Express basic auth is broken

[matteofigus]

This was introduced on #366 and is due to the fact express 4 needs a separate module to handle basic auth. Somehow, we didn't catch this in any test.

@federicomaffei is already working on it.

[debopamsengupta]

Hi, not sure if this is the same issue, but I came across this when looking to enable Basic Auth on a registry:

At https://github.com/opentable/oc/blob/master/src/cli/facade/publish.js#L127 , the parameters route and path are passed to putComponentToRegistry

putComponentToRegistry({ route: componentRoute, path: compressedPackagePath}, next);

and putComponentToRegistry is defined as

var putComponentToRegistry = function(options, cb){
      log.warn(format(strings.messages.cli.PUBLISHING, options.route));

      registry.putComponent(options, function(err, res){

        if(!!err){
       ...

and inside registry.putComponent at https://github.com/opentable/oc/blob/master/src/cli/domain/registry.js#L100

 putComponent: function(options, callback){
      if(!!options.username && !!options.password){
        requestsHeaders = _.extend(requestsHeaders, { 'Authorization': 'Basic ' + new Buffer(options.username + ':' + options.password).toString('base64') });
      }
...

we are checking for username and password, which will never be passed through.

Not sure then how the username and password can be used from the CLI oc publish ...

[matteofigus]

@debopamsengupta I think that a separate issue. The cli actually tries to make an attempt without credentials, and in case of unauthorised, tries again by providing the credentials. In case of the CLI, it prompts the user asking for the values.

You can see that as soon as it has a failing attempt, it retries...
https://github.com/opentable/oc/blob/master/src/cli/facade/publish.js#L72-L82

[debopamsengupta]

@matteofigus would it be possible / would it make sense to enable username and password to be used on the first attempt ?
I ask because I'm trying to automate the publish step using our CI
it will auto-retry if the registry returns Unauthorized

[matteofigus]

@debopamsengupta you know that you can pass username and password on the cli like oc publish component --username=hello --password=... 👍