feat: [CMPA-603] Add npm support for SBOM component metadata being FF

package.json

@@ -121,8 +121,8 @@
     "snyk-gradle-plugin": "7.0.0",
     "snyk-module": "3.1.0",
     "snyk-mvn-plugin": "4.8.0",
-    "snyk-nodejs-lockfile-parser": "2.8.1",
-    "snyk-nodejs-plugin": "^2.0.1",
+    "snyk-nodejs-lockfile-parser": "2.9.0",
+    "snyk-nodejs-plugin": "^2.1.0",
     "snyk-nuget-plugin": "4.2.3",
     "snyk-php-plugin": "1.12.1",
     "snyk-policy": "^4.1.6",

src/lib/plugins/nodejs-plugin/npm-lock-parser.ts

@@ -75,6 +75,7 @@ export async function parse(
         pruneCycles: true,
         honorAliases: true,
         showNpmScope: options.showNpmScope,
+        includeComponentMetadata: options.includeComponentMetadata || false,
       },
     );
   }
@@ -89,6 +90,7 @@ export async function parse(
       strictOutOfSync,
       true,
       options.showNpmScope,
+      options.includeComponentMetadata || false,
     );
   } finally {
     await spinner.clear<void>(resolveModuleSpinnerLabel)();

src/lib/plugins/types.ts

@@ -22,6 +22,7 @@ export interface Options {
   scanAllUnmanaged?: boolean;
   showNpmScope?: boolean;
   allProjects?: boolean;
+  includeComponentMetadata?: boolean;
 }
 
 export interface Plugin {

test/fixtures/npm-include-component-metadata/lock-v1/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "npm-component-metadata-v1",
+  "version": "1.0.0",
+  "dependencies": {
+    "lodash": "4.17.15"
+  }
+}

test/fixtures/npm-include-component-metadata/lock-v2/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "npm-component-metadata-v2",
+  "version": "1.0.0",
+  "dependencies": {
+    "lodash": "4.17.15"
+  }
+}

test/fixtures/npm-include-component-metadata/lock-v3/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "npm-component-metadata-v3",
+  "version": "1.0.0",
+  "dependencies": {
+    "lodash": "4.17.15"
+  }
+}

test/jest/acceptance/snyk-test/npm-include-component-metadata.spec.ts

@@ -0,0 +1,62 @@
+import { createProjectFromFixture } from '../../util/createProject';
+import { runSnykCLI } from '../../util/runSnykCLI';
+
+jest.setTimeout(1000 * 60);
+
+// `--include-component-metadata` makes the npm plugin forward the flag to
+// snyk-nodejs-lockfile-parser, which reads the install-time `integrity` and
+// `resolved` fields already recorded in the lockfile and surfaces them as
+// `hash:<algorithm>` and `distribution:url` labels on the dep-graph nodes.
+// Unlike maven there is nothing to resolve first — the metadata lives in the
+// lockfile — so these fixtures need no `npm install`.
+//
+// Covers npm lockfile v1 (legacy depTree path, converted to a dep-graph for
+// printing) and v2/v3 (native dep-graph path).
+describe('`snyk test --include-component-metadata` (npm)', () => {
+  const labelKeys = (printGraphStdout: string, prefix: string): string[] => {
+    const jsonDG = JSON.parse(
+      printGraphStdout.split('DepGraph data:')[1].split('DepGraph target:')[0],
+    );
+    return jsonDG.graph.nodes
+      .flatMap((node) => Object.keys(node.info?.labels ?? {}))
+      .filter((key) => key.startsWith(prefix));
+  };
+
+  const fixtures = [
+    ['v1', 'npm-include-component-metadata/lock-v1'],
+    ['v2', 'npm-include-component-metadata/lock-v2'],
+    ['v3', 'npm-include-component-metadata/lock-v3'],
+  ];
+
+  describe.each(fixtures)('lockfile %s', (_version, fixture) => {
+    it('attaches hash and distribution:url labels with the flag', async () => {
+      const project = await createProjectFromFixture(fixture);
+
+      const { code, stdout } = await runSnykCLI(
+        'test --include-component-metadata --print-graph --file=package-lock.json',
+        { cwd: project.path() },
+      );
+
+      expect(code).toEqual(0);
+      expect(stdout).toContain('DepGraph data:');
+      expect(labelKeys(stdout, 'hash:').length).toBeGreaterThan(0);
+      expect(labelKeys(stdout, 'distribution:url').length).toBeGreaterThan(0);
+    });
+
+    // Control: without the flag the same project must not produce the labels,
+    // proving they are driven by `--include-component-metadata`.
+    it('does not attach the labels without the flag', async () => {
+      const project = await createProjectFromFixture(fixture);
+
+      const { code, stdout } = await runSnykCLI(
+        'test --print-graph --file=package-lock.json',
+        { cwd: project.path() },
+      );
+
+      expect(code).toEqual(0);
+      expect(stdout).toContain('DepGraph data:');
+      expect(labelKeys(stdout, 'hash:')).toHaveLength(0);
+      expect(labelKeys(stdout, 'distribution:url')).toHaveLength(0);
+    });
+  });
+});