feat(config/getNetworkConfigs): load auth info by KSXGitHub · Pull Request #10491 · pnpm/pnpm

KSXGitHub · 2026-01-21T11:22:46Z

In order to resolve merge conflicts ahead of time for #10385

Copilot

Pull request overview

This PR adds authentication information loading capabilities to the pnpm config system. It introduces a new parseAuthInfo module that handles parsing various authentication formats (_authToken, _auth base64, username/password pairs, and tokenHelper commands) from configuration files, and integrates this functionality into the existing getNetworkConfigs function.

Changes:

Adds parsing and validation for registry authentication information from config files
Extends Config interface to include default registry authentication at the root level
Adds comprehensive test coverage for the new authentication parsing functionality

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
config/config/src/parseAuthInfo.ts	New module for parsing authentication information from various formats, including validation for tokenHelper commands
config/config/test/parseAuthInfo.test.ts	Comprehensive test suite for parseAuthInfo functionality
config/config/src/getNetworkConfigs.ts	Updated to parse and return authentication information alongside SSL configs and registries, plus new getDefaultAuthInfo function
config/config/test/getNetworkConfigs.test.ts	Added test cases for authentication info extraction from network configs
config/config/src/Config.ts	Extended Config interface to include AuthInfo properties at root level
config/config/src/index.ts	Integrated getDefaultAuthInfo to populate default registry auth in pnpmConfig

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

zkochan · 2026-01-22T00:23:52Z

  }
+
+  for (const key in authInfoInputs) {
+    const authInfo = parseAuthInfo(authInfoInputs[key])


why this can't happen inside tryParseAuthSetting?

why this can't happen inside tryParseAuthSetting?

tryParseAuthSetting mirrors the existing tryParseSslSetting. Both functions only return the setting names to target rather than the setting values. And both functions only take the keys of rawConfig, not the values.

However, there is a difference between "auth" and "ssl":

"Ssl" is all strings, so their raw values can be assigned directly to sslConfigs as-is.

But "auth" is structured, so their raw values must be assign to the indirect object named authInfoInputs first.

Why not just assign to authInfos directly, as soon as the field is determined?

Because there are multiple fields that determine username and password (_auth, username, _password). The code must know all the fields in order to decide which fields override which fields. Furthermore, username without a _password or _password without a username result in authUserPass: undefined.

See also:

pnpm/config/config/src/parseAuthInfo.ts

Lines 68 to 89 in 2b039f0

function getAuthUserPass ({

authPairBase64,

authUsername,

authPassword,

}: Pick<AuthInfoInput, 'authPairBase64' | 'authUsername' | 'authPassword'>): AuthUserPass | undefined {

if (authPairBase64) {

const pair = atob(authPairBase64)

const colonIndex = pair.indexOf(':')

if (colonIndex < 0) {

throw new AuthMissingSeparatorError()

}

const username = pair.slice(0, colonIndex)

const password = pair.slice(colonIndex + 1)

return { username, password }

}

if (authUsername && authPassword) {

return { username: authUsername, password: authPassword }

}

return undefined

}

zkochan · 2026-01-22T12:37:14Z

There are some misspelling issues. See the error

KSXGitHub · 2026-01-22T12:45:22Z

There are some misspelling issues. See the error

Should be fixed now.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

* chore(deps): add `libnpmpublish` to catalog * chore(deps): install `libnpmpublish` * feat: publishableManifest (wip) * feat: publishableManifest (wip) * chore(cspell): libnpmpublish * test: fix * feat: validate field and version * chore: @npm/types * chore: todo * refactor: reorganize * feat: transformRequiredFields * chore(deps): patch `libnpmpublish` * fix: `BaseManifest.config` * fix: eslint * chore(git): revert a patch that doesn't work This reverts commit 45f2c6a. We will use type casting * feat: `engines.runtime` * feat: normalize bin * fix: `bin === ''` * test: fix * refactor: inference friendly * feat: `peerDependenciesMeta` * refactor: group into a directory * refactor: use `ramda.pipe` * refactor: less intrusive type assertion * feat!: returning `ExportedManifest` * refactor: remove unnecessary file * docs: add a todo * refactor: getNetworkConfigs (#10458) Some tests are added as a bonus * feat: `publishPackedPkg` (wip) * feat: replace `\t` with 4 spaces * fix: newline * fix: newline * refactor: extract `FailedToPublishError` * test: FailedToPublishError * feat: registryConfigKeys * feat: `publishPackedPkg` (wip) * feat(config/getNetworkConfigs): load auth info * feat(config/getNetworkConfigs): load auth info (#10491) * feat: `publishPackedPkg` (wip) * refactor: extract a `static` function * fix: inheritance, override, and merge * feat: `executeTokenHelper` * fix: use the visible `globalWarn` * feat: add options * feat: add more options * docs: more links * fix: private packages * fix: --dry-run * feat: log more things * fix: name * fix: tag * refactor: remove extraneous `assertPublicPackage` * feat: use `publishPackedPkg` for directories * refactor: require only necessary fields * refactor: extractManifestFromPacked * fix: extractManifestFromPacked * test: extractManifestFromPacked * feat: isTarballPath * feat: use `publishPackedPkg` for tarballs * style: add an empty line for clarity * refactor: remove unnecessary works * feat: --otp * feat: PNPM_CONFIG_OTP * feat: oidc * test: fix name collision * fix: eslint * test: disable a false test * feat: set `provenance` * docs(todo): auto provenance * refactor: run oidc in `createPublishOptions` * fix: correct auth keys for `libnpmpublish` * docs: changeset * fix: incorrect `password` field * fix: typo, grammar * chore(git): resolve merge conflict ahead of time In preparation for #10385 * fix: field name * fix(config): decoding `_password` * fix: edge case of partial `cert`/`key` * fix: ensure `registry` always match its config key * fix: `_password` * test: correct a name * test: more specific assertions * fix: grammar * docs(changeset): fix grammar * docs: fix grammar * fix: clean up after failure * test: fix windows * feat(provenance): auto detect * refactor: consistent name * fix: correct error names * refactor: extract the `provenance` code * feat: show code and body of an error * refactor: use `encodeURIComponent` * refactor: rename a type * refactor: use the try-catch model * refactor: move `normalizeBinObject` * refactor: split `oidc` into `idToken` and `authToken` * refactor: run `next` on `stream`'s `'end'` * fix: use the correct encoding * feat: guard against weird names * test: `transform/engines` Closes #10599 * test: `transformPeerDependenciesMeta` Closes #10600 * refactor: dependency inject the `Date` too * refactor: export an interface * test: oidc Closes #10598 * refactor: re-arrange imports * refactor: remove unnecessary type casts * refactor: improve test

feat(config/getNetworkConfigs): load auth info

515b2ba

In order to resolve merge conflicts ahead of time for #10385

KSXGitHub requested a review from zkochan as a code owner January 21, 2026 11:22

Copilot AI review requested due to automatic review settings January 21, 2026 11:22

Copilot started reviewing on behalf of KSXGitHub January 21, 2026 11:23 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

KSXGitHub added 2 commits January 21, 2026 18:44

fix: seperator of _auth

7c0b1b1

fix: pedantic

2b039f0

zkochan reviewed Jan 22, 2026

View reviewed changes

zkochan requested a review from Copilot January 22, 2026 12:40

Copilot started reviewing on behalf of zkochan January 22, 2026 12:40 View session

fix: spelling

d7d2c1f

Copilot AI reviewed Jan 22, 2026

View reviewed changes

Comment thread config/config/src/parseAuthInfo.ts

Comment thread config/config/test/parseAuthInfo.test.ts

Comment thread config/config/src/parseAuthInfo.ts

zkochan approved these changes Jan 22, 2026

View reviewed changes

zkochan merged commit d019a7c into main Jan 22, 2026
12 of 15 checks passed

zkochan deleted the feat-load-auth-info branch January 22, 2026 13:40

KSXGitHub added a commit that referenced this pull request Jan 22, 2026

feat(config/getNetworkConfigs): load auth info (#10491)

d8938f4

	function getAuthUserPass ({
	authPairBase64,
	authUsername,
	authPassword,
	}: Pick<AuthInfoInput, 'authPairBase64' \| 'authUsername' \| 'authPassword'>): AuthUserPass \| undefined {
	if (authPairBase64) {
	const pair = atob(authPairBase64)
	const colonIndex = pair.indexOf(':')
	if (colonIndex < 0) {
	throw new AuthMissingSeparatorError()
	}
	const username = pair.slice(0, colonIndex)
	const password = pair.slice(colonIndex + 1)
	return { username, password }
	}

	if (authUsername && authPassword) {
	return { username: authUsername, password: authPassword }
	}

	return undefined
	}

Uh oh!

Conversation

KSXGitHub commented Jan 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zkochan Jan 22, 2026

Choose a reason for hiding this comment

Uh oh!

KSXGitHub Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zkochan commented Jan 22, 2026

Uh oh!

KSXGitHub commented Jan 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

KSXGitHub Jan 22, 2026 •

edited

Loading