fix(trusted-publishing): properly await the check for trusted publishing context

for #958

Author: travi

lib/verify-auth.js

@@ -74,7 +74,7 @@ async function verifyTokenAuth(registry, npmrc, context) {
 export default async function (npmrc, pkg, context) {
   const registry = getRegistry(pkg, context);
 
-  if (oidcContextEstablished(registry, pkg, context)) {
+  if (await oidcContextEstablished(registry, pkg, context)) {
     return;
   }
 

test/trusted-publishing/oidc-context.test.js

@@ -3,12 +3,11 @@ import * as td from "testdouble";
 
 import { OFFICIAL_REGISTRY } from "../../lib/definitions/constants.js";
 
-let oidcContextEstablished, trustedCiProvider, exchangeToken;
+let oidcContextEstablished, exchangeToken;
 const pkg = {};
 const context = {};
 
 test.beforeEach(async (t) => {
-  await td.replace(globalThis, "fetch");
   ({ default: exchangeToken } = await td.replaceEsm("../../lib/trusted-publishing/token-exchange.js"));
   td.when(exchangeToken(pkg, context)).thenResolve(undefined);
 
@@ -22,15 +21,13 @@ test.afterEach.always((t) => {
 test.serial(
   "that `true` is returned when a trusted-publishing context has been established with the official registry",
   async (t) => {
-    td.when(fetch("https://matt.travi.org")).thenResolve(new Response(null, { status: 401 }));
     td.when(exchangeToken(pkg, context)).thenResolve("token-value");
 
     t.true(await oidcContextEstablished(OFFICIAL_REGISTRY, pkg, context));
   }
 );
 
 test.serial("that `false` is returned when OIDC token exchange fails in a supported CI provider", async (t) => {
-  td.when(fetch("https://matt.travi.org")).thenResolve(new Response(null, { status: 401 }));
   td.when(exchangeToken(pkg, context)).thenResolve(undefined);
 
   t.false(await oidcContextEstablished(OFFICIAL_REGISTRY, pkg, context));

test/verify-auth.test.js

@@ -30,7 +30,7 @@ test.serial(
   "that the auth context for the official registry is considered valid when trusted publishing is established",
   async (t) => {
     td.when(getRegistry(pkg, context)).thenReturn(DEFAULT_NPM_REGISTRY);
-    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenReturn(true);
+    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenResolve(true);
 
     await t.notThrowsAsync(verifyAuth(npmrc, pkg, context));
   }
@@ -40,7 +40,7 @@ test.serial(
   "that the provided token is verified with `npm whoami` when trusted publishing is not established for the official registry",
   async (t) => {
     td.when(getRegistry(pkg, context)).thenReturn(DEFAULT_NPM_REGISTRY);
-    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenReturn(false);
+    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenResolve(false);
     td.when(
       execa("npm", ["whoami", "--userconfig", npmrc, "--registry", DEFAULT_NPM_REGISTRY], {
         cwd,
@@ -60,7 +60,7 @@ test.serial(
   "that the auth context for the official registry is considered invalid when no token is provided and trusted publishing is not established",
   async (t) => {
     td.when(getRegistry(pkg, context)).thenReturn(DEFAULT_NPM_REGISTRY);
-    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenReturn(false);
+    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenResolve(false);
     td.when(
       execa("npm", ["whoami", "--userconfig", npmrc, "--registry", DEFAULT_NPM_REGISTRY], {
         cwd,
@@ -89,7 +89,7 @@ test.serial(
     execaResult.stderr = { pipe: () => undefined };
     execaResult.stdout = { pipe: () => undefined };
     td.when(getRegistry(pkg, context)).thenReturn(otherRegistry);
-    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenReturn(false);
+    td.when(oidcContextEstablished(DEFAULT_NPM_REGISTRY, pkg, context)).thenResolve(false);
     td.when(
       execa(
         "npm",
@@ -127,7 +127,7 @@ test.serial(
     execaResult.stderr = { pipe: () => undefined };
     execaResult.stdout = { pipe: () => undefined };
     td.when(getRegistry(pkg, context)).thenReturn(otherRegistry);
-    td.when(oidcContextEstablished(otherRegistry, pkg, context)).thenReturn(false);
+    td.when(oidcContextEstablished(otherRegistry, pkg, context)).thenResolve(false);
     td.when(
       execa(
         "npm",
@@ -163,7 +163,7 @@ test.serial("that errors from setting up auth bubble through this function", asy
   const registry = DEFAULT_NPM_REGISTRY;
   const thrownError = new Error();
   td.when(getRegistry(pkg, context)).thenReturn(registry);
-  td.when(oidcContextEstablished(registry, pkg, context)).thenReturn(false);
+  td.when(oidcContextEstablished(registry, pkg, context)).thenResolve(false);
   td.when(setNpmrcAuth(npmrc, registry, context)).thenThrow(new AggregateError([thrownError]));
 
   const {