Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor: new CLI commands documentation #413

Merged
merged 16 commits into from
Aug 17, 2024
Merged
Show file tree
Hide file tree
Changes from 12 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -65,3 +65,7 @@ vuln.json
tmp/
dist/
reports

# macOS system files
.DS_Store

39 changes: 14 additions & 25 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -100,37 +100,26 @@ $ nsecure open
# If you want to define a specific port use the --port option.
$ nsecure open --port 8080
```
---

##### Available options

| name | shortcut | default value | description |
| --- | --- | --- | --- |
| --port | -p | 0 | Define the running port, can also be define through the environment variable `PORT` |

The `auto` command can be used to chain `cwd/from` and `open` commands automatically.

```bash
$ nsecure auto jest

# if no package is given to the auto command then it will run the cwd command instead of from.
$ nsecure auto
```
### Command Documentation

> [!IMPORTANT]
> By default with the auto command the .json file is deleted when the http server is closed. It's possible to disable this behavior by using the CLI option `--keep`, `-k`.
For complete details on each command, refer to the following documents:

---
Some options are available on both `cwd`, `from` and `auto` commands. The output option is not available for the `auto` command.
- [`cwd`](./docs/cli/cwd.md)
- [`from`](./docs/cli/from.md)
- [`auto`](./docs/cli/auto.md)
- [`open`](./docs/cli/open.md)
- [`verify`](./docs/cli/verify.md)
- [`summary`](./docs/cli/summary.md)
- [`scorecard`](./docs/cli/scorecard.md)
- [`report`](./docs/cli/report.md)
- [`lang`](./docs/cli/lang.md)
- [`config create`](./docs/cli/config-create.md)
- [`config`](./docs/cli/config.md)

| name | shortcut | default value | description |
| --- | --- | --- | --- |
| --depth | -d | **4** | the maximum depth we must walk (when we fetch the whole tree). |
| --output | -o | **nsecure-result** | the name that the outputted .json file will have |

```bash
$ nsecure from express -d 10 -o express-security-report
```
Each link redirects you to the complete documentation of the command, with additional details, options, and usage examples.

## Private registry / Verdaccio

Expand Down
19 changes: 19 additions & 0 deletions docs/cli/auto.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
## ⚙️ Options

- **`-k, --keep`**: Preserve temporary files after execution. Default: `false`.

fraxken marked this conversation as resolved.
Show resolved Hide resolved
## 📝 Description

The `auto` command is designed to simplify and accelerate the security analysis of a project or package. By automatically combining the `cwd` and `from` commands, this tool allows you to quickly generate a comprehensive security report. Additionally, it can serve the results via an HTTP server for easy access and review.

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|------------|--------------|---------------------|---------------------------------------------------------------------------|
| `--depth` | `-d` | `4` | Specify the depth of dependency analysis. |
| `--silent` | | | Suppress console output, making execution silent. |
| `--output` | `-o` | `nsecure-result` | Specify the output file for the results. |
| `--keep` | `-k` | `false` | Preserve temporary files after execution. |



fraxken marked this conversation as resolved.
Show resolved Hide resolved
20 changes: 20 additions & 0 deletions docs/cli/config-create.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
# 🛠️ Command `config create`

The `config create` command allows you to create a new configuration file for NodeSecure. This command is useful for initializing a custom configuration tailored to your project's specific needs.

## 📜 Syntax

```bash
nsecure config create [configuration] [options]
```

## 📝 Description

The `config create` command is designed to help you easily create a new configuration file in the current working directory or in a specified location. This is particularly useful when you need to set up NodeSecure with custom settings specific to your project.

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|----------|--------------|-------------------|-------------------------------------------------------------------------------|
| `--cwd` | `-c` | `false` | Create the configuration file in the current working directory instead of the default location. |

26 changes: 26 additions & 0 deletions docs/cli/config.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
# ⚙️ Command `config`

The `config` command allows you to manage the configuration files used by NodeSecure. This command can be used to either create a new configuration file or edit an existing one.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

## 📜 Syntax

```bash
nsecure config [sub-command] [options]
```

## 📝 Description

The `config` command is designed to help you manage your NodeSecure configuration files. With this command, you can create a new configuration file with the `create` sub-command, or edit an existing configuration file with the `edit` sub-command. This is useful for customizing the behavior of NodeSecure based on your specific needs.

## ⚙️ Available Options

### `create` Sub-command

| **Name** | **Shortcut** | **Default Value** | **Description** |
|----------|--------------|-------------------|-------------------------------------------------------------------------------|
| `--cwd` | `-c` | `false` | Create the configuration file in the current working directory instead of the default location. |

### `edit` Sub-command

This sub-command does not have any specific options.

22 changes: 22 additions & 0 deletions docs/cli/cwd.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# 📂 Command `cwd`

The `cwd` command allows you to scan the project located in the current working directory using the strategies defined by the tool. This command is useful for analyzing the security of a Node.js project by inspecting the dependencies installed locally in the current working directory.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

## 📜 Syntax

```bash
nsecure cwd [options]
```
## 📝 Description

The `cwd` command scans the dependencies of the project in the current working directory using the specified options to detect potential vulnerabilities. This is particularly useful for evaluating the security of a Node.js project by analyzing the packages installed in the current working directory.

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|-------------|--------------|---------------------|------------------------------------------------------------------------------|
| `--nolock` | `-n` | `false` | Do not use a lock file (package-lock.json or yarn.lock) for the analysis. |
| `--full` | `-f` | `false` | Perform a full analysis of the project, including all dependencies. |
| `--depth` | `-d` | `4` | Specify the depth of dependency analysis. |
| `--silent` | | | Suppress console output, making execution silent. |
| `--output` | `-o` | `nsecure-result` | Specify the output file for the results. |
22 changes: 22 additions & 0 deletions docs/cli/from.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# 📦 Command `from`

The `from` command allows you to run a security analysis on a specific npm package, which must be available in the npm registry. This command is useful for evaluating the security of a package before including it in your project.

## 📜 Syntax

```bash
nsecure from <package> [options]
```

## 📝 Description

The `from` command analyzes the specified npm package by scanning its dependencies to detect potential vulnerabilities. This is particularly useful for evaluating the security of a package you plan to include in your Node.js project.

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|-------------|--------------|---------------------|------------------------------------------------------------------------------|
| `--depth` | `-d` | `4` | Specify the depth of dependency analysis. |
| `--output` | `-o` | `nsecure-result` | Specify the output file for the results. |
| `--silent` | | | Suppress console output, making execution silent. |

7 changes: 7 additions & 0 deletions docs/cli/lang.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
## 📝 Description

The `lang` command is used to set the language for the NodeSecure CLI tool. It allows users to choose their preferred language for the CLI interface.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

```bash
nsecure lang
```
14 changes: 14 additions & 0 deletions docs/cli/open.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
## 📝 Description

The `open` command is used to open a security report in a local HTTP server. This allows for easy access and review of the security report through a web browser.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

```bash
nsecure open
fraxken marked this conversation as resolved.
Show resolved Hide resolved
```

fraxken marked this conversation as resolved.
Show resolved Hide resolved
## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|----------|--------------|---------------------|----------------------------------------------------------|
| `--port` | `-p` | `process.env.PORT` | Specify the port on which the HTTP server should run. |

17 changes: 17 additions & 0 deletions docs/cli/report.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
## 📝 Description

The `report` command is used to generate a detailed security report for a repository. This report can include all dependencies and be customized with various options such as theme, title, and format.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

```bash
nsecure report [repository]
```

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|---------------------|--------------|---------------------------|----------------------------------------------------------|
| `--theme` | `-t` | `white` | Specify the theme for the report. |
| `--includesAllDeps` | `-i` | `true` | Include all dependencies in the report. |
| `--title` | `-l` | `NodeSecure Report` | Specify the title of the report. |
| `--reporters` | `-r` | `["html"]` | Specify the format of the report (e.g., HTML, JSON). |

14 changes: 14 additions & 0 deletions docs/cli/scorecard.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
## 📝 Description

The `scorecard` command is used to generate a security scorecard for a specific repository. This command evaluates the repository and provides a security score based on various criteria.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

```bash
nsecure scorecard [repository]
```

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|----------|--------------|-------------------|---------------------------------------------------------|
| `--vcs` | | `github` | Specify the version control system (VCS) used by the repository. |

7 changes: 7 additions & 0 deletions docs/cli/summary.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
## 📝 Description

The `summary` command is used to generate a summarized report from a JSON security report. This command provides a concise overview of the security findings.

```bash
nsecure summary [json]
```
13 changes: 13 additions & 0 deletions docs/cli/verify.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
## 📝 Description

The `verify` command is used to verify the integrity and security of a specific package. This command checks the package against known vulnerabilities and integrity issues.
fraxken marked this conversation as resolved.
Show resolved Hide resolved

```bash
nsecure verify [package]
```

## ⚙️ Available Options

| **Name** | **Shortcut** | **Default Value** | **Description** |
|----------|--------------|-------------------|-------------------------------------------|
| `--json` | `-j` | `false` | Output the results in JSON format. |