123import { readFileSync } from "node:fs";4import { fileURLToPath } from "node:url";5import { dirname, join, resolve } from "node:path";6import { afterEach, describe, expect, it } from "vitest";78import {9 buildCommand,10 safeEnv,11 cwsUploadEnv,12 amoSignEnv,13 resolveBin,14 preflight,15 packageChromeZip,16 uploadChrome,17 signFirefox,18 CWS_SECRET_NAMES,19 AMO_SECRET_NAMES,20 type CommandSpec,21 type Runner,22} from "./release-lib";2324const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");25const ALL_SECRET_NAMES = [...CWS_SECRET_NAMES, ...AMO_SECRET_NAMES];2627const HELD_ENV: Record<string, string | undefined> = {};2829function setEnv(name: string, val: string) {30 HELD_ENV[name] = process.env[name];31 process.env[name] = val;32}3334function restoreEnv() {35 for (const [name, val] of Object.entries(HELD_ENV)) {36 if (val === undefined) delete process.env[name];37 else process.env[name] = val;38 }39 for (const key of Object.keys(HELD_ENV)) delete HELD_ENV[key];40}4142afterEach(restoreEnv);43444546describe("PB-26-211: argv-based runner — no shell, no npx", () => {47 it("buildCommand returns a CommandSpec with array args, never a string", () => {48 const spec = buildCommand("/bin/echo", ["hello", "world"]);49 expect(Array.isArray(spec.args)).toBe(true);50 expect(spec.args).toEqual(["hello", "world"]);51 expect(typeof spec.executable).toBe("string");52 });5354 it("no release/CI script source contains execSync or npx", () => {55 const scripts = [56 "scripts/release.ts",57 "scripts/release-firefox.ts",58 "scripts/release-lib.ts",59 "scripts/ci.ts",60 ];61 for (const p of scripts) {62 const src = readFileSync(join(ROOT, p), "utf8");63 expect(src, `${p} must not use execSync`).not.toContain("execSync");64 expect(src, `${p} must not invoke npx`).not.toMatch(/\bnpx\b/);65 }66 });6768 it("no release script builds commands via string concatenation (.join)", () => {69 const scripts = [70 "scripts/release.ts",71 "scripts/release-firefox.ts",72 "scripts/release-lib.ts",73 ];74 for (const p of scripts) {75 const src = readFileSync(join(ROOT, p), "utf8");76 expect(src, `${p} must not join command strings`).not.toContain("].join(");77 }78 });7980 it("fake runner captures argv — no captured spec uses a shell or npx", () => {81 const captured: CommandSpec[] = [];82 const fake: Runner = (exec, args, opts) => {83 captured.push(buildCommand(exec, args, opts));84 };8586 for (const name of ALL_SECRET_NAMES) setEnv(name, "secret-value");8788 packageChromeZip("9.9.9", fake);89 uploadChrome("9.9.9", fake);90 signFirefox("/tmp/fake-source.zip", fake);9192 expect(captured.length).toBeGreaterThanOrEqual(3);93 for (const spec of captured) {94 expect(spec.executable).not.toBe("npx");95 expect(spec.args).not.toContain("npx");96 expect(Array.isArray(spec.args)).toBe(true);97 }98 });99});100101102103describe("PB-26-211: CI/build child environments contain no store credentials", () => {104 it("safeEnv strips all CWS and AMO secret names", () => {105 for (const name of ALL_SECRET_NAMES) setEnv(name, "leak-value");106107 const env = safeEnv();108 for (const name of ALL_SECRET_NAMES) {109 expect(env, `safeEnv must not contain ${name}`).not.toHaveProperty(name);110 }111 });112113 it("safeEnv preserves non-secret environment variables", () => {114 setEnv("PATH", "/usr/bin:/bin");115 setEnv("HOME", "/tmp/test-home");116117 const env = safeEnv();118 expect(env.PATH).toBe("/usr/bin:/bin");119 expect(env.HOME).toBe("/tmp/test-home");120 });121});122123124125describe("PB-26-211: Chrome and AMO credentials are disjoint", () => {126 it("cwsUploadEnv contains CWS credentials but no AMO credentials", () => {127 for (const name of ALL_SECRET_NAMES) setEnv(name, "val-" + name);128129 const env = cwsUploadEnv();130131 132 expect(env.CLIENT_ID).toBe("val-CWS_CLIENT_ID");133 expect(env.CLIENT_SECRET).toBe("val-CWS_CLIENT_SECRET");134 expect(env.REFRESH_TOKEN).toBe("val-CWS_REFRESH_TOKEN");135 expect(env.PUBLISHER_ID).toBe("val-PUBLISHER_ID");136137 138 expect(env).not.toHaveProperty("AMO_JWT_ISSUER");139 expect(env).not.toHaveProperty("AMO_JWT_SECRET");140 expect(env).not.toHaveProperty("WEB_EXT_API_KEY");141 expect(env).not.toHaveProperty("WEB_EXT_API_SECRET");142 });143144 it("amoSignEnv contains AMO credentials but no CWS credentials", () => {145 for (const name of ALL_SECRET_NAMES) setEnv(name, "val-" + name);146147 const env = amoSignEnv();148149 150 expect(env.WEB_EXT_API_KEY).toBe("val-AMO_JWT_ISSUER");151 expect(env.WEB_EXT_API_SECRET).toBe("val-AMO_JWT_SECRET");152153 154 expect(env).not.toHaveProperty("CWS_CLIENT_ID");155 expect(env).not.toHaveProperty("CWS_CLIENT_SECRET");156 expect(env).not.toHaveProperty("CWS_REFRESH_TOKEN");157 expect(env).not.toHaveProperty("CWS_EXTENSION_ID");158 expect(env).not.toHaveProperty("PUBLISHER_ID");159 expect(env).not.toHaveProperty("CLIENT_ID");160 expect(env).not.toHaveProperty("CLIENT_SECRET");161 expect(env).not.toHaveProperty("REFRESH_TOKEN");162 });163});164165166167describe("PB-26-211: paths with shell metacharacters remain one argv element", () => {168 it("buildCommand treats a metacharacter path as a single arg", () => {169 const evilPath = "/tmp/$(whoami); echo pwned";170 const spec = buildCommand("/bin/echo", [evilPath]);171 expect(spec.args).toHaveLength(1);172 expect(spec.args[0]).toBe(evilPath);173 });174175 it("spawnSync with argv arrays does not execute shell injections", () => {176 const { spawnSync } = require("node:child_process");177 178 const evilPath = "/tmp/$(whoami)";179 const result = spawnSync("/bin/echo", [evilPath], {180 stdout: "pipe",181 stderr: "pipe",182 shell: false,183 });184 const out = result.stdout?.toString().trim();185 expect(out).toBe(evilPath);186 187 expect(out).toContain("$(whoami)");188 });189});190191192193describe("PB-26-211: missing local binary fails before any network access", () => {194 it("resolveBin throws when the tool is not in node_modules/.bin", () => {195 expect(() => resolveBin("nonexistent-tool-xyz-12345")).toThrow(196 /not found/,197 );198 });199200 it("resolveBin throws before returning a path, preventing network calls", () => {201 let threw = false;202 try {203 resolveBin("another-missing-tool-67890");204 } catch {205 threw = true;206 }207 expect(threw).toBe(true);208 });209});210211212213describe("PB-26-211: preflight rejects non-exact release-tool versions", () => {214 it("preflight passes when release-critical deps are exact", () => {215 216 217 expect(() => preflight()).not.toThrow();218 });219220 it("package.json has exact versions for release-critical dev deps", () => {221 const pkg = JSON.parse(readFileSync(join(ROOT, "package.json"), "utf8"));222 const devDeps = pkg.devDependencies ?? {};223 const critical = [224 "chrome-webstore-upload-cli",225 "web-ext",226 "typescript",227 "@playwright/test",228 ];229 for (const dep of critical) {230 const v = devDeps[dep];231 expect(v, `${dep} must be in devDependencies`).toBeDefined();232 expect(v, `${dep} must not use ^ or ~`).not.toMatch(/^[~^]/);233 }234 });235});