Address straightforward PR comments

Author: xmasoracle

src/models/vulnerability/reference.ts

@@ -52,5 +52,6 @@ export class Reference implements Comparable<Reference> {
   }
 }
 
+/** @beta */
 export class ReferenceRepository extends SortableComparables<Reference> {
 }

src/models/vulnerability/source.ts

@@ -36,12 +36,10 @@ export class Source implements Comparable<Source> {
   }
 
   compare (other: Source): number {
-    function normalizeUrl (u: URL | string): string {
-      return (typeof u === 'string') ? u : u.toString()
+    if (this.url !== undefined && other.url !== undefined) {
+      return (this.url.toString() ?? '').localeCompare(other.url.toString() ?? '')
     }
-    const urlCompare = normalizeUrl(this.url ?? '').localeCompare(normalizeUrl(other.url ?? ''))
-
     /* eslint-disable-next-line @typescript-eslint/strict-boolean-expressions -- run compares in weighted order */
-    return (this.name ?? '').localeCompare(other.name ?? '') || urlCompare
+    return (this.name ?? '').localeCompare(other.name ?? '')
   }
 }

src/models/vulnerability/vulnerability.ts

@@ -29,7 +29,7 @@ import type { Analysis } from './analysis'
 import type { Credits } from './credits'
 import { RatingRepository } from './rating'
 import { ReferenceRepository } from './reference'
-import { Source } from './source'
+import type { Source } from './source'
 
 /** @beta */
 export interface OptionalVulnerabilityProperties {
@@ -58,7 +58,7 @@ export class Vulnerability implements Comparable<Vulnerability> {
   /** @see bomRef */
   readonly #bomRef: BomRef
   id?: string
-  source: Source
+  source?: Source
   references: ReferenceRepository
   ratings: RatingRepository
   cwes: CweRepository
@@ -78,7 +78,7 @@ export class Vulnerability implements Comparable<Vulnerability> {
   constructor (op: OptionalVulnerabilityProperties = {}) {
     this.#bomRef = new BomRef(op.bomRef)
     this.id = op.id
-    this.source = op.source ?? new Source()
+    this.source = op.source
     this.references = op.references ?? new ReferenceRepository()
     this.ratings = op.ratings ?? new RatingRepository()
     this.cwes = op.cwes ?? new CweRepository()
@@ -105,9 +105,12 @@ export class Vulnerability implements Comparable<Vulnerability> {
     if (bomRefCompare !== 0) {
       return bomRefCompare
     }
+    if (this.source !== undefined && other.source !== undefined) {
+      return this.source.compare(other.source)
+    }
+
     /* eslint-disable @typescript-eslint/strict-boolean-expressions -- run compares in weighted order */
     return (this.id ?? '').localeCompare(other.id ?? '') ||
-      this.source.compare(other.source) ||
       (this.description ?? '').localeCompare(other.description ?? '') ||
       (this.detail ?? '').localeCompare(other.detail ?? '')
     /* eslint-enable  @typescript-eslint/strict-boolean-expressions */

src/serialize/json/normalize.ts

@@ -527,10 +527,10 @@ export class DependencyGraphNormalizer extends BaseJsonNormalizer<Models.Bom> {
 }
 
 export class VulnerabilityNormalizer extends BaseJsonNormalizer<Models.Vulnerability.Vulnerability> {
-  normalize (data: Models.Vulnerability.Vulnerability, options: NormalizerOptions): Normalized.Vulnerability | undefined {
-    const source = data.source !== undefined
-      ? this._factory.makeForVulnerabilitySource().normalize(data.source, options)
-      : undefined
+  normalize (data: Models.Vulnerability.Vulnerability, options: NormalizerOptions): Normalized.Vulnerability {
+    const source = data.source === undefined
+      ? undefined
+      : this._factory.makeForVulnerabilitySource().normalize(data.source, options)
     const references = data.references.size > 0
       ? this._factory.makeForVulnerabilityReference().normalizeIterable(data.references, options)
       : undefined
@@ -555,18 +555,15 @@ export class VulnerabilityNormalizer extends BaseJsonNormalizer<Models.Vulnerabi
         : Array.from(data)
     ).map(
       c => this.normalize(c, options)
-    ).filter(isNotUndefined)
+    )
   }
 }
 
 export class VulnerabilitySourceNormalizer extends BaseJsonNormalizer<Models.Vulnerability.Source> {
   normalize (data: Models.Vulnerability.Source, options: NormalizerOptions): Normalized.VulnerabilitySource {
-    const url = data.url !== undefined && typeof data.url !== 'string'
-      ? data.url.toString()
-      : data.url
     return {
       name: data.name,
-      url
+      url: data.url?.toString()
     }
   }
 }
@@ -575,9 +572,9 @@ export class VulnerabilityReferenceNormalizer extends BaseJsonNormalizer<Models.
   normalize (data: Models.Vulnerability.Reference, options: NormalizerOptions): Normalized.VulnerabilityReference {
     return {
       id: data.id,
-      source: data.source !== undefined
-        ? this._factory.makeForVulnerabilitySource().normalize(data.source, options)
-        : undefined
+      source: data.source === undefined
+        ? undefined
+        : this._factory.makeForVulnerabilitySource().normalize(data.source, options)
     }
   }
 
@@ -588,7 +585,7 @@ export class VulnerabilityReferenceNormalizer extends BaseJsonNormalizer<Models.
         : Array.from(data)
     ).map(
       c => this.normalize(c, options)
-    ).filter(isNotUndefined)
+    )
   }
 }
 

tests/_data/models.js

@@ -201,8 +201,8 @@ module.exports.createComplexStructure = function () {
     id: '1',
     source: new Models.Vulnerability.Source({ name: 'manual' }),
     references: new Models.Vulnerability.ReferenceRepository([
-      new Models.Vulnerability.Reference('CVE-2042-42420'),
-      new Models.Vulnerability.Reference('CVE-2042-42421')
+      new Models.Vulnerability.Reference('CVE-2042-42421'),
+      new Models.Vulnerability.Reference('CVE-2042-42420')
     ]),
     description: 'description of 1',
     detail: 'detail of 1',

tests/unit/Models.Vulnerability.Vulnerability.spec.js

@@ -58,7 +58,7 @@ suite('Models.Vulnerability.Vulnerability', () => {
 
     assert.strictEqual(vulnerability.bomRef.value, undefined)
     assert.strictEqual(vulnerability.id, undefined)
-    assert.ok(vulnerability.source instanceof Source)
+    assert.strictEqual(vulnerability.source, undefined)
     assert.ok(vulnerability.references instanceof ReferenceRepository)
     assert.strictEqual(vulnerability.references.size, 0)
     assert.ok(vulnerability.ratings instanceof RatingRepository)