From 228f1e6d9a68702fb375ce9744fc9ed05c0e3850 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 3 Apr 2024 12:06:24 +0100
Subject: [PATCH] feat: use @npmcli/redact for url cleaning

---
 lib/check-response.js |  2 +-
 lib/clean-url.js      | 27 ---------------------------
 lib/index.js          |  5 ++++-
 package.json          |  1 +
 4 files changed, 6 insertions(+), 29 deletions(-)
 delete mode 100644 lib/clean-url.js

diff --git a/lib/check-response.js b/lib/check-response.js
index 066ac3c3..183311d8 100644
--- a/lib/check-response.js
+++ b/lib/check-response.js
@@ -4,7 +4,7 @@ const errors = require('./errors.js')
 const { Response } = require('minipass-fetch')
 const defaultOpts = require('./default-opts.js')
 const log = require('proc-log')
-const cleanUrl = require('./clean-url.js')
+const { redact: cleanUrl } = require('@npmcli/redact')
 
 /* eslint-disable-next-line max-len */
 const moreInfoUrl = 'https://github.com/npm/cli/wiki/No-auth-for-URI,-but-auth-present-for-scoped-registry'
diff --git a/lib/clean-url.js b/lib/clean-url.js
deleted file mode 100644
index 0c2656b5..00000000
--- a/lib/clean-url.js
+++ /dev/null
@@ -1,27 +0,0 @@
-const { URL } = require('url')
-
-const replace = '***'
-const tokenRegex = /\bnpm_[a-zA-Z0-9]{36}\b/g
-const guidRegex = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g
-
-const cleanUrl = (str) => {
-  if (typeof str !== 'string' || !str) {
-    return str
-  }
-
-  try {
-    const url = new URL(str)
-    if (url.password) {
-      url.password = replace
-      str = url.toString()
-    }
-  } catch {
-    // ignore errors
-  }
-
-  return str
-    .replace(tokenRegex, `npm_${replace}`)
-    .replace(guidRegex, `npm_${replace}`)
-}
-
-module.exports = cleanUrl
diff --git a/lib/index.js b/lib/index.js
index bb413f86..1d77a770 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -10,6 +10,7 @@ const qs = require('querystring')
 const url = require('url')
 const zlib = require('minizlib')
 const { Minipass } = require('minipass')
+const { redact: cleanUrl } = require('@npmcli/redact')
 
 const defaultOpts = require('./default-opts.js')
 
@@ -246,4 +247,6 @@ function getHeaders (uri, auth, opts) {
   return headers
 }
 
-module.exports.cleanUrl = require('./clean-url.js')
+// export cleanUrl to avoid a breaking change
+// TODO: next semver major remove this. Consumers should use @npmcli/redact instead
+module.exports.cleanUrl = cleanUrl
diff --git a/package.json b/package.json
index aec92dba..c87f6050 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "dependencies": {
+    "@npmcli/redact": "^0.0.0",
     "make-fetch-happen": "^13.0.0",
     "minipass": "^7.0.2",
     "minipass-fetch": "^3.0.0",