feat: initial open marketplace with llm-security, config-audit, ultraplan-local

plugins/config-audit/tests/scanners/import-resolver.test.mjs

@@ -0,0 +1,117 @@
+import { describe, it, beforeEach } from 'node:test';
+import assert from 'node:assert/strict';
+import { resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { resetCounter } from '../../scanners/lib/output.mjs';
+import { discoverConfigFiles } from '../../scanners/lib/file-discovery.mjs';
+import { scan } from '../../scanners/import-resolver.mjs';
+
+const __dirname = fileURLToPath(new URL('.', import.meta.url));
+const FIXTURES = resolve(__dirname, '../fixtures');
+
+describe('IMP scanner — healthy project', () => {
+  let result;
+  beforeEach(async () => {
+    resetCounter();
+    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'healthy-project'));
+    result = await scan(resolve(FIXTURES, 'healthy-project'), discovery);
+  });
+
+  it('returns status ok', () => {
+    assert.equal(result.status, 'ok');
+  });
+
+  it('reports scanner prefix IMP', () => {
+    assert.equal(result.scanner, 'IMP');
+  });
+
+  it('scans at least 1 file', () => {
+    assert.ok(result.files_scanned >= 1);
+  });
+
+  it('has no high or critical findings', () => {
+    assert.equal(result.counts.critical, 0);
+    assert.equal(result.counts.high, 0);
+  });
+
+  it('finding IDs match CA-IMP-NNN pattern', () => {
+    for (const f of result.findings) {
+      assert.match(f.id, /^CA-IMP-\d{3}$/);
+    }
+  });
+});
+
+describe('IMP scanner — broken project', () => {
+  let result;
+  beforeEach(async () => {
+    resetCounter();
+    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'broken-project'));
+    result = await scan(resolve(FIXTURES, 'broken-project'), discovery);
+  });
+
+  it('returns status ok', () => {
+    assert.equal(result.status, 'ok');
+  });
+
+  it('detects broken @import link', () => {
+    assert.ok(result.findings.some(f => f.title.includes('Broken @import')));
+  });
+
+  it('broken link is high severity', () => {
+    const broken = result.findings.find(f => f.title.includes('Broken @import'));
+    assert.equal(broken.severity, 'high');
+  });
+
+  it('detects circular @import reference', () => {
+    assert.ok(result.findings.some(f => f.title.includes('Circular @import')));
+  });
+
+  it('circular reference is medium severity', () => {
+    const circular = result.findings.find(f => f.title.includes('Circular @import'));
+    assert.equal(circular.severity, 'medium');
+  });
+
+  it('has at least 2 findings', () => {
+    assert.ok(result.findings.length >= 2);
+  });
+
+  it('includes evidence with path info', () => {
+    const broken = result.findings.find(f => f.title.includes('Broken @import'));
+    assert.ok(broken.evidence);
+    assert.ok(broken.evidence.includes('nonexistent'));
+  });
+});
+
+describe('IMP scanner — minimal project', () => {
+  let result;
+  beforeEach(async () => {
+    resetCounter();
+    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'minimal-project'));
+    result = await scan(resolve(FIXTURES, 'minimal-project'), discovery);
+  });
+
+  it('returns status ok', () => {
+    assert.equal(result.status, 'ok');
+  });
+
+  it('has 0 findings for file without imports', () => {
+    assert.equal(result.findings.length, 0);
+  });
+});
+
+describe('IMP scanner — empty project', () => {
+  let result;
+  beforeEach(async () => {
+    resetCounter();
+    const discovery = await discoverConfigFiles(resolve(FIXTURES, 'empty-project'));
+    result = await scan(resolve(FIXTURES, 'empty-project'), discovery);
+  });
+
+  it('returns skipped when no CLAUDE.md files', () => {
+    assert.equal(result.status, 'skipped');
+  });
+
+  it('has 0 findings', () => {
+    assert.equal(result.findings.length, 0);
+  });
+});