Merge branch '212921-offline-npm' into 'master'v3.8.0

Specify a custom CA for npm

See merge request gitlab-org/security-products/license-management!145

1 files changed, 38 insertions, 0 deletions

diff --git a/spec/integration/js/npm_spec.rb b/spec/integration/js/npm_spec.rb
index 9cc1565..0658df6 100644
--- a/spec/integration/js/npm_spec.rb
+++ b/spec/integration/js/npm_spec.rb
@@ -464,4 +464,42 @@ RSpec.describe "npm" do
       specify { expect(subject.licenses_for(item[0])).to match_array(item[2]) }
     end
   end
+
+  context "when scanning a project with dependencies sourced from a custom registry" do
+    subject { runner.scan(env: { 'ADDITIONAL_CA_CERT_BUNDLE' => fixture_file_content('js/custom-npm.crt') }) }
+
+    before do
+      runner.add_file(".npmrc", "registry = https://#{private_npm_host}")
+      runner.add_file("package.json") do
+        JSON.pretty_generate({
+          name: "js-npm",
+          version: "1.0.0",
+          description: "Test project for js-npm",
+          dependencies: { lodash: "4.17.10" },
+          devDependencies: {},
+          scripts: { test: "echo 'test'" }
+        })
+      end
+      runner.add_file("package-lock.json") do
+        JSON.pretty_generate({
+          name: "js-npm",
+          version: "1.0.0",
+          lockfileVersion: 1,
+          requires: true,
+          dependencies: {
+            lodash: {
+              version: "4.17.10",
+              resolved: "https://#{private_npm_host}/lodash/-/lodash-4.17.10.tgz",
+              integrity: "sha512-UejweD1pDoXu+AD825lWwp4ZGtSwgnpZxb3JDViD7StjQz+Nb/6l093lx4OQ0foGWNRoc19mWy7BzL+UAK2iVg=="
+            }
+          }
+        })
+      end
+    end
+
+    specify { expect(subject).to match_schema(version: '2.0') }
+    specify { expect(subject.dependency_names).to match_array(%w[js-npm lodash]) }
+    specify { expect(subject.licenses_for('js-npm')).to match_array(['MIT']) }
+    specify { expect(subject.licenses_for('lodash')).to match_array(['MIT']) }
+  end
 end