test: add unit tests for secureMaxVersioned / secureMaxRemovalPolicy (fixes #44)

examples/basic-usage.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import 'source-map-support/register';
 import { App, Stack } from 'aws-cdk-lib';
 
 import { SecureBucket, SecurityLevel } from '../src';

examples/blueprints-usage.ts

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import 'source-map-support/register';
 import { App, Stack, PropertyInjectors } from 'aws-cdk-lib';
 import { Bucket } from 'aws-cdk-lib/aws-s3';
 

src/resources/s3-bucket/secure-bucket.ts

@@ -70,6 +70,26 @@ export class SecureBucket extends Construct {
   /** The underlying hardened bucket. */
   public readonly bucket: Bucket;
 
+  /** The bucket's ARN. Convenience pass-through for `this.bucket.bucketArn`. */
+  public get bucketArn(): string {
+    return this.bucket.bucketArn;
+  }
+
+  /** The bucket's name. Convenience pass-through for `this.bucket.bucketName`. */
+  public get bucketName(): string {
+    return this.bucket.bucketName;
+  }
+
+  /** The bucket's domain name. Convenience pass-through for `this.bucket.bucketDomainName`. */
+  public get bucketDomainName(): string {
+    return this.bucket.bucketDomainName;
+  }
+
+  /** The bucket's regional domain name. Convenience pass-through for `this.bucket.bucketRegionalDomainName`. */
+  public get bucketRegionalDomainName(): string {
+    return this.bucket.bucketRegionalDomainName;
+  }
+
   constructor(scope: Construct, id: string, props: SecureBucketProps = {}) {
     super(scope, id);
 

test/resources/s3-bucket/fields.test.ts

@@ -0,0 +1,84 @@
+import { RemovalPolicy } from 'aws-cdk-lib';
+
+import {
+  secureMaxVersioned,
+  secureMaxRemovalPolicy,
+} from '../../../src/resources/s3-bucket/fields';
+
+describe('fields: secureMaxVersioned', () => {
+  it('should enable versioning when the tier value is true', () => {
+    expect(secureMaxVersioned(true, undefined)).toBe(true);
+    expect(secureMaxVersioned(true, false)).toBe(true);
+    expect(secureMaxVersioned(true, true)).toBe(true);
+  });
+
+  it('should never weaken an enabled tier value to false', () => {
+    expect(secureMaxVersioned(true, false)).toBe(true);
+  });
+
+  it('should adopt an incoming true value when the tier value is false', () => {
+    expect(secureMaxVersioned(false, true)).toBe(true);
+  });
+
+  it('should stay disabled when both values are false/undefined', () => {
+    expect(secureMaxVersioned(false, undefined)).toBe(false);
+    expect(secureMaxVersioned(false, false)).toBe(false);
+  });
+
+  it('should treat truthy/incoming coercion correctly', () => {
+    expect(secureMaxVersioned(false, true)).toBe(true);
+    expect(secureMaxVersioned(true, false)).toBe(true);
+  });
+});
+
+describe('fields: secureMaxRemovalPolicy', () => {
+  it('should return the tier value when incoming is undefined', () => {
+    expect(secureMaxRemovalPolicy(RemovalPolicy.RETAIN, undefined)).toBe(RemovalPolicy.RETAIN);
+    expect(secureMaxRemovalPolicy(RemovalPolicy.DESTROY, undefined)).toBe(RemovalPolicy.DESTROY);
+  });
+
+  it('should never weaken a RETAIN tier', () => {
+    expect(secureMaxRemovalPolicy(RemovalPolicy.RETAIN, RemovalPolicy.DESTROY)).toBe(
+      RemovalPolicy.RETAIN
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.RETAIN, RemovalPolicy.SNAPSHOT)).toBe(
+      RemovalPolicy.RETAIN
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.RETAIN, RemovalPolicy.RETAIN)).toBe(
+      RemovalPolicy.RETAIN
+    );
+  });
+
+  it('should adopt an incoming policy that is at least as strong as the tier', () => {
+    expect(secureMaxRemovalPolicy(RemovalPolicy.DESTROY, RemovalPolicy.SNAPSHOT)).toBe(
+      RemovalPolicy.SNAPSHOT
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.DESTROY, RemovalPolicy.RETAIN)).toBe(
+      RemovalPolicy.RETAIN
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.SNAPSHOT, RemovalPolicy.RETAIN)).toBe(
+      RemovalPolicy.RETAIN
+    );
+  });
+
+  it('should keep the weaker tier value when incoming is weaker', () => {
+    expect(secureMaxRemovalPolicy(RemovalPolicy.SNAPSHOT, RemovalPolicy.DESTROY)).toBe(
+      RemovalPolicy.SNAPSHOT
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.DESTROY, RemovalPolicy.DESTROY)).toBe(
+      RemovalPolicy.DESTROY
+    );
+  });
+
+  it('should rank SNAPSHOT between DESTROY and RETAIN', () => {
+    expect(secureMaxRemovalPolicy(RemovalPolicy.SNAPSHOT, RemovalPolicy.SNAPSHOT)).toBe(
+      RemovalPolicy.SNAPSHOT
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.DESTROY, RemovalPolicy.SNAPSHOT)).toBe(
+      RemovalPolicy.SNAPSHOT
+    );
+    expect(secureMaxRemovalPolicy(RemovalPolicy.SNAPSHOT, RemovalPolicy.RETAIN)).toBe(
+      RemovalPolicy.RETAIN
+    );
+  });
+});

test/resources/s3-bucket/secure-bucket.test.ts

@@ -12,7 +12,7 @@
   });
 
   describe('default configuration (HIGH)', () => {
     it('should create a bucket with CIS-critical settings enforced', () => {
       new SecureBucket(stack, 'TestBucket');
 
       const template = Template.fromStack(stack);
@@ -35,7 +35,7 @@
       });
     });
 
     it('should enforce SSL via a bucket policy', () => {
       new SecureBucket(stack, 'TestBucket');
 
       const template = Template.fromStack(stack);
@@ -81,12 +81,12 @@
       );
       expect(mainBucket).toBeDefined();
       // tier-variable: versioning off at LOW
       expect(mainBucket!['Properties'].VersioningConfiguration).toBeUndefined();
       // CIS-critical: encryption still enforced at LOW
       expect(mainBucket!['Properties'].BucketEncryption).toBeDefined();
     });
 
     it('LOW does not provision an access-log bucket', () => {
       new SecureBucket(stack, 'TestBucket', { securityLevel: SecurityLevel.LOW });
 
       const template = Template.fromStack(stack);
@@ -95,7 +95,7 @@
   });
 
   describe('custom configuration', () => {
     it('should allow overriding bucket name', () => {
       new SecureBucket(stack, 'TestBucket', { bucketName: 'my-custom-bucket-name' });
 
       const template = Template.fromStack(stack);
@@ -111,7 +111,7 @@
         b => b['Properties']?.OwnershipControls && !b['Properties']?.AccessControl
       );
       expect(mainBucket).toBeDefined();
       expect(mainBucket!['Properties'].VersioningConfiguration).toBeUndefined();
     });
 
     it('should not be able to disable encryption (CIS-critical)', () => {
@@ -184,4 +184,27 @@
       expect(secureBucket.bucket.node.id).toBe('Bucket');
     });
   });
+
+  describe('attribute pass-through getters', () => {
+    it('exposes bucketArn and bucketName directly on the construct', () => {
+      const bucket = new SecureBucket(stack, 'TestBucket', {
+        bucketName: 'my-secure-bucket',
+      });
+
+      expect(bucket.bucketArn).toBeDefined();
+      expect(bucket.bucketArn).toBe(bucket.bucket.bucketArn);
+      expect(bucket.bucketName).toBe(bucket.bucket.bucketName);
+      expect(bucket.bucketDomainName).toBe(bucket.bucket.bucketDomainName);
+      expect(bucket.bucketRegionalDomainName).toBe(bucket.bucket.bucketRegionalDomainName);
+    });
+
+    it('resolves getters to the same values as the wrapped bucket', () => {
+      const bucket = new SecureBucket(stack, 'TestBucket', {
+        bucketName: 'direct-access',
+      });
+
+      expect(bucket.bucketArn).toBe(bucket.bucket.bucketArn);
+      expect(bucket.bucketName).toBe(bucket.bucket.bucketName);
+    });
+  });
 });