@ontrails/core 1.0.0-beta.4 → 1.0.0-beta.41

package/src/__tests__/path-security.test.ts

@@ -1,114 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-import { resolve, join } from 'node:path';
-
-import { PermissionError } from '../errors.js';
-import { securePath, isPathSafe, resolveSafePath } from '../path-security.js';
-
-// ---------------------------------------------------------------------------
-// securePath
-// ---------------------------------------------------------------------------
-
-describe('securePath', () => {
-  const base = '/project/workspace';
-
-  test('resolves a simple relative path', () => {
-    const result = securePath(base, 'src/index.ts');
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(resolve(base, 'src/index.ts'));
-  });
-
-  test('resolves nested paths', () => {
-    const result = securePath(base, 'src/../lib/utils.ts');
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(resolve(base, 'lib/utils.ts'));
-  });
-
-  test('accepts the base directory itself', () => {
-    const result = securePath(base, '.');
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(resolve(base));
-  });
-
-  test('rejects path traversal with ..', () => {
-    const result = securePath(base, '../../etc/passwd');
-    expect(result.isErr()).toBe(true);
-    const err = result as unknown as { error: PermissionError };
-    expect(err.error).toBeInstanceOf(PermissionError);
-    expect(err.error.message).toContain('Path traversal detected');
-  });
-
-  test('rejects absolute paths outside base', () => {
-    const result = securePath(base, '/etc/passwd');
-    expect(result.isErr()).toBe(true);
-    const err = result as unknown as { error: PermissionError };
-    expect(err.error).toBeInstanceOf(PermissionError);
-  });
-
-  test('rejects sneaky traversal (subdir/../../..)', () => {
-    const result = securePath(base, 'src/../../..');
-    expect(result.isErr()).toBe(true);
-  });
-
-  test('allows paths that mention .. but stay inside', () => {
-    const result = securePath(base, 'src/../src/file.ts');
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(resolve(base, 'src/file.ts'));
-  });
-});
-
-// ---------------------------------------------------------------------------
-// isPathSafe
-// ---------------------------------------------------------------------------
-
-describe('isPathSafe', () => {
-  const base = '/project/workspace';
-
-  test('returns true for child paths', () => {
-    expect(isPathSafe(base, 'src/index.ts')).toBe(true);
-  });
-
-  test('returns true for the base directory', () => {
-    expect(isPathSafe(base, '.')).toBe(true);
-  });
-
-  test('returns false for traversal', () => {
-    expect(isPathSafe(base, '../secret')).toBe(false);
-  });
-
-  test('returns false for absolute paths outside base', () => {
-    expect(isPathSafe(base, '/tmp/evil')).toBe(false);
-  });
-});
-
-// ---------------------------------------------------------------------------
-// resolveSafePath
-// ---------------------------------------------------------------------------
-
-describe('resolveSafePath', () => {
-  const base = '/project/workspace';
-
-  test('joins multiple segments safely', () => {
-    const result = resolveSafePath(base, 'src', 'lib', 'utils.ts');
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(join(resolve(base), 'src', 'lib', 'utils.ts'));
-  });
-
-  test('rejects when segments escape the base', () => {
-    const result = resolveSafePath(base, 'src', '../../../etc');
-    expect(result.isErr()).toBe(true);
-    const err = result as unknown as { error: PermissionError };
-    expect(err.error).toBeInstanceOf(PermissionError);
-  });
-
-  test('handles single segment', () => {
-    const result = resolveSafePath(base, 'file.txt');
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(resolve(base, 'file.txt'));
-  });
-
-  test('handles empty segments', () => {
-    const result = resolveSafePath(base);
-    expect(result.isOk()).toBe(true);
-    expect(result.unwrap()).toBe(resolve(base));
-  });
-});

package/src/__tests__/patterns.test.ts

@@ -1,273 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-
-import { z } from 'zod';
-
-import {
-  paginationFields,
-  paginatedOutput,
-  bulkOutput,
-  timestampFields,
-  dateRangeFields,
-  sortFields,
-  statusFields,
-  changeOutput,
-  progressFields,
-} from '../patterns/index.js';
-
-// ---------------------------------------------------------------------------
-// paginationFields
-// ---------------------------------------------------------------------------
-
-describe('paginationFields', () => {
-  const schema = paginationFields();
-
-  test('applies defaults for empty input', () => {
-    const result = schema.parse({});
-    expect(result).toEqual({ limit: 20, offset: 0 });
-  });
-
-  test('accepts explicit values', () => {
-    const result = schema.parse({ cursor: 'abc', limit: 50, offset: 10 });
-    expect(result).toEqual({ cursor: 'abc', limit: 50, offset: 10 });
-  });
-
-  test('rejects non-number limit', () => {
-    expect(() => schema.parse({ limit: 'ten' })).toThrow();
-  });
-
-  test('rejects non-string cursor', () => {
-    expect(() => schema.parse({ cursor: 123 })).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// paginatedOutput
-// ---------------------------------------------------------------------------
-
-describe('paginatedOutput', () => {
-  const schema = paginatedOutput(z.string());
-
-  test('parses valid paginated data', () => {
-    const data = {
-      hasMore: true,
-      items: ['a', 'b'],
-      nextCursor: 'x',
-      total: 10,
-    };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('allows missing nextCursor', () => {
-    const data = { hasMore: false, items: [], total: 0 };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('rejects wrong item type', () => {
-    expect(() =>
-      schema.parse({ hasMore: false, items: [1], total: 1 })
-    ).toThrow();
-  });
-
-  test('rejects missing total', () => {
-    expect(() => schema.parse({ hasMore: false, items: [] })).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// bulkOutput
-// ---------------------------------------------------------------------------
-
-describe('bulkOutput', () => {
-  const schema = bulkOutput(z.object({ id: z.number() }));
-
-  test('parses valid bulk result', () => {
-    const data = {
-      failed: 0,
-      items: [{ id: 1 }, { id: 2 }],
-      succeeded: 2,
-    };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('parses bulk result with errors', () => {
-    const data = {
-      errors: [{ index: 1, message: 'duplicate' }],
-      failed: 1,
-      items: [{ id: 1 }],
-      succeeded: 1,
-    };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('rejects missing succeeded field', () => {
-    expect(() => schema.parse({ failed: 0, items: [] })).toThrow();
-  });
-
-  test('rejects invalid error shape', () => {
-    expect(() =>
-      schema.parse({
-        errors: [{ bad: true }],
-        failed: 0,
-        items: [],
-        succeeded: 0,
-      })
-    ).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// timestampFields
-// ---------------------------------------------------------------------------
-
-describe('timestampFields', () => {
-  const schema = timestampFields();
-
-  test('parses valid timestamps', () => {
-    const data = {
-      createdAt: '2024-01-01T00:00:00Z',
-      updatedAt: '2024-06-01T00:00:00Z',
-    };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('rejects missing createdAt', () => {
-    expect(() => schema.parse({ updatedAt: '2024-01-01' })).toThrow();
-  });
-
-  test('rejects non-string values', () => {
-    expect(() => schema.parse({ createdAt: 123, updatedAt: 456 })).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// dateRangeFields
-// ---------------------------------------------------------------------------
-
-describe('dateRangeFields', () => {
-  const schema = dateRangeFields();
-
-  test('parses empty object (both optional)', () => {
-    expect(schema.parse({})).toEqual({});
-  });
-
-  test('parses with both fields', () => {
-    const data = { since: '2024-01-01', until: '2024-12-31' };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('parses with only since', () => {
-    expect(schema.parse({ since: '2024-01-01' })).toEqual({
-      since: '2024-01-01',
-    });
-  });
-
-  test('rejects non-string values', () => {
-    expect(() => schema.parse({ since: 42 })).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// sortFields
-// ---------------------------------------------------------------------------
-
-describe('sortFields', () => {
-  const schema = sortFields(['name', 'createdAt', 'updatedAt']);
-
-  test('applies default sortOrder', () => {
-    const result = schema.parse({});
-    expect(result).toEqual({ sortOrder: 'asc' });
-  });
-
-  test('accepts valid sortBy and sortOrder', () => {
-    const result = schema.parse({ sortBy: 'name', sortOrder: 'desc' });
-    expect(result).toEqual({ sortBy: 'name', sortOrder: 'desc' });
-  });
-
-  test('rejects sortBy not in allowed list', () => {
-    expect(() => schema.parse({ sortBy: 'email' })).toThrow();
-  });
-
-  test('rejects invalid sortOrder', () => {
-    expect(() => schema.parse({ sortOrder: 'up' })).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// statusFields
-// ---------------------------------------------------------------------------
-
-describe('statusFields', () => {
-  const schema = statusFields();
-
-  test('parses each valid status', () => {
-    for (const s of [
-      'pending',
-      'running',
-      'completed',
-      'failed',
-      'cancelled',
-    ] as const) {
-      expect(schema.parse({ status: s })).toEqual({ status: s });
-    }
-  });
-
-  test('rejects invalid status', () => {
-    expect(() => schema.parse({ status: 'unknown' })).toThrow();
-  });
-
-  test('rejects missing status', () => {
-    expect(() => schema.parse({})).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// changeOutput
-// ---------------------------------------------------------------------------
-
-describe('changeOutput', () => {
-  const schema = changeOutput(z.object({ name: z.string() }));
-
-  test('parses with both before and after', () => {
-    const data = { after: { name: 'new' }, before: { name: 'old' } };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('parses with only after (before is optional)', () => {
-    const data = { after: { name: 'created' } };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('rejects missing after', () => {
-    expect(() => schema.parse({ before: { name: 'old' } })).toThrow();
-  });
-
-  test('rejects invalid schema shape', () => {
-    expect(() => schema.parse({ after: { name: 123 } })).toThrow();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// progressFields
-// ---------------------------------------------------------------------------
-
-describe('progressFields', () => {
-  const schema = progressFields();
-
-  test('parses valid progress', () => {
-    const data = { current: 5, percentage: 50, total: 10 };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('allows missing percentage', () => {
-    const data = { current: 3, total: 10 };
-    expect(schema.parse(data)).toEqual(data);
-  });
-
-  test('rejects missing current', () => {
-    expect(() => schema.parse({ total: 10 })).toThrow();
-  });
-
-  test('rejects non-number values', () => {
-    expect(() => schema.parse({ current: 'five', total: 10 })).toThrow();
-  });
-});

package/src/__tests__/redaction.test.ts

@@ -1,244 +0,0 @@
-import { describe, test, expect } from 'bun:test';
-
-import { DEFAULT_SENSITIVE_KEYS, createRedactor } from '../redaction/index.js';
-
-// ---------------------------------------------------------------------------
-// DEFAULT_PATTERNS
-// ---------------------------------------------------------------------------
-
-describe('DEFAULT_PATTERNS', () => {
-  test('matches credit card numbers', () => {
-    const input = 'card: 4111-1111-1111-1111 end';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('card: [REDACTED] end');
-  });
-
-  test('matches credit card numbers with spaces', () => {
-    const input = 'card: 4111 1111 1111 1111 end';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('card: [REDACTED] end');
-  });
-
-  test('matches SSNs', () => {
-    const input = 'ssn is 123-45-6789';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('ssn is [REDACTED]');
-  });
-
-  test('matches bearer tokens', () => {
-    const input = 'Authorization: Bearer eyJhbGciOiJIUzI1NiJ9';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('Authorization: [REDACTED]');
-  });
-
-  test('matches basic auth', () => {
-    const input = 'Authorization: Basic dXNlcjpwYXNz';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('Authorization: [REDACTED]');
-  });
-
-  test('matches API keys with sk- prefix', () => {
-    const input = 'key: sk-abc123def456ghi';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('key: [REDACTED]');
-  });
-
-  test('matches API keys with pk_ prefix', () => {
-    const input = 'key: pk_live_abc123def456';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('key: [REDACTED]');
-  });
-
-  test('matches API keys with sk_ prefix', () => {
-    const input = 'key: sk_test_abc123def456';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('key: [REDACTED]');
-  });
-
-  test('matches JWT tokens', () => {
-    const input =
-      'jwt: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc123def456';
-    const redactor = createRedactor();
-    expect(redactor.redact(input)).toBe('jwt: [REDACTED]');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// DEFAULT_SENSITIVE_KEYS
-// ---------------------------------------------------------------------------
-
-describe('DEFAULT_SENSITIVE_KEYS', () => {
-  test('includes expected keys', () => {
-    const expected = [
-      'password',
-      'secret',
-      'token',
-      'apiKey',
-      'api_key',
-      'authorization',
-      'cookie',
-      'ssn',
-      'creditCard',
-      'credit_card',
-    ];
-    for (const key of expected) {
-      expect(DEFAULT_SENSITIVE_KEYS).toContain(key);
-    }
-  });
-});
-
-// ---------------------------------------------------------------------------
-// createRedactor().redact()
-// ---------------------------------------------------------------------------
-
-describe('createRedactor().redact()', () => {
-  test('replaces all matching patterns in a string', () => {
-    const redactor = createRedactor();
-    const input = 'cc: 4111-1111-1111-1111 ssn: 123-45-6789';
-    const result = redactor.redact(input);
-    expect(result).toBe('cc: [REDACTED] ssn: [REDACTED]');
-  });
-
-  test('returns string unchanged when no patterns match', () => {
-    const redactor = createRedactor();
-    const input = 'just a normal string';
-    expect(redactor.redact(input)).toBe('just a normal string');
-  });
-
-  test('works correctly when called multiple times (regex lastIndex reset)', () => {
-    const redactor = createRedactor();
-    const input = 'key: sk-abc123def456ghi';
-    expect(redactor.redact(input)).toBe('key: [REDACTED]');
-    expect(redactor.redact(input)).toBe('key: [REDACTED]');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// createRedactor().redactObject()
-// ---------------------------------------------------------------------------
-
-describe('createRedactor().redactObject()', () => {
-  test('redacts values for sensitive keys', () => {
-    const redactor = createRedactor();
-    const obj = { password: 's3cret', username: 'alice' };
-    const result = redactor.redactObject(obj);
-    expect(result.password).toBe('[REDACTED]');
-    expect(result.username).toBe('alice');
-  });
-
-  test('matches sensitive keys case-insensitively', () => {
-    const redactor = createRedactor();
-    const obj = { Authorization: 'Bearer xyz', PASSWORD: 's3cret' };
-    const result = redactor.redactObject(obj);
-    expect(result.PASSWORD).toBe('[REDACTED]');
-    expect(result.Authorization).toBe('[REDACTED]');
-  });
-
-  test('applies pattern matching to non-sensitive string values', () => {
-    const redactor = createRedactor();
-    const obj = { message: 'card 4111-1111-1111-1111 found' };
-    const result = redactor.redactObject(obj);
-    expect(result.message).toBe('card [REDACTED] found');
-  });
-
-  test('does not modify the original object', () => {
-    const redactor = createRedactor();
-    const obj = { password: 's3cret' };
-    redactor.redactObject(obj);
-    expect(obj.password).toBe('s3cret');
-  });
-
-  test('preserves non-string values', () => {
-    const redactor = createRedactor();
-    const obj = { count: 42, enabled: true, tags: null as unknown };
-    const result = redactor.redactObject(obj);
-    expect(result.count).toBe(42);
-    expect(result.enabled).toBe(true);
-    expect(result.tags).toBeNull();
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Nested objects
-// ---------------------------------------------------------------------------
-
-describe('nested objects', () => {
-  test('redacts deeply nested sensitive keys', () => {
-    const redactor = createRedactor();
-    const obj = {
-      user: {
-        credentials: {
-          password: 's3cret',
-          token: 'tok_abc123',
-        },
-        name: 'alice',
-      },
-    };
-    const result = redactor.redactObject(obj);
-    expect(result.user.name).toBe('alice');
-    expect(result.user.credentials.password).toBe('[REDACTED]');
-    expect(result.user.credentials.token).toBe('[REDACTED]');
-  });
-
-  test('redacts values inside arrays', () => {
-    const redactor = createRedactor();
-    const obj = {
-      headers: [
-        { key: 'Authorization', value: 'Bearer abc123' },
-        { key: 'Content-Type', value: 'application/json' },
-      ],
-    };
-    const result = redactor.redactObject(obj);
-    expect(result.headers).toHaveLength(2);
-    expect(result.headers[0]?.value).toBe('[REDACTED]');
-    expect(result.headers[1]?.value).toBe('application/json');
-  });
-
-  test('handles deeply nested pattern matches', () => {
-    const redactor = createRedactor();
-    const obj = {
-      data: {
-        nested: {
-          info: 'ssn: 123-45-6789',
-        },
-      },
-    };
-    const result = redactor.redactObject(obj);
-    expect(result.data.nested.info).toBe('ssn: [REDACTED]');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// Custom config
-// ---------------------------------------------------------------------------
-
-describe('custom config', () => {
-  test('custom patterns work', () => {
-    const redactor = createRedactor({
-      patterns: [/secret-\w+/g],
-    });
-    expect(redactor.redact('found secret-banana here')).toBe(
-      'found [REDACTED] here'
-    );
-    // Default patterns should not apply
-    expect(redactor.redact('4111-1111-1111-1111')).toBe('4111-1111-1111-1111');
-  });
-
-  test('custom replacement string works', () => {
-    const redactor = createRedactor({ replacement: '***' });
-    const obj = { password: 's3cret' };
-    const result = redactor.redactObject(obj);
-    expect(result.password).toBe('***');
-  });
-
-  test('custom sensitive keys work', () => {
-    const redactor = createRedactor({
-      sensitiveKeys: ['myCustomKey'],
-    });
-    const obj = { myCustomKey: 'hidden', password: 'visible' };
-    const result = redactor.redactObject(obj);
-    expect(result.myCustomKey).toBe('[REDACTED]');
-    // "password" is not in custom keys, so not redacted by key match
-    expect(result.password).toBe('visible');
-  });
-});