npm / npm/cli

[BUG] Publishing can not handle auth_tokens for base urls

Open
#4,908 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Needs Triage Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
This issue exists in the latest npm version
  • I am using the latest npm
Current Behavior

I have multiple private npm registries with the same url base.
For installing my packages, it is enough to just specify authentication using this one line in my .npmrc: //<base_url>/:_authToken=<auth_token>.
The parsing of authentication for installing is implemented in npm-registry-fetch/lib/auth.js#regKeyFromUri.

However, this authentication configuration doesn't work for publishing. For publishing, I need to add one line per private registry: //<base_url>/<registry_name>/:_authToken=<auth_token>.
The parsing of authentication for publishing is implemented in @npmcli/config/lib/index.js#Config.getCredentialsByURI.

Expected Behavior

I expect publishing to use the same authentication config as installing.
Specifying an authtoken for just the base url should be enough.

Steps To Reproduce
  1. Have a private npm registry (easy to set up using verdaccio, artifactory or gitlab for example)
  2. Publish a package to that registry.
  3. Clear your .npmrc file and put //<base_url>/:_authToken=<auth_token> in there with <base_url> not being the full registry url (cut off after a /) and <auth_token> being your auth token for that registry.
  4. Pull that package in
  5. Now update the package's version and try to publish it again
  6. See that you get a ENEEDAUTH error
Environment
  • npm: 8.10.0
  • Node.js: 14.17.0
  • OS Name: Windows
  • System Model Name: Windows 10
  • npm config:
; copy and paste output from `npm config ls` here

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing npm-registry-fetch/lib/auth.js#regKeyFromUri with @npmcli/config/lib/index.js#Config.getCredentialsByURI, using the reported base-URL auth configuration and publishing reproduction. Trace how credentials are selected for publishing and verify that a token configured at the base URL is accepted without an ENEEDAUTH error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.