ci(js): lint the backend JavaScript, which nothing did (#855)

Closes #825. A file whose methods had landed outside their class passed
the whole CI matrix — **71 green checks** — and the rating buttons it
shipped would not have worked. PHPStan does not read JavaScript, the
functional suite renders the template without executing the module, and
no Playwright spec covers that view. A person reading the diff found it.

## `node --check` lost on evidence, not on taste

It was the cheap candidate: no dependency, no config. Tested against the
actual broken file, it **accepted** it — because it parses a `.js` file
as a CommonJS *script*. ESLint parses it as an ES *module*, which is how
the browser loads it, and reports the parse error on the right line.

That also settles something left open in #842's review. I had written
there that I could not reconcile `node --check` passing with a minimal
reproduction failing, and would not dress it up. The answer is the
parsing mode: the file was a syntax error all along, and `node --check`
read it in the wrong one.

## My reason for not deciding this earlier was wrong

I had said eslint "would bring a JS toolchain into a PHP extension that
has none". One command disproves it: `package.json`,
`package-lock.json`, three devDependencies including Playwright, and CI
already runs `npm install` for the e2e job. ESLint is one more line in a
file that exists.

**No sibling extension lints JavaScript** — `rte_ckeditor_image` has a
`package.json` for commitlint and husky only, `nr-vault` one for
Playwright, `nr-repurpose` none at all. There was no house standard to
copy, which is a reason to set one rather than to wait for it.

## The rule set is small on purpose

`no-undef` is an **error**: it is the rule that catches the defect
above.

`no-unsanitized` is loaded but set to **warn**, and the reason is
measured rather than cautious. As an error it reports 12 assignments,
and **none of them is a hole** — the code escapes through
`escapeHtml()`, visibly, with a comment saying so:

```js
// SECURITY: Escape all external data to prevent XSS
const safeProviderName = escapeHtml(providerInfo.suggestedName);
```

The rule recognises a fixed set of sanitizers and a helper of ours is
not among them. Dropping the plugin was not an option either: two files
already carry `eslint-disable-line no-unsanitized/property` —
suppressions written for a rule that never ran, which become "rule not
found" errors the moment linting is switched on.

Those twelve are triaged in **#854** with the evidence and three
options. A security question belongs where it can be argued and closed,
not in a config comment.

## Verification

| | |
|---|---|
| clean tree | 0 errors, 14 warnings, exit 0 |
| #825's shape reintroduced (method after the class's closing brace) |
parse error, exit 1 |
| `npm ci` from the lockfile, then lint | exit 0 |

Repo rules: no job is defined here — thin caller of the shared
`script-check` reusable, `check-workflow-ownership.php` passes, and
`drift_compare.py` against the org template reports no drift.
`pre-command` installs the devDependencies the runner does not ship.

## One thing worth knowing beyond this repo

This makes nr_llm the first Netresearch TYPO3 extension with a
JavaScript gate. If it holds up, it belongs in the shared template
rather than being rebuilt per repository — otherwise the next extension
gets the same 71-green-checks surprise.

_Assisted by claude-code:claude-opus-5 —
[Session](https://claude.ai/code/session_01MNg1MysJVugv1xo2husknU)_

Author: CybotTM

.github/workflows/js-lint.yml

@@ -0,0 +1,34 @@
+name: JavaScript Lint
+
+# Lints Resources/Public/JavaScript. Nothing did before #825: a file whose
+# methods had landed outside their class passed the whole CI matrix — 71 green
+# checks — because PHPStan does not read JavaScript, the functional suite
+# renders the template without executing the module, and no Playwright spec
+# covers that view. The defect was found by a person reading the diff.
+#
+# `node --check` was the cheaper candidate and lost on evidence: it parses a
+# `.js` file as a CommonJS script and accepted the broken file, while ESLint
+# parses it as an ES module — which is how the browser loads it — and reports
+# the parse error on the right line.
+#
+# Thin caller of the shared script-check reusable, so the checkout pin and
+# harden-runner stay maintained centrally. `pre-command` installs the npm
+# devDependencies the runner does not ship.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  merge_group:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  js-lint:
+    uses: netresearch/.github/.github/workflows/script-check.yml@main
+    permissions:
+      contents: read
+    with:
+      pre-command: npm ci --no-audit --no-fund
+      check-cmd: npx eslint

eslint.config.mjs

@@ -0,0 +1,62 @@
+// Lints the backend JavaScript. Nothing did before: a file whose methods had
+// landed outside their class passed the whole CI matrix — 71 green checks —
+// because PHPStan does not read JavaScript, the functional suite renders the
+// template without executing the module, and no Playwright spec covers that
+// view (#825).
+//
+// `node --check` was considered as a cheaper floor and rejected on evidence:
+// it parses a `.js` file as a CommonJS script and accepted the broken file,
+// while ESLint parses it as an ES module — which is how the browser loads it —
+// and reports the parse error on the right line.
+//
+// The rule set is deliberately small. This is the first JavaScript gate in any
+// of our TYPO3 extensions, and a large one would arrive as a backlog of
+// pre-existing violations that nobody asked for.
+import globals from 'globals';
+import noUnsanitized from 'eslint-plugin-no-unsanitized';
+
+export default [
+    {
+        files: ['Resources/Public/JavaScript/**/*.js'],
+        // Vendored libraries are shipped as-is; linting them would report
+        // somebody else's code in our gate.
+        ignores: ['Resources/Public/JavaScript/Vendor/**'],
+        languageOptions: {
+            ecmaVersion: 2022,
+            sourceType: 'module',
+            globals: {
+                ...globals.browser,
+                // Provided by the TYPO3 backend at runtime, not importable.
+                TYPO3: 'readonly',
+                bootstrap: 'readonly',
+            },
+        },
+        plugins: { 'no-unsanitized': noUnsanitized },
+        rules: {
+            // The rule that would have caught #825.
+            'no-undef': 'error',
+            'no-unused-vars': ['warn', { argsIgnorePattern: '^_' }],
+            // Warning, not error, and the reason is measured rather than
+            // cautious. Switched on as an error it reports 12 assignments —
+            // and none of them is a hole: the code escapes first, visibly, at
+            // `SetupWizard.js:471-474` ("SECURITY: Escape all external data")
+            // through `escapeHtml()`. The rule cannot recognise that helper as
+            // a sanitizer, which is a known shape for it.
+            //
+            // The plugin is still loaded, because two files carry
+            // `eslint-disable-line no-unsanitized/property` — suppressions
+            // written for a rule that never ran. Without the plugin those
+            // comments become "rule not found" errors the moment linting is
+            // switched on.
+            //
+            // Making them errors would land a backlog of twelve judgements
+            // nobody asked for on a change whose job is #825. Leaving the rule
+            // out entirely would drop a real check silently. The findings are
+            // triaged in their own issue, with the escapeHtml evidence, so the
+            // security question lives somewhere it can be argued rather than
+            // in a config comment.
+            'no-unsanitized/property': 'warn',
+            'no-unsanitized/method': 'warn',
+        },
+    },
+];