@oculum/scanner 1.0.10 → 1.0.12

package/src/__tests__/snapshots/anthropic-validation-refactor.test.ts

@@ -0,0 +1,321 @@
+/**
+ * Refactor Safety Snapshot Tests for anthropic.ts
+ *
+ * These tests capture the current behavior of the AI validation logic
+ * to ensure refactoring doesn't change any behavior.
+ *
+ * DO NOT modify these tests unless intentionally changing validation behavior.
+ */
+
+import { applyAutoDismissRules } from '../../layer3/anthropic'
+import type { Vulnerability, VulnerabilityCategory, VulnerabilitySeverity } from '../../types'
+
+// Helper to create test findings
+function createFinding(overrides: Partial<Vulnerability> = {}): Vulnerability {
+  return {
+    id: 'test-finding-1',
+    filePath: 'src/handler.ts',
+    lineNumber: 10,
+    lineContent: 'const x = 1;',
+    severity: 'high' as VulnerabilitySeverity,
+    category: 'dangerous_function' as VulnerabilityCategory,
+    title: 'Test Finding',
+    description: 'Test description',
+    suggestedFix: 'Fix it',
+    confidence: 'high',
+    layer: 2,
+    ...overrides,
+  }
+}
+
+describe('Refactor Safety - anthropic.ts Auto-Dismiss Rules', () => {
+  describe('Test file auto-dismiss', () => {
+    it('should auto-dismiss findings in test files', () => {
+      const findings = [
+        createFinding({ filePath: 'src/__tests__/handler.test.ts' }),
+        createFinding({ filePath: 'src/handler.spec.ts' }),
+        createFinding({ filePath: 'tests/integration/api.test.js' }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+
+    it('should auto-dismiss findings in mock files', () => {
+      const findings = [
+        createFinding({ filePath: 'src/__mocks__/api.ts' }),
+        createFinding({ filePath: 'mocks/handler.ts' }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Example file auto-dismiss', () => {
+    it('should auto-dismiss findings in example files', () => {
+      const findings = [
+        createFinding({ filePath: 'examples/basic-usage.ts' }),
+        createFinding({ filePath: 'src/examples/demo.ts' }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Documentation file auto-dismiss', () => {
+    it('should auto-dismiss findings in documentation files', () => {
+      const findings = [
+        createFinding({ filePath: 'docs/api.md' }),
+        createFinding({ filePath: 'README.md' }),
+        createFinding({ filePath: 'CHANGELOG.txt' }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Scanner code auto-dismiss', () => {
+    it('should auto-dismiss findings in scanner/fixture code', () => {
+      const findings = [
+        createFinding({ filePath: 'packages/scanner/src/layer1/patterns.ts' }),
+        createFinding({ filePath: 'src/__tests__/fixtures/vulnerable.ts' }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Environment variable reference auto-dismiss', () => {
+    it('should auto-dismiss env var references flagged as secrets', () => {
+      const findings = [
+        createFinding({
+          category: 'hardcoded_secret',
+          lineContent: 'const apiKey = process.env.API_KEY;',
+        }),
+        createFinding({
+          category: 'high_entropy_string',
+          lineContent: 'const secret = process.env.SECRET_KEY;',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+
+    it('should NOT auto-dismiss actual hardcoded secrets', () => {
+      const findings = [
+        createFinding({
+          category: 'hardcoded_secret',
+          lineContent: 'const apiKey = "sk-1234567890abcdef";',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Health check endpoint auto-dismiss', () => {
+    it('should auto-dismiss health check missing_auth findings', () => {
+      const findings = [
+        createFinding({
+          category: 'missing_auth',
+          lineContent: 'app.get("/health", (req, res) => res.send("ok"))',
+          filePath: 'src/api/health.ts',
+        }),
+        createFinding({
+          category: 'missing_auth',
+          lineContent: 'router.get("/api/healthcheck", handler)',
+          filePath: 'src/routes/health.ts',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+
+    it('should NOT auto-dismiss other missing_auth findings', () => {
+      const findings = [
+        createFinding({
+          category: 'missing_auth',
+          lineContent: 'app.post("/api/users", createUser)',
+          filePath: 'src/api/users.ts',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('CSS classes auto-dismiss', () => {
+    it('should auto-dismiss Tailwind classes flagged as high entropy', () => {
+      const findings = [
+        createFinding({
+          category: 'high_entropy_string',
+          lineContent: 'className="flex items-center justify-between px-4 py-2 text-sm"',
+        }),
+        createFinding({
+          category: 'high_entropy_string',
+          lineContent: 'class="bg-gray-100 rounded-lg shadow-md hover:bg-gray-200"',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+
+    it('should NOT auto-dismiss high entropy strings without CSS indicators', () => {
+      const findings = [
+        createFinding({
+          category: 'high_entropy_string',
+          lineContent: 'const token = "aB3dE5fG7hI9jK1lM3nO5pQ7rS9tU1vW3xY5z";',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Comment line auto-dismiss', () => {
+    it('should auto-dismiss findings in comment lines', () => {
+      const findings = [
+        createFinding({
+          category: 'hardcoded_secret',
+          lineContent: '// TODO: Replace with env var: API_KEY=sk-1234',
+        }),
+        createFinding({
+          category: 'dangerous_function',
+          lineContent: '/* eval(userCode) would be dangerous */',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+
+    it('should NOT auto-dismiss ai_pattern findings in comments', () => {
+      const findings = [
+        createFinding({
+          category: 'ai_pattern',
+          lineContent: '// AI-generated code pattern',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Info severity auto-dismiss (core tier only)', () => {
+    it('should auto-dismiss info severity for core tier findings', () => {
+      const findings = [
+        createFinding({
+          severity: 'info',
+          category: 'dangerous_function',
+          layer: 2,
+        }),
+        createFinding({
+          severity: 'info',
+          category: 'hardcoded_secret',
+          layer: 1,
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+
+    it('should auto-dismiss info severity ai_pattern findings (code quality, not security)', () => {
+      const findings = [
+        createFinding({
+          severity: 'info',
+          category: 'ai_pattern',
+          layer: 2,
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Generic message auto-dismiss', () => {
+    it('should auto-dismiss generic success/error messages', () => {
+      const findings = [
+        createFinding({
+          category: 'ai_pattern',
+          lineContent: 'console.log("success");',
+        }),
+        createFinding({
+          category: 'ai_pattern',
+          lineContent: 'throw new Error("something went wrong");',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Type definition any auto-dismiss', () => {
+    it('should auto-dismiss any type in .d.ts files', () => {
+      const findings = [
+        createFinding({
+          category: 'ai_pattern',
+          title: 'TypeScript any usage',
+          filePath: 'types/global.d.ts',
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Mixed findings', () => {
+    it('should correctly filter mixed findings', () => {
+      const findings = [
+        // Should be dismissed - test file
+        createFinding({
+          id: '1',
+          filePath: 'src/__tests__/handler.test.ts',
+          category: 'dangerous_function',
+        }),
+        // Should be kept - real code
+        createFinding({
+          id: '2',
+          filePath: 'src/api/handler.ts',
+          category: 'dangerous_function',
+          severity: 'high',
+        }),
+        // Should be dismissed - env var
+        createFinding({
+          id: '3',
+          filePath: 'src/config.ts',
+          category: 'hardcoded_secret',
+          lineContent: 'const key = process.env.SECRET;',
+        }),
+        // Should be kept - actual secret
+        createFinding({
+          id: '4',
+          filePath: 'src/config.ts',
+          category: 'hardcoded_secret',
+          lineContent: 'const key = "actual-secret-value";',
+        }),
+        // Should be dismissed - info severity core
+        createFinding({
+          id: '5',
+          filePath: 'src/util.ts',
+          severity: 'info',
+          category: 'dangerous_function',
+          layer: 2,
+        }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result).toMatchSnapshot()
+    })
+  })
+
+  describe('Auto-dismiss stats tracking', () => {
+    it('should correctly count auto-dismissed findings', () => {
+      const findings = [
+        createFinding({ filePath: 'src/__tests__/test.ts' }),
+        createFinding({ filePath: 'src/__tests__/another.test.ts' }),
+        createFinding({ filePath: 'src/real-code.ts' }),
+      ]
+      const result = applyAutoDismissRules(findings)
+      expect(result.dismissed.length).toBe(2)
+      expect(result.toValidate.length).toBe(1)
+      expect(result).toMatchSnapshot()
+    })
+  })
+})