fix: better error message when the installed package was unpublished

close #5849
pnpm · Dec 29, 2022 · de957c9 · de957c9
1 parent 33f95fc
commit de957c9
Show file tree

Hide file tree

Showing 3 changed files with 38 additions and 1 deletion.
diff --git a/resolving/npm-resolver/src/pickPackage.ts b/resolving/npm-resolver/src/pickPackage.ts
@@ -20,10 +20,17 @@ export interface PackageMeta {
   name: string
   'dist-tags': Record<string, string>
   versions: Record<string, PackageInRegistry>
-  time?: Record<string, string>
+  time?: PackageMetaTime
   cachedAt?: number
 }
 
+export type PackageMetaTime = Record<string, string> & {
+  unpublished?: {
+    time: string
+    versions: string[]
+  }
+}
+
 export interface PackageMetaCache {
   get: (key: string) => PackageMeta | undefined
   set: (key: string, meta: PackageMeta) => void

diff --git a/resolving/npm-resolver/src/pickPackageFromMeta.ts b/resolving/npm-resolver/src/pickPackageFromMeta.ts
@@ -18,6 +18,14 @@ export function pickPackageFromMeta (
   meta: PackageMeta,
   publishedBy?: Date
 ): PackageInRegistry | null {
+  if (!meta.versions || Object.keys(meta.versions).length === 0) {
+    // Unfortunately, the npm registry doesn't return the time field in the abbreviated metadata.
+    // So we won't always know if the package was unpublished.
+    if (meta.time?.unpublished?.versions?.length) {
+      throw new PnpmError('UNPUBLISHED_PKG', `No versions available for ${spec.name} because it was unpublished`)
+    }
+    throw new PnpmError('NO_VERSIONS', `No versions available for ${spec.name}. The package may be unpublished.`)
+  }
   try {
     let version!: string | null
     switch (spec.type) {
@@ -43,6 +51,9 @@ export function pickPackageFromMeta (
     }
     return manifest
   } catch (err: any) { // eslint-disable-line
+    // if (meta.unpublished) {
+    // throw new PnpmError('UNPUBLISHED_PKG', `Package ${spec.name} has been unpublished`)
+    // }
     throw new PnpmError('MALFORMED_METADATA',
       `Received malformed metadata for "${spec.name}"`,
       { hint: 'This might mean that the package was unpublished from the registry' }

diff --git a/resolving/npm-resolver/test/index.ts b/resolving/npm-resolver/test/index.ts
@@ -1732,3 +1732,22 @@ test('resolveFromNpm() should normalize the registry', async () => {
   expect(resolveResult!.manifest!.name).toBe('is-positive')
   expect(resolveResult!.manifest!.version).toBe('1.0.0')
 })
+
+test('fail when the installed package has no versions', async () => {
+  nock(registry)
+    .get('/is-positive')
+    .reply(200, {
+      name: 'is-positive',
+      modified: '2021-09-28T14:21:36.303Z',
+    })
+
+  const cacheDir = tempy.directory()
+  const resolve = createResolveFromNpm({
+    cacheDir,
+  })
+
+  await expect(resolve({ alias: 'is-positive', pref: '1.0.0' }, { registry })).rejects
+    .toThrow(
+      new PnpmError('NO_VERSIONS', 'No versions available for is-positive. The package may be unpublished.')
+    )
+})