@npmcli/config 4.1.0 → 4.2.2

package/lib/index.js

@@ -296,6 +296,7 @@ class Config {
     // might be a security hazard, which was the intention.
     try {
       this.setCredentialsByURI(reg, creds)
+    // eslint-disable-next-line no-empty
     } catch (_) {}
     process.emit('timeEnd', 'config:load:credentials')
 
@@ -366,9 +367,11 @@ class Config {
       if (!/^npm_config_/i.test(envKey) || envVal === '') {
         continue
       }
-      const key = envKey.slice('npm_config_'.length)
-        .replace(/(?!^)_/g, '-') // don't replace _ at the start of the key
-        .toLowerCase()
+      let key = envKey.slice('npm_config_'.length)
+      if (!key.startsWith('//')) { // don't normalize nerf-darted keys
+        key = key.replace(/(?!^)_/g, '-') // don't replace _ at the start of the key
+          .toLowerCase()
+      }
       conf[key] = envVal
     }
     this[_loadObject](conf, 'env', 'environment')
@@ -654,6 +657,7 @@ class Config {
       // saved back to the .npmrc file, so we're good.
       try {
         this.setCredentialsByURI(reg, creds)
+      // eslint-disable-next-line no-empty
       } catch (_) {}
     }
 
@@ -691,16 +695,16 @@ class Config {
       this.delete(`_password`, 'user')
       this.delete(`username`, 'user')
     }
-    this.delete(`${nerfed}:-authtoken`, 'user')
-    this.delete(`${nerfed}:_authtoken`, 'user')
     this.delete(`${nerfed}:_authToken`, 'user')
     this.delete(`${nerfed}:_auth`, 'user')
     this.delete(`${nerfed}:_password`, 'user')
     this.delete(`${nerfed}:username`, 'user')
     this.delete(`${nerfed}:email`, 'user')
+    this.delete(`${nerfed}:certfile`, 'user')
+    this.delete(`${nerfed}:keyfile`, 'user')
   }
 
-  setCredentialsByURI (uri, { token, username, password, email }) {
+  setCredentialsByURI (uri, { token, username, password, email, certfile, keyfile }) {
     const nerfed = nerfDart(uri)
     const def = nerfDart(this.get('registry'))
 
@@ -730,9 +734,12 @@ class Config {
     // send auth if we have it, only to the URIs under the nerf dart.
     this.delete(`${nerfed}:always-auth`, 'user')
 
-    this.delete(`${nerfed}:-authtoken`, 'user')
-    this.delete(`${nerfed}:_authtoken`, 'user')
     this.delete(`${nerfed}:email`, 'user')
+    if (certfile && keyfile) {
+      this.set(`${nerfed}:certfile`, certfile, 'user')
+      this.set(`${nerfed}:keyfile`, keyfile, 'user')
+      // cert/key may be used in conjunction with other credentials, thus no `else`
+    }
     if (token) {
       this.set(`${nerfed}:_authToken`, token, 'user')
       this.delete(`${nerfed}:_password`, 'user')
@@ -750,7 +757,7 @@ class Config {
       // protects against shoulder-hacks if password is memorable, I guess?
       const encoded = Buffer.from(password, 'utf8').toString('base64')
       this.set(`${nerfed}:_password`, encoded, 'user')
-    } else {
+    } else if (!certfile || !keyfile) {
       throw new Error('No credentials to set.')
     }
   }
@@ -760,17 +767,31 @@ class Config {
     const nerfed = nerfDart(uri)
     const creds = {}
 
+    const deprecatedAuthWarning = [
+      '`_auth`, `_authToken`, `username` and `_password` must be scoped to a registry.',
+      'see `npm help npmrc` for more information.',
+    ].join(' ')
+
     const email = this.get(`${nerfed}:email`) || this.get('email')
     if (email) {
       creds.email = email
     }
 
-    const tokenReg = this.get(`${nerfed}:_authToken`) ||
-      this.get(`${nerfed}:_authtoken`) ||
-      this.get(`${nerfed}:-authtoken`) ||
-      nerfed === nerfDart(this.get('registry')) && this.get('_authToken')
+    const certfileReg = this.get(`${nerfed}:certfile`)
+    const keyfileReg = this.get(`${nerfed}:keyfile`)
+    if (certfileReg && keyfileReg) {
+      creds.certfile = certfileReg
+      creds.keyfile = keyfileReg
+      // cert/key may be used in conjunction with other credentials, thus no `return`
+    }
+
+    const defaultToken = nerfDart(this.get('registry')) && this.get('_authToken')
+    const tokenReg = this.get(`${nerfed}:_authToken`) || defaultToken
 
     if (tokenReg) {
+      if (tokenReg === defaultToken) {
+        log.warn('config', deprecatedAuthWarning)
+      }
       creds.token = tokenReg
       return creds
     }
@@ -805,6 +826,7 @@ class Config {
     const userDef = this.get('username')
     const passDef = this.get('_password')
     if (userDef && passDef) {
+      log.warn('config', deprecatedAuthWarning)
       creds.username = userDef
       creds.password = Buffer.from(passDef, 'base64').toString('utf8')
       const auth = `${creds.username}:${creds.password}`
@@ -819,6 +841,7 @@ class Config {
       return creds
     }
 
+    log.warn('config', deprecatedAuthWarning)
     const authDecode = Buffer.from(auth, 'base64').toString('utf8')
     const authSplit = authDecode.split(':')
     creds.username = authSplit.shift()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "4.1.0",
+  "version": "4.2.2",
   "files": [
     "bin/",
     "lib/"
@@ -31,14 +31,14 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.3.2",
+    "@npmcli/template-oss": "3.6.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
     "@npmcli/map-workspaces": "^2.0.2",
     "ini": "^3.0.0",
     "mkdirp-infer-owner": "^2.0.0",
-    "nopt": "^5.0.0",
+    "nopt": "^6.0.0",
     "proc-log": "^2.0.0",
     "read-package-json-fast": "^2.0.3",
     "semver": "^7.3.5",
@@ -49,6 +49,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.3.2"
+    "version": "3.6.0"
   }
 }