Add licenses to the response

Also added granular permission to this info

ee/app/serializers/dependency_entity.rb

@@ -11,13 +11,22 @@ class DependencyEntity < Grape::Entity
     expose :name, :severity
   end
 
+  class LicenseEntity < Grape::Entity
+    expose :name, :url
+  end
+
   expose :name, :packager, :version
   expose :location, using: LocationEntity
   expose :vulnerabilities, using: VulnerabilityEntity, if: ->(_) { can_read_vulnerabilities? }
+  expose :licenses, using: LicenseEntity, if: ->(_) { can_read_licenses? }
 
   private
 
   def can_read_vulnerabilities?
     can?(request.user, :read_project_security_dashboard, request.project)
   end
+
+  def can_read_licenses?
+    can?(request.user, :read_software_license_policy, request.project)
+  end
 end

ee/changelogs/unreleased/13084-add-licenses-to-dl-response.yml

+---
+title: Add Licenses info into Dependencies response
+merge_request: 15160
+author:
+type: added

ee/spec/factories/dependencies.rb

@@ -26,6 +26,15 @@ FactoryBot.define do
       end
     end
 
+    trait :with_licenses do
+      licenses do
+        [{
+           name: 'MIT',
+           url: 'http://opensource.org/licenses/mit-license'
+         }]
+      end
+    end
+
     initialize_with { attributes }
   end
 end

ee/spec/fixtures/api/schemas/dependency.json

@@ -5,7 +5,8 @@
     "packager",
     "version",
     "location",
-    "vulnerabilities"
+    "vulnerabilities",
+    "licenses"
   ],
   "properties": {
     "name": {
@@ -35,6 +36,17 @@
           "type": "string"
         }
       }
+    },
+    "licenses": {
+      "type": "array",
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "url": {
+          "type": "string"
+        }
+      }
     }
   },
   "additionalProperties": false

ee/spec/serializers/dependency_entity_spec.rb

@@ -6,13 +6,19 @@ describe DependencyEntity do
   describe '#as_json' do
     subject { described_class.represent(dependency, request: request).as_json }
 
-    set(:project) { create(:project, :repository, :private) }
     set(:user) { create(:user) }
+    let(:project) { create(:project, :repository, :private) }
     let(:request) { double('request') }
-    let(:dependency) { build(:dependency, :with_vulnerabilities) }
+    let(:dependency) { build(:dependency, :with_vulnerabilities, :with_licenses) }
 
     before do
-      stub_licensed_features(security_dashboard: true)
+      allow(request).to receive(:project).and_return(project)
+      allow(request).to receive(:user).and_return(user)
+    end
+
+    context 'when all required features available' do
+      before do
+        stub_licensed_features(security_dashboard: true, license_management: true)
         allow(request).to receive(:project).and_return(project)
         allow(request).to receive(:user).and_return(user)
       end
@@ -22,13 +28,11 @@ describe DependencyEntity do
           project.add_developer(user)
         end
 
-      it do
-        is_expected.to eq(dependency.except(:licenses))
-      end
+        it { is_expected.to eq(dependency) }
       end
 
       context 'with reporter' do
-      let(:dependency_info) { build(:dependency).except(:licenses) }
+        let(:dependency_info) { build(:dependency, :with_licenses) }
 
         before do
           project.add_reporter(user)
@@ -37,4 +41,15 @@ describe DependencyEntity do
         it { is_expected.to eq(dependency_info) }
       end
     end
+
+    context 'when all required features are unavailable' do
+      let(:dependency_info) { build(:dependency).except(:licenses) }
+
+      before do
+        project.add_developer(user)
+      end
+
+      it { is_expected.to eq(dependency_info) }
+    end
+  end
 end

ee/spec/serializers/dependency_list_serializer_spec.rb

@@ -6,14 +6,14 @@ describe DependencyListSerializer do
   set(:project) { create(:project, :repository, :private) }
   set(:user) { create(:user) }
   let(:ci_build) { create(:ee_ci_build, :success) }
-  let(:dependencies) { [build(:dependency, :with_vulnerabilities)] }
+  let(:dependencies) { [build(:dependency, :with_vulnerabilities, :with_licenses)] }
 
   let(:serializer) do
     described_class.new(project: project, user: user).represent(dependencies, build: ci_build)
   end
 
   before do
-    stub_licensed_features(security_dashboard: true)
+    stub_licensed_features(security_dashboard: true, license_management: true)
     project.add_developer(user)
   end