Function applyDenyForPackage

lib/utils/allow-scripts-writer.js:325–353

(existing, nodes)

// Apply a deny for a single package. Always name-only; ignores `--allow-scripts-pin`.
const applyDenyForPackage = (existing, nodes) => {
  const allowScripts = { ...existing }
  const changes = []

  if (!Array.isArray(nodes) || nodes.length === 0) {
    return { allowScripts, changes }
  }

  const sample = nodes[0]
  const name = nameKeyFor(sample)
  if (!name) {
    return { allowScripts, changes }
  }

  // Drop any pinned allow entries for this package: the name-only deny
  // overrides them anyway, and leaving them in place is confusing.
  for (const key of Object.keys(allowScripts)) {
    if (keyTargetsNode(key, sample) && key !== name) {
      delete allowScripts[key]
      changes.push({ key, change: 'removed-pinned-allow' })
    }
  }

  if (allowScripts[name] !== false) {
    allowScripts[name] = false
    changes.push({ key: name, change: 'added' })
  }
  return { allowScripts, changes }
}

module.exports = {
  applyApprovalForPackage,