`Source.constructSource` passes wrong versionSpec to `NPMRegistrySource` in case of aliased package name

[xhalo32]

I was trying to node2nix the following node-packages.json but ran into an issue where node2nix tries to download NPM sources for the wrong package in the case of having specified both an npm: alias and semantic version range for the package.

Reproducing the issue

Node.js v20.12.2
node2nix 1.11.1 (commit 315e1b8)

My package.json contains the following dependencies:

  "dependencies": {
    "abcd": "npm:@codingame/monaco-vscode-api@ >= 1.69.0 < 1.70.0"
  }

And after running the following commands

$ npm i --lockfile-version 2
$ nix run nixpkgs#nodePackages.node2nix -- -i package-lock.json
fetching local directory: ./. from .
info attempt registry request try #1 at 4:19:52 PM
http request GET https://registry.npmjs.org/abcd
http 200 https://registry.npmjs.org/abcd
Cannot resolve version: abcd@>=1.69.0 <1.70.0

node2nix tries to download a package abcd which doesn't exist. I expected it to download @codingame/monaco-vscode-api instead.

Analysis

The issue seems to be caused by NPMRegistrySource receiving an already parsed versionSpec (which is missing the npm:... prefix) from Source.constructSource.

Replacing parsedVersionSpec with versionSpec on line 51 seems to resolve the issue.

Clearly, NPMRegistrySource is responsible for the parsing of the semantic versions so this is an obvious mistake in constructSource.

The output for a successful run:

$ nix run github:xhalo32/node2nix/fix-versionSpec -- -i package-lock.json
fetching local directory: ./. from .
info attempt registry request try #1 at 4:35:23 PM
http request GET https://registry.npmjs.org/@codingame%2Fmonaco-vscode-api
http 200 https://registry.npmjs.org/@codingame%2Fmonaco-vscode-api
info attempt registry request try #1 at 4:35:24 PM
http request GET https://registry.npmjs.org/monaco-editor
http 200 https://registry.npmjs.org/monaco-editor
info attempt registry request try #1 at 4:35:25 PM
http request GET https://registry.npmjs.org/vscode-textmate
http 200 https://registry.npmjs.org/vscode-textmate
info attempt registry request try #1 at 4:35:25 PM
http request GET https://registry.npmjs.org/vscode-oniguruma
http 200 https://registry.npmjs.org/vscode-oniguruma

Testing & PR

Adding a new line in tests.json:

  { "abcd": "npm:@codingame/monaco-vscode-api@ >= 1.69.0 < 1.70.0" }

leads to the tests failing as expected:

$ node ../bin/node2nix -i tests.json -o node-packages-v16.nix -c default-v16.nix -e ../nix/node-env.nix --nodejs-16 --no-copy-node-env
# ...
http 200 https://registry.npmjs.org/string_decoder
info attempt registry request try #1 at 4:55:20 PM
http request GET https://registry.npmjs.org/abcd
http 200 https://registry.npmjs.org/abcd
Cannot resolve version: abcd@>=1.69.0 <1.70.0

PR: #332