@vltpkg/query 1.0.0-rc.32 → 1.0.0-rc.34

package/test/pseudo/malware.ts

@@ -0,0 +1,184 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { parse } from '../../src/parser.ts'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import { malware } from '../../src/pseudo/malware.ts'
+import type { ParserState } from '../../src/types.ts'
+
+t.test('selects packages with malware alerts', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'a@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'a@1.0.0']),
+              alerts: [{ type: 'malware' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'b@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'b@1.0.0']),
+              alerts: [{ type: 'gptMalware' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'c@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'c@1.0.0']),
+              alerts: [{ type: 'deprecated' }],
+            },
+          ],
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'e@1.0.0']),
+              alerts: [{ type: 'malware' }],
+            },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'matches nodes with malware or gptMalware alerts',
+    async t => {
+      const res = await malware(getState(':malware'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name).sort(),
+        ['a', 'b', 'e'],
+        'should select only packages with malware or gptMalware alerts',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test('excludes nodes without malware alerts', async t => {
+    const res = await malware(getState(':malware'))
+    t.notOk(
+      [...res.partial.nodes].some(n => n.name === 'c'),
+      'should exclude package c with only deprecated alert',
+    )
+    t.notOk(
+      [...res.partial.nodes].some(n => n.name === 'd'),
+      'should exclude package d with no security data',
+    )
+  })
+})
+
+t.test(':malware rejects parameters', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'a@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'a@1.0.0']),
+              alerts: [{ type: 'malware' }],
+            },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    malware(getState(':malware(critical)')),
+    {
+      message:
+        /:malware selector does not accept parameters\. Use :vuln\(<severity>\) for severity-based filtering\./,
+    },
+    'should throw when parameters are provided',
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    malware(getState(':malware')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/minified.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { minified } from '../../src/pseudo/minified.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with a minifiedFile alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'minifiedFile' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await minified(getState(':minified'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only minified packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    minified(getState(':minified')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/missing.ts

@@ -0,0 +1,111 @@
+import t from 'tap'
+import postcssSelectorParser from 'postcss-selector-parser'
+import type { ParserState } from '../../src/types.ts'
+import { missing } from '../../src/pseudo/missing.ts'
+import {
+  getSimpleGraph,
+  getMissingNodeGraph,
+} from '../fixtures/graph.ts'
+
+t.test('selects edges with no linked node', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = postcssSelectorParser().astSync(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      retries: 0,
+      securityArchive: undefined,
+      importers: new Set(graph.importers),
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'returns no edges in simple graph (all edges have linked nodes)',
+    async t => {
+      // In getSimpleGraph, all edges have linked nodes, so :missing should return no edges
+      const res = await missing(getState(':missing'))
+      t.strictSame(
+        [...res.partial.edges].map(e => e.name),
+        [],
+        'should not select any edges in a graph where all edges have linked nodes',
+      )
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        [],
+        'should always return an empty nodes set',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test(
+    'selects edges with no linked node in missing node graph',
+    async t => {
+      // In getMissingNodeGraph, there are edges without linked nodes
+      const missingNodeGraph = getMissingNodeGraph()
+      const res = await missing(
+        getState(':missing', missingNodeGraph),
+      )
+
+      // The getMissingNodeGraph has edges 'a' and 'b' without linked nodes
+      t.strictSame(
+        [...res.partial.edges].map(e => e.name).sort(),
+        ['a', 'b'].sort(),
+        'should select only edges without linked nodes',
+      )
+      t.strictSame(
+        [...res.partial.nodes],
+        [],
+        'should always return an empty nodes set',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name).sort(),
+        edges: [...res.partial.edges].map(e => e.name).sort(),
+      })
+    },
+  )
+
+  await t.test('handles an empty partial state', async t => {
+    // Create a state with empty partial edges and nodes
+    const state = getState(':missing')
+    state.partial.nodes.clear()
+    state.partial.edges.clear()
+
+    const res = await missing(state)
+    t.strictSame(
+      [...res.partial.edges],
+      [],
+      'should return empty array of edges when starting with empty partial state',
+    )
+    t.strictSame(
+      [...res.partial.nodes],
+      [],
+      'should return empty array of nodes when starting with empty partial state',
+    )
+    t.matchSnapshot({
+      nodes: [...res.partial.nodes].map(n => n.name),
+      edges: [...res.partial.edges].map(e => e.name),
+    })
+  })
+})

package/test/pseudo/native.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { nativeParser } from '../../src/pseudo/native.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with a hasNativeCode alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'hasNativeCode' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await nativeParser(getState(':native'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only native packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    nativeParser(getState(':native')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/network.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { network } from '../../src/pseudo/network.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with a networkAccess alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'networkAccess' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await network(getState(':network'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only network packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    network(getState(':network')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})

package/test/pseudo/obfuscated.ts

@@ -0,0 +1,98 @@
+import t from 'tap'
+import { joinDepIDTuple } from '@vltpkg/dep-id'
+import { asSecurityArchiveLike } from '@vltpkg/security-archive'
+import { getSimpleGraph } from '../fixtures/graph.ts'
+import type { ParserState } from '../../src/types.ts'
+import { obfuscated } from '../../src/pseudo/obfuscated.ts'
+import { parse } from '../../src/parser.ts'
+
+t.test('selects packages with an obfuscated alert', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'e@1.0.0']),
+            { alerts: [{ type: 'obfuscatedFile' }] },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.test(
+    'filter out any node that does not have the alert',
+    async t => {
+      const res = await obfuscated(getState(':obfuscated'))
+      t.strictSame(
+        [...res.partial.nodes].map(n => n.name),
+        ['e'],
+        'should select only obfuscated packages',
+      )
+      t.matchSnapshot({
+        nodes: [...res.partial.nodes].map(n => n.name),
+        edges: [...res.partial.edges].map(e => e.name),
+      })
+    },
+  )
+})
+
+t.test('missing security archive', async t => {
+  const getState = (query: string) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      partial: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: undefined,
+      importers: new Set(),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    obfuscated(getState(':obfuscated')),
+    { message: /Missing security archive/ },
+    'should throw an error',
+  )
+})