Repository navigation
Expand file tree
/
Copy pathcheck-sealed-columns.test.ts
More file actions
79 lines (73 loc) · 2.77 KB
/
Copy pathcheck-sealed-columns.test.ts
File metadata and controls
79 lines (73 loc) · 2.77 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
import { describe, expect, it } from 'vitest'
import { findViolations, readSealedColumns } from './check-sealed-columns'
const COLUMNS = readSealedColumns(`
export const account = pgTable(
'account',
{
accessToken: sealedText('account', 'access_token'),
refreshToken: sealedText('account', 'refresh_token'),
}
)
`)
function found(source: string, file = 'lib/file.ts') {
return findViolations(file, source, COLUMNS)
.map(({ rule, line }) => [rule, line])
.sort(([, a], [, b]) => Number(a) - Number(b))
}
describe('check-sealed-columns', () => {
it('reads every sealed column with its physical name', () => {
expect(COLUMNS).toMatchObject([
{ reference: 'account.accessToken', columnName: 'access_token' },
{ reference: 'account.refreshToken', columnName: 'refresh_token' },
])
})
it('flags comparison operators and raw interpolations but not the sealed helper', () => {
const source = [
'where(eq(account.refreshToken, token))',
'where(inArray(schema.account.accessToken, tokens))',
`sql\`\${account.accessToken} IS NOT NULL\``,
'where(like(account.accessToken, prefix))',
'where(gte(account.refreshToken, token))',
'where(sealedTextEquals(account.refreshToken, token))',
'where(isNotNull(account.refreshToken))',
'select({ accessToken: account.accessToken })',
].join('\n')
expect(found(source)).toEqual([
['comparison', 1],
['comparison', 2],
['raw-interpolation', 3],
['comparison', 4],
['comparison', 5],
])
})
it('follows renamed imports and alias() bindings of the table', () => {
const source = [
"import { account as accountTable, user } from '@sim/db/schema'",
'where(eq(accountTable.refreshToken, token))',
"const sibling = alias(account, 'sibling')",
'where(ne(sibling.accessToken, token))',
].join('\n')
expect(found(source)).toEqual([
['comparison', 2],
['comparison', 4],
])
})
it('flags physical column names in raw SQL outside tests and the backfill', () => {
const source = [
`await db.execute(sql\`SELECT id FROM account WHERE id = \${id}\nAND access_token IS NULL\`)`,
"sql.raw('refresh_token IS NULL')",
`sql\`SELECT id FROM oauth_refresh_token WHERE grant = \${'refresh_token'}\``,
"sql`SELECT * FROM account WHERE user_id = 'u'`",
'sql`SELECT a.* FROM account_activity a`',
"sql.identifier('refresh_token')",
].join('\n')
expect(found(source)).toEqual([
['raw-column-name', 2],
['raw-column-name', 3],
['raw-column-name', 5],
['raw-column-name', 7],
])
expect(found(source, 'lib/file.integration.ts')).toEqual([])
expect(found(source, 'packages/db/script-migrations/0037_seal_account_tokens.ts')).toEqual([])
})
})