|
| 1 | +import SecurityClean from './clean.js' |
| 2 | +import {appSecurityArtifactPaths} from '../../../services/app-security-artifacts.js' |
| 3 | +import {validAppConfiguration} from '../../../services/app-security-selection.test-data.js' |
| 4 | +import {Config} from '@oclif/core' |
| 5 | +import {fileExists, fileRealPath, inTemporaryDirectory, mkdir, writeFile} from '@shopify/cli-kit/node/fs' |
| 6 | +import {unstyled} from '@shopify/cli-kit/node/output' |
| 7 | +import {joinPath} from '@shopify/cli-kit/node/path' |
| 8 | +import {withCapturedStandardStreams} from '@shopify/cli-kit/node/testing/output' |
| 9 | +import {describe, expect, test, vi} from 'vitest' |
| 10 | +// eslint-disable-next-line no-restricted-imports -- Verify native filesystem paths in JSON output. |
| 11 | +import {resolve} from 'node:path' |
| 12 | + |
| 13 | +// Skip the installed-CLI error reporting setup, as `check`'s command boundary test does. |
| 14 | +vi.mock('@shopify/cli-kit/node/context/local', async (importOriginal) => ({ |
| 15 | + ...(await importOriginal<typeof import('@shopify/cli-kit/node/context/local')>()), |
| 16 | + isDevelopment: () => true, |
| 17 | +})) |
| 18 | +// Command lifecycle telemetry is unrelated to cleaning. Keep the real error handler and renderer. |
| 19 | +vi.mock('@shopify/cli-kit/node/analytics', async (importOriginal) => ({ |
| 20 | + ...(await importOriginal<typeof import('@shopify/cli-kit/node/analytics')>()), |
| 21 | + reportAnalyticsEvent: vi.fn(), |
| 22 | +})) |
| 23 | + |
| 24 | +/** Creates an app whose shopify.app.toml is linked to `clientId`, and returns its real path. */ |
| 25 | +async function createApp(directory: string, clientId = 'test-client-id'): Promise<string> { |
| 26 | + await writeFile(joinPath(directory, 'shopify.app.toml'), validAppConfiguration(clientId)) |
| 27 | + return fileRealPath(directory) |
| 28 | +} |
| 29 | + |
| 30 | +async function writeResults(appDirectory: string, resultsKey: string): Promise<string> { |
| 31 | + const paths = appSecurityArtifactPaths(appDirectory, resultsKey) |
| 32 | + await mkdir(paths.resultsDirectory) |
| 33 | + await writeFile(paths.deterministicFindingsPath, '{}\n') |
| 34 | + return paths.resultsDirectory |
| 35 | +} |
| 36 | + |
| 37 | +// Boxes wrap text across lines and draw borders, so compare their text with the borders and line breaks removed. |
| 38 | +function boxText(output: string): string { |
| 39 | + return unstyled(output).replaceAll('│', '').replace(/\s+/g, ' ') |
| 40 | +} |
| 41 | + |
| 42 | +async function runCommand(argv: string[]) { |
| 43 | + const previousExitCode = process.exitCode |
| 44 | + process.exitCode = 0 |
| 45 | + // Observe the real Oclif error handler's requested exit without terminating the test worker. |
| 46 | + const exit = vi.spyOn(process, 'exit').mockImplementation((code) => { |
| 47 | + process.exitCode = code ?? 0 |
| 48 | + return undefined as never |
| 49 | + }) |
| 50 | + try { |
| 51 | + const output = await withCapturedStandardStreams(async ({stdout, stderr}) => { |
| 52 | + const config = await Config.load(import.meta.url) |
| 53 | + // This test invokes the app command directly, not as a separately installed CLI plugin. |
| 54 | + config.plugins.clear() |
| 55 | + await SecurityClean.run(argv, config) |
| 56 | + return {stdout: stdout(), stderr: stderr()} |
| 57 | + }) |
| 58 | + return {...output, exitCode: process.exitCode} |
| 59 | + } finally { |
| 60 | + exit.mockRestore() |
| 61 | + process.exitCode = previousExitCode |
| 62 | + } |
| 63 | +} |
| 64 | + |
| 65 | +describe('app security clean command boundary', () => { |
| 66 | + test('--json removes the selected results directory and writes one result with the selected app', async () => { |
| 67 | + await inTemporaryDirectory(async (directory) => { |
| 68 | + const appDirectory = await createApp(directory) |
| 69 | + const resultsDirectory = await writeResults(appDirectory, 'shopify.app') |
| 70 | + const otherResultsDirectory = await writeResults(appDirectory, 'shopify.app.production') |
| 71 | + |
| 72 | + const result = await runCommand(['--path', directory, '--json']) |
| 73 | + |
| 74 | + expect(result.exitCode).toBe(0) |
| 75 | + expect(JSON.parse(result.stdout)).toStrictEqual({ |
| 76 | + status: 'success', |
| 77 | + changed: true, |
| 78 | + app: { |
| 79 | + directory: resolve(appDirectory), |
| 80 | + configurationPath: resolve(appDirectory, 'shopify.app.toml'), |
| 81 | + clientId: 'test-client-id', |
| 82 | + }, |
| 83 | + resultsDirectories: [resolve(resultsDirectory)], |
| 84 | + }) |
| 85 | + expect(result.stderr).toBe('') |
| 86 | + await expect(fileExists(resultsDirectory)).resolves.toBe(false) |
| 87 | + await expect(fileExists(otherResultsDirectory)).resolves.toBe(true) |
| 88 | + }) |
| 89 | + }) |
| 90 | + |
| 91 | + test('--json with --without-app-config has a null configuration path and the --client-id value', async () => { |
| 92 | + await inTemporaryDirectory(async (directory) => { |
| 93 | + const appDirectory = await fileRealPath(directory) |
| 94 | + const resultsDirectory = await writeResults(appDirectory, 'flag-client-id') |
| 95 | + |
| 96 | + const result = await runCommand([ |
| 97 | + '--path', |
| 98 | + directory, |
| 99 | + '--without-app-config', |
| 100 | + '--client-id', |
| 101 | + 'flag-client-id', |
| 102 | + '--json', |
| 103 | + ]) |
| 104 | + |
| 105 | + expect(result.exitCode).toBe(0) |
| 106 | + expect(JSON.parse(result.stdout)).toStrictEqual({ |
| 107 | + status: 'success', |
| 108 | + changed: true, |
| 109 | + app: {directory: resolve(appDirectory), configurationPath: null, clientId: 'flag-client-id'}, |
| 110 | + resultsDirectories: [resolve(resultsDirectory)], |
| 111 | + }) |
| 112 | + expect(result.stderr).toBe('') |
| 113 | + }) |
| 114 | + }) |
| 115 | + |
| 116 | + test('--json has a null client ID when the app configuration is not linked', async () => { |
| 117 | + await inTemporaryDirectory(async (directory) => { |
| 118 | + const appDirectory = await createApp(directory, '') |
| 119 | + await writeResults(appDirectory, 'shopify.app') |
| 120 | + |
| 121 | + const result = await runCommand(['--path', directory, '--json']) |
| 122 | + |
| 123 | + expect(result.exitCode).toBe(0) |
| 124 | + expect(JSON.parse(result.stdout)).toMatchObject({ |
| 125 | + app: {configurationPath: resolve(appDirectory, 'shopify.app.toml'), clientId: null}, |
| 126 | + }) |
| 127 | + }) |
| 128 | + }) |
| 129 | + |
| 130 | + test('--all --json removes every results directory and writes a result with only the app directory', async () => { |
| 131 | + await inTemporaryDirectory(async (directory) => { |
| 132 | + const appDirectory = await createApp(directory) |
| 133 | + const productionResultsDirectory = await writeResults(appDirectory, 'shopify.app.production') |
| 134 | + const resultsDirectory = await writeResults(appDirectory, 'shopify.app') |
| 135 | + |
| 136 | + const result = await runCommand(['--path', directory, '--all', '--json']) |
| 137 | + |
| 138 | + expect(result.exitCode).toBe(0) |
| 139 | + expect(JSON.parse(result.stdout)).toStrictEqual({ |
| 140 | + status: 'success', |
| 141 | + changed: true, |
| 142 | + app: {directory: resolve(appDirectory)}, |
| 143 | + resultsDirectories: [resolve(resultsDirectory), resolve(productionResultsDirectory)], |
| 144 | + }) |
| 145 | + expect(result.stderr).toBe('') |
| 146 | + await expect(Promise.all([resultsDirectory, productionResultsDirectory].map(fileExists))).resolves.toEqual([ |
| 147 | + false, |
| 148 | + false, |
| 149 | + ]) |
| 150 | + }) |
| 151 | + }) |
| 152 | + |
| 153 | + test('--all --json with nothing to remove writes a result without a change', async () => { |
| 154 | + await inTemporaryDirectory(async (directory) => { |
| 155 | + const appDirectory = await createApp(directory) |
| 156 | + |
| 157 | + const result = await runCommand(['--path', directory, '--all', '--json']) |
| 158 | + |
| 159 | + expect(result.exitCode).toBe(0) |
| 160 | + expect(JSON.parse(result.stdout)).toStrictEqual({ |
| 161 | + status: 'success', |
| 162 | + changed: false, |
| 163 | + app: {directory: resolve(appDirectory)}, |
| 164 | + resultsDirectories: [], |
| 165 | + }) |
| 166 | + expect(result.stderr).toBe('') |
| 167 | + }) |
| 168 | + }) |
| 169 | + |
| 170 | + test('--json without a results directory writes one error document with its code and exits 1', async () => { |
| 171 | + await inTemporaryDirectory(async (directory) => { |
| 172 | + const appDirectory = await createApp(directory) |
| 173 | + // The error handler reads --json from the process arguments, not from the arguments given to `run`. |
| 174 | + vi.stubEnv('SHOPIFY_FLAG_JSON', '1') |
| 175 | + |
| 176 | + try { |
| 177 | + const result = await runCommand(['--path', directory, '--json']) |
| 178 | + |
| 179 | + expect(result.exitCode).toBe(1) |
| 180 | + expect(JSON.parse(result.stdout)).toStrictEqual({ |
| 181 | + error: { |
| 182 | + type: 'abort', |
| 183 | + message: `No app security check results for shopify.app in ${appDirectory}.`, |
| 184 | + code: 'results-directory-not-found', |
| 185 | + tryMessage: expect.stringMatching(/^Run `shopify app security check --path .+`\.$/), |
| 186 | + }, |
| 187 | + }) |
| 188 | + expect(result.stderr).toBe('') |
| 189 | + } finally { |
| 190 | + vi.unstubAllEnvs() |
| 191 | + } |
| 192 | + }) |
| 193 | + }) |
| 194 | + |
| 195 | + test('without --json, prints the removed path on stderr and nothing on stdout', async () => { |
| 196 | + await inTemporaryDirectory(async (directory) => { |
| 197 | + const appDirectory = await createApp(directory) |
| 198 | + await writeResults(appDirectory, 'shopify.app') |
| 199 | + |
| 200 | + const result = await runCommand(['--path', directory]) |
| 201 | + |
| 202 | + expect(result.exitCode).toBe(0) |
| 203 | + expect(result.stdout).toBe('') |
| 204 | + expect(boxText(result.stderr)).toContain('App security check results removed.') |
| 205 | + }) |
| 206 | + }) |
| 207 | +}) |
0 commit comments