@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.33

package/test/pseudo/malware.ts

@@ -0,0 +1,431 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { parse, asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import {
+  malware,
+  isMalwareKind,
+  asMalwareKind,
+  parseInternals,
+} from '../../src/pseudo/malware.ts'
+import type { ParserState } from '../../src/types.ts'
+
+t.test('selects packages with a specific malware kind', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'a@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'a@1.0.0']),
+              alerts: [{ type: 'malware' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'b@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'b@1.0.0']),
+              alerts: [{ type: 'gptMalware' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'c@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'c@1.0.0']),
+              alerts: [{ type: 'gptSecurity' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'd@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'd@1.0.0']),
+              alerts: [{ type: 'gptAnomaly' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'e@1.0.0']),
+              alerts: [{ type: 'malware' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'f@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'f@1.0.0']),
+              alerts: [{ type: 'gptMalware' }],
+            },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the malware alert',
+    async t => {
+      const res = await malware(getState(':malware("critical")'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['a', 'e'],
+        'should select only packages with the specified malware alert',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+
+  await t.test('filter using numbered param', async t => {
+    const res = await malware(getState(':malware(0)'))
+    t.strictSame(
+      [...res.partial.nodes].map(n => n.name),
+      ['a', 'e'],
+      'should select only packages with the specified malware alert',
+    )
+    t.matchSnapshot({
+      nodes: [...res.partial.nodes].map(n => n.name),
+      edges: [...res.partial.edges].map(e => e.name),
+    })
+  })
+
+  await t.test('filter out using unquoted param', async t => {
+    const res = await malware(getState(':malware(high)'))
+    t.strictSame(
+      [...res.partial.nodes].map(n => n.name),
+      ['b', 'f'],
+      'should select only packages with the specified malware alert',
+    )
+    t.matchSnapshot({
+      nodes: [...res.partial.nodes].map(n => n.name),
+      edges: [...res.partial.edges].map(e => e.name),
+    })
+  })
+
+  await t.test(
+    'greater than comparator with number (unquoted)',
+    async t => {
+      const res = await malware(getState(':malware(>1)'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['c', 'd'],
+        'should select packages with malware kind greater than 1',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'greater than comparator with string kind (quoted)',
+    async t => {
+      const res = await malware(getState(':malware(">high")'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['c', 'd'],
+        'should select packages with malware kind greater than high',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'less than comparator with number (unquoted)',
+    async t => {
+      const res = await malware(getState(':malware(<2)'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['a', 'b', 'e', 'f'],
+        'should select packages with malware kind less than 2',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'less than comparator with string kind (quoted)',
+    async t => {
+      const res = await malware(getState(':malware("<medium")'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['a', 'b', 'e', 'f'],
+        'should select packages with malware kind less than medium',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'greater than or equal to comparator with number (unquoted)',
+    async t => {
+      const res = await malware(getState(':malware(>=2)'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['c', 'd'],
+        'should select packages with malware kind greater than or equal to 2',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'greater than or equal to comparator with string kind (quoted)',
+    async t => {
+      const res = await malware(getState(':malware(">=medium")'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['c', 'd'],
+        'should select packages with malware kind greater than or equal to medium',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'less than or equal to comparator with number (unquoted)',
+    async t => {
+      const res = await malware(getState(':malware(<=1)'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['a', 'b', 'e', 'f'],
+        'should select packages with malware kind less than or equal to 1',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'less than or equal to comparator with string kind (quoted)',
+    async t => {
+      const res = await malware(getState(':malware("<=high")'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['a', 'b', 'e', 'f'],
+        'should select packages with malware kind less than or equal to high',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'parameterless :malware matches medium+ severity',
+    async t => {
+      const res = await malware(getState(':malware'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['a', 'b', 'c', 'e', 'f'],
+        'should select packages with malware severity >= medium (exclude low/gptAnomaly)',
+      )
+      // Verify that package 'd' with gptAnomaly (low/3) is excluded
+      t.notOk(
+        [...res.partial.nodes].some(n => n.name === 'd'),
+        'should exclude package d with gptAnomaly (low severity)',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test('wrong parameter', async t => {
+    await t.rejects(
+      malware(getState(':malware("")')),
+      { message: /Failed to parse :malware selector/ },
+      'should throw an error',
+    )
+  })
+
+  await t.test('invalid comparison value', async t => {
+    await t.rejects(
+      malware(getState(':malware(>invalid)')),
+      { message: /Failed to parse :malware selector/ },
+      'should throw an error for invalid comparison value',
+    )
+  })
+
+  await t.test('out of range number', async t => {
+    await t.rejects(
+      malware(getState(':malware(>5)')),
+      { message: /Failed to parse :malware selector/ },
+      'should throw an error for out of range number',
+    )
+  })
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    malware(getState(':malware(critical)')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})
+
+t.test('isMalwareKind', async t => {
+  t.ok(
+    isMalwareKind('critical'),
+    'should return true for valid malware kinds',
+  )
+  t.notOk(
+    isMalwareKind('invalid'),
+    'should return false for invalid malware kinds',
+  )
+})
+
+t.test('asMalwareKind', async t => {
+  t.equal(
+    asMalwareKind('critical'),
+    'critical',
+    'should return the malware kind',
+  )
+  t.throws(
+    () => asMalwareKind('invalid'),
+    { message: /Expected a valid malware kind/ },
+    'should throw an error for invalid malware kinds',
+  )
+})
+
+t.test('parseInternals', async t => {
+  const testParseInternals = (query: string) => {
+    const ast = parse(query)
+    const nodes = asPostcssNodeWithChildren(ast.first.first).nodes
+    return parseInternals(nodes)
+  }
+
+  t.strictSame(
+    parseInternals([]),
+    { kind: undefined, comparator: undefined },
+    'should handle empty nodes array (parameterless :malware)',
+  )
+
+  // Test case for lines 87-88: selector node exists but has no child nodes
+  t.strictSame(
+    parseInternals([{ type: 'selector', nodes: [] } as any]),
+    { kind: undefined, comparator: undefined },
+    'should handle selector node with empty nodes array',
+  )
+
+  t.strictSame(
+    testParseInternals(':malware(critical)'),
+    { kind: 'critical', comparator: undefined },
+    'should parse simple kind without comparator',
+  )
+
+  t.strictSame(
+    testParseInternals(':malware(">1")'),
+    { kind: '1', comparator: '>' },
+    'should parse kind with greater than comparator',
+  )
+
+  t.strictSame(
+    testParseInternals(':malware(<low)'),
+    { kind: 'low', comparator: '<' },
+    'should parse kind with less than comparator',
+  )
+
+  t.strictSame(
+    testParseInternals(':malware(">=medium")'),
+    { kind: 'medium', comparator: '>=' },
+    'should parse kind with greater than or equal comparator',
+  )
+
+  t.strictSame(
+    testParseInternals(':malware(<=2)'),
+    { kind: '2', comparator: '<=' },
+    'should parse kind with less than or equal comparator',
+  )
+
+  t.throws(
+    () => testParseInternals(':malware(>invalid)'),
+    {
+      message: /Expected a valid malware kind or number between 0-3/,
+    },
+    'should throw for invalid kind with comparator',
+  )
+
+  t.throws(
+    () => testParseInternals(':malware(>4)'),
+    {
+      message: /Expected a valid malware kind or number between 0-3/,
+    },
+    'should throw for out of range number with comparator',
+  )
+})

package/test/pseudo/minified.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { minified } from '../../src/pseudo/minified.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with a minifiedFile alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'minifiedFile' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await minified(getState(':minified'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only minified packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    minified(getState(':minified')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/missing.ts

@@ -0,0 +1,111 @@
+import t from 'tap'
+import postcssSelectorParser from 'postcss-selector-parser'
+import type { ParserState } from '../../src/types.ts'
+import { missing } from '../../src/pseudo/missing.ts'
+import {
+  getSimpleGraph,
+  getMissingNodeGraph,
+} from '../fixtures/graph.ts'
+
+t.test('selects edges with no linked node', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = postcssSelectorParser().astSync(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: undefined,
+      importers: new Set(graph.importers),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'returns no edges in simple graph (all edges have linked nodes)',
+    async t => {
+      // In getSimpleGraph, all edges have linked nodes, so :missing should return no edges
+      const res = await missing(getState(':missing'))
+      t.strictSame(
+        [...res.partial.edges].map(e => e.name),
+        [],
+        'should not select any edges in a graph where all edges have linked nodes',
+      )
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        [],
+        'should always return an empty nodes set',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'selects edges with no linked node in missing node graph',
+    async t => {
+      // In getMissingNodeGraph, there are edges without linked nodes
+      const missingNodeGraph = getMissingNodeGraph()
+      const res = await missing(
+        getState(':missing', missingNodeGraph),
+      )
+
+      // The getMissingNodeGraph has edges 'a' and 'b' without linked nodes
+      t.strictSame(
+        [...res.partial.edges].map(e => e.name).sort(),
+        ['a', 'b'].sort(),
+        'should select only edges without linked nodes',
+      )
+      t.strictSame(
+        [...res.partial.nodes],
+        [],
+        'should always return an empty nodes set',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test('handles an empty partial state', async t => {
+    // Create a state with empty partial edges and nodes
+    const state = getState(':missing')
+    state.partial.nodes.clear()
+    state.partial.edges.clear()
+
+    const res = await missing(state)
+    t.strictSame(
+      [...res.partial.edges],
+      [],
+      'should return empty array of edges when starting with empty partial state',
+    )
+    t.strictSame(
+      [...res.partial.nodes],
+      [],
+      'should return empty array of nodes when starting with empty partial state',
+    )
+    t.matchSnapshot({
+      nodes: [...res.partial.nodes].map(n => n.name),
+      edges: [...res.partial.edges].map(e => e.name),
+    })
+  })
+})