testPackagesLockedTarballTravels

tcmts.cli.test.e2e.packages.testPackagesLockedTarballTravels · #fkmfxoaj · term
Packages: a locked version is one tarball, and it travels with the code.
import { plainEnv, tcmBin, tempDir } from "#codebase/tcmts/cli/test/e2e/harness";
import { timeOnMs1 } from "#codebase/tcmts/cli/test/e2e/packages";
import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import fs from "node:fs";
import path from "node:path";
import { DatabaseSync } from "node:sqlite";

export const testPackagesLockedTarballTravels = () => {
  const { dir, tcm, fails, sql } = timeOnMs1();
  // hold ms 1 back at an older version than the registry's newest, installed and recorded
  const there = tempDir("packages remote");
  spawnSync(process.execPath, [tcmBin(), "init"], { cwd: there, env: plainEnv() });
  sql("UPDATE packages SET version = '1.0.0', integrity = NULL WHERE name = 'ms' AND range = '1'");
  fs.rmSync(path.join(dir, ".tcm", "cache", "node_modules"), { recursive: true, force: true });
  assert.match(tcm("check", "--fresh"), /⧩ '2m'/);
  const mine = sql("SELECT version, integrity FROM packages WHERE name = 'ms' AND range = '1'")[0]!;
  assert.equal(mine.version, "1.0.0");
  assert.match(mine.integrity!, /^sha(512|1)-/, "the install recorded the tarball's hash");

  // pushed code brings the versions it runs on, not whatever is newest over there
  tcm("remote", "add", "there", there);
  tcm("push", "there");
  const theirs = (() => {
    const db = new DatabaseSync(path.join(there, ".tcm", "codebase.sqlite"), { readOnly: true });
    try {
      return db.prepare("SELECT version, integrity FROM packages WHERE name = 'ms' AND range = '1'").get() as Record<string, string>;
    } finally {
      db.close();
    }
  })();
  assert.deepEqual({ ...theirs }, { ...mine });

  // different bytes under a locked version are refused
  sql("UPDATE packages SET integrity = 'sha512-not-what-the-registry-serves' WHERE name = 'ms' AND range = '1'");
  fs.rmSync(path.join(dir, ".tcm", "cache", "node_modules"), { recursive: true, force: true });
  assert.match(fails("check", "--fresh"), /ms@1\.0\.0: the installed tarball .* isn't the one this codebase locked/);
  sql("UPDATE packages SET integrity = ? WHERE name = 'ms' AND range = '1'", mine.integrity!);
}
testPackagesLockedTarballTravels

uses
