@vltpkg/query 1.5.0 → 1.6.0

package/test/pseudo/cwe.ts

@@ -1,255 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import type { PackageReportData } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { cwe } from '../../src/pseudo/cwe.ts'
-import { parse } from '../../src/parser.ts'
-
-t.test('selects packages with a CWE alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            {
-              id: 'e@1.0.0',
-              author: [],
-              size: 0,
-              type: 'npm',
-              name: 'e',
-              version: '1.0.0',
-              license: 'MIT',
-              score: {
-                overall: 0,
-                license: 0,
-                maintenance: 0,
-                quality: 0,
-                supplyChain: 0,
-                vulnerability: 0,
-                signal: new AbortController().signal,
-                specificity: { idCounter: 0, commonCounter: 0 },
-              },
-              alerts: [
-                {
-                  key: '12314320948130',
-                  type: 'cve',
-                  severity: 'high',
-                  category: 'security',
-                  props: {
-                    lastPublish: '2023-01-01',
-                    cveId: 'CVE-2023-1234' as const,
-                    cwes: [
-                      { id: 'CWE-79' as const },
-                      { id: 'CWE-89' as const },
-                    ],
-                  },
-                },
-              ],
-            } as PackageReportData,
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await cwe(getState(':cwe(CWE-79)'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only packages with matching CWE ID',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-
-  await t.test('should not match an unseen CWE ID', async t => {
-    const res = await cwe(getState(':cwe(CWE-123)'))
-    t.strictSame(
-      [...res.partial.nodes].map(n => n.name),
-      [],
-      'should not select any packages when CWE ID does not match',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-
-  await t.test(
-    'filter out any node that does not match the quoted CWE ID',
-    async t => {
-      const res = await cwe(getState(':cwe("CWE-89")'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only packages with matching CWE ID',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-
-  await t.test(
-    'parameterless :cwe matches any package with a CWE',
-    async t => {
-      const res = await cwe(getState(':cwe'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select packages with any CWE alert',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: undefined,
-      importers: new Set(),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    cwe(getState(':cwe(CWE-79)')),
-    /Missing security archive/,
-    'should throw an error',
-  )
-})
-
-t.test(':cwe() with empty parens matches any CWE', async t => {
-  const graph = getSimpleGraph()
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            {
-              id: 'e@1.0.0',
-              author: [],
-              size: 0,
-              type: 'npm',
-              name: 'e',
-              version: '1.0.0',
-              license: 'MIT',
-              score: {
-                overall: 0,
-                license: 0,
-                maintenance: 0,
-                quality: 0,
-                supplyChain: 0,
-                vulnerability: 0,
-                signal: new AbortController().signal,
-                specificity: { idCounter: 0, commonCounter: 0 },
-              },
-              alerts: [
-                {
-                  key: '12314320948130',
-                  type: 'cve',
-                  severity: 'high',
-                  category: 'security',
-                  props: {
-                    lastPublish: '2023-01-01',
-                    cveId: 'CVE-2023-1234' as const,
-                    cwes: [{ id: 'CWE-79' as const }],
-                  },
-                },
-              ],
-            } as PackageReportData,
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  const res = await cwe(getState(':cwe()'))
-  t.strictSame(
-    [...res.partial.nodes].map(n => n.name),
-    ['e'],
-    'should select packages with any CWE alert',
-  )
-})

package/test/pseudo/debug.ts

@@ -1,98 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { parse } from '../../src/parser.ts'
-import { debug } from '../../src/pseudo/debug.ts'
-
-t.test('selects packages with a debugAccess alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'debugAccess' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await debug(getState(':debug'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only debug packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: undefined,
-      importers: new Set(),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    debug(getState(':debug')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})

package/test/pseudo/deprecated.ts

@@ -1,98 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { parse } from '../../src/parser.ts'
-import { deprecated } from '../../src/pseudo/deprecated.ts'
-
-t.test('selects packages with deprecated alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'deprecated' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await deprecated(getState(':deprecated'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only deprecated packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: undefined,
-      importers: new Set(),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    deprecated(getState(':deprecated')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})

package/test/pseudo/dev.ts

@@ -1,61 +0,0 @@
-import t from 'tap'
-import { pseudo } from '../../src/pseudo.ts'
-import {
-  selectorFixture,
-  copyGraphSelectionState,
-} from '../fixtures/selector.ts'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { TestCase } from '../fixtures/types.ts'
-import type { GraphSelectionState } from '../../src/types.ts'
-
-const testPseudo = selectorFixture(pseudo)
-
-t.test(':dev pseudo-selector', async t => {
-  // Get a simple graph for testing
-  const simpleGraph = getSimpleGraph()
-
-  // Get the full selection state
-  const all = {
-    edges: new Set(simpleGraph.edges),
-    nodes: new Set(simpleGraph.nodes.values()),
-  }
-
-  // Create an empty selection state
-  const empty: GraphSelectionState = {
-    edges: new Set(),
-    nodes: new Set(),
-  }
-
-  // Run tests in the same pattern as the main pseudo.ts tests
-  const queryToExpected = new Set<TestCase>([
-    [':dev', all, ['b', '@x/y']], // Should return nodes with dev edges
-    [':dev', empty, []], // Empty input should return empty output
-  ])
-
-  const initial = copyGraphSelectionState(all)
-  for (const [query, partial, expected] of queryToExpected) {
-    const result = await testPseudo(
-      query,
-      initial,
-      copyGraphSelectionState(partial),
-    )
-
-    t.strictSame(
-      result.nodes.map(i => i.name),
-      expected,
-      `query > "${query}"`,
-    )
-
-    // Verify all edges are of type 'dev'
-    const edgeArray = [...result.edges]
-    if (edgeArray.length > 0) {
-      for (const edge of edgeArray) {
-        t.equal(
-          edge.type,
-          'dev',
-          `edge ${edge.name} should be of type 'dev'`,
-        )
-      }
-    }
-  }
-})