snyk 1.1032.0 → 1.1034.0

package/dist/cli/917.index.js

@@ -1375,6 +1375,8 @@ function formatScanResult(scanResult, meta, options, projectRoot) {
             ...meta,
             projectId: '',
             policy: '',
+            isPrivate: true,
+            isLicensesEnabled: false,
         },
         filesystemPolicy: false,
         vulnerabilities: [],
@@ -2343,22 +2345,13 @@ const config_1 = __webpack_require__(25425);
 const output_1 = __webpack_require__(39313);
 const text_1 = __webpack_require__(86166);
 const output_2 = __webpack_require__(99687);
-const get_iac_org_settings_1 = __webpack_require__(11693);
-const monitor_1 = __webpack_require__(3708);
-const local_execution_1 = __webpack_require__(89627);
 const scan_1 = __webpack_require__(50277);
 const index_1 = __webpack_require__(55935);
 const policy_1 = __webpack_require__(32615);
 const assert_iac_options_1 = __webpack_require__(15335);
-const unsupported_entitlement_error_1 = __webpack_require__(78673);
 async function test(paths, options) {
-    var _a;
     assert_iac_options_1.assertIacV2Options(options);
     const testConfig = await prepareTestConfig(paths, options);
-    const { orgSettings } = testConfig;
-    if (!((_a = orgSettings.entitlements) === null || _a === void 0 ? void 0 : _a.infrastructureAsCode)) {
-        throw new unsupported_entitlement_error_1.UnsupportedEntitlementError('infrastructureAsCode');
-    }
     const testSpinner = output_1.buildSpinner(options);
     output_1.printHeader(options);
     testSpinner === null || testSpinner === void 0 ? void 0 : testSpinner.start(text_1.spinnerMessage);
@@ -2367,7 +2360,6 @@ async function test(paths, options) {
         return output_2.buildOutput({
             scanResult,
             testSpinner,
-            orgSettings,
             options,
         });
     }
@@ -2380,12 +2372,9 @@ async function prepareTestConfig(paths, options) {
     var _a;
     const iacCachePath = pathLib.join(scan_1.systemCachePath, 'iac');
     const org = options.org || config_1.default.org;
-    const orgSettings = await get_iac_org_settings_1.getIacOrgSettings(org);
-    const projectTags = local_execution_1.parseTags(options);
     const targetName = index_1.getFlag(options, 'target-name');
     const remoteRepoUrl = index_1.getFlag(options, 'remote-repo-url');
     const depthDetection = parseInt(index_1.getFlag(options, 'depth-detection')) || undefined;
-    const attributes = parseAttributes(options);
     const policy = await policy_1.findAndLoadPolicy(process.cwd(), 'iac', options);
     const scan = (_a = options.scan) !== null && _a !== void 0 ? _a : 'resource-changes';
     const varFile = options['var-file'];
@@ -2394,13 +2383,10 @@ async function prepareTestConfig(paths, options) {
     return {
         paths,
         iacCachePath,
-        orgSettings,
         userRulesBundlePath: config_1.default.IAC_BUNDLE_PATH,
         userPolicyEnginePath: config_1.default.IAC_POLICY_ENGINE_PATH,
         severityThreshold: options.severityThreshold,
         report: !!options.report,
-        attributes,
-        projectTags,
         targetReference: options['target-reference'],
         targetName,
         remoteRepoUrl,
@@ -2410,13 +2396,9 @@ async function prepareTestConfig(paths, options) {
         depthDetection,
         cloudContext,
         insecure,
+        org,
     };
 }
-function parseAttributes(options) {
-    if (options.report) {
-        return monitor_1.generateProjectAttributes(options);
-    }
-}
 
 
 /***/ }),
@@ -4563,7 +4545,7 @@ exports.convertEngineToJsonResults = void 0;
 const path = __webpack_require__(85622);
 const format_test_results_1 = __webpack_require__(59744);
 const constants_1 = __webpack_require__(68620);
-function convertEngineToJsonResults({ results, projectName, orgSettings, }) {
+function convertEngineToJsonResults({ results, projectName, }) {
     const vulnerabilityGroups = groupVulnerabilitiesByFile(results); // all vulns groups by file
     const resourceGroups = groupResourcesByFile(results); // all resources grouped by file
     const filesWithoutIssues = findFilesWithoutIssues(resourceGroups, vulnerabilityGroups); // all resources without issues grouped by file
@@ -4572,10 +4554,10 @@ function convertEngineToJsonResults({ results, projectName, orgSettings, }) {
         output.push(...format_test_results_1.createErrorMappedResultsForJsonOutput(results.errors));
     }
     for (const [file, resources] of Object.entries(filesWithoutIssues)) {
-        output.push(resourcesToResult(orgSettings, projectName, file, resources));
+        output.push(resourcesToResult(results, projectName, file, resources));
     }
     for (const [file, vulnerabilities] of Object.entries(vulnerabilityGroups)) {
-        output.push(vulnerabilitiesToResult(orgSettings, projectName, file, vulnerabilities));
+        output.push(vulnerabilitiesToResult(results, projectName, file, vulnerabilities));
     }
     return output;
 }
@@ -4617,11 +4599,10 @@ function findFilesWithoutIssues(resourceGroups, vulnerabilityGroups) {
     }
     return groups;
 }
-function resourcesToResult(orgSettings, projectName, file, resources) {
+function resourcesToResult(testOutput, projectName, file, resources) {
     const kind = resourcesToKind(resources);
-    const ignoreSettings = orgSettingsToIgnoreSettings(orgSettings);
-    const meta = orgSettingsToMeta(orgSettings, ignoreSettings);
-    const { meta: { org, isPrivate, policy }, } = orgSettings;
+    const ignoreSettings = testOutput.settings.ignoreSettings;
+    const meta = orgSettingsToMeta(testOutput, ignoreSettings);
     return {
         meta,
         filesystemPolicy: false,
@@ -4631,9 +4612,9 @@ function resourcesToResult(orgSettings, projectName, file, resources) {
         ignoreSettings,
         targetFile: file,
         projectName,
-        org,
-        policy: policy || '',
-        isPrivate,
+        org: testOutput.settings.org,
+        policy: '',
+        isPrivate: true,
         targetFilePath: path.resolve(file),
         packageManager: kind,
         path: process.cwd(),
@@ -4642,12 +4623,11 @@ function resourcesToResult(orgSettings, projectName, file, resources) {
         infrastructureAsCodeIssues: [],
     };
 }
-function vulnerabilitiesToResult(orgSettings, projectName, file, vulnerabilities) {
+function vulnerabilitiesToResult(testOutput, projectName, file, vulnerabilities) {
     const kind = vulnerabilitiesToKind(vulnerabilities);
-    const ignoreSettings = orgSettingsToIgnoreSettings(orgSettings);
-    const meta = orgSettingsToMeta(orgSettings, ignoreSettings);
+    const ignoreSettings = testOutput.settings.ignoreSettings;
+    const meta = orgSettingsToMeta(testOutput, ignoreSettings);
     const infrastructureAsCodeIssues = vulnerabilitiesToIacIssues(vulnerabilities);
-    const { meta: { org, isPrivate, policy }, } = orgSettings;
     return {
         meta,
         filesystemPolicy: false,
@@ -4657,9 +4637,9 @@ function vulnerabilitiesToResult(orgSettings, projectName, file, vulnerabilities
         ignoreSettings,
         targetFile: file,
         projectName,
-        org,
-        policy: policy || '',
-        isPrivate,
+        org: testOutput.settings.org,
+        policy: '',
+        isPrivate: true,
         targetFilePath: path.resolve(file),
         packageManager: kind,
         path: process.cwd(),
@@ -4720,24 +4700,16 @@ function vulnerabilitiesToKind(vulnerabilities) {
     }
     return '';
 }
-function orgSettingsToMeta(orgSettings, ignoreSettings) {
-    const { meta: { isPrivate, isLicensesEnabled, org, policy }, } = orgSettings;
+function orgSettingsToMeta(testOutput, ignoreSettings) {
+    const org = testOutput.settings.org;
     return {
-        isPrivate,
-        isLicensesEnabled,
+        isPrivate: true,
+        isLicensesEnabled: false,
         org,
-        policy: policy || '',
+        policy: '',
         ignoreSettings,
     };
 }
-function orgSettingsToIgnoreSettings(orgSettings) {
-    const { meta: { ignoreSettings }, } = orgSettings;
-    return {
-        adminOnly: (ignoreSettings === null || ignoreSettings === void 0 ? void 0 : ignoreSettings.adminOnly) || false,
-        reasonRequired: (ignoreSettings === null || ignoreSettings === void 0 ? void 0 : ignoreSettings.reasonRequired) || false,
-        disregardFilesystemIgnores: (ignoreSettings === null || ignoreSettings === void 0 ? void 0 : ignoreSettings.disregardFilesystemIgnores) || false,
-    };
-}
 
 
 /***/ }),
@@ -4800,12 +4772,12 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getChecksum = exports.formatPolicyEngineFileName = exports.policyEngineVersion = void 0;
 const os = __webpack_require__(12087);
 const policyEngineChecksums = `
-06f0840a1429e0f2ebbd96e6d08a8e9c8a9c6184ff6172d3e7e1df4651540c8f  snyk-iac-test_0.33.3_Darwin_arm64
-28197818fb18cf07138733170008853f605596e4cb01b9dd5d8729dec21ad820  snyk-iac-test_0.33.3_Linux_x86_64
-364d196b1ec6cd866c2116cf2a0998fd75ed6981d2b338b4d0dc43d3c18ea9d1  snyk-iac-test_0.33.3_Windows_x86_64.exe
-57714bec7ca5cc141ff2aae3b692b70a81f32b026d1b81f23bd68bc39d57be71  snyk-iac-test_0.33.3_Darwin_x86_64
-8dd58fda7f864939b97f0d00246bd4915b9054f271e14bfa93b292ffdc6e9f34  snyk-iac-test_0.33.3_Linux_arm64
-d62e2dd1d51e3a1d75e62d7eb76820b5be146d49f449dc6c47c4edae11b5f219  snyk-iac-test_0.33.3_Windows_arm64.exe
+289368b4e85d455c619b7f25e1680ca520e61f0bd727a02b55adeff85980ee57  snyk-iac-test_0.33.5_Linux_arm64
+51092d8e7bb51a0b7323f5e8f072d9f6690e2cc81561eba0615e847f68f00731  snyk-iac-test_0.33.5_Linux_x86_64
+6836d69eb527cf9ae8d87327278624ca3a487afff86da5a87c81d4a1a8785ce9  snyk-iac-test_0.33.5_Darwin_arm64
+83740d8b61000b986a6092188897b98dbeea634c64840c8beaaf9199f7055b68  snyk-iac-test_0.33.5_Darwin_x86_64
+bdc42a135e8319768841f56f0985722a7aabdc8c6259b9e426dc55efc37ecf61  snyk-iac-test_0.33.5_Windows_x86_64.exe
+cb34a3e8aaddebe2e2ba01c62c042723f832c686626cad1e15e296b7a0c0106c  snyk-iac-test_0.33.5_Windows_arm64.exe
 `;
 exports.policyEngineVersion = getPolicyEngineVersion();
 function formatPolicyEngineFileName(releaseVersion) {
@@ -5220,7 +5192,7 @@ const error_utils_1 = __webpack_require__(36401);
 const output_1 = __webpack_require__(39313);
 const utils_1 = __webpack_require__(9176);
 const wrapAnsi = __webpack_require__(88152);
-function buildOutput({ scanResult, testSpinner, orgSettings, options, }) {
+function buildOutput({ scanResult, testSpinner, options, }) {
     if (scanResult.results) {
         testSpinner === null || testSpinner === void 0 ? void 0 : testSpinner.succeed(text_1.spinnerSuccessMessage);
     }
@@ -5229,7 +5201,6 @@ function buildOutput({ scanResult, testSpinner, orgSettings, options, }) {
     }
     const { responseData, jsonData, sarifData } = buildTestCommandResultData({
         scanResult,
-        orgSettings,
         options,
     });
     if (options.json || options.sarif) {
@@ -5238,13 +5209,12 @@ function buildOutput({ scanResult, testSpinner, orgSettings, options, }) {
     return types_1.TestCommandResult.createHumanReadableTestCommandResult(responseData, jsonData, sarifData);
 }
 exports.buildOutput = buildOutput;
-function buildTestCommandResultData({ scanResult, orgSettings, options, }) {
+function buildTestCommandResultData({ scanResult, options, }) {
     var _a, _b, _c, _d, _e;
     const projectName = (_c = (_b = (_a = scanResult.results) === null || _a === void 0 ? void 0 : _a.metadata) === null || _b === void 0 ? void 0 : _b.projectName) !== null && _c !== void 0 ? _c : path.basename(process.cwd());
     const jsonData = json_2.jsonStringifyLargeObject(json_1.convertEngineToJsonResults({
         results: scanResult,
         projectName,
-        orgSettings,
     }));
     const sarifData = json_2.jsonStringifyLargeObject(sarif_1.convertEngineToSarifResults(scanResult));
     assertHasSuccessfulScans(scanResult, { json: jsonData, sarif: sarifData }, options);
@@ -5259,7 +5229,6 @@ function buildTestCommandResultData({ scanResult, orgSettings, options, }) {
         responseData = buildTextOutput({
             scanResult,
             projectName,
-            orgSettings,
             options,
         });
     }
@@ -5274,9 +5243,9 @@ function buildTestCommandResultData({ scanResult, orgSettings, options, }) {
     return { responseData, jsonData, sarifData };
 }
 const SEPARATOR = '\n-------------------------------------------------------\n';
-function buildTextOutput({ scanResult, projectName, orgSettings, options, }) {
+function buildTextOutput({ scanResult, projectName, options, }) {
     let response = '';
-    const testData = text_1.formatSnykIacTestTestData(scanResult.results, projectName, orgSettings.meta.org);
+    const testData = text_1.formatSnykIacTestTestData(scanResult.results, projectName, scanResult.settings.org);
     response +=
         os_1.EOL +
             text_1.getIacDisplayedIssues(testData.resultsBySeverity, {
@@ -5296,7 +5265,7 @@ function buildTextOutput({ scanResult, projectName, orgSettings, options, }) {
     response += os_1.EOL;
     if (options.report) {
         response += output_1.buildShareResultsSummaryV2({
-            orgName: orgSettings.meta.org,
+            orgName: scanResult.settings.org,
             projectName,
             options,
             isIacCustomRulesEntitlementEnabled: false,
@@ -5310,7 +5279,7 @@ function buildTextOutput({ scanResult, projectName, orgSettings, options, }) {
     response += os_1.EOL;
     response += utils_1.colors.title('Info') + os_1.EOL;
     response += os_1.EOL;
-    response += wrapWithPadding(infoMessage(orgSettings), 80) + os_1.EOL;
+    response += wrapWithPadding(infoMessage(scanResult), 80) + os_1.EOL;
     return response;
 }
 function wrapWithPadding(s, columns) {
@@ -5320,7 +5289,7 @@ function wrapWithPadding(s, columns) {
         .join('\n');
 }
 function infoMessage(orgSettings) {
-    return `Your organization ${orgSettings.meta.org} is using Integrated IaC. To switch to Current IaC, use --org=<ORG_ID> to select a different organization. For more information about Integrated IaC, see https://snyk.co/integrated-iac.`;
+    return `Your organization ${orgSettings.settings.org} is using Integrated IaC. To switch to Current IaC, use --org=<ORG_ID> to select a different organization. For more information about Integrated IaC, see https://snyk.co/integrated-iac.`;
 }
 function assertHasSuccessfulScans(scanResult, responseData, options) {
     var _a, _b, _c;
@@ -5586,29 +5555,33 @@ const env_paths_1 = __webpack_require__(21766);
 const debug = newDebug('snyk-iac');
 exports.systemCachePath = (_a = config_1.default.CACHE_PATH) !== null && _a !== void 0 ? _a : env_paths_1.default('snyk').cache;
 function scan(options, policyEnginePath, rulesBundlePath) {
-    const { tempConfig: configPath, tempOutput: outputPath, tempDir: tempDirPath, } = createTemporaryFiles(options);
+    const { tempOutput: outputPath, tempDir: tempDirPath, tempPolicy: tempPolicyPath, } = createTemporaryFiles(options);
     try {
-        return scanWithConfig(options, policyEnginePath, rulesBundlePath, configPath, outputPath);
+        return scanWithConfig(options, policyEnginePath, rulesBundlePath, outputPath, tempPolicyPath);
     }
     finally {
         deleteTemporaryFiles(tempDirPath);
     }
 }
 exports.scan = scan;
-function scanWithConfig(options, policyEnginePath, rulesBundlePath, configPath, outputPath) {
-    const args = processFlags(options, rulesBundlePath, configPath, outputPath);
+function scanWithConfig(options, policyEnginePath, rulesBundlePath, outputPath, policyPath) {
+    const env = { ...process.env };
+    env['SNYK_API_URL'] = getApiUrl();
+    env['SNYK_API_TOKEN'] = getApiToken();
+    const args = processFlags(options, rulesBundlePath, outputPath, policyPath);
     args.push(...options.paths);
-    const process = childProcess.spawnSync(policyEnginePath, args, {
+    const child = childProcess.spawnSync(policyEnginePath, args, {
         encoding: 'utf-8',
         stdio: 'pipe',
+        env: env,
         maxBuffer: 1024 * 1024 * 10,
     });
-    debug('policy engine standard error:\n%s', '\n' + process.stderr);
-    if (process.status && process.status !== 0) {
-        throw new ScanError(`invalid exit status: ${process.status}`);
+    debug('policy engine standard error:\n%s', '\n' + child.stderr);
+    if (child.status && child.status !== 0) {
+        throw new ScanError(`invalid exit status: ${child.status}`);
     }
-    if (process.error) {
-        throw new ScanError(`spawning process: ${process.error}`);
+    if (child.error) {
+        throw new ScanError(`spawning process: ${child.error}`);
     }
     let snykIacTestOutput, parsedSnykIacTestOutput;
     try {
@@ -5620,41 +5593,23 @@ function scanWithConfig(options, policyEnginePath, rulesBundlePath, configPath,
     }
     return results_1.mapSnykIacTestOutputToTestOutput(parsedSnykIacTestOutput);
 }
-function processFlags(options, rulesBundlePath, configPath, outputPath) {
-    var _a, _b, _c;
+function processFlags(options, rulesBundlePath, outputPath, policyPath) {
     const flags = [
         '-cache-dir',
         exports.systemCachePath,
         '-bundle',
         rulesBundlePath,
-        '-config',
-        configPath,
+        '-policy',
+        policyPath,
     ];
     flags.push('-output', outputPath);
     if (options.severityThreshold) {
         flags.push('-severity-threshold', options.severityThreshold);
     }
-    if ((_a = options.attributes) === null || _a === void 0 ? void 0 : _a.criticality) {
-        flags.push('-project-business-criticality', options.attributes.criticality.join(','));
-    }
-    if ((_b = options.attributes) === null || _b === void 0 ? void 0 : _b.environment) {
-        flags.push('-project-environment', options.attributes.environment.join(','));
-    }
-    if ((_c = options.attributes) === null || _c === void 0 ? void 0 : _c.lifecycle) {
-        flags.push('-project-lifecycle', options.attributes.lifecycle.join(','));
-    }
     if (options.depthDetection) {
         flags.push('-depth-detection', `${options.depthDetection}`);
     }
-    if (options.projectTags) {
-        const stringifiedTags = options.projectTags
-            .map((tag) => {
-            return `${tag.key}=${tag.value}`;
-        })
-            .join(',');
-        flags.push('-project-tags', stringifiedTags);
-    }
-    if (options.report) {
+    if (options.report && analytics_1.allowAnalytics()) {
         flags.push('-report');
     }
     if (options.targetReference) {
@@ -5678,25 +5633,19 @@ function processFlags(options, rulesBundlePath, configPath, outputPath) {
     if (options.insecure) {
         flags.push('-http-tls-skip-verify');
     }
+    if (options.org) {
+        flags.push('-org', options.org);
+    }
     return flags;
 }
 function createTemporaryFiles(options) {
     try {
         const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'snyk-'));
-        const tempConfig = path.join(tempDir, 'config.json');
         const tempOutput = path.join(tempDir, 'output.json');
-        const configData = JSON.stringify({
-            org: options.orgSettings.meta.org,
-            orgPublicId: options.orgSettings.meta.orgPublicId,
-            apiUrl: getApiUrl(),
-            apiAuth: api_token_1.getAuthHeader(),
-            allowAnalytics: analytics_1.allowAnalytics(),
-            policy: options.policy,
-            customSeverities: options.orgSettings.customPolicies,
-        });
-        fs.writeFileSync(tempConfig, configData);
+        const tempPolicy = path.join(tempDir, '.snyk');
         fs.writeFileSync(tempOutput, '');
-        return { tempConfig, tempOutput, tempDir };
+        fs.writeFileSync(tempPolicy, options.policy || '');
+        return { tempOutput, tempDir, tempPolicy };
     }
     catch (e) {
         throw new ScanError(`unable to create config/output file: ${e}`);
@@ -5711,9 +5660,10 @@ function deleteTemporaryFiles(tempDirPath) {
     }
 }
 function getApiUrl() {
-    const apiUrl = new URL(config_1.default.API_REST_URL);
-    apiUrl.pathname = '';
-    return apiUrl.toString();
+    return config_1.default.API_REST_URL;
+}
+function getApiToken() {
+    return api_token_1.api() || '';
 }
 class ScanError extends errors_1.CustomError {
     constructor(message) {
@@ -5735,15 +5685,27 @@ class ScanError extends errors_1.CustomError {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.mapSnykIacTestOutputToTestOutput = void 0;
 const errors_1 = __webpack_require__(87198);
+const types_1 = __webpack_require__(94820);
+const unsupported_entitlement_error_1 = __webpack_require__(78673);
+const get_iac_org_settings_1 = __webpack_require__(11693);
 function mapSnykIacTestOutputToTestOutput(snykIacOutput) {
-    var _a;
-    const errors = (_a = snykIacOutput.errors) === null || _a === void 0 ? void 0 : _a.map((err) => new errors_1.SnykIacTestError(err));
+    var _a, _b, _c, _d;
+    const entitlementError = (_a = snykIacOutput.errors) === null || _a === void 0 ? void 0 : _a.find((err) => err.code === types_1.IaCErrorCodes.EntitlementNotEnabled);
+    if (entitlementError) {
+        throw new unsupported_entitlement_error_1.UnsupportedEntitlementError(((_b = entitlementError === null || entitlementError === void 0 ? void 0 : entitlementError.fields) === null || _b === void 0 ? void 0 : _b.entitlement) || '');
+    }
+    const readSettingsError = (_c = snykIacOutput.errors) === null || _c === void 0 ? void 0 : _c.find((err) => err.code === types_1.IaCErrorCodes.ReadSettings);
+    if (readSettingsError) {
+        throw new get_iac_org_settings_1.FailedToGetIacOrgSettingsError();
+    }
+    const errors = (_d = snykIacOutput.errors) === null || _d === void 0 ? void 0 : _d.map((err) => new errors_1.SnykIacTestError(err));
     const errWithoutPath = errors === null || errors === void 0 ? void 0 : errors.find((err) => { var _a; return !((_a = err.fields) === null || _a === void 0 ? void 0 : _a.path); });
     if (errWithoutPath) {
         throw errWithoutPath;
     }
     return {
         results: snykIacOutput.results,
+        settings: snykIacOutput.settings,
         errors,
     };
 }