scriptc/tests/harness/native-cli-packaging.test.ts

import { spawnSync } from "node:child_process";
import { createHash } from "node:crypto";
import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { dirname, join } from "node:path";
import { afterEach, expect, test } from "vitest";

const repository = join(import.meta.dirname, "../..");
const directories: string[] = [];
afterEach(() => {
  for (const directory of directories.splice(0))
    rmSync(directory, { recursive: true, force: true });
});

function fixture(windows = true) {
  const directory = mkdtempSync(
    join(process.platform === "win32" ? tmpdir() : "/tmp", "scriptc-package-paths-"),
  );
  directories.push(directory);
  const packages = join(directory, "packages");
  const platform = windows ? "win32-x64-msvc" : "linux-x64-gnu";
  const target = windows ? "x86_64-windows-msvc" : "x86_64-linux-gnu";
  const cli = join(packages, `cli-${platform}`);
  const distribution = join(cli, "dist");
  const executable = windows ? "scriptc.exe" : "scriptc";
  const manifestPath = join(distribution, "bin", executable + ".json");
  const write = (path: string, data: string | Buffer) => {
    mkdirSync(dirname(path), { recursive: true });
    writeFileSync(path, data);
  };
  const identity = { name: `@scriptc/cli-${platform}`, version: "1.2.3" };
  const runtimeIdentity = { name: `@scriptc/runtime-${platform}`, version: identity.version };
  const runtime = {
    schema: "scriptc.runtime-pack.v1",
    package: runtimeIdentity.name,
    version: identity.version,
    target: { name: target },
  };
  const asset = (path: string) => (windows ? path.replaceAll("/", "\\") : path);
  const manifest = {
    schema: "scriptc.native-toolchain.v1",
    compiler_version: identity.version,
    target,
    ts7: asset(`../lib/typescript/lib/tsc${windows ? ".exe" : ""}`),
    llvm_package: asset("../lib/llvm"),
    runtime_pack: asset("../lib/runtime"),
    runtime_sources: asset("../lib/runtime-sources"),
    declarations: asset("../lib/declarations"),
    comptime: asset(`../lib/scriptc-comptime${windows ? ".exe" : ""}`),
    wasi_node_runner: asset("../lib/wasi/wasi-runner.js"),
    runtime_packs: [{ target, path: asset("../lib/runtime") }],
  };
  write(join(cli, "package.json"), JSON.stringify(identity));
  write(join(distribution, "bin", executable), Buffer.alloc(2048, 1));
  chmodSync(join(distribution, "bin", executable), 0o755);
  write(manifestPath, JSON.stringify(manifest));
  for (const path of [manifest.ts7, manifest.comptime, manifest.wasi_node_runner]) {
    write(join(distribution, "bin", path.replaceAll("\\", "/")), "fixture");
  }
  write(
    join(
      distribution,
      "lib/llvm/bin",
      windows ? "scriptc-llvm-codegen.exe" : "scriptc-llvm-codegen",
    ),
    "fixture",
  );
  mkdirSync(join(distribution, "lib/runtime-sources/vendor"), { recursive: true });
  mkdirSync(join(distribution, "lib/declarations"), { recursive: true });
  for (const path of [join(distribution, "lib/runtime"), join(packages, `runtime-${platform}`)]) {
    write(join(path, "package.json"), JSON.stringify(runtimeIdentity));
    write(join(path, "runtime-pack.json"), JSON.stringify(runtime));
    write(join(path, "artifacts/runtime.o"), "runtime object");
  }
  for (const path of ["LICENSE", "THIRD_PARTY_NOTICES"]) write(join(distribution, path), "license");
  write(
    join(packages, "compiler/package.json"),
    JSON.stringify({
      version: identity.version,
      optionalDependencies: { [runtimeIdentity.name]: identity.version },
    }),
  );
  return { directory, packages, cli, platform, executable, manifestPath, manifest };
}

function run(script: string, ...args: string[]) {
  return spawnSync(process.execPath, [join(repository, "scripts", script), ...args], {
    encoding: "utf8",
    timeout: 30_000,
  });
}

test.each([true, false])(
  "verify and archive a native distribution across packaging hosts (Windows=%s)",
  (windows) => {
    const f = fixture(windows);
    const original = readFileSync(f.manifestPath);
    const verified = run("verify-native-cli.mjs", f.cli);
    expect(verified.status, verified.stderr).toBe(0);
    const output = join(f.directory, "archives");
    const packed = run("package-native-cli.mjs", f.packages, output);
    expect(packed.status, packed.stderr).toBe(0);
    const filename = `scriptc-1.2.3-${f.platform}.tar.gz`;
    const archive = join(output, filename);
    const digest = createHash("sha256").update(readFileSync(archive)).digest("hex");
    expect(readFileSync(join(output, "SHA256SUMS"), "utf8")).toBe(`${digest}  ${filename}\n`);
    const unpacked = join(f.directory, "unpacked");
    mkdirSync(unpacked);
    const extracted = spawnSync("tar", ["-xzf", archive, "-C", unpacked], { encoding: "utf8" });
    expect(extracted.status, extracted.stderr).toBe(0);
    const manifest = JSON.parse(
      readFileSync(join(unpacked, "bin", f.executable + ".json"), "utf8"),
    );
    expect(manifest.ts7).toBe(f.manifest.ts7);
    const runtime = manifest.runtime_packs[0];
    expect(
      JSON.parse(
        readFileSync(
          join(unpacked, "bin", runtime.path.replaceAll("\\", "/"), "runtime-pack.json"),
          "utf8",
        ),
      ).target.name,
    ).toBe(f.manifest.target);
    expect(manifest.runtime_packs).toEqual(f.manifest.runtime_packs);
    expect(readFileSync(f.manifestPath)).toEqual(original);
  },
);

test.each([
  "C:\\outside\\tsc.exe",
  "C:tsc.exe",
  "\\outside\\tsc.exe",
  "\\\\server\\share\\tsc.exe",
  "/outside/tsc.exe",
])("reject Windows rooted asset paths: %s", (path) => {
  const f = fixture();
  writeFileSync(f.manifestPath, JSON.stringify({ ...f.manifest, ts7: path }));
  const result = run("verify-native-cli.mjs", f.cli);
  expect(result.status).toBe(1);
  expect(result.stderr).toContain("native toolchain needs a relative ts7");
});

test("reject Windows traversal outside the distribution", () => {
  const f = fixture();
  writeFileSync(join(f.cli, "outside.exe"), "outside");
  writeFileSync(f.manifestPath, JSON.stringify({ ...f.manifest, ts7: "..\\..\\outside.exe" }));
  const result = run("verify-native-cli.mjs", f.cli);
  expect(result.status).toBe(1);
  expect(result.stderr).toContain("distribution references external asset");
});

test("reject Windows rooted runtime-pack paths", () => {
  const f = fixture();
  writeFileSync(
    f.manifestPath,
    JSON.stringify({
      ...f.manifest,
      runtime_packs: [{ target: f.manifest.target, path: "C:\\runtime" }],
    }),
  );
  const result = run("verify-native-cli.mjs", f.cli);
  expect(result.status).toBe(1);
  expect(result.stderr).toContain("native runtime pack paths must be relative");
});