cra-audit 0.1.0 → 1.0.0

package/src/reporters/console.js

@@ -16,10 +16,10 @@ const SEVERITY_COLORS = {
  * @param {import('../core/auditor').AuditResult} report
  */
 function reportConsole(report) {
-  logger.heading('  CRA Audit — Cyber Resilience Act (UE 2024/2847) · BSI TR-03183');
-  logger.detail(`Proyecto: ${report.project.name}@${report.project.version}`);
+  logger.heading('  CRA Audit — Cyber Resilience Act (EU 2024/2847) · BSI TR-03183');
+  logger.detail(`Project: ${report.project.name}@${report.project.version}`);
   if (report.policySource) {
-    logger.detail(`Política: ${report.policySource}`);
+    logger.detail(`Policy: ${report.policySource}`);
   }
 
   if (report.sections.vulnerabilities) renderVulnerabilities(report.sections.vulnerabilities);
@@ -30,7 +30,7 @@ function reportConsole(report) {
 }
 
 function renderVulnerabilities(section) {
-  logger.heading('1) Vulnerabilidades conocidas (Art. 13 CRA)');
+  logger.heading('1) Known vulnerabilities (CRA Art. 13)');
   if (!section.ok) {
     logger.error(section.error);
     return;
@@ -38,13 +38,13 @@ function renderVulnerabilities(section) {
 
   const c = section.counts;
   if (c.total === 0) {
-    logger.success('Sin vulnerabilidades conocidas. Cumple el requisito de "cero vulnerabilidades explotables".');
+    logger.success('No known vulnerabilities. Meets the "zero exploitable vulnerabilities" requirement.');
     return;
   }
 
   logger.log(
-    `  ${color.red(`${c.critical} críticas`)} · ${color.red(`${c.high} altas`)} · ` +
-    `${color.yellow(`${c.moderate} moderadas`)} · ${color.yellow(`${c.low} bajas`)} · ${color.gray(`${c.info} info`)}`
+    `  ${color.red(`${c.critical} critical`)} · ${color.red(`${c.high} high`)} · ` +
+    `${color.yellow(`${c.moderate} moderate`)} · ${color.yellow(`${c.low} low`)} · ${color.gray(`${c.info} info`)}`
   );
 
   const top = section.vulnerabilities.slice(0, 15);
@@ -56,25 +56,25 @@ function renderVulnerabilities(section) {
     if (adv && adv.title) logger.detail(`${adv.title}${adv.url ? ' — ' + adv.url : ''}`);
   }
   if (section.vulnerabilities.length > top.length) {
-    logger.detail(`… y ${section.vulnerabilities.length - top.length} más.`);
+    logger.detail(`… and ${section.vulnerabilities.length - top.length} more.`);
   }
 }
 
 function describeFix(fix) {
-  if (fix === true) return color.green('(fix disponible)');
+  if (fix === true) return color.green('(fix available)');
   if (fix && typeof fix === 'object') {
     return color.green(`(fix: ${fix.name}@${fix.version}${fix.breaking ? ', breaking' : ''})`);
   }
-  return color.gray('(sin fix)');
+  return color.gray('(no fix)');
 }
 
 function renderSbom(section) {
-  logger.heading('2) Lista de Materiales de Software · SBOM (Anexo I CRA)');
+  logger.heading('2) Software Bill of Materials · SBOM (CRA Annex I)');
   if (!section.ok) {
     logger.error(section.error);
     return;
   }
-  logger.detail(`Formato: ${section.format} · Componentes: ${section.componentCount}`);
+  logger.detail(`Format: ${section.format} · Components: ${section.componentCount}`);
 
   if (section.validation) {
     const v = section.validation;
@@ -83,53 +83,53 @@ function renderSbom(section) {
       logger.log(`  ${mark} ${check.label}`);
     }
     if (v.valid) {
-      logger.success('El SBOM cumple los elementos mínimos de TR-03183 §6.');
+      logger.success('The SBOM meets the TR-03183 §6 minimum elements.');
     } else {
-      logger.warn(`El SBOM no cumple ${v.failedChecks.length} requisito(s) mínimo(s).`);
+      logger.warn(`The SBOM does not meet ${v.failedChecks.length} minimum requirement(s).`);
     }
   }
   if (section.outputPath) {
-    logger.detail(`SBOM escrito en: ${section.outputPath}`);
+    logger.detail(`SBOM written to: ${section.outputPath}`);
   }
 }
 
 function renderLicenses(section) {
-  logger.heading('3) Licencias de componentes de terceros (TR-03183 §6)');
+  logger.heading('3) Third-party component licenses (TR-03183 §6)');
   if (!section.ok) {
     logger.error(section.error);
     return;
   }
   const s = section.summary;
-  logger.detail(`Documentadas: ${s.documented}/${s.total}`);
+  logger.detail(`Documented: ${s.documented}/${s.total}`);
 
   if (s.missing.length) {
-    logger.warn(`${s.missing.length} componente(s) sin licencia documentada:`);
+    logger.warn(`${s.missing.length} component(s) without a documented license:`);
     for (const c of s.missing.slice(0, 10)) logger.log(`    ${color.gray('•')} ${c.name}@${c.version}`);
   }
   if (s.denied.length) {
-    logger.error(`${s.denied.length} componente(s) con licencia prohibida por la política:`);
+    logger.error(`${s.denied.length} component(s) with a license denied by the policy:`);
     for (const c of s.denied) logger.log(`    ${color.red('•')} ${c.name}@${c.version} (${c.license})`);
   }
   if (s.notAllowed.length) {
-    logger.warn(`${s.notAllowed.length} componente(s) con licencia fuera de la allowlist:`);
+    logger.warn(`${s.notAllowed.length} component(s) with a license outside the allowlist:`);
     for (const c of s.notAllowed.slice(0, 10)) logger.log(`    ${color.yellow('•')} ${c.name}@${c.version} (${c.license})`);
   }
   if (!s.missing.length && !s.denied.length && !s.notAllowed.length) {
-    logger.success('Todas las licencias están documentadas y permitidas.');
+    logger.success('All licenses are documented and allowed.');
   }
 }
 
 function renderSummary(report) {
-  logger.heading('Resultado');
+  logger.heading('Result');
   for (const item of report.gate.reasons) {
     const mark = item.passed ? color.green('✔') : color.red('✖');
     logger.log(`  ${mark} ${item.label}`);
   }
   logger.log('');
   if (report.gate.passed) {
-    logger.success(color.bold('AUDITORÍA SUPERADA — el proyecto cumple la política CRA configurada.'));
+    logger.success(color.bold('AUDIT PASSED — the project meets the configured CRA policy.'));
   } else {
-    logger.error(color.bold('AUDITORÍA FALLIDA — se han detectado incumplimientos del CRA.'));
+    logger.error(color.bold('AUDIT FAILED — CRA compliance issues were detected.'));
   }
   logger.log('');
 }

package/src/utils/logger.js

@@ -80,6 +80,25 @@ const logger = {
   detail(msg) {
     this.log(`  ${color.gray(msg)}`);
   },
+  /**
+   * Renders an in-place progress bar with a percentage and a done/total count.
+   * On a TTY the same line is rewritten on each call; a trailing newline is
+   * emitted once `done >= total`. On non-TTY streams nothing is written to
+   * avoid flooding logs (CI pipelines), so callers should log a final summary.
+   */
+  progress(label, done, total) {
+    if (!process.stdout.isTTY) return;
+    const ratio = total > 0 ? Math.min(1, done / total) : 1;
+    const pct = Math.floor(ratio * 100);
+    const width = 24;
+    const filled = Math.round(ratio * width);
+    const bar = '█'.repeat(filled) + '░'.repeat(width - filled);
+    const line =
+      `  ${color.gray(label)} ${color.cyan(`[${bar}]`)} ` +
+      `${String(pct).padStart(3)}% ${color.gray(`(${done}/${total})`)}`;
+    process.stdout.write(`\r\x1b[K${line}`);
+    if (done >= total) process.stdout.write('\n');
+  },
 };
 
 module.exports = { logger, color, SYMBOLS };

package/src/utils/yaml.js

@@ -0,0 +1,225 @@
+'use strict';
+
+/**
+ * Minimal YAML parser covering the subset used by `pnpm-lock.yaml` and
+ * Yarn Berry (v2+) lockfiles: indentation-based maps and sequences, inline
+ * flow collections (`{ ... }` and `[ ... ]`) and single/double quoted scalars.
+ *
+ * It intentionally does NOT support anchors, aliases, block scalars (`|` / `>`),
+ * multi-document streams or complex keys. cra-audit ships with zero runtime
+ * dependencies, so this keeps us from pulling in a full YAML library just to
+ * read a lockfile.
+ *
+ * @param {string} text
+ * @returns {object|Array|null}
+ */
+function parseYaml(text) {
+  const lines = [];
+  for (const raw of String(text).split(/\r?\n/)) {
+    const withoutComment = stripComment(raw);
+    if (withoutComment.trim() === '') continue;
+    const trimmedLeft = withoutComment.replace(/^ +/, '');
+    const indent = withoutComment.length - trimmedLeft.length;
+    lines.push({ indent, content: trimmedLeft.replace(/\s+$/, '') });
+  }
+
+  const state = { lines, pos: 0 };
+  if (state.lines.length === 0) return {};
+  return parseNode(state, state.lines[0].indent);
+}
+
+/** Removes an unquoted `#` comment, preserving `#` inside quoted scalars. */
+function stripComment(line) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < line.length; i++) {
+    const ch = line[i];
+    if (ch === "'" && !inDouble) inSingle = !inSingle;
+    else if (ch === '"' && !inSingle) inDouble = !inDouble;
+    else if (ch === '#' && !inSingle && !inDouble && (i === 0 || /\s/.test(line[i - 1]))) {
+      return line.slice(0, i);
+    }
+  }
+  return line;
+}
+
+function parseNode(state, indent) {
+  const line = state.lines[state.pos];
+  if (line.content === '-' || line.content.startsWith('- ')) {
+    return parseSequence(state, indent);
+  }
+  return parseMap(state, indent);
+}
+
+function parseMap(state, indent) {
+  const map = {};
+  while (state.pos < state.lines.length) {
+    const line = state.lines[state.pos];
+    if (line.indent < indent) break;
+    if (line.indent > indent) { state.pos++; continue; }
+
+    const { key, rest } = splitKey(line.content);
+    if (key === null) { state.pos++; continue; }
+    state.pos++;
+
+    if (rest !== '') {
+      map[key] = parseScalarOrFlow(rest);
+    } else if (state.pos < state.lines.length && state.lines[state.pos].indent > indent) {
+      map[key] = parseNode(state, state.lines[state.pos].indent);
+    } else {
+      map[key] = null;
+    }
+  }
+  return map;
+}
+
+function parseSequence(state, indent) {
+  const arr = [];
+  while (state.pos < state.lines.length) {
+    const line = state.lines[state.pos];
+    if (line.indent < indent) break;
+    if (line.indent > indent) { state.pos++; continue; }
+    if (line.content !== '-' && !line.content.startsWith('- ')) break;
+
+    const after = line.content === '-' ? '' : line.content.slice(2);
+    state.pos++;
+    if (after === '') {
+      if (state.pos < state.lines.length && state.lines[state.pos].indent > indent) {
+        arr.push(parseNode(state, state.lines[state.pos].indent));
+      } else {
+        arr.push(null);
+      }
+    } else {
+      arr.push(parseScalarOrFlow(after));
+    }
+  }
+  return arr;
+}
+
+/** Splits `key: value` honoring quoted keys; returns { key, rest }. */
+function splitKey(content) {
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < content.length; i++) {
+    const ch = content[i];
+    if (ch === "'" && !inDouble) inSingle = !inSingle;
+    else if (ch === '"' && !inSingle) inDouble = !inDouble;
+    else if (ch === ':' && !inSingle && !inDouble) {
+      const next = content[i + 1];
+      if (next === undefined || next === ' ') {
+        return { key: unquote(content.slice(0, i).trim()), rest: content.slice(i + 1).trim() };
+      }
+    }
+  }
+  return { key: null, rest: '' };
+}
+
+function parseScalarOrFlow(str) {
+  const s = str.trim();
+  if (s.startsWith('{') || s.startsWith('[')) {
+    return parseFlow(s);
+  }
+  return parseScalar(s);
+}
+
+function parseScalar(s) {
+  if (s === '' || s === '~' || s === 'null') return null;
+  if (s === 'true') return true;
+  if (s === 'false') return false;
+  return unquote(s);
+}
+
+function unquote(s) {
+  const t = s.trim();
+  if (t.length >= 2) {
+    if (t[0] === '"' && t[t.length - 1] === '"') {
+      return t.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');
+    }
+    if (t[0] === "'" && t[t.length - 1] === "'") {
+      return t.slice(1, -1).replace(/''/g, "'");
+    }
+  }
+  return t;
+}
+
+/** Parses an inline flow collection: `{ a: b, c: [d, e] }`. */
+function parseFlow(s) {
+  const ctx = { s, i: 0 };
+  return parseFlowValue(ctx);
+}
+
+function parseFlowValue(ctx) {
+  skipWs(ctx);
+  const ch = ctx.s[ctx.i];
+  if (ch === '{') return parseFlowMap(ctx);
+  if (ch === '[') return parseFlowSeq(ctx);
+  return parseScalar(readFlowScalar(ctx));
+}
+
+function parseFlowMap(ctx) {
+  const map = {};
+  ctx.i++; // consume '{'
+  skipWs(ctx);
+  if (ctx.s[ctx.i] === '}') { ctx.i++; return map; }
+  while (ctx.i < ctx.s.length) {
+    skipWs(ctx);
+    const key = unquote(readFlowKey(ctx));
+    skipWs(ctx);
+    if (ctx.s[ctx.i] === ':') ctx.i++;
+    const value = parseFlowValue(ctx);
+    map[key] = value;
+    skipWs(ctx);
+    if (ctx.s[ctx.i] === ',') { ctx.i++; continue; }
+    if (ctx.s[ctx.i] === '}') { ctx.i++; break; }
+    break;
+  }
+  return map;
+}
+
+function parseFlowSeq(ctx) {
+  const arr = [];
+  ctx.i++; // consume '['
+  skipWs(ctx);
+  if (ctx.s[ctx.i] === ']') { ctx.i++; return arr; }
+  while (ctx.i < ctx.s.length) {
+    arr.push(parseFlowValue(ctx));
+    skipWs(ctx);
+    if (ctx.s[ctx.i] === ',') { ctx.i++; continue; }
+    if (ctx.s[ctx.i] === ']') { ctx.i++; break; }
+    break;
+  }
+  return arr;
+}
+
+function readFlowKey(ctx) {
+  return readUntil(ctx, [':', ',', '}']);
+}
+
+function readFlowScalar(ctx) {
+  return readUntil(ctx, [',', '}', ']']);
+}
+
+/** Reads a quoted or bare token until one of the stop characters at top level. */
+function readUntil(ctx, stops) {
+  skipWs(ctx);
+  const start = ctx.i;
+  const quote = ctx.s[ctx.i];
+  if (quote === '"' || quote === "'") {
+    ctx.i++;
+    while (ctx.i < ctx.s.length) {
+      const ch = ctx.s[ctx.i];
+      if (ch === '\\' && quote === '"') { ctx.i += 2; continue; }
+      if (ch === quote) { ctx.i++; break; }
+      ctx.i++;
+    }
+    return ctx.s.slice(start, ctx.i).trim();
+  }
+  while (ctx.i < ctx.s.length && !stops.includes(ctx.s[ctx.i])) ctx.i++;
+  return ctx.s.slice(start, ctx.i).trim();
+}
+
+function skipWs(ctx) {
+  while (ctx.i < ctx.s.length && /\s/.test(ctx.s[ctx.i])) ctx.i++;
+}
+
+module.exports = { parseYaml };