fix: smarter git ssh override

lib/opts.js

@@ -1,12 +1,60 @@
-// Values we want to set if they're not already defined by the end user
-// This defaults to accepting new ssh host key fingerprints
-const gitEnv = {
-  GIT_ASKPASS: 'echo',
-  GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
-}
-module.exports = (opts = {}) => ({
-  stdioString: true,
-  ...opts,
-  shell: false,
-  env: opts.env || { ...gitEnv, ...process.env },
-})
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+const ini = require('ini')
+
+const gitConfigPath = path.join(os.homedir(), '.gitconfig')
+
+let cachedConfig = null
+
+// Function to load and cache the git config
+const loadGitConfig = () => {
+  if (cachedConfig === null) {
+    try {
+      if (fs.existsSync(gitConfigPath)) {
+        const configContent = fs.readFileSync(gitConfigPath, 'utf-8')
+        cachedConfig = ini.parse(configContent)
+      } else {
+        cachedConfig = {}
+      }
+    } catch (error) {
+      cachedConfig = {}
+    }
+  }
+  return cachedConfig
+}
+
+const isGitSshCommandSetInConfig = () => {
+  const config = loadGitConfig()
+  return config.core && config.core.sshCommand !== undefined
+}
+
+const isGitAskPassSetInConfig = () => {
+  const config = loadGitConfig()
+  return config.core && config.core.askpass !== undefined
+}
+
+module.exports = (opts = {}) => {
+  const sshCommandSetInEnv = process.env.GIT_SSH_COMMAND !== undefined
+  const sshCommandSetInConfig = isGitSshCommandSetInConfig()
+  const askPassSetInEnv = process.env.GIT_ASKPASS !== undefined
+  const askPassSetInConfig = isGitAskPassSetInConfig()
+
+  // Values we want to set if they're not already defined by the end user
+  // This defaults to accepting new ssh host key fingerprints
+  const finalGitEnv = {
+    ...(askPassSetInEnv || askPassSetInConfig ? {} : {
+      GIT_ASKPASS: 'echo',
+    }),
+    ...(sshCommandSetInEnv || sshCommandSetInConfig ? {} : {
+      GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
+    }),
+  }
+
+  return {
+    stdioString: true,
+    ...opts,
+    shell: false,
+    env: opts.env || { ...finalGitEnv, ...process.env },
+  }
+}

package.json

@@ -34,10 +34,12 @@
     "@npmcli/template-oss": "4.22.0",
     "npm-package-arg": "^11.0.0",
     "slash": "^3.0.0",
-    "tap": "^16.0.1"
+    "tap": "^16.0.1",
+    "proxyquire": "^2.1.3"
   },
   "dependencies": {
     "@npmcli/promise-spawn": "^7.0.0",
+    "ini": "^4.1.3",
     "lru-cache": "^10.0.1",
     "npm-pick-manifest": "^9.0.0",
     "proc-log": "^4.0.0",

test/opts.js

@@ -1,40 +1,125 @@
 const t = require('tap')
+const proxyquire = require('proxyquire')
 const gitOpts = require('../lib/opts.js')
+const fs = require('node:fs')
+const os = require('node:os')
+const path = require('node:path')
+
+const gitConfigPath = path.join(os.homedir(), '.gitconfig')
+
+const mockFs = {
+  existsSync: () => false,
+  readFileSync: () => '',
+}
+
+// Utility function to backup and restore gitconfig
+const backupGitConfig = () => {
+  const backupPath = `${gitConfigPath}.backup`
+  if (fs.existsSync(gitConfigPath)) {
+    fs.copyFileSync(gitConfigPath, backupPath)
+    fs.unlinkSync(gitConfigPath)
+  }
+  return backupPath
+}
+
+const restoreGitConfig = (backupPath) => {
+  if (fs.existsSync(backupPath)) {
+    fs.copyFileSync(backupPath, gitConfigPath)
+    fs.unlinkSync(backupPath)
+  } else if (fs.existsSync(gitConfigPath)) {
+    fs.unlinkSync(gitConfigPath)
+  }
+}
+
+const writeGitConfig = (content) => {
+  fs.writeFileSync(gitConfigPath, content)
+}
+
+t.test('handle case when fs.existsSync throws an error', t => {
+  const { GIT_ASKPASS, GIT_SSH_COMMAND } = process.env
+  t.teardown(() => {
+    process.env.GIT_ASKPASS = GIT_ASKPASS
+    process.env.GIT_SSH_COMMAND = GIT_SSH_COMMAND
+  })
+
+  // Mocking fs.existsSync to throw an error
+  const gitOptsWithMockFs = proxyquire('../lib/opts.js', {
+    'node:fs': {
+      ...mockFs,
+      existsSync: () => {
+        throw new Error('Mocked error')
+      },
+    },
+  })
+
+  t.match(gitOptsWithMockFs(), {
+    env: {
+      GIT_ASKPASS: 'echo',
+      GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
+    },
+    shell: false,
+  }, 'should apply defaults when fs.existsSync throws an error')
+
+  t.end()
+})
 
 t.test('defaults', t => {
+  const backupPath = backupGitConfig()
   const { GIT_ASKPASS, GIT_SSH_COMMAND } = process.env
   t.teardown(() => {
+    restoreGitConfig(backupPath)
     process.env.GIT_ASKPASS = GIT_ASKPASS
     process.env.GIT_SSH_COMMAND = GIT_SSH_COMMAND
   })
+
   delete process.env.GIT_ASKPASS
   delete process.env.GIT_SSH_COMMAND
-  t.match(gitOpts().env, {
-    GIT_ASKPASS: 'echo',
-    GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
+
+  t.match(gitOpts(), {
+    env: {
+      GIT_ASKPASS: 'echo',
+      GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
+    },
+    shell: false,
   }, 'got the git defaults we want')
-  t.equal(gitOpts().shell, false, 'shell defaults to false')
-  t.equal(gitOpts({ shell: '/bin/bash' }).shell, false, 'shell cannot be overridden')
+
   t.end()
 })
 
-t.test('does not override', t => {
+t.test('does not override when sshCommand is set in env', t => {
+  const backupPath = backupGitConfig()
   const { GIT_ASKPASS, GIT_SSH_COMMAND } = process.env
   t.teardown(() => {
+    restoreGitConfig(backupPath)
     process.env.GIT_ASKPASS = GIT_ASKPASS
     process.env.GIT_SSH_COMMAND = GIT_SSH_COMMAND
   })
+
   process.env.GIT_ASKPASS = 'test_askpass'
   process.env.GIT_SSH_COMMAND = 'test_ssh_command'
-  t.match(gitOpts().env, {
-    GIT_ASKPASS: 'test_askpass',
-    GIT_SSH_COMMAND: 'test_ssh_command',
+
+  t.match(gitOpts(), {
+    env: {
+      GIT_ASKPASS: 'test_askpass',
+      GIT_SSH_COMMAND: 'test_ssh_command',
+    },
+    shell: false,
   }, 'values already in process.env remain')
+
   t.end()
 })
 
 t.test('as non-root', t => {
+  const backupPath = backupGitConfig()
+  const { GIT_ASKPASS, GIT_SSH_COMMAND } = process.env
+  t.teardown(() => {
+    restoreGitConfig(backupPath)
+    process.env.GIT_ASKPASS = GIT_ASKPASS
+    process.env.GIT_SSH_COMMAND = GIT_SSH_COMMAND
+  })
+
   process.getuid = () => 999
+
   t.match(gitOpts({
     foo: 'bar',
     env: { override: 'for some reason' },
@@ -49,5 +134,32 @@ t.test('as non-root', t => {
     gid: undefined,
     abc: undefined,
   }, 'do not set uid/gid as non-root')
+
+  t.end()
+})
+
+t.test('does not override when sshCommand is set in git config', t => {
+  const backupPath = backupGitConfig()
+  const { GIT_ASKPASS, GIT_SSH_COMMAND } = process.env
+  t.teardown(() => {
+    restoreGitConfig(backupPath)
+    process.env.GIT_ASKPASS = GIT_ASKPASS
+    process.env.GIT_SSH_COMMAND = GIT_SSH_COMMAND
+  })
+
+  writeGitConfig(`
+[core]
+  askpass = echo
+  sshCommand = custom_ssh_command
+`)
+
+  t.match(gitOpts(), {
+    env: {
+      GIT_ASKPASS: 'undefined',
+      GIT_SSH_COMMAND: 'undefined',
+    },
+    shell: false,
+  }, 'sshCommand in git config remains')
+
   t.end()
 })