isaacs/npm — pull request #3202 by cliffano (2013-03-01 06:58:57+00:00)
Title: Use registry auth for fetching tarball.

When I use npm with a private registry where the registry is secured, i.e. registry config has authentication details like this in .npmrc:
registry = http://user:pass@host:5984/registry/_design/app/_rewrite

npm request the module doc using the above registry config (with auth info), but the auth info is then ignored while fetching the tarball:
npm http GET http://user:pass@host:5984/registry/_design/app/_rewrite/inflection
npm http 200 http://user:pass@host:5984/registry/_design/app/_rewrite/inflection
npm http 401 http://host:5984/registry/_design/app/_rewrite/inflection/-/inflection-1.2.5.tgz
npm ERR! fetch failed http://host:5984/registry/_design/app/_rewrite/inflection/-/inflection-1.2.5.tgz

This patch passes the auth info to the tarball url. Here's the log after the fix:
npm http GET http://user:pass@host:5984/registry/_design/app/_rewrite/inflection/-/inflection-1.2.5.tgz
npm http 200 http://user:pass@host:5984/registry/_design/app/_rewrite/inflection/-/inflection-1.2.5.tgz