[Bug]: optionalDependencies improperly linked when using custom registry

[jhines-ocient]

What happened?

A previously working setup of rules_js began to fail to find dependencies after moving to an internal npm registry. The expected behavior is that rules_js should work regardless of the npm registry (assuming that the registry provides the packages as expected).

rules_js was setup and integrated into our project, pulling in npm dependencies from our pnpm-lock.yaml and building js_binaries without issue. Upon attempting to point rules_js at an internal npm registry, previously successful builds began failing with error messages like:

//:.aspect_rules_js/node_modules/paseto3@registry.npmjs.org+paseto@3.1.4/ref' does not exist

This is an optionalDependency of an npm dependency we pull in, oidc-provider@7.14.3.

We verified that the registry was behaving as expected outside of bazel and that the pnpm-lock.yaml appears to be valid.

Version

Development (host) and target OS/architectures: Linux 5.4.0-131-generic x86_64 GNU/Linux

Output of bazel --version: 6.4.0

Version of the Aspect rules, or other relevant rules from your
WORKSPACE or MODULE.bazel file:

http_archive(
    name = "aspect_rules_js",
    sha256 = "76a04ef2120ee00231d85d1ff012ede23963733339ad8db81f590791a031f643",
    strip_prefix = "rules_js-1.34.1",
    url = "https://github.com/aspect-build/rules_js/releases/download/v1.34.1/rules_js-v1.34.1.tar.gz",
)

http_archive(
    name = "rules_nodejs",
    sha256 = "5ad078287b5f3069735652e1fc933cb2e2189b15d2c9fc826c889dc466c32a07",
    strip_prefix = "rules_nodejs-6.0.1",
    url = "https://github.com/bazelbuild/rules_nodejs/releases/download/v6.0.1/rules_nodejs-v6.0.1.tar.gz",
)

node_repositories(
    name = "nodejs_linux_amd64",
    node_version = "16.20.2",
    platform = "linux_amd64",
)

bazel run @pnpm//:pnpm -- --version: 8.10.2

Language(s) and/or frameworks involved: Javascript

How to reproduce

I've created a minimal reproduction with steps for reproducing this issue in the README: optional-dependency-repro.tar.gz. All that should be needed outside of the contents of this tar is version 6.4.0 of bazel.

Any other information?

Example problem output

$ bazel run :binary
ERROR: /home/jhines/repos/optional-dependency-repro/BUILD.bazel:4:22: in deps attribute of npm_package_store_internal rule //:.aspect_rules_js/node_modules/oidc-provider@registry.npmjs.org+oidc-provider@7.14.3/pkg: target '//:.aspect_rules_js/node_modules/paseto3@registry.npmjs.org+paseto@3.1.4/ref' does not exist. Since this rule was created by the macro 'npm_link_all_packages', the error might have been caused by the macro implementation
ERROR: /home/jhines/repos/optional-dependency-repro/BUILD.bazel:4:22: Analysis of target '//:.aspect_rules_js/node_modules/oidc-provider@registry.npmjs.org+oidc-provider@7.14.3/pkg' failed
ERROR: Analysis of target '//:binary' failed; build aborted:
INFO: Elapsed time: 1.700s
INFO: 0 processes.
ERROR: Build failed. Not running target
FAILED: Build did NOT complete successfully (105 packages loaded, 511 targets configured)
    Fetching repository @npm__at_types_node__registry.npmjs.org_at_types_node_18.11.18; starting

Expected output

$ bazel run :binary
INFO: Analyzed target //:binary (112 packages loaded, 705 targets configured).
INFO: Found 1 target...
Target //:binary up-to-date:
  bazel-bin/binary.sh
INFO: Elapsed time: 2.379s, Critical Path: 0.90s
INFO: 258 processes: 140 internal, 118 local.
INFO: Build completed successfully, 258 total actions
INFO: Running command line: bazel-bin/binary.sh
A Javascript Binary!

Notes

Without the registry set, these dependencies are written by pnpm like paseto3: /paseto@3.1.4. When the registry is set, the dependency is written like paseto3: path.to.npm.registry.com/paseto@3.1.4. There are several places in the code that check if the version starts with a /, which seem to handle the default case but fail to catch this case. It appears that missing these branches may be leading to the issue we see here.

rules_js-1.34.1/npm/private/transitive_closure.bzl
32:            elif version.startswith("/"):
52:    if package_path.startswith("/"):

rules_js-1.34.1/npm/private/npm_translate_lock_generate.bzl
158:                elif raw_version.startswith("/"):
222:                        elif raw_version.startswith("/"):

rules_js-1.34.1/npm/private/npm_translate_lock_helpers.bzl
222:            elif dep_version.startswith("/"):

rules_js-1.34.1/npm/private/npm_import.bzl
634:            if dep_version.startswith("/"):
661:                    if dep_version.startswith("/"):
692:                if dep_version.startswith("/"):

rules_js-1.34.1/npm/private/utils.bzl
84:    elif package_name.startswith("/"):