Skip to content

Commit 51ab3c8

Browse files
gr2mgr2m
committed
fix: remove support for legacy auth
BREAKING CHANGE: legacy authentication using `NPM_USERNAME` and `NPM_PASSWORD` is no longer supported. Use `NPM_TOKEN` instead.
1 parent c5036aa commit 51ab3c8

File tree

7 files changed

+42
-119
lines changed

7 files changed

+42
-119
lines changed

‎README.md‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,8 @@ Both the [token](https://docs.npmjs.com/getting-started/working_with_tokens) and
4747
| Variable | Description |
4848
| ----------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
4949
| `NPM_TOKEN` | Npm token created via [npm token create](https://docs.npmjs.com/getting-started/working_with_tokens#how-to-create-new-tokens) |
50-
| `NPM_USERNAME` | Npm username created via [npm adduser](https://docs.npmjs.com/cli/adduser) or on [npmjs.com](https://www.npmjs.com) |
51-
| `NPM_PASSWORD` | Password of the npm user. |
52-
| `NPM_EMAIL` | Email address associated with the npm user |
5350
| `NPM_CONFIG_USERCONFIG` | Path to non-default .npmrc file |
5451

55-
Use either `NPM_TOKEN` for token authentication or `NPM_USERNAME`, `NPM_PASSWORD` and `NPM_EMAIL` for legacy authentication
56-
5752
### Options
5853

5954
| Options | Description | Default |

‎index.js‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
import { castArray, defaultTo } from "lodash-es";
22
import AggregateError from "aggregate-error";
33
import { temporaryFile } from "tempy";
4-
import setLegacyToken from "./lib/set-legacy-token.js";
54
import getPkg from "./lib/get-pkg.js";
65
import verifyNpmConfig from "./lib/verify-config.js";
76
import verifyNpmAuth from "./lib/verify-auth.js";
@@ -26,8 +25,6 @@ export async function verifyConditions(pluginConfig, context) {
2625

2726
const errors = verifyNpmConfig(pluginConfig);
2827

29-
setLegacyToken(context);
30-
3128
try {
3229
const pkg = await getPkg(pluginConfig, context);
3330

@@ -49,8 +46,6 @@ export async function verifyConditions(pluginConfig, context) {
4946
export async function prepare(pluginConfig, context) {
5047
const errors = verified ? [] : verifyNpmConfig(pluginConfig);
5148

52-
setLegacyToken(context);
53-
5449
try {
5550
// Reload package.json in case a previous external step updated it
5651
const pkg = await getPkg(pluginConfig, context);
@@ -73,8 +68,6 @@ export async function publish(pluginConfig, context) {
7368
let pkg;
7469
const errors = verified ? [] : verifyNpmConfig(pluginConfig);
7570

76-
setLegacyToken(context);
77-
7871
try {
7972
// Reload package.json in case a previous external step updated it
8073
pkg = await getPkg(pluginConfig, context);
@@ -100,8 +93,6 @@ export async function addChannel(pluginConfig, context) {
10093
let pkg;
10194
const errors = verified ? [] : verifyNpmConfig(pluginConfig);
10295

103-
setLegacyToken(context);
104-
10596
try {
10697
// Reload package.json in case a previous external step updated it
10798
pkg = await getPkg(pluginConfig, context);

‎lib/set-legacy-token.js‎

Lines changed: 0 additions & 6 deletions
This file was deleted.

‎lib/set-npmrc-auth.js‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,7 @@ import nerfDart from "nerf-dart";
66
import AggregateError from "aggregate-error";
77
import getError from "./get-error.js";
88

9-
export default async function (
10-
npmrc,
11-
registry,
12-
{ cwd, env: { NPM_TOKEN, NPM_CONFIG_USERCONFIG, NPM_USERNAME, NPM_PASSWORD, NPM_EMAIL }, logger }
13-
) {
9+
export default async function (npmrc, registry, { cwd, env: { NPM_TOKEN, NPM_CONFIG_USERCONFIG }, logger }) {
1410
logger.log("Verify authentication for registry %s", registry);
1511
const { configs, ...rcConfig } = rc(
1612
"npm",
@@ -29,13 +25,7 @@ export default async function (
2925
return;
3026
}
3127

32-
if (NPM_USERNAME && NPM_PASSWORD && NPM_EMAIL) {
33-
await fs.outputFile(
34-
npmrc,
35-
`${currentConfig ? `${currentConfig}\n` : ""}_auth = \${LEGACY_TOKEN}\nemail = \${NPM_EMAIL}`
36-
);
37-
logger.log(`Wrote NPM_USERNAME, NPM_PASSWORD and NPM_EMAIL to ${npmrc}`);
38-
} else if (NPM_TOKEN) {
28+
if (NPM_TOKEN) {
3929
await fs.outputFile(
4030
npmrc,
4131
`${currentConfig ? `${currentConfig}\n` : ""}${nerfDart(registry)}:_authToken = \${NPM_TOKEN}`

‎test/helpers/npm-registry.js‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import path from "path";
77
import delay from "delay";
88
import pRetry from "p-retry";
99

10-
const IMAGE = "verdaccio/verdaccio:4";
10+
const IMAGE = "verdaccio/verdaccio:5";
1111
const REGISTRY_PORT = 4873;
1212
const REGISTRY_HOST = "localhost";
1313
const NPM_USERNAME = "integration";
@@ -16,7 +16,7 @@ const NPM_EMAIL = "integration@test.com";
1616
const docker = new Docker();
1717
const __dirname = dirname(fileURLToPath(import.meta.url));
1818

19-
let container;
19+
let container, npmToken;
2020

2121
/**
2222
* Download the `npm-registry-docker` Docker image, create a new container and start it.
@@ -57,16 +57,23 @@ export async function start() {
5757
email: NPM_EMAIL,
5858
},
5959
});
60+
61+
// Create token for user
62+
({ token: npmToken } = await got(`http://${REGISTRY_HOST}:${REGISTRY_PORT}/-/npm/v1/tokens`, {
63+
username: NPM_USERNAME,
64+
password: NPM_PASSWORD,
65+
method: "POST",
66+
headers: { "content-type": "application/json" },
67+
json: { password: NPM_PASSWORD, readonly: false, cidr_whitelist: [] },
68+
}).json());
6069
}
6170

6271
export const url = `http://${REGISTRY_HOST}:${REGISTRY_PORT}/`;
6372

64-
export const authEnv = {
73+
export const authEnv = () => ({
6574
npm_config_registry: url, // eslint-disable-line camelcase
66-
NPM_USERNAME,
67-
NPM_PASSWORD,
68-
NPM_EMAIL,
69-
};
75+
NPM_TOKEN: npmToken,
76+
});
7077

7178
/**
7279
* Stop and remove the `npm-registry-docker` Docker container.

‎test/integration.test.js‎

Lines changed: 26 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,17 @@ import * as npmRegistry from "./helpers/npm-registry.js";
1010
/* eslint camelcase: ["error", {properties: "never"}] */
1111

1212
// Environment variables used only for the local npm command used to do verification
13-
const testEnv = {
14-
...process.env,
15-
...npmRegistry.authEnv,
16-
npm_config_registry: npmRegistry.url,
17-
LEGACY_TOKEN: Buffer.from(`${npmRegistry.authEnv.NPM_USERNAME}:${npmRegistry.authEnv.NPM_PASSWORD}`, "utf8").toString(
18-
"base64"
19-
),
20-
};
13+
let testEnv;
2114

2215
test.before(async () => {
2316
// Start the local NPM registry
2417
await npmRegistry.start();
18+
19+
testEnv = {
20+
...process.env,
21+
...npmRegistry.authEnv(),
22+
npm_config_registry: npmRegistry.url,
23+
};
2524
});
2625

2726
test.after.always(async () => {
@@ -131,7 +130,7 @@ test("Verify npm auth and package", async (t) => {
131130
{},
132131
{
133132
cwd,
134-
env: npmRegistry.authEnv,
133+
env: npmRegistry.authEnv(),
135134
options: {},
136135
stdout: t.context.stdout,
137136
stderr: t.context.stderr,
@@ -150,7 +149,7 @@ test("Verify npm auth and package from a sub-directory", async (t) => {
150149
{ pkgRoot: "dist" },
151150
{
152151
cwd,
153-
env: npmRegistry.authEnv,
152+
env: npmRegistry.authEnv(),
154153
options: {},
155154
stdout: t.context.stdout,
156155
stderr: t.context.stderr,
@@ -169,7 +168,7 @@ test('Verify npm auth and package with "npm_config_registry" env var set by yarn
169168
{},
170169
{
171170
cwd,
172-
env: { ...npmRegistry.authEnv, npm_config_registry: "https://registry.yarnpkg.com" },
171+
env: { ...npmRegistry.authEnv(), npm_config_registry: "https://registry.yarnpkg.com" },
173172
options: { publish: [] },
174173
stdout: t.context.stdout,
175174
stderr: t.context.stderr,
@@ -216,7 +215,7 @@ test("Throw SemanticReleaseError Array if config option are not valid in verifyC
216215

217216
test("Publish the package", async (t) => {
218217
const cwd = temporaryDirectory();
219-
const env = npmRegistry.authEnv;
218+
const env = npmRegistry.authEnv();
220219
const pkg = { name: "publish", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
221220
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
222221

@@ -241,7 +240,7 @@ test("Publish the package", async (t) => {
241240

242241
test("Publish the package on a dist-tag", async (t) => {
243242
const cwd = temporaryDirectory();
244-
const env = { ...npmRegistry.authEnv, DEFAULT_NPM_REGISTRY: npmRegistry.url };
243+
const env = { ...npmRegistry.authEnv(), DEFAULT_NPM_REGISTRY: npmRegistry.url };
245244
const pkg = { name: "publish-tag", version: "0.0.0", publishConfig: { registry: npmRegistry.url, tag: "next" } };
246245
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
247246

@@ -270,7 +269,7 @@ test("Publish the package on a dist-tag", async (t) => {
270269

271270
test("Publish the package from a sub-directory", async (t) => {
272271
const cwd = temporaryDirectory();
273-
const env = npmRegistry.authEnv;
272+
const env = npmRegistry.authEnv();
274273
const pkg = { name: "publish-sub-dir", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
275274
await fs.outputJson(path.resolve(cwd, "dist/package.json"), pkg);
276275

@@ -295,7 +294,7 @@ test("Publish the package from a sub-directory", async (t) => {
295294

296295
test('Create the package and skip publish ("npmPublish" is false)', async (t) => {
297296
const cwd = temporaryDirectory();
298-
const env = npmRegistry.authEnv;
297+
const env = npmRegistry.authEnv();
299298
const pkg = { name: "skip-publish", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
300299
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
301300

@@ -320,7 +319,7 @@ test('Create the package and skip publish ("npmPublish" is false)', async (t) =>
320319

321320
test('Create the package and skip publish ("package.private" is true)', async (t) => {
322321
const cwd = temporaryDirectory();
323-
const env = npmRegistry.authEnv;
322+
const env = npmRegistry.authEnv();
324323
const pkg = {
325324
name: "skip-publish-private",
326325
version: "0.0.0",
@@ -350,7 +349,7 @@ test('Create the package and skip publish ("package.private" is true)', async (t
350349

351350
test('Create the package and skip publish from a sub-directory ("npmPublish" is false)', async (t) => {
352351
const cwd = temporaryDirectory();
353-
const env = npmRegistry.authEnv;
352+
const env = npmRegistry.authEnv();
354353
const pkg = { name: "skip-publish-sub-dir", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
355354
await fs.outputJson(path.resolve(cwd, "dist/package.json"), pkg);
356355

@@ -375,7 +374,7 @@ test('Create the package and skip publish from a sub-directory ("npmPublish" is
375374

376375
test('Create the package and skip publish from a sub-directory ("package.private" is true)', async (t) => {
377376
const cwd = temporaryDirectory();
378-
const env = npmRegistry.authEnv;
377+
const env = npmRegistry.authEnv();
379378
const pkg = {
380379
name: "skip-publish-sub-dir-private",
381380
version: "0.0.0",
@@ -440,7 +439,7 @@ test("Throw SemanticReleaseError Array if config option are not valid in publish
440439

441440
test("Prepare the package", async (t) => {
442441
const cwd = temporaryDirectory();
443-
const env = npmRegistry.authEnv;
442+
const env = npmRegistry.authEnv();
444443
const pkg = { name: "prepare", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
445444
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
446445

@@ -463,7 +462,7 @@ test("Prepare the package", async (t) => {
463462

464463
test("Prepare the package from a sub-directory", async (t) => {
465464
const cwd = temporaryDirectory();
466-
const env = npmRegistry.authEnv;
465+
const env = npmRegistry.authEnv();
467466
const pkg = { name: "prepare-sub-dir", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
468467
await fs.outputJson(path.resolve(cwd, "dist/package.json"), pkg);
469468

@@ -521,7 +520,7 @@ test("Throw SemanticReleaseError Array if config option are not valid in prepare
521520

522521
test("Publish the package and add to default dist-tag", async (t) => {
523522
const cwd = temporaryDirectory();
524-
const env = npmRegistry.authEnv;
523+
const env = npmRegistry.authEnv();
525524
const pkg = { name: "add-channel", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
526525
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
527526

@@ -557,7 +556,7 @@ test("Publish the package and add to default dist-tag", async (t) => {
557556

558557
test("Publish the package and add to lts dist-tag", async (t) => {
559558
const cwd = temporaryDirectory();
560-
const env = npmRegistry.authEnv;
559+
const env = npmRegistry.authEnv();
561560
const pkg = { name: "add-channel-legacy", version: "1.0.0", publishConfig: { registry: npmRegistry.url } };
562561
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
563562

@@ -596,7 +595,7 @@ test("Publish the package and add to lts dist-tag", async (t) => {
596595

597596
test('Skip adding the package to a channel ("npmPublish" is false)', async (t) => {
598597
const cwd = temporaryDirectory();
599-
const env = npmRegistry.authEnv;
598+
const env = npmRegistry.authEnv();
600599
const pkg = { name: "skip-add-channel", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
601600
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
602601

@@ -619,7 +618,7 @@ test('Skip adding the package to a channel ("npmPublish" is false)', async (t) =
619618

620619
test('Skip adding the package to a channel ("package.private" is true)', async (t) => {
621620
const cwd = temporaryDirectory();
622-
const env = npmRegistry.authEnv;
621+
const env = npmRegistry.authEnv();
623622
const pkg = {
624623
name: "skip-add-channel-private",
625624
version: "0.0.0",
@@ -647,7 +646,7 @@ test('Skip adding the package to a channel ("package.private" is true)', async (
647646

648647
test("Create the package in addChannel step", async (t) => {
649648
const cwd = temporaryDirectory();
650-
const env = npmRegistry.authEnv;
649+
const env = npmRegistry.authEnv();
651650
const pkg = { name: "add-channel-pkg", version: "0.0.0", publishConfig: { registry: npmRegistry.url } };
652651
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
653652

@@ -670,7 +669,7 @@ test("Create the package in addChannel step", async (t) => {
670669

671670
test("Throw SemanticReleaseError Array if config option are not valid in addChannel", async (t) => {
672671
const cwd = temporaryDirectory();
673-
const env = npmRegistry.authEnv;
672+
const env = npmRegistry.authEnv();
674673
const pkg = { publishConfig: { registry: npmRegistry.url } };
675674
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
676675
const npmPublish = 42;
@@ -706,7 +705,7 @@ test("Throw SemanticReleaseError Array if config option are not valid in addChan
706705

707706
test("Verify token and set up auth only on the fist call, then prepare on prepare call only", async (t) => {
708707
const cwd = temporaryDirectory();
709-
const env = npmRegistry.authEnv;
708+
const env = npmRegistry.authEnv();
710709
const pkg = { name: "test-module", version: "0.0.0-dev", publishConfig: { registry: npmRegistry.url } };
711710
await fs.outputJson(path.resolve(cwd, "package.json"), pkg);
712711

0 commit comments

Comments
 (0)