[BUG] Publishing can not handle auth_tokens for base urls
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
I have multiple private npm registries with the same url base.
For installing my packages, it is enough to just specify authentication using this one line in my .npmrc: //<base_url>/:_authToken=<auth_token>.
The parsing of authentication for installing is implemented in npm-registry-fetch/lib/auth.js#regKeyFromUri.
However, this authentication configuration doesn't work for publishing. For publishing, I need to add one line per private registry: //<base_url>/<registry_name>/:_authToken=<auth_token>.
The parsing of authentication for publishing is implemented in @npmcli/config/lib/index.js#Config.getCredentialsByURI.
Expected Behavior
I expect publishing to use the same authentication config as installing.
Specifying an authtoken for just the base url should be enough.
Steps To Reproduce
- Have a private npm registry (easy to set up using verdaccio, artifactory or gitlab for example)
- Publish a package to that registry.
- Clear your .npmrc file and put
//<base_url>/:_authToken=<auth_token>in there with <base_url> not being the full registry url (cut off after a/) and <auth_token> being your auth token for that registry. - Pull that package in
- Now update the package's version and try to publish it again
- See that you get a
ENEEDAUTHerror
Environment
- npm: 8.10.0
- Node.js: 14.17.0
- OS Name: Windows
- System Model Name: Windows 10
- npm config:
; copy and paste output from `npm config ls` here
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing npm-registry-fetch/lib/auth.js#regKeyFromUri with @npmcli/config/lib/index.js#Config.getCredentialsByURI, using the reported base-URL auth configuration and publishing reproduction. Trace how credentials are selected for publishing and verify that a token configured at the base URL is accepted without an ENEEDAUTH error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100