|
1 | 1 | 'use strict' |
| 2 | +const npa = require('npm-package-arg') |
2 | 3 |
|
3 | | -const defaultOpts = require('./default-opts.js') |
4 | | -const url = require('url') |
| 4 | +// Find the longest registry key that is used for some kind of auth |
| 5 | +// in the options. |
| 6 | +const regKeyFromURI = (uri, opts) => { |
| 7 | + const parsed = new URL(uri) |
| 8 | + // try to find a config key indicating we have auth for this registry |
| 9 | + // can be one of :_authToken, :_auth, or :_password and :username |
| 10 | + // We walk up the "path" until we're left with just //<host>[:<port>], |
| 11 | + // stopping when we reach '//'. |
| 12 | + let regKey = `//${parsed.host}${parsed.pathname}` |
| 13 | + while (regKey.length > '//'.length) { |
| 14 | + // got some auth for this URI |
| 15 | + if (hasAuth(regKey, opts)) |
| 16 | + return regKey |
5 | 17 |
|
6 | | -module.exports = getAuth |
7 | | -function getAuth (registry, opts_ = {}) { |
8 | | - if (!registry) |
9 | | - throw new Error('registry is required') |
10 | | - const opts = opts_.forceAuth ? opts_.forceAuth : { ...defaultOpts, ...opts_ } |
11 | | - const AUTH = {} |
12 | | - const regKey = registry && registryKey(registry) |
13 | | - const doKey = (key, alias) => addKey(opts, AUTH, regKey, key, alias) |
14 | | - doKey('token') |
15 | | - doKey('_authToken', 'token') |
16 | | - doKey('username') |
17 | | - doKey('password') |
18 | | - doKey('_password', 'password') |
19 | | - doKey('email') |
20 | | - doKey('_auth') |
21 | | - doKey('otp') |
22 | | - doKey('always-auth', 'alwaysAuth') |
23 | | - if (AUTH.password) |
24 | | - AUTH.password = Buffer.from(AUTH.password, 'base64').toString('utf8') |
25 | | - |
26 | | - if (AUTH._auth && !(AUTH.username && AUTH.password)) { |
27 | | - let auth = Buffer.from(AUTH._auth, 'base64').toString() |
28 | | - auth = auth.split(':') |
29 | | - AUTH.username = auth.shift() |
30 | | - AUTH.password = auth.join(':') |
| 18 | + // can be either //host/some/path/:_auth or //host/some/path:_auth |
| 19 | + // walk up by removing EITHER what's after the slash OR the slash itself |
| 20 | + regKey = regKey.replace(/([^/]+|\/)$/, '') |
31 | 21 | } |
32 | | - AUTH.alwaysAuth = AUTH.alwaysAuth === 'false' ? false : !!AUTH.alwaysAuth |
33 | | - return AUTH |
34 | 22 | } |
35 | 23 |
|
36 | | -function addKey (opts, obj, scope, key, objKey) { |
37 | | - if (opts[key]) |
38 | | - obj[objKey || key] = opts[key] |
| 24 | +const hasAuth = (regKey, opts) => ( |
| 25 | + opts[`${regKey}:_authToken`] || |
| 26 | + opts[`${regKey}:_auth`] || |
| 27 | + opts[`${regKey}:username`] && opts[`${regKey}:_password`] |
| 28 | +) |
39 | 29 |
|
40 | | - if (scope && opts[`${scope}:${key}`]) |
41 | | - obj[objKey || key] = opts[`${scope}:${key}`] |
42 | | -} |
| 30 | +const getAuth = (uri, opts = {}) => { |
| 31 | + const { forceAuth } = opts |
| 32 | + if (!uri) |
| 33 | + throw new Error('URI is required') |
| 34 | + const regKey = regKeyFromURI(uri, forceAuth || opts) |
| 35 | + |
| 36 | + // we are only allowed to use what's in forceAuth if specified |
| 37 | + if (forceAuth && !regKey) { |
| 38 | + return new Auth({ |
| 39 | + scopeAuthKey: null, |
| 40 | + token: forceAuth._authToken, |
| 41 | + username: forceAuth.username, |
| 42 | + password: forceAuth._password || forceAuth.password, |
| 43 | + auth: forceAuth._auth || forceAuth.auth, |
| 44 | + }) |
| 45 | + } |
| 46 | + |
| 47 | + // no auth for this URI |
| 48 | + if (!regKey && opts.spec) { |
| 49 | + // If making a tarball request to a different base URI than the |
| 50 | + // registry where we logged in, but the same auth SHOULD be sent |
| 51 | + // to that artifact host, then we track where it was coming in from, |
| 52 | + // and warn the user if we get a 4xx error on it. |
| 53 | + const { spec } = opts |
| 54 | + const { scope: specScope, subSpec } = npa(spec) |
| 55 | + const subSpecScope = subSpec && subSpec.scope |
| 56 | + const scope = subSpec ? subSpecScope : specScope |
| 57 | + const scopeReg = scope && opts[`${scope}:registry`] |
| 58 | + const scopeAuthKey = scopeReg && regKeyFromURI(scopeReg, opts) |
| 59 | + return new Auth({ scopeAuthKey }) |
| 60 | + } |
43 | 61 |
|
44 | | -// Called a nerf dart in the main codebase. Used as a "safe" |
45 | | -// key when fetching registry info from config. |
46 | | -function registryKey (registry) { |
47 | | - const parsed = new url.URL(registry) |
48 | | - const formatted = url.format({ |
49 | | - protocol: parsed.protocol, |
50 | | - host: parsed.host, |
51 | | - pathname: parsed.pathname, |
52 | | - slashes: true, |
| 62 | + const { |
| 63 | + [`${regKey}:_authToken`]: token, |
| 64 | + [`${regKey}:username`]: username, |
| 65 | + [`${regKey}:_password`]: password, |
| 66 | + [`${regKey}:_auth`]: auth, |
| 67 | + } = opts |
| 68 | + |
| 69 | + return new Auth({ |
| 70 | + scopeAuthKey: null, |
| 71 | + token, |
| 72 | + auth, |
| 73 | + username, |
| 74 | + password, |
53 | 75 | }) |
54 | | - return url.format(new url.URL('.', formatted)).replace(/^[^:]+:/, '') |
55 | 76 | } |
| 77 | + |
| 78 | +class Auth { |
| 79 | + constructor ({ token, auth, username, password, scopeAuthKey }) { |
| 80 | + this.scopeAuthKey = scopeAuthKey |
| 81 | + this.token = null |
| 82 | + this.auth = null |
| 83 | + if (token) |
| 84 | + this.token = token |
| 85 | + else if (auth) |
| 86 | + this.auth = auth |
| 87 | + else if (username && password) { |
| 88 | + const p = Buffer.from(password, 'base64').toString('utf8') |
| 89 | + this.auth = Buffer.from(`${username}:${p}`, 'utf8').toString('base64') |
| 90 | + } |
| 91 | + } |
| 92 | +} |
| 93 | + |
| 94 | +module.exports = getAuth |
0 commit comments