fix: respect user opt-out when adding overrides (#24123)

Adjust the checks for user opt-out in package.json overrides, so that an
existing override for new entries added by Vaadin is considered as an
opt-out, so that the existing user value is kept. This behavior
satisfies the previously existing
`NodeUpdatePackagesNpmVersionLockingTest.shouldNotUpdatesOverrides_whenHasUserModification`
test.

Author: platosha

flow-server/src/main/java/com/vaadin/flow/server/frontend/TaskUpdatePackages.java

@@ -189,25 +189,31 @@ boolean lockVersionForNpm(ObjectNode packageJson) throws IOException {
                 // Override value didn't change, skipping.
                 continue;
             }
+            final JsonNode lastUserValue;
+            final List<String> keyPath = List
+                    .of(entryToUpdate.getKey().split(">"));
+            if (enablePnpm) {
+                lastUserValue = overridesSection.get(entryToUpdate.getKey());
+            } else {
+                lastUserValue = JacksonUtils.getNestedKey(overridesSection,
+                        keyPath);
+            }
+            boolean optOut = !Objects.equals(StringNode.valueOf(lastValue),
+                    lastUserValue);
+            if (optOut) {
+                // Actual override value is different from last Vaadin override:
+                // assume user opt-out and skip.
+                continue;
+            }
             versionLockingUpdated = true;
             if (enablePnpm) {
                 // Use flat format for pnpm
                 overridesSection.put(entryToUpdate.getKey(),
                         entryToUpdate.getValue());
-                continue;
-            }
-            // Handle possibly nested overrides object
-            final List<String> keyPath = List
-                    .of(entryToUpdate.getKey().split(">"));
-            final JsonNode lastValueNode = StringNode.valueOf(lastValue);
-            if (lastValueNode != null && !lastValueNode.equals(
-                    JacksonUtils.getNestedKey(overridesSection, keyPath))) {
-                // Actual override value is different from last Vaadin override:
-                // assume opt-out and skip.
-                continue;
+            } else {
+                putNestedOverride(overridesSection, keyPath,
+                        entryToUpdate.getValue());
             }
-            putNestedOverride(overridesSection, keyPath,
-                    entryToUpdate.getValue());
         }
         for (final Map.Entry<String, String> entryToRemove : flatLastVaadinOverrides
                 .entrySet()) {

flow-server/src/test/java/com/vaadin/flow/server/frontend/NodeUpdatePackagesNpmVersionLockingTest.java

@@ -194,7 +194,7 @@ public void shouldHandleNestedObjectOverrides_withoutError()
         packageUpdater.lockVersionForNpm(packageJson);
 
         // Verify flat override stays flat
-        JsonNode overrides = packageJson.get(PNPM).get(OVERRIDES);
+        JsonNode overrides = packageJson.get(OVERRIDES);
         assertTrue("Flat override should remain unchanged",
                 overrides.has("flat-dep"));
         assertEquals("3.0.0", overrides.get("flat-dep").stringValue());

flow-server/src/test/java/com/vaadin/flow/server/frontend/TaskUpdatePackagesNpmTest.java

@@ -41,6 +41,7 @@
 import org.slf4j.LoggerFactory;
 import tools.jackson.databind.JsonNode;
 import tools.jackson.databind.node.ObjectNode;
+import tools.jackson.databind.node.StringNode;
 
 import com.vaadin.flow.internal.JacksonUtils;
 import com.vaadin.flow.server.Constants;
@@ -238,6 +239,11 @@ public void overridesContainPinnedVersion_platformVersionUpdatedToNewerWhileDepe
         ObjectNode packageJson = getOrCreatePackageJson();
         packageJson.set(OVERRIDES, JacksonUtils.createObjectNode());
         ((ObjectNode) packageJson.get(OVERRIDES)).put("@vaadin/aura", "1.0");
+        // Assuming Vaadin added the override, set Vaadin overrides accordingly
+        JacksonUtils.setNestedKey(packageJson,
+                List.of(VAADIN_DEP_KEY, OVERRIDES, "@vaadin/aura"),
+                StringNode.valueOf("1.0"),
+                (nonObjectNode) -> JacksonUtils.createObjectNode());
 
         FileUtils.writeStringToFile(new File(npmFolder, PACKAGE_JSON),
                 packageJson.toPrettyString(), StandardCharsets.UTF_8);