fix(npm): use configured auth for tarball urls instead of scope auth (#24111)

Deno was using the scope auth for the tarball urls, which is not always
correct. We are going to do a release immediately for this issue.

20 files changed, 88 insertions, 25 deletions

diff --git a/tests/specs/npm/npmrc/.npmrc b/tests/specs/npm/npmrc/.npmrc
index 88c811ad6..13552ad61 100644
--- a/tests/specs/npm/npmrc/.npmrc
+++ b/tests/specs/npm/npmrc/.npmrc
@@ -1,4 +1,4 @@
-@denotest:registry=http://127.0.0.1:4261/
-//127.0.0.1:4261/:_authToken=private-reg-token
-@denotest2:registry=http://127.0.0.1:4262/
-//127.0.0.1:4262/:_authToken=private-reg-token2
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_authToken=private-reg-token
+@denotest2:registry=http://localhost:4262/
+//localhost:4262/:_authToken=private-reg-token2
diff --git a/tests/specs/npm/npmrc/install.out b/tests/specs/npm/npmrc/install.out
index 7484405db..5c2ff3562 100644
--- a/tests/specs/npm/npmrc/install.out
+++ b/tests/specs/npm/npmrc/install.out
@@ -1,7 +1,7 @@
 ⚠️ `deno install` behavior will change in Deno 2. To preserve the current behavior use the `-g` or `--global` flag.
 [UNORDERED_START]
-Download http://127.0.0.1:4261/@denotest/basic
-Download http://127.0.0.1:4262/@denotest2/basic
+Download http://localhost:4261/@denotest/basic
+Download http://localhost:4262/@denotest2/basic
 Download http://localhost:4261/@denotest/basic/1.0.0.tgz
 Download http://localhost:4262/@denotest2/basic/1.0.0.tgz
 Initialize @denotest2/basic@1.0.0
diff --git a/tests/specs/npm/npmrc_bad_registry_config/.npmrc b/tests/specs/npm/npmrc_bad_registry_config/.npmrc
index 709720a45..3897db878 100644
--- a/tests/specs/npm/npmrc_bad_registry_config/.npmrc
+++ b/tests/specs/npm/npmrc_bad_registry_config/.npmrc
@@ -1,5 +1,5 @@
-@denotest:registry=http://127.0.0.1:4261/
+@denotest:registry=http://localhost:4261/
 ; This configuration is wrong - the registry URL must
 ; be exactly the same as registry configured for the scope,
 ; not root url + scope name.
-//127.0.0.1:4261/denotest/:_authToken=invalid-token
+//localhost:4261/denotest/:_authToken=invalid-token
diff --git a/tests/specs/npm/npmrc_bad_registry_config/main.out b/tests/specs/npm/npmrc_bad_registry_config/main.out
index ceee1fed4..17619e5ce 100644
--- a/tests/specs/npm/npmrc_bad_registry_config/main.out
+++ b/tests/specs/npm/npmrc_bad_registry_config/main.out
@@ -1,4 +1,4 @@
 ⚠️ `deno install` behavior will change in Deno 2. To preserve the current behavior use the `-g` or `--global` flag.
-Download http://127.0.0.1:4261/@denotest/basic
-error: Error getting response at http://127.0.0.1:4261/@denotest/basic for package "@denotest/basic": Bad response: 401
+Download http://localhost:4261/@denotest/basic
+error: Error getting response at http://localhost:4261/@denotest/basic for package "@denotest/basic": Bad response: 401
 [WILDCARD]
\ No newline at end of file
diff --git a/tests/specs/npm/npmrc_bad_token/.npmrc b/tests/specs/npm/npmrc_bad_token/.npmrc
index 6ead678f4..04f7c3109 100644
--- a/tests/specs/npm/npmrc_bad_token/.npmrc
+++ b/tests/specs/npm/npmrc_bad_token/.npmrc
@@ -1,2 +1,2 @@
-@denotest:registry=http://127.0.0.1:4261/
-//127.0.0.1:4261/:_authToken=invalid-token
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_authToken=invalid-token
diff --git a/tests/specs/npm/npmrc_bad_token/main.out b/tests/specs/npm/npmrc_bad_token/main.out
index ceee1fed4..17619e5ce 100644
--- a/tests/specs/npm/npmrc_bad_token/main.out
+++ b/tests/specs/npm/npmrc_bad_token/main.out
@@ -1,4 +1,4 @@
 ⚠️ `deno install` behavior will change in Deno 2. To preserve the current behavior use the `-g` or `--global` flag.
-Download http://127.0.0.1:4261/@denotest/basic
-error: Error getting response at http://127.0.0.1:4261/@denotest/basic for package "@denotest/basic": Bad response: 401
+Download http://localhost:4261/@denotest/basic
+error: Error getting response at http://localhost:4261/@denotest/basic for package "@denotest/basic": Bad response: 401
 [WILDCARD]
\ No newline at end of file
diff --git a/tests/specs/npm/npmrc_basic_auth/.npmrc b/tests/specs/npm/npmrc_basic_auth/.npmrc
index c5548f6f6..71177b979 100644
--- a/tests/specs/npm/npmrc_basic_auth/.npmrc
+++ b/tests/specs/npm/npmrc_basic_auth/.npmrc
@@ -1,4 +1,4 @@
-@denotest:registry=http://127.0.0.1:4261/
-//127.0.0.1:4261/:_auth=ZGVubzpsYW5k
-@denotest2:registry=http://127.0.0.1:4262/
-//127.0.0.1:4262/:_auth=ZGVubzpsYW5kMg==
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_auth=ZGVubzpsYW5k
+@denotest2:registry=http://localhost:4262/
+//localhost:4262/:_auth=ZGVubzpsYW5kMg==
diff --git a/tests/specs/npm/npmrc_basic_auth/install.out b/tests/specs/npm/npmrc_basic_auth/install.out
index 7484405db..5c2ff3562 100644
--- a/tests/specs/npm/npmrc_basic_auth/install.out
+++ b/tests/specs/npm/npmrc_basic_auth/install.out
@@ -1,7 +1,7 @@
 ⚠️ `deno install` behavior will change in Deno 2. To preserve the current behavior use the `-g` or `--global` flag.
 [UNORDERED_START]
-Download http://127.0.0.1:4261/@denotest/basic
-Download http://127.0.0.1:4262/@denotest2/basic
+Download http://localhost:4261/@denotest/basic
+Download http://localhost:4262/@denotest2/basic
 Download http://localhost:4261/@denotest/basic/1.0.0.tgz
 Download http://localhost:4262/@denotest2/basic/1.0.0.tgz
 Initialize @denotest2/basic@1.0.0
diff --git a/tests/specs/npm/npmrc_deno_json/.npmrc b/tests/specs/npm/npmrc_deno_json/.npmrc
index cea5a0fad..de3704b92 100644
--- a/tests/specs/npm/npmrc_deno_json/.npmrc
+++ b/tests/specs/npm/npmrc_deno_json/.npmrc
@@ -1,2 +1,2 @@
-@denotest:registry=http://127.0.0.1:4261/
-//127.0.0.1:4261/:_authToken=private-reg-token
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_authToken=private-reg-token
diff --git a/tests/specs/npm/npmrc_deno_json/main.out b/tests/specs/npm/npmrc_deno_json/main.out
index 6a1e47669..62750088b 100644
--- a/tests/specs/npm/npmrc_deno_json/main.out
+++ b/tests/specs/npm/npmrc_deno_json/main.out
@@ -1,4 +1,4 @@
-Download http://127.0.0.1:4261/@denotest/basic
+Download http://localhost:4261/@denotest/basic
 Download http://localhost:4261/@denotest/basic/1.0.0.tgz
 0
 42
diff --git a/tests/specs/npm/npmrc_not_next_to_package_json/.npmrc b/tests/specs/npm/npmrc_not_next_to_package_json/.npmrc
index cea5a0fad..de3704b92 100644
--- a/tests/specs/npm/npmrc_not_next_to_package_json/.npmrc
+++ b/tests/specs/npm/npmrc_not_next_to_package_json/.npmrc
@@ -1,2 +1,2 @@
-@denotest:registry=http://127.0.0.1:4261/
-//127.0.0.1:4261/:_authToken=private-reg-token
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_authToken=private-reg-token
diff --git a/tests/specs/npm/npmrc_tarball_other_server/__test__.jsonc b/tests/specs/npm/npmrc_tarball_other_server/__test__.jsonc
new file mode 100644
index 000000000..dfb311c1e
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/__test__.jsonc
@@ -0,0 +1,17 @@
+{
+  "tempDir": true,
+  "tests": {
+    "auth_success": {
+      "cwd": "success",
+      "args": "run --node-modules-dir -A main.js",
+      "output": "success/main.out",
+      "exitCode": 1
+    },
+    "auth_fail": {
+      "cwd": "fail",
+      "args": "run --node-modules-dir -A main.js",
+      "output": "fail/main.out",
+      "exitCode": 1
+    }
+  }
+}
diff --git a/tests/specs/npm/npmrc_tarball_other_server/fail/.npmrc b/tests/specs/npm/npmrc_tarball_other_server/fail/.npmrc
new file mode 100644
index 000000000..de3704b92
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/fail/.npmrc
@@ -0,0 +1,2 @@
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_authToken=private-reg-token
diff --git a/tests/specs/npm/npmrc_tarball_other_server/fail/main.js b/tests/specs/npm/npmrc_tarball_other_server/fail/main.js
new file mode 100644
index 000000000..176874aa5
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/fail/main.js
@@ -0,0 +1,3 @@
+import getValue from "@denotest/tarballs-privateserver2";
+
+console.log(getValue());
diff --git a/tests/specs/npm/npmrc_tarball_other_server/fail/main.out b/tests/specs/npm/npmrc_tarball_other_server/fail/main.out
new file mode 100644
index 000000000..08a84a477
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/fail/main.out
@@ -0,0 +1,11 @@
+Download http://localhost:4261/@denotest/tarballs-privateserver2
+Download http://localhost:4262/@denotest/tarballs-privateserver2/1.0.0.tgz
+error: Failed caching npm package '@denotest/tarballs-privateserver2@1.0.0'.
+
+Caused by:
+    No auth for tarball URI, but present for scoped registry.
+    
+    Tarball URI: http://localhost:4262/@denotest/tarballs-privateserver2/1.0.0.tgz
+    Scope URI: http://localhost:4261/
+    
+    More info here: https://github.com/npm/cli/wiki/%22No-auth-for-URI,-but-auth-present-for-scoped-registry%22
diff --git a/tests/specs/npm/npmrc_tarball_other_server/fail/package.json b/tests/specs/npm/npmrc_tarball_other_server/fail/package.json
new file mode 100644
index 000000000..2effd6bda
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/fail/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "npmrc_test",
+  "version": "0.0.1",
+  "dependencies": {
+    "@denotest/tarballs-privateserver2": "1.0.0"
+  }
+}
diff --git a/tests/specs/npm/npmrc_tarball_other_server/success/.npmrc b/tests/specs/npm/npmrc_tarball_other_server/success/.npmrc
new file mode 100644
index 000000000..cc2dde26f
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/success/.npmrc
@@ -0,0 +1,3 @@
+@denotest:registry=http://localhost:4261/
+//localhost:4261/:_authToken=private-reg-token
+//localhost:4262/:_authToken=private-reg-token2
diff --git a/tests/specs/npm/npmrc_tarball_other_server/success/main.js b/tests/specs/npm/npmrc_tarball_other_server/success/main.js
new file mode 100644
index 000000000..176874aa5
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/success/main.js
@@ -0,0 +1,3 @@
+import getValue from "@denotest/tarballs-privateserver2";
+
+console.log(getValue());
diff --git a/tests/specs/npm/npmrc_tarball_other_server/success/main.out b/tests/specs/npm/npmrc_tarball_other_server/success/main.out
new file mode 100644
index 000000000..d75f26e33
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/success/main.out
@@ -0,0 +1,10 @@
+Download http://localhost:4261/@denotest/tarballs-privateserver2
+Download http://localhost:4262/@denotest/tarballs-privateserver2/1.0.0.tgz
+[# This fails on a checksum issue, because the test server isn't smart enough]
+[# to serve proper checksums for a package at another registry. That's fine]
+[# though because this shows us that we're making it to this step instead of]
+[# failing sooner on an auth issue.]
+error: Failed caching npm package '@denotest/tarballs-privateserver2@1.0.0'.
+
+Caused by:
+    Tarball checksum did not match [WILDCARD]
diff --git a/tests/specs/npm/npmrc_tarball_other_server/success/package.json b/tests/specs/npm/npmrc_tarball_other_server/success/package.json
new file mode 100644
index 000000000..2effd6bda
--- /dev/null
+++ b/tests/specs/npm/npmrc_tarball_other_server/success/package.json
@@ -0,0 +1,7 @@
+{
+  "name": "npmrc_test",
+  "version": "0.0.1",
+  "dependencies": {
+    "@denotest/tarballs-privateserver2": "1.0.0"
+  }
+}