Class: Licensed::Sources::NPM

Inherits:
Source
  • Object
show all
Defined in:
lib/licensed/sources/npm.rb

Defined Under Namespace

Classes: Dependency

Instance Attribute Summary

Attributes inherited from Source

#config

Instance Method Summary collapse

Methods inherited from Source

#dependencies, full_type, #ignored?, inherited, #initialize, type, type_and_version

Constructor Details

This class inherits a constructor from Licensed::Sources::Source

Instance Method Details

#enabled? ⇒ Boolean

Returns:

  • (Boolean) 


26
27
28
 
# File 'lib/licensed/sources/npm.rb', line 26

def enabled?
  Licensed::Shell.tool_available?("npm") && File.exist?(config.pwd.join("package.json"))
end

#enumerate_dependencies ⇒ Object 



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/licensed/sources/npm.rb', line 30

def enumerate_dependencies
  packages.map do |name, package|
    errors = package["problems"] unless package["path"]
    Dependency.new(
      name: name,
      version: package["version"] || package["required"],
      path: package["path"],
      errors: Array(errors),
      metadata: {
        "type"     => NPM.type,
        "name"     => package["name"],
        "summary"  => package["description"],
        "homepage" => package["homepage"]
      }
    )
  end
end

#extract_version(parent, name) ⇒ Object 



159
160
161
 
# File 'lib/licensed/sources/npm.rb', line 159

def extract_version(parent, name)
  parent&.dig("_dependencies", name) || peer_dependency(parent, name)
end

#include_non_production? ⇒ Boolean

Returns whether to include non production dependencies based on the licensed configuration settings

Returns:

  • (Boolean) 


133
134
135
 
# File 'lib/licensed/sources/npm.rb', line 133

def include_non_production?
  config.dig("npm", "production_only") == false
end

#missing_peer?(parent, dependency, name) ⇒ Boolean

Returns:

  • (Boolean) 


137
138
139
140
141
142
143
144
145
146
147
 
# File 'lib/licensed/sources/npm.rb', line 137

def missing_peer?(parent, dependency, name)
  # return true if dependency is marked as "peerMissing"
  return true if dependency["peerMissing"]

  # return false unless the parent has registered the dependency
  # as a peer
  return false unless peer_dependency(parent, name)
  # return true if the dependency itself is marked as missing
  return true if dependency["missing"]
  dependency.empty? && parent&.dig("peerDependenciesMeta", name, "optional")
end

#npm_version ⇒ Object

Returns the currently installed version of npm as a Gem::Version object



121
122
123
124
125
 
# File 'lib/licensed/sources/npm.rb', line 121

def npm_version
  @npm_version ||= begin
    Gem::Version.new(Licensed::Shell.execute("npm", "-v").strip)
  end
end

#package_metadata ⇒ Object

Returns parsed package metadata returned from ‘npm list`



81
82
83
84
85
86
87
88
89
 
# File 'lib/licensed/sources/npm.rb', line 81

def package_metadata
  return @package_metadata if defined?(@package_metadata)
  @package_metadata = JSON.parse(package_metadata_command)
rescue JSON::ParserError => e
  message = "Licensed was unable to parse the output from 'npm list'. JSON Error: #{e.message}"
  npm_error = package_metadata_error
  message = "#{message}. npm Error: #{npm_error}" if npm_error
  raise Licensed::Sources::Source::Error, message
end

#package_metadata_args ⇒ Object

Returns an array of arguments that should be used for all ‘npm list` calls, regardless of how the output is formatted



109
110
111
112
113
114
115
116
117
118
 
# File 'lib/licensed/sources/npm.rb', line 109

def package_metadata_args
  args = []
  args << "--production" unless include_non_production?

  # on npm 7+, the --all argument is necessary to evaluate the project's
  # full dependency tree
  args << "--all" if npm_version >= Gem::Version.new("7.0.0")

  return args
end

#package_metadata_command ⇒ Object

Returns the output from running ‘npm list` to get package metadata



100
101
102
103
104
105
 
# File 'lib/licensed/sources/npm.rb', line 100

def package_metadata_command
  args = %w(--json --long)
  args.concat(package_metadata_args)

  Licensed::Shell.execute("npm", "list", *args, allow_failure: true)
end

#package_metadata_error ⇒ Object

Returns an error, if one exists, from running ‘npm list` to get package metadata



92
93
94
95
96
97
 
# File 'lib/licensed/sources/npm.rb', line 92

def package_metadata_error
  Licensed::Shell.execute("npm", "list", *package_metadata_args)
  return ""
rescue Licensed::Shell::Error => e
  return e.message
end

#packages ⇒ Object 



48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'lib/licensed/sources/npm.rb', line 48

def packages
  root_dependencies = package_metadata["dependencies"]
  recursive_dependencies(root_dependencies).each_with_object({}) do |(name, results), hsh|
    results.uniq! { |package| package["version"] }
    if results.size == 1
      hsh[name] = results[0]
    else
      results.each do |package|
        name_with_version = "#{name}-#{package["version"]}"
        hsh[name_with_version] = package
      end
    end
  end
end

#peer_dependency(parent, name) ⇒ Object 



149
150
151
152
153
154
155
156
157
 
# File 'lib/licensed/sources/npm.rb', line 149

def peer_dependency(parent, name)
  return unless parent.is_a?(Hash)

  peerDependencies = parent["peerDependencies"]
  # "peerDependencies" could be set to the string "[Circular]"
  return unless peerDependencies.is_a?(Hash)

  peerDependencies[name]
end

#recursive_dependencies(dependencies, result = {}, parent = nil) ⇒ Object

Recursively parse dependency JSON data. Returns a hash mapping the package name to it’s metadata



65
66
67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/licensed/sources/npm.rb', line 65

def recursive_dependencies(dependencies, result = {}, parent = nil)
  dependencies.each do |name, dependency|
    next if missing_peer?(parent, dependency, name)
    next if yarn_lock_present && dependency["missing"]
    next if dependency["extraneous"] && dependency["missing"]

    dependency["name"] = name
    dependency["version"] ||= extract_version(parent, name) if dependency["missing"]

    (result[name] ||= []) << dependency
    recursive_dependencies(dependency["dependencies"] || {}, result, dependency)
  end
  result
end

#yarn_lock_present ⇒ Object

Returns true if a yarn.lock file exists in the current directory



128
129
130
 
# File 'lib/licensed/sources/npm.rb', line 128

def yarn_lock_present
  @yarn_lock_present ||= File.exist?(config.pwd.join("yarn.lock"))
end