suitescript-verify 0.1.0 → 0.2.0

package/README.md

@@ -33,7 +33,7 @@ define(["N/record"], (record) => ({
 }));
 ```
 
-Every command that reaches the sandbox refuses an account that is not a sandbox (`digits_SBn`). The runner uses the script id `customscript_suitescript_verify_runner` and is limited to a role with the ID `customrole_suitescript_verify`, which you create in the sandbox.
+Every command that reaches the sandbox refuses an account that is not a sandbox (`digits_SBn`). The runner uses the script id `customscript_suitescript_verify_runner` and is limited to a role with the ID `customrole_suitescript_verify`, which you create in the sandbox. A project that names its own role sets `SUITESCRIPT_VERIFY_ROLE_ID` (for example `SUITESCRIPT_VERIFY_ROLE_ID=customrole_my_runner`); the generated SDF project uses it in the manifest and the runner. Like every `SUITESCRIPT_VERIFY_` setting it layers from the committed `verification/.env`, the gitignored `.env.local` and the process environment. The value must match `^customrole_[a-z0-9_]+$`; a bad value stops every command that reaches the sandbox, and the error names the key, never the value. `doctor` reports the id in use.
 
 See [docs/verification/README.md](docs/verification/README.md) and [docs/verification/lessons.md](docs/verification/lessons.md).
 

package/dist/cli.js

@@ -64,6 +64,7 @@ async function deploy(args) {
     const { files, slugs } = buildSdfProject(config.sdfDir, config.probesDir, {
         deployed: true,
         extraTags: config.extraTags,
+        roleId: config.roleId,
     });
     console.log(`Probes in the runner: ${slugs.join(", ") || "(none)"}`);
     console.log(`Files to upload: ${files.join(", ")}`);
@@ -92,6 +93,7 @@ async function cleanup(args) {
     buildSdfProject(config.sdfDir, config.probesDir, {
         deployed: false,
         extraTags: config.extraTags,
+        roleId: config.roleId,
     });
     return suitecloud(project, config, [
         "project:deploy",

package/dist/config.js

@@ -10,6 +10,10 @@ export const layoutKeys = [
 ];
 /** The committed `.env` may also register extra probe tags: a comma-separated list of tag names, not a path. */
 export const extraTagsKey = "SUITESCRIPT_VERIFY_EXTRA_TAGS";
+/** The committed `.env` may also name the runner role: a NetSuite custom role id. */
+export const roleIdKey = "SUITESCRIPT_VERIFY_ROLE_ID";
+export const defaultRoleId = "customrole_suitescript_verify";
+const roleIdPattern = /^customrole_[a-z0-9_]+$/;
 const tagName = /^[A-Za-z][A-Za-z0-9_-]*$/;
 /** The tag names in a registration value, without the `@`; blank entries are dropped. */
 export const parseTagList = (value) => value
@@ -49,11 +53,19 @@ const insideProject = (project, path) => {
 const looksSecret = (value) => /-----BEGIN /.test(value) ||
     /^eyJ[\w-]+\.[\w-]+\.[\w-]+$/.test(value) ||
     /^[A-Za-z0-9+_=-]{32,}$/.test(value);
+const roleIdProblem = (file) => ({
+    message: `${roleIdKey} in ${file} is not a NetSuite custom role id like customrole_suitescript_verify (lowercase letters, digits and underscores after customrole_).`,
+});
 /** Checks the committed `.env` against the allowlist. Messages name the key, never the value. */
 function checkCommitted(project, committed, file) {
     const problems = [];
     for (const [key, value] of committed) {
-        if (key === extraTagsKey) {
+        if (key === roleIdKey) {
+            // The pattern is the whole check: a valid id may be long enough to look like a token.
+            if (!roleIdPattern.test(value))
+                problems.push(roleIdProblem(file));
+        }
+        else if (key === extraTagsKey) {
             if (!parseTagList(value).every((name) => tagName.test(name))) {
                 problems.push({
                     message: `${key} in ${file} is not a comma-separated list of tag names like flavor,other.`,
@@ -67,7 +79,7 @@ function checkCommitted(project, committed, file) {
         }
         else if (!layoutKeys.includes(key)) {
             problems.push({
-                message: `${key} in ${file} is not a layout key. The committed file holds layout only (${[...layoutKeys, extraTagsKey].join(", ")}); put anything else in .env.local or the process environment.`,
+                message: `${key} in ${file} is not a layout key. The committed file holds layout only (${[...layoutKeys, extraTagsKey, roleIdKey].join(", ")}); put anything else in .env.local or the process environment.`,
             });
         }
         else if (!insideProject(project, value)) {
@@ -125,6 +137,13 @@ export function loadConfig(project, dir, processEnv = process.env) {
         }
     }
     const path = (key, fallback) => resolve(project, values[key] || fallback);
+    const roleId = values[roleIdKey] || defaultRoleId;
+    // The committed file reports its own bad value; this covers .env.local and the environment.
+    const committedRole = committed.get(roleIdKey);
+    const roleProblems = roleIdPattern.test(roleId) ||
+        (committedRole !== undefined && !roleIdPattern.test(committedRole))
+        ? []
+        : [roleIdProblem(".env.local or the environment")];
     const shown = relative(project, envFile).replaceAll("\\", "/");
     return {
         extraTags: parseTagList(values[extraTagsKey] ?? ""),
@@ -132,8 +151,10 @@ export function loadConfig(project, dir, processEnv = process.env) {
         problems: [
             ...checkCommitted(project, committed, shown),
             ...checkLocalIgnored(project, localFile),
+            ...roleProblems,
         ],
         resultsDir: path("SUITESCRIPT_VERIFY_RESULTS_DIR", "docs/verification/results"),
+        roleId,
         root,
         sdfDir: path("SUITESCRIPT_VERIFY_SDF_DIR", join(root, "sdf")),
         values,

package/dist/doctor.js

@@ -80,6 +80,7 @@ export function runChecks(project, config, env = process.env) {
     add("Project files: the probe, results and SDF folders exist and the SDF project has a default auth id", absent.length === 0 && authId !== "", absent.length > 0 ? "agent" : "maintainer", absent.length > 0
         ? "Run suitescript-verify init to create the missing folders."
         : "Run account:setup:ci from the SDF folder once the steps above pass, so project.json gets a default auth id.");
+    add(`Runner role id: ${config.roleId}`, true, "agent", "");
     return checks;
 }
 export function formatChecks(checks) {

package/dist/sdf.js

@@ -1,5 +1,6 @@
 import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { defaultRoleId } from "./config.js";
 import { fileCabinetFolder } from "./netsuite.js";
 import { isRestlet, listProbes, read, tagProblems, } from "./probes.js";
 import { UsageError } from "./shared.js";
@@ -24,7 +25,7 @@ export function generateRunner(probes, source) {
  * the SDF folder. Only RESTlet probes go in: the runner is a RESTlet. With
  * `deployed: false` the runner's deployment is switched off (cleanup).
  */
-export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], }) {
+export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], roleId = defaultRoleId, }) {
     const probes = listProbes(probesDir, extraTags).filter(isRestlet);
     const bad = probes.filter((probe) => tagProblems(probe).length > 0);
     if (bad.length > 0) {
@@ -39,9 +40,11 @@ export function buildSdfProject(sdfDir, probesDir, { deployed, extraTags = [], }
     mkdirSync(join(src, "Objects"), { recursive: true });
     writeFileSync(join(sdfDir, "package.json"), template("sdf/package.json"));
     writeFileSync(join(sdfDir, "suitecloud.config.js"), template("sdf/suitecloud.config.js"));
-    writeFileSync(join(src, "manifest.xml"), template("sdf/manifest.xml"));
+    writeFileSync(join(src, "manifest.xml"), template("sdf/manifest.xml").replaceAll("%%ROLE_ID%%", roleId));
     writeFileSync(join(src, "deploy.xml"), template("sdf/deploy.xml"));
-    writeFileSync(join(src, "Objects", "customscript_suitescript_verify_runner.xml"), template("sdf/runner.xml").replace("%%DEPLOYED%%", deployed ? "T" : "F"));
+    writeFileSync(join(src, "Objects", "customscript_suitescript_verify_runner.xml"), template("sdf/runner.xml")
+        .replace("%%DEPLOYED%%", deployed ? "T" : "F")
+        .replaceAll("%%ROLE_ID%%", roleId));
     const slugs = probes.map((probe) => probe.slug);
     const files = ["runner.js"];
     writeFileSync(join(folder, "runner.js"), generateRunner(probes, template("runner.template.js")));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "suitescript-verify",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Run probes in a NetSuite sandbox to verify what SuiteScript modules do, with guardrails for agents.",
   "keywords": [
     "suitescript",

package/templates/sdf/manifest.xml

@@ -6,7 +6,7 @@
       <feature required="true">SERVERSIDESCRIPTING</feature>
     </features>
     <objects>
-      <object>customrole_suitescript_verify</object>
+      <object>%%ROLE_ID%%</object>
     </objects>
   </dependencies>
 </manifest>

package/templates/sdf/runner.xml

@@ -7,7 +7,7 @@
   <scriptdeployments>
     <scriptdeployment scriptid="customdeploy_suitescript_verify_runner">
       <allroles>F</allroles>
-      <audslctrole>[customrole_suitescript_verify]</audslctrole>
+      <audslctrole>[%%ROLE_ID%%]</audslctrole>
       <isdeployed>%%DEPLOYED%%</isdeployed>
       <loglevel>DEBUG</loglevel>
       <status>RELEASED</status>