feat(conf): validate importers in lockfile

commit_hash:fbb82972273665ff4bb1be1b739a737f86d4899a

2 files changed, 25 insertions, 2 deletions

diff --git a/build/plugins/lib/nots/package_manager/pnpm/lockfile.py b/build/plugins/lib/nots/package_manager/pnpm/lockfile.py
index f4fac51bbe5..b1e8fc07069 100644
--- a/build/plugins/lib/nots/package_manager/pnpm/lockfile.py
+++ b/build/plugins/lib/nots/package_manager/pnpm/lockfile.py
@@ -10,6 +10,7 @@ from ..base import PackageJson, BaseLockfile, LockfilePackageMeta, LockfilePacka
 
 LOCKFILE_VERSION = "lockfileVersion"
 IMPORTER_KEYS = PackageJson.DEP_KEYS + ("specifiers",)
+WS_PREFIX = "workspace:"
 
 
 class PnpmLockfileHelper:
@@ -267,6 +268,25 @@ class PnpmLockfile(BaseLockfile):
 
         return {".": importer} if importer else {}
 
+    def validate_importers(self):
+        importers = self.get_importers()
+        pkg = importers.get(".")
+        peers = set(["."])
+        problem_importers = []
+
+        for _, deps in pkg.items():
+            for _, dep in deps.items():
+                specifier = dep.get("specifier")
+                if specifier and specifier.startswith(WS_PREFIX):
+                    peers.add(specifier[len(WS_PREFIX) :])
+
+        for importer in self.get_importers().keys():
+            if importer not in peers:
+                problem_importers.append(importer)
+
+        if problem_importers:
+            raise Exception(f"Invalid importers in lockfile: {", ".join(problem_importers)}")
+
     def merge(self, lf):
         """
         Merges two lockfiles:
diff --git a/build/plugins/nots.py b/build/plugins/nots.py
index 9d67685c485..911f10f65a2 100644
--- a/build/plugins/nots.py
+++ b/build/plugins/nots.py
@@ -802,6 +802,11 @@ def on_node_modules_configure(unit: NotsUnitType) -> None:
         if not unit.get("TS_TEST_FOR"):
             __set_append(unit, "_NODE_MODULES_INOUTS", _build_directives(["hide", "output"], sorted(outs)))
 
+        lf = pm.load_lockfile_from_dir(pm.sources_path)
+
+        if hasattr(lf, "validate_importers"):
+            lf.validate_importers()
+
         if pj.get_use_prebuilder():
             unit.on_peerdir_ts_resource("@yatool/prebuilder")
             unit.set(
@@ -817,7 +822,6 @@ def on_node_modules_configure(unit: NotsUnitType) -> None:
 
             if prebuilder_major == "0":
                 # TODO: FBP-1408
-                lf = pm.load_lockfile_from_dir(pm.sources_path)
                 is_valid, invalid_keys = lf.validate_has_addons_flags()
 
                 if not is_valid:
@@ -831,7 +835,6 @@ def on_node_modules_configure(unit: NotsUnitType) -> None:
                         + "\n  - ".join(invalid_keys)
                     )
             else:
-                lf = pm.load_lockfile_from_dir(pm.sources_path)
                 requires_build_packages = lf.get_requires_build_packages()
                 is_valid, validation_messages = pj.validate_prebuilds(requires_build_packages)