fix: pass npm before config to pacote as a Date (#6157)

Author: NathanWalker

lib/services/npm-config-service.ts

@@ -28,6 +28,13 @@ export class NpmConfigService implements INpmConfigService {
 						? value
 						: value.replace(/\${([^}]+)}/, (_, envVar) => process.env[envVar]);
 			});
+
+			// pacote calls before.toISOString(), but JSON gives an ISO string
+			// (npm derives `before` from `min-release-age`).
+			if (this.config.before) {
+				const before = new Date(this.config.before);
+				this.config.before = isNaN(before.getTime()) ? null : before;
+			}
 		} catch (e) {}
 	}
 }

test/services/npm-config-service.ts

@@ -0,0 +1,56 @@
+import { assert } from "chai";
+import * as sinon from "sinon";
+import * as childProcess from "child_process";
+import { NpmConfigService } from "../../lib/services/npm-config-service";
+
+describe("npmConfigService", () => {
+	let sandbox: sinon.SinonSandbox;
+
+	beforeEach(() => {
+		sandbox = sinon.createSandbox();
+	});
+
+	afterEach(() => {
+		sandbox.restore();
+	});
+
+	const getConfigFor = (npmConfig: Record<string, any>) => {
+		sandbox
+			.stub(childProcess, "execSync")
+			.returns(Buffer.from(JSON.stringify(npmConfig)));
+		return new NpmConfigService().getConfig();
+	};
+
+	it("converts `before` to a Date", () => {
+		const iso = "2026-09-30T01:51:31.276Z";
+		const config = getConfigFor({ before: iso, "min-release-age": null });
+
+		assert.instanceOf(config.before, Date);
+		assert.equal(config.before.toISOString(), iso);
+	});
+
+	it("drops an unparseable `before`", () => {
+		const config = getConfigFor({ before: "not a date" });
+
+		assert.isNull(config.before);
+	});
+
+	it("leaves a null `before` untouched", () => {
+		const config = getConfigFor({ before: null });
+
+		assert.isNull(config.before);
+	});
+
+	it("substitutes ${ENV} references in string values", () => {
+		process.env.NS_NPM_CONFIG_TEST_TOKEN = "secret";
+		try {
+			const config = getConfigFor({
+				"//registry.npmjs.org/:_authToken": "${NS_NPM_CONFIG_TEST_TOKEN}",
+			});
+
+			assert.equal(config["//registry.npmjs.org/:_authToken"], "secret");
+		} finally {
+			delete process.env.NS_NPM_CONFIG_TEST_TOKEN;
+		}
+	});
+});

test/services/pacote-service.ts

@@ -8,8 +8,7 @@ import * as _ from "lodash";
 import { EventEmitter } from "events";
 import * as fs from "fs";
 import { NpmConfigService } from "../../lib/services/npm-config-service";
-import { INpmConfigService } from "../../lib/declarations";
-import { IProxySettings } from "../../lib/common/declarations";
+import { IDictionary, IProxySettings } from "../../lib/common/declarations";
 import { IInjector } from "../../lib/common/definitions/yok";
 import { Arborist } from "@npmcli/arborist";
 import * as pacote from "pacote";
@@ -20,6 +19,7 @@ use(chaiAsPromised);
 
 let defaultPacoteOpts: IPacoteBaseOptions = null;
 let isNpmConfigSet = false;
+let npmConfig: IDictionary<any> = null;
 const packageName = "testPackage";
 const fullPath = `/Users/username/${packageName}`;
 const destinationDir = "destinationDir";
@@ -49,14 +49,16 @@ interface ITestCase extends ITestSetup {
 const createTestInjector = (opts?: ITestSetup): IInjector => {
 	opts = opts || {};
 	const testInjector = new Yok();
-	testInjector.register("npmConfigService", NpmConfigService);
-
+	// Each `npm config` read recomputes `before` from `min-release-age`, so
+	// read it once and share it, keeping expectations comparable.
 	if (!isNpmConfigSet) {
-		const npmConfigService: INpmConfigService =
-			testInjector.resolve("npmConfigService");
-		defaultPacoteOpts = { ...npmConfigService.getConfig(), Arborist };
+		npmConfig = new NpmConfigService().getConfig();
+		defaultPacoteOpts = { ...npmConfig, Arborist };
 		isNpmConfigSet = true;
 	}
+	testInjector.register("npmConfigService", {
+		getConfig: (): IDictionary<any> => ({ ...npmConfig }),
+	});
 
 	const npmCachePath = defaultPacoteOpts["cache"];