mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-19 20:22:21 -04:00
88add0909a
pnpr's resolver endpoint could previously accept anonymous resolve jobs and start outbound dependency-resolution work before checking any caller identity. Mount auth middleware on /-/pnpr/v0/resolve so Basic/Bearer credentials from the HTTP Authorization header are verified before Axum buffers or parses the body. Reject duplicate or non-text Authorization headers rather than picking one. The resolver now loads configured auth state at startup, including resolver-only deployments, so configured htpasswd/token/SQL backends are honored. New-user registration defaults to disabled unless auth.htpasswd.max_users is explicitly configured, preventing anonymous callers from creating credentials on a fresh server. Update pnpm and pacquet resolver fixtures to provision and send pnpr credentials, and add regression coverage proving anonymous Git resolve requests do not trigger egress while authenticated resolver requests still work.