Skip to content

Commit f003768

Browse files
lelialelia
committed
fix compatibility unit tests
Signed-off-by: lelia <2418071+lelia@users.noreply.github.com>
1 parent c000e6d commit f003768

1 file changed

Lines changed: 101 additions & 25 deletions

File tree

‎tests/unit/test_fossa_compat.py‎

Lines changed: 101 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,68 @@
1-
import json
2-
from pathlib import Path
3-
41
from socketsecurity.config import CliConfig
52
from socketsecurity.core.classes import Diff, Issue, Package
6-
from socketsecurity.fossa_compat import build_fossa_report_payload
7-
3+
from socketsecurity.fossa_compat import (
4+
build_fossa_attribution_payload,
5+
build_fossa_report_payload,
6+
)
87

9-
FIXTURE_DIR = Path("/Users/lelia/github/fossa/DependencyScan/Fossa/validation-pipeline")
108

9+
EXPECTED_TOP_LEVEL_KEYS = ["project", "vulnerability", "licensing", "quality"]
10+
EXPECTED_PROJECT_KEYS = ["branch", "id", "project", "projectId", "revision", "url"]
11+
EXPECTED_VULNERABILITY_KEYS = [
12+
"affectedVersionRanges",
13+
"containerLayers",
14+
"cpes",
15+
"createdAt",
16+
"cve",
17+
"cveStatus",
18+
"cwes",
19+
"cvss",
20+
"cvssVector",
21+
"depths",
22+
"details",
23+
"epss",
24+
"exploitability",
25+
"id",
26+
"metrics",
27+
"patchedVersionRanges",
28+
"projects",
29+
"published",
30+
"references",
31+
"remediation",
32+
"severity",
33+
"source",
34+
"statuses",
35+
"title",
36+
"type",
37+
"url",
38+
"vulnId",
39+
]
40+
EXPECTED_SOURCE_KEYS = ["id", "name", "packageManager", "url", "version"]
41+
EXPECTED_DEPTH_KEYS = ["deep", "direct"]
42+
EXPECTED_STATUS_KEYS = ["active", "ignored"]
43+
EXPECTED_REMEDIATION_KEYS = [
44+
"completeFix",
45+
"completeFixDistance",
46+
"partialFix",
47+
"partialFixDistance",
48+
]
49+
EXPECTED_EPSS_KEYS = ["percentile", "score"]
1150

12-
def test_fossa_report_payload_matches_sample_top_level_shape():
13-
sample = json.loads(
14-
(FIXTURE_DIR / "fossa-analyze-11464165-job-011e1ec8-6569-5e69-4f06-baf193d1351e_03172026132742.json").read_text()
15-
)
1651

52+
def test_fossa_report_payload_uses_expected_top_level_shape():
1753
config = CliConfig.from_args(["--api-token", "test", "--legal-format", "fossa"])
1854
diff = Diff(id="scan-123", report_url="https://socket.dev/report/123")
1955

2056
payload = build_fossa_report_payload(diff, config)
2157

22-
assert list(payload.keys()) == list(sample.keys())
23-
assert sorted(payload["project"].keys()) == sorted(sample["project"].keys())
58+
assert list(payload.keys()) == EXPECTED_TOP_LEVEL_KEYS
59+
assert sorted(payload["project"].keys()) == sorted(EXPECTED_PROJECT_KEYS)
2460
assert payload["vulnerability"] == []
2561
assert payload["licensing"] == []
2662
assert payload["quality"] == []
2763

2864

29-
def test_fossa_report_payload_vulnerability_keys_cover_sample_shape():
30-
sample = json.loads(
31-
(FIXTURE_DIR / "fossa-analyze-11464165-job-7f33e5bd-7764-5d8a-ba2e-506e078b9c3f_03172026132955.json").read_text()
32-
)
33-
sample_vulnerability = sample["vulnerability"][0]
34-
65+
def test_fossa_report_payload_vulnerability_shape_is_stable():
3566
config = CliConfig.from_args([
3667
"--api-token", "test",
3768
"--legal-format", "fossa",
@@ -102,10 +133,55 @@ def test_fossa_report_payload_vulnerability_keys_cover_sample_shape():
102133
payload = build_fossa_report_payload(diff, config)
103134
generated_vulnerability = payload["vulnerability"][0]
104135

105-
assert sorted(generated_vulnerability.keys()) == sorted(sample_vulnerability.keys())
106-
assert generated_vulnerability["source"]["packageManager"] == sample_vulnerability["source"]["packageManager"]
107-
assert sorted(generated_vulnerability["source"].keys()) == sorted(sample_vulnerability["source"].keys())
108-
assert sorted(generated_vulnerability["depths"].keys()) == sorted(sample_vulnerability["depths"].keys())
109-
assert sorted(generated_vulnerability["statuses"].keys()) == sorted(sample_vulnerability["statuses"].keys())
110-
assert sorted(generated_vulnerability["remediation"].keys()) == sorted(sample_vulnerability["remediation"].keys())
111-
assert sorted(generated_vulnerability["epss"].keys()) == sorted(sample_vulnerability["epss"].keys())
136+
assert sorted(generated_vulnerability.keys()) == sorted(EXPECTED_VULNERABILITY_KEYS)
137+
assert sorted(generated_vulnerability["source"].keys()) == sorted(EXPECTED_SOURCE_KEYS)
138+
assert sorted(generated_vulnerability["depths"].keys()) == sorted(EXPECTED_DEPTH_KEYS)
139+
assert sorted(generated_vulnerability["statuses"].keys()) == sorted(EXPECTED_STATUS_KEYS)
140+
assert sorted(generated_vulnerability["remediation"].keys()) == sorted(EXPECTED_REMEDIATION_KEYS)
141+
assert sorted(generated_vulnerability["epss"].keys()) == sorted(EXPECTED_EPSS_KEYS)
142+
assert generated_vulnerability["source"]["packageManager"] == "pip"
143+
assert generated_vulnerability["vulnId"] == "GHSA-9hjg-9r4m-mvj7"
144+
assert generated_vulnerability["cve"] == "CVE-2024-47081"
145+
146+
147+
def test_fossa_attribution_payload_shape_is_stable():
148+
config = CliConfig.from_args([
149+
"--api-token", "test",
150+
"--legal-format", "fossa",
151+
"--repo", "owner/repo",
152+
"--branch", "refs/heads/main",
153+
])
154+
diff = Diff(id="scan-123", report_url="https://socket.dev/report/123")
155+
diff.packages = {
156+
"pkg-1": Package(
157+
id="pkg-1",
158+
name="requests",
159+
version="2.31.0",
160+
type="pypi",
161+
score={},
162+
alerts=[],
163+
direct=True,
164+
url="https://socket.dev/pypi/package/requests/overview/2.31.0",
165+
license="Apache-2.0",
166+
licenseDetails=[{"id": "Apache-2.0"}],
167+
licenseAttrib=[{"id": "Apache-2.0"}],
168+
purl="pkg:pypi/requests@2.31.0",
169+
)
170+
}
171+
172+
payload = build_fossa_attribution_payload(diff, config)
173+
174+
assert sorted(payload.keys()) == ["dependencies", "project"]
175+
assert sorted(payload["project"].keys()) == sorted(EXPECTED_PROJECT_KEYS)
176+
assert payload["dependencies"] == [{
177+
"id": "pkg-1",
178+
"name": "requests",
179+
"version": "2.31.0",
180+
"ecosystem": "pip",
181+
"direct": True,
182+
"url": "https://socket.dev/pypi/package/requests/overview/2.31.0",
183+
"purl": "pkg:pypi/requests@2.31.0",
184+
"declaredLicense": "Apache-2.0",
185+
"licenseDetails": [{"id": "Apache-2.0"}],
186+
"licenseAttrib": [{"id": "Apache-2.0"}],
187+
}]

0 commit comments

Comments
 (0)