fix(arborist): handle link nodes in old lockfiles correctly

6 files changed, 96 insertions, 2 deletions

diff --git a/workspaces/arborist/lib/arborist/build-ideal-tree.js b/workspaces/arborist/lib/arborist/build-ideal-tree.js
index 3f001f9e9..535a6ab7d 100644
--- a/workspaces/arborist/lib/arborist/build-ideal-tree.js
+++ b/workspaces/arborist/lib/arborist/build-ideal-tree.js
@@ -743,6 +743,12 @@ This is a one-time fix-up, please be patient...
         continue
       }
 
+      // if the node's location isn't within node_modules then this is actually
+      // a link target, so skip it. the link node itself will be queued later.
+      if (!node.location.startsWith('node_modules')) {
+        continue
+      }
+
       queue.push(async () => {
         log.silly('inflate', node.location)
         const { resolved, version, path, name, location, integrity } = node
@@ -750,8 +756,7 @@ This is a one-time fix-up, please be patient...
         const useResolved = resolved && (
           !version || resolved.startsWith('file:')
         )
-        const id = useResolved ? resolved
-          : version || `file:${node.path}`
+        const id = useResolved ? resolved : version
         const spec = npa.resolve(name, id, dirname(path))
         const t = `idealTree:inflate:${location}`
         this.addTracker(t)
diff --git a/workspaces/arborist/tap-snapshots/test/arborist/build-ideal-tree.js.test.cjs b/workspaces/arborist/tap-snapshots/test/arborist/build-ideal-tree.js.test.cjs
index b743dab95..17aee505c 100644
--- a/workspaces/arborist/tap-snapshots/test/arborist/build-ideal-tree.js.test.cjs
+++ b/workspaces/arborist/tap-snapshots/test/arborist/build-ideal-tree.js.test.cjs
@@ -36919,6 +36919,53 @@ ArboristNode {
 }
 `
 
+exports[`test/arborist/build-ideal-tree.js TAP inflating a link node in an old lockfile skips registry > must match snapshot 1`] = `
+ArboristNode {
+  "children": Map {
+    "link-dep" => ArboristLink {
+      "edgesIn": Set {
+        EdgeIn {
+          "from": "",
+          "name": "link-dep",
+          "spec": "file:./link-dep",
+          "type": "prod",
+        },
+      },
+      "location": "node_modules/link-dep",
+      "name": "link-dep",
+      "path": "{CWD}/test/fixtures/old-lock-with-link/node_modules/link-dep",
+      "realpath": "{CWD}/test/fixtures/old-lock-with-link/link-dep",
+      "resolved": "file:../link-dep",
+      "target": ArboristNode {
+        "location": "link-dep",
+      },
+      "version": "1.0.0",
+    },
+  },
+  "edgesOut": Map {
+    "link-dep" => EdgeOut {
+      "name": "link-dep",
+      "spec": "file:./link-dep",
+      "to": "node_modules/link-dep",
+      "type": "prod",
+    },
+  },
+  "fsChildren": Set {
+    ArboristNode {
+      "location": "link-dep",
+      "name": "link-dep",
+      "path": "{CWD}/test/fixtures/old-lock-with-link/link-dep",
+      "version": "1.0.0",
+    },
+  },
+  "isProjectRoot": true,
+  "location": "",
+  "name": "old-lock-with-link",
+  "path": "{CWD}/test/fixtures/old-lock-with-link",
+  "version": "1.0.0",
+}
+`
+
 exports[`test/arborist/build-ideal-tree.js TAP link dep with a link dep > link metadeps with lockfile 1`] = `
 ArboristNode {
   "children": Map {
diff --git a/workspaces/arborist/test/arborist/build-ideal-tree.js b/workspaces/arborist/test/arborist/build-ideal-tree.js
index e718b0b58..d869c686e 100644
--- a/workspaces/arborist/test/arborist/build-ideal-tree.js
+++ b/workspaces/arborist/test/arborist/build-ideal-tree.js
@@ -1163,6 +1163,26 @@ This is a one-time fix-up, please be patient...
   ])
 })
 
+t.test('inflating a link node in an old lockfile skips registry', async t => {
+  const checkLogs = warningTracker()
+  const path = resolve(fixtures, 'old-lock-with-link')
+  const arb = new Arborist({ path, ...OPT, registry: 'http://invalid.host' })
+  const tree = await arb.buildIdealTree()
+  t.matchSnapshot(printTree(tree))
+  t.strictSame(checkLogs(), [
+    [
+      'warn',
+      'old lockfile',
+      `
+The package-lock.json file was created with an old version of npm,
+so supplemental metadata must be fetched from the registry.
+
+This is a one-time fix-up, please be patient...
+`,
+    ],
+  ])
+})
+
 t.test('warn for ancient lockfile, even if we use v1', async t => {
   const checkLogs = warningTracker()
   const path = resolve(fixtures, 'sax')
diff --git a/workspaces/arborist/test/fixtures/old-lock-with-link/link-dep/package.json b/workspaces/arborist/test/fixtures/old-lock-with-link/link-dep/package.json
new file mode 100644
index 000000000..0bb2ef11a
--- /dev/null
+++ b/workspaces/arborist/test/fixtures/old-lock-with-link/link-dep/package.json
@@ -0,0 +1,4 @@
+{
+  "name": "link-dep",
+  "version": "1.0.0"
+}
diff --git a/workspaces/arborist/test/fixtures/old-lock-with-link/package-lock.json b/workspaces/arborist/test/fixtures/old-lock-with-link/package-lock.json
new file mode 100644
index 000000000..f004bc625
--- /dev/null
+++ b/workspaces/arborist/test/fixtures/old-lock-with-link/package-lock.json
@@ -0,0 +1,11 @@
+{
+  "name": "old-lock-with-link",
+  "version": "1.0.0",
+  "lockfileVersion": 1,
+  "requires": true,
+  "dependencies": {
+    "link-dep": {
+      "version": "file:link-dep"
+    }
+  }
+}
diff --git a/workspaces/arborist/test/fixtures/old-lock-with-link/package.json b/workspaces/arborist/test/fixtures/old-lock-with-link/package.json
new file mode 100644
index 000000000..85c242456
--- /dev/null
+++ b/workspaces/arborist/test/fixtures/old-lock-with-link/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "old-lock-with-link",
+  "version": "1.0.0",
+  "dependencies": {
+    "link-dep": "file:./link-dep"
+  }
+}