@cyclonedx/cdxgen 12.3.3 → 12.4.1

package/lib/stages/postgen/auditBom.js

@@ -10,6 +10,7 @@ import {
   expandBomAuditCategories,
   validateBomAuditCategories,
 } from "../../helpers/auditCategories.js";
+import { isHbomLikeBom as isHbomLikeBomDocument } from "../../helpers/hbomAnalysis.js";
 import { table } from "../../helpers/table.js";
 import {
   DEBUG_MODE,
@@ -21,17 +22,7 @@ import { evaluateRules, loadRules } from "./ruleEngine.js";
 const __dirname = fileURLToPath(new URL(".", import.meta.url));
 const BUILTIN_RULES_DIR = join(__dirname, "..", "..", "..", "data", "rules");
 
-/**
- * Audit BOM formulation section using JSONata-powered rule engine
- * @param {Object} bomJson - Generated CycloneDX BOM
- * @param {Object} options - CLI options
- * @returns {Promise<Array>} Array of audit findings
- */
-export async function auditBom(bomJson, options) {
-  if (!bomJson) {
-    return [];
-  }
-  const findings = [];
+async function loadConfiguredBomAuditRules(options = {}) {
   const rules = await loadRules(BUILTIN_RULES_DIR);
   if (options.bomAuditRulesDir && safeExistsSync(options.bomAuditRulesDir)) {
     const userRulesDir = resolve(options.bomAuditRulesDir);
@@ -41,11 +32,11 @@ export async function auditBom(bomJson, options) {
     }
     rules.push(...userRules);
   }
-  if (rules.length === 0) {
-    if (DEBUG_MODE) {
-      console.log("No audit rules loaded; formulation audit skipped");
-    }
-    return findings;
+  if (!rules.length) {
+    return {
+      activeRules: [],
+      rules,
+    };
   }
   let activeRules = rules;
   if (options.bomAuditCategories) {
@@ -64,6 +55,107 @@ export async function auditBom(bomJson, options) {
       }
     }
   }
+  return {
+    activeRules,
+    rules,
+  };
+}
+
+/**
+ * Detect whether a BOM looks like an HBOM inventory.
+ *
+ * @param {object} bomJson CycloneDX BOM
+ * @returns {boolean} True when the BOM appears to represent hardware inventory
+ */
+export function isHbomLikeBom(bomJson) {
+  return isHbomLikeBomDocument(bomJson);
+}
+
+/**
+ * Detect whether a BOM looks like an OBOM/runtime inventory.
+ *
+ * @param {object} bomJson CycloneDX BOM
+ * @returns {boolean} True when the BOM appears to represent operations/runtime data
+ */
+export function isObomLikeBom(bomJson) {
+  if (!bomJson) {
+    return false;
+  }
+  if (isHbomLikeBom(bomJson)) {
+    return false;
+  }
+  if (
+    bomJson?.metadata?.component?.type === "operating-system" ||
+    bomJson?.metadata?.component?.type === "device"
+  ) {
+    return true;
+  }
+  if (
+    Array.isArray(bomJson?.metadata?.lifecycles) &&
+    bomJson.metadata.lifecycles.some(
+      (lifecycle) => lifecycle?.phase === "operations",
+    )
+  ) {
+    return true;
+  }
+  return (bomJson?.components || []).some((component) =>
+    (component?.properties || []).some(
+      (property) => property?.name === "cdx:osquery:category",
+    ),
+  );
+}
+
+function summarizeDryRunSupport(activeRules = []) {
+  const summary = {
+    fullCount: 0,
+    noCount: 0,
+    partialCount: 0,
+    totalRules: activeRules.length,
+  };
+  for (const rule of activeRules) {
+    if (rule?.dryRunSupport === "no") {
+      summary.noCount += 1;
+      continue;
+    }
+    if (rule?.dryRunSupport === "full") {
+      summary.fullCount += 1;
+      continue;
+    }
+    summary.partialCount += 1;
+  }
+  return summary;
+}
+
+export async function getBomAuditDryRunSupportSummary(options = {}) {
+  const { activeRules } = await loadConfiguredBomAuditRules(options);
+  return summarizeDryRunSupport(activeRules);
+}
+
+export function formatDryRunSupportSummary(summary) {
+  if (!summary) {
+    return "";
+  }
+  return `BOM audit dry-run summary: ${summary.noCount} rule(s) do not support dry-run, ${summary.partialCount} rule(s) have partial dry-run support, ${summary.totalRules} active rule(s) total.`;
+}
+
+/**
+ * Audit BOM formulation section using JSONata-powered rule engine
+ * @param {Object} bomJson - Generated CycloneDX BOM
+ * @param {Object} options - CLI options
+ * @returns {Promise<Array>} Array of audit findings
+ */
+export async function auditBom(bomJson, options) {
+  if (!bomJson) {
+    return [];
+  }
+  const findings = [];
+  const { activeRules, rules } = await loadConfiguredBomAuditRules(options);
+  if (rules.length === 0) {
+    if (DEBUG_MODE) {
+      console.log("No audit rules loaded; formulation audit skipped");
+    }
+    return findings;
+  }
   const allFindings = await evaluateRules(activeRules, bomJson);
   if (options.bomAuditMinSeverity) {
     const minSeverity = options.bomAuditMinSeverity.toLowerCase();
@@ -87,7 +179,7 @@ export async function auditBom(bomJson, options) {
 /**
  * Format findings for console output with color-coded severity
  */
-export function formatConsoleOutput(findings) {
+export function renderBomAuditConsoleReport(findings) {
   if (!findings?.length) {
     return "";
   }
@@ -119,7 +211,18 @@ export function formatConsoleOutput(findings) {
     line.push(f.location?.file || "");
     data.push(line);
   }
-  console.log(table(data, config));
+  return table(data, config);
+}
+
+/**
+ * Format findings for console output with color-coded severity
+ */
+export function formatConsoleOutput(findings) {
+  const output = renderBomAuditConsoleReport(findings);
+  if (output) {
+    console.log(output);
+  }
+  return output;
 }
 
 /**