mcp/internal/rules/cors_rules_test.go

package rules

import "testing"

const corsWildcardSnippet = `package wire

import "code.nochebuena.dev/einherjar/web/mw"

func f() { _ = mw.CORS([]string{"*"}) }
`

const serverAppendedSnippet = `package wire

import (
	"code.nochebuena.dev/einherjar/core/launcher"
	"code.nochebuena.dev/einherjar/web/server"
)

func f() {
	srv := server.New(logger, cfg)
	lc := launcher.New(logger)
	lc.Append(srv)
}
`

const serverNotAppendedSnippet = `package wire

import (
	"code.nochebuena.dev/einherjar/core/launcher"
	"code.nochebuena.dev/einherjar/web/server"
)

func f() {
	srv := server.New(logger, cfg)
	lc := launcher.New(logger)
	_ = srv
	_ = lc
}
`

const allowedOriginsSelectorSnippet = `package wire

import "code.nochebuena.dev/einherjar/web/mw"

func f(cfg Config) { _ = mw.CORS(cfg.Web.AllowedOrigins) }
`

const allowedOriginsLiteralSnippet = `package wire

import "code.nochebuena.dev/einherjar/web"

func f() { _ = web.Config{AllowedOrigins: []string{"https://x"}} }
`

func TestAllowedOriginsSelectorFires(t *testing.T) {
	got := findingsFor(Run(allowedOriginsSelectorSnippet), "web.allowedorigins-removed")
	if len(got) == 0 {
		t.Fatal("web.allowedorigins-removed did not fire on cfg.Web.AllowedOrigins")
	}
}

func TestAllowedOriginsLiteralFires(t *testing.T) {
	got := findingsFor(Run(allowedOriginsLiteralSnippet), "web.allowedorigins-removed")
	if len(got) == 0 {
		t.Fatal("web.allowedorigins-removed did not fire on web.Config{AllowedOrigins: ...}")
	}
}

func TestCORSWildcardFires(t *testing.T) {
	got := findingsFor(Run(corsWildcardSnippet), "cors.wildcard-noop")
	if len(got) == 0 {
		t.Fatal("cors.wildcard-noop did not fire on mw.CORS([]string{\"*\"})")
	}
}

func TestServerAppendedNoFalsePositive(t *testing.T) {
	if got := findingsFor(Run(serverAppendedSnippet), "web.server-not-appended"); len(got) != 0 {
		t.Errorf("web.server-not-appended false-positived on an appended server: %+v", got)
	}
}

func TestServerNotAppendedFires(t *testing.T) {
	if got := findingsFor(Run(serverNotAppendedSnippet), "web.server-not-appended"); len(got) == 0 {
		t.Error("web.server-not-appended should fire when server.New is not appended")
	}
}