Review round 1 for the Node build module: registry for other @novox packages and refused bundles (1489), toolchain.reported stream (1483, 1488), re-pin to mesh-sdk 36d6f774; delta part 4 of 4

2026-10-20 21:12:10 +00:00
parent 4a1804cda3
commit 00fa5e74d0
9 changed files with 210 additions and 31 deletions
@@ -137,10 +137,74 @@ func TestAModuleNamingLodashWithALockIsInstalledWithoutTheSdkAndWithoutALockFail
 		t.Errorf("the scratch install is left in the workspace: %v", scratch)
 	}

-	delete(files, "modules/m/package-lock.json")
-	m, _ = fetchMachine(t, files, nil)
-	if _, err := m.fetch(context.Background(), fetchArgs); err == nil || !strings.Contains(err.Error(), "modules/m") || !strings.Contains(err.Error(), "package-lock.json") {
-		t.Errorf("without a lock: %v, want the failure naming modules/m", err)
+}
+
+// 1489 (the 1459 settlement): a module naming packages with no package-lock.json does not fail the fetch: it passes,
+// installs nothing for that module, and its result lists the refused bundle with its reason; a build of that bundle
+// fails naming it.
+func TestAModuleWithoutALockIsRefusedInTheResultNotTheFetch(t *testing.T) {
+	files := typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6","lodash":"^4"}}`)
+	files["modules/ok/module.json"] = `{"module":"ok","build":{"artifacts":[{"name":"tools","kind":"bundle","language":"typescript","entrypoints":["tools/index.js"]}]}}`
+	files["modules/ok/package.json"] = `{"dependencies":{"@novox/mesh-sdk":"^0.1.6"}}`
+	m, f := fetchMachine(t, files, nil)
+	out, err := m.fetch(context.Background(), fetchArgs)
+	if err != nil {
+		t.Fatalf("a module without a lock failed the fetch: %v", err)
+	}
+	r := out.(FetchResult)
+	if len(npmCalls(f)) != 0 || len(r.Installed) != 0 || len(r.Modules) != 2 {
+		t.Errorf("result = %+v, npm calls %d", r, len(npmCalls(f)))
+	}
+	if len(r.Refused) != 1 || r.Refused[0].Module != "modules/m" ||
+		!strings.Contains(r.Refused[0].Reason, "names packages beyond the SDK and has no package-lock.json") || !strings.Contains(r.Refused[0].Reason, "lodash") {
+		t.Fatalf("refused = %+v, want modules/m with its reason", r.Refused)
+	}
+	// the build of that bundle fails naming it, without running a compiler.
+	f.calls = nil
+	_, err = m.build(context.Background(), map[string]any{"workspace": r.Workspace, "module": "modules/m", "artifact": "tools"})
+	if err == nil || !strings.Contains(err.Error(), "modules/m") || !strings.Contains(err.Error(), "no package-lock.json") || len(f.calls) != 0 {
+		t.Errorf("build = %v after %d commands, want the refusal naming modules/m and nothing run", err, len(f.calls))
+	}
+}
+
+// 1489 (review 4): a bundle depending on another @novox package is installed, the mesh's registry given to npm ci
+// through --userconfig, as the toolchain's install gives it.
+func TestAnotherNovoxPackageIsInstalledFromTheRegistryThroughAUserconfig(t *testing.T) {
+	files := typeScriptModule(`{"dependencies":{"@novox/other":"^1","lodash":"^4"}}`)
+	files["modules/m/package-lock.json"] = `{}`
+	m, f := fetchMachine(t, files, map[string]string{"@novox/other/index.js": "o", "lodash/index.js": "l"})
+	m.Toolchain.Registry = func() (Registry, error) {
+		return Registry{URL: "https://git.novox.be/api/packages/novox/npm/", Username: "mesh-build-node", Password: "pw"}, nil
+	}
+	var npmrc string
+	inner := f.effect
+	f.effect = func(c call) {
+		inner(c)
+		for i, a := range c.args {
+			if c.name == "npm" && a == "--userconfig" {
+				raw, _ := os.ReadFile(c.args[i+1])
+				npmrc = string(raw)
+			}
+		}
+	}
+	out, err := m.fetch(context.Background(), fetchArgs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(npmrc, "@novox:registry=https://git.novox.be/api/packages/novox/npm/") || !strings.Contains(npmrc, ":_auth=") {
+		t.Errorf("npm ci was given the config %q", npmrc)
+	}
+	if strings.Contains(strings.Join(npmCalls(f)[0].args, " "), "pw") {
+		t.Errorf("the credential is on npm's command line")
+	}
+	r := out.(FetchResult)
+	if _, err := os.Stat(filepath.Join(m.Work, r.Workspace, "tree", "modules", "m", "node_modules", "@novox", "other", "index.js")); err != nil {
+		t.Errorf("@novox/other was not installed: %v", err)
+	}
+	for _, e := range mustReadDir(t, filepath.Join(m.Work, r.Workspace)) {
+		if strings.HasPrefix(e, "npm-") {
+			t.Errorf("the scratch install (and its credential file) is left: %s", e)
+		}
 	}
 }