qinglong/test/back/ql3ProfileVulnerabilityAudit.test.cjs

const assert = require('node:assert/strict');
const { test } = require('node:test');
const {
  PROFILE_IMPORTERS,
  auditProfileVulnerabilities,
} = require('../../scripts/ql3-profile-vulnerability-audit.cjs');

function advisory({ id, moduleName, severity, version = '1.0.0', paths }) {
  return {
    id,
    module_name: moduleName,
    severity,
    findings: [{ version, paths }],
  };
}

function document(...advisories) {
  return {
    advisories: Object.fromEntries(
      advisories.map((item) => [String(item.id), item]),
    ),
  };
}

test('separates legacy debt from clean 3.0 Profile importers', () => {
  const report = auditProfileVulnerabilities(
    document(
      advisory({
        id: 1,
        moduleName: 'legacy-risk',
        severity: 'critical',
        paths: ['. > legacy-risk@1.0.0'],
      }),
      advisory({
        id: 2,
        moduleName: 'bounded-moderate',
        severity: 'moderate',
        paths: ['packages/ql3-worker-runtime > bounded-moderate@1.0.0'],
      }),
    ),
  );

  assert.equal(report.compatible, true);
  assert.equal(report.legacyRoot.compatible, false);
  assert.equal(report.legacyRoot.advisories.critical, 1);
  assert.equal(
    report.profileImporters['packages/ql3-worker-runtime'].advisories.moderate,
    1,
  );
  assert.deepEqual(report.findings, []);
  assert.deepEqual(Object.keys(report.profileImporters), PROFILE_IMPORTERS);
});

test('blocks a high or critical advisory in any reviewed Profile', () => {
  const report = auditProfileVulnerabilities(
    document(
      advisory({
        id: 'GHSA-profile',
        moduleName: 'profile-risk',
        severity: 'high',
        paths: [
          'packages/ql3-cluster-postgres > profile-risk@1.0.0',
          'packages/ql3-cluster-control > @qinglong/cluster-postgres@3.0.0 > profile-risk@1.0.0',
        ],
      }),
    ),
  );

  assert.equal(report.compatible, false);
  assert.deepEqual(
    report.findings.map(({ code, importer, moduleName, severity }) => ({
      code,
      importer,
      moduleName,
      severity,
    })),
    [
      {
        code: 'PROFILE_HIGH_CRITICAL_ADVISORY',
        importer: 'packages/ql3-cluster-control',
        moduleName: 'profile-risk',
        severity: 'high',
      },
      {
        code: 'PROFILE_HIGH_CRITICAL_ADVISORY',
        importer: 'packages/ql3-cluster-postgres',
        moduleName: 'profile-risk',
        severity: 'high',
      },
    ],
  );
});

test('fails closed for unreviewed importers and malformed audit data', () => {
  const unreviewed = auditProfileVulnerabilities(
    document(
      advisory({
        id: 3,
        moduleName: 'unknown-risk',
        severity: 'critical',
        paths: ['packages/ql3-new-profile > unknown-risk@1.0.0'],
      }),
    ),
  );
  assert.equal(unreviewed.compatible, false);
  assert.deepEqual(unreviewed.unknownImporters, ['packages/ql3-new-profile']);
  assert.equal(
    unreviewed.findings[0].code,
    'UNREVIEWED_IMPORTER_HIGH_CRITICAL_ADVISORY',
  );

  assert.throws(
    () =>
      auditProfileVulnerabilities({
        advisories: {
          4: {
            id: 4,
            module_name: 'broken',
            severity: 'high',
            findings: [{ version: '1.0.0' }],
          },
        },
      }),
    /finding paths is invalid/,
  );
});