build(deps): bump basic-auth from 2.0.1 to 3.0.0

lib/auth-middleware.js

@@ -5,12 +5,12 @@
  * in the follow format: "username:password"
  */
 
-import auth from 'basic-auth'
+import { parse } from 'basic-auth'
 
 const [username, password] = (process.env.LOGIN_CREDENTIALS || '').split(':')
 
 export default function authMiddleware (req, res, next) {
-  const user = auth(req)
+  const user = parse(req.headers.authorization || '')
 
   if (user === undefined || user.name !== username || user.pass !== password) {
     res.statusCode = 401

package.json

@@ -9,14 +9,14 @@
     "test:watch": "nodemon -q -x 'npm test'"
   },
   "engines": {
-    "node": ">= 20.11.0"
+    "node": ">= 22.0.0"
   },
   "private": true,
   "license": "MIT",
   "dependencies": {
     "@octokit/rest": "^22.0.1",
     "aigle": "^1.14.1",
-    "basic-auth": "^2.0.1",
+    "basic-auth": "^3.0.0",
     "body-parser": "^2.3.0",
     "bunyan": "^1.8.1",
     "codeowners-utils": "^1.0.2",

test/unit/auth-middleware.test.js

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+process.env.LOGIN_CREDENTIALS = 'admin:secret'
+const { default: authMiddleware } = await import('../../lib/auth-middleware.js')
+
+function request (authorization) {
+  return { headers: { authorization } }
+}
+
+function response () {
+  return {
+    headers: {},
+    setHeader (name, value) {
+      this.headers[name] = value
+    },
+    end (body) {
+      this.body = body
+    }
+  }
+}
+
+test('accepts the configured credentials', () => {
+  const req = request('Basic ' + Buffer.from('admin:secret').toString('base64'))
+  const res = response()
+  let nextCalled = false
+
+  authMiddleware(req, res, () => { nextCalled = true })
+
+  assert.equal(nextCalled, true)
+  assert.equal(res.statusCode, undefined)
+})
+
+test('rejects missing or incorrect credentials', () => {
+  for (const authorization of [undefined, 'Basic invalid', 'Bearer token']) {
+    const res = response()
+    let nextCalled = false
+
+    authMiddleware(request(authorization), res, () => { nextCalled = true })
+
+    assert.equal(nextCalled, false)
+    assert.equal(res.statusCode, 401)
+    assert.equal(res.headers['WWW-Authenticate'], 'Basic realm="nodejs-github-bot"')
+    assert.equal(res.body, 'Unauthorized')
+  }
+})