Something went wrong. Try again.
Comail's webmail client, based on Bulwark. Public source mirror
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434import { describe, it, expect } from 'vitest';import JSZip from 'jszip';import { extractTheme, extractPlugin } from '../plugin-validator';
function createZipFile(zip: JSZip, name = 'test.zip'): Promise<File> { return zip.generateAsync({ type: 'blob' }).then(blob => new File([blob], name));}
describe('extractTheme', () => { it('extracts a valid theme ZIP', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'my-theme', name: 'My Theme', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light', 'dark'], })); zip.file('theme.css', ':root { --color-primary: #ff0000; }\n.dark { --color-primary: #00ff00; }');
const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.manifest).not.toBeNull(); expect(result.manifest!.id).toBe('my-theme'); expect(result.css).toContain('--color-primary'); });
it('rejects oversized theme', async () => { // Theme size limit is 2 MB; create a file just past it. const oversizedFile = new File([new ArrayBuffer(2 * 1024 * 1024 + 1)], 'big.zip'); const result = await extractTheme(oversizedFile); expect(result.valid).toBe(false); expect(result.errors).toContain('Theme ZIP exceeds 2 MB size limit'); });
it('rejects non-ZIP file', async () => { const file = new File(['not a zip'], 'bad.zip'); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors).toContain('Invalid ZIP file'); });
it('rejects missing manifest.json', async () => { const zip = new JSZip(); zip.file('theme.css', ':root { --color-primary: blue; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors).toContain('Missing manifest.json'); });
it('rejects invalid JSON manifest', async () => { const zip = new JSZip(); zip.file('manifest.json', 'not json {{{'); zip.file('theme.css', ':root { --color-primary: blue; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors).toContain('Invalid manifest.json (not valid JSON)'); });
it('rejects missing theme.css', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'no-css', name: 'No CSS', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light'], })); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors).toContain('Missing theme.css'); });
it('rejects wrong type in manifest', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'wrong-type', name: 'Wrong', version: '1.0.0', author: 'Test', type: 'plugin', // wrong variants: ['light'], })); zip.file('theme.css', ':root { --color-primary: blue; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('Expected type "theme"'))).toBe(true); });
it('rejects missing variants', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'no-variants', name: 'No Variants', version: '1.0.0', author: 'Test', type: 'theme', })); zip.file('theme.css', ':root { --color-primary: blue; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('variants'))).toBe(true); });
it('handles ZIP with folder root', async () => { const zip = new JSZip(); const folder = zip.folder('my-theme')!; folder.file('manifest.json', JSON.stringify({ id: 'nested-theme', name: 'Nested', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light', 'dark'], })); folder.file('theme.css', ':root { --color-primary: #aaa; }\n.dark { --color-primary: #bbb; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.manifest!.id).toBe('nested-theme'); });
// ── Theme API v2 (advanced manifest) ──────────────────────────────
it('compiles a v2 manifest with tokens and no theme.css', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'tokens-only', name: 'Tokens Only', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light', 'dark'], apiVersion: 2, tokens: { light: { primary: '#1373d9', background: '#ffffff' }, dark: { primary: '#58c9ff', background: '#1a202c' }, }, })); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.css).toContain('--color-primary: #1373d9'); expect(result.css).toContain('--color-primary: #58c9ff'); });
it('concatenates compiled tokens with author-supplied theme.css', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'tokens-plus-css', name: 'Tokens + CSS', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light'], apiVersion: 2, tokens: { light: { primary: '#000' } }, })); zip.file('theme.css', '@font-face { font-family: "X"; src: local("X"); }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.css).toContain('--color-primary: #000'); expect(result.css).toContain('@font-face'); });
it('extracts a skin.css when shipped with a v2 manifest', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'with-skin', name: 'With Skin', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light'], apiVersion: 2, tokens: { light: { primary: '#000' } }, })); zip.file('skin.css', '[data-tour="email-list"] { font-size: 13px; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.skin).not.toBeNull(); expect(result.skin!).toContain('[data-tour="email-list"]'); });
it('strips dangerous patterns from skin.css', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'evil-skin', name: 'Evil', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light'], apiVersion: 2, tokens: { light: { primary: '#000' } }, })); zip.file('skin.css', '@import url("https://x.com/p.css"); button { background: javascript:alert(1); }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.skin).not.toBeNull(); expect(result.skin!).not.toContain('javascript:'); expect(result.skin!).not.toContain('@import'); expect(result.warnings.some((w) => w.toLowerCase().includes('skin'))).toBe(true); });
it('ignores skin.css when manifest is not v2', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'v1-with-skin', name: 'V1', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light'], })); zip.file('theme.css', ':root { --color-primary: #000; }'); zip.file('skin.css', 'body { display: none; }'); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(true); expect(result.skin).toBeNull(); expect(result.warnings.some((w) => w.includes('skin.css ignored'))).toBe(true); });
it('rejects a v2 manifest with invalid density', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'bad-density', name: 'Bad', version: '1.0.0', author: 'Test', type: 'theme', variants: ['light'], density: 'gigantic', tokens: { light: { primary: '#000' } }, })); const file = await createZipFile(zip); const result = await extractTheme(file); expect(result.valid).toBe(false); expect(result.errors.some((e) => e.includes('density'))).toBe(true); });});
describe('extractPlugin', () => { it('extracts a valid plugin ZIP', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'my-plugin', name: 'My Plugin', version: '1.0.0', author: 'Test', type: 'ui-extension', entrypoint: 'index.js', permissions: ['email:read'], })); zip.file('index.js', 'export function activate(api) { console.log("hi"); }');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(true); expect(result.manifest!.id).toBe('my-plugin'); expect(result.code).toContain('activate'); });
it('rejects oversized plugin', async () => { const oversizedFile = new File([new ArrayBuffer(5 * 1024 * 1024 + 1)], 'big.zip'); const result = await extractPlugin(oversizedFile); expect(result.valid).toBe(false); expect(result.errors).toContain('Plugin ZIP exceeds 5 MB size limit'); });
it('rejects non-ZIP file', async () => { const file = new File(['not a zip'], 'bad.zip'); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors).toContain('Invalid ZIP file'); });
it('rejects missing manifest', async () => { const zip = new JSZip(); zip.file('index.js', 'export function activate() {}'); const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors).toContain('Missing manifest.json'); });
it('rejects disallowed file types', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'bad-files', name: 'Bad', version: '1.0.0', author: 'Test', type: 'hook', entrypoint: 'index.js', permissions: [], })); zip.file('index.js', 'export function activate() {}'); zip.file('hack.exe', 'binary');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('.exe'))).toBe(true); });
it('rejects unknown permissions', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'bad-perms', name: 'Bad perms', version: '1.0.0', author: 'Test', type: 'hook', entrypoint: 'index.js', permissions: ['email:read', 'nuclear:launch'], })); zip.file('index.js', 'export function activate() {}');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('nuclear:launch'))).toBe(true); });
it('warns about eval() in code', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'eval-plugin', name: 'Eval', version: '1.0.0', author: 'Test', type: 'hook', entrypoint: 'index.js', permissions: [], })); zip.file('index.js', 'export function activate() { eval("alert(1)"); }');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(true); expect(result.warnings.some(w => w.includes('eval()'))).toBe(true); });
it('warns about document.cookie in code', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'cookie-plugin', name: 'Cookie', version: '1.0.0', author: 'Test', type: 'hook', entrypoint: 'index.js', permissions: [], })); zip.file('index.js', 'export function activate() { const c = document.cookie; }');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(true); expect(result.warnings.some(w => w.includes('document.cookie'))).toBe(true); });
it('rejects invalid plugin type', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'bad-type', name: 'Bad Type', version: '1.0.0', author: 'Test', type: 'theme', // wrong type for plugin entrypoint: 'index.js', permissions: [], })); zip.file('index.js', 'export function activate() {}');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('Invalid type'))).toBe(true); });
it('rejects missing entrypoint', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'no-entry', name: 'No Entry', version: '1.0.0', author: 'Test', type: 'hook', entrypoint: 'main.js', permissions: [], })); zip.file('index.js', 'export function activate() {}'); // entrypoint 'main.js' doesn't exist
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('Missing entrypoint'))).toBe(true); });
it('rejects invalid manifest ID format', async () => { const zip = new JSZip(); zip.file('manifest.json', JSON.stringify({ id: 'Bad_ID!', name: 'Bad ID', version: '1.0.0', author: 'Test', type: 'hook', entrypoint: 'index.js', permissions: [], })); zip.file('index.js', 'export function activate() {}');
const file = await createZipFile(zip); const result = await extractPlugin(file); expect(result.valid).toBe(false); expect(result.errors.some(e => e.includes('ID must be lowercase'))).toBe(true); });});