girenit/Argus
0
1import assert from "node:assert/strict";2import { readFile } from "node:fs/promises";3import test from "node:test";4 5const root = new URL("../", import.meta.url);6const read = (path) => readFile(new URL(path, root), "utf8");7 8const demoUrl = "https://werea-co-argus-security-console.static.hf.space/index.html";9 10test("Hugging Face metadata defines the Argus static overview Space", async () => {11 const readme = await read("README.md");12 assert.match(readme, /^---[\s\S]*?title: Argus$/m);13 assert.match(readme, /^sdk: static$/m);14 assert.match(readme, /^app_file: index\.html$/m);15 assert.match(readme, /^fullWidth: true$/m);16 assert.doesNotMatch(readme, /pipeline_tag|base_model|metrics:/);17});18 19test("the primary demo action targets the existing console Space", async () => {20 const html = await read("index.html");21 assert.match(html, new RegExp(`href=["']${demoUrl}["']`));22 assert.equal((html.match(new RegExp(demoUrl, "g")) ?? []).length, 3);23 assert.equal((html.match(/target="_blank"/g) ?? []).length, 3);24 assert.equal((html.match(/rel="noopener noreferrer"/g) ?? []).length, 3);25 assert.doesNotMatch(html, /href="https:\/\/huggingface\.co\/spaces\/Werea-co\/argus-security-console"/);26});27 28test("public attribution and product boundaries are explicit", async () => {29 const content = `${await read("README.md")}\n${await read("index.html")}`;30 assert.match(content, /owned by We'Rea\. Development by Girenit and GoktugD\./);31 assert.match(content, /synthetic/i);32 assert.match(content, /No production connection/i);33 assert.match(content, /does not claim AI/i);34});35 36test("the overview loads only the local motion script and makes no network requests", async () => {37 const html = await read("index.html");38 const app = await read("app.js");39 assert.match(html, /<script type="module" src="app\.js"><\/script>/);40 assert.equal((html.match(/<script\b/gi) ?? []).length, 1);41 assert.doesNotMatch(`${html}\n${app}`, /fetch\s*\(|XMLHttpRequest|WebSocket|EventSource/);42 assert.match(app, /IntersectionObserver/);43 assert.match(app, /prefers-reduced-motion/);44 assert.match(html, /connect-src 'none'/);45});46 47test("external links are limited to the approved Argus demo", async () => {48 const html = await read("index.html");49 const urls = [...html.matchAll(/https:\/\/[^"'\s<]+/g)].map((match) => match[0]);50 assert.deepEqual([...new Set(urls)], [demoUrl]);51});52 53test("public files contain no secret or private infrastructure patterns", async () => {54 const files = ["README.md", "LICENSE", "package.json", "index.html", "styles.css", "app.js"];55 const content = (await Promise.all(files.map(read))).join("\n");56 const forbidden = [57 /hf_[A-Za-z0-9]{20,}/,58 /\bBearer\s+[A-Za-z0-9._~-]+/i,59 /(?:api[_-]?key|client[_-]?secret|password)\s*[:=]/i,60 /\b(?:10|127)\.(?:\d{1,3}\.){2}\d{1,3}\b/,61 /\b192\.168\.(?:\d{1,3}\.)\d{1,3}\b/,62 /\b172\.(?:1[6-9]|2\d|3[01])\.(?:\d{1,3}\.)\d{1,3}\b/,63 ];64 for (const pattern of forbidden) assert.doesNotMatch(content, pattern);65});66 67test("HTML includes baseline accessibility and security controls", async () => {68 const html = await read("index.html");69 const css = await read("styles.css");70 assert.match(html, /<html lang="tr"/);71 assert.match(html, /<meta name="viewport"/);72 assert.match(html, /class="skip-link" href="#main-content"/);73 assert.match(html, /<main id="main-content"/);74 assert.match(html, /aria-label="Argus Security Console demosunu aç"/);75 assert.match(css, /prefers-reduced-motion/);76});77 78test("the interactive product tour exposes four truthful views", async () => {79 const html = await read("index.html");80 const scenes = [...html.matchAll(/data-scene="([^"]+)"/g)].map((match) => match[1]);81 assert.deepEqual(scenes, ["fleet", "endpoints", "events", "policies"]);82 assert.match(html, /Unknown and stale states are never counted as passing\./);83 assert.match(html, /Synthetic event/g);84});85