import { scriptWritesEnvVar } from './env-var-write-warning'; describe('scriptWritesEnvVar', () => { it('detects bru.setEnvVar', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", res.body.token);')).toBe(true); }); it('detects bru.setGlobalEnvVar', () => { expect(scriptWritesEnvVar('bru.setGlobalEnvVar("token", "x");')).toBe(true); }); it('detects bru.deleteEnvVar', () => { expect(scriptWritesEnvVar('bru.deleteEnvVar("token");')).toBe(true); }); it('detects calls with surrounding whitespace', () => { expect(scriptWritesEnvVar('bru . setEnvVar ( "token" , "x" )')).toBe(true); }); it('detects a call with a one-level function-call argument', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", getToken());')).toBe(true); }); it('detects a call with two levels of nested parentheses in its arguments', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", build(read()));')).toBe(true); }); it('returns false for unrelated or read-only bru APIs', () => { expect(scriptWritesEnvVar('bru.setVar("token", "x");')).toBe(false); expect(scriptWritesEnvVar('bru.getEnvVar("token");')).toBe(false); }); it('returns false for empty/invalid input', () => { expect(scriptWritesEnvVar('')).toBe(false); expect(scriptWritesEnvVar(null)).toBe(false); expect(scriptWritesEnvVar(undefined)).toBe(false); }); it('does not match when the receiver is not bru', () => { expect(scriptWritesEnvVar('store.setEnvVar("token", "x");')).toBe(false); }); it('does not match an identifier that merely ends in "bru"', () => { expect(scriptWritesEnvVar('mybru.setEnvVar("token", "x");')).toBe(false); }); it('does not match an affected name that has a trailing suffix', () => { expect(scriptWritesEnvVar('bru.setEnvVarAndCommit("token", "x");')).toBe(false); }); it('is suppressed when persist: false is passed', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", "x", { persist: false });')).toBe(false); }); it('is suppressed with arbitrary whitespace around persist: false', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", "x", {persist:false})')).toBe(false); }); it('is suppressed with a multi-line options object on the same statement', () => { const script = `bru.setEnvVar("token", "x", { persist: false });`; expect(scriptWritesEnvVar(script)).toBe(false); }); it('is suppressed even when a string argument contains a parenthesis', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", "a)b", { persist: false });')).toBe(false); }); it('honors persist: false even when the value is a long, deeply nested expression', () => { const script = 'bru.setEnvVar("accessToken", JSON.parse(decode(res.body.data.session.authentication.tokens.accessToken)), { persist: false });'; expect(scriptWritesEnvVar(script)).toBe(false); }); it('still warns for a separate persisting call alongside a suppressed one', () => { const script = ` bru.setEnvVar("a", "x", { persist: false }); bru.setEnvVar("b", "secret"); `; expect(scriptWritesEnvVar(script)).toBe(true); }); it('warns for a real write even when an unrelated persist: false follows without a semicolon', () => { const script = 'bru.setEnvVar("token", "secret")\nconst opts = { persist: false }'; expect(scriptWritesEnvVar(script)).toBe(true); }); it('warns when persist: false appears only inside a string value, not as an option', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", "persist: false");')).toBe(true); }); it('warns when an affected call opening exists but cannot be bounded', () => { expect(scriptWritesEnvVar('bru.setEnvVar("token", build(read(inner())));')).toBe(true); }); it('does not let comments affect detection', () => { expect(scriptWritesEnvVar('// bru.setEnvVar("token", "x")')).toBe(false); expect(scriptWritesEnvVar('/* bru.setEnvVar("token", "x") */')).toBe(false); }); it('does not let multiline comments affect detection', () => { const script = ` /* * bru.setEnvVar("token", "x") * persist: false */ bru.setVar("token", "runtime-only"); `; expect(scriptWritesEnvVar(script)).toBe(false); }); });