Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Merge remote-tracking branch 'origin/claude/cool-newton-7nm8r9' into claude/cool-newton-7nm8r9 | 1 | import assert from "node:assert/strict"; |
| 2 | import { test } from "node:test"; | |
| 3 | ||
| 4 | import { advisoryFromForm, advisoryStanding, parseAdvisoryState, parseReportState, parseSeverity, reportFromForm } from "./advisories.ts"; | |
| 5 | ||
| 6 | const form = (fields: Record<string, string>): FormData => { | |
| 7 | const data = new FormData(); | |
| 8 | for (const [key, value] of Object.entries(fields)) data.set(key, value); | |
| 9 | return data; | |
| 10 | }; | |
| 11 | ||
| 12 | test("an advisory form is checked and cleaned", () => { | |
| 13 | const input = advisoryFromForm( | |
| 14 | form({ | |
| 15 | title: " Path traversal in the archive reader ", | |
| 16 | description: "Details", | |
| 17 | severity: "high", | |
| 18 | cveId: "cve-2026-12345", | |
| 19 | cvssScore: "8.1", | |
| 20 | credits: "@ana, bo\n\ncy", | |
| 21 | package: "@flagon/hello", | |
| 22 | affectedVersions: ">= 1.2.0, < 1.4.1", | |
| 23 | }), | |
| 24 | ); | |
| 25 | assert.ok(typeof input !== "string"); | |
| 26 | assert.equal(input.title, "Path traversal in the archive reader"); | |
| 27 | assert.equal(input.cveId, "CVE-2026-12345"); | |
| 28 | assert.equal(input.cvssScore, 8.1); | |
| 29 | assert.deepEqual(input.credits, ["ana", "bo", "cy"]); | |
| 30 | assert.equal(input.ecosystem, null); | |
| 31 | assert.equal(advisoryFromForm(form({ title: " ", severity: "high" })), "Give the advisory a title."); | |
| 32 | assert.equal(advisoryFromForm(form({ title: "x", severity: "severe" })), "Choose a severity."); | |
| 33 | assert.equal(advisoryFromForm(form({ title: "x", severity: "low", cvssScore: "11" })), "A CVSS score is 0 to 10."); | |
| 34 | assert.equal(advisoryFromForm(form({ title: "x", severity: "low", cveId: "CVE-1" })), "A CVE id looks like CVE-2026-12345."); | |
| 35 | }); | |
| 36 | ||
| 37 | test("a report needs a title and a description, and an email when signed out", () => { | |
| 38 | const signedIn = reportFromForm(form({ title: "XSS in the search box", description: "Type <script> into…", severity: "medium" }), true); | |
| 39 | assert.ok(typeof signedIn !== "string"); | |
| 40 | assert.equal(signedIn.severity, "medium"); | |
| 41 | assert.equal(signedIn.email, null); | |
| 42 | assert.equal(reportFromForm(form({ title: "XSS", description: "…" }), false), "Give an email address the maintainers can answer at, or sign in."); | |
| 43 | assert.equal(reportFromForm(form({ title: "XSS", description: "…", email: "not an address" }), false), "Give an email address the maintainers can answer at, or sign in."); | |
| 44 | const signedOut = reportFromForm(form({ title: "XSS", description: "…", email: "finder@example.com", severity: "nope" }), false); | |
| 45 | assert.ok(typeof signedOut !== "string"); | |
| 46 | assert.equal(signedOut.email, "finder@example.com"); | |
| 47 | assert.equal(signedOut.severity, null); | |
| 48 | assert.equal(reportFromForm(form({ title: "", description: "…" }), true), "Give the report a title: one line on what you found."); | |
| 49 | assert.equal(reportFromForm(form({ title: "x", description: " " }), true), "Describe the vulnerability: what is affected and how to reproduce it."); | |
| 50 | }); | |
| 51 | ||
| 52 | test("states and severities parse only to what is known", () => { | |
| 53 | assert.equal(parseSeverity("critical"), "critical"); | |
| 54 | assert.equal(parseSeverity("severe"), null); | |
| 55 | assert.equal(parseAdvisoryState("withdrawn"), "withdrawn"); | |
| 56 | assert.equal(parseAdvisoryState("gone"), null); | |
| 57 | assert.equal(parseReportState("new"), "new"); | |
| 58 | assert.deepEqual(advisoryStanding({ state: "draft", createdBy: "ana" }), { verb: "Drafted by ana", at: null }); | |
| 59 | assert.deepEqual(advisoryStanding({ state: "published", createdBy: "ana", publishedAt: "2026-10-07T15:02:40.000Z" }), { verb: "Published", at: "2026-10-07T15:02:40.000Z" }); | |
| 60 | assert.deepEqual(advisoryStanding({ state: "withdrawn", createdBy: "ana", withdrawnAt: "2026-10-08T00:00:00.000Z" }), { verb: "Withdrawn", at: "2026-10-08T00:00:00.000Z" }); | |
| 61 | }); |
This file's history is long; its oldest lines are credited to the oldest commit read.