feat: update policy

Signed-off-by: Christopher Phillips <[email protected]>

grant/evalutation/license_evaluation_test.go

@@ -57,10 +57,10 @@ func Test_checkLicense(t *testing.T) {
 		}
 	}{
 		{
-			name:    "should reject denied licenses",
-			license: grant.License{Name: "MIT"},
+			name:    "should reject denied licenses when SPDX expressions and CheckNON SPDX is False",
+			license: grant.License{ID: "MIT", SPDXExpression: "MIT", LicenseID: "MIT"},
 			// Only allow OSI licenses.
-			config: EvaluationConfig{CheckNonSPDX: true, Policy: grant.DefaultPolicy()},
+			config: EvaluationConfig{CheckNonSPDX: false, Policy: grant.DefaultPolicy().SetMatchNonSPDX(false)},
 			wants: struct {
 				Pass    bool
 				Reasons []Reason
@@ -73,10 +73,10 @@ func Test_checkLicense(t *testing.T) {
 			},
 		},
 		{
-			name:    "should reject denied licenses when CheckNonSPDX is also false",
+			name:    "should reject denied licenses when CheckNonSPDX is also true",
 			license: grant.License{Name: "foobar"},
 			// Only allow OSI licenses.
-			config: EvaluationConfig{CheckNonSPDX: false, Policy: grant.DefaultPolicy()},
+			config: EvaluationConfig{CheckNonSPDX: true, Policy: grant.DefaultPolicy().SetMatchNonSPDX(true)},
 			wants: struct {
 				Pass    bool
 				Reasons []Reason

grant/policy.go

@@ -50,8 +50,13 @@ func (p Policy) IsEmpty() bool {
 // IsDenied returns true if the given license is denied by the policy
 func (p Policy) IsDenied(license License, pkg *Package) (bool, *Rule) {
 	for _, rule := range p.Rules {
+		// ignore non spdx licenses if the rule is configured to not match on non spdx
+		isSPDX := license.IsSPDX()
+		matchNonSPDX := p.MatchNonSPDX
+		if !matchNonSPDX && !isSPDX {
+			continue
+		}
 		var toMatch string
-
 		if license.IsSPDX() {
 			toMatch = strings.ToLower(license.LicenseID)
 		} else {
@@ -82,3 +87,9 @@ func (p Policy) IsDenied(license License, pkg *Package) (bool, *Rule) {
 	}
 	return false, nil
 }
+
+// SetMatchNonSPDX updates the match option for the given policy
+func (p Policy) SetMatchNonSPDX(matchNonSPDX bool) Policy {
+	p.MatchNonSPDX = matchNonSPDX
+	return p
+}