Apply auth also for private pypi packages

conda_lock/conda_lock.py

@@ -91,10 +91,14 @@
 DEFAULT_FILES = [pathlib.Path("environment.yml")]
 
 # Captures basic auth credentials, if they exists, in the second capture group.
-AUTH_PATTERN = re.compile(r"^(https?:\/\/)(.*:.*@)?(.*)")
+AUTH_PATTERN = re.compile(r"^(# pip .* @ )?(https?:\/\/)(.*:.*@)?(.*)")
+
+# Do not substitute in comments, but do substitute in pip installable packages
+# with the pattern: # pip package @ url.
+PKG_PATTERN = re.compile(r"(^[^#@].*|^# pip .*)")
 
 # Captures the domain in the second group.
-DOMAIN_PATTERN = re.compile(r"^(https?:\/\/)?([^\/]+)(.*)")
+DOMAIN_PATTERN = re.compile(r"^(# pip .* @ )?(https?:\/\/)?([^\/]+)(.*)")
 
 # Captures the platform in the first group.
 PLATFORM_PATTERN = re.compile(r"^# platform: (.*)$")
@@ -914,7 +918,7 @@ def _add_auth_to_line(line: str, auth: Dict[str, str]) -> str:
 
 def _add_auth_to_lockfile(lockfile: str, auth: Dict[str, str]) -> str:
     lockfile_with_auth = "\n".join(
-        _add_auth_to_line(line, auth) if line[0] not in ("#", "@") else line
+        _add_auth_to_line(line, auth) if PKG_PATTERN.match(line) else line
         for line in lockfile.strip().split("\n")
     )
     if lockfile.endswith("\n"):
@@ -930,17 +934,17 @@ def _add_auth(lockfile: str, auth: Dict[str, str]) -> Iterator[pathlib.Path]:
 
 
 def _strip_auth_from_line(line: str) -> str:
-    return AUTH_PATTERN.sub(r"\1\3", line)
+    return AUTH_PATTERN.sub(r"\1\2\4", line)
 
 
 def _extract_domain(line: str) -> str:
-    return DOMAIN_PATTERN.sub(r"\2", line)
+    return DOMAIN_PATTERN.sub(r"\3", line)
 
 
 def _strip_auth_from_lockfile(lockfile: str) -> str:
     lockfile_lines = lockfile.strip().split("\n")
     stripped_lockfile_lines = tuple(
-        _strip_auth_from_line(line) if line[0] not in ("#", "@") else line
+        _strip_auth_from_line(line) if PKG_PATTERN.match(line) else line
         for line in lockfile_lines
     )
     stripped_domains = sorted(

tests/test-lockfile-with-auth/test.lock

@@ -1,6 +1,8 @@
 # The following domains require authentication:
 # - a.mychannel.cloud
 # - c.mychannel.cloud
+# - d.mychannel.cloud
 http://username_a:password_a@a.mychannel.cloud/mypackage
 http://b.mychannel.cloud/mypackage
 http://username_c:password_c@c.mychannel.cloud/mypackage
+# pip mypackage @ http://username_d:password_d@d.mychannel.cloud/mypackage

tests/test-lockfile/no-auth.lock

@@ -1,3 +1,4 @@
 http://a.mychannel.cloud/mypackage
 http://b.mychannel.cloud/mypackage
 http://c.mychannel.cloud/mypackage
+# pip mypackage @ http://d.mychannel.cloud/mypackage

tests/test-lockfile/test.lock

@@ -1,3 +1,4 @@
 http://user:password@a.mychannel.cloud/mypackage
 http://b.mychannel.cloud/mypackage
 http://user:password@c.mychannel.cloud/mypackage
+# pip mypackage @ http://user:password@d.mychannel.cloud/mypackage

tests/test-stripped-lockfile/no-auth.lock

@@ -1,3 +1,4 @@
 http://a.mychannel.cloud/mypackage
 http://b.mychannel.cloud/mypackage
 http://c.mychannel.cloud/mypackage
+# pip mypackage @ http://d.mychannel.cloud/mypackage

tests/test-stripped-lockfile/test.lock

@@ -1,6 +1,8 @@
 # The following domains require authentication:
 # - a.mychannel.cloud
 # - c.mychannel.cloud
+# - d.mychannel.cloud
 http://a.mychannel.cloud/mypackage
 http://b.mychannel.cloud/mypackage
 http://c.mychannel.cloud/mypackage
+# pip mypackage @ http://d.mychannel.cloud/mypackage

tests/test_conda_lock.py

@@ -1474,6 +1474,7 @@ def auth_():
     return {
         "a.mychannel.cloud": "username_a:password_a",
         "c.mychannel.cloud": "username_c:password_c",
+        "d.mychannel.cloud": "username_d:password_d",
     }