[sunsided]

Summary

cargo upgrade now sends the registry authentication token when querying a private sparse-registry index, so workspaces depending on an auth-required = true registry can be upgraded instead of failing with 401 Unauthorized.

Why

Reported in #931: cargo upgrade --incompatible fails with status code '401 Unauthorized': the request was not authorized against a private registry, while cargo search / build / test succeed with the same credentials, and downgrading to 0.13.1 avoids it.

The index request was always unauthenticated: RemoteIndex::krate builds it via tame-index's make_remote_request, which by design attaches no credentials, and cargo-edit never read or sent a token. Before 0.13.2 the resulting 401 was silently swallowed and the dependency skipped; #925 made index errors propagate, turning that long-standing gap into a hard failure that aborts the whole run.

Key changes

• registry_token() in src/registry.rs resolves a registry's token from CARGO_REGISTRIES_<NAME>_TOKEN, then token under [registries.<name>] in credentials / config files, walking .cargo/ from the manifest up to $CARGO_HOME.
• RemoteIndex carries the token and attaches it verbatim as the Authorization header on the index request, matching cargo (no Bearer prefix is injected).
• The token is threaded through IndexCache to the single call site in cargo upgrade.
• The crates.io index itself is left unauthenticated, so a crates.io publish token is never leaked to the CDN-fronted sparse index. When crates.io is replaced by another registry, that registry's token is used instead (see below).
• replace-with source replacement is followed for both the index URL and the token: with [source.crates-io] replace-with = "my-registry", the request goes to my-registry's index with my-registry's token. Replacement chains of any length are resolved; a cycle (a -> b -> a) is reported as an error instead of a misleading "could not be found". Thanks to @mkatychev for this part.
• A misconfigured registry or replacement chain is now an error from registry_token() as well, matching registry_url(), rather than silently sending no token and surfacing later as a 401.
• registry = "crates-io" on a dependency resolves to the built-in crates.io index instead of failing with "The registry 'crates-io' could not be found".
• IndexCache is keyed by index URL and token, so two registries sharing a URL, or one URL looked up with and without a token, no longer reuse the wrong client.
• Regression coverage: token precedence (env over files, credentials over config, nearest directory first), env-var name mangling, single- and multi-hop source replacement, cycle and missing-source errors, plus a local HTTP server asserting the Authorization header is present with a token and absent without.

Known gap: credential providers

Only static tokens are handled. The CARGO_REGISTRIES_<NAME>_TOKEN env var and a plaintext token in credentials.toml / config.toml. Cargo credential providers (registries.<name>.credential-provider, [registry] global-credential-providers, e.g. cargo:token-from-stdout, cargo:libsecret, or any credential-process) are not invoked. Users who keep their token in a provider rather than a plaintext token will still hit the 401. Matching cargo's full credential-provider resolution is left as a follow-up.

Review instructions

Start with registry_token() in src/registry.rs, resolution order and the crates.io opt-out. resolve_registry() is shared by registry_url() and registry_token(), so both follow the same replace-with chain; the token is looked up under the last name in that chain. Then RemoteIndex::krate in src/index.rs, where the header is attached right after the tame-index request is converted to a reqwest request. The src/bin/upgrade/upgrade.rs change is just wiring the token into the existing index.krate call. Worth scrutiny: the token precedence (env over file, credentials over config, nearest dir first) and the decision to send the token verbatim.

Closes #931

[Copilot]

Pull request overview

This PR updates cargo upgrade to authenticate sparse index requests for private registries by resolving a registry token (matching Cargo’s precedence rules) and attaching it as the Authorization header on the index HTTP request.

Changes:

• Added registry_token() to resolve per-registry auth tokens from env/config/credentials files while explicitly opting out for the default (crates.io) registry.
• Threaded an optional auth value through IndexCache/RemoteIndex and attach it as the Authorization header for remote sparse index requests.
• Wired token lookup into cargo upgrade, and added regression tests plus a changelog entry.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/registry.rs	Adds token resolution logic (registry_token) and unit tests for precedence/behavior.
src/lib.rs	Re-exports registry_token for use by binaries.
src/index.rs	Threads optional auth into remote index access and attaches Authorization header; adds request-capture tests.
src/bin/upgrade/upgrade.rs	Wires token resolution into the existing index lookup call in cargo upgrade.
CHANGELOG.md	Documents the fix in Unreleased notes.

Comments suppressed due to low confidence (1)

src/index.rs:93

• IndexCache is keyed only by registry Url, but the RemoteIndex stores auth as state. If the same Url is queried with different auth values in one run (e.g. default crates.io with None, then a named registry/source replacement mapping to the same Url with Some(token), or two names sharing an index Url), the cached RemoteIndex will keep the first auth value. This can either omit credentials (causing 401) or send a token on requests that were meant to be unauthenticated (credential leakage). Consider updating the cached RemoteIndex's auth on every access (or include auth in the cache key).

        if !self.index.contains_key(registry) {
            let index = AnyIndex::open(registry, self.certs_source, auth)?;
            let index = AnyIndexCache::new(index);
            self.index.insert(registry.clone(), index);
        }
        Ok(self.index.get_mut(registry).unwrap())
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sunsided]

@killercup Any interest in this?

[sunsided]

@mkatychev Hey, thanks a lot! I didn't follow up up on merge conflicts until I got an OK from @killercup; noticed the master branch was moving and didn't want to chase it all the time. 😅 Will apply your patch though, much appreciated!

[sunsided]

Re the suppressed Copilot note on IndexCache being keyed only by registry URL:

Fixed in 22e7082. IndexCache is now keyed by (Url, auth), so a token is never reused for, or withheld from, another lookup on the same index URL. Covered by auth_is_part_of_the_cache_key.