Build a Dependency Graph Analyzer

// src/deps/analyzer.ts — Dependency graph analysis with vulnerability prioritization
import { pool } from "../db";
import { Redis } from "ioredis";
import { readFile } from "node:fs/promises";
import { join } from "node:path";
import { createHash } from "node:crypto";

const redis = new Redis(process.env.REDIS_URL!);

interface Package {
  name: string;
  version: string;
  type: "production" | "development" | "peer";
  license: string;
  dependencies: string[];    // package names
  dependents: string[];      // packages that depend on this
  depth: number;             // distance from root
  isInternal: boolean;       // monorepo package
}

interface Vulnerability {
  id: string;
  package: string;
  severity: "critical" | "high" | "medium" | "low";
  title: string;
  fixVersion: string | null;
  cwe: string;
  reachable: boolean;        // is this actually reachable in production code?
  affectedPaths: string[][];  // dependency chains leading to this vuln
  riskScore: number;         // 0-100, factoring in severity + reachability + exposure
}

interface LicenseIssue {
  package: string;
  version: string;
  license: string;
  issue: "copyleft" | "unknown" | "restricted";
  requiredBy: string[];
}

interface UpgradeImpact {
  package: string;
  from: string;
  to: string;
  directDependents: string[];
  transitiveDependents: string[];
  breakingChanges: string[];
  vulnerabilitiesFixed: number;
}

// Scan project and build dependency graph
export async function scanProject(rootDir: string): Promise<{
  totalPackages: number;
  graph: Map<string, Package>;
  vulnerabilities: Vulnerability[];
  licenseIssues: LicenseIssue[];
  circularDeps: string[][];
}> {
  const graph = new Map<string, Package>();

  // Parse package.json and lock file
  const pkgJson = JSON.parse(await readFile(join(rootDir, "package.json"), "utf-8"));
  const allDeps = { ...pkgJson.dependencies };
  const devDeps = { ...pkgJson.devDependencies };

  // Build graph from dependencies
  await buildGraph(graph, allDeps, "production", 0);
  await buildGraph(graph, devDeps, "development", 0);

  // Scan for vulnerabilities
  const vulnerabilities = await scanVulnerabilities(graph);

  // Check licenses
  const licenseIssues = checkLicenses(graph);

  // Detect circular dependencies
  const circularDeps = detectCircularDeps(graph);

  // Cache results
  const scanId = createHash("sha256").update(JSON.stringify(Array.from(graph.entries()))).digest("hex").slice(0, 12);
  await redis.setex(`deps:scan:${scanId}`, 86400, JSON.stringify({
    totalPackages: graph.size, vulnerabilities, licenseIssues, circularDeps,
  }));

  return { totalPackages: graph.size, graph, vulnerabilities, licenseIssues, circularDeps };
}

async function buildGraph(
  graph: Map<string, Package>,
  deps: Record<string, string>,
  type: Package["type"],
  depth: number
): Promise<void> {
  for (const [name, version] of Object.entries(deps)) {
    const key = `${name}@${version}`;
    if (graph.has(key)) {
      graph.get(key)!.dependents.push("root");
      continue;
    }

    graph.set(key, {
      name, version: version.replace(/^[^\d]/, ""), type,
      license: "unknown", dependencies: [], dependents: ["root"],
      depth, isInternal: name.startsWith("@internal/"),
    });
  }
}

async function scanVulnerabilities(graph: Map<string, Package>): Promise<Vulnerability[]> {
  const vulns: Vulnerability[] = [];

  for (const [key, pkg] of graph) {
    // In production: check against npm advisory database or Snyk/GitHub
    // Simplified: check known vulnerable patterns
    const knownVulns = await checkAdvisoryDB(pkg.name, pkg.version);
    for (const v of knownVulns) {
      const reachable = pkg.type === "production" && pkg.depth <= 3;
      const riskScore = calculateRiskScore(v.severity, reachable, pkg.type, pkg.depth);

      vulns.push({
        ...v, package: key, reachable,
        affectedPaths: [["root", ...getPathToPackage(graph, key)]],
        riskScore,
      });
    }
  }

  return vulns.sort((a, b) => b.riskScore - a.riskScore);
}

function calculateRiskScore(severity: string, reachable: boolean, type: string, depth: number): number {
  let score = 0;
  switch (severity) {
    case "critical": score = 90; break;
    case "high": score = 70; break;
    case "medium": score = 40; break;
    case "low": score = 20; break;
  }
  if (!reachable) score *= 0.3;       // unreachable = much lower risk
  if (type === "development") score *= 0.2;  // dev-only = lower risk
  if (depth > 5) score *= 0.5;         // deep transitive = lower risk
  return Math.round(score);
}

function checkLicenses(graph: Map<string, Package>): LicenseIssue[] {
  const issues: LicenseIssue[] = [];
  const copyleftLicenses = ["GPL-2.0", "GPL-3.0", "AGPL-3.0", "LGPL-2.1", "LGPL-3.0"];
  const unknownLicenses = ["unknown", "UNLICENSED", ""];

  for (const [key, pkg] of graph) {
    if (pkg.type === "development") continue;  // dev deps don't affect distribution
    if (copyleftLicenses.includes(pkg.license)) {
      issues.push({ package: pkg.name, version: pkg.version, license: pkg.license, issue: "copyleft", requiredBy: pkg.dependents });
    }
    if (unknownLicenses.includes(pkg.license)) {
      issues.push({ package: pkg.name, version: pkg.version, license: pkg.license || "unknown", issue: "unknown", requiredBy: pkg.dependents });
    }
  }

  return issues;
}

function detectCircularDeps(graph: Map<string, Package>): string[][] {
  const cycles: string[][] = [];
  const visited = new Set<string>();
  const stack = new Set<string>();

  function dfs(node: string, path: string[]): void {
    if (stack.has(node)) {
      const cycleStart = path.indexOf(node);
      cycles.push(path.slice(cycleStart));
      return;
    }
    if (visited.has(node)) return;

    visited.add(node);
    stack.add(node);

    const pkg = graph.get(node);
    if (pkg) {
      for (const dep of pkg.dependencies) {
        dfs(dep, [...path, node]);
      }
    }

    stack.delete(node);
  }

  for (const key of graph.keys()) dfs(key, []);
  return cycles;
}

// Analyze upgrade impact
export async function analyzeUpgrade(packageName: string, targetVersion: string, graph: Map<string, Package>): Promise<UpgradeImpact> {
  const current = Array.from(graph.entries()).find(([, p]) => p.name === packageName);
  if (!current) throw new Error(`Package ${packageName} not found`);

  const [key, pkg] = current;
  const directDependents = pkg.dependents;
  const transitiveDependents = getTransitiveDependents(graph, key);

  return {
    package: packageName,
    from: pkg.version,
    to: targetVersion,
    directDependents,
    transitiveDependents,
    breakingChanges: [],  // in production: check changelogs
    vulnerabilitiesFixed: 0,
  };
}

function getPathToPackage(graph: Map<string, Package>, target: string): string[] {
  return [target];
}

function getTransitiveDependents(graph: Map<string, Package>, target: string): string[] {
  const visited = new Set<string>();
  const queue = [target];
  while (queue.length > 0) {
    const current = queue.shift()!;
    const pkg = graph.get(current);
    if (!pkg) continue;
    for (const dep of pkg.dependents) {
      if (!visited.has(dep)) {
        visited.add(dep);
        queue.push(dep);
      }
    }
  }
  return Array.from(visited);
}

async function checkAdvisoryDB(name: string, version: string): Promise<Array<{ id: string; severity: string; title: string; fixVersion: string | null; cwe: string }>> {
  // In production: call npm audit API or Snyk
  return [];
}