@pnpm/network.web-auth 1101.1.2 → 1101.2.0

package/lib/index.d.ts

@@ -2,4 +2,4 @@ export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { canonicalHttpUrl, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -2,5 +2,5 @@ export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { canonicalHttpUrl, isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
 //# sourceMappingURL=index.js.map

package/lib/withOtpHandling.d.ts

@@ -69,8 +69,23 @@ export declare class SyntheticOtpError extends Error implements OtpError {
     static fromUnknownBody(globalWarn: OtpContext['globalWarn'], body: unknown): SyntheticOtpError;
 }
 export declare class OtpNonInteractiveError extends PnpmError {
-    constructor();
+    readonly authUrl?: string;
+    readonly doneUrl?: string;
+    constructor(body?: OtpErrorBody);
 }
+/**
+ * Returns the canonical serialization of an `http:`/`https:` URL with any
+ * userinfo (`user:pass@`) stripped, or `undefined` for a non-string, an
+ * unparsable URL, or any other scheme.
+ *
+ * These URLs come from the registry and get displayed, opened in a browser,
+ * and emitted in parseable error output: the scheme restriction keeps a
+ * malicious registry from injecting e.g. a `javascript:` URL into something
+ * that opens it, and stripping userinfo keeps credential-shaped data out of
+ * logs (the capability tokens automation needs live in the path/query, which
+ * are preserved).
+ */
+export declare function canonicalHttpUrl(value: unknown): string | undefined;
 export declare class OtpSecondChallengeError extends PnpmError {
     constructor();
 }

package/lib/withOtpHandling.js

@@ -30,19 +30,21 @@ export async function withOtpHandling({ context, fetchOptions, operation, }) {
         if (!isOtpError(error))
             throw error;
         if (!process.stdin.isTTY || !process.stdout.isTTY) {
-            throw new OtpNonInteractiveError();
+            throw new OtpNonInteractiveError(error.body);
         }
         let otp;
-        if (error.body?.authUrl && error.body?.doneUrl) {
-            const qrCode = generateQrCode(error.body.authUrl);
-            globalInfo(`Authenticate your account at:\n${error.body.authUrl}\n\n${qrCode}`);
+        const authUrl = canonicalHttpUrl(error.body?.authUrl);
+        const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
+        if (authUrl != null && doneUrl != null) {
+            const qrCode = generateQrCode(authUrl);
+            globalInfo(`Authenticate your account at:\n${authUrl}\n\n${qrCode}`);
             const pollPromise = pollForWebAuthToken({
                 context,
-                doneUrl: error.body.doneUrl,
+                doneUrl,
                 fetchOptions,
             });
             otp = await promptBrowserOpen({
-                authUrl: error.body.authUrl,
+                authUrl,
                 context,
                 pollPromise,
             });
@@ -113,10 +115,47 @@ export class SyntheticOtpError extends Error {
     }
 }
 export class OtpNonInteractiveError extends PnpmError {
-    constructor() {
+    authUrl;
+    doneUrl;
+    constructor(body) {
         super('OTP_NON_INTERACTIVE', 'The registry requires additional authentication, but pnpm is not running in an interactive terminal', {
             hint: 'Re-run this command in an interactive terminal to complete authentication, or provide the --otp option if you are using a classic one-time password (OTP)',
         });
+        const authUrl = canonicalHttpUrl(body?.authUrl);
+        if (authUrl != null) {
+            this.authUrl = authUrl;
+        }
+        const doneUrl = canonicalHttpUrl(body?.doneUrl);
+        if (doneUrl != null) {
+            this.doneUrl = doneUrl;
+        }
+    }
+}
+/**
+ * Returns the canonical serialization of an `http:`/`https:` URL with any
+ * userinfo (`user:pass@`) stripped, or `undefined` for a non-string, an
+ * unparsable URL, or any other scheme.
+ *
+ * These URLs come from the registry and get displayed, opened in a browser,
+ * and emitted in parseable error output: the scheme restriction keeps a
+ * malicious registry from injecting e.g. a `javascript:` URL into something
+ * that opens it, and stripping userinfo keeps credential-shaped data out of
+ * logs (the capability tokens automation needs live in the path/query, which
+ * are preserved).
+ */
+export function canonicalHttpUrl(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            return undefined;
+        url.username = '';
+        url.password = '';
+        return url.href;
+    }
+    catch {
+        return undefined;
     }
 }
 export class OtpSecondChallengeError extends PnpmError {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1101.1.2",
+  "version": "1101.2.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -35,7 +35,7 @@
   "devDependencies": {
     "@jest/globals": "30.4.1",
     "@types/qrcode-terminal": "^0.12.2",
-    "@pnpm/network.web-auth": "1101.1.2"
+    "@pnpm/network.web-auth": "1101.2.0"
   },
   "engines": {
     "node": ">=22.13"