@vltpkg/vsr 0.0.0-26

package/test/audit.test.ts

@@ -0,0 +1,828 @@
+import { describe, it, expect } from 'vitest'
+import { env } from 'cloudflare:test'
+import { app } from '../src/index.ts'
+
+describe('Security Audit Endpoints', () => {
+  describe('Root Registry Audit', () => {
+    describe('POST /-/npm/audit', () => {
+      it('should handle basic audit requests', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                lodash: '^4.17.21',
+                express: '^4.18.0',
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                },
+                express: {
+                  version: '4.18.2',
+                  resolved:
+                    'https://registry.npmjs.org/express/-/express-4.18.2.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+        expect(res.headers.get('content-type')).toContain(
+          'application/json',
+        )
+      })
+
+      it('should handle audit requests without dependencies', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'empty-app',
+              version: '1.0.0',
+              requires: {},
+              dependencies: {},
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle malformed audit requests', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: 'invalid-json',
+          },
+          env,
+        )
+        expect([400, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle missing required fields', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({}),
+          },
+          env,
+        )
+        expect([400, 501].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Audit Response Structure', () => {
+      it('should return proper audit response format', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                lodash: '^4.17.21',
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Audit response should include vulnerabilities, metadata, etc.
+        }
+      })
+
+      it('should include vulnerability counts in response', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                'vulnerable-package': '^1.0.0',
+              },
+              dependencies: {
+                'vulnerable-package': {
+                  version: '1.0.0',
+                  resolved:
+                    'https://registry.npmjs.org/vulnerable-package/-/vulnerable-package-1.0.0.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Would validate vulnerability counts based on implementation
+        }
+      })
+
+      it('should include advisory details for vulnerabilities', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                'old-package': '^0.1.0',
+              },
+              dependencies: {
+                'old-package': {
+                  version: '0.1.0',
+                  resolved:
+                    'https://registry.npmjs.org/old-package/-/old-package-0.1.0.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+
+        if (res.status === 200) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Would validate advisory structure based on implementation
+        }
+      })
+    })
+  })
+
+  describe('Upstream Registry Audit', () => {
+    describe('NPM Registry Audit', () => {
+      it('should handle npm upstream audit requests', async () => {
+        const res = await app.request(
+          '/npm/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                lodash: '^4.17.21',
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
+      })
+
+      it('should handle npm audit with dev dependencies', async () => {
+        const res = await app.request(
+          '/npm/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                lodash: '^4.17.21',
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                  dev: false,
+                },
+                jest: {
+                  version: '29.0.0',
+                  resolved:
+                    'https://registry.npmjs.org/jest/-/jest-29.0.0.tgz',
+                  dev: true,
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('JSR Registry Audit', () => {
+      it('should handle jsr upstream audit requests', async () => {
+        const res = await app.request(
+          '/jsr/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                '@std/fs': '^0.1.0',
+              },
+              dependencies: {
+                '@std/fs': {
+                  version: '0.1.0',
+                  resolved: 'https://jsr.io/@std/fs/0.1.0',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Custom Registry Audit', () => {
+      it('should handle custom upstream audit requests', async () => {
+        const res = await app.request(
+          '/custom/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                'custom-package': '^1.0.0',
+              },
+              dependencies: {
+                'custom-package': {
+                  version: '1.0.0',
+                  resolved:
+                    'https://custom-registry.com/custom-package/-/custom-package-1.0.0.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501, 502].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Legacy Audit Redirects', () => {
+    describe('NPM v1 API Compatibility', () => {
+      it('should redirect /-/npm/v1/security/audits/quick to /-/npm/audit', async () => {
+        const res = await app.request(
+          '/-/npm/v1/security/audits/quick',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+            }),
+          },
+          env,
+        )
+        expect(res.status).toBe(308)
+        expect(res.headers.get('location')).toBe('/-/npm/audit')
+      })
+
+      it('should handle /-/npm/v1/security/advisories/bulk requests', async () => {
+        const res = await app.request(
+          '/-/npm/v1/security/advisories/bulk',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+            }),
+          },
+          env,
+        )
+        // Audit functionality is not implemented yet, expect error status codes
+        expect([400, 404, 500, 501].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Audit Request Validation', () => {
+    describe('Package Lock Format', () => {
+      it('should handle package-lock.json v1 format', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              lockfileVersion: 1,
+              requires: true,
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                  integrity:
+                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle package-lock.json v2 format', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              lockfileVersion: 2,
+              requires: true,
+              packages: {
+                '': {
+                  name: 'test-app',
+                  version: '1.0.0',
+                  dependencies: {
+                    lodash: '^4.17.21',
+                  },
+                },
+                'node_modules/lodash': {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                  integrity:
+                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
+                },
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                  integrity:
+                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle package-lock.json v3 format', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              lockfileVersion: 3,
+              requires: true,
+              packages: {
+                '': {
+                  name: 'test-app',
+                  version: '1.0.0',
+                  dependencies: {
+                    lodash: '^4.17.21',
+                  },
+                },
+                'node_modules/lodash': {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                  integrity:
+                    'sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Dependency Tree Validation', () => {
+      it('should handle nested dependencies', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                express: '^4.18.0',
+              },
+              dependencies: {
+                express: {
+                  version: '4.18.2',
+                  resolved:
+                    'https://registry.npmjs.org/express/-/express-4.18.2.tgz',
+                  requires: {
+                    'body-parser': '^1.20.1',
+                  },
+                },
+                'body-parser': {
+                  version: '1.20.1',
+                  resolved:
+                    'https://registry.npmjs.org/body-parser/-/body-parser-1.20.1.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle peer dependencies', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                react: '^18.0.0',
+                'react-dom': '^18.0.0',
+              },
+              dependencies: {
+                react: {
+                  version: '18.2.0',
+                  resolved:
+                    'https://registry.npmjs.org/react/-/react-18.2.0.tgz',
+                },
+                'react-dom': {
+                  version: '18.2.0',
+                  resolved:
+                    'https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz',
+                  requires: {
+                    react: '^18.2.0',
+                  },
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle optional dependencies', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                'optional-package': '^1.0.0',
+              },
+              dependencies: {
+                'optional-package': {
+                  version: '1.0.0',
+                  resolved:
+                    'https://registry.npmjs.org/optional-package/-/optional-package-1.0.0.tgz',
+                  optional: true,
+                },
+              },
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Error Handling', () => {
+    describe('Request Validation Errors', () => {
+      it('should handle missing content-type header', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+            }),
+          },
+          env,
+        )
+        expect([400, 415, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle oversized audit requests', async () => {
+        const largeDependencies = {}
+        for (let i = 0; i < 1000; i++) {
+          largeDependencies[`package-${i}`] = {
+            version: '1.0.0',
+            resolved: `https://registry.npmjs.org/package-${i}/-/package-${i}-1.0.0.tgz`,
+          }
+        }
+
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'large-app',
+              version: '1.0.0',
+              requires: {},
+              dependencies: largeDependencies,
+            }),
+          },
+          env,
+        )
+        expect([200, 400, 413, 501].includes(res.status)).toBe(true)
+      })
+
+      it('should handle invalid lockfile versions', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              lockfileVersion: 999,
+              requires: {},
+              dependencies: {},
+            }),
+          },
+          env,
+        )
+        expect([400, 501].includes(res.status)).toBe(true)
+      })
+    })
+
+    describe('Upstream Registry Errors', () => {
+      it('should handle upstream registry connection errors', async () => {
+        const res = await app.request(
+          '/nonexistent/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {},
+              dependencies: {},
+            }),
+          },
+          env,
+        )
+        expect([404, 501, 502].includes(res.status)).toBe(true)
+      })
+
+      it('should handle upstream registry timeout errors', async () => {
+        const res = await app.request(
+          '/npm/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                lodash: '^4.17.21',
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        // May return 502 due to upstream connection issues in test environment
+        expect([200, 501, 502].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Response Headers and Performance', () => {
+    describe('Content-Type Headers', () => {
+      it('should set appropriate content-type headers', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {},
+              dependencies: {},
+            }),
+          },
+          env,
+        )
+        if (res.status === 200) {
+          expect(res.headers.get('content-type')).toContain(
+            'application/json',
+          )
+        }
+      })
+    })
+
+    describe('Response Time', () => {
+      it('should respond within reasonable time limits', async () => {
+        const startTime = Date.now()
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {
+                lodash: '^4.17.21',
+              },
+              dependencies: {
+                lodash: {
+                  version: '4.17.21',
+                  resolved:
+                    'https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz',
+                },
+              },
+            }),
+          },
+          env,
+        )
+        const endTime = Date.now()
+
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+        expect(endTime - startTime).toBeLessThan(10000) // 10 second timeout
+      })
+    })
+
+    describe('Security Headers', () => {
+      it('should include security headers in audit responses', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {},
+              dependencies: {},
+            }),
+          },
+          env,
+        )
+        // Security headers would be validated based on implementation
+        expect([200, 400, 501].includes(res.status)).toBe(true)
+      })
+    })
+  })
+
+  describe('Audit Implementation Status', () => {
+    describe('Feature Availability', () => {
+      it('should indicate audit feature status', async () => {
+        const res = await app.request(
+          '/-/npm/audit',
+          {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+              name: 'test-app',
+              version: '1.0.0',
+              requires: {},
+              dependencies: {},
+            }),
+          },
+          env,
+        )
+
+        // Audit may not be fully implemented, should return 501 Not Implemented
+        // or 200 with proper audit response
+        expect([200, 501].includes(res.status)).toBe(true)
+
+        if (res.status === 501) {
+          const data = (await res.json()) as any
+          expect(data).toBeDefined()
+          // Should indicate that audit is not implemented
+        }
+      })
+
+      it('should handle GET requests to audit endpoint', async () => {
+        const res = await app.request('/-/npm/audit', {}, env)
+        // Audit functionality is not implemented yet, expect error status codes
+        expect([400, 404, 405, 500, 501].includes(res.status)).toBe(
+          true,
+        )
+      })
+    })
+  })
+})