config-audit/tests/scanners/rules-validator.test.mjs

import { describe, it, beforeEach } from 'node:test';
import assert from 'node:assert/strict';
import { resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { resetCounter } from '../../scanners/lib/output.mjs';
import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';
import { scan } from '../../scanners/rules-validator.mjs';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const FIXTURES = resolve(__dirname, '../fixtures');

describe('RUL scanner — healthy project', () => {
  let result;
  beforeEach(async () => {
    resetCounter();
    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'healthy-project'));
    result = await scan(resolve(FIXTURES, 'healthy-project'), discovery);
  });

  it('returns status ok', () => {
    assert.strictEqual(result.status, 'ok');
  });

  it('has scanner prefix RUL', () => {
    assert.strictEqual(result.scanner, 'RUL');
  });

  it('finds no high severity issues', () => {
    const high = result.findings.filter(f => f.severity === 'high' || f.severity === 'critical');
    assert.strictEqual(high.length, 0, `Found: ${high.map(f => f.title + ': ' + f.description).join('\n')}`);
  });

  it('all finding IDs match CA-RUL-NNN', () => {
    for (const f of result.findings) {
      assert.match(f.id, /^CA-RUL-\d{3}$/);
    }
  });
});

describe('RUL scanner — broken project', () => {
  let result;
  beforeEach(async () => {
    resetCounter();
    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'broken-project'));
    result = await scan(resolve(FIXTURES, 'broken-project'), discovery);
  });

  it('flags a "globs" rule and steers to the documented "paths" field', () => {
    const f = result.findings.find(x => /globs/i.test(x.title));
    assert.ok(f, 'Should flag globs: usage');
    // Verifiseringsplikt: only `paths` is documented; whether CC ever read
    // `globs` is unverified, so the wording must NOT claim it is
    // deprecated/legacy Claude Code syntax.
    assert.ok(
      !/deprecated|legacy/i.test(`${f.title} ${f.description} ${f.recommendation}`),
      'wording must not assert globs is deprecated/legacy CC syntax (unverified)',
    );
    assert.match(
      `${f.description} ${f.recommendation}`,
      /paths/,
      'should steer to the documented paths: field',
    );
  });

  it('detects dead rule (matches no files)', () => {
    const found = result.findings.some(f => f.title.includes('matches no files'));
    assert.ok(found, 'Should detect dead glob pattern');
  });

  it('detects large unscoped rule', () => {
    const found = result.findings.some(f => f.title.includes('unscoped'));
    assert.ok(found, 'Should detect big rule without paths: frontmatter');
  });

  it('marks dead rule as high severity', () => {
    const f = result.findings.find(f => f.title.includes('matches no files'));
    assert.strictEqual(f?.severity, 'high');
  });
});

describe('RUL scanner — empty project', () => {
  let result;
  beforeEach(async () => {
    resetCounter();
    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'empty-project'));
    result = await scan(resolve(FIXTURES, 'empty-project'), discovery);
  });

  it('returns skipped when no rule files', () => {
    assert.strictEqual(result.status, 'skipped');
  });

  it('has 0 findings', () => {
    assert.strictEqual(result.findings.length, 0);
  });
});