wip

Author: santigimeno

dep_checker/npm_audit.py

@@ -113,6 +113,12 @@ def has_package_lock(self, package_dir: Path) -> bool:
     def has_node_modules(self, package_dir: Path) -> bool:
         return (package_dir / "node_modules").is_dir()
 
+    def is_missing_lockfile_error(self, audit_data: Optional[Dict]) -> bool:
+        if not isinstance(audit_data, dict):
+            return False
+        error = audit_data.get("error")
+        return isinstance(error, dict) and error.get("code") == "ENOLOCK"
+
 
     def run_npm_install(self, package_dir: Path) -> bool:
         """Install non-dev dependencies needed for an audit when no lockfile is present."""
@@ -389,6 +395,15 @@ def check_npm_vulnerabilities(self, vulnerability_class) -> List:
                     continue
 
                 audit_data = self.run_npm_audit(package_dir, package_lock_only=package_lock_only)
+                if package_lock_only and self.is_missing_lockfile_error(audit_data):
+                    logger.warning(
+                        f"npm audit reported ENOLOCK for {package_dir}; falling back to npm install + npm audit"
+                    )
+                    if not self.run_npm_install(package_dir):
+                        logger.warning(f"Skipping npm audit for {package_dir} due to install failure")
+                        self.failed_packages.append(f"{package_dir}: npm install failed")
+                        continue
+                    audit_data = self.run_npm_audit(package_dir, package_lock_only=False)
                 if audit_data is None:
                     logger.warning(f"Skipping vulnerability parsing for {package_dir} due to audit failure")
                     self.failed_packages.append(f"{package_dir}: npm audit failed")

dep_checker/test_npm_audit.py

@@ -67,7 +67,7 @@ def fake_run(cmd, **kwargs):
     finally:
         npm_audit.subprocess.run = original_run
 
-    assert ["npm", "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund", "--silent"] in calls
+    assert ["npm", "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"] in calls
     assert ["npm", "audit", "--omit=dev", "--json"] in calls
     assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] in calls
 
@@ -158,13 +158,60 @@ def fake_run(cmd, **kwargs):
     assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] not in calls
 
 
+def test_enolock_falls_back_to_install_and_normal_audit() -> None:
+    calls = []
+
+    class Result:
+        def __init__(self, returncode: int = 0, stdout: str = "", stderr: str = ""):
+            self.returncode = returncode
+            self.stdout = stdout
+            self.stderr = stderr
+
+    def fake_run(cmd, **kwargs):
+        calls.append(cmd)
+        if cmd == ["npm", "--version"]:
+            return Result(stdout="10.0.0\n")
+        if cmd[:2] == ["npm", "install"]:
+            return Result()
+        if cmd == ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"]:
+            return Result(stdout='{"error":{"code":"ENOLOCK"}}')
+        if cmd == ["npm", "audit", "--omit=dev", "--json"]:
+            return Result(stdout='{"vulnerabilities": {}}')
+        raise AssertionError(cmd)
+
+    original_run = npm_audit.subprocess.run
+    npm_audit.subprocess.run = fake_run
+    try:
+        with tempfile.TemporaryDirectory() as temp_dir:
+            package_dir = Path(temp_dir) / "deps" / "pkg"
+            write_package_json(
+                package_dir / "package.json",
+                {"name": "pkg", "version": "1.0.0", "dependencies": {"lodash": "4.17.0"}},
+            )
+            write_package_json(
+                package_dir / "package-lock.json",
+                {"name": "pkg", "lockfileVersion": 3},
+            )
+
+            checker = NPMAuditChecker(Path(temp_dir), timeout=60)
+            vulnerabilities = checker.check_npm_vulnerabilities(Vulnerability)
+            assert vulnerabilities == [], vulnerabilities
+    finally:
+        npm_audit.subprocess.run = original_run
+
+    assert ["npm", "audit", "--omit=dev", "--package-lock-only", "--json"] in calls
+    assert ["npm", "install", "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund"] in calls
+    assert ["npm", "audit", "--omit=dev", "--json"] in calls
+
+
 def test_npm_audit_basic() -> None:
     """Test basic npm audit functionality"""
     print("Testing npm audit functionality...")
     test_find_package_json_files_skips_nested_manifests()
     test_npm_commands_omit_dev()
     test_lockfile_skips_install()
     test_node_modules_skips_install_and_lockfile_only()
+    test_enolock_falls_back_to_install_and_normal_audit()
 
     with tempfile.TemporaryDirectory() as temp_dir:
         temp_path = Path(temp_dir)