dependabot-core 0.79.4 → 0.80.0

data/lib/dependabot/update_checkers/dotnet/nuget.rb

@@ -1,127 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/file_parsers/dotnet/nuget"
-require "dependabot/update_checkers/base"
-
-module Dependabot
-  module UpdateCheckers
-    module Dotnet
-      class Nuget < Dependabot::UpdateCheckers::Base
-        require_relative "nuget/version_finder"
-        require_relative "nuget/property_updater"
-        require_relative "nuget/requirements_updater"
-
-        def latest_version
-          @latest_version = latest_version_details&.fetch(:version)
-        end
-
-        def latest_resolvable_version
-          # TODO: Check version resolution!
-          return nil if version_comes_from_multi_dependency_property?
-
-          latest_version
-        end
-
-        def latest_resolvable_version_with_no_unlock
-          # Irrelevant, since Nuget has a single dependency file
-          nil
-        end
-
-        def updated_requirements
-          RequirementsUpdater.new(
-            requirements: dependency.requirements,
-            latest_version: latest_version&.to_s,
-            source_details: latest_version_details&.
-                            slice(:nuspec_url, :repo_url, :source_url)
-          ).updated_requirements
-        end
-
-        def up_to_date?
-          # If any requirements have an uninterpolated property in them then
-          # that property couldn't be found, and we assume that the dependency
-          # is up-to-date
-          return true unless requirements_unlocked_or_can_be?
-
-          super
-        end
-
-        def requirements_unlocked_or_can_be?
-          # If any requirements have an uninterpolated property in them then
-          # that property couldn't be found, and the requirement therefore
-          # cannot be unlocked (since we can't update that property)
-          namespace = FileParsers::Dotnet::Nuget::PropertyValueFinder
-          dependency.requirements.none? do |req|
-            req.fetch(:requirement)&.match?(namespace::PROPERTY_REGEX)
-          end
-        end
-
-        private
-
-        def latest_version_resolvable_with_full_unlock?
-          return false unless version_comes_from_multi_dependency_property?
-
-          property_updater.update_possible?
-        end
-
-        def updated_dependencies_after_full_unlock
-          property_updater.updated_dependencies
-        end
-
-        def latest_version_details
-          @latest_version_details ||= version_finder.latest_version_details
-        end
-
-        def version_finder
-          @version_finder ||=
-            VersionFinder.new(
-              dependency: dependency,
-              dependency_files: dependency_files,
-              credentials: credentials,
-              ignored_versions: ignored_versions
-            )
-        end
-
-        def property_updater
-          @property_updater ||=
-            PropertyUpdater.new(
-              dependency: dependency,
-              dependency_files: dependency_files,
-              target_version_details: latest_version_details,
-              credentials: credentials,
-              ignored_versions: ignored_versions
-            )
-        end
-
-        def version_comes_from_multi_dependency_property?
-          declarations_using_a_property.any? do |requirement|
-            property_name = requirement.fetch(:metadata).fetch(:property_name)
-
-            all_property_based_dependencies.any? do |dep|
-              next false if dep.name == dependency.name
-
-              dep.requirements.any? do |req|
-                req.dig(:metadata, :property_name) == property_name
-              end
-            end
-          end
-        end
-
-        def declarations_using_a_property
-          @declarations_using_a_property ||=
-            dependency.requirements.
-            select { |req| req.dig(:metadata, :property_name) }
-        end
-
-        def all_property_based_dependencies
-          @all_property_based_dependencies ||=
-            FileParsers::Dotnet::Nuget.new(
-              dependency_files: dependency_files,
-              source: nil
-            ).parse.select do |dep|
-              dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
-            end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/update_checkers/dotnet/nuget/property_updater.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/file_parsers/dotnet/nuget"
-require "dependabot/update_checkers/dotnet/nuget"
-
-module Dependabot
-  module UpdateCheckers
-    module Dotnet
-      class Nuget
-        class PropertyUpdater
-          require_relative "version_finder"
-          require_relative "requirements_updater"
-
-          def initialize(dependency:, dependency_files:, credentials:,
-                         target_version_details:, ignored_versions:)
-            @dependency       = dependency
-            @dependency_files = dependency_files
-            @credentials      = credentials
-            @ignored_versions = ignored_versions
-            @target_version   = target_version_details&.fetch(:version)
-            @source_details   = target_version_details&.
-                                slice(:nuspec_url, :repo_url, :source_url)
-          end
-
-          def update_possible?
-            return false unless target_version
-
-            @update_possible ||=
-              dependencies_using_property.all? do |dep|
-                versions = VersionFinder.new(
-                  dependency: dep,
-                  dependency_files: dependency_files,
-                  credentials: credentials,
-                  ignored_versions: ignored_versions
-                ).versions.map { |v| v.fetch(:version) }
-
-                versions.include?(target_version) || versions.none?
-              end
-          end
-
-          def updated_dependencies
-            raise "Update not possible!" unless update_possible?
-
-            @updated_dependencies ||=
-              dependencies_using_property.map do |dep|
-                Dependency.new(
-                  name: dep.name,
-                  version: target_version.to_s,
-                  requirements: updated_requirements(dep),
-                  previous_version: dep.version,
-                  previous_requirements: dep.requirements,
-                  package_manager: dep.package_manager
-                )
-              end
-          end
-
-          private
-
-          attr_reader :dependency, :dependency_files, :target_version,
-                      :source_details, :credentials, :ignored_versions
-
-          def dependencies_using_property
-            @dependencies_using_property ||=
-              FileParsers::Dotnet::Nuget.new(
-                dependency_files: dependency_files,
-                source: nil
-              ).parse.select do |dep|
-                dep.requirements.any? do |r|
-                  r.dig(:metadata, :property_name) == property_name
-                end
-              end
-          end
-
-          def property_name
-            @property_name ||= dependency.requirements.
-                               find { |r| r.dig(:metadata, :property_name) }&.
-                               dig(:metadata, :property_name)
-
-            raise "No requirement with a property name!" unless @property_name
-
-            @property_name
-          end
-
-          def updated_requirements(dep)
-            @updated_requirements ||= {}
-            @updated_requirements[dep.name] ||=
-              RequirementsUpdater.new(
-                requirements: dep.requirements,
-                latest_version: target_version,
-                source_details: source_details
-              ).updated_requirements
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/update_checkers/dotnet/nuget/repository_finder.rb

@@ -1,232 +0,0 @@
-# frozen_string_literal: true
-
-require "excon"
-require "nokogiri"
-require "dependabot/errors"
-require "dependabot/update_checkers/dotnet/nuget"
-require "dependabot/shared_helpers"
-
-module Dependabot
-  module UpdateCheckers
-    module Dotnet
-      class Nuget
-        class RepositoryFinder
-          DEFAULT_REPOSITORY_URL = "https://api.nuget.org/v3/index.json"
-
-          def initialize(dependency:, credentials:, config_file: nil)
-            @dependency  = dependency
-            @credentials = credentials
-            @config_file = config_file
-          end
-
-          def dependency_urls
-            find_dependency_urls
-          end
-
-          private
-
-          attr_reader :dependency, :credentials, :config_file
-
-          def find_dependency_urls
-            @find_dependency_urls ||=
-              known_repositories.flat_map do |details|
-                if details.fetch(:url) == DEFAULT_REPOSITORY_URL
-                  # Save a request for the default URL, since we already how
-                  # it addresses packages
-                  next default_repository_details
-                end
-
-                build_url_for_details(details)
-              end.compact.uniq
-          end
-
-          def build_url_for_details(repo_details)
-            response = get_repo_metadata(repo_details)
-            check_repo_reponse(response, repo_details)
-            return unless response.status == 200
-
-            base_url = base_url_from_v3_metadata(JSON.parse(response.body))
-            search_url = search_url_from_v3_metadata(JSON.parse(response.body))
-
-            details = {
-              repository_url: repo_details.fetch(:url),
-              auth_header: auth_header_for_token(repo_details.fetch(:token)),
-              repository_type: "v3"
-            }
-            if base_url
-              details[:versions_url] =
-                File.join(base_url, dependency.name.downcase, "index.json")
-            end
-            if search_url
-              details[:search_url] =
-                search_url + "?q=#{dependency.name.downcase}&prerelease=true"
-            end
-            details
-          rescue JSON::ParserError
-            build_v2_url(response, repo_details)
-          rescue Excon::Error::Timeout, Excon::Error::Socket
-            handle_timeout(repo_metadata_url: repo_details.fetch(:url))
-          end
-
-          def get_repo_metadata(repo_details)
-            Excon.get(
-              repo_details.fetch(:url),
-              headers: auth_header_for_token(repo_details.fetch(:token)),
-              idempotent: true,
-              **SharedHelpers.excon_defaults
-            )
-          end
-
-          def base_url_from_v3_metadata(metadata)
-            metadata.
-              fetch("resources", []).
-              find { |r| r.fetch("@type") == "PackageBaseAddress/3.0.0" }&.
-              fetch("@id")
-          end
-
-          def search_url_from_v3_metadata(metadata)
-            metadata.
-              fetch("resources", []).
-              find { |r| r.fetch("@type") == "SearchQueryService" }&.
-              fetch("@id")
-          end
-
-          def build_v2_url(response, repo_details)
-            doc = Nokogiri::XML(response.body)
-            doc.remove_namespaces!
-            base_url = doc.at_xpath("service")&.attributes&.fetch("base")&.value
-            return unless base_url
-
-            {
-              repository_url: base_url,
-              versions_url: File.join(
-                base_url,
-                "FindPackagesById()?id='#{dependency.name}'"
-              ),
-              auth_header: auth_header_for_token(repo_details.fetch(:token)),
-              repository_type: "v2"
-            }
-          end
-
-          def check_repo_reponse(response, details)
-            return unless [401, 402, 403].include?(response.status)
-            raise if details.fetch(:url) == DEFAULT_REPOSITORY_URL
-
-            raise PrivateSourceAuthenticationFailure, details.fetch(:url)
-          end
-
-          def handle_timeout(repo_metadata_url:)
-            raise if repo_metadata_url == DEFAULT_REPOSITORY_URL
-
-            raise PrivateSourceTimedOut, repo_metadata_url
-          end
-
-          def known_repositories
-            return @known_repositories if @known_repositories
-
-            @known_repositories = []
-            @known_repositories += credential_repositories
-            @known_repositories += config_file_repositories
-
-            if @known_repositories.empty?
-              @known_repositories << { url: DEFAULT_REPOSITORY_URL, token: nil }
-            end
-
-            @known_repositories.uniq
-          end
-
-          def credential_repositories
-            @credential_repositories ||=
-              credentials.
-              select { |cred| cred["type"] == "nuget_feed" }.
-              map { |c| { url: c.fetch("url"), token: c["token"] } }
-          end
-
-          def config_file_repositories
-            return [] unless config_file
-
-            doc = Nokogiri::XML(config_file.content)
-            doc.remove_namespaces!
-            sources =
-              doc.css("configuration > packageSources > add").map do |node|
-                {
-                  key:
-                    node.attribute("key")&.value&.strip ||
-                      node.at_xpath("./key")&.content&.strip,
-                  url:
-                    node.attribute("value")&.value&.strip ||
-                      node.at_xpath("./value")&.content&.strip
-                }
-              end
-
-            sources.reject! do |s|
-              known_urls = credential_repositories.map { |cr| cr.fetch(:url) }
-              known_urls.include?(s.fetch(:url))
-            end
-
-            add_config_file_credentials(sources: sources, doc: doc)
-            sources.each { |details| details.delete(:key) }
-
-            sources
-          end
-
-          def default_repository_details
-            {
-              repository_url: DEFAULT_REPOSITORY_URL,
-              versions_url: "https://api.nuget.org/v3-flatcontainer/"\
-                               "#{dependency.name.downcase}/index.json",
-              search_url: "https://api-v2v3search-0.nuget.org/query"\
-                               "?q=#{dependency.name.downcase}&prerelease=true",
-              auth_header: {},
-              repository_type: "v3"
-            }
-          end
-
-          def add_config_file_credentials(sources:, doc:)
-            sources.each do |source_details|
-              key = source_details.fetch(:key)
-              next source_details[:token] = nil unless key
-              next source_details[:token] = nil if key.match?(/^\d/)
-
-              tag = key.gsub(" ", "_x0020_")
-              creds_nodes = doc.css("configuration > packageSourceCredentials "\
-                                    "> #{tag} > add")
-
-              username =
-                creds_nodes.
-                find { |n| n.attribute("key")&.value == "Username" }&.
-                attribute("value")&.value
-              password =
-                creds_nodes.
-                find { |n| n.attribute("key")&.value == "ClearTextPassword" }&.
-                attribute("value")&.value
-
-              # Note: We have to look for plain text passwords, as we have no
-              # way of decrypting encrypted passwords. For the same reason we
-              # don't fetch API keys from the nuget.config at all.
-              next source_details[:token] = nil unless username && password
-
-              source_details[:token] = "#{username}:#{password}"
-            end
-
-            sources
-          end
-
-          def auth_header_for_token(token)
-            return {} unless token
-
-            if token.include?(":")
-              encoded_token = Base64.encode64(token).delete("\n")
-              { "Authorization" => "Basic #{encoded_token}" }
-            elsif Base64.decode64(token).ascii_only? &&
-                  Base64.decode64(token).include?(":")
-              { "Authorization" => "Basic #{token.delete("\n")}" }
-            else
-              { "Authorization" => "Bearer #{token}" }
-            end
-          end
-        end
-      end
-    end
-  end
-end