@sentry/dotagents 0.2.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +73 -15
- package/dist/agents/definitions/claude.d.ts +4 -0
- package/dist/agents/definitions/claude.d.ts.map +1 -0
- package/dist/agents/definitions/claude.js +28 -0
- package/dist/agents/definitions/claude.js.map +1 -0
- package/dist/agents/definitions/codex.d.ts +4 -0
- package/dist/agents/definitions/codex.d.ts.map +1 -0
- package/dist/agents/definitions/codex.js +21 -0
- package/dist/agents/definitions/codex.js.map +1 -0
- package/dist/agents/definitions/cursor.d.ts +4 -0
- package/dist/agents/definitions/cursor.d.ts.map +1 -0
- package/dist/agents/definitions/cursor.js +45 -0
- package/dist/agents/definitions/cursor.js.map +1 -0
- package/dist/agents/definitions/helpers.d.ts +14 -0
- package/dist/agents/definitions/helpers.d.ts.map +1 -0
- package/dist/agents/definitions/helpers.js +39 -0
- package/dist/agents/definitions/helpers.js.map +1 -0
- package/dist/agents/definitions/opencode.d.ts +4 -0
- package/dist/agents/definitions/opencode.d.ts.map +1 -0
- package/dist/agents/definitions/opencode.js +33 -0
- package/dist/agents/definitions/opencode.js.map +1 -0
- package/dist/agents/definitions/vscode.d.ts +4 -0
- package/dist/agents/definitions/vscode.d.ts.map +1 -0
- package/dist/agents/definitions/vscode.js +31 -0
- package/dist/agents/definitions/vscode.js.map +1 -0
- package/dist/agents/errors.d.ts +9 -0
- package/dist/agents/errors.d.ts.map +1 -0
- package/dist/agents/errors.js +14 -0
- package/dist/agents/errors.js.map +1 -0
- package/dist/agents/hook-writer.d.ts +26 -0
- package/dist/agents/hook-writer.d.ts.map +1 -0
- package/dist/agents/hook-writer.js +105 -0
- package/dist/agents/hook-writer.js.map +1 -0
- package/dist/agents/hook-writer.test.d.ts +2 -0
- package/dist/agents/hook-writer.test.d.ts.map +1 -0
- package/dist/agents/hook-writer.test.js +155 -0
- package/dist/agents/hook-writer.test.js.map +1 -0
- package/dist/agents/index.d.ts +6 -0
- package/dist/agents/index.d.ts.map +1 -0
- package/dist/agents/index.js +5 -0
- package/dist/agents/index.js.map +1 -0
- package/dist/agents/mcp-writer.d.ts +21 -0
- package/dist/agents/mcp-writer.d.ts.map +1 -0
- package/dist/agents/mcp-writer.js +115 -0
- package/dist/agents/mcp-writer.js.map +1 -0
- package/dist/agents/mcp-writer.test.d.ts +2 -0
- package/dist/agents/mcp-writer.test.d.ts.map +1 -0
- package/dist/agents/mcp-writer.test.js +146 -0
- package/dist/agents/mcp-writer.test.js.map +1 -0
- package/dist/agents/registry.d.ts +4 -0
- package/dist/agents/registry.d.ts.map +1 -0
- package/dist/agents/registry.js +14 -0
- package/dist/agents/registry.js.map +1 -0
- package/dist/agents/registry.test.d.ts +2 -0
- package/dist/agents/registry.test.d.ts.map +1 -0
- package/dist/agents/registry.test.js +144 -0
- package/dist/agents/registry.test.js.map +1 -0
- package/dist/agents/types.d.ts +88 -0
- package/dist/agents/types.d.ts.map +1 -0
- package/dist/agents/types.js +2 -0
- package/dist/agents/types.js.map +1 -0
- package/dist/cli/commands/add.d.ts.map +1 -1
- package/dist/cli/commands/add.js +6 -2
- package/dist/cli/commands/add.js.map +1 -1
- package/dist/cli/commands/init.d.ts +1 -0
- package/dist/cli/commands/init.d.ts.map +1 -1
- package/dist/cli/commands/init.js +29 -9
- package/dist/cli/commands/init.js.map +1 -1
- package/dist/cli/commands/init.test.js +16 -0
- package/dist/cli/commands/init.test.js.map +1 -1
- package/dist/cli/commands/install.d.ts +4 -0
- package/dist/cli/commands/install.d.ts.map +1 -1
- package/dist/cli/commands/install.js +83 -69
- package/dist/cli/commands/install.js.map +1 -1
- package/dist/cli/commands/install.test.js +44 -0
- package/dist/cli/commands/install.test.js.map +1 -1
- package/dist/cli/commands/sync.d.ts +3 -1
- package/dist/cli/commands/sync.d.ts.map +1 -1
- package/dist/cli/commands/sync.js +61 -3
- package/dist/cli/commands/sync.js.map +1 -1
- package/dist/cli/commands/sync.test.js +35 -0
- package/dist/cli/commands/sync.test.js.map +1 -1
- package/dist/cli/commands/update.d.ts.map +1 -1
- package/dist/cli/commands/update.js +4 -1
- package/dist/cli/commands/update.js.map +1 -1
- package/dist/cli/index.d.ts +1 -0
- package/dist/cli/index.js +1 -0
- package/dist/cli/index.js.map +1 -1
- package/dist/config/index.d.ts +1 -1
- package/dist/config/index.d.ts.map +1 -1
- package/dist/config/loader.d.ts.map +1 -1
- package/dist/config/loader.js +7 -0
- package/dist/config/loader.js.map +1 -1
- package/dist/config/loader.test.js +21 -0
- package/dist/config/loader.test.js.map +1 -1
- package/dist/config/schema.d.ts +63 -0
- package/dist/config/schema.d.ts.map +1 -1
- package/dist/config/schema.js +39 -0
- package/dist/config/schema.js.map +1 -1
- package/dist/config/schema.test.js +156 -0
- package/dist/config/schema.test.js.map +1 -1
- package/dist/config/writer.d.ts +1 -1
- package/dist/config/writer.d.ts.map +1 -1
- package/dist/config/writer.js +7 -2
- package/dist/config/writer.js.map +1 -1
- package/dist/index.d.ts +4 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/trust/index.d.ts +2 -0
- package/dist/trust/index.d.ts.map +1 -0
- package/dist/trust/index.js +2 -0
- package/dist/trust/index.js.map +1 -0
- package/dist/trust/validator.d.ts +25 -0
- package/dist/trust/validator.d.ts.map +1 -0
- package/dist/trust/validator.js +86 -0
- package/dist/trust/validator.js.map +1 -0
- package/dist/trust/validator.test.d.ts +2 -0
- package/dist/trust/validator.test.d.ts.map +1 -0
- package/dist/trust/validator.test.js +145 -0
- package/dist/trust/validator.test.js.map +1 -0
- package/package.json +1 -1
|
@@ -0,0 +1,86 @@
|
|
|
1
|
+
import { parseSource } from "../skills/resolver.js";
|
|
2
|
+
export class TrustError extends Error {
|
|
3
|
+
constructor(message) {
|
|
4
|
+
super(message);
|
|
5
|
+
this.name = "TrustError";
|
|
6
|
+
}
|
|
7
|
+
}
|
|
8
|
+
/**
|
|
9
|
+
* Extract domain from a git URL.
|
|
10
|
+
*
|
|
11
|
+
* Supports:
|
|
12
|
+
* https://host.com/... → host.com
|
|
13
|
+
* ssh://host.com/... → host.com
|
|
14
|
+
* git://host.com/... → host.com
|
|
15
|
+
* git@host.com:... → host.com
|
|
16
|
+
* file:///... → (no domain)
|
|
17
|
+
*/
|
|
18
|
+
export function extractDomain(url) {
|
|
19
|
+
// git@host.com:owner/repo.git
|
|
20
|
+
const scpMatch = url.match(/^[a-z]+@([^:]+):/);
|
|
21
|
+
if (scpMatch)
|
|
22
|
+
return scpMatch[1];
|
|
23
|
+
// https://host.com/..., ssh://host.com/..., git://host.com/...
|
|
24
|
+
try {
|
|
25
|
+
const parsed = new URL(url);
|
|
26
|
+
if (parsed.hostname)
|
|
27
|
+
return parsed.hostname;
|
|
28
|
+
}
|
|
29
|
+
catch {
|
|
30
|
+
// Not a valid URL — no domain
|
|
31
|
+
}
|
|
32
|
+
return undefined;
|
|
33
|
+
}
|
|
34
|
+
function formatAllowed(trust) {
|
|
35
|
+
const parts = [];
|
|
36
|
+
if (trust.github_orgs.length > 0) {
|
|
37
|
+
parts.push(`orgs: ${trust.github_orgs.join(", ")}`);
|
|
38
|
+
}
|
|
39
|
+
if (trust.github_repos.length > 0) {
|
|
40
|
+
parts.push(`repos: ${trust.github_repos.join(", ")}`);
|
|
41
|
+
}
|
|
42
|
+
if (trust.git_domains.length > 0) {
|
|
43
|
+
parts.push(`domains: ${trust.git_domains.join(", ")}`);
|
|
44
|
+
}
|
|
45
|
+
return parts.length > 0 ? parts.join("; ") : "none";
|
|
46
|
+
}
|
|
47
|
+
/**
|
|
48
|
+
* Validate that a source specifier is allowed by the trust configuration.
|
|
49
|
+
*
|
|
50
|
+
* - No trust config → allow all (backward compat)
|
|
51
|
+
* - allow_all = true → allow all
|
|
52
|
+
* - Local path: sources → always allowed
|
|
53
|
+
* - Otherwise → must match at least one rule (org, repo, or domain)
|
|
54
|
+
*/
|
|
55
|
+
export function validateTrustedSource(source, trust) {
|
|
56
|
+
// No trust config → allow everything
|
|
57
|
+
if (!trust)
|
|
58
|
+
return;
|
|
59
|
+
// Explicit opt-out
|
|
60
|
+
if (trust.allow_all)
|
|
61
|
+
return;
|
|
62
|
+
const parsed = parseSource(source);
|
|
63
|
+
// Local sources are always allowed
|
|
64
|
+
if (parsed.type === "local")
|
|
65
|
+
return;
|
|
66
|
+
if (parsed.type === "github") {
|
|
67
|
+
const owner = parsed.owner.toLowerCase();
|
|
68
|
+
const repo = `${owner}/${parsed.repo.toLowerCase()}`;
|
|
69
|
+
if (trust.github_orgs.some((o) => o.toLowerCase() === owner))
|
|
70
|
+
return;
|
|
71
|
+
if (trust.github_repos.some((r) => r.toLowerCase() === repo))
|
|
72
|
+
return;
|
|
73
|
+
throw new TrustError(`Source "${source}" is not trusted. ` +
|
|
74
|
+
`Allowed sources: ${formatAllowed(trust)}. ` +
|
|
75
|
+
`Add the org or repo to [trust] in agents.toml to allow it.`);
|
|
76
|
+
}
|
|
77
|
+
if (parsed.type === "git") {
|
|
78
|
+
const domain = extractDomain(parsed.url)?.toLowerCase();
|
|
79
|
+
if (domain && trust.git_domains.some((d) => d.toLowerCase() === domain))
|
|
80
|
+
return;
|
|
81
|
+
throw new TrustError(`Source "${source}" is not trusted. ` +
|
|
82
|
+
`Allowed sources: ${formatAllowed(trust)}. ` +
|
|
83
|
+
`Add the domain to [trust] in agents.toml to allow it.`);
|
|
84
|
+
}
|
|
85
|
+
}
|
|
86
|
+
//# sourceMappingURL=validator.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"validator.js","sourceRoot":"","sources":["../../src/trust/validator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,OAAO,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEjC,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,KAAkB;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,KAAmB;IAEnB,qCAAqC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,mBAAmB;IACnB,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO;IAE5B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEnC,mCAAmC;IACnC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO;IAEpC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,IAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QAEtD,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;YAAE,OAAO;QACrE,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;YAAE,OAAO;QAErE,MAAM,IAAI,UAAU,CAClB,WAAW,MAAM,oBAAoB;YACnC,oBAAoB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC5C,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAI,CAAC,EAAE,WAAW,EAAE,CAAC;QACzD,IAAI,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAAE,OAAO;QAEhF,MAAM,IAAI,UAAU,CAClB,WAAW,MAAM,oBAAoB;YACnC,oBAAoB,aAAa,CAAC,KAAK,CAAC,IAAI;YAC5C,uDAAuD,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"validator.test.d.ts","sourceRoot":"","sources":["../../src/trust/validator.test.ts"],"names":[],"mappings":""}
|
|
@@ -0,0 +1,145 @@
|
|
|
1
|
+
import { describe, it, expect } from "vitest";
|
|
2
|
+
import { validateTrustedSource, extractDomain, TrustError } from "./validator.js";
|
|
3
|
+
function makeTrust(overrides = {}) {
|
|
4
|
+
return {
|
|
5
|
+
allow_all: false,
|
|
6
|
+
github_orgs: [],
|
|
7
|
+
github_repos: [],
|
|
8
|
+
git_domains: [],
|
|
9
|
+
...overrides,
|
|
10
|
+
};
|
|
11
|
+
}
|
|
12
|
+
describe("validateTrustedSource", () => {
|
|
13
|
+
it("allows everything when trust config is undefined", () => {
|
|
14
|
+
expect(() => validateTrustedSource("evil/repo", undefined)).not.toThrow();
|
|
15
|
+
expect(() => validateTrustedSource("git:https://evil.com/repo.git", undefined)).not.toThrow();
|
|
16
|
+
expect(() => validateTrustedSource("path:../local", undefined)).not.toThrow();
|
|
17
|
+
});
|
|
18
|
+
it("allows everything when allow_all is true", () => {
|
|
19
|
+
const trust = makeTrust({ allow_all: true });
|
|
20
|
+
expect(() => validateTrustedSource("evil/repo", trust)).not.toThrow();
|
|
21
|
+
expect(() => validateTrustedSource("git:https://evil.com/repo.git", trust)).not.toThrow();
|
|
22
|
+
});
|
|
23
|
+
it("allows everything when allow_all is true even with other rules", () => {
|
|
24
|
+
const trust = makeTrust({ allow_all: true, github_orgs: ["getsentry"] });
|
|
25
|
+
expect(() => validateTrustedSource("evil/repo", trust)).not.toThrow();
|
|
26
|
+
});
|
|
27
|
+
describe("github_orgs", () => {
|
|
28
|
+
const trust = makeTrust({ github_orgs: ["getsentry", "anthropics"] });
|
|
29
|
+
it("allows matching orgs", () => {
|
|
30
|
+
expect(() => validateTrustedSource("getsentry/skills", trust)).not.toThrow();
|
|
31
|
+
expect(() => validateTrustedSource("anthropics/tools", trust)).not.toThrow();
|
|
32
|
+
});
|
|
33
|
+
it("rejects non-matching orgs", () => {
|
|
34
|
+
expect(() => validateTrustedSource("evil/repo", trust)).toThrow(TrustError);
|
|
35
|
+
});
|
|
36
|
+
it("strips @ref before checking", () => {
|
|
37
|
+
expect(() => validateTrustedSource("getsentry/skills@v1.0.0", trust)).not.toThrow();
|
|
38
|
+
expect(() => validateTrustedSource("evil/repo@main", trust)).toThrow(TrustError);
|
|
39
|
+
});
|
|
40
|
+
});
|
|
41
|
+
describe("github_repos", () => {
|
|
42
|
+
const trust = makeTrust({ github_repos: ["external-org/one-approved"] });
|
|
43
|
+
it("allows exact repo matches", () => {
|
|
44
|
+
expect(() => validateTrustedSource("external-org/one-approved", trust)).not.toThrow();
|
|
45
|
+
});
|
|
46
|
+
it("rejects same-org different-repo", () => {
|
|
47
|
+
expect(() => validateTrustedSource("external-org/other-repo", trust)).toThrow(TrustError);
|
|
48
|
+
});
|
|
49
|
+
it("rejects different-org same-repo", () => {
|
|
50
|
+
expect(() => validateTrustedSource("other-org/one-approved", trust)).toThrow(TrustError);
|
|
51
|
+
});
|
|
52
|
+
it("strips @ref before checking", () => {
|
|
53
|
+
expect(() => validateTrustedSource("external-org/one-approved@v2", trust)).not.toThrow();
|
|
54
|
+
});
|
|
55
|
+
});
|
|
56
|
+
describe("git_domains", () => {
|
|
57
|
+
const trust = makeTrust({ git_domains: ["git.corp.example.com"] });
|
|
58
|
+
it("allows matching domains (https)", () => {
|
|
59
|
+
expect(() => validateTrustedSource("git:https://git.corp.example.com/team/repo.git", trust)).not.toThrow();
|
|
60
|
+
});
|
|
61
|
+
it("allows matching domains (ssh)", () => {
|
|
62
|
+
expect(() => validateTrustedSource("git:ssh://git.corp.example.com/team/repo.git", trust)).not.toThrow();
|
|
63
|
+
});
|
|
64
|
+
it("allows matching domains (scp-style)", () => {
|
|
65
|
+
expect(() => validateTrustedSource("git:git@git.corp.example.com:team/repo.git", trust)).not.toThrow();
|
|
66
|
+
});
|
|
67
|
+
it("rejects non-matching domains", () => {
|
|
68
|
+
expect(() => validateTrustedSource("git:https://evil.com/repo.git", trust)).toThrow(TrustError);
|
|
69
|
+
});
|
|
70
|
+
});
|
|
71
|
+
describe("local sources", () => {
|
|
72
|
+
it("always allows path: sources even with restrictive trust", () => {
|
|
73
|
+
const trust = makeTrust({ github_orgs: ["getsentry"] });
|
|
74
|
+
expect(() => validateTrustedSource("path:../local-skill", trust)).not.toThrow();
|
|
75
|
+
});
|
|
76
|
+
});
|
|
77
|
+
describe("combined rules", () => {
|
|
78
|
+
const trust = makeTrust({
|
|
79
|
+
github_orgs: ["getsentry"],
|
|
80
|
+
github_repos: ["external/approved"],
|
|
81
|
+
git_domains: ["git.corp.com"],
|
|
82
|
+
});
|
|
83
|
+
it("allows source matching org rule", () => {
|
|
84
|
+
expect(() => validateTrustedSource("getsentry/anything", trust)).not.toThrow();
|
|
85
|
+
});
|
|
86
|
+
it("allows source matching repo rule", () => {
|
|
87
|
+
expect(() => validateTrustedSource("external/approved", trust)).not.toThrow();
|
|
88
|
+
});
|
|
89
|
+
it("allows source matching domain rule", () => {
|
|
90
|
+
expect(() => validateTrustedSource("git:https://git.corp.com/team/repo.git", trust)).not.toThrow();
|
|
91
|
+
});
|
|
92
|
+
it("rejects source matching none", () => {
|
|
93
|
+
expect(() => validateTrustedSource("evil/repo", trust)).toThrow(TrustError);
|
|
94
|
+
});
|
|
95
|
+
});
|
|
96
|
+
describe("case-insensitive matching", () => {
|
|
97
|
+
it("matches GitHub orgs case-insensitively", () => {
|
|
98
|
+
const trust = makeTrust({ github_orgs: ["getsentry"] });
|
|
99
|
+
expect(() => validateTrustedSource("GetSentry/repo", trust)).not.toThrow();
|
|
100
|
+
expect(() => validateTrustedSource("GETSENTRY/repo", trust)).not.toThrow();
|
|
101
|
+
});
|
|
102
|
+
it("matches GitHub repos case-insensitively", () => {
|
|
103
|
+
const trust = makeTrust({ github_repos: ["MyOrg/MyRepo"] });
|
|
104
|
+
expect(() => validateTrustedSource("myorg/myrepo", trust)).not.toThrow();
|
|
105
|
+
expect(() => validateTrustedSource("MYORG/MYREPO", trust)).not.toThrow();
|
|
106
|
+
});
|
|
107
|
+
it("matches git domains case-insensitively", () => {
|
|
108
|
+
const trust = makeTrust({ git_domains: ["git.corp.example.com"] });
|
|
109
|
+
expect(() => validateTrustedSource("git:https://Git.Corp.Example.COM/repo.git", trust)).not.toThrow();
|
|
110
|
+
});
|
|
111
|
+
});
|
|
112
|
+
describe("error messages", () => {
|
|
113
|
+
it("includes the rejected source", () => {
|
|
114
|
+
const trust = makeTrust({ github_orgs: ["getsentry"] });
|
|
115
|
+
expect(() => validateTrustedSource("evil/repo", trust)).toThrow(/evil\/repo/);
|
|
116
|
+
});
|
|
117
|
+
it("includes allowed alternatives", () => {
|
|
118
|
+
const trust = makeTrust({ github_orgs: ["getsentry"], github_repos: ["ext/one"] });
|
|
119
|
+
expect(() => validateTrustedSource("evil/repo", trust)).toThrow(/getsentry/);
|
|
120
|
+
expect(() => validateTrustedSource("evil/repo", trust)).toThrow(/ext\/one/);
|
|
121
|
+
});
|
|
122
|
+
});
|
|
123
|
+
});
|
|
124
|
+
describe("extractDomain", () => {
|
|
125
|
+
it("extracts from https URL", () => {
|
|
126
|
+
expect(extractDomain("https://git.corp.com/team/repo.git")).toBe("git.corp.com");
|
|
127
|
+
});
|
|
128
|
+
it("extracts from ssh URL", () => {
|
|
129
|
+
expect(extractDomain("ssh://git.corp.com/team/repo.git")).toBe("git.corp.com");
|
|
130
|
+
});
|
|
131
|
+
it("extracts from git:// URL", () => {
|
|
132
|
+
expect(extractDomain("git://git.corp.com/team/repo.git")).toBe("git.corp.com");
|
|
133
|
+
});
|
|
134
|
+
it("extracts from scp-style URL", () => {
|
|
135
|
+
expect(extractDomain("git@github.com:owner/repo.git")).toBe("github.com");
|
|
136
|
+
});
|
|
137
|
+
it("returns undefined for file:// URLs", () => {
|
|
138
|
+
// file:///tmp/repo has empty hostname
|
|
139
|
+
expect(extractDomain("file:///tmp/repo")).toBeUndefined();
|
|
140
|
+
});
|
|
141
|
+
it("returns undefined for bare paths", () => {
|
|
142
|
+
expect(extractDomain("/tmp/local-repo")).toBeUndefined();
|
|
143
|
+
});
|
|
144
|
+
});
|
|
145
|
+
//# sourceMappingURL=validator.test.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"validator.test.js","sourceRoot":"","sources":["../../src/trust/validator.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGlF,SAAS,SAAS,CAAC,YAAkC,EAAE;IACrD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,EAAE;QAChB,WAAW,EAAE,EAAE;QACf,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9F,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACtE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;QAEtE,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7E,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACpF,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;QAEzE,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;YACnC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,2BAA2B,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACxF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;QAEnE,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAC/E,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,8CAA8C,EAAE,KAAK,CAAC,CAC7E,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAC3E,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,+BAA+B,EAAE,KAAK,CAAC,CAC9D,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,MAAM,KAAK,GAAG,SAAS,CAAC;YACtB,WAAW,EAAE,CAAC,WAAW,CAAC;YAC1B,YAAY,EAAE,CAAC,mBAAmB,CAAC;YACnC,WAAW,EAAE,CAAC,cAAc,CAAC;SAC9B,CAAC,CAAC;QAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;YACzC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;YAC1C,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;YAC5C,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,wCAAwC,EAAE,KAAK,CAAC,CACvE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAC3E,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YACnE,MAAM,CAAC,GAAG,EAAE,CACV,qBAAqB,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAC1E,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;YACvC,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnF,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,aAAa,CAAC,oCAAoC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,CAAC,aAAa,CAAC,kCAAkC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,aAAa,CAAC,+BAA+B,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,sCAAsC;QACtC,MAAM,CAAC,aAAa,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
|