using alternative NPM registries does not seem to have effect

[countoren]

Some of the npm packages are from private repo the project that I am trying to package in nix had .npmrc that old the token it has the following shape:

@fortawesome:registry=https://npm.fontawesome.com/
//npm.fontawesome.com/:_authToken=XXXXXXXXXXXXXXXXXXXXXXX

I was generating the nix files with:

        node2nix -13 \
        --registry "https://registry.npmjs.org" \
        --registry "https://npm.fontawesome.com/" \
        --registry-auth-token "XXXXXXXXXXXXXXXXXXXXXXX" \
        --registry-scope "@fortawesome" \
        --development \
        --input package.json --lock package-lock.json \
        --node-env ./node-env.nix --composition ./default.nix \
        --output ./node-packages.nix

when nix build (default is wired to flake) on package getting the following error:

error: builder for '/nix/store/15r954j4n54k0v5i5nf6b2qsx0zihy5v-angular-fontawesome-0.5.0.tgz.drv' failed with exit code 1;
       last 7 log lines:
       >
       > trying https://npm.fontawesome.com/@fortawesome/angular-fontawesome/-/angular-fontawesome-0.5.0.tgz
       >   % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
       >                                  Dload  Upload   Total   Spent    Left  Speed
       >   0    49    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
       > curl: (22) The requested URL returned error: 401
       > error: cannot download angular-fontawesome-0.5.0.tgz from any mirror
       For full logs, run 'nix log /nix/store/15r954j4n54k0v5i5nf6b2qsx0zihy5v-angular-fontawesome-0.5.0.tgz.drv'.
error: 1 dependencies of derivation '/nix/store/bm4xs3dlp33hfhvzrx9gf2s1gllq19rz-webservers-0.0.0.drv' failed to build

Running directly with npm ci will build the project completly.

Any help. thanks.

[camelpunch]

I believe this is because node2nix will initially generate files for private repos, but the resulting derivations will not build, because they rely on nixpkgs' fetchurl, which has all sorts of problems with private repos. I have a disgusting hack for my use case.

See also:

• https://nixos.wiki/wiki/Enterprise (seems out of date)
• https://github.com/NixOS/nix/blob/master/src/libexpr/fetchurl.nix (some explanation about the different fetchers)
• https://github.com/NixOS/nix/blob/master/src/libexpr/fetchurl.nix (source for a built-in derivation based on a built-in function
• https://github.com/NixOS/nix/blob/master/src/libstore/builtins/fetchurl.cc (that built-in function)

In short: a massive rabbithole! I think it should be possible to patch node2nix to cope with private repos. I'm trying to figure out how to add a test for the private repo case, so it doesn't regress.