@intentius/chant 0.79.0 → 0.81.0

package/src/discovery/sandbox/path-lexicon-parity.test.ts

@@ -0,0 +1,162 @@
+/**
+ * chant#2577 — a lexicon declared by path in `chant.config.ts` (#2520) gets the
+ * same fold treatment as the same lexicon installed as a package, with and
+ * without `--sandbox`.
+ *
+ * One lexicon source is written twice: once as the package
+ * `@intentius/chant-lexicon-demo` under the fixture's own `node_modules`, and
+ * once as `./lexicon/index.ts` named by path. The two projects differ only in
+ * how `chant.config.ts` names the lexicon and in the specifier `main.ts`
+ * imports it by. Each project's config is loaded, which is what records a
+ * path-declared lexicon, and each is built with the lexicon list a CLI build
+ * passes (the loaded plugins' names). The outputs and fold verdicts are compared.
+ */
+import { describe, test, expect, beforeAll, afterAll, afterEach } from "vitest";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { build } from "../../build";
+import { loadChantConfig } from "../../config";
+import { resetLexiconModules } from "../../lexicon-module";
+import type { LexiconPlugin } from "../../lexicon";
+
+const runtimePath = resolve(import.meta.dirname, "../../runtime");
+const compositePath = resolve(import.meta.dirname, "../../composite");
+
+const LEXICON_SOURCE = `
+import { createResource } from ${JSON.stringify(runtimePath)};
+import { Composite } from ${JSON.stringify(compositePath)};
+
+export const Bucket = createResource("Demo::Bucket", "demo", { arn: "Arn" });
+export const Role = createResource("Demo::Role", "demo", {});
+export const Regions = { primary: "us-east-1" };
+
+export const WebApp = Composite((props) => {
+  const bucket = new Bucket({ bucketName: props.name });
+  const role = new Role({ resource: bucket.arn });
+  return { bucket, role };
+}, "WebApp");
+
+function plain(value) {
+  if (value && typeof value === "object" && typeof value.getLogicalName === "function") {
+    return { ref: value.getLogicalName(), attr: value.attribute };
+  }
+  if (Array.isArray(value)) return value.map(plain);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, plain(v)]));
+  }
+  return value;
+}
+
+export const demoPlugin = {
+  name: "demo",
+  serializer: {
+    name: "demo",
+    rulePrefix: "DEMO",
+    serialize: (entities) =>
+      JSON.stringify(
+        Object.fromEntries(
+          [...entities.keys()].sort().map((name) => {
+            const entity = entities.get(name);
+            return [name, { type: entity.entityType, props: plain(entity.props) }];
+          }),
+        ),
+      ),
+  },
+  generate: async () => {},
+  validate: async () => {},
+  coverage: async () => {},
+  package: async () => {},
+};
+`;
+
+function mainSource(specifier: string): string {
+  return `
+import { Bucket, Regions, WebApp } from ${JSON.stringify(specifier)};
+
+export const logs = new Bucket({ bucketName: Regions.primary });
+export const web = WebApp({ name: "data" });
+`;
+}
+
+let root: string;
+
+beforeAll(async () => {
+  root = await realpath(await mkdtemp(join(tmpdir(), "chant-2577-")));
+
+  const pkg = join(root, "pkg");
+  const pkgDir = join(pkg, "node_modules", "@intentius", "chant-lexicon-demo");
+  await mkdir(pkgDir, { recursive: true });
+  await writeFile(
+    join(pkgDir, "package.json"),
+    JSON.stringify({ name: "@intentius/chant-lexicon-demo", type: "module", main: "index.ts" }),
+  );
+  await writeFile(join(pkgDir, "index.ts"), LEXICON_SOURCE);
+  await mkdir(join(pkg, "src"));
+  await writeFile(join(pkg, "src", "main.ts"), mainSource("@intentius/chant-lexicon-demo"));
+  await writeFile(join(pkg, "chant.config.ts"), `export default { lexicons: ["demo"] };\n`);
+
+  const path = join(root, "path");
+  await mkdir(join(path, "lexicon"), { recursive: true });
+  await writeFile(join(path, "lexicon", "index.ts"), LEXICON_SOURCE);
+  await mkdir(join(path, "src"));
+  await writeFile(join(path, "src", "main.ts"), mainSource("../lexicon"));
+  await writeFile(
+    join(path, "chant.config.ts"),
+    `export default { lexicons: [{ name: "demo", module: "./lexicon/index.ts" }] };\n`,
+  );
+});
+
+afterAll(async () => {
+  await rm(root, { recursive: true, force: true });
+});
+
+afterEach(() => {
+  resetLexiconModules();
+});
+
+async function buildProject(project: "pkg" | "path", modes: { fold: boolean; sandbox: boolean }) {
+  const dir = join(root, project);
+  const lexiconFile =
+    project === "pkg"
+      ? join(dir, "node_modules", "@intentius", "chant-lexicon-demo", "index.ts")
+      : join(dir, "lexicon", "index.ts");
+  await loadChantConfig(dir);
+  const plugin = (await import(lexiconFile)).demoPlugin as LexiconPlugin;
+  const result = await build(join(dir, "src"), [plugin.serializer], undefined, {
+    ...modes,
+    lexicons: [plugin.name],
+  });
+  return {
+    errors: result.errors,
+    output: result.outputs.get("demo") as string,
+    decisions: result.foldDecisions.map((d) => ({ file: d.file.slice(dir.length), mode: d.mode, reason: d.reason })),
+  };
+}
+
+describe("a lexicon declared by path folds like the same lexicon installed as a package (chant#2577)", () => {
+  for (const modes of [
+    { fold: true, sandbox: true },
+    { fold: true, sandbox: false },
+  ]) {
+    test(
+      `--fold${modes.sandbox ? " --sandbox" : ""}: same output, same fold verdicts`,
+      async () => {
+        const asPackage = await buildProject("pkg", modes);
+        const byPath = await buildProject("path", modes);
+
+        expect(asPackage.errors).toEqual([]);
+        expect(byPath.errors).toEqual([]);
+        expect(byPath.output).toBe(asPackage.output);
+        expect(JSON.parse(byPath.output)).toEqual({
+          logs: { type: "Demo::Bucket", props: { bucketName: "us-east-1" } },
+          webBucket: { type: "Demo::Bucket", props: { bucketName: "data" } },
+          webRole: { type: "Demo::Role", props: { resource: { ref: "webBucket", attr: "Arn" } } },
+        });
+        expect(byPath.decisions).toEqual(asPackage.decisions);
+        expect(byPath.decisions).toEqual([{ file: "/src/main.ts", mode: "fold", reason: undefined }]);
+      },
+      60_000,
+    );
+  }
+});

package/src/discovery/walk.test.ts

@@ -0,0 +1,263 @@
+import { afterEach, describe, expect, test } from "vitest";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join, relative } from "node:path";
+import { walkDiscovery, workspaceMemberDirs, type DiscoveryWalker } from "./walk";
+import { findInfraFiles } from "./files";
+import { discoverOps } from "../op/discover";
+import type { DiscoveryGlobs } from "../config";
+import { auditCommand } from "../cli/commands/audit";
+
+/**
+ * chant#2527: one discovery walk. Every walker skips dot-directories, `dist`
+ * and git-ignored paths, stops at child projects inside a project, reads
+ * every child project outside one, and lets `include` re-admit what it skips.
+ */
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+
+function tree(files: Record<string, string>, opts: { git?: boolean } = {}): string {
+  const root = mkdtempSync(join(tmpdir(), "chant-2527-"));
+  dirs.push(root);
+  for (const [path, body] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), body);
+  }
+  if (opts.git) execFileSync("git", ["init", "-q"], { cwd: root });
+  return root;
+}
+
+const WALKERS: DiscoveryWalker[] = ["source", "lint", "components", "ops", "audit"];
+
+function walk(walker: DiscoveryWalker, root: string, globs?: Partial<DiscoveryGlobs>): string[] {
+  return walkDiscovery({
+    walker,
+    root,
+    accept: (name) => name.endsWith(".ts"),
+    globs: globs ? { root, exclude: [], include: [], ...globs } : undefined,
+  })
+    .map((f) => relative(root, f).split("\\").join("/"))
+    .sort();
+}
+
+describe("the rules every walker shares (#2527)", () => {
+  test.each(WALKERS)("%s skips dot-directories, dist and node_modules", (walker) => {
+    const root = tree({
+      "a.ts": "",
+      ".cache/b.ts": "",
+      "dist/c.ts": "",
+      "src/dist/d.ts": "",
+      "node_modules/x/e.ts": "",
+      ".github/f.ts": "",
+    });
+    const expected = walker === "audit" ? [".github/f.ts", "a.ts"] : ["a.ts"];
+    expect(walk(walker, root)).toEqual(expected);
+  });
+
+  test.each(WALKERS)("%s skips git-ignored paths, nested .gitignore included", (walker) => {
+    const root = tree(
+      {
+        ".gitignore": "vendor/\n",
+        "a.ts": "",
+        "vendor/b.ts": "",
+        "pkg/.gitignore": "gen.ts\n",
+        "pkg/gen.ts": "",
+        "pkg/keep.ts": "",
+      },
+      { git: true },
+    );
+    expect(walk(walker, root)).toEqual(["a.ts", "pkg/keep.ts"]);
+  });
+
+  test("a scan root that is itself ignored is read", () => {
+    const root = tree({ ".gitignore": "/carveout/\n", "carveout/src/main.ts": "" }, { git: true });
+    const src = join(root, "carveout", "src");
+    expect(walk("lint", src)).toEqual(["main.ts"]);
+  });
+
+  test("a tree outside git is read without ignore rules", () => {
+    const root = tree({ ".gitignore": "*.ts\n", "a.ts": "" });
+    expect(walk("source", root)).toEqual(["a.ts"]);
+  });
+});
+
+describe("child projects (#2527)", () => {
+  const files = {
+    "chant.config.ts": "export default {};\n",
+    "main.ts": "",
+    "east/chant.config.ts": "export default {};\n",
+    "east/e.ts": "",
+    "west/chant.config.json": JSON.stringify({ lexicons: ["aws"] }),
+    "west/w.ts": "",
+    "lintonly/chant.config.json": JSON.stringify({ rules: { COR004: "off" } }),
+    "lintonly/l.ts": "",
+  };
+
+  test.each(WALKERS)("inside a project, %s stops at every child project, .json configs included, and not at a lint-only fragment", (walker) => {
+    const root = tree(files);
+    expect(walk(walker, root)).toEqual(["chant.config.ts", "lintonly/l.ts", "main.ts"]);
+  });
+
+  test("the first-config quirk is gone: no child project is read as the project's own source", () => {
+    const root = tree({ "chant.config.ts": "export default {};\n", "src/chant.config.ts": "export default {};\n", "src/a.ts": "", "zz/chant.config.ts": "export default {};\n", "zz/b.ts": "" });
+    expect(walk("source", root)).toEqual(["chant.config.ts"]);
+  });
+
+  test.each(["source", "components", "lint"] as DiscoveryWalker[])("outside a project, %s reads every child project", (walker) => {
+    const root = tree({ "package.json": "{}", "a/chant.config.ts": "", "a/x.ts": "", "b/chant.config.ts": "", "b/y.ts": "" });
+    expect(walk(walker, root)).toEqual(["a/chant.config.ts", "a/x.ts", "b/chant.config.ts", "b/y.ts"]);
+  });
+
+  test("Op discovery stops at child projects even with no config at its root", () => {
+    const root = tree({ "package.json": "{}", "a/chant.config.ts": "", "a/x.ts": "", "top.ts": "" });
+    expect(walk("ops", root)).toEqual(["top.ts"]);
+  });
+
+  test("discoverOps from a configless git root does not collect a sibling project's Ops", async () => {
+    const root = tree(
+      {
+        "ops/local.op.ts": `export default { props: { name: "local", phases: [] } };\n`,
+        "sibling/chant.config.json": JSON.stringify({ lexicons: ["aws"] }),
+        "sibling/ops/theirs.op.ts": `export default { props: { name: "theirs", phases: [] } };\n`,
+      },
+      { git: true },
+    );
+    const { ops, errors } = await discoverOps({ cwd: root });
+    expect(errors).toEqual([]);
+    expect([...ops.keys()]).toEqual(["local"]);
+  });
+});
+
+describe("include and exclude (#2519, #2527)", () => {
+  test("include re-admits a dot-directory, dist, an ignored path and a child project", () => {
+    const root = tree(
+      {
+        "chant.config.ts": "export default {};\n",
+        ".gitignore": "gen/\n",
+        ".cache/a.ts": "",
+        "dist/b.ts": "",
+        "gen/c.ts": "",
+        "stack/chant.config.ts": "",
+        "stack/d.ts": "",
+        "main.ts": "",
+      },
+      { git: true },
+    );
+    expect(walk("source", root)).toEqual(["chant.config.ts", "main.ts"]);
+    expect(walk("source", root, { include: [".cache", "dist/b.ts", "gen", "stack"] })).toEqual([
+      ".cache/a.ts",
+      "chant.config.ts",
+      "dist/b.ts",
+      "gen/c.ts",
+      "main.ts",
+      "stack/chant.config.ts",
+      "stack/d.ts",
+    ]);
+  });
+
+  test("an include below a skipped directory reads only what it names there", () => {
+    const root = tree({ ".tool/keep/a.ts": "", ".tool/drop/b.ts": "", ".tool/c.ts": "" });
+    expect(walk("source", root, { include: [".tool/keep/**"] })).toEqual([".tool/keep/a.ts"]);
+  });
+
+  test("exclude drops files, include wins over it, and include never reaches node_modules", () => {
+    const root = tree({ "ops/run.ts": "", "ops/stack.ts": "", "node_modules/x/a.ts": "", "main.ts": "" });
+    expect(walk("ops", root, { exclude: ["ops"], include: ["ops/stack.ts", "node_modules"] })).toEqual(["main.ts", "ops/stack.ts"]);
+  });
+
+  test("findInfraFiles reads include from the project config", async () => {
+    const root = tree({
+      "chant.config.json": JSON.stringify({ lexicons: ["aws"], include: ["src"] }),
+      "src/chant.config.ts": "export default { lint: {} };\n",
+      "src/a.ts": "",
+    });
+    const files = (await findInfraFiles(root)).map((f) => relative(root, f)).sort();
+    expect(files).toEqual(["src/a.ts", "src/chant.config.ts"]);
+  });
+});
+
+describe("workspace members and groups (#2525 rule 3, read by #2534's reader)", () => {
+  test("nothing is excluded without a workspace declaration", async () => {
+    const root = tree({ "chant.config.json": JSON.stringify({ lexicons: ["aws"] }), "members/a/x.ts": "" }, { git: true });
+    expect(await workspaceMemberDirs(root)).toEqual([]);
+  });
+
+  test("with chant.workspace.json, member directories below the scan root leave the walk", async () => {
+    const root = tree(
+      {
+        "chant.workspace.json": JSON.stringify({
+          name: "w",
+          schema: 1,
+          members: [
+            { name: "root", dir: ".", kind: "chant" },
+            { name: "a", dir: "members/a", kind: "chant" },
+          ],
+        }),
+        "main.ts": "",
+        "members/a/x.ts": "",
+        "members/b/y.ts": "",
+      },
+      { git: true },
+    );
+    const excludeDirs = await workspaceMemberDirs(root);
+    expect(excludeDirs.map((d) => relative(root, d))).toEqual(["members/a"]);
+    const files = walkDiscovery({ walker: "source", root, accept: (n) => n.endsWith(".ts"), excludeDirs, globs: { root, exclude: [], include: ["members"] } });
+    expect(files.map((f) => relative(root, f)).sort()).toEqual(["main.ts", "members/b/y.ts"]);
+    // Scanned from inside the member, the member is the project and is read.
+    expect(await workspaceMemberDirs(join(root, "members", "a"))).toEqual([]);
+  });
+
+  test("an example group's matches leave the walk too, and a .jsonc declaration counts", async () => {
+    const root = tree(
+      {
+        "chant.workspace.jsonc": `{
+          // groups are read through #2534's declaration reader
+          "name": "w",
+          "schema": 1,
+          "members": [
+            { "name": "root", "dir": ".", "kind": "chant" },
+            { "name": "examples", "kind": "examples", "glob": "examples/*" },
+          ],
+        }`,
+        "main.ts": "",
+        "examples/one/chant.config.ts": "export default {};",
+        "examples/one/x.ts": "",
+        "examples/notes/readme.ts": "",
+      },
+      { git: true },
+    );
+    const excludeDirs = await workspaceMemberDirs(root);
+    // `examples/notes` holds no chant project, so the group leaves it alone.
+    expect(excludeDirs.map((d) => relative(root, d))).toEqual(["examples/one"]);
+  });
+
+  test("chant audit at the workspace root leaves members out", async () => {
+    const root = tree(
+      {
+        "chant.workspace.json": JSON.stringify({
+          name: "w",
+          schema: 1,
+          members: [
+            { name: "root", dir: ".", kind: "chant" },
+            { name: "a", dir: "members/a", kind: "chant" },
+          ],
+        }),
+        "terraform.tfstate": "{}",
+        "members/a/terraform.tfstate": "{}",
+      },
+      { git: true },
+    );
+    // No lexicons: TF023 still runs, and its paths show what the walk read.
+    const result = await auditCommand({ path: root, format: "json", plugins: [] });
+    expect(result.findings.filter((f) => f.checkId === "TF023").map((f) => f.file)).toEqual(["terraform.tfstate"]);
+  });
+
+  test("a declaration that fails to read excludes nothing", async () => {
+    const root = tree({ "chant.workspace.json": "{ not json", "members/a/x.ts": "" }, { git: true });
+    expect(await workspaceMemberDirs(root)).toEqual([]);
+  });
+});