fix: forward git auth to hosted CDN tarball downloads - #2
dyk1454683243-sudo wants to merge 1 commit into
Conversation
Hosted-git-info tarball URLs (codeload.github.com) omit git URL userinfo, and npm-registry-fetch looks up credentials by request host. Pass URL credentials and //<git-host>/ credential-store entries as forceAuth so the CDN request gets an Authorization header. Fixes: npm#331 Co-authored-by: David <dyk1454683243-sudo@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a826ae4c7f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| const headersHaveAuthorization = (opts) => { | ||
| const headers = opts.headers || {} | ||
| return !!(headers.authorization || headers.Authorization) |
There was a problem hiding this comment.
HTTP header names are case-insensitive, but this recognizes only authorization and Authorization. If a caller supplies another valid casing such as AUTHORIZATION while git-host credentials are configured, the helper adds forceAuth; npm-registry-fetch then emits both the caller's header and the forwarded credential as duplicate Authorization fields, which proxies or the CDN may reject or interpret using the wrong credential. Normalize the supplied header names before deciding whether authorization is already present.
Useful? React with 👍 / 👎.
2 participants
Fixes npm#331
Cause
When installing a hosted git dependency (
git+https://oauth2:TOKEN@github.com/org/private.git), pacote prefers the provider CDN tarball (https://codeload.github.com/.../tar.gz/<sha>) overgit clone.hosted-git-info'starball()URL does not include git URL userinfo.npm-registry-fetchthen looks up credentials by the request host (codeload.github.com), so neither:oauth2:TOKEN@github.com), nor//github.com/:_authToken)are sent. GitHub returns 404 for the private archive, and pacote falls back to
git+ssh.Fix
When
GitFetchershells out toRemoteFetcherfor a hosted tarball, computeforceAuththe same way other authenticated pacote fetches do:hosted.auth) to HTTP Basic (percent-decoding first).//<git-host>/credential-store auth (_authToken→ Bearer,_auth/ username+password → Basic).Authorizationheader or a CDN-specific token (//codeload.github.com/:_authToken) alone.npm-registry-fetchthen setsAuthorizationon the CDN request.Tests
//github.com/:_authToken, Basic store entries, and CDN-host precedence.https://codeload.github.comand assert theAuthorizationheader on the tarball GET.This is distinct from npm#285 / npm#514 (hardlink extract filter).