Make the lockfile work

Author: dsherret

Cargo.lock

@@ -17,6 +17,7 @@ deno_cache_dir = "0.44.0"
 deno_config = "0.102.0"
 deno_error = { version = "0.7.1", features = ["serde", "serde_json", "url"] }
 deno_graph = { version = "0.109.0", features = ["swc"], default-features = false }
+deno_lockfile = "0.54.0"
 deno_path_util = "0.6.4"
 deno_resolver = { version = "0.83.0", features = ["graph"] }
 serde_json = { version = "1.0.140", features = ["preserve_order"] }

Cargo.toml

@@ -20,6 +20,7 @@ deno_cache_dir.workspace = true
 deno_config.workspace = true
 deno_error.workspace = true
 deno_graph.workspace = true
+deno_lockfile.workspace = true
 deno_path_util.workspace = true
 deno_resolver.workspace = true
 deno_semver = "=0.10.0"

rs-lib/Cargo.toml

@@ -40,6 +40,9 @@ pub struct ModuleGraphOptions<'a, TSys: WorkspaceFactorySys> {
   pub compiler_options_resolver: Rc<CompilerOptionsResolver>,
   pub cjs_tracker:
     Rc<deno_resolver::cjs::CjsTracker<DenoInNpmPackageChecker, TSys>>,
+  /// The project's deno lockfile, used to lock module versions and verify
+  /// remote module checksums while building the graph.
+  pub maybe_lockfile: Option<deno_resolver::lockfile::LockfileLockRc<TSys>>,
 }
 
 /// Wrapper around deno_graph::ModuleGraph.
@@ -67,6 +70,15 @@ impl ModuleGraph {
     let capturing_analyzer =
       CapturingModuleAnalyzer::new(Some(Box::new(source_parser)), None);
     let mut graph = deno_graph::ModuleGraph::new(deno_graph::GraphKind::All);
+    // seed the graph with the locked module versions and redirects so the
+    // same versions Deno resolved for the project are used
+    if let Some(lockfile) = &options.maybe_lockfile {
+      lockfile.fill_graph(&mut graph);
+    }
+    let mut locker = options
+      .maybe_lockfile
+      .as_ref()
+      .map(|lockfile| lockfile.as_deno_graph_locker());
     let graph_resolver = resolver.as_graph_resolver(
       &options.cjs_tracker,
       &scoped_jsx_import_source_config,
@@ -87,7 +99,9 @@ impl ModuleGraph {
           is_dynamic: false,
           skip_dynamic_deps: false,
           resolver: Some(&graph_resolver),
-          locker: None,
+          locker: locker
+            .as_mut()
+            .map(|l| l as &mut dyn deno_graph::source::Locker),
           module_analyzer: &capturing_analyzer,
           module_info_cacher: &NullModuleInfoCacher,
           reporter: None,

rs-lib/src/graph.rs

@@ -409,6 +409,11 @@ pub async fn transform(
   );
   let deno_resolver = resolver_factory.deno_resolver().await?;
   let cjs_tracker = resolver_factory.cjs_tracker()?.clone();
+  let maybe_lockfile = resolver_factory
+    .workspace_factory()
+    .maybe_lockfile(&NullNpmPackageInfoProvider)
+    .await?
+    .cloned();
 
   let loader = Rc::new(DenoGraphLoader::new(
     Rc::new(file_fetcher),
@@ -452,6 +457,7 @@ pub async fn transform(
         .compiler_options_resolver()?
         .clone(),
       cjs_tracker,
+      maybe_lockfile,
     })
     .await?;
 
@@ -647,6 +653,27 @@ pub async fn transform(
   })
 }
 
+/// Provides npm package info when reading the lockfile.
+///
+/// dnt resolves npm specifiers via the specifier mappers rather than through
+/// the module graph, and never writes the lockfile back, so the only time this
+/// is consulted is when an older lockfile is migrated to the latest version in
+/// memory. Returning default info for each requested package is sufficient.
+struct NullNpmPackageInfoProvider;
+
+#[async_trait::async_trait(?Send)]
+impl deno_lockfile::NpmPackageInfoProvider for NullNpmPackageInfoProvider {
+  async fn get_npm_package_info(
+    &self,
+    values: &[deno_semver::package::PackageNv],
+  ) -> Result<
+    Vec<deno_lockfile::Lockfile5NpmInfo>,
+    Box<dyn std::error::Error + Send + Sync>,
+  > {
+    Ok(vec![Default::default(); values.len()])
+  }
+}
+
 fn add_shim_types_packages_to_test_environment<'a>(
   test_output_env: &mut TransformOutputEnvironment,
   all_shims: impl Iterator<Item = &'a Shim>,

rs-lib/src/lib.rs

@@ -2147,6 +2147,77 @@ async fn npm_specifier() {
   );
 }
 
+#[tokio::test]
+async fn transform_uses_lockfile_remote_checksum() {
+  // a deno.lock with a non-matching remote checksum should cause an
+  // integrity error, proving the lockfile is being used
+  let result = TestBuilder::new()
+    .with_loader(|loader| {
+      loader
+        .add_local_file("/deno.json", "{}")
+        .add_local_file(
+          "/deno.lock",
+          concat!(
+            "{\n",
+            "  \"version\": \"5\",\n",
+            "  \"remote\": {\n",
+            "    \"https://localhost/mod.ts\": \"0000000000000000000000000000000000000000000000000000000000000000\"\n",
+            "  }\n",
+            "}\n"
+          ),
+        )
+        .add_local_file("/mod.ts", "import 'https://localhost/mod.ts';")
+        .add_remote_file("https://localhost/mod.ts", "console.log(1);");
+    })
+    .transform()
+    .await
+    .err()
+    .unwrap();
+
+  assert!(
+    result
+      .to_string()
+      .to_lowercase()
+      .contains("integrity check failed"),
+    "unexpected error: {:#}",
+    result
+  );
+}
+
+#[tokio::test]
+async fn transform_uses_lockfile_matching_remote_checksum() {
+  // a deno.lock with a matching remote checksum should transform successfully
+  let result = TestBuilder::new()
+    .with_loader(|loader| {
+      loader
+        .add_local_file("/deno.json", "{}")
+        .add_local_file(
+          "/deno.lock",
+          concat!(
+            "{\n",
+            "  \"version\": \"5\",\n",
+            "  \"remote\": {\n",
+            "    \"https://localhost/mod.ts\": \"35c146f76e129477c64061bc84511e1090f3d4d8059713e6663dd4b35b1f7642\"\n",
+            "  }\n",
+            "}\n"
+          ),
+        )
+        .add_local_file("/mod.ts", "import 'https://localhost/mod.ts';")
+        .add_remote_file("https://localhost/mod.ts", "console.log(1);");
+    })
+    .transform()
+    .await
+    .unwrap();
+
+  assert_files!(
+    result.main.files,
+    &[
+      ("mod.ts", "import './deps/localhost/mod.js';"),
+      ("deps/localhost/mod.ts", "console.log(1);"),
+    ]
+  );
+}
+
 fn get_shim_file_text(mut text: String) -> String {
   text.push('\n');
   text.push_str(