fix: 🔒 don't write the auth token in npmrc (#31)

ghusse · Dec 31, 2021 · 7669fce · 7669fce
1 parent 1da5ea7
commit 7669fce
Show file tree

Hide file tree

Showing 4 changed files with 6 additions and 10 deletions.
diff --git a/src/authentifier.test.ts b/src/authentifier.test.ts
@@ -35,7 +35,6 @@ describe("Authentifier", () => {
         npm.authenticate(
           {
             registry: npmConfig.registry,
-            token: "token",
           },
           instance(context)
         )

diff --git a/src/authentifier.ts b/src/authentifier.ts
@@ -15,10 +15,7 @@ export class Authentifier {
       throw new Error("NPM TOKEN needs to be set");
     }
 
-    await this.npm.authenticate(
-      { registry: npmConfig.registry, token: env.NPM_TOKEN },
-      context
-    );
+    await this.npm.authenticate({ registry: npmConfig.registry }, context);
 
     logger.log("npm token set");
   }

diff --git a/src/npm.test.ts b/src/npm.test.ts
@@ -36,7 +36,7 @@ describe("npm", () => {
             "config",
             "set",
             "//registry.npmjs.org/:_authToken",
-            "token",
+            "${NPM_TOKEN}",
             "--json",
           ],
           {
@@ -47,7 +47,7 @@ describe("npm", () => {
       ).thenResolve(undefined as any);
 
       await npm.authenticate(
-        { registry: "https://registry.npmjs.org", token: "token" },
+        { registry: "https://registry.npmjs.org/" },
         instance(context)
       );
 

diff --git a/src/npm.ts b/src/npm.ts
@@ -28,12 +28,12 @@ export class Npm {
   constructor(private readonly execa: Execa) {}
 
   public async authenticate(
-    { registry, token }: { registry: string; token: string },
+    { registry }: { registry: string },
     context: Context & Config
   ): Promise<void> {
-    const registryUrl = registry.replace(/^https?:/, "");
+    const registryUrl = registry.replace(/^https?:/, "").replace(/\/$/, "");
     await this.runJsonNpm(
-      ["config", "set", `${registryUrl}/:_authToken`, token],
+      ["config", "set", `${registryUrl}/:_authToken`, "${NPM_TOKEN}"],
       context
     );
   }