File Explorer

1// Do not rely on package._fields, so that we don't throw2// false failures if a tree is generated by other clients.3// Only relies on child.resolved, which MAY come from4// client-specific package.json meta _fields, but most of5// the time will be pulled out of a lockfile6 7const semver = require('semver')8const npa = require('npm-package-arg')9const { relative } = require('node:path')10const fromPath = require('./from-path.js')11 12// A named ref (tag or branch) resolves to a commit hash, so look up the13// committish recorded for this edge in the lockfile to detect spec changes.14const lockedGitCommittish = (child, requestor) => {15  const lock = requestor.root?.meta?.data?.packages?.[requestor.location]16  const spec = lock && (17    lock.dependencies?.[child.name] ||18    lock.optionalDependencies?.[child.name] ||19    lock.devDependencies?.[child.name] ||20    lock.peerDependencies?.[child.name]21  )22  if (!spec) {23    return null24  }25  try {26    const parsed = npa.resolve(child.name, spec, requestor.realpath)27    return parsed.type === 'git' ? parsed.gitCommittish || '' : null28  } catch {29    return null30  }31}32 33const depValid = (child, requested, requestor) => {34  // NB: we don't do much to verify 'tag' type requests.35  // Just verify that we got a remote resolution.  Presumably, it36  // came from a registry and was tagged at some point.37 38  if (typeof requested === 'string') {39    try {40      // tarball/dir must have resolved to the same tgz on disk, but for41      // file: deps that depend on other files/dirs, we must resolve the42      // location based on the *requestor* file/dir, not where it ends up.43      // '' is equivalent to '*'44      requested = npa.resolve(child.name, requested || '*', fromPath(requestor, requestor.edgesOut.get(child.name)))45    } catch (er) {46      // Not invalid because the child doesn't match, but because47      // the spec itself is not supported.  Nothing would match,48      // so the edge is definitely not valid and never can be.49      er.dependency = child.name50      er.requested = requested51      requestor.errors.push(er)52      return false53    }54  }55 56  // if the lockfile is super old, or hand-modified,57  // then it's possible to hit this state.58  if (!requested) {59    const er = new Error('Invalid dependency specifier')60    er.dependency = child.name61    er.requested = requested62    requestor.errors.push(er)63    return false64  }65 66  switch (requested.type) {67    case 'range':68      if (requested.fetchSpec === '*') {69        return true70      }71      // fallthrough72    case 'version':73      // if it's a version or a range other than '*', semver it74      return semver.satisfies(child.version, requested.fetchSpec, true)75 76    case 'directory':77      return linkValid(child, requested, requestor)78 79    case 'file':80      return tarballValid(child, requested, requestor)81 82    case 'alias':83      // check that the alias target is valid84      return depValid(child, requested.subSpec, requestor)85 86    case 'tag':87      // if it's a tag, we just verify that it has a tarball resolution88      // presumably, it came from the registry and was tagged at some point89      return child.resolved && npa(child.resolved).type === 'remote'90 91    case 'remote':92      // verify that we got it from the desired location93      return child.resolved === requested.fetchSpec94 95    case 'git': {96      // if it's a git type, verify that they're the same repo97      //98      // if it specifies a definite commit, then it must have the99      // same commit to be considered the same repo100      //101      // if it has a #semver:<range> specifier, verify that the102      // version in the package is in the semver range103      const resRepo = npa(child.resolved || '')104      const resHost = resRepo.hosted105      const reqHost = requested.hosted106      const reqCommit = /^[a-fA-F0-9]{40,64}$/.test(requested.gitCommittish || '')107      const nc = { noCommittish: !reqCommit }108      if (!resHost) {109        if (resRepo.fetchSpec !== requested.fetchSpec) {110          return false111        }112      } else {113        if (reqHost?.ssh(nc) !== resHost.ssh(nc)) {114          return false115        }116      }117      if (!requested.gitRange) {118        // a named ref can't be verified against the resolved commit offline,119        // so re-resolve if it differs from the committish in the lockfile120        if (!reqCommit) {121          const locked = lockedGitCommittish(child, requestor)122          if (locked !== null && locked !== (requested.gitCommittish || '')) {123            return false124          }125        }126        return true127      }128      return semver.satisfies(child.package.version, requested.gitRange, {129        loose: true,130      })131    }132 133    default: // impossible, just being cautious134      break135  }136 137  const er = new Error('Unsupported dependency type')138  er.dependency = child.name139  er.requested = requested140  requestor.errors.push(er)141  return false142}143 144const linkValid = (child, requested, requestor) => {145  const isLink = !!child.isLink146  // if we're installing links and the node is a link, then it's invalid because we want147  // a real node to be there.  Except for workspaces. They are always links.148  if (requestor.installLinks && !child.isWorkspace) {149    return !isLink150  }151 152  // directory must be a link to the specified folder153  return isLink && relative(child.realpath, requested.fetchSpec) === ''154}155 156const tarballValid = (child, requested) => {157  if (child.isLink) {158    return false159  }160 161  if (child.resolved) {162    return child.resolved.replace(/\\/g, '/') === `file:${requested.fetchSpec.replace(/\\/g, '/')}`163  }164 165  // if we have a legacy mutated package.json file.  we can't be 100%166  // sure that it resolved to the same file, but if it was the same167  // request, that's a pretty good indicator of sameness.168  if (child.package._requested) {169    return child.package._requested.saveSpec === requested.saveSpec170  }171 172  // ok, we're probably dealing with some legacy cruft here, not much173  // we can do at this point unfortunately.174  return false175}176 177module.exports = (child, requested, accept, requestor) =>178  depValid(child, requested, requestor) ||179  (typeof accept === 'string' ? depValid(child, accept, requestor) : false)180