Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

test/support/fixtures/accounts_fixtures.ex

@@ -0,0 +1,114 @@
+defmodule Tarakan.AccountsFixtures do
+  @moduledoc false
+
+  alias Tarakan.Accounts
+
+  def github_account_fixture(overrides \\ %{}) do
+    unique_id = System.unique_integer([:positive])
+
+    profile =
+      Map.merge(
+        %{
+          provider_uid: unique_id,
+          provider_login: "contributor-#{unique_id}",
+          name: "Tarakan Contributor",
+          avatar_url: "https://avatars.githubusercontent.com/u/#{unique_id}",
+          profile_url: "https://github.com/contributor-#{unique_id}"
+        },
+        overrides
+      )
+
+    {:ok, account} = Accounts.upsert_external_identity(:github, profile)
+    account
+  end
+
+  import Ecto.Query
+
+  alias Tarakan.Accounts
+  alias Tarakan.Accounts.Scope
+
+  def unique_account_email, do: "account#{System.unique_integer()}@example.com"
+  def unique_account_handle, do: "account-#{System.unique_integer([:positive])}"
+  def valid_account_password, do: "correct horse battery staple"
+
+  def valid_account_attributes(attrs \\ %{}) do
+    Enum.into(attrs, %{
+      email: unique_account_email(),
+      handle: unique_account_handle()
+    })
+  end
+
+  # Registration no longer stamps confirmed_at: email confirmation happens on
+  # the first magic-link login (see account_fixture/1 below).
+  def unconfirmed_account_fixture(attrs \\ %{}) do
+    {:ok, account} =
+      attrs
+      |> valid_account_attributes()
+      |> Accounts.register_account()
+
+    account
+  end
+
+  def account_fixture(attrs \\ %{}) do
+    account = unconfirmed_account_fixture(attrs)
+
+    token =
+      extract_account_token(fn url ->
+        Accounts.deliver_login_instructions(account, url)
+      end)
+
+    {:ok, {account, _expired_tokens}} =
+      Accounts.login_account_by_magic_link(token)
+
+    account
+  end
+
+  def account_scope_fixture do
+    account = account_fixture()
+    account_scope_fixture(account)
+  end
+
+  def account_scope_fixture(account) do
+    Scope.for_account(account)
+  end
+
+  def set_password(account) do
+    {:ok, {account, _expired_tokens}} =
+      Accounts.update_account_password(account, %{password: valid_account_password()})
+
+    account
+  end
+
+  def extract_account_token(fun) do
+    {:ok, captured_email} = fun.(&"[TOKEN]#{&1}[TOKEN]")
+    [_, token | _] = String.split(captured_email.text_body, "[TOKEN]")
+    token
+  end
+
+  def override_token_authenticated_at(token, authenticated_at) when is_binary(token) do
+    hashed = Accounts.AccountToken.hash_token(token)
+
+    Tarakan.Repo.update_all(
+      from(t in Accounts.AccountToken,
+        where: t.token == ^hashed
+      ),
+      set: [authenticated_at: authenticated_at]
+    )
+  end
+
+  def generate_account_magic_link_token(account) do
+    {encoded_token, account_token} = Accounts.AccountToken.build_email_token(account, "login")
+    Tarakan.Repo.insert!(account_token)
+    {encoded_token, account_token.token}
+  end
+
+  def offset_account_token(token, amount_to_add, unit) do
+    dt = DateTime.add(DateTime.utc_now(:second), amount_to_add, unit)
+    hashed = Accounts.AccountToken.hash_token(token)
+
+    Tarakan.Repo.update_all(
+      from(ut in Accounts.AccountToken, where: ut.token == ^hashed),
+      set: [inserted_at: dt, authenticated_at: dt]
+    )
+  end
+end

test/support/fixtures/scans_fixtures.ex

@@ -0,0 +1,131 @@
+defmodule Tarakan.ScansFixtures do
+  @moduledoc """
+  Test helpers for creating entities via the `Tarakan.Scans` context.
+  """
+
+  import Tarakan.AccountsFixtures
+
+  alias Tarakan.Repositories
+  alias Tarakan.Scans
+  alias Tarakan.Accounts.Account
+
+  @doc """
+  Registers the one repository the GitHub stub can verify.
+  """
+  def github_repository_fixture(account \\ nil) do
+    account = account || github_account_fixture()
+    {:ok, repository} = Repositories.register_github_repository("openai/codex", account)
+    repository
+  end
+
+  @doc "Registers the GitHub fixture and makes it visible for public-record tests."
+  def listed_github_repository_fixture(account \\ nil) do
+    account
+    |> github_repository_fixture()
+    |> listed_repository_fixture()
+  end
+
+  @doc """
+  Inserts a listed Tarakan-hosted repository record.
+
+  Goes through the schema rather than `Tarakan.HostedRepositories.create/2` so
+  no bare repository is written to disk.
+  """
+  def listed_hosted_repository_fixture(account \\ nil) do
+    account = account || github_account_fixture()
+
+    %Tarakan.Repositories.Repository{}
+    |> Tarakan.Repositories.Repository.hosted_changeset(
+      %{"name" => "hosted-#{System.unique_integer([:positive])}", "description" => "Hosted."},
+      account.handle
+    )
+    |> Ecto.Changeset.put_change(:submitted_by_id, account.id)
+    |> Tarakan.Repo.insert!()
+    |> listed_repository_fixture()
+  end
+
+  def listed_repository_fixture(repository) do
+    repository
+    |> Tarakan.Repositories.Repository.listing_changeset(%{listing_status: "listed"})
+    |> Tarakan.Repo.update!()
+  end
+
+  def valid_scan_attributes(overrides \\ %{}) do
+    Enum.into(overrides, %{
+      "commit_sha" => random_commit_sha(),
+      "model" => "claude-sonnet-5",
+      "prompt_version" => "tarakan-baseline/v1",
+      "run_id" => "fixture-#{System.unique_integer([:positive, :monotonic])}",
+      "findings_json" => nil
+    })
+  end
+
+  def scan_fixture(repository, account, overrides \\ %{}) do
+    {:ok, scan} = Scans.submit_scan(repository, account, valid_scan_attributes(overrides))
+    scan
+  end
+
+  def confirmation_fixture(scan, account, verdict \\ "confirmed") do
+    account = reviewer_account(account)
+
+    {:ok, scan} =
+      Scans.record_confirmation(scan, account, %{
+        "verdict" => verdict,
+        "notes" =>
+          "Independently traced and reproduced the reported behavior in a local checkout."
+      })
+
+    scan
+  end
+
+  def reviewer_account_fixture do
+    account_fixture() |> reviewer_account()
+  end
+
+  def moderator_account_fixture do
+    account_fixture() |> moderator_account()
+  end
+
+  def moderator_account(account) do
+    account
+    |> Account.authorization_changeset(%{
+      state: "active",
+      platform_role: "moderator",
+      trust_tier: "reviewer"
+    })
+    |> Tarakan.Repo.update!()
+  end
+
+  def reviewer_account(%Account{platform_role: "moderator", trust_tier: "reviewer"} = account),
+    do: account
+
+  def reviewer_account(account) do
+    account
+    |> Account.authorization_changeset(%{
+      state: "active",
+      platform_role: "moderator",
+      trust_tier: "reviewer"
+    })
+    |> Tarakan.Repo.update!()
+  end
+
+  def findings_json_fixture(count \\ 1) do
+    findings =
+      for index <- 1..count do
+        %{
+          "file" => "lib/example/module_#{index}.ex",
+          "line_start" => index * 10,
+          "line_end" => index * 10 + 5,
+          "severity" => "high",
+          "title" => "Unsanitized input reaches interpolated query (#{index})",
+          "description" => "String-built SQL executed with request parameters."
+        }
+      end
+
+    Jason.encode!(%{"tarakan_scan_format" => 1, "findings" => findings})
+  end
+
+  def random_commit_sha do
+    16 |> :crypto.strong_rand_bytes() |> Base.encode16(case: :lower) |> Kernel.<>("00000000")
+  end
+end

test/support/fixtures/work_fixtures.ex

@@ -0,0 +1,45 @@
+defmodule Tarakan.WorkFixtures do
+  @moduledoc """
+  Test helpers for the public review work queue.
+  """
+
+  alias Tarakan.Work
+
+  def proposed_review_task_fixture(repository, creator, overrides \\ %{}) do
+    {:ok, task} =
+      Work.create_task(repository, creator, valid_review_task_attributes(overrides))
+
+    task
+  end
+
+  def valid_review_task_attributes(overrides \\ %{}) do
+    Enum.into(overrides, %{
+      "commit_sha" => Tarakan.ScansFixtures.random_commit_sha(),
+      "kind" => "threat_model",
+      "capability" => "human",
+      "title" => "Map the authorization boundary",
+      "description" => "Trace organization membership checks and document trust assumptions."
+    })
+  end
+
+  def review_task_fixture(repository, creator, overrides \\ %{}) do
+    task = proposed_review_task_fixture(repository, creator, overrides)
+    publisher = Tarakan.AccountsFixtures.account_fixture()
+
+    publisher =
+      publisher
+      |> Tarakan.Accounts.Account.authorization_changeset(%{
+        state: "active",
+        platform_role: "moderator",
+        trust_tier: "reviewer"
+      })
+      |> Tarakan.Repo.update!()
+
+    {:ok, task} =
+      Work.publish_task(task, publisher, %{
+        "reason" => "The task has a bounded, safe, and useful review scope."
+      })
+
+    task
+  end
+end