fix(trusted-publishing): uri encode the package name for the token exchange request

for #958

Author: travi

lib/trusted-publishing/token-exchange.js

@@ -1,7 +1,10 @@
 import { OFFICIAL_REGISTRY } from "../definitions/constants.js";
 
 export default async function tokenExchange(pkg) {
-  const response = await fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${pkg.name}`, { method: 'POST' });
+  const response = await fetch(
+    `${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(pkg.name)}`,
+    { method: "POST" }
+  );
 
   if (response.ok) {
     return (await response.json()).token;

test/trusted-publishing/oidc-context.test.js

@@ -19,19 +19,25 @@ test.afterEach.always((t) => {
   td.reset();
 });
 
-test.serial("that `true` is returned when a trusted-publishing context has been established with the official registry", async (t) => {
-  td.when(trustedCiProvider()).thenResolve(true);
-  td.when(fetch("https://matt.travi.org")).thenResolve(new Response(null, { status: 401 }));
-  td.when(tokenExchange(pkg)).thenResolve('token-value');
-
-  t.true(await oidcContextEstablished(OFFICIAL_REGISTRY, pkg));
-});
-
-test.serial("that `false` is returned when the official registry is targeted, but outside the context of a supported CI provider", async (t) => {
-  td.when(trustedCiProvider()).thenResolve(false);
-
-  t.false(await oidcContextEstablished(OFFICIAL_REGISTRY, pkg));
-});
+test.serial(
+  "that `true` is returned when a trusted-publishing context has been established with the official registry",
+  async (t) => {
+    td.when(trustedCiProvider()).thenResolve(true);
+    td.when(fetch("https://matt.travi.org")).thenResolve(new Response(null, { status: 401 }));
+    td.when(tokenExchange(pkg)).thenResolve("token-value");
+
+    t.true(await oidcContextEstablished(OFFICIAL_REGISTRY, pkg));
+  }
+);
+
+test.serial(
+  "that `false` is returned when the official registry is targeted, but outside the context of a supported CI provider",
+  async (t) => {
+    td.when(trustedCiProvider()).thenResolve(false);
+
+    t.false(await oidcContextEstablished(OFFICIAL_REGISTRY, pkg));
+  }
+);
 
 test.serial("that `false` is returned when OIDC token exchange fails in a supported CI provider", async (t) => {
   td.when(trustedCiProvider()).thenResolve(true);

test/trusted-publishing/token-exchange.test.js

@@ -1,12 +1,12 @@
 import test from "ava";
 import * as td from "testdouble";
 
-import tokenExchange from '../../lib/trusted-publishing/token-exchange.js';
+import tokenExchange from "../../lib/trusted-publishing/token-exchange.js";
 import { OFFICIAL_REGISTRY } from "../../lib/definitions/constants.js";
 
 // https://api-docs.npmjs.com/#tag/registry.npmjs.org/operation/exchangeOidcToken
 
-const packageName = "some-package";
+const packageName = "@scope/some-package";
 const pkg = { name: packageName };
 
 test.beforeEach(async (t) => {
@@ -19,15 +19,25 @@ test.afterEach.always((t) => {
 
 test.serial("that an access token is returned when token exchange succeeds", async (t) => {
   const token = "token-value";
-  td.when(fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${packageName}`, {method: 'POST'}))
-    .thenResolve(new Response(JSON.stringify({token}), {status: 201, headers: {'Content-Type': 'application/json'}}));
+  td.when(
+    fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(packageName)}`, {
+      method: "POST",
+    })
+  ).thenResolve(
+    new Response(JSON.stringify({ token }), { status: 201, headers: { "Content-Type": "application/json" } })
+  );
 
   t.is(await tokenExchange(pkg), token);
 });
 
 test.serial("that `undefined` is returned when token exchange fails", async (t) => {
-  td.when(fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${packageName}`, {method: 'POST'}))
-    .thenResolve(new Response(JSON.stringify({message: 'foo'}), {status: 401, headers: {'Content-Type': 'application/json'}}));
+  td.when(
+    fetch(`${OFFICIAL_REGISTRY}-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(packageName)}`, {
+      method: "POST",
+    })
+  ).thenResolve(
+    new Response(JSON.stringify({ message: "foo" }), { status: 401, headers: { "Content-Type": "application/json" } })
+  );
 
   t.is(await tokenExchange(pkg), undefined);
 });