CHANGELOG.md

@@ -2,6 +2,52 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="4.0.5"></a>
+## [4.0.5](https://github.com/npm/registry-fetch/compare/v4.0.4...v4.0.5) (2020-06-30)
+
+
+
+<a name="4.0.4"></a>
+## [4.0.4](https://github.com/npm/registry-fetch/compare/v4.0.3...v4.0.4) (2020-04-28)
+
+
+
+<a name="4.0.3"></a>
+## [4.0.3](https://github.com/npm/registry-fetch/compare/v4.0.2...v4.0.3) (2020-02-13)
+
+
+### Bug Fixes
+
+* always bypass cache when ?write=true ([ba8b4fe](https://github.com/npm/registry-fetch/commit/ba8b4fe))
+* use 30s default for timeout as per README ([69c2977](https://github.com/npm/registry-fetch/commit/69c2977)), closes [#20](https://github.com/npm/registry-fetch/issues/20)
+
+
+
+<a name="4.0.2"></a>
+## [4.0.2](https://github.com/npm/registry-fetch/compare/v4.0.0...v4.0.2) (2019-10-04)
+
+
+### Bug Fixes
+
+* Add null check on body on 401 errors ([e3a0186](https://github.com/npm/registry-fetch/commit/e3a0186)), closes [#9](https://github.com/npm/registry-fetch/issues/9)
+* **deps:** Add explicit dependency on safe-buffer ([8eae5f0](https://github.com/npm/registry-fetch/commit/8eae5f0)), closes [npm/libnpmaccess#2](https://github.com/npm/libnpmaccess/issues/2) [#3](https://github.com/npm/registry-fetch/issues/3)
+
+
+
+<a name="4.0.0"></a>
+# [4.0.0](https://github.com/npm/registry-fetch/compare/v3.9.1...v4.0.0) (2019-07-15)
+
+
+* cacache@12.0.0, infer uid from cache folder ([0c4f060](https://github.com/npm/registry-fetch/commit/0c4f060))
+
+
+### BREAKING CHANGES
+
+* uid and gid are inferred from cache folder, rather than
+being passed in as options.
+
+
+
 <a name="3.9.1"></a>
 ## [3.9.1](https://github.com/npm/registry-fetch/compare/v3.9.0...v3.9.1) (2019-07-02)
 

README.md

@@ -50,6 +50,25 @@ Happy hacking!
 
 ### API
 
+#### Caching and `write=true` query strings
+
+Before performing any PUT or DELETE operation, npm clients first make a
+GET request to the registry resource being updated, which includes
+the query string `?write=true`.
+
+The semantics of this are, effectively, "I intend to write to this thing,
+and need to know the latest current value, so that my write can land
+cleanly".
+
+The public npm registry handles these `?write=true` requests by ensuring
+that the cache is re-validated before sending a response.  In order to
+maintain the same behavior on the client, and not get tripped up by an
+overeager local cache when we intend to write data to the registry, any
+request that comes through `npm-registry-fetch` that contains `write=true`
+in the query string will forcibly set the `prefer-online` option to `true`,
+and set both `prefer-offline` and `offline` to false, so that any local
+cached value will be revalidated.
+
 #### <a name="fetch"></a> `> fetch(url, [opts]) -> Promise<Response>`
 
 Performs a request to a given URL.
@@ -391,6 +410,9 @@ Force offline mode: no network requests will be done during install. To allow
 This option is only really useful if you're also using
 [`opts.cache`](#opts-cache).
 
+This option is set to `true` when the request includes `write=true` in the
+query string.
+
 ##### <a name="opts-otp"></a> `opts.otp`
 
 * Type: Number | String
@@ -402,7 +424,7 @@ account.
 
 ##### <a name="opts-password"></a> `opts.password`
 
-* Alias: _password
+* Alias: `_password`
 * Type: String
 * Default: null
 
@@ -432,6 +454,9 @@ will be requested from the server. To force full offline mode, use
 This option is generally only useful if you're also using
 [`opts.cache`](#opts-cache).
 
+This option is set to `false` when the request includes `write=true` in the
+query string.
+
 ##### <a name="opts-prefer-online"></a> `opts.prefer-online`
 
 * Type: Boolean
@@ -443,6 +468,8 @@ for updates immediately even for fresh package data.
 This option is generally only useful if you're also using
 [`opts.cache`](#opts-cache).
 
+This option is set to `true` when the request includes `write=true` in the
+query string.
 
 ##### <a name="opts-project-scope"></a> `opts.project-scope`
 
@@ -554,7 +581,7 @@ See also [`opts.ca`](#opts-ca).
 ##### <a name="opts-timeout"></a> `opts.timeout`
 
 * Type: Milliseconds
-* Default: 30000 (30 seconds)
+* Default: 0 (no timeout)
 
 Time before a hanging request times out.
 
@@ -606,4 +633,4 @@ See also [`opts.password`](#opts-password)
 * Default: null
 
 ** DEPRECATED ** This is a legacy authentication token supported only for
-*compatibility. Please use [`opts.token`](#opts-token) instead.
+compatibility. Please use [`opts.token`](#opts-token) instead.

check-response.js

@@ -29,9 +29,19 @@ function logRequest (method, res, startTime, opts) {
   const attempt = res.headers.get('x-fetch-attempts')
   const attemptStr = attempt && attempt > 1 ? ` attempt #${attempt}` : ''
   const cacheStr = res.headers.get('x-local-cache') ? ' (from cache)' : ''
+
+  let urlStr
+  try {
+    const URL = require('url')
+    const url = new URL(res.url)
+    urlStr = res.url.replace(url.password, '***')
+  } catch (er) {
+    urlStr = res.url
+  }
+
   opts.log.http(
     'fetch',
-    `${method.toUpperCase()} ${res.status} ${res.url} ${elapsedTime}ms${attemptStr}${cacheStr}`
+    `${method.toUpperCase()} ${res.status} ${urlStr} ${elapsedTime}ms${attemptStr}${cacheStr}`
   )
 }
 
@@ -95,7 +105,7 @@ function checkErrors (method, res, startTime, opts) {
             method, res, parsed, opts.spec
           )
         }
-      } else if (res.status === 401 && /one-time pass/.test(body.toString('utf8'))) {
+      } else if (res.status === 401 && body != null && /one-time pass/.test(body.toString('utf8'))) {
         // Heuristic for malformed OTP responses that don't include the www-authenticate header.
         throw new errors.HttpErrorAuthOTP(
           method, res, parsed, opts.spec

config.js

@@ -19,7 +19,6 @@ module.exports = figgyPudding({
   'fetch-retry-mintimeout': {},
   'force-auth': {},
   forceAuth: 'force-auth',
-  'gid': {},
   'gzip': {},
   'headers': {},
   'https-proxy': {},
@@ -76,8 +75,9 @@ module.exports = figgyPudding({
   'scope': {},
   'spec': {},
   'strict-ssl': {},
-  'timeout': {},
-  'uid': {},
+  'timeout': {
+    default: 0
+  },
   'user-agent': {
     default: `${
       pkg.name

index.js

@@ -53,26 +53,38 @@ function regFetch (uri, opts) {
       })
     }
   }
-  if (opts.query) {
-    let q = opts.query
+
+  let q = opts.query
+  if (q) {
     if (typeof q === 'string') {
       q = qs.parse(q)
+    } else if (typeof q !== 'object') {
+      throw new TypeError('invalid query option, must be string or object')
     }
     Object.keys(q).forEach(key => {
       if (q[key] === undefined) {
         delete q[key]
       }
     })
-    if (Object.keys(q).length) {
-      const parsed = url.parse(uri)
-      parsed.search = '?' + qs.stringify(
-        parsed.query
-          ? Object.assign(qs.parse(parsed.query), q)
-          : q
-      )
-      uri = url.format(parsed)
+  }
+  const parsed = url.parse(uri)
+
+  const query = parsed.query ? Object.assign(qs.parse(parsed.query), q || {})
+    : Object.keys(q || {}).length ? q
+      : null
+
+  if (query) {
+    if (String(query.write) === 'true' && opts.method === 'GET') {
+      opts = opts.concat({
+        offline: false,
+        'prefer-offline': false,
+        'prefer-online': true
+      })
     }
+    parsed.search = '?' + qs.stringify(query)
+    uri = url.format(parsed)
   }
+
   return opts.Promise.resolve(body).then(body => fetch(uri, {
     agent: opts.agent,
     algorithms: opts.algorithms,
@@ -99,9 +111,7 @@ function regFetch (uri, opts) {
       maxTimeout: opts['fetch-retry-maxtimeout']
     },
     strictSSL: !!opts['strict-ssl'],
-    timeout: opts.timeout,
-    uid: opts.uid,
-    gid: opts.gid
+    timeout: opts.timeout
   }).then(res => checkResponse(
     opts.method || 'GET', res, registry, startTime, opts
   )))