@callstack/licenses 0.2.2 → 0.3.1

package/src/{common.ts → node/common.ts}

@@ -1,5 +1,5 @@
-import fs from 'fs';
-import path from 'path';
+import fs from 'node:fs';
+import path from 'node:path';
 
 import glob from 'glob';
 
@@ -7,13 +7,16 @@ import type {
   AboutLibrariesLibraryJsonPayload,
   AboutLibrariesLicenseJsonPayload,
   AboutLibrariesLikePackageInfo,
-  AggregatedLicensesObj,
+  AggregatedLicensesMapping,
   DependencyType,
   LicensePlistPayload,
+  ParentPackageInfo,
   ScanPackageCallContext,
   ScanPackageOptionsFactory,
-} from './types';
-import { PackageUtils, YamlUtils } from './utils';
+} from '../types';
+import { YamlUtils } from '../utils';
+
+import { PackageUtils } from './utils';
 
 type InternalScanGroupSpecifier = { packages: [depName: string, depVersion: string][]; dependencyType: DependencyType };
 
@@ -32,7 +35,7 @@ function scanPackage(
   packageName: string,
   requiredVersion: string,
   processedPackages: Set<string>,
-  result: AggregatedLicensesObj,
+  result: AggregatedLicensesMapping,
   scanOptionsFactory: ScanPackageOptionsFactory = PackageUtils.legacyDefaultScanPackageOptionsFactory,
   {
     parentPackageRoot,
@@ -83,21 +86,37 @@ function scanPackage(
 
       const resolvedVersionPackageKey = `${packageName}@${localPackageJson.version}`;
 
-      result[resolvedVersionPackageKey] = {
-        name: packageName,
-        author: PackageUtils.parseAuthorField(localPackageJson),
-        content: licenseFiles?.[0] ? fs.readFileSync(licenseFiles[0], { encoding: 'utf-8' }) : undefined,
-        file: licenseFiles?.[0] ? licenseFiles[0] : undefined,
-        description: localPackageJson.description,
-        type: PackageUtils.parseLicenseField(localPackageJson),
-        url: PackageUtils.parseRepositoryFieldToUrl(localPackageJson),
-        version: localPackageJson.version,
-        requiredVersion,
-        parentPackageName,
-        parentPackageRequiredVersion,
-        parentPackageResolvedVersion,
-        dependencyType,
-      };
+      let parentPackageInfo: ParentPackageInfo | undefined;
+      if (parentPackageName && parentPackageRequiredVersion && parentPackageResolvedVersion) {
+        parentPackageInfo = {
+          name: parentPackageName,
+          requiredVersion: parentPackageRequiredVersion,
+          resolvedVersion: parentPackageResolvedVersion,
+        };
+      }
+
+      if (parentPackageInfo && resolvedVersionPackageKey in result) {
+        result[resolvedVersionPackageKey].parentPackages = [
+          ...(result[resolvedVersionPackageKey].parentPackages ?? []),
+          parentPackageInfo,
+        ];
+      } else {
+        result[resolvedVersionPackageKey] = {
+          name: packageName,
+          author: PackageUtils.parseAuthorField(localPackageJson),
+          content: licenseFiles?.[0] ? fs.readFileSync(licenseFiles[0], { encoding: 'utf-8' }) : undefined,
+          file: licenseFiles?.[0] ? licenseFiles[0] : undefined,
+          description: localPackageJson.description,
+          type: PackageUtils.parseLicenseField(localPackageJson),
+          url: PackageUtils.parseRepositoryFieldToUrl(localPackageJson),
+          version: localPackageJson.version,
+          requiredVersion,
+          parentPackages: parentPackageInfo ? [parentPackageInfo] : [],
+          parentPackageRequiredVersion,
+          parentPackageResolvedVersion,
+          dependencyType,
+        };
+      }
     }
 
     const dependencies: MaybeDependencyMapping = localPackageJson.dependencies;
@@ -161,12 +180,12 @@ type MaybeDependencyMapping = DependencyMapping | undefined;
 export function scanDependencies(
   appPackageJsonPath: string,
   scanOptionsFactory: ScanPackageOptionsFactory = PackageUtils.legacyDefaultScanPackageOptionsFactory,
-): AggregatedLicensesObj {
+): AggregatedLicensesMapping {
   const appPackageJson = require(path.resolve(appPackageJsonPath));
   const dependencies: MaybeDependencyMapping = appPackageJson.dependencies;
   const devDependencies: MaybeDependencyMapping = appPackageJson.devDependencies;
   const optionalDependencies: MaybeDependencyMapping = appPackageJson.optionalDependencies;
-  const result: AggregatedLicensesObj = {};
+  const result: AggregatedLicensesMapping = {};
   const processedPackages = new Set<string>();
 
   const rootScanOptions = scanOptionsFactory({ isRoot: true, isWorkspacePackage: false });
@@ -196,6 +215,9 @@ export function scanDependencies(
   return result;
 }
 
+const PODSPEC_NAME_REGEX =
+  /(Pod::Spec\.new\s+do\s+\|(?<specref>.*)\|).*(\k<specref>\.name\s+=\s+(?<quote>["'])(?<specname>[a-zA-Z0-9_\-@]+)\k<quote>)/;
+
 /**
  * Generates LicensePlist-compatible metadata for NPM dependencies as a YAML string.
  *
@@ -205,30 +227,67 @@ export function scanDependencies(
  * @param iosProjectPath Path to the iOS project directory
  * @see {@link writeLicensePlistNPMOutput}
  */
-export function generateLicensePlistNPMOutput(licenses: AggregatedLicensesObj, iosProjectPath: string): string {
+export function generateLicensePlistNPMOutput(licenses: AggregatedLicensesMapping, iosProjectPath: string): string {
   const renames: Record<string, string> = {};
-  const licenseEntries = Object.entries(licenses).map(([packageKey, licenseObj]) => {
+  const licenseEntries = Object.entries(licenses).map(([packageKey, license]) => {
     const normalizedPackageNameWithVersion = PackageUtils.normalizePackageName(packageKey);
 
-    if (licenseObj.name !== normalizedPackageNameWithVersion) {
-      renames[normalizedPackageNameWithVersion] = licenseObj.name;
+    if (license.name !== normalizedPackageNameWithVersion) {
+      renames[normalizedPackageNameWithVersion] = license.name;
     }
 
-    const relativeLicenseFile = licenseObj.file ? path.relative(iosProjectPath, licenseObj.file) : undefined;
+    const relativeLicenseFile = license.file ? path.relative(iosProjectPath, license.file) : undefined;
 
     return {
       name: normalizedPackageNameWithVersion,
-      version: licenseObj.version,
-      ...(licenseObj.url && { source: licenseObj.url }),
-      ...(licenseObj.file
-        ? { file: relativeLicenseFile }
-        : { body: licenseObj.content ?? licenseObj.type ?? 'UNKNOWN' }),
+      version: license.version,
+      ...(license.url && { source: license.url }),
+      ...(license.file ? { file: relativeLicenseFile } : { body: license.content ?? license.type ?? 'UNKNOWN' }),
     } as LicensePlistPayload;
   });
 
+  const excludedEntries = Object.values(licenses).reduce<Array<{ name: string }>>((acc, license) => {
+    const packageName = license.name;
+    const localPackageJsonPath = PackageUtils.getPackageJsonPath(packageName);
+
+    if (!localPackageJsonPath) {
+      return acc;
+    }
+
+    const podspecFiles = glob.sync('**.podspec', {
+      cwd: path.dirname(localPackageJsonPath),
+      absolute: true,
+      nocase: true,
+      nodir: true,
+      ignore: '**/{__tests__,__fixtures__,__mocks__}/**',
+    });
+
+    if (!podspecFiles) {
+      return acc;
+    }
+
+    const podspecEntries = podspecFiles.map((podspecFile) => {
+      const podspecContent = fs.readFileSync(podspecFile, { encoding: 'utf-8' });
+      const podspecContentShrinked = podspecContent.replace(/\n/g, ' ');
+      const { specname } = PODSPEC_NAME_REGEX.exec(podspecContentShrinked)?.groups ?? {};
+
+      return { name: specname ?? packageName };
+    });
+
+    return [...acc, ...podspecEntries];
+  }, []);
+
   const yamlDoc = {
     ...(Object.keys(renames).length > 0 && { rename: renames }),
     manual: licenseEntries,
+    /**
+     * Adding excludes to prevent duplicates - NPM packages with iOS Podspecs are already
+     * manually included in the `licenseEntries`. However License Plist is automatically including all
+     * the entries detected via Pods-<project-name>-acknowledgements.plist, which also
+     * includes the NPM package with iOS Podspecs - let's filter them out,
+     * so that only the manual NPM entries are displayed
+     */
+    exclude: excludedEntries,
   };
 
   const yamlContent = [
@@ -261,7 +320,7 @@ export function generateLicensePlistNPMOutput(licenses: AggregatedLicensesObj, i
  * @see {@link generateLicensePlistNPMOutput}
  */
 export function writeLicensePlistNPMOutput(
-  licenses: AggregatedLicensesObj,
+  licenses: AggregatedLicensesMapping,
   iosProjectPath: string,
   plistLikeOutput?: string,
 ) {
@@ -281,20 +340,20 @@ export function writeLicensePlistNPMOutput(
  * @returns Array of AboutLibrariesLikePackage objects, each representing a NPM dependency
  * @see {@link writeAboutLibrariesNPMOutput}
  */
-export function generateAboutLibrariesNPMOutput(licenses: AggregatedLicensesObj): AboutLibrariesLikePackageInfo[] {
+export function generateAboutLibrariesNPMOutput(licenses: AggregatedLicensesMapping): AboutLibrariesLikePackageInfo[] {
   return Object.entries(licenses)
-    .map(([packageKey, licenseObj]) => {
+    .map(([packageKey, license]) => {
       return {
-        artifactVersion: licenseObj.version,
-        content: licenseObj.content ?? '',
-        description: licenseObj.description ?? '',
-        developers: [{ name: licenseObj.author ?? '', organisationUrl: '' }],
-        licenses: [PackageUtils.prepareAboutLibrariesLicenseField(licenseObj)],
-        name: licenseObj.name,
+        artifactVersion: license.version,
+        content: license.content ?? '',
+        description: license.description ?? '',
+        developers: [{ name: license.author ?? '', organisationUrl: '' }],
+        licenses: [PackageUtils.prepareAboutLibrariesLicenseField(license)],
+        name: license.name,
         tag: '',
-        type: licenseObj.type,
+        type: license.type,
         uniqueId: PackageUtils.normalizePackageName(packageKey),
-        website: licenseObj.url,
+        website: license.url,
       };
     })
     .map((jsonPayload) => {
@@ -344,7 +403,7 @@ export function generateAboutLibrariesNPMOutput(licenses: AggregatedLicensesObj)
  * @see {@link generateAboutLibrariesNPMOutput}
  */
 export function writeAboutLibrariesNPMOutput(
-  licenses: AggregatedLicensesObj,
+  licenses: AggregatedLicensesMapping,
   androidProjectPath: string,
   aboutLibrariesLikeOutput?: AboutLibrariesLikePackageInfo[],
 ) {

package/src/node/index.ts

@@ -0,0 +1,3 @@
+export * from './common';
+export * from './utils';
+export * from '../';

package/src/node/utils/index.ts

@@ -0,0 +1,2 @@
+export * as PackageUtils from './packageUtils';
+export * as MiscUtils from './miscUtils';

package/src/{utils → node/utils}/packageUtils.ts

@@ -1,10 +1,10 @@
 import fs from 'fs';
 import path from 'path';
 
-import type { LicenseObj, ScanPackageOptionsFactory } from '../types';
+import type { License, ScanPackageOptionsFactory } from '../../types';
+import { normalizeRepositoryUrl } from '../../utils/repositoryUtils';
 
 import { sha512 } from './miscUtils';
-import { normalizeRepositoryUrl } from './repositoryUtils';
 
 export function getPackageJsonPath(dependency: string, root?: string) {
   const rootsToSearch = [
@@ -54,7 +54,7 @@ export function normalizePackageName(packageName: string): string {
   return packageName.replace('/', '_');
 }
 
-export function prepareAboutLibrariesLicenseField(license: LicenseObj) {
+export function prepareAboutLibrariesLicenseField(license: License) {
   if (!license.type) {
     return '';
   }

package/src/types/AggregatedLicensesMapping.ts

@@ -0,0 +1,7 @@
+import type { License } from './License';
+
+/**
+ * Mapping from package keys in format `<package-name>@<package-version>` to license objects.
+ * @see {@link License}
+ */
+export type AggregatedLicensesMapping = Record<string, License>;

package/src/types/{LicenseObj.ts → License.ts}

@@ -1,7 +1,8 @@
 import type { DependencyType } from './DependencyType';
+import type { ParentPackageInfo } from './ParentPackageInfo';
 import type { ScanPackageCallContext } from './ScanPackageCallContext';
 
-export type LicenseObj = {
+export type License = {
   /** Package name */
   name: string;
 
@@ -31,4 +32,10 @@ export type LicenseObj = {
 
   /** The required version specified in package.json */
   requiredVersion: string;
-} & Pick<ScanPackageCallContext, 'parentPackageName' | 'parentPackageRequiredVersion' | 'parentPackageResolvedVersion'>;
+
+  /**
+   * The name(s) of the package(s) that introduced the package as a dependency (of any type);
+   * empty array if the package is a dependency of the root package
+   */
+  parentPackages: ParentPackageInfo[];
+} & Pick<ScanPackageCallContext, 'parentPackageRequiredVersion' | 'parentPackageResolvedVersion'>;

package/src/types/LicenseAnalysisResult.ts

@@ -0,0 +1,7 @@
+import type { LicenseCategory } from '../licenses/LicenseCategory';
+
+import type { LicenseStats } from './LicenseStats';
+
+export interface LicenseAnalysisResult extends LicenseStats {
+  categorizedLicenses: Record<string, LicenseCategory>;
+}

package/src/types/LicenseStats.ts

@@ -0,0 +1,33 @@
+import type { LicenseCategory } from '../licenses/LicenseCategory';
+
+export interface LicenseStats {
+  /**
+   * Total number of packages
+   */
+  total: number;
+
+  /**
+   * Mapping of license category to count of packages in that category
+   */
+  byCategory: Record<LicenseCategory, number>;
+
+  /**
+   * Mapping of license name to count of packages with that license
+   */
+  byLicense: Record<string, number>;
+
+  /**
+   * Information about the presence of different license categories
+   */
+  categoriesPresence: {
+    hasAnyUnknown: boolean;
+    hasAnyWeakCopyleft: boolean;
+    hasAnyStrongCopyleft: boolean;
+    hasAllPermissive: boolean;
+  };
+
+  /**
+   * Description of the graph state based on the license categories
+   */
+  description: string;
+}

package/src/types/ParentPackageInfo.ts

@@ -0,0 +1,16 @@
+export type ParentPackageInfo = {
+  /**
+   * The name of the package
+   */
+  name: string;
+
+  /**
+   * The required version, as specified in package.json
+   */
+  requiredVersion: string;
+
+  /**
+   * The resolved version, as specified in package.json
+   */
+  resolvedVersion: string;
+};

package/src/types/index.ts

@@ -1,5 +1,5 @@
-export * from './LicenseObj';
-export * from './AggregatedLicensesObj';
+export * from './License';
+export * from './AggregatedLicensesMapping';
 export * from './AboutLibrariesLibraryJsonPayload';
 export * from './AboutLibrariesLicenseJsonPayload';
 export * from './LicensePlistPayload';
@@ -7,3 +7,6 @@ export * from './AboutLibrariesLikePackageInfo';
 export * from './ScanPackageOptions';
 export * from './ScanPackageCallContext';
 export * from './DependencyType';
+export * from './ParentPackageInfo';
+export * from './LicenseAnalysisResult';
+export * from './LicenseStats';

package/src/utils/index.ts

@@ -1,4 +1,2 @@
-export * as PackageUtils from './packageUtils';
-export * as MiscUtils from './miscUtils';
 export * as RepositoryUtils from './repositoryUtils';
 export * as YamlUtils from './yamlUtils';

package/build/types/AggregatedLicensesObj.d.ts

@@ -1,6 +0,0 @@
-import type { LicenseObj } from './LicenseObj';
-/**
- * Mapping from package keys in format `<package-name>/<package-version>` to license objects.
- * @see {@link LicenseObj}
- */
-export type AggregatedLicensesObj = Record<string, LicenseObj>;

package/src/types/AggregatedLicensesObj.ts

@@ -1,7 +0,0 @@
-import type { LicenseObj } from './LicenseObj';
-
-/**
- * Mapping from package keys in format `<package-name>/<package-version>` to license objects.
- * @see {@link LicenseObj}
- */
-export type AggregatedLicensesObj = Record<string, LicenseObj>;