npq 3.2.1 → 3.2.3

package/__tests__/marshalls.provenance.test.js

@@ -196,7 +196,7 @@ describe('Provenance test suites', () => {
     // We assert that the validate method didn't throw an error,
     // because the keys match the signature
     await expect(testMarshall.validate(pkg)).rejects.toThrow(
-      'the package was published without any attestations. Proceed with care.'
+      'the package was published without any attestations.'
     )
 
     // Assert that the fetch method is called with the correct URL

package/__tests__/packageRepoUtils.test.js

@@ -136,3 +136,27 @@ test('repo utils parses package version', async () => {
   )
   expect(result).toBeTruthy()
 })
+
+test('repo utils returns valid semver for different cases of version asked', async () => {
+  const PackageRepoUtils = require('../lib/helpers/packageRepoUtils')
+  global.fetch = jest.fn().mockImplementation(() =>
+    Promise.resolve({
+      json: () => require('./mocks/registryPackageOk.mock.json')
+    })
+  )
+
+  const packageRepoUtils = new PackageRepoUtils()
+  const packageName = 'testPackage'
+
+  let result
+
+  result = await packageRepoUtils.getSemVer(packageName, 'latest')
+  expect(result).toEqual('3.1.0')
+
+  result = await packageRepoUtils.getSemVer(packageName, '3.1.0')
+  expect(result).toEqual('3.1.0')
+
+  await expect(packageRepoUtils.getSemVer(packageName, 'next')).rejects.toThrow(
+    'could not find dist-tag next for package testPackage'
+  )
+})

package/lib/helpers/packageRepoUtils.js

@@ -51,6 +51,28 @@ class PackageRepoUtils {
   parsePackageVersion(version) {
     return semver.coerce(version)
   }
+
+  async getSemVer(packageName, packageVersion) {
+    if (semver.valid(packageVersion)) {
+      return packageVersion
+    } else {
+      // this is probably an alias such as `latest` that we need to match
+      // via dist-tags:
+      const packageInfo = await this.getPackageInfo(packageName)
+
+      if (packageInfo['dist-tags'] === undefined) {
+        throw new Error(`could not find dist-tags for package ${packageName}`)
+      }
+
+      if (packageInfo['dist-tags'][packageVersion] === undefined) {
+        throw new Error(`could not find dist-tag ${packageVersion} for package ${packageName}`)
+      }
+
+      const semverVersion = packageInfo['dist-tags'][packageVersion]
+
+      return semverVersion
+    }
+  }
 }
 
 module.exports = PackageRepoUtils

package/lib/marshalls/author.marshall.js

@@ -34,9 +34,14 @@ class Marshall extends BaseMarshall {
     // published, date diff, etc into the package repo utils
     const pakument = await this.packageRepoUtils.getPackageInfo(pkg.packageName)
 
+    const packageVersion = await this.packageRepoUtils.getSemVer(
+      pkg.packageName,
+      pkg.packageVersion
+    )
+
     // @TODO fix to work for both explicit versions (1.0.0) and also
     // for dis-tags (latest)
-    const npmUser = pakument.versions[pkg.packageVersion]._npmUser
+    const npmUser = pakument.versions[packageVersion]._npmUser
     if (!npmUser || !npmUser.email) {
       throw new Error('could not determine publishing user for this package version')
     }
@@ -46,7 +51,7 @@ class Marshall extends BaseMarshall {
     }
 
     let firstVersionForUser = null
-    const versionPublishedDateString = pakument.time[pkg.packageVersion]
+    const versionPublishedDateString = pakument.time[packageVersion]
     for (const [version, versionMetadata] of Object.entries(pakument.versions)) {
       if (versionMetadata._npmUser && versionMetadata._npmUser.email === npmUser.email) {
         firstVersionForUser = versionMetadata
@@ -54,9 +59,9 @@ class Marshall extends BaseMarshall {
       }
     }
 
-    if (!firstVersionForUser || firstVersionForUser.version === pkg.packageVersion) {
+    if (!firstVersionForUser || firstVersionForUser.version === packageVersion) {
       throw new Error(
-        `The user ${npmUser.name} <${npmUser.email}> published this package for the first time only ${dateDiffInDays} days ago. Proceed with care.`
+        `This is first version the user ${npmUser.name} <${npmUser.email}> published this package`
       )
     }
 
@@ -70,7 +75,7 @@ class Marshall extends BaseMarshall {
 
     if (dateDiffInDays <= 30) {
       throw new Error(
-        `The user ${npmUser.name} <${npmUser.email}> published this package for the first time only ${dateDiffInDays} days ago. Proceed with care.`
+        `The user ${npmUser.name} <${npmUser.email}> published this package for the first time only ${dateDiffInDays} days ago.`
       )
     }
 

package/lib/marshalls/provenance.marshall.js

@@ -32,6 +32,10 @@ class Marshall extends BaseMarshall {
 
         validationMetadata.name = packageName
         validationMetadata.version = packageVersion
+
+        if (!validationMetadata.version) {
+          throw new Error('Unable to find version or dist-tag for package')
+        }
       })
       .then(() => {
         return this.fetchRegistryKeys()
@@ -48,15 +52,16 @@ class Marshall extends BaseMarshall {
       })
       .then((metadata) => {
         if (!metadata || !metadata._attestations) {
-          throw new Warning(
-            'the package was published without any attestations. Proceed with care.'
-          )
+          throw new Warning('the package was published without any attestations.')
         }
 
         const attestations = metadata._attestations
 
         return attestations
       })
+      .catch((error) => {
+        throw new Error(`Unable to verify provenance: ${error.message}`)
+      })
   }
 
   fetchRegistryKeys() {

package/lib/marshalls/signatures.marshall.js

@@ -32,6 +32,9 @@ class Marshall extends BaseMarshall {
       .then((metadata) => {
         return metadata
       })
+      .catch((error) => {
+        throw new Error(`Unable to grab package manifest: ${error.message}`)
+      })
   }
 
   fetchRegistryKeys() {

package/lib/{marshalls → marshallsDecomissioned}/readme.marshall.js

@@ -1,7 +1,7 @@
 'use strict'
 
-const BaseMarshall = require('./baseMarshall')
-const { marshallCategories } = require('./constants')
+const BaseMarshall = require('../marshalls/baseMarshall')
+const { marshallCategories } = require('../marshalls/constants')
 
 const MARSHALL_NAME = 'readme'
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npq",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "description": "marshall your npm/npm package installs with high quality and class 🎖",
   "bin": {
     "npq": "./bin/npq.js",