bpmnlint-plugin-camunda-compat 2.60.1 → 2.60.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bpmnlint-plugin-camunda-compat",
-  "version": "2.60.1",
+  "version": "2.60.2",
   "description": "A bpmnlint plug-in for Camunda compatibility",
   "main": "index.js",
   "scripts": {

package/rules/camunda-cloud/secrets.js

@@ -15,7 +15,13 @@ const { reportErrors } = require('../utils/reporter');
 
 const { skipInNonExecutableProcess } = require('../utils/rule');
 
-module.exports = skipInNonExecutableProcess(function() {
+const { greaterOrEqual } = require('../utils/version');
+
+// `camunda.secrets.<name>` only resolves on engines with this version or newer;
+// before that, `{{secrets.<name>}}` remains the only working format
+const CAMUNDA_SECRETS_FORMAT_ALLOWED_VERSION = '8.10';
+
+module.exports = skipInNonExecutableProcess(function({ version }) {
   function check(node, reporter) {
     const errors = [
       validateIoMapping,
@@ -33,66 +39,85 @@ module.exports = skipInNonExecutableProcess(function() {
     }
   }
 
-  return {
-    check
-  };
-});
+  function validateIoMapping(node) {
+    const ioMapping = findExtensionElement(node, 'zeebe:IoMapping');
 
-function validateIoMapping(node) {
-  const ioMapping = findExtensionElement(node, 'zeebe:IoMapping');
+    if (!ioMapping) {
+      return [];
+    }
 
-  if (!ioMapping) {
-    return [];
+    return ioMapping.get('inputParameters')
+      .filter(inputParameter => !isValidSecret(inputParameter.get('source')))
+      .map(inputParameter => getReport('source', inputParameter, node));
   }
 
-  return ioMapping.get('inputParameters')
-    .filter(inputParameter => !isValidSecret(inputParameter.get('source')))
-    .map(inputParameter => getReport('source', inputParameter, node));
-}
+  function validateProperties(node) {
+    const properties = findExtensionElement(node, 'zeebe:Properties');
 
-function validateProperties(node) {
-  const properties = findExtensionElement(node, 'zeebe:Properties');
+    if (!properties) {
+      return [];
+    }
 
-  if (!properties) {
-    return [];
+    return (properties.get('properties'))
+      .filter(property => !isValidSecret(property.get('value')))
+      .map(property => getReport('value', property, node));
   }
 
-  return (properties.get('properties'))
-    .filter(property => !isValidSecret(property.get('value')))
-    .map(property => getReport('value', property, node));
-}
+  function validateSubscription(node) {
+    let message;
 
-function validateSubscription(node) {
-  let message;
+    if (is(node, 'bpmn:ReceiveTask')) {
+      message = node.get('messageRef');
+    } else {
+      const messageEventDefinition = getEventDefinition(node, 'bpmn:MessageEventDefinition');
 
-  if (is(node, 'bpmn:ReceiveTask')) {
-    message = node.get('messageRef');
-  } else {
-    const messageEventDefinition = getEventDefinition(node, 'bpmn:MessageEventDefinition');
+      if (!messageEventDefinition) {
+        return [];
+      }
 
-    if (!messageEventDefinition) {
+      message = messageEventDefinition.get('messageRef');
+    }
+
+    if (!message) {
       return [];
     }
 
-    message = messageEventDefinition.get('messageRef');
-  }
+    const subscription = findExtensionElement(message, 'zeebe:Subscription');
 
-  if (!message) {
-    return [];
-  }
+    if (!subscription) {
+      return [];
+    }
 
-  const subscription = findExtensionElement(message, 'zeebe:Subscription');
+    const correlationKey = subscription.get('correlationKey');
 
-  if (!subscription) {
-    return [];
+    return isValidSecret(correlationKey)
+      ? []
+      : [ getReport('correlationKey', subscription, node) ];
   }
 
-  const correlationKey = subscription.get('correlationKey');
+  function isValidSecret(value) {
+    if (!value || !isString(value) || !value.includes('secrets.')) {
+      return true;
+    }
 
-  return isValidSecret(correlationKey)
-    ? []
-    : [ getReport('correlationKey', subscription, node) ];
-}
+    // the current, opt-in `camunda.secrets.<name>` format is always accepted
+    if (/camunda\.secrets\.[\w-]+/.test(value)) {
+      return true;
+    }
+
+    // once the engine supports `camunda.secrets.<name>`, any remaining
+    // `secrets.<name>` reference (wrapped or not) is considered outdated
+    if (greaterOrEqual(version, CAMUNDA_SECRETS_FORMAT_ALLOWED_VERSION)) {
+      return false;
+    }
+
+    return /{{\s*secrets\.[\w-]+\s*}}/.test(value);
+  }
+
+  return {
+    check
+  };
+});
 
 function getReport(propertyName, node, parentNode) {
   const path = getPath(node, parentNode);
@@ -104,14 +129,8 @@ function getReport(propertyName, node, parentNode) {
       type: ERROR_TYPES.SECRET_EXPRESSION_FORMAT_DEPRECATED,
       node,
       parentNode: parentNode,
-      property: propertyName
+      property: propertyName,
+      allowedVersion: CAMUNDA_SECRETS_FORMAT_ALLOWED_VERSION
     }
   };
 }
-
-function isValidSecret(value) {
-  return !value
-    || !isString(value)
-    || !value.includes('secrets.')
-    || /{{\s*secrets\.[\w-]+\s*}}/.test(value);
-}