feat(gradle): Support HTTP header authentication for repositories

Add support for Gradle `HttpHeaderAuthentication` defined for private
repositories inside `settings.gradle`.

Signed-off-by: Mateusz Los <mateusz.los@extern.wenovate.de>

Author: losmateusz1

plugins/package-managers/gradle-model/src/main/kotlin/GradleModel.kt

@@ -70,4 +70,6 @@ interface OrtRepository {
     val url: String
     val username: String?
     val password: String?
+    val headerName: String?
+    val headerValue: String?
 }

plugins/package-managers/gradle-plugin/src/main/kotlin/GradleModelExtensions.kt

@@ -27,6 +27,8 @@ import org.gradle.api.artifacts.repositories.ArtifactRepository
 import org.gradle.api.artifacts.repositories.AuthenticationSupported
 import org.gradle.api.artifacts.repositories.UrlArtifactRepository
 import org.gradle.api.attributes.AttributeContainer
+import org.gradle.api.credentials.HttpHeaderCredentials
+import org.gradle.authentication.http.HttpHeaderAuthentication
 import org.gradle.internal.deprecation.DeprecatableConfiguration
 import org.gradle.util.GradleVersion
 
@@ -71,10 +73,28 @@ internal fun RepositoryHandler.associateNamesWithUrlsTo(repositories: MutableMap
  * Convert this [UrlArtifactRepository] to an [OrtRepository] by extracting the relevant properties.
  */
 internal fun UrlArtifactRepository.toOrtRepository(): OrtRepository {
-    val credentials = (this as? AuthenticationSupported)?.credentials
-    return OrtRepositoryImpl(
-        url = url.toString(),
-        username = credentials?.username,
-        password = credentials?.password
-    )
+    val authSupported = this as? AuthenticationSupported
+
+    val isHttpHeaderAuth = authSupported?.authentication
+        ?.any { it is HttpHeaderAuthentication } == true
+
+    return if (isHttpHeaderAuth) {
+        val headerCredentials = authSupported?.getCredentials(HttpHeaderCredentials::class.java)
+        OrtRepositoryImpl(
+            url = url.toString(),
+            username = null,
+            password = null,
+            headerName = headerCredentials?.name,
+            headerValue = headerCredentials?.value
+        )
+    } else {
+        val credentials = authSupported?.credentials
+        OrtRepositoryImpl(
+            url = url.toString(),
+            username = credentials?.username,
+            password = credentials?.password,
+            headerName = null,
+            headerValue = null
+        )
+    }
 }

plugins/package-managers/gradle-plugin/src/main/kotlin/OrtModelImpl.kt

@@ -81,5 +81,7 @@ internal class OrtVcsModelImpl(
 internal class OrtRepositoryImpl(
     override val url: String,
     override val username: String?,
-    override val password: String?
+    override val password: String?,
+    override val headerName: String?,
+    override val headerValue: String?
 ) : OrtRepository, Serializable

plugins/package-managers/gradle/src/main/kotlin/Gradle.kt

@@ -338,7 +338,13 @@ private fun getGradleProperties(): Map<String, String> =
  */
 private fun OrtRepository.toRemoteRepository(): RemoteRepository =
     RemoteRepository.Builder(url, "default", url).apply {
-        if (username != null) {
+        if (headerName != null && headerValue != null) {
+            setAuthentication(
+                AuthenticationBuilder().apply {
+                    addString(headerName, headerValue)
+                }.build()
+            )
+        } else if (username != null) {
             setAuthentication(
                 AuthenticationBuilder().apply {
                     addUsername(username)

plugins/package-managers/gradle/src/main/resources/init.gradle

@@ -26,6 +26,8 @@ import org.gradle.api.internal.artifacts.DefaultProjectComponentIdentifier
 import org.gradle.api.internal.artifacts.repositories.DefaultFlatDirArtifactRepository
 import org.gradle.api.internal.artifacts.repositories.DefaultIvyArtifactRepository
 import org.gradle.api.internal.artifacts.repositories.DefaultMavenArtifactRepository
+import org.gradle.authentication.http.HttpHeaderAuthentication
+import org.gradle.api.credentials.HttpHeaderCredentials
 import org.gradle.internal.build.BuildState
 import org.gradle.tooling.provider.model.ToolingModelBuilder
 import org.gradle.tooling.provider.model.ToolingModelBuilderRegistry
@@ -85,6 +87,8 @@ interface OrtRepository {
     String getUrl()
     String getUsername()
     String getPassword()
+    String getHeaderName()
+    String getHeaderValue()
 }
 
 @ToString(includeNames = true)
@@ -127,6 +131,8 @@ class OrtRepositoryImpl implements OrtRepository, Serializable {
     String url = ''
     String username = null
     String password = null
+    String headerName = null
+    String headerValue = null
 }
 
 class OrtDependencyTreeGradlePlugin extends AbstractOrtDependencyTreePlugin<Gradle> {
@@ -239,7 +245,13 @@ class AbstractOrtDependencyTreePlugin<T> implements Plugin<T> {
 
             List<OrtRepository> repositories = project.repositories.findResults {
                 if (it instanceof DefaultMavenArtifactRepository) {
-                    new OrtRepositoryImpl(it.url.toString(), it.credentials?.username, it.credentials?.password)
+                    def isHttpHeader = it.authentication.any { auth -> auth instanceof HttpHeaderAuthentication }
+                    if (isHttpHeader) {
+                        def headerCreds = it.getCredentials(HttpHeaderCredentials)
+                        new OrtRepositoryImpl(it.url.toString(), null, null, headerCreds?.name, headerCreds?.value)
+                    } else {
+                        new OrtRepositoryImpl(it.url.toString(), it.credentials?.username, it.credentials?.password, null, null)
+                    }
                 } else if (it instanceof DefaultFlatDirArtifactRepository) {
                     warnings.add('Project uses a flat dir repository which is not supported by the analyzer. ' +
                             "Dependencies from this repository will be ignored: ${it.dirs}".toString())