Function isScriptAllowed

workspaces/arborist/lib/script-allowed.js:26–69

(node, policy)

//     resolved committish

const isScriptAllowed = (node, policy) => {
  // Bundled dependencies never run their install scripts and cannot be
  // allowlisted. Matching by name@version from the bundled tarball would
  // reintroduce manifest confusion (a bundled tarball can claim any name
  // and version). Returning null marks them as not-allowed regardless of
  // any policy entry, so their install scripts are blocked by the
  // install-time gate. A package that needs a bundled dep's script must
  // forward it as one of its own lifecycle scripts.
  if (node.inBundle) {
    return null
  }

  if (!policy || typeof policy !== 'object') {
    return null
  }

  let anyAllow = false
  let anyDeny = false

  for (const [key, value] of Object.entries(policy)) {
    // Pass deny intent so matchRegistry can fail closed on an unverifiable
    // version: a deny still blocks, an allow stays refused.
    if (!matches(node, key, value === false)) {
      continue
    }
    if (value === false) {
      anyDeny = true
      continue
    }
    /* istanbul ignore else: policy values are strictly true/false;
       defensive guard against unexpected coercions. */
    if (value === true) {
      anyAllow = true
    }
  }

  if (anyDeny) {
    return false
  }
  if (anyAllow) {
    return true
  }
  return null
}

const matches = (node, key, failClosed) => {
  let parsed