@platforma-sdk/package-builder-lib 1.1.0

package/src/core/conda/validate-spec.test.ts

@@ -0,0 +1,213 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+import * as fsp from "node:fs/promises";
+import { validateCondaSpec } from "./validate-spec";
+import * as util from "../util";
+
+describe("validateCondaSpec", () => {
+  let tempDir: string;
+  const mockLogger = util.createLogger();
+
+  beforeEach(() => {
+    tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "validate-conda-spec-test"));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  });
+
+  const createSpec = async (content: string): Promise<string> => {
+    const specPath = path.join(tempDir, "spec.yaml");
+    await fsp.writeFile(specPath, content);
+    return specPath;
+  };
+
+  const expectValid = async (content: string) => {
+    const specPath = await createSpec(content);
+    expect(() => validateCondaSpec(mockLogger, specPath)).not.toThrow();
+  };
+
+  const expectInvalid = async (content: string, errorPattern: RegExp) => {
+    const specPath = await createSpec(content);
+    expect(() => validateCondaSpec(mockLogger, specPath)).toThrow(errorPattern);
+  };
+
+  describe("allowed channels", () => {
+    it("should accept single allowed channel", async () => {
+      await expectValid(`
+channels:
+  - bioconda
+dependencies:
+  - anarci
+`);
+    });
+
+    it("should accept multiple allowed channels", async () => {
+      await expectValid(`
+channels:
+  - bioconda
+  - conda-forge
+dependencies: []
+`);
+    });
+  });
+
+  describe("forbidden channels", () => {
+    const forbiddenChannels = [
+      { name: "main", variations: ["main", "MAIN"] },
+      { name: "r", variations: ["r", "R"] },
+      { name: "msys2", variations: ["msys2", "Msys2"] },
+    ];
+
+    forbiddenChannels.forEach(({ name, variations }) => {
+      variations.forEach((variation) => {
+        it(`should reject ${name} channel (${variation})`, async () => {
+          await expectInvalid(
+            `
+channels:
+  - conda-forge
+  - ${variation}
+dependencies: []
+`,
+            new RegExp(`Forbidden channel '${variation}'`),
+          );
+        });
+      });
+    });
+  });
+
+  describe("allowed dependencies", () => {
+    it("should accept simple package names", async () => {
+      await expectValid(`
+channels:
+  - conda-forge
+dependencies:
+  - python
+  - numpy
+`);
+    });
+
+    it("should accept packages with allowed channel prefix", async () => {
+      await expectValid(`
+channels:
+  - bioconda
+dependencies:
+  - bioconda::anarci
+  - conda-forge::python
+`);
+    });
+  });
+
+  describe("forbidden dependencies prefixes (case insensitive)", () => {
+    const forbiddenPrefixes = [
+      { prefix: "main", package: "python" },
+      { prefix: "MAIN", package: "stats" },
+      { prefix: "r", package: "some-package" },
+      { prefix: "R", package: "some-package" },
+      { prefix: "msys2", package: "git" },
+      { prefix: "Msys2", package: "git" },
+    ];
+
+    forbiddenPrefixes.forEach(({ prefix, package: pkg }) => {
+      it(`should reject ${prefix}::${pkg}`, async () => {
+        await expectInvalid(
+          `
+channels:
+  - conda-forge
+dependencies:
+  - ${prefix}::${pkg}
+`,
+          new RegExp(`Forbidden channel prefix '${prefix}::'`),
+        );
+      });
+    });
+  });
+
+  describe("mixed scenarios", () => {
+    it("should accept allowed channels with allowed dependencies", async () => {
+      await expectValid(`
+channels:
+  - bioconda
+  - conda-forge
+dependencies:
+  - anarci
+  - bioconda::biotools
+  - python
+`);
+    });
+
+    it("should reject when both channels and dependencies have violations", async () => {
+      const content = `
+channels:
+  - main
+  - conda-forge
+dependencies:
+  - main::python
+  - anarci
+`;
+      const specPath = await createSpec(content);
+
+      expect(() => validateCondaSpec(mockLogger, specPath)).toThrow(
+        /Forbidden channel 'main'[\s\S]*Forbidden channel prefix 'main::'/,
+      );
+    });
+
+    it("should reject multiple violations", async () => {
+      await expectInvalid(
+        `
+channels:
+  - main
+  - r
+  - msys2
+dependencies:
+  - main::python
+  - r::stats
+  - msys2::git
+`,
+        /.+/,
+      );
+    });
+  });
+
+  describe("edge cases", () => {
+    it("should handle empty channels list", async () => {
+      await expectValid(`
+channels: []
+dependencies:
+  - python
+`);
+    });
+
+    it("should handle empty dependencies list", async () => {
+      await expectValid(`
+channels:
+  - conda-forge
+dependencies: []
+`);
+    });
+
+    it("should handle specs without dependencies section", async () => {
+      await expectValid(`
+channels:
+  - conda-forge
+`);
+    });
+
+    it("should throw error for non-existent file", () => {
+      expect(() => validateCondaSpec(mockLogger, "/non-existent/path.yaml")).toThrow();
+    });
+
+    it("should handle dependencies with version constraints", async () => {
+      await expectValid(`
+channels:
+  - conda-forge
+dependencies:
+  - python=3.9
+  - numpy>=1.20.0
+  - matplotlib<3.5
+`);
+    });
+  });
+});

package/src/core/conda/validate-spec.ts

@@ -0,0 +1,107 @@
+import fs from "node:fs";
+import yaml from "yaml";
+import type winston from "winston";
+
+export interface CondaSpec {
+  channels?: string[];
+  dependencies?: (string | Record<string, unknown>)[];
+  name?: string;
+  prefix?: string;
+  [key: string]: unknown;
+}
+
+/**
+ * Channels that are forbidden because they reference the official Anaconda channel.
+ * These channels (main, r, msys2, defaults, anaconda) should be avoided in favor of
+ * community-maintained channels like conda-forge to avoid licensing restrictions
+ */
+const FORBIDDEN_CHANNELS = ["main", "r", "msys2", "defaults", "anaconda"];
+
+/**
+ * Validates a conda spec file to ensure it doesn't use forbidden channels
+ * @param logger Winston logger instance
+ * @param specPath Path to the conda spec file
+ * @throws Error if forbidden channels are found
+ */
+export function validateCondaSpec(logger: winston.Logger, specPath: string): void {
+  logger.debug(`Validating conda spec file: ${specPath}`);
+
+  if (!fs.existsSync(specPath)) {
+    throw new Error(`Conda spec file not found: ${specPath}`);
+  }
+
+  const specContent = fs.readFileSync(specPath, "utf-8");
+  const spec = yaml.parse(specContent) as CondaSpec;
+
+  if (!spec || typeof spec !== "object") {
+    throw new Error(`Invalid conda spec file format: ${specPath}`);
+  }
+
+  const errors: string[] = [];
+
+  if (spec.channels) {
+    const channelErrors = validateChannels(spec.channels);
+    if (channelErrors.length > 0) {
+      errors.push(...channelErrors);
+    }
+  }
+
+  if (spec.dependencies) {
+    const depErrors = validateDependencies(spec.dependencies);
+    if (depErrors.length > 0) {
+      errors.push(...depErrors);
+    }
+  }
+
+  if (errors.length > 0) {
+    throw new Error(`Conda spec file contains forbidden Anaconda channels:\n${errors.join("\n")}`);
+  }
+
+  logger.debug(`Conda spec file validation passed: ${specPath}`);
+}
+
+/**
+ * Validates that no forbidden channels are in the channels list
+ * @param channels Array of channel names
+ * @returns Array of error messages for forbidden channels
+ */
+function validateChannels(channels: string[]): string[] {
+  const errors: string[] = [];
+
+  for (const channel of channels) {
+    const channelLower = channel.toLowerCase().trim();
+    if (FORBIDDEN_CHANNELS.includes(channelLower)) {
+      errors.push(`  - Forbidden channel '${channel}' in channels list`);
+    }
+  }
+
+  return errors;
+}
+
+/**
+ * Validates that no dependencies use forbidden channel prefixes
+ * @param dependencies Array of dependencies (can be strings or objects)
+ * @returns Array of error messages for forbidden dependencies
+ */
+function validateDependencies(dependencies: (string | Record<string, unknown>)[]): string[] {
+  const errors: string[] = [];
+
+  for (const dep of dependencies) {
+    // Skip non-string dependencies (they might be pip dependencies, etc.)
+    if (typeof dep !== "string") {
+      continue;
+    }
+
+    // Check if dependency uses channel prefix (format: channel::package)
+    if (dep.includes("::")) {
+      const [channel, ..._packageParts] = dep.split("::");
+      const channelLower = channel.toLowerCase().trim();
+
+      if (FORBIDDEN_CHANNELS.includes(channelLower)) {
+        errors.push(`  - Forbidden channel prefix '${channel}::' in dependency '${dep}'`);
+      }
+    }
+  }
+
+  return errors;
+}