67 lines
2.3 KiB
JavaScript
67 lines
2.3 KiB
JavaScript
import console from "node:console";
|
|
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { validateAndHashStage } from "./lib/package-integrity.ts";
|
|
|
|
const root = mkdtempSync(join(tmpdir(), "wrnexus-stage-integrity-"));
|
|
const manifest = { name: "@wrnexus/probe", version: "0.7.0" };
|
|
try {
|
|
const safe = join(root, "safe");
|
|
mkdirSync(join(safe, "dist"), { recursive: true });
|
|
writeFileSync(join(safe, "dist", "index.js"), "export const safe = true;\n");
|
|
writeFileSync(join(safe, "dist", "index.d.ts"), "export declare const safe: true;\n");
|
|
const result = validateAndHashStage(safe, manifest);
|
|
if (result.files.length !== 2 || result.files.some((file) => file.sha256.length !== 64)) {
|
|
throw new Error("Safe stage did not produce deterministic SHA-256 records.");
|
|
}
|
|
|
|
const forbidden = join(root, "forbidden");
|
|
mkdirSync(forbidden);
|
|
writeFileSync(join(forbidden, ".env"), "TOKEN=secret\n");
|
|
let rejected = false;
|
|
try {
|
|
validateAndHashStage(forbidden, manifest);
|
|
} catch {
|
|
rejected = true;
|
|
}
|
|
if (!rejected) throw new Error("Secret-like stage file was not rejected.");
|
|
|
|
const temporaryShim = join(root, "temporary-shim");
|
|
mkdirSync(temporaryShim);
|
|
writeFileSync(join(temporaryShim, "focus-shims.d.ts"), "declare const Bun: any;\n");
|
|
rejected = false;
|
|
try {
|
|
validateAndHashStage(temporaryShim, manifest);
|
|
} catch {
|
|
rejected = true;
|
|
}
|
|
if (!rejected) throw new Error("Temporary typecheck shim was not rejected.");
|
|
|
|
const sourceMap = join(root, "source-map");
|
|
mkdirSync(sourceMap);
|
|
writeFileSync(join(sourceMap, "index.js.map"), "{}\n");
|
|
rejected = false;
|
|
try {
|
|
validateAndHashStage(sourceMap, manifest);
|
|
} catch {
|
|
rejected = true;
|
|
}
|
|
if (!rejected) throw new Error("Source map was not rejected.");
|
|
|
|
const leaked = join(root, "leaked-secret");
|
|
mkdirSync(leaked);
|
|
writeFileSync(join(leaked, "index.js"), 'export const key = "-----BEGIN PRIVATE KEY-----";\n');
|
|
rejected = false;
|
|
try {
|
|
validateAndHashStage(leaked, manifest);
|
|
} catch {
|
|
rejected = true;
|
|
}
|
|
if (!rejected) throw new Error("High-confidence secret content was not rejected.");
|
|
|
|
console.log("Package staging integrity probes passed.");
|
|
} finally {
|
|
rmSync(root, { recursive: true, force: true });
|
|
}
|