@bongos/core 1.19.366 → 1.19.368

package/tests/redteam_patrol.mjs

@@ -128,3 +128,73 @@ test('filingBlocker reports a sessionless runner instead of exiting with re-auth
   assert.doesNotMatch(r.stdout + r.stderr, /builder-reauth/,
     'the sessionless path must not print interactive re-auth guidance into a cron log');
 });
+
+// ---------------------------------------------------------------------------
+// overrideVerdict (task 1003283, report 1000025). The first scheduled patrol run
+// filed a medium saying `undici` was "pinned ^6.28.0 while latest is 8.10.0".
+// It was wrong: 6.28.0 IS the newest 6.x, discord.js (the only consumer) requires
+// the 6.x line, and npm audit finds nothing — acting on it would have broken the
+// dependent, and ignoring it weekly is the alert-fatigue failure the patrol is
+// supposed to avoid. These pin the narrower rule that replaced it.
+// ---------------------------------------------------------------------------
+
+test('a pin holding a major line on purpose is a NOTE, never a finding', () => {
+  // THE regression. An override exists precisely to hold a line; "latest is a
+  // higher major" is the expected steady state, not a defect.
+  const v = p.overrideVerdict({
+    name: 'undici', range: '^6.28.0', locked: '6.28.0',
+    satisfying: ['6.24.1', '6.27.0', '6.28.0'], latest: '8.10.0',
+  });
+  assert.equal(v.finding, undefined, 'a deliberate major pin must not file weekly forever');
+  assert.match(v.note, /trails the latest major/);
+  assert.match(v.note, /do NOT bump blind/);
+});
+
+test('a lock that trails what the pin already allows IS a finding — rot nobody chose', () => {
+  const v = p.overrideVerdict({
+    name: 'undici', range: '^6.28.0', locked: '6.27.0',
+    satisfying: ['6.27.0', '6.28.0'], latest: '8.10.0',
+  });
+  assert.equal(v.finding.severity, 'medium');
+  assert.match(v.finding.item, /locked at 6\.27\.0 but its own pin .* already allows 6\.28\.0/);
+  assert.equal(v.note, undefined, 'the actionable finding replaces the note, not doubles it');
+});
+
+test('a current pin with no newer major says nothing at all', () => {
+  const v = p.overrideVerdict({
+    name: 'x', range: '^3.1.0', locked: '3.4.0', satisfying: ['3.1.0', '3.4.0'], latest: '3.4.0',
+  });
+  assert.deepEqual(v, {});
+});
+
+test('no npm data produces silence, not a guess', () => {
+  // A registry failure must not read as "the pin is fine" OR invent a finding —
+  // the caller adds an explicit skipped-check note instead.
+  assert.deepEqual(p.overrideVerdict({ name: 'x', range: '^3.0.0', locked: '3.0.0', satisfying: [], latest: null }), {});
+  assert.deepEqual(p.overrideVerdict(), {});
+});
+
+test('a locked version OUTSIDE the declared range is not reported as a stale lock', () => {
+  // If the lock does not satisfy the range at all, the mismatch is a different
+  // (worse) problem than "refresh the lockfile", and this rule must not mislabel
+  // it — the `satisfying.includes(locked)` guard is what keeps that honest.
+  const v = p.overrideVerdict({
+    name: 'x', range: '^6.0.0', locked: '5.9.9', satisfying: ['6.0.0', '6.1.0'], latest: '6.1.0',
+  });
+  assert.equal(v.finding, undefined);
+});
+
+test('LIVE: the repo\'s own overrides produce no medium finding today', () => {
+  // The end state report 1000025 should have had. Uses the committed package.json
+  // + lockfile, with the registry answers stubbed to what they really are, so the
+  // assertion is hermetic but not fictional.
+  const pkg = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8'));
+  const lock = JSON.parse(fs.readFileSync(path.join(ROOT, 'package-lock.json'), 'utf8'));
+  const ranges = Object.entries(pkg.overrides || {}).filter(([, r]) => typeof r === 'string');
+  assert.ok(ranges.length > 0, 'this test is pointless if the repo declares no overrides');
+  for (const [name, range] of ranges) {
+    const locked = p.lockedVersion(lock, name);
+    const v = p.overrideVerdict({ name, range, locked, satisfying: [locked], latest: '99.0.0' });
+    assert.equal(v.finding, undefined, `${name} should not file a medium: ${JSON.stringify(v)}`);
+  }
+});