fix(config): respect --global, --package-lock-only

This corrects two things,

`--global` implies `--location=global` and `--package-lock-only` implies
`--package-lock`

It also introduces a new sandbox runner for testing purposes. it's not
the prettiest thing i've ever written, but it seems to do the job pretty
nicely and doesn't require keeping track of wild shenanigans everywhere.

Fixes #2747
Fixes #3572

PR-URL: #3684
Credit: @nlf
Close: #3684
Reviewed-by: @wraithgar

lib/config.js

@@ -121,7 +121,7 @@ class Config extends BaseCommand {
           break
         case 'list':
         case 'ls':
-          await (this.npm.config.get('json') ? this.listJson() : this.list())
+          await (this.npm.flatOptions.json ? this.listJson() : this.list())
           break
         case 'edit':
           await this.edit()
@@ -138,7 +138,7 @@ class Config extends BaseCommand {
     if (!args.length)
       throw this.usageError()
 
-    const where = this.npm.config.get('location')
+    const where = this.npm.flatOptions.location
     for (const [key, val] of Object.entries(keyValues(args))) {
       this.npm.log.info('config', 'set %j %j', key, val)
       this.npm.config.set(key, val || '', where)
@@ -168,15 +168,15 @@ class Config extends BaseCommand {
     if (!keys.length)
       throw this.usageError()
 
-    const where = this.npm.config.get('location')
+    const where = this.npm.flatOptions.location
     for (const key of keys)
       this.npm.config.delete(key, where)
     await this.npm.config.save(where)
   }
 
   async edit () {
-    const e = this.npm.config.get('editor')
-    const where = this.npm.config.get('location')
+    const e = this.npm.flatOptions.editor
+    const where = this.npm.flatOptions.location
     const file = this.npm.config.data.get(where).source
 
     // save first, just to make sure it's synced up
@@ -232,6 +232,7 @@ ${defData}
 
   async list () {
     const msg = []
+    // long does not have a flattener
     const long = this.npm.config.get('long')
     for (const [where, { data, source }] of this.npm.config.data.entries()) {
       if (where === 'default' && !long)

lib/utils/config/definitions.js

@@ -804,7 +804,11 @@ define('global', {
     * bin files are linked to \`{prefix}/bin\`
     * man pages are linked to \`{prefix}/share/man\`
   `,
-  flatten,
+  flatten: (key, obj, flatOptions) => {
+    flatten(key, obj, flatOptions)
+    if (flatOptions.global)
+      flatOptions.location = 'global'
+  },
 })
 
 define('global-style', {
@@ -1131,14 +1135,10 @@ define('location', {
   description: `
     When passed to \`npm config\` this refers to which config file to use.
   `,
-  // NOTE: the flattener here deliberately does not alter the value of global
-  // for now, this is to avoid inadvertently causing any breakage. the value of
-  // global, however, does modify this flag.
-  flatten (key, obj, flatOptions) {
-    // if global is set, we override ourselves
-    if (obj.global)
-      obj.location = 'global'
-    flatOptions.location = obj.location
+  flatten: (key, obj, flatOptions) => {
+    flatten(key, obj, flatOptions)
+    if (flatOptions.global)
+      flatOptions.location = 'global'
   },
 })
 
@@ -1359,7 +1359,11 @@ define('package-lock', {
     modules will also be disabled.  To remove extraneous modules with
     package-locks disabled use \`npm prune\`.
   `,
-  flatten,
+  flatten: (key, obj, flatOptions) => {
+    flatten(key, obj, flatOptions)
+    if (flatOptions.packageLockOnly)
+      flatOptions.packageLock = true
+  },
 })
 
 define('package-lock-only', {
@@ -1375,7 +1379,11 @@ define('package-lock-only', {
     For \`list\` this means the output will be based on the tree described by the
     \`package-lock.json\`, rather than the contents of \`node_modules\`.
   `,
-  flatten,
+  flatten: (key, obj, flatOptions) => {
+    flatten(key, obj, flatOptions)
+    if (flatOptions.packageLockOnly)
+      flatOptions.packageLock = true
+  },
 })
 
 define('pack-destination', {