replaced arborist with arborist bundle & common func for analysis

cmd/ecosystems/npm.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"net/http"
 	"os"
-	"os/exec"
 	"strings"
 
 	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
@@ -15,7 +14,7 @@ import (
 	malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
 	drygrpc "github.com/safedep/dry/adapters/grpc"
 	"github.com/safedep/dry/log"
-	"github.com/safedep/pmg/common"
+	"github.com/safedep/pmg/pkg/common"
 	"github.com/spf13/cobra"
 	"google.golang.org/grpc"
 )
@@ -25,7 +24,7 @@ var (
 	action      string
 )
 
-//go:embed tree/arborist.js
+//go:embed tree/arborist-bundle.js
 var arboristJs string
 
 func NewNpmCommand() *cobra.Command {
@@ -36,7 +35,11 @@ func NewNpmCommand() *cobra.Command {
 			action = args[0]
 			packageName = args[1]
 			if action == "install" {
-				wrapNpm()
+				err := wrapNpm()
+				if err != nil {
+					// TODO
+					log.Fatalf("wrapNpm: ", err.Error())
+				}
 			}
 			return nil
 		},
@@ -45,19 +48,23 @@ func NewNpmCommand() *cobra.Command {
 }
 
 func wrapNpm() error {
-	data, err := common.RunPkgExtractor(common.ExtractorOptions{
-		ScriptType:    "js",
-		Interpreter:   "node",
+	outputFile, err := common.RunPkgExtractor(common.ExtractorOptions{
 		PackageName:   packageName,
 		ScriptContent: arboristJs,
+		Interpreter:   "node",
+		ScriptType:    "js",
 		Args:          []string{},
 	})
-
 	if err != nil {
 		return err
 	}
 
-	lines := strings.SplitSeq(data, "\n")
+	data, err := os.ReadFile(outputFile)
+	if err != nil {
+		return fmt.Errorf("Error while reading package output file: %s", err.Error())
+	}
+
+	lines := strings.SplitSeq(string(data), "\n")
 	for line := range lines {
 		line = strings.TrimSpace(line)
 		if line == "" || !strings.Contains(line, "@") {
@@ -116,13 +123,11 @@ func wrapNpm() error {
 
 	}
 
-	// Get the npm PATH (using exec.LookPath)
-	_, err = exec.LookPath("npm")
-
+	// TODO:
+	// Get the npm PATH
 	// Check if any vulnerable package exists?
 	// If yes - Confirm with user to continue or not
 	// If no - Install the pkg & return
-
-	//  If continue - Install the pkg
-
+	// If continue - Install the pkg
+	return nil
 }

cmd/ecosystems/tree/arborist.js

@@ -1,60 +0,0 @@
-const Arborist = require("@npmcli/arborist");
-const fs = require("fs");
-
-async function getDependencyTree(packageName) {
-  const arb = new Arborist({
-    registry: "https://registry.npmjs.org",
-    token: "",
-    authToken: "",
-  });
-  try {
-    const idealTree = await arb.buildIdealTree({
-      add: [packageName],
-    });
-    const packageNames = [];
-    idealTree.children.forEach((node) => {
-      packageNames.push(`${node.name}@${node.version}`);
-    });
-    return packageNames;
-  } catch (error) {
-    console.error(`Failed to fetch dependency tree for ${packageName}:`, error);
-    return [];
-  }
-}
-
-/**
- * Write dependency list to a file
- * @param {string[]} packages - List of package dependencies
- * @param {string} filename - Output filename
- */
-function writeToFile(packages, filename) {
-  try {
-    fs.writeFileSync(filename, packages.join("\n"), "utf8");
-    console.log(`Dependencies written to ${filename}`);
-  } catch (error) {
-    console.error(`Failed to write to file ${filename}:`, error);
-    process.exit(1);
-  }
-}
-
-const packageArg = process.argv[2];
-const outputFile = process.argv[3];
-
-if (!packageArg) {
-  console.error("Please provide a package name as an argument");
-  process.exit(1);
-}
-
-if (!outputFile) {
-  console.error("Please provide an output filename as the second argument");
-  process.exit(1);
-}
-
-getDependencyTree(packageArg)
-  .then((packages) => {
-    writeToFile(packages, outputFile);
-  })
-  .catch((err) => {
-    console.error("Error:", err);
-    process.exit(1);
-  });

pkg/analyser/analysis.go

@@ -0,0 +1,43 @@
+package analyser
+
+import (
+	"context"
+	"fmt"
+
+	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
+	malysisv1pb "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/malysis/v1"
+	packagev1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/messages/package/v1"
+	malysisv1 "buf.build/gen/go/safedep/api/protocolbuffers/go/safedep/services/malysis/v1"
+)
+
+func SubmitPackageForAnalysis(client malysisv1grpc.MalwareAnalysisServiceClient,
+	ecosystem packagev1.Ecosystem, name string,
+	version string) (string, error) {
+	req := &malysisv1.AnalyzePackageRequest{
+		Target: &malysisv1pb.PackageAnalysisTarget{
+			PackageVersion: &packagev1.PackageVersion{
+				Package: &packagev1.Package{
+					Ecosystem: ecosystem,
+					Name:      name,
+				},
+				Version: version,
+			},
+		},
+	}
+	resp, err := client.AnalyzePackage(context.Background(), req)
+	if err != nil {
+		return "", fmt.Errorf("failed to analyze %s@%s: %v", name, version, err)
+	}
+	return resp.GetAnalysisId(), nil
+}
+func GetAnalysisReport(client malysisv1grpc.MalwareAnalysisServiceClient,
+	analysisId string) (*malysisv1pb.Report, error) {
+	analysisReportReq := &malysisv1.GetAnalysisReportRequest{
+		AnalysisId: analysisId,
+	}
+	reportResp, err := client.GetAnalysisReport(context.Background(), analysisReportReq)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get analysis report: %v", err)
+	}
+	return reportResp.GetReport(), nil
+}

pkg/analyser/client.go

@@ -0,0 +1,27 @@
+package analyser
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+
+	"buf.build/gen/go/safedep/api/grpc/go/safedep/services/malysis/v1/malysisv1grpc"
+	drygrpc "github.com/safedep/dry/adapters/grpc"
+	"google.golang.org/grpc"
+)
+
+func GetMalwareAnalysisClient() (malysisv1grpc.MalwareAnalysisServiceClient, error) {
+	tok := os.Getenv("SAFEDEP_API_KEY")
+	tenantId := os.Getenv("SAFEDEP_TENANT_ID")
+	if tok == "" || tenantId == "" {
+		return nil, fmt.Errorf("SAFEDEP_API_KEY and SAFEDEP_TENANT_ID must be set")
+	}
+	headers := http.Header{}
+	headers.Set("x-tenant-id", tenantId)
+	cc, err := drygrpc.GrpcClient("pmg-pkg-scan", "api.safedep.io", "443",
+		tok, headers, []grpc.DialOption{})
+	if err != nil {
+		return nil, fmt.Errorf("failed to create gRPC client: %v", err)
+	}
+	return malysisv1grpc.NewMalwareAnalysisServiceClient(cc), nil
+}