44 lines
1.8 KiB
JavaScript
44 lines
1.8 KiB
JavaScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { inspectLock, readProject } from "../lib/project.js";
|
|
import { DEFAULT_POLICY } from "../lib/constants.js";
|
|
import { makeProject } from "./helpers.js";
|
|
|
|
test("resolves exact direct dependency versions from a v3 lockfile", async () => {
|
|
const directory = await makeProject();
|
|
const project = await readProject(directory);
|
|
assert.deepEqual(project.direct, [{ name: "alpha", version: "1.2.3", dev: false }]);
|
|
});
|
|
|
|
test("lock inspection rejects unexpected install scripts and missing integrity", async () => {
|
|
const directory = await makeProject({ alphaEntry: { hasInstallScript: true, integrity: undefined } });
|
|
const project = await readProject(directory);
|
|
const result = inspectLock(project.lock, structuredClone(DEFAULT_POLICY));
|
|
assert.equal(result.failures.length, 2);
|
|
assert.match(result.failures[0], /hasInstallScript/);
|
|
assert.match(result.failures[1], /integrity/);
|
|
});
|
|
|
|
test("version-pinned lock exception permits only the reviewed fsevents version", () => {
|
|
const lock = {
|
|
packages: {
|
|
"": {},
|
|
"node_modules/fsevents": {
|
|
version: "2.3.3",
|
|
resolved: "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
|
|
integrity: `sha512-${Buffer.from("value").toString("base64")}`,
|
|
hasInstallScript: true,
|
|
},
|
|
},
|
|
};
|
|
const policy = structuredClone(DEFAULT_POLICY);
|
|
policy.allowInstallScripts.fsevents = {
|
|
versions: ["2.3.3"],
|
|
reason: "Reviewed optional native filesystem watcher install script.",
|
|
expiresAt: "2027-01-01T00:00:00Z",
|
|
};
|
|
assert.deepEqual(inspectLock(lock, policy, Date.parse("2026-01-01T00:00:00Z")).failures, []);
|
|
lock.packages["node_modules/fsevents"].version = "2.3.4";
|
|
assert.match(inspectLock(lock, policy, Date.parse("2026-01-01T00:00:00Z")).failures[0], /2\.3\.4/);
|
|
});
|