@vltpkg/query 1.5.0 → 1.6.0

package/test/pseudo/built.ts

@@ -1,214 +0,0 @@
-import t from 'tap'
-import postcssSelectorParser from 'postcss-selector-parser'
-import type { ParserState } from '../../src/types.ts'
-import { built } from '../../src/pseudo/built.ts'
-import {
-  getSimpleGraph,
-  getSingleWorkspaceGraph,
-  getCycleGraph,
-} from '../fixtures/graph.ts'
-
-t.test('selects packages with built buildState', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = postcssSelectorParser().astSync(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: undefined,
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'selects nodes with built buildState in simple graph',
-    async t => {
-      const graph = getSimpleGraph()
-      // Set some nodes to have buildState 'built'
-      const nodes = [...graph.nodes.values()]
-      if (nodes.length >= 5) {
-        nodes[0]!.buildState = 'built'
-        nodes[1]!.buildState = 'needed'
-        nodes[2]!.buildState = 'built'
-        nodes[3]!.buildState = 'failed'
-        nodes[4]!.buildState = 'none'
-
-        const res = await built(getState(':built', graph))
-        const resultNames = [...res.partial.nodes].map(n => n.name)
-
-        t.ok(
-          resultNames.includes(nodes[0]!.name),
-          'should include first node with built state',
-        )
-        t.ok(
-          resultNames.includes(nodes[2]!.name),
-          'should include second node with built state',
-        )
-        t.notOk(
-          resultNames.includes(nodes[1]!.name),
-          'should not include node with needed state',
-        )
-        t.notOk(
-          resultNames.includes(nodes[3]!.name),
-          'should not include node with failed state',
-        )
-        t.notOk(
-          resultNames.includes(nodes[4]!.name),
-          'should not include node with none state',
-        )
-
-        t.matchSnapshot({
-          nodes: [...res.partial.nodes].map(n => n.name).sort(),
-          edges: [...res.partial.edges].map(e => e.name).sort(),
-        })
-      }
-    },
-  )
-
-  await t.test(
-    'selects no nodes when none have built state',
-    async t => {
-      const graph = getSingleWorkspaceGraph()
-      // Set all nodes to have non-built buildState
-      for (const node of graph.nodes.values()) {
-        node.buildState = 'needed'
-      }
-
-      const res = await built(getState(':built', graph))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        [],
-        'should not select any nodes when none have built state',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'selects all nodes when all have built state',
-    async t => {
-      const graph = getCycleGraph()
-      // Set all nodes to have built buildState
-      for (const node of graph.nodes.values()) {
-        node.buildState = 'built'
-      }
-
-      const res = await built(getState(':built', graph))
-      const allNodeNames = [...graph.nodes.values()].map(n => n.name)
-      const resultNodeNames = [...res.partial.nodes].map(n => n.name)
-
-      t.strictSame(
-        resultNodeNames.sort(),
-        allNodeNames.sort(),
-        'should select all nodes when all have built state',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test('handles an empty partial state', async t => {
-    // Create a state with empty partial nodes
-    const state = getState(':built')
-    state.partial.nodes.clear()
-    state.partial.edges.clear()
-
-    const res = await built(state)
-    t.strictSame(
-      [...res.partial.nodes].map(n => n.name),
-      [],
-      'should return empty array when starting with empty partial state',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-
-  await t.test('properly removes dangling edges', async t => {
-    const graph = getSimpleGraph()
-    const nodes = [...graph.nodes.values()]
-
-    // Set only one node to be built
-    if (nodes[0]) {
-      nodes[0].buildState = 'built'
-      for (let i = 1; i < nodes.length; i++) {
-        if (nodes[i]) {
-          nodes[i]!.buildState = 'none'
-        }
-      }
-    }
-
-    const res = await built(getState(':built', graph))
-
-    // Check that edges pointing to removed nodes are also removed
-    for (const edge of res.partial.edges) {
-      t.ok(
-        edge.to?.buildState === 'built' || !edge.to,
-        'edges should only point to built nodes or be missing',
-      )
-    }
-
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name).sort(),
-      edges: [...res.partial.edges].map(e => e.name).sort(),
-    })
-  })
-
-  await t.test(
-    'filters mixed buildState values correctly',
-    async t => {
-      const graph = getSimpleGraph()
-      const nodes = [...graph.nodes.values()]
-
-      // Create a realistic scenario with mixed buildStates
-      if (nodes.length >= 5) {
-        nodes[0]!.buildState = 'built'
-        nodes[1]!.buildState = 'needed'
-        nodes[2]!.buildState = 'built'
-        nodes[3]!.buildState = 'failed'
-        nodes[4]!.buildState = 'built'
-      }
-
-      const res = await built(getState(':built', graph))
-      const resultNodes = [...res.partial.nodes]
-
-      // All resulting nodes should have buildState === 'built'
-      for (const node of resultNodes) {
-        t.equal(
-          node.buildState,
-          'built',
-          `node ${node.name} should have buildState 'built'`,
-        )
-      }
-
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-})

package/test/pseudo/confused.ts

@@ -1,160 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { parse } from '../../src/parser.ts'
-import { confused } from '../../src/pseudo/confused.ts'
-
-t.test('selects packages with a manifestConfusion alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'manifestConfusion' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await confused(getState(':confused'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only confused packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: undefined,
-      importers: new Set(),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    confused(getState(':confused')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})
-
-t.test('nodes with confused=true flag', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const graph = getSimpleGraph()
-
-    // Find node 'a' and set confused=true
-    const nodeA = [...graph.nodes.values()].find(n => n.name === 'a')
-    if (nodeA) {
-      nodeA.confused = true
-      t.teardown(() => {
-        nodeA.confused = false // Reset the flag after the test
-      })
-    }
-
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'manifestConfusion' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test('filter out nodes that are not confused', async t => {
-    const res = await confused(getState(':confused'))
-    t.strictSame(
-      [...res.partial.nodes].map(n => n.name),
-      ['a', 'e'],
-      'should select both confused=true nodes and nodes with manifestConfusion alert',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-})

package/test/pseudo/cve.ts

@@ -1,249 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import {
-  asPackageReportData,
-  asSecurityArchiveLike,
-} from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { parse } from '../../src/parser.ts'
-import { cve } from '../../src/pseudo/cve.ts'
-
-t.test('selects packages with a CVE alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            asPackageReportData({
-              id: 'e@1.0.0',
-              author: [],
-              size: 0,
-              type: 'npm',
-              name: 'e',
-              version: '1.0.0',
-              license: 'MIT',
-              score: {
-                overall: 0,
-                license: 0,
-                maintenance: 0,
-                quality: 0,
-                supplyChain: 0,
-                vulnerability: 0,
-                signal: new AbortController().signal,
-                specificity: { idCounter: 0, commonCounter: 0 },
-              },
-              alerts: [
-                {
-                  key: '12314320948130',
-                  type: 'cve',
-                  severity: 'high',
-                  category: 'security',
-                  props: {
-                    cveId: 'CVE-2023-1234',
-                    lastPublish: '2023-01-01',
-                  },
-                },
-              ],
-            }),
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await cve(getState(':cve(CVE-2023-1234)'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only packages with matching CVE ID',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-
-  await t.test('should not match an unseen CVE ID', async t => {
-    const res = await cve(getState(':cve(CVE-2023-5678)'))
-    t.strictSame(
-      [...res.partial.nodes].map(n => n.name),
-      [],
-      'should not select any packages when CVE ID does not match',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-
-  await t.test(
-    'filter out any node that does not match the quoted CVE ID',
-    async t => {
-      const res = await cve(getState(':cve("CVE-2023-1234")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only packages with matching CVE ID',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-
-  await t.test(
-    'parameterless :cve matches any package with a CVE',
-    async t => {
-      const res = await cve(getState(':cve'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select packages with any CVE alert',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test(':cve() with empty parens matches any CVE', async t => {
-  const graph = getSimpleGraph()
-  const ast = parse(':cve()')
-  const current = ast.first.first
-  const state: ParserState = {
-    comment: '',
-    current,
-    initial: {
-      edges: new Set(graph.edges.values()),
-      nodes: new Set(graph.nodes.values()),
-    },
-    partial: {
-      edges: new Set(graph.edges.values()),
-      nodes: new Set(graph.nodes.values()),
-    },
-    collect: {
-      edges: new Set(),
-      nodes: new Set(),
-    },
-    cancellable: async () => {},
-    walk: async i => i,
-    retries: 0,
-    securityArchive: asSecurityArchiveLike(
-      new Map([
-        [
-          joinDepIDTuple(['registry', '', 'e@1.0.0']),
-          asPackageReportData({
-            id: 'e@1.0.0',
-            author: [],
-            size: 0,
-            type: 'npm',
-            name: 'e',
-            version: '1.0.0',
-            license: 'MIT',
-            score: {
-              overall: 0,
-              license: 0,
-              maintenance: 0,
-              quality: 0,
-              supplyChain: 0,
-              vulnerability: 0,
-              signal: new AbortController().signal,
-              specificity: { idCounter: 0, commonCounter: 0 },
-            },
-            alerts: [
-              {
-                key: '12314320948130',
-                type: 'cve',
-                severity: 'high',
-                category: 'security',
-                props: {
-                  cveId: 'CVE-2023-1234',
-                  lastPublish: '2023-01-01',
-                },
-              },
-            ],
-          }),
-        ],
-      ]),
-    ),
-    importers: new Set(graph.importers),
-    signal: new AbortController().signal,
-    specificity: { idCounter: 0, commonCounter: 0 },
-  }
-
-  const res = await cve(state)
-  t.strictSame(
-    [...res.partial.nodes].map(n => n.name),
-    ['e'],
-    'should select packages with any CVE alert',
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: undefined,
-      importers: new Set(),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    cve(getState(':cve(CVE-2023-1234)')),
-    /Missing security archive/,
-    'should throw an error',
-  )
-})