feat: 31 new tests, metrics LLM counters, Dockerfile caching, Makefile targets, compose limits, code fixes

tests/test_nexus.py

@@ -95,3 +95,57 @@ class TestDispatchExtractor:
 
     def test_unknown_ecosystem(self):
         assert extract_package_info("/packages/pkg/1.0/file.tar.gz", "unknown") == ("pkg", "1.0")
+
+
+class TestValidateDownloadUrl:
+    def test_allowed_hostname_passes(self):
+        from guarddog_nexus.core.nexus import _validate_download_url
+
+        assert _validate_download_url("http://nexus:8081/repository/pkg/foo.tar.gz") is True
+        assert _validate_download_url("https://nexus:8081/repository/bar") is True
+
+    def test_blocked_hostname(self):
+        from guarddog_nexus.core.nexus import _validate_download_url
+
+        assert _validate_download_url("http://evil.com/malware.tar.gz") is False
+        assert _validate_download_url("https://169.254.169.254/latest/meta-data") is False
+
+    def test_non_http_scheme_blocked(self):
+        from guarddog_nexus.core.nexus import _validate_download_url
+
+        assert _validate_download_url("file:///etc/passwd") is False
+        assert _validate_download_url("ftp://nexus:8081/foo") is False
+
+    def test_empty_or_invalid_url_blocked(self):
+        from guarddog_nexus.core.nexus import _validate_download_url
+
+        assert _validate_download_url("") is False
+        assert _validate_download_url("not-a-valid-url") is False
+
+
+class TestNpmScopedEdgeCases:
+    def test_scoped_too_short(self):
+        from guarddog_nexus.core.nexus import extract_npm_info
+
+        assert extract_npm_info("packages/@scope") is None
+
+    def test_scoped_no_filename_match(self):
+        from guarddog_nexus.core.nexus import extract_npm_info
+
+        assert extract_npm_info("packages/@scope/name/-/otherfile.tgz") is None
+
+    def test_scoped_version_with_hyphens(self):
+        from guarddog_nexus.core.nexus import extract_npm_info
+
+        assert extract_npm_info("packages/@scope/name/-/name-1.0.0-beta.1.tgz") == (
+            "@scope/name",
+            "1.0.0-beta.1",
+        )
+
+    def test_scoped_tar_gz_extension(self):
+        from guarddog_nexus.core.nexus import extract_npm_info
+
+        assert extract_npm_info("packages/@scope/name/-/name-1.0.0.tar.gz") == (
+            "@scope/name",
+            "1.0.0",
+        )