51 lines
2.0 KiB
TypeScript
51 lines
2.0 KiB
TypeScript
import { afterEach, describe, expect, test } from "bun:test";
|
|
import { mkdir, rm, writeFile } from "node:fs/promises";
|
|
import { join } from "node:path";
|
|
import { tmpdir } from "node:os";
|
|
import { runSecurityCommand, securityAudit, securityHeaders } from "../src/security-command.ts";
|
|
|
|
const roots: string[] = [];
|
|
afterEach(async () =>
|
|
Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true }))),
|
|
);
|
|
|
|
async function fixture(config = "export default {};"): Promise<string> {
|
|
const root = join(tmpdir(), `wrnexus-security-${crypto.randomUUID()}`);
|
|
roots.push(root);
|
|
await mkdir(root, { recursive: true });
|
|
await writeFile(join(root, "wrnexus.config.ts"), config);
|
|
return root;
|
|
}
|
|
|
|
describe("security command", () => {
|
|
test("audits secure framework defaults against mapped ASVS controls", async () => {
|
|
const report = await securityAudit(await fixture());
|
|
expect(report.passed).toBe(true);
|
|
expect(report.version).toBe("ASVS 5.0.0");
|
|
expect(report.checks.every((check) => check.asvs.length > 0)).toBe(true);
|
|
});
|
|
|
|
test("reports deliberately disabled headers", async () => {
|
|
const report = await securityAudit(
|
|
await fixture("export default { security: { headers: false } };"),
|
|
);
|
|
expect(report.passed).toBe(false);
|
|
expect(report.checks.find((check) => check.id === "SEC-HEADERS")?.passed).toBe(false);
|
|
});
|
|
|
|
test("prints the effective production headers", async () => {
|
|
const headers = await securityHeaders(await fixture());
|
|
expect(headers["content-security-policy"]).toContain("nonce-audit-nonce");
|
|
expect(headers["strict-transport-security"]).toContain("max-age=");
|
|
expect(headers["x-content-type-options"]).toBe("nosniff");
|
|
});
|
|
|
|
test("rejects credentialed wildcard CORS and unknown commands", async () => {
|
|
const root = await fixture(
|
|
'export default { security: { cors: { origin: "*", credentials: true } } };',
|
|
);
|
|
expect((await securityAudit(root)).passed).toBe(false);
|
|
await expect(runSecurityCommand(root, "unknown")).rejects.toThrow("WRN-SECURITY-COMMAND");
|
|
});
|
|
});
|