Fix installBaseUrl calculation in Node.js when relative URL is passed. (pyodide#5750)

Author: ryanking13

docs/project/changelog.md

@@ -21,6 +21,9 @@ myst:
   when the `lockfileURL` was set to a custom URL.
   {pr}`5737`
 
+- {{ Fix }} Fixed a bug in Node.js which providing a relative path to `lockFileURL` parameter of `loadPyodide()` did not work.
+  {pr}`5750`
+
 ## Version 0.28.0
 
 _July 4, 2025_

src/js/load-package.ts

@@ -147,14 +147,7 @@ export class PackageManager {
     this.#module = pyodideModule;
     this.#installer = new Installer(api, pyodideModule);
 
-    // use lockFileURL as the base URL for the packages
-    // if lockFileURL is relative, use location as the base URL
-    const lockfileBase =
-      this.#api.config.lockFileURL.substring(
-        0,
-        this.#api.config.lockFileURL.lastIndexOf("/") + 1,
-      ) || globalThis.location?.toString();
-
+    const lockfileBase = calculateInstallBaseUrl(this.#api.config.lockFileURL);
     if (IN_NODE) {
       this.installBaseUrl = this.#api.config.packageCacheDir ?? lockfileBase;
     } else {
@@ -457,7 +450,6 @@ export class PackageManager {
       }
       const lockfilePackage = this.#api.lockfile_packages[pkg.normalizedName];
       fileName = lockfilePackage.file_name;
-
       uri = resolvePath(fileName, this.installBaseUrl);
       fileSubResourceHash = "sha256-" + base16ToBase64(lockfilePackage.sha256);
     } else {
@@ -674,6 +666,24 @@ export function toStringArray(str: string | PyProxy | string[]): string[] {
   return str;
 }
 
+/**
+ * Calculates the install base url for the package manager.
+ * exported for testing
+ * @param lockFileURL
+ * @returns the install base url
+ */
+export function calculateInstallBaseUrl(lockFileURL: string) {
+  // 1. If the lockfile URL includes a path with slash (file url in Node.js or http url in browser), use the directory of the lockfile URL
+  // 2. Otherwise, fallback to the current location
+  //    2.1. In the browser, use `location` to get the current location
+  //    2.2. In Node.js just use the pwd
+  return (
+    lockFileURL.substring(0, lockFileURL.lastIndexOf("/") + 1) ||
+    globalThis.location?.toString() ||
+    "."
+  );
+}
+
 export let loadPackage: typeof PackageManager.prototype.loadPackage;
 /**
  * An object whose keys are the names of the loaded packages and whose values

src/js/test/unit/package-manager.test.ts

@@ -2,6 +2,7 @@ import * as chai from "chai";
 import sinon from "sinon";
 import { PackageManager, toStringArray } from "../../load-package.ts";
 import { genMockAPI, genMockModule } from "./test-helper.ts";
+import { calculateInstallBaseUrl } from "../../load-package.ts";
 
 describe("PackageManager", () => {
   it("should initialize with API and Module", () => {
@@ -120,3 +121,111 @@ describe("getLoadedPackageChannel", () => {
     });
   });
 });
+
+describe("calculateInstallBaseUrl", () => {
+  let originalLocation: any;
+
+  beforeEach(() => {
+    // Store original location
+    originalLocation = globalThis.location;
+  });
+
+  afterEach(() => {
+    // Restore original location
+    if (originalLocation) {
+      globalThis.location = originalLocation;
+    } else {
+      delete (globalThis as any).location;
+    }
+  });
+
+  it("Should extract base URL from absolute HTTP URL", () => {
+    const result = calculateInstallBaseUrl(
+      "https://cdn.example.com/pyodide/pyodide-lock.json",
+    );
+    chai.assert.equal(result, "https://cdn.example.com/pyodide/");
+  });
+
+  it("Should extract base URL from file URL", () => {
+    const result = calculateInstallBaseUrl(
+      "file:///tmp/pyodide/pyodide-lock.json",
+    );
+    chai.assert.equal(result, "file:///tmp/pyodide/");
+  });
+
+  it("Should extract base URL from relative URL with path", () => {
+    const result = calculateInstallBaseUrl("./pyodide/pyodide-lock.json");
+    chai.assert.equal(result, "./pyodide/");
+  });
+
+  it("Should extract base URL from relative URL with parent directory", () => {
+    const result = calculateInstallBaseUrl("../pyodide/pyodide-lock.json");
+    chai.assert.equal(result, "../pyodide/");
+  });
+
+  it("Should handle URL with no path component", () => {
+    const result = calculateInstallBaseUrl("pyodide-lock.json");
+    chai.assert.equal(result, ".");
+  });
+
+  it("Should handle empty string", () => {
+    const result = calculateInstallBaseUrl("");
+    chai.assert.equal(result, ".");
+  });
+
+  it("Should fallback to location when URL has no slash", () => {
+    // Mock browser location
+    (globalThis as any).location = {
+      toString: () => "https://example.com/app/",
+    };
+
+    const result = calculateInstallBaseUrl("pyodide-lock.json");
+    chai.assert.equal(result, "https://example.com/app/");
+  });
+
+  it("Should fallback to location when URL is empty", () => {
+    // Mock browser location
+    (globalThis as any).location = {
+      toString: () => "https://example.com/app/",
+    };
+
+    const result = calculateInstallBaseUrl("");
+    chai.assert.equal(result, "https://example.com/app/");
+  });
+
+  it("Should fallback to '.' when no location available", () => {
+    // Remove location to simulate environment without location
+    delete (globalThis as any).location;
+
+    const result = calculateInstallBaseUrl("pyodide-lock.json");
+    chai.assert.equal(result, ".");
+  });
+
+  it("Should handle URL with query parameters", () => {
+    const result = calculateInstallBaseUrl(
+      "https://cdn.example.com/pyodide/pyodide-lock.json?v=1.0",
+    );
+    chai.assert.equal(result, "https://cdn.example.com/pyodide/");
+  });
+
+  it("Should handle URL with hash fragment", () => {
+    const result = calculateInstallBaseUrl(
+      "https://cdn.example.com/pyodide/pyodide-lock.json#section",
+    );
+    chai.assert.equal(result, "https://cdn.example.com/pyodide/");
+  });
+
+  it("Should handle URL with both query parameters and hash", () => {
+    const result = calculateInstallBaseUrl(
+      "https://cdn.example.com/pyodide/pyodide-lock.json?v=1.0#section",
+    );
+    chai.assert.equal(result, "https://cdn.example.com/pyodide/");
+  });
+
+  it("Should handle URL with username and password", () => {
+    const result = calculateInstallBaseUrl(
+      "https://user:[email protected]/pyodide/pyodide-lock.json",
+    );
+    chai.assert.equal(result, "https://user:[email protected]/pyodide/");
+  });
+});