@docupace/pipeline 1.0.123-xray.3 → 1.0.123

package/src/xray/report.test.js

@@ -1,278 +0,0 @@
-import { describe, expect, test } from '@jest/globals';
-import {
-  rankOf,
-  extractFindings,
-  countBySeverity,
-  buildBuildLink,
-  buildParentPayload,
-  buildFindingText,
-  buildThreadPayload,
-  parseReportArgs,
-  sortBySeverity,
-} from './report.js';
-
-describe('rankOf', () => {
-  test('ranks known severities Critical -> Low', () => {
-    expect(rankOf('Critical')).toBe(0);
-    expect(rankOf('High')).toBe(1);
-    expect(rankOf('Medium')).toBe(2);
-    expect(rankOf('Low')).toBe(3);
-  });
-
-  test('unranked/unknown severities sort last', () => {
-    expect(rankOf('Unknown')).toBe(9);
-    expect(rankOf(undefined)).toBe(9);
-  });
-});
-
-describe('extractFindings', () => {
-  test('flattens SCA rows with CVE ids, package and direct components', () => {
-    const data = {
-      vulnerabilities: [
-        {
-          severity: 'Critical',
-          cves: [{ cve: 'CVE-2024-0001' }, { cve: 'CVE-2024-0002' }],
-          impactedPackageName: 'lodash',
-          impactedPackageVersion: '4.17.15',
-          fixedVersions: ['4.17.21'],
-          components: [{ name: 'my-app' }, { name: 'my-app' }],
-        },
-      ],
-    };
-
-    const [finding] = extractFindings(data, 'my-repo deps');
-
-    expect(finding).toMatchObject({
-      scan: 'my-repo deps',
-      kind: 'Vulnerability',
-      severity: 'Critical',
-      rank: 0,
-      cve: 'CVE-2024-0001',
-      cvesAll: ['CVE-2024-0001', 'CVE-2024-0002'],
-      pkg: 'lodash 4.17.15',
-      fixed: '4.17.21',
-      directs: 'my-app',
-      path: '',
-      line: 0,
-    });
-  });
-
-  test('falls back to issueId when a vulnerability has no CVEs', () => {
-    const data = {
-      securityViolations: [{ severity: 'High', issueId: 'XRAY-123' }],
-    };
-    const [finding] = extractFindings(data, 'scan');
-    expect(finding.cve).toBe('XRAY-123');
-    expect(finding.cvesAll).toEqual([]);
-    expect(finding.kind).toBe('Security violation');
-  });
-
-  test('flattens code rows (secrets/SAST/IaC) with file + line', () => {
-    const data = {
-      secrets: [
-        {
-          severity: 'Medium',
-          finding: 'AWS key',
-          file: 'src/config.js',
-          startLine: 12,
-        },
-      ],
-      sast: [
-        {
-          severity: 'Low',
-          ruleId: 'js/hardcoded-secret',
-          scannerShortDescription: 'x',
-        },
-      ],
-    };
-
-    const findings = extractFindings(data, 'scan');
-
-    expect(findings[0]).toMatchObject({
-      kind: 'Secret',
-      severity: 'Medium',
-      pkg: 'AWS key',
-      path: 'src/config.js',
-      line: 12,
-    });
-    expect(findings[1]).toMatchObject({
-      kind: 'SAST',
-      cve: 'js/hardcoded-secret',
-      pkg: 'x',
-    });
-  });
-
-  test('missing sections produce no findings', () => {
-    expect(extractFindings({}, 'scan')).toEqual([]);
-  });
-});
-
-describe('countBySeverity', () => {
-  test('counts only the four named severities and totals them', () => {
-    const findings = [
-      { severity: 'Critical' },
-      { severity: 'High' },
-      { severity: 'High' },
-      { severity: 'Unknown' },
-    ];
-    expect(countBySeverity(findings)).toEqual({
-      Critical: 1,
-      High: 2,
-      Medium: 0,
-      Low: 0,
-      total: 3,
-    });
-  });
-});
-
-describe('buildBuildLink', () => {
-  test('builds a pipeline results URL when all pieces are present', () => {
-    expect(
-      buildBuildLink({
-        workspace: 'dp-cloud',
-        repoSlug: 'my-repo',
-        buildNumber: '42',
-      }),
-    ).toBe('https://bitbucket.org/dp-cloud/my-repo/pipelines/results/42');
-  });
-
-  test('returns empty string when any piece is missing', () => {
-    expect(
-      buildBuildLink({
-        workspace: 'dp-cloud',
-        repoSlug: '',
-        buildNumber: '42',
-      }),
-    ).toBe('');
-    expect(buildBuildLink({})).toBe('');
-  });
-});
-
-describe('buildParentPayload', () => {
-  test('includes branch and pipeline link when present', () => {
-    const payload = buildParentPayload({
-      channel: '#security-alerts',
-      project: 'my-repo',
-      branch: 'main',
-      buildLink: 'https://bitbucket.org/x/y/pipelines/results/1',
-      counts: { Critical: 1, High: 2, Medium: 0, Low: 0, total: 3 },
-    });
-
-    expect(payload.channel).toBe('#security-alerts');
-    const projectSection = payload.blocks[1].text.text;
-    expect(projectSection).toContain('*Project:* my-repo');
-    expect(projectSection).toContain('*Branch:* main');
-    expect(payload.blocks[3].elements[0].text).toContain('Pipeline run');
-  });
-
-  test('omits branch and link when not provided', () => {
-    const payload = buildParentPayload({
-      channel: '#c',
-      project: 'my-repo',
-      branch: '',
-      buildLink: '',
-      counts: { Critical: 0, High: 0, Medium: 0, Low: 0, total: 0 },
-    });
-
-    expect(payload.blocks[1].text.text).toBe('*Project:* my-repo');
-    expect(payload.blocks[3].elements[0].text).toBe(
-      'Detailed findings are in the thread below 👇',
-    );
-  });
-});
-
-describe('buildFindingText / buildThreadPayload', () => {
-  test('links CVE ids to NVD', () => {
-    const finding = {
-      severity: 'Critical',
-      scan: 'my-repo deps',
-      kind: 'Vulnerability',
-      cve: 'CVE-2024-0001',
-      cvesAll: ['CVE-2024-0001'],
-      pkg: 'lodash 4.17.15',
-      fixed: '4.17.21',
-      directs: 'my-app',
-      path: '',
-      line: 0,
-    };
-
-    const text = buildFindingText(finding);
-    expect(text).toContain('🔴 *Critical*');
-    expect(text).toContain(
-      '<https://nvd.nist.gov/vuln/detail/CVE-2024-0001|CVE-2024-0001>',
-    );
-    expect(text).toContain('*Fixed in:* 4.17.21');
-    expect(text).toContain('*Via:* my-app');
-    expect(text).not.toContain('*File:*');
-  });
-
-  test('non-CVE rule ids are left as plain text', () => {
-    const finding = {
-      severity: 'Low',
-      scan: 'scan',
-      kind: 'SAST',
-      cve: 'js/hardcoded-secret',
-      cvesAll: [],
-      pkg: 'x',
-      fixed: '',
-      directs: '',
-      path: 'src/config.js',
-      line: 12,
-    };
-
-    const text = buildFindingText(finding);
-    expect(text).toContain('👻 *Low*');
-    expect(text).toContain('*ID:* js/hardcoded-secret');
-    expect(text).toContain('*File:* `src/config.js:12`');
-  });
-
-  test('buildThreadPayload wraps the text in a Slack section block', () => {
-    const finding = {
-      severity: 'Medium',
-      scan: 'scan',
-      kind: 'IaC',
-      cve: 'N/A',
-      cvesAll: [],
-      pkg: 'x',
-      fixed: '',
-      directs: '',
-      path: '',
-      line: 0,
-    };
-    const payload = buildThreadPayload({
-      channel: '#c',
-      threadTs: '123.456',
-      finding,
-    });
-    expect(payload).toMatchObject({ channel: '#c', thread_ts: '123.456' });
-    expect(payload.blocks[0].text.text).toContain('🎃 *Medium*');
-  });
-});
-
-describe('parseReportArgs', () => {
-  test('splits "label:file" lines and ignores blanks', () => {
-    expect(
-      parseReportArgs(
-        'my-repo deps:xray-report/my-repo-audit.json\n\napp image:xray-report/app-docker.json\n',
-      ),
-    ).toEqual([
-      { label: 'my-repo deps', file: 'xray-report/my-repo-audit.json' },
-      { label: 'app image', file: 'xray-report/app-docker.json' },
-    ]);
-  });
-
-  test('returns empty file when a line has no colon', () => {
-    expect(parseReportArgs('just-a-label')).toEqual([
-      { label: 'just-a-label', file: '' },
-    ]);
-  });
-});
-
-describe('sortBySeverity', () => {
-  test('orders Critical -> High -> Medium -> Low without mutating input', () => {
-    const findings = [{ rank: 3 }, { rank: 0 }, { rank: 1 }];
-    const sorted = sortBySeverity(findings);
-    expect(sorted.map((f) => f.rank)).toEqual([0, 1, 3]);
-    expect(findings.map((f) => f.rank)).toEqual([3, 0, 1]);
-  });
-});

package/src/xray/slack.js

@@ -1,14 +0,0 @@
-import axios from 'axios';
-
-const SLACK_API = 'https://slack.com/api/chat.postMessage';
-
-// Thin wrapper so callers can mock the network boundary in tests.
-export async function postMessage(payload, token) {
-  const { data } = await axios.post(SLACK_API, payload, {
-    headers: {
-      Authorization: `Bearer ${token}`,
-      'Content-Type': 'application/json',
-    },
-  });
-  return data;
-}