test: Add tests for pypi and pypi_resolver

packagemanager/pypi.go

@@ -76,7 +76,7 @@ func (pip *pipPackageManager) ParseCommand(args []string) (*ParsedCommand, error
 				version = strings.TrimPrefix(version, "==")
 			} else {
 				// Version range, resolve from PyPI
-				version, err = pipGetLatestMatchingVersion(packageName, version)
+				version, err = pipGetMatchingVersion(packageName, version)
 				if err != nil {
 					return nil, fmt.Errorf("error resolving version for %s: %s", packageName, err.Error())
 				}
@@ -146,16 +146,43 @@ func pipParsePackageInfo(input string) (packageName, version string, err error)
 	return packageName, version, nil
 }
 
-// convert "~=3.1.0" → ">=3.1.0,<3.2.0"
 func pipConvertCompatibleRelease(version string) string {
+	if !strings.HasPrefix(version, "~=") {
+		return version
+	}
+
 	version = strings.TrimPrefix(version, "~=")
 	parts := strings.Split(version, ".")
 	if len(parts) < 2 {
 		return "" // invalid
 	}
+
+	if len(parts) == 2 {
+		// ~=X.Y case, increment major version: ~=2.1 -> >=2.1,<3.0
+		major := parts[0]
+		nextMajor, _ := strconv.Atoi(major)
+		nextMajor += 1
+		return fmt.Sprintf(">=%s,<%d.0", version, nextMajor)
+	} else if len(parts) == 3 {
+		// ~=X.Y.Z case, increment minor version: ~=2.1.5 -> >=2.1.5,<2.2.0
 		major := parts[0]
 		minor := parts[1]
 		nextMinor, _ := strconv.Atoi(minor)
 		nextMinor += 1
 		return fmt.Sprintf(">=%s,<%s.%d.0", version, major, nextMinor)
+	} else {
+		// ~=X.Y.Z.W[.more] case, increment second-to-last component
+		// ~=2.1.5.2 -> >=2.1.5.2,<2.1.6
+		incIndex := len(parts) - 2
+		upperBoundParts := make([]string, incIndex+1)
+		copy(upperBoundParts, parts[:incIndex+1])
+
+		increment, _ := strconv.Atoi(upperBoundParts[incIndex])
+		increment++
+		upperBoundParts[incIndex] = strconv.Itoa(increment)
+
+		upperBound := strings.Join(upperBoundParts, ".")
+
+		return fmt.Sprintf(">=%s,<%s", version, upperBound)
+	}
 }

packagemanager/pypi_resolver.go

@@ -92,7 +92,12 @@ type PyPIPackage struct {
 
 var httpClient = &http.Client{Timeout: 10 * time.Second}
 
-func pipGetLatestMatchingVersion(packageName, versionConstraint string) (string, error) {
+func pipGetMatchingVersion(packageName, versionConstraint string) (string, error) {
+	// Already a exact version
+	if strings.HasPrefix(versionConstraint, "==") {
+		return versionConstraint, nil
+	}
+
 	// Handle compatible release operator
 	if strings.HasPrefix(versionConstraint, "~=") {
 		versionConstraint = pipConvertCompatibleRelease(versionConstraint)

packagemanager/pypi_resolver_test.go

@@ -0,0 +1,98 @@
+package packagemanager
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	"github.com/safedep/dry/semver"
+	"github.com/stretchr/testify/require"
+)
+
+func TestPypiDependencyResolver_ResolveLatestVersion(t *testing.T) {
+	cases := []struct {
+		name     string
+		pkg      *packagev1.Package
+		assertFn func(t *testing.T, pv *packagev1.PackageVersion, err error)
+	}{
+		{
+			name: "should resolve latest version for a package",
+			pkg: &packagev1.Package{
+				Name:      "requests",
+				Ecosystem: packagev1.Ecosystem_ECOSYSTEM_PYPI,
+			},
+			assertFn: func(t *testing.T, pv *packagev1.PackageVersion, err error) {
+				require.NoError(t, err)
+				require.True(t, semver.IsAhead("2.30.0", pv.Version))
+			},
+		},
+		{
+			name: "should return an error if the package is not found",
+			pkg: &packagev1.Package{
+				Name:      "nonexistent-package-12345",
+				Ecosystem: packagev1.Ecosystem_ECOSYSTEM_PYPI,
+			},
+			assertFn: func(t *testing.T, pv *packagev1.PackageVersion, err error) {
+				require.Error(t, err)
+				require.Nil(t, pv)
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			resolver, err := NewPypiDependencyResolver(NewDefaultPypiDependencyResolverConfig())
+			require.NoError(t, err)
+
+			pv, err := resolver.ResolveLatestVersion(context.Background(), tc.pkg)
+			tc.assertFn(t, pv, err)
+		})
+	}
+}
+
+func TestPipGetLatestMatchingVersion(t *testing.T) {
+	cases := []struct {
+		name              string
+		packageName       string
+		versionConstraint string
+		assertFn          func(t *testing.T, version string, err error)
+	}{
+		{
+			name:              "should resolve exact version",
+			packageName:       "requests",
+			versionConstraint: "==2.28.0",
+			assertFn: func(t *testing.T, version string, err error) {
+				require.NoError(t, err)
+				require.Equal(t, "==2.28.0", version)
+			},
+		},
+		{
+			name:              "should resolve compatible version",
+			packageName:       "requests",
+			versionConstraint: "~=2.26.0",
+			assertFn: func(t *testing.T, version string, err error) {
+				require.NoError(t, err)
+				require.NotEmpty(t, version)
+				fmt.Println("Version: ", version)
+				require.True(t, semver.IsAheadOrEqual("2.26.0", version) && !semver.IsAhead("2.27.0", version))
+			},
+		},
+		{
+			name:              "should return error for nonexistent package",
+			packageName:       "nonexistent-package-12345",
+			versionConstraint: ">=1.0.0",
+			assertFn: func(t *testing.T, version string, err error) {
+				require.Error(t, err)
+				require.Empty(t, version)
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			version, err := pipGetMatchingVersion(tc.packageName, tc.versionConstraint)
+			tc.assertFn(t, version, err)
+		})
+	}
+}

packagemanager/pypi_test.go

@@ -0,0 +1,147 @@
+package packagemanager
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPipParsePackageInfo(t *testing.T) {
+	cases := []struct {
+		name    string
+		input   string
+		pkgName string
+		version string
+		wantErr bool
+	}{
+		{
+			name:    "simple package name",
+			input:   "fastapi",
+			pkgName: "fastapi",
+			version: "",
+			wantErr: false,
+		},
+		{
+			name:    "package with exact version",
+			input:   "fastapi==0.115.7",
+			pkgName: "fastapi",
+			version: "==0.115.7",
+			wantErr: false,
+		},
+		{
+			name:    "package with version range",
+			input:   "requests>=2.0,<3.0",
+			pkgName: "requests",
+			version: ">=2.0,<3.0",
+			wantErr: false,
+		},
+		{
+			name:    "package with exclusion",
+			input:   "pydantic!=1.8,!=1.8.1",
+			pkgName: "pydantic",
+			version: "!=1.8,!=1.8.1",
+			wantErr: false,
+		},
+		{
+			name:    "package with compatible release",
+			input:   "django~=3.1.0",
+			pkgName: "django",
+			version: "~=3.1.0",
+			wantErr: false,
+		},
+		{
+			name:    "package with greater than",
+			input:   "numpy>1.20.0",
+			pkgName: "numpy",
+			version: ">1.20.0",
+			wantErr: false,
+		},
+		{
+			name:    "package with less than",
+			input:   "pandas<2.0.0",
+			pkgName: "pandas",
+			version: "<2.0.0",
+			wantErr: false,
+		},
+		{
+			name:    "empty input",
+			input:   "",
+			pkgName: "",
+			version: "",
+			wantErr: true,
+		},
+		{
+			name:    "only version specifier",
+			input:   "==1.0.0",
+			pkgName: "",
+			version: "",
+			wantErr: true,
+		},
+		{
+			name:    "package with whitespace",
+			input:   "  requests  ==  2.0.0  ",
+			pkgName: "requests",
+			version: "==  2.0.0",
+			wantErr: false,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			pkgName, version, err := pipParsePackageInfo(tc.input)
+			if tc.wantErr {
+				assert.Error(t, err)
+			} else {
+				assert.NoError(t, err)
+				assert.Equal(t, tc.pkgName, pkgName)
+				assert.Equal(t, tc.version, version)
+			}
+		})
+	}
+}
+
+func TestPipConvertCompatibleRelease(t *testing.T) {
+	cases := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "standard version",
+			input:    "~=3.1.0",
+			expected: ">=3.1.0,<3.2.0",
+		},
+		{
+			name:     "single digit minor",
+			input:    "~=2.1.5",
+			expected: ">=2.1.5,<2.2.0",
+		},
+		{
+			name:     "double digit minor",
+			input:    "~=1.10.0",
+			expected: ">=1.10.0,<1.11.0",
+		},
+		{
+			name:     "invalid format",
+			input:    "~=1",
+			expected: "",
+		},
+		{
+			name:     "missing prefix",
+			input:    "3.1.0",
+			expected: "3.1.0",
+		},
+		{
+			name:     "extra segments",
+			input:    "~=2.1.5.2",
+			expected: ">=2.1.5.2,<2.1.6",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			result := pipConvertCompatibleRelease(tc.input)
+			assert.Equal(t, tc.expected, result)
+		})
+	}
+}