@aws/nx-plugin 1.0.0-rc.4 → 1.0.0-rc.41

package/src/license/dependency-check/evaluator.js

@@ -0,0 +1,94 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import spdxSatisfies from "spdx-satisfies";
+const isUnknownToken = (raw)=>{
+    if (!raw) return true;
+    const trimmed = raw.trim();
+    if (!trimmed) return true;
+    if (trimmed.toUpperCase() === 'UNKNOWN') return true;
+    if (trimmed.toLowerCase().startsWith('custom:')) return true;
+    if (trimmed.toLowerCase().startsWith('see license in')) return true;
+    return false;
+};
+/**
+ * Strip the trailing `*` that license-checker adds when a license is guessed
+ * from file content rather than declared in package.json metadata.
+ */ const normalise = (raw)=>{
+    let s = raw.trim();
+    if (s.endsWith('*')) s = s.slice(0, -1).trim();
+    return s;
+};
+/**
+ * Build a flat list of valid SPDX IDs from the allowlist for use with
+ * spdx-satisfies. Entries that aren't parseable as SPDX identifiers are
+ * excluded (they're still matched via the alias lookup).
+ */ const buildSpdxIds = (allow)=>{
+    const ids = [];
+    for (const entry of allow){
+        if (!entry.spdxId) continue;
+        try {
+            spdxSatisfies(entry.spdxId, [
+                entry.spdxId
+            ]);
+            ids.push(entry.spdxId);
+        } catch  {
+        // Not a valid SPDX identifier — skip for spdx-satisfies, still
+        // matched via alias lookup
+        }
+    }
+    return ids;
+};
+/**
+ * Build a case-insensitive lookup for matching by full name or alias
+ * (for licenses that aren't valid SPDX but appear in package metadata).
+ */ const buildAliasLookup = (allow)=>{
+    const m = new Map();
+    for (const e of allow){
+        if (e.spdxId) m.set(e.spdxId.toLowerCase(), true);
+        if (e.fullName) m.set(e.fullName.toLowerCase(), true);
+        for (const a of e.aliases ?? []){
+            if (a) m.set(a.toLowerCase(), true);
+        }
+    }
+    return m;
+};
+const evaluateToken = (token, spdxIds, aliasLookup)=>{
+    const cleaned = normalise(token);
+    if (isUnknownToken(cleaned)) return 'UNKNOWN';
+    // Try spdx-satisfies for valid SPDX expressions
+    try {
+        if (spdxSatisfies(cleaned, spdxIds)) return 'PRE_APPROVED';
+    } catch  {
+    // Not a valid SPDX expression — fall through to alias matching
+    }
+    // Fall back to alias/fullName matching for non-SPDX strings
+    if (aliasLookup.has(cleaned.toLowerCase())) return 'PRE_APPROVED';
+    return 'NOT_APPROVED';
+};
+export const createEvaluator = (options)=>{
+    const spdxIds = buildSpdxIds(options.allow);
+    const aliasLookup = buildAliasLookup(options.allow);
+    return {
+        evaluate (rawLicense) {
+            if (!rawLicense || rawLicense.trim().length === 0) return 'UNKNOWN';
+            const normalised = normalise(rawLicense);
+            if (isUnknownToken(normalised)) return 'UNKNOWN';
+            // Python tooling emits "Apache Software License; BSD License" — split and treat as OR
+            if (normalised.includes(';')) {
+                const parts = normalised.split(';').map((p)=>p.trim()).filter((p)=>p.length > 0);
+                if (parts.length > 1) {
+                    for (const part of parts){
+                        const status = evaluateToken(part, spdxIds, aliasLookup);
+                        if (status === 'PRE_APPROVED') return 'PRE_APPROVED';
+                    }
+                    if (parts.every((p)=>isUnknownToken(normalise(p)))) return 'UNKNOWN';
+                    return 'NOT_APPROVED';
+                }
+            }
+            return evaluateToken(normalised, spdxIds, aliasLookup);
+        }
+    };
+};
+
+//# sourceMappingURL=evaluator.js.map

package/src/license/dependency-check/evaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/evaluator.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport spdxSatisfies from 'spdx-satisfies';\nimport type { AllowlistEntry, LicenseStatus } from './types';\n\nexport interface EvaluatorOptions {\n  allow: AllowlistEntry[];\n}\n\ninterface Evaluator {\n  evaluate(rawLicense: string | undefined | null): LicenseStatus;\n}\n\nconst isUnknownToken = (raw: string): boolean => {\n  if (!raw) return true;\n  const trimmed = raw.trim();\n  if (!trimmed) return true;\n  if (trimmed.toUpperCase() === 'UNKNOWN') return true;\n  if (trimmed.toLowerCase().startsWith('custom:')) return true;\n  if (trimmed.toLowerCase().startsWith('see license in')) return true;\n  return false;\n};\n\n/**\n * Strip the trailing `*` that license-checker adds when a license is guessed\n * from file content rather than declared in package.json metadata.\n */\nconst normalise = (raw: string): string => {\n  let s = raw.trim();\n  if (s.endsWith('*')) s = s.slice(0, -1).trim();\n  return s;\n};\n\n/**\n * Build a flat list of valid SPDX IDs from the allowlist for use with\n * spdx-satisfies. Entries that aren't parseable as SPDX identifiers are\n * excluded (they're still matched via the alias lookup).\n */\nconst buildSpdxIds = (allow: AllowlistEntry[]): string[] => {\n  const ids: string[] = [];\n  for (const entry of allow) {\n    if (!entry.spdxId) continue;\n    try {\n      spdxSatisfies(entry.spdxId, [entry.spdxId]);\n      ids.push(entry.spdxId);\n    } catch {\n      // Not a valid SPDX identifier — skip for spdx-satisfies, still\n      // matched via alias lookup\n    }\n  }\n  return ids;\n};\n\n/**\n * Build a case-insensitive lookup for matching by full name or alias\n * (for licenses that aren't valid SPDX but appear in package metadata).\n */\nconst buildAliasLookup = (allow: AllowlistEntry[]): Map<string, true> => {\n  const m = new Map<string, true>();\n  for (const e of allow) {\n    if (e.spdxId) m.set(e.spdxId.toLowerCase(), true);\n    if (e.fullName) m.set(e.fullName.toLowerCase(), true);\n    for (const a of e.aliases ?? []) {\n      if (a) m.set(a.toLowerCase(), true);\n    }\n  }\n  return m;\n};\n\nconst evaluateToken = (\n  token: string,\n  spdxIds: string[],\n  aliasLookup: Map<string, true>,\n): LicenseStatus => {\n  const cleaned = normalise(token);\n  if (isUnknownToken(cleaned)) return 'UNKNOWN';\n\n  // Try spdx-satisfies for valid SPDX expressions\n  try {\n    if (spdxSatisfies(cleaned, spdxIds)) return 'PRE_APPROVED';\n  } catch {\n    // Not a valid SPDX expression — fall through to alias matching\n  }\n\n  // Fall back to alias/fullName matching for non-SPDX strings\n  if (aliasLookup.has(cleaned.toLowerCase())) return 'PRE_APPROVED';\n\n  return 'NOT_APPROVED';\n};\n\nexport const createEvaluator = (options: EvaluatorOptions): Evaluator => {\n  const spdxIds = buildSpdxIds(options.allow);\n  const aliasLookup = buildAliasLookup(options.allow);\n\n  return {\n    evaluate(rawLicense) {\n      if (!rawLicense || rawLicense.trim().length === 0) return 'UNKNOWN';\n\n      const normalised = normalise(rawLicense);\n      if (isUnknownToken(normalised)) return 'UNKNOWN';\n\n      // Python tooling emits \"Apache Software License; BSD License\" — split and treat as OR\n      if (normalised.includes(';')) {\n        const parts = normalised\n          .split(';')\n          .map((p) => p.trim())\n          .filter((p) => p.length > 0);\n        if (parts.length > 1) {\n          for (const part of parts) {\n            const status = evaluateToken(part, spdxIds, aliasLookup);\n            if (status === 'PRE_APPROVED') return 'PRE_APPROVED';\n          }\n          if (parts.every((p) => isUnknownToken(normalise(p))))\n            return 'UNKNOWN';\n          return 'NOT_APPROVED';\n        }\n      }\n\n      return evaluateToken(normalised, spdxIds, aliasLookup);\n    },\n  };\n};\n"],"names":["spdxSatisfies","isUnknownToken","raw","trimmed","trim","toUpperCase","toLowerCase","startsWith","normalise","s","endsWith","slice","buildSpdxIds","allow","ids","entry","spdxId","push","buildAliasLookup","m","Map","e","set","fullName","a","aliases","evaluateToken","token","spdxIds","aliasLookup","cleaned","has","createEvaluator","options","evaluate","rawLicense","length","normalised","includes","parts","split","map","p","filter","part","status","every"],"mappings":"AAAA;;;CAGC,GACD,OAAOA,mBAAmB,iBAAiB;AAW3C,MAAMC,iBAAiB,CAACC;IACtB,IAAI,CAACA,KAAK,OAAO;IACjB,MAAMC,UAAUD,IAAIE,IAAI;IACxB,IAAI,CAACD,SAAS,OAAO;IACrB,IAAIA,QAAQE,WAAW,OAAO,WAAW,OAAO;IAChD,IAAIF,QAAQG,WAAW,GAAGC,UAAU,CAAC,YAAY,OAAO;IACxD,IAAIJ,QAAQG,WAAW,GAAGC,UAAU,CAAC,mBAAmB,OAAO;IAC/D,OAAO;AACT;AAEA;;;CAGC,GACD,MAAMC,YAAY,CAACN;IACjB,IAAIO,IAAIP,IAAIE,IAAI;IAChB,IAAIK,EAAEC,QAAQ,CAAC,MAAMD,IAAIA,EAAEE,KAAK,CAAC,GAAG,CAAC,GAAGP,IAAI;IAC5C,OAAOK;AACT;AAEA;;;;CAIC,GACD,MAAMG,eAAe,CAACC;IACpB,MAAMC,MAAgB,EAAE;IACxB,KAAK,MAAMC,SAASF,MAAO;QACzB,IAAI,CAACE,MAAMC,MAAM,EAAE;QACnB,IAAI;YACFhB,cAAce,MAAMC,MAAM,EAAE;gBAACD,MAAMC,MAAM;aAAC;YAC1CF,IAAIG,IAAI,CAACF,MAAMC,MAAM;QACvB,EAAE,OAAM;QACN,+DAA+D;QAC/D,2BAA2B;QAC7B;IACF;IACA,OAAOF;AACT;AAEA;;;CAGC,GACD,MAAMI,mBAAmB,CAACL;IACxB,MAAMM,IAAI,IAAIC;IACd,KAAK,MAAMC,KAAKR,MAAO;QACrB,IAAIQ,EAAEL,MAAM,EAAEG,EAAEG,GAAG,CAACD,EAAEL,MAAM,CAACV,WAAW,IAAI;QAC5C,IAAIe,EAAEE,QAAQ,EAAEJ,EAAEG,GAAG,CAACD,EAAEE,QAAQ,CAACjB,WAAW,IAAI;QAChD,KAAK,MAAMkB,KAAKH,EAAEI,OAAO,IAAI,EAAE,CAAE;YAC/B,IAAID,GAAGL,EAAEG,GAAG,CAACE,EAAElB,WAAW,IAAI;QAChC;IACF;IACA,OAAOa;AACT;AAEA,MAAMO,gBAAgB,CACpBC,OACAC,SACAC;IAEA,MAAMC,UAAUtB,UAAUmB;IAC1B,IAAI1B,eAAe6B,UAAU,OAAO;IAEpC,gDAAgD;IAChD,IAAI;QACF,IAAI9B,cAAc8B,SAASF,UAAU,OAAO;IAC9C,EAAE,OAAM;IACN,+DAA+D;IACjE;IAEA,4DAA4D;IAC5D,IAAIC,YAAYE,GAAG,CAACD,QAAQxB,WAAW,KAAK,OAAO;IAEnD,OAAO;AACT;AAEA,OAAO,MAAM0B,kBAAkB,CAACC;IAC9B,MAAML,UAAUhB,aAAaqB,QAAQpB,KAAK;IAC1C,MAAMgB,cAAcX,iBAAiBe,QAAQpB,KAAK;IAElD,OAAO;QACLqB,UAASC,UAAU;YACjB,IAAI,CAACA,cAAcA,WAAW/B,IAAI,GAAGgC,MAAM,KAAK,GAAG,OAAO;YAE1D,MAAMC,aAAa7B,UAAU2B;YAC7B,IAAIlC,eAAeoC,aAAa,OAAO;YAEvC,sFAAsF;YACtF,IAAIA,WAAWC,QAAQ,CAAC,MAAM;gBAC5B,MAAMC,QAAQF,WACXG,KAAK,CAAC,KACNC,GAAG,CAAC,CAACC,IAAMA,EAAEtC,IAAI,IACjBuC,MAAM,CAAC,CAACD,IAAMA,EAAEN,MAAM,GAAG;gBAC5B,IAAIG,MAAMH,MAAM,GAAG,GAAG;oBACpB,KAAK,MAAMQ,QAAQL,MAAO;wBACxB,MAAMM,SAASnB,cAAckB,MAAMhB,SAASC;wBAC5C,IAAIgB,WAAW,gBAAgB,OAAO;oBACxC;oBACA,IAAIN,MAAMO,KAAK,CAAC,CAACJ,IAAMzC,eAAeO,UAAUkC,MAC9C,OAAO;oBACT,OAAO;gBACT;YACF;YAEA,OAAOhB,cAAcW,YAAYT,SAASC;QAC5C;IACF;AACF,EAAE"}

package/src/license/dependency-check/executor-schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://json-schema.org/schema",
+  "type": "object",
+  "properties": {},
+  "additionalProperties": false
+}

package/src/license/dependency-check/executor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { type ExecutorContext } from '@nx/devkit';
+export type LicenseCheckExecutorSchema = Record<string, never>;
+export default function runLicenseCheckExecutor(_options: LicenseCheckExecutorSchema, _context: ExecutorContext): Promise<{
+    success: boolean;
+}>;

package/src/license/dependency-check/executor.js

@@ -0,0 +1,51 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */ import { workspaceRoot } from "@nx/devkit";
+import { readAwsNxPluginConfigFromDisk } from "../../utils/config/utils.js";
+import { formatReport, runCheck } from "./check.js";
+import { npmCollector } from "./collectors/collector.js";
+const loadConfig = ()=>{
+    const config = readAwsNxPluginConfigFromDisk(workspaceRoot);
+    if (!config) return null;
+    // Dependency checking is enabled by the presence of `license.dependencies`.
+    return config.license?.dependencies ?? null;
+};
+export default async function runLicenseCheckExecutor(_options, _context) {
+    if (process.env.LICENSE_DEPENDENCY_CHECK === 'skip') {
+        console.log('License check skipped via LICENSE_DEPENDENCY_CHECK=skip environment variable.');
+        return {
+            success: true
+        };
+    }
+    const config = loadConfig();
+    if (!config) {
+        console.log('License check skipped — not configured.');
+        return {
+            success: true
+        };
+    }
+    const collectors = config.collectors ?? [
+        npmCollector()
+    ];
+    const result = await runCheck({
+        projectRoot: workspaceRoot,
+        config,
+        collectors
+    });
+    const report = formatReport(result, {
+        collectors
+    });
+    if (result.pass) {
+        console.log(report);
+        return {
+            success: true
+        };
+    }
+    console.error(report);
+    return {
+        success: false
+    };
+}
+
+//# sourceMappingURL=executor.js.map

package/src/license/dependency-check/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../packages/nx-plugin/src/license/dependency-check/executor.ts"],"sourcesContent":["/**\n * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.\n * SPDX-License-Identifier: Apache-2.0\n */\nimport { type ExecutorContext, workspaceRoot } from '@nx/devkit';\nimport { readAwsNxPluginConfigFromDisk } from '../../utils/config/utils';\nimport { formatReport, runCheck } from './check';\nimport { type LicenseCollector, npmCollector } from './collectors/collector';\nimport type { DependencyCheckConfig } from './types';\n\nexport type LicenseCheckExecutorSchema = Record<string, never>;\n\nconst loadConfig = (): DependencyCheckConfig | null => {\n  const config = readAwsNxPluginConfigFromDisk(workspaceRoot);\n  if (!config) return null;\n\n  // Dependency checking is enabled by the presence of `license.dependencies`.\n  return config.license?.dependencies ?? null;\n};\n\nexport default async function runLicenseCheckExecutor(\n  _options: LicenseCheckExecutorSchema,\n  _context: ExecutorContext,\n): Promise<{ success: boolean }> {\n  if (process.env.LICENSE_DEPENDENCY_CHECK === 'skip') {\n    console.log(\n      'License check skipped via LICENSE_DEPENDENCY_CHECK=skip environment variable.',\n    );\n    return { success: true };\n  }\n\n  const config = loadConfig();\n  if (!config) {\n    console.log('License check skipped — not configured.');\n    return { success: true };\n  }\n\n  const collectors: LicenseCollector[] = config.collectors ?? [npmCollector()];\n\n  const result = await runCheck({\n    projectRoot: workspaceRoot,\n    config,\n    collectors,\n  });\n\n  const report = formatReport(result, { collectors });\n\n  if (result.pass) {\n    console.log(report);\n    return { success: true };\n  }\n\n  console.error(report);\n  return { success: false };\n}\n"],"names":["workspaceRoot","readAwsNxPluginConfigFromDisk","formatReport","runCheck","npmCollector","loadConfig","config","license","dependencies","runLicenseCheckExecutor","_options","_context","process","env","LICENSE_DEPENDENCY_CHECK","console","log","success","collectors","result","projectRoot","report","pass","error"],"mappings":"AAAA;;;CAGC,GACD,SAA+BA,aAAa,QAAQ,aAAa;AACjE,SAASC,6BAA6B,QAAQ,8BAA2B;AACzE,SAASC,YAAY,EAAEC,QAAQ,QAAQ,aAAU;AACjD,SAAgCC,YAAY,QAAQ,4BAAyB;AAK7E,MAAMC,aAAa;IACjB,MAAMC,SAASL,8BAA8BD;IAC7C,IAAI,CAACM,QAAQ,OAAO;IAEpB,4EAA4E;IAC5E,OAAOA,OAAOC,OAAO,EAAEC,gBAAgB;AACzC;AAEA,eAAe,eAAeC,wBAC5BC,QAAoC,EACpCC,QAAyB;IAEzB,IAAIC,QAAQC,GAAG,CAACC,wBAAwB,KAAK,QAAQ;QACnDC,QAAQC,GAAG,CACT;QAEF,OAAO;YAAEC,SAAS;QAAK;IACzB;IAEA,MAAMX,SAASD;IACf,IAAI,CAACC,QAAQ;QACXS,QAAQC,GAAG,CAAC;QACZ,OAAO;YAAEC,SAAS;QAAK;IACzB;IAEA,MAAMC,aAAiCZ,OAAOY,UAAU,IAAI;QAACd;KAAe;IAE5E,MAAMe,SAAS,MAAMhB,SAAS;QAC5BiB,aAAapB;QACbM;QACAY;IACF;IAEA,MAAMG,SAASnB,aAAaiB,QAAQ;QAAED;IAAW;IAEjD,IAAIC,OAAOG,IAAI,EAAE;QACfP,QAAQC,GAAG,CAACK;QACZ,OAAO;YAAEJ,SAAS;QAAK;IACzB;IAEAF,QAAQQ,KAAK,CAACF;IACd,OAAO;QAAEJ,SAAS;IAAM;AAC1B"}

package/src/license/dependency-check/pre-approved.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import type { AllowlistEntry } from './types';
+export declare const PRE_APPROVED_LICENSES: AllowlistEntry[];