@pnpm/engine.runtime.node-resolver 1101.2.3 → 1101.3.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @pnpm/node.resolver
 
+## 1101.3.0
+
+### Minor Changes
+
+- Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/config.reader@1102.1.1
+  - @pnpm/crypto.shasums-file@1100.2.3
+  - @pnpm/error@1100.1.4
+
 ## 1101.2.3
 
 ### Patch Changes

package/lib/index.d.ts

@@ -1,4 +1,4 @@
-import type { FetchFromRegistry } from '@pnpm/fetching.types';
+import type { FetchFromRegistry, GetAuthHeader } from '@pnpm/fetching.types';
 import type { LatestInfo, LatestQuery, ResolveOptions, ResolveResult, VariationsResolution, WantedDependency } from '@pnpm/resolving.resolver-base';
 import { getNodeArtifactAddress } from './getNodeArtifactAddress.js';
 import { getNodeMirror } from './getNodeMirror.js';
@@ -13,13 +13,19 @@ export interface NodeRuntimeResolveResult extends ResolveResult {
 }
 export declare function resolveNodeRuntime(ctx: {
     fetchFromRegistry: FetchFromRegistry;
+    getAuthHeader?: GetAuthHeader;
     nodeDownloadMirrors?: Record<string, string>;
     offline?: boolean;
     cacheDir?: string;
 }, wantedDependency: WantedDependency, opts?: Partial<ResolveOptions>): Promise<NodeRuntimeResolveResult | null>;
 export declare function resolveLatestNodeRuntime(ctx: {
     fetchFromRegistry: FetchFromRegistry;
+    getAuthHeader?: GetAuthHeader;
     nodeDownloadMirrors?: Record<string, string>;
 }, query: LatestQuery, _opts: ResolveOptions): Promise<LatestInfo | undefined>;
-export declare function resolveNodeVersion(fetch: FetchFromRegistry, versionSpec: string, nodeMirrorBaseUrl?: string): Promise<string | null>;
-export declare function resolveNodeVersions(fetch: FetchFromRegistry, versionSpec?: string, nodeMirrorBaseUrl?: string): Promise<string[]>;
+export declare function resolveNodeVersion(fetch: FetchFromRegistry, versionSpec: string, opts?: string | NodeVersionFetchOptions): Promise<string | null>;
+export declare function resolveNodeVersions(fetch: FetchFromRegistry, versionSpec?: string, opts?: string | NodeVersionFetchOptions): Promise<string[]>;
+export interface NodeVersionFetchOptions {
+    nodeMirrorBaseUrl?: string;
+    getAuthHeader?: GetAuthHeader;
+}

package/lib/index.js

@@ -1,3 +1,4 @@
+import { isIP } from 'node:net';
 import { fetchShasumsFileCached, fetchVerifiedNodeShasumsFileCached } from '@pnpm/crypto.shasums-file';
 import { PnpmError } from '@pnpm/error';
 import semver from 'semver';
@@ -25,6 +26,7 @@ export async function resolveNodeRuntime(ctx, wantedDependency, opts) {
     }
     if (ctx.offline)
         throw new PnpmError('NO_OFFLINE_NODEJS_RESOLUTION', 'Offline Node.js resolution is not supported');
+    const fetch = createAuthenticatedFetch(ctx.fetchFromRegistry, ctx.getAuthHeader);
     const versionSpec = normalizeRuntimeSpec(wantedDependency.bareSpecifier.substring('runtime:'.length));
     const { releaseChannel, versionSpecifier } = parseNodeSpecifier(versionSpec);
     const nodeMirrorBaseUrl = getNodeMirror(ctx.nodeDownloadMirrors, releaseChannel);
@@ -34,14 +36,14 @@ export async function resolveNodeRuntime(ctx, wantedDependency, opts) {
     const exactVersion = exactReleaseVersion(releaseChannel, versionSpecifier);
     let version = exactVersion;
     if (version == null) {
-        version = await resolveNodeVersion(ctx.fetchFromRegistry, versionSpecifier, nodeMirrorBaseUrl) ?? undefined;
+        version = await resolveNodeVersion(fetch, versionSpecifier, nodeMirrorBaseUrl) ?? undefined;
         if (!version) {
             throw new PnpmError('NODEJS_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies ${versionSpec}`);
         }
     }
     let variants;
     try {
-        variants = await readNodeAssets(ctx.fetchFromRegistry, { nodeMirrorBaseUrl, version, releaseChannel, cacheDir: ctx.cacheDir });
+        variants = await readNodeAssets(fetch, { nodeMirrorBaseUrl, version, releaseChannel, cacheDir: ctx.cacheDir, getAuthHeader: ctx.getAuthHeader });
     }
     catch (err) {
         // The exact-specifier pick skipped the release index, so a failed asset
@@ -49,7 +51,7 @@ export async function resolveNodeRuntime(ctx, wantedDependency, opts) {
         // now, purely to raise the same NODEJS_VERSION_NOT_FOUND the index-first
         // path raises for a nonexistent version; any other outcome re-raises the
         // asset error unchanged.
-        if (exactVersion != null && await versionMissingFromIndex(ctx.fetchFromRegistry, exactVersion, nodeMirrorBaseUrl)) {
+        if (exactVersion != null && await versionMissingFromIndex(fetch, exactVersion, nodeMirrorBaseUrl)) {
             throw new PnpmError('NODEJS_VERSION_NOT_FOUND', `Could not find a Node.js version that satisfies ${versionSpec}`);
         }
         throw err;
@@ -77,7 +79,10 @@ export async function resolveLatestNodeRuntime(ctx, query, _opts) {
     const versionSpec = query.compatible ? normalizeRuntimeSpec(manifestSpec.substring('runtime:'.length)) : 'latest';
     const { releaseChannel, versionSpecifier } = parseNodeSpecifier(versionSpec);
     const nodeMirrorBaseUrl = getNodeMirror(ctx.nodeDownloadMirrors, releaseChannel);
-    const version = await resolveNodeVersion(ctx.fetchFromRegistry, versionSpecifier, nodeMirrorBaseUrl);
+    const version = await resolveNodeVersion(ctx.fetchFromRegistry, versionSpecifier, {
+        nodeMirrorBaseUrl,
+        getAuthHeader: ctx.getAuthHeader,
+    });
     if (!version)
         return {};
     return { latestManifest: { name: 'node', version } };
@@ -120,20 +125,20 @@ async function versionMissingFromIndex(fetch, version, nodeMirrorBaseUrl) {
     }
 }
 async function readNodeAssets(fetch, opts) {
-    const { nodeMirrorBaseUrl, version, releaseChannel, cacheDir } = opts;
+    const { nodeMirrorBaseUrl, version, releaseChannel, cacheDir, getAuthHeader } = opts;
     // The mirror is repository-configurable, so the SHASUMS file's hashes are only
     // trustworthy once its OpenPGP signature is verified against the Node.js
     // release keys embedded in pnpm. Only the `release` channel publishes a signed
     // SHASUMS256.txt; pre-release channels (rc, nightly, …) are unsigned by Node,
     // so they cannot be verified this way.
-    const assets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl, version, muslOnly: false, verifySignature: releaseChannel === 'release', cacheDir });
+    const assets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl, version, muslOnly: false, verifySignature: releaseChannel === 'release', cacheDir, getAuthHeader });
     // When using the default mirror, also fetch musl variants from unofficial-builds.nodejs.org,
     // since musl builds are not available on the official mirror. That URL is hardcoded (not
     // repository-configurable) and signed by a different (unofficial-builds) key, so it is trusted
     // over TLS rather than verified against the official release keys.
     if (nodeMirrorBaseUrl === DEFAULT_NODE_MIRROR_BASE_URL) {
         try {
-            const muslAssets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl: UNOFFICIAL_NODE_MIRROR_BASE_URL, version, muslOnly: true, verifySignature: false, cacheDir });
+            const muslAssets = await readNodeAssetsFromMirror(fetch, { nodeMirrorBaseUrl: UNOFFICIAL_NODE_MIRROR_BASE_URL, version, muslOnly: true, verifySignature: false, cacheDir, getAuthHeader });
             assets.push(...muslAssets);
         }
         catch {
@@ -143,13 +148,18 @@ async function readNodeAssets(fetch, opts) {
     return assets;
 }
 async function readNodeAssetsFromMirror(fetch, opts) {
-    const { nodeMirrorBaseUrl, version, muslOnly, verifySignature, cacheDir } = opts;
+    const { nodeMirrorBaseUrl, version, muslOnly, verifySignature, getAuthHeader } = opts;
     // The URL is pinned to one released version, which is what makes it
     // eligible for the SHASUMS disk cache.
     const integritiesFileUrl = `${nodeMirrorBaseUrl}v${version}/SHASUMS256.txt`;
+    const cacheOpts = {
+        cacheDir: opts.cacheDir,
+        skipCache: getSecureAuthHeader(getAuthHeader, integritiesFileUrl) != null ||
+            getSecureAuthHeader(getAuthHeader, `${integritiesFileUrl}.sig`) != null,
+    };
     const shasumsFileItems = verifySignature
-        ? await fetchVerifiedNodeShasumsFileCached(fetch, integritiesFileUrl, { cacheDir })
-        : await fetchShasumsFileCached(fetch, integritiesFileUrl, { cacheDir });
+        ? await fetchVerifiedNodeShasumsFileCached(fetch, integritiesFileUrl, cacheOpts)
+        : await fetchShasumsFileCached(fetch, integritiesFileUrl, cacheOpts);
     const escaped = version.replace(/\\/g, '\\\\').replace(/\./g, '\\.');
     // The second capture group uses [^.-]+ to stop at a dash, so that the optional
     // third group can capture the '-musl' suffix separately (e.g. 'x64' + '-musl').
@@ -201,8 +211,10 @@ const SEMVER_OPTS = {
     includePrerelease: true,
     loose: true,
 };
-export async function resolveNodeVersion(fetch, versionSpec, nodeMirrorBaseUrl) {
-    const allVersions = await fetchAllVersions(fetch, nodeMirrorBaseUrl);
+const MAX_NODE_MIRROR_REDIRECTS = 20;
+export async function resolveNodeVersion(fetch, versionSpec, opts) {
+    const { nodeMirrorBaseUrl, getAuthHeader } = normalizeNodeVersionFetchOptions(opts);
+    const allVersions = await fetchAllVersions(createAuthenticatedFetch(fetch, getAuthHeader), nodeMirrorBaseUrl);
     versionSpec = normalizeRuntimeSpec(versionSpec);
     if (versionSpec === 'latest') {
         return allVersions[0].version;
@@ -210,8 +222,9 @@ export async function resolveNodeVersion(fetch, versionSpec, nodeMirrorBaseUrl)
     const { versions, versionRange } = filterVersions(allVersions, versionSpec);
     return semver.maxSatisfying(versions, versionRange, SEMVER_OPTS) ?? null;
 }
-export async function resolveNodeVersions(fetch, versionSpec, nodeMirrorBaseUrl) {
-    const allVersions = await fetchAllVersions(fetch, nodeMirrorBaseUrl);
+export async function resolveNodeVersions(fetch, versionSpec, opts) {
+    const { nodeMirrorBaseUrl, getAuthHeader } = normalizeNodeVersionFetchOptions(opts);
+    const allVersions = await fetchAllVersions(createAuthenticatedFetch(fetch, getAuthHeader), nodeMirrorBaseUrl);
     if (versionSpec == null) {
         return allVersions.map(({ version }) => version);
     }
@@ -233,6 +246,46 @@ async function fetchAllVersions(fetch, nodeMirrorBaseUrl) {
         lts,
     }));
 }
+function normalizeNodeVersionFetchOptions(opts) {
+    return typeof opts === 'string' ? { nodeMirrorBaseUrl: opts } : opts ?? {};
+}
+function createAuthenticatedFetch(fetch, getAuthHeader) {
+    if (getAuthHeader == null)
+        return fetch;
+    return async (url, opts) => {
+        let currentUrl = url;
+        for (let redirectCount = 0;; redirectCount++) {
+            // eslint-disable-next-line no-await-in-loop
+            const response = await fetch(currentUrl, {
+                ...opts,
+                authHeaderValue: getSecureAuthHeader(getAuthHeader, currentUrl),
+                redirect: 'manual',
+            });
+            if (opts?.redirect === 'manual' || !isRedirectStatus(response.status) || redirectCount === MAX_NODE_MIRROR_REDIRECTS) {
+                return response;
+            }
+            const location = response.headers.get('location');
+            if (location == null)
+                return response;
+            currentUrl = new URL(location, currentUrl).toString();
+        }
+    };
+}
+function getSecureAuthHeader(getAuthHeader, url) {
+    const authHeaderValue = getAuthHeader?.(url);
+    if (authHeaderValue == null)
+        return undefined;
+    const parsed = new URL(url);
+    if (parsed.protocol === 'https:' || isLoopbackHost(parsed.hostname))
+        return authHeaderValue;
+    return undefined;
+}
+function isLoopbackHost(hostname) {
+    return hostname === 'localhost' || hostname === '[::1]' || (isIP(hostname) === 4 && hostname.startsWith('127.'));
+}
+function isRedirectStatus(status) {
+    return status === 301 || status === 302 || status === 303 || status === 307 || status === 308;
+}
 function getNodeBinsForCurrentOS(platform = process.platform) {
     if (platform === 'win32') {
         return { node: 'node.exe' };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/engine.runtime.node-resolver",
-  "version": "1101.2.3",
+  "version": "1101.3.0",
   "description": "Resolves a Node.js version specifier to an exact Node.js version",
   "keywords": [
     "pnpm",
@@ -29,9 +29,9 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/config.reader": "1102.1.0",
-    "@pnpm/crypto.shasums-file": "1100.2.2",
-    "@pnpm/error": "1100.1.3",
+    "@pnpm/config.reader": "1102.1.1",
+    "@pnpm/crypto.shasums-file": "1100.2.3",
+    "@pnpm/error": "1100.1.4",
     "@pnpm/fetching.types": "1100.0.3",
     "@pnpm/resolving.resolver-base": "1101.2.0",
     "@pnpm/types": "1102.1.0",
@@ -40,8 +40,8 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/engine.runtime.node-resolver": "1101.2.3",
-    "@pnpm/network.fetch": "1100.1.14",
+    "@pnpm/engine.runtime.node-resolver": "1101.3.0",
+    "@pnpm/network.fetch": "1100.1.15",
     "@types/semver": "7.8.0"
   },
   "engines": {