123import { readFileSync } from "node:fs";4import { fileURLToPath } from "node:url";5import { dirname, join, resolve } from "node:path";6import { afterEach, describe, expect, it } from "vitest";78import {9 buildCommand,10 safeEnv,11 cwsUploadEnv,12 amoSignEnv,13 resolveBin,14 preflight,15 packageChromeZip,16 packageFirefoxSourceZip,17 uploadChrome,18 signFirefox,19 CWS_SECRET_NAMES,20 AMO_SECRET_NAMES,21 type CommandSpec,22 type Runner,23} from "./release-lib";2425const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");26const ALL_SECRET_NAMES = [...CWS_SECRET_NAMES, ...AMO_SECRET_NAMES];2728const HELD_ENV: Record<string, string | undefined> = {};2930function setEnv(name: string, val: string) {31 HELD_ENV[name] = process.env[name];32 process.env[name] = val;33}3435function restoreEnv() {36 for (const [name, val] of Object.entries(HELD_ENV)) {37 if (val === undefined) delete process.env[name];38 else process.env[name] = val;39 }40 for (const key of Object.keys(HELD_ENV)) delete HELD_ENV[key];41}4243afterEach(restoreEnv);44454647describe("PB-26-211: argv-based runner — no shell, no npx", () => {48 it("buildCommand returns a CommandSpec with array args, never a string", () => {49 const spec = buildCommand("/bin/echo", ["hello", "world"]);50 expect(Array.isArray(spec.args)).toBe(true);51 expect(spec.args).toEqual(["hello", "world"]);52 expect(typeof spec.executable).toBe("string");53 });5455 it("no release/CI script source contains execSync or npx", () => {56 const scripts = [57 "scripts/release.ts",58 "scripts/release-firefox.ts",59 "scripts/release-lib.ts",60 "scripts/ci.ts",61 ];62 for (const p of scripts) {63 const src = readFileSync(join(ROOT, p), "utf8");64 expect(src, `${p} must not use execSync`).not.toContain("execSync");65 expect(src, `${p} must not invoke npx`).not.toMatch(/\bnpx\b/);66 }67 });6869 it("no release script builds commands via string concatenation (.join)", () => {70 const scripts = [71 "scripts/release.ts",72 "scripts/release-firefox.ts",73 "scripts/release-lib.ts",74 ];75 for (const p of scripts) {76 const src = readFileSync(join(ROOT, p), "utf8");77 expect(src, `${p} must not join command strings`).not.toContain("].join(");78 }79 });8081 it("fake runner captures argv — no captured spec uses a shell or npx", () => {82 const captured: CommandSpec[] = [];83 const fake: Runner = (exec, args, opts) => {84 captured.push(buildCommand(exec, args, opts));85 };8687 for (const name of ALL_SECRET_NAMES) setEnv(name, "secret-value");8889 packageChromeZip("9.9.9", fake);90 packageFirefoxSourceZip("9.9.9", fake);91 uploadChrome("9.9.9", fake);92 signFirefox("/tmp/fake-source.zip", fake);9394 expect(captured.length).toBeGreaterThanOrEqual(4);95 for (const spec of captured) {96 expect(spec.executable).not.toBe("npx");97 expect(spec.args).not.toContain("npx");98 expect(Array.isArray(spec.args)).toBe(true);99 }100 });101});102103104105describe("PB-26-211: CI/build child environments contain no store credentials", () => {106 it("safeEnv strips all CWS and AMO secret names", () => {107 for (const name of ALL_SECRET_NAMES) setEnv(name, "leak-value");108109 const env = safeEnv();110 for (const name of ALL_SECRET_NAMES) {111 expect(env, `safeEnv must not contain ${name}`).not.toHaveProperty(name);112 }113 });114115 it("safeEnv preserves non-secret environment variables", () => {116 setEnv("PATH", "/usr/bin:/bin");117 setEnv("HOME", "/tmp/test-home");118119 const env = safeEnv();120 expect(env.PATH).toBe("/usr/bin:/bin");121 expect(env.HOME).toBe("/tmp/test-home");122 });123});124125126127describe("PB-26-211: Chrome and AMO credentials are disjoint", () => {128 it("cwsUploadEnv contains CWS credentials but no AMO credentials", () => {129 for (const name of ALL_SECRET_NAMES) setEnv(name, "val-" + name);130131 const env = cwsUploadEnv();132133 134 expect(env.CLIENT_ID).toBe("val-CWS_CLIENT_ID");135 expect(env.CLIENT_SECRET).toBe("val-CWS_CLIENT_SECRET");136 expect(env.REFRESH_TOKEN).toBe("val-CWS_REFRESH_TOKEN");137 expect(env.PUBLISHER_ID).toBe("val-PUBLISHER_ID");138139 140 expect(env).not.toHaveProperty("AMO_JWT_ISSUER");141 expect(env).not.toHaveProperty("AMO_JWT_SECRET");142 expect(env).not.toHaveProperty("WEB_EXT_API_KEY");143 expect(env).not.toHaveProperty("WEB_EXT_API_SECRET");144 });145146 it("amoSignEnv contains AMO credentials but no CWS credentials", () => {147 for (const name of ALL_SECRET_NAMES) setEnv(name, "val-" + name);148149 const env = amoSignEnv();150151 152 expect(env.WEB_EXT_API_KEY).toBe("val-AMO_JWT_ISSUER");153 expect(env.WEB_EXT_API_SECRET).toBe("val-AMO_JWT_SECRET");154155 156 expect(env).not.toHaveProperty("CWS_CLIENT_ID");157 expect(env).not.toHaveProperty("CWS_CLIENT_SECRET");158 expect(env).not.toHaveProperty("CWS_REFRESH_TOKEN");159 expect(env).not.toHaveProperty("CWS_EXTENSION_ID");160 expect(env).not.toHaveProperty("PUBLISHER_ID");161 expect(env).not.toHaveProperty("CLIENT_ID");162 expect(env).not.toHaveProperty("CLIENT_SECRET");163 expect(env).not.toHaveProperty("REFRESH_TOKEN");164 });165});166167168169describe("PB-26-211: paths with shell metacharacters remain one argv element", () => {170 it("buildCommand treats a metacharacter path as a single arg", () => {171 const evilPath = "/tmp/$(whoami); echo pwned";172 const spec = buildCommand("/bin/echo", [evilPath]);173 expect(spec.args).toHaveLength(1);174 expect(spec.args[0]).toBe(evilPath);175 });176177 it("spawnSync with argv arrays does not execute shell injections", () => {178 const { spawnSync } = require("node:child_process");179 180 const evilPath = "/tmp/$(whoami)";181 const result = spawnSync("/bin/echo", [evilPath], {182 stdout: "pipe",183 stderr: "pipe",184 shell: false,185 });186 const out = result.stdout?.toString().trim();187 expect(out).toBe(evilPath);188 189 expect(out).toContain("$(whoami)");190 });191});192193194195describe("PB-26-211: missing local binary fails before any network access", () => {196 it("resolveBin throws when the tool is not in node_modules/.bin", () => {197 expect(() => resolveBin("nonexistent-tool-xyz-12345")).toThrow(198 /not found/,199 );200 });201202 it("resolveBin throws before returning a path, preventing network calls", () => {203 let threw = false;204 try {205 resolveBin("another-missing-tool-67890");206 } catch {207 threw = true;208 }209 expect(threw).toBe(true);210 });211});212213214215describe("PB-26-211: preflight rejects non-exact release-tool versions", () => {216 it("preflight passes when release-critical deps are exact", () => {217 218 219 expect(() => preflight()).not.toThrow();220 });221222 it("package.json has exact versions for release-critical dev deps", () => {223 const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));224 const devDeps = pkg.devDependencies ?? {};225 const critical = [226 "chrome-webstore-upload-cli",227 "web-ext",228 "typescript",229 "@playwright/test",230 ];231 for (const dep of critical) {232 const v = devDeps[dep];233 expect(v, `${dep} must be in devDependencies`).toBeDefined();234 expect(v, `${dep} must not use ^ or ~`).not.toMatch(/^[~^]/);235 }236 });237});