@vltpkg/query 1.0.0-rc.33 → 1.0.0-rc.34

package/test/pseudo/malware.ts

@@ -1,17 +1,12 @@
 import t from 'tap'
 import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { parse, asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
+import { parse } from '../../src/parser.ts'
 import { asSecurityArchiveLike } from '@vltpkg/security-archive'
 import { getSimpleGraph } from '../fixtures/graph.ts'
-import {
-  malware,
-  isMalwareKind,
-  asMalwareKind,
-  parseInternals,
-} from '../../src/pseudo/malware.ts'
+import { malware } from '../../src/pseudo/malware.ts'
 import type { ParserState } from '../../src/types.ts'
 
-t.test('selects packages with a specific malware kind', async t => {
+t.test('selects packages with malware alerts', async t => {
   const getState = (query: string, graph = getSimpleGraph()) => {
     const ast = parse(query)
     const current = ast.first.first
@@ -52,14 +47,7 @@ t.test('selects packages with a specific malware kind', async t => {
             joinDepIDTuple(['registry', '', 'c@1.0.0']),
             {
               id: joinDepIDTuple(['registry', '', 'c@1.0.0']),
-              alerts: [{ type: 'gptSecurity' }],
-            },
-          ],
-          [
-            joinDepIDTuple(['registry', '', 'd@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'd@1.0.0']),
-              alerts: [{ type: 'gptAnomaly' }],
+              alerts: [{ type: 'deprecated' }],
             },
           ],
           [
@@ -69,13 +57,6 @@ t.test('selects packages with a specific malware kind', async t => {
               alerts: [{ type: 'malware' }],
             },
           ],
-          [
-            joinDepIDTuple(['registry', '', 'f@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'f@1.0.0']),
-              alerts: [{ type: 'gptMalware' }],
-            },
-          ],
         ]),
       ),
       importers: new Set(graph.importers),
@@ -87,188 +68,13 @@ t.test('selects packages with a specific malware kind', async t => {
   }
 
   await t.test(
-    'filter out any node that does not have the malware alert',
-    async t => {
-      const res = await malware(getState(':malware("critical")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['a', 'e'],
-        'should select only packages with the specified malware alert',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-
-  await t.test('filter using numbered param', async t => {
-    const res = await malware(getState(':malware(0)'))
-    t.strictSame(
-      [...res.partial.nodes].map(n => n.name),
-      ['a', 'e'],
-      'should select only packages with the specified malware alert',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-
-  await t.test('filter out using unquoted param', async t => {
-    const res = await malware(getState(':malware(high)'))
-    t.strictSame(
-      [...res.partial.nodes].map(n => n.name),
-      ['b', 'f'],
-      'should select only packages with the specified malware alert',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-
-  await t.test(
-    'greater than comparator with number (unquoted)',
-    async t => {
-      const res = await malware(getState(':malware(>1)'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['c', 'd'],
-        'should select packages with malware kind greater than 1',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'greater than comparator with string kind (quoted)',
-    async t => {
-      const res = await malware(getState(':malware(">high")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['c', 'd'],
-        'should select packages with malware kind greater than high',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'less than comparator with number (unquoted)',
-    async t => {
-      const res = await malware(getState(':malware(<2)'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['a', 'b', 'e', 'f'],
-        'should select packages with malware kind less than 2',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'less than comparator with string kind (quoted)',
-    async t => {
-      const res = await malware(getState(':malware("<medium")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['a', 'b', 'e', 'f'],
-        'should select packages with malware kind less than medium',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'greater than or equal to comparator with number (unquoted)',
-    async t => {
-      const res = await malware(getState(':malware(>=2)'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['c', 'd'],
-        'should select packages with malware kind greater than or equal to 2',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'greater than or equal to comparator with string kind (quoted)',
-    async t => {
-      const res = await malware(getState(':malware(">=medium")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['c', 'd'],
-        'should select packages with malware kind greater than or equal to medium',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'less than or equal to comparator with number (unquoted)',
-    async t => {
-      const res = await malware(getState(':malware(<=1)'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['a', 'b', 'e', 'f'],
-        'should select packages with malware kind less than or equal to 1',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'less than or equal to comparator with string kind (quoted)',
-    async t => {
-      const res = await malware(getState(':malware("<=high")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['a', 'b', 'e', 'f'],
-        'should select packages with malware kind less than or equal to high',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'parameterless :malware matches medium+ severity',
+    'matches nodes with malware or gptMalware alerts',
     async t => {
       const res = await malware(getState(':malware'))
       t.strictSame(
         [...res.partial.nodes].map(n => n.name).sort(),
-        ['a', 'b', 'c', 'e', 'f'],
-        'should select packages with malware severity >= medium (exclude low/gptAnomaly)',
-      )
-      // Verify that package 'd' with gptAnomaly (low/3) is excluded
-      t.notOk(
-        [...res.partial.nodes].some(n => n.name === 'd'),
-        'should exclude package d with gptAnomaly (low severity)',
+        ['a', 'b', 'e'],
+        'should select only packages with malware or gptMalware alerts',
       )
       t.matchSnapshot({
         nodes: [...res.partial.nodes].map(n => n.name).sort(),
@@ -277,29 +83,67 @@ t.test('selects packages with a specific malware kind', async t => {
     },
   )
 
-  await t.test('wrong parameter', async t => {
-    await t.rejects(
-      malware(getState(':malware("")')),
-      { message: /Failed to parse :malware selector/ },
-      'should throw an error',
+  await t.test('excludes nodes without malware alerts', async t => {
+    const res = await malware(getState(':malware'))
+    t.notOk(
+      [...res.partial.nodes].some(n => n.name === 'c'),
+      'should exclude package c with only deprecated alert',
     )
-  })
-
-  await t.test('invalid comparison value', async t => {
-    await t.rejects(
-      malware(getState(':malware(>invalid)')),
-      { message: /Failed to parse :malware selector/ },
-      'should throw an error for invalid comparison value',
+    t.notOk(
+      [...res.partial.nodes].some(n => n.name === 'd'),
+      'should exclude package d with no security data',
     )
   })
+})
 
-  await t.test('out of range number', async t => {
-    await t.rejects(
-      malware(getState(':malware(>5)')),
-      { message: /Failed to parse :malware selector/ },
-      'should throw an error for out of range number',
-    )
-  })
+t.test(':malware rejects parameters', async t => {
+  const getState = (query: string, graph = getSimpleGraph()) => {
+    const ast = parse(query)
+    const current = ast.first.first
+    const state: ParserState = {
+      comment: '',
+      current,
+      initial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      partial: {
+        edges: new Set(graph.edges.values()),
+        nodes: new Set(graph.nodes.values()),
+      },
+      collect: {
+        edges: new Set(),
+        nodes: new Set(),
+      },
+      cancellable: async () => {},
+      walk: async i => i,
+      securityArchive: asSecurityArchiveLike(
+        new Map([
+          [
+            joinDepIDTuple(['registry', '', 'a@1.0.0']),
+            {
+              id: joinDepIDTuple(['registry', '', 'a@1.0.0']),
+              alerts: [{ type: 'malware' }],
+            },
+          ],
+        ]),
+      ),
+      importers: new Set(graph.importers),
+      retries: 0,
+      signal: new AbortController().signal,
+      specificity: { idCounter: 0, commonCounter: 0 },
+    }
+    return state
+  }
+
+  await t.rejects(
+    malware(getState(':malware(critical)')),
+    {
+      message:
+        /:malware selector does not accept parameters\. Use :vuln\(<severity>\) for severity-based filtering\./,
+    },
+    'should throw when parameters are provided',
+  )
 })
 
 t.test('missing security archive', async t => {
@@ -333,99 +177,8 @@ t.test('missing security archive', async t => {
   }
 
   await t.rejects(
-    malware(getState(':malware(critical)')),
+    malware(getState(':malware')),
     { message: /Missing security archive/ },
     'should throw an error',
   )
 })
-
-t.test('isMalwareKind', async t => {
-  t.ok(
-    isMalwareKind('critical'),
-    'should return true for valid malware kinds',
-  )
-  t.notOk(
-    isMalwareKind('invalid'),
-    'should return false for invalid malware kinds',
-  )
-})
-
-t.test('asMalwareKind', async t => {
-  t.equal(
-    asMalwareKind('critical'),
-    'critical',
-    'should return the malware kind',
-  )
-  t.throws(
-    () => asMalwareKind('invalid'),
-    { message: /Expected a valid malware kind/ },
-    'should throw an error for invalid malware kinds',
-  )
-})
-
-t.test('parseInternals', async t => {
-  const testParseInternals = (query: string) => {
-    const ast = parse(query)
-    const nodes = asPostcssNodeWithChildren(ast.first.first).nodes
-    return parseInternals(nodes)
-  }
-
-  t.strictSame(
-    parseInternals([]),
-    { kind: undefined, comparator: undefined },
-    'should handle empty nodes array (parameterless :malware)',
-  )
-
-  // Test case for lines 87-88: selector node exists but has no child nodes
-  t.strictSame(
-    parseInternals([{ type: 'selector', nodes: [] } as any]),
-    { kind: undefined, comparator: undefined },
-    'should handle selector node with empty nodes array',
-  )
-
-  t.strictSame(
-    testParseInternals(':malware(critical)'),
-    { kind: 'critical', comparator: undefined },
-    'should parse simple kind without comparator',
-  )
-
-  t.strictSame(
-    testParseInternals(':malware(">1")'),
-    { kind: '1', comparator: '>' },
-    'should parse kind with greater than comparator',
-  )
-
-  t.strictSame(
-    testParseInternals(':malware(<low)'),
-    { kind: 'low', comparator: '<' },
-    'should parse kind with less than comparator',
-  )
-
-  t.strictSame(
-    testParseInternals(':malware(">=medium")'),
-    { kind: 'medium', comparator: '>=' },
-    'should parse kind with greater than or equal comparator',
-  )
-
-  t.strictSame(
-    testParseInternals(':malware(<=2)'),
-    { kind: '2', comparator: '<=' },
-    'should parse kind with less than or equal comparator',
-  )
-
-  t.throws(
-    () => testParseInternals(':malware(>invalid)'),
-    {
-      message: /Expected a valid malware kind or number between 0-3/,
-    },
-    'should throw for invalid kind with comparator',
-  )
-
-  t.throws(
-    () => testParseInternals(':malware(>4)'),
-    {
-      message: /Expected a valid malware kind or number between 0-3/,
-    },
-    'should throw for out of range number with comparator',
-  )
-})