@sap/eslint-plugin-cds/lib/rules/auth-valid-restrict-keys.js

ESLint plugin including recommended SAP Cloud Application Programming model and environment rules

'use strict'

const { isEmptyObject, findFuzzy } = require('../utils/rules')

// These are the only valid properties inside `@restrict` annotations.
// They are described in <https://cap.cloud.sap/docs/guides/security/authorization#restrict-annotation>
const VALID_RESTRICT_PROPERTIES = ['grant', 'to', 'where']

module.exports = {
  meta: {
    schema: [{/* to avoid deprecation warning for ESLint 9 */}],
    docs: {
      description: '`@restrict` must not have properties besides `to`, `grant`, and `where`.',
      category: 'Model Validation',
      recommended: true,
      url: 'https://cap.cloud.sap/docs/tools/cds-lint/rules/auth-valid-restrict-keys',
    },
    messages: {
      misspelledProperty: "Misspelled or unknown property '{{invalid}}'. Did you mean '{{candidates}}'?",
      unknownProperty: "Unknown property '{{invalid}}'. Possible: ['to', 'grant', 'where']",
    },
    type: 'problem',
    model: 'inferred'
  },
  create (context) {
    return {
      any: checkRestrictKeys,
    }

    function checkRestrictKeys (e) {
      if (!Array.isArray(e?.['@restrict']))
        return

      for (const entry of e['@restrict']) {
        if (entry && typeof entry === 'object' && !isEmptyObject(entry)) {
          for (const key of Object.keys(entry)) {
            if (VALID_RESTRICT_PROPERTIES.includes(key))
              continue
            const candidates = findFuzzy(key, VALID_RESTRICT_PROPERTIES.sort(), null, false, 2)
            if (candidates.length === 0) {
              context.report({
                messageId: 'unknownProperty',
                data: { invalid: key },
                node: context.getNode(e),
                file: e.$location.file
              })
            } else {
              context.report({
                messageId: 'misspelledProperty',
                data: { invalid: key, candidates },
                node: context.getNode(e),
                file: e.$location.file
              })
            }
          }
        }
      }
    }
  }
}