pnpm i doesn't pick up .npmrc token changes caused by pnpm:devPreinstall script

[MilesWellsSVT]

pnpm version: 7.13.5

Code to reproduce the issue:

"scripts": {
   "pnpm:devPreinstall": "pnpx azure-devops-npm-auth --ci --client_id=[client_id] --tenant_id=[tenant_id]",
}

Expected behavior:

When installing dependencies and the token in $HOME/.npmrc needs to be refreshed, pnpm:devPreinstall will take care of refreshing via azure-devops-npm-auth resulting in a new valid token in $HOME/.npmrc. Then install will pick up the updated .npmrc and authenticate with the private registry.

Actual behavior:

azure-devops-npm-auth does what it's supposed to, but install proceeds with the old token resulting in having to run pnpm i twice.

Obfuscated terminal output:

❯ pnpm i
> [project] pnpm:devPreinstall [project_path]
> pnpx azure-devops-npm-auth --ci --client_id=[client_id] --tenant_id=[tenant_id]

.../Library/pnpm/store/v3/tmp/dlx-68842  |  +63 ++++++
Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /Users/mileswells/Library/pnpm/store/v3
  Virtual store is at:             ../../Library/pnpm/store/v3/tmp/dlx-68842/node_modules/.pnpm
.../Library/pnpm/store/v3/tmp/dlx-68842  | Progress: resolved 63, reused 63, downloaded 0, added 63, done
Found registry [azure_registry]
Trying to use refresh token...
Done! You can now install packages from [azure_registry]

Lockfile is up to date, resolution step is skipped
Packages: +1 -1
+-
 ERR_PNPM_FETCH_401  GET [azure_registry]/[private_package]: Unauthorized - 401

An authorization header was used: Bearer eyJ0[hidden]

These authorization settings were found:
//[registry_location]/npm/:_password=[hidden]
//[registry_location]/npm/:username=[username]
//[registry_location]/npm/registry/:_password=[hidden]
//[registry_location]/npm/registry/:username=[username]
//[registry_location]/npm/registry/:_authToken=eyJ0[hidden]
@[registry_name]:registry=[azure_registry]
Progress: resolved 1, reused 0, downloaded 0, added 0

❯ pnpm i
> [project] pnpm:devPreinstall [project_path]
> pnpx azure-devops-npm-auth --client_id=[client_id] --tenant_id=[tenant_id]

.../Library/pnpm/store/v3/tmp/dlx-68902  |  +63 ++++++
Packages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /Users/mileswells/Library/pnpm/store/v3
  Virtual store is at:             ../../Library/pnpm/store/v3/tmp/dlx-68902/node_modules/.pnpm
.../Library/pnpm/store/v3/tmp/dlx-68902  | Progress: resolved 63, reused 63, downloaded 0, added 63, done
Found registry [azure_registry]
Trying to use refresh token...
Done! You can now install packages from [azure_registry]

Lockfile is up to date, resolution step is skipped
Packages: +1 -1
+-
Progress: resolved 1, reused 0, downloaded 1, added 1, done
[registry_package]: Running preinstall script, done in 15ms

dependencies:
- [registry_package]
+ [registry_package] [updated_version]

[other script output]

Done in 8.1s

Additional information:

• node -v prints: v16.14.2
• Windows, macOS, or Linux?: macOS

[zkochan]

Does it work with npm?

pnpm only reads the configs ones.

You can try to use the token helper setting instead: https://pnpm.io/npmrc#urltokenhelper

[MilesWellsSVT]

Does it work with npm?

preinstall doesn't occur before installing dependencies in npm since v7 which is why we're trying out the pnpm:devPreinstall

You can try to use the token helper setting instead: https://pnpm.io/npmrc#urltokenhelper

Thanks for this suggestion! If we can't find a way to automate out-of-the-box we'll have to write a simple binary to output the token from azure-devops-npm-auth (or some other device code flow binary or our own binary), use this feature, and add that binary to our onboarding process (the step I'm trying to avoid).

If the tokenHelper is the recommended way of handling this scenario then this issue can be closed.

However I'm not convinced this isn't a bug (or maybe it should be a feature request) considering how common it is to need to authenticate with a private registry in the world of proprietary software. For that reason affordances to automate that process seem important to me, but I could be mistaken in it being npm/pnpm's responsibility to provide those affordances.

[dmichon-msft]

An interesting thing I learned about using an Azure DevOps npm feed is that if you are also using Azure DevOps Git, and using Git Credential Manager Core (which is default for Windows Git nowadays) to manage your Git credential, you can reuse the Git credential as your npm token as long as the feed and the Git repository are on the same domain (because Git Credential Manager Core requests Package Read permissions in addition to Code Read + Write).

You can then reference an environment variable in .npmrc (i.e. =${NPM_AUTH_TOKEN}), and have code in your .bashrc, PowerShell Profile, etc. that asks Git for the current credential, base64 encodes it, and stores it in the environment variable for the session. Then your developers only need to update one credential for their typical workflow.

[edumserrano]

Just came across this bug with pnpm version 10.24.0.

It definitely feels like it should be a bug. Any feedback here indicating which direction pnpm plans to take this? Being able to have logic in the pnpm:devPreinstall script that automatically authenticates you to the registry you are using whenever a user runs pnpm i is great for dev experience and simplifying the How to build this repo sections of READMEs.

[icopp]

Does it work with npm?

pnpm only reads the configs ones.

You can try to use the token helper setting instead: https://pnpm.io/npmrc#urltokenhelper

I'm only coming across this years later, but tokenHelper seems pretty useless for the purposes of my company, where we need something platform-independent that can supply a single registry token that all devs have to use to connect to a particular external registry. Requiring an absolute path doesn't work for that for obvious reasons.

[kopach]

I have the same issue. I do have a script in pnpm:devPreinstall, which would ask user for a token if not authorized and write it to ~/.npmrc. Then I have to exit install and print user message to re-run pnpm install.

Another use case: in pnpm:devPreinstall I would like to setup tokenHelper (for dynamic token) and write it to ~/.npmrc. Since PNPM currently doesn't pick this up automatically during same run - I have to exit and again ask user to re-run install.

[Shuuren]

I'm working on a fix for this.

[zkochan]

I am not sure we want to support it. We already have so many ways to set auth tokens. And pnpm:devPreinstall should be probably deprecated.

[icopp]

If that happened, my company would have to switch away from pnpm entirely. We need a way to inject a FontAwesome npm token identically across machines without committing it in plain text, and the only way to do that is with pnpm:devPreinstall. As I commented above, tokenHelper is useless because it can't be committed in the repo in any useful way.

[kopach]

Plese, do not deprecate it. IMO, this is one of the best hidden gemes of PNPM. In my case, I do quite a lot with it which allow me to setup our repo seamlessly almost with one command (including auth of private packages but not only).
Can't wait to have this issue #16292 fixed - it will further improve my setup.