Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit8cb4c04

Browse files
committed
fix: verify authentication for default npm registry only
1 parent1e612b6 commit8cb4c04

File tree

3 files changed

+31
-5
lines changed

3 files changed

+31
-5
lines changed

‎lib/verify-auth.js‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,25 @@
11
constexeca=require('execa');
2+
constnormalizeUrl=require('normalize-url');
23
constSemanticReleaseError=require('@semantic-release/error');
34
constgetRegistry=require('./get-registry');
45
constsetNpmrcAuth=require('./set-npmrc-auth');
56

6-
module.exports=async(pluginConfig,pkg,logger)=>{
7+
constDEFAULT_NPM_REGISTRY='https://registry.npmjs.org/';
8+
9+
module.exports=async(
10+
pluginConfig,
11+
pkg,
12+
logger,
13+
defaultRegistry=process.env.DEFAULT_NPM_REGISTRY||DEFAULT_NPM_REGISTRY
14+
)=>{
715
constregistry=awaitgetRegistry(pkg.publishConfig,pkg.name);
816
awaitsetNpmrcAuth(registry,logger);
9-
try{
10-
awaitexeca('npm',['whoami','--registry',registry]);
11-
}catch(err){
12-
thrownewSemanticReleaseError('Invalid npm token.','EINVALIDNPMTOKEN');
17+
18+
if(normalizeUrl(registry)===normalizeUrl(defaultRegistry)){
19+
try{
20+
awaitexeca('npm',['whoami','--registry',registry]);
21+
}catch(err){
22+
thrownewSemanticReleaseError('Invalid npm token.','EINVALIDNPMTOKEN');
23+
}
1324
}
1425
};

‎package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
"fs-extra":"^5.0.0",
2323
"lodash":"^4.17.4",
2424
"nerf-dart":"^1.0.0",
25+
"normalize-url":"^2.0.1",
2526
"npm-conf":"^1.1.3",
2627
"npm-registry-client":"^8.5.0",
2728
"read-pkg":"^3.0.0",

‎test/integration.test.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ test.beforeEach(async t => {
2626
deleteprocess.env.NPM_USERNAME;
2727
deleteprocess.env.NPM_PASSWORD;
2828
deleteprocess.env.NPM_EMAIL;
29+
deleteprocess.env.DEFAULT_NPM_REGISTRY;
2930
// Create a git repository, set the current working directory at the root of the repo
3031
awaitgitRepo();
3132
awaitgitCommit('Initial commit');
@@ -58,6 +59,7 @@ test.serial('Skip npm auth verification if "npmPublish" is false', async t => {
5859

5960
test.serial('Throws error if NPM token is invalid',asynct=>{
6061
process.env.NPM_TOKEN='wrong_token';
62+
process.env.DEFAULT_NPM_REGISTRY=npmRegistry.url;
6163
constpkg={name:'published',version:'1.0.0',publishConfig:{registry:npmRegistry.url}};
6264
awaitoutputJson('./package.json',pkg);
6365
consterror=awaitt.throws(t.context.m.verifyConditions({},{options:{},logger:t.context.logger}));
@@ -70,10 +72,21 @@ test.serial('Throws error if NPM token is invalid', async t => {
7072
t.regex(npmrc,/:_authToken/);
7173
});
7274

75+
test.serial('Skip Token validation if the registry configured is not the default one',asynct=>{
76+
process.env.NPM_TOKEN='wrong_token';
77+
constpkg={name:'published',version:'1.0.0',publishConfig:{registry:'http://custom-registry.com/'}};
78+
awaitoutputJson('./package.json',pkg);
79+
awaitt.notThrows(t.context.m.verifyConditions({},{options:{},logger:t.context.logger}));
80+
81+
constnpmrc=(awaitreadFile('.npmrc')).toString();
82+
t.regex(npmrc,/:_authToken/);
83+
});
84+
7385
test.serial(
7486
'Throws error if NPM token is invalid if "npmPublish" is false and npm plugin used for "getLastRelease"',
7587
asynct=>{
7688
process.env.NPM_TOKEN='wrong_token';
89+
process.env.DEFAULT_NPM_REGISTRY=npmRegistry.url;
7790
constpkg={name:'published',version:'1.0.0',publishConfig:{registry:npmRegistry.url}};
7891
awaitoutputJson('./package.json',pkg);
7992
consterror=awaitt.throws(
@@ -96,6 +109,7 @@ test.serial(
96109
'Throws error if NPM token is invalid if "npmPublish" is false and npm plugin used for "getLastRelease" as an object',
97110
asynct=>{
98111
process.env.NPM_TOKEN='wrong_token';
112+
process.env.DEFAULT_NPM_REGISTRY=npmRegistry.url;
99113
constpkg={name:'published',version:'1.0.0',publishConfig:{registry:npmRegistry.url}};
100114
awaitoutputJson('./package.json',pkg);
101115
consterror=awaitt.throws(

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp