licenses.test.ts

import {expect, test} from '@jest/globals'
import {Change, Changes} from '../src/schemas'
import {getDeniedLicenseChanges} from '../src/licenses'

let npmChange: Change = {
  manifest: 'package.json',
  change_type: 'added',
  ecosystem: 'npm',
  name: 'Reeuhq',
  version: '1.0.2',
  package_url: 'pkg:npm/reeuhq@1.0.2',
  license: 'MIT',
  source_repository_url: 'github.com/some-repo',
  scope: 'runtime',
  vulnerabilities: [
    {
      severity: 'critical',
      advisory_ghsa_id: 'first-random_string',
      advisory_summary: 'very dangerous',
      advisory_url: 'github.com/future-funk'
    }
  ]
}

let rubyChange: Change = {
  change_type: 'added',
  manifest: 'Gemfile.lock',
  ecosystem: 'rubygems',
  name: 'actionsomething',
  version: '3.2.0',
  package_url: 'pkg:gem/actionsomething@3.2.0',
  license: 'BSD',
  source_repository_url: 'github.com/some-repo',
  scope: 'runtime',
  vulnerabilities: [
    {
      severity: 'moderate',
      advisory_ghsa_id: 'second-random_string',
      advisory_summary: 'not so dangerous',
      advisory_url: 'github.com/future-funk'
    },
    {
      severity: 'low',
      advisory_ghsa_id: 'third-random_string',
      advisory_summary: 'dont page me',
      advisory_url: 'github.com/future-funk'
    }
  ]
}

test('it fails if a license outside the allow list is found', async () => {
  const changes: Changes = [npmChange, rubyChange]
  const [invalidChanges, _] = await getDeniedLicenseChanges(changes, {
    allow: ['BSD']
  })
  expect(invalidChanges[0]).toBe(npmChange)
})

test('it fails if a license inside the deny list is found', async () => {
  const changes: Changes = [npmChange, rubyChange]
  const [invalidChanges] = await getDeniedLicenseChanges(changes, {
    deny: ['BSD']
  })
  expect(invalidChanges[0]).toBe(rubyChange)
})

// This is more of a "here's a behavior that might be surprising" than an actual
// thing we want in the system. Please remove this test after refactoring.
test('it fails all license checks when allow is provided an empty array', async () => {
  const changes: Changes = [npmChange, rubyChange]
  let [invalidChanges, _] = await getDeniedLicenseChanges(changes, {
    allow: [],
    deny: ['BSD']
  })
  expect(invalidChanges.length).toBe(2)
})

test('it does not fail if a license outside the allow list is found in removed changes', async () => {
  const changes: Changes = [
    {...npmChange, change_type: 'removed'},
    {...rubyChange, change_type: 'removed'}
  ]
  const [invalidChanges, _] = await getDeniedLicenseChanges(changes, {
    allow: ['BSD']
  })
  expect(invalidChanges).toStrictEqual([])
})

test('it does not fail if a license inside the deny list is found in removed changes', async () => {
  const changes: Changes = [
    {...npmChange, change_type: 'removed'},
    {...rubyChange, change_type: 'removed'}
  ]
  const [invalidChanges, _] = await getDeniedLicenseChanges(changes, {
    deny: ['BSD']
  })
  expect(invalidChanges).toStrictEqual([])
})

test('it fails if a license outside the allow list is found in both of added and removed changes', async () => {
  const changes: Changes = [
    {...npmChange, change_type: 'removed'},
    npmChange,
    {...rubyChange, change_type: 'removed'}
  ]
  const [invalidChanges, _] = await getDeniedLicenseChanges(changes, {
    allow: ['BSD']
  })
  expect(invalidChanges).toStrictEqual([npmChange])
})