feat: use RATTLER_AUTH_FILE and use proper reqwest clients in search

docs/advanced/authentication.md

@@ -67,3 +67,34 @@ On Linux, one can use `GNOME Keyring` (or just Keyring) to access credentials th
 
 If you run on a server with none of the aforementioned keychains available, then pixi falls back to store the credentials in an _insecure_ JSON file.
 This JSON file is located at `~/.rattler/credentials.json` and contains the credentials.
+
+## Override the authentication storage
+
+You can use the `RATTLER_AUTH_FILE` environment variable to override the default location of the credentials file. When this environment variable is set, it provides the only source of authentication data that is used by pixi.
+
+E.g.
+
+```bash
+export RATTLER_AUTH_FILE=$HOME/credentials.json
+```
+
+The JSON should follow the following format:
+
+```json
+{
+    "*.prefix.dev": {
+        "BearerToken": "your_token"
+    },
+    "otherhost.com": {
+        "BasicHttp": {
+            "username": "your_username",
+            "password": "your_password"
+        }
+    },
+    "conda.anaconda.org": {
+        "CondaToken": "your_token"
+    }
+}
+```
+
+Note: if you use a wildcard in the host, any subdomain will match (e.g. `*.prefix.dev` also matches `repo.prefix.dev`).

src/cli/global/common.rs

@@ -1,17 +1,20 @@
 use std::path::PathBuf;
-use std::sync::Arc;
 
 use indexmap::IndexMap;
 use miette::IntoDiagnostic;
 use rattler_conda_types::{
     Channel, ChannelConfig, MatchSpec, PackageName, Platform, PrefixRecord, RepoDataRecord,
 };
-use rattler_networking::AuthenticationMiddleware;
 use rattler_repodata_gateway::sparse::SparseRepoData;
 use rattler_solve::{resolvo, SolverImpl, SolverTask};
 use reqwest_middleware::ClientWithMiddleware;
 
-use crate::{config::home_path, prefix::Prefix, repodata};
+use crate::{
+    config::{home_path, Config},
+    prefix::Prefix,
+    repodata,
+    utils::reqwest::build_reqwest_clients,
+};
 
 /// Global binaries directory, default to `$HOME/.pixi/bin`
 pub struct BinDir(pub PathBuf);
@@ -173,13 +176,12 @@ pub fn load_package_records(
 /// The network client and the fetched sparse repodata
 pub(super) async fn get_client_and_sparse_repodata(
     channels: impl IntoIterator<Item = &'_ Channel>,
+    config: &Config,
 ) -> miette::Result<(
     ClientWithMiddleware,
     IndexMap<(Channel, Platform), SparseRepoData>,
 )> {
-    let authenticated_client = reqwest_middleware::ClientBuilder::new(reqwest::Client::new())
-        .with_arc(Arc::new(AuthenticationMiddleware::default()))
-        .build();
+    let authenticated_client = build_reqwest_clients(Some(config)).1;
     let platform_sparse_repodata =
         repodata::fetch_sparse_repodata(channels, [Platform::current()], &authenticated_client)
             .await?;

src/cli/global/install.rs

@@ -243,7 +243,8 @@ pub async fn execute(args: Args) -> miette::Result<()> {
         .into_diagnostic()?;
 
     // Fetch sparse repodata
-    let (authenticated_client, sparse_repodata) = get_client_and_sparse_repodata(&channels).await?;
+    let (authenticated_client, sparse_repodata) =
+        get_client_and_sparse_repodata(&channels, &config).await?;
 
     // Install the package(s)
     let mut executables = vec![];

src/cli/global/upgrade.rs

@@ -84,7 +84,8 @@ pub async fn execute(args: Args) -> miette::Result<()> {
     channels = channels.into_iter().unique().collect::<Vec<_>>();
 
     // Fetch sparse repodata
-    let (authenticated_client, sparse_repodata) = get_client_and_sparse_repodata(&channels).await?;
+    let (authenticated_client, sparse_repodata) =
+        get_client_and_sparse_repodata(&channels, &config).await?;
 
     let records = load_package_records(package_matchspec, &sparse_repodata)?;
     let package_record = records

src/cli/global/upgrade_all.rs

@@ -58,7 +58,8 @@ pub async fn execute(args: Args) -> miette::Result<()> {
     channels = channels.into_iter().unique().collect::<Vec<_>>();
 
     // Fetch sparse repodata
-    let (authenticated_client, sparse_repodata) = get_client_and_sparse_repodata(&channels).await?;
+    let (authenticated_client, sparse_repodata) =
+        get_client_and_sparse_repodata(&channels, &config).await?;
 
     let mut upgraded = false;
     for package_name in packages.iter() {

src/cli/search.rs

@@ -7,14 +7,14 @@ use indexmap::IndexMap;
 use itertools::Itertools;
 use miette::IntoDiagnostic;
 use rattler_conda_types::{Channel, PackageName, Platform, RepoDataRecord};
-use rattler_networking::AuthenticationMiddleware;
 use rattler_repodata_gateway::sparse::SparseRepoData;
 use regex::Regex;
 
 use strsim::jaro;
 use tokio::task::spawn_blocking;
 
 use crate::config::Config;
+use crate::utils::reqwest::build_reqwest_clients;
 use crate::{progress::await_in_progress, repodata::fetch_sparse_repodata, Project};
 
 /// Search a package, output will list the latest version of package
@@ -137,12 +137,14 @@ pub async fn execute(args: Args) -> miette::Result<()> {
 
     let package_name_filter = args.package;
 
-    let authenticated_client = reqwest_middleware::ClientBuilder::new(reqwest::Client::new())
-        .with_arc(Arc::new(AuthenticationMiddleware::default()))
-        .build();
-    let repo_data = Arc::new(
-        fetch_sparse_repodata(channels.iter(), [args.platform], &authenticated_client).await?,
-    );
+    let client = if let Some(project) = project.as_ref() {
+        project.authenticated_client().clone()
+    } else {
+        build_reqwest_clients(None).1
+    };
+
+    let repo_data =
+        Arc::new(fetch_sparse_repodata(channels.iter(), [args.platform], &client).await?);
 
     // When package name filter contains * (wildcard), it will search and display a list of packages matching this filter
     if package_name_filter.contains('*') {

src/utils/reqwest.rs

@@ -1,6 +1,9 @@
-use std::{sync::Arc, time::Duration};
+use std::{path::PathBuf, sync::Arc, time::Duration};
 
-use rattler_networking::{retry_policies::ExponentialBackoff, AuthenticationMiddleware};
+use rattler_networking::{
+    authentication_storage, retry_policies::ExponentialBackoff, AuthenticationMiddleware,
+    AuthenticationStorage,
+};
 use reqwest::Client;
 use reqwest_middleware::{ClientBuilder, ClientWithMiddleware};
 
@@ -12,6 +15,21 @@ pub fn default_retry_policy() -> ExponentialBackoff {
     ExponentialBackoff::builder().build_with_max_retries(3)
 }
 
+fn auth_middleware() -> AuthenticationMiddleware {
+    if let Ok(auth_file) = std::env::var("RATTLER_AUTH_FILE") {
+        tracing::info!("Loading authentication from file: {:?}", auth_file);
+
+        let mut store = AuthenticationStorage::new();
+        store.add_backend(Arc::from(
+            authentication_storage::backends::file::FileStorage::new(PathBuf::from(&auth_file)),
+        ));
+
+        return AuthenticationMiddleware::new(store);
+    }
+
+    AuthenticationMiddleware::default()
+}
+
 pub(crate) fn build_reqwest_clients(config: Option<&Config>) -> (Client, ClientWithMiddleware) {
     static APP_USER_AGENT: &str = concat!(env!("CARGO_PKG_NAME"), "/", env!("CARGO_PKG_VERSION"),);
 
@@ -36,7 +54,7 @@ pub(crate) fn build_reqwest_clients(config: Option<&Config>) -> (Client, ClientW
         .expect("failed to create reqwest Client");
 
     let authenticated_client = ClientBuilder::new(client.clone())
-        .with_arc(Arc::new(AuthenticationMiddleware::default()))
+        .with_arc(Arc::new(auth_middleware()))
         .build();
 
     (client, authenticated_client)