Okay, so I haven't solved it. I'm using the file

{ lib
, fetchFromGitHub
, stdenvNoCC
, php83
, nixosTests
, dataDir ? "/var/lib/firefly-iii"
}:

let
  pname = "firefly-iii";
  version = "6.1.18";
  phpPackage = php83;

  src = fetchFromGitHub {
    owner = "firefly-iii";
    repo = "firefly-iii";
    rev = "v${version}";
    hash = "sha256-mA7gvKhHouUUz1Aix7253O/+VcufoEFwdcJeZxnazEo=";
  };
in

stdenvNoCC.mkDerivation (finalAttrs: {
  inherit pname src version;

  buildInputs = [ phpPackage ];

  nativeBuildInputs = [
    phpPackage.packages.composer
    phpPackage.composerHooks.composerInstallHook
  ];

  composerRepository = phpPackage.mkComposerRepository {
    inherit (finalAttrs) src pname version;
    composerNoDev = true;
    composerNoPlugins = true;
    composerNoScripts = true;
    composerStrictValidation = true;
    # composerLock = null;
    vendorHash = "sha256-EpMypgj6lZDz6T94bGoCUH9IVwh7VB4Ds08AcCsreRw=";
  };

  passthru = {
    inherit phpPackage;
    tests = nixosTests.firefly-iii;
  };
    # cp -a ${assets} $out/public

  postInstall = ''
    mv $out/share/php/${pname}/* $out/
    rm -R $out/share $out/storage $out/bootstrap/cache $out/public
    ln -s ${dataDir}/storage $out/storage
    ln -s ${dataDir}/cache $out/bootstrap/cache
  '';

  meta = {
    changelog = "https://github.com/firefly-iii/firefly-iii/releases/tag/v${version}";
    description = "Firefly III: a personal finances manager";
    homepage = "https://github.com/firefly-iii/firefly-iii";
    license = lib.licenses.agpl3Only;
    maintainers = [ lib.maintainers.savyajha ];
  };
})

When I do that I get this:

Executing composerInstallBuildHook
Setting COMPOSER_ROOT_VERSION to 6.1.18
New "composer.lock" has been successfully created in /nix/store/nh1p9v51farsza0cq1vpdgqxfs6qkx3d-firefly-iii-6.1.18-composer-repository
Finished composerInstallBuildHook
no Makefile or custom buildPhase, doing nothing
@nix { "action": "setPhase", "phase": "installPhase" }
Running phase: installPhase
Executing composerInstallInstallHook
Setting COMPOSER_ROOT_VERSION to 6.1.18
Installing dependencies from lock file (including require-dev)
Verifying lock file contents can be installed on current platform.
Package operations: 178 installs, 0 updates, 0 removals
    Failed to download phpstan/phpstan from dist: Source path "/nix/store/nh1p9v51farsza0cq1vpdgqxfs6qkx3d-firefly-iii-6.1.18-composer-repository/>
    Now trying to download from source
  - Syncing phpstan/phpstan (1.11.5) into cache

In Git.php line 473:

  Failed to clone https://github.com/phpstan/phpstan.git via https, ssh proto
  cols, aborting.

  - https://github.com/phpstan/phpstan.git
    fatal: could not create leading directories of '/nix/store/7238h8vdl69gyb
  vp9d185vgkmammjv9q-nix-community-composer-local-repo-plugin-vendor-1.1.0/ca
  che/vcs/https---github.com-phpstan-phpstan.git'

  - git@github.com:phpstan/phpstan.git
    fatal: could not create leading directories of '/nix/store/7238h8vdl69gyb
  vp9d185vgkmammjv9q-nix-community-composer-local-repo-plugin-vendor-1.1.0/ca
  che/vcs/https---github.com-phpstan-phpstan.git'