@cyclonedx/cdxgen 12.2.1 → 12.3.0

package/lib/helpers/bomUtils.poku.js

@@ -0,0 +1,51 @@
+import { assert, describe, it } from "poku";
+
+import {
+  detectBomFormat,
+  getNonCycloneDxErrorMessage,
+  isCycloneDxBom,
+  isSpdxJsonLd,
+} from "./bomUtils.js";
+
+const sampleSpdx = {
+  "@context": "https://spdx.org/rdf/3.0.1/spdx-context.jsonld",
+  "@graph": [{ type: "SpdxDocument", spdxId: "urn:demo#SPDXRef-DOCUMENT" }],
+};
+
+describe("bomUtils", () => {
+  it("detects CycloneDX documents", () => {
+    assert.strictEqual(
+      isCycloneDxBom({
+        bomFormat: "CycloneDX",
+        specVersion: 1.7,
+      }),
+      true,
+    );
+    assert.strictEqual(isCycloneDxBom(sampleSpdx), false);
+  });
+
+  it("detects SPDX JSON-LD documents", () => {
+    assert.strictEqual(isSpdxJsonLd(sampleSpdx), true);
+    assert.strictEqual(isSpdxJsonLd({ bomFormat: "CycloneDX" }), false);
+  });
+
+  it("classifies BOM formats for CLI reuse", () => {
+    assert.strictEqual(detectBomFormat(sampleSpdx), "spdx");
+    assert.strictEqual(
+      detectBomFormat({ bomFormat: "CycloneDX", specVersion: "1.6" }),
+      "cyclonedx",
+    );
+    assert.strictEqual(detectBomFormat({ foo: "bar" }), "unknown");
+  });
+
+  it("generates clear CycloneDX-only command errors", () => {
+    assert.strictEqual(
+      getNonCycloneDxErrorMessage(sampleSpdx, "cdx-sign"),
+      "cdx-sign expects a CycloneDX BOM. SPDX input is not supported for this command.",
+    );
+    assert.strictEqual(
+      getNonCycloneDxErrorMessage({ foo: "bar" }, "cdx-sign"),
+      "cdx-sign expects a CycloneDX JSON BOM.",
+    );
+  });
+});

package/lib/helpers/caxa.js

@@ -1,6 +1,6 @@
 import { readFileSync } from "node:fs";
 
-import { getNpmMetadata, shouldFetchLicense } from "./utils.js";
+import { getNpmMetadata, shouldFetchPackageMetadata } from "./utils.js";
 
 export async function parseCaxaMetadata(mfile) {
   let mdata;
@@ -48,7 +48,7 @@ export async function parseCaxaMetadata(mfile) {
       },
     };
   }
-  if (shouldFetchLicense()) {
+  if (shouldFetchPackageMetadata()) {
     mdata.components = await getNpmMetadata(mdata.components);
   }
   return mdata;