@vltpkg/vsr 0.0.0-26 → 0.0.0-27

package/test/audit.test.ts

@@ -1,828 +0,0 @@
-import { describe, it, expect } from 'vitest'
-import { env } from 'cloudflare:test'
-import { app } from '../src/index.ts'
-
-describe('Security Audit Endpoints', () => {
-  describe('Root Registry Audit', () => {
-    describe('POST /-/npm/audit', () => {
-      it('should handle basic audit requests', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                lodash: '^4.17.21',
-                express: '^4.18.0',
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                },
-                express: {
-                  version: '4.18.2',
-                  resolved:
-                    'https://registry.npmjs.org/express/-/express-4.18.2.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-        expect(res.headers.get('content-type')).toContain(
-          'application/json',
-        )
-      })
-
-      it('should handle audit requests without dependencies', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'empty-app',
-              version: '1.0.0',
-              requires: {},
-              dependencies: {},
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle malformed audit requests', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: 'invalid-json',
-          },
-          env,
-        )
-        expect([400, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle missing required fields', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({}),
-          },
-          env,
-        )
-        expect([400, 501].includes(res.status)).toBe(true)
-      })
-    })
-
-    describe('Audit Response Structure', () => {
-      it('should return proper audit response format', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                lodash: '^4.17.21',
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-
-        if (res.status === 200) {
-          const data = (await res.json()) as any
-          expect(data).toBeDefined()
-          // Audit response should include vulnerabilities, metadata, etc.
-        }
-      })
-
-      it('should include vulnerability counts in response', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                'vulnerable-package': '^1.0.0',
-              },
-              dependencies: {
-                'vulnerable-package': {
-                  version: '1.0.0',
-                  resolved:
-                    'https://registry.npmjs.org/vulnerable-package/-/vulnerable-package-1.0.0.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-
-        if (res.status === 200) {
-          const data = (await res.json()) as any
-          expect(data).toBeDefined()
-          // Would validate vulnerability counts based on implementation
-        }
-      })
-
-      it('should include advisory details for vulnerabilities', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                'old-package': '^0.1.0',
-              },
-              dependencies: {
-                'old-package': {
-                  version: '0.1.0',
-                  resolved:
-                    'https://registry.npmjs.org/old-package/-/old-package-0.1.0.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-
-        if (res.status === 200) {
-          const data = (await res.json()) as any
-          expect(data).toBeDefined()
-          // Would validate advisory structure based on implementation
-        }
-      })
-    })
-  })
-
-  describe('Upstream Registry Audit', () => {
-    describe('NPM Registry Audit', () => {
-      it('should handle npm upstream audit requests', async () => {
-        const res = await app.request(
-          '/npm/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                lodash: '^4.17.21',
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
-      })
-
-      it('should handle npm audit with dev dependencies', async () => {
-        const res = await app.request(
-          '/npm/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                lodash: '^4.17.21',
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                  dev: false,
-                },
-                jest: {
-                  version: '29.0.0',
-                  resolved:
-                    'https://registry.npmjs.org/jest/-/jest-29.0.0.tgz',
-                  dev: true,
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
-      })
-    })
-
-    describe('JSR Registry Audit', () => {
-      it('should handle jsr upstream audit requests', async () => {
-        const res = await app.request(
-          '/jsr/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                '@std/fs': '^0.1.0',
-              },
-              dependencies: {
-                '@std/fs': {
-                  version: '0.1.0',
-                  resolved: 'https://jsr.io/@std/fs/0.1.0',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
-      })
-    })
-
-    describe('Custom Registry Audit', () => {
-      it('should handle custom upstream audit requests', async () => {
-        const res = await app.request(
-          '/custom/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                'custom-package': '^1.0.0',
-              },
-              dependencies: {
-                'custom-package': {
-                  version: '1.0.0',
-                  resolved:
-                    'https://custom-registry.com/custom-package/-/custom-package-1.0.0.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
-      })
-    })
-  })
-
-  describe('Legacy Audit Redirects', () => {
-    describe('NPM v1 API Compatibility', () => {
-      it('should redirect /-/npm/v1/security/audits/quick to /-/npm/audit', async () => {
-        const res = await app.request(
-          '/-/npm/v1/security/audits/quick',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-            }),
-          },
-          env,
-        )
-        expect(res.status).toBe(308)
-        expect(res.headers.get('location')).toBe('/-/npm/audit')
-      })
-
-      it('should handle /-/npm/v1/security/advisories/bulk requests', async () => {
-        const res = await app.request(
-          '/-/npm/v1/security/advisories/bulk',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-            }),
-          },
-          env,
-        )
-        // Audit functionality is not implemented yet, expect error status codes
-        expect([400, 404, 500, 501].includes(res.status)).toBe(true)
-      })
-    })
-  })
-
-  describe('Audit Request Validation', () => {
-    describe('Package Lock Format', () => {
-      it('should handle package-lock.json v1 format', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              lockfileVersion: 1,
-              requires: true,
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                  integrity:
-                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle package-lock.json v2 format', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              lockfileVersion: 2,
-              requires: true,
-              packages: {
-                '': {
-                  name: 'test-app',
-                  version: '1.0.0',
-                  dependencies: {
-                    lodash: '^4.17.21',
-                  },
-                },
-                'node_modules/lodash': {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                  integrity:
-                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
-                },
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                  integrity:
-                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle package-lock.json v3 format', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              lockfileVersion: 3,
-              requires: true,
-              packages: {
-                '': {
-                  name: 'test-app',
-                  version: '1.0.0',
-                  dependencies: {
-                    lodash: '^4.17.21',
-                  },
-                },
-                'node_modules/lodash': {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                  integrity:
-                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-    })
-
-    describe('Dependency Tree Validation', () => {
-      it('should handle nested dependencies', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                express: '^4.18.0',
-              },
-              dependencies: {
-                express: {
-                  version: '4.18.2',
-                  resolved:
-                    'https://registry.npmjs.org/express/-/express-4.18.2.tgz',
-                  requires: {
-                    'body-parser': '^1.20.1',
-                  },
-                },
-                'body-parser': {
-                  version: '1.20.1',
-                  resolved:
-                    'https://registry.npmjs.org/body-parser/-/body-parser-1.20.1.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle peer dependencies', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                react: '^18.0.0',
-                'react-dom': '^18.0.0',
-              },
-              dependencies: {
-                react: {
-                  version: '18.2.0',
-                  resolved:
-                    'https://registry.npmjs.org/react/-/react-18.2.0.tgz',
-                },
-                'react-dom': {
-                  version: '18.2.0',
-                  resolved:
-                    'https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz',
-                  requires: {
-                    react: '^18.2.0',
-                  },
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle optional dependencies', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                'optional-package': '^1.0.0',
-              },
-              dependencies: {
-                'optional-package': {
-                  version: '1.0.0',
-                  resolved:
-                    'https://registry.npmjs.org/optional-package/-/optional-package-1.0.0.tgz',
-                  optional: true,
-                },
-              },
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-    })
-  })
-
-  describe('Error Handling', () => {
-    describe('Request Validation Errors', () => {
-      it('should handle missing content-type header', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-            }),
-          },
-          env,
-        )
-        expect([400, 415, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle oversized audit requests', async () => {
-        const largeDependencies = {}
-        for (let i = 0; i < 1000; i++) {
-          largeDependencies[`package-${i}`] = {
-            version: '1.0.0',
-            resolved: `https://registry.npmjs.org/package-${i}/-/package-${i}-1.0.0.tgz`,
-          }
-        }
-
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'large-app',
-              version: '1.0.0',
-              requires: {},
-              dependencies: largeDependencies,
-            }),
-          },
-          env,
-        )
-        expect([200, 400, 413, 501].includes(res.status)).toBe(true)
-      })
-
-      it('should handle invalid lockfile versions', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              lockfileVersion: 999,
-              requires: {},
-              dependencies: {},
-            }),
-          },
-          env,
-        )
-        expect([400, 501].includes(res.status)).toBe(true)
-      })
-    })
-
-    describe('Upstream Registry Errors', () => {
-      it('should handle upstream registry connection errors', async () => {
-        const res = await app.request(
-          '/nonexistent/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {},
-              dependencies: {},
-            }),
-          },
-          env,
-        )
-        expect([404, 501, 502].includes(res.status)).toBe(true)
-      })
-
-      it('should handle upstream registry timeout errors', async () => {
-        const res = await app.request(
-          '/npm/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                lodash: '^4.17.21',
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        // May return 502 due to upstream connection issues in test environment
-        expect([200, 501, 502].includes(res.status)).toBe(true)
-      })
-    })
-  })
-
-  describe('Response Headers and Performance', () => {
-    describe('Content-Type Headers', () => {
-      it('should set appropriate content-type headers', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {},
-              dependencies: {},
-            }),
-          },
-          env,
-        )
-        if (res.status === 200) {
-          expect(res.headers.get('content-type')).toContain(
-            'application/json',
-          )
-        }
-      })
-    })
-
-    describe('Response Time', () => {
-      it('should respond within reasonable time limits', async () => {
-        const startTime = Date.now()
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {
-                lodash: '^4.17.21',
-              },
-              dependencies: {
-                lodash: {
-                  version: '4.17.21',
-                  resolved:
-                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
-                },
-              },
-            }),
-          },
-          env,
-        )
-        const endTime = Date.now()
-
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-        expect(endTime - startTime).toBeLessThan(10000) // 10 second timeout
-      })
-    })
-
-    describe('Security Headers', () => {
-      it('should include security headers in audit responses', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {},
-              dependencies: {},
-            }),
-          },
-          env,
-        )
-        // Security headers would be validated based on implementation
-        expect([200, 400, 501].includes(res.status)).toBe(true)
-      })
-    })
-  })
-
-  describe('Audit Implementation Status', () => {
-    describe('Feature Availability', () => {
-      it('should indicate audit feature status', async () => {
-        const res = await app.request(
-          '/-/npm/audit',
-          {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({
-              name: 'test-app',
-              version: '1.0.0',
-              requires: {},
-              dependencies: {},
-            }),
-          },
-          env,
-        )
-
-        // Audit may not be fully implemented, should return 501 Not Implemented
-        // or 200 with proper audit response
-        expect([200, 501].includes(res.status)).toBe(true)
-
-        if (res.status === 501) {
-          const data = (await res.json()) as any
-          expect(data).toBeDefined()
-          // Should indicate that audit is not implemented
-        }
-      })
-
-      it('should handle GET requests to audit endpoint', async () => {
-        const res = await app.request('/-/npm/audit', {}, env)
-        // Audit functionality is not implemented yet, expect error status codes
-        expect([400, 404, 405, 500, 501].includes(res.status)).toBe(
-          true,
-        )
-      })
-    })
-  })
-})