chore(release): document hardening and verify complete source package composition

2026-09-08 02:06:35 +02:00
parent 6a8f53b87d
commit 32fe4b7238
9 changed files with 585 additions and 13 deletions
@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+import runpy
+import tempfile
+import unittest
+
+
+META_ROOT = Path(__file__).resolve().parents[1]
+CHECK = runpy.run_path(str(META_ROOT / "tools/checks/check-webui-package-facades.py"))
+
+
+class WebuiPackageFacadeTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temporary = tempfile.TemporaryDirectory()
+        self.addCleanup(self.temporary.cleanup)
+        self.repository = Path(self.temporary.name) / "govoplan-example"
+        source = self.repository / "webui/src"
+        source.mkdir(parents=True)
+        (source / "index.ts").write_text("export {};\n", encoding="utf-8")
+        (source / "styles.css").write_text(":root {}\n", encoding="utf-8")
+        self.webui = {
+            "name": "@govoplan/example-webui", "version": "0.1.2", "type": "module",
+            "main": "src/index.ts",
+            "exports": {".": {"import": "./src/index.ts"}, "./styles.css": "./src/styles.css"},
+            "peerDependencies": {"@govoplan/core-webui": "^0.1.45"},
+            "peerDependenciesMeta": {"@govoplan/core-webui": {"optional": True}},
+        }
+        self.root = {**self.webui, **{
+            field: CHECK["prefixed_entries"](self.webui[field])
+            for field in CHECK["ENTRY_FIELDS"] if field in self.webui
+        }}
+        self.write_manifests()
+
+    def write_manifests(self) -> None:
+        (self.repository / "webui/package.json").write_text(json.dumps(self.webui), encoding="utf-8")
+        (self.repository / "package.json").write_text(json.dumps(self.root), encoding="utf-8")
+
+    def issues(self) -> list[str]:
+        return CHECK["facade_issues"](self.repository, package_name="@govoplan/example-webui")
+
+    def test_matching_conditional_and_css_entries_are_accepted(self) -> None:
+        self.assertEqual([], self.issues())
+
+    def test_missing_root_or_generic_package_is_rejected(self) -> None:
+        (self.repository / "package.json").unlink()
+        self.assertIn("cannot read", " ".join(self.issues()))
+        self.root = {"name": "@govoplan/example", "version": "0.1.2"}
+        self.write_manifests()
+        self.assertIn("root name differs", " ".join(self.issues()))
+        self.assertIn("no WebUI entry point", " ".join(self.issues()))
+
+    def test_peer_drift_or_missing_entry_is_rejected(self) -> None:
+        self.root["peerDependencies"] = {"@govoplan/core-webui": "^9.0.0"}
+        self.write_manifests()
+        self.assertIn("peerDependencies differs", " ".join(self.issues()))
+        (self.repository / "webui/src/styles.css").unlink()
+        self.assertIn("missing exports entry", " ".join(self.issues()))
+
+    def test_entry_cannot_escape_webui_even_if_it_exists(self) -> None:
+        (self.repository / "outside.ts").write_text("export {};\n", encoding="utf-8")
+        self.root["main"] = "webui/../outside.ts"
+        self.write_manifests()
+        self.assertIn("escapes webui/", " ".join(self.issues()))
+
+    def test_release_composition_checks_only_declared_module_sources(self) -> None:
+        core = self.repository.parent / "govoplan-core/webui"
+        core.mkdir(parents=True)
+        (core / "package.release.json").write_text(json.dumps({"dependencies": {
+            "react": "19.2.7",
+            "@govoplan/example-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-example.git#v0.1.2",
+        }}), encoding="utf-8")
+        self.assertEqual((1, []), CHECK["check_composition"](self.repository.parent))
+
+
+if __name__ == "__main__":
+    unittest.main()