@vltpkg/query 1.0.0-rc.8 → 1.0.1

package/src/pseudo/license.ts

@@ -0,0 +1,134 @@
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+  removeQuotes,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+export type LicenseKinds =
+  | 'unlicensed'
+  | 'misc'
+  | 'restricted'
+  | 'ambiguous'
+  | 'copyleft'
+  | 'unknown'
+  | 'none'
+  | 'exception'
+  | undefined
+
+export type LicenseAlertTypes =
+  | 'explicitlyUnlicensedItem'
+  | 'miscLicenseIssues'
+  | 'nonpermissiveLicense'
+  | 'ambiguousClassifier'
+  | 'copyleftLicense'
+  | 'unidentifiedLicense'
+  | 'noLicenseFound'
+  | 'licenseException'
+  | undefined
+
+const kindsMap = new Map<LicenseKinds, LicenseAlertTypes>([
+  ['unlicensed', 'explicitlyUnlicensedItem'],
+  ['misc', 'miscLicenseIssues'],
+  ['restricted', 'nonpermissiveLicense'],
+  ['ambiguous', 'ambiguousClassifier'],
+  ['copyleft', 'copyleftLicense'],
+  ['unknown', 'unidentifiedLicense'],
+  ['none', 'noLicenseFound'],
+  ['exception', 'licenseException'],
+  [undefined, undefined],
+])
+const kinds = new Set(kindsMap.keys())
+
+export const isLicenseKind = (
+  value?: string,
+): value is LicenseKinds => kinds.has(value as LicenseKinds)
+
+export const asLicenseKind = (value?: string): LicenseKinds => {
+  if (!isLicenseKind(value)) {
+    throw error('Expected a valid license kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+export const parseInternals = (
+  nodes: PostcssNode[],
+): { kind: LicenseKinds } => {
+  let kind: LicenseKinds
+
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    kind = asLicenseKind(
+      removeQuotes(
+        asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+          .value,
+      ),
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    kind = asLicenseKind(
+      asTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value,
+    )
+  }
+
+  return { kind }
+}
+
+export const license = async (state: ParserState) => {
+  assertSecurityArchive(state, 'license')
+
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      // No parameters provided - pseudo state form: match ANY license defined (not 'none')
+      for (const node of state.partial.nodes) {
+        const report = state.securityArchive.get(node.id)
+        // Exclude if no report or if it has 'noLicenseFound' alert
+        const exclude =
+          !report?.alerts ||
+          report.alerts.some(alert => alert.type === 'noLicenseFound')
+        if (exclude) {
+          removeNode(state, node)
+        }
+      }
+      removeDanglingEdges(state)
+      return state
+    } else {
+      throw error('Failed to parse :license selector', { cause: err })
+    }
+  }
+
+  const { kind } = internals
+  const alertName = kindsMap.get(kind)
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    const exclude = !report?.alerts.some(
+      alert => alert.type === alertName,
+    )
+    if (exclude) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/link.ts

@@ -0,0 +1,30 @@
+import { splitDepID } from '@vltpkg/dep-id/browser'
+import type { ParserState } from '../types.ts'
+import { removeNode } from './helpers.ts'
+
+/**
+ * :link Pseudo-Selector, matches only nodes that are file links.
+ *
+ * It filters out any node that is not of type 'file' or nodes of 'file'
+ * type that ends with 'tar.gz' since these are local tarballs.
+ */
+export const link = async (state: ParserState) => {
+  for (const node of state.partial.nodes) {
+    const [type, path] = splitDepID(node.id)
+    if (type !== 'file' || path.endsWith('tar.gz') || path === '.') {
+      removeNode(state, node)
+    }
+  }
+
+  for (const edge of state.partial.edges) {
+    if (
+      !edge.spec.file ||
+      edge.spec.file.endsWith('tar.gz') ||
+      edge.spec.file === '.'
+    ) {
+      state.partial.edges.delete(edge)
+    }
+  }
+
+  return state
+}

package/src/pseudo/malware.ts

@@ -0,0 +1,41 @@
+import { error } from '@vltpkg/error-cause'
+import { asPostcssNodeWithChildren } from '@vltpkg/dss-parser'
+import {
+  assertSecurityArchive,
+  removeDanglingEdges,
+  removeNode,
+} from './helpers.ts'
+import type { ParserState } from '../types.ts'
+
+const malwareAlertTypes = new Set(['malware', 'gptMalware'])
+
+/**
+ * :malware Pseudo-Selector, matches nodes with any malware-related alert.
+ *
+ * This is a binary selector — no parameters. A node matches if it has
+ * at least one alert whose type is `malware` or `gptMalware`.
+ */
+export const malware = async (state: ParserState) => {
+  assertSecurityArchive(state, 'malware')
+
+  const currentNode = asPostcssNodeWithChildren(state.current)
+  if (currentNode.nodes.length > 0) {
+    throw error(
+      ':malware selector does not accept parameters. Use :vuln(<severity>) for severity-based filtering.',
+    )
+  }
+
+  for (const node of state.partial.nodes) {
+    const report = state.securityArchive.get(node.id)
+    const hasMalware = report?.alerts.some(alert =>
+      malwareAlertTypes.has(alert.type),
+    )
+    if (!hasMalware) {
+      removeNode(state, node)
+    }
+  }
+
+  removeDanglingEdges(state)
+
+  return state
+}

package/src/pseudo/minified.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **minifiedFile** report alert.
+ */
+export const minified = createSecuritySelectorFilter(
+  'minified',
+  'minifiedFile',
+)

package/src/pseudo/missing.ts

@@ -0,0 +1,16 @@
+import type { ParserState } from '../types.ts'
+
+/**
+ * :missing Pseudo-Selector, matches only edges that are not linked to any node.
+ * It filters out any edges that have a 'to' property, keeping only dangling edges
+ * and clears all nodes from the result.
+ */
+export const missing = async (state: ParserState) => {
+  for (const edge of state.partial.edges) {
+    if (edge.to) {
+      state.partial.edges.delete(edge)
+    }
+  }
+  state.partial.nodes.clear()
+  return state
+}

package/src/pseudo/native.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **hasNativeCode** report alert.
+ */
+export const nativeParser = createSecuritySelectorFilter(
+  'native',
+  'hasNativeCode',
+)

package/src/pseudo/network.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have a **networkAccess** report alert.
+ */
+export const network = createSecuritySelectorFilter(
+  'network',
+  'networkAccess',
+)

package/src/pseudo/obfuscated.ts

@@ -0,0 +1,9 @@
+import { createSecuritySelectorFilter } from './helpers.ts'
+
+/**
+ * Filters out any node that does not have an **obfuscatedFile** report alert.
+ */
+export const obfuscated = createSecuritySelectorFilter(
+  'obfuscated',
+  'obfuscatedFile',
+)

package/src/pseudo/optional.ts

@@ -0,0 +1,18 @@
+import type { ParserState } from '../types.ts'
+import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
+
+/**
+ * :optional Pseudo-Selector will only match optional dependencies.
+ */
+export const optional = async (state: ParserState) => {
+  // filter edges that aren't marked as optional
+  for (const edge of state.partial.edges) {
+    if (!edge.optional) {
+      removeEdge(state, edge)
+    }
+  }
+
+  removeUnlinkedNodes(state)
+
+  return state
+}

package/src/pseudo/outdated.ts

@@ -0,0 +1,305 @@
+import pRetry, { AbortError } from 'p-retry'
+import { hydrate, splitDepID } from '@vltpkg/dep-id/browser'
+import { error } from '@vltpkg/error-cause'
+import { asError } from '@vltpkg/types'
+import {
+  compare,
+  gt,
+  major,
+  minor,
+  patch,
+  satisfies,
+} from '@vltpkg/semver'
+import {
+  asPostcssNodeWithChildren,
+  asStringNode,
+  asTagNode,
+  isStringNode,
+  isTagNode,
+} from '@vltpkg/dss-parser'
+import { removeNode, removeQuotes } from './helpers.ts'
+import type { NodeLike, Packument } from '@vltpkg/types'
+import type { ParserState } from '../types.ts'
+import type { PostcssNode } from '@vltpkg/dss-parser'
+
+/**
+ * The possible values accepted by the :outdated() pseudo selector.
+ */
+export type OutdatedKinds =
+  'any' | 'major' | 'minor' | 'patch' | 'in-range' | 'out-of-range'
+
+/**
+ * Result of the internal parsing of the :outdated() pseudo selector.
+ */
+export type OutdatedInternals = {
+  kind: OutdatedKinds
+}
+
+/**
+ * Extracts a semver type from a version string.
+ */
+export type SemverTypeExtraction = (
+  version: string,
+) => number | undefined
+
+const kinds = new Set<OutdatedKinds>([
+  'any',
+  'major',
+  'minor',
+  'patch',
+  'in-range',
+  'out-of-range',
+])
+
+/**
+ * Checks if a string is a valid {@link OutdatedKinds}.
+ */
+export const isOutdatedKind = (
+  value: string,
+): value is OutdatedKinds => kinds.has(value as OutdatedKinds)
+
+/**
+ * Asserts that a string is a valid {@link OutdatedKinds}.
+ */
+export const asOutdatedKind = (value: string): OutdatedKinds => {
+  if (!isOutdatedKind(value)) {
+    throw error('Expected a valid outdated kind', {
+      found: value,
+      validOptions: Array.from(kinds),
+    })
+  }
+  return value
+}
+
+/**
+ * Fetches the available versions of a package from the npm registry.
+ */
+export const retrieveRemoteVersions = async (
+  node: NodeLike,
+  signal?: AbortSignal,
+): Promise<string[]> => {
+  const spec = hydrate(node.id, String(node.name), node.options)
+  if (!spec.registry || !node.name) {
+    return []
+  }
+
+  const url = new URL(spec.registry)
+  url.pathname = `/${node.name}`
+
+  const response = await fetch(String(url), {
+    headers: {
+      Accept: 'application/vnd.npm.install-v1+json',
+    },
+    signal,
+  })
+  // on missing valid auth or API, it should abort the retry logic
+  if (response.status === 404) {
+    throw new AbortError('Missing API')
+  }
+  if (!response.ok) {
+    throw error('Failed to fetch packument', {
+      name: node.name,
+      spec,
+      response,
+    })
+  }
+  const packument = (await response.json()) as Packument
+  return Object.keys(packument.versions).sort(compare)
+}
+
+/**
+ * Retrieves what kind of check the :outdated selector should perform.
+ */
+export const parseInternals = (
+  nodes: PostcssNode[],
+): OutdatedInternals => {
+  let kind: OutdatedKinds = 'any'
+
+  if (isStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])) {
+    kind = asOutdatedKind(
+      removeQuotes(
+        asStringNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+          .value,
+      ),
+    )
+  } else if (
+    isTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0])
+  ) {
+    kind = asOutdatedKind(
+      asTagNode(asPostcssNodeWithChildren(nodes[0]).nodes[0]).value,
+    )
+  }
+
+  return { kind }
+}
+
+/**
+ * Filter nodes by queueing up for removal those that are not outdated.
+ */
+export const queueNode = async (
+  state: ParserState,
+  node: NodeLike,
+  kind: OutdatedKinds,
+): Promise<NodeLike | undefined> => {
+  if (!node.name || !node.version) {
+    return node
+  }
+
+  const nodeVersion: string = node.version
+  let versions: string[]
+  try {
+    versions = await pRetry(
+      () => retrieveRemoteVersions(node, state.signal),
+      {
+        retries: state.retries,
+        signal: state.signal,
+      },
+    )
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn(
+      error('Could not retrieve registry versions', {
+        name: node.name,
+        cause: err,
+      }),
+    )
+    versions = []
+  }
+
+  const greaterVersions = versions.filter((version: string) =>
+    gt(version, nodeVersion),
+  )
+
+  // if there are no greater versions, then the node is not outdated
+  if (!greaterVersions.length) {
+    return node
+  }
+
+  const checkKind = new Map<OutdatedKinds, SemverTypeExtraction>([
+    ['major', major],
+    ['minor', minor],
+    ['patch', patch],
+  ])
+
+  switch (kind) {
+    case 'any':
+      return
+    case 'major':
+    case 'minor':
+    case 'patch': {
+      return (
+          greaterVersions.some((version: string) => {
+            const va = checkKind.get(kind)?.(version)
+            const vb = checkKind.get(kind)?.(nodeVersion)
+            /* c8 ignore next - impossible but typescript doesn't know */
+            if (va === undefined || vb === undefined) return false
+            return va > vb
+          })
+        ) ?
+          undefined
+        : node
+    }
+    // the node should be part of the result as long as it has at least
+    // one parent node that has a spec definition that satisfies one
+    // of the available remove versions
+    case 'in-range': {
+      for (const edge of node.edgesIn) {
+        // if the edge is not part of the partial results, skip it
+        /* c8 ignore next */
+        if (!state.partial.edges.has(edge)) continue
+
+        if (
+          greaterVersions.some(
+            version =>
+              edge.spec.final.range &&
+              satisfies(version, edge.spec.final.range),
+          )
+        ) {
+          return
+        }
+      }
+      return node
+    }
+    // the node is part of the result as long as none of its parents has
+    // a spec definition that satisfies one of the available remote versions
+    case 'out-of-range': {
+      for (const edge of node.edgesIn) {
+        // if the edge is not part of the partial results, skip it
+        /* c8 ignore next */
+        if (!state.partial.edges.has(edge)) continue
+
+        if (
+          greaterVersions.some(
+            version =>
+              edge.spec.final.range &&
+              satisfies(version, edge.spec.final.range),
+          )
+        ) {
+          return node
+        }
+      }
+      return
+    }
+  }
+}
+
+/**
+ * Filters out nodes that are not outdated.
+ *
+ * The :outdated() pseudo selector supports one `type` argument,
+ * possible values are the following:
+ *
+ * - `any`: Selects all nodes that have a greater version available.
+ * - `major`: Selects all nodes that have a greater major version available.
+ * - `minor`: Selects all nodes that have a greater minor version available.
+ * - `patch`: Selects all nodes that have a greater patch version available.
+ * - `in-range`: Selects all nodes that have a parent node with a spec definition
+ *  that satisfies one of the available remote versions.
+ *  - `out-of-range`: Selects all nodes that have a parent node with a spec definition
+ *  that does not satisfy any of the available remote versions.
+ */
+export const outdated = async (state: ParserState) => {
+  let internals
+  try {
+    internals = parseInternals(
+      asPostcssNodeWithChildren(state.current).nodes,
+    )
+  } catch (err) {
+    if (asError(err).message === 'Expected a query node') {
+      internals = { kind: 'any' } satisfies OutdatedInternals
+    } else {
+      throw error('Failed to parse :outdated selector', {
+        cause: err,
+      })
+    }
+  }
+
+  const { kind } = internals
+  const queue = []
+
+  for (const node of state.partial.nodes) {
+    // filter out nodes that are always ignored by the outdated selector
+    if (
+      node.mainImporter ||
+      node.manifest?.private ||
+      splitDepID(node.id)[0] !== 'registry'
+    ) {
+      removeNode(state, node)
+      continue
+    }
+
+    // fetchs outdated info and performs checks to define
+    // whether or not a node should be filtered out
+    queue.push(queueNode(state, node, kind))
+  }
+
+  // nodes queued for removal are then finally removed
+  const removeNodeQueue = await Promise.all(queue)
+  for (const node of removeNodeQueue) {
+    if (node) {
+      removeNode(state, node)
+    }
+  }
+
+  return state
+}

package/src/pseudo/overridden.ts

@@ -0,0 +1,20 @@
+import type { ParserState } from '../types.ts'
+import { removeEdge, removeUnlinkedNodes } from './helpers.ts'
+
+/**
+ * :overridden Pseudo-Selector, matches only edges that have a truthy overridden property in their spec.
+ * It filters out any edges that don't have edge.spec.overridden set to a truthy value
+ * and removes any unlinked nodes from the result.
+ */
+export const overridden = async (state: ParserState) => {
+  // filter edges that don't have a truthy overridden property
+  for (const edge of state.partial.edges) {
+    if (!edge.spec.overridden) {
+      removeEdge(state, edge)
+    }
+  }
+
+  removeUnlinkedNodes(state)
+
+  return state
+}