63 lines
3.4 KiB
JavaScript
63 lines
3.4 KiB
JavaScript
import { execFileSync } from 'node:child_process';
|
|
import { readFileSync } from 'node:fs';
|
|
import { resolve } from 'node:path';
|
|
|
|
const root = resolve(import.meta.dirname, '../..');
|
|
const violations = [];
|
|
|
|
const productionFiles = execFileSync('git', ['ls-files', 'src/apps/**/*.ts', 'src/apps/**/*.tsx', 'src/components/**/*.ts', 'src/components/**/*.tsx'], { cwd: root, encoding: 'utf8' })
|
|
.split(/\r?\n/).filter(Boolean);
|
|
for (const file of productionFiles) {
|
|
const content = readFileSync(resolve(root, file), 'utf8');
|
|
if (/from\s+['"]@\/mock(?:\/|['"])/.test(content)) violations.push(`${file}: production code imports @/mock`);
|
|
}
|
|
|
|
const clientControllers = execFileSync('git', ['ls-files', 'api/src/**/*.controller.ts'], { cwd: root, encoding: 'utf8' })
|
|
.split(/\r?\n/).filter(Boolean);
|
|
for (const file of clientControllers) {
|
|
const content = readFileSync(resolve(root, file), 'utf8');
|
|
const clientClassOffset = content.indexOf('export class Client');
|
|
const clientSection = clientClassOffset >= 0 ? content.slice(clientClassOffset) : content;
|
|
if (/['"]client(?:\/|['"])/.test(clientSection) && /@TenantId\(\)/.test(clientSection)) {
|
|
violations.push(`${file}: client route still reads request-controlled @TenantId()`);
|
|
}
|
|
}
|
|
|
|
const trackedBuildCaches = execFileSync('git', ['ls-files', '*.tsbuildinfo', '**/*.tsbuildinfo'], { cwd: root, encoding: 'utf8' }).trim();
|
|
if (trackedBuildCaches) violations.push(`tracked TypeScript build caches: ${trackedBuildCaches.replace(/\r?\n/g, ', ')}`);
|
|
|
|
const usersService = readFileSync(resolve(root, 'api/src/users/users.service.ts'), 'utf8');
|
|
if (/createHash\(['"]sha256['"]\)/.test(usersService)) {
|
|
violations.push('api/src/users/users.service.ts: password writes must use the versioned password hasher');
|
|
}
|
|
const authService = readFileSync(resolve(root, 'api/src/auth/auth.service.ts'), 'utf8');
|
|
if (/passwordHash\s*===|===\s*[^\n;]*passwordHash/.test(authService)) {
|
|
violations.push('api/src/auth/auth.service.ts: password hashes must not be compared directly');
|
|
}
|
|
const ensureAdmin = readFileSync(resolve(root, 'tools/deploy/ensure-production-admin.mjs'), 'utf8');
|
|
if (/createHash\(['"]sha256['"]\)|function\s+hashPassword\s*\(/.test(ensureAdmin)
|
|
|| !ensureAdmin.includes("api/dist/auth/password-hasher.js")) {
|
|
violations.push('tools/deploy/ensure-production-admin.mjs: administrative password writes must use the API password hasher');
|
|
}
|
|
for (const relativePath of ['tools/deploy/ensure-production-admin.mjs', 'tools/smoke/real-env-smoke.mjs']) {
|
|
const content = readFileSync(resolve(root, relativePath), 'utf8');
|
|
if (/function\s+hashPassword\s*\(|passwordHash:\s*(?:createHash|legacyHashPassword)/.test(content)
|
|
|| !content.includes("api/dist/auth/password-hasher.js")) {
|
|
violations.push(`${relativePath}: user password writes must use the compiled API password hasher`);
|
|
}
|
|
}
|
|
|
|
const packageJson = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
|
|
if (packageJson.dependencies?.['react-router-dom'] !== '7.18.2') {
|
|
violations.push('package.json: react-router-dom must remain on the remediated 7.18.2 baseline');
|
|
}
|
|
if (packageJson.overrides?.nanoid !== '3.3.18') {
|
|
violations.push('package.json: nanoid override must remain on the remediated 3.3.18 baseline');
|
|
}
|
|
|
|
if (violations.length) {
|
|
console.error(violations.map((item) => `ERROR: ${item}`).join('\n'));
|
|
process.exit(1);
|
|
}
|
|
console.log('Code quality structural checks passed.');
|