@pnpm/fetching.binary-fetcher 1102.0.11 → 1102.0.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +18 -0
  2. package/lib/index.d.ts +3 -1
  3. package/lib/index.js +16 -2
  4. package/package.json +6 -6
package/CHANGELOG.md CHANGED
@@ -1,5 +1,23 @@
1
1
  # @pnpm/fetching.binary-fetcher
2
2
 
3
+ ## 1102.0.13
4
+
5
+ ### Patch Changes
6
+
7
+ - Authenticate Node.js runtime downloads from `nodeDownloadMirrors` with URL-scoped npm registry credentials, including bearer tokens, basic auth, and `tokenHelper` [pnpm/pnpm#14334](https://github.com/pnpm/pnpm/issues/14334).
8
+
9
+ - Updated dependencies:
10
+ - @pnpm/error@1100.1.4
11
+ - @pnpm/store.index@1100.3.1
12
+
13
+ ## 1102.0.12
14
+
15
+ ### Patch Changes
16
+
17
+ - Updated dependencies:
18
+ - @pnpm/fetching.fetcher-base@1100.2.9
19
+ - @pnpm/store.index@1100.3.0
20
+
3
21
  ## 1102.0.11
4
22
 
5
23
  ### Patch Changes
package/lib/index.d.ts CHANGED
@@ -1,9 +1,10 @@
1
1
  import type { BinaryFetcher, FetchFunction } from '@pnpm/fetching.fetcher-base';
2
- import type { FetchFromRegistry } from '@pnpm/fetching.types';
2
+ import type { FetchFromRegistry, GetAuthHeader } from '@pnpm/fetching.types';
3
3
  import type { StoreIndex } from '@pnpm/store.index';
4
4
  export interface CreateBinaryFetcherOptions {
5
5
  fetch: FetchFromRegistry;
6
6
  fetchFromRemoteTarball: FetchFunction;
7
+ getAuthHeader?: GetAuthHeader;
7
8
  storeIndex: StoreIndex;
8
9
  offline?: boolean;
9
10
  /**
@@ -21,6 +22,7 @@ export interface AssetInfo {
21
22
  url: string;
22
23
  integrity: string;
23
24
  basename: string;
25
+ authHeaderValue?: string;
24
26
  /**
25
27
  * Regex matched against each zip entry's path relative to the archive's top-level basename.
26
28
  * Matching entries are skipped during extraction.
package/lib/index.js CHANGED
@@ -1,4 +1,5 @@
1
1
  import fsPromises from 'node:fs/promises';
2
+ import { isIP } from 'node:net';
2
3
  import path from 'node:path';
3
4
  import util from 'node:util';
4
5
  import { PnpmError } from '@pnpm/error';
@@ -52,6 +53,7 @@ export function createBinaryFetcher(ctx) {
52
53
  url: resolution.url,
53
54
  integrity: resolution.integrity,
54
55
  basename: resolution.prefix ?? '',
56
+ authHeaderValue: getSecureNodeMirrorAuthHeader(ctx.getAuthHeader, resolution.url, opts.pkg.name),
55
57
  ignoreEntry: archiveFilter?.regex,
56
58
  }, tempLocation);
57
59
  fetchResult = await addFilesFromDir({
@@ -78,6 +80,18 @@ export function createBinaryFetcher(ctx) {
78
80
  binary: fetchBinary,
79
81
  };
80
82
  }
83
+ function getSecureNodeMirrorAuthHeader(getAuthHeader, url, packageName) {
84
+ const authHeaderValue = getAuthHeader?.(url);
85
+ if (authHeaderValue == null || packageName !== 'node')
86
+ return authHeaderValue;
87
+ const parsed = new URL(url);
88
+ if (parsed.protocol === 'https:' || isLoopbackHost(parsed.hostname))
89
+ return authHeaderValue;
90
+ return undefined;
91
+ }
92
+ function isLoopbackHost(hostname) {
93
+ return hostname === 'localhost' || hostname === '[::1]' || (isIP(hostname) === 4 && hostname.startsWith('127.'));
94
+ }
81
95
  /**
82
96
  * Downloads and unpacks a zip file containing a binary asset.
83
97
  *
@@ -105,8 +119,8 @@ export async function downloadAndUnpackZip(fetchFromRegistry, assetInfo, targetD
105
119
  /**
106
120
  * Downloads a file with integrity verification.
107
121
  */
108
- async function downloadWithIntegrityCheck(fetchFromRegistry, { url, integrity }, tmpPath) {
109
- const response = await fetchFromRegistry(url);
122
+ async function downloadWithIntegrityCheck(fetchFromRegistry, { url, integrity, authHeaderValue }, tmpPath) {
123
+ const response = await fetchFromRegistry(url, { authHeaderValue });
110
124
  // Collect all chunks from the response
111
125
  const chunks = [];
112
126
  for await (const chunk of response.body) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@pnpm/fetching.binary-fetcher",
3
- "version": "1102.0.11",
3
+ "version": "1102.0.13",
4
4
  "description": "A fetcher for binary archives",
5
5
  "keywords": [
6
6
  "pnpm",
@@ -27,10 +27,10 @@
27
27
  "!*.map"
28
28
  ],
29
29
  "dependencies": {
30
- "@pnpm/error": "1100.1.3",
31
- "@pnpm/fetching.fetcher-base": "1100.2.8",
30
+ "@pnpm/error": "1100.1.4",
31
+ "@pnpm/fetching.fetcher-base": "1100.2.9",
32
32
  "@pnpm/fetching.types": "1100.0.3",
33
- "@pnpm/store.index": "1100.2.5",
33
+ "@pnpm/store.index": "1100.3.1",
34
34
  "adm-zip": "^0.6.0",
35
35
  "is-subdir": "^2.0.0",
36
36
  "rename-overwrite": "^7.0.1",
@@ -38,11 +38,11 @@
38
38
  "tempy": "3.0.0"
39
39
  },
40
40
  "peerDependencies": {
41
- "@pnpm/worker": "^1100.3.0"
41
+ "@pnpm/worker": "^1100.4.1"
42
42
  },
43
43
  "devDependencies": {
44
44
  "@jest/globals": "30.4.1",
45
- "@pnpm/fetching.binary-fetcher": "1102.0.11",
45
+ "@pnpm/fetching.binary-fetcher": "1102.0.13",
46
46
  "@types/adm-zip": "^0.5.8",
47
47
  "@types/ssri": "^7.1.5",
48
48
  "tempy": "3.0.0"