diff --git a/src/fetchcode/package.py b/src/fetchcode/package.py index e8c30a3..52a430a 100644 --- a/src/fetchcode/package.py +++ b/src/fetchcode/package.py @@ -167,7 +167,7 @@ def get_npm_data_from_purl(purl): vcs_url = get_npm_field_url(version.get("repository")) download_url = dist.get("tarball") bug_tracking_url = get_npm_field_url(version.get("bugs") or response.get("bugs")) - declared_license = license + declared_license = version.get("license") or license if purl.version and version_purl.version != purl.version: continue diff --git a/tests/test_package.py b/tests/test_package.py index e1e22b5..91a3882 100644 --- a/tests/test_package.py +++ b/tests/test_package.py @@ -140,6 +140,56 @@ def test_npm_string_repository_and_bugs(mock_get): assert package.download_url == "https://registry.npmjs.org/@babel/core/-/core-7.0.0.tgz" +@mock.patch("fetchcode.package.get_response") +def test_npm_package_license_from_selected_release(mock_get): + mock_get.return_value = { + "name": "example", + "license": "Apache-2.0", + "versions": { + "1.0.0": { + "version": "1.0.0", + "license": "MIT", + "dist": {"tarball": "https://registry.npmjs.org/example/-/example-1.0.0.tgz"}, + }, + "1.0.1": { + "version": "1.0.1", + "license": "Apache-2.0", + "dist": {"tarball": "https://registry.npmjs.org/example/-/example-1.0.1.tgz"}, + }, + "0.9.0": { + "version": "0.9.0", + "dist": {"tarball": "https://registry.npmjs.org/example/-/example-0.9.0.tgz"}, + }, + "0.8.0": { + "version": "0.8.0", + "license": None, + "dist": {"tarball": "https://registry.npmjs.org/example/-/example-0.8.0.tgz"}, + }, + }, + } + + packages_1_0_0 = list(info("pkg:npm/example@1.0.0")) + assert len(packages_1_0_0) == 1 + assert packages_1_0_0[0].version == "1.0.0" + assert packages_1_0_0[0].declared_license == "MIT" + + packages_1_0_1 = list(info("pkg:npm/example@1.0.1")) + assert len(packages_1_0_1) == 1 + assert packages_1_0_1[0].version == "1.0.1" + assert packages_1_0_1[0].declared_license == "Apache-2.0" + + packages_0_9_0 = list(info("pkg:npm/example@0.9.0")) + assert len(packages_0_9_0) == 1 + assert packages_0_9_0[0].version == "0.9.0" + assert packages_0_9_0[0].declared_license == "Apache-2.0" + + packages_0_8_0 = list(info("pkg:npm/example@0.8.0")) + assert len(packages_0_8_0) == 1 + assert packages_0_8_0[0].version == "0.8.0" + assert packages_0_8_0[0].declared_license == "Apache-2.0" + + + @mock.patch("fetchcode.package.get_response") def test_pypi_packages(mock_get): side_effect = [load_json("tests/data/pypi_mock_data.json")]