snyk 1.754.0 → 1.758.0

package/dist/cli/917.index.js

@@ -112,7 +112,7 @@ exports.performanceAnalyticsObject = {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.assertIaCOptionsFlags = exports.FlagValueError = exports.FlagError = void 0;
+exports.assertIaCOptionsFlags = exports.UnsupportedEntitlementFlagError = exports.FlagValueError = exports.FlagError = void 0;
 const errors_1 = __webpack_require__(55191);
 const args_1 = __webpack_require__(94765);
 const error_utils_1 = __webpack_require__(23872);
@@ -177,6 +177,16 @@ class FlagValueError extends errors_1.CustomError {
     }
 }
 exports.FlagValueError = FlagValueError;
+class UnsupportedEntitlementFlagError extends errors_1.CustomError {
+    constructor(key, entitlementName) {
+        const flag = getFlagName(key);
+        super(`Unsupported flag: ${flag} - Missing the ${entitlementName} entitlement`);
+        this.code = types_1.IaCErrorCodes.UnsupportedEntitlementFlagError;
+        this.strCode = error_utils_1.getErrorStringCode(this.code);
+        this.userMessage = `Flag "${flag}" is currently not supported for this org. To enable it, please contact snyk support.`;
+    }
+}
+exports.UnsupportedEntitlementFlagError = UnsupportedEntitlementFlagError;
 /**
  * Validates the command line flags passed to the snyk iac test
  * command. The current argument parsing is very permissive and
@@ -655,7 +665,7 @@ exports.computeCustomRulesBundleChecksum = computeCustomRulesBundleChecksum;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.FailedToExecuteCustomRulesError = exports.FailedToPullCustomBundleError = exports.isValidURL = exports.removeFileContent = exports.test = void 0;
+exports.FailedToExecuteCustomRulesError = exports.FailedToPullCustomBundleError = exports.pullIaCCustomRules = exports.isValidURL = exports.removeFileContent = exports.test = void 0;
 const detect_1 = __webpack_require__(45318);
 const types_1 = __webpack_require__(42258);
 const analytics_1 = __webpack_require__(22716);
@@ -664,63 +674,32 @@ const policy_1 = __webpack_require__(25476);
 const measurable_methods_1 = __webpack_require__(78272);
 const feature_flags_1 = __webpack_require__(63011);
 const assert_iac_options_flag_1 = __webpack_require__(68590);
+const user_config_1 = __webpack_require__(28137);
 const config_1 = __webpack_require__(22541);
 const policy_2 = __webpack_require__(32615);
 const errors_1 = __webpack_require__(55191);
 const error_utils_1 = __webpack_require__(23872);
 const oci_pull_1 = __webpack_require__(5029);
+const unsupported_entitlement_error_1 = __webpack_require__(78673);
 // this method executes the local processing engine and then formats the results to adapt with the CLI output.
 // this flow is the default GA flow for IAC scanning.
 async function test(pathToScan, options) {
-    var _a, _b, _c;
+    var _a;
     try {
-        const org = (_a = options.org) !== null && _a !== void 0 ? _a : config_1.default.org;
-        const iacOrgSettings = await measurable_methods_1.getIacOrgSettings(org);
-        const customRulesPath = await customRulesPathForOrg(options.rules, org);
-        const OCIRegistryURL = (((_b = iacOrgSettings.customRules) === null || _b === void 0 ? void 0 : _b.isEnabled) && ((_c = iacOrgSettings.customRules) === null || _c === void 0 ? void 0 : _c.ociRegistryURL)) ||
-            process.env.OCI_REGISTRY_URL;
-        if (OCIRegistryURL && customRulesPath) {
+        let customRulesPath;
+        const orgPublicId = (_a = options.org) !== null && _a !== void 0 ? _a : config_1.default.org;
+        const iacOrgSettings = await measurable_methods_1.getIacOrgSettings(orgPublicId);
+        if (options.rules) {
+            await assertRulesFlagAvailable(orgPublicId, iacOrgSettings);
+            customRulesPath = options.rules;
+        }
+        const isOCIRegistryURLProvided = checkOCIRegistryURLProvided(iacOrgSettings);
+        if (isOCIRegistryURLProvided && customRulesPath) {
             throw new FailedToExecuteCustomRulesError();
         }
-        if (OCIRegistryURL) {
-            if (!isValidURL(OCIRegistryURL)) {
-                throw new oci_pull_1.InvalidRemoteRegistryURLError();
-            }
-            const URLComponents = oci_pull_1.extractURLComponents(OCIRegistryURL);
-            const username = process.env.OCI_REGISTRY_USERNAME;
-            const password = process.env.OCI_REGISTRY_PASSWORD;
-            const opt = {
-                username,
-                password,
-                reqOptions: {
-                    acceptManifest: types_1.manifestContentType,
-                    acceptLayer: types_1.layerContentType,
-                    indexContentType: '',
-                },
-            };
-            try {
-                await measurable_methods_1.pull(URLComponents, opt);
-            }
-            catch (err) {
-                if (err.statusCode === 401) {
-                    throw new FailedToPullCustomBundleError('There was an authentication error. Incorrect credentials provided.');
-                }
-                else if (err.statusCode === 404) {
-                    throw new FailedToPullCustomBundleError('The remote repository could not be found. Please check the provided URL.');
-                }
-                else if (err instanceof oci_pull_1.InvalidManifestSchemaVersionError) {
-                    throw new FailedToPullCustomBundleError(err.message);
-                }
-                else if (err instanceof oci_pull_1.FailedToBuildOCIArtifactError) {
-                    throw new oci_pull_1.FailedToBuildOCIArtifactError();
-                }
-                else if (err instanceof oci_pull_1.InvalidRemoteRegistryURLError) {
-                    throw new oci_pull_1.InvalidRemoteRegistryURLError();
-                }
-                else {
-                    throw new FailedToPullCustomBundleError();
-                }
-            }
+        if (isOCIRegistryURLProvided) {
+            await assertPullAvailable(orgPublicId, iacOrgSettings);
+            await pullIaCCustomRules(iacOrgSettings);
         }
         else {
             await measurable_methods_1.initLocalCache({ customRulesPath });
@@ -729,7 +708,7 @@ async function test(pathToScan, options) {
         const filesToParse = await measurable_methods_1.loadFiles(pathToScan, options);
         const { parsedFiles, failedFiles } = await measurable_methods_1.parseFiles(filesToParse, options);
         // Duplicate all the files and run them through the custom engine.
-        if (customRulesPath || OCIRegistryURL) {
+        if (customRulesPath || isOCIRegistryURLProvided) {
             parsedFiles.push(...parsedFiles.map((file) => ({
                 ...file,
                 engineType: types_1.EngineType.Custom,
@@ -764,15 +743,6 @@ async function test(pathToScan, options) {
     }
 }
 exports.test = test;
-async function customRulesPathForOrg(customRulesPath, publicOrgId) {
-    if (!customRulesPath)
-        return;
-    const isCustomRulesSupported = (await feature_flags_1.isFeatureFlagSupportedForOrg('iacCustomRules', publicOrgId)).ok;
-    if (isCustomRulesSupported) {
-        return customRulesPath;
-    }
-    throw new assert_iac_options_flag_1.FlagError('rules', 'iacCustomRules');
-}
 function removeFileContent({ filePath, fileType, failureReason, projectType, }) {
     return {
         filePath,
@@ -782,10 +752,10 @@ function removeFileContent({ filePath, fileType, failureReason, projectType, })
     };
 }
 exports.removeFileContent = removeFileContent;
-function isValidURL(string) {
+function isValidURL(str) {
     let url;
     try {
-        url = new URL(string);
+        url = new URL(str);
     }
     catch (e) {
         return false;
@@ -793,6 +763,144 @@ function isValidURL(string) {
     return url.protocol === 'http:' || url.protocol === 'https:';
 }
 exports.isValidURL = isValidURL;
+/**
+ * Checks if the OCI registry URL has been provided.
+ */
+function checkOCIRegistryURLProvided(iacOrgSettings) {
+    return (checkOCIRegistryURLExistsInSettings(iacOrgSettings) ||
+        !!user_config_1.config.get('oci-registry-url'));
+}
+/**
+ * Checks if the OCI registry URL was provided in the org's IaC settings.
+ */
+function checkOCIRegistryURLExistsInSettings(iacOrgSettings) {
+    var _a, _b;
+    return (!!((_a = iacOrgSettings.customRules) === null || _a === void 0 ? void 0 : _a.isEnabled) &&
+        !!((_b = iacOrgSettings.customRules) === null || _b === void 0 ? void 0 : _b.ociRegistryURL));
+}
+/**
+ * Extracts the OCI registry URL components from the org's IaC settings.
+ */
+function getOCIRegistryURLComponentsFromSettings(iacOrgSettings) {
+    const settingsOCIRegistryURL = iacOrgSettings.customRules.ociRegistryURL;
+    if (!isValidURL(settingsOCIRegistryURL)) {
+        throw new oci_pull_1.InvalidRemoteRegistryURLError();
+    }
+    return {
+        ...oci_pull_1.extractOCIRegistryURLComponents(settingsOCIRegistryURL),
+        tag: iacOrgSettings.customRules.ociRegistryTag || 'latest',
+    };
+}
+/**
+ * Extracts the OCI registry URL components from the environment variables.
+ */
+function getOCIRegistryURLComponentsFromEnv() {
+    const envOCIRegistryURL = user_config_1.config.get('oci-registry-url');
+    if (!isValidURL(envOCIRegistryURL)) {
+        throw new oci_pull_1.InvalidRemoteRegistryURLError();
+    }
+    return oci_pull_1.extractOCIRegistryURLComponents(envOCIRegistryURL);
+}
+/**
+ * Gets the OCI registry URL components from either the env variables or the IaC org settings.
+ */
+function getOCIRegistryURLComponents(iacOrgSettings) {
+    if (checkOCIRegistryURLExistsInSettings(iacOrgSettings)) {
+        return getOCIRegistryURLComponentsFromSettings(iacOrgSettings);
+    }
+    // Default is to get the URL from env variables.
+    return getOCIRegistryURLComponentsFromEnv();
+}
+/**
+ * Pull and store the IaC custom-rules bundle from the remote OCI Registry.
+ */
+async function pullIaCCustomRules(iacOrgSettings) {
+    const ociRegistryURLComponents = getOCIRegistryURLComponents(iacOrgSettings);
+    const username = user_config_1.config.get('oci-registry-username');
+    const password = user_config_1.config.get('oci-registry-password');
+    const opt = {
+        username,
+        password,
+        reqOptions: {
+            acceptManifest: types_1.manifestContentType,
+            acceptLayer: types_1.layerContentType,
+            indexContentType: '',
+        },
+    };
+    try {
+        await measurable_methods_1.pull(ociRegistryURLComponents, opt);
+    }
+    catch (err) {
+        if (err.statusCode === 401) {
+            throw new FailedToPullCustomBundleError('There was an authentication error. Incorrect credentials provided.');
+        }
+        else if (err.statusCode === 404) {
+            throw new FailedToPullCustomBundleError('The remote repository could not be found. Please check the provided URL.');
+        }
+        else if (err instanceof oci_pull_1.InvalidManifestSchemaVersionError) {
+            throw new FailedToPullCustomBundleError(err.message);
+        }
+        else if (err instanceof oci_pull_1.FailedToBuildOCIArtifactError) {
+            throw new oci_pull_1.FailedToBuildOCIArtifactError();
+        }
+        else if (err instanceof oci_pull_1.InvalidRemoteRegistryURLError) {
+            throw new oci_pull_1.InvalidRemoteRegistryURLError();
+        }
+        else {
+            throw new FailedToPullCustomBundleError();
+        }
+    }
+}
+exports.pullIaCCustomRules = pullIaCCustomRules;
+/**
+ * Asserts the custom-rules feature is available for the provided org.
+ */
+async function assertCustomRulesAvailable(orgPublicId, iacOrgSettings) {
+    var _a;
+    const isCustomRulesEnabled = !!(await feature_flags_1.isFeatureFlagSupportedForOrg('iacCustomRules', orgPublicId)).ok;
+    if (!isCustomRulesEnabled) {
+        throw new errors_1.UnsupportedFeatureFlagError('iacCustomRules');
+    }
+    const isEntitledToCustomRules = !!((_a = iacOrgSettings.entitlements) === null || _a === void 0 ? void 0 : _a.iacCustomRulesEntitlement);
+    if (!isEntitledToCustomRules) {
+        throw new unsupported_entitlement_error_1.UnsupportedEntitlementError('iacCustomRulesEntitlement');
+    }
+}
+/**
+ * Asserts the --rules flag is available for the provided org.
+ */
+async function assertRulesFlagAvailable(orgPublicId, iacOrgSettings) {
+    try {
+        await assertCustomRulesAvailable(orgPublicId, iacOrgSettings);
+    }
+    catch (err) {
+        if (err instanceof unsupported_entitlement_error_1.UnsupportedEntitlementError) {
+            throw new assert_iac_options_flag_1.UnsupportedEntitlementFlagError('rules', err.entitlement);
+        }
+        else if (err instanceof errors_1.UnsupportedFeatureFlagError) {
+            throw new assert_iac_options_flag_1.FlagError('rules', err.featureFlag);
+        }
+        else {
+            throw err;
+        }
+    }
+}
+/**
+ * Asserts the feature custom-rules bundles pulling feature is available for the provided org.
+ */
+async function assertPullAvailable(orgPublicId, iacOrgSettings) {
+    try {
+        await assertCustomRulesAvailable(orgPublicId, iacOrgSettings);
+    }
+    catch (err) {
+        if (err instanceof unsupported_entitlement_error_1.UnsupportedEntitlementError) {
+            throw new oci_pull_1.UnsupportedEntitlementPullError(err.entitlement);
+        }
+        else if (err instanceof errors_1.UnsupportedFeatureFlagError) {
+            throw new oci_pull_1.UnsupportedFeatureFlagPullError(err.featureFlag);
+        }
+    }
+}
 class FailedToPullCustomBundleError extends errors_1.CustomError {
     constructor(message) {
         super(message || 'Could not pull custom bundle');
@@ -1086,7 +1194,7 @@ exports.pull = measurableOciPull;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.InvalidRemoteRegistryURLError = exports.InvalidManifestSchemaVersionError = exports.FailedToBuildOCIArtifactError = exports.pull = exports.extractURLComponents = exports.CUSTOM_RULES_TARBALL = void 0;
+exports.UnsupportedEntitlementPullError = exports.UnsupportedFeatureFlagPullError = exports.InvalidRemoteRegistryURLError = exports.InvalidManifestSchemaVersionError = exports.FailedToBuildOCIArtifactError = exports.pull = exports.extractOCIRegistryURLComponents = exports.CUSTOM_RULES_TARBALL = void 0;
 const registryClient = __webpack_require__(28310);
 const fs_1 = __webpack_require__(35747);
 const path = __webpack_require__(85622);
@@ -1099,7 +1207,7 @@ const measurable_methods_1 = __webpack_require__(78272);
 const file_utils_1 = __webpack_require__(58486);
 const debug = Debug('iac-oci-pull');
 exports.CUSTOM_RULES_TARBALL = 'custom-bundle.tar.gz';
-function extractURLComponents(OCIRegistryURL) {
+function extractOCIRegistryURLComponents(OCIRegistryURL) {
     try {
         const url = OCIRegistryURL.split('://')[1];
         const [registryBase, accountName, repoWithTag] = url.split('/');
@@ -1111,7 +1219,7 @@ function extractURLComponents(OCIRegistryURL) {
         throw new InvalidRemoteRegistryURLError();
     }
 }
-exports.extractURLComponents = extractURLComponents;
+exports.extractOCIRegistryURLComponents = extractOCIRegistryURLComponents;
 /**
  * Downloads an OCI Artifact from a remote OCI Registry and writes it to the disk.
  * The artifact here is a custom rules bundle stored in a remote registry.
@@ -1171,6 +1279,24 @@ class InvalidRemoteRegistryURLError extends errors_1.CustomError {
     }
 }
 exports.InvalidRemoteRegistryURLError = InvalidRemoteRegistryURLError;
+class UnsupportedFeatureFlagPullError extends errors_1.CustomError {
+    constructor(featureFlag) {
+        super('OCI Pull not supported - Missing the ${featureFlag} feature flag');
+        this.code = types_1.IaCErrorCodes.UnsupportedFeatureFlagPullError;
+        this.strCode = error_utils_1.getErrorStringCode(this.code);
+        this.userMessage = `The custom rules feature is not supported for this org - The feature flag '${featureFlag}' is not currently enabled. It can be enabled via Snyk Preview, if you are on the Enterprise Plan.`;
+    }
+}
+exports.UnsupportedFeatureFlagPullError = UnsupportedFeatureFlagPullError;
+class UnsupportedEntitlementPullError extends errors_1.CustomError {
+    constructor(entitlement) {
+        super(`OCI Pull not supported - Missing the ${entitlement} entitlement`);
+        this.code = types_1.IaCErrorCodes.UnsupportedEntitlementPullError;
+        this.strCode = error_utils_1.getErrorStringCode(this.code);
+        this.userMessage = `The custom rules feature is currently not supported for this org. To enable it, please contact snyk support.`;
+    }
+}
+exports.UnsupportedEntitlementPullError = UnsupportedEntitlementPullError;
 
 
 /***/ }),
@@ -2206,6 +2332,28 @@ FailOnError.ERROR_MESSAGE = 'Invalid fail on argument, please use one of: ' +
     Object.keys(common_1.FAIL_ON).join(' | ');
 
 
+/***/ }),
+
+/***/ 78673:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.UnsupportedEntitlementError = void 0;
+const custom_error_1 = __webpack_require__(17188);
+class UnsupportedEntitlementError extends custom_error_1.CustomError {
+    constructor(entitlement, userMessage = `This feature is currently not enabled for your org. To enable it, please contact snyk support.`) {
+        super('Unsupported feature - Missing the ${entitlementName} entitlement');
+        this.entitlement = entitlement;
+        this.code = UnsupportedEntitlementError.ERROR_CODE;
+        this.userMessage = userMessage;
+    }
+}
+exports.UnsupportedEntitlementError = UnsupportedEntitlementError;
+UnsupportedEntitlementError.ERROR_CODE = 403;
+
+
 /***/ }),
 
 /***/ 9401: