fix: remove npm-cli-login for ssri security (#754)

GHSA-vx3p-948g-6vhq

![image](https://github.com/user-attachments/assets/4eaf45a2-f3da-45ba-9613-c3bcb62f31f2)

https://hub.docker.com/repository/docker/fengmk2/cnpmcore/tags/v4/sha256-38b310438907eec1f00da6f110f6f24c81c85e983833fddd08a31598510154f3

Author: fengmk2

Dockerfile

@@ -8,7 +8,8 @@ COPY . .
 
 RUN npm install -g npminstall --registry=https://registry.npmmirror.com \
   && npminstall -c \
-  && npm run tsc
+  && npm run tsc \
+  && npmupdate -c --production # remove devDependencies
 
 ENV NODE_ENV=production \
   EGG_SERVER_ENV=prod

app/port/controller/AccessController.ts

@@ -50,6 +50,4 @@ export class AccessController extends AbstractController {
 
     return res;
   }
-
-
 }

package.json

@@ -129,7 +129,6 @@
     "s3-cnpmcore": "^1.1.2"
   },
   "devDependencies": {
-    "@cnpmjs/npm-cli-login": "^1.1.0",
     "@eggjs/bin": "^7.1.0",
     "@eggjs/mock": "^6.0.7",
     "@elastic/elasticsearch-mock": "^2.0.0",

test/cli/CliUtil.ts

@@ -1,18 +1,23 @@
-import coffee from 'coffee';
+import fs from 'node:fs/promises';
 
 export async function npmLogin(registry: string, userconfig: string) {
-  await coffee
-    .spawn('npm-cli-login', [], {
-      env: {
-        ...process.env,
-        NPM_USER: 'testuser',
-        NPM_PASS: '123123123',
-        NPM_EMAIL: '[email protected]',
-        NPM_REGISTRY: registry,
-        NPM_RC_PATH: userconfig,
-      },
-    })
-    .debug()
-    .expect('code', 0)
-    .end();
+  const response = await fetch(`${registry}/-/user/org.couchdb.user:testuser`, {
+    headers: {
+      Authorization: 'Bearer 123123123',
+      'Content-Type': 'application/json',
+    },
+    method: 'PUT',
+    body: JSON.stringify({
+      name: 'testuser',
+      password: '123123123',
+      email: '[email protected]',
+      type: 'user',
+    }),
+  });
+  if (!response.ok) {
+    throw new Error(`Failed to login: ${await response.text()}`);
+  }
+  const body = await response.json();
+  const registryUrl = new URL(registry);
+  await fs.writeFile(userconfig, `\n//${registryUrl.host}/:_authToken=${body.token}\n`);
 }