[lockfile-explorer] Rewrite lockfile parser to be more correct (#5363)

* Add edge case for projects with duplicate names

* Replace custom interfaces with official PNPM types; temporarily remove the V6 kludge

* Add lockfilePath.ts utility that can completely eliminate `@lifaon/path`

* Completed rewrite of 5.4 loader logic

* Remove "@lifaon/path" dependency

* Splite createLockfileEntry() into createProjectLockfileEntry() and createPackageLockfileEntry()

* Upgrade to use @pnpm/lockfile.types@1002.0.1

* Implement support for lockfile version 6.0

* Hide the "." package from Rush workspaces, shuffling the jsonId's in all the snapshots

* Fix an incorrect path

* rush change

* Improve formatting of 6.0 suffixes

* Move entry to nonbrowser-approved-packages.json

* Add a failing test case for "link:" in packages section

* PR feedback

* PR feedback: don't try to resolve "link:" under packages section

* rush update

Author: octogonz

apps/lockfile-explorer-web/src/packlets/lfx-shared/IJsonLfxWorkspace.ts

@@ -3,7 +3,7 @@
 
 export interface IJsonLfxWorkspaceRushConfig {
   /**
-   * The rushVersion from rush.json.
+   * The `rushVersion` field from rush.json.
    */
   readonly rushVersion: string;
 
@@ -16,19 +16,36 @@ export interface IJsonLfxWorkspaceRushConfig {
 
 export interface IJsonLfxWorkspace {
   /**
-   * Absolute path to the workspace folder that is opened by the app.
-   * Relative paths are generally relative to this path.
+   * Absolute path to the workspace folder that is opened by the app,  normalized to use forward slashes
+   * without a trailing slash.
+   *
+   * @example `"C:/path/to/MyRepo"`
    */
-  readonly workspaceRootFolder: string;
+  readonly workspaceRootFullPath: string;
 
   /**
-   * The path to the pnpm-lock.yaml file.
+   * The path to the "pnpm-lock.yaml" file, relative to `workspaceRootFullPath`
+   * and normalized to use forward slashes without a leading slash.
+   *
+   * @example `"common/temp/my-subspace/pnpm-lock.yaml"`
+   * @example `"pnpm-lock.yaml"`
    */
   readonly pnpmLockfilePath: string;
 
   /**
-   * If this is a Rush workspace (versus a plain PNPM workspace), then
-   * this section will be defined.
+   * The path to the folder of "pnpm-lock.yaml" file, relative to `workspaceRootFullPath`
+   * and normalized to use forward slashes without a leading slash.
+   *
+   * If `pnpm-lack.yaml` is in the `workspaceRootFullPath` folder, then pnpmLockfileFolder
+   * is the empty string.
+   *
+   * @example `"common/temp/my-subspace"`
+   * @example `""`
+   */
+  readonly pnpmLockfileFolder: string;
+
+  /**
+   * This section will be defined only if this is a Rush workspace (versus a plain PNPM workspace).
    */
   readonly rushConfig: IJsonLfxWorkspaceRushConfig | undefined;
 }

apps/lockfile-explorer/.vscode/launch.json

@@ -20,7 +20,7 @@
       "name": "Single Jest test",
       "program": "${workspaceFolder}/node_modules/@rushstack/heft/lib/start.js",
       "cwd": "${workspaceFolder}",
-      "args": ["--debug", "test", "--clean", "-u", "--test-path-pattern", "lfxGraphLoader60"],
+      "args": ["--debug", "test", "--clean", "-u", "--test-path-pattern", "lfxGraph-website-sample-1-v6.0.test"],
       "console": "integratedTerminal",
       "sourceMaps": true
     },

apps/lockfile-explorer/package.json

@@ -39,7 +39,7 @@
     "_phase:test": "heft run --only test -- --clean"
   },
   "peerDependencies": {
-    "@types/express": "^4.17.21"
+    "@types/express": "^5.0.3"
   },
   "peerDependenciesMeta": {
     "@types/express": {
@@ -55,12 +55,12 @@
     "@types/update-notifier": "~6.0.1",
     "eslint": "~9.25.1",
     "local-node-rig": "workspace:*",
-    "@pnpm/lockfile-types": "^5.1.5",
+    "@pnpm/lockfile.types": "1002.0.1",
+    "@pnpm/types": "1000.8.0",
     "@types/semver": "7.5.0"
   },
   "dependencies": {
     "tslib": "~2.8.1",
-    "@lifaon/path": "~2.1.0",
     "@microsoft/rush-lib": "workspace:*",
     "@pnpm/dependency-path-lockfile-pre-v9": "npm:@pnpm/dependency-path@~2.1.2",
     "@rushstack/node-core-library": "workspace:*",

apps/lockfile-explorer/src/cli/explorer/ExplorerCommandLineParser.ts

@@ -15,7 +15,6 @@ import {
   CommandLineParser,
   type IRequiredCommandLineStringParameter
 } from '@rushstack/ts-command-line';
-import type { Lockfile } from '@pnpm/lockfile-types';
 import {
   type LfxGraph,
   lfxGraphSerializer,
@@ -152,13 +151,9 @@ export class ExplorerCommandLineParser extends CommandLineParser {
 
     app.get('/api/graph', async (req: express.Request, res: express.Response) => {
       const pnpmLockfileText: string = await FileSystem.readFileAsync(appState.pnpmLockfileLocation);
-      const lockfile: Lockfile = yaml.load(pnpmLockfileText) as Lockfile;
+      const lockfile: unknown = yaml.load(pnpmLockfileText) as unknown;
 
-      const graph: LfxGraph = lfxGraphLoader.generateLockfileGraph(
-        appState.lfxWorkspace,
-        lockfile as lfxGraphLoader.ILockfilePackageType,
-        appState.lfxWorkspace.rushConfig?.subspaceName ?? ''
-      );
+      const graph: LfxGraph = lfxGraphLoader.generateLockfileGraph(lockfile, appState.lfxWorkspace);
 
       const jsonGraph: IJsonLfxGraph = lfxGraphSerializer.serializeToJson(graph);
       res.type('application/json').send(jsonGraph);

apps/lockfile-explorer/src/cli/lint/actions/CheckAction.ts

@@ -7,6 +7,8 @@ import { RushConfiguration, type RushConfigurationProject, type Subspace } from
 import path from 'path';
 import yaml from 'js-yaml';
 import semver from 'semver';
+import type * as lockfileTypes from '@pnpm/lockfile.types';
+import type * as pnpmTypes from '@pnpm/types';
 import { AlreadyReportedError, Async, FileSystem, JsonFile, JsonSchema } from '@rushstack/node-core-library';
 
 import lockfileLintSchema from '../../../schemas/lockfile-lint.schema.json';
@@ -17,7 +19,6 @@ import {
   parseDependencyPath,
   splicePackageWithVersion
 } from '../../../utils/shrinkwrap';
-import type { Lockfile, LockfileV6 } from '@pnpm/lockfile-types';
 
 export interface ILintRule {
   rule: 'restrict-versions';
@@ -40,7 +41,7 @@ export class CheckAction extends CommandLineAction {
 
   private _rushConfiguration!: RushConfiguration;
   private _checkedProjects: Set<RushConfigurationProject>;
-  private _docMap: Map<string, Lockfile | LockfileV6>;
+  private _docMap: Map<string, lockfileTypes.LockfileObject>;
 
   public constructor(parser: LintCommandLineParser) {
     super({
@@ -59,8 +60,8 @@ export class CheckAction extends CommandLineAction {
 
   private async _checkVersionCompatibilityAsync(
     shrinkwrapFileMajorVersion: number,
-    packages: Lockfile['packages'],
-    dependencyPath: string,
+    packages: lockfileTypes.PackageSnapshots | undefined,
+    dependencyPath: pnpmTypes.DepPath,
     requiredVersions: Record<string, string>,
     checkedDependencyPaths: Set<string>
   ): Promise<void> {
@@ -84,7 +85,7 @@ export class CheckAction extends CommandLineAction {
                 shrinkwrapFileMajorVersion,
                 dependencyPackageName,
                 dependencyPackageVersion
-              ),
+              ) as pnpmTypes.DepPath,
               requiredVersions,
               checkedDependencyPaths
             );
@@ -103,12 +104,12 @@ export class CheckAction extends CommandLineAction {
     const projectFolder: string = project.projectFolder;
     const subspace: Subspace = project.subspace;
     const shrinkwrapFilename: string = subspace.getCommittedShrinkwrapFilePath();
-    let doc: Lockfile | LockfileV6;
+    let doc: lockfileTypes.LockfileObject;
     if (this._docMap.has(shrinkwrapFilename)) {
       doc = this._docMap.get(shrinkwrapFilename)!;
     } else {
       const pnpmLockfileText: string = await FileSystem.readFileAsync(shrinkwrapFilename);
-      doc = yaml.load(pnpmLockfileText) as Lockfile | LockfileV6;
+      doc = yaml.load(pnpmLockfileText) as lockfileTypes.LockfileObject;
       this._docMap.set(shrinkwrapFilename, doc);
     }
     const { importers, lockfileVersion, packages } = doc;
@@ -120,7 +121,7 @@ export class CheckAction extends CommandLineAction {
         if (path.resolve(projectFolder, relativePath) === projectFolder) {
           const dependenciesEntries: [string, unknown][] = Object.entries(dependencies ?? {});
           for (const [dependencyName, dependencyValue] of dependenciesEntries) {
-            const fullDependencyPath: string = splicePackageWithVersion(
+            const fullDependencyPath: pnpmTypes.DepPath = splicePackageWithVersion(
               shrinkwrapFileMajorVersion,
               dependencyName,
               typeof dependencyValue === 'string'
@@ -131,7 +132,7 @@ export class CheckAction extends CommandLineAction {
                       specifier: string;
                     }
                   ).version
-            );
+            ) as pnpmTypes.DepPath;
             if (fullDependencyPath.includes('link:')) {
               const dependencyProject: RushConfigurationProject | undefined =
                 this._rushConfiguration.getProjectByName(dependencyName);