Make Pnpm separate from Npm

plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/project-with-lockfile-expected-output.yml

@@ -47,7 +47,7 @@ project:
         - id: "NPM::domhandler:2.4.2"
           dependencies:
           - id: "NPM::domelementtype:1.3.1"
-        - id: "NPM::domutils:1.5.1"
+        - id: "NPM::domutils:1.7.0"
           dependencies:
           - id: "NPM::dom-serializer:0.1.1"
             dependencies:
@@ -477,6 +477,36 @@ packages:
     url: "https://github.com/FB55/domutils.git"
     revision: "7d4bd16cd36ffce62362ef91616806ea27e30d95"
     path: ""
+- id: "NPM::domutils:1.7.0"
+  purl: "pkg:npm/[email protected]"
+  authors:
+  - "Felix Boehm"
+  declared_licenses:
+  - "BSD-2-Clause"
+  declared_licenses_processed:
+    spdx_expression: "BSD-2-Clause"
+  description: "utilities for working with htmlparser2's dom"
+  homepage_url: "https://github.com/FB55/domutils#readme"
+  binary_artifact:
+    url: ""
+    hash:
+      value: ""
+      algorithm: ""
+  source_artifact:
+    url: "https://registry.npmjs.org/domutils/-/domutils-1.7.0.tgz"
+    hash:
+      value: "56ea341e834e06e6748af7a1cb25da67ea9f8c2a"
+      algorithm: "SHA-1"
+  vcs:
+    type: "Git"
+    url: "git://github.com/FB55/domutils.git"
+    revision: "34f193ca17d11a98d9310b1965efe5f73d32d79f"
+    path: ""
+  vcs_processed:
+    type: "Git"
+    url: "https://github.com/FB55/domutils.git"
+    revision: "34f193ca17d11a98d9310b1965efe5f73d32d79f"
+    path: ""
 - id: "NPM::eachr:3.3.0"
   purl: "pkg:npm/[email protected]"
   authors:

plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/workspaces-expected-output.yml

@@ -89,6 +89,14 @@ analyzer:
         - id: "NPM::json-stable-stringify:1.0.1"
           dependencies:
           - id: "NPM::jsonify:0.0.0"
+        - id: "PNPM::pnpm-workspaces:1.0.1"
+          linkage: "PROJECT_DYNAMIC"
+          dependencies:
+          - id: "NPM::json-stable-stringify:1.0.1"
+            dependencies:
+            - id: "NPM::jsonify:0.0.0"
+          - id: "PNPM::pnpm-workspaces:1.0.1"
+            linkage: "PROJECT_DYNAMIC"
     - id: "PNPM::testing-pnpm-package-a:1.0.2"
       definition_file_path: "plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/workspaces/src/packages/package-a/package.json"
       authors:

plugins/package-managers/node/src/funTest/kotlin/PnpmFunTest.kt → plugins/package-managers/node/src/funTest/kotlin/pnpm/PnpmFunTest.kt

@@ -17,7 +17,7 @@
  * License-Filename: LICENSE
  */
 
-package org.ossreviewtoolkit.plugins.packagemanagers.node
+package org.ossreviewtoolkit.plugins.packagemanagers.node.pnpm
 
 import io.kotest.core.spec.style.WordSpec
 import io.kotest.matchers.should

plugins/package-managers/node/src/funTest/kotlin/Yarn2FunTest.kt → plugins/package-managers/node/src/funTest/kotlin/yarn2/Yarn2FunTest.kt

@@ -17,7 +17,7 @@
  * License-Filename: LICENSE
  */
 
-package org.ossreviewtoolkit.plugins.packagemanagers.node
+package org.ossreviewtoolkit.plugins.packagemanagers.node.yarn2
 
 import io.kotest.core.spec.style.WordSpec
 import io.kotest.matchers.should

plugins/package-managers/node/src/main/kotlin/Npm.kt

@@ -28,7 +28,9 @@ import org.apache.logging.log4j.kotlin.logger
 
 import org.ossreviewtoolkit.analyzer.AbstractPackageManagerFactory
 import org.ossreviewtoolkit.analyzer.PackageManager
+import org.ossreviewtoolkit.analyzer.PackageManager.Companion.getFallbackProjectName
 import org.ossreviewtoolkit.analyzer.PackageManager.Companion.processPackageVcs
+import org.ossreviewtoolkit.analyzer.PackageManager.Companion.processProjectVcs
 import org.ossreviewtoolkit.analyzer.PackageManagerResult
 import org.ossreviewtoolkit.downloader.VcsHost
 import org.ossreviewtoolkit.downloader.VersionControlSystem
@@ -120,11 +122,6 @@ open class Npm(
 
     protected open fun hasLockfile(projectDir: File) = NodePackageManager.NPM.hasLockfile(projectDir)
 
-    /**
-     * Check if [this] represents a workspace within a `node_modules` directory.
-     */
-    protected open fun File.isWorkspaceDir() = isSymbolicLink()
-
     /**
      * Load the submodule directories of the project defined in [moduleDir].
      */
@@ -182,7 +179,7 @@ open class Npm(
 
         if (installIssues.any { it.severity == Severity.ERROR }) {
             val project = runCatching {
-                parseProject(definitionFile)
+                parseProject(definitionFile, analysisRoot, managerName)
             }.getOrElse {
                 logger.error { "Failed to parse project information: ${it.collectMessages()}" }
                 Project.EMPTY
@@ -199,7 +196,7 @@ open class Npm(
             }
 
             val project = runCatching {
-                parseProject(projectDir.resolve("package.json"))
+                parseProject(projectDir.resolve("package.json"), analysisRoot, managerName)
             }.getOrElse {
                 issues += createAndLogIssue(
                     source = managerName,
@@ -261,7 +258,7 @@ open class Npm(
     /**
      * Find the directories which are defined as submodules of the project within [moduleDir].
      */
-    protected fun findWorkspaceSubmodules(moduleDir: File): Set<File> =
+    private fun findWorkspaceSubmodules(moduleDir: File): Set<File> =
         submodulesCache.getOrPut(moduleDir.absolutePath) {
             loadWorkspaceSubmodules(moduleDir)
         }
@@ -392,47 +389,6 @@ open class Npm(
             )
         }
 
-    private fun parseProject(packageJsonFile: File): Project {
-        logger.debug { "Parsing project info from '$packageJsonFile'." }
-
-        val packageJson = parsePackageJson(packageJsonFile)
-
-        val rawName = packageJson.name.orEmpty()
-        val (namespace, name) = splitNpmNamespaceAndName(rawName)
-
-        val projectName = name.ifBlank {
-            getFallbackProjectName(analysisRoot, packageJsonFile).also {
-                logger.warn { "'$packageJsonFile' does not define a name, falling back to '$it'." }
-            }
-        }
-
-        val version = packageJson.version.orEmpty()
-        if (version.isBlank()) {
-            logger.warn { "'$packageJsonFile' does not define a version." }
-        }
-
-        val declaredLicenses = packageJson.licenses.mapNpmLicenses()
-        val authors = parseNpmAuthor(packageJson.authors.firstOrNull()) // TODO: parse all authors.
-        val homepageUrl = packageJson.homepage.orEmpty()
-        val projectDir = packageJsonFile.parentFile.realFile()
-        val vcsFromPackage = parseNpmVcsInfo(packageJson)
-
-        return Project(
-            id = Identifier(
-                type = managerName,
-                namespace = namespace,
-                name = projectName,
-                version = version
-            ),
-            definitionFilePath = VersionControlSystem.getPathInfo(packageJsonFile.realFile()).path,
-            authors = authors,
-            declaredLicenses = declaredLicenses,
-            vcs = vcsFromPackage,
-            vcsProcessed = processProjectVcs(projectDir, vcsFromPackage, homepageUrl),
-            homepageUrl = homepageUrl
-        )
-    }
-
     /**
      * Install dependencies using the given package manager command.
      */
@@ -641,3 +597,44 @@ internal fun parsePackage(
 
     return module
 }
+
+internal fun parseProject(packageJsonFile: File, analysisRoot: File, managerName: String): Project {
+    Npm.logger.debug { "Parsing project info from '$packageJsonFile'." }
+
+    val packageJson = parsePackageJson(packageJsonFile)
+
+    val rawName = packageJson.name.orEmpty()
+    val (namespace, name) = splitNpmNamespaceAndName(rawName)
+
+    val projectName = name.ifBlank {
+        getFallbackProjectName(analysisRoot, packageJsonFile).also {
+            Npm.logger.warn { "'$packageJsonFile' does not define a name, falling back to '$it'." }
+        }
+    }
+
+    val version = packageJson.version.orEmpty()
+    if (version.isBlank()) {
+        Npm.logger.warn { "'$packageJsonFile' does not define a version." }
+    }
+
+    val declaredLicenses = packageJson.licenses.mapNpmLicenses()
+    val authors = parseNpmAuthor(packageJson.authors.firstOrNull()) // TODO: parse all authors.
+    val homepageUrl = packageJson.homepage.orEmpty()
+    val projectDir = packageJsonFile.parentFile.realFile()
+    val vcsFromPackage = parseNpmVcsInfo(packageJson)
+
+    return Project(
+        id = Identifier(
+            type = managerName,
+            namespace = namespace,
+            name = projectName,
+            version = version
+        ),
+        definitionFilePath = VersionControlSystem.getPathInfo(packageJsonFile.realFile()).path,
+        authors = authors,
+        declaredLicenses = declaredLicenses,
+        vcs = vcsFromPackage,
+        vcsProcessed = processProjectVcs(projectDir, vcsFromPackage, homepageUrl),
+        homepageUrl = homepageUrl
+    )
+}

plugins/package-managers/node/src/main/kotlin/pnpm/ModuleInfo.kt

@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2024 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+package org.ossreviewtoolkit.plugins.packagemanagers.node.pnpm
+
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+
+private val JSON = Json { ignoreUnknownKeys = true }
+
+internal fun parsePnpmList(json: String): List<ModuleInfo> = JSON.decodeFromString(json)
+
+@Serializable
+internal data class ModuleInfo(
+    val name: String,
+    val version: String,
+    val path: String,
+    val private: Boolean,
+    val dependencies: Map<String, Dependency> = emptyMap(),
+    val devDependencies: Map<String, Dependency> = emptyMap(),
+    val optionalDependencies: Map<String, Dependency> = emptyMap()
+) {
+    @Serializable
+    data class Dependency(
+        val from: String,
+        val version: String,
+        val resolved: String? = null,
+        val path: String,
+        val dependencies: Map<String, Dependency> = emptyMap(),
+        val optionalDependencies: Map<String, Dependency> = emptyMap()
+    )
+}