Tweak alert types and add alert fix type

jdalton · jdalton · commit 527a77905f13 · 2025-03-21T20:48:15.000-04:00
diff --git a/src/commands/diff-scan/fetch-diff-scan.ts b/src/commands/diff-scan/fetch-diff-scan.ts
@@ -1,7 +1,7 @@
 import colors from 'yoctocolors-cjs'
 
 import constants from '../../constants'
-import { handleAPIError, handleApiCall, queryAPI } from '../../utils/api'
+import { handleApiCall, handleApiError, queryApi } from '../../utils/api'
 import { AuthError } from '../../utils/errors'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -47,15 +47,15 @@ export async function fetchDiffScanWithToken(
 
   spinner.start('Fetching diff-scan...')
 
-  const response = await queryAPI(
+  const response = await queryApi(
     `orgs/${orgSlug}/full-scans/diff?before=${encodeURIComponent(before)}&after=${encodeURIComponent(after)}`,
     apiToken
   )
 
   spinner?.successAndStop('Received diff-scan response')
 
   if (!response.ok) {
-    const err = await handleAPIError(response.status)
+    const err = await handleApiError(response.status)
     spinner.errorAndStop(
       `${colors.bgRed(colors.white(response.statusText))}: ${err}`
     )
diff --git a/src/commands/info/output-package-info.ts b/src/commands/info/output-package-info.ts
@@ -5,7 +5,7 @@ import constants from '@socketsecurity/registry/lib/constants'
 import { logger } from '@socketsecurity/registry/lib/logger'
 import { hasKeys } from '@socketsecurity/registry/lib/objects'
 
-import { SEVERITY, formatSeverityCount } from '../../utils/alert/severity'
+import { ALERT_SEVERITY, formatSeverityCount } from '../../utils/alert/severity'
 import { ColorOrMarkdown } from '../../utils/color-or-markdown'
 import {
   getSocketDevAlertUrl,
@@ -32,8 +32,8 @@ function outputPackageIssuesDetails(
 ) {
   const issueDetails = packageData.filter(
     d =>
-      d.value?.severity === SEVERITY.critical ||
-      d.value?.severity === SEVERITY.high
+      d.value?.severity === ALERT_SEVERITY.critical ||
+      d.value?.severity === ALERT_SEVERITY.high
   )
   const uniqueIssueDetails = issueDetails.reduce((acc, issue) => {
     const { type } = issue
diff --git a/src/commands/scan/fetch-report-data.ts b/src/commands/scan/fetch-report-data.ts
@@ -3,7 +3,7 @@ import colors from 'yoctocolors-cjs'
 import { logger } from '@socketsecurity/registry/lib/logger'
 
 import constants from '../../constants'
-import { handleAPIError, handleApiCall, queryAPI } from '../../utils/api'
+import { handleApiCall, handleApiError, queryApi } from '../../utils/api'
 import { AuthError } from '../../utils/errors'
 import { getDefaultToken, setupSdk } from '../../utils/sdk'
 
@@ -102,7 +102,7 @@ export async function fetchReportData(
   ] = await Promise.all([
     (async () => {
       try {
-        const response = await queryAPI(
+        const response = await queryApi(
           `orgs/${orgSlug}/full-scans/${encodeURIComponent(fullScanId)}`,
           apiToken
         )
@@ -111,7 +111,7 @@ export async function fetchReportData(
         updateProgress()
 
         if (!response.ok) {
-          const err = await handleAPIError(response.status)
+          const err = await handleApiError(response.status)
           logger.fail(
             `${colors.bgRed(colors.white(response.statusText))}: Fetch error: ${err}`
           )
diff --git a/src/commands/scan/get-full-scan.ts b/src/commands/scan/get-full-scan.ts
@@ -3,7 +3,7 @@ import colors from 'yoctocolors-cjs'
 import { logger } from '@socketsecurity/registry/lib/logger'
 
 import constants from '../../constants'
-import { handleAPIError, queryAPI } from '../../utils/api'
+import { handleApiError, queryApi } from '../../utils/api'
 import { AuthError } from '../../utils/errors'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -25,15 +25,15 @@ export async function getFullScan(
 
   spinner.start('Fetching full-scan...')
 
-  const response = await queryAPI(
+  const response = await queryApi(
     `orgs/${orgSlug}/full-scans/${encodeURIComponent(fullScanId)}`,
     apiToken
   )
 
   spinner.stop('Fetch complete.')
 
   if (!response.ok) {
-    const err = await handleAPIError(response.status)
+    const err = await handleApiError(response.status)
     logger.fail(
       `${colors.bgRed(colors.white(response.statusText))}: Fetch error: ${err}`
     )
diff --git a/src/commands/threat-feed/get-threat-feed.ts b/src/commands/threat-feed/get-threat-feed.ts
@@ -10,7 +10,7 @@ import TableWidget from 'blessed-contrib/lib/widget/table'
 import { logger } from '@socketsecurity/registry/lib/logger'
 
 import constants from '../../constants'
-import { queryAPI } from '../../utils/api'
+import { queryApi } from '../../utils/api'
 import { AuthError } from '../../utils/errors'
 import { getDefaultToken } from '../../utils/sdk'
 
@@ -90,7 +90,7 @@ async function getThreatFeedWithToken({
 
   spinner.start('Fetching Threat Feed data...')
 
-  const response = await queryAPI(`threat-feed?${queryParams}`, apiToken)
+  const response = await queryApi(`threat-feed?${queryParams}`, apiToken)
   const data = (await response.json()) as {
     results: ThreatResult[]
     nextPage: string
diff --git a/src/constants.ts b/src/constants.ts
@@ -57,8 +57,6 @@ type IPC = Readonly<{
 type Constants = Remap<
   Omit<typeof registryConstants, 'Symbol(kInternalsSymbol)' | 'ENV' | 'IPC'> & {
     readonly 'Symbol(kInternalsSymbol)': Internals
-    readonly ALERT_FIX_TYPE_CVE: 'cve'
-    readonly ALERT_FIX_TYPE_UPGRADE: 'upgrade'
     readonly ALERT_TYPE_CRITICAL_CVE: 'criticalCVE'
     readonly ALERT_TYPE_CVE: 'cve'
     readonly ALERT_TYPE_MEDIUM_CVE: 'mediumCVE'
@@ -128,8 +126,6 @@ type Constants = Remap<
   }
 >
 
-const ALERT_FIX_TYPE_CVE = 'cve'
-const ALERT_FIX_TYPE_UPGRADE = 'upgrade'
 const ALERT_TYPE_CRITICAL_CVE = 'criticalCVE'
 const ALERT_TYPE_CVE = 'cve'
 const ALERT_TYPE_MEDIUM_CVE = 'mediumCVE'
@@ -303,8 +299,6 @@ const lazyZshRcPath = () =>
 
 const constants = createConstantsObject(
   {
-    ALERT_FIX_TYPE_CVE,
-    ALERT_FIX_TYPE_UPGRADE,
     ALERT_TYPE_CRITICAL_CVE,
     ALERT_TYPE_CVE,
     ALERT_TYPE_MEDIUM_CVE,
diff --git a/src/utils/alert/fix.ts b/src/utils/alert/fix.ts
@@ -0,0 +1,4 @@
+export enum ALERT_FIX_TYPE {
+  cve = 'cve',
+  upgrade = 'upgrade'
+}
diff --git a/src/utils/alert/rules.ts b/src/utils/alert/rules.ts
@@ -185,29 +185,35 @@ export async function uxLookup(
         const sockSdk = await setupSdk(getPublicToken())
         const orgResult = await sockSdk.getOrganizations()
         if (!orgResult.success) {
+          if (orgResult.status === 429) {
+            throw new Error(
+              `API token quota exceeded: ${orgResult.error}`
+            )
+          }
           throw new Error(
-            `Failed to fetch Socket organization info: ${orgResult.error.message}`
+            `Failed to fetch Socket organization info: ${orgResult.error}`
           )
         }
+        const { organizations } = orgResult.data
         const orgs: Array<
-          Exclude<(typeof orgResult.data.organizations)[string], undefined>
+          Exclude<(typeof organizations)[string], undefined>
         > = []
-        for (const org of Object.values(orgResult.data.organizations)) {
+        for (const org of Object.values(organizations)) {
           if (org) {
             orgs.push(org)
           }
         }
-        const result = await sockSdk.postSettings(
+        const settingsResult = await sockSdk.postSettings(
           orgs.map(org => ({ organization: org.id }))
         )
-        if (!result.success) {
+        if (!settingsResult.success) {
           throw new Error(
-            `Failed to fetch API key settings: ${result.error.message}`
+            `Failed to fetch API key settings: ${settingsResult.error}`
           )
         }
         return {
           orgs,
-          settings: result.data
+          settings: settingsResult.data
         }
       } catch (e) {
         const cause = isObject(e) && 'cause' in e ? e['cause'] : undefined
diff --git a/src/utils/alert/severity.ts b/src/utils/alert/severity.ts
@@ -3,6 +3,13 @@ import { stringJoinWithSeparateFinalSeparator } from '../strings'
 
 import type { SocketSdkReturnType } from '@socketsecurity/sdk'
 
+export enum ALERT_SEVERITY {
+  critical = 'critical',
+  high = 'high',
+  middle = 'middle',
+  low = 'low'
+}
+
 export type SocketSdkAlertList =
   SocketSdkReturnType<'getIssuesByNPMPackage'>['data']
 
@@ -12,20 +19,9 @@ export type SocketSdkAlert = SocketSdkAlertList[number]['value'] extends
   ? U
   : never
 
-export enum SEVERITY {
-  critical = 'critical',
-  high = 'high',
-  middle = 'middle',
-  low = 'low'
-}
-
 // Ordered from most severe to least.
-const SEVERITIES_BY_ORDER: Array<SocketSdkAlert['severity']> = [
-  'critical',
-  'high',
-  'middle',
-  'low'
-]
+const SEVERITIES_BY_ORDER: ReadonlyArray<SocketSdkAlert['severity']> =
+  Object.freeze(['critical', 'high', 'middle', 'low'])
 
 function getDesiredSeverities(
   lowestToInclude: SocketSdkAlert['severity'] | undefined
@@ -66,8 +62,9 @@ export function getSeverityCount(
     if (!value) {
       continue
     }
-    if (severityCount[value.severity] !== undefined) {
-      severityCount[value.severity] += 1
+    const { severity } = value
+    if (severityCount[severity] !== undefined) {
+      severityCount[severity] += 1
     }
   }
   return severityCount
diff --git a/src/utils/api.ts b/src/utils/api.ts
@@ -50,7 +50,7 @@ export async function handleApiCall<T>(
   return result
 }
 
-export async function handleAPIError(code: number) {
+export async function handleApiError(code: number) {
   if (code === 400) {
     return 'One of the options passed might be incorrect.'
   } else if (code === 403) {
@@ -72,7 +72,7 @@ function getDefaultApiBaseUrl(): string | undefined {
   return isNonEmptyString(baseUrl) ? baseUrl : undefined
 }
 
-export async function queryAPI(path: string, apiToken: string) {
+export async function queryApi(path: string, apiToken: string) {
   const API_V0_URL = getDefaultApiBaseUrl()
   return await fetch(`${API_V0_URL}/${path}`, {
     method: 'GET',
diff --git a/src/utils/socket-package-alert.ts b/src/utils/socket-package-alert.ts
@@ -7,8 +7,9 @@ import { resolvePackageName } from '@socketsecurity/registry/lib/packages'
 import { naturalCompare } from '@socketsecurity/registry/lib/sorts'
 
 import { CompactSocketArtifact, isArtifactAlertCve } from './alert/artifact'
+import { ALERT_FIX_TYPE } from './alert/fix'
 import { uxLookup } from './alert/rules'
-import { SEVERITY } from './alert/severity'
+import { ALERT_SEVERITY } from './alert/severity'
 import { ColorOrMarkdown } from './color-or-markdown'
 import { getSocketDevPackageOverviewUrl } from './socket-url'
 import { getTranslations } from './translations'
@@ -29,12 +30,7 @@ export type SocketPackageAlert = {
 
 export type AlertsByPkgId = Map<string, SocketPackageAlert[]>
 
-const {
-  ALERT_FIX_TYPE_CVE,
-  ALERT_FIX_TYPE_UPGRADE,
-  CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER,
-  NPM
-} = constants
+const { CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER, NPM } = constants
 
 const format = new ColorOrMarkdown(false)
 
@@ -53,16 +49,15 @@ type AddSocketArtifactAlertToAlertsMapOptions = {
   spinner?: Spinner | undefined
 }
 
-export async function addArtifactToAlertsMap(
+export async function addArtifactToAlertsMap<T extends AlertsByPkgId>(
   artifact: CompactSocketArtifact,
-  alertsByPkgId: AlertsByPkgId,
+  alertsByPkgId: T,
   options?: AddSocketArtifactAlertToAlertsMapOptions | undefined
-) {
+): Promise<T> {
   // Make TypeScript happy.
   if (!artifact.name || !artifact.version || !artifact.alerts?.length) {
-    return
+    return alertsByPkgId
   }
-
   const {
     consolidate = false,
     include: _include,
@@ -94,10 +89,10 @@ export async function addArtifactToAlertsMap(
       alert: { type: alert.type }
     })
     const fixType = alert.fix?.type ?? ''
-    const critical = alert.severity === SEVERITY.critical
+    const critical = alert.severity === ALERT_SEVERITY.critical
     const cve = isArtifactAlertCve(alert)
-    const fixableCve = fixType === ALERT_FIX_TYPE_CVE
-    const fixableUpgrade = fixType === ALERT_FIX_TYPE_UPGRADE
+    const fixableCve = fixType === ALERT_FIX_TYPE.cve
+    const fixableUpgrade = fixType === ALERT_FIX_TYPE.upgrade
     const fixable = fixableCve || fixableUpgrade
     const upgrade = fixableUpgrade && !hasOwn(overrides, name)
     if (
@@ -121,7 +116,7 @@ export async function addArtifactToAlertsMap(
     }
   }
   if (!sockPkgAlerts.length) {
-    return
+    return alertsByPkgId
   }
   if (consolidate) {
     const highestForCve = new Map<
@@ -136,7 +131,7 @@ export async function addArtifactToAlertsMap(
     for (const sockPkgAlert of sockPkgAlerts) {
       const alert = sockPkgAlert.raw
       const fixType = alert.fix?.type ?? ''
-      if (fixType === ALERT_FIX_TYPE_CVE) {
+      if (fixType === ALERT_FIX_TYPE.cve) {
         const patchedVersion =
           alert.props[CVE_ALERT_PROPS_FIRST_PATCHED_VERSION_IDENTIFIER]
         const patchedMajor = semver.major(patchedVersion)
@@ -148,7 +143,7 @@ export async function addArtifactToAlertsMap(
             version: patchedVersion
           })
         }
-      } else if (fixType === ALERT_FIX_TYPE_UPGRADE) {
+      } else if (fixType === ALERT_FIX_TYPE.upgrade) {
         const oldHighest = highestForUpgrade.get(major)
         const highest = oldHighest?.version ?? '0.0.0'
         if (semver.gt(version, highest)) {
@@ -164,11 +159,11 @@ export async function addArtifactToAlertsMap(
       ...[...highestForUpgrade.values()].map(d => d.alert)
     ]
   }
-  if (!sockPkgAlerts.length) {
-    return
+  if (sockPkgAlerts.length) {
+    sockPkgAlerts.sort((a, b) => naturalCompare(a.type, b.type))
+    alertsByPkgId.set(pkgId, sockPkgAlerts)
   }
-  sockPkgAlerts.sort((a, b) => naturalCompare(a.type, b.type))
-  alertsByPkgId.set(pkgId, sockPkgAlerts)
+  return alertsByPkgId
 }
 
 type CveExcludeFilter = {
@@ -202,7 +197,7 @@ export function getCveInfoByAlertsMap(
     for (const sockPkgAlert of sockPkgAlerts) {
       const alert = sockPkgAlert.raw
       if (
-        alert.fix?.type !== ALERT_FIX_TYPE_CVE ||
+        alert.fix?.type !== ALERT_FIX_TYPE.cve ||
         (exclude.upgrade && getManifestData(NPM, name))
       ) {
         continue

Original file line number	Diff line number	Diff line change
`@@ -185,29 +185,35 @@ export async function uxLookup(`
`185`	`185`	`const sockSdk = await setupSdk(getPublicToken())`
`186`	`186`	`const orgResult = await sockSdk.getOrganizations()`
`187`	`187`	`if (!orgResult.success) {`
	`188`	`+ if (orgResult.status === 429) {`
	`189`	`+ throw new Error(`
	`190`	+ `API token quota exceeded: ${orgResult.error}`
	`191`	`+ )`
	`192`	`+ }`
`188`	`193`	`throw new Error(`
`189`		- `Failed to fetch Socket organization info: ${orgResult.error.message}`
	`194`	+ `Failed to fetch Socket organization info: ${orgResult.error}`
`190`	`195`	`)`
`191`	`196`	`}`
	`197`	`+ const { organizations } = orgResult.data`
`192`	`198`	`const orgs: Array<`
`193`		`- Exclude<(typeof orgResult.data.organizations)[string], undefined>`
	`199`	`+ Exclude<(typeof organizations)[string], undefined>`
`194`	`200`	`> = []`
`195`		`- for (const org of Object.values(orgResult.data.organizations)) {`
	`201`	`+ for (const org of Object.values(organizations)) {`
`196`	`202`	`if (org) {`
`197`	`203`	`orgs.push(org)`
`198`	`204`	`}`
`199`	`205`	`}`
`200`		`- const result = await sockSdk.postSettings(`
	`206`	`+ const settingsResult = await sockSdk.postSettings(`
`201`	`207`	`orgs.map(org => ({ organization: org.id }))`
`202`	`208`	`)`
`203`		`- if (!result.success) {`
	`209`	`+ if (!settingsResult.success) {`
`204`	`210`	`throw new Error(`
`205`		- `Failed to fetch API key settings: ${result.error.message}`
	`211`	+ `Failed to fetch API key settings: ${settingsResult.error}`
`206`	`212`	`)`
`207`	`213`	`}`
`208`	`214`	`return {`
`209`	`215`	`orgs,`
`210`		`- settings: result.data`
	`216`	`+ settings: settingsResult.data`
`211`	`217`	`}`
`212`	`218`	`} catch (e) {`
`213`	`219`	`const cause = isObject(e) && 'cause' in e ? e['cause'] : undefined`