fix: emit valid JSON from approve-scripts/deny-scripts --json

Author: Michael Smith

lib/utils/allow-scripts-cmd.js

@@ -79,6 +79,10 @@ class AllowScriptsCmd extends BaseCommand {
   }
 
   runPending (unreviewed) {
+    if (this.npm.flatOptions.json) {
+      output.buffer({ allowScripts: this.pendingSummary(unreviewed) })
+      return
+    }
     if (unreviewed.length === 0) {
       output.standard('No packages with unreviewed install scripts.')
       return
@@ -105,8 +109,30 @@ class AllowScriptsCmd extends BaseCommand {
     )
   }
 
+  // Build the same `{ name, changes }` shape printSummary uses for writes,
+  // but tag every entry as `pending` since nothing is written. Names and
+  // versions are derived exactly like the text listing above.
+  pendingSummary (unreviewed) {
+    const groups = new Map()
+    for (const { node } of unreviewed) {
+      const { name, version } = trustedDisplay(node)
+      /* istanbul ignore next: every test node has a name */
+      const display = name || '<unknown>'
+      const key = version ? `${display}@${version}` : display
+      if (!groups.has(display)) {
+        groups.set(display, [])
+      }
+      groups.get(display).push({ key, change: 'pending' })
+    }
+    return [...groups].map(([name, changes]) => ({ name, changes }))
+  }
+
   async runAll (unreviewed) {
     if (unreviewed.length === 0) {
+      if (this.npm.flatOptions.json) {
+        output.buffer({ allowScripts: [] })
+        return
+      }
       output.standard('No packages with unreviewed install scripts.')
       return
     }

test/lib/commands/approve-scripts.js

@@ -178,6 +178,51 @@ t.test('approve-scripts --json outputs structured summary', async t => {
   })
 })
 
+t.test('approve-scripts --pending --json lists unreviewed packages as JSON', async t => {
+  const { npm, joinedOutput } = await mockNpm(t, {
+    prefixDir: setupProject({ withScripts: ['canvas', 'sharp'] }),
+    config: { 'allow-scripts-pending': true, json: true },
+  })
+  await npm.exec('approve-scripts', [])
+  const parsed = JSON.parse(joinedOutput())
+  const byName = Object.fromEntries(parsed.allowScripts.map((e) => [e.name, e.changes]))
+  t.strictSame(byName, {
+    canvas: [{ key: 'canvas@1.0.0', change: 'pending' }],
+    sharp: [{ key: 'sharp@1.0.0', change: 'pending' }],
+  })
+})
+
+t.test('approve-scripts --pending --json with no unreviewed emits empty list', async t => {
+  const { npm, joinedOutput } = await mockNpm(t, {
+    prefixDir: setupProject({
+      allowScripts: { canvas: true },
+      withScripts: ['canvas'],
+    }),
+    config: { 'allow-scripts-pending': true, json: true },
+  })
+  await npm.exec('approve-scripts', [])
+  t.strictSame(JSON.parse(joinedOutput()), { allowScripts: [] })
+})
+
+t.test('approve-scripts --all --json with no unreviewed emits empty list', async t => {
+  const { npm, joinedOutput } = await _mockNpm(t, {
+    prefixDir: {
+      'package.json': JSON.stringify({ name: 'host', version: '1.0.0' }),
+      'package-lock.json': JSON.stringify({
+        name: 'host',
+        version: '1.0.0',
+        lockfileVersion: 3,
+        requires: true,
+        packages: { '': { name: 'host', version: '1.0.0' } },
+      }),
+      node_modules: {},
+    },
+    config: { all: true, json: true },
+  })
+  await npm.exec('approve-scripts', [])
+  t.strictSame(JSON.parse(joinedOutput()), { allowScripts: [] })
+})
+
 t.test('approve-scripts --all with no unreviewed packages prints message', async t => {
   const { npm, joinedOutput } = await _mockNpm(t, {
     prefixDir: {

test/lib/commands/deny-scripts.js

@@ -130,6 +130,25 @@ t.test('deny-scripts --all with no unreviewed packages prints message', async t
   t.match(joinedOutput(), /No packages with unreviewed install scripts/)
 })
 
+t.test('deny-scripts --all --json with no unreviewed emits empty list', async t => {
+  const { npm, joinedOutput } = await _mockNpm(t, {
+    prefixDir: {
+      'package.json': JSON.stringify({ name: 'host', version: '1.0.0' }),
+      'package-lock.json': JSON.stringify({
+        name: 'host',
+        version: '1.0.0',
+        lockfileVersion: 3,
+        requires: true,
+        packages: { '': { name: 'host', version: '1.0.0' } },
+      }),
+      node_modules: {},
+    },
+    config: { all: true, json: true },
+  })
+  await npm.exec('deny-scripts', [])
+  t.strictSame(JSON.parse(joinedOutput()), { allowScripts: [] })
+})
+
 t.test('deny-scripts fails on global', async t => {
   const { npm } = await _mockNpm(t, {
     config: { global: true },