Start adding Snyk commands

This is a big change, moving the top level enrich command to the
ecosystems subcommand, and adding a snyk subcommand. Still some
refactoring to do, but this is a working version.

Makefile

@@ -17,13 +17,17 @@ cover:
 specs:
 	@curl --silent https://packages.ecosyste.ms/docs/api/v1/openapi.yaml -o specs/packages.yaml
 	@curl --silent https://repos.ecosyste.ms/docs/api/v1/openapi.yaml -o specs/repos.yaml
+	@curl --silent https://api.snyk.io/rest/openapi/2023-04-28~experimental -o specs/snyk-experimental.json
+	@curl --silent https://api.snyk.io/rest/openapi/2023-04-28 -o specs/snyk.json
 
 clients: specs
 	@oapi-codegen -generate types,client -package packages specs/packages.yaml > ecosystems/packages/packages.go
 	@oapi-codegen -generate types,client -package repos specs/repos.yaml > ecosystems/repos/repos.go
+	@oapi-codegen -generate types,client -package users -include-tags Users specs/snyk-experimental.json > snyk/users/users.go
+	@oapi-codegen -generate types,client -package issues -include-tags Issues specs/snyk.json > snyk/issues/issues.go
+	sed -i '' 's/"purl", runtime.ParamLocationPath, purl/"purl", runtime.ParamLocationQuery, purl/' snyk/issues/issues.go
 
 fmt:
 	@gofmt -s -w -l .
 
-
-.PHONY: build test acceptance lint cover specs clients fmt
+.PHONY: build test acceptance lint cover specs patch clients fmt

README.md

@@ -38,7 +38,7 @@ $ cat testing/sbom.cyclonedx.json
 	"purl": "pkg:npm/[email protected]"
 }
 ...
-$ cat testing/sbom.cyclonedx.json | parlay enrich - | jq
+$ cat testing/sbom.cyclonedx.json | parlay e enrich - | jq
 ...
 {
 	"bom-ref": "[email protected]",

go.mod

@@ -5,6 +5,7 @@ go 1.20
 require (
 	github.com/CycloneDX/cyclonedx-go v0.7.1
 	github.com/deepmap/oapi-codegen v1.12.4
+	github.com/google/uuid v1.3.0
 	github.com/jarcoal/httpmock v1.3.0
 	github.com/package-url/packageurl-go v0.1.0
 	github.com/remeh/sizedwaitgroup v1.0.0
@@ -15,7 +16,6 @@ require (
 require (
 	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/google/uuid v1.3.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect

internal/commands/default.go

@@ -1,29 +1,26 @@
 package commands
 
 import (
-	"log"
-	"os"
-
 	"github.com/snyk/parlay/internal/commands/ecosystems"
+	"github.com/snyk/parlay/internal/commands/snyk"
 
 	"github.com/spf13/cobra"
 )
 
 func NewDefaultCommand() *cobra.Command {
 	cmd := cobra.Command{
-		Use:          "parlay",
-		Short:        "",
-		Long:         ``,
-		SilenceUsage: true,
+		Use:                   "parlay",
+		Short:                 "",
+		Long:                  ``,
+		SilenceUsage:          true,
+		DisableFlagsInUseLine: true,
 		Run: func(cmd *cobra.Command, args []string) {
 			_ = cmd.Help()
 		},
 	}
 
-	logger := log.New(os.Stdout, "", log.LstdFlags)
-
-	cmd.AddCommand(NewEnrichCommand(logger))
 	cmd.AddCommand(ecosystems.NewEcosystemsRootCommand())
+	cmd.AddCommand(snyk.NewSnykRootCommand())
 
 	return &cmd
 }

internal/commands/enrich.go → internal/commands/ecosystems/enrich.go

@@ -1,4 +1,4 @@
-package commands
+package ecosystems
 
 import (
 	"bufio"

internal/commands/ecosystems/root.go

@@ -1,21 +1,29 @@
 package ecosystems
 
 import (
+	"log"
+	"os"
+
 	"github.com/spf13/cobra"
 )
 
 func NewEcosystemsRootCommand() *cobra.Command {
 	cmd := cobra.Command{
-		Use:          "ecosystems",
-		Short:        "",
-		Long:         ``,
-		SilenceUsage: true,
+		Use:                   "ecosystems",
+		Short:                 "",
+		Long:                  ``,
+		Aliases:               []string{"e"},
+		DisableFlagsInUseLine: true,
+		SilenceUsage:          true,
 		Run: func(cmd *cobra.Command, args []string) {
 			_ = cmd.Help()
 		},
 	}
+	logger := log.New(os.Stdout, "", log.LstdFlags)
+
 	cmd.AddCommand(NewPackageCommand())
 	cmd.AddCommand(NewRepoCommand())
+	cmd.AddCommand(NewEnrichCommand(logger))
 
 	return &cmd
 }

internal/commands/snyk/packages.go

@@ -0,0 +1,31 @@
+package snyk
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/snyk/parlay/lib"
+
+	"github.com/package-url/packageurl-go"
+	"github.com/spf13/cobra"
+)
+
+func NewPackageCommand() *cobra.Command {
+	cmd := cobra.Command{
+		Use:   "package <purl> ",
+		Short: "Return package vulnerabilities from Snyk",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			purl, err := packageurl.FromString(args[0])
+			if err != nil {
+				log.Fatal(err)
+			}
+			resp, err := lib.GetPackageVulnerabilities(purl)
+			if err != nil {
+				log.Fatal(err)
+			}
+			fmt.Print(string(resp.Body))
+		},
+	}
+	return &cmd
+}

internal/commands/snyk/root.go

@@ -0,0 +1,20 @@
+package snyk
+
+import (
+	"github.com/spf13/cobra"
+)
+
+func NewSnykRootCommand() *cobra.Command {
+	cmd := cobra.Command{
+		Use:          "snyk",
+		Short:        "",
+		Long:         ``,
+		SilenceUsage: true,
+		Run: func(cmd *cobra.Command, args []string) {
+			_ = cmd.Help()
+		},
+	}
+	cmd.AddCommand(NewPackageCommand())
+
+	return &cmd
+}

lib/package.go

@@ -2,15 +2,51 @@ package lib
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/url"
+	"os"
 
 	"github.com/snyk/parlay/ecosystems/packages"
+	"github.com/snyk/parlay/snyk/issues"
 
+	"github.com/deepmap/oapi-codegen/pkg/securityprovider"
 	"github.com/package-url/packageurl-go"
 )
 
 const server = "https://packages.ecosyste.ms/api/v1"
+const snykServer = "https://api.snyk.io/rest"
+const version = "2023-04-28"
+
+func GetPackageVulnerabilities(purl packageurl.PackageURL) (*issues.FetchIssuesPerPurlResponse, error) {
+	token := os.Getenv("SNYK_TOKEN")
+	if token == "" {
+		return nil, errors.New("Must provide a SNYK_TOKEN environment variable")
+	}
+
+	auth, err := securityprovider.NewSecurityProviderApiKey("header", "Authorization", fmt.Sprintf("token %s", token))
+	if err != nil {
+		return nil, err
+	}
+
+	org, err := getSnykOrg(auth)
+	if err != nil {
+		return nil, err
+	}
+
+	client, err := issues.NewClientWithResponses(snykServer, issues.WithRequestEditorFn(auth.Intercept))
+	if err != nil {
+		return nil, err
+	}
+
+	params := issues.FetchIssuesPerPurlParams{Version: version}
+	resp, err := client.FetchIssuesPerPurlWithResponse(context.Background(), *org, purl.ToString(), &params)
+	if err != nil {
+		return nil, err
+	}
+
+	return resp, nil
+}
 
 func GetPackageData(purl packageurl.PackageURL) (*packages.GetRegistryPackageResponse, error) {
 	client, err := packages.NewClientWithResponses(server)

lib/self.go

@@ -0,0 +1,53 @@
+package lib
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/snyk/parlay/snyk/users"
+
+	"github.com/deepmap/oapi-codegen/pkg/securityprovider"
+	"github.com/google/uuid"
+)
+
+const experimentalVersion = "2023-04-28~experimental"
+
+type selfDocument struct {
+	Data struct {
+		Attributes struct {
+			AvatarURL         string `json:"avatar_url,omitempty"`
+			DefaultOrgContext string `json:"default_org_context,omitempty"`
+			Name              string `json:"name,omitempty"`
+			Username          string `json:"username,omitempty"`
+		} `json:"attributes,omitempty"`
+		ID   string `json:"id,omitempty"`
+		Type string `json:"type,omitempty"`
+	}
+	Jsonapi interface{} `json:"jsonapi,omitempty"`
+	Links   interface{} `json:"links,omitempty"`
+}
+
+func getSnykOrg(auth *securityprovider.SecurityProviderApiKey) (*uuid.UUID, error) {
+	experimental, err := users.NewClientWithResponses(snykServer, users.WithRequestEditorFn(auth.Intercept))
+	if err != nil {
+		return nil, err
+	}
+
+	userParams := users.GetSelfParams{Version: experimentalVersion}
+	self, err := experimental.GetSelfWithResponse(context.Background(), &userParams)
+	if err != nil {
+		return nil, err
+	}
+
+	var userInfo selfDocument
+	if err = json.Unmarshal(self.Body, &userInfo); err != nil {
+		return nil, err
+	}
+
+	orgId := userInfo.Data.Attributes.DefaultOrgContext
+	org, err := uuid.Parse(orgId)
+	if err != nil {
+		return nil, err
+	}
+	return &org, nil
+}