cli.js

#!/usr/bin/env node

import fs from 'node:fs'
import * as path from "path";

import yargs from 'yargs'
import { hideBin } from 'yargs/helpers'

import { resolveConfig } from './config.js'
import { getProjectLicense, getLicenseDetails } from './license/index.js'
import { runRemediation } from './remediate.js'
import { generateReport } from './remediation_report.js'

import client, { selectTrustifyDABackend, generateSbom } from './index.js'

/**
 * Builds a yargs middleware that loads `.trustify-da.yml` (discovered by walking
 * up from the command's target path, or cwd when no path is available) and fills `--providers`, `--sources`, and
 * `--group-by` with config file values when they were not supplied on the CLI or
 * via environment variables. Precedence: CLI flag > env var > config file > default.
 * @param {string} [pathKey] - positional argument holding the target path; defaults to the current working directory
 * @param {{ groupBy?: boolean }} [options={}] - set `groupBy` when the command exposes `--group-by`
 * @returns {(args: object) => object} yargs middleware
 */
function configMiddleware(pathKey, options = {}) {
	return args => {
		const startPath = pathKey === undefined ? process.cwd() : args[pathKey]
		const envVars = options.groupBy
			? process.env
			: Object.fromEntries(Object.entries(process.env).filter(([key]) => key !== 'TRUSTIFY_DA_GROUP_BY'))
		const merged = resolveConfig(
			startPath,
			{ backendUrl: args.backendUrl, providers: args.providers, sources: args.sources, groupBy: args['group-by'] },
			envVars
		)
		if (merged.backendUrlSource === 'file' && process.env.TRUSTIFY_DA_TOKEN) {
			throw new Error('Refusing to send TRUSTIFY_DA_TOKEN to a backend selected by project configuration. Set --backend-url or TRUSTIFY_DA_BACKEND_URL to explicitly trust it.')
		}
		if (args.providers !== undefined || merged.providers.length) {
			args.providers = merged.providers.join(',')
		}
		if (args.sources !== undefined || merged.sources.length) {
			args.sources = merged.sources.join(',')
		}
		if (merged.backendUrl != null) {
			args.backendUrl = merged.backendUrl
		}
		if (options.groupBy) {
			args['group-by'] = merged.groupBy
		}
		const fileExclude = merged.remediation?.exclude
		if (Array.isArray(fileExclude) && fileExclude.length > 0) {
			const cliExclude = Array.isArray(args.exclude) ? args.exclude : []
			args.exclude = [...new Set([...cliExclude, ...fileExclude])]
		}
		return args
	}
}


// command for component analysis take manifest type and content
const component = {
	command: 'component </path/to/manifest>',
	desc: 'produce component report for manifest path',
	builder: yargs => yargs.positional(
		'/path/to/manifest',
		{
			desc: 'manifest path for analyzing',
			type: 'string',
			normalize: true,
		}
	).options({
		workspaceDir: {
			alias: 'w',
			desc: 'Workspace root directory (for monorepos; lock file is expected here)',
			type: 'string',
			normalize: true,
		},
		backendUrl: {
			desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
			type: 'string',
		},
		providers: {
			desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
			type: 'string',
		},
		sources: {
			desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
			type: 'string',
		}
	}).middleware(configMiddleware('/path/to/manifest')),
	handler: async args => {
		let manifestName = args['/path/to/manifest']
		const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {}
		if (args.backendUrl !== undefined) {
			opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl
		}
		if (args.providers !== undefined) {
			opts.TRUSTIFY_DA_PROVIDERS = args.providers
		}
		if (args.sources !== undefined) {
			opts.TRUSTIFY_DA_SOURCES = args.sources
		}
		let res = await client.componentAnalysis(manifestName, opts)
		console.log(JSON.stringify(res, null, 2))
	}
}
const validateToken = {
	command: 'validate-token <token-provider> [--token-value thevalue]',
	desc: 'Validates input token if authentic and authorized',
	builder: yargs => yargs.positional(
		'token-provider',
		{
			desc: 'the token provider name',
			type: 'string'
		}
	).options({
		tokenValue: {
			alias: 'value',
			desc: 'the actual token value to be checked',
			type: 'string',
		}
	}),
	handler: async args => {
		let tokenProvider = args['token-provider'].toUpperCase()
		let opts={}
		if(args['tokenValue'] !== undefined && args['tokenValue'].trim() !=="" ) {
			let tokenValue = args['tokenValue'].trim()
			opts[`TRUSTIFY_DA_PROVIDER_${tokenProvider}_TOKEN`] = tokenValue
		}
		let res = await client.validateToken(opts)
		console.log(res)
	}
}

// command for image analysis takes OCI image references
const image = {
	command: 'image <image-refs..>',
	desc: 'produce image analysis report for OCI image references',
	builder: yargs => yargs.positional(
		'image-refs',
		{
			desc: 'OCI image references to analyze (one or more)',
			type: 'string',
			array: true,
		}
	).options({
		html: {
			alias: 'r',
			desc: 'Get the report as HTML instead of JSON',
			type: 'boolean',
			conflicts: 'summary'
		},
		summary: {
			alias: 's',
			desc: 'For JSON report, get only the \'summary\'',
			type: 'boolean',
			conflicts: 'html'
		},
		backendUrl: {
			desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
			type: 'string',
		},
		providers: {
			desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
			type: 'string',
		},
		sources: {
			desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
			type: 'string',
		}
	}).middleware(configMiddleware()),
	handler: async args => {
		let imageRefs = args['image-refs']
		if (!Array.isArray(imageRefs)) {
			imageRefs = [imageRefs]
		}
		let html = args['html']
		let summary = args['summary']
		const opts = {}
		if (args.backendUrl !== undefined) {
			opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl
		}
		if (args.providers !== undefined) {
			opts.TRUSTIFY_DA_PROVIDERS = args.providers
		}
		if (args.sources !== undefined) {
			opts.TRUSTIFY_DA_SOURCES = args.sources
		}
		let res = await client.imageAnalysis(imageRefs, html, opts)
		if(summary && !html) {
			let summaries = {}
			for (let [imageRef, report] of Object.entries(res)) {
				for (let provider in report.providers) {
					if (report.providers[provider].sources !== undefined) {
						for (let source in report.providers[provider].sources) {
							if (report.providers[provider].sources[source].summary) {
								if (!summaries[imageRef]) {
									summaries[imageRef] = {};
								}
								if (!summaries[imageRef][provider]) {
									summaries[imageRef][provider] = {};
								}
								summaries[imageRef][provider][source] = report.providers[provider].sources[source].summary
							}
						}
					}
				}
			}
			res = summaries
		}
		console.log(html ? res : JSON.stringify(res, null, 2))
	}
}

// command for stack analysis takes a manifest path
const stack = {
	command: 'stack </path/to/manifest> [--html|--summary]',
	desc: 'produce stack report for manifest path',
	builder: yargs => yargs.positional(
		'/path/to/manifest',
		{
			desc: 'manifest path for analyzing',
			type: 'string',
			normalize: true,
		}
	).options({
		html: {
			alias: 'r',
			desc: 'Get the report as HTML instead of JSON',
			type: 'boolean',
			conflicts: 'summary'
		},
		summary: {
			alias: 's',
			desc: 'For JSON report, get only the \'summary\'',
			type: 'boolean',
			conflicts: 'html'
		},
		workspaceDir: {
			alias: 'w',
			desc: 'Workspace root directory (for monorepos; lock file is expected here)',
			type: 'string',
			normalize: true,
		},
		backendUrl: {
			desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
			type: 'string',
		},
		providers: {
			desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
			type: 'string',
		},
		sources: {
			desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
			type: 'string',
		}
	}).middleware(configMiddleware('/path/to/manifest')),
	handler: async args => {
		let manifest = args['/path/to/manifest']
		let html = args['html']
		let summary = args['summary']
		const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {}
		if (args.backendUrl !== undefined) {
			opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl
		}
		if (args.providers !== undefined) {
			opts.TRUSTIFY_DA_PROVIDERS = args.providers
		}
		if (args.sources !== undefined) {
			opts.TRUSTIFY_DA_SOURCES = args.sources
		}
		let theProvidersSummary = new Map();
		let theProvidersObject ={}
		let res = await client.stackAnalysis(manifest, html, opts)
		if(summary)
		{
			for (let provider in res.providers ) {
				if (res.providers[provider].sources !== undefined) {
					for(let source in res.providers[provider].sources ) {
						if(res.providers[provider].sources[source].summary) {
							theProvidersSummary.set(source,res.providers[provider].sources[source].summary)
						}
					}
				}
			}
			for (let [provider, providerSummary] of theProvidersSummary) {
				theProvidersObject[provider]=providerSummary
			}
		}
		console.log(html ? res : JSON.stringify(
			!html && summary ? theProvidersObject : res,
			null,
			2
		))
	}
}

// command for batch stack analysis (workspace)
const stackBatch = {
	command: 'stack-batch </path/to/workspace-root> [--html|--summary] [--concurrency <n>] [--ignore <pattern>...] [--metadata] [--fail-fast]',
	desc: 'produce stack report for all packages/crates in a workspace (Cargo or JS/TS)',
	builder: yargs => yargs.positional(
		'/path/to/workspace-root',
		{
			desc: 'workspace root directory (containing Cargo.toml+Cargo.lock or package.json+lock file)',
			type: 'string',
			normalize: true,
		}
	).options({
		html: {
			alias: 'r',
			desc: 'Get the report as HTML instead of JSON',
			type: 'boolean',
			conflicts: 'summary'
		},
		summary: {
			alias: 's',
			desc: 'For JSON report, get only the \'summary\' per package',
			type: 'boolean',
			conflicts: 'html'
		},
		concurrency: {
			alias: 'c',
			desc: 'Max parallel SBOM generations (default: 10, env: TRUSTIFY_DA_BATCH_CONCURRENCY)',
			type: 'number',
		},
		ignore: {
			alias: 'i',
			desc: 'Extra glob patterns excluded from workspace discovery (merged with defaults). Repeat flag per pattern. Env: TRUSTIFY_DA_WORKSPACE_DISCOVERY_IGNORE (comma-separated)',
			type: 'string',
			array: true,
		},
		metadata: {
			alias: 'm',
			desc: 'Return { analysis, metadata } with per-manifest errors (env: TRUSTIFY_DA_BATCH_METADATA=true)',
			type: 'boolean',
			default: false,
		},
		failFast: {
			desc: 'Stop on first invalid package.json or SBOM error (env: TRUSTIFY_DA_CONTINUE_ON_ERROR=false)',
			type: 'boolean',
			default: false,
		},
		backendUrl: {
			desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
			type: 'string',
		},
		providers: {
			desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
			type: 'string',
		},
		sources: {
			desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
			type: 'string',
		}
	}).middleware(configMiddleware('/path/to/workspace-root')),
	handler: async args => {
		const workspaceRoot = args['/path/to/workspace-root']
		const html = args['html']
		const summary = args['summary']
		const opts = {}
		if (args.backendUrl !== undefined) {
			opts.TRUSTIFY_DA_BACKEND_URL = args.backendUrl
		}
		if (args.concurrency != null) {
			opts.batchConcurrency = args.concurrency
		}
		const extraIgnores = Array.isArray(args.ignore) ? args.ignore.filter(p => p != null && String(p).trim()) : []
		if (extraIgnores.length > 0) {
			opts.workspaceDiscoveryIgnore = extraIgnores
		}
		if (args.metadata) {
			opts.batchMetadata = true
		}
		if (args.failFast) {
			opts.continueOnError = false
		}
		if (args.providers !== undefined) {
			opts.TRUSTIFY_DA_PROVIDERS = args.providers
		}
		if (args.sources !== undefined) {
			opts.TRUSTIFY_DA_SOURCES = args.sources
		}
		let res = await client.stackAnalysisBatch(workspaceRoot, html, opts)
		const batchAnalysis =
			res && typeof res === 'object' && res != null && 'analysis' in res ? res.analysis : res
		if (summary && !html && typeof batchAnalysis === 'object') {
			const summaries = {}
			for (const [purl, report] of Object.entries(batchAnalysis)) {
				if (report?.providers) {
					for (const provider of Object.keys(report.providers)) {
						const sources = report.providers[provider]?.sources
						if (sources) {
							for (const [source, data] of Object.entries(sources)) {
								if (data?.summary) {
									if (!summaries[purl]) {
										summaries[purl] = {}
									}
									if (!summaries[purl][provider]) {
										summaries[purl][provider] = {}
									}
									summaries[purl][provider][source] = data.summary
								}
							}
						}
					}
				}
			}
			if (res && typeof res === 'object' && res != null && 'metadata' in res) {
				res = { analysis: summaries, metadata: res.metadata }
			} else {
				res = summaries
			}
		}
		if (html) {
			const htmlContent = res && typeof res === 'object' && 'analysis' in res ? res.analysis : res
			console.log(htmlContent)
		} else {
			console.log(JSON.stringify(res, null, 2))
		}
	}
}

// command for license checking
const license = {
	command: 'license </path/to/manifest>',
	desc: 'Display project license information from manifest and LICENSE file in JSON format',
	builder: yargs => yargs.positional(
		'/path/to/manifest',
		{
			desc: 'manifest path for license analysis',
			type: 'string',
			normalize: true,
		}
	),
	handler: async args => {
		let manifestPath = args['/path/to/manifest']

		const opts = {} // CLI options can be extended in the future
		try {
			selectTrustifyDABackend(opts)
		} catch (err) {
			console.error(JSON.stringify({ error: err.message }, null, 2))
			process.exit(1)
		}

		let localResult
		try {
			localResult = getProjectLicense(manifestPath)
		} catch (err) {
			console.error(JSON.stringify({ error: `Failed to read manifest: ${err.message}` }, null, 2))
			process.exit(1)
		}

		const errors = []

		// Build LicenseInfo objects
		const buildLicenseInfo = async (spdxId) => {
			if (!spdxId) {return null}

			const licenseInfo = { spdxId }

			try {
				const details = await getLicenseDetails(spdxId, opts)
				if (details) {
					// Check if backend recognized the license as valid
					if (details.category === 'UNKNOWN') {
						errors.push(`"${spdxId}" is not a valid SPDX license identifier. Please use a valid SPDX expression (e.g., "Apache-2.0", "MIT"). See https://spdx.org/licenses/`)
					} else {
						Object.assign(licenseInfo, details)
					}
				} else {
					errors.push(`No license details found for ${spdxId}`)
				}
			} catch (err) {
				errors.push(`Failed to fetch details for ${spdxId}: ${err.message}`)
			}

			return licenseInfo
		}

		const output = {
			manifestLicense: await buildLicenseInfo(localResult.fromManifest),
			fileLicense: await buildLicenseInfo(localResult.fromFile),
			mismatch: localResult.mismatch
		}

		if (errors.length > 0) {
			output.errors = errors
		}

		console.log(JSON.stringify(output, null, 2))
	}
}

const sbom = {
	command: 'sbom </path/to/manifest> [--output]',
	desc: 'generate a CycloneDX SBOM from a manifest file',
	builder: yargs => yargs.positional(
		'/path/to/manifest',
		{
			desc: 'manifest path for SBOM generation',
			type: 'string',
			normalize: true,
		}
	).options({
		output: {
			alias: 'o',
			desc: 'Write SBOM JSON to a file instead of stdout',
			type: 'string',
			normalize: true,
		},
		workspaceDir: {
			alias: 'w',
			desc: 'Workspace root directory (for monorepos; lock file is expected here)',
			type: 'string',
			normalize: true,
		},
		name: {
			alias: 'n',
			desc: 'Root component name for the SBOM (overrides the manifest name field)',
			type: 'string',
		},
	}),
	handler: async args => {
		let manifest = args['/path/to/manifest']
		const opts = args.workspaceDir ? { TRUSTIFY_DA_WORKSPACE_DIR: args.workspaceDir } : {}
		if (args.name) {
			opts.TRUSTIFY_DA_SBOM_NAME = args.name
		}
		let result
		try {
			result = await generateSbom(manifest, opts)
		} catch (err) {
			console.error(JSON.stringify({ error: `Failed to generate SBOM: ${err.message}` }, null, 2))
			process.exit(1)
		}
		const json = JSON.stringify(result, null, 2)
		if (args.output) {
			try {
				fs.writeFileSync(args.output, json)
			} catch (err) {
				console.error(JSON.stringify({ error: `Failed to write output file: ${err.message}` }, null, 2))
				process.exit(1)
			}
		} else {
			console.log(json)
		}
	}
}

const remediate = {
	command: 'remediate <path>',
	desc: 'Scan and apply vulnerability remediations to manifest files',
	builder: yargs => yargs.positional(
		'path',
		{
			desc: 'Path to manifest file or directory',
			type: 'string',
			normalize: true,
		}
	).options({
		'dry-run': {
			alias: 'd',
			type: 'boolean',
			desc: 'Preview changes without modifying files',
		},
		providers: {
			desc: 'Comma-separated list of vulnerability providers (env: TRUSTIFY_DA_PROVIDERS)',
			type: 'string',
		},
		sources: {
			desc: 'Comma-separated list of vulnerability sources (env: TRUSTIFY_DA_SOURCES)',
			type: 'string',
		},
		'group-by': {
			type: 'string',
			choices: ['dependency', 'bundle'],
			desc: 'Report grouping strategy (default: dependency)',
		},
		exclude: {
			desc: 'Version-less purl glob to exclude from remediation, e.g. pkg:maven/com.example/legacy-lib. Supports globs: * within a segment (pkg:maven/com.example/* for a group), ** across segments (pkg:maven/** for an ecosystem). Repeat flag per entry.',
			type: 'string',
			array: true,
		},
		backendUrl: {
			desc: 'Trustify DA backend URL (env: TRUSTIFY_DA_BACKEND_URL)',
			type: 'string',
		},
	}).middleware(configMiddleware('path', { groupBy: true })),
	handler: async args => {
		try {
			const result = await runRemediation(args.path, {
				dryRun: args['dry-run'],
				providers: args.providers,
				sources: args.sources,
				backendUrl: args.backendUrl,
				exclude: Array.isArray(args.exclude)
					? args.exclude.filter(p => p != null && String(p).trim())
					: [],
			})

			if (result.remediations.length === 0 && result.manifests.length === 0) {
				console.log('No supported manifest files found.')
				process.exit(result.exitCode)
			}

			for (const s of result.skipped) {
				console.warn(`Warning: skipped ${s.groupId}:${s.artifactId} → ${s.newVersion}: ${s.reason}`)
			}

			if (!args['dry-run'] && result.appliedFiles.length > 0) {
				console.log(`Updated ${result.appliedFiles.length} file(s):`)
				for (const file of result.appliedFiles) {
					console.log(`  ${file}`)
				}
				console.log('')
			}
			console.log(generateReport(result.remediations, { groupBy: args['group-by'], dryRun: args['dry-run'] }))
			process.exit(result.exitCode)
		} catch (err) {
			console.error(err.message)
			process.exit(1)
		}
	}
}

// parse and invoke the command
yargs(hideBin(process.argv))
	.usage(`Usage: ${process.argv[0].includes("node") ?  path.parse(process.argv[1]).base : path.parse(process.argv[0]).base} {component|stack|stack-batch|image|validate-token|license|sbom|remediate}`)
	.command(stack)
	.command(stackBatch)
	.command(component)
	.command(image)
	.command(validateToken)
	.command(license)
	.command(sbom)
	.command(remediate)
	.scriptName('')
	.version(false)
	.demandCommand(1)
	.wrap(null)
	.parse()