From d810b70c482ddfbb15b7d9afc175602295265bd0 Mon Sep 17 00:00:00 2001 From: ghe Date: Thu, 10 Dec 2020 18:24:34 +0000 Subject: [PATCH] fix: licenses are not unique, accumilate deps Also return the dep as is if it can't be enriched --- .nvmrc | 1 - package.json | 2 +- src/lib/generate-org-license-report.ts | 23 ++++++++++++++----- .../templates/licenses-view.hbs | 7 ++++-- src/lib/types.ts | 3 ++- .../fetch-spdx-license.test.ts.snap | 19 +++++++++------ .../generate-html-report.test.ts.snap | 12 +++++----- test/lib/generate-license-report-data.test.ts | 5 ++-- test/system/json.test.ts | 6 ++--- 9 files changed, 49 insertions(+), 29 deletions(-) diff --git a/.nvmrc b/.nvmrc index 7a3707e..8351c19 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1,2 +1 @@ 14 -package-lock=false diff --git a/package.json b/package.json index 4e49ed5..a145b53 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "node-fetch": "2.6.1", "puppeteer": "5.4.1", "snyk-api-ts-client": "1.5.2", - "snyk-config": "^3.0.0", + "snyk-config": "4.0.0", "source-map-support": "^0.5.16", "tslib": "2.0.3", "yargs": "16.0.3" diff --git a/src/lib/generate-org-license-report.ts b/src/lib/generate-org-license-report.ts index 7d4927d..b91652f 100644 --- a/src/lib/generate-org-license-report.ts +++ b/src/lib/generate-org-license-report.ts @@ -64,11 +64,20 @@ export async function generateLicenseData( license.dependencies = dependenciesEnriched; } const licenseData = await getLicenseTextAndUrl(license.id); - licenseReportData[license.id] = { - ...(license as any), - licenseText: licenseData?.licenseText, - licenseUrl: licenseData?.licenseUrl, - }; + if (licenseReportData[license.id]) { + licenseReportData[license.id].dependencies = { + ...licenseReportData[license.id].dependencies, + ...(license as any).dependencies, + }; + licenseReportData[license.id].severities.push(license.severity) + } else { + licenseReportData[license.id] = { + ...(license as any), + licenseText: licenseData?.licenseText, + licenseUrl: licenseData?.licenseUrl, + severities: [license.severity] + }; + } } debug(`✅ Done processing ${licenseData.total} licenses`); @@ -93,7 +102,9 @@ function enrichDependencies( ...dep[0], }); } else { - debug('Dep information not available from /dependencies API response for ' + dependency.id); + enrichDependencies.push({ + ...dependency, + }); } } diff --git a/src/lib/generate-report/templates/licenses-view.hbs b/src/lib/generate-report/templates/licenses-view.hbs index 223a165..5db8be1 100644 --- a/src/lib/generate-report/templates/licenses-view.hbs +++ b/src/lib/generate-report/templates/licenses-view.hbs @@ -146,10 +146,13 @@

Organization: {{orgData.name}}

{{#each licenses}}
-

+

{{id}}

- Severity: {{severity}} + Severities: + {{#each severities}} + "{{ this }}", + {{/each}} {{#if instructions}} Legal Instructions: {{instructions}} {{/if}} diff --git a/src/lib/types.ts b/src/lib/types.ts index 0bd471e..0b7bd4f 100644 --- a/src/lib/types.ts +++ b/src/lib/types.ts @@ -6,7 +6,7 @@ export interface Dependency { } export type LicenseSeverity = 'none' | 'high' | 'medium' | 'low'; -export type EnrichedDependency = Dependency & DependencyData; +export type EnrichedDependency = Dependency & Partial; export interface LicenseReportDataEntry { /** @@ -37,6 +37,7 @@ export interface LicenseReportDataEntry { /** * Snyk projects from this org with dependencies using this license */ + severities: string[]; projects: { id: string; name: string; diff --git a/test/lib/__snapshots__/fetch-spdx-license.test.ts.snap b/test/lib/__snapshots__/fetch-spdx-license.test.ts.snap index cce9c09..90329af 100644 --- a/test/lib/__snapshots__/fetch-spdx-license.test.ts.snap +++ b/test/lib/__snapshots__/fetch-spdx-license.test.ts.snap @@ -17,17 +17,17 @@ Object { - + Software Package Data Exchange (SPDX) - - + + - + @@ -47,11 +47,16 @@ Object { Other web pages for this license - http://opensource.linux-mirror.org/licenses/afl-1.1.txt - http://wayback.archive.org/web/20021004124254/http://www.opensource.org/licenses/academic.php + + http://opensource.linux-mirror.org/licenses/afl-1.1.txt + + + + http://wayback.archive.org/web/20021004124254/http://www.opensource.org/licenses/academic.php [no longer live] + - + true Notes diff --git a/test/lib/__snapshots__/generate-html-report.test.ts.snap b/test/lib/__snapshots__/generate-html-report.test.ts.snap index 7bf8bc8..16b7f0b 100644 --- a/test/lib/__snapshots__/generate-html-report.test.ts.snap +++ b/test/lib/__snapshots__/generate-html-report.test.ts.snap @@ -147,10 +147,10 @@ exports[`Generate HTML report License HTML Report is generated as expected 1`] =

Snyk Licenses Attribution Report

Organization: org

-

+

BSD-2-Clause

- Severity: medium + Severities: Legal Instructions: Do not use any package with this license without speaking to anna@legal.com
@@ -337,10 +337,10 @@ THIS SOFTWARE IS PROVIDED BY <
-

+

Unknown

- Severity: high + Severities: Legal Instructions: Any package with this license is not to be used.
@@ -401,10 +401,10 @@ THIS SOFTWARE IS PROVIDED BY <
-

+

Unlicense

- Severity: none + Severities:
diff --git a/test/lib/generate-license-report-data.test.ts b/test/lib/generate-license-report-data.test.ts index 09459e2..d81bfff 100644 --- a/test/lib/generate-license-report-data.test.ts +++ b/test/lib/generate-license-report-data.test.ts @@ -37,7 +37,7 @@ describe('Get org licenses', () => { expect(licenseRes['ISC'].dependencies[0].copyright).toEqual( ['Copyright (c) Isaac Z. Schlueter and Contributors'], ); - }, 70000); + }, 80000); test('License data is generated as expected', async () => { const licenseRes = await generateLicenseData(ORG_ID, { @@ -46,6 +46,7 @@ describe('Get org licenses', () => { }, }); expect(Object.keys(licenseRes).length >= 11).toBeTruthy(); + console.log(`licenseRes`, licenseRes) expect(licenseRes['Unknown']).toBeUndefined(); expect(licenseRes['Unlicense'].licenseText).not.toBeNull(); expect(licenseRes['Unlicense'].licenseUrl).toBe( @@ -65,7 +66,7 @@ describe('Get org licenses', () => { expect(licenseRes['ISC'].dependencies[0].copyright).toEqual([ 'Copyright (c) Isaac Z. Schlueter and Contributors', ]); - }, 70000); + }, 80000); test.todo('Test for when API fails aka bad org id provided'); }); diff --git a/test/system/json.test.ts b/test/system/json.test.ts index acdff8a..c1cdb9b 100644 --- a/test/system/json.test.ts +++ b/test/system/json.test.ts @@ -20,7 +20,7 @@ describe('`snyk-licenses-report json <...>`', () => { done(); }, ); - }, 70000); + }, 80000); it('Generated JSON data with correct --orgPublicId', async (done) => { exec( `node ${main} json --orgPublicId=${ORG_ID}`, @@ -36,7 +36,7 @@ describe('`snyk-licenses-report json <...>`', () => { done(); }, ); - }, 70000); + }, 80000); it('Generated JSON data with correct --orgPublicId --project', async (done) => { exec( `node ${main} json --orgPublicId=${ORG_ID} --project=${PROJECT_ID}}`, @@ -52,5 +52,5 @@ describe('`snyk-licenses-report json <...>`', () => { done(); }, ); - }, 70000); + }, 80000); });