fix(audit): honor configured CA stores (#36728)

Fixes #36726

Author: pttydou

cli/tools/pm/audit.rs

@@ -21,7 +21,6 @@ use crate::colors;
 use crate::factory::CliFactory;
 use crate::http_util;
 use crate::http_util::HttpClient;
-use crate::http_util::HttpClientProvider;
 use crate::util::console::escape_terminal_control_chars;
 
 struct FixableAction {
@@ -45,7 +44,7 @@ pub async fn audit(
   let snapshot = npm_resolver.resolution().snapshot();
 
   let npm_url = &factory.npmrc()?.default_config.registry_url;
-  let http_provider = HttpClientProvider::new(None, None);
+  let http_provider = factory.http_client_provider();
   let http_client = http_provider
     .get_or_create()
     .context("Failed to create HTTP client")?;

tests/specs/audit/ca_store/RootCA.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDIzCCAgugAwIBAgIJAMKPPW4tsOymMA0GCSqGSIb3DQEBCwUAMCcxCzAJBgNV
+BAYTAlVTMRgwFgYDVQQDDA9FeGFtcGxlLVJvb3QtQ0EwIBcNMTkxMDIxMTYyODIy
+WhgPMjExODA5MjcxNjI4MjJaMCcxCzAJBgNVBAYTAlVTMRgwFgYDVQQDDA9FeGFt
+cGxlLVJvb3QtQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMH/IO
+2qtHfyBKwANNPB4K0q5JVSg8XxZdRpTTlz0CwU0oRO3uHrI52raCCfVeiQutyZop
+eFZTDWeXGudGAFA2B5m3orWt0s+touPi8MzjsG2TQ+WSI66QgbXTNDitDDBtTVcV
+5G3Ic+3SppQAYiHSekLISnYWgXLl+k5CnEfTowg6cjqjVr0KjL03cTN3H7b+6+0S
+ws4rYbW1j4ExR7K6BFNH6572yq5qR20E6GqlY+EcOZpw4CbCk9lS8/CWuXze/vMs
+OfDcc6K+B625d27wyEGZHedBomT2vAD7sBjvO8hn/DP1Qb46a8uCHR6NSfnJ7bXO
+G1igaIbgY1zXirNdAgMBAAGjUDBOMB0GA1UdDgQWBBTzut+pwwDfqmMYcI9KNWRD
+hxcIpTAfBgNVHSMEGDAWgBTzut+pwwDfqmMYcI9KNWRDhxcIpTAMBgNVHRMEBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB9AqSbZ+hEglAgSHxAMCqRFdhVu7MvaQM0
+P090mhGlOCt3yB7kdGfsIrUW6nQcTz7PPQFRaJMrFHPvFvPootkBUpTYR4hTkdce
+H6RCRu2Jxl4Y9bY/uezd9YhGCYfUtfjA6/TH9FcuZfttmOOlxOt01XfNvVMIR6RM
+z/AYhd+DeOXjr35F/VHeVpnk+55L0PYJsm1CdEbOs5Hy1ecR7ACuDkXnbM4fpz9I
+kyIWJwk2zJReKcJMgi1aIinDM9ao/dca1G99PHOw8dnr4oyoTiv8ao6PWiSRHHMi
+MNf4EgWfK+tZMnuqfpfO9740KzfcVoMNo4QJD4yn5YxroUOO/Azi
+-----END CERTIFICATE-----

tests/specs/audit/ca_store/__test__.jsonc

@@ -0,0 +1,17 @@
+{
+  "tempDir": true,
+  "steps": [
+    {
+      "args": "install",
+      "output": "install.out"
+    },
+    {
+      "args": "audit",
+      "output": "audit.out",
+      "envs": {
+        "DENO_CERT": "$PWD/RootCA.pem",
+        "NPM_CONFIG_REGISTRY": "https://localhost:5545/"
+      }
+    }
+  ]
+}

tests/specs/audit/ca_store/audit.out

@@ -0,0 +1 @@
+No known vulnerabilities found

tests/specs/audit/ca_store/install.out

@@ -0,0 +1,12 @@
+Download http://localhost:4260/@denotest%2fsay-hello
+Download http://localhost:4260/@denotest/say-hello/1.0.0.tgz
+Initialize @denotest/say-hello@1.0.0
+Installed 1 package in [WILDLINE]
+Reused 0 packages from cache
+Downloaded 0 packages from JSR
+Downloaded 1 package from npm
++
+
+Dependencies:
++ npm:@denotest/say-hello 1.0.0
+[WILDLINE]

tests/specs/audit/ca_store/package.json

@@ -0,0 +1,5 @@
+{
+  "dependencies": {
+    "@denotest/say-hello": "1.0.0"
+  }
+}

tests/util/server/servers/mod.rs

@@ -417,6 +417,9 @@ async fn main_server(
   remote_addr: SocketAddr,
 ) -> Result<Response<UnsyncBoxBody<Bytes, Infallible>>, anyhow::Error> {
   match (req.method(), req.uri().path()) {
+    (&Method::POST, "/-/npm/v1/security/advisories/bulk") => {
+      npm_registry::npm_security_advisories_bulk(req).await
+    }
     (_, "/echo_server") => {
       let (parts, body) = req.into_parts();
       let mut response = Response::new(UnsyncBoxBody::new(Full::new(

tests/util/server/servers/npm_registry.rs

@@ -604,7 +604,7 @@ fn npm_security_advisories_bulk_no_vulns()
     .map_err(|e| e.into())
 }
 
-async fn npm_security_advisories_bulk(
+pub(super) async fn npm_security_advisories_bulk(
   req: Request<Incoming>,
 ) -> Result<Response<UnsyncBoxBody<Bytes, Infallible>>, anyhow::Error> {
   // Respond with 400 for a request whose body can't be read or isn't valid