@tehw0lf/yaft 0.0.8 → 0.0.10

package/.github/workflows/build.yml

@@ -17,6 +17,7 @@ jobs:
       packages: write
       id-token: write
       security-events: write
+      pull-requests: write
     with:
       tool: "npm"
       test: "run test"
@@ -24,3 +25,4 @@ jobs:
       build_main: "run build"
       artifact_path: "dist"
       library_path: "dist"
+      npm_audit_omit_dev: true

package/.github/workflows/security-scan.yml

@@ -0,0 +1,79 @@
+# Security Monitoring Workflow
+#
+# This workflow performs security scanning using only the security-specific
+# reusable workflows, without building or publishing.
+#
+# Schedule: Runs daily at 2:00 AM UTC to catch newly disclosed vulnerabilities
+# Manual Trigger: Can be triggered via GitHub Actions UI or gh CLI
+#
+# Security Checks:
+# - Source code scanning: Semgrep (OWASP Top 10, security-audit, CI), npm audit
+# - Artifact scanning: Trivy on dist/ artifacts (requires prior build)
+#
+name: Security Monitoring
+
+on:
+  schedule:
+    # Run daily at 2:00 AM UTC
+    - cron: "0 2 * * *"
+  workflow_dispatch:
+    # Allow manual triggering
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+  pull-requests: write
+
+jobs:
+  # Scan source code for security vulnerabilities
+  scan_source:
+    name: Scan Source Code
+    uses: tehw0lf/workflows/.github/workflows/security-scan-source.yml@main
+    permissions:
+      contents: write
+      security-events: write
+      actions: read
+      pull-requests: write
+    with:
+      tool: "npm"
+      semgrep_rules: "auto p/security-audit p/owasp-top-ten p/ci p/nodejs p/typescript"
+      npm_audit_omit_dev: true
+      npm_audit_severity_threshold: "high"
+
+  # Download artifacts from latest CI build
+  # Note: Reuses artifacts from the main CI workflow instead of rebuilding
+  download_artifacts:
+    name: Download Build Artifacts
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download latest dist artifacts from CI
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          workflow: build.yml
+          name: dist
+          path: dist/
+          if_no_artifact_found: warn
+
+      - name: Upload artifacts for scanning
+        if: hashFiles('dist/**/*') != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: build
+          path: dist/
+          retention-days: 1
+
+  # Scan built artifacts for vulnerabilities
+  scan_artifacts:
+    name: Scan Artifacts
+    needs: download_artifacts
+    if: needs.download_artifacts.result == 'success'
+    uses: tehw0lf/workflows/.github/workflows/security-scan-artifacts.yml@main
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    with:
+      tool: "npm"
+      artifact_path: "dist"

package/jest.config.js

@@ -11,6 +11,6 @@ module.exports = {
     '<rootDir>/src/**/*.spec.ts'
   ],
   transform: {
-    "^.+\.tsx?$": ["ts-jest",{}],
+    "^.+\\.tsx?$": ["ts-jest", { tsconfig: "tsconfig.spec.json" }],
   },
 };

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@tehw0lf/yaft",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "YaFT - Feature Toggles using Go&PostgreSQL or any source!",
   "type": "commonjs",
   "scripts": {
-    "build": "tsc && npm pkg delete devDependencies && cp package.json README.md logo.svg dist/",
+    "build": "tsc && cp package.json README.md logo.svg dist/yaft/ && npm pkg delete devDependencies --prefix dist/yaft",
     "test": "npx jest"
   },
   "repository": {
@@ -24,15 +24,15 @@
   },
   "homepage": "https://github.com/tehw0lf/yaft-ts#readme",
   "dependencies": {
-    "reflect-metadata": "^0.2.2"
+    "reflect-metadata": "0.2.2"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.14",
-    "@types/node": "^22.14.1",
-    "axios": "^1.8.4",
-    "jest": "^29.7.0",
-    "ts-jest": "^29.3.2",
-    "ts-node": "^10.9.2",
-    "typescript": "^4.2.3"
+    "@types/jest": "30.0.0",
+    "@types/node": "24.1.0",
+    "axios": "1.18.0",
+    "jest": "30.4.2",
+    "ts-jest": "29.4.11",
+    "ts-node": "10.9.2",
+    "typescript": "6.0.3"
   }
 }

package/src/FeatureToggle.ts

@@ -25,7 +25,6 @@ export function FeatureToggle(key: string, fallback?: any) {
   if (!FeatureToggleBase.featureProvider) {
     throw new Error("FeatureToggleProvider not set");
   }
-  const isEnabled = FeatureToggleBase.featureProvider.isEnabled(key);
   return (
     target: any,
     propertyKey?: string,
@@ -36,12 +35,13 @@ export function FeatureToggle(key: string, fallback?: any) {
       const originalMethod = descriptor.value;
 
       descriptor.value = function (...args: any[]) {
+        const isEnabled = FeatureToggleBase.featureProvider.isEnabled(key);
         if (isEnabled) {
           return originalMethod.apply(this, args);
         } else {
           return fallback !== undefined
-            ? fallback.apply(this, args)
-            : (() => {}).apply(this, args);
+            ? fallback.apply(this, args as [])
+            : (() => {}).apply(this, args as []);
         }
       };
       return descriptor;
@@ -50,6 +50,7 @@ export function FeatureToggle(key: string, fallback?: any) {
       const originalConstructor = target;
       let newConstructor: any;
 
+      const isEnabled = FeatureToggleBase.featureProvider.isEnabled(key);
       if (isEnabled) {
         newConstructor = originalConstructor;
       } else {

package/src/examples/ApiServiceBooleanProvider.ts

@@ -5,7 +5,7 @@ import { FeatureProvider } from "../FeatureToggle";
 export class ApiServiceBooleanProvider implements FeatureProvider<boolean> {
   apiUrl: string;
   baseUUID: string;
-  data: Record<string, boolean>;
+  data: Record<string, boolean> = {};
   collectionHash = "";
 
   constructor(apiUrl: string, baseUUID: string) {

package/src/test/decorator-behavior.spec.ts

@@ -288,12 +288,12 @@ describe('FeatureToggle Decorator Behavior', () => {
         throw new Error('Provider error');
       });
 
-      expect(() => {
-        class TestClass {
-          @FeatureToggle('errorFeature')
-          testMethod() {}
-        }
-      }).toThrow('Provider error');
+      class TestClass {
+        @FeatureToggle('errorFeature')
+        testMethod() {}
+      }
+
+      expect(() => new TestClass().testMethod()).toThrow('Provider error');
     });
 
     it('should handle undefined/null feature keys', () => {

package/src/test/error-handling.spec.ts

@@ -317,8 +317,11 @@ describe('Error Handling and Edge Cases', () => {
       }
 
       const instance = new TestClass();
-      
+
       expect(instance.method1()).toBe(1);
+      expect(instance.method2()).toBe(2);
+      expect(instance.method3()).toBe(3);
+      expect(instance.method4()).toBe(4);
       expect(instance.method5()).toBe(5);
       expect(mockProvider.isEnabled).toHaveBeenCalledTimes(5);
     });
@@ -364,7 +367,7 @@ describe('Error Handling and Edge Cases', () => {
           'objectFeature': { enabled: true },
           'nullFeature': null,
           'undefinedFeature': undefined
-        },
+        } as Record<string, unknown>,
         getConfig: jest.fn(),
         isEnabled: (key: string) => {
           const value = mixedProvider.data[key];

package/tsconfig.json

@@ -4,7 +4,10 @@
     "target": "ES2022",
     "experimentalDecorators": true,
     "declaration": true,
-    "outDir": "./dist"
+    "rootDir": "./src",
+    "outDir": "./dist/yaft",
+    "types": ["node"],
+    "lib": ["ES2022"]
   },
   "include": ["src/**/*.ts"],
   "exclude": ["**/*.spec.ts", "**/*.test.ts", "**/test/**/*"]