package-audit 0.2.0 → 0.4.0

data/lib/package/audit/services/command_parser.rb

@@ -0,0 +1,103 @@
+require_relative '../const/cmd'
+require_relative '../const/file'
+require_relative '../enum/option'
+require_relative '../enum/report'
+require_relative '../technology/detector'
+require_relative '../technology/validator'
+require_relative '../util/summary_printer'
+require_relative 'package_finder'
+require_relative 'package_printer'
+
+require 'yaml'
+
+module Package
+  module Audit
+    class CommandParser
+      def initialize(dir, options, report)
+        @dir = dir
+        @options = options
+        @report = report
+        @config = parse_config_file
+        @technologies = parse_technologies
+      end
+
+      def run
+        cumulative_pkgs = []
+
+        @technologies.each do |technology|
+          all_pkgs, ignored_pkgs = PackageFinder.new(@config, @dir, @report).run(technology)
+          ignored_pkgs = [] if @options[Enum::Option::INCLUDE_IGNORED]
+          cumulative_pkgs << all_pkgs
+          print_results(technology, (all_pkgs || []) - (ignored_pkgs || []), ignored_pkgs || [])
+        end
+
+        cumulative_pkgs.any?
+      end
+
+      private
+
+      def print_results(technology, pkgs, ignored_pkgs)
+        PackagePrinter.new(@options, pkgs).print(report_fields)
+        print_summary(technology, pkgs, ignored_pkgs) unless @options[Enum::Option::CSV]
+        print_disclaimer(technology) unless @options[Enum::Option::CSV] || pkgs.empty?
+      end
+
+      def print_summary(technology, pkgs, ignored_pkgs)
+        if @report == Enum::Report::ALL
+          Util::SummaryPrinter.statistics(technology, @report, pkgs, ignored_pkgs)
+        else
+          Util::SummaryPrinter.total(technology, @report, pkgs, ignored_pkgs)
+        end
+      end
+
+      def print_disclaimer(technology)
+        case @report
+        when Enum::Report::DEPRECATED
+          Util::SummaryPrinter.deprecated
+        when Enum::Report::ALL, Enum::Report::VULNERABLE
+          Util::SummaryPrinter.vulnerable(technology, learn_more_command(technology))
+        end
+      end
+
+      def learn_more_command(technology)
+        case technology
+        when Enum::Technology::RUBY
+          Const::Cmd::BUNDLE_AUDIT
+        when Enum::Technology::NODE
+          Const::Cmd::YARN_AUDIT
+        else
+          raise ArgumentError, "Unexpected technology \"#{technology}\" found in #{__method__}"
+        end
+      end
+
+      def report_fields
+        case @report
+        when Enum::Report::DEPRECATED
+          Const::Fields::DEPRECATED
+        when Enum::Report::OUTDATED
+          Const::Fields::OUTDATED
+        when Enum::Report::VULNERABLE
+          Const::Fields::VULNERABLE
+        else
+          Const::Fields::ALL
+        end
+      end
+
+      def parse_config_file
+        if @options[Enum::Option::CONFIG].nil?
+          YAML.load_file("#{@dir}/#{Const::File::CONFIG}") if File.exist? "#{@dir}/#{Const::File::CONFIG}"
+        elsif File.exist? @options[Enum::Option::CONFIG]
+          YAML.load_file(@options[Enum::Option::CONFIG])
+        else
+          raise ArgumentError, "Configuration file not found: #{@options[Enum::Option::CONFIG]}"
+        end
+      end
+
+      def parse_technologies
+        technology_validator = Technology::Validator.new(@dir)
+        @options[Enum::Option::TECHNOLOGY]&.each { |technology| technology_validator.validate! technology }
+        @options[Enum::Option::TECHNOLOGY] || Technology::Detector.new(@dir).detect
+      end
+    end
+  end
+end

data/lib/package/audit/services/package_filter.rb

@@ -0,0 +1,39 @@
+require_relative '../const/cmd'
+require_relative '../const/file'
+require_relative '../const/yaml'
+require_relative '../enum/technology'
+require_relative '../ruby/gem_collection'
+
+require 'yaml'
+
+module Package
+  module Audit
+    class PackageFilter
+      def initialize(config)
+        @config = config
+      end
+
+      def ignored?(pkg)
+        pkg_yaml = pkg_yaml_from_config(pkg)
+        pkg_version_in_config?(pkg, pkg_yaml) && ignore_package?(pkg, pkg_yaml)
+      end
+
+      private
+
+      def pkg_yaml_from_config(pkg)
+        yaml_fragment = @config&.dig(Const::YAML::TECHNOLOGY, pkg.technology, pkg.name)&.to_yaml
+        yaml_fragment.nil? ? nil : YAML.safe_load(yaml_fragment)
+      end
+
+      def pkg_version_in_config?(pkg, yaml)
+        yaml&.dig(Const::YAML::VERSION) == pkg.version
+      end
+
+      def ignore_package?(pkg, yaml)
+        (!pkg.deprecated? || yaml&.dig(Const::YAML::DEPRECATED) == false) &&
+          (!pkg.outdated? || yaml&.dig(Const::YAML::OUTDATED) == false) &&
+          (!pkg.vulnerable? || yaml&.dig(Const::YAML::VULNERABLE) == false)
+      end
+    end
+  end
+end

data/lib/package/audit/services/package_finder.rb

@@ -0,0 +1,58 @@
+require_relative '../const/cmd'
+require_relative '../const/file'
+require_relative '../const/yaml'
+require_relative '../enum/technology'
+require_relative '../npm/node_collection'
+require_relative '../ruby/gem_collection'
+require_relative 'package_filter'
+
+require 'yaml'
+
+module Package
+  module Audit
+    class PackageFinder
+      def initialize(config, dir, report)
+        @config = config
+        @dir = dir
+        @report = report
+      end
+
+      def run(technology)
+        all_pkgs = find_by_technology(technology)
+        ignored_pkgs = filter_pkgs_based_on_config(all_pkgs)
+        [all_pkgs, ignored_pkgs]
+      end
+
+      private
+
+      def find_by_technology(technology)
+        case technology
+        when Enum::Technology::RUBY
+          find_ruby
+        when Enum::Technology::NODE
+          find_node
+        else
+          []
+        end
+      end
+
+      def find_node
+        Npm::NodeCollection.new(@dir, @report).fetch
+      end
+
+      def find_ruby
+        Ruby::GemCollection.new(@dir, @report).fetch
+      end
+
+      def filter_pkgs_based_on_config(pkgs)
+        package_filter = PackageFilter.new(@config)
+        ignored_pkgs = []
+
+        pkgs.each do |pkg|
+          ignored_pkgs << pkg if package_filter.ignored?(pkg)
+        end
+        ignored_pkgs
+      end
+    end
+  end
+end

data/lib/package/audit/{printer.rb → services/package_printer.rb}

@@ -1,27 +1,28 @@
-require_relative './const/fields'
-require_relative './formatter/risk'
-require_relative './formatter/version'
-require_relative './formatter/version_date'
-require_relative './formatter/vulnerability'
+require_relative '../const/fields'
+require_relative '../enum/option'
+require_relative '../formatter/risk'
+require_relative '../formatter/version'
+require_relative '../formatter/version_date'
+require_relative '../formatter/vulnerability'
 
 module Package
   module Audit
-    class Printer
+    class PackagePrinter
       BASH_FORMATTING_REGEX = /\e\[\d+(?:;\d+)*m/
 
       COLUMN_GAP = 2
 
-      def initialize(pkgs, options)
-        @pkgs = pkgs
+      def initialize(options, pkgs)
         @options = options
+        @pkgs = pkgs
       end
 
       def print(fields)
         check_fields(fields)
         return if @pkgs.empty?
 
-        if @options[:csv]
-          csv(fields, exclude_headers: @options[:'exclude-headers'])
+        if @options[Enum::Option::CSV]
+          csv(fields, exclude_headers: @options[Enum::Option::CSV_EXCLUDE_HEADERS])
         else
           pretty(fields)
         end
@@ -38,7 +39,7 @@ module Package
               "Available fields names are: #{Const::Fields::ALL}."
       end
 
-      def pretty(fields = Const::Fields::REPORT) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      def pretty(fields = Const::Fields::ALL) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
         # find the maximum length of each field across all the packages so we know how many
         # characters of horizontal space to allocate for each field when printing
         fields.each do |key|

data/lib/package/audit/{risk_calculator.rb → services/risk_calculator.rb}

@@ -1,4 +1,7 @@
-require_relative './const/time'
+require_relative '../const/time'
+require_relative '../enum/vulnerability_type'
+
+require 'time'
 
 module Package
   module Audit
@@ -62,12 +65,13 @@ module Package
       end
 
       def assess_deprecation_risks
+        risk = Risk.new(Enum::RiskType::MEDIUM, Enum::RiskExplanation::POTENTIAL_DEPRECATION)
+        return [risk] if @pkg.latest_version_date.nil?
+
         risks = []
         seconds_since_date = (Time.now - Time.parse(@pkg.latest_version_date)).to_i
 
-        if seconds_since_date >= Const::Time::SECONDS_ELAPSED_TO_BE_OUTDATED
-          risks << Risk.new(Enum::RiskType::MEDIUM, Enum::RiskExplanation::POTENTIAL_DEPRECATION)
-        end
+        risks << risk if seconds_since_date >= Const::Time::SECONDS_ELAPSED_TO_BE_OUTDATED
         risks
       end
 

data/lib/package/audit/technology/detector.rb

@@ -0,0 +1,40 @@
+require_relative '../const/cmd'
+require_relative '../const/file'
+require_relative '../enum/report'
+require_relative '../enum/technology'
+
+require 'yaml'
+
+module Package
+  module Audit
+    module Technology
+      class Detector
+        def initialize(dir)
+          @dir = dir
+        end
+
+        def detect
+          technologies = []
+          technologies << Enum::Technology::RUBY if ruby?
+          technologies << Enum::Technology::NODE if node?
+          technologies.sort
+        end
+
+        private
+
+        def node?
+          package_json_present = File.exist?("#{@dir}/#{Const::File::PACKAGE_JSON}")
+          package_lock_json_present = File.exist?("#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}")
+          yarn_lock_present = File.exist?("#{@dir}/#{Const::File::YARN_LOCK}")
+          package_json_present && (package_lock_json_present || yarn_lock_present)
+        end
+
+        def ruby?
+          gemfile_present = File.exist?("#{@dir}/#{Const::File::GEMFILE}")
+          gemfile_lock_present = File.exist?("#{@dir}/#{Const::File::GEMFILE_LOCK}")
+          gemfile_present && gemfile_lock_present
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/technology/validator.rb

@@ -0,0 +1,56 @@
+require_relative '../const/file'
+require_relative '../enum/technology'
+
+module Package
+  module Audit
+    module Technology
+      class Validator
+        def initialize(dir)
+          @dir = dir
+        end
+
+        def validate!(technology)
+          case technology
+          when Enum::Technology::NODE
+            validate_node!
+          when Enum::Technology::RUBY
+            validate_ruby!
+          else
+            raise ArgumentError, "\"#{technology}\" is not a supported technology, " \
+                                 "use one of #{Enum::Technology.all}"
+          end
+        end
+
+        private
+
+        def validate_node!
+          package_json_present = File.exist?("#{@dir}/#{Const::File::PACKAGE_JSON}")
+          package_lock_json_present = File.exist?("#{@dir}/#{Const::File::PACKAGE_LOCK_JSON}")
+          yarn_lock_present = File.exist?("#{@dir}/#{Const::File::YARN_LOCK}")
+
+          unless package_json_present
+            puts Util::BashColor.red("\"#{Const::File::PACKAGE_JSON}\" was not found in #{@dir}")
+          end
+          unless package_lock_json_present || yarn_lock_present
+            puts Util::BashColor.red("\"#{Const::File::PACKAGE_LOCK_JSON}\" or \"#{Const::File::YARN_LOCK}\" " \
+                                     "was not found in #{@dir}")
+          end
+
+          exit 1 unless package_json_present && (package_lock_json_present || yarn_lock_present)
+        end
+
+        def validate_ruby!
+          gemfile_present = File.exist?("#{@dir}/#{Const::File::GEMFILE}")
+          gemfile_lock_present = File.exist?("#{@dir}/#{Const::File::GEMFILE_LOCK}")
+
+          puts Util::BashColor.red("\"#{Const::File::GEMFILE}\" was not found in #{@dir}") unless gemfile_present
+          unless gemfile_lock_present
+            puts Util::BashColor.red("\"#{Const::File::GEMFILE_LOCK}\" was not found in #{@dir}")
+          end
+
+          exit 1 unless gemfile_present && gemfile_lock_present
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/util/summary_printer.rb

@@ -1,14 +1,14 @@
 require_relative '../const/time'
-require_relative './bash_color'
+require_relative 'bash_color'
 
 module Package
   module Audit
     module Util
       module SummaryPrinter
-        def self.report
+        def self.all
           printf("\n%<info>s\n%<cmd>s\n\n",
                  info: Util::BashColor.blue('To show how risk is calculated run:'),
-                 cmd: Util::BashColor.magenta(' > bundle exec package-audit risk'))
+                 cmd: Util::BashColor.magenta(' > package-audit risk'))
         end
 
         def self.deprecated
@@ -16,26 +16,37 @@ module Package
           puts Util::BashColor.blue("Please contact the package author for more information about its status.\n")
         end
 
-        def self.vulnerable(package_type, cmd)
+        def self.vulnerable(technology, cmd)
           printf("%<info>s\n%<cmd>s\n\n",
-                 info: Util::BashColor.blue("To get more information about the #{package_type} vulnerabilities run:"),
+                 info: Util::BashColor.blue("To get more information about the #{technology} vulnerabilities run:"),
                  cmd: Util::BashColor.magenta(" > #{cmd}"))
         end
 
-        def self.total(package_type, pkgs)
-          puts Util::BashColor.cyan("Found a total of #{pkgs.length} #{package_type}s.\n")
+        def self.total(technology, report, pkgs, ignored_pkgs)
+          if ignored_pkgs.any?
+            puts Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology} packages " \
+                                      "(#{ignored_pkgs.length} ignored).\n")
+          elsif pkgs.any?
+            puts Util::BashColor.cyan("Found a total of #{pkgs.length} #{technology} packages.\n")
+          else
+            puts Util::BashColor.green("There are no #{report} #{technology} packages!\n")
+          end
         end
 
-        def self.statistics(package_type, pkgs)
+        def self.statistics(technology, report, pkgs, ignored_pkgs)
           outdated = pkgs.count(&:outdated?)
           deprecated = pkgs.count(&:deprecated?)
           vulnerable = pkgs.count(&:vulnerable?)
 
           vulnerabilities = pkgs.sum { |pkg| pkg.vulnerabilities.length }
 
-          puts Util::BashColor.cyan("Found a total of #{pkgs.length} #{package_type}s.\n" \
-                                    "#{vulnerable} vulnerable (#{vulnerabilities} vulnerabilities), " \
-                                    "#{outdated} outdated, #{deprecated} deprecated.\n")
+          if pkgs.any?
+            puts Util::BashColor.cyan("#{vulnerable} vulnerable (#{vulnerabilities} vulnerabilities), " \
+                                      "#{outdated} outdated, #{deprecated} deprecated.")
+            total(technology, report, pkgs, ignored_pkgs)
+          else
+            puts Util::BashColor.green("There are no deprecated, outdated or vulnerable #{technology} packages!\n")
+          end
         end
 
         def self.risk # rubocop:disable Metrics/AbcSize, Metrics/MethodLength

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.2.0'
+    VERSION = '0.4.0'
   end
 end

data/sig/package/audit/cli.rbs

@@ -9,6 +9,8 @@ module Package
 
       def report: (String) -> void
 
+      def respond_to_missing?: -> bool
+
       def risk: -> void
 
       def version: -> void

data/sig/package/audit/const/fields.rbs

@@ -3,9 +3,10 @@ module Package
     module Const
       module Fields
         ALL: Array[Symbol]
+        AVAILABLE: Array[Symbol]
+        DEPRECATED: Array[Symbol]
         HEADERS: Hash[Symbol, String]
         OUTDATED: Array[Symbol]
-        REPORT: Array[Symbol]
         VULNERABLE: Array[Symbol]
       end
     end

data/sig/package/audit/const/file.rbs

@@ -2,6 +2,7 @@ module Package
   module Audit
     module Const
       module File
+        CONFIG: String
         GEMFILE: String
         GEMFILE_LOCK: String
         PACKAGE_JSON: String

data/sig/package/audit/const/yaml.rbs

@@ -0,0 +1,13 @@
+module Package
+  module Audit
+    module Const
+      module YAML
+        DEPRECATED: String
+        OUTDATED: String
+        TECHNOLOGY: String
+        VERSION: String
+        VULNERABLE: String
+      end
+    end
+  end
+end

data/sig/package/audit/enum/option.rbs

@@ -0,0 +1,13 @@
+module Package
+  module Audit
+    module Enum
+      module Option
+        CONFIG: String
+        CSV: String
+        CSV_EXCLUDE_HEADERS: String
+        INCLUDE_IGNORED: String
+        TECHNOLOGY: String
+      end
+    end
+  end
+end

data/sig/package/audit/enum/report.rbs

@@ -0,0 +1,12 @@
+module Package
+  module Audit
+    module Enum
+      module Report
+        ALL: Symbol
+        DEPRECATED: Symbol
+        OUTDATED: Symbol
+        VULNERABLE: Symbol
+      end
+    end
+  end
+end

data/sig/package/audit/enum/technology.rbs

@@ -0,0 +1,12 @@
+module Package
+  module Audit
+    module Enum
+      module Technology
+        NODE: String
+        RUBY: String
+
+        def self.all: -> Array[String]
+      end
+    end
+  end
+end

data/sig/package/audit/{package.rbs → models/package.rbs}

@@ -3,17 +3,19 @@ module Package
     class Package
       @groups: Array[Symbol]
       @risks: Array[Risk]
+      @technology: String
       @vulnerabilities: Array[String]
 
       attr_accessor groups: Array[Symbol]
       attr_accessor latest_version: String
       attr_accessor latest_version_date: String
       attr_reader name: String
+      attr_reader technology: String
       attr_reader version: String
       attr_accessor version_date: String
       attr_accessor vulnerabilities: Array[String]
 
-      def initialize: (String, String, **untyped) -> void
+      def initialize: (String, String, String, **untyped) -> void
 
       def deprecated?: -> bool
 

data/sig/package/audit/{risk.rbs → models/risk.rbs}

@@ -4,7 +4,7 @@ module Package
       attr_reader explanation: String?
       attr_reader type: String
 
-      def initialize: (String, ?String?)-> void
+      def initialize: (String, ?String?) -> void
 
       def <=>: (Risk) -> Integer?
     end

data/sig/package/audit/npm/node_collection.rbs

@@ -2,18 +2,17 @@ module Package
   module Audit
     module Npm
       class NodeCollection
-        PACKAGE_JSON: String
-        PACKAGE_LOCK: String
-        YARN_LOCK: String
-
         @dir: String
+        @report: Symbol
 
-        def initialize: (String) -> void
+        def initialize: (String, Symbol) -> void
 
         def all: -> Array[Package]
 
         def deprecated: -> Array[Package]
 
+        def fetch: -> Array[Package]
+
         def outdated: -> Array[Package]
 
         def vulnerable: -> Array[Package]

data/sig/package/audit/npm/vulnerability_finder.rbs

@@ -4,16 +4,17 @@ module Package
       class VulnerabilityFinder
         AUDIT_ADVISORY_REGEX: Regexp
 
+        @dir: String
         @pkg_hash: Hash[String, Package]
         @vuln_hash: Hash[String?, Package]
 
-        def initialize: (Array[Package]) -> void
+        def initialize: (String, Array[Package]) -> void
 
         def run: -> Array[Package]
 
         private
 
-        def update_meta_data: (Hash[Symbol, untyped])-> void
+        def update_meta_data: (Hash[Symbol, untyped]) -> void
       end
     end
   end

data/sig/package/audit/npm/yarn_lock_parser.rbs

@@ -2,6 +2,7 @@ module Package
   module Audit
     module Npm
       class YarnLockParser
+        @yarn_lock_file: String
         @yarn_lock_path: String
 
         def initialize: (String) -> void

data/sig/package/audit/ruby/bundler_specs.rbs

@@ -2,9 +2,9 @@ module Package
   module Audit
     module Ruby
       class BundlerSpecs
-        def self.all: -> untyped
+        def self.all: (String) -> untyped
 
-        def self.gemfile: -> untyped
+        def self.gemfile: (String) -> untyped
       end
     end
   end

data/sig/package/audit/ruby/gem_collection.rbs

@@ -2,13 +2,20 @@ module Package
   module Audit
     module Ruby
       class GemCollection
-        def self.all: -> Array[Package]
+        @dir: String
+        @report: Symbol
 
-        def self.deprecated: -> Array[Package]
+        def initialize: (String, Symbol) -> void
 
-        def self.outdated: (?include_implicit: bool) -> Array[Package]
+        def all: -> Array[Package]
 
-        def self.vulnerable: -> Array[Package]
+        def deprecated: -> Array[Package]
+
+        def fetch: -> Array[Package]
+
+        def outdated: (?include_implicit: bool) -> Array[Package]
+
+        def vulnerable: -> Array[Package]
       end
     end
   end

data/sig/package/audit/ruby/vulnerability_finder.rbs

@@ -2,8 +2,11 @@ module Package
   module Audit
     module Ruby
       class VulnerabilityFinder
+        @dir: String
         @vuln_hash: Hash[String?, Package]
 
+        def initialize: (String) -> void
+
         def run: -> Array[Package]
 
         private