fix: inline license validation code

wraithgar · wraithgar · commit 09b981db4a56 · 2026-02-18T13:21:10.000-08:00
diff --git a/lib/license.js b/lib/license.js
@@ -0,0 +1,27 @@
+// This is an implementation of the validForNewPackage flag in validate-npm-package-license, which is no longer maintained
+
+const parse = require('spdx-expression-parse')
+
+function usesLicenseRef (ast) {
+  if (Object.hasOwn(ast, 'license')) {
+    return ast.license.startsWith('LicenseRef') || ast.license.startsWith('DocumentRef')
+  } else {
+    return usesLicenseRef(ast.left) || usesLicenseRef(ast.right)
+  }
+}
+
+// license should be a valid SPDX license expression (without "LicenseRef"), "UNLICENSED", or "SEE LICENSE IN <filename>"
+module.exports = function licenseValidForNewPackage (argument) {
+  if (argument === 'UNLICENSED' || argument === 'UNLICENCED') {
+    return true
+  }
+  if (/^SEE LICEN[CS]E IN ./.test(argument)) {
+    return true
+  }
+  try {
+    const ast = parse(argument)
+    return !usesLicenseRef(ast)
+  } catch {
+    return false
+  }
+}
diff --git a/lib/normalize-data.js b/lib/normalize-data.js
@@ -2,7 +2,7 @@
 
 const { URL } = require('node:url')
 const hostedGitInfo = require('hosted-git-info')
-const validateLicense = require('validate-npm-package-license')
+const validateLicense = require('./license.js')
 
 const typos = {
   dependancies: 'dependencies',
@@ -230,7 +230,7 @@ function normalizeData (data, changes) {
     changes?.push('No license field.')
   } else if (typeof (license) !== 'string' || license.length < 1 || license.trim() === '') {
     changes?.push('license should be a valid SPDX license expression')
-  } else if (!validateLicense(license).validForNewPackages) {
+  } else if (!validateLicense(license)) {
     changes?.push('license should be a valid SPDX license expression')
   }
   // fixPeople
diff --git a/tap-snapshots/test/normalize-data.js.test.cjs b/tap-snapshots/test/normalize-data.js.test.cjs
@@ -166,6 +166,18 @@ exports[`test/normalize-data.js TAP fixKeywordsField splits string > must match
 Array []
 `
 
+exports[`test/normalize-data.js TAP fixLicenseField SPDX > must match snapshot 1`] = `
+Array []
+`
+
+exports[`test/normalize-data.js TAP fixLicenseField SPDX LEFT and RIGHT > must match snapshot 1`] = `
+Array []
+`
+
+exports[`test/normalize-data.js TAP fixLicenseField file ref > must match snapshot 1`] = `
+Array []
+`
+
 exports[`test/normalize-data.js TAP fixLicenseField invalid > must match snapshot 1`] = `
 Array [
   "license should be a valid SPDX license expression",
diff --git a/test/normalize-data.js b/test/normalize-data.js
@@ -330,6 +330,30 @@ t.test('fixLicenseField', async t => {
     })
     t.equal(content.license, 'BESPOKE LICENSE')
   })
+
+  t.test('SPDX', async t => {
+    const { content } = await normalizeData(t, {
+      ...base,
+      license: 'MIT',
+    })
+    t.equal(content.license, 'MIT')
+  })
+
+  t.test('file ref', async t => {
+    const { content } = await normalizeData(t, {
+      ...base,
+      license: 'SEE LICENSE IN LICENSE.TXT',
+    })
+    t.equal(content.license, 'SEE LICENSE IN LICENSE.TXT')
+  })
+
+  t.test('SPDX LEFT and RIGHT', async t => {
+    const { content } = await normalizeData(t, {
+      ...base,
+      license: 'MIT or ISC',
+    })
+    t.equal(content.license, 'MIT or ISC')
+  })
 })
 
 t.test('fixPeople', async t => {
