happyskills 0.35.5 → 0.37.0

package/src/validation/dependency_rules.test.js

@@ -0,0 +1,231 @@
+'use strict'
+const { describe, it, beforeEach, afterEach } = require('node:test')
+const assert = require('node:assert/strict')
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+
+const { validate_dependencies } = require('./dependency_rules')
+
+const make_tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), 'hs-validate-deps-'))
+
+let tmp
+beforeEach(() => { tmp = make_tmp() })
+afterEach(() => { fs.rmSync(tmp, { recursive: true, force: true }) })
+
+// ---------------------------------------------------------------------------
+// Local rules (no registry)
+// ---------------------------------------------------------------------------
+
+describe('dep-self-reference', () => {
+	it('passes when no dependencies', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0' }
+		const [err, results] = await validate_dependencies(tmp, manifest)
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-self-reference')
+		assert.strictEqual(check.severity, 'pass')
+	})
+
+	it('passes when dependencies do not include self', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/other': '*' } }
+		const [err, results] = await validate_dependencies(tmp, manifest)
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-self-reference')
+		assert.strictEqual(check.severity, 'pass')
+	})
+
+	it('errors when skill depends on itself (short name match)', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/my-skill': '*' } }
+		const [err, results] = await validate_dependencies(tmp, manifest)
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-self-reference' && r.severity === 'error')
+		assert.ok(check, 'should find self-reference error')
+		assert.ok(check.message.includes('depends on itself'))
+	})
+})
+
+// ---------------------------------------------------------------------------
+// Registry rules (mocked API)
+// ---------------------------------------------------------------------------
+
+const make_mock_api = (repos = {}, resolve_result = null) => ({
+	get_repo: async (owner, name, opts) => {
+		const key = `${owner}/${name}`
+		if (repos[key]) return [null, repos[key]]
+		return [new Error(`Not found: ${key}`), null]
+	},
+	resolve_dependencies: async (skill, version, installed) => {
+		if (resolve_result) return [null, resolve_result]
+		return [new Error('Not implemented'), null]
+	}
+})
+
+describe('dep-exists (registry)', () => {
+	it('passes when all deps exist', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/auth': '*' } }
+		const api = make_mock_api({ 'acme/auth': { visibility: 'public' } })
+		const [err, results] = await validate_dependencies(tmp, manifest, { registry: true, repos_api: api })
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-exists' && r.value === 'acme/auth')
+		assert.strictEqual(check.severity, 'pass')
+	})
+
+	it('errors when dep is missing', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/missing': '*' } }
+		const api = make_mock_api({})
+		const [err, results] = await validate_dependencies(tmp, manifest, { registry: true, repos_api: api })
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-exists' && r.value === 'acme/missing')
+		assert.strictEqual(check.severity, 'error')
+		assert.ok(check.message.includes('not found'))
+	})
+})
+
+describe('dep-visibility-direct (registry)', () => {
+	it('errors when public skill depends on private dep', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/secret': '*' } }
+		const api = make_mock_api({ 'acme/secret': { visibility: 'private' } })
+		const [err, results] = await validate_dependencies(tmp, manifest, { registry: true, visibility: 'public', repos_api: api })
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-visibility-direct' && r.severity === 'error')
+		assert.ok(check, 'should find visibility error')
+		assert.ok(check.message.includes('Visibility mismatch'))
+		assert.ok(check.message.includes('private'))
+	})
+
+	it('warns when public skill depends on workspace-scoped dep', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/internal': '*' } }
+		const api = make_mock_api({ 'acme/internal': { visibility: 'workspace' } })
+		const [err, results] = await validate_dependencies(tmp, manifest, { registry: true, visibility: 'public', repos_api: api })
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-visibility-workspace')
+		assert.strictEqual(check.severity, 'warning')
+	})
+
+	it('passes when public skill has all public deps', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/auth': '*' } }
+		const api = make_mock_api({ 'acme/auth': { visibility: 'public' } })
+		const [err, results] = await validate_dependencies(tmp, manifest, { registry: true, visibility: 'public', repos_api: api })
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-visibility-direct')
+		assert.strictEqual(check.severity, 'pass')
+	})
+
+	it('skips visibility check for private skills', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/secret': '*' } }
+		const api = make_mock_api({ 'acme/secret': { visibility: 'private' } })
+		const [err, results] = await validate_dependencies(tmp, manifest, { registry: true, visibility: 'private', repos_api: api })
+		assert.ifError(err)
+		const vis_results = results.filter(r => r.rule === 'dep-visibility-direct' || r.rule === 'dep-visibility-workspace')
+		assert.strictEqual(vis_results.length, 0)
+	})
+})
+
+describe('dep-circular (registry)', () => {
+	it('detects a simple cycle A → B → A', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/b': '*' } }
+		const resolve_result = {
+			packages: [
+				{ skill: 'acme/a', version: '1.0.0', dependencies: { 'acme/b': '*' } },
+				{ skill: 'acme/b', version: '1.0.0', dependencies: { 'acme/a': '*' } }
+			],
+			skipped: []
+		}
+		const api = make_mock_api({ 'acme/b': { visibility: 'public' } }, resolve_result)
+		const [err, results] = await validate_dependencies(tmp, manifest, {
+			registry: true, full_name: 'acme/a', repos_api: api
+		})
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-circular' && r.severity === 'error')
+		assert.ok(check, 'should detect cycle')
+		assert.ok(check.message.includes('Circular dependency'))
+	})
+
+	it('passes when no cycles', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/b': '*' } }
+		const resolve_result = {
+			packages: [
+				{ skill: 'acme/a', version: '1.0.0', dependencies: { 'acme/b': '*' } },
+				{ skill: 'acme/b', version: '1.0.0', dependencies: {} }
+			],
+			skipped: []
+		}
+		const api = make_mock_api({ 'acme/b': { visibility: 'public' } }, resolve_result)
+		const [err, results] = await validate_dependencies(tmp, manifest, {
+			registry: true, full_name: 'acme/a', repos_api: api
+		})
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-circular')
+		assert.strictEqual(check.severity, 'pass')
+	})
+})
+
+describe('dep-visibility-transitive (registry)', () => {
+	it('errors when transitive dep is private', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/b': '*' } }
+		const resolve_result = {
+			packages: [
+				{ skill: 'acme/a', version: '1.0.0', visibility: 'public', dependencies: { 'acme/b': '*' } },
+				{ skill: 'acme/b', version: '1.0.0', visibility: 'public', dependencies: { 'acme/c': '*' } },
+				{ skill: 'acme/c', version: '1.0.0', visibility: 'private', dependencies: {} }
+			],
+			skipped: []
+		}
+		const api = make_mock_api(
+			{ 'acme/b': { visibility: 'public' } },
+			resolve_result
+		)
+		const [err, results] = await validate_dependencies(tmp, manifest, {
+			registry: true, visibility: 'public', full_name: 'acme/a', repos_api: api
+		})
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-visibility-transitive' && r.severity === 'error')
+		assert.ok(check, 'should find transitive visibility error')
+		assert.ok(check.message.includes('acme/c'))
+		assert.ok(check.message.includes('private'))
+	})
+
+	it('reports skipped (access-denied) deps as visibility errors', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/b': '*' } }
+		const resolve_result = {
+			packages: [
+				{ skill: 'acme/a', version: '1.0.0', visibility: 'public', dependencies: { 'acme/b': '*' } },
+				{ skill: 'acme/b', version: '1.0.0', visibility: 'public', dependencies: { 'acme/secret': '*' } }
+			],
+			skipped: [
+				{ skill: 'acme/secret', reason: 'access_denied', message: 'Access denied', required_by: 'acme/b', visibility: 'private' }
+			]
+		}
+		const api = make_mock_api(
+			{ 'acme/b': { visibility: 'public' } },
+			resolve_result
+		)
+		const [err, results] = await validate_dependencies(tmp, manifest, {
+			registry: true, visibility: 'public', full_name: 'acme/a', repos_api: api
+		})
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-visibility-transitive' && r.severity === 'error' && r.value === 'acme/secret')
+		assert.ok(check, 'should report skipped dep as visibility error')
+	})
+
+	it('passes when all transitive deps are public', async () => {
+		const manifest = { name: 'my-skill', version: '1.0.0', dependencies: { 'acme/b': '*' } }
+		const resolve_result = {
+			packages: [
+				{ skill: 'acme/a', version: '1.0.0', visibility: 'public', dependencies: { 'acme/b': '*' } },
+				{ skill: 'acme/b', version: '1.0.0', visibility: 'public', dependencies: {} }
+			],
+			skipped: []
+		}
+		const api = make_mock_api(
+			{ 'acme/b': { visibility: 'public' } },
+			resolve_result
+		)
+		const [err, results] = await validate_dependencies(tmp, manifest, {
+			registry: true, visibility: 'public', full_name: 'acme/a', repos_api: api
+		})
+		assert.ifError(err)
+		const check = results.find(r => r.rule === 'dep-visibility-transitive')
+		assert.strictEqual(check.severity, 'pass')
+	})
+})