azure-devops-npm-auth2

⚠️ Fork Notice & Maintenance Status

This is a maintained fork of azure-devops-npm-auth.\
The original repository is no longer actively maintained and depends on third-party packages with known vulnerabilities.
This fork exists to keep the project usable, secure, and up to date.

Project Status & Rationale

This repository is a maintained fork created to support our team’s continued use of the functionality originally provided by azure-devops-npm-auth.

The original project has not received updates for an extended period and currently depends on third-party packages with known vulnerabilities. As a result, it was no longer viable for use in our environment.

In this fork, all third-party dependencies have been updated to current, secure versions where possible. The openid-connect dependency was intentionally left unchanged, as upgrading it would introduce significant breaking changes. I did not have the capacity to address those changes at this time; however, pull requests to upgrade this dependency are very welcome.

In addition to dependency updates, this fork includes several quality-of-life improvements:
* More colorized and readable console output
* Automatic browser launch on Enter key press
* Automatic copying of the device code to the clipboard

azure-devops-npm-auth

Uses the OAuth 2 device code flow to authenticate against the Azure DevOps artifact private registry.

Why? 🤔

Microsoft provides the vsts-npm-auth package for this task but sadly, it's not cross-platform and doesn't automatically handle token refresh.

There's also better-vsts-npm-auth which solves these issues but requires manual setup (not ideal for a dev team) and authentication through a web app, which in my opinion isn't the best flow to use in the command line.

The azure-devops-npm-auth solves all these problems mainly by using the OAuth 2 device code flow. Once authenticated, access and refresh tokens are then stored in the user's personal .npmrc file, keeping them secure and out of any code repository.

Installation 💪

Simply run npm i azure-devops-npm-auth --save-dev.

Usage 🤷‍♂️

First, add a pre-installation script to your package.json file like so:
``javascript
"scripts": {
"preinstall": "azure-devops-npm-auth"
...
},
`

Then, setup the project repository in the .npmrc file as documented in the Azure DevOps npm feed connection page:

!az devops npm feed connection

When installing packages using npm i, the preinstallation script will be executed and ask you to login using a device code:

!az devops device code flow

Follow the instructions to login and authenticate npm to the Azure DevOps private feed. The following installation should be able to use the refresh token and automate the task of authenticating:

!az devops device code refresh

$3

The updated command output looks like in the image below. In the example it can be seen that two registries have been found.
1. The first Github registry found uses the refresh token.
2. The second DevOps registry launches the device code flow.

!output after update




Advanced Usage 🧙‍♂️

If you want to use your own Azure Active Directory application, it's possible to specify the client_id and tenant_id arguments:

`javascript
"scripts": {
"preinstall": "azure-devops-npm-auth --client_id='xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' --tenant_id='xxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'"
...
},
`

Note: If your Azure Active Directory application is configured to be multitenant, tenant_id can also be common (is the default; Work and school accounts or personal Microsoft accounts), consumers (personal Microsoft accounts) or organizations (work and school accounts).

When creating your own Azure Active Direction application, under the authentication section, you need the configure it to be a public application:

!aad public app

You also need to add the required API permissions to have 'Azure DevOps user_impersonation' and 'Microsoft Graph User.Read':

!aad api permissions

$3

To automate the creation of the above AD app registration in your AD tenant:

1. Ensure you have installed azure-cli
2. Open a powershell core prompt (minimum version 6.1)
3. Run ./register-azure-devops-npm-auth.ps1 -Login -InfA Continue

This will open your default browser where you will need to login to Azure with credentials that has the Azure AD 'Global administrator' RBAC role

$3

To disable authentication within CI environments add the --ci flag which skips authentication when the TF_BUILD environment variable is set (which is automatically set in Azure DevOps build pipelines):
`javascript
"scripts": {
"preinstall": "azure-devops-npm-auth --ci"
...
},
`
It's also possible to specify a custom environment variable:
`javascript
"scripts": {
"preinstall": "azure-devops-npm-auth --ci=MY_CUSTOM_VARIABLE"
...
},
`

$3

You can pass in a path to customize the directory to look in for the project's .npmrc file. The default value is the current working directory:

`javascript
"scripts": {
"preinstall": "azure-devops-npm-auth --project_base_path=./configs"
...
},
``

Note: this is the path to the directory that contains the .npmrc file, meaning you do not need to specify the .npmrc in the path.

Special Thanks 👏

I have to give thanks to the author(s) of better-vsts-npm-auth which was a big inspiration of mine for this project. Also, thanks to openid-client for simplifying the process of integrating the OAuth device code flow to the code.

License 👩‍⚖️

Copyright © 2022, GSoft inc. This code is licensed under the Apache License, Version 2.0. You may obtain a copy of this license at https://github.com/gsoft-inc/gsoft-license/blob/master/LICENSE.