Support for bearer auth in .netrc

src/auth.rs

@@ -38,9 +38,9 @@ impl Auth {
 
     pub fn from_netrc(auth_type: AuthType, entry: netrc::Entry) -> Option<Auth> {
         match auth_type {
-            AuthType::basic => Some(Auth::Basic(entry.login, Some(entry.password))),
-            AuthType::bearer => None,
-            AuthType::digest => Some(Auth::Digest(entry.login, entry.password)),
+            AuthType::basic => Some(Auth::Basic(entry.login?, Some(entry.password))),
+            AuthType::bearer => Some(Auth::Bearer(entry.password)),
+            AuthType::digest => Some(Auth::Digest(entry.login?, entry.password)),
         }
     }
 
@@ -49,7 +49,7 @@ impl Auth {
     pub fn supports_netrc(auth_type: AuthType) -> bool {
         match auth_type {
             AuthType::basic => true,
-            AuthType::bearer => false,
+            AuthType::bearer => true,
             AuthType::digest => true,
         }
     }

src/netrc.rs

@@ -12,6 +12,9 @@
 //!
 //! - The default entry doesn't have to be at the end of the file.
 //!
+//! This implementation additionally handles entries with just a password and no login,
+//! to support using .netrc for bearer auth.
+//!
 //! HTTPie uses the implementation from Python's standard library
 //! (with a wrapper from requests).
 //!
@@ -35,7 +38,7 @@ use crate::utils::get_home_dir;
 
 #[derive(Debug, PartialEq, Eq)]
 pub struct Entry {
-    pub login: String,
+    pub login: Option<String>,
     pub password: String,
 }
 
@@ -217,7 +220,7 @@ impl<'a, R: BufRead> Parser<'a, R> {
         let state = self.state;
         self.state = EntryState::Wrong;
 
-        if let (Some(login), Some(password)) = (login.or(account), password) {
+        if let (login, Some(password)) = (login.or(account), password) {
             let entry = Entry { login, password };
             match state {
                 EntryState::Wrong => unreachable!("netrc: Should not have been storing info"),
@@ -317,9 +320,16 @@ mod tests {
             machine example.com password pass
             default login user
         ";
-        notfound(MISSING_USER, COM);
+        found(MISSING_USER, COM, None, "pass");
         notfound(MISSING_USER, ORG);
 
+        const DEFAULT_PASSWORD_MISSING_USER: &str = "
+            machine example.com password pass
+            default password def
+        ";
+        found(DEFAULT_PASSWORD_MISSING_USER, COM, None, "pass");
+        found(DEFAULT_PASSWORD_MISSING_USER, ORG, None, "def");
+
         const DEFAULT_LAST: &str = "
             machine example.com login ex password am
             default login def password ault
@@ -438,13 +448,20 @@ mod tests {
         notfound(STRANGE_CHARACTERS, COM);
     }
 
-    fn found(netrc: &str, host: url::Host<&str>, login: &str, password: &str) {
+    #[track_caller]
+    fn found(
+        netrc: &str,
+        host: url::Host<&str>,
+        login: impl Into<Option<&'static str>>,
+        password: &str,
+    ) {
         let entry = Parser::new(netrc.as_bytes(), host).parse().unwrap();
         let entry = entry.expect("Didn't find entry");
-        assert_eq!(entry.login, login);
+        assert_eq!(entry.login.as_deref(), login.into());
         assert_eq!(entry.password, password);
     }
 
+    #[track_caller]
     fn notfound(netrc: &str, host: url::Host<&str>) {
         let entry = Parser::new(netrc.as_bytes(), host).parse().unwrap();
         assert!(entry.is_none(), "Found entry");

tests/cli.rs

@@ -836,6 +836,45 @@ fn netrc_env_user_password_auth() {
         .success();
 }
 
+#[test]
+fn netrc_env_no_bearer_auth_unless_specified() {
+    // Test that we don't pass an authorization header if the .netrc contains no username,
+    // and the --auth-type=bearer flag isn't explicitly specified.
+    let server = server::http(|req| async move {
+        assert!(req.headers().get("Authorization").is_none());
+        hyper::Response::default()
+    });
+
+    let mut netrc = NamedTempFile::new().unwrap();
+    writeln!(netrc, "machine {}\npassword pass", server.host()).unwrap();
+
+    get_command()
+        .env("NETRC", netrc.path())
+        .arg(server.base_url())
+        .assert()
+        .success();
+}
+
+#[test]
+fn netrc_env_auth_type_bearer() {
+    // If we're using --auth-type=bearer, test that it's properly sent with a .netrc that
+    // contains only a password and no username.
+    let server = server::http(|req| async move {
+        assert_eq!(req.headers()["Authorization"], "Bearer pass");
+        hyper::Response::default()
+    });
+
+    let mut netrc = NamedTempFile::new().unwrap();
+    writeln!(netrc, "machine {}\npassword pass", server.host()).unwrap();
+
+    get_command()
+        .env("NETRC", netrc.path())
+        .arg(server.base_url())
+        .arg("--auth-type=bearer")
+        .assert()
+        .success();
+}
+
 #[test]
 fn netrc_file_user_password_auth() {
     for netrc_file in &[".netrc", "_netrc"] {