fad-checker 1.0.0

package/lib/cache-archive.js

@@ -0,0 +1,107 @@
+/**
+ * lib/cache-archive.js — export / import the entire ~/.fad-check/ directory.
+ *
+ * Use case:
+ *   - Move the warmed-up CVE/OSV/NVD/POM caches between machines
+ *   - Snapshot the index before a scheduled refresh
+ *   - Share a known-good cache with a teammate
+ *
+ * Format:
+ *   .tar.gz   — preferred when tar is available (Linux, macOS, Windows 10+)
+ *   .zip      — fallback for Windows-only envs without tar
+ *
+ * The format is selected from the file extension. Tar uses native `tar`
+ * binary (zero new deps).
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+const { execFile } = require("child_process");
+const { promisify } = require("util");
+const execFileP = promisify(execFile);
+
+const FAD_CACHE_DIR = path.join(os.homedir(), ".fad-check");
+
+/**
+ * Files inside ~/.fad-check/ that hold secrets and should NOT be shipped by default.
+ * Override by passing `includeConfig: true`.
+ */
+const SENSITIVE_FILES = ["config.json"];
+
+async function exportCache(destFile, opts = {}) {
+	const { verbose, includeConfig } = opts;
+	if (!fs.existsSync(FAD_CACHE_DIR)) throw new Error(`no ~/.fad-check/ directory to export`);
+	const abs = path.resolve(destFile);
+	fs.mkdirSync(path.dirname(abs), { recursive: true });
+
+	const excludes = includeConfig ? [] : SENSITIVE_FILES.map(f => `${path.basename(FAD_CACHE_DIR)}/${f}`);
+	if (excludes.length && verbose) console.log(`   excluding (use --include-config to keep): ${excludes.join(", ")}`);
+
+	const ext = abs.toLowerCase();
+	if (ext.endsWith(".tar.gz") || ext.endsWith(".tgz")) {
+		const args = ["-czf", abs];
+		for (const e of excludes) args.push(`--exclude=${e}`);
+		args.push("-C", path.dirname(FAD_CACHE_DIR), path.basename(FAD_CACHE_DIR));
+		if (verbose) console.log(`📦 tar ${args.join(" ")}`);
+		await execFileP("tar", args, { maxBuffer: 1024 * 1024 * 32 });
+	} else if (ext.endsWith(".zip")) {
+		if (process.platform === "win32") {
+			if (verbose) console.log(`📦 Compress-Archive -Path ${FAD_CACHE_DIR}\\* -DestinationPath ${abs}`);
+			// Powershell Compress-Archive doesn't have a clean exclude flag — manual copy
+			await execFileP("powershell", ["-NoProfile", "-Command",
+				`$src='${FAD_CACHE_DIR}'; $dst='${abs}'; ${includeConfig ? `Compress-Archive -Path "$src\\*" -DestinationPath $dst -Force` : `$tmp=Join-Path $env:TEMP "fad-check-stage-$(Get-Random)"; Copy-Item $src $tmp -Recurse; ${SENSITIVE_FILES.map(f => `Remove-Item -Force -ErrorAction SilentlyContinue (Join-Path $tmp '${f}')`).join("; ")}; Compress-Archive -Path "$tmp\\*" -DestinationPath $dst -Force; Remove-Item $tmp -Recurse -Force`}`]);
+		} else {
+			const args = ["-r", "-q", abs, path.basename(FAD_CACHE_DIR)];
+			for (const e of excludes) { args.push("-x"); args.push(e); }
+			if (verbose) console.log(`📦 zip ${args.join(" ")}`);
+			await execFileP("zip", args, { cwd: path.dirname(FAD_CACHE_DIR), maxBuffer: 1024 * 1024 * 32 });
+		}
+	} else {
+		throw new Error(`unknown archive extension on ${destFile} (expected .tar.gz, .tgz, or .zip)`);
+	}
+
+	const size = fs.statSync(abs).size;
+	return { path: abs, size, excluded: excludes };
+}
+
+async function importCache(srcFile, opts = {}) {
+	const { verbose, force } = opts;
+	const abs = path.resolve(srcFile);
+	if (!fs.existsSync(abs)) throw new Error(`archive not found: ${abs}`);
+
+	if (fs.existsSync(FAD_CACHE_DIR) && !force) {
+		// Move existing aside as .fad-check.bak-<timestamp>
+		const backup = `${FAD_CACHE_DIR}.bak-${Date.now()}`;
+		fs.renameSync(FAD_CACHE_DIR, backup);
+		if (verbose) console.log(`💾 existing ~/.fad-check/ moved to ${backup}`);
+	} else if (force && fs.existsSync(FAD_CACHE_DIR)) {
+		fs.rmSync(FAD_CACHE_DIR, { recursive: true, force: true });
+		if (verbose) console.log(`🗑  --force: existing ~/.fad-check/ removed`);
+	}
+
+	const parent = path.dirname(FAD_CACHE_DIR);
+	fs.mkdirSync(parent, { recursive: true });
+	const ext = abs.toLowerCase();
+	if (ext.endsWith(".tar.gz") || ext.endsWith(".tgz")) {
+		if (verbose) console.log(`📦 tar -xzf ${abs} -C ${parent}`);
+		await execFileP("tar", ["-xzf", abs, "-C", parent], { maxBuffer: 1024 * 1024 * 32 });
+	} else if (ext.endsWith(".zip")) {
+		if (process.platform === "win32") {
+			if (verbose) console.log(`📦 Expand-Archive -Path ${abs} -DestinationPath ${parent}`);
+			await execFileP("powershell", ["-NoProfile", "-Command",
+				`Expand-Archive -Path '${abs}' -DestinationPath '${parent}' -Force`]);
+		} else {
+			if (verbose) console.log(`📦 unzip ${abs} -d ${parent}`);
+			await execFileP("unzip", ["-o", "-q", abs, "-d", parent], { maxBuffer: 1024 * 1024 * 32 });
+		}
+	} else {
+		throw new Error(`unknown archive extension on ${srcFile}`);
+	}
+
+	if (!fs.existsSync(FAD_CACHE_DIR)) {
+		throw new Error(`import completed but ~/.fad-check/ was not created — was the archive built with fad-check --export-cache?`);
+	}
+	return { dir: FAD_CACHE_DIR };
+}
+
+module.exports = { exportCache, importCache, FAD_CACHE_DIR };

package/lib/config.js

@@ -0,0 +1,87 @@
+/**
+ * lib/config.js — persistent user config in ~/.fad-check/config.json
+ *
+ * Stores credentials and per-user preferences that should survive across runs.
+ * Currently: NVD API key (so users don't have to re-export the env var).
+ */
+const fs = require("fs");
+const path = require("path");
+const os = require("os");
+
+const CONFIG_DIR = path.join(os.homedir(), ".fad-check");
+const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
+
+function load() {
+	try { return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8")); }
+	catch { return {}; }
+}
+
+function save(cfg) {
+	fs.mkdirSync(CONFIG_DIR, { recursive: true });
+	// 0o600 so an API key isn't world-readable
+	fs.writeFileSync(CONFIG_PATH, JSON.stringify(cfg, null, 2), { mode: 0o600 });
+	try { fs.chmodSync(CONFIG_PATH, 0o600); } catch { /* ignore on platforms without chmod */ }
+}
+
+function set(key, value) {
+	const cfg = load();
+	if (value == null || value === "") delete cfg[key];
+	else cfg[key] = value;
+	save(cfg);
+	return cfg;
+}
+
+function get(key) {
+	return load()[key];
+}
+
+/** NVD API key resolution: env var first, then ~/.fad-check/config.json. */
+function getNvdApiKey() {
+	return process.env.NVD_API_KEY || get("nvd_api_key") || null;
+}
+
+/**
+ * Custom Maven repositories (Nexus, Artifactory, JBoss, …) the user has
+ * configured. Returned as an array of { name, url, auth? } where `auth` is
+ * pre-encoded "user:pass" (caller wraps as Basic <base64>).
+ *
+ * Maven Central is intentionally NOT included here — callers append it as
+ * the final fallback. That keeps the user's repos in priority order while
+ * always ensuring Central works as a safety net.
+ */
+function getMavenRepos() {
+	const list = get("maven_repos") || [];
+	return Array.isArray(list) ? list : [];
+}
+
+function setMavenRepos(list) {
+	return set("maven_repos", Array.isArray(list) && list.length ? list : null);
+}
+
+function addMavenRepo(name, url, auth = null) {
+	const list = getMavenRepos().filter(r => r.name !== name);
+	list.push({ name, url, ...(auth ? { auth } : {}) });
+	setMavenRepos(list);
+	return list;
+}
+
+function removeMavenRepo(name) {
+	const before = getMavenRepos();
+	const after = before.filter(r => r.name !== name);
+	setMavenRepos(after);
+	return before.length !== after.length;
+}
+
+module.exports = {
+	CONFIG_PATH,
+	CONFIG_DIR,
+	load,
+	save,
+	set,
+	get,
+	getNvdApiKey,
+	getMavenRepos,
+	setMavenRepos,
+	addMavenRepo,
+	removeMavenRepo,
+};

package/lib/core.js

@@ -0,0 +1,317 @@
+/**
+ * lib/core.js — pure logic for parsing and cleaning Maven POMs.
+ * No CLI, no console formatting. Callers pass options explicitly.
+ */
+const fs = require("fs");
+const path = require("path");
+const { parseStringPromise, Builder } = require("xml2js");
+
+const SKIP_DIRS = new Set([
+	"target", "node_modules", "bower_components", "jspm_packages",
+	".git", ".idea", ".vscode", ".gradle", ".mvn",
+	"dist", "build-output", "out", "coverage", ".next", ".nuxt",
+	// NOTE: "build" is intentionally NOT skipped — Maven multi-module projects
+	// sometimes use a "build/" module to hold a BOM or shared parent.
+]);
+
+const coord = v => (v == null ? null : String(v).trim() || null);
+
+function findPomFiles(dir) {
+	const out = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries;
+		try { entries = fs.readdirSync(cur, { withFileTypes: true }); }
+		catch { continue; }
+		for (const e of entries) {
+			if (e.isDirectory()) {
+				if (SKIP_DIRS.has(e.name)) continue;
+				stack.push(path.join(cur, e.name));
+			} else if (e.name === "pom.xml") {
+				out.push(path.join(cur, e.name));
+			}
+		}
+	}
+	return out;
+}
+
+function newMetadataStore() {
+	return {
+		byPath: {},
+		byId: {},
+		excludedById: {},
+		missingById: {},
+		anyMissingById: {},
+	};
+}
+
+async function parsePom(pomPath, allPomMetadata) {
+	const xml = fs.readFileSync(pomPath, "utf8");
+	// Skip POM templates that use literal `\${...}` placeholders.
+	if (/\\\$\{/g.test(xml)) return;
+
+	let json;
+	try { json = await parseStringPromise(xml); }
+	catch (e) { throw new Error(`xml parse failed: ${e.message}`); }
+
+	const project = json?.project || {};
+	const parent = project?.parent?.[0];
+	const parentInfo = parent ? {
+		groupId: coord(parent.groupId?.[0]),
+		artifactId: coord(parent.artifactId?.[0]),
+		version: coord(parent.version?.[0]),
+		relativePath: parent.relativePath?.[0],
+	} : null;
+
+	const groupId = coord(project.groupId?.[0]) || parentInfo?.groupId || null;
+	const artifactId = coord(project.artifactId?.[0]);
+	const version = coord(project.version?.[0]) || parentInfo?.version || null;
+
+	let profilesById = null;
+	let defaultProfileId = null;
+	if (project.profiles?.[0]?.profile) {
+		profilesById = {};
+		for (const profile of project.profiles[0].profile) {
+			if (!profile.id?.[0]) continue;
+			const hasContent = profile.properties?.[0] || profile.dependencyManagement?.[0] || profile.dependencies?.[0];
+			if (!hasContent) continue;
+			profilesById[profile.id[0]] = {
+				dependencyManagement: profile.dependencyManagement?.[0],
+				dependencies: profile.dependencies?.[0],
+				properties: profile.properties?.[0],
+			};
+			if (profile.activation?.[0]?.activeByDefault?.[0] === "true") {
+				defaultProfileId = profile.id[0];
+			}
+		}
+		if (Object.keys(profilesById).length === 0) profilesById = null;
+	}
+
+	const descr = {
+		dependencyManagement: project.dependencyManagement?.[0],
+		dependencies: project.dependencies?.[0],
+		pomPath,
+		properties: (project?.properties?.[0] && typeof project.properties[0] !== "string") ? project.properties[0] : {},
+		profilesById,
+		defaultProfileId,
+		parentInfo,
+		groupId,
+		artifactId,
+		version,
+		localVars: {
+			"project.groupId": groupId,
+			"project.artifactId": artifactId,
+			"project.version": version,
+		},
+	};
+
+	// Skip indexing by id if we don't have both groupId and artifactId — avoids
+	// "undefined:foo" lookup collisions across POMs.
+	if (groupId && artifactId) {
+		allPomMetadata.byId[`${groupId}:${artifactId}`] = descr;
+		if (version) allPomMetadata.byId[`${groupId}:${artifactId}:${version}`] = descr;
+	}
+	allPomMetadata.byPath[pomPath] = descr;
+	return descr;
+}
+
+function resolveParentPath(pomPath, parentInfo, allPomMetadata) {
+	const self = allPomMetadata.byPath[pomPath];
+	if (!parentInfo) return null;
+
+	if (parentInfo.relativePath != null && parentInfo.relativePath !== "") {
+		const rel = parentInfo.relativePath.trim();
+		let resolved = path.resolve(path.dirname(pomPath), rel);
+		if (fs.existsSync(resolved)) {
+			// Maven appends /pom.xml when relativePath points at a directory.
+			try {
+				if (fs.statSync(resolved).isDirectory()) resolved = path.join(resolved, "pom.xml");
+			} catch { /* ignore */ }
+			if (allPomMetadata.byPath[resolved]) {
+				self.parentDescr = allPomMetadata.byPath[resolved];
+				return resolved;
+			}
+		}
+	}
+
+	const keyV = `${parentInfo.groupId}:${parentInfo.artifactId}:${parentInfo.version}`;
+	const key = `${parentInfo.groupId}:${parentInfo.artifactId}`;
+	if (allPomMetadata.byId[keyV]) {
+		self.parentDescr = allPomMetadata.byId[keyV];
+		return self.parentDescr.pomPath;
+	}
+	if (allPomMetadata.byId[key]) {
+		self.parentDescr = allPomMetadata.byId[key];
+		return self.parentDescr.pomPath;
+	}
+	return null;
+}
+
+async function getAllInheritedProps(pomPath, allPomMetadata, cache) {
+	if (cache[pomPath]) return cache[pomPath];
+	const meta = allPomMetadata.byPath[pomPath];
+	if (!meta) return { properties: {}, dependencies: [], dependencyManagement: [] };
+
+	const { dependencyManagement, dependencies, properties, parentInfo, profilesById } = meta;
+
+	const merged = {
+		properties: { ...(properties || {}) },
+		dependencies: [...(dependencies?.dependency || [])],
+		dependencyManagement: [...(dependencyManagement?.dependencies?.[0]?.dependency || [])],
+	};
+
+	// Merge every profile so the scan covers any dep any profile could pull in.
+	if (profilesById) {
+		const ids = Object.keys(profilesById);
+		const ordered = meta.defaultProfileId
+			? [meta.defaultProfileId, ...ids.filter(id => id !== meta.defaultProfileId)]
+			: ids;
+		for (const id of ordered) {
+			const prof = profilesById[id];
+			if (prof.properties)
+				merged.properties = { ...prof.properties, ...merged.properties };
+			if (prof.dependencies?.dependency)
+				merged.dependencies.push(...prof.dependencies.dependency);
+			if (prof.dependencyManagement?.dependencies?.[0]?.dependency)
+				merged.dependencyManagement.push(...prof.dependencyManagement.dependencies[0].dependency);
+		}
+	}
+
+	// Resolve local BOM imports (scope=import) — pull their managed deps in.
+	const toImport = [];
+	const doImports = dep => {
+		if (dep.scope?.[0] !== "import") return;
+		const g = coord(dep.groupId?.[0]);
+		const a = coord(dep.artifactId?.[0]);
+		const v = coord(dep.version?.[0]);
+		if (!g || !a) return;
+		const local = (v && allPomMetadata.byId[`${g}:${a}:${v}`]) || allPomMetadata.byId[`${g}:${a}`];
+		if (local) toImport.push(local);
+	};
+	for (const dep of merged.dependencies) doImports(dep);
+	for (const dep of merged.dependencyManagement) doImports(dep);
+
+	for (const pom of toImport) {
+		const imported = await getAllInheritedProps(pom.pomPath, allPomMetadata, cache);
+		merged.properties = { ...merged.properties, ...imported.properties };
+		merged.dependencies.push(...imported.dependencies);
+		merged.dependencyManagement.push(...imported.dependencyManagement);
+	}
+
+	resolveParentPath(pomPath, parentInfo, allPomMetadata);
+
+	cache[pomPath] = merged;
+	return merged;
+}
+
+const NODES_TO_KEEP = new Set([
+	"groupId", "artifactId", "version", "packaging", "modules",
+	"properties", "dependencyManagement", "name", "dependencies",
+	"modelVersion", "$",
+]);
+
+async function rewritePoms(pomPath, allPomMetadata, allPropsByPom, opts) {
+	const { srcRoot, targetRoot, deps2Exclude, verbose, readOnly } = opts;
+	const descr = allPomMetadata.byPath[pomPath];
+	if (!descr) return false;
+
+	const xmlData = fs.readFileSync(pomPath, "utf8").replace("", "");
+	const tPom = readOnly ? null : path.join(targetRoot, path.relative(srcRoot, pomPath));
+
+	let json;
+	try { json = await parseStringPromise(xmlData); }
+	catch (e) { throw new Error(`xml parse failed: ${e.message}`); }
+
+	const props = json.project || {};
+	const keep = new Set(NODES_TO_KEEP);
+
+	// Re-resolve parent if first pass missed it.
+	if (!descr.parentDescr && descr.parentInfo) {
+		const p = descr.parentInfo;
+		descr.parentDescr =
+			allPomMetadata.byId[`${p.groupId}:${p.artifactId}:${p.version}`] ||
+			allPomMetadata.byId[`${p.groupId}:${p.artifactId}`];
+	}
+
+	if (!descr.parentDescr && descr.parentInfo) {
+		const p = descr.parentInfo;
+		const isExcluded = deps2Exclude && deps2Exclude.test(p.groupId || "");
+		allPomMetadata.missingById[`${p.groupId}:${p.artifactId}`] = true;
+		allPomMetadata.missingById[`${p.groupId}:${p.artifactId}:${p.version}`] = true;
+		if (!isExcluded) {
+			allPomMetadata.anyMissingById[`${p.groupId}:${p.artifactId}`] = true;
+			allPomMetadata.anyMissingById[`${p.groupId}:${p.artifactId}:${p.version}`] = true;
+			keep.add("parent");
+			if (verbose) console.warn(`⚠️  parent not found locally for ${pomPath} → ${p.groupId}:${p.artifactId}:${p.version} (will be treated as public)`);
+		} else if (verbose) {
+			console.warn(`⚠️⚠️  excluded parent for ${pomPath} → ${p.groupId}:${p.artifactId}:${p.version} (snyk may fail)`);
+		}
+	} else if (descr.parentDescr) {
+		keep.add("parent");
+		const pd = descr.parentDescr;
+		props.parent[0].relativePath = [path.relative(path.dirname(pomPath), path.dirname(pd.pomPath))];
+		if (pd.version) props.parent[0].version = [pd.version];
+	}
+
+	for (const k of Object.keys(props)) {
+		if (!keep.has(k)) delete props[k];
+	}
+
+	const cleanDeps = list =>
+		list?.filter(dep => {
+			const g = coord(dep.groupId?.[0]);
+			const a = coord(dep.artifactId?.[0]);
+			const v = coord(dep.version?.[0]);
+			if (!g || !a) return false;
+			if (deps2Exclude) {
+				// Versionless deps inside dependencyManagement-merged result are
+				// often resolvable via a managed parent — keep them unless we
+				// can prove they're excluded.
+				if (deps2Exclude.test(g)) {
+					const local = (v && allPomMetadata.byId[`${g}:${a}:${v}`]) || allPomMetadata.byId[`${g}:${a}`];
+					if (local && dep.scope?.[0] === "import") {
+						dep.systemPath = [path.resolve(local.pomPath)];
+						return false;
+					}
+					if (!local && dep.scope?.[0] === "import" && verbose) {
+						console.warn(`⚠️  excluded import-scope BOM in ${pomPath}: ${g}:${a}:${v}`);
+					}
+					allPomMetadata.excludedById[`${g}:${a}`] = true;
+					if (v) allPomMetadata.excludedById[`${g}:${a}:${v}`] = true;
+					return false;
+				}
+				allPomMetadata.anyMissingById[`${g}:${a}`] = true;
+				if (v) allPomMetadata.anyMissingById[`${g}:${a}:${v}`] = true;
+				return true;
+			}
+			allPomMetadata.anyMissingById[`${g}:${a}`] = true;
+			if (v) allPomMetadata.anyMissingById[`${g}:${a}:${v}`] = true;
+			return true;
+		});
+
+	const propsForPom = allPropsByPom[pomPath] || { properties: {}, dependencies: [], dependencyManagement: [] };
+
+	if (props.dependencies?.[0]?.dependency)
+		props.dependencies[0].dependency = cleanDeps(propsForPom.dependencies);
+	if (props.dependencyManagement?.[0]?.dependencies?.[0]?.dependency)
+		props.dependencyManagement[0].dependencies[0].dependency = cleanDeps(propsForPom.dependencyManagement);
+	props.properties = [propsForPom.properties];
+
+	if (!readOnly) {
+		await fs.promises.mkdir(path.dirname(tPom), { recursive: true });
+		const builder = new Builder();
+		fs.writeFileSync(tPom, builder.buildObject(json));
+	}
+	return true;
+}
+
+module.exports = {
+	coord,
+	findPomFiles,
+	newMetadataStore,
+	parsePom,
+	resolveParentPath,
+	getAllInheritedProps,
+	rewritePoms,
+};