spectrum-cli 5.0.2 → 5.1.0

package/src/nextjs/index.js

@@ -0,0 +1,184 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { isDryRun, reportPreflight } = require("../cli/command-executor");
+function licenses({
+  cwd = process.cwd(),
+  reportOnly = false,
+  dry = isDryRun(),
+} = {}) {
+  const workspace = fs.realpathSync(cwd);
+  const standalone = path.join(workspace, "dist/standalone");
+  const result = { copied: 0, existing: 0, withoutLicense: 0, warnings: [] };
+  if (dry) result.planned = 0;
+
+  function warn(file, error) {
+    result.warnings.push({
+      path: path.relative(workspace, file),
+      reason: error.message,
+    });
+  }
+
+  // Reject symlinks at every level; never read or write outside this checkout.
+  function checked(file, kind) {
+    const relative = path.relative(workspace, file);
+    if (
+      !relative ||
+      relative === ".." ||
+      relative.startsWith(".." + path.sep) ||
+      path.isAbsolute(relative)
+    ) {
+      throw new Error("path outside checkout");
+    }
+    let current = workspace;
+    const parts = relative.split(path.sep);
+    for (let i = 0; i < parts.length; i++) {
+      current = path.join(current, parts[i]);
+      const stat = fs.lstatSync(current);
+      if (
+        stat.isSymbolicLink() ||
+        (i < parts.length - 1 && !stat.isDirectory())
+      ) {
+        throw new Error("unsafe symlink or parent path");
+      }
+      if (
+        i === parts.length - 1 &&
+        !(kind === "directory" ? stat.isDirectory() : stat.isFile())
+      ) {
+        throw new Error("unexpected file type");
+      }
+    }
+    return file;
+  }
+
+  function read(file) {
+    return fs.readFileSync(checked(file, "file"));
+  }
+
+  function identical(left, right) {
+    if (!read(left).equals(read(right)))
+      throw new Error("source and standalone files differ");
+  }
+
+  function files(directory) {
+    checked(directory, "directory");
+    const found = [];
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isDirectory()) found.push(...files(file));
+      else if (entry.isFile()) found.push(checked(file, "file"));
+      else throw new Error("non-regular compiled package entry");
+    }
+    return found;
+  }
+
+  function preserve(nextRoot) {
+    const sourceRoot = path.join(
+      workspace,
+      path.relative(standalone, nextRoot),
+    );
+    const owner = JSON.parse(read(path.join(nextRoot, "package.json")));
+    if (
+      owner.name !== "next" ||
+      typeof owner.version !== "string" ||
+      !owner.version
+    ) {
+      throw new Error("invalid standalone Next identity");
+    }
+    identical(
+      path.join(nextRoot, "package.json"),
+      path.join(sourceRoot, "package.json"),
+    );
+    const compiled = path.join(nextRoot, "dist/compiled");
+    const manifests = files(compiled).filter(
+      (file) => path.basename(file) === "package.json",
+    );
+    for (const manifest of manifests) {
+      try {
+        const target = path.dirname(manifest);
+        const source = path.join(sourceRoot, path.relative(nextRoot, target));
+        const pkg = JSON.parse(read(manifest));
+        if (typeof pkg.name !== "string" || !pkg.name)
+          throw new Error("invalid compiled package identity");
+        identical(manifest, path.join(source, "package.json"));
+        const license = path.join(source, "LICENSE");
+        // Some published compiled packages legitimately have no LICENSE file.
+        // Validate the parent first so ENOENT cannot hide an unsafe source path.
+        checked(source, "directory");
+        try {
+          checked(license, "file");
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+          result.withoutLicense++;
+          continue;
+        }
+        // No repair of modified code, assets or existing license files.
+        for (const file of files(target)) {
+          identical(file, path.join(source, path.relative(target, file)));
+        }
+        const destination = path.join(target, "LICENSE");
+        try {
+          checked(destination, "file");
+          identical(destination, license);
+          result.existing++;
+          continue;
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+        checked(target, "directory");
+        if (dry) result.planned++;
+        else {
+          fs.copyFileSync(license, destination, fs.constants.COPYFILE_EXCL);
+          result.copied++;
+        }
+      } catch (error) {
+        warn(manifest, error);
+      }
+    }
+  }
+
+  function discover(directory) {
+    checked(directory, "directory");
+    for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+      const file = path.join(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        // Standalone .bin links are not package roots and are never followed.
+        if (entry.name === "next" || entry.name === "node_modules")
+          warn(file, new Error("symlinked package root"));
+        continue;
+      }
+      if (!entry.isDirectory()) continue;
+      if (
+        entry.name === "next" &&
+        path.basename(directory) === "node_modules"
+      ) {
+        try {
+          preserve(file);
+        } catch (error) {
+          warn(file, error);
+        }
+      }
+      discover(file);
+    }
+  }
+
+  try {
+    discover(standalone);
+  } catch (error) {
+    warn(standalone, error);
+  }
+  if (dry) {
+    if (result.warnings.length)
+      console.error(
+        "Standalone LICENSE preflight: " + JSON.stringify(result.warnings),
+      );
+    else
+      reportPreflight(
+        "nextjs licenses",
+        "standalone-metadata",
+        "проверены исходники, standalone и LICENSE",
+      );
+  } else
+    console.log("Standalone LICENSE preservation: " + JSON.stringify(result));
+  return reportOnly ? result : result.warnings.length ? 2 : 0;
+}
+module.exports = { licenses };

package/src/preflight/automation.js

@@ -0,0 +1,291 @@
+// Noninteractive preflights. Remote checks are read-only and never log credentials.
+const { fs, path, ensure, request } = require("../automation");
+const { API, projectPath } = require("../security/runtime");
+const { encoded } = require("../sbom/schema");
+const { reportPreflight } = require("../cli/command-executor");
+class PreflightError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PreflightError";
+  }
+}
+function check(condition, message) {
+  if (!condition) throw new PreflightError(message);
+}
+function required(env, names) {
+  const missing = names.filter(
+    (name) => typeof env[name] !== "string" || !env[name].trim(),
+  );
+  check(!missing.length, "Missing required variables: " + missing.join(", "));
+  return env;
+}
+function credentialPair(env, user, password) {
+  check(
+    Boolean(env[user]) === Boolean(env[password]),
+    `Configure both ${user} and ${password}`,
+  );
+}
+function httpsEndpoint(value, name) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new PreflightError(name + " must be an explicit HTTPS URL");
+  }
+  check(
+    typeof value === "string" &&
+      !/[\x00-\x20]/.test(value) &&
+      parsed.protocol === "https:" &&
+      !parsed.username &&
+      !parsed.password &&
+      !parsed.search &&
+      !parsed.hash,
+    name + " must be an HTTPS URL without credentials, query or fragment",
+  );
+  return value.replace(/\/+$/, "");
+}
+async function get(api, location, options, label) {
+  try {
+    return await api.get(location, options);
+  } catch (error) {
+    const status = Number.isInteger(error.status)
+      ? ` (HTTP ${error.status})`
+      : "";
+    throw new PreflightError(
+      `${label}: connection, authentication or access check failed${status}`,
+    );
+  }
+}
+async function checkGitlabAccess(
+  env,
+  projects,
+  { write = false, purpose = "repository", api } = {},
+) {
+  required(env, ["CI_API_V4_URL", "GLAB_BOT_PAT"]);
+  const base = httpsEndpoint(env.CI_API_V4_URL, "CI_API_V4_URL");
+  if (env.CI_SERVER_URL)
+    check(
+      base === httpsEndpoint(env.CI_SERVER_URL, "CI_SERVER_URL") + "/api/v4",
+      "GitLab API URL does not match CI_SERVER_URL",
+    );
+  check(base.endsWith("/api/v4"), "CI_API_V4_URL must end with /api/v4");
+  const client = api || new API(base, { "PRIVATE-TOKEN": env.GLAB_BOT_PAT });
+  const user = await get(client, "user", undefined, "GitLab identity");
+  check(
+    user?.id && user.state === "active",
+    "GitLab token does not belong to an active user",
+  );
+  const token = await get(
+    client,
+    "personal_access_tokens/self",
+    undefined,
+    "GitLab token scope",
+  );
+  check(
+    token?.active === true &&
+      token.revoked !== true &&
+      Array.isArray(token.scopes),
+    "GitLab token is inactive, revoked or cannot be inspected",
+  );
+  check(
+    token.scopes.includes("api") ||
+      (!write && token.scopes.includes("read_api")),
+    write
+      ? "GitLab token requires the api scope for pipeline/repository writes"
+      : "GitLab token requires read_api or api scope",
+  );
+  for (const project of [...new Set(projects)]) {
+    check(
+      typeof project === "string" && project.trim() && !/[\r\n]/.test(project),
+      "GitLab project must be configured explicitly",
+    );
+    const data = await get(
+      client,
+      projectPath(project),
+      undefined,
+      "GitLab project access",
+    );
+    const level = user.is_admin
+      ? 50
+      : Math.max(
+          data.permissions?.project_access?.access_level || 0,
+          data.permissions?.group_access?.access_level || 0,
+        );
+    check(
+      level >= (write ? 30 : 20),
+      write
+        ? "GitLab project requires Developer access or higher"
+        : "GitLab project requires Reporter access or higher",
+    );
+    if (write) {
+      check(data.archived !== true, "GitLab project is archived");
+      if (purpose === "pipeline")
+        check(
+          data.builds_access_level !== "disabled",
+          "GitLab pipeline access is disabled",
+        );
+      else
+        check(
+          data.repository_access_level !== "disabled" &&
+            data.merge_requests_access_level !== "disabled" &&
+            data.can_create_merge_request_in !== false,
+          "GitLab repository/MR access is disabled",
+        );
+    }
+  }
+  reportPreflight(
+    "automation",
+    "gitlab-access",
+    "проверены GitLab token, scope и роль в проектах",
+  );
+  return {
+    identity: "verified",
+    token_scope: "verified",
+    project_role: "verified",
+    protected_branch_policies: "checked_by_operations",
+  };
+}
+async function checkYouTrackAccess(env, cfg, api) {
+  required(env, ["YOUTRACK_URL", "YOUTRACK_PRIVATE_TOKEN"]);
+  const base = httpsEndpoint(env.YOUTRACK_URL, "YOUTRACK_URL");
+  check(
+    /^[A-Za-z0-9_-]+$/.test(cfg.youtrack_project || ""),
+    "YouTrack project key is required",
+  );
+  const client =
+    api ||
+    new API(base + "/api", {
+      Authorization: "Bearer " + env.YOUTRACK_PRIVATE_TOKEN,
+    });
+  const user = await get(
+    client,
+    "users/me",
+    { query: { fields: "id,login,guest,banned" } },
+    "YouTrack identity",
+  );
+  check(
+    user?.id && user.login && user.guest !== true && user.banned !== true,
+    "YouTrack token must belong to an active, non-guest user",
+  );
+  const parentProject = env.NIGHTLY_CVE_PROJECT || "CVE";
+  check(
+    /^[A-Za-z0-9_-]+$/.test(parentProject),
+    "Invalid parent YouTrack project",
+  );
+  for (const project of [...new Set([parentProject, cfg.youtrack_project])]) {
+    const projects = await get(
+      client,
+      "admin/projects",
+      { query: { query: project, fields: "id,shortName,archived", $top: 100 } },
+      "YouTrack project access",
+    );
+    check(Array.isArray(projects), "Invalid YouTrack project response");
+    const matches = projects.filter((item) => item.shortName === project);
+    check(
+      matches.length === 1 && matches[0].archived !== true,
+      "YouTrack project is missing, inaccessible or archived",
+    );
+    const fields = await get(
+      client,
+      "admin/projects/" + encoded(matches[0].id) + "/customFields",
+      { query: { fields: "field(name)", $top: 100 } },
+      "YouTrack custom fields",
+    );
+    check(Array.isArray(fields), "Invalid YouTrack custom field response");
+    const names = new Set(fields.map((field) => field.field?.name));
+    const expected =
+      project === parentProject
+        ? ["CVE ID", "Severity", "Priority", "Type"]
+        : [
+            "Tester",
+            "Статья учета времени",
+            ...(cfg.subsystem ? ["Subsystem"] : []),
+          ];
+    const missing = expected.filter((name) => !names.has(name));
+    check(
+      !missing.length,
+      "YouTrack project is missing required fields: " + missing.join(", "),
+    );
+    await get(
+      client,
+      "issues",
+      { query: { query: `project: {${project}}`, fields: "id", $top: 1 } },
+      "YouTrack issue read access",
+    );
+  }
+  // GET access cannot prove create/update/link permission or workflow acceptance.
+  reportPreflight(
+    "security track",
+    "youtrack-access",
+    "проверены вход в YouTrack, проекты, поля и чтение",
+  );
+  return {
+    identity: "verified",
+    projects: "read_verified",
+    required_fields: "verified",
+    write_permissions: "checked_by_operations",
+  };
+}
+async function checkRegistryAccess(
+  namespace,
+  { transport = request, probe } = {},
+) {
+  const host = namespace.split("/")[0];
+  const base = httpsEndpoint("https://" + host, "Registry");
+  let response;
+  try {
+    response = await transport(base + "/v2/", {
+      timeout: 15000,
+      limit: 1024 * 1024,
+    });
+  } catch {
+    throw new PreflightError(
+      "Registry is unavailable or TLS validation failed",
+    );
+  }
+  check(
+    response.status === 200 ||
+      (response.status === 401 && !!response.headers?.get("www-authenticate")),
+    "Registry v2 endpoint is unavailable",
+  );
+  // ORAS handles registry authentication; an exact target read distinguishes
+  // auth failures from an empty/missing catalogue before upstream work begins.
+  const existing = await probe();
+  reportPreflight(
+    "sbom catalog populate",
+    "registry-access",
+    "проверены доступность registry и чтение namespace",
+  );
+  return {
+    endpoint: "reachable",
+    authentication: "oras_login_completed",
+    namespace_read: existing ? "verified" : "missing_or_hidden",
+    push_permissions: "checked_by_publish",
+  };
+}
+function checkExecutables(names, env = process.env) {
+  for (const name of names) {
+    const found = (env.PATH || "").split(path.delimiter).some((directory) => {
+      const file = path.join(directory, name);
+      try {
+        return (
+          fs.statSync(file).isFile() &&
+          (fs.accessSync(file, fs.constants.X_OK), true)
+        );
+      } catch {
+        return false;
+      }
+    });
+    check(found, "Required executable is unavailable: " + name);
+  }
+}
+module.exports = {
+  checkExecutables,
+  PreflightError,
+  required,
+  credentialPair,
+  httpsEndpoint,
+  checkGitlabAccess,
+  checkYouTrackAccess,
+  checkRegistryAccess,
+};

package/src/sbom/index.js

@@ -0,0 +1,4 @@
+const { resolve } = require('./resolve');
+const { populate } = require('./populate');
+
+module.exports = { resolve, populate };