dependabot-common 0.392.0 → 0.394.0

data/lib/dependabot/clients/codecommit.rb

@@ -83,19 +83,19 @@ module Dependabot
           commit: T.nilable(String),
           path: T.nilable(String)
         )
-          # See PR 9344: should .returns(Seahorse::Client::Response)
-          # but it not extend Delegator, unblocking until shim or
-          # another fix is implemented
-          .returns(T.untyped)
+          .returns(Seahorse::Client::Response)
       end
       def fetch_repo_contents(repo, commit = nil, path = nil)
         actual_path = path
         actual_path = "/" if path.to_s.empty?
 
-        cc_client.get_folder(
-          repository_name: repo,
-          commit_specifier: commit,
-          folder_path: actual_path
+        T.cast(
+          cc_client.get_folder(
+            repository_name: repo,
+            commit_specifier: commit,
+            folder_path: actual_path
+          ),
+          Seahorse::Client::Response
         )
       end
 
@@ -121,12 +121,15 @@ module Dependabot
         params(
           branch_name: String
         )
-          .returns(String)
+          .returns(Seahorse::Client::Response)
       end
       def branch(branch_name)
-        cc_client.get_branch(
-          repository_name: source.unscoped_repo,
-          branch_name: branch_name
+        T.cast(
+          cc_client.get_branch(
+            repository_name: source.unscoped_repo,
+            branch_name: branch_name
+          ),
+          Seahorse::Client::Response
         )
       end
 
@@ -183,18 +186,24 @@ module Dependabot
           repo: String,
           branch_name: String
         )
-          .returns(Aws::CodeCommit::Types::Commit)
+          .returns(Seahorse::Client::Response)
       end
       def commits(repo, branch_name = T.must(source.branch))
         retrieved_commits = fetch_commits(repo, branch_name, 5)
 
-        result = @cc_client.batch_get_commits(
-          commit_ids: retrieved_commits,
-          repository_name: repo
+        result = T.cast(
+          @cc_client.batch_get_commits(
+            commit_ids: retrieved_commits,
+            repository_name: repo
+          ),
+          Seahorse::Client::Response
         )
 
         # sort the results by date
-        result.commits.sort! { |a, b| b.author.date <=> a.author.date }
+        output = T.cast(result.data, Aws::CodeCommit::Types::BatchGetCommitsOutput)
+        commits = output.commits
+        commits&.sort_by! { |commit| commit.author&.date || "" }
+        commits&.reverse!
         result
       end
 
@@ -204,7 +213,7 @@ module Dependabot
           state: String,
           branch: String
         )
-          .returns(T::Array[Aws::CodeCommit::Types::PullRequest])
+          .returns(T::Array[Seahorse::Client::Response])
       end
       def pull_requests(repo, state, branch)
         pull_request_ids = @cc_client.list_pull_requests(
@@ -212,18 +221,20 @@ module Dependabot
           pull_request_status: state
         ).pull_request_ids
 
-        result = []
+        result = T.let([], T::Array[Seahorse::Client::Response])
         # list_pull_requests only gets us the pull request id
         # get_pull_request has all the info we need
         pull_request_ids.each do |id|
-          pr_hash = @cc_client.get_pull_request(
-            pull_request_id: id
+          pr_hash = T.cast(
+            @cc_client.get_pull_request(
+              pull_request_id: id
+            ),
+            Seahorse::Client::Response
           )
+          output = T.cast(pr_hash.data, Aws::CodeCommit::Types::GetPullRequestOutput)
           # only include PRs from the referenced branch
-          if pr_hash.pull_request.pull_request_targets[0]
-                    .source_reference.include? branch
-            result << pr_hash
-          end
+          source_reference = T.must(output.pull_request.pull_request_targets[0]).source_reference
+          result << pr_hash if source_reference.delete_prefix("refs/heads/") == branch.delete_prefix("refs/heads/")
         end
         result
       end
@@ -234,13 +245,16 @@ module Dependabot
           branch_name: String,
           commit_id: String
         )
-          .returns(Aws::CodeCommit::Types::BranchInfo)
+          .returns(Seahorse::Client::Response)
       end
       def create_branch(repo, branch_name, commit_id)
-        cc_client.create_branch(
-          repository_name: repo,
-          branch_name: branch_name,
-          commit_id: commit_id
+        T.cast(
+          cc_client.create_branch(
+            repository_name: repo,
+            branch_name: branch_name,
+            commit_id: commit_id
+          ),
+          Seahorse::Client::Response
         )
       end
 
@@ -252,7 +266,7 @@ module Dependabot
           commit_message: String,
           files: T::Array[Dependabot::DependencyFile]
         )
-          .returns(Aws::CodeCommit::Types::CreateCommitOutput)
+          .returns(Seahorse::Client::Response)
       end
       def create_commit(
         branch_name,
@@ -261,19 +275,22 @@ module Dependabot
         commit_message,
         files
       )
-        cc_client.create_commit(
-          repository_name: source.unscoped_repo,
-          branch_name: branch_name,
-          parent_commit_id: base_commit,
-          author_name: author_name,
-          commit_message: commit_message,
-          put_files: files.map do |file|
-            {
-              file_path: file.path,
-              file_mode: "NORMAL",
-              file_content: file.content
-            }
-          end
+        T.cast(
+          cc_client.create_commit(
+            repository_name: source.unscoped_repo,
+            branch_name: branch_name,
+            parent_commit_id: base_commit,
+            author_name: author_name,
+            commit_message: commit_message,
+            put_files: files.map do |file|
+              {
+                file_path: file.path,
+                file_mode: "NORMAL",
+                file_content: file.content
+              }
+            end
+          ),
+          Seahorse::Client::Response
         )
       end
 
@@ -284,7 +301,7 @@ module Dependabot
           source_branch: String,
           pr_description: String
         )
-          .returns(T.nilable(Aws::CodeCommit::Types::CreatePullRequestOutput))
+          .returns(Seahorse::Client::Response)
       end
       def create_pull_request(
         pr_name,
@@ -292,14 +309,17 @@ module Dependabot
         source_branch,
         pr_description
       )
-        cc_client.create_pull_request(
-          title: pr_name,
-          description: pr_description,
-          targets: [
-            { repository_name: source.unscoped_repo,
-              source_reference: target_branch,
-              destination_reference: source_branch }
-          ]
+        T.cast(
+          cc_client.create_pull_request(
+            title: pr_name,
+            description: pr_description,
+            targets: [
+              { repository_name: source.unscoped_repo,
+                source_reference: target_branch,
+                destination_reference: source_branch }
+            ]
+          ),
+          Seahorse::Client::Response
         )
       end
 

data/lib/dependabot/clients/github_resource_parser.rb

@@ -0,0 +1,70 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "dependabot/errors"
+require "sorbet-runtime"
+
+module Dependabot
+  module Clients
+    module GithubResourceParser
+      extend T::Sig
+
+      private
+
+      sig { params(resource: Sawyer::Resource, key: Symbol, context: String).returns(String) }
+      def github_string(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_github_response("#{context} #{key} must be a string")
+      end
+
+      sig { params(resource: Sawyer::Resource, key: Symbol, context: String).returns(T.nilable(String)) }
+      def github_optional_string(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return if value.nil?
+        return value if value.is_a?(String)
+
+        raise_bad_github_response("#{context} #{key} must be a string or nil")
+      end
+
+      sig { params(resource: Sawyer::Resource, key: Symbol, context: String).returns(Integer) }
+      def github_integer(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(Integer)
+
+        raise_bad_github_response("#{context} #{key} must be an integer")
+      end
+
+      sig { params(resource: Sawyer::Resource, key: Symbol, context: String).returns(T::Boolean) }
+      def github_boolean(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value == true
+        return false if value.nil? || value == false
+
+        raise_bad_github_response("#{context} #{key} must be a boolean or nil")
+      end
+
+      sig { params(resource: Sawyer::Resource, key: Symbol, context: String).returns(Sawyer::Resource) }
+      def github_resource(resource, key, context)
+        value = T.cast(resource[key], Object)
+        return value if value.is_a?(Sawyer::Resource)
+
+        raise_bad_github_response("#{context} #{key} must be an object")
+      end
+
+      sig { params(message: String).returns(T.noreturn) }
+      def raise_bad_github_response(message)
+        Kernel.raise Dependabot::PrivateSourceBadResponse.new(
+          github_response_source,
+          "Malformed GitHub response: #{message}"
+        )
+      end
+
+      sig { returns(String) }
+      def github_response_source
+        Kernel.raise NotImplementedError
+      end
+    end
+  end
+end

data/lib/dependabot/clients/github_with_retries.rb

@@ -3,15 +3,17 @@
 
 require "octokit"
 require "sorbet-runtime"
+require "delegate"
 require "dependabot/credential"
 
 module Dependabot
   module Clients
-    class GithubWithRetries
+    class GithubWithRetries < SimpleDelegator
       extend T::Sig
 
       DEFAULT_OPEN_TIMEOUT_IN_SECONDS = 2
       DEFAULT_READ_TIMEOUT_IN_SECONDS = 5
+      ClientOptions = T.type_alias { T::Hash[Symbol, Object] }
 
       sig { returns(Integer) }
       def self.open_timeout_in_seconds
@@ -32,7 +34,7 @@ module Dependabot
             }
           }
         }.freeze,
-        T::Hash[Symbol, T.untyped]
+        ClientOptions
       )
 
       RETRYABLE_ERRORS = T.let(
@@ -88,30 +90,35 @@ module Dependabot
 
       sig { params(repo: String, branch: String).returns(String) }
       def fetch_commit(repo, branch)
-        response = T.unsafe(ref(repo, "heads/#{branch}"))
+        response = ref(repo, "heads/#{branch}")
 
-        raise Octokit::NotFound if response.is_a?(Array)
+        Kernel.raise Octokit::NotFound if response.is_a?(Array)
 
-        response.object.sha
+        object = T.cast(response[:object], Sawyer::Resource)
+        T.cast(object[:sha], String)
       end
 
       sig { params(repo: String).returns(String) }
       def fetch_default_branch(repo)
-        T.unsafe(repository(repo)).default_branch
+        T.cast(repository(repo)[:default_branch], String)
+      end
+
+      sig { params(repo: String, path: String, ref: String).returns(String) }
+      def raw_contents(repo, path:, ref:)
+        T.cast(
+          contents(repo, path: path, ref: ref, accept: "application/vnd.github.v3.raw"),
+          String
+        )
       end
 
       ############
       # Proxying #
       ############
 
-      sig { params(max_retries: T.nilable(Integer), args: T.untyped).void }
+      sig { params(max_retries: T.nilable(Integer), args: Object).void }
       def initialize(max_retries: 3, **args)
         args = DEFAULT_CLIENT_ARGS.merge(args)
-
-        access_tokens = args.delete(:access_tokens) || []
-        access_tokens << args[:access_token] if args[:access_token]
-        access_tokens << nil if access_tokens.empty?
-        access_tokens.uniq!
+        access_tokens = extract_access_tokens(args)
 
         # Explicitly set the proxy if one is set in the environment
         # as Faraday's find_proxy is very slow.
@@ -135,30 +142,29 @@ module Dependabot
           end,
           T::Array[Octokit::Client]
         )
+        super(T.must(@clients.last))
       end
 
       # TODO: Create all the methods that are called on the client
       sig do
         params(
           method_name: T.any(Symbol, String),
-          args: T.untyped,
-          block: T.nilable(T.proc.returns(T.untyped))
+          args: Object,
+          block: T.nilable(Proc)
         )
-          .returns(T.untyped)
+          .returns(T.anything)
       end
       def method_missing(method_name, *args, &block)
+        original_args = args
         untried_clients = @clients.dup
         client = untried_clients.pop
 
         begin
-          if client.respond_to?(method_name)
-            mutatable_args = args.map(&:dup)
-            T.unsafe(client).public_send(method_name, *mutatable_args, &block)
-          else
-            super
-          end
+          __setobj__(T.must(client))
+          args = original_args.map(&:dup)
+          super
         rescue Octokit::NotFound, Octokit::Unauthorized, Octokit::Forbidden
-          raise unless (client = untried_clients.pop)
+          Kernel.raise unless (client = untried_clients.pop)
 
           retry
         end
@@ -172,7 +178,41 @@ module Dependabot
           .returns(T::Boolean)
       end
       def respond_to_missing?(method_name, include_private = false)
-        @clients.first.respond_to?(method_name) || super
+        @clients.first.respond_to?(method_name, include_private)
+      end
+
+      private
+
+      sig { params(args: ClientOptions).returns(T::Array[T.nilable(String)]) }
+      def extract_access_tokens(args)
+        access_tokens = T.let([], T::Array[T.nilable(String)])
+        case (raw_access_tokens = args.delete(:access_tokens))
+        when nil
+          nil
+        when Array
+          raw_access_tokens.each do |raw_token|
+            token = T.cast(raw_token, Object)
+            case token
+            when nil, String then access_tokens << token
+            else Kernel.raise TypeError, "access_tokens must contain only strings or nil"
+            end
+          end
+        else
+          Kernel.raise TypeError, "access_tokens must be an array or nil"
+        end
+
+        access_token = args[:access_token]
+        case access_token
+        when nil
+          nil
+        when String
+          access_tokens << access_token
+        else
+          Kernel.raise TypeError, "access_token must be a string or nil"
+        end
+
+        access_tokens << nil if access_tokens.empty?
+        access_tokens.uniq
       end
     end
   end

data/lib/dependabot/clients/gitlab_with_retries.rb

@@ -3,14 +3,17 @@
 
 require "gitlab"
 require "sorbet-runtime"
+require "delegate"
 
 require "dependabot/credential"
 
 module Dependabot
   module Clients
-    class GitlabWithRetries
+    class GitlabWithRetries < SimpleDelegator
       extend T::Sig
 
+      ClientOptions = T.type_alias { T::Hash[Symbol, Object] }
+
       RETRYABLE_ERRORS = T.let(
         [Gitlab::Error::BadGateway].freeze,
         T::Array[T.class_of(Gitlab::Error::ResponseError)]
@@ -67,22 +70,24 @@ module Dependabot
 
       sig { params(repo: String, branch: String).returns(String) }
       def fetch_commit(repo, branch)
-        T.unsafe(branch(repo, branch)).commit.id
+        commit = T.cast(branch(repo, branch)["commit"], Gitlab::ObjectifiedHash)
+        T.cast(commit["id"], String)
       end
 
       sig { params(repo: String).returns(String) }
       def fetch_default_branch(repo)
-        T.unsafe(project(repo)).default_branch
+        T.cast(project(repo)["default_branch"], String)
       end
 
       ############
       # Proxying #
       ############
 
-      sig { params(max_retries: T.nilable(Integer), args: T.untyped).void }
+      sig { params(max_retries: T.nilable(Integer), args: Object).void }
       def initialize(max_retries: 3, **args)
         @max_retries = T.let(max_retries || 3, Integer)
         @client = T.let(::Gitlab::Client.new(args), ::Gitlab::Client)
+        super(@client)
       end
 
       # Create commit in gitlab repo with correctly mapped file actions
@@ -99,7 +104,7 @@ module Dependabot
           branch_name: String,
           commit_message: String,
           files: T::Array[Dependabot::DependencyFile],
-          options: T.untyped
+          options: Object
         )
           .returns(Gitlab::ObjectifiedHash)
       end
@@ -117,19 +122,16 @@ module Dependabot
       sig do
         params(
           method_name: T.any(Symbol, String),
-          args: T.untyped,
-          block: T.nilable(T.proc.returns(T.untyped))
+          args: Object,
+          block: T.nilable(Proc)
         )
-          .returns(T.untyped)
+          .returns(T.anything)
       end
       def method_missing(method_name, *args, &block)
+        original_args = args
         retry_connection_failures do
-          if @client.respond_to?(method_name)
-            mutatable_args = args.map(&:dup)
-            T.unsafe(@client).public_send(method_name, *mutatable_args, &block)
-          else
-            super
-          end
+          args = original_args.map(&:dup)
+          super
         end
       end
 
@@ -141,7 +143,7 @@ module Dependabot
           .returns(T::Boolean)
       end
       def respond_to_missing?(method_name, include_private = false)
-        @client.respond_to?(method_name) || super
+        @client.respond_to?(method_name, include_private)
       end
 
       sig do
@@ -156,7 +158,7 @@ module Dependabot
           yield
         rescue *RETRYABLE_ERRORS
           retry_attempt += 1
-          retry_attempt <= @max_retries ? retry : raise
+          retry_attempt <= @max_retries ? retry : Kernel.raise
         end
       end
 
@@ -166,7 +168,7 @@ module Dependabot
       #
       # @param [Array<Dependabot::DependencyFile>] files
       # @return [Array<Hash>]
-      sig { params(files: T::Array[Dependabot::DependencyFile]).returns(T::Array[T::Hash[Symbol, T.untyped]]) }
+      sig { params(files: T::Array[Dependabot::DependencyFile]).returns(T::Array[T::Hash[Symbol, Object]]) }
       def file_actions(files)
         files.map do |file|
           {

data/lib/dependabot/clients/json_response_parser.rb

@@ -0,0 +1,103 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+
+require "dependabot/errors"
+require "sorbet-runtime"
+
+module Dependabot
+  module Clients
+    module JsonResponseParser
+      extend T::Sig
+
+      JsonObject = T.type_alias { T::Hash[String, Object] }
+      JsonObjects = T.type_alias { T::Array[JsonObject] }
+
+      private
+
+      sig { params(body: String, context: String).returns(JsonObject) }
+      def parse_json_object(body, context)
+        value = T.cast(JSON.parse(body), Object)
+        return T.let(value, JsonObject) if value.is_a?(Hash)
+
+        raise_bad_response(context, "expected an object")
+      rescue JSON::ParserError => e
+        raise_bad_response(context, e.message)
+      end
+
+      sig { params(object: JsonObject, key: String, context: String).returns(JsonObject) }
+      def object_field(object, key, context)
+        value = object.fetch(key)
+        return T.let(value, JsonObject) if value.is_a?(Hash)
+
+        raise_bad_response(context, "#{key} must be an object")
+      rescue KeyError => e
+        raise_bad_response(context, e.message)
+      end
+
+      sig { params(object: JsonObject, key: String, context: String).returns(String) }
+      def string_field(object, key, context)
+        string_value(object.fetch(key), context)
+      rescue KeyError => e
+        raise_bad_response(context, e.message)
+      end
+
+      sig { params(value: Object, context: String).returns(String) }
+      def string_value(value, context)
+        return value if value.is_a?(String)
+
+        raise_bad_response(context, "expected a string")
+      end
+
+      sig { params(object: JsonObject, key: String, context: String).returns(JsonObjects) }
+      def object_array_field(object, key, context)
+        object_array(object.fetch(key), context)
+      rescue KeyError => e
+        raise_bad_response(context, e.message)
+      end
+
+      sig { params(value: Object, context: String).returns(JsonObjects) }
+      def object_array(value, context)
+        raise_bad_response(context, "expected an array") unless value.is_a?(Array)
+
+        value.map do |raw_entry|
+          entry = T.cast(raw_entry, Object)
+          next T.let(entry, JsonObject) if entry.is_a?(Hash)
+
+          raise_bad_response(context, "array entries must be objects")
+        end
+      end
+
+      sig { params(object: JsonObject, key: String, context: String).returns(JsonObject) }
+      def first_object_field(object, key, context)
+        value = object_array_field(object, key, context).first
+        return value if value
+
+        raise_bad_response(context, "#{key} must contain at least one object")
+      end
+
+      sig { params(object: JsonObject, context: String, paths: T::Array[T::Array[String]]).void }
+      def validate_string_paths(object, context, paths)
+        paths.each do |path|
+          current = T.must(path[0...-1]).reduce(object) { |value, key| object_field(value, key, context) }
+          string_field(current, T.must(path.last), context)
+        end
+      end
+
+      sig { params(context: String, message: String).returns(T.noreturn) }
+      def raise_bad_response(context, message)
+        provider, source = response_identity
+        Kernel.raise Dependabot::PrivateSourceBadResponse.new(
+          source,
+          "Malformed #{provider} response for #{context}: #{message}"
+        )
+      end
+
+      sig { returns([String, String]) }
+      def response_identity
+        Kernel.raise NotImplementedError
+      end
+    end
+  end
+end