mirror of
https://github.com/pnpm/pnpm.git
synced 2026-04-10 18:18:56 -04:00
Replaces the dual `authConfig` (raw .npmrc) + `authInfos` (parsed auth) + `sslConfigs` (parsed SSL) pattern with a single structured `configByUri: Record<string, RegistryConfig>` field on Config.
### New types (`@pnpm/types`)
- **`RegistryConfig`** — per-registry config: `{ creds?: Creds, tls?: TlsConfig }`
- **`Creds`** — auth credentials: `{ authToken?, basicAuth?, tokenHelper? }`
- **`TlsConfig`** — TLS config: `{ cert?, key?, ca? }`
### Key changes
- Rewrite `createGetAuthHeaderByURI` to accept `Record<string, RegistryConfig>` instead of raw .npmrc key-value pairs
- Eliminate duplicate auth parsing between `getAuthHeadersFromConfig` and `getNetworkConfigs`
- Remove `authConfig` from the install pipeline (`StrictInstallOptions`, `HeadlessOptions`), replaced by `configByUri`
- Remove `sslConfigs` from Config — SSL fields now live in `configByUri[uri].tls`
- Remove `authConfig['registry']` mutation in `extendInstallOptions` (default registry now passed directly to `createGetAuthHeaderByURI`)
- `authConfig` remains on Config only for raw .npmrc access (config commands, error reporting, config inheritance)
### Security
- tokenHelper in project .npmrc now throws instead of being silently stripped
- tokenHelper execution uses `shell: false` to prevent shell metacharacter injection
- Basic auth uses `Buffer.from().toString('base64')` instead of `btoa()` for Unicode safety
- Dispatcher only creates custom agents when entries actually have TLS fields
156 lines
3.7 KiB
TypeScript
156 lines
3.7 KiB
TypeScript
import path from 'node:path'
|
|
|
|
import { install, update } from '@pnpm/installing.commands'
|
|
import type { LockfileFile } from '@pnpm/lockfile.types'
|
|
import { prepare } from '@pnpm/prepare'
|
|
import { addDistTag } from '@pnpm/registry-mock'
|
|
import type { ProjectManifest } from '@pnpm/types'
|
|
import { loadJsonFileSync } from 'load-json-file'
|
|
|
|
import { DEFAULT_OPTS } from '../utils/index.js'
|
|
|
|
// This must be a function because some of its values depend on CWD
|
|
const createOptions = (jsr: string = DEFAULT_OPTS.registry) => ({
|
|
...DEFAULT_OPTS,
|
|
configByUri: {},
|
|
registries: {
|
|
...DEFAULT_OPTS.registries,
|
|
'@jsr': jsr,
|
|
},
|
|
dir: process.cwd(),
|
|
cacheDir: path.resolve('cache'),
|
|
storeDir: path.resolve('store'),
|
|
})
|
|
|
|
test('jsr without alias', async () => {
|
|
await addDistTag({ package: '@jsr/pnpm-e2e__bar', version: '2.0.0', distTag: 'latest' })
|
|
|
|
const project = prepare({
|
|
dependencies: {
|
|
'@pnpm-e2e/bar': 'jsr:1.0.0',
|
|
},
|
|
})
|
|
|
|
await install.handler(createOptions())
|
|
expect(project.readLockfile()).toMatchObject({
|
|
importers: {
|
|
'.': {
|
|
dependencies: {
|
|
'@pnpm-e2e/bar': {
|
|
specifier: 'jsr:1.0.0',
|
|
version: '@jsr/pnpm-e2e__bar@1.0.0',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
packages: {
|
|
'@jsr/pnpm-e2e__bar@1.0.0': {
|
|
resolution: {
|
|
integrity: expect.any(String),
|
|
},
|
|
},
|
|
},
|
|
snapshots: {
|
|
'@jsr/pnpm-e2e__bar@1.0.0': expect.any(Object),
|
|
},
|
|
} as Partial<LockfileFile>)
|
|
|
|
await update.handler({
|
|
...createOptions(),
|
|
latest: true,
|
|
})
|
|
expect(loadJsonFileSync('package.json')).toMatchObject({
|
|
dependencies: {
|
|
'@pnpm-e2e/bar': 'jsr:2.0.0',
|
|
},
|
|
} as Partial<ProjectManifest>)
|
|
expect(project.readLockfile()).toMatchObject({
|
|
importers: {
|
|
'.': {
|
|
dependencies: {
|
|
'@pnpm-e2e/bar': {
|
|
specifier: 'jsr:2.0.0',
|
|
version: '@jsr/pnpm-e2e__bar@2.0.0',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
packages: {
|
|
'@jsr/pnpm-e2e__bar@2.0.0': {
|
|
resolution: {
|
|
integrity: expect.any(String),
|
|
},
|
|
},
|
|
},
|
|
snapshots: {
|
|
'@jsr/pnpm-e2e__bar@2.0.0': expect.any(Object),
|
|
},
|
|
} as Partial<LockfileFile>)
|
|
})
|
|
|
|
test('jsr with alias', async () => {
|
|
await addDistTag({ package: '@jsr/pnpm-e2e__bar', version: '2.0.0', distTag: 'latest' })
|
|
|
|
const project = prepare({
|
|
dependencies: {
|
|
'bar-from-jsr': 'jsr:@pnpm-e2e/bar@1.0.0',
|
|
},
|
|
})
|
|
|
|
await install.handler(createOptions())
|
|
expect(project.readLockfile()).toMatchObject({
|
|
importers: {
|
|
'.': {
|
|
dependencies: {
|
|
'bar-from-jsr': {
|
|
specifier: 'jsr:@pnpm-e2e/bar@1.0.0',
|
|
version: '@jsr/pnpm-e2e__bar@1.0.0',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
packages: {
|
|
'@jsr/pnpm-e2e__bar@1.0.0': {
|
|
resolution: {
|
|
integrity: expect.any(String),
|
|
},
|
|
},
|
|
},
|
|
snapshots: {
|
|
'@jsr/pnpm-e2e__bar@1.0.0': expect.any(Object),
|
|
},
|
|
} as Partial<LockfileFile>)
|
|
|
|
await update.handler({
|
|
...createOptions(),
|
|
latest: true,
|
|
})
|
|
expect(loadJsonFileSync('package.json')).toMatchObject({
|
|
dependencies: {
|
|
'bar-from-jsr': 'jsr:@pnpm-e2e/bar@2.0.0',
|
|
},
|
|
} as Partial<ProjectManifest>)
|
|
expect(project.readLockfile()).toMatchObject({
|
|
importers: {
|
|
'.': {
|
|
dependencies: {
|
|
'bar-from-jsr': {
|
|
specifier: 'jsr:@pnpm-e2e/bar@2.0.0',
|
|
version: '@jsr/pnpm-e2e__bar@2.0.0',
|
|
},
|
|
},
|
|
},
|
|
},
|
|
packages: {
|
|
'@jsr/pnpm-e2e__bar@2.0.0': {
|
|
resolution: {
|
|
integrity: expect.any(String),
|
|
},
|
|
},
|
|
},
|
|
snapshots: {
|
|
'@jsr/pnpm-e2e__bar@2.0.0': expect.any(Object),
|
|
},
|
|
} as Partial<LockfileFile>)
|
|
})
|