test: add test that check project generation using snapshot testing

[derberg]

This PR is the best example that shows how to add to template tests based on snapshot testing. All files in the PR are needed for any other project except for:

• This was just minor readme stuff to fix https://github.com/asyncapi/nodejs-template/pull/103/files#diff-b335630551682c19a781afebcf4d07bf978fb1f8ac04c6bf87428ed5106870f5
• This was not related to snapshot testing, it is just a bug I noticed when writing tests https://github.com/asyncapi/nodejs-template/pull/103/files#diff-24184f7a7ff0522d0bd530ee861c3455c63d7f600164090f7f10978c5d1f8583
• This file was just missing in the repo https://github.com/asyncapi/nodejs-template/pull/103/files#diff-fcf14c4b7b34fe7a11916195871ae66a59be87a395f28db73e345ebdc828085b

[derberg]

@fmvilas now I know why I did not use Math.random as then I would have to ask sonar cloud to ignore security in tests... Are you very strongly opinionated about not using crypto? I think it is better really

[fmvilas]

I'm not opinionated but Sonar Cloud says:

When software generates predictable values in a context requiring unpredictability, it may be possible for an attacker to guess the next value that will be generated, and use this guess to impersonate another user or access sensitive information.

As the Math.random() function relies on a weak pseudorandom number generator, this function should not be used for security-critical applications or for protecting sensitive data. In such context, a cryptographically strong pseudorandom number generator (CSPRNG) should be used instead.

I don't think it's our case here. We should be fine with random. If an attacker guesses the next random number, good for them! 😂

[derberg]

@fmvilas I'm not afraid of a real security issues, these are tests. Just that there are 2 options:

• we use crypto and do not add any sonar cloud config file
• we use Math and add sonar clound config file where we tell it to ignore security checks in tests

I prefer first option as it means one less file 😄

[fmvilas]

Isn't there a way to ignore SonarCloud on that line only? Like eslint-disable or similar? If that's not possible then yeah, let's go for crypto.

Another option is not to use Math.random but to use Date.now(), which gives you a timestamp and would do the trick as well.

[derberg]

@fmvilas love it, added Date.now().toString() instead!

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.0% Duplication

[fmvilas]

[asyncapi-bot]

🎉 This PR is included in version 0.11.3 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀