feat: throw forbidden error when package is blocked by security policy #1
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
claudiahdz
force-pushed
the
claudiahdz/403-error-messaging
branch
from
17a0e05 to
c88c666
Compare
djsauble
reviewed
Aug 12, 2019
| const isForbidden = target && policyRestrictions && packument.policyRestrictions.restrictedVersions[target] | ||
| const pckg = `${packument.name}@${wanted}${ | ||
| opts.enjoyBy | ||
| ? ` with an Enjoy By date of ${ |
There was a problem hiding this comment.
Curious. What is this 'Enjoy By' date about?
There was a problem hiding this comment.
There was a problem hiding this comment.
Interesting. So what's the benefit of filtering out packages that are newer than a given date? Avoiding packages that haven't been thoroughly tested or widely deployed?
There was a problem hiding this comment.
@djsauble Reproducing installs as they would have happened at some point in the past.
claudiahdz
force-pushed
the
claudiahdz/403-error-messaging
branch
from
aa2c6c9 to
45b6df3
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
✏️ Changes
This PR introduces a new error in the case that a forbidden package was requested and blocked by the security proxy. If no manifest was found under the
versionsobject, then a check is done to verify if the package is forbidden under therestrictedVersionsobject. If it is, a new error code is thrownE403and the admin custom message will be shown on the CLI like:If no policy restrictions are found on the packument then the behavior will continue as is right now and throw a
ETARGETerror.🔗 References
RFC: https://npmjs.slab.com/posts/proposed-package-filtering-messaging-on-the-cli-kejlhyow
🔍 Testing
Automated testing
✅ This change has unit test coverage
This PR depends on: npm/cli#234