max / goingson

5.7 KB · 110 lines History Blame Raw

1	#!/bin/bash
2	# Frontend design-system lint guards.
3	# See docs/design-system.md "Inline-style rules" and docs/ux-audit/remediation-plan.md Step 10.
4	# Exit 0 = clean. Exit non-zero = violations found (printed with file:line).
5
6	set -u
7	ROOT="$(cd "$(dirname "$0")/.." && pwd)"
8	FRONTEND="$ROOT/src-tauri/frontend"
9	SRC_JS="$FRONTEND/js"
10	SRC_HTML="$FRONTEND/index.html $FRONTEND/compose.html"
11	SRC_CSS="$FRONTEND/css/styles.css"
12
13	violations=0
14
15	report() {
16	local rule="$1"; shift
17	local msg="$1"; shift
18	if [ -n "$*" ]; then
19	echo
20	echo "[$rule] $msg"
21	echo "$*"
22	violations=$((violations + 1))
23	fi
24	}
25
26	# 1. No raw hex literals in JS or source HTML (HTML entities &#NNNN; are OK;
27	# <meta name="theme-color"> is a documented exception — value is set
28	# programmatically by js/themes.js to track the active theme).
29	hits=$(grep -rnE '#[0-9a-fA-F]{3,8}\b' "$SRC_JS" $SRC_HTML 2>/dev/null \
30	\| grep -vE '&#[0-9]+;' \
31	\| grep -vE 'meta name="theme-color"' \
32	\|\| true)
33	report "no-raw-hex" "Raw hex literal in JS/HTML — use a CSS class or token instead." "$hits"
34
35	# 2. No style.cssText anywhere in JS.
36	hits=$(grep -rn 'cssText' "$SRC_JS" 2>/dev/null \|\| true)
37	report "no-csstext" "style.cssText injection — move styles into a CSS class." "$hits"
38
39	# 3. No var(--token, #fallback). Fallback hex defeats theme switching.
40	hits=$(grep -rnE 'var\(--[a-z-]+,\s#' "$FRONTEND" --include='.js' --include='*.html' --include='styles.css' 2>/dev/null \| grep -v styles.min.css \|\| true)
41	report "no-var-fallback-hex" "var(--token, #fallback) — drop the fallback; it bypasses themes." "$hits"
42
43	# 4. No window.confirm / bare confirm() — route through GoingsOn.ui.showConfirmDialog.
44	# Skip js/tests/: test fixtures carry attack payloads and mocks that
45	# legitimately contain `confirm(`/`alert(` as data, not as app calls.
46	hits=$(grep -rnE '\b(window\.)?confirm\(' "$SRC_JS" 2>/dev/null \| grep -v '/tests/' \| grep -vE 'showConfirmDialog\|confirmDelete\|//\s\\|\*\s' \|\| true)
47	report "no-window-confirm" "window.confirm() — use GoingsOn.ui.showConfirmDialog instead." "$hits"
48
49	# 5. No inline style= that touches color / background / border / shadow / font / padding values.
50	hits=$(grep -rnE 'style="[^"]*(color\|background\|border\|shadow\|font-size\|font-family\|padding)' "$SRC_JS" $SRC_HTML 2>/dev/null \|\| true)
51	report "no-styled-attrs" "Inline style= with color/background/border/shadow/font/padding — use a class." "$hits"
52
53	# 6. Deprecated empty-state classes have been removed.
54	hits=$(grep -rnE 'empty-dashboard-list\|kanban-empty\|virtual-scroller-empty' "$FRONTEND" --include='.js' --include='.html' --include='styles.css' 2>/dev/null \| grep -v styles.min.css \|\| true)
55	report "no-deprecated-empty-states" "Deprecated class — use .empty-state with --compact / --dashboard / --error." "$hits"
56
57	# 7. No native browser dialogs. Charter rule from Phase 7 roll-up.
58	# Skip js/tests/ (attack payloads / mocks reference these as data, not calls).
59	hits=$(grep -rnE '\b(window\.)?(confirm\|prompt\|alert)\(' "$SRC_JS" 2>/dev/null \
60	\| grep -v '/tests/' \
61	\| grep -vE 'showConfirmDialog\|showPromptDialog\|confirmDelete\|//\s\|\*\s' \|\| true)
62	report "no-native-dialogs" "window.confirm/prompt/alert are banned — use GoingsOn.ui.show{Confirm,Prompt}Dialog or showToast." "$hits"
63
64	# 8. Frontend JS test suite, including the CHRONIC-XSS escaping-enforcement gate
65	# (js/tests/run.js). GO has no CI and running node inside `cargo build` is an
66	# anti-pattern, so the gate lives here in the lint script that's run before a
67	# commit — wiring it in makes the "build-failing gate" literal rather than a
68	# test you have to remember to invoke. run.js exits non-zero on any failure.
69	if command -v node >/dev/null 2>&1; then
70	if ! js_out=$(node "$SRC_JS/tests/run.js" 2>&1); then
71	echo
72	echo "[frontend-js-tests] JS test suite failed (includes the CHRONIC-XSS escaping gate):"
73	echo "$js_out" \| tail -40
74	violations=$((violations + 1))
75	fi
76	else
77	echo "[frontend-js-tests] WARNING: node not found — skipping JS tests and the XSS gate"
78	fi
79
80	# 9. Inline event-handler ratchet (CSP `unsafe-inline` drawdown).
81	# Dropping `script-src 'unsafe-inline'` from tauri.conf.json requires
82	# converting every inline `on<event>="..."` handler to addEventListener — CSP
83	# has no nonce for inline handlers. That's a phased migration; this gate stops
84	# BACKSLIDING in the meantime: the occurrence count may only go DOWN. When you
85	# remove handlers, lower INLINE_HANDLER_BUDGET to the new count (the script
86	# prints the new number on progress). When it reaches 0 and the two inline
87	# <script> blocks (index.html, compose.html) are externalized, drop
88	# 'unsafe-inline' from the CSP. Tests and minified bundles are excluded.
89	INLINE_HANDLER_BUDGET=389
90	inline_count=$(grep -rlE "\bon[a-z]+=[\"']" "$FRONTEND" --include='.html' --include='.js' 2>/dev/null \
91	\| grep -v '/tests/' \| grep -v '\.min\.' \
92	\| tr '\n' '\0' \| xargs -0 grep -oE "\bon[a-z]+=[\"']" 2>/dev/null \| wc -l \| tr -d ' ')
93	if [ "$inline_count" -gt "$INLINE_HANDLER_BUDGET" ]; then
94	report "inline-handler-ratchet" \
95	"Inline event handlers rose to $inline_count (budget $INLINE_HANDLER_BUDGET). Don't add inline on= attributes; wire events with addEventListener (data- + delegation)." \
96	"count $inline_count > budget $INLINE_HANDLER_BUDGET"
97	elif [ "$inline_count" -lt "$INLINE_HANDLER_BUDGET" ]; then
98	echo "[inline-handler-ratchet] progress: $inline_count inline handlers (budget $INLINE_HANDLER_BUDGET)."
99	echo " Lower INLINE_HANDLER_BUDGET in scripts/lint-frontend.sh to $inline_count to lock in the gain."
100	fi
101
102	if [ $violations -eq 0 ]; then
103	echo "frontend lint: clean"
104	exit 0
105	else
106	echo
107	echo "frontend lint: $violations rule(s) failed"
108	exit 1
109	fi
110