voice-cat/scripts/check-licenses.ps1

$ErrorActionPreference = 'Stop'
$allowed = @('MIT', 'BSD-2-Clause', 'BSD-3-Clause', 'Apache-2.0', 'ISC', '0BSD', 'MPL-2.0')
$seen = @{}
$sourceLocks = Get-ChildItem -LiteralPath "$PSScriptRoot/.." -Filter 'packages*.lock.json' -Recurse |
    Where-Object { $_.FullName -notmatch '[\\/](?:bin|obj)[\\/]' }
foreach ($lockPath in $sourceLocks) {
    $lock = Get-Content -Raw -LiteralPath $lockPath.FullName | ConvertFrom-Json
    $assets = Get-Content -Raw -LiteralPath (Join-Path $lockPath.DirectoryName 'obj/project.assets.json') | ConvertFrom-Json
    foreach ($framework in $lock.dependencies.PSObject.Properties) {
        foreach ($package in $framework.Value.PSObject.Properties) {
            if ($package.Value.type -eq 'Project') { continue }
            $id = $package.Name.ToLowerInvariant()
            $version = $package.Value.resolved
            if ($seen.ContainsKey("$id/$version")) { continue }
            $seen["$id/$version"] = $true
            $nuspec = $null
            foreach ($folder in $assets.packageFolders.PSObject.Properties.Name) {
                $candidate = Join-Path $folder "$id/$version/$id.nuspec"
                if (Test-Path -LiteralPath $candidate) { $nuspec = $candidate; break }
            }
            if (!$nuspec) { throw "Restore dependencies before auditing $id/$version." }
            [xml]$spec = Get-Content -Raw -LiteralPath $nuspec
            $license = $spec.package.metadata.license
            if ($license.type -eq 'expression' -and $allowed -contains $license.InnerText) { continue }
            # This pinned package contains public-domain SQLite builds; no NuGet license metadata.
            if ($id -eq 'sourcegear.sqlite3' -and $version -eq '3.50.4.2' -and
                $spec.package.metadata.projectUrl -eq 'https://sqlite.org/' -and
                $spec.package.metadata.repository.commit -eq '9a2d8281d8f714fe54f7cbcd122479d17b533e89') { continue }
            # This legacy pinned package predates NuGet license expressions (Apache-2.0).
            if ($id -eq 'xunit.abstractions' -and $version -eq '2.0.3' -and
                $spec.package.metadata.licenseUrl -eq 'https://raw.githubusercontent.com/xunit/xunit/master/license.txt') { continue }
            throw "Unapproved license for $id/$version. Review before changing the allowlist."
        }
    }
}
Write-Output "Checked $($seen.Count) package licenses: approved allowlist passed."