Issue #3255749 by Spokje, alexpott, shaal, longwave, cilefen, AaronMcHale, benjifisher, Mile23: Composer v2.2 prompts to authorize pluginsile

composer/Template/LegacyProject/composer.json

@@ -30,6 +30,12 @@
     "minimum-stability": "dev",
     "prefer-stable": true,
     "config": {
+        "allow-plugins": {
+            "composer/installers": true,
+            "drupal/core-composer-scaffold": true,
+            "drupal/core-project-message": true,
+            "drupal/core-vendor-hardening": true
+        },
         "sort-packages": true
     },
     "extra": {

composer/Template/RecommendedProject/composer.json

@@ -29,6 +29,11 @@
     "minimum-stability": "dev",
     "prefer-stable": true,
     "config": {
+        "allow-plugins": {
+            "composer/installers": true,
+            "drupal/core-composer-scaffold": true,
+            "drupal/core-project-message": true
+        },
         "sort-packages": true
     },
     "extra": {

core/tests/Drupal/BuildTests/Composer/Template/ComposerProjectTemplatesTest.php

@@ -244,6 +244,14 @@ class ComposerProjectTemplatesTest extends BuildTestBase {
 
     $this->executeCommand("COMPOSER_HOME=$composer_home COMPOSER_ROOT_VERSION=$simulated_core_version composer create-project --no-ansi $project testproject $simulated_core_version -vvv --repository $repository_path");
     $this->assertCommandSuccessful();
+    // Check the output of the project creation for the absence of warnings
+    // about any non-allowed composer plugins.
+    // Note: There are different warnings for unallowed composer plugins
+    // depending on running in non-interactive mode or not. It seems the Drupal
+    // CI environment always forces composer commands to run in the
+    // non-interactive mode. The only thing these messages have in common is the
+    // following string.
+    $this->assertErrorOutputNotContains('See https://getcomposer.org/allow-plugins');
 
     // Ensure we used the project from our codebase.
     $this->assertErrorOutputContains("Installing $project ($simulated_core_version): Symlinking from $package_dir");
@@ -386,6 +394,16 @@ JSON;
             "version" => $version,
           ],
         ];
+        // Ensure composer plugins are registered correctly.
+        $package_json = json_decode(file_get_contents($full_path . '/composer.json'), TRUE);
+        if (isset($package_json['type']) && $package_json['type'] === 'composer-plugin') {
+          $packages['packages'][$name][$version]['type'] = $package_json['type'];
+          $packages['packages'][$name][$version]['require'] = $package_json['require'];
+          $packages['packages'][$name][$version]['extra'] = $package_json['extra'];
+          if (isset($package_json['autoload'])) {
+            $packages['packages'][$name][$version]['autoload'] = $package_json['autoload'];
+          }
+        }
       }
     }
 

core/tests/Drupal/BuildTests/Framework/BuildTestBase.php

@@ -265,6 +265,16 @@ abstract class BuildTestBase extends TestCase {
     $this->assertStringContainsString($expected, $this->commandProcess->getErrorOutput());
   }
 
+  /**
+   * Assert text is not present in the error output of the most recent command.
+   *
+   * @param string $expected
+   *   Text we expect not to find in the error output of the command.
+   */
+  public function assertErrorOutputNotContains($expected) {
+    $this->assertStringNotContainsString($expected, $this->commandProcess->getErrorOutput());
+  }
+
   /**
    * Assert that text is present in the output of the most recent command.
    *

core/tests/Drupal/Tests/Composer/Plugin/Scaffold/Functional/ComposerHookTest.php

@@ -3,10 +3,10 @@
 namespace Drupal\Tests\Composer\Plugin\Scaffold\Functional;
 
 use Composer\Util\Filesystem;
+use Drupal\BuildTests\Framework\BuildTestBase;
 use Drupal\Tests\Composer\Plugin\Scaffold\AssertUtilsTrait;
 use Drupal\Tests\Composer\Plugin\Scaffold\ExecTrait;
 use Drupal\Tests\Composer\Plugin\Scaffold\Fixtures;
-use PHPUnit\Framework\TestCase;
 
 /**
  * Tests Composer Hooks that run scaffold operations.
@@ -22,7 +22,8 @@ use PHPUnit\Framework\TestCase;
  *
  * @group Scaffold
  */
-class ComposerHookTest extends TestCase {
+class ComposerHookTest extends BuildTestBase {
+
   use ExecTrait;
   use AssertUtilsTrait;
 
@@ -120,9 +121,10 @@ class ComposerHookTest extends TestCase {
     $this->mustExec("composer install --no-ansi", $sut);
     // Require a project that is not allowed to scaffold and confirm that we
     // get a warning, and it does not scaffold.
-    $stdout = $this->mustExec("composer require --no-ansi --no-interaction fixtures/drupal-assets-fixture:dev-main fixtures/scaffold-override-fixture:dev-main", $sut);
+    $this->executeCommand("composer require --no-ansi --no-interaction fixtures/drupal-assets-fixture:dev-main fixtures/scaffold-override-fixture:dev-main", $sut);
+    $this->assertCommandSuccessful();
     $this->assertFileDoesNotExist($sut . '/sites/default/default.settings.php');
-    $this->assertStringContainsString("Not scaffolding files for fixtures/scaffold-override-fixture, because it is not listed in the element 'extra.drupal-scaffold.allowed-packages' in the root-level composer.json file.", $stdout);
+    $this->assertErrorOutputContains('See https://getcomposer.org/allow-plugins');
   }
 
   /**

core/tests/Drupal/Tests/Composer/Plugin/Scaffold/fixtures/composer-hooks-fixture/composer.json.tmpl

@@ -64,5 +64,10 @@
       "libraries/{$name}": ["type:drupal-library"],
       "drush/Commands/contrib/{$name}": ["type:drupal-drush"]
     }
+  },
+  "config": {
+     "allow-plugins": {
+       "drupal/core-composer-scaffold": true
+     }
   }
 }

core/tests/Drupal/Tests/Composer/Plugin/Scaffold/fixtures/drupal-drupal/composer.json.tmpl

@@ -67,5 +67,10 @@
       "libraries/{$name}": ["type:drupal-library"],
       "drush/Commands/contrib/{$name}": ["type:drupal-drush"]
     }
-  }
+  },
+   "config": {
+      "allow-plugins": {
+        "drupal/core-composer-scaffold": true
+      }
+   }
 }