@qaguardian/playwright-score 0.1.0 → 0.1.9

package/dist/rules/guardian-plugin.js

@@ -13,6 +13,76 @@ const DUMMY_SECRETS = new Set([
     'qwerty',
     '',
 ].map((s) => s.toLowerCase()));
+// Playwright's actual modifier API is test.fixme() — not test.fix().
+const TEST_MODIFIERS = new Set(['only', 'skip', 'fixme', 'slow']);
+const DESCRIBE_MODIFIERS = new Set(['serial', 'parallel', 'only', 'fixme']);
+/** Matches a bare test(...) call. */
+function isBareTestCall(node) {
+    return node.callee?.type === 'Identifier' && node.callee.name === 'test';
+}
+/** Matches test.describe(...) and test.describe.serial/parallel/only/fixme(...). */
+function isDescribeCall(node) {
+    const callee = node.callee;
+    if (!callee || callee.type !== 'MemberExpression' || callee.computed)
+        return false;
+    const obj = callee.object;
+    const prop = callee.property;
+    if (!obj || !prop || prop.type !== 'Identifier')
+        return false;
+    // test.describe(...)
+    if (obj.type === 'Identifier' && obj.name === 'test' && prop.name === 'describe') {
+        return true;
+    }
+    // test.describe.serial/parallel/only/fixme(...)
+    if (obj.type === 'MemberExpression' &&
+        !obj.computed &&
+        obj.object?.type === 'Identifier' &&
+        obj.object.name === 'test' &&
+        obj.property?.type === 'Identifier' &&
+        obj.property.name === 'describe' &&
+        DESCRIBE_MODIFIERS.has(prop.name ?? '')) {
+        return true;
+    }
+    return false;
+}
+/** Matches specifically test.describe.serial(...). */
+function isSerialDescribeCall(node) {
+    const callee = node.callee;
+    if (!callee || callee.type !== 'MemberExpression' || callee.computed)
+        return false;
+    const obj = callee.object;
+    const prop = callee.property;
+    return (obj?.type === 'MemberExpression' &&
+        !obj.computed &&
+        obj.object?.type === 'Identifier' &&
+        obj.object.name === 'test' &&
+        obj.property?.type === 'Identifier' &&
+        obj.property.name === 'describe' &&
+        prop?.type === 'Identifier' &&
+        prop.name === 'serial');
+}
+/** Matches test.only/skip/fixme/slow(...) (a modifier form of a real test declaration). */
+function isTestModifierCall(node) {
+    const callee = node.callee;
+    if (!callee || callee.type !== 'MemberExpression' || callee.computed)
+        return false;
+    const obj = callee.object;
+    const prop = callee.property;
+    return (obj?.type === 'Identifier' &&
+        obj.name === 'test' &&
+        prop?.type === 'Identifier' &&
+        TEST_MODIFIERS.has(prop.name ?? ''));
+}
+/** Matches test.step(...). */
+function isTestStepCall(node) {
+    const callee = node.callee;
+    return (callee?.type === 'MemberExpression' &&
+        !callee.computed &&
+        callee.object?.type === 'Identifier' &&
+        callee.object.name === 'test' &&
+        callee.property?.type === 'Identifier' &&
+        callee.property.name === 'step');
+}
 function hasDisableNextLine(sourceCode, line, ruleId) {
     const lines = sourceCode.getText().split(/\r?\n/);
     if (line < 2)
@@ -69,6 +139,42 @@ const noDateNowId = {
         };
     },
 };
+// Whole words only (after splitting camelCase/snake_case/kebab-case), not a
+// bare substring match — a substring match on "auth" flags "authorName",
+// "isAuthenticated", every "Author"/"authenticate"/"authorize" field in a
+// typical app under test, which is a lot of unrelated real-world test data.
+const SENSITIVE_WORDS = new Set([
+    'password',
+    'passwd',
+    'secret',
+    'secrets',
+    'token',
+    'tokens',
+    'auth',
+    'authorization',
+    'credential',
+    'credentials',
+]);
+function splitIdentifierWords(identifier) {
+    return identifier
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/[_-]+/g, ' ')
+        .split(/\s+/)
+        .filter(Boolean)
+        .map((w) => w.toLowerCase());
+}
+function looksLikeSensitiveKey(rawKey) {
+    const words = splitIdentifierWords(rawKey);
+    if (words.some((w) => SENSITIVE_WORDS.has(w)))
+        return true;
+    // apiKey / api_key / API-KEY — "key" alone is too generic (primaryKey,
+    // sortKey, ...) so only flag it directly adjacent to "api".
+    for (let i = 0; i < words.length - 1; i++) {
+        if (words[i] === 'api' && words[i + 1] === 'key')
+            return true;
+    }
+    return false;
+}
 const noHardcodedSecrets = {
     meta: {
         type: 'suggestion',
@@ -80,7 +186,6 @@ const noHardcodedSecrets = {
     },
     create(context) {
         const sourceCode = context.sourceCode ?? context.getSourceCode();
-        const keyRe = /password|passwd|secret|token|api[_-]?key|auth/i;
         function check(node, rawKey) {
             if (node.type !== 'Literal' || typeof node.value !== 'string')
                 return;
@@ -89,7 +194,7 @@ const noHardcodedSecrets = {
                 return;
             if (value.length < 6)
                 return;
-            if (!keyRe.test(rawKey ?? ''))
+            if (!looksLikeSensitiveKey(rawKey ?? ''))
                 return;
             const line = node.loc?.start.line ?? 1;
             if (hasDisableNextLine(sourceCode, line, 'guardian/no-hardcoded-secrets'))
@@ -126,13 +231,26 @@ const noGenericLongTimeout = {
         const allowed = new Set([2000, 20000]);
         return {
             Property(node) {
-                if (node.key.type === 'Identifier' &&
-                    node.key.name === 'timeout' &&
-                    node.value.type === 'Literal' &&
-                    typeof node.value.value === 'number' &&
-                    !allowed.has(node.value.value)) {
-                    context.report({ node, messageId: 'timeout' });
+                if (node.key.type !== 'Identifier' ||
+                    node.key.name !== 'timeout' ||
+                    node.value.type !== 'Literal' ||
+                    typeof node.value.value !== 'number' ||
+                    allowed.has(node.value.value)) {
+                    return;
                 }
+                // Only flag timeout options passed inline to a call, e.g.
+                // locator.click({ timeout }), expect(x).toBeVisible({ timeout }),
+                // test('x', { timeout }, fn) — not unrelated business data that
+                // happens to have a field named "timeout" (session config, a
+                // fixture payload, a mocked API response body, ...).
+                const objectExpr = node.parent;
+                const call = objectExpr?.parent;
+                if (objectExpr?.type !== 'ObjectExpression' ||
+                    call?.type !== 'CallExpression' ||
+                    !call.arguments?.includes(objectExpr)) {
+                    return;
+                }
+                context.report({ node, messageId: 'timeout' });
             },
         };
     },
@@ -150,27 +268,16 @@ const oneDescribeOneTest = {
     create(context) {
         let describes = 0;
         let tests = 0;
+        let usesSerialDescribe = false;
         return {
             CallExpression(node) {
-                if (node.callee.type === 'MemberExpression' && !node.callee.computed) {
-                    if (node.callee.object.type === 'Identifier' &&
-                        node.callee.object.name === 'test' &&
-                        node.callee.property.type === 'Identifier' &&
-                        node.callee.property.name === 'describe') {
-                        describes++;
-                    }
-                }
-                if (node.callee.type === 'Identifier' && node.callee.name === 'test') {
-                    tests++;
+                if (isDescribeCall(node)) {
+                    describes++;
+                    if (isSerialDescribeCall(node))
+                        usesSerialDescribe = true;
                 }
-                if (node.callee.type === 'MemberExpression' &&
-                    !node.callee.computed &&
-                    node.callee.object.type === 'Identifier' &&
-                    node.callee.object.name === 'test' &&
-                    node.callee.property.type === 'Identifier' &&
-                    ['only', 'skip', 'fix', 'slow'].includes(node.callee.property.name)) {
+                if (isBareTestCall(node) || isTestModifierCall(node))
                     tests++;
-                }
             },
             'Program:exit'() {
                 if (describes > 1) {
@@ -180,7 +287,12 @@ const oneDescribeOneTest = {
                         data: { count: String(describes) },
                     });
                 }
-                if (tests > 1) {
+                // test.describe.serial(...) is Playwright's documented mechanism
+                // for one user journey split into multiple ordered, dependent
+                // test() calls — the same "one scenario per file" intent as this
+                // rule, expressed a different way. Don't nag a pattern the
+                // framework itself recommends for exactly this case.
+                if (tests > 1 && !usesSerialDescribe) {
                     context.report({
                         loc: { line: 1, column: 0 },
                         messageId: 'tests',
@@ -205,20 +317,10 @@ const requireTestStep = {
         let hasStep = false;
         return {
             CallExpression(node) {
-                if (node.callee.type === 'Identifier' && node.callee.name === 'test') {
+                if (isBareTestCall(node) || isTestModifierCall(node))
                     hasTest = true;
-                }
-                if (node.callee.type === 'MemberExpression' &&
-                    !node.callee.computed &&
-                    node.callee.object.type === 'Identifier' &&
-                    node.callee.object.name === 'test' &&
-                    node.callee.property.type === 'Identifier') {
-                    if (['only', 'skip', 'fix', 'slow'].includes(node.callee.property.name)) {
-                        hasTest = true;
-                    }
-                    if (node.callee.property.name === 'step')
-                        hasStep = true;
-                }
+                if (isTestStepCall(node))
+                    hasStep = true;
             },
             'Program:exit'() {
                 if (hasTest && !hasStep) {
@@ -242,14 +344,13 @@ const requireExpect = {
         let hasExpect = false;
         return {
             CallExpression(node) {
-                if (node.callee.type === 'Identifier' && node.callee.name === 'test') {
+                if (isBareTestCall(node) || isTestModifierCall(node))
                     hasTest = true;
-                }
-                if (node.callee.type === 'Identifier' && node.callee.name === 'expect') {
+                if (node.callee?.type === 'Identifier' && node.callee.name === 'expect') {
                     hasExpect = true;
                 }
-                if (node.callee.type === 'MemberExpression' &&
-                    node.callee.object.type === 'Identifier' &&
+                if (node.callee?.type === 'MemberExpression' &&
+                    node.callee.object?.type === 'Identifier' &&
                     node.callee.object.name === 'expect') {
                     hasExpect = true;
                 }

package/dist/types.d.ts

@@ -41,6 +41,15 @@ export interface ScoreResult {
     summary: ScoreSummary;
     dimensions: ScoreDimensions;
     findings: Finding[];
+    /**
+     * Files matched by a directory/glob input but skipped because they show
+     * positive evidence of being a non-Playwright test (an import from
+     * vitest/jest/mocha/jasmine/@testing-library, or React Testing Library's
+     * screen.getBy/toBeInTheDocument() APIs). Repo-relative paths. Files passed
+     * explicitly by the caller are always scored and never appear here, even
+     * if they'd otherwise be skipped.
+     */
+    skippedFiles?: string[];
 }
 export interface ScoreOptions {
     paths: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qaguardian/playwright-score",
-  "version": "0.1.0",
+  "version": "0.1.9",
   "description": "Deterministic, AI-free Playwright spec quality score (sqs-v1). Lint + score with standard and guardian profiles.",
   "type": "module",
   "main": "./dist/index.js",