Add authorization

crates/cargo-test-support/src/registry.rs

@@ -15,61 +15,75 @@ use std::sync::Arc;
 use std::thread;
 use tar::{Builder, Header};
 use url::Url;
+use std::ops::Deref;
 
 /// Gets the path to the local index pretending to be crates.io. This is a Git repo
 /// initialized with a `config.json` file pointing to `dl_path` for downloads
 /// and `api_path` for uploads.
 pub fn registry_path() -> PathBuf {
  generate_path("registry")
 }
+
 pub fn registry_url() -> Url {
  generate_url("registry")
 }
+
 /// Gets the path for local web API uploads. Cargo will place the contents of a web API
 /// request here. For example, `api/v1/crates/new` is the result of publishing a crate.
 pub fn api_path() -> PathBuf {
  generate_path("api")
 }
+
 pub fn api_url() -> Url {
  generate_url("api")
 }
+
 /// Gets the path where crates can be downloaded using the web API endpoint. Crates
 /// should be organized as `{name}/{version}/download` to match the web API
 /// endpoint. This is rarely used and must be manually set up.
 pub fn dl_path() -> PathBuf {
  generate_path("dl")
 }
+
 pub fn dl_url() -> Url {
  generate_url("dl")
 }
+
 /// Gets the alternative-registry version of `registry_path`.
 pub fn alt_registry_path() -> PathBuf {
  generate_path("alternative-registry")
 }
+
 pub fn alt_registry_url() -> Url {
  generate_url("alternative-registry")
 }
+
 /// Gets the alternative-registry version of `dl_path`.
 pub fn alt_dl_path() -> PathBuf {
  generate_path("alt_dl")
 }
+
 pub fn alt_dl_url() -> String {
  generate_alt_dl_url("alt_dl")
 }
+
 /// Gets the alternative-registry version of `api_path`.
 pub fn alt_api_path() -> PathBuf {
  generate_path("alt_api")
 }
+
 pub fn alt_api_url() -> Url {
  generate_url("alt_api")
 }
 
 pub fn generate_path(name: &str) -> PathBuf {
  paths::root().join(name)
 }
+
 pub fn generate_url(name: &str) -> Url {
  Url::from_file_path(generate_path(name)).ok().unwrap()
 }
+
 pub fn generate_alt_dl_url(name: &str) -> String {
  let base = Url::from_file_path(generate_path(name)).ok().unwrap();
  format!("{}/{{crate}}/{{version}}/{{crate}}-{{version}}.crate", base)
@@ -239,7 +253,7 @@ impl Drop for RegistryServer {
 }
 
 #[must_use]
-pub fn serve_registry(registry_path: PathBuf) -> RegistryServer {
+pub fn serve_registry(registry_path: PathBuf, auth_token: Option<String>) -> RegistryServer {
  let listener = TcpListener::bind("127.0.0.1:0").unwrap();
  let addr = listener.local_addr().unwrap();
  let done = Arc::new(AtomicBool::new(false));
@@ -274,6 +288,7 @@ pub fn serve_registry(registry_path: PathBuf) -> RegistryServer {
  // Grab some other headers we may care about.
  let mut if_modified_since = None;
  let mut if_none_match = None;
+ let mut token = None;
  loop {
  line.clear();
  if buf.read_line(&mut line).unwrap() == 0 {
@@ -297,9 +312,21 @@ pub fn serve_registry(registry_path: PathBuf) -> RegistryServer {
  if_modified_since = Some(value.to_owned());
  } else if line.starts_with("If-None-Match:") {
  if_none_match = Some(value.trim_matches('"').to_owned());
+ // It would make sense to check the auth. header before the "file.exists()", as
+ // everything after can be skipped. For the tests, it should be enough to check it here.
+ } else if line.starts_with("Authorization:") {
+ token = Some(value.to_owned())
  }
  }
 
+ // Check if authorization is expected and
+ // an authorization token is provided.
+ let authorized = match (&auth_token, token) {
+ (Some(expected), Some(actual)) => expected.deref() == actual,
+ (Some(expected), None) => false,
+ (_, _) => true
+ };
+
  // Now grab info about the file.
  let data = fs::read(&file).unwrap();
  let etag = Sha256::new().update(&data).finish_hex();
@@ -325,7 +352,12 @@ pub fn serve_registry(registry_path: PathBuf) -> RegistryServer {
  }
 
  // Write out the main response line.
- if any_match && all_match {
+ if !authorized {
+ buf.get_mut()
+ .write_all(b"HTTP/1.1 401 Unauthorized\r\n\r\n")
+ .unwrap();
+ }
+ else if any_match && all_match {
  buf.get_mut()
  .write_all(b"HTTP/1.1 304 Not Modified\r\n")
  .unwrap();
@@ -335,19 +367,21 @@ pub fn serve_registry(registry_path: PathBuf) -> RegistryServer {
  // TODO: Support 451 for crate index deletions.
 
  // Write out other headers.
- buf.get_mut()
- .write_all(format!("Content-Length: {}\r\n", data.len()).as_bytes())
- .unwrap();
- buf.get_mut()
- .write_all(format!("ETag: \"{}\"\r\n", etag).as_bytes())
- .unwrap();
- buf.get_mut()
- .write_all(format!("Last-Modified: {}\r\n", last_modified).as_bytes())
- .unwrap();
+ if authorized {
+ buf.get_mut()
+ .write_all(format!("Content-Length: {}\r\n", data.len()).as_bytes())
+ .unwrap();
+ buf.get_mut()
+ .write_all(format!("ETag: \"{}\"\r\n", etag).as_bytes())
+ .unwrap();
+ buf.get_mut()
+ .write_all(format!("Last-Modified: {}\r\n", last_modified).as_bytes())
+ .unwrap();
 
- // And finally, write out the body.
- buf.get_mut().write_all(b"\r\n").unwrap();
- buf.get_mut().write_all(&data).unwrap();
+ // And finally, write out the body.
+ buf.get_mut().write_all(b"\r\n").unwrap();
+ buf.get_mut().write_all(&data).unwrap();
+ }
  } else {
  loop {
  line.clear();
@@ -593,7 +627,7 @@ impl Package {
  "yanked": self.yanked,
  "links": self.links,
  })
- .to_string();
+  .to_string();
 
  let file = match self.name.len() {
  1 => format!("1/{}", self.name),

src/cargo/core/source/source_id.rs

@@ -365,6 +365,10 @@ impl SourceId {
  pub fn full_hash<S: hash::Hasher>(self, into: &mut S) {
  ptr::NonNull::from(self.inner).hash(into)
  }
+
+ pub fn get_name(&self) -> Option<String> {
+ self.inner.name.clone()
+ }
 }
 
 impl PartialEq for SourceId {

src/cargo/sources/config.rs

@@ -33,6 +33,8 @@ struct SourceConfigDef {
  directory: Option<ConfigRelativePath>,
  /// A registry source. Value is a URL.
  registry: OptValue<String>,
+ /// An optional authorization token
+ token: Option<String>,
  /// A local registry source.
  local_registry: Option<ConfigRelativePath>,
  /// A git source. Value is a URL.
@@ -51,6 +53,7 @@ struct SourceConfigDef {
 /// [source.crates-io]
 /// registry = 'https://github.com/rust-lang/crates.io-index'
 /// replace-with = 'foo' # optional
+/// token = 'authorization_token' # optional
 /// ```
 #[derive(Clone)]
 struct SourceConfig {
@@ -64,6 +67,11 @@ struct SourceConfig {
  /// this configuration key was defined (such as the `.cargo/config` path
  /// or the environment variable name).
  replace_with: Option<(String, String)>,
+
+ /// Optional authorization token.
+ ///
+ /// Use to authorize any request to a private registry.
+ token: Option<String>,
 }
 
 impl<'cfg> SourceConfigMap<'cfg> {
@@ -89,11 +97,17 @@ impl<'cfg> SourceConfigMap<'cfg> {
  SourceConfig {
  id: SourceId::crates_io(config)?,
  replace_with: None,
+ token: None,
  },
  )?;
  Ok(base)
  }
 
+ pub fn token(&self, source_id: &SourceId) -> Option<String> {
+ let name: &str = self.id2name[source_id].as_ref();
+ self.cfgs.get(name).and_then(|c| c.token.clone())
+ }
+
  pub fn config(&self) -> &'cfg Config {
  self.config
  }
@@ -269,11 +283,13 @@ restore the source replacement configuration to continue the build
  .replace_with
  .map(|val| (val.val, val.definition.to_string()));
 
+
  self.add(
  &name,
  SourceConfig {
  id: src,
  replace_with,
+ token: def.token,
  },
  )?;
 

src/cargo/sources/registry/http_remote.rs

@@ -61,6 +61,9 @@ pub struct HttpRegistry<'cfg> {
  /// Store the server URL without the protocol prefix (sparse+)
  url: Url,
 
+ /// Store optional authorization token
+ token: Option<String>,
+
  /// Cached HTTP handle for synchronous requests (RegistryData::load).
  http: RefCell<Option<Easy>>,
 
@@ -160,12 +163,16 @@ impl<'cfg> HttpRegistry<'cfg> {
  .into_url()
  .expect("a url with the protocol stripped should still be valid");
 
+ // I bet there is better way to get to the token that I'm not aware of
+ let token=crate::sources::SourceConfigMap::new(&config).unwrap().token(&source_id);
+
  HttpRegistry {
  index_path: config.registry_index_path().join(name),
  cache_path: config.registry_cache_path().join(name),
  source_id,
  config,
  url,
+ token,
  http: RefCell::new(None),
  prefetch: Multi::new(),
  multiplexing: false,
@@ -452,17 +459,22 @@ impl<'cfg> RegistryData for HttpRegistry<'cfg> {
  try_old_curl!(handle.pipewait(true), "pipewait");
 
  // Make sure we don't send data back if it's the same as we have in the index.
+ let mut list = List::new();
  if let Some((ref etag, ref last_modified, _)) = was {
- let mut list = List::new();
  if !etag.is_empty() {
  list.append(&format!("If-None-Match: {}", etag))?;
  }
  if !last_modified.is_empty() {
  list.append(&format!("If-Modified-Since: {}", last_modified))?;
  }
- handle.http_headers(list)?;
  }
 
+ // If an authorization token is set, add it to the headers.
+ if let Some(ref auth_token) = self.token {
+ list.append(&format!("Authorization: {}", auth_token))?;
+ }
+ handle.http_headers(list)?;
+
  // We're going to have a bunch of downloads all happening "at the same time".
  // So, we need some way to track what headers/data/responses are for which request.
  // We do that through this token. Each request (and associated response) gets one.
@@ -732,6 +744,21 @@ impl<'cfg> RegistryData for HttpRegistry<'cfg> {
  paths::remove_file(pkg)?;
  }
  }
+ 401 => {
+ // Not Authorized
+ //
+ // If the registry supports authorization and the authorization
+ // fails for some reason, e.g. missing or wrong token.
+ eprintln!("error: authorization failed. Request needs to be authorized with a token."); // Not sure what the correct why of displaying a meaningful error message is
+
+ // Let cargo handle the "Not Authorized" case the same way, it handles a "Not Found", as in the end
+ // the package is not available to use.
+ let path = self.config.assert_package_cache_locked(&self.index_path);
+ let pkg = path.join(&fetched.path);
+ if pkg.exists() {
+ paths::remove_file(pkg)?;
+ }
+ }
  code => {
  anyhow::bail!(
  "prefetch: server returned unexpected HTTP status code {} for {}{}: {}",
@@ -880,13 +907,18 @@ impl<'cfg> RegistryData for HttpRegistry<'cfg> {
  debug!("fetch {}{}", self.url, path.display());
  handle.url(&format!("{}{}", self.url, path.display()))?;
 
+ let mut list = List::new();
  if let Some((ref etag, ref last_modified, _)) = was {
- let mut list = List::new();
  list.append(&format!("If-None-Match: {}", etag))?;
  list.append(&format!("If-Modified-Since: {}", last_modified))?;
- handle.http_headers(list)?;
  }
 
+ // If an authorization token is set, add it to the headers.
+ if let Some(ref auth_token) = self.token {
+ list.append(&format!("Authorization: {}", auth_token))?;
+ }
+ handle.http_headers(list)?;
+
  let mut contents = Vec::new();
  let mut etag = None;
  let mut last_modified = None;

src/cargo/util/config/de.rs

@@ -527,7 +527,7 @@ impl<'de, 'config> de::MapAccess<'de> for ValueDeserializer<'config> {
  seed.deserialize(Tuple2Deserializer(0i32, path.to_string_lossy()))
  }
  Definition::Environment(env) => {
- seed.deserialize(Tuple2Deserializer(1i32, env.as_ref()))
+ seed.deserialize(Tuple2Deserializer(1i32, env.as_ref() as &str))
  }
  Definition::Cli => seed.deserialize(Tuple2Deserializer(2i32, "")),
  }