Repository: astral-sh/uv
File: crates/uv/src/commands/auth/helper.rs (Rust)

Code before:
impl TryFrom<Credentials> for BazelCredentialResponse {
    fn try_from(creds: Credentials) -> Result<Self> {
        let mut headers = HashMap::new();
        // Only include the Authorization header if credentials are authenticated
        // (i.e., not just a username without password)
        if creds.is_authenticated() {
            let header_value = creds.to_header_value();

            // Convert HeaderValue to String
            let header_str = header_value
                .to_str()
                .context("Failed to convert header value to string")?
                .to_string();

            headers.insert("Authorization".to_string(), vec![header_str]);
        }
        Ok(Self { headers })
    }

    type Error = anyhow::Error;
}

async fn credentials_for_url(
    url: &DisplaySafeUrl,
    preview: Preview,
    network_settings: &NetworkSettings,
) -> Result<Option<Credentials>> {
    let pyx_store = PyxTokenStore::from_settings()?;

    // Use only the username from the URL, if present - discarding the password
    let url_credentials = Credentials::from_url(url);
    let url_username = url_credentials.as_ref().and_then(|c| c.username());
    let username = url_username.map(ToString::to_string);

    if pyx_store.is_known_domain(url) {
        if username.is_some() {
            bail!(
                "Cannot specify a username for URLs under {}",
                url.host()
                    .map(|host| host.to_string())
                    .unwrap_or("this host".to_owned())
            );
        }
        let client = BaseClientBuilder::new(
            network_settings.connectivity,
            network_settings.native_tls,
            network_settings.allow_insecure_host.clone(),
            preview,
            network_settings.timeout,
            network_settings.retries,
        )

Review comment (bug):
We should add a log message here indicating that we discard a password if there's any. There shouldn't be, but if someone tries to use it, see it doesn't work and then tries to debug it by manually running `uv auth helper --protocol bazel -v`, we should be helpful and tell them that we're intentionally eating the password.

Not as a user-facing warning (since we're in a machine-readable interface anyway), just as a `warn!` or `debug!` that only gets shown with `-v`.

Code after:

impl TryFrom<Credentials> for BazelCredentialResponse {
    fn try_from(creds: Credentials) -> Result<Self> {
        let header_str = creds
            .to_header_value()
            .to_str()
            // TODO: this is infallible in practice
            .context("Failed to convert header value to string")?
            .to_owned();

        Ok(Self {
            headers: HashMap::from([("Authorization".to_owned(), vec![header_str])]),
        })
    }

    type Error = anyhow::Error;
}

async fn credentials_for_url(
    url: &DisplaySafeUrl,
    preview: Preview,
    network_settings: &NetworkSettings,
) -> Result<Option<Credentials>> {
    let pyx_store = PyxTokenStore::from_settings()?;

    // Use only the username from the URL, if present - discarding the password
    let url_credentials = Credentials::from_url(url);
    let username = url_credentials.as_ref().and_then(|c| c.username());
    if url_credentials
        .as_ref()
        .map(|c| c.password().is_some())
        .unwrap_or(false)
    {
        debug!("URL '{url}' contain a password; ignoring");
    }

    if pyx_store.is_known_domain(url) {
        if username.is_some() {
            bail!(
                "Cannot specify a username for URLs under {}",
                url.host()
                    .map(|host| host.to_string())
                    .unwrap_or(url.to_string())
            );
        }
        let client = BaseClientBuilder::new(
            network_settings.connectivity,
            network_settings.native_tls,
            network_settings.allow_insecure_host.clone(),
            preview,
            network_settings.timeout,