Marc Mintel
1bdead4df8
Some checks failed
Build & Deploy / 🔍 Prepare (push) Successful in 41s
Build & Deploy / 🧪 QA (push) Failing after 1m1s
Build & Deploy / 🏗️ Build (push) Has been skipped
Build & Deploy / 🚀 Deploy (push) Has been skipped
Build & Deploy / 🧪 Post-Deploy Verification (push) Has been skipped
Build & Deploy / 🔔 Notify (push) Successful in 1s
108 lines
3.7 KiB
Bash
Executable File
108 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
# Hardened Registry Authentication Discovery & Hardening
|
|
# Standard: mmintel/klz-2026
|
|
|
|
set -e
|
|
|
|
REGISTRY_DOMAIN="git.infra.mintel.me"
|
|
REGISTRY_PATH="/api/packages/mmintel/npm/"
|
|
TEST_PACKAGE_ENCODED="%40mintel%2Fmail"
|
|
TEST_URL="https://${REGISTRY_DOMAIN}${REGISTRY_PATH}${TEST_PACKAGE_ENCODED}"
|
|
|
|
echo "🔍 Starting robust functional registry discovery..."
|
|
|
|
# Collect candidate tokens from environment
|
|
# We try them all because NPM_TOKEN might be stale while GITEA_PAT is fresh
|
|
CANDIDATES=""
|
|
[ -n "$NPM_TOKEN" ] && CANDIDATES="${CANDIDATES} NPM_TOKEN"
|
|
[ -n "$GITEA_PAT" ] && CANDIDATES="${CANDIDATES} GITEA_PAT"
|
|
[ -n "$MINTEL_PRIVATE_TOKEN" ] && CANDIDATES="${CANDIDATES} MINTEL_PRIVATE_TOKEN"
|
|
|
|
if [ -z "$CANDIDATES" ]; then
|
|
echo "❌ No registry tokens found in environment (NPM_TOKEN, GITEA_PAT, MINTEL_PRIVATE_TOKEN are empty)."
|
|
exit 1
|
|
fi
|
|
|
|
AUTH_TYPE="None"
|
|
WORKING_TOKEN=""
|
|
|
|
# Function to test connectivity
|
|
check_url() {
|
|
local label=$1
|
|
local auth_header=$2
|
|
local url=$3
|
|
|
|
# Using -k for internal cert resilience
|
|
local code=$(curl -s -k -o /tmp/reg_body -w "%{http_code}" -H "$auth_header" "$url")
|
|
if [ "$code" = "200" ]; then
|
|
return 0
|
|
else
|
|
local body=$(cat /tmp/reg_body | head -c 100)
|
|
echo " $label failed ($code): $body"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
for CANDIDATE_NAME in $CANDIDATES; do
|
|
TOKEN_VAL=$(eval echo "\$$CANDIDATE_NAME")
|
|
echo "Testing token from $CANDIDATE_NAME (length: ${#TOKEN_VAL})..."
|
|
|
|
# 1. Try Bearer
|
|
if check_url "Bearer" "Authorization: Bearer ${TOKEN_VAL}" "${TEST_URL}"; then
|
|
echo "✅ Working Bearer token found in $CANDIDATE_NAME."
|
|
AUTH_TYPE="Bearer"
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
break
|
|
fi
|
|
|
|
# 2. Try Basic (token:x-oauth-basic) - Gitea Standard
|
|
# Encode token:x-oauth-basic
|
|
BASIC_AUTH=$(echo -n "${TOKEN_VAL}:x-oauth-basic" | base64 | tr -d '\n')
|
|
if check_url "Basic (token:x-oauth-basic)" "Authorization: Basic ${BASIC_AUTH}" "${TEST_URL}"; then
|
|
echo "✅ Working Basic (token:x-oauth-basic) found in $CANDIDATE_NAME."
|
|
AUTH_TYPE="Bearer" # Still use _authToken
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
break
|
|
fi
|
|
|
|
# 3. Try Basic (token:empty)
|
|
BASIC_AUTH_EMPTY=$(echo -n "${TOKEN_VAL}:" | base64 | tr -d '\n')
|
|
if check_url "Basic (token:)" "Authorization: Basic ${BASIC_AUTH_EMPTY}" "${TEST_URL}"; then
|
|
echo "✅ Working Basic (token:) found in $CANDIDATE_NAME."
|
|
AUTH_TYPE="Bearer"
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
break
|
|
fi
|
|
|
|
# 4. Try Gitea 'token' header
|
|
if check_url "Token Header" "Authorization: token ${TOKEN_VAL}" "${TEST_URL}"; then
|
|
echo "✅ Working Gitea Token header found in $CANDIDATE_NAME."
|
|
AUTH_TYPE="Bearer"
|
|
WORKING_TOKEN="${TOKEN_VAL}"
|
|
break
|
|
fi
|
|
done
|
|
|
|
# Generate .npmrc
|
|
echo "Generating .npmrc..."
|
|
{
|
|
echo "always-auth=true"
|
|
echo "@mintel:registry=https://${REGISTRY_DOMAIN}${REGISTRY_PATH}"
|
|
|
|
if [ "$AUTH_TYPE" != "None" ]; then
|
|
echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:_authToken=${WORKING_TOKEN}"
|
|
echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:always-auth=true"
|
|
# Fallback without trailing slash for some versions of npm/pnpm
|
|
CLEAN_PATH=$(echo "${REGISTRY_PATH}" | sed 's/\/$//')
|
|
echo "//${REGISTRY_DOMAIN}${CLEAN_PATH}:_authToken=${WORKING_TOKEN}"
|
|
echo "✅ .npmrc hardened with verified $CANDIDATE_NAME."
|
|
else
|
|
echo "❌ ALL functional tests failed. Falling back to NPM_TOKEN (unverified)."
|
|
echo "//${REGISTRY_DOMAIN}${REGISTRY_PATH}:_authToken=${NPM_TOKEN}"
|
|
fi
|
|
} > .npmrc
|
|
|
|
# Debug summary
|
|
echo "Final .npmrc configuration (masked):"
|
|
cat .npmrc | sed 's/_authToken=.*/_authToken=********/'
|