dependabot-npm_and_yarn 0.302.0 → 0.304.0

data/lib/dependabot/npm_and_yarn/{update_checker → package}/registry_finder.rb

@@ -1,14 +1,19 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "excon"
 require "dependabot/npm_and_yarn/update_checker"
 require "dependabot/registry_client"
+require "sorbet-runtime"
 
 module Dependabot
   module NpmAndYarn
-    class UpdateChecker
+    module Package
       class RegistryFinder
+        extend T::Sig
+
+        GLOBAL_NPM_REGISTRY = "https://registry.npmjs.org"
+
         CENTRAL_REGISTRIES = %w(
           https://registry.npmjs.org
           http://registry.npmjs.org
@@ -21,6 +26,15 @@ module Dependabot
         NPM_SCOPED_REGISTRY_REGEX = /^(?<scope>@[^:]+)\s*:registry\s*=\s*['"]?(?<registry>.*?)['"]?$/
         YARN_SCOPED_REGISTRY_REGEX = /['"](?<scope>@[^:]+):registry['"]\s((['"](?<registry>.*)['"])|(?<registry>.*))/
 
+        sig do
+          params(
+            dependency: T.nilable(Dependabot::Dependency),
+            credentials: T::Array[Dependabot::Credential],
+            npmrc_file: T.nilable(Dependabot::DependencyFile),
+            yarnrc_file: T.nilable(Dependabot::DependencyFile),
+            yarnrc_yml_file: T.nilable(Dependabot::DependencyFile)
+          ).void
+        end
         def initialize(dependency:, credentials:, npmrc_file: nil,
                        yarnrc_file: nil, yarnrc_yml_file: nil)
           @dependency = dependency
@@ -28,58 +42,91 @@ module Dependabot
           @npmrc_file = npmrc_file
           @yarnrc_file = yarnrc_file
           @yarnrc_yml_file = yarnrc_yml_file
+
+          @registry = T.let(nil, T.nilable(String))
+          @first_registry_with_dependency_details = T.let(nil, T.nilable(String))
+          @known_registries = T.let([], T::Array[T::Hash[String, T.nilable(String)]])
+          @configured_global_registry = T.let(nil, T.nilable(String))
+          @global_registry = T.let(nil, T.nilable(String))
+          @parsed_yarnrc_yml = T.let(nil, T.nilable(T::Hash[String, T.untyped]))
         end
 
+        sig { returns(String) }
         def registry
-          @registry ||= locked_registry || configured_registry || first_registry_with_dependency_details
+          return @registry if @registry
+
+          @registry = locked_registry || configured_registry || first_registry_with_dependency_details
+          T.must(@registry)
         end
 
+        sig { returns(T::Hash[String, String]) }
         def auth_headers
           auth_header_for(auth_token)
         end
 
+        sig { returns(String) }
         def dependency_url
           "#{registry_url}/#{escaped_dependency_name}"
         end
 
+        sig { params(version: T.any(String, Gem::Version)).returns(String) }
         def tarball_url(version)
           version_without_build_metadata = version.to_s.gsub(/\+.*/, "")
 
           # Dependency name needs to be unescaped since tarball URLs don't always work with escaped slashes
-          "#{registry_url}/#{dependency.name}/-/#{scopeless_name}-#{version_without_build_metadata}.tgz"
+          "#{registry_url}/#{dependency&.name}/-/#{scopeless_name}-#{version_without_build_metadata}.tgz"
         end
 
+        sig { params(registry: String).returns(T::Boolean) }
         def self.central_registry?(registry)
           CENTRAL_REGISTRIES.any? do |r|
             r.include?(registry)
           end
         end
 
+        sig { params(dependency_name: String).returns(T.nilable(String)) }
         def registry_from_rc(dependency_name)
           explicit_registry_from_rc(dependency_name) || global_registry
         end
 
+        sig { returns(T::Boolean) }
+        def custom_registry?
+          return false if CENTRAL_REGISTRIES.include?(registry_url)
+
+          !(registry_url || "").match?(/registry\.npmjs\.(org|com)/)
+        end
+
         private
 
+        sig { returns(T.nilable(Dependabot::Dependency)) }
         attr_reader :dependency
+
+        sig { returns(T::Array[Dependabot::Credential]) }
         attr_reader :credentials
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :npmrc_file
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :yarnrc_file
+        sig { returns(T.nilable(Dependabot::DependencyFile)) }
         attr_reader :yarnrc_yml_file
 
+        sig { params(dependency_name: T.nilable(String)).returns(T.nilable(String)) }
         def explicit_registry_from_rc(dependency_name)
-          if dependency_name.start_with?("@") && dependency_name.include?("/")
+          if dependency_name&.start_with?("@") && dependency_name.include?("/")
             scope = dependency_name.split("/").first
-            scoped_registry(scope) || configured_global_registry
+            scoped_registry(T.must(scope)) || configured_global_registry
           else
             configured_global_registry
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def first_registry_with_dependency_details
+          return @first_registry_with_dependency_details if @first_registry_with_dependency_details
+
           @first_registry_with_dependency_details ||=
             known_registries.find do |details|
-              url = "#{details['registry'].gsub(%r{/+$}, '')}/#{escaped_dependency_name}"
+              url = "#{details['registry']&.gsub(%r{/+$}, '')}/#{escaped_dependency_name}"
               url = "https://#{url}" unless url.start_with?("http")
               response = Dependabot::RegistryClient.get(
                 url: url,
@@ -97,6 +144,7 @@ module Dependabot
           @first_registry_with_dependency_details ||= global_registry.sub(%r{/+$}, "").sub(%r{^.*?//}, "")
         end
 
+        sig { returns(T.nilable(String)) }
         def registry_url
           url =
             if registry.start_with?("http")
@@ -104,7 +152,7 @@ module Dependabot
             else
               protocol =
                 if registry_source_url
-                  registry_source_url.split("://").first
+                  registry_source_url&.split("://")&.first
                 else
                   "https"
                 end
@@ -115,6 +163,7 @@ module Dependabot
           url.gsub(%r{/+$}, "")
         end
 
+        sig { params(token: T.nilable(String)).returns(T::Hash[String, String]) }
         def auth_header_for(token)
           return {} unless token
 
@@ -129,36 +178,45 @@ module Dependabot
           end
         end
 
+        sig { returns(T.nilable(String)) }
         def auth_token
           known_registries
             .find { |cred| cred["registry"] == registry }
             &.fetch("token", nil)
         end
 
+        sig { returns(T.nilable(String)) }
         def locked_registry
           return unless registry_source_url
 
           lockfile_registry =
             registry_source_url
-            .gsub("https://", "")
-            .gsub("http://", "")
-          detailed_registry =
-            known_registries
-            .find { |h| h["registry"].include?(lockfile_registry) }
-            &.fetch("registry")
+            &.gsub("https://", "")
+            &.gsub("http://", "")
+
+          if lockfile_registry
+            detailed_registry =
+              known_registries
+              .find { |h| h["registry"]&.include?(lockfile_registry) }
+              &.fetch("registry")
+          end
 
           detailed_registry || lockfile_registry
         end
 
+        sig { returns(T.nilable(String)) }
         def configured_registry
-          configured_registry_url = explicit_registry_from_rc(dependency.name)
+          configured_registry_url = explicit_registry_from_rc(dependency&.name)
           return unless configured_registry_url
 
           normalize_configured_registry(configured_registry_url)
         end
 
+        sig { returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def known_registries
-          @known_registries ||=
+          return @known_registries if @known_registries.any?
+
+          @known_registries =
             begin
               registries = []
               registries += credentials
@@ -169,13 +227,15 @@ module Dependabot
 
               unique_registries(registries)
             end
+          @known_registries
         end
 
+        sig { returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def npmrc_registries
           return [] unless npmrc_file
 
           registries = []
-          npmrc_file.content.scan(NPM_AUTH_TOKEN_REGEX) do
+          npmrc_file&.content&.scan(NPM_AUTH_TOKEN_REGEX) do
             next if Regexp.last_match&.[](:registry)&.include?("${")
 
             registry = T.must(Regexp.last_match)[:registry]
@@ -191,12 +251,17 @@ module Dependabot
           registries += npmrc_global_registries
         end
 
+        sig { returns(T::Array[T::Hash[String, T.nilable(String)]]) }
         def yarnrc_registries
           return [] unless yarnrc_file
 
           yarnrc_global_registries
         end
 
+        sig do
+          params(registries: T::Array[T::Hash[String, T.nilable(String)]])
+            .returns(T::Array[T::Hash[String, T.nilable(String)]])
+        end
         def unique_registries(registries)
           registries.uniq.reject do |registry|
             next if registry["token"]
@@ -208,28 +273,31 @@ module Dependabot
           end
         end
 
+        sig { returns(String) }
         def global_registry
-          return @global_registry if defined? @global_registry
+          return @global_registry if @global_registry
 
-          @global_registry ||= configured_global_registry || "https://registry.npmjs.org"
+          @global_registry = configured_global_registry || GLOBAL_NPM_REGISTRY
+          @global_registry
         end
 
         # rubocop:disable Metrics/PerceivedComplexity
+        sig { returns(T.nilable(String)) }
         def configured_global_registry
-          return @configured_global_registry if defined? @configured_global_registry
+          return @configured_global_registry if @configured_global_registry
 
           @configured_global_registry = (npmrc_file && npmrc_global_registries.first&.fetch("url")) ||
                                         (yarnrc_file && yarnrc_global_registries.first&.fetch("url"))
           return @configured_global_registry if @configured_global_registry
 
           if parsed_yarnrc_yml&.key?("npmRegistryServer")
-            return @configured_global_registry = parsed_yarnrc_yml["npmRegistryServer"]
+            return @configured_global_registry = T.must(parsed_yarnrc_yml)["npmRegistryServer"]
           end
 
           replaces_base = credentials.find { |cred| cred["type"] == "npm_registry" && cred.replaces_base? }
           if replaces_base
             registry = replaces_base["registry"]
-            registry = "https://#{registry}" unless registry.start_with?("http")
+            registry = "https://#{registry}" unless registry&.start_with?("http")
             return @configured_global_registry = registry
           end
 
@@ -237,31 +305,40 @@ module Dependabot
         end
         # rubocop:enable Metrics/PerceivedComplexity
 
+        sig { returns(T::Array[T::Hash[String, String]]) }
         def npmrc_global_registries
           global_rc_registries(npmrc_file, syntax: NPM_GLOBAL_REGISTRY_REGEX)
         end
 
+        sig { returns(T::Array[T::Hash[String, String]]) }
         def yarnrc_global_registries
           global_rc_registries(yarnrc_file, syntax: YARN_GLOBAL_REGISTRY_REGEX)
         end
 
+        sig { params(scope: String).returns(T.nilable(String)) }
         def scoped_registry(scope)
           scoped_rc_registry = scoped_rc_registry(npmrc_file, syntax: NPM_SCOPED_REGISTRY_REGEX, scope: scope) ||
                                scoped_rc_registry(yarnrc_file, syntax: YARN_SCOPED_REGISTRY_REGEX, scope: scope)
           return scoped_rc_registry if scoped_rc_registry
 
           if parsed_yarnrc_yml
-            yarn_berry_registry = parsed_yarnrc_yml.dig("npmScopes", scope.delete_prefix("@"), "npmRegistryServer")
+            yarn_berry_registry = parsed_yarnrc_yml&.dig("npmScopes", scope.delete_prefix("@"), "npmRegistryServer")
             return yarn_berry_registry if yarn_berry_registry
           end
 
           nil
         end
 
+        sig do
+          params(
+            file: T.nilable(Dependabot::DependencyFile),
+            syntax: T.any(String, Regexp)
+          ).returns(T::Array[T::Hash[String, String]])
+        end
         def global_rc_registries(file, syntax:)
           registries = []
 
-          file.content.scan(syntax) do
+          file&.content&.scan(syntax) do
             next if Regexp.last_match&.[](:registry)&.include?("${")
 
             url = T.must(T.must(Regexp.last_match)[:registry]).strip
@@ -277,6 +354,13 @@ module Dependabot
           registries
         end
 
+        sig do
+          params(
+            file: T.nilable(Dependabot::DependencyFile),
+            syntax: T.any(String, Regexp),
+            scope: String
+          ).returns(T.nilable(String))
+        end
         def scoped_rc_registry(file, syntax:, scope:)
           file&.content.to_s.scan(syntax) do
             next if Regexp.last_match&.[](:registry)&.include?("${") || Regexp.last_match&.[](:scope) != scope
@@ -288,29 +372,36 @@ module Dependabot
         end
 
         # npm registries expect slashes to be escaped
+        sig { returns(T.nilable(String)) }
         def escaped_dependency_name
-          dependency.name.gsub("/", "%2F")
+          dependency&.name&.gsub("/", "%2F")
         end
 
+        sig { returns(T.nilable(String)) }
         def scopeless_name
-          dependency.name.split("/").last
+          dependency&.name&.split("/")&.last
         end
 
-        def registry_source_url
-          sources = dependency.requirements
-                              .map { |r| r.fetch(:source) }.uniq.compact
-                              .sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
+        sig { returns(T.nilable(String)) }
+        def registry_source_url # rubocop:disable Metrics/PerceivedComplexity
+          sources = dependency&.requirements
+                              &.map { |r| r.fetch(:source) }&.uniq&.compact
+                              &.sort_by { |source| self.class.central_registry?(source[:url]) ? 1 : 0 }
 
-          sources.find { |s| s[:type] == "registry" }&.fetch(:url)
+          sources&.find { |s| s[:type] == "registry" }&.fetch(:url)
         end
 
+        sig { returns(T.nilable(T::Hash[String, T.untyped])) }
         def parsed_yarnrc_yml
-          return unless yarnrc_yml_file
-          return @parsed_yarnrc_yml if defined? @parsed_yarnrc_yml
+          yarnrc_yml_file_content = yarnrc_yml_file&.content
+          return unless yarnrc_yml_file_content
+          return @parsed_yarnrc_yml if @parsed_yarnrc_yml
 
-          @parsed_yarnrc_yml = YAML.safe_load(yarnrc_yml_file.content)
+          @parsed_yarnrc_yml = YAML.safe_load(yarnrc_yml_file_content)
+          @parsed_yarnrc_yml
         end
 
+        sig { params(url: String).returns(String) }
         def normalize_configured_registry(url)
           url.sub(%r{/+$}, "")
              .sub(%r{^.*?//}, "")

data/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

@@ -110,7 +110,7 @@ module Dependabot
         def yarnrc_specifies_private_reg?
           return false unless yarnrc_file
 
-          regex = UpdateChecker::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
+          regex = Package::RegistryFinder::YARN_GLOBAL_REGISTRY_REGEX
           yarnrc_global_registry =
             yarnrc_file.content
                        .lines.find { |line| line.match?(regex) }
@@ -120,7 +120,7 @@ module Dependabot
 
           return false unless yarnrc_global_registry
 
-          UpdateChecker::RegistryFinder::CENTRAL_REGISTRIES.none? do |r|
+          Package::RegistryFinder::CENTRAL_REGISTRIES.none? do |r|
             r.include?(T.must(URI(yarnrc_global_registry).host))
           end
         end