@@ -30,25 +30,27 @@ describe('detectPublishSecurityDowngradeForVersion', () => {
3030 expect ( result ) . toEqual ( {
3131 downgradedVersion : '1.0.1' ,
3232 downgradedPublishedAt : '2026-01-02T00:00:00.000Z' ,
33+ downgradedTrustLevel : 'none' ,
3334 trustedVersion : '1.0.0' ,
3435 trustedPublishedAt : '2026-01-01T00:00:00.000Z' ,
36+ trustedTrustLevel : 'provenance' ,
3537 } )
3638 } )
3739
38- it ( 'flags trust downgrade from provenance to trustedPublisher ' , ( ) => {
40+ it ( 'flags trust downgrade from trustedPublisher to provenance ' , ( ) => {
3941 const result = detectPublishSecurityDowngradeForVersion (
4042 [
4143 {
4244 version : '1.0.0' ,
4345 time : '2026-01-01T00:00:00.000Z' ,
4446 hasProvenance : true ,
45- trustLevel : 'provenance ' ,
47+ trustLevel : 'trustedPublisher ' ,
4648 } ,
4749 {
4850 version : '1.0.1' ,
4951 time : '2026-01-02T00:00:00.000Z' ,
5052 hasProvenance : true ,
51- trustLevel : 'trustedPublisher ' ,
53+ trustLevel : 'provenance ' ,
5254 } ,
5355 ] ,
5456 '1.0.1' ,
@@ -57,11 +59,35 @@ describe('detectPublishSecurityDowngradeForVersion', () => {
5759 expect ( result ) . toEqual ( {
5860 downgradedVersion : '1.0.1' ,
5961 downgradedPublishedAt : '2026-01-02T00:00:00.000Z' ,
62+ downgradedTrustLevel : 'provenance' ,
6063 trustedVersion : '1.0.0' ,
6164 trustedPublishedAt : '2026-01-01T00:00:00.000Z' ,
65+ trustedTrustLevel : 'trustedPublisher' ,
6266 } )
6367 } )
6468
69+ it ( 'does not flag upgrade from provenance to trustedPublisher' , ( ) => {
70+ const result = detectPublishSecurityDowngradeForVersion (
71+ [
72+ {
73+ version : '1.0.0' ,
74+ time : '2026-01-01T00:00:00.000Z' ,
75+ hasProvenance : true ,
76+ trustLevel : 'provenance' ,
77+ } ,
78+ {
79+ version : '1.0.1' ,
80+ time : '2026-01-02T00:00:00.000Z' ,
81+ hasProvenance : true ,
82+ trustLevel : 'trustedPublisher' ,
83+ } ,
84+ ] ,
85+ '1.0.1' ,
86+ )
87+
88+ expect ( result ) . toBeNull ( )
89+ } )
90+
6591 it ( 'flags ongoing downgraded versions until an upgrade happens' , ( ) => {
6692 const versions = [
6793 {
@@ -216,29 +242,61 @@ describe('detectPublishSecurityDowngradeForVersion', () => {
216242 expect ( result ?. trustedVersion ) . toBe ( '2.0.0' )
217243 } )
218244
219- it ( 'uses trustedPublisher rank (not provenance) for hasProvenance fallback without trustLevel' , ( ) => {
220- // When trustLevel is absent, hasProvenance: true should map to trustedPublisher rank,
221- // not provenance rank. This means a version with only hasProvenance: true should NOT
222- // be considered a downgrade from trustedPublisher.
245+ it ( 'uses provenance rank (not trustedPublisher) for hasProvenance fallback without trustLevel' , ( ) => {
246+ // When trustLevel is absent, hasProvenance: true should map to provenance rank,
247+ // not trustedPublisher rank. This means a version with only hasProvenance: true
248+ // should be considered a downgrade from trustedPublisher.
249+ const result = detectPublishSecurityDowngradeForVersion (
250+ [
251+ {
252+ version : '1.0.0' ,
253+ time : '2026-01-01T00:00:00.000Z' ,
254+ hasProvenance : true ,
255+ trustLevel : 'trustedPublisher' ,
256+ } ,
257+ {
258+ version : '1.0.1' ,
259+ time : '2026-01-02T00:00:00.000Z' ,
260+ hasProvenance : true ,
261+ // no trustLevel — fallback path maps to provenance
262+ } ,
263+ ] ,
264+ '1.0.1' ,
265+ )
266+
267+ // hasProvenance fallback maps to provenance (rank 1), trustedPublisher is rank 2, so this is a downgrade
268+ expect ( result ) . toEqual ( {
269+ downgradedVersion : '1.0.1' ,
270+ downgradedPublishedAt : '2026-01-02T00:00:00.000Z' ,
271+ downgradedTrustLevel : 'provenance' ,
272+ trustedVersion : '1.0.0' ,
273+ trustedPublishedAt : '2026-01-01T00:00:00.000Z' ,
274+ trustedTrustLevel : 'trustedPublisher' ,
275+ } )
276+ } )
277+
278+ it ( 'does not flag hasProvenance fallback against provenance trustLevel' , ( ) => {
279+ // When trustLevel is absent, hasProvenance: true maps to provenance rank.
280+ // An explicit provenance trustLevel is the same rank, so no downgrade.
223281 const result = detectPublishSecurityDowngradeForVersion (
224282 [
225283 {
226284 version : '1.0.0' ,
227285 time : '2026-01-01T00:00:00.000Z' ,
228286 hasProvenance : true ,
229- // no trustLevel — fallback path
287+ // no trustLevel — fallback path maps to provenance
230288 } ,
231289 {
232290 version : '1.0.1' ,
233291 time : '2026-01-02T00:00:00.000Z' ,
234292 hasProvenance : true ,
235- trustLevel : 'trustedPublisher ' ,
293+ trustLevel : 'provenance ' ,
236294 } ,
237295 ] ,
238296 '1.0.1' ,
239297 )
240298
241- // Both should be treated as trustedPublisher rank, so no downgrade
299+ // Both are provenance rank, so no downgrade
242300 expect ( result ) . toBeNull ( )
243301 } )
244302} )
0 commit comments