/netsuite-suitescript-learning

/netsuite-suitescript-learning learn [topic] # Learn a SAFE Guide topic
/netsuite-suitescript-learning review [filename] # Review a file and identify learning concepts
/netsuite-suitescript-learning explain [concept] # Deep dive into a specific concept
/netsuite-suitescript-learning annotate [filename] # Add inline learning comments to code
/netsuite-suitescript-learning quiz [section] # Generate quiz questions
/netsuite-suitescript-learning final # Generate a comprehensive learning document

{
  "permissions": {
    "allow": [
      "Skill(netsuite-sdf-safe-guide)",
      "Skill(netsuite-suitescript-learning)"
    ]
  }
}

/netsuite-suitescript-learning [mode] [target] [options]

Modes:
  learn – Topic-based learning from SAFE Guide principles
  review – Review a specific file and identify learning concepts
  explain – Explain a specific concept or code pattern
  annotate – Add inline learning comments to existing code
  quiz – Generate quiz questions for recent code
  final – Generate final comprehensive learning document

Target:
  - File path for review/annotate mode
  - Concept name for explain mode
  - "all" or section name for quiz mode
  - Topic keyword for learn mode (see SAFE Guide Learning Topics)

Options:
  --source=code Quiz questions from user's code only (quiz mode)
  --source=safe Quiz questions from SAFE Guide principles only (quiz mode)
  --source=owasp Quiz questions from OWASP secure coding practices only (quiz mode)
  --source=both Quiz questions from both sources (default for quiz mode)

/suitescript-learning learn ncache
/suitescript-learning learn governance
/suitescript-learning review quick_add_ue.js
/suitescript-learning explain beforeLoad
/suitescript-learning annotate quick_add_cs.js
/suitescript-learning quiz user-event-scripts
/suitescript-learning quiz --source=safe
/suitescript-learning final

undefined

---

undefined

[Relevant code snippet]

undefined

// CONCEPT: context.type tells us how the record is being accessed
if (context.type !== context.UserEventType.VIEW)

/**
 * beforeLoad Entry Point
 *
 * LEARNING NOTES:
 * - This function executes BEFORE the form is sent to the browser
 * - Perfect place to modify the form (add fields, buttons, sublists)
 * - context.form gives access to the N/ui/serverWidget.Form object
 *
 * @param {Object} context – Contains form, record, type (view/edit/create)
 */
 const beforeLoad = (context) => {
      const form = context.form;
  };

// Parameters:
//   id: Unique identifier (prefix with custpage_ for custom buttons)
//   label: What the user sees
//   functionName: Client Script function to call when clicked
form.addButton({
    id: 'custpage_quick_add_items',
    label: 'Quick Add Items',
    functionName: 'openQuickAddDialog'
});

/**
 * @NApiVersion 2.1
 * @NScriptType UserEventScript
 * @NModuleScope SameAccount
 *
 * @description User Event Script to add "Quick Add Items" button to Sales Orders
 *
 * LEARNING NOTES:
 * - @NApiVersion 2.1 tells NetSuite to use SuiteScript 2.1 (modern JS support)
 * - @NScriptType UserEventScript identifies this as a UE script
 * - @NModuleScope SameAccount restricts execution to same NetSuite account
 * - User Event Scripts run on the SERVER, not in the browser
 */

// CONCEPT: define() is the AMD module pattern; loads dependencies
define(['N/ui/serverWidget', 'N/runtime'], (serverWidget, runtime) => {

    /**
     * beforeLoad Entry Point
     *
     * LEARNING NOTES:
     * - Executes BEFORE the form is sent to the browser
     * - Perfect place to modify the form (add fields, buttons, sublists)
     * - context.form gives access to the N/ui/serverWidget.Form object
     * - Changes made here appear when the page loads
     *
     * @param {Object} context – Contains form, record, type (view/edit/create)
     */
    const beforeLoad = (context) => {
        try {
            // CONCEPT: context.type tells us how the record is being accessed
            // We only want the button in edit or create mode, not view-only
            if (context.type !== context.UserEventType.VIEW) {

                // CONCEPT: context.form is the N/ui/serverWidget.Form object
                // This gives us access to modify the form before rendering
                const form = context.form;

                // CONCEPT: addButton() adds a button to the form's toolbar
                // Parameters:
                //   id: Unique identifier (prefix with custpage_ for custom buttons)
                //   label: What the user sees
                //   functionName: Client Script function to call when clicked
                form.addButton({
                    id: 'custpage_quick_add_items',
                    label: 'Quick Add Items',
                    functionName: 'openQuickAddDialog'
                });

                // CONCEPT: clientScriptModulePath links a Client Script to this form
                // The Client Script will contain our openQuickAddDialog function
                // Path is relative to this script's location in the File Cabinet
                form.clientScriptModulePath = './quick_add_cs.js';
            }
        } catch (error) {
            log.error('beforeLoad Error', error.message);
        }
    };

    // CONCEPT: Return object exposes entry points to NetSuite
    // Only functions returned here are recognized as entry points
    // Custom helper functions inside the module stay private
    return {
        beforeLoad: beforeLoad
    };
});

undefined

---

undefined

[Relevant code snippet from SAFE Guide demonstrating the concept]

undefined

undefined

define(['N/cache'], (cache) => {
    const configCache = cache.getCache({
        name: 'myAppConfig',
        scope: cache.Scope.PROTECTED
    });

    const getConfig = () => {
        return configCache.get({
            key: 'settings',
            loader: () => {
                // This runs only on cache miss
                return loadConfigFromRecord();
            },
            ttl: 300 // 5 minutes
        });
    };
});

---

Q: What is the difference between beforeLoad and beforeSubmit entry points?
A: beforeLoad runs when the form is being built (before render), while beforeSubmit
   runs when the user clicks Save (before the record is written to the database).

Q: What will happen if you call form.addButton() in afterSubmit instead of beforeLoad?
A: Nothing visible; the form has already been rendered and submitted. The button
   would never appear because afterSubmit runs after the save operation completes.

Q: This RESTlet deployment XML will fail. Why?
   <scriptdeployment>
     <runasrole>ADMINISTRATOR</runasrole>
     <allroles>T</allroles>
   </scriptdeployment>
A: RESTlets do not support <runasrole> or <allroles> elements. These must be removed.

Q: Why do we use url.resolveScript() instead of hardcoding a Suitelet URL?
A: resolveScript() dynamically generates the correct URL for the current environment
   (sandbox vs production), handles URL encoding, and includes necessary parameters
   like company ID and deployment ID.

Q: To add a line to a sublist, you must call three methods in order:
   _______, setCurrentSublistValue(), and _______.
A: selectNewLine(), commitLine()

Q: According to the SAFE Guide, why should you use N/cache with Scope.PROTECTED
   when multiple scripts need to share cached data?
A: Scope.PROTECTED allows cache sharing across all scripts in the same SuiteApp
   bundle while isolating data from other SuiteApps. This provides data privacy
   between different publishers' SuiteApps.

Q: A User Event Script is taking too long. According to SAFE Guide Principle 2,
   what's the recommended approach when you need to process 500+ records?
A: Offload heavy processing to a Map/Reduce script using N/task. User Event
   Scripts have a 1,000 unit limit; Map/Reduce has 10,000 units per stage.
   This pattern is called "async offloading."

Q: You need to make AJAX calls from a popup Suitelet. According to Principle 3,
   why should you not use a RESTlet for this?
A: RESTlets count against the Web Services concurrent user limit (typically 5).
   Use the Suitelet-as-API pattern instead, which uses the user's existing session
   and doesn't consume web services slots.

Q: This RESTlet accepts a customer ID from the URL and uses it in a SuiteQL query.
   What OWASP vulnerability is present in this code?
   const id = context.request.parameters.custId;
   const sql = "SELECT * FROM Customer WHERE id = " + id;
A: SQL Injection (OWASP A03:2021). The customer ID is concatenated directly into
   the query string without validation or parameterization. Fix: use parameterized
   query with ? placeholder: query.runSuiteQL({ query: 'SELECT * FROM Customer WHERE id = ?', params: [parseInt(id, 10)] })

undefined

---

undefined

// 1 search + 50 pricing lookups = 51 queries!
itemSearch.run().each((result) => {
    const price = getItemPrice(result.id); // ← Separate query per item!
});

// Collect IDs first, then ONE batch query
const itemIds = [];
itemSearch.run().each((result) => {
    itemIds.push(result.id);
});

// Single batch lookup for ALL items
const prices = getBatchPricing(itemIds); // Uses ['item', 'anyof', itemIds]

// This FAILS in NetSuite:
window.opener.myFunction(data); // window.opener exists but myFunction is undefined

define(['N/currentRecord'], (currentRecord) => {
    // CRITICAL: Module-level code, not in pageInit
    // pageInit may not fire with clientScriptModulePath
    window.addEventListener('message', (event) => {
        // SECURITY: Use anchored regex to prevent origin spoofing
        // For example, "evil-netsuite.com" would pass .includes() but fails this check
        if (!/^https:\/\/([a-z0-9-]+\.)*netsuite\.com$/.test(event.origin)) return;
        if (event.data?.action === 'addItems') {
            handleAddItems(event.data.items);
        }
    });
});

function sendToParent(items) {
    const message = { action: 'addItems', items };
    // SECURITY: Use specific origin, never wildcard '*'
    const targetOrigin = window.location.origin;
    window.opener.postMessage(message, targetOrigin);
    // Also post to all frames
    for (let i = 0; i < window.opener.frames.length; i++) {
        window.opener.frames[i].postMessage(message, targetOrigin);
    }
    window.close();
}

define(['N/currentRecord'], (currentRecord) => {
    // ✅ GOOD: Module-level; always runs when script loads
    console.log('Script loaded');
    window.addEventListener('message', handler);

    // ❌ BAD: pageInit; may not fire with clientScriptModulePath
    const pageInit = (context) => {
        window.addEventListener('message', handler); // May never execute!
    };
});

// Single Suitelet handles both UI and API
const onRequest = (context) => {
    const action = context.request.parameters.action;

    if (action === 'search') {
        // Return JSON for AJAX calls
        context.response.setHeader({ name: 'Content-Type', value: 'application/json' });
        context.response.write(JSON.stringify({ items: searchResults }));
    } else {
        // Return HTML for page load
        context.response.write(generateHtmlPage());
    }
};

define(['N/search', 'N/record', 'N/log'], (search, record, log) => {
    // Module names in array must match parameter order
});

// CORRECT for SuiteApps:
form.clientScriptModulePath = '/SuiteApps/com.publisher.appid/scripts/my_cs.js';

// WRONG for SuiteApps (works in Account Customization only):
form.clientScriptModulePath = './my_cs.js';

record.selectNewLine({ sublistId: 'item' });
record.setCurrentSublistValue({ sublistId: 'item', fieldId: 'item', value: itemId });
record.setCurrentSublistValue({ sublistId: 'item', fieldId: 'quantity', value: qty });
record.commitLine({ sublistId: 'item' });

---

undefined

---

Unable to detect script type. Please ensure the file contains:
- @NScriptType annotation in JSDoc comment
- Valid script type value (UserEventScript, ClientScript, Suitelet, etc.)

No recognizable SuiteScript patterns found in this file.
This may be a utility module rather than a script entry point.

Unable to generate quiz questions. Possible reasons:
- File is too short or lacks distinct concepts
- Script type not supported for quiz generation
- Code patterns are too generic to quiz