Merge pull request finos#1551 from Andreybest/1541-http-basic-ntlm

feat(upstream-proxy): add HTTP Basic and NTLM auth methods

Author: jescalada

config.schema.json

@@ -472,6 +472,43 @@
           "items": {
             "type": "string"
           }
+        },
+        "auth": {
+          "description": "Credentials presented to the upstream proxy. Preferred over embedding credentials in `url`.",
+          "oneOf": [
+            {
+              "type": "object",
+              "name": "Basic Auth",
+              "description": "HTTP Basic — sends base64(username:password) in the Proxy-Authorization header on every CONNECT.",
+              "properties": {
+                "type": { "type": "string", "const": "basic" },
+                "username": { "type": "string" },
+                "password": { "type": "string" }
+              },
+              "required": ["type", "username", "password"],
+              "additionalProperties": false
+            },
+            {
+              "type": "object",
+              "name": "NTLM Auth",
+              "description": "Windows NTLM — multi-round CONNECT handshake (Type1/Type2/Type3) on the same TCP connection. Use when the proxy advertises `Proxy-Authenticate: NTLM`.",
+              "properties": {
+                "type": { "type": "string", "const": "ntlm" },
+                "username": { "type": "string" },
+                "password": { "type": "string" },
+                "domain": {
+                  "type": "string",
+                  "description": "NTLM domain / target. Optional; defaults to empty (proxy decides)."
+                },
+                "workstation": {
+                  "type": "string",
+                  "description": "Workstation name reported in the Type1/Type3 messages. Optional; defaults to the host's name."
+                }
+              },
+              "required": ["type", "username", "password"],
+              "additionalProperties": false
+            }
+          ]
         }
       },
       "additionalProperties": false

package-lock.json

@@ -112,6 +112,7 @@
     "@material-ui/icons": "4.11.3",
     "@primer/octicons-react": "^19.21.2",
     "@seald-io/nedb": "^4.1.2",
+    "agent-base": "^7.1.4",
     "axios": "^1.18.1",
     "bcryptjs": "^3.0.3",
     "clsx": "^2.1.1",
@@ -127,6 +128,7 @@
     "express-session": "^1.19.0",
     "font-awesome": "^4.7.0",
     "history": "5.3.0",
+    "httpntlm": "^1.8.13",
     "https-proxy-agent": "^7.0.6",
     "isomorphic-git": "^1.36.3",
     "jsonwebtoken": "^9.0.3",
@@ -205,7 +207,8 @@
     "vitest": "^3.2.7"
   },
   "overrides": {
-    "rolldown": "1.0.1"
+    "rolldown": "1.0.1",
+    "underscore": "^1.13.8"
   },
   "optionalDependencies": {
     "@esbuild/darwin-arm64": "^0.27.2",

package.json

@@ -681,6 +681,11 @@ export interface RouteAuthRule {
  * Configuration for routing outbound requests to upstream Git hosts via an HTTP(S) proxy.
  */
 export interface UpstreamProxy {
+  /**
+   * Credentials presented to the upstream proxy. Preferred over embedding credentials in
+   * `url`.
+   */
+  auth?: Auth;
   /**
    * Whether to use an outbound HTTP(S) proxy for upstream Git hosts.
    */
@@ -695,6 +700,36 @@ export interface UpstreamProxy {
   url?: string;
 }
 
+/**
+ * Credentials presented to the upstream proxy. Preferred over embedding credentials in
+ * `url`.
+ *
+ * HTTP Basic — sends base64(username:password) in the Proxy-Authorization header on every
+ * CONNECT.
+ *
+ * Windows NTLM — multi-round CONNECT handshake (Type1/Type2/Type3) on the same TCP
+ * connection. Use when the proxy advertises `Proxy-Authenticate: NTLM`.
+ */
+export interface Auth {
+  password: string;
+  type: AuthType;
+  username: string;
+  /**
+   * NTLM domain / target. Optional; defaults to empty (proxy decides).
+   */
+  domain?: string;
+  /**
+   * Workstation name reported in the Type1/Type3 messages. Optional; defaults to the host's
+   * name.
+   */
+  workstation?: string;
+}
+
+export enum AuthType {
+  Basic = 'basic',
+  NTLM = 'ntlm',
+}
+
 // Converts JSON strings to/from your types
 // and asserts the results of JSON.parse at runtime
 export class Convert {
@@ -1147,12 +1182,24 @@ const typeMap: any = {
   ),
   UpstreamProxy: o(
     [
+      { json: 'auth', js: 'auth', typ: u(undefined, r('Auth')) },
       { json: 'enabled', js: 'enabled', typ: u(undefined, true) },
       { json: 'noProxy', js: 'noProxy', typ: u(undefined, a('')) },
       { json: 'url', js: 'url', typ: u(undefined, '') },
     ],
     false,
   ),
+  Auth: o(
+    [
+      { json: 'password', js: 'password', typ: '' },
+      { json: 'type', js: 'type', typ: r('AuthType') },
+      { json: 'username', js: 'username', typ: '' },
+      { json: 'domain', js: 'domain', typ: u(undefined, '') },
+      { json: 'workstation', js: 'workstation', typ: u(undefined, '') },
+    ],
+    false,
+  ),
   AuthenticationElementType: ['ActiveDirectory', 'jwt', 'local', 'openidconnect'],
   DatabaseType: ['fs', 'mongo'],
+  AuthType: ['basic', 'ntlm'],
 };