Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Duplicate Code] Extract shared compose fixture in capability-filter tests

Closed
  • Is something wrong?
#9,273 0 comments 1 reaction 2 assignees View on GitHub

Maintainers usually reply within 1 day

@lpcox is already working on this.

Since Sep 30, 2026.

  • #9275 by @copilot-swe-agent — open

Assessment

This issue has not been assessed yet.

Description

code-quality refactoring

Duplicate Code Opportunity

Summary
  • Pattern: The capability-filter tests repeat the same DockerComposeConfig fixture shape and capability-bit trimming setup across multiple cases.
  • Locations: src/capability-filter.test.ts lines 125-154 and 177-202.
  • Impact: Removes about 21 duplicated lines and centralizes the security-sensitive cap-drop fixture used by multiple assertions.
Evidence

Block A (src/capability-filter.test.ts:125-154)

it('filters cap_drop across all services in compose config', () => {
  const compose = {
    version: '3.8',
    networks: {},
    services: {
      'squid-proxy': {
        container_name: 'awf-squid',
        cap_drop: ['NET_RAW', 'SYS_ADMIN', 'SYS_MODULE'],
      },
      agent: {
        container_name: 'awf-agent',
        cap_drop: ['NET_RAW', 'SYS_MODULE'],
      },
      'api-proxy': {
        container_name: 'awf-api-proxy',
        cap_drop: ['ALL'],
      },
    },
  } as unknown as DockerComposeConfig;

  // Trim SYS_MODULE (bit 16)
  const fullCapBnd = 0x000001ffffffffffn;
  const sysModuleBit = 1n << 16n;
  const trimmedCapBnd = fullCapBnd & ~sysModuleBit;

  const filtered = filterComposeCapDrop(compose, trimmedCapBnd);
  expect(filtered.services['squid-proxy'].cap_drop).toEqual(['NET_RAW', 'SYS_ADMIN']);
  expect(filtered.services.agent.cap_drop).toEqual(['NET_RAW']);
  expect(filtered.services['api-proxy'].cap_drop).toEqual(['ALL']);
});

Block B (src/capability-filter.test.ts:177-202)

it('deletes cap_drop from all services when AWF_SKIP_CAP_DROP is set', () => {
  process.env.AWF_SKIP_CAP_DROP = 'true';
  const compose = {
    version: '3.8',
    networks: {},
    services: {
      'squid-proxy': {
        container_name: 'awf-squid',
        cap_drop: ['NET_RAW', 'SYS_ADMIN', 'SYS_MODULE'],
      },
      agent: {
        container_name: 'awf-agent',
        cap_drop: ['NET_RAW', 'SYS_MODULE'],
      },
      'api-proxy': {
        container_name: 'awf-api-proxy',
        cap_drop: ['ALL'],
      },
    },
  } as unknown as DockerComposeConfig;

  const filtered = filterComposeCapDrop(compose);
  expect(filtered.services['squid-proxy'].cap_drop).toBeUndefined();
  expect(filtered.services.agent.cap_drop).toBeUndefined();
  expect(filtered.services['api-proxy'].cap_drop).toBeUndefined();
});
Suggested Refactoring
  • Extract a makeBaseComposeFixture() helper for the shared service graph.
  • Add a small makeTrimmedCapBnd() helper for the repeated bitmask math.
  • Reuse those helpers across the capability-filter cases so only the policy under test changes.
Affected Files
  • src/capability-filter.test.ts — lines 125-154
  • src/capability-filter.test.ts — lines 177-202
Effort Estimate

Low

Detected by Duplicate Code Detector workflow. Run date: 2026-09-30

Generated by Duplicate Code Detector · copilot · gpt50mini · 8.6 AIC · ⊞ 21.2K · ◷

  • expires on Oct 30, 2026, 9:57 PM UTC
Dominant language
TypeScript
Stars
149
Forks
77
Avg merge
4h 33m
Merged PRs (30d)
413

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github/gh-aw-firewall

All issues in github/gh-aw-firewall

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.