config-audit/tests/scanners/rules-validator.test.mjs

import { describe, it, beforeEach, afterEach } from 'node:test';
import assert from 'node:assert/strict';
import { resolve, join } from 'node:path';
import { fileURLToPath } from 'node:url';
import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { resetCounter } from '../../scanners/lib/output.mjs';
import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';
import { scan } from '../../scanners/rules-validator.mjs';

const __dirname = fileURLToPath(new URL('.', import.meta.url));
const FIXTURES = resolve(__dirname, '../fixtures');

describe('RUL scanner — healthy project', () => {
  let result;
  beforeEach(async () => {
    resetCounter();
    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'healthy-project'));
    result = await scan(resolve(FIXTURES, 'healthy-project'), discovery);
  });

  it('returns status ok', () => {
    assert.strictEqual(result.status, 'ok');
  });

  it('has scanner prefix RUL', () => {
    assert.strictEqual(result.scanner, 'RUL');
  });

  it('finds no high severity issues', () => {
    const high = result.findings.filter(f => f.severity === 'high' || f.severity === 'critical');
    assert.strictEqual(high.length, 0, `Found: ${high.map(f => f.title + ': ' + f.description).join('\n')}`);
  });

  it('all finding IDs match CA-RUL-NNN', () => {
    for (const f of result.findings) {
      assert.match(f.id, /^CA-RUL-\d{3}$/);
    }
  });
});

describe('RUL scanner — broken project', () => {
  let result;
  beforeEach(async () => {
    resetCounter();
    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'broken-project'));
    result = await scan(resolve(FIXTURES, 'broken-project'), discovery);
  });

  it('flags a "globs" rule and steers to the documented "paths" field', () => {
    const f = result.findings.find(x => /globs/i.test(x.title));
    assert.ok(f, 'Should flag globs: usage');
    // Verifiseringsplikt: only `paths` is documented; whether CC ever read
    // `globs` is unverified, so the wording must NOT claim it is
    // deprecated/legacy Claude Code syntax.
    assert.ok(
      !/deprecated|legacy/i.test(`${f.title} ${f.description} ${f.recommendation}`),
      'wording must not assert globs is deprecated/legacy CC syntax (unverified)',
    );
    assert.match(
      `${f.description} ${f.recommendation}`,
      /paths/,
      'should steer to the documented paths: field',
    );
  });

  it('detects dead rule (matches no files)', () => {
    const found = result.findings.some(f => f.title.includes('matches no files'));
    assert.ok(found, 'Should detect dead glob pattern');
  });

  it('detects large unscoped rule', () => {
    const found = result.findings.some(f => f.title.includes('unscoped'));
    assert.ok(found, 'Should detect big rule without paths: frontmatter');
  });

  it('marks dead rule as high severity', () => {
    const f = result.findings.find(f => f.title.includes('matches no files'));
    assert.strictEqual(f?.severity, 'high');
  });
});

describe('RUL scanner — empty project', () => {
  let result;
  beforeEach(async () => {
    resetCounter();
    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'empty-project'));
    result = await scan(resolve(FIXTURES, 'empty-project'), discovery);
  });

  it('returns skipped when no rule files', () => {
    assert.strictEqual(result.status, 'skipped');
  });

  it('has 0 findings', () => {
    assert.strictEqual(result.findings.length, 0);
  });
});

describe('RUL — large path-scoped rule lost after compaction (A)', () => {
  // Path-scoped rules are NOT re-injected after a context compaction (V2,
  // context-window.md) — a large one carrying must-hold rules silently drops.
  let tmpRoot;
  let result;

  async function writeProject(root, ruleBodyLines) {
    await mkdir(join(root, '.claude', 'rules'), { recursive: true });
    await mkdir(join(root, 'src'), { recursive: true });
    // A matching file so the path glob is not flagged as "matches no files".
    await writeFile(join(root, 'src', 'foo.ts'), 'export {};\n', 'utf8');
    const body = Array.from({ length: ruleBodyLines }, (_, i) => `- rule ${i + 1}`).join('\n');
    // Inline paths form: config-audit's lightweight frontmatter parser reads
    // `paths: <inline>` (comma-normalized), not YAML block sequences. The RUL
    // scoped-detection (existing + this check) keys on that parsed value.
    await writeFile(
      join(root, '.claude', 'rules', 'scoped.md'),
      `---\npaths: "src/**/*.ts"\n---\n\n# Scoped rule\n${body}\n`,
      'utf8',
    );
  }

  beforeEach(async () => {
    resetCounter();
    tmpRoot = await mkdtemp(join(tmpdir(), 'ca-rul-durability-'));
    await writeProject(tmpRoot, 60);
    const discovery = await discoverConfigFiles(tmpRoot);
    result = await scan(tmpRoot, discovery);
  });

  afterEach(async () => {
    if (tmpRoot) await rm(tmpRoot, { recursive: true, force: true });
  });

  it('flags a large path-scoped rule as low (compaction durability)', () => {
    const f = result.findings.find(x => x.scanner === 'RUL' && /compaction/i.test(x.title || ''));
    assert.ok(f, `expected durability finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
    assert.equal(f.severity, 'low');
  });

  it('does NOT flag a small path-scoped rule', async () => {
    resetCounter();
    const small = await mkdtemp(join(tmpdir(), 'ca-rul-small-'));
    try {
      await writeProject(small, 3);
      const d = await discoverConfigFiles(small);
      const r = await scan(small, d);
      const f = r.findings.find(x => x.scanner === 'RUL' && /compaction/i.test(x.title || ''));
      assert.equal(f, undefined, 'a small scoped rule should not be flagged');
    } finally {
      await rm(small, { recursive: true, force: true });
    }
  });
});

describe('RUL — block-sequence-scoped rule is correctly scoped (parser regression)', () => {
  // A rule scoped with a YAML block sequence:
  //   paths:
  //     - src/**/*.ts
  // was previously misread as unscoped (the lightweight parser only read inline
  // `paths:`), so a large one wrongly fired the "unscoped" finding AND silently
  // skipped the compaction-durability finding. The parser block-sequence fix
  // flows through unchanged rules-validator code.
  let tmpRoot;
  let result;

  async function writeBlockSeqProject(root, ruleBodyLines) {
    await mkdir(join(root, '.claude', 'rules'), { recursive: true });
    await mkdir(join(root, 'src'), { recursive: true });
    await writeFile(join(root, 'src', 'foo.ts'), 'export {};\n', 'utf8');
    const body = Array.from({ length: ruleBodyLines }, (_, i) => `- rule ${i + 1}`).join('\n');
    // YAML block-sequence paths: form (the regression target).
    await writeFile(
      join(root, '.claude', 'rules', 'scoped-seq.md'),
      `---\npaths:\n  - "src/**/*.ts"\n---\n\n# Scoped rule\n${body}\n`,
      'utf8',
    );
  }

  beforeEach(async () => {
    resetCounter();
    tmpRoot = await mkdtemp(join(tmpdir(), 'ca-rul-blockseq-'));
    await writeBlockSeqProject(tmpRoot, 60);
    const discovery = await discoverConfigFiles(tmpRoot);
    result = await scan(tmpRoot, discovery);
  });

  afterEach(async () => {
    if (tmpRoot) await rm(tmpRoot, { recursive: true, force: true });
  });

  it('does NOT misflag a block-sequence-scoped rule as unscoped', () => {
    const f = result.findings.find(x => x.scanner === 'RUL' && /unscoped/i.test(x.title || ''));
    assert.equal(f, undefined,
      `block-sequence-scoped rule wrongly flagged unscoped; got: ${result.findings.map(x => x.title).join(' | ')}`);
  });

  it('DOES flag the block-sequence-scoped large rule as lost after compaction (low)', () => {
    const f = result.findings.find(x => x.scanner === 'RUL' && /compaction/i.test(x.title || ''));
    assert.ok(f, `expected durability finding; got: ${result.findings.map(x => x.title).join(' | ')}`);
    assert.equal(f.severity, 'low');
  });
});