Skip to content

Commit df5e9e0

Browse files
pvdzpvdz
committed
Update to match current endpoint output
1 parent 8249fcb commit df5e9e0

File tree

2 files changed

+210
-78
lines changed

2 files changed

+210
-78
lines changed

‎src/commands/package/fetch-purl-deep-score.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ import colors from 'yoctocolors-cjs'
33
import { logger } from '@socketsecurity/registry/lib/logger'
44

55
import constants from '../../constants'
6-
import { handleAPIError, handleApiCall, queryAPI } from '../../utils/api'
6+
import { handleApiCall, handleApiError, queryApi } from '../../utils/api'
77
import { AuthError } from '../../utils/errors'
88
import { getDefaultToken } from '../../utils/sdk'
99

@@ -19,14 +19,14 @@ export async function fetchPurlDeepScore(purl: string) {
1919
}
2020

2121
spinner.start('Getting deep package score...')
22-
const response = await queryAPI(
22+
const response = await queryApi(
2323
`purl/score/${encodeURIComponent(purl)}`,
2424
apiToken
2525
)
2626
spinner?.successAndStop('Received deep package score response.')
2727

2828
if (!response.ok) {
29-
const err = await handleAPIError(response.status)
29+
const err = await handleApiError(response.status)
3030
logger.log('\nThere was an error', err)
3131
spinner.errorAndStop(
3232
`${colors.bgRed(colors.white(response.statusText))}: ${err}`

‎src/commands/package/output-purl-score.ts‎

Lines changed: 207 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -24,99 +24,231 @@ export async function outputPurlScore(
2424
}
2525

2626
if (outputKind === 'markdown') {
27-
const { alerts, func, score, worst } = data as {
28-
func: string
29-
score: {
30-
license: number
31-
maintenance: number
32-
overall: number
33-
quality: number
34-
supplyChain: number
35-
vulnerability: number
27+
const {
28+
purl: requestedPurl,
29+
self: {
30+
alerts: selfAlerts,
31+
capabilities: selfCaps,
32+
purl,
33+
score: selfScore
34+
},
35+
transitively: {
36+
alerts,
37+
capabilities,
38+
dependencyCount,
39+
func,
40+
lowest,
41+
score
3642
}
37-
worst: {
38-
license: string
39-
maintenance: string
40-
overall: string
41-
quality: string
42-
supplyChain: string
43-
vulnerability: string
43+
} = data as {
44+
purl: string
45+
self: {
46+
purl: string
47+
score: {
48+
license: number
49+
maintenance: number
50+
overall: number
51+
quality: number
52+
supplyChain: number
53+
vulnerability: number
54+
}
55+
capabilities: string[]
56+
alerts: Array<{
57+
name: string
58+
severity: string
59+
category: string
60+
example: string
61+
}>
62+
}
63+
transitively: {
64+
dependencyCount: number
65+
func: string
66+
score: {
67+
license: number
68+
maintenance: number
69+
overall: number
70+
quality: number
71+
supplyChain: number
72+
vulnerability: number
73+
}
74+
lowest: {
75+
license: string
76+
maintenance: string
77+
overall: string
78+
quality: string
79+
supplyChain: string
80+
vulnerability: string
81+
}
82+
capabilities: string[]
83+
alerts: Array<{
84+
name: string
85+
severity: string
86+
category: string
87+
example: string
88+
}>
4489
}
45-
alerts: Array<{
46-
name: string
47-
severity: string
48-
category: string
49-
}>
5090
}
5191

52-
logger.error(`Score report for "${purl}":\n`)
53-
logger.log('# Deep Package Score')
54-
logger.log('')
55-
logger.log(
56-
'This Socket report contains the response for requesting a deep package score for'
57-
)
58-
logger.log(
59-
`a package and any of its dependencies or transitive dependencies.`
60-
)
61-
logger.log('')
62-
logger.log(`The package is: ${purl}`)
92+
logger.error(`Score report for "${requestedPurl}" ("${purl}"):\n`)
93+
logger.log('# Complete Package Score')
6394
logger.log('')
64-
logger.log('## Score')
95+
if (dependencyCount) {
96+
logger.log(
97+
`This is a Socket report for the package *"${purl}"* and its *${dependencyCount}* direct/transitive dependencies.`
98+
)
99+
} else {
100+
logger.log(
101+
`This is a Socket report for the package *"${purl}"*. It has *no dependencies*.`
102+
)
103+
}
65104
logger.log('')
66-
logger.log('Please note:')
67-
logger.log(
68-
' The listed scores reflect the scores from the requested package, its'
69-
)
70-
logger.log(
71-
' dependencies, and any transitive dependencies. An aggregation function'
72-
)
73-
logger.log(
74-
' computes the final score which is presented in this report.'
75-
)
105+
if (dependencyCount) {
106+
logger.log(
107+
`It will show you the shallow score for just the package itself and a deep score for all the transitives combined. Additionally you can see which capabilities were found and the top alerts as well as a package that was responsible for it.`
108+
)
109+
} else {
110+
logger.log(
111+
`It will show you the shallow score for the package itself, which capabilities were found, and its top alerts.`
112+
)
113+
logger.log('')
114+
logger.log(
115+
'Since it has no dependencies, the shallow score is also the deep score.'
116+
)
117+
}
76118
logger.log('')
77-
logger.log(`The aggregation function that was used is: "${func}"`)
119+
if (dependencyCount) {
120+
// This doesn't make much sense if there are no dependencies. Better to omit it.
121+
logger.log(
122+
'The report should give you a good insight into the status of this package.'
123+
)
124+
logger.log('')
125+
logger.log('## Package itself')
126+
logger.log('')
127+
logger.log(
128+
'Here are results for the package itself (excluding data from dependencies).'
129+
)
130+
} else {
131+
logger.log('## Report')
132+
logger.log('')
133+
logger.log(
134+
'The report should give you a good insight into the status of this package.'
135+
)
136+
}
78137
logger.log('')
79-
logger.log('- Overall: ' + score.overall)
80-
logger.log('- Maintenance: ' + score.maintenance)
81-
logger.log('- Quality: ' + score.quality)
82-
logger.log('- Supply Chain: ' + score.supplyChain)
83-
logger.log('- Vulnerability: ' + score.vulnerability)
84-
logger.log('- License: ' + score.license)
138+
logger.log('### Shallow Score')
85139
logger.log('')
86-
logger.log('## Worst score examples')
140+
logger.log('This score is just for the package itself:')
87141
logger.log('')
88-
logger.log(
89-
'These are packages with the worst score in each category. Only one package is'
90-
)
91-
logger.log(
92-
'listed even if multiple have that lowest score. Each of these packages is the'
93-
)
94-
logger.log('package itself or a (transitive) dependency.')
142+
logger.log('- Overall: ' + selfScore.overall)
143+
logger.log('- Maintenance: ' + selfScore.maintenance)
144+
logger.log('- Quality: ' + selfScore.quality)
145+
logger.log('- Supply Chain: ' + selfScore.supplyChain)
146+
logger.log('- Vulnerability: ' + selfScore.vulnerability)
147+
logger.log('- License: ' + selfScore.license)
95148
logger.log('')
96-
logger.log('- Overall: ' + worst.overall)
97-
logger.log('- Maintenance: ' + worst.maintenance)
98-
logger.log('- Quality: ' + worst.quality)
99-
logger.log('- Supply Chain: ' + worst.supplyChain)
100-
logger.log('- Vulnerability: ' + worst.vulnerability)
101-
logger.log('- License: ' + worst.license)
149+
logger.log('### Capabilities')
102150
logger.log('')
103-
logger.log('## Alerts')
151+
if (selfCaps.length) {
152+
logger.log('These are the capabilities detected in the package itself:')
153+
logger.log('')
154+
selfCaps.forEach(cap => {
155+
logger.log(`- ${cap}`)
156+
})
157+
} else {
158+
logger.log('No capabilities were found in the package.')
159+
}
104160
logger.log('')
105-
logger.log(
106-
'Here is a list of the alerts emitted by this package or any of its (transitive)'
107-
)
108-
logger.log(
109-
'dependencies in aggregate. Only the first 100 or shown, ordered by severity.'
110-
)
161+
logger.log('### Alerts for this package')
111162
logger.log('')
112-
alerts.forEach(({ name, severity }) => {
113-
logger.log(`- [${severity}] ${name}`)
114-
})
163+
if (selfAlerts.length) {
164+
if (dependencyCount) {
165+
logger.log('These are the alerts found for the package itself:')
166+
} else {
167+
logger.log('These are the alerts found for this package:')
168+
}
169+
logger.log('')
170+
selfAlerts.forEach(alert => {
171+
logger.log(`- [${alert.severity}] ${alert.name}`)
172+
})
173+
} else {
174+
logger.log('There are currently no alerts for this package.')
175+
}
115176
logger.log('')
177+
if (dependencyCount) {
178+
logger.log('## Transitive Package Results')
179+
logger.log('')
180+
logger.log(
181+
'Here are results for the package and its direct/transitive dependencies.'
182+
)
183+
logger.log('')
184+
logger.log('### Deep Score')
185+
logger.log('')
186+
logger.log(
187+
'This score represents the package and and its direct/transitive dependencies:'
188+
)
189+
logger.log(
190+
`The function used to calculate the values in aggregate is: *"${func}"*`
191+
)
192+
logger.log('')
193+
logger.log('- Overall: ' + score.overall)
194+
logger.log('- Maintenance: ' + score.maintenance)
195+
logger.log('- Quality: ' + score.quality)
196+
logger.log('- Supply Chain: ' + score.supplyChain)
197+
logger.log('- Vulnerability: ' + score.vulnerability)
198+
logger.log('- License: ' + score.license)
199+
logger.log('')
200+
logger.log('### Capabilities')
201+
logger.log('')
202+
logger.log(
203+
'These are the packages with the lowest recorded score. If there is more than one with the lowest score, just one is shown here. This may help you figure out the source of low scores.'
204+
)
205+
logger.log('')
206+
logger.log('- Overall: ' + lowest.overall)
207+
logger.log('- Maintenance: ' + lowest.maintenance)
208+
logger.log('- Quality: ' + lowest.quality)
209+
logger.log('- Supply Chain: ' + lowest.supplyChain)
210+
logger.log('- Vulnerability: ' + lowest.vulnerability)
211+
logger.log('- License: ' + lowest.license)
212+
logger.log('')
213+
logger.log('### Capabilities')
214+
logger.log('')
215+
if (capabilities.length) {
216+
logger.log(
217+
'These are the capabilities detected in at least one package:'
218+
)
219+
logger.log('')
220+
capabilities.forEach(cap => {
221+
logger.log(`- ${cap}`)
222+
})
223+
} else {
224+
logger.log(
225+
'This package had no capabilities and neither did any of its direct/transitive dependencies.'
226+
)
227+
}
228+
logger.log('')
229+
logger.log('### Alerts')
230+
logger.log('')
231+
if (alerts.length) {
232+
logger.log('These are the alerts found:')
233+
logger.log('')
234+
alerts.forEach(alert => {
235+
logger.log(
236+
`- [${alert.severity}] ${alert.name} (at least in ${alert.example})`
237+
)
238+
})
239+
} else {
240+
logger.log(
241+
'This package had no alerts and neither did any of its direct/transitive dependencies.'
242+
)
243+
}
244+
logger.log('')
245+
}
116246
return
117247
}
118248

119-
logger.log(`Score report for "${purl}":`)
249+
logger.log(
250+
`Score report for "${purl}" (use --json for raw and --markdown for formatted reports):`
251+
)
120252
logger.log(data)
121253
logger.log('')
122254
}

0 commit comments

Comments
 (0)