Fix registry auth comparison for explicit port numbers

__tests__/registries/is-request-to-registry.js

@@ -0,0 +1,46 @@
+/* @flow */
+/* eslint yarn-internal/warn-language: 0 */
+
+import isRequestToRegistry from '../../src/registries/is-request-to-registry.js';
+
+test('isRequestToRegistry functional test', () => {
+  expect(isRequestToRegistry(
+    'http://foo.bar:80/foo/bar/baz',
+    'http://foo.bar/foo/',
+  )).toBe(true);
+
+  expect(isRequestToRegistry(
+    'http://foo.bar/foo/bar/baz',
+    'http://foo.bar/foo/',
+  )).toBe(true);
+
+  expect(isRequestToRegistry(
+    'https://foo.bar:443/foo/bar/baz',
+    'https://foo.bar/foo/',
+  )).toBe(true);
+
+  expect(isRequestToRegistry(
+      'https://foo.bar/foo/bar/baz',
+      'https://foo.bar:443/foo/',
+    )).toBe(true);
+
+  expect(isRequestToRegistry(
+    'http://foo.bar:80/foo/bar/baz',
+    'https://foo.bar/foo/',
+  )).toBe(false);
+
+  expect(isRequestToRegistry(
+    'http://foo.bar/blah/whatever/something',
+    'http://foo.bar/foo/',
+  )).toBe(false);
+
+  expect(isRequestToRegistry(
+    'https://wrong.thing/foo/bar/baz',
+    'https://foo.bar/foo/',
+  )).toBe(false);
+
+  expect(isRequestToRegistry(
+    'https://foo.bar:1337/foo/bar/baz',
+    'https://foo.bar/foo/',
+  )).toBe(false);
+});

src/registries/is-request-to-registry.js

@@ -0,0 +1,28 @@
+/* @flow */
+
+import url from 'url';
+
+export default function isRequestToRegistry(requestUrl: string, registry: string): boolean {
+  const requestParsed = url.parse(requestUrl);
+  const registryParsed = url.parse(registry);
+  const requestPort = getPortOrDefaultPort(requestParsed.port, requestParsed.protocol);
+  const registryPort = getPortOrDefaultPort(registryParsed.port, registryParsed.protocol);
+  const requestPath = requestParsed.path || '';
+  const registryPath = registryParsed.path || '';
+
+  return (requestParsed.protocol === registryParsed.protocol) &&
+        (requestParsed.hostname === registryParsed.hostname) &&
+        (requestPort === registryPort) &&
+        requestPath.startsWith(registryPath);
+}
+
+function getPortOrDefaultPort(port: ?string, protocol: ?string): ?string {
+  const defaultPort = !port;
+  if (defaultPort && protocol === 'https:') {
+    return '443';
+  }
+  if (defaultPort && protocol === 'http:') {
+    return '80';
+  }
+  return port;
+}

src/registries/npm-registry.js

@@ -9,6 +9,7 @@ import NpmResolver from '../resolvers/registries/npm-resolver.js';
 import envReplace from '../util/env-replace.js';
 import Registry from './base-registry.js';
 import {addSuffix, removePrefix} from '../util/misc';
+import isRequestToRegistry from './is-request-to-registry.js';
 
 const defaults = require('defaults');
 const userHome = require('user-home');
@@ -58,7 +59,7 @@ export default class NpmRegistry extends Registry {
       || removePrefix(requestUrl, registry)[0] === '@';
 
     const headers = {};
-    if (this.token || (alwaysAuth && requestUrl.startsWith(registry))) {
+    if (this.token || (alwaysAuth && isRequestToRegistry(requestUrl, registry))) {
       const authorization = this.getAuth(pathname);
       if (authorization) {
         headers.authorization = authorization;