fix(proxy): replace basic-auth-parser with built-in implementation (#418)

clutz-bot[bot] · jangolano · web-flow · commit 0f40077ee34f · 2026-05-03T12:25:16.000-07:00
Remove the unmaintained `basic-auth-parser` dependency and replace it
with a simple built-in parser. Removes a `require()` call and the
`@ts-expect-error` suppression.

Co-authored-by: clutz-bot[bot] &lt;261721731+clutz-bot[bot]@users.noreply.github.com&gt;
Co-authored-by: jangolano &lt;jangolano@users.noreply.github.com&gt;
diff --git a/.changeset/remove-basic-auth-parser.md b/.changeset/remove-basic-auth-parser.md
@@ -0,0 +1,5 @@
+---
+"proxy": patch
+---
+
+Replace `basic-auth-parser` dependency with built-in implementation
diff --git a/packages/proxy/package.json b/packages/proxy/package.json
@@ -39,7 +39,6 @@
   "license": "MIT",
   "dependencies": {
     "args": "^5.0.3",
-    "basic-auth-parser": "0.0.2-1",
     "debug": "catalog:"
   },
   "devDependencies": {
diff --git a/packages/proxy/src/basic-auth-parser.ts b/packages/proxy/src/basic-auth-parser.ts
@@ -0,0 +1,18 @@
+export interface BasicAuthResult {
+	scheme: string;
+	username?: string;
+	password?: string;
+}
+
+export function basicAuthParser(auth: string): BasicAuthResult {
+	const parts = auth.split(' ');
+	const scheme = parts[0];
+	if (scheme !== 'Basic') {
+		return { scheme };
+	}
+	const decoded = Buffer.from(parts[1], 'base64').toString('utf-8');
+	const colon = decoded.indexOf(':');
+	const username = decoded.substring(0, colon);
+	const password = decoded.substring(colon + 1);
+	return { scheme, username, password };
+}
diff --git a/packages/proxy/src/bin/proxy.ts b/packages/proxy/src/bin/proxy.ts
@@ -3,8 +3,7 @@ import args from 'args';
 import createDebug from 'debug';
 import { spawn } from 'child_process';
 import { once } from 'events';
-// @ts-expect-error no types for "basic-auth-parser"
-import basicAuthParser from 'basic-auth-parser';
+import { basicAuthParser } from '../basic-auth-parser.js';
 import { createProxy } from '../proxy.js';
 //import pkg from '../pkg';
 
diff --git a/packages/proxy/test/basic-auth-parser.test.ts b/packages/proxy/test/basic-auth-parser.test.ts
@@ -0,0 +1,26 @@
+import { basicAuthParser } from '../src/basic-auth-parser';
+
+describe('basicAuthParser', () => {
+	it('should parse Basic auth header', () => {
+		const result = basicAuthParser('Basic YWRtaW46cGFzc3dvcmQ=');
+		expect(result).toEqual({
+			scheme: 'Basic',
+			username: 'admin',
+			password: 'password',
+		});
+	});
+
+	it('should return only scheme for non-Basic auth', () => {
+		const result = basicAuthParser('Digest DEADC0FFEE');
+		expect(result).toEqual({ scheme: 'Digest' });
+	});
+
+	it('should handle colons in password', () => {
+		const result = basicAuthParser('Basic YWRtaW46cGFzczp3b3Jk');
+		expect(result).toEqual({
+			scheme: 'Basic',
+			username: 'admin',
+			password: 'pass:word',
+		});
+	});
+});
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"proxy": patch
 +---
++
 +Replace `basic-auth-parser` dependency with built-in implementation