Initial Commit

packages/foundation/flow/idempotency/tests/no-disallowed.test.ts

@@ -0,0 +1,72 @@
+/**
+ * Validates that `crypto.randomUUID` and `crypto.subtle` are only used in
+ * approved files and that no other disallowed globals appear in the source.
+ */
+
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { describe, expect, it } from "@suaveplan/testing/runner";
+
+const SRC_ROOT = resolve(import.meta.dirname, "../src");
+
+// Files approved to use globalThis.crypto.randomUUID / crypto.subtle
+const CRYPTO_APPROVED_FILES = new Set(["key/key-generator.ts"]);
+
+function walkFiles(dir: string): string[] {
+    const results: string[] = [];
+    for (const entry of readdirSync(dir)) {
+        const full = resolve(dir, entry);
+        const stat = statSync(full);
+        if (stat.isDirectory()) {
+            results.push(...walkFiles(full));
+        } else if (
+            entry.endsWith(".ts") &&
+            !entry.endsWith(".test.ts") &&
+            !entry.endsWith(".bench.ts")
+        ) {
+            results.push(full);
+        }
+    }
+    return results;
+}
+
+describe("no-disallowed globals", () => {
+    it("crypto.randomUUID only used in approved files", {
+        timeout: 5000,
+    }, () => {
+        const files = walkFiles(SRC_ROOT);
+        const violations: string[] = [];
+        for (const file of files) {
+            const rel = relative(SRC_ROOT, file);
+            const content = readFileSync(file, "utf-8");
+            if (
+                content.includes("randomUUID") &&
+                !CRYPTO_APPROVED_FILES.has(rel)
+            ) {
+                violations.push(rel);
+            }
+        }
+        expect(violations).toEqual([]);
+    });
+
+    it("crypto.subtle only used in approved files", { timeout: 5000 }, () => {
+        const files = walkFiles(SRC_ROOT);
+        const violations: string[] = [];
+        for (const file of files) {
+            const rel = relative(SRC_ROOT, file);
+            const content = readFileSync(file, "utf-8");
+            if (
+                (content.includes("crypto.subtle") ||
+                    content.includes("crypto.subtle")) &&
+                !CRYPTO_APPROVED_FILES.has(rel)
+            ) {
+                violations.push(rel);
+            }
+        }
+        expect(violations).toEqual([]);
+    });
+
+    it("key-generator.ts is in the approved set", { timeout: 5000 }, () => {
+        expect(CRYPTO_APPROVED_FILES.has("key/key-generator.ts")).toBe(true);
+    });
+});