Skip to content

Conversation

@TkDodo
Copy link
Collaborator

@TkDodo TkDodo commented Nov 24, 2025

This PR adds our first custom eslint rule, @sentry/scraps/no-token-import, which disallows importing our generated tokens except from within static/app/utils/theme.

I opted for a custom estlint rule instead of using no-restricted-import because:

  • I’d want to have a setup for custom rules anyways, and now we can easily add more
  • no-restricted-imports can report errors everywhere, and then we’d need to either disable it inside the file we want to allow, or have eslint override no-restriced-imports for our allowed location. But, if we do that, we also disable all the other restricted imports. Yes, this would be solvable by extracting them to a common object and re-spreading them, but I think the custom rule is much clearer and has a better error message. Focused rule are better than generic ones imo.

@linear
Copy link

linear bot commented Nov 24, 2025

@github-actions github-actions bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Nov 24, 2025
import invariant from 'invariant';
import typescript from 'typescript-eslint';

import * as sentryScrapsPlugin from './static/eslint/eslintPluginScraps/index.mjs';
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we can’t to .ts because that would require a build-step for the eslint config 😭

transform: {
'^.+\\.jsx?$': ['babel-jest', babelConfig as any],
'^.+\\.tsx?$': ['babel-jest', babelConfig as any],
'^.+\\.mjs?$': ['babel-jest', babelConfig as any],
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

jest can’t read mjs so we now transform it with babel like all other ts files

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

jest is just so weird. structuredClone exists in the node version we use but I think the jsdom env doesn’t see it? it exists in node:util to “polyfill” it but ts doesn’t know that. What a mess!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you could change the test env for this test, doesn't need to be jsdom https://jestjs.io/docs/configuration#testenvironment-string but some of the beforeEach etc might all break i guess

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I tried that and was hit with window is not defined or something similar :/

@TkDodo TkDodo marked this pull request as ready for review November 24, 2025 12:37
@TkDodo TkDodo requested a review from a team as a code owner November 24, 2025 12:37
@TkDodo TkDodo requested a review from a team November 24, 2025 12:37
},

create(context) {
const importerIsInAllowedDir = context.filename?.includes(EXCEPT_DIR_NAME);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: Path matching allows unintended directories

The includes() check for EXCEPT_DIR_NAME matches any path containing the substring 'static/app/utils/theme', which incorrectly allows imports from unintended directories like static/app/utils/theme-old/ or static/app/utils/themeConfig/. This violates the rule's intent to only allow imports from within the static/app/utils/theme/ directory. A proper directory boundary check is needed.

Fix in Cursor Fix in Web

TkDodo added a commit that referenced this pull request Nov 24, 2025
This ensures `.js` and `.mjs` files are type-checked (with jsdoc
comments) per default.

We’ll need this more when e.g. writing custom eslint rules, as they have
to be `.mjs` because we don’t have a typescript transform pipeline and
eslint can’t natively read ts.

see:
- #103889
@TkDodo TkDodo merged commit df18169 into master Nov 25, 2025
48 checks passed
@TkDodo TkDodo deleted the tkdodo/feat/de-555-we-forbid-imports-of-token-files-anywhere-besides-theme branch November 25, 2025 17:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Frontend Automatically applied to PRs that change frontend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants