@@ -767,6 +767,11 @@ class Config {
767767 const nerfed = nerfDart ( uri )
768768 const creds = { }
769769
770+ const deprecatedAuthWarning = [
771+ '`_auth`, `_authToken`, `username` and `_password` must be scoped to a registry.' ,
772+ 'see `npm help npmrc` for more information.' ,
773+ ] . join ( ' ' )
774+
770775 const email = this . get ( `${ nerfed } ) || this . get ( 'email' )
771776 if ( email ) {
772777 creds . email = email
@@ -780,10 +785,13 @@ class Config {
780785 // cert/key may be used in conjunction with other credentials, thus no `return`
781786 }
782787
783- const tokenReg = this . get ( ` ${ nerfed } :_authToken` ) ||
784- nerfed === nerfDart ( this . get ( 'registry' ) ) && this . get ( '_authToken' )
788+ const defaultToken = nerfDart ( this . get ( 'registry' ) ) && this . get ( '_authToken' )
789+ const tokenReg = this . get ( ` ${ nerfed } :_authToken` ) || defaultToken
785790
786791 if ( tokenReg ) {
792+ if ( tokenReg === defaultToken ) {
793+ log . warn ( 'config' , deprecatedAuthWarning )
794+ }
787795 creds . token = tokenReg
788796 return creds
789797 }
@@ -818,6 +826,7 @@ class Config {
818826 const userDef = this . get ( 'username' )
819827 const passDef = this . get ( '_password' )
820828 if ( userDef && passDef ) {
829+ log . warn ( 'config' , deprecatedAuthWarning )
821830 creds . username = userDef
822831 creds . password = Buffer . from ( passDef , 'base64' ) . toString ( 'utf8' )
823832 const auth = `${ creds . username } ${ creds . password }
@@ -832,6 +841,7 @@ class Config {
832841 return creds
833842 }
834843
844+ log . warn ( 'config' , deprecatedAuthWarning )
835845 const authDecode = Buffer . from ( auth , 'base64' ) . toString ( 'utf8' )
836846 const authSplit = authDecode . split ( ':' )
837847 creds . username = authSplit . shift ( )
0 commit comments