@trustify-da/trustify-da-javascript-client 0.3.0-ea.608d6fa → 0.3.0-ea.62b88e5

package/dist/src/providers/base_javascript.d.ts

@@ -1,4 +1,17 @@
-export type purlType = import("../provider").Provider;
+/**
+ * Converts a Subresource Integrity (SRI) string to a CycloneDX hash object.
+ * SRI is formatted as `<alg>-<base64>` (e.g. `sha512-Ab3d...`). CycloneDX
+ * expects an uppercased algorithm label (e.g. `SHA-512`) and a hex-encoded
+ * digest. When the SRI string contains multiple space-separated hashes, only
+ * the first is used.
+ * @param {string} integrity - SRI string from a lock file
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null when unparseable
+ */
+export function sriToHash(integrity: string): {
+    alg: string;
+    content: string;
+} | null;
+export type purlType = any;
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
 /**
@@ -19,7 +32,7 @@ export default class Base_javascript {
    * @param {Object} opts - Configuration options for the provider
    * @protected
    */
-    protected _setUp(manifestPath: string, opts: any): void;
+    protected _setUp(manifestPath: string, opts: Object): void;
     /**
      * Gets the current manifest object
      * @returns {Manifest} The manifest object
@@ -47,6 +60,11 @@ export default class Base_javascript {
    */
     protected _cmdName(): string;
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName(): string;
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract
@@ -60,6 +78,47 @@ export default class Base_javascript {
    * @protected
    */
     protected _updateLockFileCmdArgs(): Array<string>;
+    /**
+     * Parses the provider's lock file into a hash map keyed by `name@version`.
+     * Subclasses override this (accepting the lock directory) to support their
+     * lock file format. The default implementation returns an empty map so
+     * providers without lock parsing (or without a lock file present) gracefully
+     * omit hashes.
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    protected _parseLockFileHashes(): Map<string, Array<{
+        alg: string;
+        content: string;
+    }>>;
+    /**
+     * Loads lock-file hashes for the given directory into internal state.
+     * Parsing failures degrade gracefully to an empty map (no hashes emitted).
+     * @param {string} lockDir - Directory containing the lock file
+     * @protected
+     */
+    protected _loadHashes(lockDir: string): void;
+    /**
+     * Looks up CycloneDX hashes for a package by name and resolved version.
+     * @param {string} name - The package name (including scope, e.g. `@hapi/joi`)
+     * @param {string} version - The resolved package version
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    protected _hashesFor(name: string, version: string): Array<{
+        alg: string;
+        content: string;
+    }> | undefined;
+    /**
+     * Looks up CycloneDX hashes for a package described by a PackageURL.
+     * @param {PackageURL} purl - The package URL
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    protected _hashesForPurl(purl: PackageURL): Array<{
+        alg: string;
+        content: string;
+    }> | undefined;
     /**
    * Checks if the provider supports the given manifest name
    * @param {string} manifestName - The manifest name to check
@@ -67,25 +126,40 @@ export default class Base_javascript {
    */
     isSupported(manifestName: string): boolean;
     /**
-   * Checks if a required lock file exists in the same path as the manifest
+   * Walks up the directory tree from manifestDir looking for the lock file.
+   * Stops when the lock file is found, when a package.json with a "workspaces"
+   * field is encountered without a lock file (workspace root boundary), or
+   * when the filesystem root is reached.
+   *
+   * When TRUSTIFY_DA_WORKSPACE_DIR is set, checks only that directory (no walk-up).
+   *
+   * @param {string} manifestDir - The directory to start searching from
+   * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
+   * @returns {string|null} The directory containing the lock file, or null
+   * @protected
+   */
+    protected _isWorkspaceRoot(dir: any): string | null;
+    _findLockFileDir(manifestDir: any, opts?: {}): string | null;
+    /**
    * @param {string} manifestDir - The base directory where the manifest is located
+   * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir: string): boolean;
+    validateLockFile(manifestDir: string, opts?: Object): boolean;
     /**
    * Provides content and content type for stack analysis
    * @param {string} manifestPath - The manifest path or name
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for stack analysis
    */
-    provideStack(manifestPath: string, opts?: any): Provided;
+    provideStack(manifestPath: string, opts?: Object): Provided;
     /**
    * Provides content and content type for component analysis
    * @param {string} manifestPath - Path to package.json for component report
    * @param {Object} [opts={}] - Optional configuration options
    * @returns {Provided} The provided data for component analysis
    */
-    provideComponent(manifestPath: string, opts?: any): Provided;
+    provideComponent(manifestPath: string, opts?: Object): Provided;
     /**
      * Read license from manifest (package.json). Reused by npm, pnpm, yarn.
      * @param {string} manifestPath - path to package.json
@@ -95,24 +169,25 @@ export default class Base_javascript {
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
+   * @param {Object} [opts={}] - Configuration options; when `TRUSTIFY_DA_WORKSPACE_DIR` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
-    protected _buildDependencyTree(includeTransitive: boolean): any;
+    protected _buildDependencyTree(includeTransitive: boolean, opts?: Object): Object;
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to
    * @param {Object} depTree - The current dependency tree
    * @protected
    */
-    protected _addDependenciesToSbom(sbom: Sbom, depTree: any): void;
+    protected _addDependenciesToSbom(sbom: Sbom, depTree: Object): void;
     /**
    * Extracts root dependencies from the dependency tree
    * @param {Object} depTree - The dependency tree object
    * @returns {Map<string, PackageURL>} Map of dependency names to their PackageURL objects
    * @protected
    */
-    protected _getRootDependencies(depTree: any): Map<string, PackageURL>;
+    protected _getRootDependencies(depTree: Object): Map<string, PackageURL>;
     /**
    * Gets the version of the package manager
    * @returns {string} The version string of the package manager
@@ -120,6 +195,12 @@ export default class Base_javascript {
    */
     protected _version(): string;
     /**
+   * Creates or updates the lock file for the package manager
+   * @param {string} manifestDir - Directory containing the manifest file
+   * @protected
+   */
+    protected _createLockFile(manifestDir: string): void;
+    /**
    * Parses the dependency tree output
    * @param {string} output - The output to parse
    * @returns {string} The parsed output
@@ -128,6 +209,6 @@ export default class Base_javascript {
     protected _parseDepTreeOutput(output: string): string;
     #private;
 }
-export type Provided = import("../provider").Provided;
+export type Provided = any;
 import Manifest from './manifest.js';
 import Sbom from '../sbom.js';

package/dist/src/providers/base_javascript.js

@@ -3,7 +3,7 @@ import os from "node:os";
 import path from 'node:path';
 import { getLicense } from '../license/license_utils.js';
 import Sbom from '../sbom.js';
-import { getCustom, getCustomPath, invokeCommand, toPurl, toPurlFromString } from "../tools.js";
+import { getCustom, getCustomPath, invokeCommand, toPurl, toPurlFromString } from '../tools.js';
 import Manifest from './manifest.js';
 /** @typedef {import('../provider').Provider} */
 /** @typedef {import('../provider').Provided} Provided */
@@ -12,6 +12,49 @@ import Manifest from './manifest.js';
  * @type {string}
  */
 export const purlType = 'npm';
+/**
+ * Maps a Subresource Integrity (SRI) algorithm token to its CycloneDX label.
+ * @type {Object<string, string>}
+ */
+const SRI_ALG_LABELS = {
+    sha1: 'SHA-1',
+    sha256: 'SHA-256',
+    sha384: 'SHA-384',
+    sha512: 'SHA-512',
+};
+/**
+ * Converts a Subresource Integrity (SRI) string to a CycloneDX hash object.
+ * SRI is formatted as `<alg>-<base64>` (e.g. `sha512-Ab3d...`). CycloneDX
+ * expects an uppercased algorithm label (e.g. `SHA-512`) and a hex-encoded
+ * digest. When the SRI string contains multiple space-separated hashes, only
+ * the first is used.
+ * @param {string} integrity - SRI string from a lock file
+ * @returns {{alg: string, content: string}|null} CycloneDX hash, or null when unparseable
+ */
+export function sriToHash(integrity) {
+    if (typeof integrity !== 'string') {
+        return null;
+    }
+    const first = integrity.trim().split(/\s+/)[0];
+    if (!first) {
+        return null;
+    }
+    const dash = first.indexOf('-');
+    if (dash < 0) {
+        return null;
+    }
+    const alg = SRI_ALG_LABELS[first.slice(0, dash).toLowerCase()];
+    // Strip any SRI options (e.g. "?foo") that may follow the base64 payload
+    const base64 = first.slice(dash + 1).split('?')[0];
+    if (!alg || !base64) {
+        return null;
+    }
+    const content = Buffer.from(base64, 'base64').toString('hex');
+    if (!content) {
+        return null;
+    }
+    return { alg, content };
+}
 /**
  * Base class for JavaScript package manager providers.
  * This class provides common functionality for different JavaScript package managers
@@ -25,6 +68,11 @@ export default class Base_javascript {
     #cmd;
     /** @type {string} */
     #ecosystem;
+    /**
+     * Lock-file hashes keyed by `name@version`.
+     * @type {Map<string, Array<{alg: string, content: string}>>}
+     */
+    #hashes = new Map();
     /**
    * Sets up the provider with the manifest path and options
    * @param {string} manifestPath - Path to the package.json manifest file
@@ -71,6 +119,13 @@ export default class Base_javascript {
         throw new TypeError("_cmdName must be implemented");
     }
     /**
+   * Returns the package manager name (e.g. npm, yarn, pnpm, bun)
+   * @returns {string} The package manager name
+   */
+    packageManagerName() {
+        return this._cmdName();
+    }
+    /**
    * Returns the command arguments for listing dependencies
    * @returns {Array<string>} The command arguments
    * @abstract
@@ -88,6 +143,58 @@ export default class Base_javascript {
     _updateLockFileCmdArgs() {
         throw new TypeError("_updateLockFileCmdArgs must be implemented");
     }
+    /**
+     * Parses the provider's lock file into a hash map keyed by `name@version`.
+     * Subclasses override this (accepting the lock directory) to support their
+     * lock file format. The default implementation returns an empty map so
+     * providers without lock parsing (or without a lock file present) gracefully
+     * omit hashes.
+     * @returns {Map<string, Array<{alg: string, content: string}>>} Hash map
+     * @protected
+     */
+    _parseLockFileHashes() {
+        return new Map();
+    }
+    /**
+     * Loads lock-file hashes for the given directory into internal state.
+     * Parsing failures degrade gracefully to an empty map (no hashes emitted).
+     * @param {string} lockDir - Directory containing the lock file
+     * @protected
+     */
+    _loadHashes(lockDir) {
+        try {
+            this.#hashes = this._parseLockFileHashes(lockDir) || new Map();
+        }
+        catch (_) {
+            this.#hashes = new Map();
+        }
+    }
+    /**
+     * Looks up CycloneDX hashes for a package by name and resolved version.
+     * @param {string} name - The package name (including scope, e.g. `@hapi/joi`)
+     * @param {string} version - The resolved package version
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    _hashesFor(name, version) {
+        if (!name || !version) {
+            return undefined;
+        }
+        return this.#hashes.get(`${name}@${version}`);
+    }
+    /**
+     * Looks up CycloneDX hashes for a package described by a PackageURL.
+     * @param {PackageURL} purl - The package URL
+     * @returns {Array<{alg: string, content: string}>|undefined} Hashes, or undefined
+     * @protected
+     */
+    _hashesForPurl(purl) {
+        if (!purl) {
+            return undefined;
+        }
+        const name = purl.namespace ? `${purl.namespace}/${purl.name}` : purl.name;
+        return this._hashesFor(name, purl.version);
+    }
     /**
    * Checks if the provider supports the given manifest name
    * @param {string} manifestName - The manifest name to check
@@ -97,13 +204,63 @@ export default class Base_javascript {
         return 'package.json' === manifestName;
     }
     /**
-   * Checks if a required lock file exists in the same path as the manifest
+   * Walks up the directory tree from manifestDir looking for the lock file.
+   * Stops when the lock file is found, when a package.json with a "workspaces"
+   * field is encountered without a lock file (workspace root boundary), or
+   * when the filesystem root is reached.
+   *
+   * When TRUSTIFY_DA_WORKSPACE_DIR is set, checks only that directory (no walk-up).
+   *
+   * @param {string} manifestDir - The directory to start searching from
+   * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
+   * @returns {string|null} The directory containing the lock file, or null
+   * @protected
+   */
+    _isWorkspaceRoot(dir) {
+        if (fs.existsSync(path.join(dir, 'pnpm-workspace.yaml'))) {
+            return true;
+        }
+        const pkgJsonPath = path.join(dir, 'package.json');
+        if (fs.existsSync(pkgJsonPath)) {
+            try {
+                const content = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf-8'));
+                if (content.workspaces) {
+                    return true;
+                }
+            }
+            catch (_) {
+                // ignore parse errors
+            }
+        }
+        return false;
+    }
+    _findLockFileDir(manifestDir, opts = {}) {
+        const workspaceDir = getCustom('TRUSTIFY_DA_WORKSPACE_DIR', null, opts);
+        if (workspaceDir) {
+            const dir = path.resolve(workspaceDir);
+            return fs.existsSync(path.join(dir, this._lockFileName())) ? dir : null;
+        }
+        let dir = path.resolve(manifestDir);
+        let parent = dir;
+        do {
+            dir = parent;
+            if (fs.existsSync(path.join(dir, this._lockFileName()))) {
+                return dir;
+            }
+            if (this._isWorkspaceRoot(dir)) {
+                return null;
+            }
+            parent = path.dirname(dir);
+        } while (parent !== dir);
+        return null;
+    }
+    /**
    * @param {string} manifestDir - The base directory where the manifest is located
+   * @param {Object} [opts={}] - optional; may contain TRUSTIFY_DA_WORKSPACE_DIR
    * @returns {boolean} True if the lock file exists
    */
-    validateLockFile(manifestDir) {
-        const lock = path.join(manifestDir, this._lockFileName());
-        return fs.existsSync(lock);
+    validateLockFile(manifestDir, opts = {}) {
+        return this._findLockFileDir(manifestDir, opts) !== null;
     }
     /**
    * Provides content and content type for stack analysis
@@ -159,14 +316,17 @@ export default class Base_javascript {
     /**
    * Builds the dependency tree for the project
    * @param {boolean} includeTransitive - Whether to include transitive dependencies
+   * @param {Object} [opts={}] - Configuration options; when `TRUSTIFY_DA_WORKSPACE_DIR` is set, commands run from workspace root
    * @returns {Object} The dependency tree
    * @protected
    */
-    _buildDependencyTree(includeTransitive) {
+    _buildDependencyTree(includeTransitive, opts = {}) {
         this._version();
-        let manifestDir = path.dirname(this.#manifest.manifestPath);
-        this.#createLockFile(manifestDir);
-        let output = this.#executeListCmd(includeTransitive, manifestDir);
+        const manifestDir = path.dirname(this.#manifest.manifestPath);
+        const cmdDir = this._findLockFileDir(manifestDir, opts) || manifestDir;
+        this._createLockFile(cmdDir);
+        this._loadHashes(cmdDir);
+        let output = this.#executeListCmd(includeTransitive, cmdDir);
         output = this._parseDepTreeOutput(output);
         return JSON.parse(output);
     }
@@ -177,15 +337,38 @@ export default class Base_javascript {
    * @private
    */
     #getSBOM(opts = {}) {
-        const depsObject = this._buildDependencyTree(true);
+        const depsObject = this._buildDependencyTree(true, opts);
         let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
         const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
         let sbom = new Sbom();
         sbom.addRoot(mainComponent, license);
         this._addDependenciesToSbom(sbom, depsObject);
+        this.#ensurePeerAndOptionalDeps(sbom);
         sbom.filterIgnoredDeps(this.#manifest.ignored);
         return sbom.getAsJsonString(opts);
     }
+    /**
+     * Ensures peer and optional dependencies declared in the manifest are
+     * present in the SBOM, even when the package manager does not resolve them
+     * (e.g. yarn does not include peer deps in its dependency listing).
+     * @param {Sbom} sbom - The SBOM to supplement
+     * @private
+     */
+    #ensurePeerAndOptionalDeps(sbom) {
+        const rootPurl = toPurl(purlType, this.#manifest.name, this.#manifest.version);
+        const depSources = [this.#manifest.peerDependencies, this.#manifest.optionalDependencies];
+        for (const source of depSources) {
+            for (const [name, version] of Object.entries(source)) {
+                // Build the purl prefix for exact matching (e.g. "pkg:npm/minimist@"
+                // or "pkg:npm/%40hapi/joi@") to avoid substring false positives
+                const probe = toPurl(purlType, name, version);
+                const purlPrefix = probe.toString().replace(/@[^@]*$/, '@');
+                if (!sbom.checkDependsOnByPurlPrefix(rootPurl, purlPrefix)) {
+                    sbom.addDependency(rootPurl, probe);
+                }
+            }
+        }
+    }
     /**
    * Recursively builds the Sbom from the JSON that npm listing returns
    * @param {Sbom} sbom - The SBOM object to add dependencies to
@@ -193,13 +376,16 @@ export default class Base_javascript {
    * @protected
    */
     _addDependenciesToSbom(sbom, depTree) {
-        const dependencies = depTree["dependencies"] || {};
+        const dependencies = {
+            ...depTree["dependencies"],
+            ...depTree["optionalDependencies"],
+        };
         Object.entries(dependencies)
             .forEach(entry => {
             const [name, artifact] = entry;
             const target = toPurl(purlType, name, artifact.version);
             const rootPurl = toPurl(purlType, this.#manifest.name, this.#manifest.version);
-            sbom.addDependency(rootPurl, target);
+            sbom.addDependency(rootPurl, target, undefined, this._hashesFor(name, artifact.version));
             this.#addDependenciesOf(sbom, target, artifact);
         });
     }
@@ -217,7 +403,7 @@ export default class Base_javascript {
             const [name, depArtifact] = entry;
             if (depArtifact.version !== undefined) {
                 const target = toPurl(purlType, name, depArtifact.version);
-                sbom.addDependency(from, target);
+                sbom.addDependency(from, target, undefined, this._hashesFor(name, depArtifact.version));
                 this.#addDependenciesOf(sbom, target, depArtifact);
             }
         });
@@ -229,7 +415,7 @@ export default class Base_javascript {
    * @private
    */
     #getDirectDependencySbom(opts = {}) {
-        const depTree = this._buildDependencyTree(false);
+        const depTree = this._buildDependencyTree(false, opts);
         let mainComponent = toPurl(purlType, this.#manifest.name, this.#manifest.version);
         const license = this.readLicenseFromManifest(this.#manifest.manifestPath);
         let sbom = new Sbom();
@@ -241,8 +427,10 @@ export default class Base_javascript {
             .sort();
         for (const key of sortedDepsKeys) {
             const rootPurl = toPurlFromString(sbom.getRoot().purl);
-            sbom.addDependency(rootPurl, rootDeps.get(key));
+            const targetPurl = rootDeps.get(key);
+            sbom.addDependency(rootPurl, targetPurl, undefined, this._hashesForPurl(targetPurl));
         }
+        this.#ensurePeerAndOptionalDeps(sbom);
         sbom.filterIgnoredDeps(this.#manifest.ignored);
         return sbom.getAsJsonString(opts);
     }
@@ -253,10 +441,14 @@ export default class Base_javascript {
    * @protected
    */
     _getRootDependencies(depTree) {
-        if (!depTree.dependencies) {
+        const allDeps = {
+            ...depTree.dependencies,
+            ...depTree.optionalDependencies,
+        };
+        if (Object.keys(allDeps).length === 0) {
             return new Map();
         }
-        return new Map(Object.entries(depTree.dependencies).map(([key, value]) => [key, toPurl(purlType, key, value.version)]));
+        return new Map(Object.entries(allDeps).map(([key, value]) => [key, toPurl(purlType, key, value.version)]));
     }
     /**
    * Executes the list command to get dependencies
@@ -267,7 +459,7 @@ export default class Base_javascript {
    */
     #executeListCmd(includeTransitive, manifestDir) {
         const listArgs = this._listCmdArgs(includeTransitive, manifestDir);
-        return this.#invokeCommand(listArgs);
+        return this.#invokeCommand(listArgs, { cwd: manifestDir });
     }
     /**
    * Gets the version of the package manager
@@ -280,19 +472,17 @@ export default class Base_javascript {
     /**
    * Creates or updates the lock file for the package manager
    * @param {string} manifestDir - Directory containing the manifest file
-   * @private
+   * @protected
    */
-    #createLockFile(manifestDir) {
+    _createLockFile(manifestDir) {
         const originalDir = process.cwd();
         const isWindows = os.platform() === 'win32';
         if (isWindows) {
-            // On Windows, --prefix flag doesn't work as expected
-            // Instead of installing from the prefix folder, it installs from current working directory
             process.chdir(manifestDir);
         }
         try {
             const args = this._updateLockFileCmdArgs(manifestDir);
-            this.#invokeCommand(args);
+            this.#invokeCommand(args, { cwd: manifestDir });
         }
         finally {
             if (isWindows) {
@@ -342,7 +532,7 @@ export default class Base_javascript {
                 }
             }
             // Try to find the command in the following order:
-            // 1. Custom path from environment/opts (via getCustomPath)
+            // 1. Custom path from opts/environment (via getCustomPath)
             // 2. Local node_modules/.bin
             // 3. Global installation
             let cmd = this.#cmd;