File Explorer

1const { isNodeGypPackage } = require('@npmcli/node-gyp')2const PackageJson = require('@npmcli/package-json')3 4// Returns the install-relevant lifecycle scripts that would run for a5// given arborist Node, or `{}` if there are none.6//7// Includes:8//   - explicit preinstall/install/postinstall9//   - prepare, but only for non-registry sources (git, file, link, remote)10//   - synthetic `node-gyp rebuild`, when `binding.gyp` is present on disk11//     and the package does not opt out via `gypfile: false` or define its12//     own install / preinstall script13 14// Lifecycle-script enumeration boundary.15//16// IMPORTANT: this helper decides whether `prepare` should be included17// in the enumerated install scripts (true for non-registry sources only).18// It is NOT a policy-matching predicate. The policy matcher in19// script-allowed.js uses `isRegistryNode`, which is strictly tied to20// versionFromTgz(node.resolved). The two helpers exist separately on21// purpose:22//23//   - `hasNonRegistryShape` (here): "should we consider running prepare24//     on this node?" — a yes/no for what to enumerate.25//   - `isRegistryNode` (script-allowed.js): "do we trust this node's26//     identity enough to apply a policy entry?" — a security check.27//28// The looser fallback here (treating unknown-resolved nodes as registry,29// thus skipping `prepare`) is the safer default for enumeration: we'd30// rather omit a script we should have run than synthesise one for a31// non-registry source we couldn't confirm. The policy matcher's stricter32// behaviour is correct for its boundary; the two helpers must not be33// merged.34const hasNonRegistryShape = (node) => {35  if (typeof node.isRegistryDependency === 'boolean') {36    return !node.isRegistryDependency37  }38  if (!node.resolved) {39    return false40  }41  return !/^https?:\/\/[^/]+\/.+\/-\/[^/]+-\d/.test(node.resolved)42}43 44const getInstallScripts = async (node) => {45  /* istanbul ignore next: arborist Nodes always carry a `package` object;46     defensive fallbacks for non-arborist callers. */47  const pkg = node.package || {}48  /* istanbul ignore next */49  const scripts = pkg.scripts || {}50  const collected = {}51 52  if (scripts.preinstall) {53    collected.preinstall = scripts.preinstall54  }55  if (scripts.install) {56    collected.install = scripts.install57  }58  if (scripts.postinstall) {59    collected.postinstall = scripts.postinstall60  }61  if (scripts.prepare && hasNonRegistryShape(node)) {62    collected.prepare = scripts.prepare63  }64 65  const hasExplicitGypGate = !!(collected.preinstall || collected.install)66  if (67    !hasExplicitGypGate &&68    pkg.gypfile !== false &&69    await isNodeGypPackage(node.path).catch(() => false)70  ) {71    collected.install = 'node-gyp rebuild'72  }73 74  // Lockfile-only nodes carry `hasInstallScript: true` but no enumerated75  // scripts: the lockfile records the presence flag, not the script bodies,76  // so `node.package.scripts` is empty on a lockfile-driven install (`npm ci`,77  // a repeat `npm install`). Before giving up, read the installed78  // package.json from disk to recover the real script bodies. Builder#addToBuildSet79  // does the same disk read to decide what to run, but unlike that path this80  // one is read-only: we never mutate `node.package`.81  if (Object.keys(collected).length === 0 && node.hasInstallScript === true) {82    const { content } = await PackageJson.normalize(node.path)83      .catch(() => ({ content: {} }))84    /* istanbul ignore next: normalize resolves to an object with a scripts85       object, or our catch fallback returns {}; defensive guard only. */86    const diskScripts = content?.scripts || {}87 88    if (diskScripts.preinstall) {89      collected.preinstall = diskScripts.preinstall90    }91    if (diskScripts.install) {92      collected.install = diskScripts.install93    }94    if (diskScripts.postinstall) {95      collected.postinstall = diskScripts.postinstall96    }97    if (diskScripts.prepare && hasNonRegistryShape(node)) {98      collected.prepare = diskScripts.prepare99    }100 101    // Still nothing. The package isn't on disk yet (e.g. `npm ci` before102    // reify) or its package.json is unreadable. Emit a sentinel so the103    // advisory and the strict-allow-scripts preflight still surface that104    // install scripts are present.105    if (Object.keys(collected).length === 0) {106      collected.install = '(install scripts present)'107    }108  }109 110  return collected111}112 113module.exports = getInstallScripts114module.exports.getInstallScripts = getInstallScripts115