@callstack/licenses 0.3.0 → 0.3.2

package/build/node/common.js

@@ -166,6 +166,7 @@ function scanDependencies(appPackageJsonPath, scanOptionsFactory = utils_2.Packa
     }
     return result;
 }
+const PODSPEC_NAME_REGEX = /(Pod::Spec\.new\s+do\s+\|(?<specref>.*)\|).*(\k<specref>\.name\s+=\s+(?<quote>["'])(?<specname>[a-zA-Z0-9_\-@]+)\k<quote>)/;
 /**
  * Generates LicensePlist-compatible metadata for NPM dependencies as a YAML string.
  *
@@ -190,9 +191,41 @@ function generateLicensePlistNPMOutput(licenses, iosProjectPath) {
             ...(license.file ? { file: relativeLicenseFile } : { body: license.content ?? license.type ?? 'UNKNOWN' }),
         };
     });
+    const excludedEntries = Object.values(licenses).reduce((acc, license) => {
+        const packageName = license.name;
+        const localPackageJsonPath = utils_2.PackageUtils.getPackageJsonPath(packageName);
+        if (!localPackageJsonPath) {
+            return acc;
+        }
+        const podspecFiles = glob_1.default.sync('**.podspec', {
+            cwd: node_path_1.default.dirname(localPackageJsonPath),
+            absolute: true,
+            nocase: true,
+            nodir: true,
+            ignore: '**/{__tests__,__fixtures__,__mocks__}/**',
+        });
+        if (!podspecFiles) {
+            return acc;
+        }
+        const podspecEntries = podspecFiles.map((podspecFile) => {
+            const podspecContent = node_fs_1.default.readFileSync(podspecFile, { encoding: 'utf-8' });
+            const podspecContentShrinked = podspecContent.replace(/\n/g, ' ');
+            const { specname } = PODSPEC_NAME_REGEX.exec(podspecContentShrinked)?.groups ?? {};
+            return { name: specname ?? packageName };
+        });
+        return [...acc, ...podspecEntries];
+    }, []);
     const yamlDoc = {
         ...(Object.keys(renames).length > 0 && { rename: renames }),
         manual: licenseEntries,
+        /**
+         * Adding excludes to prevent duplicates - NPM packages with iOS Podspecs are already
+         * manually included in the `licenseEntries`. However License Plist is automatically including all
+         * the entries detected via Pods-<project-name>-acknowledgements.plist, which also
+         * includes the NPM package with iOS Podspecs - let's filter them out,
+         * so that only the manual NPM entries are displayed
+         */
+        exclude: excludedEntries,
     };
     const yamlContent = [
         '# BEGIN Generated NPM license entries',

package/build/node/utils/packageUtils.js

@@ -62,7 +62,13 @@ function prepareAboutLibrariesLicenseField(license) {
     if (!license.type) {
         return '';
     }
-    return `${license.type}_${(0, miscUtils_1.sha512)(license.content ?? license.type)}`;
+    // The returned value is used as a filename under `android/config/licenses/`.
+    // Legacy/compound SPDX expressions like `MIT/X11` or `(MIT OR Apache-2.0)` would
+    // otherwise produce paths containing `/`, `(` or spaces, which causes the writer
+    // to either fail with ENOENT (when a `/` is interpreted as a subdirectory) or
+    // to produce names that are invalid on some filesystems.
+    const sanitizedType = license.type.replace(/[^A-Za-z0-9._-]/g, '_');
+    return `${sanitizedType}_${(0, miscUtils_1.sha512)(license.content ?? sanitizedType)}`;
 }
 function parseAuthorField(json) {
     if (typeof json.author === 'object' && typeof json.author.name === 'string') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@callstack/licenses",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "API package that exposes functionalities for programmatic scanning of licenses in Node.js projects.",
   "browser": "./build/index.js",
   "main": "./build/node/index.js",

package/src/node/common.ts

@@ -215,6 +215,9 @@ export function scanDependencies(
   return result;
 }
 
+const PODSPEC_NAME_REGEX =
+  /(Pod::Spec\.new\s+do\s+\|(?<specref>.*)\|).*(\k<specref>\.name\s+=\s+(?<quote>["'])(?<specname>[a-zA-Z0-9_\-@]+)\k<quote>)/;
+
 /**
  * Generates LicensePlist-compatible metadata for NPM dependencies as a YAML string.
  *
@@ -243,9 +246,48 @@ export function generateLicensePlistNPMOutput(licenses: AggregatedLicensesMappin
     } as LicensePlistPayload;
   });
 
+  const excludedEntries = Object.values(licenses).reduce<Array<{ name: string }>>((acc, license) => {
+    const packageName = license.name;
+    const localPackageJsonPath = PackageUtils.getPackageJsonPath(packageName);
+
+    if (!localPackageJsonPath) {
+      return acc;
+    }
+
+    const podspecFiles = glob.sync('**.podspec', {
+      cwd: path.dirname(localPackageJsonPath),
+      absolute: true,
+      nocase: true,
+      nodir: true,
+      ignore: '**/{__tests__,__fixtures__,__mocks__}/**',
+    });
+
+    if (!podspecFiles) {
+      return acc;
+    }
+
+    const podspecEntries = podspecFiles.map((podspecFile) => {
+      const podspecContent = fs.readFileSync(podspecFile, { encoding: 'utf-8' });
+      const podspecContentShrinked = podspecContent.replace(/\n/g, ' ');
+      const { specname } = PODSPEC_NAME_REGEX.exec(podspecContentShrinked)?.groups ?? {};
+
+      return { name: specname ?? packageName };
+    });
+
+    return [...acc, ...podspecEntries];
+  }, []);
+
   const yamlDoc = {
     ...(Object.keys(renames).length > 0 && { rename: renames }),
     manual: licenseEntries,
+    /**
+     * Adding excludes to prevent duplicates - NPM packages with iOS Podspecs are already
+     * manually included in the `licenseEntries`. However License Plist is automatically including all
+     * the entries detected via Pods-<project-name>-acknowledgements.plist, which also
+     * includes the NPM package with iOS Podspecs - let's filter them out,
+     * so that only the manual NPM entries are displayed
+     */
+    exclude: excludedEntries,
   };
 
   const yamlContent = [

package/src/node/utils/packageUtils.ts

@@ -59,7 +59,14 @@ export function prepareAboutLibrariesLicenseField(license: License) {
     return '';
   }
 
-  return `${license.type}_${sha512(license.content ?? license.type)}`;
+  // The returned value is used as a filename under `android/config/licenses/`.
+  // Legacy/compound SPDX expressions like `MIT/X11` or `(MIT OR Apache-2.0)` would
+  // otherwise produce paths containing `/`, `(` or spaces, which causes the writer
+  // to either fail with ENOENT (when a `/` is interpreted as a subdirectory) or
+  // to produce names that are invalid on some filesystems.
+  const sanitizedType = license.type.replace(/[^A-Za-z0-9._-]/g, '_');
+
+  return `${sanitizedType}_${sha512(license.content ?? sanitizedType)}`;
 }
 
 export function parseAuthorField(json: { author: string | { name: string } }) {