dev dep only

Author: santigimeno

dep_checker/npm_audit.py

@@ -1,9 +1,9 @@
 """NPM package vulnerability checker using npm audit
 
 This module handles npm package vulnerability scanning by:
-1. Finding all package.json files in the repository
-2. Running npm install --production in each directory
-3. Running npm audit --json to get vulnerability data
+1. Finding dep-root package.json files in the repository
+2. Reusing package-lock.json when present, otherwise installing non-dev dependencies
+3. Running npm audit against the prod dependency tree
 4. Parsing results into Vulnerability objects
 """
 
@@ -55,7 +55,7 @@ def __init__(self, repo_path: Path, timeout: int = 300):
         self.failed_packages: List[str] = []
 
     def find_package_json_files(self) -> List[Path]:
-        """Find all package.json files in the deps/ folder only, excluding specified folders"""
+        """Find dep-root package.json files in deps/, excluding nested package manifests."""
         package_json_files = []
         excluded_count = 0
 
@@ -86,8 +86,17 @@ def find_package_json_files(self) -> List[Path]:
                         logger.debug(f"Excluding {package_json} (matches exclusion: {exclude_path})")
                         break
 
-                if not is_excluded:
-                    package_json_files.append(package_json)
+                if is_excluded:
+                    continue
+
+                relative_to_deps = package_json.relative_to(deps_path)
+                dep_root = deps_path / relative_to_deps.parts[0] / "package.json"
+                if package_json != dep_root:
+                    # ponytail: only audit dep roots; add a nested allowlist if a shipped package ever lives deeper.
+                    logger.debug(f"Skipping nested package.json {package_json}")
+                    continue
+
+                package_json_files.append(package_json)
 
             logger.info(f"Found {len(package_json_files)} package.json files in deps/ folder")
             if excluded_count > 0:
@@ -98,8 +107,12 @@ def find_package_json_files(self) -> List[Path]:
             logger.error(f"Error finding package.json files in deps/ folder: {e}")
             return []
 
+    def has_package_lock(self, package_dir: Path) -> bool:
+        return (package_dir / "package-lock.json").exists()
+
+
     def run_npm_install(self, package_dir: Path) -> bool:
-        """Install production dependencies needed for an audit without lifecycle scripts."""
+        """Install non-dev dependencies needed for an audit when no lockfile is present."""
         try:
             logger.info(f"Running npm install in {package_dir}")
             # Check if npm is available
@@ -119,7 +132,7 @@ def run_npm_install(self, package_dir: Path) -> bool:
             # construct npm's dependency tree for an audit.
             result = subprocess.run(
                 [
-                    "npm", "install", "--production", "--ignore-scripts",
+                    "npm", "install", "--omit=dev", "--ignore-scripts",
                     "--no-audit", "--no-fund", "--silent",
                 ],
                 cwd=package_dir,
@@ -145,12 +158,18 @@ def run_npm_install(self, package_dir: Path) -> bool:
             logger.error(f"Error running npm install in {package_dir}: {e}")
             return False
 
-    def run_npm_audit(self, package_dir: Path) -> Optional[Dict]:
-        """Run npm audit --json in the given directory"""
+    def run_npm_audit(
+        self, package_dir: Path, package_lock_only: bool = False
+    ) -> Optional[Dict]:
+        """Run npm audit against the production dependency tree in the given directory."""
         try:
             logger.info(f"Running npm audit in {package_dir}")
+            command = ["npm", "audit", "--omit=dev"]
+            if package_lock_only:
+                command.append("--package-lock-only")
+            command.append("--json")
             result = subprocess.run(
-                ["npm", "audit", "--json"],
+                command,
                 cwd=package_dir,
                 capture_output=True,
                 text=True,
@@ -347,14 +366,14 @@ def check_npm_vulnerabilities(self, vulnerability_class) -> List:
             logger.info(f"Processing {package_json}")
 
             try:
-                # Run npm install
-                if not self.run_npm_install(package_dir):
+                package_lock_only = self.has_package_lock(package_dir)
+
+                if not package_lock_only and not self.run_npm_install(package_dir):
                     logger.warning(f"Skipping npm audit for {package_dir} due to install failure")
                     self.failed_packages.append(f"{package_dir}: npm install failed")
                     continue
-                
-                # Run npm audit
-                audit_data = self.run_npm_audit(package_dir)
+
+                audit_data = self.run_npm_audit(package_dir, package_lock_only=package_lock_only)
                 if audit_data is None:
                     logger.warning(f"Skipping vulnerability parsing for {package_dir} due to audit failure")
                     self.failed_packages.append(f"{package_dir}: npm audit failed")

dep_checker/test_npm_audit.py

@@ -1,61 +1,149 @@
 #!/usr/bin/env python3
 """Simple test script to verify npm audit functionality"""
 
-import tempfile
 import json
+import tempfile
 from pathlib import Path
+
+import npm_audit
 from npm_audit import NPMAuditChecker
-from main import Vulnerability
-
-def create_test_package_json(temp_dir: Path) -> Path:
-    """Create a test package.json with known vulnerable packages"""
-    package_json_content = {
-        "name": "test-package",
-        "version": "1.0.0",
-        "dependencies": {
-            # Using an older version that might have known vulnerabilities
-            "lodash": "4.17.0"
-        }
-    }
-    
-    package_json_path = temp_dir / "package.json"
-    with open(package_json_path, 'w') as f:
-        json.dump(package_json_content, f, indent=2)
-    
-    return package_json_path
-
-def test_npm_audit_basic():
+
+
+class Vulnerability:
+    def __init__(self, **kwargs):
+        self.__dict__.update(kwargs)
+
+
+def write_package_json(path: Path, content: dict) -> Path:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(json.dumps(content, indent=2))
+    return path
+
+
+def test_find_package_json_files_skips_nested_manifests() -> None:
+    with tempfile.TemporaryDirectory() as temp_dir:
+        temp_path = Path(temp_dir)
+        root_package = write_package_json(
+            temp_path / "deps" / "pkg" / "package.json",
+            {"name": "pkg", "version": "1.0.0", "dependencies": {"lodash": "4.17.0"}},
+        )
+        write_package_json(
+            temp_path / "deps" / "pkg" / "src" / "package.json",
+            {"name": "pkg-src", "version": "1.0.0", "devDependencies": {"esbuild": "0.27.0"}},
+        )
+
+        checker = NPMAuditChecker(temp_path, timeout=60)
+        package_files = checker.find_package_json_files()
+
+        assert package_files == [root_package], package_files
+
+
+def test_npm_commands_omit_dev() -> None:
+    calls = []
+
+    class Result:
+        def __init__(self, returncode: int = 0, stdout: str = "", stderr: str = ""):
+            self.returncode = returncode
+            self.stdout = stdout
+            self.stderr = stderr
+
+    def fake_run(cmd, **kwargs):
+        calls.append(cmd)
+        if cmd == ["npm", "--version"]:
+            return Result(stdout="10.0.0\n")
+        if cmd[:2] == ["npm", "install"]:
+            return Result()
+        if cmd[:2] == ["npm", "audit"]:
+            return Result(stdout='{"vulnerabilities": {}}')
+        raise AssertionError(cmd)
+
+    original_run = npm_audit.subprocess.run
+    npm_audit.subprocess.run = fake_run
+    try:
+        checker = NPMAuditChecker(Path("/tmp"), timeout=60)
+        assert checker.run_npm_install(Path("/tmp"))
+        assert checker.run_npm_audit(Path("/tmp")) == {"vulnerabilities": {}}
+        assert checker.run_npm_audit(Path("/tmp"), package_lock_only=True) == {"vulnerabilities": {}}
+    finally:
+        npm_audit.subprocess.run = original_run
+
+    assert ["npm", "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund", "--silent"] in calls
+    assert ["npm", "audit", "--omit=dev", "--json"] in calls
+    assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] in calls
+
+
+def test_lockfile_skips_install() -> None:
+    calls = []
+
+    class Result:
+        def __init__(self, returncode: int = 0, stdout: str = "", stderr: str = ""):
+            self.returncode = returncode
+            self.stdout = stdout
+            self.stderr = stderr
+
+    def fake_run(cmd, **kwargs):
+        calls.append(cmd)
+        if cmd[:2] == ["npm", "audit"]:
+            return Result(stdout='{"vulnerabilities": {}}')
+        if cmd == ["npm", "--version"]:
+            raise AssertionError("install should be skipped when package-lock.json exists")
+        if cmd[:2] == ["npm", "install"]:
+            raise AssertionError("install should be skipped when package-lock.json exists")
+        raise AssertionError(cmd)
+
+    original_run = npm_audit.subprocess.run
+    npm_audit.subprocess.run = fake_run
+    try:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            package_dir = Path(temp_dir) / "deps" / "pkg"
+            write_package_json(
+                package_dir / "package.json",
+                {"name": "pkg", "version": "1.0.0", "dependencies": {"lodash": "4.17.0"}},
+            )
+            write_package_json(
+                package_dir / "package-lock.json",
+                {"name": "pkg", "lockfileVersion": 3},
+            )
+
+            checker = NPMAuditChecker(Path(temp_dir), timeout=60)
+            vulnerabilities = checker.check_npm_vulnerabilities(Vulnerability)
+            assert vulnerabilities == [], vulnerabilities
+    finally:
+        npm_audit.subprocess.run = original_run
+
+    assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] in calls
+
+
+def test_npm_audit_basic() -> None:
     """Test basic npm audit functionality"""
     print("Testing npm audit functionality...")
-    
+    test_find_package_json_files_skips_nested_manifests()
+    test_npm_commands_omit_dev()
+    test_lockfile_skips_install()
+
     with tempfile.TemporaryDirectory() as temp_dir:
         temp_path = Path(temp_dir)
-        
-        # Create test package.json
-        package_json = create_test_package_json(temp_path)
+        package_json = write_package_json(
+            temp_path / "deps" / "pkg" / "package.json",
+            {"name": "pkg", "version": "1.0.0", "dependencies": {"lodash": "4.17.0"}},
+        )
         print(f"Created test package.json at: {package_json}")
-        
-        # Test NPM audit checker
+
         checker = NPMAuditChecker(temp_path, timeout=60)
-        
-        # Test finding package.json files
         package_files = checker.find_package_json_files()
         print(f"Found {len(package_files)} package.json files")
-        assert len(package_files) == 1, "Should find exactly one package.json file"
-        
-        # Test npm audit (this will only work if npm is available)
+        assert package_files == [package_json], package_files
+
         try:
             vulnerabilities = checker.check_npm_vulnerabilities(Vulnerability)
             print(f"Found {len(vulnerabilities)} vulnerabilities")
-            
-            # Print vulnerability details
             for vuln in vulnerabilities:
                 print(f"- {vuln.dependency} ({vuln.version}): {vuln.id} - {vuln.severity}")
-                
         except Exception as e:
             print(f"npm audit test failed (this is expected if npm is not available): {e}")
-    
+
     print("Basic npm audit test completed!")
 
+
 if __name__ == "__main__":
     test_npm_audit_basic()