Initial Commit

packages/foundation/core/env/tests/no-disallowed.test.ts

@@ -0,0 +1,65 @@
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+const SRC = join(__dirname, "..", "src");
+
+/**
+ * Files approved to use node:fs.
+ * dotenvLoader uses readFileSync to read .env files — this is intentional
+ * and approved. The loader is explicitly documented as a Node.js loader.
+ */
+const APPROVED_FS_FILES = new Set([
+    join(SRC, "loaders", "dotenv", "dotenv.ts"),
+]);
+
+const BANNED: ReadonlyArray<{ pattern: RegExp; label: string }> = [
+    { pattern: /\bMath\.random\b/, label: "Math.random" },
+    { pattern: /\bDate\.now\b/, label: "Date.now" },
+    { pattern: /\bcrypto\.getRandomValues\b/, label: "crypto.getRandomValues" },
+];
+
+function* walk(dir: string): Generator<string> {
+    for (const entry of readdirSync(dir)) {
+        const full = join(dir, entry);
+        const st = statSync(full);
+        if (st.isDirectory()) {
+            if (entry === "__benchmarks__") continue;
+            yield* walk(full);
+        } else if (full.endsWith(".ts") && !full.endsWith(".test.ts")) {
+            yield full;
+        }
+    }
+}
+
+describe("no-disallowed", () => {
+    it("src/ contains no Math.random, Date.now, or crypto.getRandomValues", {
+        timeout: 5000,
+    }, () => {
+        const hits: string[] = [];
+        for (const file of walk(SRC)) {
+            const content = readFileSync(file, "utf8");
+            for (const { pattern, label } of BANNED) {
+                if (pattern.test(content)) {
+                    hits.push(`${file}: ${label}`);
+                }
+            }
+        }
+        expect(hits).toEqual([]);
+    });
+
+    it("node:fs usage is limited to approved files (dotenv loader)", {
+        timeout: 5000,
+    }, () => {
+        const unapproved: string[] = [];
+        const fsPattern = /from ['"]node:fs['"]/;
+        for (const file of walk(SRC)) {
+            if (APPROVED_FS_FILES.has(file)) continue;
+            const content = readFileSync(file, "utf8");
+            if (fsPattern.test(content)) {
+                unapproved.push(file);
+            }
+        }
+        expect(unapproved).toEqual([]);
+    });
+});