feat: verify frontend supply chain

2026-07-26 17:37:51 +09:00
parent a64708f3de
commit 8b4f875c1c
35 changed files with 8910 additions and 141 deletions
@@ -0,0 +1,89 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  diffDependencyInventories,
+  isValidSha512Integrity,
+  parsePnpmLockfilePackages,
+  supplyChainDigest,
+  validateDependencyReview,
+  validateLicensePolicy,
+} from "../../scripts/lib/supply-chain.mjs";
+
+const integrity = `sha512-${Buffer.alloc(64, 7).toString("base64")}`;
+const dependency = {
+  name: "fixture",
+  version: "1.0.0",
+  direct: true,
+  scope: "production",
+  optional: false,
+  license: "MIT",
+  integrity,
+  dependencies: [],
+};
+
+describe("supply-chain policy", () => {
+  it("parses every top-level lockfile package and validates SRI", () => {
+    const parsed = parsePnpmLockfilePackages(`
+packages:
+
+  '@scope/one@1.0.0':
+    resolution: {integrity: ${integrity}}
+
+  two@2.0.0:
+    resolution: {integrity: ${integrity}}
+
+snapshots:
+`);
+    expect(parsed).toEqual([
+      { name: "@scope/one", version: "1.0.0", integrity },
+      { name: "two", version: "2.0.0", integrity },
+    ]);
+    expect(parsed.every((entry) => isValidSha512Integrity(entry.integrity))).toBe(
+      true,
+    );
+  });
+
+  it("keeps inventory digests stable when dependency ordering changes", () => {
+    const other = { ...dependency, name: "other" };
+    expect(supplyChainDigest([dependency, other])).toBe(
+      supplyChainDigest([other, dependency]),
+    );
+  });
+
+  it("calculates actual additions and requires independent high-risk review", () => {
+    const before = { dependencies: [] };
+    const after = { dependencies: [dependency] };
+    const diff = diffDependencyInventories(before, after);
+    expect(diff.added).toEqual(["fixture@1.0.0"]);
+    expect(
+      validateDependencyReview(diff, after, {
+        changes: [
+          {
+            changeId: "add:fixture@1.0.0",
+            owner: "one",
+            reviewer: "one",
+            reason: "fixture",
+            rollback: "remove",
+          },
+        ],
+      }).passed,
+    ).toBe(false);
+  });
+
+  it("allows explicit policy licenses and rejects denied licenses", () => {
+    expect(
+      validateLicensePolicy(
+        { dependencies: [dependency] },
+        { allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
+      ).passed,
+    ).toBe(true);
+    expect(
+      validateLicensePolicy(
+        {
+          dependencies: [{ ...dependency, license: "AGPL-3.0" }],
+        },
+        { allowedLicenses: ["MIT"], deniedLicensePatterns: ["AGPL"] },
+      ).passed,
+    ).toBe(false);
+  });
+});