[dev/license_checker][dev/npm] reactor, ts-ify, de-grunt (#37807)

.gitignore

@@ -5,7 +5,7 @@
 .DS_Store
 .node_binaries
 node_modules
-!/src/dev/npm/__tests__/fixtures/fixture1/node_modules
+!/src/dev/npm/integration_tests/__fixtures__/fixture1/node_modules
 !/src/dev/notice/__fixtures__/node_modules
 trash
 /optimize

package.json

@@ -51,7 +51,7 @@
     "test:server": "grunt test:server",
     "test:coverage": "grunt test:coverage",
     "typespec": "typings-tester --config x-pack/plugins/canvas/public/lib/aeroelastic/tsconfig.json x-pack/plugins/canvas/public/lib/aeroelastic/__fixtures__/typescript/typespec_tests.ts",
-    "checkLicenses": "grunt licenses --dev",
+    "checkLicenses": "node scripts/check_licenses --dev",
     "build": "node scripts/build --all-platforms",
     "start": "node --trace-warnings --trace-deprecation scripts/kibana --dev ",
     "debug": "node --nolazy --inspect scripts/kibana --dev",
@@ -304,6 +304,7 @@
     "@types/jquery": "^3.3.6",
     "@types/js-yaml": "^3.11.1",
     "@types/json5": "^0.0.30",
+    "@types/license-checker": "15.0.0",
     "@types/listr": "^0.14.0",
     "@types/lodash": "^3.10.1",
     "@types/lru-cache": "^5.1.0",

scripts/check_licenses.js

@@ -0,0 +1,21 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+require('../src/setup_node_env');
+require('../src/dev/license_checker/run_check_licenses_cli');

src/dev/license_checker/config.js → src/dev/license_checker/config.ts

@@ -56,6 +56,7 @@ export const LICENSE_WHITELIST = [
   'ISC',
   'ISC*',
   'MIT OR GPL-2.0',
+  '(MIT OR CC0-1.0)',
   'MIT',
   'MIT*',
   'MIT/X11',
@@ -69,15 +70,13 @@ export const LICENSE_WHITELIST = [
 
 // The following list only applies to licenses that
 // we wanna allow in packages only used as dev dependencies
-export const DEV_ONLY_LICENSE_WHITELIST = [
-  'MPL-2.0'
-];
+export const DEV_ONLY_LICENSE_WHITELIST = ['MPL-2.0'];
 
 // Globally overrides a license for a given package@version
 export const LICENSE_OVERRIDES = {
   'cycle@1.0.3': ['CC0-1.0'], // conversion to a public-domain like license
-  'jsts@1.1.2': ['Eclipse Distribution License - v 1.0'], //cf. https://github.com/bjornharrtell/jsts
-  '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], //license in readme https://github.com/tmcw/jsonlint
+  'jsts@1.1.2': ['Eclipse Distribution License - v 1.0'], // cf. https://github.com/bjornharrtell/jsts
+  '@mapbox/jsonlint-lines-primitives@2.0.2': ['MIT'], // license in readme https://github.com/tmcw/jsonlint
 
   // TODO can be removed once we upgrade past elasticsearch-browser@14.0.0
   'elasticsearch-browser@13.0.1': ['Apache-2.0'],
@@ -105,5 +104,5 @@ export const LICENSE_OVERRIDES = {
   'walk@2.3.9': ['MIT'],
 
   // TODO remove this once we upgrade past or equal to v1.0.2
-  'babel-plugin-mock-imports@1.0.1': ['MIT']
+  'babel-plugin-mock-imports@1.0.1': ['MIT'],
 };

src/dev/license_checker/run_check_licenses_cli.ts

@@ -0,0 +1,61 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { getInstalledPackages } from '../npm';
+import { run } from '../run';
+
+import { LICENSE_WHITELIST, DEV_ONLY_LICENSE_WHITELIST, LICENSE_OVERRIDES } from './config';
+import { assertLicensesValid } from './valid';
+import { REPO_ROOT } from '../constants';
+
+run(
+  async ({ log, flags }) => {
+    const packages = await getInstalledPackages({
+      directory: REPO_ROOT,
+      licenseOverrides: LICENSE_OVERRIDES,
+      includeDev: !!flags.dev,
+    });
+
+    // Assert if the found licenses in the production
+    // packages are valid
+    assertLicensesValid({
+      packages: packages.filter(pkg => !pkg.isDevOnly),
+      validLicenses: LICENSE_WHITELIST,
+    });
+    log.success('All production dependency licenses are allowed');
+
+    // Do the same as above for the packages only used in development
+    // if the dev flag is found
+    if (flags.dev) {
+      assertLicensesValid({
+        packages: packages.filter(pkg => pkg.isDevOnly),
+        validLicenses: LICENSE_WHITELIST.concat(DEV_ONLY_LICENSE_WHITELIST),
+      });
+      log.success('All development dependency licenses are allowed');
+    }
+  },
+  {
+    flags: {
+      boolean: ['dev'],
+      help: `
+        --dev              Also check dev dependencies
+      `,
+    },
+  }
+);

src/dev/license_checker/valid.ts

@@ -0,0 +1,67 @@
+/*
+ * Licensed to Elasticsearch B.V. under one or more contributor
+ * license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright
+ * ownership. Elasticsearch B.V. licenses this file to you under
+ * the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *    http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import dedent from 'dedent';
+import { createFailError } from '../run';
+
+interface Options {
+  packages: Array<{
+    name: string;
+    version: string;
+    relative: string;
+    licenses: string[];
+  }>;
+  validLicenses: string[];
+}
+
+/**
+ *  When given a list of packages and the valid license
+ *  options, either throws an error with details about
+ *  violations or returns undefined.
+ */
+export function assertLicensesValid({ packages, validLicenses }: Options) {
+  const invalidMsgs = packages.reduce(
+    (acc, pkg) => {
+      const invalidLicenses = pkg.licenses.filter(license => !validLicenses.includes(license));
+
+      if (pkg.licenses.length && !invalidLicenses.length) {
+        return acc;
+      }
+
+      return acc.concat(dedent`
+        ${pkg.name}
+          version: ${pkg.version}
+          all licenses: ${pkg.licenses}
+          invalid licenses: ${invalidLicenses.join(', ')}
+          path: ${pkg.relative}
+      `);
+    },
+    [] as string[]
+  );
+
+  if (invalidMsgs.length) {
+    throw createFailError(
+      `Non-conforming licenses:\n${invalidMsgs
+        .join('\n')
+        .split('\n')
+        .map(l => `  ${l}`)
+        .join('\n')}`
+    );
+  }
+}