@vltpkg/query 1.0.0-rc.31 → 1.0.0-rc.33

package/test/pseudo/unstable.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { unstable } from '../../src/pseudo/unstable.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with an unstable alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'unstableOwnership' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await unstable(getState(':unstable'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only unstable packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    unstable(getState(':unstable')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/vulnerable.ts

@@ -0,0 +1,130 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { parse } from '../../src/parser.ts'
+import { vulnerable } from '../../src/pseudo/vulnerable.ts'
+
+t.test('selects packages with any CVE', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            {
+              alerts: [
+                {
+                  type: 'socketUpstreamVulnerability',
+                  severity: 'high' as const,
+                  category: 'vulnerability',
+                  key: 'some-key',
+                  props: {
+                    lastPublish: '',
+                    cveId: 'CVE-2023-1234' as const,
+                  },
+                },
+              ],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'c@1.0.0']),
+            {
+              alerts: [
+                {
+                  type: 'deprecated',
+                  severity: 'low' as const,
+                  category: 'maintenance',
+                  key: 'some-key-2',
+                },
+              ],
+            },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test('filter out nodes without CVE alerts', async t => {
+    const res = await vulnerable(getState(':vulnerable'))
+    t.strictSame(
+      [...res.partial.nodes].map(n => n.name),
+      ['e'],
+      'should select only packages with CVEs',
+    )
+    t.matchSnapshot({
+      nodes: [...res.partial.nodes].map(n => n.name),
+      edges: [...res.partial.edges].map(e => e.name),
+    })
+  })
+
+  await t.test('vuln alias works the same way', async t => {
+    const res = await vulnerable(getState(':vuln'))
+    t.strictSame(
+      [...res.partial.nodes].map(n => n.name),
+      ['e'],
+      'should select only packages with CVEs',
+    )
+  })
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    vulnerable(getState(':vulnerable')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/workspace.ts

@@ -0,0 +1,111 @@
+import t from 'tap'
+import { pseudo } from '../../src/pseudo.ts'
+import {
+  selectorFixture,
+  copyGraphSelectionState,
+} from '../fixtures/selector.ts'
+import {
+  getSingleWorkspaceGraph,
+  getMultiWorkspaceGraph,
+} from '../fixtures/graph.ts'
+import type { TestCase } from '../fixtures/types.ts'
+import type { GraphSelectionState } from '../../src/types.ts'
+
+const testPseudo = selectorFixture(pseudo)
+
+t.test(':workspace pseudo-selector', async t => {
+  // Test with a single workspace graph
+  t.test('with single workspace', async t => {
+    // Get a graph with a single workspace
+    const singleWorkspaceGraph = getSingleWorkspaceGraph()
+
+    // Get the full selection state
+    const all = {
+      edges: new Set(singleWorkspaceGraph.edges),
+      nodes: new Set(singleWorkspaceGraph.nodes.values()),
+    }
+
+    // Create an empty selection state
+    const empty: GraphSelectionState = {
+      edges: new Set(),
+      nodes: new Set(),
+    }
+
+    // Run tests in the same pattern as the main pseudo.ts tests
+    const queryToExpected = new Set<TestCase>([
+      [':workspace', all, ['w']], // Should return only workspace nodes
+      [':workspace', empty, []], // Empty input should return empty output
+    ])
+
+    const initial = copyGraphSelectionState(all)
+    for (const [query, partial, expected] of queryToExpected) {
+      const result = await testPseudo(
+        query,
+        initial,
+        copyGraphSelectionState(partial),
+      )
+
+      t.strictSame(
+        result.nodes.map(i => i.name),
+        expected,
+        `query > "${query}"`,
+      )
+
+      // Verify all nodes are workspace nodes
+      const nodeArray = [...result.nodes]
+      if (nodeArray.length > 0) {
+        for (const node of nodeArray) {
+          t.equal(
+            node.importer && !node.mainImporter,
+            true,
+            `node ${node.name} should be a workspace node (importer=true, mainImporter=false)`,
+          )
+        }
+      }
+    }
+  })
+
+  // Test with multiple workspaces
+  t.test('with multiple workspaces', async t => {
+    // Get a graph with multiple workspaces
+    const multiWorkspaceGraph = getMultiWorkspaceGraph()
+
+    // Get the full selection state
+    const all = {
+      edges: new Set(multiWorkspaceGraph.edges),
+      nodes: new Set(multiWorkspaceGraph.nodes.values()),
+    }
+
+    // Run the test
+    const result = await testPseudo(
+      ':workspace',
+      copyGraphSelectionState(all),
+      copyGraphSelectionState(all),
+    )
+
+    // Should return all workspace nodes (a, b, c)
+    const nodeNames = [...result.nodes].map(n => n.name).sort()
+    t.strictSame(
+      nodeNames,
+      ['a', 'b', 'c'],
+      'should return all workspace nodes in multi-workspace graph',
+    )
+
+    t.matchSnapshot(
+      {
+        nodes: [...result.nodes].map(n => n.name).sort(),
+        edges: [...result.edges].map(e => e.name).sort(),
+      },
+      'should match snapshot for multi-workspace graph',
+    )
+
+    // Verify all nodes are workspace nodes
+    for (const node of result.nodes) {
+      t.equal(
+        node.importer && !node.mainImporter,
+        true,
+        `node ${node.name} should be a workspace node (importer=true, mainImporter=false)`,
+      )
+    }
+  })
+})