install: Refactor module validation for ealier/better checks

This does a few things:

1. It fixes the calls to npm-install-checks– we were passing a
read-package-tree node, and it wants package.json data.

2. This moves checks to be at "install" time (resolveWithNewModule), so
they happen earlier.

3. Arguments passed in from the command line are checked even earlier.
This is where "don't install yourself" checks are done.

PR-URL: https://github.com/npm/npm/pull/9039
Fixes: https://github.com/npm/npm/issues/8637
Fixes: https://github.com/npm/npm/issues/8921

5 files changed, 261 insertions, 4 deletions

diff --git a/test/tap/check-cpu-reqs.js b/test/tap/check-cpu-reqs.js
new file mode 100644
index 000000000..4d8c3dc65
--- /dev/null
+++ b/test/tap/check-cpu-reqs.js
@@ -0,0 +1,63 @@
+'use strict'
+var path = require('path')
+var fs = require('fs')
+var test = require('tap').test
+var osenv = require('osenv')
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var common = require('../common-tap.js')
+
+var base = path.join(__dirname, path.basename(__filename, '.js'))
+var installFrom = path.join(base, 'from')
+var installIn = path.join(base, 'in')
+
+var json = {
+  name: 'check-cpu-reqs',
+  version: '0.0.1',
+  description: 'fixture',
+  cpu: ['fake-cpu']
+}
+
+test('setup', function (t) {
+  setup()
+  t.end()
+})
+
+var INSTALL_OPTS = ['--loglevel', 'silly']
+var EXEC_OPTS = {cwd: installIn}
+
+test('install bad cpu', function (t) {
+  common.npm(['install', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 1, 'npm install refused to install a package in itself')
+    t.end()
+  })
+})
+test('force install bad cpu', function (t) {
+  common.npm(['install', '--force', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 0, 'npm install happily installed a package in itself with --force')
+    t.end()
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(base)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(path.resolve(installFrom, 'node_modules'))
+  fs.writeFileSync(
+    path.join(installFrom, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  mkdirp.sync(path.resolve(installIn, 'node_modules'))
+  process.chdir(base)
+}
diff --git a/test/tap/check-engine-reqs.js b/test/tap/check-engine-reqs.js
new file mode 100644
index 000000000..8dd9b8231
--- /dev/null
+++ b/test/tap/check-engine-reqs.js
@@ -0,0 +1,65 @@
+'use strict'
+var path = require('path')
+var fs = require('fs')
+var test = require('tap').test
+var osenv = require('osenv')
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var common = require('../common-tap.js')
+
+var base = path.join(__dirname, path.basename(__filename, '.js'))
+var installFrom = path.join(base, 'from')
+var installIn = path.join(base, 'in')
+
+var json = {
+  name: 'check-engine-reqs',
+  version: '0.0.1',
+  description: 'fixture',
+  engines: {
+    node: '1.0.0-not-a-real-version'
+  }
+}
+
+test('setup', function (t) {
+  setup()
+  t.end()
+})
+
+var INSTALL_OPTS = ['--loglevel', 'silly']
+var EXEC_OPTS = {cwd: installIn}
+
+test('install bad engine', function (t) {
+  common.npm(['install', '--engine-strict', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 1, 'npm install refused to install a package in itself')
+    t.end()
+  })
+})
+test('force install bad engine', function (t) {
+  common.npm(['install', '--engine-strict', '--force', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 0, 'npm install happily installed a package in itself with --force')
+    t.end()
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(base)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(path.resolve(installFrom, 'node_modules'))
+  fs.writeFileSync(
+    path.join(installFrom, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  mkdirp.sync(path.resolve(installIn, 'node_modules'))
+  process.chdir(base)
+}
diff --git a/test/tap/check-install-self.js b/test/tap/check-install-self.js
new file mode 100644
index 000000000..821d8eb4d
--- /dev/null
+++ b/test/tap/check-install-self.js
@@ -0,0 +1,66 @@
+'use strict'
+var path = require('path')
+var fs = require('fs')
+var test = require('tap').test
+var osenv = require('osenv')
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var common = require('../common-tap.js')
+
+var base = path.join(__dirname, path.basename(__filename, '.js'))
+var installFrom = path.join(base, 'from')
+var installIn = path.join(base, 'in')
+
+var json = {
+  name: 'check-install-self',
+  version: '0.0.1',
+  description: 'fixture'
+}
+
+test('setup', function (t) {
+  setup()
+  t.end()
+})
+
+var INSTALL_OPTS = ['--loglevel', 'silent']
+var EXEC_OPTS = {cwd: installIn}
+
+test('install self', function (t) {
+  common.npm(['install', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 1, 'npm install refused to install a package in itself')
+    t.end()
+  })
+})
+test('force install self', function (t) {
+  common.npm(['install', '--force', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 0, 'npm install happily installed a package in itself with --force')
+    t.end()
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(base)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(path.resolve(installFrom, 'node_modules'))
+  fs.writeFileSync(
+    path.join(installFrom, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  mkdirp.sync(path.resolve(installIn, 'node_modules'))
+  fs.writeFileSync(
+    path.join(installIn, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  process.chdir(base)
+}
diff --git a/test/tap/check-os-reqs.js b/test/tap/check-os-reqs.js
new file mode 100644
index 000000000..5d0c1ecf7
--- /dev/null
+++ b/test/tap/check-os-reqs.js
@@ -0,0 +1,63 @@
+'use strict'
+var path = require('path')
+var fs = require('fs')
+var test = require('tap').test
+var osenv = require('osenv')
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var common = require('../common-tap.js')
+
+var base = path.join(__dirname, path.basename(__filename, '.js'))
+var installFrom = path.join(base, 'from')
+var installIn = path.join(base, 'in')
+
+var json = {
+  name: 'check-os-reqs',
+  version: '0.0.1',
+  description: 'fixture',
+  os: ['fake-os']
+}
+
+test('setup', function (t) {
+  setup()
+  t.end()
+})
+
+var INSTALL_OPTS = ['--loglevel', 'silly']
+var EXEC_OPTS = {cwd: installIn}
+
+test('install bad os', function (t) {
+  common.npm(['install', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 1, 'npm install refused to install a package in itself')
+    t.end()
+  })
+})
+test('force install bad os', function (t) {
+  common.npm(['install', '--force', installFrom].concat(INSTALL_OPTS), EXEC_OPTS, function (err, code) {
+    t.ifError(err, 'npm ran without issue')
+    t.is(code, 0, 'npm install happily installed a package in itself with --force')
+    t.end()
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(base)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(path.resolve(installFrom, 'node_modules'))
+  fs.writeFileSync(
+    path.join(installFrom, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  mkdirp.sync(path.resolve(installIn, 'node_modules'))
+  process.chdir(base)
+}
diff --git a/test/tap/install-at-locally.js b/test/tap/install-at-locally.js
index 9c5d85980..8745c4d60 100644
--- a/test/tap/install-at-locally.js
+++ b/test/tap/install-at-locally.js
@@ -13,7 +13,7 @@ var pkg = path.join(__dirname, 'install-at-locally')
 var EXEC_OPTS = { cwd: pkg }
 
 var json = {
-  name: 'install-at-locally',
+  name: 'install-at-locally-mock',
   version: '0.0.0'
 }
 
@@ -25,8 +25,8 @@ test('setup', function (t) {
 test('\'npm install ./package@1.2.3\' should install local pkg', function (t) {
   var target = './package@1.2.3'
   setup(target)
-  common.npm(['install', target], EXEC_OPTS, function (err, code) {
-    var p = path.resolve(pkg, 'node_modules/install-at-locally/package.json')
+  common.npm(['install', '--loglevel=silent', target], EXEC_OPTS, function (err, code) {
+    var p = path.resolve(pkg, 'node_modules/install-at-locally-mock/package.json')
     t.ifError(err, 'install local package successful')
     t.equal(code, 0, 'npm install exited with code')
     t.ok(JSON.parse(fs.readFileSync(p, 'utf8')))
@@ -38,7 +38,7 @@ test('\'npm install install/at/locally@./package@1.2.3\' should install local pk
   var target = 'install/at/locally@./package@1.2.3'
   setup(target)
   common.npm(['install', target], EXEC_OPTS, function (err, code) {
-    var p = path.resolve(pkg, 'node_modules/install-at-locally/package.json')
+    var p = path.resolve(pkg, 'node_modules/install-at-locally-mock/package.json')
     t.ifError(err, 'install local package in explicit directory successful')
     t.equal(code, 0, 'npm install exited with code')
     t.ok(JSON.parse(fs.readFileSync(p, 'utf8')))