dependabot-python 0.98.30 → 0.98.31

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: de12aa5fff8598a55962c37fd73ad95554f9322f0c780d77ea7563c145ac4db8
-  data.tar.gz: 0b942489fd3b4e6d6f7c92657d66cf26cecea1b9d16078f3082e8e0df31d8073
+  metadata.gz: 55f2df02a86fe3a817276864b695d703405ef351bb4bd0603d5f312ce77dfd33
+  data.tar.gz: c777600045af9242c35cbe00362b55fb564cb118d0eb67f6cb2ba38542a9f607
 SHA512:
-  metadata.gz: 48592d3c0b731410126e49e3f2ed35b05b0a3e0c710034b43e267db38435891d52981fe9a7d1ce27885f04068ecdd6beade6bbb5362f16650e25713401dfdf3e
-  data.tar.gz: c3ec892d6f85db912d4fe1e81602f06e022acb46f1879099e35a2fcb5edb2f0587a1b98ffdf20ea859fcddb2f3029ae089c931396a27ada7462202833550f308
+  metadata.gz: 73358ae18269988f15538f36f63816742768dacb98a134ad1cc43639aa805596144f9c5d493a97f40416bf3aa13c67dad618cf7528e59e13f158dd3e313f9280
+  data.tar.gz: dc1e97ab3f7427cadc635953124e15ba7cb9115ad68986855163c64ddcb67aec22f66e9a2f7d5bc7eb398e7e753198fdfa4e32d4cccad4b1b48ea9de0fbc6b91

data/lib/dependabot/python/authed_url_builder.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Python
+    class AuthedUrlBuilder
+      def self.authed_url(credential:)
+        token = credential.fetch("token", nil)
+        url = credential.fetch("index-url")
+        return url unless token
+
+        basic_auth_details =
+          if token.ascii_only? && token.include?(":") then token
+          elsif Base64.decode64(token).ascii_only? &&
+                Base64.decode64(token).include?(":")
+            Base64.decode64(token)
+          else token
+          end
+
+        url.sub("://", "://#{basic_auth_details}@")
+      end
+    end
+  end
+end

data/lib/dependabot/python/file_updater/pipfile_preparer.rb

@@ -4,6 +4,7 @@ require "toml-rb"
 
 require "dependabot/python/file_parser"
 require "dependabot/python/file_updater"
+require "dependabot/python/authed_url_builder"
 
 module Dependabot
   module Python
@@ -116,7 +117,7 @@ module Dependabot
           @config_variable_sources ||=
             credentials.
             select { |cred| cred["type"] == "python_index" }.
-            map { |cred| { "url" => cred["index-url"] } }
+            map { |c| { "url" => AuthedUrlBuilder.authed_url(credential: c) } }
         end
       end
     end

data/lib/dependabot/python/file_updater/pyproject_preparer.rb

@@ -4,6 +4,7 @@ require "toml-rb"
 
 require "dependabot/python/file_parser"
 require "dependabot/python/file_updater"
+require "dependabot/python/authed_url_builder"
 
 module Dependabot
   module Python
@@ -96,7 +97,7 @@ module Dependabot
           @config_variable_sources ||=
             credentials.
             select { |cred| cred["type"] == "python_index" }.
-            map { |cred| { "url" => cred["index-url"] } }
+            map { |c| { "url" => AuthedUrlBuilder.authed_url(credential: c) } }
         end
 
         def parsed_lockfile

data/lib/dependabot/python/metadata_finder.rb

@@ -4,6 +4,7 @@ require "excon"
 require "dependabot/metadata_finders"
 require "dependabot/metadata_finders/base"
 require "dependabot/shared_helpers"
+require "dependabot/python/authed_url_builder"
 
 module Dependabot
   module Python
@@ -149,10 +150,10 @@ module Dependabot
         credential_urls =
           credentials.
           select { |cred| cred["type"] == "python_index" }.
-          map { |cred| cred["index-url"].gsub(%r{/$}, "") }
+          map { |c| AuthedUrlBuilder.authed_url(credential: c) }
 
         (credential_urls + [MAIN_PYPI_URL]).map do |base_url|
-          base_url + "/#{dependency.name}/json"
+          base_url.gsub(%r{/$}, "") + "/#{dependency.name}/json"
         end
       end
     end

data/lib/dependabot/python/update_checker/latest_version_finder.rb

@@ -4,6 +4,7 @@ require "excon"
 
 require "dependabot/python/update_checker"
 require "dependabot/shared_helpers"
+require "dependabot/python/authed_url_builder"
 
 module Dependabot
   module Python
@@ -194,14 +195,15 @@ module Dependabot
 
           index_url_creds = credentials.
                             select { |cred| cred["type"] == "python_index" }
-          urls[:main] =
-            index_url_creds.
-            find { |cred| cred["replaces-base"] }&.
-            fetch("index-url")
+
+          if (main_cred = index_url_creds.find { |cred| cred["replaces-base"] })
+            urls[:main] = AuthedUrlBuilder.authed_url(credential: main_cred)
+          end
+
           urls[:extra] =
             index_url_creds.
             reject { |cred| cred["replaces-base"] }.
-            map { |cred| cred["index-url"] }
+            map { |cred| AuthedUrlBuilder.authed_url(credential: cred) }
 
           urls
         end

data/lib/dependabot/python/update_checker/pipfile_version_resolver.rb

@@ -12,6 +12,7 @@ require "dependabot/python/update_checker"
 require "dependabot/python/python_versions"
 require "dependabot/python/native_helpers"
 require "dependabot/python/version"
+require "dependabot/python/authed_url_builder"
 
 # rubocop:disable Metrics/ClassLength
 module Dependabot
@@ -555,7 +556,10 @@ module Dependabot
           @config_variable_sources ||=
             credentials.
             select { |cred| cred["type"] == "python_index" }.
-            map { |h| { "url" => h["index-url"].gsub(%r{/*$}, "") + "/" } }
+            map do |h|
+              url = AuthedUrlBuilder.authed_url(credential: h)
+              { "url" => url.gsub(%r{/*$}, "") + "/" }
+            end
         end
 
         def pipfile_sources

data/lib/dependabot/python/update_checker/poetry_version_resolver.rb

@@ -12,6 +12,7 @@ require "dependabot/python/version"
 require "dependabot/python/requirement"
 require "dependabot/python/native_helpers"
 require "dependabot/python/python_versions"
+require "dependabot/python/authed_url_builder"
 
 # rubocop:disable Metrics/ClassLength
 module Dependabot
@@ -340,7 +341,10 @@ module Dependabot
           @config_variable_sources ||=
             credentials.
             select { |cred| cred["type"] == "python_index" }.
-            map { |h| { "url" => h["index-url"].gsub(%r{/*$}, "") + "/" } }
+            map do |h|
+              url = AuthedUrlBuilder.authed_url(credential: h)
+              { "url" => url.gsub(%r{/*$}, "") + "/" }
+            end
         end
 
         def pyproject_sources

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-python
 version: !ruby/object:Gem::Version
-  version: 0.98.30
+  version: 0.98.31
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.30
+        version: 0.98.31
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.98.30
+        version: 0.98.31
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -150,6 +150,7 @@ files:
 - helpers/requirements.txt
 - helpers/run.py
 - lib/dependabot/python.rb
+- lib/dependabot/python/authed_url_builder.rb
 - lib/dependabot/python/file_fetcher.rb
 - lib/dependabot/python/file_parser.rb
 - lib/dependabot/python/file_parser/pipfile_files_parser.rb