fix: exempt explicit pack targets from allow-directory · npm/cli@7455793 · GitHub
Skip to content

Commit 7455793

Browse files
committed
fix: exempt explicit pack targets from allow-directory
Constraint: allow-directory governs directory dependencies, not the package explicitly selected for pack or publish. Rejected: Override only in publish | leaves libnpmpack callers and npm pack inconsistent at the same policy boundary. Confidence: high Scope-risk: narrow Directive: Keep registry, remote, file, git, and dependency resolution subject to their configured fetch policies. Tested: node . run test; node . run test -w libnpmpack; publish and pack dry-run smoke for allow-directory=none|root; registry/file denial probes; git diff --check Not-tested: Manual CLI smoke on non-Linux platforms
1 parent 834408e commit 7455793

5 files changed

Lines changed: 58 additions & 0 deletions

File tree

‎lib/commands/pack.js‎

Lines changed: 1 addition & 0 deletions

‎test/lib/commands/pack.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,25 @@ t.test('dry run', async t => {
112112
t.throws(() => fs.statSync(path.resolve(npm.prefix, filename)))
113113
})
114114

115+
for (const allowDirectory of ['none', 'root']) {
116+
t.test(`dry run with allow-directory=${allowDirectory}`, async t => {
117+
const { npm, outputs } = await loadMockNpm(t, {
118+
prefixDir: {
119+
'package.json': JSON.stringify({
120+
name: 'test-package',
121+
version: '1.0.0',
122+
}),
123+
},
124+
config: {
125+
'allow-directory': allowDirectory,
126+
'dry-run': true,
127+
},
128+
})
129+
await npm.exec('pack', [])
130+
t.strictSame(outputs, ['test-package-1.0.0.tgz'])
131+
})
132+
}
133+
115134
t.test('foreground-scripts defaults to true', async t => {
116135
const { npm, outputs, logs } = await loadMockNpm(t, {
117136
prefixDir: {

‎test/lib/commands/publish.js‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,25 @@ t.test('dry-run', async t => {
151151
t.matchSnapshot(logs.notice)
152152
})
153153

154+
for (const allowDirectory of ['none', 'root']) {
155+
t.test(`dry-run with allow-directory=${allowDirectory}`, async t => {
156+
const { joinedOutput, npm, registry } = await loadNpmWithRegistry(t, {
157+
config: {
158+
'allow-directory': allowDirectory,
159+
'dry-run': true,
160+
...auth,
161+
},
162+
prefixDir: {
163+
'package.json': JSON.stringify(pkgJson, null, 2),
164+
},
165+
authorization: token,
166+
})
167+
registry.publish(pkg, { noPut: true })
168+
await npm.exec('publish', [])
169+
t.equal(joinedOutput(), `+ ${pkg}@1.0.0`)
170+
})
171+
}
172+
154173
t.test('foreground-scripts defaults to true', async t => {
155174
const { outputs, npm, logs, registry } = await loadNpmWithRegistry(t, {
156175
config: {

‎workspaces/libnpmpack/lib/index.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ async function pack (spec = 'file:.', opts = {}) {
1212
// gets spec
1313
spec = npa(spec)
1414

15+
// An explicit directory is the package being packed, not a dependency fetch.
16+
if (spec.type === 'directory') {
17+
opts = { ...opts, allowDirectory: 'all' }
18+
}
19+
1520
const manifest = await pacote.manifest(spec, { ...opts, Arborist, _isRoot: true })
1621

1722
if (spec.type === 'directory') {

‎workspaces/libnpmpack/test/index.js‎

Lines changed: 14 additions & 0 deletions

0 commit comments

Comments
 (0)