434 lines
14 KiB
TypeScript
434 lines
14 KiB
TypeScript
import { describe, it, expect } from 'vitest';
|
|
import JSZip from 'jszip';
|
|
import { extractTheme, extractPlugin } from '../plugin-validator';
|
|
|
|
function createZipFile(zip: JSZip, name = 'test.zip'): Promise<File> {
|
|
return zip.generateAsync({ type: 'blob' }).then(blob => new File([blob], name));
|
|
}
|
|
|
|
describe('extractTheme', () => {
|
|
it('extracts a valid theme ZIP', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'my-theme',
|
|
name: 'My Theme',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light', 'dark'],
|
|
}));
|
|
zip.file('theme.css', ':root { --color-primary: #ff0000; }\n.dark { --color-primary: #00ff00; }');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.manifest).not.toBeNull();
|
|
expect(result.manifest!.id).toBe('my-theme');
|
|
expect(result.css).toContain('--color-primary');
|
|
});
|
|
|
|
it('rejects oversized theme', async () => {
|
|
// Theme size limit is 2 MB; create a file just past it.
|
|
const oversizedFile = new File([new ArrayBuffer(2 * 1024 * 1024 + 1)], 'big.zip');
|
|
const result = await extractTheme(oversizedFile);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Theme ZIP exceeds 2 MB size limit');
|
|
});
|
|
|
|
it('rejects non-ZIP file', async () => {
|
|
const file = new File(['not a zip'], 'bad.zip');
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Invalid ZIP file');
|
|
});
|
|
|
|
it('rejects missing manifest.json', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('theme.css', ':root { --color-primary: blue; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Missing manifest.json');
|
|
});
|
|
|
|
it('rejects invalid JSON manifest', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', 'not json {{{');
|
|
zip.file('theme.css', ':root { --color-primary: blue; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Invalid manifest.json (not valid JSON)');
|
|
});
|
|
|
|
it('rejects missing theme.css', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'no-css',
|
|
name: 'No CSS',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light'],
|
|
}));
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Missing theme.css');
|
|
});
|
|
|
|
it('rejects wrong type in manifest', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'wrong-type',
|
|
name: 'Wrong',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'plugin', // wrong
|
|
variants: ['light'],
|
|
}));
|
|
zip.file('theme.css', ':root { --color-primary: blue; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('Expected type "theme"'))).toBe(true);
|
|
});
|
|
|
|
it('rejects missing variants', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'no-variants',
|
|
name: 'No Variants',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
}));
|
|
zip.file('theme.css', ':root { --color-primary: blue; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('variants'))).toBe(true);
|
|
});
|
|
|
|
it('handles ZIP with folder root', async () => {
|
|
const zip = new JSZip();
|
|
const folder = zip.folder('my-theme')!;
|
|
folder.file('manifest.json', JSON.stringify({
|
|
id: 'nested-theme',
|
|
name: 'Nested',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light', 'dark'],
|
|
}));
|
|
folder.file('theme.css', ':root { --color-primary: #aaa; }\n.dark { --color-primary: #bbb; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.manifest!.id).toBe('nested-theme');
|
|
});
|
|
|
|
// ── Theme API v2 (advanced manifest) ──────────────────────────────
|
|
|
|
it('compiles a v2 manifest with tokens and no theme.css', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'tokens-only',
|
|
name: 'Tokens Only',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light', 'dark'],
|
|
apiVersion: 2,
|
|
tokens: {
|
|
light: { primary: '#1373d9', background: '#ffffff' },
|
|
dark: { primary: '#58c9ff', background: '#1a202c' },
|
|
},
|
|
}));
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.css).toContain('--color-primary: #1373d9');
|
|
expect(result.css).toContain('--color-primary: #58c9ff');
|
|
});
|
|
|
|
it('concatenates compiled tokens with author-supplied theme.css', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'tokens-plus-css',
|
|
name: 'Tokens + CSS',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light'],
|
|
apiVersion: 2,
|
|
tokens: { light: { primary: '#000' } },
|
|
}));
|
|
zip.file('theme.css', '@font-face { font-family: "X"; src: local("X"); }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.css).toContain('--color-primary: #000');
|
|
expect(result.css).toContain('@font-face');
|
|
});
|
|
|
|
it('extracts a skin.css when shipped with a v2 manifest', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'with-skin',
|
|
name: 'With Skin',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light'],
|
|
apiVersion: 2,
|
|
tokens: { light: { primary: '#000' } },
|
|
}));
|
|
zip.file('skin.css', '[data-tour="email-list"] { font-size: 13px; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.skin).not.toBeNull();
|
|
expect(result.skin!).toContain('[data-tour="email-list"]');
|
|
});
|
|
|
|
it('strips dangerous patterns from skin.css', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'evil-skin',
|
|
name: 'Evil',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light'],
|
|
apiVersion: 2,
|
|
tokens: { light: { primary: '#000' } },
|
|
}));
|
|
zip.file('skin.css', '@import url("https://x.com/p.css"); button { background: javascript:alert(1); }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.skin).not.toBeNull();
|
|
expect(result.skin!).not.toContain('javascript:');
|
|
expect(result.skin!).not.toContain('@import');
|
|
expect(result.warnings.some((w) => w.toLowerCase().includes('skin'))).toBe(true);
|
|
});
|
|
|
|
it('ignores skin.css when manifest is not v2', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'v1-with-skin',
|
|
name: 'V1',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light'],
|
|
}));
|
|
zip.file('theme.css', ':root { --color-primary: #000; }');
|
|
zip.file('skin.css', 'body { display: none; }');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.skin).toBeNull();
|
|
expect(result.warnings.some((w) => w.includes('skin.css ignored'))).toBe(true);
|
|
});
|
|
|
|
it('rejects a v2 manifest with invalid density', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'bad-density',
|
|
name: 'Bad',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme',
|
|
variants: ['light'],
|
|
density: 'gigantic',
|
|
tokens: { light: { primary: '#000' } },
|
|
}));
|
|
const file = await createZipFile(zip);
|
|
const result = await extractTheme(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some((e) => e.includes('density'))).toBe(true);
|
|
});
|
|
});
|
|
|
|
describe('extractPlugin', () => {
|
|
it('extracts a valid plugin ZIP', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'my-plugin',
|
|
name: 'My Plugin',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'ui-extension',
|
|
entrypoint: 'index.js',
|
|
permissions: ['email:read'],
|
|
}));
|
|
zip.file('index.js', 'export function activate(api) { console.log("hi"); }');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.manifest!.id).toBe('my-plugin');
|
|
expect(result.code).toContain('activate');
|
|
});
|
|
|
|
it('rejects oversized plugin', async () => {
|
|
const oversizedFile = new File([new ArrayBuffer(5 * 1024 * 1024 + 1)], 'big.zip');
|
|
const result = await extractPlugin(oversizedFile);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Plugin ZIP exceeds 5 MB size limit');
|
|
});
|
|
|
|
it('rejects non-ZIP file', async () => {
|
|
const file = new File(['not a zip'], 'bad.zip');
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Invalid ZIP file');
|
|
});
|
|
|
|
it('rejects missing manifest', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('index.js', 'export function activate() {}');
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors).toContain('Missing manifest.json');
|
|
});
|
|
|
|
it('rejects disallowed file types', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'bad-files',
|
|
name: 'Bad',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'hook',
|
|
entrypoint: 'index.js',
|
|
permissions: [],
|
|
}));
|
|
zip.file('index.js', 'export function activate() {}');
|
|
zip.file('hack.exe', 'binary');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('.exe'))).toBe(true);
|
|
});
|
|
|
|
it('rejects unknown permissions', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'bad-perms',
|
|
name: 'Bad perms',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'hook',
|
|
entrypoint: 'index.js',
|
|
permissions: ['email:read', 'nuclear:launch'],
|
|
}));
|
|
zip.file('index.js', 'export function activate() {}');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('nuclear:launch'))).toBe(true);
|
|
});
|
|
|
|
it('warns about eval() in code', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'eval-plugin',
|
|
name: 'Eval',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'hook',
|
|
entrypoint: 'index.js',
|
|
permissions: [],
|
|
}));
|
|
zip.file('index.js', 'export function activate() { eval("alert(1)"); }');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.warnings.some(w => w.includes('eval()'))).toBe(true);
|
|
});
|
|
|
|
it('warns about document.cookie in code', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'cookie-plugin',
|
|
name: 'Cookie',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'hook',
|
|
entrypoint: 'index.js',
|
|
permissions: [],
|
|
}));
|
|
zip.file('index.js', 'export function activate() { const c = document.cookie; }');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(true);
|
|
expect(result.warnings.some(w => w.includes('document.cookie'))).toBe(true);
|
|
});
|
|
|
|
it('rejects invalid plugin type', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'bad-type',
|
|
name: 'Bad Type',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'theme', // wrong type for plugin
|
|
entrypoint: 'index.js',
|
|
permissions: [],
|
|
}));
|
|
zip.file('index.js', 'export function activate() {}');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('Invalid type'))).toBe(true);
|
|
});
|
|
|
|
it('rejects missing entrypoint', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'no-entry',
|
|
name: 'No Entry',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'hook',
|
|
entrypoint: 'main.js',
|
|
permissions: [],
|
|
}));
|
|
zip.file('index.js', 'export function activate() {}');
|
|
// entrypoint 'main.js' doesn't exist
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('Missing entrypoint'))).toBe(true);
|
|
});
|
|
|
|
it('rejects invalid manifest ID format', async () => {
|
|
const zip = new JSZip();
|
|
zip.file('manifest.json', JSON.stringify({
|
|
id: 'Bad_ID!',
|
|
name: 'Bad ID',
|
|
version: '1.0.0',
|
|
author: 'Test',
|
|
type: 'hook',
|
|
entrypoint: 'index.js',
|
|
permissions: [],
|
|
}));
|
|
zip.file('index.js', 'export function activate() {}');
|
|
|
|
const file = await createZipFile(zip);
|
|
const result = await extractPlugin(file);
|
|
expect(result.valid).toBe(false);
|
|
expect(result.errors.some(e => e.includes('ID must be lowercase'))).toBe(true);
|
|
});
|
|
});
|