fix(audit): compare effective block fields from base snapshots

Author: TheodoreSpeaks

apps/sim/scripts/block-registry-snapshot.test.ts

@@ -0,0 +1,133 @@
+/** @vitest-environment node */
+import { execFileSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join } from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { readBlockRegistryAtRef } from '@/scripts/block-registry-snapshot'
+
+let root: string
+
+function write(path: string, content: string) {
+  const target = join(root, path)
+  mkdirSync(dirname(target), { recursive: true })
+  writeFileSync(target, content)
+}
+
+function git(...args: string[]) {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: 'pipe' }).trim()
+}
+
+function commit() {
+  git('add', '.')
+  git(
+    '-c',
+    'user.name=Test',
+    '-c',
+    'commit.gpgsign=false',
+    '-c',
+    'core.hooksPath=/dev/null',
+    '-c',
+    'user.email=test@example.test',
+    'commit',
+    '-m',
+    'Baseline fixture'
+  )
+  return git('rev-parse', 'HEAD')
+}
+
+beforeEach(() => {
+  root = mkdtempSync(join(tmpdir(), 'registry-snapshot-test-'))
+  git('init', '--quiet')
+  write('.gitignore', 'node_modules\n')
+  write('apps/sim/package.json', JSON.stringify({ name: '@sim/app', type: 'module' }))
+  write(
+    'apps/sim/tsconfig.json',
+    JSON.stringify({ compilerOptions: { paths: { '@/*': ['./*'] } } })
+  )
+})
+
+afterEach(() => rmSync(root, { recursive: true, force: true }))
+
+describe('readBlockRegistryAtRef', () => {
+  it('reads effective IDs from spreads, local arrays, helpers, and derived blocks at the base revision', () => {
+    write(
+      'apps/sim/blocks/registry.ts',
+      `
+import { sharedFields } from '@sim/fields'
+import { triggerFields } from '@/triggers/fields'
+const localFields = [{ id: 'operation', options: [{ id: 'nested-option' }] }, { id: 'encoding' }]
+const LegacyBlock = { type: 'legacy', subBlocks: localFields } satisfies { type: string; subBlocks: { id: string }[] }
+const CurrentBlock = { ...LegacyBlock, type: 'current', subBlocks: LegacyBlock.subBlocks.filter(field => field.id !== 'encoding') }
+const makeFields = () => [...sharedFields, ...triggerFields]
+const SpreadBlock = { type: 'spread', subBlocks: [...localFields, ...makeFields()] }
+export const getBlockRegistry = () => ({ legacy: LegacyBlock, current: CurrentBlock, spread: SpreadBlock })
+`
+    )
+    write('apps/sim/triggers/fields.ts', "export const triggerFields = [{ id: 'trigger' }]\n")
+    write(
+      'packages/fields/package.json',
+      JSON.stringify({ name: '@sim/fields', type: 'module', exports: './index.ts' })
+    )
+    write('packages/fields/index.ts', "export const sharedFields = [{ id: 'shared' }]\n")
+    const base = commit()
+    mkdirSync(join(root, 'node_modules/@sim'), { recursive: true })
+    symlinkSync(join(root, 'packages/fields'), join(root, 'node_modules/@sim/fields'), 'dir')
+    write(
+      'packages/fields/index.ts',
+      "export const sharedFields = [{ id: 'changed-after-base' }]\n"
+    )
+    write('apps/sim/triggers/fields.ts', 'export const triggerFields = []\n')
+    const statusBefore = git('status', '--porcelain')
+
+    expect(readBlockRegistryAtRef(root, base)).toEqual({
+      legacy: ['operation', 'encoding'],
+      current: ['operation'],
+      spread: ['operation', 'encoding', 'shared', 'trigger'],
+    })
+    expect(git('status', '--porcelain')).toBe(statusBefore)
+    expect(readFileSync(join(root, 'packages/fields/index.ts'), 'utf8')).toContain(
+      'changed-after-base'
+    )
+  })
+
+  it('keeps installed third-party dependencies available without treating their output as registry JSON', () => {
+    write(
+      'apps/sim/blocks/registry.ts',
+      `
+import { field } from 'fixture-provider'
+console.log('Registry initialization diagnostic')
+export const getBlockRegistry = () => ({ block: { type: 'block', subBlocks: [field] } })
+`
+    )
+    const base = commit()
+    write(
+      'node_modules/fixture-provider/package.json',
+      JSON.stringify({ name: 'fixture-provider', type: 'module', exports: './index.js' })
+    )
+    write(
+      'node_modules/fixture-provider/index.js',
+      "export const field = { id: 'installed-field' }\n"
+    )
+
+    expect(readBlockRegistryAtRef(root, base)).toEqual({ block: ['installed-field'] })
+  })
+
+  it('fails instead of returning partial IDs when a derived definition cannot load', () => {
+    write(
+      'apps/sim/blocks/registry.ts',
+      `
+import { missingFields } from './missing'
+export const getBlockRegistry = () => ({ block: { type: 'block', subBlocks: missingFields } })
+`
+    )
+    const base = commit()
+    expect(() => readBlockRegistryAtRef(root, base)).toThrow()
+  })
+
+  it('fails when the requested base revision is unavailable', () => {
+    write('apps/sim/blocks/registry.ts', 'export const getBlockRegistry = () => ({})\n')
+    commit()
+    expect(() => readBlockRegistryAtRef(root, 'missing-base')).toThrow()
+  })
+})

apps/sim/scripts/block-registry-snapshot.ts

@@ -0,0 +1,134 @@
+import { execFileSync } from 'node:child_process'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve, sep } from 'node:path'
+import { z } from 'zod'
+
+const registryIdsSchema = z.record(z.string().min(1), z.array(z.string().min(1)))
+
+interface WorkspacePackage {
+  name: string
+  path: string
+  relativePath: string
+}
+
+function readWorkspacePackages(snapshot: string): WorkspacePackage[] {
+  const workspaces: WorkspacePackage[] = []
+  for (const group of ['apps', 'packages']) {
+    const directory = join(snapshot, group)
+    if (!existsSync(directory)) continue
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue
+      const relativePath = join(group, entry.name)
+      const path = join(snapshot, relativePath)
+      const manifestPath = join(path, 'package.json')
+      if (!existsSync(manifestPath)) continue
+      const { name } = z
+        .object({ name: z.string().min(1) })
+        .parse(JSON.parse(readFileSync(manifestPath, 'utf8')))
+      workspaces.push({ name, path, relativePath })
+    }
+  }
+  return workspaces
+}
+
+function linkInstalledDependencies(
+  source: string,
+  target: string,
+  root: string,
+  workspaceNames: Set<string>,
+  scope = ''
+) {
+  if (!existsSync(source)) return
+  mkdirSync(target, { recursive: true })
+  for (const entry of readdirSync(source, { withFileTypes: true })) {
+    const sourcePath = join(source, entry.name)
+    const targetPath = join(target, entry.name)
+    if (entry.name.startsWith('@')) {
+      linkInstalledDependencies(sourcePath, targetPath, root, workspaceNames, `${entry.name}/`)
+      continue
+    }
+    if (workspaceNames.has(scope + entry.name)) continue
+    const resolved = realpathSync(sourcePath)
+    if (['apps', 'packages'].some((group) => resolved.startsWith(join(root, group) + sep))) continue
+    symlinkSync(sourcePath, targetPath, 'dir')
+  }
+}
+
+function linkWorkspaceDependencies(root: string, snapshot: string) {
+  const workspaces = readWorkspacePackages(snapshot)
+  const workspaceNames = new Set(workspaces.map(({ name }) => name))
+  const modules = join(snapshot, 'node_modules')
+  linkInstalledDependencies(join(root, 'node_modules'), modules, root, workspaceNames)
+  for (const workspace of workspaces) {
+    const packageLink = resolve(modules, workspace.name)
+    if (!packageLink.startsWith(modules + sep)) {
+      throw new Error(`Invalid workspace package name: ${workspace.name}`)
+    }
+    mkdirSync(dirname(packageLink), { recursive: true })
+    symlinkSync(workspace.path, packageLink, 'dir')
+    linkInstalledDependencies(
+      join(root, workspace.relativePath, 'node_modules'),
+      join(workspace.path, 'node_modules'),
+      root,
+      workspaceNames
+    )
+  }
+}
+
+/**
+ * Reads effective subblock IDs from the base revision's complete source tree.
+ * Workspace packages resolve inside the snapshot; only installed third-party
+ * dependencies are shared. A failed import or missing revision fails the audit.
+ */
+export function readBlockRegistryAtRef(root: string, ref: string): Record<string, string[]> {
+  root = realpathSync(root)
+  const gitOptions = { cwd: root, encoding: 'utf8' as const, stdio: 'pipe' as const }
+  const commit = execFileSync(
+    'git',
+    ['rev-parse', '--verify', '--end-of-options', `${ref}^{commit}`],
+    gitOptions
+  ).trim()
+  const temporary = mkdtempSync(join(tmpdir(), 'sim-block-registry-'))
+  try {
+    const archive = join(temporary, 'source.tar')
+    const snapshot = join(temporary, 'source')
+    mkdirSync(snapshot)
+    execFileSync('git', ['archive', '--format=tar', `--output=${archive}`, commit], gitOptions)
+    execFileSync('tar', ['-xf', archive, '-C', snapshot])
+    linkWorkspaceDependencies(root, snapshot)
+
+    const script = join(snapshot, 'apps/sim/.block-registry-snapshot.ts')
+    const output = join(temporary, 'ids.json')
+    writeFileSync(
+      script,
+      `
+import { writeFileSync } from 'node:fs'
+import { getBlockRegistry } from '@/blocks/registry'
+
+const entries = Object.values(getBlockRegistry()).map(block => [block.type, block.subBlocks.map(field => field.id)])
+writeFileSync(process.argv[2], JSON.stringify(Object.fromEntries(entries)))
+`
+    )
+    execFileSync('bun', ['--no-env-file', 'run', script, output], {
+      cwd: join(snapshot, 'apps/sim'),
+      encoding: 'utf8',
+      stdio: 'pipe',
+      timeout: 60_000,
+      maxBuffer: 4 * 1024 * 1024,
+    })
+    return registryIdsSchema.parse(JSON.parse(readFileSync(output, 'utf8')))
+  } finally {
+    rmSync(temporary, { recursive: true, force: true })
+  }
+}