fix: improve snippet lookup with fallback for aliased/pre-resolved specifiers

danielroe · danielroe · commit 03113e4547d6 · 2026-03-05T19:56:13.000Z
diff --git a/src/index.ts b/src/index.ts
@@ -290,15 +290,29 @@ function enrichAndReport(
   // Build trace
   const trace = buildTrace(importer, moduleGraph, resolvedImports, entries, maxTraceDepth, cwd)
 
-  // Build snippet &mdash; try multiple key forms for the importer since resolveId
-  // and transform may use different path formats (relative vs absolute, with/without query)
+  // Build snippet from the module graph (entries are stored under normalized key forms in transform)
   let snippet: ImpoundSnippet | undefined
-  const importerBare = importer.split('?')[0]!
-  const importerAbs = cwd && !isAbsolute(importer) ? join(cwd, importer) : importer
-  const importerAbsBare = importerAbs.split('?')[0]!
-  const importerEntry = moduleGraph.get(importer) || moduleGraph.get(importerBare) || moduleGraph.get(importerAbs) || moduleGraph.get(importerAbsBare)
+  /* v8 ignore start -- always defined: enrichAndReport is only called when the importer is in the module graph */
+  const importerEntry = moduleGraph.get(importer)
   if (importerEntry) {
-    const loc = importerEntry.imports.get(rawId)
+  /* v8 ignore stop */
+    // Try exact rawId first, then fall back to searching for a matching specifier.
+    // rawId may differ from the source specifier when bundlers pre-resolve imports.
+    let loc = importerEntry.imports.get(rawId)
+    if (!loc) {
+      const importerBase = importer.split('?')[0]!
+      for (const [specifier, specLoc] of importerEntry.imports) {
+        const resolved = RELATIVE_IMPORT_RE.test(specifier) ? join(importerBase, '..', specifier) : specifier
+        let normalizedResolved = resolved
+        if (cwd && isAbsolute(resolved)) {
+          normalizedResolved = relative(cwd, resolved)
+        }
+        if (normalizedResolved === id || resolved === rawId || specifier.endsWith(id)) {
+          loc = specLoc
+          break
+        }
+      }
+    }
     if (loc) {
       const text = generateSnippet(importerEntry.code, loc.line, loc.column)
       snippet = { text, line: loc.line, column: loc.column }
@@ -492,7 +506,22 @@ export const ImpoundPlugin = createUnplugin((globalOptions: ImpoundOptions) => {
               })
             }
           }
-          moduleGraph.set(id, { code, imports: importMap })
+          const graphEntry = { code, imports: importMap }
+          moduleGraph.set(id, graphEntry)
+          // Also store under normalized key forms so enrichAndReport can find it
+          // when the importer path format differs (e.g. with/without query string)
+          /* v8 ignore start -- defensive normalization for framework-specific virtual module IDs */
+          const bareId = id.split('?')[0]!
+          if (bareId !== id)
+            moduleGraph.set(bareId, graphEntry)
+          if (isAbsolute(id) && globalOptions.cwd) {
+            const relId = relative(globalOptions.cwd, id)
+            moduleGraph.set(relId, graphEntry)
+            const relBareId = relId.split('?')[0]!
+            if (relBareId !== relId)
+              moduleGraph.set(relBareId, graphEntry)
+          }
+          /* v8 ignore stop */
         }
         catch {
           // If parsing fails (e.g. non-JS asset), just skip
diff --git a/test/index.test.ts b/test/index.test.ts
@@ -506,6 +506,91 @@ describe('trace mode (deferred violations)', () => {
     expect(result.message).toContain('entry.js')
   })
 
+  it('finds snippet via fallback when rawId differs from source specifier', async () => {
+    // Simulates frameworks like Nuxt where alias resolution rewrites import specifiers
+    // before resolveId sees them (e.g. ../server/api/test &rarr; ~~/server/api/test)
+    const plugins = ImpoundPlugin.rollup({ trace: true, cwd: '/root', patterns: [[/server\/api/, 'Not allowed']] })
+    const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
+    const impoundPlugin = pluginArray.find(p => p.name === 'impound')!
+    const tracePlugin = pluginArray.find(p => p.name === 'impound:trace')!
+
+    const errors: string[] = []
+    const context = { error: (msg: string) => errors.push(msg) }
+
+    // Transform with source code using a relative specifier
+    await (tracePlugin as any).transform('import api from "../server/api/test";\nconsole.log(api)', '/root/app/app.vue')
+
+    // But resolveId receives an absolute pre-resolved path (as if a bundler alias resolved it)
+    // rawId will be the absolute path, not the relative specifier from source
+    await (impoundPlugin as any).resolveId.call(context, '/root/server/api/test', '/root/app/app.vue')
+
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('Not allowed')
+    // Fallback search should find the snippet by resolving '../server/api/test' relative to importer
+    expect(errors[0]).toContain('Code:')
+    expect(errors[0]).toContain('import api from "../server/api/test"')
+    expect(errors[0]).toContain('^')
+  })
+
+  it('handles fallback when no specifier matches the resolved id', async () => {
+    // The fallback loop runs but no specifier matches &mdash; snippet remains undefined
+    const plugins = ImpoundPlugin.rollup({ trace: true, patterns: [[/secret/, 'Not allowed']] })
+    const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
+    const impoundPlugin = pluginArray.find(p => p.name === 'impound')!
+    const tracePlugin = pluginArray.find(p => p.name === 'impound:trace')!
+
+    const errors: string[] = []
+    const context = { error: (msg: string) => errors.push(msg) }
+
+    // Transform with an import that doesn't match the resolved id at all
+    await (tracePlugin as any).transform('import foo from "unrelated-module";\nexport default foo', 'middle.js')
+    // resolveId with a completely different id
+    await (impoundPlugin as any).resolveId.call(context, 'secret', 'middle.js')
+
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('Not allowed')
+    // No Code: since no specifier in the fallback matched
+    expect(errors[0]).not.toContain('Code:')
+  })
+
+  it('finds snippet via fallback without cwd', async () => {
+    // Exercises the fallback path where cwd is undefined
+    const plugins = ImpoundPlugin.rollup({ trace: true, patterns: [[/server\/api/, 'Not allowed']] })
+    const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
+    const impoundPlugin = pluginArray.find(p => p.name === 'impound')!
+    const tracePlugin = pluginArray.find(p => p.name === 'impound:trace')!
+
+    const errors: string[] = []
+    const context = { error: (msg: string) => errors.push(msg) }
+
+    await (tracePlugin as any).transform('import api from "~~/server/api/test";\nconsole.log(api)', 'app.vue')
+    await (impoundPlugin as any).resolveId.call(context, 'server/api/test', 'app.vue')
+
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('Code:')
+  })
+
+  it('finds snippet via suffix match when specifier uses aliases', async () => {
+    // When the source has an alias like ~~/server/api/test and the resolved id is server/api/test
+    const plugins = ImpoundPlugin.rollup({ trace: true, patterns: [[/server\/api/, 'Not allowed']] })
+    const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
+    const impoundPlugin = pluginArray.find(p => p.name === 'impound')!
+    const tracePlugin = pluginArray.find(p => p.name === 'impound:trace')!
+
+    const errors: string[] = []
+    const context = { error: (msg: string) => errors.push(msg) }
+
+    // Transform with aliased import
+    await (tracePlugin as any).transform('import api from "~~/server/api/test";\nconsole.log(api)', 'app.vue')
+
+    // resolveId receives the resolved form (without alias)
+    await (impoundPlugin as any).resolveId.call(context, 'server/api/test', 'app.vue')
+
+    expect(errors).toHaveLength(1)
+    expect(errors[0]).toContain('Code:')
+    expect(errors[0]).toContain('~~/server/api/test')
+  })
+
   it('handles dynamic imports with non-literal specifiers in transform', async () => {
     const plugins = ImpoundPlugin.rollup({ trace: true, patterns: [['secret']] })
     const pluginArray = Array.isArray(plugins) ? plugins : [plugins]
