Function keyTargetsNode

deps/npm/lib/utils/allow-scripts-writer.js:150–188

(key, node)

// install-directory name and is forgeable through aliases / manifest
// confusion.
const keyTargetsNode = (key, node) => {
  let parsed
  try {
    parsed = npa(key)
  } catch {
    return false
  }
  switch (parsed.type) {
    case 'tag':
    case 'range':
    case 'version': {
      const trusted = getTrustedRegistryIdentity(node)
      if (!trusted) {
        return false
      }
      return trusted.name === parsed.name
    }
    case 'git': {
      let resolvedParsed
      try {
        const resolved = primaryResolvedSource(node)
        resolvedParsed = resolved ? npa(resolved) : null
      } catch {
        /* istanbul ignore next */
        return false
      }
      const keyHost = parsed.hosted?.ssh({ noCommittish: true })
      const nodeHost = resolvedParsed?.hosted?.ssh({ noCommittish: true })
      return !!(keyHost && nodeHost && keyHost === nodeHost)
    }
    case 'file':
    case 'directory':
    case 'remote':
      return resolvedSourceSpecs(node)
        .some(resolved => resolved === parsed.saveSpec || resolved === parsed.fetchSpec)
    default:
      return false
  }
}

// Apply approvals for all currently-installed versions of a single package.
//