fix: pass the scope option to pacote for auth purposes

[nlf]

without the scope, the tarball url is passed through npm-package-arg which is expected to be able to identify a scope. since the url does not follow the standard npm registry url patterns, the scope is not identified and so we do not apply the correct registry-specific auth header.

this change makes it so the scope from the original package identifier is passed through to pacote, ensuring that the correct registry and auth header are identified.

References

Fixes npm/cli#2918

[ablackrose]

Is there an ETA for this to get merged and released? npm v6 is no longer active and we can't move to v7 until this fix is released.

[wraithgar]

@ablackrose thanks for the reminder. This seems to have slipped through the cracks.

[nlf]

@ablackrose this pull request is actually going to be closed as the implementation here we concluded wasn't the right place for it. instead, we did a pretty significant refactor of how auth is handled in npm-registry-fetch and published it as part of npm@7.11.1. we're currently at 7.18.1, which includes even more bug fixes.

can you please try updating to the latest version of npm 7 and seeing if you still have an issue? if you do, open a new issue at https://github.com/npm/cli and we can help figure out exactly what's going on. as much information as you can give us to reproduce the problem you're seeing is the fastest way to help us figure out a fix. thanks!

[ablackrose]

Yes, thanks for the work, the issue appears to be resolved in 7.18.1.