Vendure Plugin Reviewing

Purpose

Audit Vendure plugins for violations of best practices, security issues, and anti-patterns.

When NOT to Use

• Creating new plugins (use vendure-plugin-writing)
• GraphQL-only review (use vendure-graphql-reviewing)
• Entity-only review (use vendure-entity-reviewing)

Review Workflow

Step 1: Identify Plugin Files

# Find all plugin files
find . -name "*.plugin.ts" -o -name "*-plugin.ts"

# Find all service files
find . -name "*.service.ts"

# Find all entity files
find . -name "*.entity.ts"

Step 2: Run Automated Checks

# === CRITICAL VIOLATIONS ===

# Missing @VendurePlugin decorator
grep -rn "export class.*Plugin" --include="*plugin.ts" | grep -v "@VendurePlugin"

# Missing PluginCommonModule import
grep -rn "@VendurePlugin" --include="*plugin.ts" -A 10 | grep -v "PluginCommonModule"

# Direct database access (bypassing TransactionalConnection)
grep -rn "getRepository\|createQueryBuilder\|getConnection" --include="*.service.ts" | grep -v "TransactionalConnection"

# === HIGH PRIORITY ===

# Missing @Injectable on services
grep -rn "export class.*Service" --include="*.service.ts" | grep -v "@Injectable"

# Hardcoded configuration values
grep -rn "localhost\|127.0.0.1\|apiKey.*=.*['\"]" --include="*.plugin.ts" --include="*.service.ts"

# Missing RequestContext parameter
grep -rn "async.*\(" --include="*.service.ts" | grep -v "ctx.*RequestContext\|RequestContext.*ctx"

# === MEDIUM PRIORITY ===

# Missing init() static method
grep -rn "export class.*Plugin" --include="*plugin.ts" -A 20 | grep -v "static init"

# Missing default options
grep -rn "this.options = options" --include="*plugin.ts" | grep -v "...default\|...options"

# Missing lifecycle cleanup
grep -rn "onApplicationBootstrap" --include="*plugin.ts" | xargs -I{} sh -c 'grep -L "onApplicationShutdown" {} 2>/dev/null'

Step 3: Manual Review Checklist

Plugin Structure

• @VendurePlugin decorator present
• PluginCommonModule in imports
• All entities in entities array
• All services in providers array
• Static init() method with defaults
• Options interface with types

Services

• @Injectable() decorator on all services
• RequestContext as first parameter
• TransactionalConnection for DB access
• No direct TypeORM repository access
• Proper error handling

Lifecycle

• OnApplicationBootstrap if initialization needed
• OnApplicationShutdown if cleanup needed
• Async/await on lifecycle methods
• Strategy init() calls in bootstrap

Configuration

• Options interface defined
• Default values for all options
• No hardcoded secrets
• Environment variable usage for sensitive data

Severity Classification

CRITICAL (Must Fix Before Merge)

• Missing @VendurePlugin decorator
• Direct database access bypassing services
• Missing PluginCommonModule import
• Hardcoded secrets or API keys
• Security vulnerabilities

HIGH (Should Fix Before Merge)

• Missing @Injectable decorator
• Missing RequestContext in service methods
• Hardcoded configuration values
• Missing error handling
• No default options

MEDIUM (Should Fix)

• Missing lifecycle cleanup (shutdown)
• No configuration validation
• Poor naming conventions
• Missing TypeScript types

LOW (Suggestions)

• Missing documentation
• Could use better error messages
• Performance improvements possible

Review Output Template

## Vendure Plugin Review: [Plugin Name]

### Summary

[Brief overview of plugin purpose and review findings]

### Critical Issues (Must Fix)

- [ ] [Issue description] - `file:line`

### High Priority

- [ ] [Issue description] - `file:line`

### Medium Priority

- [ ] [Issue description] - `file:line`

### Passed Checks

- [x] @VendurePlugin decorator present
- [x] PluginCommonModule imported
- [x] All services @Injectable

### Recommendations

- [Improvement suggestions]

Common Violations

1. Missing PluginCommonModule

Violation:

@VendurePlugin({
  imports: [],  // Missing PluginCommonModule!
  providers: [MyService],
})

Fix:

@VendurePlugin({
  imports: [PluginCommonModule],
  providers: [MyService],
})

2. Direct Database Access

Violation:

@Injectable()
export class MyService {
  constructor(
    @InjectRepository(MyEntity) // WRONG
    private repo: Repository<MyEntity>,
  ) {}
}

Fix:

@Injectable()
export class MyService {
  constructor(
    private connection: TransactionalConnection, // CORRECT
  ) {}

  async findAll(ctx: RequestContext) {
    return this.connection.getRepository(ctx, MyEntity).find();
  }
}

3. Missing RequestContext

Violation:

async findAll(): Promise<MyEntity[]> {  // Missing ctx!
  return this.connection.getRepository(MyEntity).find();
}

Fix:

async findAll(ctx: RequestContext): Promise<MyEntity[]> {
  return this.connection.getRepository(ctx, MyEntity).find();
}

4. Hardcoded Options

Violation:

static init(options: MyOptions): typeof MyPlugin {
  this.options = options;  // No defaults!
  return MyPlugin;
}

Fix:

static init(options: MyOptions = {}): typeof MyPlugin {
  this.options = {
    ...defaultOptions,  // Always merge with defaults
    ...options,
  };
  return MyPlugin;
}

5. Strategy Without Lifecycle

Violation:

static init(options: { strategy: MyStrategy }) {
  this.options = options;
  // Strategy init() never called!
}

Fix:

async onApplicationBootstrap(): Promise<void> {
  if (typeof MyPlugin.options.strategy.init === 'function') {
    await MyPlugin.options.strategy.init(this.injector);
  }
}

Quick Detection Commands

# All-in-one audit script
echo "=== CRITICAL ===" && \
grep -rn "export class.*Plugin" --include="*plugin.ts" | grep -v "@VendurePlugin" && \
echo "=== HIGH ===" && \
grep -rn "export class.*Service" --include="*.service.ts" | grep -v "@Injectable" && \
echo "=== MEDIUM ===" && \
grep -rn "TODO\|FIXME\|HACK" --include="*.ts"

Cross-Reference

All rules in this skill match patterns documented in vendure-plugin-writing skill.

When reviewing, verify the plugin follows the patterns in:

• vendure-plugin-writing (plugin structure)
• vendure-graphql-writing (if has API extensions)
• vendure-entity-writing (if has entities)
• vendure-admin-ui-writing (if has UI extensions)

Related Skills

• vendure-plugin-writing – Plugin creation patterns
• vendure-graphql-reviewing – GraphQL-specific review
• vendure-entity-reviewing – Entity-specific review
• vendure-admin-ui-reviewing – UI-specific review