@mnci/cli 4.7.1 → 4.8.0

package/dist/cli.js

@@ -4718,6 +4718,53 @@ function checkNpmrc(workspaceRoot, registry, scope) {
     remedy: "run `mnci upgrade`"
   };
 }
+function checkNpmrcCredentialResolves(workspaceRoot, environment = process.env) {
+  const npmrcPath = (0, import_node_path19.join)(workspaceRoot, ".npmrc");
+  if (!fileExists(npmrcPath)) {
+    return void 0;
+  }
+  const npmrc = (0, import_node_fs12.readFileSync)(npmrcPath, "utf8");
+  const credentials = npmrc.split("\n").filter((line) => !line.trimStart().startsWith(";") && !line.trimStart().startsWith("#")).filter((line) => /(?:_authToken|_password|_auth)\s*=/u.test(line));
+  const referenced = [
+    ...new Set(
+      credentials.flatMap(
+        (line) => Array.from(line.matchAll(/\$\{(\w+)\}/gu), (match) => match[1])
+      )
+    )
+  ];
+  if (referenced.length === 0) {
+    return void 0;
+  }
+  const unset = referenced.filter((name) => (environment[name] ?? "") === "");
+  if (unset.length === 0) {
+    return npmjsCredentialShape(credentials, environment);
+  }
+  return {
+    check: "npm credentials in this workspace resolve to something",
+    ok: false,
+    detail: `.npmrc authenticates with \${${unset.join("}, ${")}}, which ${unset.length > 1 ? "are" : "is"} unset here \u2014 and a project .npmrc beats your user one, so npm will send an EMPTY token from this directory rather than the one \`npm login\` wrote. Writes are then refused as a 404 on the PUT, which reads like a missing package`,
+    remedy: "nothing, for installing or building \u2014 this only affects authenticated commands. To publish or deprecate by hand, run it from outside this workspace, or export a real token first. If it still fails there, `npm whoami` \u2014 an expired token gives the same 404"
+  };
+}
+var NPM_TOKEN_PREFIX = "npm_";
+var LEGACY_NPM_TOKEN = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu;
+function npmjsCredentialShape(credentials, environment) {
+  const line = credentials.find((entry) => entry.includes("//registry.npmjs.org/:_authToken="));
+  const variable = line === void 0 ? void 0 : /\$\{(\w+)\}/u.exec(line)?.[1];
+  if (variable === void 0) {
+    return void 0;
+  }
+  const value = environment[variable] ?? "";
+  if (value.startsWith(NPM_TOKEN_PREFIX) || LEGACY_NPM_TOKEN.test(value)) {
+    return void 0;
+  }
+  return {
+    check: "the credential bound for npmjs.org looks like an npm token",
+    ok: false,
+    detail: `\${${variable}} is set (${value.length} characters) but does not start with '${NPM_TOKEN_PREFIX}' and is not a legacy UUID token, so it is probably a credential for somewhere else \u2014 '${variable}' is a generic name that other tooling also sets, and inside this workspace it is sent to the PUBLIC registry. A write then fails as a 404 on the PUT, which reads like a missing package`,
+    remedy: `\`npm whoami\` to confirm \u2014 it is the only thing that separates a wrong token from an expired one. Then unset \`${variable}\` for local work, or set it to a real npm token`
+  };
+}
 function checkVersionActions(workspaceRoot) {
   const candidates = [
     ...(0, import_node_fs12.globSync)("packages/*/pubspec.yaml", { cwd: workspaceRoot }),
@@ -4902,6 +4949,7 @@ function collectFindings(workspaceRoot) {
     checkEslintPlugin(nxJson),
     checkResolvedEslint(workspaceRoot),
     checkNpmrc(workspaceRoot, nxJson.mnci?.registry, nxJson.mnci?.scope),
+    checkNpmrcCredentialResolves(workspaceRoot),
     checkNoRootRuntimeDependencies(workspaceRoot),
     ...checkRollupSourceMaps(workspaceRoot),
     ...checkDeclarationSpecifiers(workspaceRoot),