feat: add local OneNote and ONEPKG reader

tests/release-archive.test.ts

@@ -0,0 +1,121 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+import {
+  collectDirectoryFiles,
+  createThirdPartyLicenseBundle,
+} from '../scripts/release-archive.mjs';
+
+interface PackageReleaseModule {
+  collectReleaseMetadataFiles(
+    projectRoot: string
+  ): Promise<Record<string, Buffer>>;
+}
+
+describe('release archive', () => {
+  it('creates identical bytes in different process timezones', () => {
+    const hashes = ['UTC', 'Europe/Berlin', 'America/New_York'].map(
+      (timezone) => {
+        const script = `
+          import { createHash } from 'node:crypto';
+          import { createDeterministicZip } from './scripts/release-archive.mjs';
+          const archive = createDeterministicZip({
+            'z.txt': Buffer.from('last'),
+            'a.txt': Buffer.from('first'),
+          });
+          process.stdout.write(createHash('sha256').update(archive).digest('hex'));
+        `;
+        const result = spawnSync(
+          process.execPath,
+          ['--input-type=module', '--eval', script],
+          {
+            cwd: process.cwd(),
+            encoding: 'utf8',
+            env: { ...process.env, TZ: timezone },
+          }
+        );
+        expect(result.status, result.stderr).toBe(0);
+        return result.stdout;
+      }
+    );
+    expect(new Set(hashes)).toHaveLength(1);
+  });
+
+  it('collects every installed runtime license text', async () => {
+    const bundle = await createThirdPartyLicenseBundle(process.cwd(), [
+      '@add-ideas/toolbox-contract',
+      '@add-ideas/toolbox-shell-react',
+      'react',
+    ]);
+    const text = bundle.toString('utf8');
+    expect(text).toContain('@add-ideas/toolbox-contract@0.1.1');
+    expect(text).toContain('@add-ideas/toolbox-shell-react@0.1.1');
+    expect(text).toContain('react@');
+    expect(createHash('sha256').update(bundle).digest('hex')).toMatch(
+      /^[a-f0-9]{64}$/
+    );
+  });
+
+  it('packages parser provenance and every required license text', async () => {
+    const moduleUrl = pathToFileURL(
+      path.join(process.cwd(), 'scripts', 'package-release.mjs')
+    ).href;
+    const { collectReleaseMetadataFiles } = (await import(
+      moduleUrl
+    )) as PackageReleaseModule;
+    const files = await collectReleaseMetadataFiles(process.cwd());
+
+    expect(Object.keys(files).sort()).toEqual(
+      expect.arrayContaining([
+        'LICENSE',
+        'LICENSES/AGPL-3.0.txt',
+        'LICENSES/MPL-2.0.txt',
+        'LICENSES/THIRD-PARTY-LICENSES.txt',
+        'LICENSES/lzxd-MIT.txt',
+        'LICENSES/rust-cab-MIT.txt',
+        'THIRD_PARTY_NOTICES.md',
+        'docs/FORMAT_SUPPORT.md',
+        'docs/PORTING.md',
+        'docs/REFERENCE_IMPLEMENTATIONS.md',
+        'docs/SECURITY.md',
+        'tests/fixtures/README.md',
+      ])
+    );
+    expect(
+      createHash('sha256')
+        .update(files['LICENSES/rust-cab-MIT.txt']!)
+        .digest('hex')
+    ).toBe('ebaac853b53fec0ed475796f533ce676912a4df9ad9d8a621fa76d5060591e10');
+    expect(
+      createHash('sha256').update(files['LICENSES/lzxd-MIT.txt']!).digest('hex')
+    ).toBe('c7a1dcbf839b1dfb72f24e1de12ab55f789db2c61d894ca9aa8b5f595490d9ca');
+    expect(files).not.toHaveProperty(
+      'tests/fixtures/joplin-test.onepkg.base64'
+    );
+    expect(files).not.toHaveProperty('tests/fixtures/onenote_desktop.one.b64');
+  });
+
+  it('rejects symbolic links in release input', async () => {
+    const temporaryDirectory = await mkdtemp(
+      path.join(os.tmpdir(), 'onenote-tools-release-')
+    );
+    try {
+      const outsideFile = path.join(temporaryDirectory, 'outside.txt');
+      const inputDirectory = path.join(temporaryDirectory, 'input');
+      await writeFile(outsideFile, 'private');
+      await mkdir(inputDirectory);
+      await symlink(outsideFile, path.join(inputDirectory, 'linked.txt'));
+
+      await expect(collectDirectoryFiles(inputDirectory)).rejects.toThrow(
+        'Unsupported filesystem entry in release input: linked.txt'
+      );
+    } finally {
+      await rm(temporaryDirectory, { recursive: true, force: true });
+    }
+  });
+});