policy: add dependencies map for resources

Adds a "dependencies" field to resources in policy manifest files.
In order to ease development and testing while using manifests,
wildcard values for both "dependencies" and "integrity" have been
added using the boolean value "true" in the policy manifest.

PR-URL: https://github.com/nodejs/node/pull/28767
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jan Krems <jan.krems@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>

12 files changed, 161 insertions, 12 deletions

diff --git a/test/common/index.mjs b/test/common/index.mjs
index 4758704402..f747ee3279 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -1,12 +1,7 @@
 // Flags: --experimental-modules
 /* eslint-disable node-core/require-common-first, node-core/required-modules */
 
-import { createRequireFromPath } from 'module';
-import { fileURLToPath as toPath } from 'url';
-
-function createRequire(metaUrl) {
-  return createRequireFromPath(toPath(metaUrl));
-}
+import { createRequire } from 'module';
 
 const require = createRequire(import.meta.url);
 const common = require('./index.js');
diff --git a/test/fixtures/policy/dependencies/dependencies-empty-policy.json b/test/fixtures/policy/dependencies/dependencies-empty-policy.json
new file mode 100644
index 0000000000..9c0389cd03
--- /dev/null
+++ b/test/fixtures/policy/dependencies/dependencies-empty-policy.json
@@ -0,0 +1,11 @@
+{
+  "resources": {
+    "../parent.js": {
+      "integrity": true,
+      "dependencies": {}
+    },
+    "../dep.js": {
+      "integrity": true
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/policy/dependencies/dependencies-missing-policy.json b/test/fixtures/policy/dependencies/dependencies-missing-policy.json
new file mode 100644
index 0000000000..40d2866ba5
--- /dev/null
+++ b/test/fixtures/policy/dependencies/dependencies-missing-policy.json
@@ -0,0 +1,10 @@
+{
+  "resources": {
+    "../parent.js": {
+      "integrity": true
+    },
+    "../dep.js": {
+      "integrity": true
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/policy/dependencies/dependencies-redirect-builtin-policy.json b/test/fixtures/policy/dependencies/dependencies-redirect-builtin-policy.json
new file mode 100644
index 0000000000..437228a2e5
--- /dev/null
+++ b/test/fixtures/policy/dependencies/dependencies-redirect-builtin-policy.json
@@ -0,0 +1,10 @@
+{
+  "resources": {
+    "../parent.js": {
+      "integrity": true,
+      "dependencies": {
+        "./dep.js": "node:util"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/policy/dependencies/dependencies-redirect-policy.json b/test/fixtures/policy/dependencies/dependencies-redirect-policy.json
new file mode 100644
index 0000000000..993a683f10
--- /dev/null
+++ b/test/fixtures/policy/dependencies/dependencies-redirect-policy.json
@@ -0,0 +1,13 @@
+{
+  "resources": {
+    "../parent.js": {
+      "integrity": true,
+      "dependencies": {
+        "./dep.js": "../dep.js"
+      }
+    },
+    "../dep.js": {
+      "integrity": true
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/policy/dependencies/dependencies-redirect-unknown-builtin-policy.json b/test/fixtures/policy/dependencies/dependencies-redirect-unknown-builtin-policy.json
new file mode 100644
index 0000000000..db2046c6d3
--- /dev/null
+++ b/test/fixtures/policy/dependencies/dependencies-redirect-unknown-builtin-policy.json
@@ -0,0 +1,10 @@
+{
+  "resources": {
+    "../parent.js": {
+      "integrity": true,
+      "dependencies": {
+        "./dep.js": "node:404"
+      }
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/policy/dependencies/dependencies-wildcard-policy.json b/test/fixtures/policy/dependencies/dependencies-wildcard-policy.json
new file mode 100644
index 0000000000..04ae9a318f
--- /dev/null
+++ b/test/fixtures/policy/dependencies/dependencies-wildcard-policy.json
@@ -0,0 +1,11 @@
+{
+  "resources": {
+    "../parent.js": {
+      "integrity": true,
+      "dependencies": true
+    },
+    "../dep.js": {
+      "integrity": true
+    }
+  }
+}
\ No newline at end of file
diff --git a/test/fixtures/policy/parent.js b/test/fixtures/policy/parent.js
new file mode 100644
index 0000000000..b821bfee18
--- /dev/null
+++ b/test/fixtures/policy/parent.js
@@ -0,0 +1,3 @@
+'use strict';
+// Included in parent-policy.json
+require('./dep.js');
diff --git a/test/message/async_error_sync_esm.out b/test/message/async_error_sync_esm.out
index 544916e248..f34628ef44 100644
--- a/test/message/async_error_sync_esm.out
+++ b/test/message/async_error_sync_esm.out
@@ -5,4 +5,3 @@ Error: test
     at async three (*fixtures*async-error.js:20:3)
     at async four (*fixtures*async-error.js:24:3)
     at async main (*message*async_error_sync_esm.mjs:7:5)
-(node:*) [DEP0130] DeprecationWarning: Module.createRequireFromPath() is deprecated. Use Module.createRequire() instead.
diff --git a/test/parallel/test-policy-dependencies.js b/test/parallel/test-policy-dependencies.js
new file mode 100644
index 0000000000..e7b2289714
--- /dev/null
+++ b/test/parallel/test-policy-dependencies.js
@@ -0,0 +1,90 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const fixtures = require('../common/fixtures');
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+
+const dep = fixtures.path('policy', 'parent.js');
+{
+  const depPolicy = fixtures.path(
+    'policy',
+    'dependencies',
+    'dependencies-redirect-policy.json');
+  const { status } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-policy', depPolicy, dep,
+    ]
+  );
+  assert.strictEqual(status, 0);
+}
+{
+  const depPolicy = fixtures.path(
+    'policy',
+    'dependencies',
+    'dependencies-redirect-builtin-policy.json');
+  const { status } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-policy', depPolicy, dep,
+    ]
+  );
+  assert.strictEqual(status, 0);
+}
+{
+  const depPolicy = fixtures.path(
+    'policy',
+    'dependencies',
+    'dependencies-redirect-unknown-builtin-policy.json');
+  const { status } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-policy', depPolicy, dep,
+    ]
+  );
+  assert.strictEqual(status, 1);
+}
+{
+  const depPolicy = fixtures.path(
+    'policy',
+    'dependencies',
+    'dependencies-wildcard-policy.json');
+  const { status } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-policy', depPolicy, dep,
+    ]
+  );
+  assert.strictEqual(status, 0);
+}
+{
+  const depPolicy = fixtures.path(
+    'policy',
+    'dependencies',
+    'dependencies-empty-policy.json');
+  const { status } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-policy', depPolicy, dep,
+    ]
+  );
+  assert.strictEqual(status, 1);
+}
+{
+  const depPolicy = fixtures.path(
+    'policy',
+    'dependencies',
+    'dependencies-missing-policy.json');
+  const { status } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-policy', depPolicy, dep,
+    ]
+  );
+  assert.strictEqual(status, 1);
+}
diff --git a/test/parallel/test-policy-integrity-flag.js b/test/parallel/test-policy-integrity-flag.js
index 3b332758d1..d97ef86cbe 100644
--- a/test/parallel/test-policy-integrity-flag.js
+++ b/test/parallel/test-policy-integrity-flag.js
@@ -28,10 +28,6 @@ const windowsPolicySRI = 'sha512-OeyCPRo4OZMosHyquZXDHpuU1F4KzG9UHFnn12FMaHsvqFU
 /* eslint-enable max-len */
 
 const depPolicySRI = `${nixPolicySRI} ${windowsPolicySRI}`;
-console.dir({
-  depPolicySRI,
-  body: JSON.stringify(fs.readFileSync(depPolicy).toString('utf8'))
-});
 {
   const { status, stderr } = spawnSync(
     process.execPath,
diff --git a/test/parallel/test-policy-integrity.js b/test/parallel/test-policy-integrity.js
index 86d1078d9f..722b45f633 100644
--- a/test/parallel/test-policy-integrity.js
+++ b/test/parallel/test-policy-integrity.js
@@ -71,7 +71,8 @@ function test({
   };
   for (const [url, { body, match }] of Object.entries(resources)) {
     manifest.resources[url] = {
-      integrity: `sha256-${hash('sha256', match ? body : body + '\n')}`
+      integrity: `sha256-${hash('sha256', match ? body : body + '\n')}`,
+      dependencies: true
     };
     fs.writeFileSync(new URL(url, tmpdirURL.href), body);
   }