@pnpm/network.web-auth 1101.2.0 → 1101.4.0

package/CHANGELOG.md

@@ -0,0 +1,22 @@
+# @pnpm/network.web-auth
+
+## 1101.4.0
+
+### Minor Changes
+
+- `pnpm login` no longer requires an interactive terminal when the registry supports web-based login: without a TTY it prints the authentication URL (skipping the QR code and the "Press ENTER to open the URL in your browser" prompt) and polls the registry until the browser approval completes. Only the classic username/password login still fails with `ERR_PNPM_LOGIN_NON_INTERACTIVE` in a non-interactive terminal.
+
+## 1101.3.0
+
+### Minor Changes
+
+- The token poll for web-based authentication no longer reads the body of non-OK or still-pending (HTTP 202) responses, and caps the token response body it does read at 64 KiB, so a malicious or compromised registry cannot exhaust memory through the poll [pnpm/pnpm#12721](https://github.com/pnpm/pnpm/issues/12721).
+
+- When the authentication URL cannot be rendered as a QR code (for example when it exceeds the maximum QR data capacity), web-based login now displays the URL alone with a warning instead of aborting authentication [pnpm/pnpm#12721](https://github.com/pnpm/pnpm/issues/12721).
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.0

package/lib/formatAuthUrlMessage.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Formats the "Authenticate your account at" message for an authentication
+ * URL, appending a QR code rendering of it when one can be generated.
+ *
+ * The URL itself is the authentication mechanism and the QR code only a
+ * convenience, so a QR generation failure (e.g. a URL exceeding the maximum
+ * QR data capacity) downgrades to a `globalWarn` and a URL-only message
+ * instead of aborting the authentication flow.
+ */
+export declare function formatAuthUrlMessage(authUrl: string, globalWarn: (message: string) => void): string;
+/**
+ * Formats the "Authenticate your account at" message without a QR code — for
+ * output that is not a terminal and cannot render one.
+ */
+export declare function formatAuthUrlOnlyMessage(authUrl: string): string;

package/lib/formatAuthUrlMessage.js

@@ -0,0 +1,29 @@
+import { generateQrCode } from './generateQrCode.js';
+/**
+ * Formats the "Authenticate your account at" message for an authentication
+ * URL, appending a QR code rendering of it when one can be generated.
+ *
+ * The URL itself is the authentication mechanism and the QR code only a
+ * convenience, so a QR generation failure (e.g. a URL exceeding the maximum
+ * QR data capacity) downgrades to a `globalWarn` and a URL-only message
+ * instead of aborting the authentication flow.
+ */
+export function formatAuthUrlMessage(authUrl, globalWarn) {
+    let qrCode;
+    try {
+        qrCode = generateQrCode(authUrl);
+    }
+    catch (err) {
+        globalWarn(`Could not generate a QR code: ${String(err)}`);
+        return formatAuthUrlOnlyMessage(authUrl);
+    }
+    return `${formatAuthUrlOnlyMessage(authUrl)}\n\n${qrCode}`;
+}
+/**
+ * Formats the "Authenticate your account at" message without a QR code — for
+ * output that is not a terminal and cannot render one.
+ */
+export function formatAuthUrlOnlyMessage(authUrl) {
+    return `Authenticate your account at:\n${authUrl}`;
+}
+//# sourceMappingURL=formatAuthUrlMessage.js.map

package/lib/index.d.ts

@@ -1,5 +1,6 @@
+export { formatAuthUrlMessage, formatAuthUrlOnlyMessage } from './formatAuthUrlMessage.js';
 export { generateQrCode } from './generateQrCode.js';
-export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
+export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseBody, type WebAuthFetchResponseBodyReader, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
 export { canonicalHttpUrl, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -1,3 +1,4 @@
+export { formatAuthUrlMessage, formatAuthUrlOnlyMessage } from './formatAuthUrlMessage.js';
 export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, } from './promptBrowserOpen.js';

package/lib/pollForWebAuthToken.d.ts

@@ -12,7 +12,19 @@ export interface WebAuthFetchOptions {
 export interface WebAuthFetchResponseHeaders {
     get: (name: string) => string | null;
 }
+export interface WebAuthFetchResponseBodyReader {
+    read: () => Promise<{
+        done: boolean;
+        value?: Uint8Array;
+    }>;
+    cancel: () => Promise<void>;
+}
+export interface WebAuthFetchResponseBody {
+    cancel: () => Promise<void>;
+    getReader: () => WebAuthFetchResponseBodyReader;
+}
 export interface WebAuthFetchResponse {
+    readonly body?: WebAuthFetchResponseBody | null;
     readonly headers: WebAuthFetchResponseHeaders;
     readonly json: () => Promise<unknown>;
     readonly ok: boolean;

package/lib/pollForWebAuthToken.js

@@ -1,4 +1,11 @@
 import { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
+/**
+ * The most bytes of a poll response body that are read. The expected body is
+ * a small JSON object carrying the token, and the URL it comes from is
+ * registry-controlled, so an unbounded read on every poll tick would let a
+ * malicious or compromised registry grow memory at will.
+ */
+const TOKEN_BODY_LIMIT = 64 * 1024;
 /**
  * Polls a registry's "done" URL until an authentication token is returned.
  *
@@ -27,9 +34,12 @@ export async function pollForWebAuthToken({ context: { Date, fetch, setTimeout }
         catch {
             continue;
         }
-        if (!response.ok)
+        if (!response.ok) {
+            discardBody(response);
             continue;
+        }
         if (response.status === 202) {
+            discardBody(response);
             // Registry is still waiting for authentication.
             // Respect Retry-After header if present by waiting the additional time
             // beyond the default poll interval already elapsed above, but do not
@@ -50,17 +60,86 @@ export async function pollForWebAuthToken({ context: { Date, fetch, setTimeout }
             }
             continue;
         }
-        let body;
+        // eslint-disable-next-line no-await-in-loop
+        const body = await readTokenBody(response);
+        if (body?.token) {
+            return body.token;
+        }
+    }
+}
+/**
+ * Reads and parses a poll response body, applying {@link TOKEN_BODY_LIMIT}
+ * when the raw stream is exposed. Returns `undefined` — which the poll loop
+ * treats the same as an unparsable body, retrying on the next tick — for an
+ * oversized or truncated body.
+ */
+async function readTokenBody(response) {
+    // A response that exposes no readable body stream can only be read whole via
+    // json(), which the size cap cannot bound. The production undici-backed fetch
+    // always exposes `body` as a ReadableStream, so this uncapped path is reached
+    // only by stream-less WebAuthFetch stand-ins (the json()-based test mocks);
+    // every real transport goes through the capped stream read below.
+    if (response.body === undefined) {
         try {
-            // eslint-disable-next-line no-await-in-loop
-            body = await response.json();
+            return await response.json();
         }
         catch {
-            continue;
+            return undefined;
         }
-        if (body.token) {
-            return body.token;
+    }
+    const contentLength = Number(response.headers.get('content-length'));
+    if (Number.isFinite(contentLength) && contentLength > TOKEN_BODY_LIMIT) {
+        discardBody(response);
+        return undefined;
+    }
+    if (response.body === null)
+        return undefined;
+    let reader;
+    try {
+        reader = response.body.getReader();
+    }
+    catch {
+        return undefined;
+    }
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            // eslint-disable-next-line no-await-in-loop
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value == null)
+                continue;
+            total += value.length;
+            if (total > TOKEN_BODY_LIMIT) {
+                reader.cancel().catch(() => { });
+                return undefined;
+            }
+            chunks.push(value);
         }
     }
+    catch {
+        return undefined;
+    }
+    try {
+        return JSON.parse(new TextDecoder().decode(Buffer.concat(chunks)));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Cancels a response body the poll loop will not read (non-ok and 202
+ * responses), so its payload is not transferred on every poll tick.
+ */
+function discardBody(response) {
+    try {
+        response.body?.cancel().catch(() => { });
+    }
+    catch {
+        // Cancellation is best-effort: a body that cannot be cancelled is simply
+        // left unread.
+    }
 }
 //# sourceMappingURL=pollForWebAuthToken.js.map

package/lib/withOtpHandling.js

@@ -1,5 +1,5 @@
 import { PnpmError } from '@pnpm/error';
-import { generateQrCode } from './generateQrCode.js';
+import { formatAuthUrlMessage } from './formatAuthUrlMessage.js';
 import { pollForWebAuthToken } from './pollForWebAuthToken.js';
 import { promptBrowserOpen } from './promptBrowserOpen.js';
 export const isOtpError = (error) => error != null &&
@@ -22,7 +22,7 @@ export const isOtpError = (error) => error != null &&
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
  */
 export async function withOtpHandling({ context, fetchOptions, operation, }) {
-    const { enquirer, globalInfo, process, } = context;
+    const { enquirer, globalInfo, globalWarn, process, } = context;
     try {
         return await operation();
     }
@@ -36,8 +36,7 @@ export async function withOtpHandling({ context, fetchOptions, operation, }) {
         const authUrl = canonicalHttpUrl(error.body?.authUrl);
         const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
         if (authUrl != null && doneUrl != null) {
-            const qrCode = generateQrCode(authUrl);
-            globalInfo(`Authenticate your account at:\n${authUrl}\n\n${qrCode}`);
+            globalInfo(formatAuthUrlMessage(authUrl, globalWarn));
             const pollPromise = pollForWebAuthToken({
                 context,
                 doneUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1101.2.0",
+  "version": "1101.4.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -28,14 +28,14 @@
     "!*.map"
   ],
   "dependencies": {
+    "@pnpm/error": "1100.1.0",
     "open": "^11.0.0",
-    "qrcode-terminal": "^0.12.0",
-    "@pnpm/error": "1100.0.1"
+    "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@types/qrcode-terminal": "^0.12.2",
-    "@pnpm/network.web-auth": "1101.2.0"
+    "@pnpm/network.web-auth": "1101.4.0",
+    "@types/qrcode-terminal": "^0.12.2"
   },
   "engines": {
     "node": ">=22.13"