qa360 2.1.7 → 2.2.0

package/core/src/adapters/__tests__/pytest-adapter.test.ts

@@ -0,0 +1,207 @@
+/**
+ * QA360 Pytest Adapter Tests
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { resolve } from 'path';
+import { mkdir, rm, writeFile } from 'fs/promises';
+import { tmpdir } from 'os';
+
+import { PytestAdapter } from '../pytest-adapter.js';
+import type { UnitTestConfig } from '../unit-test-types.js';
+
+describe('PytestAdapter', () => {
+  let testDir: string;
+  let adapter: PytestAdapter;
+
+  beforeEach(async () => {
+    testDir = resolve(tmpdir(), `pytest-adapter-test-${Date.now()}`);
+    await mkdir(testDir, { recursive: true });
+    adapter = new PytestAdapter(testDir);
+  });
+
+  afterEach(async () => {
+    await rm(testDir, { recursive: true, force: true });
+  });
+
+  describe('execute with results file', () => {
+    it('should parse Pytest JUnit XML results', async () => {
+      const fixturePath = resolve(__dirname, 'fixtures/pytest-junit.xml');
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, await import('fs/promises').then(fs => fs.readFile(fixturePath, 'utf-8')));
+
+      const config: UnitTestConfig = {
+        results: resultsPath,
+      };
+
+      const result = await adapter.execute(config);
+
+      expect(result.adapter).toBe('pytest');
+      expect(result.total).toBe(5);
+      expect(result.passed).toBe(3);
+      expect(result.failed).toBe(1);
+      expect(result.skipped).toBe(1);
+      expect(result.pending).toBe(0);
+      expect(result.tests).toHaveLength(5);
+    });
+
+    it('should extract test details from JUnit XML', async () => {
+      const fixturePath = resolve(__dirname, 'fixtures/pytest-junit.xml');
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, await import('fs/promises').then(fs => fs.readFile(fixturePath, 'utf-8')));
+
+      const config: UnitTestConfig = {
+        results: resultsPath,
+      };
+
+      const result = await adapter.execute(config);
+
+      // Check passed test
+      const passedTest = result.tests.find(t => t.name === 'test_add');
+      expect(passedTest).toBeDefined();
+      expect(passedTest?.status).toBe('passed');
+      expect(passedTest?.duration).toBeGreaterThan(0);
+
+      // Check failed test
+      const failedTest = result.tests.find(t => t.name === 'test_divide');
+      expect(failedTest).toBeDefined();
+      expect(failedTest?.status).toBe('failed');
+      expect(failedTest?.error).toBeDefined();
+
+      // Check skipped test
+      const skippedTest = result.tests.find(t => t.name === 'test_skipped');
+      expect(skippedTest).toBeDefined();
+      expect(skippedTest?.status).toBe('skipped');
+    });
+  });
+
+  describe('execute without results', () => {
+    it('should return empty result when no results file', async () => {
+      const config: UnitTestConfig = {};
+
+      const result = await adapter.execute(config);
+
+      expect(result.adapter).toBe('pytest');
+      expect(result.total).toBe(0);
+      expect(result.tests).toHaveLength(0);
+      expect(result.success).toBe(true);
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle all passed tests', async () => {
+      const allPassedXml = `<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+  <testsuite name="test_math.py" tests="2" failures="0" errors="0" skipped="0" time="0.1">
+    <testcase name="test_add" classname="test_math.py" time="0.045"></testcase>
+    <testcase name="test_subtract" classname="test_math.py" time="0.032"></testcase>
+  </testsuite>
+</testsuites>`;
+
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, allPassedXml);
+
+      const result = await adapter.execute({ results: resultsPath });
+
+      expect(result.passed).toBe(2);
+      expect(result.failed).toBe(0);
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle all failed tests', async () => {
+      const allFailedXml = `<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+  <testsuite name="test_math.py" tests="1" failures="1" errors="0" skipped="0" time="0.1">
+    <testcase name="test_divide" classname="test_math.py" time="0.015">
+      <failure message="AssertionError: assert 2 == 0">def test_divide():
+    assert 2 == 0
+       AssertionError: assert 2 == 0</failure>
+    </testcase>
+  </testsuite>
+</testsuites>`;
+
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, allFailedXml);
+
+      const result = await adapter.execute({ results: resultsPath });
+
+      expect(result.failed).toBe(1);
+      expect(result.success).toBe(false);
+    });
+
+    it('should handle errors separately from failures', async () => {
+      const errorXml = `<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+  <testsuite name="test_math.py" tests="2" failures="1" errors="1" skipped="0" time="0.1">
+    <testcase name="test_divide" classname="test_math.py" time="0.015">
+      <failure message="AssertionError: assert 2 == 0">def test_divide():
+    assert 2 == 0</failure>
+    </testcase>
+    <testcase name="test_error" classname="test_math.py" time="0.005">
+      <error message="RuntimeError: something went wrong">def test_error():
+    raise RuntimeError("something went wrong")</error>
+    </testcase>
+  </testsuite>
+</testsuites>`;
+
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, errorXml);
+
+      const result = await adapter.execute({ results: resultsPath });
+
+      // Both errors and failures are counted as failed
+      expect(result.failed).toBe(2);
+      expect(result.success).toBe(false);
+    });
+
+    it('should handle skipped tests', async () => {
+      const skippedXml = `<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+  <testsuite name="test_math.py" tests="1" failures="0" errors="0" skipped="1" time="0">
+    <testcase name="test_skipped" classname="test_math.py" time="0">
+      <skipped message="Test skipped conditionally"/>
+    </testcase>
+  </testsuite>
+</testsuites>`;
+
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, skippedXml);
+
+      const result = await adapter.execute({ results: resultsPath });
+
+      expect(result.skipped).toBe(1);
+      expect(result.passed).toBe(0);
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle multiple test suites', async () => {
+      const multiSuiteXml = `<?xml version="1.0" encoding="utf-8"?>
+<testsuites>
+  <testsuite name="test_math.py" tests="2" failures="0" errors="0" skipped="0" time="0.1">
+    <testcase name="test_add" classname="test_math.py" time="0.045"></testcase>
+    <testcase name="test_subtract" classname="test_math.py" time="0.032"></testcase>
+  </testsuite>
+  <testsuite name="test_string.py" tests="1" failures="0" errors="0" skipped="0" time="0.05">
+    <testcase name="test_concat" classname="test_string.py" time="0.020"></testcase>
+  </testsuite>
+</testsuites>`;
+
+      const resultsPath = resolve(testDir, 'test-results/junit.xml');
+      await mkdir(resolve(testDir, 'test-results'), { recursive: true });
+      await writeFile(resultsPath, multiSuiteXml);
+
+      const result = await adapter.execute({ results: resultsPath });
+
+      expect(result.total).toBe(3);
+      expect(result.passed).toBe(3);
+      expect(result.failed).toBe(0);
+      expect(result.success).toBe(true);
+    });
+  });
+});

package/core/src/adapters/__tests__/semgrep-sast.test.ts

@@ -0,0 +1,436 @@
+/**
+ * SemgrepSastAdapter - Real Unit Tests
+ * Tests actual adapter logic without executing semgrep
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { SemgrepSastAdapter } from '../semgrep-sast.js';
+
+// Mock child_process to avoid actually running semgrep
+vi.mock('child_process', () => ({
+  spawn: vi.fn().mockReturnValue({
+    stdout: { on: vi.fn() },
+    stderr: { on: vi.fn() },
+    on: vi.fn(),
+    kill: vi.fn()
+  })
+}));
+
+// Mock fs for file existence checks
+vi.mock('fs', async () => {
+  const actual = await vi.importActual('fs');
+  return {
+    ...actual,
+    existsSync: vi.fn().mockReturnValue(true)
+  };
+});
+
+describe('SemgrepSastAdapter', () => {
+  let adapter: SemgrepSastAdapter;
+
+  beforeEach(() => {
+    adapter = new SemgrepSastAdapter();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  // ============================================================
+  // validateConfig - Static method tests
+  // ============================================================
+  describe('validateConfig', () => {
+    it('should validate config with valid working directory', () => {
+      const result = SemgrepSastAdapter.validateConfig({
+        workingDir: '/tmp/project'
+      });
+      expect(result.valid).toBe(true);
+      expect(result.errors).toHaveLength(0);
+    });
+
+    it('should reject config without working directory', async () => {
+      const fs = await import('fs');
+      const mockedExistsSync = vi.mocked(fs.existsSync);
+      mockedExistsSync.mockReturnValueOnce(false);
+
+      const result = SemgrepSastAdapter.validateConfig({
+        workingDir: ''
+      } as any);
+      expect(result.valid).toBe(false);
+      expect(result.errors.some(e => e.includes('valid working directory'))).toBe(true);
+    });
+
+    it('should accept paths array in config', () => {
+      // Note: This test verifies that paths are accepted in the config structure
+      // Actual path validation is tested in integration tests
+      const config = {
+        workingDir: '/tmp/project',
+        paths: ['src/', 'lib/']
+      };
+      expect(config.paths).toHaveLength(2);
+      expect(config.paths).toContain('src/');
+      expect(config.paths).toContain('lib/');
+    });
+
+    it('should accept config file option', () => {
+      // Note: This test verifies that configFile is accepted in the config structure
+      // Actual file validation is tested in integration tests
+      const config = {
+        workingDir: '/tmp/project',
+        configFile: '.semgrep.yml'
+      };
+      expect(config.configFile).toBe('.semgrep.yml');
+    });
+  });
+
+  // ============================================================
+  // mapSeverity - Severity mapping (via reflection)
+  // ============================================================
+  describe('mapSeverity (via reflection)', () => {
+    const mapSeverity = (adapter: any, severity: string) => {
+      return adapter.mapSeverity.call(adapter, severity);
+    };
+
+    it('should map ERROR to ERROR', () => {
+      expect(mapSeverity(adapter, 'ERROR')).toBe('ERROR');
+      expect(mapSeverity(adapter, 'error')).toBe('ERROR');
+    });
+
+    it('should map HIGH to ERROR', () => {
+      expect(mapSeverity(adapter, 'HIGH')).toBe('ERROR');
+      expect(mapSeverity(adapter, 'high')).toBe('ERROR');
+    });
+
+    it('should map WARNING to WARNING', () => {
+      expect(mapSeverity(adapter, 'WARNING')).toBe('WARNING');
+      expect(mapSeverity(adapter, 'warning')).toBe('WARNING');
+    });
+
+    it('should map MEDIUM to WARNING', () => {
+      expect(mapSeverity(adapter, 'MEDIUM')).toBe('WARNING');
+      expect(mapSeverity(adapter, 'medium')).toBe('WARNING');
+    });
+
+    it('should map INFO to INFO', () => {
+      expect(mapSeverity(adapter, 'INFO')).toBe('INFO');
+      expect(mapSeverity(adapter, 'info')).toBe('INFO');
+    });
+
+    it('should default unknown severities to INFO', () => {
+      expect(mapSeverity(adapter, 'LOW')).toBe('INFO');
+      expect(mapSeverity(adapter, 'unknown')).toBe('INFO');
+      expect(mapSeverity(adapter, '')).toBe('INFO');
+    });
+  });
+
+  // ============================================================
+  // calculateSummary - Summary calculation (via reflection)
+  // ============================================================
+  describe('calculateSummary (via reflection)', () => {
+    const calculateSummary = (adapter: any, findings: any[]) => {
+      return adapter.calculateSummary.call(adapter, findings);
+    };
+
+    it('should calculate summary for mixed findings', () => {
+      const findings = [
+        { severity: 'ERROR' },
+        { severity: 'ERROR' },
+        { severity: 'WARNING' },
+        { severity: 'WARNING' },
+        { severity: 'WARNING' },
+        { severity: 'INFO' }
+      ];
+      const summary = calculateSummary(adapter, findings);
+      
+      expect(summary.total).toBe(6);
+      expect(summary.high).toBe(2);
+      expect(summary.medium).toBe(3);
+      expect(summary.info).toBe(1);
+    });
+
+    it('should handle empty findings', () => {
+      const summary = calculateSummary(adapter, []);
+      
+      expect(summary.total).toBe(0);
+      expect(summary.high).toBe(0);
+      expect(summary.medium).toBe(0);
+      expect(summary.info).toBe(0);
+    });
+
+    it('should handle all ERROR findings', () => {
+      const findings = [
+        { severity: 'ERROR' },
+        { severity: 'ERROR' },
+        { severity: 'ERROR' }
+      ];
+      const summary = calculateSummary(adapter, findings);
+      
+      expect(summary.total).toBe(3);
+      expect(summary.high).toBe(3);
+      expect(summary.medium).toBe(0);
+    });
+
+    it('should initialize critical and low to 0', () => {
+      const findings = [{ severity: 'ERROR' }];
+      const summary = calculateSummary(adapter, findings);
+      
+      expect(summary.critical).toBe(0);
+      expect(summary.low).toBe(0);
+    });
+  });
+
+  // ============================================================
+  // checkThresholds - Threshold checking (via reflection)
+  // ============================================================
+  describe('checkThresholds (via reflection)', () => {
+    const checkThresholds = (adapter: any, summary: any, security?: any) => {
+      return adapter.checkThresholds.call(adapter, summary, security);
+    };
+
+    it('should pass when high findings under budget', () => {
+      const summary = { high: 2 };
+      const security = { sast: { max_high: 5 } };
+      const thresholds = checkThresholds(adapter, summary, security);
+      
+      expect(thresholds.sast_max_high.passed).toBe(true);
+      expect(thresholds.sast_max_high.actual).toBe(2);
+      expect(thresholds.sast_max_high.budget).toBe(5);
+    });
+
+    it('should fail when high findings exceed budget', () => {
+      const summary = { high: 10 };
+      const security = { sast: { max_high: 5 } };
+      const thresholds = checkThresholds(adapter, summary, security);
+      
+      expect(thresholds.sast_max_high.passed).toBe(false);
+      expect(thresholds.sast_max_high.actual).toBe(10);
+      expect(thresholds.sast_max_high.budget).toBe(5);
+    });
+
+    it('should pass when high equals budget', () => {
+      const summary = { high: 5 };
+      const security = { sast: { max_high: 5 } };
+      const thresholds = checkThresholds(adapter, summary, security);
+      
+      expect(thresholds.sast_max_high.passed).toBe(true);
+    });
+
+    it('should default to strict (0) when no security config', () => {
+      const summary = { high: 1 };
+      const thresholds = checkThresholds(adapter, summary, undefined);
+      
+      expect(thresholds.sast_max_high.passed).toBe(false);
+      expect(thresholds.sast_max_high.budget).toBe(0);
+    });
+
+    it('should pass with 0 findings and default budget', () => {
+      const summary = { high: 0 };
+      const thresholds = checkThresholds(adapter, summary, undefined);
+      
+      expect(thresholds.sast_max_high.passed).toBe(true);
+    });
+  });
+
+  // ============================================================
+  // generateJUnit - JUnit XML generation (via reflection)
+  // ============================================================
+  describe('generateJUnit (via reflection)', () => {
+    const generateJUnit = (adapter: any, findings: any[], success: boolean) => {
+      return adapter.generateJUnit.call(adapter, findings, success);
+    };
+
+    it('should generate valid XML structure', () => {
+      const findings: any[] = [];
+      const junit = generateJUnit(adapter, findings, true);
+      
+      expect(junit).toContain('<?xml version="1.0" encoding="UTF-8"?>');
+      expect(junit).toContain('<testsuite');
+      expect(junit).toContain('name="Semgrep SAST Scan"');
+      expect(junit).toContain('</testsuite>');
+    });
+
+    it('should not include failure for success', () => {
+      const findings: any[] = [];
+      const junit = generateJUnit(adapter, findings, true);
+      
+      expect(junit).not.toContain('<failure');
+      expect(junit).toContain('failures="0"');
+    });
+
+    it('should include failure for failed scan', () => {
+      const findings = [
+        { severity: 'ERROR', ruleId: 'sql-injection', message: 'SQL injection detected', file: 'app.js', line: 10 }
+      ];
+      const junit = generateJUnit(adapter, findings, false);
+      
+      expect(junit).toContain('<failure');
+      expect(junit).toContain('failures="1"');
+      expect(junit).toContain('Security issues found');
+    });
+
+    it('should include finding summary in failure', () => {
+      const findings = [
+        { severity: 'ERROR', ruleId: 'xss', message: 'XSS vulnerability', file: 'index.js', line: 5 },
+        { severity: 'WARNING', ruleId: 'hardcoded-secret', message: 'Hardcoded API key', file: 'config.js', line: 15 }
+      ];
+      const junit = generateJUnit(adapter, findings, false);
+      
+      expect(junit).toContain('High severity findings: 1');
+      expect(junit).toContain('Medium severity findings: 1');
+      expect(junit).toContain('Total findings: 2');
+    });
+
+    it('should include top findings in failure', () => {
+      const findings = [
+        { severity: 'ERROR', ruleId: 'sql-injection', message: 'SQL injection', file: 'app.js', line: 10 }
+      ];
+      const junit = generateJUnit(adapter, findings, false);
+      
+      expect(junit).toContain('sql-injection');
+      expect(junit).toContain('app.js:10');
+    });
+
+    it('should include timestamp', () => {
+      const findings: any[] = [];
+      const junit = generateJUnit(adapter, findings, true);
+      
+      expect(junit).toMatch(/timestamp="\d{4}-\d{2}-\d{2}T/);
+    });
+  });
+
+  // ============================================================
+  // getDefaultSummary - Default summary structure (via reflection)
+  // ============================================================
+  describe('getDefaultSummary (via reflection)', () => {
+    const getDefaultSummary = (adapter: any) => {
+      return adapter.getDefaultSummary.call(adapter);
+    };
+
+    it('should return all expected keys', () => {
+      const summary = getDefaultSummary(adapter);
+      
+      expect(summary).toHaveProperty('total');
+      expect(summary).toHaveProperty('critical');
+      expect(summary).toHaveProperty('high');
+      expect(summary).toHaveProperty('medium');
+      expect(summary).toHaveProperty('low');
+      expect(summary).toHaveProperty('info');
+    });
+
+    it('should initialize all values to 0', () => {
+      const summary = getDefaultSummary(adapter);
+      
+      expect(summary.total).toBe(0);
+      expect(summary.critical).toBe(0);
+      expect(summary.high).toBe(0);
+      expect(summary.medium).toBe(0);
+      expect(summary.low).toBe(0);
+      expect(summary.info).toBe(0);
+    });
+  });
+
+  // ============================================================
+  // Constructor and instance
+  // ============================================================
+  describe('constructor', () => {
+    it('should create adapter instance', () => {
+      const adapter = new SemgrepSastAdapter();
+      expect(adapter).toBeInstanceOf(SemgrepSastAdapter);
+    });
+
+    it('should have redactor initialized', () => {
+      const adapter = new SemgrepSastAdapter();
+      expect((adapter as any).redactor).toBeDefined();
+    });
+  });
+
+  // ============================================================
+  // parseSemgrepResults - JSON parsing (via reflection)
+  // ============================================================
+  describe('parseSemgrepResults (via reflection)', () => {
+    const parseSemgrepResults = (adapter: any, output: string, config: any) => {
+      return adapter.parseSemgrepResults.call(adapter, output, config);
+    };
+
+    it('should parse valid JSON with findings', () => {
+      const output = JSON.stringify({
+        results: [
+          {
+            check_id: 'security.sql-injection',
+            path: 'src/db.js',
+            start: { line: 10, col: 5 },
+            extra: {
+              severity: 'ERROR',
+              message: 'SQL injection vulnerability detected'
+            }
+          }
+        ]
+      });
+      
+      const result = parseSemgrepResults(adapter, output, { workingDir: '/tmp' });
+      
+      expect(result.findings).toHaveLength(1);
+      expect(result.findings[0].ruleId).toBe('security.sql-injection');
+      expect(result.findings[0].file).toBe('src/db.js');
+      expect(result.findings[0].line).toBe(10);
+    });
+
+    it('should handle empty results', () => {
+      const output = JSON.stringify({ results: [] });
+      
+      const result = parseSemgrepResults(adapter, output, { workingDir: '/tmp' });
+      
+      expect(result.findings).toHaveLength(0);
+      expect(result.success).toBe(true);
+    });
+
+    it('should handle invalid JSON', () => {
+      const result = parseSemgrepResults(adapter, 'invalid json', { workingDir: '/tmp' });
+      
+      expect(result.success).toBe(false);
+      expect(result.error).toContain('Failed to parse Semgrep results');
+    });
+
+    it('should include junit output', () => {
+      const output = JSON.stringify({ results: [] });
+      
+      const result = parseSemgrepResults(adapter, output, { workingDir: '/tmp' });
+      
+      expect(result.junit).toBeDefined();
+      expect(result.junit).toContain('<?xml');
+    });
+  });
+
+  // ============================================================
+  // Threshold logic integration
+  // ============================================================
+  describe('Threshold logic', () => {
+    it('should fail scan when high findings exceed threshold', () => {
+      const findings = [
+        { severity: 'ERROR' },
+        { severity: 'ERROR' },
+        { severity: 'ERROR' }
+      ];
+      const security = { sast: { max_high: 2 } };
+      
+      const summary = (adapter as any).calculateSummary(findings);
+      const thresholds = (adapter as any).checkThresholds(summary, security);
+      
+      expect(thresholds.sast_max_high.passed).toBe(false);
+    });
+
+    it('should pass scan when high findings within threshold', () => {
+      const findings = [
+        { severity: 'ERROR' },
+        { severity: 'WARNING' },
+        { severity: 'WARNING' }
+      ];
+      const security = { sast: { max_high: 2 } };
+      
+      const summary = (adapter as any).calculateSummary(findings);
+      const thresholds = (adapter as any).checkThresholds(summary, security);
+      
+      expect(thresholds.sast_max_high.passed).toBe(true);
+    });
+  });
+});