Accept local package-lock.json as target

hipcheck/src/cli.rs

@@ -13,9 +13,9 @@ use crate::{
 	shell::{color_choice::ColorChoice, verbosity::Verbosity},
 	source,
 	target::{
-		pm, LocalGitRepo, MavenPackage, Package, PackageHost, Sbom, SbomStandard, SingleTargetSeed,
-		SingleTargetSeedKind, TargetSeed, TargetSeedKind, TargetType, ToTargetSeed,
-		ToTargetSeedKind, VcsUrl,
+		pm, LocalGitRepo, MavenPackage, MultiTargetSeed, MultiTargetSeedKind, Package, PackageHost,
+		Sbom, SbomStandard, SingleTargetSeed, SingleTargetSeedKind, TargetSeed, TargetSeedKind,
+		TargetType, ToTargetSeed, ToTargetSeedKind, VcsUrl,
 	},
 };
 use clap::{Parser as _, ValueEnum};
@@ -651,7 +651,13 @@ impl ToTargetSeed for CheckArgs {
 
 				Ok(TargetSeed::Single(seed))
 			}
-			TargetSeedKind::Multi(_multi_target_seed_kind) => todo!(),
+			TargetSeedKind::Multi(multi_target_seed_kind) => {
+				let seed = MultiTargetSeed {
+					kind: multi_target_seed_kind,
+					specifier: command.get_specifier().to_string(),
+				};
+				Ok(TargetSeed::Multi(seed))
+			}
 		}
 	}
 }
@@ -673,6 +679,9 @@ pub enum CheckCommand {
 	/// Analyze packages specified in an SBOM document
 	#[command(hide = true)]
 	Sbom(CheckSbomArgs),
+	/// Analyze npm dependencies specified in an package-lock.json document
+	#[command(hide = true)]
+	PackageLockJson(CheckPackageLockJsonArgs),
 }
 
 impl CheckCommand {
@@ -684,6 +693,7 @@ impl CheckCommand {
 			Pypi(args) => &args.package,
 			Repo(args) => &args.source,
 			Sbom(args) => &args.path,
+			PackageLockJson(args) => &args.path,
 		}
 	}
 }
@@ -696,6 +706,7 @@ impl ToTargetSeedKind for CheckCommand {
 			CheckCommand::Pypi(args) => args.to_target_seed_kind(),
 			CheckCommand::Repo(args) => args.to_target_seed_kind(),
 			CheckCommand::Sbom(args) => args.to_target_seed_kind(),
+			CheckCommand::PackageLockJson(args) => args.to_target_seed_kind(),
 		}
 	}
 }
@@ -887,6 +898,24 @@ impl ToTargetSeedKind for CheckSbomArgs {
 	}
 }
 
+#[derive(Debug, Clone, clap::Args)]
+pub struct CheckPackageLockJsonArgs {
+	/// package-lock.json to analyze
+	pub path: String,
+}
+
+impl ToTargetSeedKind for CheckPackageLockJsonArgs {
+	fn to_target_seed_kind(&self) -> Result<TargetSeedKind> {
+		let path = PathBuf::from(&self.path);
+		if path.exists() && self.path.ends_with("package-lock.json") {
+			return Ok(TargetSeedKind::Multi(MultiTargetSeedKind::PackageLockJson(
+				path,
+			)));
+		}
+		Err(hc_error!("The provided package-lock.json does not exist"))
+	}
+}
+
 #[derive(Debug, Clone, clap::Args)]
 pub struct SchemaArgs {
 	#[clap(subcommand)]
@@ -1616,6 +1645,7 @@ mod tests {
 			CheckCommand::Pypi(args) => args.package,
 			CheckCommand::Repo(args) => args.source,
 			CheckCommand::Sbom(args) => args.path,
+			CheckCommand::PackageLockJson(args) => args.path,
 		}
 	}
 

hipcheck/src/target/mod.rs

@@ -60,6 +60,8 @@ pub enum TargetType {
 	Repo,
 	Request,
 	Sbom,
+	#[serde(rename = "package-lock-json")]
+	PackageLockJson,
 }
 
 impl TargetType {
@@ -96,6 +98,9 @@ impl TargetType {
 			|| tgt.ends_with(".cdx.xml")
 		{
 			Some((Sbom, tgt.to_string()))
+		// Otherwise check if it is a package-lock.json for a local npm project
+		} else if tgt.ends_with("package-lock.json") {
+			Some((PackageLockJson, tgt.to_string()))
 		// If is path to a file/dir that exists, treat as a local Repo
 		} else if PathBuf::from(tgt).exists() {
 			Some((Repo, tgt.to_string()))

hipcheck/src/target/types.rs

@@ -237,11 +237,25 @@ impl Display for SingleTargetSeedKind {
 	}
 }
 
+impl Display for MultiTargetSeedKind {
+	fn fmt(&self, f: &mut Formatter) -> fmt::Result {
+		use MultiTargetSeedKind::*;
+		match self {
+			GoMod(path) => {
+				write!(f, "go.mod file at {}", path.display())
+			}
+			PackageLockJson(path) => {
+				write!(f, "package-lock.json file at {}", path.display())
+			}
+		}
+	}
+}
+
 impl Display for TargetSeed {
 	fn fmt(&self, f: &mut Formatter) -> fmt::Result {
 		match self {
 			TargetSeed::Single(x) => x.kind.fmt(f),
-			TargetSeed::Multi(_x) => unimplemented!(),
+			TargetSeed::Multi(x) => x.kind.fmt(f),
 		}
 	}
 }