up

src/Scanner/__Tests/StellaOps.Scanner.Analyzers.Lang.Tests/DotNet/DotNetLanguageAnalyzerTests.cs

@@ -214,6 +214,111 @@ public sealed class DotNetLanguageAnalyzerTests
         Assert.Contains("win-arm64", ridValues);
     }
 
+    [Fact]
+    public async Task SourceTreeOnlyEmitsDeclaredPackagesAsync()
+    {
+        var cancellationToken = TestContext.Current.CancellationToken;
+        var fixturePath = TestPaths.ResolveFixture("lang", "dotnet", "source-tree-only");
+
+        var analyzers = new ILanguageAnalyzer[]
+        {
+            new DotNetLanguageAnalyzer()
+        };
+
+        var json = await LanguageAnalyzerTestHarness.RunToJsonAsync(
+            fixturePath,
+            analyzers,
+            cancellationToken);
+
+        using var document = JsonDocument.Parse(json);
+        var root = document.RootElement;
+        Assert.True(root.ValueKind == JsonValueKind.Array, "Result root should be an array.");
+        Assert.Equal(2, root.GetArrayLength());
+
+        // Check that packages are declared-only
+        foreach (var component in root.EnumerateArray())
+        {
+            var metadata = component.GetProperty("metadata");
+            Assert.Equal("true", metadata.GetProperty("declaredOnly").GetString());
+            Assert.Equal("declared", metadata.GetProperty("provenance").GetString());
+        }
+
+        // Check specific packages
+        var newtonsoftJson = root.EnumerateArray()
+            .First(element => element.GetProperty("name").GetString() == "Newtonsoft.Json");
+        Assert.Equal("13.0.3", newtonsoftJson.GetProperty("version").GetString());
+        Assert.Equal("pkg:nuget/newtonsoft.json@13.0.3", newtonsoftJson.GetProperty("purl").GetString());
+    }
+
+    [Fact]
+    public async Task LockfileOnlyEmitsDeclaredPackagesAsync()
+    {
+        var cancellationToken = TestContext.Current.CancellationToken;
+        var fixturePath = TestPaths.ResolveFixture("lang", "dotnet", "lockfile-only");
+
+        var analyzers = new ILanguageAnalyzer[]
+        {
+            new DotNetLanguageAnalyzer()
+        };
+
+        var json = await LanguageAnalyzerTestHarness.RunToJsonAsync(
+            fixturePath,
+            analyzers,
+            cancellationToken);
+
+        using var document = JsonDocument.Parse(json);
+        var root = document.RootElement;
+        Assert.True(root.ValueKind == JsonValueKind.Array, "Result root should be an array.");
+        Assert.Equal(2, root.GetArrayLength());
+
+        // Check that packages are declared-only
+        foreach (var component in root.EnumerateArray())
+        {
+            var metadata = component.GetProperty("metadata");
+            Assert.Equal("true", metadata.GetProperty("declaredOnly").GetString());
+        }
+
+        // Check direct vs transitive sources
+        var directPackage = root.EnumerateArray()
+            .First(element => element.GetProperty("name").GetString() == "Microsoft.Extensions.Logging");
+        var transitivePackage = root.EnumerateArray()
+            .First(element => element.GetProperty("name").GetString() == "Microsoft.Extensions.Logging.Abstractions");
+
+        Assert.Contains("Direct", directPackage.GetProperty("metadata").GetProperty("declared.source[0]").GetString());
+        Assert.Contains("Transitive", transitivePackage.GetProperty("metadata").GetProperty("declared.source[0]").GetString());
+    }
+
+    [Fact]
+    public async Task PackagesConfigOnlyEmitsDeclaredPackagesAsync()
+    {
+        var cancellationToken = TestContext.Current.CancellationToken;
+        var fixturePath = TestPaths.ResolveFixture("lang", "dotnet", "packages-config-only");
+
+        var analyzers = new ILanguageAnalyzer[]
+        {
+            new DotNetLanguageAnalyzer()
+        };
+
+        var json = await LanguageAnalyzerTestHarness.RunToJsonAsync(
+            fixturePath,
+            analyzers,
+            cancellationToken);
+
+        using var document = JsonDocument.Parse(json);
+        var root = document.RootElement;
+        Assert.True(root.ValueKind == JsonValueKind.Array, "Result root should be an array.");
+        Assert.Equal(2, root.GetArrayLength());
+
+        // Check that packages are from packages.config
+        foreach (var component in root.EnumerateArray())
+        {
+            var metadata = component.GetProperty("metadata");
+            Assert.Equal("true", metadata.GetProperty("declaredOnly").GetString());
+            Assert.Equal("packages.config", metadata.GetProperty("declared.source[0]").GetString());
+            Assert.Equal("net48", metadata.GetProperty("declared.tfm[0]").GetString());
+        }
+    }
+
     private sealed class StubAuthenticodeInspector : IDotNetAuthenticodeInspector
     {
         public DotNetAuthenticodeMetadata? TryInspect(string assemblyPath, CancellationToken cancellationToken)