
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
deprivation
Advanced tools
testing facilitation, by converting Unit Under Test to a sandboxed version, that exposes module internals without the need to export them.
This module facilitate whitebox and blackbox testing (binding it with conventional UT and MT paradigms) of nodejs applications.
We define a module as a folder with implementations.
These are the two main modes of operation of the deprivation module:
whitebox unit
blackbox module
Both modes enable auto mocking.
Behind the curtains it uses the Node's VM module, and plows the require.cache.
npm install deprivation
For running a complete suite of tests use the npm test command.
Example implementation (Unit Under Test).
var glob = require('glob');
var dep = require('./dep.js');
var myPrivateFunc = function(param){
return glob.GlobSync(param);
};
var publicFunc = function(param) {
return myPrivateFunc(param);
};
var callAnotherGlob = function() {
return dep('huhu');
};
module.exports.publicFunc = publicFunc;
An example test file.
var chamber = require("deprivation").chamber;
var session = chamber("./implementation.js");
// uut - Unit Under Test
var uut = session.whitebox();
uut.publicFunc("blabla"); // nothing special. Will call private func, which calls the original glob.GlobSync.
uut.myPrivateFunc("blabla"); // However... note that this func is not exported, but still accessible in a test!
uut.glob.GlobSync("blabla") // or even this...
It's possible to inject any type of a test double: mock, spy, stub, fake, etc., into the UUT.
Example dependency of UUT.
// dep.js
module.exports = require('glob').GlobSync;
// let's get rid of glob.GlobSync dependency
uut.glob.GlobSync = function(){};
// all calls execute the dummy function
uut.publicFunc('blabla');
uut.myPrivateFunc('blabla');
uut.glob.GlobSync('blabla');
// ...but not this one!
uut.callAnotherGlob();
Leads to a different result:
var myGlob = {GlobSync: function() {return './.ssh/id_rsa.priv'}}
var session = chamber('./implementation.js', {replace:[{'glob': myGlob}]});
var uut = session.whitebox();
// all calls return './.ssh/id_rsa.priv'
uut.glob.GlobSync('something');
uut.callAnotherGlob('something');
If a function exists, which accepts an object, and returns its test double,
// A jasmine spy-maker example
var myReplacer = function (obj) {
Object.keys(obj).forEach(function (item) {
spyOn(obj, item);
});
};
it can be passed on with the replacer option.
seance = chamber("myModule/impl.js", {replace: ['glob', '../*'], replacer: myReplacer});
In the above example
'*' replaces all implementations (within the same folder too!)
An example test suite (jasmine/mocha):
beforeEach(function () {
sut = seance.blackbox();
spies = seance.getTestDoubles();
});
spies above are the spy objects references, stored in a dictionary. This allows to work with objects, that are inaccessible from the module's public interface.
The expectation may be set, using the obtained references.
it('uses GlobSync', function () {
sut.arrangeHeapDumps('bleble');
expect(spies['node_modules/glob/glob.js'].GlobSync).toHaveBeenCalled();
});
Test doubles are accessed using the path relative to the process current directory. This is the most readable way to specify, which test double object is referenced (the glob package may be used by other sub-packages, in different versions, etc.)
Clone the project from the repository and refer to the test/*.* files for more examples.
FAQs
testing facilitation, by converting Unit Under Test to a sandboxed version, that exposes module internals without the need to export them.
The npm package deprivation receives a total of 16 weekly downloads. As such, deprivation popularity was classified as not popular.
We found that deprivation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.