Conversation
Use package-scoped OIDC exchange tokens for dist-tag operations and clear the previous token before each subsequent exchange. Keep temporary credentials in the non-persistable CLI config layer and invalidate flattened options when config values are deleted. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 15207d1d-40b3-4973-9371-b7aba1e286fb
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Notable bug fix: workspace OIDC token reuse
During a single
npm publish --workspacesinvocation, a successful OIDC exchange for workspace A could leave its package-specific token in shared configuration. If workspace B's exchange failed, npm could incorrectly fall back to A's token instead of the original credentials or reportingENEEDAUTHwhen no credentials were available. This PR clears the previous exchanged token before every subsequent OIDC attempt, including attempts that fail or are skipped.Exchanged tokens now use the
cliconfig namespace instead ofuser. Theclilayer is non-persistable, so temporary tokens do not overwrite user credentials (in memory) and cannot be included when saving user configuration. Token deletion also invalidates cached flat options so a stale copy cannot remain available to subsequent operations.Validation
All 1,439 assertions passed: 422 across the affected OIDC and command tests, plus 1,017 in the config workspace.
node node_modules/tap/bin/run.js --no-coverage --reporter=classic test/lib/utils/oidc.js test/lib/commands/dist-tag.js test/lib/commands/publish.js test/lib/commands/stage/index.js (cd workspaces/config && node ../../node_modules/tap/bin/run.js --no-coverage --reporter=classic test)The workspace token-reuse and config cache regression tests were also verified to fail against the existing implementation with the fixes stashed.