Add vitest per-scanner fixture tests for v1-a.

Wire npm test to vitest and cover all eight scanners against test-data fixtures so regressions are caught before CI.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: slowcoder360

package-lock.json

@@ -16,7 +16,7 @@
     "build": "tsc",
     "start": "node dist/index.js",
     "dev": "ts-node src/index.ts",
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "vitest run"
   },
   "repository": {
     "type": "git",
@@ -40,7 +40,8 @@
   "devDependencies": {
     "@types/node": "^22.14.1",
     "ts-node": "^10.9.2",
-    "typescript": "^5.8.3"
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
   },
   "dependencies": {
     "@types/js-yaml": "^4.0.9",

package.json

@@ -0,0 +1,20 @@
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import { scanConfigFile } from '../../src/scanners/configuration';
+
+describe('configuration scanner', () => {
+  it('detects CORS High and DEBUG Medium in app.config.json', () => {
+    const file = path.join(__dirname, '../../test-data/app.config.json');
+    const findings = scanConfigFile(file);
+
+    const corsHigh = findings.filter(
+      (f) => f.type === 'Permissive CORS' && f.severity === 'High',
+    );
+    const debugMedium = findings.filter(
+      (f) => f.type === 'Insecure Setting' && f.severity === 'Medium',
+    );
+
+    expect(corsHigh.length).toBeGreaterThanOrEqual(1);
+    expect(debugMedium.length).toBeGreaterThanOrEqual(1);
+  });
+});

tests/scanners/configuration.test.ts

@@ -0,0 +1,21 @@
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import { parseDependencies, lookupCves } from '../../src/scanners/dependencies';
+
+describe('dependencies scanner', () => {
+  it('finds vulnerabilities for lodash or axios in vulnerable-deps/package.json', async () => {
+    const manifestPath = path.join(__dirname, '../../test-data/vulnerable-deps/package.json');
+    const dependencies = parseDependencies({
+      npm: { manifest: manifestPath },
+    });
+
+    expect(dependencies.some((d) => d.name === 'lodash' || d.name === 'axios')).toBe(true);
+
+    const findings = await lookupCves(dependencies);
+    const vulnerable = findings.filter(
+      (f) => (f.name === 'lodash' || f.name === 'axios') && f.vulnerabilities.length > 0,
+    );
+
+    expect(vulnerable.length).toBeGreaterThan(0);
+  });
+});

tests/scanners/dependencies.test.ts

@@ -0,0 +1,30 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import { scanForExposedEndpoints } from '../../src/scanners/endpoints';
+
+const detectedTech = {
+  hasFrontend: false,
+  hasBackend: true,
+  isNextJs: false,
+  hasAuth: false,
+  hasMiddleware: false,
+  hasHttpClient: false,
+  hasCors: false,
+  hasFileUpload: false,
+};
+
+describe('endpoints scanner', () => {
+  it('flags /admin with Medium or higher severity in endpoint-test.js', () => {
+    const rootDir = path.join(__dirname, '../../test-data');
+    const file = path.join(rootDir, 'endpoint-test.js');
+    const content = fs.readFileSync(file, 'utf-8');
+
+    const findings = scanForExposedEndpoints(rootDir, file, content, detectedTech);
+    const adminFindings = findings.filter(
+      (f) => f.path.includes('/admin') && (f.severity === 'Medium' || f.severity === 'High' || f.severity === 'Critical'),
+    );
+
+    expect(adminFindings.length).toBeGreaterThanOrEqual(1);
+  });
+});

tests/scanners/endpoints.test.ts

@@ -0,0 +1,16 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import { scanForHttpClientIssues } from '../../src/scanners/httpClient';
+
+describe('httpClient scanner', () => {
+  it('detects at least one missing timeout in http-client-unsafe.js', () => {
+    const file = path.join(__dirname, '../../test-data/http-client-unsafe.js');
+    const content = fs.readFileSync(file, 'utf-8');
+
+    const findings = scanForHttpClientIssues(file, content, true);
+    const missingTimeout = findings.filter((f) => f.type === 'Potential Missing Timeout');
+
+    expect(missingTimeout.length).toBeGreaterThanOrEqual(1);
+  });
+});

tests/scanners/httpClient.test.ts

@@ -0,0 +1,16 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import { scanForLoggingIssues } from '../../src/scanners/logging';
+
+describe('logging scanner', () => {
+  it('detects at least one PII finding in logging-test.js', () => {
+    const file = path.join(__dirname, '../../test-data/logging-test.js');
+    const content = fs.readFileSync(file, 'utf-8');
+
+    const findings = scanForLoggingIssues(file, content, true);
+    const piiFindings = findings.filter((f) => f.type === 'Potential PII Logging');
+
+    expect(piiFindings.length).toBeGreaterThanOrEqual(1);
+  });
+});

tests/scanners/logging.test.ts

@@ -0,0 +1,56 @@
+import { describe, it, expect } from 'vitest';
+import path from 'path';
+import { checkRateLimitHeuristic } from '../../src/scanners/rateLimiting';
+import type { DependencyInfo } from '../../src/scanners/dependencies';
+
+const detectedTech = {
+  hasFrontend: false,
+  hasBackend: true,
+  isNextJs: false,
+  hasAuth: false,
+  hasMiddleware: false,
+  hasHttpClient: false,
+  hasCors: false,
+  hasFileUpload: false,
+};
+
+describe('rateLimiting scanner', () => {
+  it('issues advisory when routes exist but no rate-limit package is in dependencies', () => {
+    const missingFile = path.join(__dirname, '../../test-data/rate-limit-missing.js');
+    const dependencies: DependencyInfo[] = [
+      {
+        name: 'express',
+        version: '4.18.0',
+        packageManager: 'npm',
+        sourceFile: 'package.json',
+      },
+    ];
+
+    const findings = checkRateLimitHeuristic(dependencies, [missingFile], detectedTech);
+
+    expect(findings.length).toBe(1);
+    expect(findings[0].type).toBe('Project-Level Rate Limit Advisory');
+  });
+
+  it('returns no advisory when express-rate-limit is in dependencies', () => {
+    const presentFile = path.join(__dirname, '../../test-data/rate-limit-present.js');
+    const dependencies: DependencyInfo[] = [
+      {
+        name: 'express',
+        version: '4.18.0',
+        packageManager: 'npm',
+        sourceFile: 'package.json',
+      },
+      {
+        name: 'express-rate-limit',
+        version: '6.7.0',
+        packageManager: 'npm',
+        sourceFile: 'package.json',
+      },
+    ];
+
+    const findings = checkRateLimitHeuristic(dependencies, [presentFile], detectedTech);
+
+    expect(findings).toHaveLength(0);
+  });
+});

tests/scanners/rateLimiting.test.ts

@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { scanFileForSecrets } from '../../src/scanners/secrets';
+import path from 'path';
+
+describe('secrets scanner', () => {
+  it('detects High severity AWS keys in aws-secrets-tests.txt', () => {
+    const file = path.join(__dirname, '../../test-data/aws-secrets-tests.txt');
+    const findings = scanFileForSecrets(file);
+    const high = findings.filter((f) => f.severity === 'High');
+    expect(high.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it('returns no High findings for safe-file.txt', () => {
+    const file = path.join(__dirname, '../../test-data/safe-file.txt');
+    const findings = scanFileForSecrets(file);
+    const high = findings.filter((f) => f.severity === 'High');
+    expect(high).toHaveLength(0);
+  });
+});

tests/scanners/secrets.test.ts

@@ -0,0 +1,16 @@
+import { describe, it, expect } from 'vitest';
+import fs from 'fs';
+import path from 'path';
+import { scanForUnvalidatedUploads } from '../../src/scanners/uploads';
+
+describe('uploads scanner', () => {
+  it('reports missing multer limits when hasBackend is true', () => {
+    const file = path.join(__dirname, '../../test-data/multer-test.js');
+    const content = fs.readFileSync(file, 'utf-8');
+
+    const findings = scanForUnvalidatedUploads(file, content, true);
+    const missingLimits = findings.filter((f) => f.type === 'Missing Upload Size Limit');
+
+    expect(missingLimits.length).toBeGreaterThanOrEqual(1);
+  });
+});