@vltpkg/query 1.5.0 → 1.6.1

package/test/pseudo/malware.ts

@@ -1,184 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { parse } from '../../src/parser.ts'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import { malware } from '../../src/pseudo/malware.ts'
-import type { ParserState } from '../../src/types.ts'
-
-t.test('selects packages with malware alerts', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'a@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'a@1.0.0']),
-              alerts: [{ type: 'malware' }],
-            },
-          ],
-          [
-            joinDepIDTuple(['registry', '', 'b@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'b@1.0.0']),
-              alerts: [{ type: 'gptMalware' }],
-            },
-          ],
-          [
-            joinDepIDTuple(['registry', '', 'c@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'c@1.0.0']),
-              alerts: [{ type: 'deprecated' }],
-            },
-          ],
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'e@1.0.0']),
-              alerts: [{ type: 'malware' }],
-            },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'matches nodes with malware or gptMalware alerts',
-    async t => {
-      const res = await malware(getState(':malware'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name).sort(),
-        ['a', 'b', 'e'],
-        'should select only packages with malware or gptMalware alerts',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test('excludes nodes without malware alerts', async t => {
-    const res = await malware(getState(':malware'))
-    t.notOk(
-      [...res.partial.nodes].some(n => n.name === 'c'),
-      'should exclude package c with only deprecated alert',
-    )
-    t.notOk(
-      [...res.partial.nodes].some(n => n.name === 'd'),
-      'should exclude package d with no security data',
-    )
-  })
-})
-
-t.test(':malware rejects parameters', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'a@1.0.0']),
-            {
-              id: joinDepIDTuple(['registry', '', 'a@1.0.0']),
-              alerts: [{ type: 'malware' }],
-            },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    malware(getState(':malware(critical)')),
-    {
-      message:
-        /:malware selector does not accept parameters\. Use :vuln\(<severity>\) for severity-based filtering\./,
-    },
-    'should throw when parameters are provided',
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: undefined,
-      importers: new Set(),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    malware(getState(':malware')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})

package/test/pseudo/minified.ts

@@ -1,98 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { minified } from '../../src/pseudo/minified.ts'
-import { parse } from '../../src/parser.ts'
-
-t.test('selects packages with a minifiedFile alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'minifiedFile' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await minified(getState(':minified'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only minified packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: undefined,
-      importers: new Set(),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    minified(getState(':minified')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})

package/test/pseudo/missing.ts

@@ -1,111 +0,0 @@
-import t from 'tap'
-import postcssSelectorParser from 'postcss-selector-parser'
-import type { ParserState } from '../../src/types.ts'
-import { missing } from '../../src/pseudo/missing.ts'
-import {
-  getSimpleGraph,
-  getMissingNodeGraph,
-} from '../fixtures/graph.ts'
-
-t.test('selects edges with no linked node', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = postcssSelectorParser().astSync(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      retries: 0,
-      securityArchive: undefined,
-      importers: new Set(graph.importers),
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'returns no edges in simple graph (all edges have linked nodes)',
-    async t => {
-      // In getSimpleGraph, all edges have linked nodes, so :missing should return no edges
-      const res = await missing(getState(':missing'))
-      t.strictSame(
-        [...res.partial.edges].map(e => e.name),
-        [],
-        'should not select any edges in a graph where all edges have linked nodes',
-      )
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        [],
-        'should always return an empty nodes set',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test(
-    'selects edges with no linked node in missing node graph',
-    async t => {
-      // In getMissingNodeGraph, there are edges without linked nodes
-      const missingNodeGraph = getMissingNodeGraph()
-      const res = await missing(
-        getState(':missing', missingNodeGraph),
-      )
-
-      // The getMissingNodeGraph has edges 'a' and 'b' without linked nodes
-      t.strictSame(
-        [...res.partial.edges].map(e => e.name).sort(),
-        ['a', 'b'].sort(),
-        'should select only edges without linked nodes',
-      )
-      t.strictSame(
-        [...res.partial.nodes],
-        [],
-        'should always return an empty nodes set',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name).sort(),
-        edges: [...res.partial.edges].map(e => e.name).sort(),
-      })
-    },
-  )
-
-  await t.test('handles an empty partial state', async t => {
-    // Create a state with empty partial edges and nodes
-    const state = getState(':missing')
-    state.partial.nodes.clear()
-    state.partial.edges.clear()
-
-    const res = await missing(state)
-    t.strictSame(
-      [...res.partial.edges],
-      [],
-      'should return empty array of edges when starting with empty partial state',
-    )
-    t.strictSame(
-      [...res.partial.nodes],
-      [],
-      'should return empty array of nodes when starting with empty partial state',
-    )
-    t.matchSnapshot({
-      nodes: [...res.partial.nodes].map(n => n.name),
-      edges: [...res.partial.edges].map(e => e.name),
-    })
-  })
-})

package/test/pseudo/native.ts

@@ -1,98 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { nativeParser } from '../../src/pseudo/native.ts'
-import { parse } from '../../src/parser.ts'
-
-t.test('selects packages with a hasNativeCode alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'hasNativeCode' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await nativeParser(getState(':native'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only native packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: undefined,
-      importers: new Set(),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    nativeParser(getState(':native')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})

package/test/pseudo/network.ts

@@ -1,98 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { network } from '../../src/pseudo/network.ts'
-import { parse } from '../../src/parser.ts'
-
-t.test('selects packages with a networkAccess alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'networkAccess' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await network(getState(':network'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only network packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: undefined,
-      importers: new Set(),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    network(getState(':network')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})

package/test/pseudo/obfuscated.ts

@@ -1,98 +0,0 @@
-import t from 'tap'
-import { joinDepIDTuple } from '@vltpkg/dep-id'
-import { asSecurityArchiveLike } from '@vltpkg/security-archive'
-import { getSimpleGraph } from '../fixtures/graph.ts'
-import type { ParserState } from '../../src/types.ts'
-import { obfuscated } from '../../src/pseudo/obfuscated.ts'
-import { parse } from '../../src/parser.ts'
-
-t.test('selects packages with an obfuscated alert', async t => {
-  const getState = (query: string, graph = getSimpleGraph()) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      partial: {
-        edges: new Set(graph.edges.values()),
-        nodes: new Set(graph.nodes.values()),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: asSecurityArchiveLike(
-        new Map([
-          [
-            joinDepIDTuple(['registry', '', 'e@1.0.0']),
-            { alerts: [{ type: 'obfuscatedFile' }] },
-          ],
-        ]),
-      ),
-      importers: new Set(graph.importers),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.test(
-    'filter out any node that does not have the alert',
-    async t => {
-      const res = await obfuscated(getState(':obfuscated'))
-      t.strictSame(
-        [...res.partial.nodes].map(n => n.name),
-        ['e'],
-        'should select only obfuscated packages',
-      )
-      t.matchSnapshot({
-        nodes: [...res.partial.nodes].map(n => n.name),
-        edges: [...res.partial.edges].map(e => e.name),
-      })
-    },
-  )
-})
-
-t.test('missing security archive', async t => {
-  const getState = (query: string) => {
-    const ast = parse(query)
-    const current = ast.first.first
-    const state: ParserState = {
-      comment: '',
-      current,
-      initial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      partial: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      collect: {
-        edges: new Set(),
-        nodes: new Set(),
-      },
-      cancellable: async () => {},
-      walk: async i => i,
-      securityArchive: undefined,
-      importers: new Set(),
-      retries: 0,
-      signal: new AbortController().signal,
-      specificity: { idCounter: 0, commonCounter: 0 },
-    }
-    return state
-  }
-
-  await t.rejects(
-    obfuscated(getState(':obfuscated')),
-    { message: /Missing security archive/ },
-    'should throw an error',
-  )
-})