| Consistent naming convention | - Write code in English - use English names for variables, functions, etc.
Exceptions: top-down business naming conventions or a high level of script complexity (the decision here is up to the low-code developer). If you decide to use Polish naming convention - be consistent within a single script. - Literal constants hard-coded in code, name them in UPPER_SNAKE_CASE format, e.g.
const MOBILE_CHANNEL = "mobile" - Name other variables and functions in camelCase format, e.g. const correlationId = context.getFirstParameter('correlationId'), let motherBranchNumber, function generateBranch()
|
| Order in code structure | Organize code according to the following order: - Literal constantsdeclare at the beginning of the script
- Variables then declare variables that will be used in the main logic
- Main logic the main sequence of operations that the code performs (e.g. data processing, function calls)
- Helper functions place at the end
|
| Logging | - Do not duplicate platform logs - if any parameters are automatically generated by the platform, do not log them again in the script
- Use a sensitive logger to log sensitive data, pattern:
Logger.info("Client's PESEL filled in on the form: {}", pesel)
Learn more:
Logging in ScriptCode |
| Variable declaration | - Do not use var
- Primitive types: use let only when you change the variable's value in the script. In other cases, use const
- Complex types: do not use let if you only modify the content of an object - including arrays (Array), sets (Set), maps (Map).
There is no need to use let when declaring objects - including arrays (Array), sets (Set), maps (Map) - as long as the reference (that is, the reference to a specific object or array) will not be changed.
In most cases, you should use const to declare arrays and other objects, even if their contents will be modified. Example using const: const array = [1, 2, 3];
array.push(4); // Works correctly, we are modifying the contents of the array
const obj = { name: "Alice" };
obj.age = 30; // Works correctly, we are modifying the object's properties
Note: As long as the rhino engine does not properly support block scope for const variables should be declared inside the "for" loop using let. More about the error can be read in the material linked below.
Learn more:
Data types in Javascript, Reference, mutability, primitive types - a refresher on Javascript! Scripts(ScriptService) A table listing which functionalities are currently not properly supported by the rhino engine
Rhino: error when declaring const inside for loop |
| Error handling | - Use
try-catch blocks where exceptions may occur. If an error occurs, log it using the logger to enable easy tracking of the problem.
|
| Code readability | - Right-click → select Format Document. This will make the code more clear and readable
- Remove code that is commented out and no longer needed
- Write comments concisely and clearly, explaining more difficult code fragments, intentions, and unusual solutions. Avoid obvious comments that merely repeat what is already readable in the code.
|
| Code repetition | - If you repeat a code fragment several times - create a helper function
|
| Script description | - When creating a new script/validator - add a description
|
| Tests | - Create unit tests whenever possible, including edge cases.
|
| Security | - Treat any parameters entering ScriptCode as untrusted when sending to services
Sample code: Wrong: const url = "/api/form/" + context.getFirstParameter( "form\_id" ) + "/data" ;
const response = api.rest.v1.get( "host" , {pathParams: url.split( "/" )});
Correct: const pathParams = \[ "api" , "form" , context.getFirstParameter( "form\_id" ), "data" ];
const response = api.rest.v1.get( "host" , {pathParams: pathParms});
- Do not use authorization data directly in ScriptCode
- Fetch remote resources (images, documents, card images, etc.) from a trusted source (e.g. eximee platform, bank resource)
- If you need to use any link in the application, make sure it is trusted and that its use directly follows from the requirements
- If a functionality is not available on the platform, report the need - do not use external tools
Learn more: OWASP\_Application\_Security\_Verification\_Standard\_4.0 - scriptCode |
| Mathematical operations with BigDecimal | - Perform mathematical operations using BigDecimal
Learn more: Mathematical operations in ScriptCode |
| Handling falsy values | - Before using a property or method, check whether the variable's value is not
null or undefined, to prevent errors related to missing values. In situations where you want to catch also 0an empty string or NaN, you can use the general condition if(value).
|
| Review | - If you are not the only low-code developer on the team - ask someone from the team to review the code.
|