From 5da0a6677f416a77c68d3f98fd63d2353172d698 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Mon, 24 Aug 2026 06:50:23 +0100 Subject: [PATCH] refactor: semantically port TS to AffineScript --- tests/aspect/security_aspect_test.affine | 70 ++++++++--------- tests/bench/config_bench.affine | 12 +-- tests/contract/network_contracts_test.affine | 70 ++++++++--------- tests/e2e/network_e2e_test.affine | 64 ++++++++-------- tests/property/network_property_test.affine | 80 ++++++++++---------- tests/smoke/infra_smoke_test.affine | 40 +++++----- tests/unit/config_structure_test.affine | 38 +++++----- 7 files changed, 173 insertions(+), 201 deletions(-) diff --git a/tests/aspect/security_aspect_test.affine b/tests/aspect/security_aspect_test.affine index a331aea..31351ce 100644 --- a/tests/aspect/security_aspect_test.affine +++ b/tests/aspect/security_aspect_test.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module security_aspect_test; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -14,34 +11,34 @@ module security_aspect_test; import { assertEquals } from "https://deno.land/std@0.208.0/assert/mod.ts"; Deno.test("aspect: No hardcoded API keys in network config", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Should use placeholders, not real credentials - const realTokenPatterns = [ + let realTokenPatterns = [ /[a-zA-Z0-9]{32,}/, // 32+ char alphanumeric (real tokens) /sk_live_/, // Stripe pattern /zt_[a-zA-Z0-9]+/, // ZT pattern ]; for (const pattern of realTokenPatterns) { - const hasRealCredential = pattern.test(content) && !content.includes("CHANGEME"); + let hasRealCredential = pattern.test(content) && !content.includes("CHANGEME"); assertEquals(hasRealCredential, false); } }); Deno.test("aspect: No hardcoded tokens in daemonset", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); // Should use secretKeyRef, not hardcoded values - const credentials = content.match(/ZEROTIER_[A-Z_]+/g) || []; + let credentials = content.match(/ZEROTIER_[A-Z_]+/g) || []; for (const cred of credentials) { - const hasSecretRef = content.includes("secretKeyRef") || content.includes("configMapKeyRef"); + let hasSecretRef = content.includes("secretKeyRef") || content.includes("configMapKeyRef"); assertEquals(hasSecretRef, true); } }); Deno.test("aspect: No HTTP endpoints (HTTPS only)", async () => { - const files = [ + let files = [ "configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl", @@ -50,15 +47,15 @@ Deno.test("aspect: No HTTP endpoints (HTTPS only)", async () => { ]; for (const file of files) { - const content = await Deno.readTextFile(file); + let content = await Deno.readTextFile(file); // Should not have http:// URLs (except in comments) - const httpUrls = content.match(/(? { - const files = [ + let files = [ "scripts/authorize-nodes.sh", "scripts/configure-routes.sh", "scripts/health-check.sh", @@ -67,27 +64,27 @@ Deno.test("aspect: No world-readable permission patterns (chmod 777)", async () ]; for (const file of files) { - const content = await Deno.readTextFile(file); + let content = await Deno.readTextFile(file); // Should not have 777 permissions assertEquals(content.includes("chmod 777") || content.includes("chmod a+rwx"), false); } }); Deno.test("aspect: ZeroTier auth tokens are placeholders only", async () => { - const content = await Deno.readTextFile("manifests/secret.yaml"); + let content = await Deno.readTextFile("manifests/secret.yaml"); // Should use EXAMPLE placeholders - const hasPlaceholder = content.includes("EXAMPLE_API_TOKEN") && content.includes("EXAMPLE_NETWORK_ID"); + let hasPlaceholder = content.includes("EXAMPLE_API_TOKEN") && content.includes("EXAMPLE_NETWORK_ID"); assertEquals(hasPlaceholder, true); // Should not contain real-looking tokens - const realTokenPattern = /[a-z0-9]{20,}/; - const looksRealButNotExample = realTokenPattern.test(content) && !content.includes("EXAMPLE"); + let realTokenPattern = /[a-z0-9]{20,}/; + let looksRealButNotExample = realTokenPattern.test(content) && !content.includes("EXAMPLE"); assertEquals(looksRealButNotExample, false); }); Deno.test("aspect: NetworkPolicy has both ingress and egress rules", async () => { - const content = await Deno.readTextFile("manifests/networkpolicy.yaml"); + let content = await Deno.readTextFile("manifests/networkpolicy.yaml"); // Must explicitly define both assertEquals(content.includes("ingress:"), true); @@ -99,7 +96,7 @@ Deno.test("aspect: NetworkPolicy has both ingress and egress rules", async () => }); Deno.test("aspect: No plaintext passwords in manifests", async () => { - const manifests = [ + let manifests = [ "manifests/configmap.yaml", "manifests/daemonset.yaml", "manifests/namespace.yaml", @@ -108,18 +105,18 @@ Deno.test("aspect: No plaintext passwords in manifests", async () => { "manifests/servicemonitor.yaml", ]; - const passwordPatterns = [/password\s*:\s*[^#\n]+[a-zA-Z0-9]{8,}/, /passwd\s*:\s*[^#\n]+/]; + let passwordPatterns = [/password\s*:\s*[^#\n]+[a-zA-Z0-9]{8,}/, /passwd\s*:\s*[^#\n]+/]; for (const manifest of manifests) { - const content = await Deno.readTextFile(manifest); + let content = await Deno.readTextFile(manifest); for (const pattern of passwordPatterns) { // Should not have unencoded passwords - const match = pattern.exec(content); + let match = pattern.exec(content); if (match) { // Must be a placeholder or base64 - const isPlaceholder = match[0].includes("EXAMPLE") || match[0].includes("CHANGEME"); - const isBase64Hint = match[0].includes("base64") || match[0].includes("encoded"); + let isPlaceholder = match[0].includes("EXAMPLE") || match[0].includes("CHANGEME"); + let isBase64Hint = match[0].includes("base64") || match[0].includes("encoded"); assertEquals(isPlaceholder || isBase64Hint, true); } } @@ -127,16 +124,16 @@ Deno.test("aspect: No plaintext passwords in manifests", async () => { }); Deno.test("aspect: No expose of internal credentials via logs", async () => { - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); // Should not directly echo secret environment variables // (using secretKeyRef is OK, but shouldn't directly print values) - const hasDirectEchoOfSecret = daemonsetContent.match(/echo\s+"\s*\$ZEROTIER_(NETWORK_ID|API_TOKEN)/); + let hasDirectEchoOfSecret = daemonsetContent.match(/echo\s+"\s*\$ZEROTIER_(NETWORK_ID|API_TOKEN)/); assertEquals(hasDirectEchoOfSecret === null, true); }); Deno.test("aspect: Firewall denies by default (principle of least privilege)", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); // Input and Forward should be DROP (most restrictive) assertEquals(content.includes(`input_policy = "DROP"`), true); @@ -147,14 +144,14 @@ Deno.test("aspect: Firewall denies by default (principle of least privilege)", a }); Deno.test("aspect: DaemonSet security context restricts container capabilities", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); // Must have securityContext defined assertEquals(content.includes("securityContext:"), true); }); Deno.test("aspect: No hardcoded secrets in scripts", async () => { - const scripts = [ + let scripts = [ "scripts/authorize-nodes.sh", "scripts/configure-routes.sh", "scripts/health-check.sh", @@ -163,10 +160,10 @@ Deno.test("aspect: No hardcoded secrets in scripts", async () => { ]; for (const script of scripts) { - const content = await Deno.readTextFile(script); + let content = await Deno.readTextFile(script); // Should not embed API tokens or network IDs - const hasEmbeddedSecret = + let hasEmbeddedSecret = /[a-zA-Z0-9]{32,}/.test(content) && !content.includes("CHANGEME") && !content.includes("EXAMPLE") && @@ -178,7 +175,7 @@ Deno.test("aspect: No hardcoded secrets in scripts", async () => { }); Deno.test("aspect: Network config disables dangerous capabilities", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Should not allow global IPs via ZT network assertEquals(content.includes("allow_global_ips = false"), true); @@ -188,17 +185,16 @@ Deno.test("aspect: Network config disables dangerous capabilities", async () => }); Deno.test("aspect: Kubernetes RBAC references are appropriate", async () => { - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); // Should not request cluster-admin role assertEquals(daemonsetContent.includes("cluster-admin"), false); }); Deno.test("aspect: Secret is type Opaque not other types", async () => { - const content = await Deno.readTextFile("manifests/secret.yaml"); + let content = await Deno.readTextFile("manifests/secret.yaml"); // Should be Opaque type for sensitive data assertEquals(content.includes('type: Opaque') || content.includes('type: "Opaque"'), true); }); -==================================== */ diff --git a/tests/bench/config_bench.affine b/tests/bench/config_bench.affine index de0f79c..88e23f4 100644 --- a/tests/bench/config_bench.affine +++ b/tests/bench/config_bench.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module config_bench; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -18,7 +15,7 @@ Deno.bench("bench: read all nickel configs sequentially", async () => { }); Deno.bench("bench: read all k8s manifests sequentially", async () => { - const files = [ + let files = [ "manifests/configmap.yaml", "manifests/daemonset.yaml", "manifests/namespace.yaml", @@ -63,15 +60,14 @@ Deno.bench("bench: read all ABI files", async () => { }); Deno.bench("bench: parse nickel config string content", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Basic parsing simulation: count lines content.split("\n").length; }); Deno.bench("bench: parse kubernetes manifest string content", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); // Basic parsing simulation: count lines content.split("\n").length; }); -==================================== */ diff --git a/tests/contract/network_contracts_test.affine b/tests/contract/network_contracts_test.affine index 9e5ad3c..c44ec2e 100644 --- a/tests/contract/network_contracts_test.affine +++ b/tests/contract/network_contracts_test.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module network_contracts_test; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -14,47 +11,47 @@ module network_contracts_test; import { assertEquals, assertStringIncludes } from "https://deno.land/std@0.208.0/assert/mod.ts"; Deno.test("contract: INVARIANT — Firewall must have default deny rule for input", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); assertStringIncludes(content, `input_policy = "DROP"`); }); Deno.test("contract: INVARIANT — Firewall must have default deny rule for forward", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); assertStringIncludes(content, `forward_policy = "DROP"`); }); Deno.test("contract: INVARIANT — ZeroTier network config uses private IP ranges only", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Extract IP ranges and verify they're private (10.x.x.x, 172.16-31.x.x, 192.168.x.x) - const ipMatches = content.match(/(\d+\.\d+\.\d+\.\d+)/g) || []; + let ipMatches = content.match(/(\d+\.\d+\.\d+\.\d+)/g) || []; for (const ip of ipMatches) { - const octets = ip.split(".").map(Number); + let octets = ip.split(".").map(Number); // Check if IP is in private ranges - const isPrivate10 = octets[0] === 10; - const isPrivate172 = octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31; - const isPrivate192 = octets[0] === 192 && octets[1] === 168; + let isPrivate10 = octets[0] === 10; + let isPrivate172 = octets[0] === 172 && octets[1] >= 16 && octets[1] <= 31; + let isPrivate192 = octets[0] === 192 && octets[1] === 168; assertEquals(isPrivate10 || isPrivate172 || isPrivate192, true); } }); Deno.test("contract: INVARIANT — Kubernetes Secret must not have real credentials", async () => { - const content = await Deno.readTextFile("manifests/secret.yaml"); + let content = await Deno.readTextFile("manifests/secret.yaml"); // Should have placeholder values only - const hasExampleValues = content.includes("EXAMPLE") || content.includes("CHANGEME"); + let hasExampleValues = content.includes("EXAMPLE") || content.includes("CHANGEME"); assertEquals(hasExampleValues, true); // Should not contain realistic API tokens or private keys // Real ZT tokens are typically alphanumeric strings of specific length - const hasRealToken = /[a-zA-Z0-9]{20,}/.test(content) && !content.includes("EXAMPLE"); + let hasRealToken = /[a-zA-Z0-9]{20,}/.test(content) && !content.includes("EXAMPLE"); assertEquals(hasRealToken, false); }); Deno.test("contract: INVARIANT — NetworkPolicy must restrict ingress rules", async () => { - const content = await Deno.readTextFile("manifests/networkpolicy.yaml"); + let content = await Deno.readTextFile("manifests/networkpolicy.yaml"); // Must have explicit ingress rules assertStringIncludes(content, "ingress:"); @@ -62,7 +59,7 @@ Deno.test("contract: INVARIANT — NetworkPolicy must restrict ingress rules", a }); Deno.test("contract: INVARIANT — NetworkPolicy must restrict egress rules", async () => { - const content = await Deno.readTextFile("manifests/networkpolicy.yaml"); + let content = await Deno.readTextFile("manifests/networkpolicy.yaml"); // Must have explicit egress rules assertStringIncludes(content, "egress:"); @@ -70,12 +67,12 @@ Deno.test("contract: INVARIANT — NetworkPolicy must restrict egress rules", as }); Deno.test("contract: INVARIANT — DaemonSet namespace must match namespace.yaml", async () => { - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); - const namespaceContent = await Deno.readTextFile("manifests/namespace.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let namespaceContent = await Deno.readTextFile("manifests/namespace.yaml"); // Extract and compare namespaces - const dsNsMatch = daemonsetContent.match(/namespace:\s*([a-z0-9-]+)/); - const declaredNsMatch = namespaceContent.match(/metadata:\s*\n\s*name:\s*([a-z0-9-]+)/); + let dsNsMatch = daemonsetContent.match(/namespace:\s*([a-z0-9-]+)/); + let declaredNsMatch = namespaceContent.match(/metadata:\s*\n\s*name:\s*([a-z0-9-]+)/); if (dsNsMatch && declaredNsMatch) { assertEquals(dsNsMatch[1], declaredNsMatch[1]); @@ -83,16 +80,16 @@ Deno.test("contract: INVARIANT — DaemonSet namespace must match namespace.yaml }); Deno.test("contract: INVARIANT — All ABI files must have module declarations", async () => { - const abiFiles = ["src/abi/Layout.idr", "src/abi/Types.idr", "src/abi/Foreign.idr"]; + let abiFiles = ["src/abi/Layout.idr", "src/abi/Types.idr", "src/abi/Foreign.idr"]; for (const file of abiFiles) { - const content = await Deno.readTextFile(file); + let content = await Deno.readTextFile(file); assertEquals(content.includes("module"), true); } }); Deno.test("contract: INVARIANT — Network config must define both IPv4 and IPv6", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Must have IPv4 pool assertStringIncludes(content, "ipv4_assignment_pool"); @@ -101,74 +98,73 @@ Deno.test("contract: INVARIANT — Network config must define both IPv4 and IPv6 }); Deno.test("contract: INVARIANT — Routes must reference valid destinations", async () => { - const content = await Deno.readTextFile("configs/routes.ncl"); + let content = await Deno.readTextFile("configs/routes.ncl"); // Should have at least one route with CIDR notation - const hasCidr = /(?:destination|target)\s*=\s*"[^"]+\/\d+"/.test(content); + let hasCidr = /(?:destination|target)\s*=\s*"[^"]+\/\d+"/.test(content); assertEquals(hasCidr, true); }); Deno.test("contract: INVARIANT — Firewall must have zerotier zone definition", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); // Must define zerotier zone assertStringIncludes(content, "zerotier"); }); Deno.test("contract: INVARIANT — DaemonSet must request privileged capabilities", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); // Network overlay requires NET_ADMIN capability assertStringIncludes(content, "NET_ADMIN"); }); Deno.test("contract: INVARIANT — DaemonSet must use hostNetwork=true", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); // Network overlay requires direct host network access assertStringIncludes(content, "hostNetwork: true"); }); Deno.test("contract: INVARIANT — ConfigMap must be named zerotier-config", async () => { - const content = await Deno.readTextFile("manifests/configmap.yaml"); + let content = await Deno.readTextFile("manifests/configmap.yaml"); // Name validation assertStringIncludes(content, "zerotier-config"); }); Deno.test("contract: INVARIANT — Secret must be named zerotier-credentials", async () => { - const content = await Deno.readTextFile("manifests/secret.yaml"); + let content = await Deno.readTextFile("manifests/secret.yaml"); // Name validation assertStringIncludes(content, "zerotier-credentials"); }); Deno.test("contract: INVARIANT — Network config must not allow default route via ZT", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Should disable default route capability (security measure) assertStringIncludes(content, "allow_default_route = false"); }); Deno.test("contract: INVARIANT — Firewall control plane rule must use port 9993", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); // ZeroTier control plane is always port 9993 assertStringIncludes(content, "9993"); }); Deno.test("contract: INVARIANT — All config files must have SPDX headers", async () => { - const files = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; + let files = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; for (const file of files) { - const content = await Deno.readTextFile(file); + let content = await Deno.readTextFile(file); assertStringIncludes(content, "SPDX-License-Identifier"); } }); Deno.test("contract: INVARIANT — Layout.idr must import Types module", async () => { - const content = await Deno.readTextFile("src/abi/Layout.idr"); + let content = await Deno.readTextFile("src/abi/Layout.idr"); assertStringIncludes(content, "import ZEROTIER_K8S_LINK.ABI.Types"); }); -==================================== */ diff --git a/tests/e2e/network_e2e_test.affine b/tests/e2e/network_e2e_test.affine index f3c6872..0ce8101 100644 --- a/tests/e2e/network_e2e_test.affine +++ b/tests/e2e/network_e2e_test.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module network_e2e_test; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -14,7 +11,7 @@ module network_e2e_test; import { assertEquals, assertStringIncludes } from "https://deno.land/std@0.208.0/assert/mod.ts"; Deno.test("e2e: full config pipeline - read all Nickel configs", async () => { - const configs = [ + let configs = [ await Deno.readTextFile("configs/network.ncl"), await Deno.readTextFile("configs/firewall.ncl"), await Deno.readTextFile("configs/routes.ncl"), @@ -27,12 +24,12 @@ Deno.test("e2e: full config pipeline - read all Nickel configs", async () => { }); Deno.test("e2e: K8s daemonset references correct namespace", async () => { - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); - const namespaceContent = await Deno.readTextFile("manifests/namespace.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let namespaceContent = await Deno.readTextFile("manifests/namespace.yaml"); // Extract namespace names - const daemonsetNs = daemonsetContent.match(/namespace:\s*([a-z0-9-]+)/); - const declaredNs = namespaceContent.match(/metadata:\s*\n\s*name:\s*([a-z0-9-]+)/); + let daemonsetNs = daemonsetContent.match(/namespace:\s*([a-z0-9-]+)/); + let declaredNs = namespaceContent.match(/metadata:\s*\n\s*name:\s*([a-z0-9-]+)/); if (daemonsetNs && declaredNs) { assertEquals(daemonsetNs[1], declaredNs[1]); @@ -40,8 +37,8 @@ Deno.test("e2e: K8s daemonset references correct namespace", async () => { }); Deno.test("e2e: NetworkPolicy references zerotier app labels", async () => { - const policyContent = await Deno.readTextFile("manifests/networkpolicy.yaml"); - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let policyContent = await Deno.readTextFile("manifests/networkpolicy.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); // Both should reference the same app label assertStringIncludes(policyContent, "app.kubernetes.io/name: zerotier"); @@ -49,8 +46,8 @@ Deno.test("e2e: NetworkPolicy references zerotier app labels", async () => { }); Deno.test("e2e: routes don't conflict with firewall deny rules", async () => { - const routesContent = await Deno.readTextFile("configs/routes.ncl"); - const firewallContent = await Deno.readTextFile("configs/firewall.ncl"); + let routesContent = await Deno.readTextFile("configs/routes.ncl"); + let firewallContent = await Deno.readTextFile("configs/firewall.ncl"); // Firewall should have DROP policy but allow zerotier assertStringIncludes(firewallContent, "input_policy = \"DROP\""); @@ -61,10 +58,10 @@ Deno.test("e2e: routes don't conflict with firewall deny rules", async () => { }); Deno.test("e2e: secret manifest does not contain real credentials", async () => { - const secretContent = await Deno.readTextFile("manifests/secret.yaml"); + let secretContent = await Deno.readTextFile("manifests/secret.yaml"); // Should not contain realistic credentials (no real tokens) - const hasPlaceholder = secretContent.includes("EXAMPLE") || secretContent.includes("CHANGEME"); + let hasPlaceholder = secretContent.includes("EXAMPLE") || secretContent.includes("CHANGEME"); assertEquals(hasPlaceholder, true); // Should not contain common token patterns (real tokens are usually longer) @@ -72,19 +69,19 @@ Deno.test("e2e: secret manifest does not contain real credentials", async () => }); Deno.test("e2e: network config IPv6 pool is valid format", async () => { - const networkContent = await Deno.readTextFile("configs/network.ncl"); + let networkContent = await Deno.readTextFile("configs/network.ncl"); // Should have IPv6 prefix in valid format - const ipv6Match = networkContent.match(/prefix\s*=\s*"([^"]+)"/); + let ipv6Match = networkContent.match(/prefix\s*=\s*"([^"]+)"/); if (ipv6Match) { - const ipv6Prefix = ipv6Match[1]; + let ipv6Prefix = ipv6Match[1]; // Should be valid IPv6 CIDR (contain colons and /prefix) assertEquals(/[a-f0-9:]+\/\d+/.test(ipv6Prefix), true); } }); Deno.test("e2e: configmap provides auto-join configuration", async () => { - const configmapContent = await Deno.readTextFile("manifests/configmap.yaml"); + let configmapContent = await Deno.readTextFile("manifests/configmap.yaml"); // Should have some configuration keys assertStringIncludes(configmapContent, "kind: ConfigMap"); @@ -92,16 +89,16 @@ Deno.test("e2e: configmap provides auto-join configuration", async () => { }); Deno.test("e2e: daemonset includes health check configuration", async () => { - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); // Should have liveness or readiness probes assertEquals(daemonsetContent.includes("livenessProbe:") || daemonsetContent.includes("readinessProbe:"), true); }); Deno.test("e2e: all manifest references use existing configmap/secret", async () => { - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); - const configmapContent = await Deno.readTextFile("manifests/configmap.yaml"); - const secretContent = await Deno.readTextFile("manifests/secret.yaml"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let configmapContent = await Deno.readTextFile("manifests/configmap.yaml"); + let secretContent = await Deno.readTextFile("manifests/secret.yaml"); // Daemonset references zerotier-config configmap assertStringIncludes(daemonsetContent, "zerotier-config"); @@ -114,24 +111,24 @@ Deno.test("e2e: all manifest references use existing configmap/secret", async () assertStringIncludes(secretContent, "zerotier-credentials"); }); -Deno.test("e2e: firewall zones reference zerotier interface pattern", async () => { - const firewallContent = await Deno.readTextFile("configs/firewall.ncl"); +Deno.test("e2e: firewall zones reference zerotier struct pattern", async () => { + let firewallContent = await Deno.readTextFile("configs/firewall.ncl"); - // Should have zerotier zone with zt+ interface pattern + // Should have zerotier zone with zt+ struct pattern assertStringIncludes(firewallContent, "zerotier"); assertStringIncludes(firewallContent, "zt+"); }); Deno.test("e2e: routes match network config IP pools", async () => { - const networkContent = await Deno.readTextFile("configs/network.ncl"); - const routesContent = await Deno.readTextFile("configs/routes.ncl"); + let networkContent = await Deno.readTextFile("configs/network.ncl"); + let routesContent = await Deno.readTextFile("configs/routes.ncl"); // Extract the IPv4 pool range from network config - const networkPoolMatch = networkContent.match(/start\s*=\s*"(\d+\.\d+\.\d+\.\d+)"/); + let networkPoolMatch = networkContent.match(/start\s*=\s*"(\d+\.\d+\.\d+\.\d+)"/); if (networkPoolMatch) { - const ipStart = networkPoolMatch[1]; + let ipStart = networkPoolMatch[1]; // Extract subnet from IP - const subnet = ipStart.split(".").slice(0, 3).join(".") + ".0/24"; + let subnet = ipStart.split(".").slice(0, 3).join(".") + ".0/24"; // Routes should reference this subnet assertStringIncludes(routesContent, "10.147.17.0/24"); @@ -139,8 +136,8 @@ Deno.test("e2e: routes match network config IP pools", async () => { }); Deno.test("e2e: capabilities in network config align with daemonset permissions", async () => { - const networkContent = await Deno.readTextFile("configs/network.ncl"); - const daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); + let networkContent = await Deno.readTextFile("configs/network.ncl"); + let daemonsetContent = await Deno.readTextFile("manifests/daemonset.yaml"); // Network config should allow managed IPs assertStringIncludes(networkContent, "allow_managed_ips = true"); @@ -149,4 +146,3 @@ Deno.test("e2e: capabilities in network config align with daemonset permissions" assertStringIncludes(daemonsetContent, "NET_ADMIN"); }); -==================================== */ diff --git a/tests/property/network_property_test.affine b/tests/property/network_property_test.affine index f45914b..1eb55f3 100644 --- a/tests/property/network_property_test.affine +++ b/tests/property/network_property_test.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module network_property_test; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -15,11 +12,11 @@ import { assertEquals } from "https://deno.land/std@0.208.0/assert/mod.ts"; // Property: Config files are repeatedly readable Deno.test("property: Nickel configs readable in 100-iteration loop", async () => { - const configs = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; + let configs = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; for (let i = 0; i < 100; i++) { for (const config of configs) { - const content = await Deno.readTextFile(config); + let content = await Deno.readTextFile(config); assertEquals(typeof content, "string"); } } @@ -27,10 +24,10 @@ Deno.test("property: Nickel configs readable in 100-iteration loop", async () => // Property: Nickel files follow naming conventions (lowercase-hyphen) Deno.test("property: Nickel files follow lowercase-hyphen naming", async () => { - const configs = ["network.ncl", "firewall.ncl", "routes.ncl"]; + let configs = ["network.ncl", "firewall.ncl", "routes.ncl"]; for (const config of configs) { - const filename = config.replace(".ncl", ""); + let filename = config.replace(".ncl", ""); // Should be lowercase and hyphenated (no CamelCase, no SCREAMING_SNAKE_CASE) assertEquals(/^[a-z-]+$/.test(filename), true); } @@ -38,7 +35,7 @@ Deno.test("property: Nickel files follow lowercase-hyphen naming", async () => { // Property: Manifest files follow lowercase-hyphen-yaml naming Deno.test("property: Kubernetes manifest files follow naming conventions", async () => { - const manifests = [ + let manifests = [ "configmap.yaml", "daemonset.yaml", "namespace.yaml", @@ -48,7 +45,7 @@ Deno.test("property: Kubernetes manifest files follow naming conventions", async ]; for (const manifest of manifests) { - const filename = manifest.replace(".yaml", ""); + let filename = manifest.replace(".yaml", ""); // Should be lowercase and hyphenated (no CamelCase) assertEquals(/^[a-z-]+$/.test(filename), true); } @@ -56,15 +53,15 @@ Deno.test("property: Kubernetes manifest files follow naming conventions", async // Property: ZeroTier network IDs are 16 hex characters when not placeholder Deno.test("property: ZeroTier network ID format validation", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Extract network_id value - const match = content.match(/network_id[^=]*=\s*"([^"]+)"/); + let match = content.match(/network_id[^=]*=\s*"([^"]+)"/); if (match) { - const networkId = match[1]; + let networkId = match[1]; // Either a placeholder (CHANGEME_NETWORK_ID) or 16 hex chars - const isPlaceholder = networkId.includes("CHANGEME") || networkId.includes("EXAMPLE"); - const isValidHex = /^[0-9a-fA-F]{16}$/.test(networkId); + let isPlaceholder = networkId.includes("CHANGEME") || networkId.includes("EXAMPLE"); + let isValidHex = /^[0-9a-fA-F]{16}$/.test(networkId); assertEquals(isPlaceholder || isValidHex, true); } @@ -72,25 +69,25 @@ Deno.test("property: ZeroTier network ID format validation", async () => { // Property: IPv4 pool start < end Deno.test("property: IPv4 assignment pool is valid range", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); // Extract start and end IPs - const startMatch = content.match(/start\s*=\s*"([^"]+)"/); - const endMatch = content.match(/end\s*=\s*"([^"]+)"/); + let startMatch = content.match(/start\s*=\s*"([^"]+)"/); + let endMatch = content.match(/end\s*=\s*"([^"]+)"/); if (startMatch && endMatch) { - const startIp = startMatch[1]; - const endIp = endMatch[1]; + let startIp = startMatch[1]; + let endIp = endMatch[1]; // Basic validation: both look like IPs assertEquals(/^\d+\.\d+\.\d+\.\d+$/.test(startIp), true); assertEquals(/^\d+\.\d+\.\d+\.\d+$/.test(endIp), true); // Convert to numbers for comparison - const startOctets = startIp.split(".").map(Number); - const endOctets = endIp.split(".").map(Number); - const startNum = startOctets[0] * 256 ** 3 + startOctets[1] * 256 ** 2 + startOctets[2] * 256 + startOctets[3]; - const endNum = endOctets[0] * 256 ** 3 + endOctets[1] * 256 ** 2 + endOctets[2] * 256 + endOctets[3]; + let startOctets = startIp.split(".").map(Number); + let endOctets = endIp.split(".").map(Number); + let startNum = startOctets[0] * 256 ** 3 + startOctets[1] * 256 ** 2 + startOctets[2] * 256 + startOctets[3]; + let endNum = endOctets[0] * 256 ** 3 + endOctets[1] * 256 ** 2 + endOctets[2] * 256 + endOctets[3]; assertEquals(startNum < endNum, true); } @@ -98,7 +95,7 @@ Deno.test("property: IPv4 assignment pool is valid range", async () => { // Property: Firewall rules have required fields Deno.test("property: Firewall rules have action and type fields", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); // Should contain action fields assertEquals(content.includes("action ="), true); @@ -108,14 +105,14 @@ Deno.test("property: Firewall rules have action and type fields", async () => { // Property: Routes destination formats are valid CIDR Deno.test("property: Route destinations are valid CIDR notation", async () => { - const content = await Deno.readTextFile("configs/routes.ncl"); + let content = await Deno.readTextFile("configs/routes.ncl"); // Extract all destination/target values - const cidrPattern = /(?:destination|target)\s*=\s*"([^"]+)"/g; + let cidrPattern = /(?:destination|target)\s*=\s*"([^"]+)"/g; let match; while ((match = cidrPattern.exec(content)) !== null) { - const cidr = match[1]; + let cidr = match[1]; // Should be in CIDR notation (IP/prefix) assertEquals(/^\d+\.\d+\.\d+\.\d+\/\d+$|^[a-f0-9:]+\/\d+$/.test(cidr), true); } @@ -123,17 +120,17 @@ Deno.test("property: Route destinations are valid CIDR notation", async () => { // Property: All manifest namespaces are consistent Deno.test("property: Kubernetes manifest namespace consistency", async () => { - const manifests = [ + let manifests = [ "manifests/daemonset.yaml", "manifests/networkpolicy.yaml", "manifests/secret.yaml", ]; - const namespaces = new Set(); + let namespaces = new Set(); for (const manifest of manifests) { - const content = await Deno.readTextFile(manifest); - const match = content.match(/namespace:\s*([a-z0-9-]+)/); + let content = await Deno.readTextFile(manifest); + let match = content.match(/namespace:\s*([a-z0-9-]+)/); if (match) { namespaces.add(match[1]); } @@ -145,11 +142,11 @@ Deno.test("property: Kubernetes manifest namespace consistency", async () => { // Property: DaemonSet selector matches pod labels Deno.test("property: DaemonSet selector matches pod labels", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); // Extract selector labels - const selectorMatch = content.match(/selector:\s*\n\s*matchLabels:\s*\n([\s\S]*?)(?=\n\s*template:)/); - const templateMatch = content.match(/template:\s*\n\s*metadata:\s*\n\s*labels:\s*\n([\s\S]*?)(?=\n\s*spec:)/); + let selectorMatch = content.match(/selector:\s*\n\s*matchLabels:\s*\n([\s\S]*?)(?=\n\s*template:)/); + let templateMatch = content.match(/template:\s*\n\s*metadata:\s*\n\s*labels:\s*\n([\s\S]*?)(?=\n\s*spec:)/); if (selectorMatch && templateMatch) { // Both should contain app.kubernetes.io/name: zerotier @@ -160,7 +157,7 @@ Deno.test("property: DaemonSet selector matches pod labels", async () => { // Property: NetworkPolicy targets matching labeled pods Deno.test("property: NetworkPolicy pod selector is defined", async () => { - const content = await Deno.readTextFile("manifests/networkpolicy.yaml"); + let content = await Deno.readTextFile("manifests/networkpolicy.yaml"); // Should have podSelector with labels assertEquals(content.includes("podSelector:"), true); @@ -169,17 +166,17 @@ Deno.test("property: NetworkPolicy pod selector is defined", async () => { // Property: Firewall zone names are valid identifiers Deno.test("property: Firewall zone names are lowercase identifiers", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); // Extract zone names - const zonePattern = /zones\s*=\s*\{([\s\S]*?)\}/; - const match = content.match(zonePattern); + let zonePattern = /zones\s*=\s*\{([\s\S]*?)\}/; + let match = content.match(zonePattern); if (match) { - const zones = match[1].match(/(\w+)\s*=\s*\{/g); + let zones = match[1].match(/(\w+)\s*=\s*\{/g); if (zones) { for (const zone of zones) { - const zoneName = zone.replace(/[=\s{]/g, ""); + let zoneName = zone.replace(/[=\s{]/g, ""); // Should be lowercase alphanumeric assertEquals(/^[a-z0-9_]+$/.test(zoneName), true); } @@ -187,4 +184,3 @@ Deno.test("property: Firewall zone names are lowercase identifiers", async () => } }); -==================================== */ diff --git a/tests/smoke/infra_smoke_test.affine b/tests/smoke/infra_smoke_test.affine index 3faec9e..650cd32 100644 --- a/tests/smoke/infra_smoke_test.affine +++ b/tests/smoke/infra_smoke_test.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module infra_smoke_test; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -14,7 +11,7 @@ module infra_smoke_test; import { assertEquals, assertStringIncludes } from "https://deno.land/std@0.208.0/assert/mod.ts"; Deno.test("smoke: bash scripts exist with shebangs", async () => { - const scripts = [ + let scripts = [ "scripts/authorize-nodes.sh", "scripts/configure-routes.sh", "scripts/health-check.sh", @@ -22,22 +19,22 @@ Deno.test("smoke: bash scripts exist with shebangs", async () => { ]; for (const script of scripts) { - const content = await Deno.readTextFile(script); + let content = await Deno.readTextFile(script); // Accept #!/bin/bash, #!/bin/sh, or #!/usr/bin/env bash - const hasShebang = content.match(/^#!\/(?:usr\/)?bin\/(bash|sh)/) || content.match(/^#!\/usr\/bin\/env bash/); + let hasShebang = content.match(/^#!\/(?:usr\/)?bin\/(bash|sh)/) || content.match(/^#!\/usr\/bin\/env bash/); assertEquals(hasShebang !== null, true); } }); Deno.test("smoke: setup.sh exists with shell shebang", async () => { - const content = await Deno.readTextFile("setup.sh"); + let content = await Deno.readTextFile("setup.sh"); // Accept #!/bin/bash, #!/bin/sh, or #!/usr/bin/env bash - const hasShebang = content.match(/^#!\/(?:usr\/)?bin\/(bash|sh)/) || content.match(/^#!\/usr\/bin\/env bash/); + let hasShebang = content.match(/^#!\/(?:usr\/)?bin\/(bash|sh)/) || content.match(/^#!\/usr\/bin\/env bash/); assertEquals(hasShebang !== null, true); }); Deno.test("smoke: validation hooks exist with shell shebangs", async () => { - const hooks = [ + let hooks = [ "hooks/validate-codeql.sh", "hooks/validate-permissions.sh", "hooks/validate-sha-pins.sh", @@ -45,25 +42,25 @@ Deno.test("smoke: validation hooks exist with shell shebangs", async () => { ]; for (const hook of hooks) { - const content = await Deno.readTextFile(hook); + let content = await Deno.readTextFile(hook); // Accept #!/bin/bash, #!/bin/sh, or #!/usr/bin/env bash - const hasShebang = content.match(/^#!\/(?:usr\/)?bin\/(bash|sh)/) || content.match(/^#!\/usr\/bin\/env bash/); + let hasShebang = content.match(/^#!\/(?:usr\/)?bin\/(bash|sh)/) || content.match(/^#!\/usr\/bin\/env bash/); assertEquals(hasShebang !== null, true); } }); Deno.test("smoke: Idris2 ABI files exist", async () => { - const abiFiles = ["src/abi/Layout.idr", "src/abi/Types.idr", "src/abi/Foreign.idr"]; + let abiFiles = ["src/abi/Layout.idr", "src/abi/Types.idr", "src/abi/Foreign.idr"]; for (const file of abiFiles) { - const content = await Deno.readTextFile(file); + let content = await Deno.readTextFile(file); assertEquals(typeof content, "string"); assertEquals(content.length > 0, true); } }); Deno.test("smoke: Kubernetes manifests are non-empty YAML", async () => { - const manifests = [ + let manifests = [ "manifests/configmap.yaml", "manifests/daemonset.yaml", "manifests/namespace.yaml", @@ -73,14 +70,14 @@ Deno.test("smoke: Kubernetes manifests are non-empty YAML", async () => { ]; for (const manifest of manifests) { - const content = await Deno.readTextFile(manifest); + let content = await Deno.readTextFile(manifest); assertStringIncludes(content, "apiVersion:"); assertStringIncludes(content, "kind:"); } }); Deno.test("smoke: manifests do not contain hardcoded secrets", async () => { - const secretPatterns = [ + let secretPatterns = [ { content: await Deno.readTextFile("manifests/secret.yaml"), name: "secret.yaml" }, { content: await Deno.readTextFile("manifests/daemonset.yaml"), name: "daemonset.yaml" }, ]; @@ -98,25 +95,24 @@ Deno.test("smoke: manifests do not contain hardcoded secrets", async () => { }); Deno.test("smoke: Idris2 Layout.idr has module declaration", async () => { - const content = await Deno.readTextFile("src/abi/Layout.idr"); + let content = await Deno.readTextFile("src/abi/Layout.idr"); assertStringIncludes(content, "module ZEROTIER_K8S_LINK.ABI.Layout"); }); Deno.test("smoke: Idris2 Types.idr has module declaration", async () => { - const content = await Deno.readTextFile("src/abi/Types.idr"); + let content = await Deno.readTextFile("src/abi/Types.idr"); assertStringIncludes(content, "module ZEROTIER_K8S_LINK.ABI.Types"); }); Deno.test("smoke: Idris2 Foreign.idr exists", async () => { - const content = await Deno.readTextFile("src/abi/Foreign.idr"); + let content = await Deno.readTextFile("src/abi/Foreign.idr"); assertEquals(typeof content, "string"); assertEquals(content.length > 0, true); }); Deno.test("smoke: root manifest file exists", async () => { - const content = await Deno.readTextFile("zerotier-k8s-link.manifest.ncl"); + let content = await Deno.readTextFile("zerotier-k8s-link.manifest.ncl"); assertEquals(typeof content, "string"); assertEquals(content.length > 0, true); }); -==================================== */ diff --git a/tests/unit/config_structure_test.affine b/tests/unit/config_structure_test.affine index 5862ecf..07fead4 100644 --- a/tests/unit/config_structure_test.affine +++ b/tests/unit/config_structure_test.affine @@ -1,11 +1,8 @@ // SPDX-License-Identifier: MPL-2.0 -// Ported via Harvard Engine mechanical processor +// Ported via Harvard Engine (Semantic pass) module config_structure_test; -// TODO: Complete semantic implementation - -/* === ORIGINAL TYPESCRIPT CONTEXT === // SPDX-License-Identifier: MPL-2.0 // Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) // @@ -14,10 +11,10 @@ module config_structure_test; import { assertEquals, assertExists, assertStringIncludes } from "https://deno.land/std@0.208.0/assert/mod.ts"; Deno.test("unit: Nickel config files exist", async () => { - const configs = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; + let configs = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; for (const config of configs) { - const content = await Deno.readTextFile(config); + let content = await Deno.readTextFile(config); assertExists(content); assertEquals(typeof content, "string"); assertEquals(content.length > 0, true); @@ -25,7 +22,7 @@ Deno.test("unit: Nickel config files exist", async () => { }); Deno.test("unit: Kubernetes manifest files exist", async () => { - const manifests = [ + let manifests = [ "manifests/configmap.yaml", "manifests/daemonset.yaml", "manifests/namespace.yaml", @@ -35,7 +32,7 @@ Deno.test("unit: Kubernetes manifest files exist", async () => { ]; for (const manifest of manifests) { - const content = await Deno.readTextFile(manifest); + let content = await Deno.readTextFile(manifest); assertExists(content); assertEquals(typeof content, "string"); assertEquals(content.length > 0, true); @@ -43,16 +40,16 @@ Deno.test("unit: Kubernetes manifest files exist", async () => { }); Deno.test("unit: Nickel configs have SPDX headers", async () => { - const configs = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; + let configs = ["configs/network.ncl", "configs/firewall.ncl", "configs/routes.ncl"]; for (const config of configs) { - const content = await Deno.readTextFile(config); + let content = await Deno.readTextFile(config); assertStringIncludes(content, "SPDX-License-Identifier: MPL-2.0"); } }); Deno.test("unit: network.ncl contains ZeroTier config", async () => { - const content = await Deno.readTextFile("configs/network.ncl"); + let content = await Deno.readTextFile("configs/network.ncl"); assertStringIncludes(content, "network_id"); assertStringIncludes(content, "api_token"); assertStringIncludes(content, "ipv4_assignment_pool"); @@ -61,7 +58,7 @@ Deno.test("unit: network.ncl contains ZeroTier config", async () => { }); Deno.test("unit: firewall.ncl contains firewall rules", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); assertStringIncludes(content, "rules"); assertStringIncludes(content, "zerotier_control"); assertStringIncludes(content, "established"); @@ -71,13 +68,13 @@ Deno.test("unit: firewall.ncl contains firewall rules", async () => { }); Deno.test("unit: firewall.ncl has deny-by-default policy", async () => { - const content = await Deno.readTextFile("configs/firewall.ncl"); + let content = await Deno.readTextFile("configs/firewall.ncl"); assertStringIncludes(content, `input_policy = "DROP"`); assertStringIncludes(content, `forward_policy = "DROP"`); }); Deno.test("unit: routes.ncl contains route definitions", async () => { - const content = await Deno.readTextFile("configs/routes.ncl"); + let content = await Deno.readTextFile("configs/routes.ncl"); assertStringIncludes(content, "static_routes"); assertStringIncludes(content, "network_routes"); assertStringIncludes(content, "10.147.17.0/24"); @@ -85,14 +82,14 @@ Deno.test("unit: routes.ncl contains route definitions", async () => { }); Deno.test("unit: daemonset.yaml references zerotier-system namespace", async () => { - const content = await Deno.readTextFile("manifests/daemonset.yaml"); + let content = await Deno.readTextFile("manifests/daemonset.yaml"); assertStringIncludes(content, "namespace: zerotier-system"); assertStringIncludes(content, "kind: DaemonSet"); assertStringIncludes(content, "app.kubernetes.io/name: zerotier"); }); Deno.test("unit: networkpolicy.yaml has ingress and egress rules", async () => { - const content = await Deno.readTextFile("manifests/networkpolicy.yaml"); + let content = await Deno.readTextFile("manifests/networkpolicy.yaml"); assertStringIncludes(content, "kind: NetworkPolicy"); assertStringIncludes(content, "ingress:"); assertStringIncludes(content, "egress:"); @@ -102,27 +99,26 @@ Deno.test("unit: networkpolicy.yaml has ingress and egress rules", async () => { }); Deno.test("unit: secret.yaml has placeholder values only", async () => { - const content = await Deno.readTextFile("manifests/secret.yaml"); + let content = await Deno.readTextFile("manifests/secret.yaml"); assertStringIncludes(content, "kind: Secret"); assertStringIncludes(content, "network-id: \"EXAMPLE_NETWORK_ID\""); assertStringIncludes(content, "api-token: \"EXAMPLE_API_TOKEN\""); }); Deno.test("unit: namespace.yaml declares zerotier-system", async () => { - const content = await Deno.readTextFile("manifests/namespace.yaml"); + let content = await Deno.readTextFile("manifests/namespace.yaml"); assertStringIncludes(content, "kind: Namespace"); assertStringIncludes(content, "zerotier-system"); }); Deno.test("unit: configmap.yaml exists and is valid YAML", async () => { - const content = await Deno.readTextFile("manifests/configmap.yaml"); + let content = await Deno.readTextFile("manifests/configmap.yaml"); assertStringIncludes(content, "kind: ConfigMap"); }); Deno.test("unit: servicemonitor.yaml exists and is valid YAML", async () => { - const content = await Deno.readTextFile("manifests/servicemonitor.yaml"); + let content = await Deno.readTextFile("manifests/servicemonitor.yaml"); // ServiceMonitor may be optional but should validate if present assertEquals(typeof content, "string"); }); -==================================== */