fix: relativize file links when inflating shrinkwrap

PR-URL: https://github.com/npm/cli/pull/758
Credit: @jsnajdr
Close: #758
Reviewed-by: @ruyadorno

3 files changed, 33 insertions, 5 deletions

diff --git a/lib/install/deps.js b/lib/install/deps.js
index 3d8b333c6..72c719296 100644
--- a/lib/install/deps.js
+++ b/lib/install/deps.js
@@ -74,7 +74,10 @@ function doesChildVersionMatch (child, requested, requestor) {
     var childReq = child.package._requested
     if (childReq) {
       if (childReq.rawSpec === requested.rawSpec) return true
-      if (childReq.type === requested.type && childReq.saveSpec === requested.saveSpec) return true
+      if (childReq.type === requested.type) {
+        if (childReq.saveSpec === requested.saveSpec) return true
+        if (childReq.fetchSpec === requested.fetchSpec) return true
+      }
     }
     // If _requested didn't exist OR if it didn't match then we'll try using
     // _from. We pass it through npa to normalize the specifier.
@@ -200,6 +203,7 @@ function removeObsoleteDep (child, log) {
   })
 }
 
+exports.packageRelativePath = packageRelativePath
 function packageRelativePath (tree) {
   if (!tree) return ''
   var requested = tree.package._requested || {}
@@ -570,7 +574,7 @@ function addDependency (name, versionSpec, tree, log, done) {
   try {
     var req = childDependencySpecifier(tree, name, versionSpec)
     if (tree.swRequires && tree.swRequires[name]) {
-      var swReq = childDependencySpecifier(tree, name, tree.swRequires[name], tree.package._where)
+      var swReq = childDependencySpecifier(tree, name, tree.swRequires[name])
     }
   } catch (err) {
     return done(err)
diff --git a/lib/install/get-requested.js b/lib/install/get-requested.js
index ab410ffc9..df0eec6f6 100644
--- a/lib/install/get-requested.js
+++ b/lib/install/get-requested.js
@@ -1,12 +1,15 @@
 'use strict'
 const npa = require('npm-package-arg')
 const moduleName = require('../utils/module-name.js')
-
+const packageRelativePath = require('./deps').packageRelativePath
 module.exports = function (child, reqBy) {
   if (!child.requiredBy.length) return
   if (!reqBy) reqBy = child.requiredBy[0]
   const deps = reqBy.package.dependencies || {}
   const devDeps = reqBy.package.devDependencies || {}
+  const optDeps = reqBy.package.optionalDependencies || {}
   const name = moduleName(child)
-  return npa.resolve(name, deps[name] || devDeps[name], reqBy.realpath)
+  const spec = deps[name] || devDeps[name] || optDeps[name]
+  const where = packageRelativePath(reqBy)
+  return npa.resolve(name, spec, where)
 }
diff --git a/lib/install/inflate-shrinkwrap.js b/lib/install/inflate-shrinkwrap.js
index 1ec4f9ba6..122068c20 100644
--- a/lib/install/inflate-shrinkwrap.js
+++ b/lib/install/inflate-shrinkwrap.js
@@ -89,6 +89,20 @@ function tarballToVersion (name, tb) {
   return match[2] || match[1]
 }
 
+function relativizeLink (name, spec, topPath, requested) {
+  if (!spec.startsWith('file:')) {
+    return
+  }
+
+  let requestedPath = requested.fetchSpec
+  if (requested.type === 'file') {
+    requestedPath = path.dirname(requestedPath)
+  }
+
+  const relativized = path.relative(requestedPath, path.resolve(topPath, spec.slice(5)))
+  return 'file:' + relativized
+}
+
 function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts) {
   validate('OSSOOOO|ZSSOOOO', arguments)
   const usesIntegrity = (
@@ -101,7 +115,14 @@ function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts)
     sw.resolved = sw.version
     sw.version = regTarball
   }
-  if (sw.requires) Object.keys(sw.requires).map(_ => { sw.requires[_] = tarballToVersion(_, sw.requires[_]) || sw.requires[_] })
+  if (sw.requires) {
+    Object.keys(sw.requires).forEach(name => {
+      const spec = sw.requires[name]
+      sw.requires[name] = tarballToVersion(name, spec) ||
+        relativizeLink(name, spec, topPath, requested) ||
+        spec
+    })
+  }
   const modernLink = requested.type === 'directory' && !sw.from
   if (hasModernMeta(onDiskChild) && childIsEquivalent(sw, requested, onDiskChild)) {
     // The version on disk matches the shrinkwrap entry.