGlobalShadowing": "./dist/rules/noGlobalShadowing.js"
       },
+      {
+        "noHardcodedAuthPasswords": "./dist/rules/noHardcodedAuthPasswords.js"
+      },
       {
         "noHardcodedSecrets": "./dist/rules/noHardcodedSecrets.js"
       },
       {
         "noHeaderUnderscores": "./dist/rules/noHeaderUnderscores.js"
       },
+      {
+        "noInnerHtml": "./dist/rules/noInnerHtml.js"
+      },
+      {
+        "noInsecureCookie": "./dist/rules/noInsecureCookie.js"
+      },
       {
         "noInsecureHttpsUrl": "./dist/rules/noInsecureHttpsUrl.js"
       },
+      {
+        "noInvalidDefine": "./dist/rules/noInvalidDefine.js"
+      },
+      {
+        "noInvalidEnumMember": "./dist/rules/noInvalidEnumMember.js"
+      },
       {
         "noInvalidModules": "./dist/rules/noInvalidModules.js"
       },
+      {
+        "noLocationHeader": "./dist/rules/noLocationHeader.js"
+      },
       {
         "noLogModule": "./dist/rules/noLogModule.js"
       },
@@ -125,20 +221,65 @@
       {
         "noModuleScopeApiCalls": "./dist/rules/noModuleScopeApiCalls.js"
       },
+      {
+        "noMultipleDefine": "./dist/rules/noMultipleDefine.js"
+      },
       {
         "noNativeIterators": "./dist/rules/noNativeIterators.js"
       },
+      {
+        "noPositionalOptions": "./dist/rules/noPositionalOptions.js"
+      },
+      {
+        "noPostMessageWildcard": "./dist/rules/noPostMessageWildcard.js"
+      },
+      {
+        "noPublicFileUpload": "./dist/rules/noPublicFileUpload.js"
+      },
       {
         "noQueryColumnFieldAndFormula": "./dist/rules/noQueryColumnFieldAndFormula.js"
       },
       {
         "noRecordInLoop": "./dist/rules/noRecordInLoop.js"
       },
+      {
+        "noRequireInsteadOfDefine": "./dist/rules/noRequireInsteadOfDefine.js"
+      },
+      {
+        "noSecretKeyGuidAndSecret": "./dist/rules/noSecretKeyGuidAndSecret.js"
+      },
+      {
+        "noSensitiveBrowserStorage": "./dist/rules/noSensitiveBrowserStorage.js"
+      },
+      {
+        "noStackInResponse": "./dist/rules/noStackInResponse.js"
+      },
+      {
+        "noSuiteQLSelectStar": "./dist/rules/noSuiteQLSelectStar.js"
+      },
+      {
+        "noSuiteQLSystemNoteJoin": "./dist/rules/noSuiteQLSystemNoteJoin.js"
+      },
+      {
+        "noSuiteQLTypeInSearch": "./dist/rules/noSuiteQLTypeInSearch.js"
+      },
       {
         "noSuiteScript1Api": "./dist/rules/noSuiteScript1Api.js"
       },
       {
-        "noUserEventContextSave": "./dist/rules/noUserEventContextSave.js"
+        "noUnknownModuleMember": "./dist/rules/noUnknownModuleMember.js"
+      },
+      {
+        "noUnknownOptions": "./dist/rules/noUnknownOptions.js"
+      },
+      {
+        "noUnsupportedServerWidgetFieldType": "./dist/rules/noUnsupportedServerWidgetFieldType.js"
+      },
+      {
+        "noWeakHash": "./dist/rules/noWeakHash.js"
+      },
+      {
+        "noWildcardCors": "./dist/rules/noWildcardCors.js"
       },
       {
         "noWrongScriptTypeModules": "./dist/rules/noWrongScriptTypeModules.js"
@@ -148,6 +289,27 @@
       },
       {
         "requireCustpagePrefix": "./dist/rules/requireCustpagePrefix.js"
+      },
+      {
+        "requireEachReturn": "./dist/rules/requireEachReturn.js"
+      },
+      {
+        "requireLogModule": "./dist/rules/requireLogModule.js"
+      },
+      {
+        "requireOptions": "./dist/rules/requireOptions.js"
+      },
+      {
+        "requireOrderByForPagedSuiteQL": "./dist/rules/requireOrderByForPagedSuiteQL.js"
+      },
+      {
+        "requireQueryOptions": "./dist/rules/requireQueryOptions.js"
+      },
+      {
+        "requireServerResponseOptions": "./dist/rules/requireServerResponseOptions.js"
+      },
+      {
+        "requireServerWidgetOptions": "./dist/rules/requireServerWidgetOptions.js"
       }
     ]
   },

package/configs/all.json

@@ -0,0 +1,29 @@
+{
+  "javascript": {
+    "globals": ["define", "require", "log", "util"]
+  },
+  "linter": {
+    "rules": {
+      "correctness": {
+        "noUnusedFunctionParameters": "off"
+      },
+      "nursery": {
+        "noImpliedEval": "error",
+        "useIncludes": "warn"
+      },
+      "preset": "recommended",
+      "security": {
+        "noGlobalEval": "error"
+      },
+      "style": {
+        "useConst": "warn",
+        "useForOf": "warn",
+        "useTemplate": "warn"
+      },
+      "suspicious": {
+        "noVar": "warn"
+      }
+    }
+  },
+  "plugins": ["biome-plugin-suitescript/presets/all"]
+}

package/configs/minimal.json

@@ -0,0 +1,14 @@
+{
+  "javascript": {
+    "globals": ["define", "require", "log", "util"]
+  },
+  "linter": {
+    "rules": {
+      "correctness": {
+        "noUnusedFunctionParameters": "off"
+      },
+      "preset": "recommended"
+    }
+  },
+  "plugins": ["biome-plugin-suitescript/presets/minimal"]
+}

package/configs/recommended.json

@@ -0,0 +1,20 @@
+{
+  "javascript": {
+    "globals": ["define", "require", "log", "util"]
+  },
+  "linter": {
+    "rules": {
+      "correctness": {
+        "noUnusedFunctionParameters": "off"
+      },
+      "nursery": {
+        "noImpliedEval": "error"
+      },
+      "preset": "recommended",
+      "security": {
+        "noGlobalEval": "error"
+      }
+    }
+  },
+  "plugins": ["biome-plugin-suitescript/presets/recommended"]
+}

package/dist/lib/define.js

@@ -8,11 +8,38 @@ export function stringValue(node) {
         return undefined;
     return node.text.slice(1, -1);
 }
+/**
+ * The array literal a variable is initialised with, for `var dependencies = [...]`
+ * followed by `define(dependencies, ...)`. The first matching declaration in the
+ * file wins; a variable that is not an array literal is not resolved.
+ */
+function declaredArray(from, name) {
+    const root = [...from.ancestors()].at(-1);
+    const visit = (node) => {
+        if (node.kind === "JS_VARIABLE_DECLARATOR") {
+            const children = node.children();
+            const id = children.find((c) => c.kind === "JS_IDENTIFIER_BINDING");
+            const init = children.find((c) => c.kind === "JS_INITIALIZER_CLAUSE");
+            const value = init?.children()[0];
+            if (id?.text === name && value?.kind === "JS_ARRAY_EXPRESSION") {
+                return value;
+            }
+        }
+        for (const child of node.children()) {
+            const found = visit(child);
+            if (found)
+                return found;
+        }
+        return undefined;
+    };
+    return root ? visit(root) : undefined;
+}
 /**
  * Parses an AMD `define([...], function (...) {})` call.
  *
- * Returns undefined unless `call` is `define(...)` with a dependency array
- * followed by a function callback (the optional leading module id is allowed).
+ * Returns undefined unless `call` is `define(...)` with a dependency array (a
+ * literal, or a variable initialised with one) followed by a function callback (the
+ * optional leading module id is allowed).
  */
 export function parseDefine(call) {
     if (call.callee?.text !== "define")
@@ -20,11 +47,14 @@ export function parseDefine(call) {
     const args = call.arguments?.children()[0]?.children() ?? [];
     if (args.length < 2 || args.length > 3)
         return undefined;
-    const deps = args[args.length - 2];
+    const given = args[args.length - 2];
     const callback = args[args.length - 1];
-    if (!deps || !callback)
+    if (!given || !callback)
         return undefined;
-    if (deps.kind !== "JS_ARRAY_EXPRESSION")
+    const deps = given.kind === "JS_IDENTIFIER_EXPRESSION"
+        ? declaredArray(call, given.text)
+        : given;
+    if (deps?.kind !== "JS_ARRAY_EXPRESSION")
         return undefined;
     if (!FUNCTION_KINDS.includes(callback.kind))
         return undefined;

package/dist/lib/headers.js

@@ -0,0 +1,12 @@
+import { optionsObject, propertyValue, stringValue } from "./options.js";
+/** The header name and value nodes of `x.setHeader({ name, value })` or `addHeader`. */
+export function headerCall(call) {
+    if (!/\.(setHeader|addHeader)$/.test(call.callee?.text ?? ""))
+        return undefined;
+    const options = optionsObject(call);
+    const nameNode = options && propertyValue(options, "name");
+    const name = stringValue(nameNode)?.toLowerCase();
+    if (!options || !nameNode || !name)
+        return undefined;
+    return { name, nameNode, value: propertyValue(options, "value") };
+}

package/dist/lib/module-calls.js

@@ -0,0 +1,65 @@
+import { dependencies } from "./biome-modules.js";
+import { parseDefine, stringValue } from "./define.js";
+import { isFunction } from "./script-side.js";
+import { TYPINGS } from "./typings-data.js";
+const has = (object, key) => Object.hasOwn(object, key);
+/**
+ * The N/ module a receiver expression (`record` in `record.load`) is bound to by a
+ * define() callback parameter or an import. A local variable or parameter of the
+ * same name shadows it, and a global resolves to nothing.
+ */
+export function moduleOfReceiver(receiver, model) {
+    if (receiver.kind !== "JS_IDENTIFIER_EXPRESSION")
+        return undefined;
+    const reference = receiver.children()[0];
+    if (reference?.kind !== "JS_REFERENCE_IDENTIFIER")
+        return undefined;
+    const declaration = model.binding(reference)?.syntax();
+    if (!declaration)
+        return undefined;
+    const nearestFunction = declaration.ancestors().find(isFunction);
+    for (const ancestor of declaration.ancestors()) {
+        if (ancestor.kind === "JS_IMPORT") {
+            return dependencies(ancestor).find((d) => d.param?.text === declaration.text)?.name;
+        }
+        if (ancestor.kind === "JS_CALL_EXPRESSION") {
+            const def = parseDefine(ancestor);
+            if (def && nearestFunction?.text === def.callback.text) {
+                const index = def.params.findIndex((p) => p?.text === declaration.text);
+                return index >= 0 ? stringValue(def.elements[index]) : undefined;
+            }
+        }
+    }
+    return undefined;
+}
+/** The generated data for a module, if there is any. */
+export function typingsOf(module) {
+    return module && has(TYPINGS, module) ? TYPINGS[module] : undefined;
+}
+/** A call to a function of a loaded N/ module that the type definitions describe. */
+export function moduleCall(call, model) {
+    let callee = call.callee;
+    if (callee?.kind !== "JS_STATIC_MEMBER_EXPRESSION")
+        return undefined;
+    if (callee.children()[1]?.text === "promise") {
+        const inner = callee.children()[0];
+        if (inner?.kind !== "JS_STATIC_MEMBER_EXPRESSION")
+            return undefined;
+        callee = inner;
+    }
+    const [object, member] = callee.children();
+    if (!object || !member)
+        return undefined;
+    const module = moduleOfReceiver(object, model);
+    const typings = typingsOf(module);
+    if (!module || !typings || !has(typings.functions, member.text)) {
+        return undefined;
+    }
+    return {
+        alternatives: typings.functions[member.text],
+        callee: callee.text,
+        fn: member.text,
+        module,
+        typings,
+    };
+}

package/dist/lib/module-script-types.js

@@ -1,12 +1,18 @@
 // Which side of NetSuite a script type runs on, and the N/ modules that only
 // work on one side. From the "Supported Script Types" column of Oracle's SuiteScript
 // module reference; loading a module on the wrong side fails at runtime.
+// N/ui/message is not listed although the table marks it client-only. No agent
+// skill requires it to be client-only: the SAFE guide's complete Suitelet sample
+// (references/appendices/appendix-ncache-sample.md) loads it and passes
+// message.Type to Form.addPageInitMessage. The type definitions accept a message
+// there too (N/ui/serverWidget.d.ts). And Oracle's Form.addPageInitMessage page
+// (Suitelets and user event beforeLoad) and FAQ sample build the message on the
+// server. Only show() and hide() need a browser.
 // Pure logic shared by the Biome rules and the CLI.
 export const CLIENT_ONLY_MODULES = new Set([
     "N/currentRecord",
     "N/portlet",
     "N/ui/dialog",
-    "N/ui/message",
 ]);
 export const SERVER_ONLY_MODULES = new Set([
     "N/auth",

package/dist/lib/options.js

@@ -0,0 +1,35 @@
+const unquote = (text) => text.replace(/^['"]|['"]$/g, "");
+/** The arguments of a call. */
+export function callArguments(call) {
+    return call.arguments?.children()[0]?.children() ?? [];
+}
+/** The members of an object literal (properties, methods and spreads). */
+export function objectMembers(object) {
+    return object.children()[0]?.children() ?? [];
+}
+/** The object literal passed as argument `index`, if it is one. */
+export function optionsObject(call, index = 0) {
+    const argument = callArguments(call)[index];
+    return argument?.kind === "JS_OBJECT_EXPRESSION" ? argument : undefined;
+}
+/** The value node of property `key` in an object literal. */
+export function propertyValue(object, key) {
+    for (const member of objectMembers(object)) {
+        if (member.kind !== "JS_PROPERTY_OBJECT_MEMBER")
+            continue;
+        const [name, value] = member.children();
+        if (name && unquote(name.text) === key)
+            return value;
+    }
+    return undefined;
+}
+/** Whether an object literal contains a spread, so its keys are not all known. */
+export function hasSpread(object) {
+    return objectMembers(object).some((m) => m.kind === "JS_SPREAD");
+}
+/** The text of a string literal without its quotes, or undefined for anything else. */
+export function stringValue(node) {
+    return node?.kind === "JS_STRING_LITERAL_EXPRESSION"
+        ? unquote(node.text)
+        : undefined;
+}

package/dist/lib/required-options.js

@@ -0,0 +1,14 @@
+import { hasSpread, objectMembers, optionsObject } from "./options.js";
+/** Names of the properties an options object literal defines, or undefined if a spread hides some. */
+export function definedOptions(call) {
+    const options = optionsObject(call);
+    if (!options || hasSpread(options))
+        return undefined;
+    const names = new Set();
+    for (const member of objectMembers(options)) {
+        const name = member.children()[0]?.text.replace(/^['"]|['"]$/g, "");
+        if (name)
+            names.add(name);
+    }
+    return names;
+}

package/dist/lib/script-types.js

@@ -33,6 +33,10 @@ export const SCRIPT_TYPES = [
         ],
         name: "ClientScript",
     },
+    {
+        entryPoints: [],
+        name: "ConsolidatedRateAdjustorPlugin",
+    },
     {
         entryPoints: ["customizeGlImpact"],
         name: "CustomGLPlugin",
@@ -46,21 +50,12 @@ export const SCRIPT_TYPES = [
         name: "DatasetBuilderPlugin",
     },
     {
-        entryPoints: [
-            "getConfigurationIFrameUrl",
-            "getAccounts",
-            "getTransactionData",
-        ],
-        name: "FiConnectivityPlugin",
+        entryPoints: [],
+        name: "EmailCapturePlugin",
     },
     {
-        entryPoints: [
-            "parseData",
-            "getStandardTransactionCodes",
-            "getExpenseCodes",
-            "getConfigurationPageUrl",
-        ],
-        name: "FiParserPlugin",
+        entryPoints: ["handle"],
+        name: "EventSubscriber",
     },
     {
         entryPoints: ["getInputData", "map", "reduce", "summarize"],
@@ -70,6 +65,10 @@ export const SCRIPT_TYPES = [
         entryPoints: ["each"],
         name: "MassUpdateScript",
     },
+    {
+        entryPoints: [],
+        name: "PaymentGatewayPlugin",
+    },
     {
         entryPoints: [],
         name: "PluginTypeImpl",
@@ -78,6 +77,10 @@ export const SCRIPT_TYPES = [
         entryPoints: ["render"],
         name: "Portlet",
     },
+    {
+        entryPoints: [],
+        name: "PromotionsPlugin",
+    },
     {
         entryPoints: ["delete", "get", "post", "put"],
         name: "Restlet",
@@ -90,6 +93,10 @@ export const SCRIPT_TYPES = [
         entryPoints: ["run"],
         name: "SDFInstallationScript",
     },
+    {
+        entryPoints: [],
+        name: "ShippingPartnersPlugin",
+    },
     {
         entryPoints: ["run"],
         name: "SpaClientScript",
@@ -102,13 +109,17 @@ export const SCRIPT_TYPES = [
         entryPoints: ["onRequest"],
         name: "Suitelet",
     },
+    {
+        entryPoints: [],
+        name: "TaxCalculationPlugin",
+    },
     {
         entryPoints: ["afterSubmit", "beforeLoad", "beforeSubmit"],
         name: "UserEventScript",
     },
     {
         entryPoints: ["createWorkbook"],
-        name: "WorkbookBbuilderPlugin",
+        name: "WorkbookBuilderPlugin",
     },
     {
         entryPoints: ["onAction"],