404 on private repo

[mikehardy]

This is sort of a duplicate of #70 but that was closed due to inactivity. I have more data that might help.

patch-package fails to generate a patch when you use a private package, even though the entry is available for normal non-interactive use by npm install.

An example would be the react-native-background-geolocation-android package which requires a license then you are added to a private github repository, and then you can set up a token to do installs.

Here's what happens:

(virtualenv) mike@kunashir:~/work/Kullki/kscoreapp-rxp (master) % npx patch-package react-native-background-geolocation-android
patch-package 6.0.7
• Creating temporary folder
• Installing react-native-background-geolocation-android@3.0.0-beta.4 with npm
• Diffing your files with clean files
{ Error: ENOENT: no such file or directory, scandir '/var/folders/hx/f496r_555tq4zk47cm3yyjbc0000gn/T/tmp-468412kP3RdowuGqu/node_modules/react-native-background-geolocation-android'
    at Object.readdirSync (fs.js:806:3)
    at Object.klawSync [as default] (/Users/mike/work/Kullki/kscoreapp-rxp/node_modules/klaw-sync/klaw-sync.js:13:25)
    at Object.removeIgnoredFiles (/Users/mike/work/Kullki/kscoreapp-rxp/node_modules/patch-package/dist/filterFiles.js:10:24)
    at Object.makePatch (/Users/mike/work/Kullki/kscoreapp-rxp/node_modules/patch-package/dist/makePatch.js:87:23)
    at /Users/mike/work/Kullki/kscoreapp-rxp/node_modules/patch-package/dist/index.js:48:25
    at Array.forEach (<anonymous>)
    at Object.<anonymous> (/Users/mike/work/Kullki/kscoreapp-rxp/node_modules/patch-package/dist/index.js:47:22)
    at Module._compile (internal/modules/cjs/loader.js:799:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:810:10)
    at Module.load (internal/modules/cjs/loader.js:666:32)
  errno: -2,
  syscall: 'scandir',
  code: 'ENOENT',
  path:
   '/var/folders/hx/f496r_555tq4zk47cm3yyjbc0000gn/T/tmp-468412kP3RdowuGqu/node_modules/react-native-background-geolocation-android' }
ENOENT: no such file or directory, scandir '/var/folders/hx/f496r_555tq4zk47cm3yyjbc0000gn/T/tmp-468412kP3RdowuGqu/node_modules/react-native-background-geolocation-android'
(virtualenv) mike@kunashir:~/work/Kullki/kscoreapp-rxp (master) % cat package.json |grep react-native-background-geolocation-android
    "react-native-background-geolocation-android": "git+https://**OATH_TOKEN_DELETED_FOR_THIS_EXAMPLE***:x-oauth-basic@github.com/transistorsoft/react-native-background-geolocation-android.git#3.0.0-beta.4",

Here's the line from the dependencies in package.json

(virtualenv) mike@kunashir:~/work/Kullki/kscoreapp-rxp (master) % cat package.json |grep react-native-background-geolocation-android
    "react-native-background-geolocation-android": "git+https://***OATH_TOKEN_DELETED**:x-oauth-basic@github.com/transistorsoft/react-native-background-geolocation-android.git#3.0.0-beta.4",

So it seems like patch-package should take the current dependency, not just blindly npm install the name given to it assuming it's on the public registry

It isn't easy to make npm cough up the actual install url but this is one way:

(virtualenv) mike@kunashir:~/work/Kullki/kscoreapp-rxp (master) % npm list --depth=0|grep geolocation
├── react-native-background-geolocation-android@3.0.0-beta.4 (git+https://***OATH_TOKEN_DELETED**:x-oauth-basic@github.com/transistorsoft/react-native-background-geolocation-android.git#418e1f3c31690af2efd6b9904a6b0462cb87188c)

I am able to access it programmatically like so:

(virtualenv) mike@kunashir:~/work/Kullki/kscoreapp-rxp (master) % node -p "require('./package.json').dependencies[\"react-native-background-geolocation-android\"]"
git+https://**OATH_TOKEN_DELETED**:x-oauth-basic@github.com/transistorsoft/react-native-background-geolocation-android.git#3.0.0-beta.4

And it does show up as the 'from' property inside getPackageResolution's npm chunk if I print it out like so:

        console.info(relevantStackEntry.dependencies[packageDetails.name]);

Finally, if I brutally hack at the dist/ javascript to force it to print a package.json like so:

fs_extra_1.writeFileSync(tmpRepoPackageJsonPath, '{ "dependencies": { "react-native-background-geolocation-android": "git+https://**OATH_TOKEN_DELETED**:x-oauth-basic@github.com/transistorsoft/react-native-background-geolocation-android.git#3.0.0-beta.4" }}');

It correctly generates a patch and will correctly apply it as well

I'm not involved in this package so I'm not sure where you'd want to actually pick up the installed version and plumb it through, but it seems like this shouldn't be too difficult a change

[mikehardy]

quick thought - it may be that there are assumptions around the '@' parsing as I saw that in the code in a couple places - the '@' is sometimes part of a valid HTTP URI and not anything to do with an npmjs organization...

[ds300]

Hi! 👋 Thanks for the detailed report! I'll take a look at this asap. patch-package should be using the resolution from the lock file, but maybe there's some issue with these basic auth urls.

[mikehardy]

Awesome. Sorry I couldn't just propose a PR. I ❤️ patch-package, made my CI builds work again without needing to maintain forks for a solid number of upstream bugs that hadn't released fixes yet. This was my first issue with it :-)