@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.34

package/test/pseudo/cwe.ts

@@ -0,0 +1,255 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import type { PackageReportData } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { cwe } from '../../src/pseudo/cwe.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with a CWE alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            {
+              id: 'e@1.0.0',
+              author: [],
+              size: 0,
+              type: 'npm',
+              name: 'e',
+              version: '1.0.0',
+              license: 'MIT',
+              score: {
+                overall: 0,
+                license: 0,
+                maintenance: 0,
+                quality: 0,
+                supplyChain: 0,
+                vulnerability: 0,
+                signal: new AbortController().signal,
+                specificity: { idCounter: 0, commonCounter: 0 },
+              },
+              alerts: [
+                {
+                  key: '12314320948130',
+                  type: 'cve',
+                  severity: 'high',
+                  category: 'security',
+                  props: {
+                    lastPublish: '2023-01-01',
+                    cveId: 'CVE-2023-1234' as const,
+                    cwes: [
+                      { id: 'CWE-79' as const },
+                      { id: 'CWE-89' as const },
+                    ],
+                  },
+                },
+              ],
+            } as PackageReportData,
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await cwe(getState(':cwe(CWE-79)'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only packages with matching CWE ID',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+
+  await t.test('should not match an unseen CWE ID', async t => {
+    const res = await cwe(getState(':cwe(CWE-123)'))
+    t.strictSame(
+      [...res.partial.nodes].map(n => n.name),
+      [],
+      'should not select any packages when CWE ID does not match',
+    )
+    t.matchSnapshot({
+      nodes: [...res.partial.nodes].map(n => n.name),
+      edges: [...res.partial.edges].map(e => e.name),
+    })
+  })
+
+  await t.test(
+    'filter out any node that does not match the quoted CWE ID',
+    async t => {
+      const res = await cwe(getState(':cwe("CWE-89")'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only packages with matching CWE ID',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+
+  await t.test(
+    'parameterless :cwe matches any package with a CWE',
+    async t => {
+      const res = await cwe(getState(':cwe'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select packages with any CWE alert',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: undefined,
+      importers: new Set(),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    cwe(getState(':cwe(CWE-79)')),
+    /Missing security archive/,
+    'should throw an error',
+  )
+})
+
+t.test(':cwe() with empty parens matches any CWE', async t => {
+  const graph = getSimpleGraph()
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            {
+              id: 'e@1.0.0',
+              author: [],
+              size: 0,
+              type: 'npm',
+              name: 'e',
+              version: '1.0.0',
+              license: 'MIT',
+              score: {
+                overall: 0,
+                license: 0,
+                maintenance: 0,
+                quality: 0,
+                supplyChain: 0,
+                vulnerability: 0,
+                signal: new AbortController().signal,
+                specificity: { idCounter: 0, commonCounter: 0 },
+              },
+              alerts: [
+                {
+                  key: '12314320948130',
+                  type: 'cve',
+                  severity: 'high',
+                  category: 'security',
+                  props: {
+                    lastPublish: '2023-01-01',
+                    cveId: 'CVE-2023-1234' as const,
+                    cwes: [{ id: 'CWE-79' as const }],
+                  },
+                },
+              ],
+            } as PackageReportData,
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  const res = await cwe(getState(':cwe()'))
+  t.strictSame(
+    [...res.partial.nodes].map(n => n.name),
+    ['e'],
+    'should select packages with any CWE alert',
+  )
+})

package/test/pseudo/debug.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { parse } from '../../src/parser.ts'
+import { debug } from '../../src/pseudo/debug.ts'
+
+t.test('selects packages with a debugAccess alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'debugAccess' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await debug(getState(':debug'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only debug packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: undefined,
+      importers: new Set(),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    debug(getState(':debug')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/deprecated.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { parse } from '../../src/parser.ts'
+import { deprecated } from '../../src/pseudo/deprecated.ts'
+
+t.test('selects packages with deprecated alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'deprecated' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await deprecated(getState(':deprecated'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only deprecated packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    deprecated(getState(':deprecated')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/dev.ts

@@ -0,0 +1,61 @@
+import t from 'tap'
+import { pseudo } from '../../src/pseudo.ts'
+import {
+  selectorFixture,
+  copyGraphSelectionState,
+} from '../fixtures/selector.ts'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { TestCase } from '../fixtures/types.ts'
+import type { GraphSelectionState } from '../../src/types.ts'
+
+const testPseudo = selectorFixture(pseudo)
+
+t.test(':dev pseudo-selector', async t => {
+  // Get a simple graph for testing
+  const simpleGraph = getSimpleGraph()
+
+  // Get the full selection state
+  const all = {
+    edges: new Set(simpleGraph.edges),
+    nodes: new Set(simpleGraph.nodes.values()),
+  }
+
+  // Create an empty selection state
+  const empty: GraphSelectionState = {
+    edges: new Set(),
+    nodes: new Set(),
+  }
+
+  // Run tests in the same pattern as the main pseudo.ts tests
+  const queryToExpected = new Set<TestCase>([
+    [':dev', all, ['b', '@x/y']], // Should return nodes with dev edges
+    [':dev', empty, []], // Empty input should return empty output
+  ])
+
+  const initial = copyGraphSelectionState(all)
+  for (const [query, partial, expected] of queryToExpected) {
+    const result = await testPseudo(
+      query,
+      initial,
+      copyGraphSelectionState(partial),
+    )
+
+    t.strictSame(
+      result.nodes.map(i => i.name),
+      expected,
+      `query > "${query}"`,
+    )
+
+    // Verify all edges are of type 'dev'
+    const edgeArray = [...result.edges]
+    if (edgeArray.length > 0) {
+      for (const edge of edgeArray) {
+        t.equal(
+          edge.type,
+          'dev',
+          `edge ${edge.name} should be of type 'dev'`,
+        )
+      }
+    }
+  }
+})