dependabot-composer 0.397.0 → 0.399.0

data/lib/dependabot/composer/helpers.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 require "dependabot/composer/version"
+require "dependabot/composer/manifest_document"
+require "dependabot/composer/lockfile_document"
 require "sorbet-runtime"
 
 module Dependabot
@@ -31,20 +33,20 @@ module Dependabot
 
       sig do
         params(
-          composer_json: T::Hash[String, T.untyped],
-          parsed_lockfile: T.nilable(T::Hash[String, T.untyped])
+          composer_json: ManifestDocument,
+          parsed_lockfile: T.nilable(LockfileDocument)
         )
           .returns(String)
       end
       def self.composer_version(composer_json, parsed_lockfile = nil)
         # If the parsed lockfile has a plugin API version, always use V2.
         # V1 helpers have been removed, so we run with Composer V2 regardless.
-        if parsed_lockfile && parsed_lockfile[PackageManager::PLUGIN_API_VERSION_KEY]
-          version = Composer::Version.new(parsed_lockfile[PackageManager::PLUGIN_API_VERSION_KEY])
+        plugin_api_version = parsed_lockfile&.plugin_api_version
+        if plugin_api_version
+          version = Composer::Version.new(plugin_api_version)
           major_version = version.canonical_segments.first
 
           if major_version && major_version <= 1
-            plugin_api_version = parsed_lockfile[PackageManager::PLUGIN_API_VERSION_KEY]
             Dependabot.logger.warn(
               "Composer V1 lockfile detected (plugin-api-version: #{plugin_api_version}). " \
               "Dependabot no longer supports Composer V1. Running with Composer V2."
@@ -56,7 +58,8 @@ module Dependabot
 
         # Check if the composer name does not follow the Composer V2 naming conventions.
         # This happens if "name" is present in composer.json but doesn't match the required pattern.
-        composer_name_invalid = composer_json["name"] && composer_json["name"] !~ COMPOSER_V2_NAME_REGEX
+        composer_name = composer_json.name
+        composer_name_invalid = composer_name && composer_name !~ COMPOSER_V2_NAME_REGEX
 
         # If the name is invalid returns the fallback version.
         return V2 if composer_name_invalid
@@ -141,34 +144,32 @@ module Dependabot
       end
 
       # Capture the platform PHP version from composer.json
-      sig { params(parsed_composer_json: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
+      sig { params(parsed_composer_json: ManifestDocument).returns(T.nilable(String)) }
       def self.capture_platform_php(parsed_composer_json)
         capture_platform(parsed_composer_json, Language::NAME)
       end
 
       # Capture the platform extension from composer.json
-      sig { params(parsed_composer_json: T::Hash[String, T.untyped], name: String).returns(T.nilable(String)) }
+      sig { params(parsed_composer_json: ManifestDocument, name: String).returns(T.nilable(String)) }
       def self.capture_platform(parsed_composer_json, name)
-        parsed_composer_json.dig(PackageManager::CONFIG_KEY, PackageManager::PLATFORM_KEY, name)
+        parsed_composer_json.platform(name)
       end
 
       # Capture PHP version constraint from composer.json
-      sig { params(parsed_composer_json: T::Hash[String, T.untyped]).returns(T.nilable(String)) }
+      sig { params(parsed_composer_json: ManifestDocument).returns(T.nilable(String)) }
       def self.php_constraint(parsed_composer_json)
         dependency_constraint(parsed_composer_json, Language::NAME)
       end
 
       # Capture extension version constraint from composer.json
-      sig { params(parsed_composer_json: T::Hash[String, T.untyped], name: String).returns(T.nilable(String)) }
+      sig { params(parsed_composer_json: ManifestDocument, name: String).returns(T.nilable(String)) }
       def self.dependency_constraint(parsed_composer_json, name)
-        parsed_composer_json.dig(PackageManager::REQUIRE_KEY, name)
+        parsed_composer_json.dependency_constraint(name)
       end
 
-      sig { params(composer_json: T::Hash[String, T.untyped]).returns(T::Boolean) }
+      sig { params(composer_json: ManifestDocument).returns(T::Boolean) }
       def self.invalid_v2_requirement?(composer_json)
-        return false unless composer_json.key?(PackageManager::REQUIRE_KEY)
-
-        composer_json[PackageManager::REQUIRE_KEY].keys.any? do |key|
+        composer_json.required_dependency_names.any? do |key|
           key !~ PLATFORM_PACKAGE_REGEX && key !~ COMPOSER_V2_NAME_REGEX
         end
       end

data/lib/dependabot/composer/lockfile_document.rb

@@ -0,0 +1,180 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/dependency_requirement"
+require "dependabot/composer/document_value_parser"
+
+module Dependabot
+  module Composer
+    class LockfileDocument
+      extend T::Sig
+
+      class PackageRecord
+        extend T::Sig
+
+        sig { params(data: DocumentValueParser::ObjectHash, context: String).void }
+        def initialize(data:, context:)
+          @data = data
+          @context = context
+        end
+
+        sig { returns(T.nilable(String)) }
+        def name
+          value = @data["name"]
+          value if value.is_a?(String)
+        end
+
+        sig { returns(T.nilable(String)) }
+        def version
+          @data["version"]&.to_s
+        end
+
+        sig { returns(T.nilable(String)) }
+        def required_version
+          @data.fetch("version")&.to_s
+        end
+
+        sig { returns(T::Boolean) }
+        def path_source?
+          @data["source"].nil? && path_distribution?
+        end
+
+        sig { returns(T::Boolean) }
+        def path_distribution?
+          section("dist")&.[]("type") == "path"
+        end
+
+        sig { params(path: String).returns(T::Boolean) }
+        def matches_distribution_path?(path)
+          section("dist")&.[]("url") == path
+        end
+
+        sig { params(prefix: String).returns(T::Boolean) }
+        def dist_url_starts_with?(prefix)
+          section("dist")&.[]("url").to_s.start_with?(prefix)
+        end
+
+        sig { returns(String) }
+        def dist_url
+          DocumentValueParser.string(section("dist")&.[]("url"), "#{@context} dist.url")
+        end
+
+        sig { returns(String) }
+        def to_manifest_json
+          @data.to_json
+        end
+
+        sig { returns(T.nilable(String)) }
+        def source_reference
+          DocumentValueParser.optional_string(section("source")&.[]("reference"), "#{@context} source.reference")
+        end
+
+        sig { returns(T.nilable(Dependabot::DependencyRequirement::ObjectHash)) }
+        def git_source
+          source = section("source")
+          return unless source && source["type"] == "git"
+
+          # The URL is passed through as source metadata, not interpreted by the file parser.
+          { type: "git", url: source["url"] }
+        end
+
+        private
+
+        sig { params(key: String).returns(T.nilable(DocumentValueParser::ObjectHash)) }
+        def section(key)
+          value = @data[key]
+          return if value.nil?
+
+          DocumentValueParser.object_hash(value, "#{@context} #{key}")
+        end
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(LockfileDocument) }
+      def self.from_file(file)
+        new(data: T.cast(JSON.parse(T.must(file.content)), Object), context: file.path)
+      end
+
+      sig { params(data: Object, context: String).void }
+      def initialize(data:, context:)
+        @data = T.let(DocumentValueParser.object_hash(data, context), DocumentValueParser::ObjectHash)
+        @context = context
+      end
+
+      sig { returns(T.nilable(T.any(String, Integer))) }
+      def plugin_api_version
+        value = @data["plugin-api-version"]
+        return unless value
+        return value if value.is_a?(String) || value.is_a?(Integer)
+
+        raise TypeError, "#{@context} plugin-api-version must be a string or integer"
+      end
+
+      sig { params(group: String).returns(T::Array[PackageRecord]) }
+      def packages(group)
+        entries = @data[group]
+        return [] unless entries.is_a?(Array)
+
+        entries.each_with_index.filter_map { |entry, index| package_record(T.cast(entry, Object), group, index) }
+      end
+
+      sig { params(group: String, name: String).returns(T.nilable(PackageRecord)) }
+      def find_package(group, name)
+        entries = @data.fetch(group, [])
+        return if entries.nil?
+        raise TypeError, "#{@context} #{group} must be an array" unless entries.is_a?(Array)
+
+        entries.each_with_index do |entry, index|
+          package = package_record(T.cast(entry, Object), group, index)
+          return package if package&.name == name
+        end
+        nil
+      end
+
+      sig { params(group: String).returns(T::Array[PackageRecord]) }
+      def path_packages(group)
+        distribution_entries(group).each_with_index.filter_map do |entry, index|
+          package = strict_package_record(entry, group, index)
+          package if package.path_distribution?
+        end
+      end
+
+      sig { params(group: String, path: String).returns(T.nilable(PackageRecord)) }
+      def find_path_package(group, path)
+        distribution_entries(group).each_with_index do |entry, index|
+          package = strict_package_record(entry, group, index)
+          return package if package.matches_distribution_path?(path)
+        end
+        nil
+      end
+
+      private
+
+      sig { params(group: String).returns(T::Array[Object]) }
+      def distribution_entries(group)
+        entries = @data[group]
+        return [] unless entries
+        return [] if entries.is_a?(Hash) && entries.empty?
+        raise TypeError, "#{@context} #{group} must be an array" unless entries.is_a?(Array)
+
+        entries.map { |entry| T.cast(entry, Object) }
+      end
+
+      sig { params(value: Object, group: String, index: Integer).returns(T.nilable(PackageRecord)) }
+      def package_record(value, group, index)
+        return if value.is_a?(String)
+
+        strict_package_record(value, group, index)
+      end
+
+      sig { params(value: Object, group: String, index: Integer).returns(PackageRecord) }
+      def strict_package_record(value, group, index)
+        context = "#{@context} #{group}[#{index}]"
+        PackageRecord.new(data: DocumentValueParser.object_hash(value, context), context: context)
+      end
+    end
+  end
+end

data/lib/dependabot/composer/manifest_document.rb

@@ -0,0 +1,145 @@
+# typed: strong
+# frozen_string_literal: true
+
+require "json"
+require "sorbet-runtime"
+
+require "dependabot/dependency_file"
+require "dependabot/composer/document_value_parser"
+
+module Dependabot
+  module Composer
+    class ManifestDocument
+      extend T::Sig
+
+      class DependencyEntry
+        extend T::Sig
+
+        sig { params(name: String, value: Object, context: String).void }
+        def initialize(name:, value:, context:)
+          @name = name
+          @value = value
+          @context = context
+        end
+
+        sig { returns(String) }
+        attr_reader :name
+
+        sig { returns(T.nilable(String)) }
+        def string_requirement
+          value = @value
+          value if value.is_a?(String)
+        end
+
+        sig { returns(String) }
+        def requirement
+          DocumentValueParser.string(@value, @context)
+        end
+      end
+
+      class Repository
+        extend T::Sig
+
+        sig { params(type: String, url: Object, context: String).void }
+        def initialize(type:, url:, context:)
+          @type = type
+          @url = url
+          @context = context
+        end
+
+        sig { returns(String) }
+        attr_reader :type
+
+        sig { returns(String) }
+        def url
+          DocumentValueParser.string(@url, "#{@context} url")
+        end
+      end
+
+      sig { params(file: Dependabot::DependencyFile).returns(ManifestDocument) }
+      def self.from_file(file)
+        new(data: T.cast(JSON.parse(T.must(file.content)), Object), context: file.path)
+      end
+
+      sig { params(data: Object, context: String).void }
+      def initialize(data:, context:)
+        @data = T.let(DocumentValueParser.object_hash(data, context), DocumentValueParser::ObjectHash)
+        @context = context
+      end
+
+      sig { returns(T.nilable(String)) }
+      def name
+        value = @data["name"]
+        return unless value
+
+        DocumentValueParser.string(value, "#{@context} name")
+      end
+
+      sig { params(group: String).returns(T::Array[DependencyEntry]) }
+      def requirements(group)
+        value = @data[group]
+        return [] unless value.is_a?(Hash)
+
+        DocumentValueParser.object_hash(value, "#{@context} #{group}").map do |name, requirement|
+          DependencyEntry.new(name: name, value: requirement, context: "#{@context} #{group} requirement")
+        end
+      end
+
+      sig { returns(T::Array[String]) }
+      def required_dependency_names
+        return [] unless @data.key?("require")
+
+        DocumentValueParser.object_hash(@data.fetch("require"), "#{@context} require").keys
+      end
+
+      sig { params(name: String).returns(T.nilable(String)) }
+      def platform(name)
+        config = section(@data, "config", "config")
+        platform = config && section(config, "platform", "config.platform")
+        DocumentValueParser.optional_string(platform&.[](name), "#{@context} config.platform.#{name}")
+      end
+
+      sig { params(name: String).returns(T.nilable(String)) }
+      def dependency_constraint(name)
+        requirements = section(@data, "require", "require")
+        DocumentValueParser.optional_string(requirements&.[](name), "#{@context} require.#{name}")
+      end
+
+      sig { returns(T::Array[Repository]) }
+      def repositories
+        value = @data["repositories"]
+        entries =
+          case value
+          when Hash then value.values
+          when Array then value
+          else return []
+          end
+
+        entries.each_with_index.filter_map do |raw_entry, index|
+          entry = T.cast(raw_entry, Object)
+          next unless entry.is_a?(Hash)
+
+          context = "#{@context} repositories[#{index}]"
+          details = DocumentValueParser.object_hash(entry, context)
+          type = details["type"]
+          next unless type.is_a?(String) && (type == "path" || type == "artifact")
+
+          Repository.new(type: type, url: details["url"], context: context)
+        end
+      end
+
+      private
+
+      sig do
+        params(data: DocumentValueParser::ObjectHash, key: String, field: String)
+          .returns(T.nilable(DocumentValueParser::ObjectHash))
+      end
+      def section(data, key, field)
+        value = data[key]
+        return if value.nil?
+
+        DocumentValueParser.object_hash(value, "#{@context} #{field}")
+      end
+    end
+  end
+end

data/lib/dependabot/composer/package/package_details_fetcher.rb

@@ -2,13 +2,13 @@
 # frozen_string_literal: true
 
 require "json"
-require "time"
 require "excon"
 require "nokogiri"
 require "sorbet-runtime"
 require "dependabot/registry_client"
 require "dependabot/package/package_release"
 require "dependabot/package/package_details"
+require "dependabot/composer/package/registry_package"
 
 # Stores metadata for a package, including all its available versions
 module Dependabot
@@ -46,7 +46,7 @@ module Dependabot
           @security_advisories = security_advisories
 
           @registry_urls = T.let(nil, T.nilable(T::Array[String]))
-          @registry_version_details = T.let(nil, T.nilable(T::Array[T::Hash[String, T.untyped]]))
+          @registry_version_details = T.let(nil, T.nilable(T::Array[RegistryPackage::Release]))
         end
 
         sig { returns(Dependabot::Dependency) }
@@ -66,38 +66,18 @@ module Dependabot
 
         sig { returns(T::Array[Dependabot::Package::PackageRelease]) }
         def fetch_releases
-          available_version_details = registry_version_details
-                                      .select do |version_details|
-            version = version_details.fetch("version")
-            version && version_class.correct?(version.gsub(/^v/, ""))
-          end
-
-          releases = available_version_details.map do |version_details|
-            format_version_release(version_details)
-          end
-          releases
+          registry_version_details.filter_map { |release| format_version_release(release) }
         end
 
         sig { returns(Dependabot::Package::PackageDetails) }
         def fetch
-          available_version_details = registry_version_details
-                                      .select do |version_details|
-            version = version_details.fetch("version")
-            version && version_class.correct?(version.gsub(/^v/, ""))
-          end
-
-          releases = available_version_details.map do |version_details|
-            format_version_release(version_details)
-          end
           Dependabot::Package::PackageDetails.new(
             dependency: dependency,
-            releases: releases.reverse.uniq(&:version)
+            releases: fetch_releases.reverse.uniq(&:version)
           )
         end
 
-        sig do
-          returns(T::Array[T::Hash[String, T.untyped]])
-        end
+        sig { returns(T::Array[RegistryPackage::Release]) }
         def registry_version_details
           return @registry_version_details unless @registry_version_details.nil?
 
@@ -114,16 +94,15 @@ module Dependabot
             urls << "https://repo.packagist.org/p2/#{dependency.name.downcase}.json"
           end
 
-          @registry_version_details = []
+          releases = T.let([], T::Array[RegistryPackage::Release])
           urls.each do |url|
-            @registry_version_details += fetch_registry_versions_from_url(url)
+            releases.concat(fetch_registry_versions_from_url(url))
           end
 
-          @registry_version_details.uniq! { |version_details| version_details["version"] }
-          @registry_version_details
+          @registry_version_details = releases.uniq(&:version_string)
         end
 
-        sig { params(url: String).returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { params(url: String).returns(T::Array[RegistryPackage::Release]) }
         def fetch_registry_versions_from_url(url)
           url_host = URI(url).host
           cred = registry_credentials.find do |c|
@@ -146,60 +125,25 @@ module Dependabot
           []
         end
 
-        sig { params(response: T.untyped, url: String).returns(T::Array[T::Hash[String, T.untyped]]) }
+        sig { params(response: Excon::Response, url: String).returns(T::Array[RegistryPackage::Release]) }
         def parse_registry_response(response, url)
           return [] unless response.status == 200
 
-          listing = JSON.parse(response.body)
-          return [] if listing.nil?
-          return [] unless listing.is_a?(Hash)
-          return [] if listing.fetch("packages", []) == []
-          return [] unless listing.dig("packages", dependency.name.downcase)
-
-          extract_versions(listing)
-        rescue JSON::ParserError
-          msg = "'#{url}' does not contain valid JSON"
-          raise DependencyFileNotResolvable, msg
-        end
-
-        sig { params(listing: T::Hash[String, T.untyped]).returns(T::Array[T::Hash[String, T.untyped]]) }
-        def extract_versions(listing)
-          # Packagist's Metadata API format:
-          # v1: "packages": {<package name>: {<version_number>: {hash of metadata for a particular release version}}}
-          # v2: "packages": {<package name>: [{hash of metadata for a particular release version}]}
-          version_listings = listing.dig("packages", dependency.name.downcase)
-
-          if version_listings.is_a?(Hash) # some private registries are still using the v1 format
-            # Regardless of API version, composer always reads the version from the metadata hash. So for the v1 API,
-            # ignore the keys as repositories other than packagist.org could be using different keys. Instead, coerce
-            # to an array of metadata hashes to match v2 format.
-            version_listings = version_listings.values
-          end
-
-          if version_listings.is_a?(Array)
-            version_listings
-          else
-            []
-          end
+          RegistryPackage.from_json(response.body, package_name: dependency.name, source: url).releases
         end
 
         sig do
-          params(
-            release_data: T::Hash[String, T.untyped]
-          )
-            .returns(Dependabot::Package::PackageRelease)
+          params(release_data: RegistryPackage::Release).returns(T.nilable(Dependabot::Package::PackageRelease))
         end
         def format_version_release(release_data)
-          version = release_data["version"].gsub(/^v/, "")
-          released_at = release_data["time"] ? Time.parse(release_data["time"]) : nil # this will return nil if the time key is missing, avoiding error # rubocop:disable Layout/LineLength
-          url = release_data["dist"] ? release_data["dist"]["url"] : nil
-          package_type = PACKAGE_TYPE
+          version = release_data.version_string
+          return unless version && version_class.correct?(version.gsub(/^v/, ""))
 
           package_release(
-            version: version,
-            released_at: released_at,
-            url: url,
-            package_type: package_type
+            version: version.gsub(/^v/, ""),
+            released_at: release_data.released_at,
+            url: release_data.url,
+            package_type: PACKAGE_TYPE
           )
         end