more SPDX unit tests to illustrate matching behavior

src/licenses.ts

@@ -87,11 +87,19 @@ export async function getInvalidLicenseChanges(
     } else if (validityCache.get(license) === undefined) {
       try {
         if (allow !== undefined) {
-          const found = spdx.satisfiesAny(license, allow)
-          validityCache.set(license, found)
+          if (spdx.isValid(license)) {
+            const found = spdx.satisfiesAny(license, allow)
+            validityCache.set(license, found)
+          } else {
+            invalidLicenseChanges.unresolved.push(change)
+          }
         } else if (deny !== undefined) {
-          const found = spdx.satisfiesAny(license, deny)
-          validityCache.set(license, !found)
+          if (spdx.isValid(license)) {
+            const found = spdx.satisfiesAny(license, deny)
+            validityCache.set(license, !found)
+          } else {
+            invalidLicenseChanges.unresolved.push(change)
+          }
         }
       } catch (err) {
         invalidLicenseChanges.unresolved.push(change)

src/spdx.ts

@@ -1,28 +1,51 @@
-import * as spdx from '@onebeyond/spdx-license-satisfies'
+import * as spdxlib from '@onebeyond/spdx-license-satisfies'
 import parse from 'spdx-expression-parse'
 
+/*
+ * NOTE: spdx-license-satisfies methods depend on spdx-expression-parse
+ * which throws errors in the presence of any syntax trouble, unknown
+ * license tokens, case sensitivity problems etc. to simplify handling
+ * you should pre-screen inputs to the satisfies* methods using isValid
+ */
+
+// accepts a pair of well-formed SPDX expressions. the
+// candidate is tested against the constraint
 export function satisfies(
   candidateExpr: string,
   constraintExpr: string
 ): boolean {
-  return spdx.satisfies(candidateExpr, constraintExpr)
+  try {
+    return spdxlib.satisfies(candidateExpr, constraintExpr)
+  } catch (_) {
+    return false
+  }
 }
 
+// accepts an SPDX expression and a non-empty list of licenses (not expressions)
 export function satisfiesAny(
   candidateExpr: string,
   licenses: string[]
 ): boolean {
-  return spdx.satisfiesAny(candidateExpr, licenses)
+  try {
+    return spdxlib.satisfiesAny(candidateExpr, licenses)
+  } catch (_) {
+    return false
+  }
 }
 
+// accepts an SPDX expression and a non-empty list of licenses (not expressions)
 export function satisfiesAll(
   candidateExpr: string,
   licenses: string[]
 ): boolean {
-  return spdx.satisfiesAll(candidateExpr, licenses)
+  try {
+    return spdxlib.satisfiesAll(candidateExpr, licenses)
+  } catch (_) {
+    return false
+  }
 }
 
-// can be a single license or an SPDX expression
+// accepts any SPDX expression
 export function isValid(spdxExpr: string): boolean {
   try {
     parse(spdxExpr)