Avoid installing URL dependencies multiple times.

Use the _resolved property from installed packages to avoid installing
URL dependencies after they are already installed. Also ensure that you
can still use --force if the packages have really changed

This also fixes #3463 as shrinkwrapped dependencies are basically
treated the same as tarball dependencies.

3 files changed, 82 insertions, 1 deletions

diff --git a/lib/install.js b/lib/install.js
index ea414dd26..fe210764c 100644
--- a/lib/install.js
+++ b/lib/install.js
@@ -631,7 +631,8 @@ function targetResolver (where, context, deps) {
         // otherwise, make sure that it's a semver match with what we want.
         var bd = parent.bundleDependencies
         if (bd && bd.indexOf(d.name) !== -1 ||
-            semver.satisfies(d.version, deps[d.name] || "*", true)) {
+            semver.satisfies(d.version, deps[d.name] || "*", true) ||
+            deps[d.name] === d._resolved) {
           return cb(null, d.name)
         }
 
diff --git a/test/tap/url-dependencies.js b/test/tap/url-dependencies.js
new file mode 100644
index 000000000..0c2078aff
--- /dev/null
+++ b/test/tap/url-dependencies.js
@@ -0,0 +1,72 @@
+var test = require("tap").test
+var rimraf = require("rimraf")
+
+var mr = require("npm-registry-mock")
+
+var spawn = require("child_process").spawn
+var npm = require.resolve("../../bin/npm-cli.js")
+var node = process.execPath
+var pkg = "./url-dependencies"
+
+var mockRoutes = {
+  "get": {
+    "/underscore/-/underscore-1.3.1.tgz": [200]
+  }
+}
+
+test("url-dependencies: download first time", function(t) {
+  rimraf.sync(__dirname + "/url-dependencies/node_modules")
+
+  performInstall(function(output){
+    if(!tarballWasFetched(output)){
+      t.fail("Tarball was not fetched")
+    }else{
+      t.pass("Tarball was fetched")
+    }
+    t.end()
+  })
+})
+
+test("url-dependencies: do not download subsequent times", function(t) {
+  rimraf.sync(__dirname + "/url-dependencies/node_modules")
+
+  performInstall(function(){
+    performInstall(function(output){
+      if(tarballWasFetched(output)){
+        t.fail("Tarball was fetched second time around")
+      }else{
+        t.pass("Tarball was not fetched")
+      }
+      t.end()
+    })
+  })
+})
+
+function tarballWasFetched(output){
+  return output.indexOf("http GET http://localhost:1337/underscore/-/underscore-1.3.1.tgz") > -1
+}
+
+function performInstall (cb) {
+  mr({port: 1337, mocks: mockRoutes}, function(s){
+    var output = ""
+      , child = spawn(node, [npm, "install"], {
+          cwd: pkg,
+          env: {
+            npm_config_registry: "http://localhost:1337",
+            npm_config_cache_lock_stale: 1000,
+            npm_config_cache_lock_wait: 1000,
+            HOME: process.env.HOME,
+            Path: process.env.PATH,
+            PATH: process.env.PATH
+          }
+        })
+
+    child.stderr.on("data", function(data){
+      output += data.toString()
+    })
+    child.on("close", function () {
+      s.close()
+      cb(output)
+    })
+  })
+}
diff --git a/test/tap/url-dependencies/package.json b/test/tap/url-dependencies/package.json
new file mode 100644
index 000000000..96ae3e247
--- /dev/null
+++ b/test/tap/url-dependencies/package.json
@@ -0,0 +1,8 @@
+{
+  "author": "Steve Mason",
+  "name": "url-dependencies",
+  "version": "0.0.0",
+  "dependencies": {
+    "underscore": "http://localhost:1337/underscore/-/underscore-1.3.1.tgz"
+  }
+}