mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-01 02:00:10 +00:00
secustor
e63f40f8b3
`token` and `username`/`password` are not meant to be configured together, but
rank merging of a broad and a specific rule produces a rule carrying both, and
every consumer decided for itself what to do with one. Resolve it once, in
`resolveAuth()`, under a single documented precedence: a `password` wins over a
`token`, with `username` optional because HTTP Basic permits an empty user.
Adopted at the four formatters which already preferred Basic: the HTTP layer's
`applyHostRule()`, the docker datasource, composer's `auth.json` and bundler's
`BUNDLE_*` variables. `basicUserinfo()` and `basicAuthHeaderValue()` replace the
hand-rolled base64 in `util/http/auth.ts` and the docker datasource.
The precedence itself is unchanged at all four. Unifying what counts as a usable
Basic credential does change two of them for a rule that sets `password` without
`username`:
- the docker datasource now sends `Basic base64(":<password>")` for such a rule,
where it previously fell through to the rule's `token`, or sent no credentials
at all - covered by "supports basic authentication for a password without a
username" in lib/modules/datasource/docker/index.spec.ts
- composer now writes an `http-basic` entry with an empty `username` for such a
rule, where it previously wrote nothing - covered by "uses hostRules to set
COMPOSER_AUTH" in lib/modules/manager/composer/artifacts.spec.ts
Both now match what the HTTP layer has always done for the same rule, which is
what authenticates the corresponding lookup. bundler is unaffected, as its
`findAllAuthenticatable()` filter still requires a `username` alongside the
`password`.
`add()` registers the base64 of a password-only credential for sanitizing too,
so the header the widened cases produce is redacted from logs.