verification_test.go

package main

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

// TestGhostPackCore is a simple integration test
// It mocks a server that serves a package.json and a yarn.lock
// And checks if the scanner finds them and correctly identifies packages.
// Since the actual main() reads from stdin and prints to stdout,
// we will test the core functions: ProbeDomain, ParsePackageJSON, CheckPackage.
func TestGhostPackCore(t *testing.T) {
	// 1. Mock NPM Registry
	mockRegistry := func(req *http.Request) (*http.Response, error) {
		if req.URL.Path == "/@internal/secret-pkg" {
			return &http.Response{
				StatusCode: 404,
				Body:       http.NoBody,
			}, nil
		}
		if req.URL.Path == "/react" {
			return &http.Response{
				StatusCode: 200,
				Body:       http.NoBody,
			}, nil
		}
		return &http.Response{StatusCode: 404, Body: http.NoBody}, nil
	}

	client := &http.Client{
		Transport: &MockTransport{RoundTripFunc: mockRegistry},
	}

	// 2. Test Analysis
	res1 := CheckPackage(client, "@internal/secret-pkg")
	if res1.Status != "VULNERABLE" {
		t.Errorf("Expected @internal/secret-pkg to be VULNERABLE, got %s", res1.Status)
	}

	res2 := CheckPackage(client, "react")
	if res2.Status != "SAFE" {
		t.Errorf("Expected react to be SAFE, got %s", res2.Status)
	}

	// 3. Test Parsing
	pkgJSON := `{"dependencies": {"react": "^17.0.0"}, "devDependencies": {"@internal/secret-pkg": "1.0.0"}}`
	pkgs, err := ParsePackageJSON([]byte(pkgJSON))
	if err != nil {
		t.Fatalf("Parse error: %v", err)
	}
	if len(pkgs) != 2 {
		t.Errorf("Expected 2 packages, found %d", len(pkgs))
	}

	// 4. Test Discovery via Mock Server
	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Path == "/package.json" {
			w.WriteHeader(200)
			w.Write([]byte(pkgJSON))
		} else {
			w.WriteHeader(404)
		}
	}))
	defer ts.Close()

	// Use a real client for local server probing
	probeClient := &http.Client{}
	found, err := ProbeDomain(ts.URL, probeClient, nil)
	if err != nil {
		t.Fatalf("ProbeDomain failed: %v", err)
	}

	if len(found) == 0 {
		t.Fatal("Expected to find package.json, found nothing")
	}
	if found[0].Type != "json" {
		t.Errorf("Expected type json, got %s", found[0].Type)
	}
}

func TestProtocolDefault(t *testing.T) {
	// Check if ProbeDomain adds http:// to bare domains
	// We mock the transport to capture the URL scheme
	var params []string
	mockTransport := func(req *http.Request) (*http.Response, error) {
		params = append(params, req.URL.Scheme)
		return &http.Response{StatusCode: 404, Body: http.NoBody}, nil
	}

	client := &http.Client{
		Transport: &MockTransport{RoundTripFunc: mockTransport},
	}

	ProbeDomain("example.com", client, nil)

	if len(params) == 0 {
		t.Fatal("No requests made")
	}
	if params[0] != "http" {
		t.Errorf("Expected scheme http, got %s", params[0])
	}
}

type MockTransport struct {
	RoundTripFunc func(req *http.Request) (*http.Response, error)
}

func (m *MockTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	return m.RoundTripFunc(req)
}