From c627f1d724b90805d054422877d270f455d60b9e Mon Sep 17 00:00:00 2001
From: Marc Mintel <marc@mintel.me>
Date: Tue, 12 May 2026 11:02:18 +0200
Subject: [PATCH] chore: implement robust registry authentication via
 functional discovery

---
 .gitea/workflows/ci.yml     |  8 ++++--
 .gitea/workflows/deploy.yml | 14 +++++++--
 .gitea/workflows/qa.yml     |  8 ++++--
 scripts/registry-auth.sh    | 57 +++++++++++++++++++++++++++++++++++++
 4 files changed, 80 insertions(+), 7 deletions(-)
 create mode 100755 scripts/registry-auth.sh

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index b4922921e..e60002019 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -25,10 +25,14 @@ jobs:
         with:
           node-version: 20
 
-      - name: Install dependencies
-        run: pnpm install --no-frozen-lockfile
+      - name: 🔐 Registry Auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install dependencies
+        run: pnpm install --no-frozen-lockfile
 
       - name: 🧪 QA Checks
         env:
diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index ba96a4cb7..f1630cb93 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -170,9 +170,13 @@ jobs:
         with:
           node-version: 20
 
-      - name: Install dependencies
+      - name: 🔐 Registry Auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install dependencies
         run: |
           pnpm store prune
           pnpm install --no-frozen-lockfile
@@ -383,10 +387,14 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: 20
-      - name: Install dependencies
-        id: deps
+      - name: 🔐 Registry Auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install dependencies
+        id: deps
         run: |
           pnpm store prune
           pnpm install --no-frozen-lockfile
diff --git a/.gitea/workflows/qa.yml b/.gitea/workflows/qa.yml
index 1b01eb3b0..37044420c 100644
--- a/.gitea/workflows/qa.yml
+++ b/.gitea/workflows/qa.yml
@@ -29,10 +29,14 @@ jobs:
         with:
           path: node_modules
           key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
-      - name: Install
-        if: steps.cache-deps.outputs.cache-hit != 'true'
+      - name: 🔐 Registry Auth
         env:
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITEA_PAT: ${{ secrets.GITEA_PAT }}
+          MINTEL_PRIVATE_TOKEN: ${{ secrets.MINTEL_PRIVATE_TOKEN }}
+        run: bash scripts/registry-auth.sh
+      - name: Install
+        if: steps.cache-deps.outputs.cache-hit != 'true'
         run: pnpm install --no-frozen-lockfile
       - name: 🌐 Install Chrome & Dependencies
         run: |
diff --git a/scripts/registry-auth.sh b/scripts/registry-auth.sh
new file mode 100755
index 000000000..b0651fc6f
--- /dev/null
+++ b/scripts/registry-auth.sh
@@ -0,0 +1,57 @@
+#!/bin/bash
+set -e
+
+# Robust Registry Authentication Script
+# Following Mintel CI/CD Hardening Standards
+
+# 1. Discovery
+TOKENS="${NPM_TOKEN} ${GITEA_PAT} ${MINTEL_PRIVATE_TOKEN}"
+# Add more potential user aliases
+USERS="${GITHUB_REPOSITORY_OWNER} ${GITHUB_ACTOR} marcmintel mintel mmintel"
+
+VALID_TOKEN=""
+VALID_USER=""
+
+echo "🔍 Starting functional registry discovery..."
+
+for T in $TOKENS; do
+    [ -z "$T" ] && continue
+    for U in $USERS; do
+        [ -z "$U" ] && continue
+        
+        T_MASKED="${T:0:4}..."
+        # Use Gitea API to verify token
+        STATUS=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $T" "https://git.infra.mintel.me/api/v1/user" || echo "500")
+        
+        if [ "$STATUS" == "200" ]; then
+            VALID_TOKEN="$T"
+            VALID_USER="$U"
+            echo "✅ Token verified via API (User: $U)"
+            break 2
+        fi
+    done
+done
+
+# Fallback: If API verification failed, try to use NPM_TOKEN if provided
+if [ -z "$VALID_TOKEN" ] && [ -n "$NPM_TOKEN" ]; then
+    echo "⚠️ API verification failed, falling back to provided NPM_TOKEN"
+    VALID_TOKEN="$NPM_TOKEN"
+fi
+
+if [ -z "$VALID_TOKEN" ]; then
+    echo "❌ CRITICAL: No valid registry token found in environment."
+    echo "Available env vars: NPM_TOKEN=${NPM_TOKEN:0:2}..., GITEA_PAT=${GITEA_PAT:0:2}..., MINTEL_PRIVATE_TOKEN=${MINTEL_PRIVATE_TOKEN:0:2}..."
+    exit 1
+fi
+
+# 2. Hardened .npmrc Generation
+# We use the pattern from klz-2026 which is known to work
+cat << EOF > .npmrc
+@mintel:registry=https://git.infra.mintel.me/api/packages/mmintel/npm
+//git.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
+//git.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
+//registry.infra.mintel.me/api/packages/mmintel/npm/:_authToken=${VALID_TOKEN}
+//registry.infra.mintel.me/api/packages/mmintel/npm/:always-auth=true
+EOF
+
+echo "✅ .npmrc hardened and generated."