Error caching npm package from gitlab private registry

[JarekToro]

Version: Deno 2.1.6

Seems to be related to #25924
But either was not entirely fixed by #26473 or has since regressed. But I believe it is the latter as It also failed on 2.0.3

.npmrc

@privateregistryname:registry=https://gitlab.company.engineering/api/v4/packages/npm/
//gitlab.company.engineering/api/v4/packages/npm/:_authToken=XXXXXXX

deno.json

{
  "imports": {
    "@privateregistryname/package-name": "npm:@privateregistryname/[email protected]"
  }
}

Command

deno install
error: Failed caching npm package '@privateregistryname/[email protected]'

Caused by:
    Could not find npm package tarball at: 
https://gitlab.company.engineering/api/v4/projects/4055/packages/npm/@privateregistryname/package-name/-/@privateregistryname/package-name-1.0.0.tgz_

[marvinhagemeister]

I just tried it out and I can both publish and install packages from the GitLab npm registry without any issues.

Is the domain correct? Is the project id correct? Does the package with the matching version exist in the registry?

[JarekToro]

The domain is correct. Upon further debugging. Deno seems to have problems when using gitlab instance level registry setup.

example:

@privateregistryname:registry=https://gitlab.company.engineering/api/v4/packages/npm/

However it does work when using a project level registry setup

example:

@privateregistryname:registry=https://gitlab.company.engineering/api/v4/projects/4055/packages/npm/ 

[marvinhagemeister]

Right, I was only trying out the project level setup.

[JarekToro]

@marvinhagemeister Does this ticket need anymore info?

[marvinhagemeister]

no

[JarekToro]

Ok, Im pretty sure I identified the cause and have a workaround.

This problem is that the tarball url has a different pattern then the registry url.

so in ResolvedNpmRc:tarball_config it only does a startsWith check. Which atleast in instance level gitlab registries will not match.

pub fn tarball_config(
    &self,
    tarball_url: &Url,
  ) -> Option<&Arc<RegistryConfig>> {
    // https://example.com/chalk.tgz -> example.com/.tgz
    let registry_url = tarball_url
      .as_str()
      .split_once("//")
      .map(|(_, right)| right)?;
    let mut best_match: Option<(&str, &Arc<RegistryConfig>)> = None;
    for (config_url, config) in &self.registry_configs {
      if registry_url.starts_with(config_url) // <---
        && (best_match.is_none()
          || matches!(best_match, Some((current_config_url, _)) if config_url.len() > current_config_url.len()))
      {
        best_match = Some((config_url, config));
      }
    }
    best_match.map(|(_, config)| config)
  }
}

// Url to authenticate with gitlab registry apis
https://gitlab.company.engineering/api/v4/packages/npm/
// Url of the tarball
https://gitlab.company.engineering/api/v4/projects/4055/packages/npm/@foo/bar/-/...tgz

so when it parses looking for auth info
//gitlab.company.engineering/api/v4/packages/npm/:_authToken=XXXXXX
Doesn't match for the tarball.

Work around

You can set the url higher up in the directory to a point where the paths match.

//gitlab.company.engineering/api/v4/:_authToken=XXXXXX

You can specify each project explicitly with the same token.

One for the registry

//gitlab.company.engineering/api/v4/packages/npm/:_authToken=XXXXXX

And one for each project in github that your trying to install from

//gitlab.company.engineering/api/v4/projects/2650/packages/npm/:_authToken=XXXXXX
//gitlab.company.engineering/api/v4/projects/4055/packages/npm/:_authToken=XXXXXX
//gitlab.company.engineering/api/v4/projects/2580/packages/npm/:_authToken=XXXXXX

Both workarounds work with npm and deno install