Прокси для npm: настройка и проверка

node --version
npm --version

import { execFile } from 'node:child_process';
import { mkdtemp, writeFile, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join, resolve } from 'node:path';
import { createInterface } from 'node:readline';
import { Writable } from 'node:stream';
import { promisify } from 'node:util';

const run = promisify(execFile);

async function secret(name, label) {
  if (process.env[name]) return process.env[name];
  if (!process.stdin.isTTY) throw new Error('Secret input requires a terminal');
  process.stderr.write(label + ': ');
  const muted = new Writable({ write(_data, _encoding, done) { done(); } });
  const rl = createInterface({ input: process.stdin, output: muted, terminal: true });
  try {
    return await new Promise((resolve, reject) => {
      rl.once('SIGINT', () => reject(new Error('Input cancelled')));
      rl.once('close', () => reject(new Error('Input closed')));
      rl.question('', resolve);
    });
  } finally {
    rl.close();
    process.stderr.write('\n');
  }
}

async function main() {
  if (process.platform === 'win32') throw new Error('This example targets macOS and Linux');
  const proxy = new URL(process.env.PROXY_SERVER ?? 'http://gw.portproof.org:7000');
  const registry = new URL(process.env.NPM_CHECK_REGISTRY ?? 'https://registry.npmjs.org/');
  if (proxy.protocol !== 'http:' || proxy.username || proxy.password ||
      proxy.pathname !== '/' || proxy.search || proxy.hash) throw new Error('Invalid proxy');
  if (registry.protocol !== 'https:' || registry.username || registry.password ||
      registry.search || registry.hash) throw new Error('Invalid registry');
  const username = await secret('PROXY_USER', 'Full proxy username');
  const password = await secret('PROXY_PASSWORD', 'Proxy password');
  if (!username || !password || /[:\r\n\0]/.test(username) || /[\r\n\0]/.test(password)) {
    throw new Error('Invalid credentials');
  }
  proxy.username = encodeURIComponent(username);
  proxy.password = encodeURIComponent(password);

  // Keep npm's child environment small: no inherited npm settings, proxy
  // exceptions, registry tokens, NODE_OPTIONS or TLS-verification overrides.
  const childEnv = {};
  for (const name of ['PATH', 'HOME', 'TMPDIR', 'TMP', 'TEMP', 'LANG']) {
    if (process.env[name]) childEnv[name] = process.env[name];
  }
  // npm enables Node's compile cache outside its --cache directory by default.
  // Disable that optional cache for this one-off child so nothing is left behind.
  childEnv.NODE_DISABLE_COMPILE_CACHE = '1';
  const directory = await mkdtemp(join(tmpdir(), 'npm-proxy-check-'));
  const controller = new AbortController();
  const stop = () => controller.abort();
  process.once('SIGINT', stop);
  process.once('SIGTERM', stop);
  try {
    const config = [
      'proxy=' + JSON.stringify(proxy.href),
      'https-proxy=' + JSON.stringify(proxy.href),
      'noproxy=',
    ];
    // Optional certificate file for an approved internal registry.
    // This adds trust for this check; certificate verification remains on.
    if (process.env.NPM_CHECK_CA) {
      config.push('cafile=' + JSON.stringify(resolve(process.env.NPM_CHECK_CA)));
    }
    await writeFile(join(directory, 'user.npmrc'), config.join('\n') + '\n', { mode: 0o600 });
    await writeFile(join(directory, 'global.npmrc'), '', { mode: 0o600 });
    await run('npm', [
      'ping', '--json', '--registry=' + registry.href,
      '--userconfig=' + join(directory, 'user.npmrc'),
      '--globalconfig=' + join(directory, 'global.npmrc'),
      '--cache=' + join(directory, 'cache'),
      '--strict-ssl=true', '--fetch-retries=0', '--fetch-timeout=15000',
      '--logs-max=0', '--update-notifier=false', '--ignore-scripts=true',
    ], {
      cwd: directory, env: childEnv, signal: controller.signal,
      timeout: 20000, killSignal: 'SIGKILL', maxBuffer: 65536,
    });
    console.log('Registry ping succeeded. No package was installed.');
  } catch (error) {
    // Never echo npm's raw output: it may contain configuration details.
    let code = error.code === 'ABORT_ERR' ? 'ABORTED' : 'CHECK_FAILED';
    try {
      const reported = JSON.parse(error.stdout).error?.code;
      if (['E401', 'E403', 'E407', 'E502', 'ECONNREFUSED', 'ENOTFOUND',
        'ETIMEDOUT', 'ECONNRESET', 'FETCH_ERROR', 'CERT_HAS_EXPIRED',
        'SELF_SIGNED_CERT_IN_CHAIN', 'DEPTH_ZERO_SELF_SIGNED_CERT',
        'UNABLE_TO_VERIFY_LEAF_SIGNATURE'].includes(reported)) code = reported;
    } catch {}
    console.error('Registry ping failed: ' + code);
    process.exitCode = 1;
  } finally {
    process.removeListener('SIGINT', stop);
    process.removeListener('SIGTERM', stop);
    await rm(directory, { recursive: true, force: true });
  }
}

main().catch(() => {
  console.error('Check setup failed. Verify the gateway, HTTPS registry and secret input.');
  process.exitCode = 1;
});