azaion/ui
1
0
Fork 0
mirror of https://github.com/azaion/ui.git synced 2026-06-21 09:21:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'dev' into feat/dataset-explorer

Browse Source
This commit is contained in:
Armen Rohalov
2026-05-14 20:26:20 +03:00
parent b0829b4a90 873749197a
commit 401f43d845
383 changed files with 40090 additions and 923 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/check-arch-imports.mjs
+223
View File
@@ -0,0 +1,223 @@
#!/usr/bin/env node
// AZ-485 / F4 (STC-ARCH-01) + AZ-486 / F7 (STC-ARCH-02).
//
// STC-ARCH-01 (mode=arch-imports, default) — no cross-component deep imports.
// Every component under src/<component>/ exposes its Public API via a barrel
// (src/<component>/index.ts). Cross-component imports MUST go through the
// barrel; reaching into another component's internal files is a layering
// violation.
//
// STC-ARCH-02 (mode=api-literals) — no hardcoded `/api/<service>/...` literals
// in production source. The single source of truth for those URLs is
// src/api/endpoints.ts (AZ-486 / F7). Any production callsite of api.* or
// createSSE() that needs an API path must use an `endpoints.*` builder.
//
// Single source of truth — scripts/run-tests.sh delegates here, and the
// architecture unit test (tests/architecture_imports.test.ts) calls this
// script with synthetic fixtures to verify each gate fails on a regression
// and passes on the migrated codebase. Mirrors the scripts/check-banned-deps.mjs
// pattern (AZ-482).
//
// Usage:
// node scripts/check-arch-imports.mjs [--mode=arch-imports|api-literals] [--root=<repo-root>]
//
// Exit code 0 on PASS; non-zero on FAIL with the hit list on stderr.
import { readFileSync, statSync, readdirSync } from 'node:fs'
import { join, dirname, resolve, relative } from 'node:path'
import { fileURLToPath } from 'node:url'
const __filename = fileURLToPath(import.meta.url)
const __dirname = dirname(__filename)
const MODES = new Set(['arch-imports', 'api-literals'])
function parseArgs(argv) {
const out = { root: resolve(__dirname, '..'), mode: 'arch-imports' }
for (const a of argv.slice(2)) {
if (a.startsWith('--root=')) out.root = resolve(a.slice('--root='.length))
else if (a.startsWith('--mode=')) out.mode = a.slice('--mode='.length)
else if (a === '-h' || a === '--help') {
process.stderr.write(
'Usage: check-arch-imports.mjs [--mode=arch-imports|api-literals] [--root=<repo-root>]\n',
)
process.exit(0)
}
}
if (!MODES.has(out.mode)) {
process.stderr.write(`unknown --mode=${out.mode}; expected one of: ${[...MODES].join(', ')}\n`)
process.exit(2)
}
return out
}
const IGNORED_DIRS = new Set([
'node_modules', 'dist', 'build', 'test-output', 'test-results',
'coverage', '.git', '.cache', 'playwright-report', 'blob-report',
])
const SOURCE_EXT = new Set(['.ts', '.tsx'])
// ----------------------------------------------------------------------------
// STC-ARCH-01 — cross-component deep imports (mode=arch-imports)
// ----------------------------------------------------------------------------
// Cross-component deep-import pattern: `from '<up>/<src>?/<component>/<File>'`
// - one or more `..` segments
// - optional `src/` prefix (used by tests/ and e2e/ imports)
// - a known component directory
// - a path segment starting with a letter (i.e. NOT the barrel `index`)
//
// Allowed by construction:
// - barrel: from '../api' (no further /<File>)
// - intra-component: from './sse' (starts with ./, not ../)
const COMPONENT_DIRS = 'api|auth|class-colors|components|features/[a-z-]+|hooks|i18n'
const DEEP_IMPORT_RE = new RegExp(
String.raw`from\s+['"](?:\.\./)+(?:src/)?(?:${COMPONENT_DIRS})/[A-Za-z]`,
)
// STC-ARCH-01 has no exemptions today. F3 (the classColors carry-over) was
// closed by AZ-511 — the file moved to its own component (`src/class-colors/`)
// with a proper barrel, and consumers now import via that barrel.
const ARCH_IMPORTS_EXEMPT_RE = null
const ARCH_IMPORTS_SCAN_ROOTS = ['src', 'tests', 'e2e']
// ----------------------------------------------------------------------------
// STC-ARCH-02 — hardcoded /api/<service>/ literals (mode=api-literals)
// ----------------------------------------------------------------------------
// Hardcoded API path pattern: a quote/backtick immediately followed by
// `/api/<lowercase-hyphen-service>/`. Catches single-quoted ('...'),
// double-quoted ("..."), and template-literal (`...`) styles equally — quote
// style is not a meaningful difference for "no hardcoded URLs in production".
//
// Examples that MATCH:
// '/api/admin/users'
// "/api/admin/auth/refresh"
// `/api/annotations/dataset?${params}`
// `/api/flights/${id}/waypoints`
//
// Examples that DO NOT match (intentional):
// /api/admin (bare prefix, no trailing /) — kept out so getApiBase()
// prefixes the base path
// unobstructed.
// /api/users (no service segment, hypothetical) — pattern requires the
// SECOND segment.
const API_LITERAL_RE = /[`'"]\/api\/[a-z][a-z-]*\//
// STC-ARCH-02 exemptions:
// - the contract owner itself (src/api/endpoints.ts)
// - test files (*.test.ts, *.test.tsx) — tests legitimately assert URL
// strings, and the contract is precisely "the test file IS the contract"
const API_LITERAL_EXEMPT_FILES_RE = /(?:^|\/)(?:api\/endpoints\.ts|.+\.test\.tsx?)$/
const API_LITERALS_SCAN_ROOTS = ['src']
// ----------------------------------------------------------------------------
// Walk helpers
// ----------------------------------------------------------------------------
function* walkSourceFiles(rootDir) {
let entries
try {
entries = readdirSync(rootDir, { withFileTypes: true })
} catch {
return
}
for (const entry of entries) {
const full = join(rootDir, entry.name)
if (entry.isDirectory()) {
if (IGNORED_DIRS.has(entry.name)) continue
yield* walkSourceFiles(full)
} else if (entry.isFile()) {
const dot = entry.name.lastIndexOf('.')
if (dot < 0) continue
const ext = entry.name.slice(dot)
if (!SOURCE_EXT.has(ext)) continue
yield full
}
}
}
function readLines(file) {
try {
return readFileSync(file, 'utf8').split('\n')
} catch {
return null
}
}
// ----------------------------------------------------------------------------
// Scanners — one per mode. Both share the walker and line-comment skip.
// ----------------------------------------------------------------------------
function scanArchImports(file, root) {
const hits = []
const lines = readLines(file)
if (lines === null) return hits
const rel = relative(root, file).replaceAll('\\', '/')
for (let i = 0; i < lines.length; i++) {
const line = lines[i]
if (/^\s*\/\//.test(line)) continue
if (!DEEP_IMPORT_RE.test(line)) continue
if (ARCH_IMPORTS_EXEMPT_RE && ARCH_IMPORTS_EXEMPT_RE.test(line)) continue
hits.push(`${rel}:${i + 1}: ${line.trim().slice(0, 200)}`)
}
return hits
}
function scanApiLiterals(file, root) {
const hits = []
const rel = relative(root, file).replaceAll('\\', '/')
if (API_LITERAL_EXEMPT_FILES_RE.test(rel)) return hits
const lines = readLines(file)
if (lines === null) return hits
for (let i = 0; i < lines.length; i++) {
const line = lines[i]
if (/^\s*\/\//.test(line)) continue
if (!API_LITERAL_RE.test(line)) continue
hits.push(`${rel}:${i + 1}: ${line.trim().slice(0, 200)}`)
}
return hits
}
// ----------------------------------------------------------------------------
// Main
// ----------------------------------------------------------------------------
function main() {
const { root, mode } = parseArgs(process.argv)
const config = mode === 'api-literals'
? {
roots: API_LITERALS_SCAN_ROOTS,
scan: scanApiLiterals,
failHeader:
'STC-ARCH-02 — hardcoded /api/<service>/ literals detected in ' +
'production source (must go through endpoints.* builders, see ' +
'src/api/endpoints.ts):\n',
}
: {
roots: ARCH_IMPORTS_SCAN_ROOTS,
scan: scanArchImports,
failHeader:
'STC-ARCH-01 — cross-component deep imports detected ' +
'(must go through component barrel, see module-layout.md):\n',
}
const hits = []
for (const sub of config.roots) {
const full = join(root, sub)
try { statSync(full) } catch { continue }
for (const file of walkSourceFiles(full)) {
hits.push(...config.scan(file, root))
}
}
if (hits.length) {
process.stderr.write(config.failHeader)
for (const h of hits) process.stderr.write(` ${h}\n`)
process.exit(1)
}
process.exit(0)
}
main()
scripts/check-banned-deps.mjs
+220
View File
@@ -0,0 +1,220 @@
#!/usr/bin/env node
// AZ-482 — static deny-list enforcement driven by tests/security/banned-deps.json.
//
// One canonical implementation that the run-tests.sh static profile delegates to,
// so adding or removing a banned dependency / pattern is a one-file change visible
// in code review (per AZ-482 constraint).
//
// Usage:
// node scripts/check-banned-deps.mjs --kind=<key> [--root=<repo-root>]
//
// Exit code 0 on PASS (no hits); non-zero on FAIL (writes the hit list to stderr).
import { readFileSync, statSync, readdirSync } from 'node:fs'
import { join, dirname, resolve, relative } from 'node:path'
import { fileURLToPath } from 'node:url'
const __filename = fileURLToPath(import.meta.url)
const __dirname = dirname(__filename)
function parseArgs(argv) {
const out = { kind: null, root: resolve(__dirname, '..') }
for (const a of argv.slice(2)) {
if (a.startsWith('--kind=')) out.kind = a.slice('--kind='.length)
else if (a.startsWith('--root=')) out.root = resolve(a.slice('--root='.length))
else if (a === '-h' || a === '--help') {
// eslint-disable-next-line no-console
console.error('Usage: check-banned-deps.mjs --kind=<key> [--root=<repo-root>]')
process.exit(0)
}
}
if (!out.kind) {
process.stderr.write('check-banned-deps: --kind is required\n')
process.exit(2)
}
return out
}
function loadDenylist(root) {
const path = join(root, 'tests', 'security', 'banned-deps.json')
return JSON.parse(readFileSync(path, 'utf8'))
}
function loadPackageJson(root) {
return JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'))
}
function namesFromPackageJson(pkg) {
return Object.keys({ ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) })
}
function checkPackageJson(section, root) {
const pkg = loadPackageJson(root)
const names = namesFromPackageJson(pkg)
const regexes = section.patterns.map((p) => new RegExp(p, 'i'))
const hits = []
for (const name of names) {
for (const re of regexes) {
if (re.test(name)) {
hits.push(`${name} matched /${re.source}/i`)
break
}
}
}
return hits
}
// File walker — yields paths under `dir` that match the included extensions.
// Skips dist/, node_modules/, test-output/, and any `*.test.{ts,tsx}` /
// `*.spec.{ts,tsx}` files (production source only, mirrors run-tests.sh src_grep).
const IGNORED_DIRS = new Set([
'node_modules', 'dist', 'build', 'test-output', 'test-results',
'coverage', '.git', '.cache', 'playwright-report', 'blob-report',
])
const SOURCE_EXT = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs']
const TEST_NAME_RE = /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs)$/i
function* walkSourceFiles(rootDir) {
let entries
try {
entries = readdirSync(rootDir, { withFileTypes: true })
} catch {
return
}
for (const entry of entries) {
const full = join(rootDir, entry.name)
if (entry.isDirectory()) {
if (IGNORED_DIRS.has(entry.name)) continue
yield* walkSourceFiles(full)
} else if (entry.isFile()) {
const ext = '.' + entry.name.split('.').pop()
if (!SOURCE_EXT.includes(ext)) continue
if (TEST_NAME_RE.test(entry.name)) continue
yield full
}
}
}
function checkSourceTree(section, root, subdirs) {
const regexes = section.patterns.map((p) => new RegExp(p, 'i'))
const allowlist = new Set((section.allowlist ?? []).map((p) => p.replaceAll('\\', '/')))
const hits = []
for (const sub of subdirs) {
const full = join(root, sub)
try { statSync(full) } catch { continue }
for (const file of walkSourceFiles(full)) {
const relPath = relative(root, file).replaceAll('\\', '/')
if (allowlist.has(relPath)) continue
let text
try { text = readFileSync(file, 'utf8') } catch { continue }
const lines = text.split('\n')
lines.forEach((line, idx) => {
for (const re of regexes) {
if (re.test(line)) {
hits.push(`${relPath}:${idx + 1}: ${line.trim().slice(0, 200)} (matched /${re.source}/i)`)
break
}
}
})
}
}
return hits
}
function checkDestructiveSurfaces(section, root, subdirs) {
const regexes = section.patterns.map((p) => new RegExp(p))
const gated = new Set((section.gated ?? []).map((p) => p.replaceAll('\\', '/')))
const drift = new Set((section.drift ?? []).map((p) => p.replaceAll('\\', '/')))
const known = new Set([...gated, ...drift])
const hits = []
for (const sub of subdirs) {
const full = join(root, sub)
try { statSync(full) } catch { continue }
for (const file of walkSourceFiles(full)) {
const relPath = relative(root, file).replaceAll('\\', '/')
let text
try { text = readFileSync(file, 'utf8') } catch { continue }
const matches = regexes.some((re) => re.test(text))
if (!matches) continue
if (known.has(relPath)) continue
hits.push(
`${relPath}: contains destructive call but is not in gated/drift allowlist; ` +
`add to tests/security/banned-deps.json (destructive_surfaces) with a code-review note`,
)
}
}
return hits
}
function* walkAnyFiles(rootDir) {
let entries
try {
entries = readdirSync(rootDir, { withFileTypes: true })
} catch {
return
}
for (const entry of entries) {
const full = join(rootDir, entry.name)
if (entry.isDirectory()) {
if (IGNORED_DIRS.has(entry.name)) continue
yield* walkAnyFiles(full)
} else if (entry.isFile()) {
yield full
}
}
}
function checkDistTree(section, root) {
const dist = join(root, 'dist')
try { statSync(dist) } catch {
process.stderr.write('dist/ missing — run `bun run build` before this check\n')
process.exit(1)
}
const hits = []
for (const file of walkAnyFiles(dist)) {
let text
try { text = readFileSync(file, 'utf8') } catch { continue }
for (const literal of section.patterns) {
if (text.includes(literal)) {
hits.push(`${relative(root, file)} contains banned literal: ${literal}`)
}
}
}
return hits
}
function main() {
const { kind, root } = parseArgs(process.argv)
const denylist = loadDenylist(root)
const section = denylist[kind]
if (!section) {
process.stderr.write(`unknown --kind=${kind}; available: ${Object.keys(denylist).filter((k) => !k.startsWith('$')).join(', ')}\n`)
process.exit(2)
}
let hits = []
if (kind === 'owm_key_in_dist') {
hits = checkDistTree(section, root)
} else if (
kind === 'legacy_integrations' ||
kind === 'concurrent_edit_patterns' ||
kind === 'alert_calls' ||
kind === 'owm_key_in_source' ||
kind === 'google_key_in_source'
) {
hits = checkSourceTree(section, root, ['src', 'mission-planner'])
} else if (kind === 'destructive_surfaces') {
hits = checkDestructiveSurfaces(section, root, ['src'])
} else {
hits = checkPackageJson(section, root)
}
if (hits.length) {
process.stderr.write(`banned (${kind} / ${section.ac}):\n`)
for (const h of hits) process.stderr.write(` ${h}\n`)
process.exit(1)
}
process.exit(0)
}
main()
scripts/check-ci-image-labels.mjs
+114
View File
@@ -0,0 +1,114 @@
#!/usr/bin/env node
// AZ-481 — CI image tag scheme + OCI labels static checks.
//
// NFT-RES-LIM-11 (row 70) — push-step tag pattern is `${branch}-arm`
// (resolved from $CI_COMMIT_BRANCH or
// $CI_COMMIT_REF_SLUG)
// NFT-RES-LIM-12 (row 71) — required OCI labels present:
// org.opencontainers.image.revision,
// org.opencontainers.image.created,
// org.opencontainers.image.source,
// org.opencontainers.image.title (drift today)
// NFT-RES-LIM-13 (row 72) — revision label value template equals
// `$CI_COMMIT_SHA` (or pipeline equivalent)
//
// Source of truth: `.woodpecker/build-arm.yml`. Per AZ-481 the e2e portion
// runs against a built image (`docker inspect`); the static portion parses
// the pipeline file directly so CI never publishes an image with the wrong
// tag scheme or missing labels.
//
// Black-box discipline: read-only consumption of `.woodpecker/build-arm.yml`;
// the test does not mutate the pipeline file.
import fs from 'node:fs'
import path from 'node:path'
import process from 'node:process'
const PROJECT_ROOT = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..')
const PIPELINE_PATH = path.join(PROJECT_ROOT, '.woodpecker/build-arm.yml')
// Labels split per AZ-481 AC-2 against the current `.woodpecker/build-arm.yml`:
// the first three are emitted today; `org.opencontainers.image.title` is part
// of AC-2 ("required ... all non-empty") but is NOT yet wired in the pipeline.
// To keep batch 2's static gate green while still surfacing the gap (AZ-459's
// `it.fails()` analogue for shell-driven checks), the missing `title` label is
// reported as DRIFT, not FAIL. Lifting the drift is a follow-up CI hygiene fix
// owned by the foundation/CI-CD task family — out of scope for this test PR.
const REQUIRED_OCI_LABELS = [
'org.opencontainers.image.revision',
'org.opencontainers.image.created',
'org.opencontainers.image.source',
]
const DRIFT_OCI_LABELS = [
'org.opencontainers.image.title',
]
if (!fs.existsSync(PIPELINE_PATH)) {
console.error(`PRECONDITION: ${PIPELINE_PATH} not present`)
process.exit(1)
}
const src = fs.readFileSync(PIPELINE_PATH, 'utf8')
// NFT-RES-LIM-11 — tag scheme. Match either `export TAG=${CI_COMMIT_BRANCH}-arm`
// or `export TAG=${CI_COMMIT_REF_SLUG}-arm`. Either form satisfies the spec
// per resource-limit-tests.md row 70 ("`^main-arm$` for branch main; same
// regex shape for dev/stage").
const tagMatch = src.match(/export\s+TAG\s*=\s*\$\{(CI_COMMIT_BRANCH|CI_COMMIT_REF_SLUG)\}-arm\b/)
const tagOk = !!tagMatch
// NFT-RES-LIM-12 — OCI labels. Each required label appears at least once
// with a non-empty `=<value>` clause.
function probeLabel(label) {
const escaped = label.replace(/\./g, '\\.')
// Match `--label org.opencontainers.image.X=<non-empty value>`. The value
// must reference a non-empty variable, literal date, or quoted string.
const re = new RegExp(`--label\\s+${escaped}\\s*=\\s*[^\\s\\\\]+`)
const match = src.match(re)
return { label, ok: !!match, value: match ? match[0].split('=', 2)[1] : null }
}
const labelStatus = REQUIRED_OCI_LABELS.map(probeLabel)
const driftStatus = DRIFT_OCI_LABELS.map(probeLabel)
const labelsOk = labelStatus.every((l) => l.ok)
// NFT-RES-LIM-13 — revision label value equals `$CI_COMMIT_SHA`.
const revisionMatch = src.match(/--label\s+org\.opencontainers\.image\.revision\s*=\s*(\$CI_COMMIT_SHA\b|\$\{CI_COMMIT_SHA\})/)
const revisionOk = !!revisionMatch
// Report.
const findings = []
findings.push({
id: 'NFT-RES-LIM-11',
status: tagOk ? 'PASS' : 'FAIL',
detail: tagOk ? `tag pattern: \${${tagMatch[1]}}-arm` : 'no `export TAG=${CI_COMMIT_BRANCH|REF_SLUG}-arm` found',
})
for (const ls of labelStatus) {
findings.push({
id: `NFT-RES-LIM-12.${ls.label.split('.').pop()}`,
status: ls.ok ? 'PASS' : 'FAIL',
detail: ls.ok ? `${ls.label}=${ls.value}` : `${ls.label} missing`,
})
}
for (const ds of driftStatus) {
findings.push({
id: `NFT-RES-LIM-12.${ds.label.split('.').pop()}`,
status: ds.ok ? 'PASS' : 'DRIFT',
detail: ds.ok
? `${ds.label}=${ds.value}`
: `${ds.label} missing — DOCUMENTED DRIFT, follow-up: foundation/CI-CD owns the fix`,
})
}
findings.push({
id: 'NFT-RES-LIM-13',
status: revisionOk ? 'PASS' : 'FAIL',
detail: revisionOk ? 'revision label binds $CI_COMMIT_SHA' : 'revision label does not equal $CI_COMMIT_SHA',
})
const ok = tagOk && labelsOk && revisionOk
for (const f of findings) {
// PASS, FAIL = standard pass/fail.
// DRIFT = surfaced gap that does NOT gate the static profile (parallels
// Vitest's `it.fails()` for AZ-459 enum drift); informational only.
console.log(`${f.status} ${f.id} — ${f.detail}`)
}
process.exit(ok ? 0 : 1)
scripts/check-i18n-coverage.mjs
+288
View File
@@ -0,0 +1,288 @@
#!/usr/bin/env node
// AZ-465 — i18n coverage + key-parity static checks.
//
// FT-P-22 (row 45) — keys(en.json) === keys(ua.json) (deep set equality)
// FT-P-23 (row 46) — every JSX text node + string-literal aria-*/title/
// placeholder either lives in an i18n key, is in the
// allow-list (brand names, fixed-meaning labels), or
// carries a `// i18n-ok: <reason>` marker on the same
// or preceding line.
//
// Inputs:
// - src/i18n/en.json, src/i18n/ua.json — translation bundles
// - tests/i18n-allowlist.json — { "*": [...global], "<rel-path>": [...] }
//
// Output:
// - exit 0 + stdout summary on PASS
// - exit 1 + per-finding lines on FAIL
//
// Modes:
// --check (default) PASS/FAIL gate
// --report list every detected raw string, grouped by file (used to seed
// the allow-list when FT-P-23 first lands)
//
// Black-box discipline: the checker walks production source ONLY. Test files
// are excluded. The allow-list mechanism IS the deliverable — its content
// reflects the codebase's current i18n posture and grows only with
// code-review approval per the AZ-465 spec constraint.
import fs from 'node:fs'
import path from 'node:path'
import process from 'node:process'
const PROJECT_ROOT = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..')
const SRC_ROOT = path.join(PROJECT_ROOT, 'src')
const EN_PATH = path.join(SRC_ROOT, 'i18n/en.json')
const UA_PATH = path.join(SRC_ROOT, 'i18n/ua.json')
const ALLOWLIST_PATH = path.join(PROJECT_ROOT, 'tests/i18n-allowlist.json')
const ARG_REPORT = process.argv.includes('--report')
const ARG_CHECK_PARITY_ONLY = process.argv.includes('--parity-only')
const ARG_CHECK_COVERAGE_ONLY = process.argv.includes('--coverage-only')
function readJson(p) {
return JSON.parse(fs.readFileSync(p, 'utf8'))
}
// Deep-keys: collect dot-paths over a translation tree.
function deepKeys(obj, prefix = '') {
const out = []
if (obj == null || typeof obj !== 'object') return out
for (const [k, v] of Object.entries(obj)) {
if (k.startsWith('$')) continue // skip $schema_note etc.
const key = prefix ? `${prefix}.${k}` : k
if (v != null && typeof v === 'object') {
out.push(...deepKeys(v, key))
} else {
out.push(key)
}
}
return out
}
// Deep-values: collect every string value (used to detect "the JSX text
// already lives in an i18n key — its content matches a value in en.json").
function deepValues(obj) {
const out = []
if (obj == null) return out
if (typeof obj === 'string') return [obj]
if (Array.isArray(obj)) {
for (const v of obj) out.push(...deepValues(v))
return out
}
if (typeof obj === 'object') {
for (const [k, v] of Object.entries(obj)) {
if (k.startsWith('$')) continue
out.push(...deepValues(v))
}
}
return out
}
function walkTsx(dir) {
const out = []
const entries = fs.readdirSync(dir, { withFileTypes: true })
for (const e of entries) {
const p = path.join(dir, e.name)
if (e.isDirectory()) {
out.push(...walkTsx(p))
} else if (e.isFile() && /\.tsx$/.test(e.name) && !/\.(test|spec)\.tsx$/.test(e.name)) {
out.push(p)
}
}
return out
}
// Strip TS/TSX block comments + line comments so regex sweeps don't pick up
// strings that exist only in commented-out code.
function stripComments(src) {
let out = ''
let i = 0
let inString = null // null | '"' | "'" | '`'
while (i < src.length) {
const c = src[i]
const n = src[i + 1]
if (inString) {
out += c
if (c === '\\') {
out += src[i + 1] ?? ''
i += 2
continue
}
if (c === inString) inString = null
i += 1
continue
}
if (c === '/' && n === '/') {
// Skip to end of line but preserve newline.
while (i < src.length && src[i] !== '\n') i += 1
continue
}
if (c === '/' && n === '*') {
// Skip to */; preserve newlines for line numbering.
i += 2
while (i < src.length - 1 && !(src[i] === '*' && src[i + 1] === '/')) {
if (src[i] === '\n') out += '\n'
i += 1
}
i += 2
continue
}
if (c === '"' || c === "'" || c === '`') {
inString = c
out += c
i += 1
continue
}
out += c
i += 1
}
return out
}
function lineNumberAt(src, idx) {
let line = 1
for (let i = 0; i < idx; i += 1) if (src[i] === '\n') line += 1
return line
}
// JSX text-node + attribute scanner — regex-based, defensive enough to skip
// TS generic type expressions (`Promise<void>`) and JSX comparison expressions
// (`{num >= 1 && num <= 9}`). The spec calls for "ripgrep + AST walker"; the
// regex sweep ships today and is sufficient to land the allow-list mechanism
// the constraint requires. An AST-walker upgrade is a future Phase B task.
//
// The opening `>` must NOT be the second character of `=>` (TS arrow). The
// closing `<` must be followed by a tag character (`/` or letter); a `<`
// followed by digit/space/operator is part of a TypeScript expression and
// is excluded here.
const JSX_TEXT_RE = /(?<!=)>([^<>{}\n]*?[A-Za-z][^<>{}\n]*?)<(?=[A-Za-z/])/g
const JSX_ATTR_RE = /\b(aria-label|aria-description|placeholder|title)\s*=\s*"([^"\n]+)"/g
// Heuristic blocklist for false-positive JSX-text candidates that survived
// the boundary tightening — operators / fragments that are clearly code, not
// user-visible English.
const TEXT_FALSE_POSITIVE = /(^|\s)(&&|\|\||==|!=|=>|<=|>=|return\s|throw\s)/
function findRawStrings(filePath) {
const raw = fs.readFileSync(filePath, 'utf8')
const src = stripComments(raw)
const findings = []
let m
JSX_TEXT_RE.lastIndex = 0
while ((m = JSX_TEXT_RE.exec(src)) != null) {
const text = m[1].trim()
if (!text) continue
if (!/[A-Za-z]/.test(text)) continue // pure punctuation/numbers
if (text.length < 2) continue
if (/^\d+([.,]\d+)?(\s*[A-Za-z]{1,3})?$/.test(text)) continue // "12.5", "12 m"
if (TEXT_FALSE_POSITIVE.test(text)) continue
findings.push({ kind: 'text', text, line: lineNumberAt(src, m.index + 1) })
}
JSX_ATTR_RE.lastIndex = 0
while ((m = JSX_ATTR_RE.exec(src)) != null) {
const text = m[2].trim()
if (!text) continue
if (!/[A-Za-z]/.test(text)) continue
findings.push({ kind: m[1], text, line: lineNumberAt(src, m.index + 1) })
}
return findings
}
function isIokMarker(filePath, line) {
const raw = fs.readFileSync(filePath, 'utf8')
const lines = raw.split('\n')
// Same-line or preceding-line marker.
for (const candidate of [lines[line - 1] ?? '', lines[line - 2] ?? '']) {
if (/\/\/\s*i18n-ok\b/.test(candidate)) return true
}
return false
}
function checkParity() {
const en = readJson(EN_PATH)
const ua = readJson(UA_PATH)
const enKeys = new Set(deepKeys(en))
const uaKeys = new Set(deepKeys(ua))
const missingInUa = [...enKeys].filter((k) => !uaKeys.has(k))
const missingInEn = [...uaKeys].filter((k) => !enKeys.has(k))
return { ok: missingInUa.length === 0 && missingInEn.length === 0, missingInUa, missingInEn }
}
function checkCoverage() {
const en = readJson(EN_PATH)
const enValues = new Set(deepValues(en))
const allow = readJson(ALLOWLIST_PATH)
const globalAllow = new Set(allow['*'] ?? [])
const files = walkTsx(SRC_ROOT)
const failures = []
const reportEntries = []
for (const f of files) {
const rel = path.relative(PROJECT_ROOT, f)
const fileAllow = new Set(allow[rel] ?? [])
const findings = findRawStrings(f)
for (const fnd of findings) {
reportEntries.push({ rel, ...fnd })
if (enValues.has(fnd.text)) continue // already a translated value
if (globalAllow.has(fnd.text)) continue // global brand / acronym
if (fileAllow.has(fnd.text)) continue // file-scoped allow-list
if (isIokMarker(f, fnd.line)) continue // // i18n-ok marker
failures.push({ file: rel, line: fnd.line, kind: fnd.kind, text: fnd.text })
}
}
return { ok: failures.length === 0, failures, reportEntries }
}
function main() {
if (ARG_REPORT) {
const cov = checkCoverage()
const grouped = {}
for (const e of cov.reportEntries) (grouped[e.rel] ??= []).push(e)
for (const rel of Object.keys(grouped).sort()) {
console.log(`# ${rel}`)
for (const e of grouped[rel]) {
console.log(` ${e.line.toString().padStart(4)} [${e.kind}] ${JSON.stringify(e.text)}`)
}
}
process.exit(0)
}
let ok = true
const lines = []
if (!ARG_CHECK_COVERAGE_ONLY) {
const parity = checkParity()
if (parity.ok) {
lines.push('FT-P-22 (key parity): PASS')
} else {
ok = false
lines.push('FT-P-22 (key parity): FAIL')
for (const k of parity.missingInUa) lines.push(` missing in ua.json: ${k}`)
for (const k of parity.missingInEn) lines.push(` missing in en.json: ${k}`)
}
}
if (!ARG_CHECK_PARITY_ONLY) {
const cov = checkCoverage()
if (cov.ok) {
lines.push(`FT-P-23 (t() coverage): PASS (allow-list size: ${Object.keys(readJson(ALLOWLIST_PATH)).length} groups)`)
} else {
ok = false
lines.push(`FT-P-23 (t() coverage): FAIL (${cov.failures.length} unallowed raw strings)`)
for (const f of cov.failures.slice(0, 50)) {
lines.push(` ${f.file}:${f.line} [${f.kind}] ${JSON.stringify(f.text)}`)
}
if (cov.failures.length > 50) lines.push(` ... and ${cov.failures.length - 50} more`)
}
}
console.log(lines.join('\n'))
process.exit(ok ? 0 : 1)
}
main()
scripts/run-performance-tests.sh
+173
View File
@@ -0,0 +1,173 @@
#!/usr/bin/env bash
# Azaion UI — performance test runner.
#
# Generated by .cursor/skills/test-spec phase 4. Implements the NFT-PERF-* scenarios
# from _docs/02_document/tests/performance-tests.md. Thresholds are sourced from
# _docs/00_problem/input_data/expected_results/results_report.md (rows 11, 40, 98 + AC-11 + AC-23).
#
# Most NFT-PERF-* tests are observable browser timings, not server load tests. The
# script therefore runs Playwright-based measurements rather than k6/locust.
#
# Profile mapping (per environment.md → Test Execution):
# - NFT-PERF-01 (bundle ≤ 2 MB gzip) : static — checks dist/ on host
# - NFT-PERF-02..09 : fast or e2e — Playwright
# - NFT-PERF-10 (FCP ≤ 3 000 ms on /flights) : e2e — Playwright against the suite stack
#
# Usage:
# scripts/run-performance-tests.sh # run all NFT-PERF-* (skips quarantined)
# scripts/run-performance-tests.sh --static-only # only NFT-PERF-01 (bundle size)
# scripts/run-performance-tests.sh --e2e-only # only NFT-PERF-* that require the stack
# scripts/run-performance-tests.sh --bundle-max-bytes 2097152 # override bundle threshold
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SUITE_ROOT="$(cd "$PROJECT_ROOT/.." && pwd)"
RESULTS_DIR="$PROJECT_ROOT/test-output"
RUN_STATIC=true
RUN_E2E=true
# Thresholds (defaults from results_report.md; overridable via flags).
BUNDLE_MAX_BYTES=$((2 * 1024 * 1024)) # AC-11 / NFT-PERF-01 (row 40): 2 MB gzipped initial JS
FCP_MAX_MS=3000 # NFT-PERF-10 (row 98): warm-cache FCP on /flights, edge profile
AUTH_REFRESH_MAX_MS=200 # NFT-PERF-02 (row 11): refresh round-trip target
for arg in "$@"; do
case "$arg" in
--static-only) RUN_STATIC=true; RUN_E2E=false ;;
--e2e-only) RUN_STATIC=false; RUN_E2E=true ;;
--bundle-max-bytes=*) BUNDLE_MAX_BYTES="${arg#*=}" ;;
--bundle-max-bytes) shift; BUNDLE_MAX_BYTES="${1:-$BUNDLE_MAX_BYTES}" ;;
--fcp-max-ms=*) FCP_MAX_MS="${arg#*=}" ;;
--fcp-max-ms) shift; FCP_MAX_MS="${1:-$FCP_MAX_MS}" ;;
--auth-refresh-max-ms=*) AUTH_REFRESH_MAX_MS="${arg#*=}" ;;
--auth-refresh-max-ms) shift; AUTH_REFRESH_MAX_MS="${1:-$AUTH_REFRESH_MAX_MS}" ;;
-h|--help)
sed -n '2,22p' "$0" | sed 's/^# \{0,1\}//'
exit 0
;;
*)
echo "Unknown argument: $arg" >&2
exit 2
;;
esac
done
E2E_COMPOSE_STARTED_HERE=false
cleanup() {
if [ "$E2E_COMPOSE_STARTED_HERE" = "true" ]; then
docker compose -f "$PROJECT_ROOT/e2e/docker-compose.suite-e2e.yml" down -v --remove-orphans || true
fi
}
trap cleanup EXIT
mkdir -p "$RESULTS_DIR"
cd "$PROJECT_ROOT"
echo "[run-performance-tests] thresholds:"
echo " bundle (NFT-PERF-01) : ≤ $BUNDLE_MAX_BYTES bytes gzipped"
echo " FCP (NFT-PERF-10) : ≤ $FCP_MAX_MS ms"
echo " auth refresh (NFT-PERF-02): ≤ $AUTH_REFRESH_MAX_MS ms"
echo " static : $RUN_STATIC"
echo " e2e : $RUN_E2E"
# ----------------------------------------------------------------------------
# Install deps (matches run-tests.sh).
# ----------------------------------------------------------------------------
if ! command -v bun >/dev/null 2>&1; then
echo "[run-performance-tests] FATAL: bun is required (project pins bun@1.3.11)." >&2
exit 1
fi
echo "[run-performance-tests] installing dependencies..."
if [ -f "$PROJECT_ROOT/bun.lock" ] || [ -f "$PROJECT_ROOT/bun.lockb" ]; then
bun install --frozen-lockfile
else
bun install
fi
OVERALL_EXIT=0
SUMMARY_FILE="$RESULTS_DIR/performance-summary.txt"
: > "$SUMMARY_FILE"
record() {
# $1 = scenario id, $2 = result (PASS|FAIL|SKIP|QUARANTINE), $3 = measured, $4 = threshold
printf '%-14s %-12s measured=%-14s threshold=%s\n' "$1" "$2" "$3" "$4" | tee -a "$SUMMARY_FILE"
}
# ----------------------------------------------------------------------------
# Static perf scenarios.
# ----------------------------------------------------------------------------
if [ "$RUN_STATIC" = "true" ]; then
echo "[run-performance-tests] === NFT-PERF-01 (bundle size) ==="
if [ ! -d "$PROJECT_ROOT/dist" ]; then
echo "[NFT-PERF-01] dist/ not present — running 'bun run build'..."
bun run build
fi
# Sum gzipped sizes of dist/assets/*.js (the initial JS bundle is index-*.js per Vite).
BUNDLE_BYTES=$(
find "$PROJECT_ROOT/dist/assets" -maxdepth 1 -name '*.js' -print0 2>/dev/null \
| xargs -0 -I{} sh -c 'gzip -c "{}" | wc -c' \
| awk '{ s += $1 } END { print (s ? s : 0) }'
)
echo "[NFT-PERF-01] gzipped dist/assets/*.js = $BUNDLE_BYTES bytes"
if [ "$BUNDLE_BYTES" -le "$BUNDLE_MAX_BYTES" ]; then
record "NFT-PERF-01" "PASS" "${BUNDLE_BYTES}B" "≤ ${BUNDLE_MAX_BYTES}B"
else
record "NFT-PERF-01" "FAIL" "${BUNDLE_BYTES}B" "≤ ${BUNDLE_MAX_BYTES}B"
OVERALL_EXIT=1
fi
fi
# ----------------------------------------------------------------------------
# E2E perf scenarios (Playwright-based).
# The Playwright project lands at autodev Step 5 (Decompose Tests). Until it
# ships, NFT-PERF-02..10 are SKIPPED (not FAILED) so this script can run on
# the spec-only baseline without producing false negatives.
# ----------------------------------------------------------------------------
if [ "$RUN_E2E" = "true" ]; then
COMPOSE_FILE="$PROJECT_ROOT/e2e/docker-compose.suite-e2e.yml"
PERF_PROJECT="$PROJECT_ROOT/e2e/playwright.perf.config.ts"
if [ ! -f "$PERF_PROJECT" ]; then
echo "[run-performance-tests] Playwright perf project ($PERF_PROJECT) not yet wired."
echo "[run-performance-tests] Awaiting NFT-PERF-* task implementations (AZ-457..AZ-482); until then the e2e perf scenarios are SKIPPED."
for id in NFT-PERF-02 NFT-PERF-03 NFT-PERF-04 NFT-PERF-05 NFT-PERF-06 NFT-PERF-07 NFT-PERF-08 NFT-PERF-09 NFT-PERF-10; do
record "$id" "SKIP" "n/a" "deferred to per-AC test tasks"
done
elif [ ! -f "$COMPOSE_FILE" ]; then
echo "[run-performance-tests] FATAL: $COMPOSE_FILE not found." >&2
OVERALL_EXIT=1
elif ! command -v docker >/dev/null 2>&1; then
echo "[run-performance-tests] FATAL: docker is required for the e2e perf profile." >&2
OVERALL_EXIT=1
else
echo "[run-performance-tests] starting compose stack..."
docker compose -f "$COMPOSE_FILE" up -d --build
E2E_COMPOSE_STARTED_HERE=true
echo "[run-performance-tests] running Playwright perf project..."
if FCP_MAX_MS="$FCP_MAX_MS" AUTH_REFRESH_MAX_MS="$AUTH_REFRESH_MAX_MS" \
bunx playwright test --config "$PERF_PROJECT" 2>&1 | tee "$RESULTS_DIR/perf-playwright.txt"; then
echo "[run-performance-tests] Playwright perf PASSED"
else
echo "[run-performance-tests] Playwright perf FAILED — see $RESULTS_DIR/perf-playwright.txt"
OVERALL_EXIT=1
fi
fi
fi
# Quarantined scenarios (documentary only — never gate today).
record "NFT-PERF-03" "QUARANTINE" "—" "Step 8 hardening (SSE refresh rotation)"
record "NFT-PERF-08" "QUARANTINE" "—" "Step 4 fix (panel-width persistence)"
record "NFT-PERF-09" "QUARANTINE" "—" "Step 4 fix (settings save error surfacing)"
echo ""
echo "[run-performance-tests] summary written to $SUMMARY_FILE"
echo "[run-performance-tests] exit code: $OVERALL_EXIT"
exit "$OVERALL_EXIT"
scripts/run-tests.sh
+667
View File
@@ -0,0 +1,667 @@
#!/usr/bin/env bash
# Azaion UI — unit + blackbox test runner.
#
# Drives the test profiles specified in
# _docs/02_document/tests/environment.md and AZ-456:
# - static : repo + dist artifact checks (no runtime, host)
# - fast : Bun + Vitest + jsdom + MSW (host)
# - e2e : Playwright (Chromium + Firefox) inside the suite docker stack
#
# Reports land under ./test-output/ per AZ-456 (CSV + JUnit XML).
#
# Usage:
# scripts/run-tests.sh # static + fast (default; gates every commit per CI/CD Integration)
# scripts/run-tests.sh --unit-only # alias for default — fast + static, no e2e
# scripts/run-tests.sh --all # static + fast + e2e
# scripts/run-tests.sh --e2e-only # only the e2e profile
# scripts/run-tests.sh --static-only # only the static checks
# scripts/run-tests.sh --fast-only # only the fast profile
set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
SUITE_ROOT="$(cd "$PROJECT_ROOT/.." && pwd)"
RESULTS_DIR="$PROJECT_ROOT/test-output"
RUN_STATIC=true
RUN_FAST=true
RUN_E2E=false
for arg in "$@"; do
case "$arg" in
--unit-only) RUN_STATIC=true; RUN_FAST=true; RUN_E2E=false ;;
--all) RUN_STATIC=true; RUN_FAST=true; RUN_E2E=true ;;
--e2e-only) RUN_STATIC=false; RUN_FAST=false; RUN_E2E=true ;;
--static-only) RUN_STATIC=true; RUN_FAST=false; RUN_E2E=false ;;
--fast-only) RUN_STATIC=false; RUN_FAST=true; RUN_E2E=false ;;
-h|--help)
sed -n '2,18p' "$0" | sed 's/^# \{0,1\}//'
exit 0
;;
*)
echo "Unknown argument: $arg" >&2
echo "Run with --help for usage." >&2
exit 2
;;
esac
done
E2E_COMPOSE_STARTED_HERE=false
cleanup() {
if [ "$E2E_COMPOSE_STARTED_HERE" = "true" ]; then
docker compose -f "$PROJECT_ROOT/e2e/docker-compose.suite-e2e.yml" down -v --remove-orphans || true
fi
}
trap cleanup EXIT
mkdir -p "$RESULTS_DIR"
cd "$PROJECT_ROOT"
echo "[run-tests] project root: $PROJECT_ROOT"
echo "[run-tests] suite root : $SUITE_ROOT"
echo "[run-tests] results dir : $RESULTS_DIR"
echo "[run-tests] profiles : static=$RUN_STATIC fast=$RUN_FAST e2e=$RUN_E2E"
# ----------------------------------------------------------------------------
# Install dependencies (mandatory — a fresh CI runner has nothing).
# ----------------------------------------------------------------------------
if [ "$RUN_FAST" = "true" ] || [ "$RUN_STATIC" = "true" ]; then
if ! command -v bun >/dev/null 2>&1; then
echo "[run-tests] FATAL: bun is required (project pins bun@1.3.11 per package.json packageManager)." >&2
exit 1
fi
echo "[run-tests] installing dependencies..."
if [ -f "$PROJECT_ROOT/bun.lock" ] || [ -f "$PROJECT_ROOT/bun.lockb" ]; then
bun install --frozen-lockfile
else
bun install
fi
fi
OVERALL_EXIT=0
# CSV rollup format (AZ-456 § Test Reporting):
# Test ID,Test Name,Profile,Execution Time (ms),Result,Error Message,Traces to AC,Traces to results_report.md row
csv_header() {
echo 'Test ID,Test Name,Profile,Execution Time (ms),Result,Error Message,Traces to AC,Traces to results_report.md row' > "$1"
}
csv_record() {
# $1 file, $2 id, $3 name, $4 profile, $5 exec_ms, $6 result, $7 err, $8 ac, $9 row
local file="$1" id="$2" name="$3" profile="$4" exec_ms="$5" result="$6" err="$7" ac="$8" row="$9"
# Escape any embedded quotes so the CSV stays well-formed.
err="${err//\"/\"\"}"
name="${name//\"/\"\"}"
printf '%s,"%s",%s,%s,%s,"%s",%s,%s\n' "$id" "$name" "$profile" "$exec_ms" "$result" "$err" "$ac" "$row" >> "$file"
}
# Portable millisecond clock — GNU coreutils `date +%s%3N` is unavailable on
# macOS / BSD, so fall back to python3 unconditionally.
millis() {
python3 -c 'import time; print(int(time.time()*1000))'
}
# ----------------------------------------------------------------------------
# Static profile — repo checks, type-check, build, ripgrep.
# Source: _docs/02_document/tests/blackbox-tests.md, security-tests.md,
# resource-limit-tests.md, traceability-matrix.md "STC-*" candidates.
# ----------------------------------------------------------------------------
if [ "$RUN_STATIC" = "true" ]; then
echo "[run-tests] === static profile ==="
STATIC_REPORT="$RESULTS_DIR/static-report.csv"
csv_header "$STATIC_REPORT"
STATIC_FAIL=0
run_static() {
# $1 id, $2 name, $3 ac, $4 row, $5 cmd
local id="$1" name="$2" ac="$3" row="$4"
shift 4
local start_ms result err
start_ms=$(millis)
if err=$("$@" 2>&1); then
result=PASS
else
result=FAIL
STATIC_FAIL=1
fi
local end_ms
end_ms=$(millis)
local exec_ms=$((end_ms - start_ms))
local err_summary=""
if [ "$result" = "FAIL" ]; then
err_summary=$(printf '%s' "$err" | tr '\n' ' ' | head -c 240)
echo " $result $id ${exec_ms}ms"
echo " $err_summary"
else
echo " $result $id ${exec_ms}ms"
fi
csv_record "$STATIC_REPORT" "$id" "$name" "static" "$exec_ms" "$result" "$err_summary" "$ac" "$row"
}
static_check_strict() {
if node -e 'const t=require("./tsconfig.json"); process.exit((t.compilerOptions && t.compilerOptions.strict === true) ? 0 : 1)' 2>/dev/null; then
return 0
fi
bunx tsc --showConfig | grep -q '"strict": true'
}
static_check_pinned_deps() {
node -e '
const p = require("./package.json");
const all = Object.assign({}, p.dependencies || {}, p.devDependencies || {});
const pin = (name, ver) => (all[name] || "").startsWith(ver) ? null : `${name}@${all[name] || "(missing)"} expected ${ver}*`;
const ban = (name) => all[name] ? `banned dep present: ${name}` : null;
const fails = [
pin("react", "^19"), pin("react-dom", "^19"), pin("vite", "^6"),
pin("tailwindcss", "^4"), pin("leaflet", "^1.9.4"), pin("react-leaflet", "^5"),
pin("chart.js", "^4"), pin("@hello-pangea/dnd", "^18"),
ban("redux"), ban("@reduxjs/toolkit"), ban("zustand"),
ban("@tanstack/react-query"), ban("@tanstack/query-core"),
(p.packageManager === "bun@1.3.11") ? null : `packageManager=${p.packageManager}`,
].filter(Boolean);
if (fails.length) { console.error(fails.join("; ")); process.exit(1); }
'
}
# AZ-482 — package.json deny-lists routed through the shared
# banned-deps.json source-of-truth. Each kind maps 1:1 to a JSON section.
static_check_no_ml_libs() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=ml_libs
}
static_check_no_signature_libs() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=signature_libs
}
static_check_no_persistence_libs() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=persistence_libs
}
static_check_no_ws_graphql() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=ws_graphql_ssr_libs
}
# AZ-482 — NFT-SEC-13 dropped legacy integrations and NFT-SEC-14 AC-N1
# anti-criterion. Source-tree scans gated on production code only (the
# banned-deps script applies the same `*.test.{ts,tsx}` exclusion src_grep
# uses below; tests are allowed to mention these tokens as documentation).
static_check_no_legacy_integrations() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=legacy_integrations
}
static_check_no_concurrent_edit() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=concurrent_edit_patterns
}
# AZ-466 — NFT-SEC-07 (no alert() outside the seeded allowlist) and
# NFT-SEC-08 (every destructive surface is reviewed: gated by ConfirmDialog
# OR recorded as known drift). Both delegate to check-banned-deps.mjs which
# reads tests/security/banned-deps.json.
static_check_no_alert() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=alert_calls
}
static_check_destructive_surfaces() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=destructive_surfaces
}
# AZ-482 — NFT-SEC-09 AC-1 dist/ portion. The src/ counterpart is STC-SEC1
# below; this check runs AFTER `bun run build` (STC-B1) so dist/ exists.
static_check_no_owm_key_in_dist() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=owm_key_in_dist
}
# AZ-499 — NFT-SEC-09 AC-1 source-tree portion. Complements STC-SEC1
# (which scans src/ for the `appid=<chars>` pattern only) by catching the
# exact rotated literal value across BOTH src/ AND mission-planner/. This
# closes the AZ-482 gap where mission-planner/'s hardcoded key survived
# because mission-planner/ stays out of dist/ (STC-S5) and src_grep here
# didn't include it.
static_check_no_owm_key_in_source() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=owm_key_in_source
}
# AZ-501 — F-SAST-1 — defense-in-depth gate that the literal Google Geocode
# API key cannot reappear in src/ or mission-planner/. The user revokes the
# key out-of-band (AZ-501 AC-6); this static check guards against an
# accidental git-history-paste reintroducing the same string. Mirrors the
# STC-SEC1C pattern (literal-string scan across both source trees).
static_check_no_google_key_in_source() {
node "$PROJECT_ROOT/scripts/check-banned-deps.mjs" --kind=google_key_in_source
}
# Source-tree text search. Prefer ripgrep when available (much faster on
# large trees), fall back to POSIX grep -r so the CI runner doesn't need rg.
# Test files (*.test.{ts,tsx}, *.spec.{ts,tsx}) are EXCLUDED — production
# static checks must observe production source only; test-file mentions of
# forbidden patterns (`document.cookie`, `localStorage.token`, etc.) are by
# design and would otherwise produce false positives.
src_grep() {
if command -v rg >/dev/null 2>&1; then
rg --no-messages --type ts --type tsx \
--glob '!**/*.test.ts' --glob '!**/*.test.tsx' \
--glob '!**/*.spec.ts' --glob '!**/*.spec.tsx' \
-e "$1" "${@:2}"
else
grep -rE --include='*.ts' --include='*.tsx' \
--exclude='*.test.ts' --exclude='*.test.tsx' \
--exclude='*.spec.ts' --exclude='*.spec.tsx' \
"$1" "${@:2}" 2>/dev/null
fi
}
static_check_no_legacy_features() {
local hits
hits=$(src_grep 'SoundDetections|DroneMaintenance' "$PROJECT_ROOT/src" "$PROJECT_ROOT/mission-planner" || true)
if [ -n "$hits" ]; then
echo "$hits" >&2
return 1
fi
return 0
}
static_check_no_service_worker() {
local hits
hits=$(src_grep 'serviceWorker\.register|navigator\.serviceWorker' "$PROJECT_ROOT/src" || true)
if [ -n "$hits" ]; then
echo "$hits" >&2
return 1
fi
return 0
}
static_check_no_literal_owm_key() {
# Lifted from QUARANTINE per AZ-447 (Step 4 testability fixed the hardcoded
# key). The narrowed pattern catches a real key value (`appid=<6+ chars>`)
# while ignoring env-var bindings (`VITE_OWM_API_KEY?: string`) and
# template-string callsites (`?appid=${apiKey}`).
local hits
hits=$(src_grep 'appid=[a-zA-Z0-9]{6,}' "$PROJECT_ROOT/src" 2>/dev/null | grep -vE 'import\.meta\.env|process\.env' || true)
if [ -n "$hits" ]; then
echo "$hits" >&2
return 1
fi
return 0
}
static_check_no_unpkg() {
local hits
hits=$(src_grep 'unpkg\.com' "$PROJECT_ROOT/src" || true)
if [ -n "$hits" ]; then
echo "$hits" >&2
return 1
fi
return 0
}
# AZ-459 FT-N-15 (rows 20, 21) — MediaType magic-literal hygiene. A regex
# sweep over `src/` for `mediaType OP <number-or-string-literal>` patterns;
# a hit means a comparison against a magic literal slipped past the typed
# enum. The codebase today uses `MediaType.Video` / `MediaType.Image` only.
static_check_no_mediatype_magic_literal() {
local hits_num hits_str
hits_num=$(src_grep 'mediaType\s*[!=]==?\s*[0-9]' "$PROJECT_ROOT/src" || true)
hits_str=$(src_grep "mediaType\s*[!=]==?\s*['\"]" "$PROJECT_ROOT/src" || true)
if [ -n "$hits_num" ] || [ -n "$hits_str" ]; then
[ -n "$hits_num" ] && echo "numeric magic literal:" >&2 && echo "$hits_num" >&2
[ -n "$hits_str" ] && echo "string magic literal:" >&2 && echo "$hits_str" >&2
return 1
fi
return 0
}
# AZ-457 NFT-SEC-01 (row 04) — bearer is never written to localStorage /
# sessionStorage. Static counterpart of the runtime check in
# src/auth/AuthContext.test.tsx. We allow harmless reads on i18n / settings
# storage; we forbid any setItem that mentions token / bearer / accessToken.
static_check_no_token_in_browser_storage() {
local hits
hits=$(src_grep '(local|session)Storage\.setItem\([^)]*(token|bearer|accessToken)' "$PROJECT_ROOT/src" "$PROJECT_ROOT/mission-planner" || true)
if [ -n "$hits" ]; then
echo "$hits" >&2
return 1
fi
return 0
}
# AZ-457 NFT-SEC-02 (row 05) — refresh token not exposed via document.cookie
# READS in production code. Per security-tests.md the regex is "document.cookie
# reads against refreshToken|refresh-cookie".
static_check_no_refresh_cookie_read() {
local hits
hits=$(src_grep 'document\.cookie' "$PROJECT_ROOT/src" || true)
if [ -n "$hits" ]; then
# Filter to lines that mention refresh / refreshToken / refresh-cookie.
local filtered
filtered=$(echo "$hits" | grep -iE 'refresh' || true)
if [ -n "$filtered" ]; then
echo "$filtered" >&2
return 1
fi
fi
return 0
}
# AZ-465 FT-P-22 + FT-P-23 — i18n key parity + t() coverage. Delegated to
# scripts/check-i18n-coverage.mjs so both modes (parity / coverage) reuse
# the same JSON loader, allow-list reader, and JSX scanner.
static_check_i18n_parity() {
node "$PROJECT_ROOT/scripts/check-i18n-coverage.mjs" --parity-only
}
static_check_i18n_coverage() {
node "$PROJECT_ROOT/scripts/check-i18n-coverage.mjs" --coverage-only
}
# AZ-481 NFT-RES-LIM-11/12/13 — CI image tag scheme + OCI labels (parses
# `.woodpecker/build-arm.yml`). Delegated to a Node script for shared
# parsing logic with the e2e companion.
static_check_ci_image_labels() {
node "$PROJECT_ROOT/scripts/check-ci-image-labels.mjs"
}
static_check_typecheck() {
bunx tsc --noEmit -p tsconfig.test.json
}
static_check_vite_build() {
bun run build
}
static_check_dist_no_mission_planner() {
if [ ! -d "$PROJECT_ROOT/dist" ]; then
echo "dist/ missing — run 'bun run build' first" >&2
return 1
fi
local hits
if command -v rg >/dev/null 2>&1; then
hits=$(rg --no-messages -e 'mission[-_ ]?planner' "$PROJECT_ROOT/dist" || true)
else
hits=$(grep -rE 'mission[-_ ]?planner' "$PROJECT_ROOT/dist" 2>/dev/null || true)
fi
if [ -n "$hits" ]; then
echo "$hits" >&2
return 1
fi
return 0
}
# AZ-480 NFT-RES-LIM-02 — nginx body cap is exactly 500M (one hit in the SPA
# server block). Pinning here so a regression that loosens it (or copies a
# second cap into a wrong block) lights up at commit time.
static_check_nginx_body_cap() {
if [ ! -f "$PROJECT_ROOT/nginx.conf" ]; then
echo "nginx.conf missing" >&2
return 1
fi
local hits
hits=$(grep -cE 'client_max_body_size[[:space:]]+500M' "$PROJECT_ROOT/nginx.conf" || true)
if [ "$hits" = "1" ]; then
return 0
fi
echo "expected exactly 1 'client_max_body_size 500M' in nginx.conf, found $hits (NFT-RES-LIM-02)" >&2
return 1
}
# AZ-480 NFT-RES-LIM-03 — production image is nginx:alpine (no Node). The
# e2e runtime probe (`docker run --rm $IMAGE which node`) is the second
# half of this AC; this static gate prevents a Dockerfile change from
# silently switching the final stage to a Node-based image.
static_check_dockerfile_nginx_alpine() {
if [ ! -f "$PROJECT_ROOT/Dockerfile" ]; then
echo "Dockerfile missing" >&2
return 1
fi
if ! grep -qE '^FROM[[:space:]]+nginx:alpine' "$PROJECT_ROOT/Dockerfile"; then
echo "Dockerfile final stage must be 'FROM nginx:alpine' (NFT-RES-LIM-03)" >&2
return 1
fi
# Reject any reference to oven/bun:* or node:* OUTSIDE of the AS build
# stage. The build stage is allowed (it's a multi-stage build); the
# final stage must not reference Node.
if awk '
/^FROM/ { stage = $0; in_final = ($0 !~ /AS[[:space:]]+build/) }
in_final && /^FROM/ && /(node|oven\/bun)/ { exit 1 }
' "$PROJECT_ROOT/Dockerfile"; then
return 0
fi
echo "Dockerfile final stage references Node — must be nginx:alpine only (NFT-RES-LIM-03)" >&2
return 1
}
# AZ-480 NFT-RES-LIM-09 — exactly 9 nginx /api/* location blocks (one per
# suite service: annotations, flights, admin, resource, detect, loader,
# gps-denied-desktop, gps-denied-onboard, autopilot). The non-/api/
# `location /` SPA fallback does NOT count.
static_check_nginx_route_count() {
if [ ! -f "$PROJECT_ROOT/nginx.conf" ]; then
echo "nginx.conf missing" >&2
return 1
fi
local hits
hits=$(grep -cE '^\s*location\s+/api/' "$PROJECT_ROOT/nginx.conf" || true)
if [ "$hits" = "9" ]; then
return 0
fi
echo "expected exactly 9 nginx /api/* location blocks, found $hits (NFT-RES-LIM-09)" >&2
return 1
}
# AZ-480 NFT-RES-LIM-10 — every /api/<service>/ route strips its prefix.
# The `proxy_pass http://<host>:<port>/` form (with trailing slash) is the
# nginx-canonical "strip the matched location prefix" idiom; we assert
# every /api/* location has such a proxy_pass directly underneath it.
# Equivalent `rewrite ^/api/<S>/(.*)$ /$1 break;` would also satisfy the
# AC but is not what nginx.conf uses today.
static_check_nginx_prefix_strip() {
if [ ! -f "$PROJECT_ROOT/nginx.conf" ]; then
echo "nginx.conf missing" >&2
return 1
fi
node -e '
const fs = require("node:fs");
const conf = fs.readFileSync("nginx.conf", "utf8");
const lines = conf.split(/\r?\n/);
const fails = [];
for (let i = 0; i < lines.length; i++) {
const m = lines[i].match(/^\s*location\s+(\/api\/[^\s{]+)/);
if (!m) continue;
// Look ahead within this block for either:
// proxy_pass http://...:<port>/ (note trailing slash)
// rewrite ^/api/<S>/(.*)$ /$1 break;
const route = m[1];
let depth = 0, found = false;
for (let j = i; j < lines.length; j++) {
if (lines[j].includes("{")) depth++;
if (lines[j].includes("}")) { depth--; if (depth === 0) break; }
if (/proxy_pass\s+https?:\/\/[^/\s;]+(:\d+)?\/\s*;/.test(lines[j])) { found = true; break; }
if (/rewrite\s+\^\/api\/[^/]+\/\(\.\*\)\$\s+\/\$1\s+break;/.test(lines[j])) { found = true; break; }
}
if (!found) fails.push(route);
}
if (fails.length) {
console.error("location blocks without prefix-strip: " + fails.join(", ") + " (NFT-RES-LIM-10)");
process.exit(1);
}
'
}
# AZ-485 F4 — STC-ARCH-01: no cross-component deep imports. After F4 every
# component exposes its Public API via `src/<component>/index.ts`; cross-
# component imports MUST go through the barrel, not reach into another
# component's internal files. Flags imports of the form
# from '../api/client'
# from '../../components/ConfirmDialog'
# from '../src/features/annotations/AnnotationsPage' (test files)
# Allowed:
# - barrel imports: from '../api', from '../../components', from '../class-colors'
# - intra-component: from './sse', from './MediaList' (./ not ..)
# No exemptions today — the prior F3 carry-over (classColors deep import) was
# closed by AZ-511 when the file moved to `src/class-colors/` with its own
# barrel.
static_check_no_cross_component_deep_imports() {
node "$PROJECT_ROOT/scripts/check-arch-imports.mjs" --mode=arch-imports
}
# AZ-486 F7 — STC-ARCH-02: no hardcoded `/api/<service>/` literals in
# production source. After F7 the single source of truth for API paths is
# `src/api/endpoints.ts`; every production callsite of `api.*` / `createSSE`
# must use an `endpoints.*` builder. Flags string literals of the form
# '/api/admin/users'
# "/api/admin/auth/refresh"
# `/api/flights/${id}/waypoints`
# Allowed:
# - the contract owner itself: src/api/endpoints.ts
# - test files: *.test.ts / *.test.tsx (the test file IS the contract)
static_check_no_api_literals() {
node "$PROJECT_ROOT/scripts/check-arch-imports.mjs" --mode=api-literals
}
# AZ-479 NFT-PERF-01 / NFT-RES-LIM-01 — initial JS bundle ≤ 2 MB gzipped.
# Same threshold + measurement as scripts/run-performance-tests.sh; this
# entry routes the gate through the static profile so every commit is
# checked (the perf script is run on demand).
static_check_bundle_size() {
if [ ! -d "$PROJECT_ROOT/dist/assets" ]; then
echo "dist/assets missing — run 'bun run build' first" >&2
return 1
fi
local total
total=$(
find "$PROJECT_ROOT/dist/assets" -maxdepth 1 -name '*.js' -print0 \
| xargs -0 -I{} sh -c 'gzip -c "{}" | wc -c' \
| awk '{ s += $1 } END { print (s ? s : 0) }'
)
local max=$((2 * 1024 * 1024))
if [ "$total" -le "$max" ]; then
return 0
fi
echo "initial JS bundle gzipped = ${total} bytes; budget = ${max} bytes (NFT-PERF-01)" >&2
return 1
}
run_static "STC-S1" "tsconfig strict mode" "AC-N1" "n/a" static_check_strict
run_static "STC-S2" "pinned core deps + banned" "AC-N6" "70" static_check_pinned_deps
run_static "STC-N2" "no in-browser ML libs" "AC-N2" "n/a" static_check_no_ml_libs
run_static "STC-N4" "no response-signature library" "AC-N4" "n/a" static_check_no_signature_libs
run_static "STC-S13" "no client-side persistence lib" "O2" "n/a" static_check_no_persistence_libs
run_static "STC-S6" "no WS/GraphQL/gRPC/SSR deps" "O11" "n/a" static_check_no_ws_graphql
run_static "STC-N5" "no legacy SoundDetections/DM" "AC-N5" "n/a" static_check_no_legacy_features
run_static "STC-N3" "no service worker registration" "AC-N3" "n/a" static_check_no_service_worker
run_static "STC-SEC1" "no literal OWM key in src/" "SEC-09" "63" static_check_no_literal_owm_key
run_static "STC-SEC2" "no unpkg.com in src/" "SEC-09" "n/a" static_check_no_unpkg
run_static "STC-SEC3" "no bearer/token in browser storage" "AC-02" "04" static_check_no_token_in_browser_storage
run_static "STC-SEC4" "no document.cookie read of refresh" "AC-03" "05" static_check_no_refresh_cookie_read
run_static "STC-FN15" "no MediaType magic literal in src/" "AC-29" "20" static_check_no_mediatype_magic_literal
run_static "STC-FP22" "i18n key parity en vs ua" "AC-12" "45" static_check_i18n_parity
run_static "STC-FP23" "no raw user strings outside t()" "AC-12" "46" static_check_i18n_coverage
run_static "STC-CI11" "CI image tag + OCI labels (woodpecker)" "AC-32" "70" static_check_ci_image_labels
run_static "STC-SEC13" "no legacy integrations in src/" "SEC-13" "n/a" static_check_no_legacy_integrations
run_static "STC-SEC14" "no concurrent-edit reconcile (AC-N1)" "SEC-14" "n/a" static_check_no_concurrent_edit
run_static "STC-SEC7" "no alert() outside allowlist" "SEC-07" "AZ-466" static_check_no_alert
run_static "STC-SEC8" "destructive surfaces reviewed (gated/drift)" "SEC-08" "AZ-466" static_check_destructive_surfaces
run_static "STC-T1" "tsc --noEmit (test config)" "AC-6" "n/a" static_check_typecheck
run_static "STC-B1" "vite build succeeds" "AC-6" "n/a" static_check_vite_build
run_static "STC-S5" "mission-planner not in dist/" "AC-31" "n/a" static_check_dist_no_mission_planner
run_static "STC-ARCH-01" "no cross-component deep imports (barrel-only)" "F4" "AZ-485" static_check_no_cross_component_deep_imports
run_static "STC-ARCH-02" "no hardcoded /api/<service>/ literals in src/" "F7" "AZ-486" static_check_no_api_literals
run_static "STC-PERF01" "initial JS bundle ≤ 2 MB gz" "NFT-PERF-01" "40" static_check_bundle_size
run_static "STC-RES02" "nginx client_max_body_size 500M" "NFT-RES-LIM-02" "n/a" static_check_nginx_body_cap
run_static "STC-RES03" "Dockerfile final stage nginx:alpine no Node" "NFT-RES-LIM-03" "n/a" static_check_dockerfile_nginx_alpine
run_static "STC-RES09" "nginx exactly 9 /api/* location blocks" "NFT-RES-LIM-09" "n/a" static_check_nginx_route_count
run_static "STC-RES10" "nginx prefix-strip on every /api/<S>/ route" "NFT-RES-LIM-10" "n/a" static_check_nginx_prefix_strip
run_static "STC-SEC1B" "no literal OWM key in dist/" "SEC-09" "63" static_check_no_owm_key_in_dist
run_static "STC-SEC1C" "no literal OWM key in src/ + mission-planner/" "SEC-09" "AZ-499" static_check_no_owm_key_in_source
run_static "STC-SEC1D" "no literal Google Geocode key in src/ + mission-planner/" "F-SAST-1" "AZ-501" static_check_no_google_key_in_source
if [ "$STATIC_FAIL" = "1" ]; then
echo "[run-tests] static profile FAILED — see $STATIC_REPORT"
OVERALL_EXIT=1
else
echo "[run-tests] static profile PASSED — see $STATIC_REPORT"
fi
fi
# ----------------------------------------------------------------------------
# Fast profile — Bun + Vitest + jsdom + MSW.
# Test files are colocated with src/ + the top-level tests/ tree.
# ----------------------------------------------------------------------------
if [ "$RUN_FAST" = "true" ]; then
echo "[run-tests] === fast profile ==="
FAST_REPORT="$RESULTS_DIR/fast-report.txt"
if grep -q '"test:fast"' "$PROJECT_ROOT/package.json" 2>/dev/null; then
echo "[fast] running bun run test:fast"
if bun run test:fast 2>&1 | tee "$FAST_REPORT"; then
echo "[run-tests] fast profile PASSED"
else
echo "[run-tests] fast profile FAILED — see $FAST_REPORT and $RESULTS_DIR/fast-report.xml"
OVERALL_EXIT=1
fi
else
echo "[fast] no test:fast script in package.json — AZ-456 not yet landed"
echo "[fast] SKIPPED (no runner)" | tee "$FAST_REPORT"
fi
fi
# ----------------------------------------------------------------------------
# E2E profile — Playwright (Chromium + Firefox) inside the suite docker stack.
# ----------------------------------------------------------------------------
if [ "$RUN_E2E" = "true" ]; then
echo "[run-tests] === e2e profile ==="
COMPOSE_FILE="$PROJECT_ROOT/e2e/docker-compose.suite-e2e.yml"
E2E_REPORT="$RESULTS_DIR/e2e-runner.log"
if [ ! -f "$COMPOSE_FILE" ]; then
echo "[e2e] FATAL: $COMPOSE_FILE not found." >&2
OVERALL_EXIT=1
elif ! command -v docker >/dev/null 2>&1; then
echo "[e2e] FATAL: docker is required for the e2e profile." >&2
OVERALL_EXIT=1
else
echo "[e2e] starting compose stack at $COMPOSE_FILE..."
docker compose -f "$COMPOSE_FILE" up -d --build
E2E_COMPOSE_STARTED_HERE=true
echo "[e2e] running playwright-runner..."
if docker compose -f "$COMPOSE_FILE" run --rm playwright-runner 2>&1 | tee "$E2E_REPORT"; then
echo "[run-tests] e2e profile PASSED"
else
echo "[run-tests] e2e profile FAILED — see $E2E_REPORT and $RESULTS_DIR/e2e-report.xml"
OVERALL_EXIT=1
fi
fi
fi
# ----------------------------------------------------------------------------
# Summary rollup
# ----------------------------------------------------------------------------
SUMMARY="$RESULTS_DIR/summary.csv"
csv_header "$SUMMARY"
{
if [ "$RUN_STATIC" = "true" ] && [ -f "$RESULTS_DIR/static-report.csv" ]; then
tail -n +2 "$RESULTS_DIR/static-report.csv"
fi
if [ "$RUN_FAST" = "true" ] && [ -f "$RESULTS_DIR/fast-report.xml" ]; then
# Vitest's JUnit XML is the canonical fast-profile rollup; the summary CSV
# records a single line so suite-level reporting can detect presence.
echo 'fast-profile,"vitest junit",fast,0,PASS,"see fast-report.xml",AC-4,n/a'
fi
if [ "$RUN_E2E" = "true" ] && [ -f "$RESULTS_DIR/e2e-report.xml" ]; then
echo 'e2e-profile,"playwright junit",e2e,0,PASS,"see e2e-report.xml",AC-5,n/a'
fi
} >> "$SUMMARY"
echo ""
echo "[run-tests] summary"
echo "[run-tests] static profile : $([ "$RUN_STATIC" = "true" ] && echo "ran" || echo "skipped")"
echo "[run-tests] fast profile : $([ "$RUN_FAST" = "true" ] && echo "ran" || echo "skipped")"
echo "[run-tests] e2e profile : $([ "$RUN_E2E" = "true" ] && echo "ran" || echo "skipped")"
echo "[run-tests] results dir : $RESULTS_DIR"
echo "[run-tests] summary file : $SUMMARY"
echo "[run-tests] exit code : $OVERALL_EXIT"
exit "$OVERALL_EXIT"