
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
constructable
Advanced tools
`constructable` is a very lightweight library to make your code easily testable. It is an alternative for mocking node modules or traditional dependency injection frameworks.
constructable is a very lightweight library to make your code easily testable.
It is an alternative for mocking node modules or traditional dependency injection frameworks.
// index.ts
import {app} from "./app"
app.run()
// app.ts
import {logger} from "./logger"
export const app = {
run: ()=>{
logger.log("app started")
}
}
// logger.ts
export const logger = {
log: (values: ...any[])=>console.log(...values)
}
The only way to unit-test app is to mock the logger module for example with jest.mock
// app.spec.ts
import { app } from "./app";
import { logger } from "./logger";
jest.mock("./logger");
it("logs", () => {
app.run();
expect(app).toHaveBeenCalledWith("app started");
});
Integration tests are exactly the same as unit tests and can only be achieved by module mocking
jest.mock(...) calls, which is easily forgotten.jest.mock(...) was not called. You'll only notice this after running the tests.// index.ts
import {resolve} from "constructable"
import {app} from "./app"
resolve(app).run()
// app.ts
import {logger} from "./logger"
export const app = constructable({logger},({logger})=>({
run: ()=>{
logger.log("app started")
}
}))
// logger.ts
export const logger = constructable({console},({console})=>({
log: (values: ...any[])=>console.log(...values)
}))
// app.spec.ts
import { app } from "./app";
it("logs", () => {
const logger = { log: jest.mock() };
app.construct({ logger }).run(); //construct does not typecheck, if not all dependencies get passed
expect(logger.log).toHaveBeenCalledWith("app started");
});
// app.spec.ts
import {import,resolve,container} from "constructable"
import { app } from "./app";
import { logger } from "./logger";
it("logs", () => {
const loggerMock = {log: jest.mock()}
resolve(app,container().set(logger,loggerMock)).run()
expect(logger.log).toHaveBeenCalledWith("app started");
});
Classic dependency injection frameworks usually require you to think a bit different when bootstrapping your app, than you usually would. This means defining your components in one place, and then wire the whole thing together in a different place (the container). This has the benefit of completely decoupling your components from each other.
With constructable your thinking or project structure won't change much. You just wrap your code everywhere and that's basically it. Your code won't be as decoupled as with classic dependency injection, but testing it is very easy.
MIT
FAQs
`constructable` is a very lightweight library to make your code easily testable. It is an alternative for mocking node modules or traditional dependency injection frameworks.
The npm package constructable receives a total of 2 weekly downloads. As such, constructable popularity was classified as not popular.
We found that constructable demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.