@flow-scanner/lightning-flow-scanner-core 6.16.2 → 6.17.1

package/tests/ExportSarif.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, it } from "@jest/globals";
+import * as path from "path";
+import * as core from "../src";
+
+describe("exportSarif()", () => {
+  const badFlowPath = path.join(__dirname, "../../../example-flows/force-app/demo/DML_Statement_In_A_Loop.flow-meta.xml");
+  const goodFlowPath = path.join(__dirname, "../../../example-flows/force-app/testing/Duplicate_DML_Operation_Fixed.flow-meta.xml");
+  const config = {
+    ruleMode: "isolated",
+    rules: {
+      DMLStatementInLoop: { severity: "error" },
+    },
+  };
+  it("generates valid SARIF with real file path and line numbers", async () => {
+    const flows = await core.parse([badFlowPath]);
+    const results = core.scan(flows, config);
+    const sarif = core.exportSarif(results);
+   
+    const json = JSON.parse(sarif);
+    // SARIF structure
+    expect(json.version).toBe("2.1.0");
+    expect(json.runs).toHaveLength(1);
+    expect(json.runs[0].tool.driver.name).toBe("Lightning Flow Scanner");
+    // Artifacts: real path (relative or absolute containing the substring)
+    const artifactUri = json.runs[0].artifacts[0].location.uri;
+    expect(artifactUri).toContain("force-app/demo/DML_Statement_In_A_Loop.flow-meta.xml");
+    // Results: one issue
+    const resultsArray = json.runs[0].results;
+    expect(resultsArray).toHaveLength(1);
+    expect(resultsArray[0].ruleId).toBe("dml-in-loop");
+    expect(resultsArray[0].level).toBe("warning");
+    // Location: has region
+    const region = resultsArray[0].locations[0].physicalLocation.region;
+    expect(region).toBeDefined();
+    expect(typeof region.startLine).toBe("number");
+    expect(typeof region.startColumn).toBe("number");
+    expect(region.startLine).toBeGreaterThanOrEqual(1);
+    expect(region.startColumn).toBeGreaterThanOrEqual(1);
+    // Message
+    expect(resultsArray[0].message.text).toContain("createNewCase");
+  });
+  it("generates empty results for fixed flow", async () => {
+    const flows = await core.parse([goodFlowPath]);
+    const results = core.scan(flows, config);
+    const sarif = core.exportSarif(results);
+   
+    const json = JSON.parse(sarif);
+    expect(json.runs[0].results).toHaveLength(0);
+  });
+  it("falls back to virtual URI when no fsPath", async () => {
+    const flows = await core.parse([badFlowPath]);
+    // Simulate browser: remove fsPath and set virtual uri with subdir structure
+    flows[0].flow.fsPath = undefined;
+    flows[0].flow.uri = "flows/demo/DML_Statement_In_A_Loop.flow-meta.xml";
+    const results = core.scan(flows, config);
+    const sarif = core.exportSarif(results);
+    const json = JSON.parse(sarif);
+   
+    const uri = json.runs[0].artifacts[0].location.uri;
+    expect(uri).toBe("flows/demo/DML_Statement_In_A_Loop.flow-meta.xml");
+  });
+});

package/tests/FlowDescription.test.ts

@@ -0,0 +1,44 @@
+import * as core from "../src";
+import * as path from "path";
+
+import { describe, it, expect } from "@jest/globals";
+
+describe("FlowDescription", () => {
+  const example_uri = path.join(__dirname, "../../../example-flows/force-app/demo/Missing_Flow_Description.flow-meta.xml");
+  const fixed_uri = path.join(__dirname, "../../../example-flows/force-app/testing/Missing_Flow_Description_Fixed.flow-meta.xml");
+
+  it("should return a result when missing a description", async () => {
+    const flows = await core.parse([example_uri]);
+    const ruleConfig = {
+      ruleMode: "isolated",
+      rules: {
+        FlowDescription: {
+          severity: "error",
+        },
+      },
+    };
+
+    const results: core.ScanResult[] = core.scan(flows, ruleConfig);
+    const occurringResults = results[0].ruleResults.filter((rule) => rule.occurs);
+    expect(occurringResults).toHaveLength(1);
+    expect(occurringResults[0].ruleName).toBe("FlowDescription");
+  });
+
+  it("should have no result when provided a description", async () => {
+    const flows = await core.parse([fixed_uri]);
+    const ruleConfig = {
+      ruleMode: "isolated",
+      rules: {
+        FlowDescription: {
+          severity: "error",
+        },
+      },
+    };
+
+    const results: core.ScanResult[] = core.scan(flows, ruleConfig);
+
+    expect(results[0].ruleResults).toHaveLength(1);
+    expect(results[0].ruleResults[0].ruleName).toBe("FlowDescription");
+    expect(results[0].ruleResults[0].occurs).toBe(false);
+  });
+});

package/tests/FlowDocumentation.test.ts

@@ -0,0 +1,74 @@
+import * as core from "../src";
+import * as path from "path";
+import * as fs from "fs";
+import * as os from "os";
+
+import { describe, it, expect } from "@jest/globals";
+
+describe("FlowDocumentation", () => {
+  const example_uri = path.join(__dirname, "../../../example-flows/force-app/demo/Invalid_API_Version.flow-meta.xml");
+  const fixed_uri = path.join(__dirname, "../../../example-flows/force-app/testing/Outdated_API_Version_Fixed.flow-meta.xml");
+
+  it("should generate markdown for a single flow with default options", async () => {
+    const parsed = await core.parse([example_uri]);
+    const md = core.exportDiagram(parsed);
+    
+    expect(md).toContain("# Flow Documentation");
+    expect(md).toContain("## Invalid_API_Version");
+    expect(md).toContain("```mermaid");
+    expect(md).toMatch(/flowchart TB/);  // Updated to match current Mermaid syntax
+    // Check no errors section since parse should succeed
+    expect(md).not.toContain("## Parse Errors");
+  });
+
+  it("should generate markdown with custom options", async () => {
+    const parsed = await core.parse([fixed_uri]);
+    const options = {
+      includeDetails: true,
+      includeMarkdownDocs: true,
+      collapsedDetails: true
+    };
+    const md = core.exportDiagram(parsed, options);
+    
+    expect(md).toContain("# Flow Documentation");
+    expect(md).toContain("## Outdated_API_Version_Fixed");
+    expect(md).toContain("```mermaid");
+    // Assuming visualize with these options includes details like <details> tags
+    expect(md).toMatch(/<details>/);
+    expect(md).not.toContain("## Parse Errors");
+  });
+
+  it("should handle multiple flows", async () => {
+    const parsed = await core.parse([example_uri, fixed_uri]);
+    const md = core.exportDiagram(parsed);
+    
+    expect(md).toContain("# Flow Documentation");
+    expect(md).toContain("## Invalid_API_Version");
+    expect(md).toContain("## Outdated_API_Version_Fixed");
+    expect(md).toContain("```mermaid");
+    expect(md).not.toContain("No valid flows found.");
+  });
+
+  it("should include parse errors if any", async () => {
+    const invalid_uri = path.join(__dirname, "non-existent-file.xml");
+    const parsed = await core.parse([example_uri, invalid_uri]);
+    const md = core.exportDiagram(parsed);
+    
+    expect(md).toContain("# Flow Documentation");
+    expect(md).toContain("## Invalid_API_Version");
+    expect(md).toContain("## Parse Errors");
+    expect(md).toContain(`- ${invalid_uri}`);
+    expect(md).toContain("ENOENT"); // Part of file not found error
+  });
+
+  it("should handle no valid flows", async () => {
+    const invalid_uri = path.join(__dirname, "non-existent-file.xml");
+    const parsed = await core.parse([invalid_uri]);
+    const md = core.exportDiagram(parsed);
+    
+    expect(md).toContain("# Flow Documentation");
+    expect(md).toContain("No valid flows found.");
+    expect(md).toContain("## Parse Errors");
+    expect(md).toContain(`- ${invalid_uri}`);
+  });
+});

package/tests/FlowName.test.ts

@@ -0,0 +1,61 @@
+import * as core from "../src";
+import * as path from "path";
+import { describe, it, expect } from "@jest/globals";
+
+describe("FlowName", () => {
+  const example_uri = path.join(__dirname, "../../../example-flows/force-app/demo/FlowNamingConvention.flow-meta.xml");
+  const fixed_uri = path.join(__dirname, "../../../example-flows/force-app/testing/Flow_Naming_Convention_Fixed.flow-meta.xml");
+  
+  it("should have a result when not in line with conventions", async () => {
+    const flows = await core.parse([example_uri]);
+    const ruleConfig = {
+      ruleMode: "isolated",
+      rules: {
+        FlowName: {
+          severity: "error",
+          expression: "[A-Za-z0-9]+_[A-Za-z0-9]+",
+        },
+      },
+    };
+    const results: core.ScanResult[] = core.scan(flows, ruleConfig);
+    expect(results[0].ruleResults).toHaveLength(1);
+    expect(results[0].ruleResults[0].ruleName).toBe("FlowName");
+    expect(results[0].ruleResults[0].occurs).toBe(true);
+  });
+  
+  it("should have no result when defined as exception", async () => {
+    const flows = await core.parse([example_uri]);
+    const ruleConfig = {
+      ruleMode: "isolated" as const,
+      rules: {
+        FlowName: {
+          severity: "error",
+          expression: "[0-9]",
+        },
+      },
+      exceptions: {
+        FlowNamingConvention: { FlowName: ["FlowNamingConvention"] },
+      },
+    };
+    const results: core.ScanResult[] = core.scan(flows, ruleConfig);
+    expect(results[0].ruleResults).toHaveLength(1);
+    expect(results[0].ruleResults[0].ruleName).toBe("FlowName");
+    expect(results[0].ruleResults[0].occurs).toBe(false);
+  });
+  
+  it("should not have a result when in line with conventions", async () => {
+    const flows = await core.parse([fixed_uri]);
+    const ruleConfig = {
+      ruleMode: "isolated" as const,
+      rules: {
+        FlowName: {
+          severity: "error",
+          expression: "[A-Za-z0-9]+_[A-Za-z0-9]+",
+        },
+      },
+    };
+    const results: core.ScanResult[] = core.scan(flows, ruleConfig);
+    const occurringResults = results[0].ruleResults.filter((rule) => rule.occurs);
+    expect(occurringResults).toHaveLength(0);
+  });
+});

package/tests/GetRecordElementAllFields.test.ts

@@ -0,0 +1,182 @@
+import { ParsedFlow } from "../src/main/models/ParsedFlow";
+import { RuleResult, Flow, scan, ScanResult } from "../src";
+import { GetRecordAllFields } from "../src/main/rules/GetRecordAllFields";
+
+import { describe, it, expect } from "@jest/globals";
+
+describe("GetRecordAllFields", () => {
+  it("should be defined", () => {
+    expect(GetRecordAllFields).toBeDefined();
+  });
+
+  let rule: GetRecordAllFields;
+  beforeEach(() => {
+    rule = new GetRecordAllFields();
+  });
+
+  describe("e2e", () => {
+    it("should be empty when no Get Record elements are present", () => {
+      const config = {
+        ruleMode: "isolated",
+        rules: {
+          GetRecordAllFields: {
+            severity: "error",
+          },
+        },
+      };
+
+      const flows: ParsedFlow[] = [
+        {
+          flow: {
+            type: "AutoLaunchedFlow",
+          },
+        } as Partial<ParsedFlow> as ParsedFlow,
+      ];
+
+      const results: ScanResult[] = scan(flows, config);
+      const scanResults = results.pop();
+      const ruleResults = scanResults?.ruleResults.filter((rule) => {
+        return rule.ruleDefinition.name === "GetRecordAllFields" && rule.occurs;
+      });
+      expect(ruleResults).toHaveLength(0);
+    });
+
+    it("should error when getRecord element has storeOutputAutomatically", () => {
+      const config = {
+        ruleMode: "isolated",
+        rules: {
+          GetRecordAllFields: {
+            severity: "error",
+          },
+        },
+      };
+
+      const flows: ParsedFlow[] = [
+        {
+          flow: {
+            type: "AutoLaunchedFlow",
+            elements: [
+              {
+                name: "GetRecord",
+                subtype: "recordLookups",
+                metaType: "node",
+                element: {
+                  storeOutputAutomatically: true,
+                },
+              },
+            ],
+          },
+        } as Partial<ParsedFlow> as ParsedFlow,
+      ];
+
+      const results: ScanResult[] = scan(flows, config);
+      const scanResults = results.pop();
+      const ruleResults = scanResults?.ruleResults.filter((rule) => {
+        return rule.ruleDefinition.name === "GetRecordAllFields" && rule.occurs;
+      });
+      expect(ruleResults).toHaveLength(1);
+    });
+  });
+
+  describe("empty unit", () => {
+    it("should be empty results when no Get Record elements are present", () => {
+      const flow: Flow = {
+        type: "AutoLaunchedFlow",
+      } as Partial<Flow> as Flow;
+      const result: RuleResult = rule.execute(flow);
+      expect(result.occurs).toBeFalsy();
+    });
+
+    it("should be empty when no qualified node", () => {
+      const flow: Flow = {
+        type: "AutoLaunchedFlow",
+        elements: [
+          {
+            name: "GetRecord",
+            subtype: "recordLookups",
+            metaType: "node",
+            element: "attribute",
+          },
+        ],
+      } as Partial<Flow> as Flow;
+      const result: RuleResult = rule.execute(flow);
+      expect(result.occurs).toBeFalsy();
+    });
+
+    it("should be empty when outputReference and queriedFields are present", () => {
+      const flow: Flow = {
+        type: "AutoLaunchedFlow",
+        elements: [
+          {
+            name: "GetRecord",
+            subtype: "recordLookups",
+            metaType: "node",
+            element: {
+              queriedFields: ["Id", "AccountId"],
+              outputReference: "outputReference",
+            },
+          },
+        ],
+      } as Partial<Flow> as Flow;
+      const result: RuleResult = rule.execute(flow);
+      expect(result.occurs).toBeFalsy();
+    });
+
+    it("should be empty when outputAssignments are present", () => {
+      const flow: Flow = {
+        type: "AutoLaunchedFlow",
+        elements: [
+          {
+            name: "GetRecord",
+            subtype: "recordLookups",
+            metaType: "node",
+            element: {
+              outputAssignments: [{ assignToReference: "testVar", field: "AccountId" }],
+            },
+          },
+        ],
+      } as Partial<Flow> as Flow;
+      const result: RuleResult = rule.execute(flow);
+      expect(result.occurs).toBeFalsy();
+    });
+
+    it("should be empty when storeOutputAutomatically and queriedFields", () => {
+      const flow: Flow = {
+        type: "AutoLaunchedFlow",
+        elements: [
+          {
+            name: "GetRecord",
+            subtype: "recordLookups",
+            metaType: "node",
+            element: {
+              storeOutputAutomatically: true,
+              queriedFields: ["Id", "AccountId"],
+            },
+          },
+        ],
+      } as Partial<Flow> as Flow;
+      const result: RuleResult = rule.execute(flow);
+      expect(result.occurs).toBeFalsy();
+    });
+  });
+
+  describe("error unit", () => {
+    it("should error when Get Record element has storeOutputAutomatically and no queriedFields", () => {
+      const flow: Flow = {
+        type: "AutoLaunchedFlow",
+        elements: [
+          {
+            name: "GetRecord",
+            subtype: "recordLookups",
+            metaType: "node",
+            element: {
+              storeOutputAutomatically: true,
+            },
+          },
+        ],
+      } as Partial<Flow> as Flow;
+      const result: RuleResult = rule.execute(flow);
+      expect(result.occurs).toBe(true);
+    });
+  });
+});

package/tests/HardcodedId.test.ts

@@ -0,0 +1,16 @@
+import * as core from "../src";
+import * as path from "path";
+
+import { describe, it, expect } from "@jest/globals";
+
+describe("HardcodedId", () => {
+  const example_uri = path.join(__dirname, "../../../example-flows/force-app/demo/Hardcoded_Id.flow-meta.xml");
+
+  it("there should be one result for the rule HardcodedIds", async () => {
+    const flows = await core.parse([example_uri]);
+    const results: core.ScanResult[] = core.scan(flows);
+    const occurringResults = results[0].ruleResults.filter((rule) => rule.occurs);
+    expect(occurringResults).toHaveLength(1);
+    expect(occurringResults[0].ruleName).toBe("HardcodedId");
+  });
+});

package/tests/HardcodedSecret.test.ts

@@ -0,0 +1,32 @@
+import * as core from "../src";
+import * as path from "path";
+
+import { describe, it, expect } from "@jest/globals";
+
+describe("HardcodedSecret", () => {
+  const example_uri = path.join(__dirname, "../../../example-flows/force-app/testing/Hardcoded_Secret.flow-meta.xml");
+
+  it("should not be available without betaMode", async () => {
+    const flows = await core.parse([example_uri]);
+    const results: core.ScanResult[] = core.scan(flows);
+    const ruleNames = results[0].ruleResults.map((r) => r.ruleName);
+    expect(ruleNames).not.toContain("HardcodedSecret");
+  });
+
+  it("should be available with betaMode enabled", async () => {
+    const flows = await core.parse([example_uri]);
+    const results: core.ScanResult[] = core.scan(flows, { betaMode: true });
+    const ruleNames = results[0].ruleResults.map((r) => r.ruleName);
+    expect(ruleNames).toContain("HardcodedSecret");
+  });
+
+  it("should detect Stripe secret key in flow variable", async () => {
+    const flows = await core.parse([example_uri]);
+    const results: core.ScanResult[] = core.scan(flows, { betaMode: true });
+    const secretRule = results[0].ruleResults.find((r) => r.ruleName === "HardcodedSecret");
+
+    expect(secretRule).toBeDefined();
+    expect(secretRule!.occurs).toBe(true);
+    expect(secretRule!.details.length).toBeGreaterThan(0);
+  });
+});