@growth-labs/conformance 0.1.0 → 0.2.0

package/src/schema.ts

@@ -1,9 +1,28 @@
 import { z } from 'zod'
 
-export const EVIDENCE_SCHEMA_VERSION = 'growth-labs.conformance.v1'
+export const EVIDENCE_SCHEMA_VERSION = 'growth-labs.conformance.v2'
+export const REQUIRED_FUNCTIONAL_PROBE_NAMES = [
+	'oauth',
+	'media',
+	'images',
+	'analytics',
+	'embeds',
+	'error-pages',
+] as const
 
 export const REQUIRED_NEGATIVE_FIXTURE_CODES = {
 	'csp-unsafe-inline': 'security.csp.unsafe_inline',
+	'missing-coop': 'security.header.missing',
+	'missing-corp': 'security.header.missing',
+	'hsts-below-one-year': 'security.hsts.max_age_too_low',
+	'csp-wildcard-default-src': 'security.csp.default_src_wildcard',
+	'csp-unsafe-eval': 'security.csp.unsafe_eval',
+	'csp-inline-executable-without-nonce-or-hash':
+		'security.csp.inline_executable_without_nonce_or_hash',
+	'conflicting-duplicate-security-header': 'security.header.conflicting_values',
+	'missing-functional-probe-receipt': 'security.functional_probe.missing',
+	'missing-csp-report-receipt': 'security.csp_report.missing',
+	'failed-csp-report-receipt': 'security.csp_report.failed',
 	'headers-static-only-while-ssr-missing': 'security.headers.static_only_for_ssr',
 	'undeclared-na': 'publication.na.undeclared',
 	'stringified-is-accessible-for-free': 'structured_data.is_accessible_for_free.stringified',
@@ -62,6 +81,30 @@ export const cacheVariantSchema = z.object({
 	headers: headerMapSchema.default({}),
 })
 
+export const securityFunctionalProbeReceiptSchema = z.object({
+	name: z.string().min(1),
+	status: checkStatusSchema,
+	checkedAt: z.string().min(1).optional(),
+	evidence: z.string().min(1).optional(),
+	capabilityBoundary: z.string().min(1).optional(),
+})
+
+export const cspReportReceiptSchema = z.object({
+	name: z.string().min(1),
+	status: checkStatusSchema,
+	checkedAt: z.string().min(1).optional(),
+	evidence: z.string().min(1).optional(),
+	endpoint: z.string().min(1).optional(),
+	capabilityBoundary: z.string().min(1).optional(),
+})
+
+export const securityReceiptsSchema = z
+	.object({
+		functionalProbes: z.array(securityFunctionalProbeReceiptSchema).default([]),
+		cspReports: z.array(cspReportReceiptSchema).default([]),
+	})
+	.default({ functionalProbes: [], cspReports: [] })
+
 export const buildEvidenceSchema = z.object({
 	commitSha: z.string().min(7).optional(),
 	artifactId: z.string().min(1).optional(),
@@ -88,6 +131,7 @@ export const conformanceFixtureSchema = z.object({
 	expected: conformanceExpectedSchema.default({}),
 	publicationSurfaces: z.array(publicationSurfaceSchema).default([]),
 	cacheVariants: z.array(cacheVariantSchema).default([]),
+	securityReceipts: securityReceiptsSchema,
 	buildEvidence: buildEvidenceSchema.optional(),
 	expectedFailingCode: z.string().min(1).optional(),
 })
@@ -125,6 +169,7 @@ export const siteEvidenceBundleSchema = z.object({
 	summary: evidenceSummarySchema,
 	checks: z.array(conformanceCheckReceiptSchema),
 	findings: z.array(conformanceFindingSchema),
+	securityReceipts: securityReceiptsSchema,
 })
 
 export const fleetEvidenceBundleSchema = z.object({
@@ -143,6 +188,9 @@ export type HeaderMap = z.infer<typeof headerMapSchema>
 export type SurfaceResponse = z.infer<typeof surfaceResponseSchema>
 export type PublicationSurfaceEvidence = z.infer<typeof publicationSurfaceSchema>
 export type CacheVariant = z.infer<typeof cacheVariantSchema>
+export type SecurityFunctionalProbeReceipt = z.infer<typeof securityFunctionalProbeReceiptSchema>
+export type CspReportReceipt = z.infer<typeof cspReportReceiptSchema>
+export type SecurityReceipts = z.infer<typeof securityReceiptsSchema>
 export type BuildEvidence = z.infer<typeof buildEvidenceSchema>
 export type ConformanceFixtureInput = z.input<typeof conformanceFixtureSchema>
 export type ConformanceFixture = z.infer<typeof conformanceFixtureSchema>