cesnimda
56 lines
3.2 KiB
JavaScript
56 lines
3.2 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import test from 'node:test';
|
|
import { evaluateAudit } from './audit-dependencies.mjs';
|
|
|
|
const now = Date.parse('2026-10-17T18:00:00Z');
|
|
function fixture() {
|
|
return {
|
|
report: {
|
|
metadata: { vulnerabilities: { high: 2, critical: 0 } },
|
|
vulnerabilities: {
|
|
braces: { severity: 'high', nodes: ['node_modules/braces'], via: [{ name: 'braces', dependency: 'braces', severity: 'high', url: 'https://github.com/advisories/GHSA-vfj7-8cjw-p6xm' }] },
|
|
micromatch: { severity: 'high', nodes: ['node_modules/micromatch'], via: ['braces'] },
|
|
},
|
|
},
|
|
lock: { packages: { 'node_modules/braces': { dev: true, version: '3.0.3' }, 'node_modules/micromatch': { dev: true, version: '4.0.8' } } },
|
|
};
|
|
}
|
|
test('allows only the approved dev-only advisory and its linked findings before expiry', () => {
|
|
const { report, lock } = fixture();
|
|
assert.deepEqual(evaluateAudit(report, lock, now), { accepted: ['braces', 'micromatch'], failures: [] });
|
|
});
|
|
test('blocks the same advisory if any affected copy is a production dependency', () => {
|
|
const { report, lock } = fixture(); delete lock.packages['node_modules/braces'].dev;
|
|
assert.ok(evaluateAudit(report, lock, now).failures.length);
|
|
});
|
|
test('blocks any new advisory even inside the otherwise approved chain', () => {
|
|
const { report, lock } = fixture(); report.vulnerabilities.braces.via.push({ name: 'braces', url: 'https://github.com/advisories/UNKNOWN' });
|
|
assert.ok(evaluateAudit(report, lock, now).failures.length);
|
|
});
|
|
test('critical findings cannot use the high-only exception', () => {
|
|
const { report, lock } = fixture(); report.vulnerabilities.braces.severity = 'critical';
|
|
assert.ok(evaluateAudit(report, lock, now).failures.length);
|
|
});
|
|
test('a critical underlying advisory is rejected even if its aggregate severity is inconsistent', () => {
|
|
const { report, lock } = fixture(); report.vulnerabilities.braces.via[0].severity = 'critical';
|
|
assert.ok(evaluateAudit(report, lock, now).failures.length);
|
|
});
|
|
test('expires after 31 October UTC without an environment-variable bypass', () => {
|
|
const { report, lock } = fixture();
|
|
assert.ok(evaluateAudit(report, lock, Date.parse('2026-11-01T00:00:00Z')).failures.length);
|
|
});
|
|
test('missing nodes, missing lock entries and cyclic origins fail closed', () => {
|
|
for (const change of [x => x.report.vulnerabilities.braces.nodes = [], x => delete x.lock.packages['node_modules/braces'], x => x.report.vulnerabilities.braces.via = ['micromatch']]) {
|
|
const input = fixture(); change(input); assert.ok(evaluateAudit(input.report, input.lock, now).failures.length);
|
|
}
|
|
});
|
|
test('invalid reports and unknown severities fail closed', () => {
|
|
assert.ok(evaluateAudit({ error: { message: 'Registry unavailable' } }, {}, now).failures.length);
|
|
const { report, lock } = fixture(); report.vulnerabilities.braces.severity = 'unknown';
|
|
assert.ok(evaluateAudit(report, lock, now).failures.length);
|
|
});
|
|
test('non-blocking moderate findings retain the existing audit threshold', () => {
|
|
const report = { metadata: { vulnerabilities: { moderate: 1 } }, vulnerabilities: { tool: { severity: 'moderate', via: [] } } };
|
|
assert.deepEqual(evaluateAudit(report, { packages: {} }, now), { accepted: [], failures: [] });
|
|
});
|