Pnpm suppport (#6)

* fix: resolves issues #3 and #4

* feat: add pnpm support & introduce pkg manager wrap for npm

pkg/common/utils/command.go

@@ -1,7 +1,6 @@
 package utils
 
 import (
-	"fmt"
 	"os"
 	"os/exec"
 )
@@ -10,8 +9,10 @@ func ExecCmd(name string, args, env []string) error {
 	cmd := exec.Command(name, args...)
 	cmd.Env = append(os.Environ(), env...)
 
-	if err := cmd.Run(); err != nil {
-		return fmt.Errorf("error running cmd %s: %s\n", name, err.Error())
-	}
-	return nil
+	// Connect to standard streams
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	cmd.Stdin = os.Stdin
+
+	return cmd.Run()
 }

pkg/common/utils/config.go

@@ -1,6 +1,10 @@
 package utils
 
-import "os"
+import (
+	"fmt"
+	"os"
+	"strings"
+)
 
 func ApiKey() string {
 	return os.Getenv("SAFEDEP_API_KEY")
@@ -13,3 +17,35 @@ func TenantDomain() string {
 func NpmAuthToken() string {
 	return os.Getenv("NPM_AUTH_TOKEN")
 }
+
+func ValidateEnvVars() error {
+	apiKey := ApiKey()
+	tenantId := TenantDomain()
+	var missingVars []string
+
+	if apiKey == "" {
+		missingVars = append(missingVars, "SAFEDEP_API_KEY")
+	}
+	if tenantId == "" {
+		missingVars = append(missingVars, "SAFEDEP_TENANT_ID")
+	}
+
+	if len(missingVars) > 0 {
+		return fmt.Errorf(`
+SafeDep configuration incomplete
+
+Missing environment variables:
+  %s
+
+To enable package scanning:
+  1. Export these variables in your terminal:
+     export %s=your_api_key
+     export %s=your_tenant_id
+  2. Or add them to your shell profile file
+
+For more information, visit: https://docs.safedep.io/cloud/quickstart
+`, strings.Join(missingVars, "\n  "), missingVars[0], missingVars[len(missingVars)-1])
+	}
+
+	return nil
+}

pkg/common/utils/utils.go

@@ -33,3 +33,23 @@ func ParsePackageInfo(input string) (packageName, version string, err error) {
 
 	return "", "", fmt.Errorf("invalid format: expected 'package' OR 'package@version', got '%s'", input)
 }
+
+func IsInstallCommand(pkgManager, cmd string) bool {
+	validActions := map[string]map[string]bool{
+		"npm": {
+			"install": true,
+			"i":       true,
+			"add":     true,
+		},
+		"pnpm": {
+			"add":     true,
+			"install": true,
+			"i":       true,
+		},
+	}
+
+	if actions, exists := validActions[pkgManager]; exists {
+		return actions[cmd]
+	}
+	return false
+}

pkg/registry/factory.go

@@ -10,6 +10,7 @@ type RegistryType string
 
 const (
 	RegistryNPM  RegistryType = "npm"
+	RegistryPNPM RegistryType = "pnpm"
 	RegistryPyPI RegistryType = "pypi"
 	RegistryGo   RegistryType = "go"
 )
@@ -29,7 +30,7 @@ func NewFetcherFactory(timeout time.Duration) *FetcherFactory {
 // CreateFetcher returns a fetcher for the specified registry type
 func (ff *FetcherFactory) CreateFetcher(registryType RegistryType) (Fetcher, error) {
 	switch registryType {
-	case RegistryNPM:
+	case RegistryNPM, RegistryPNPM:
 		return NewNpmFetcher(ff.timeout), nil
 	default:
 		return nil, fmt.Errorf("unsupported registry type: %s", registryType)

pkg/wrapper/npm_base.go

@@ -0,0 +1,154 @@
+package wrapper
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/safedep/dry/log"
+	"github.com/safedep/pmg/internal/ui"
+	"github.com/safedep/pmg/pkg/analyser"
+	"github.com/safedep/pmg/pkg/common/utils"
+	"github.com/safedep/pmg/pkg/models"
+	"github.com/safedep/pmg/pkg/registry"
+	vetUtils "github.com/safedep/vet/pkg/common/utils"
+)
+
+type PackageManagerWrapper struct {
+	RegistryType registry.RegistryType
+	Action       string
+	PackageName  string
+}
+
+func NewPackageManagerWrapper(registryType registry.RegistryType) *PackageManagerWrapper {
+	return &PackageManagerWrapper{
+		RegistryType: registryType,
+	}
+}
+
+func (pmw *PackageManagerWrapper) Wrap() error {
+	ui.StartProgressWriter()
+
+	progressTracker := ui.TrackProgress(fmt.Sprintf("Scanning %s ", pmw.PackageName), 1)
+	if pmw.PackageName == "" {
+		return fmt.Errorf("package name cannot be empty")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Minute)
+	defer cancel()
+
+	if err := pmw.scanAndInstall(ctx, progressTracker); err != nil {
+		return err
+	}
+
+	log.Infof("Successfully installed %s", pmw.PackageName)
+	return nil
+}
+
+func (pmw *PackageManagerWrapper) scanAndInstall(ctx context.Context, progressTracker ui.ProgressTracker) error {
+	factory := registry.NewFetcherFactory(10 * time.Second)
+	fetcher, err := factory.CreateFetcher(pmw.RegistryType)
+	if err != nil {
+		return err
+	}
+
+	name, version, err := utils.ParsePackageInfo(pmw.PackageName)
+	if err != nil {
+		return err
+	}
+
+	if version == "" {
+		version, err = pmw.resolveLatestVersion(ctx, fetcher, name)
+		if err != nil {
+			return err
+		}
+		pmw.PackageName = fmt.Sprintf("%s@%s", name, version)
+	}
+
+	deps, err := pmw.getDependencies(ctx, fetcher, name, version, progressTracker)
+	if err != nil {
+		return err
+	}
+
+	if err := pmw.analyzeDependencies(ctx, deps, progressTracker); err != nil {
+		return err
+	}
+
+	return pmw.executeInstallation()
+}
+
+func (pmw *PackageManagerWrapper) resolveLatestVersion(ctx context.Context, fetcher registry.Fetcher, name string) (string, error) {
+	log.Infof("No version specified for %s, fetching latest version...", name)
+	version, err := fetcher.(*registry.NpmFetcher).ResolveVersion(ctx, name, "")
+	if err != nil {
+		return "", err
+	}
+	log.Infof("Latest version of %s is %s", name, version)
+	return version, nil
+}
+
+func (pmw *PackageManagerWrapper) getDependencies(ctx context.Context, fetcher registry.Fetcher, name, version string, progressTracker ui.ProgressTracker) ([]string, error) {
+	ui.IncrementProgress(progressTracker, 1)
+	deps, err := fetcher.GetFlattenedDependencies(ctx, name, version)
+	ui.IncrementProgress(progressTracker, 1)
+	if err != nil {
+		return nil, err
+	}
+	ui.IncrementTrackerTotal(progressTracker, int64(len(deps)))
+	return deps, nil
+}
+
+func (pmw *PackageManagerWrapper) analyzeDependencies(ctx context.Context, deps []string, progressTracker ui.ProgressTracker) error {
+	client, err := analyser.GetMalwareAnalysisClient()
+	if err != nil {
+		return fmt.Errorf("error while creating a malware analysis client: %w", err)
+	}
+
+	pkgAnalyser := analyser.New(client, ctx)
+	pkgAnalyser.ProgressTracker = progressTracker
+	handler := pkgAnalyser.Handler()
+
+	queue := vetUtils.NewWorkQueue[models.Package](100, 10, handler)
+	queue.Start()
+	defer queue.Stop()
+
+	for _, dep := range deps {
+		name, version, err := utils.ParsePackageInfo(dep)
+		if err != nil {
+			log.Errorf("Error while parsing info of package %s", name)
+			continue
+		}
+		queue.Add(models.Package{
+			Name:    name,
+			Version: version,
+		})
+	}
+
+	queue.Wait()
+	ui.MarkTrackerAsDone(progressTracker)
+	ui.StopProgressWriter()
+
+	if len(pkgAnalyser.MaliciousPkgs) > 0 {
+		if !utils.ConfirmInstallation(pkgAnalyser.MaliciousPkgs) {
+			log.Infof("Installation canceled due to security concerns")
+			return fmt.Errorf("installation canceled")
+		}
+		log.Warnf("Continuing installation despite security warnings...")
+	}
+
+	return nil
+}
+
+func (pmw *PackageManagerWrapper) executeInstallation() error {
+	execPath, err := utils.GetExecutablePath(string(pmw.RegistryType))
+	if err != nil {
+		return fmt.Errorf("%s not found: %w", pmw.RegistryType, err)
+	}
+
+	cmdArgs := []string{pmw.Action, pmw.PackageName}
+	if err = utils.ExecCmd(execPath, cmdArgs, []string{}); err != nil {
+		return fmt.Errorf("failed to execute %s command: %w", pmw.RegistryType, err)
+	}
+
+	return nil
+}