release: WRNexusJS 0.8.0

packages/cli/test/security-command.test.ts

@@ -0,0 +1,50 @@
+import { afterEach, describe, expect, test } from "bun:test";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { runSecurityCommand, securityAudit, securityHeaders } from "../src/security-command.ts";
+
+const roots: string[] = [];
+afterEach(async () =>
+  Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true }))),
+);
+
+async function fixture(config = "export default {};"): Promise<string> {
+  const root = join(tmpdir(), `wrnexus-security-${crypto.randomUUID()}`);
+  roots.push(root);
+  await mkdir(root, { recursive: true });
+  await writeFile(join(root, "wrnexus.config.ts"), config);
+  return root;
+}
+
+describe("security command", () => {
+  test("audits secure framework defaults against mapped ASVS controls", async () => {
+    const report = await securityAudit(await fixture());
+    expect(report.passed).toBe(true);
+    expect(report.version).toBe("ASVS 5.0.0");
+    expect(report.checks.every((check) => check.asvs.length > 0)).toBe(true);
+  });
+
+  test("reports deliberately disabled headers", async () => {
+    const report = await securityAudit(
+      await fixture("export default { security: { headers: false } };"),
+    );
+    expect(report.passed).toBe(false);
+    expect(report.checks.find((check) => check.id === "SEC-HEADERS")?.passed).toBe(false);
+  });
+
+  test("prints the effective production headers", async () => {
+    const headers = await securityHeaders(await fixture());
+    expect(headers["content-security-policy"]).toContain("nonce-audit-nonce");
+    expect(headers["strict-transport-security"]).toContain("max-age=");
+    expect(headers["x-content-type-options"]).toBe("nosniff");
+  });
+
+  test("rejects credentialed wildcard CORS and unknown commands", async () => {
+    const root = await fixture(
+      'export default { security: { cors: { origin: "*", credentials: true } } };',
+    );
+    expect((await securityAudit(root)).passed).toBe(false);
+    await expect(runSecurityCommand(root, "unknown")).rejects.toThrow("WRN-SECURITY-COMMAND");
+  });
+});