wip

Author: santigimeno

dep_checker/npm_audit.py

@@ -110,6 +110,9 @@ def find_package_json_files(self) -> List[Path]:
     def has_package_lock(self, package_dir: Path) -> bool:
         return (package_dir / "package-lock.json").exists()
 
+    def has_node_modules(self, package_dir: Path) -> bool:
+        return (package_dir / "node_modules").is_dir()
+
 
     def run_npm_install(self, package_dir: Path) -> bool:
         """Install non-dev dependencies needed for an audit when no lockfile is present."""
@@ -366,9 +369,11 @@ def check_npm_vulnerabilities(self, vulnerability_class) -> List:
             logger.info(f"Processing {package_json}")
 
             try:
-                package_lock_only = self.has_package_lock(package_dir)
+                has_package_lock = self.has_package_lock(package_dir)
+                has_node_modules = self.has_node_modules(package_dir)
+                package_lock_only = has_package_lock and not has_node_modules
 
-                if not package_lock_only and not self.run_npm_install(package_dir):
+                if not has_node_modules and not has_package_lock and not self.run_npm_install(package_dir):
                     logger.warning(f"Skipping npm audit for {package_dir} due to install failure")
                     self.failed_packages.append(f"{package_dir}: npm install failed")
                     continue

dep_checker/test_npm_audit.py

@@ -114,12 +114,57 @@ def fake_run(cmd, **kwargs):
     assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] in calls
 
 
+def test_node_modules_skips_install_and_lockfile_only() -> None:
+    calls = []
+
+    class Result:
+        def __init__(self, returncode: int = 0, stdout: str = "", stderr: str = ""):
+            self.returncode = returncode
+            self.stdout = stdout
+            self.stderr = stderr
+
+    def fake_run(cmd, **kwargs):
+        calls.append(cmd)
+        if cmd[:2] == ["npm", "audit"]:
+            return Result(stdout='{"vulnerabilities": {}}')
+        if cmd == ["npm", "--version"]:
+            raise AssertionError("install should be skipped when node_modules exists")
+        if cmd[:2] == ["npm", "install"]:
+            raise AssertionError("install should be skipped when node_modules exists")
+        raise AssertionError(cmd)
+
+    original_run = npm_audit.subprocess.run
+    npm_audit.subprocess.run = fake_run
+    try:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            package_dir = Path(temp_dir) / "deps" / "pkg"
+            write_package_json(
+                package_dir / "package.json",
+                {"name": "pkg", "version": "1.0.0", "dependencies": {"lodash": "4.17.0"}},
+            )
+            write_package_json(
+                package_dir / "package-lock.json",
+                {"name": "pkg", "lockfileVersion": 3},
+            )
+            (package_dir / "node_modules").mkdir(parents=True)
+
+            checker = NPMAuditChecker(Path(temp_dir), timeout=60)
+            vulnerabilities = checker.check_npm_vulnerabilities(Vulnerability)
+            assert vulnerabilities == [], vulnerabilities
+    finally:
+        npm_audit.subprocess.run = original_run
+
+    assert ["npm", "audit", "--omit=dev", "--json"] in calls
+    assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] not in calls
+
+
 def test_npm_audit_basic() -> None:
     """Test basic npm audit functionality"""
     print("Testing npm audit functionality...")
     test_find_package_json_files_skips_nested_manifests()
     test_npm_commands_omit_dev()
     test_lockfile_skips_install()
+    test_node_modules_skips_install_and_lockfile_only()
 
     with tempfile.TemporaryDirectory() as temp_dir:
         temp_path = Path(temp_dir)