package rules import "testing" const corsWildcardSnippet = `package wire import "code.nochebuena.dev/einherjar/web/mw" func f() { _ = mw.CORS([]string{"*"}) } ` const serverAppendedSnippet = `package wire import ( "code.nochebuena.dev/einherjar/core/launcher" "code.nochebuena.dev/einherjar/web/server" ) func f() { srv := server.New(logger, cfg) lc := launcher.New(logger) lc.Append(srv) } ` const serverNotAppendedSnippet = `package wire import ( "code.nochebuena.dev/einherjar/core/launcher" "code.nochebuena.dev/einherjar/web/server" ) func f() { srv := server.New(logger, cfg) lc := launcher.New(logger) _ = srv _ = lc } ` const allowedOriginsSelectorSnippet = `package wire import "code.nochebuena.dev/einherjar/web/mw" func f(cfg Config) { _ = mw.CORS(cfg.Web.AllowedOrigins) } ` const allowedOriginsLiteralSnippet = `package wire import "code.nochebuena.dev/einherjar/web" func f() { _ = web.Config{AllowedOrigins: []string{"https://x"}} } ` func TestAllowedOriginsSelectorFires(t *testing.T) { got := findingsFor(Run(allowedOriginsSelectorSnippet), "web.allowedorigins-removed") if len(got) == 0 { t.Fatal("web.allowedorigins-removed did not fire on cfg.Web.AllowedOrigins") } } func TestAllowedOriginsLiteralFires(t *testing.T) { got := findingsFor(Run(allowedOriginsLiteralSnippet), "web.allowedorigins-removed") if len(got) == 0 { t.Fatal("web.allowedorigins-removed did not fire on web.Config{AllowedOrigins: ...}") } } func TestCORSWildcardFires(t *testing.T) { got := findingsFor(Run(corsWildcardSnippet), "cors.wildcard-noop") if len(got) == 0 { t.Fatal("cors.wildcard-noop did not fire on mw.CORS([]string{\"*\"})") } } func TestServerAppendedNoFalsePositive(t *testing.T) { if got := findingsFor(Run(serverAppendedSnippet), "web.server-not-appended"); len(got) != 0 { t.Errorf("web.server-not-appended false-positived on an appended server: %+v", got) } } func TestServerNotAppendedFires(t *testing.T) { if got := findingsFor(Run(serverNotAppendedSnippet), "web.server-not-appended"); len(got) == 0 { t.Error("web.server-not-appended should fire when server.New is not appended") } }