send referer header

2 files changed, 42 insertions, 0 deletions

diff --git a/lib/npm.js b/lib/npm.js
index a529862d5..c8965bdc6 100644
--- a/lib/npm.js
+++ b/lib/npm.js
@@ -191,20 +191,38 @@ Object.keys(abbrevs).concat(plumbing).forEach(function addCommand (c) {
     if (c === "la" || c === "ll") {
       npm.config.set("long", true)
     }
+
     npm.command = c
     if (commandCache[a]) return commandCache[a]
+
     var cmd = require(__dirname+"/"+a+".js")
+
     commandCache[a] = function () {
       var args = Array.prototype.slice.call(arguments, 0)
       if (typeof args[args.length - 1] !== "function") {
         args.push(defaultCb)
       }
       if (args.length === 1) args.unshift([])
+
+      npm.registry.refer = [a].concat(args[0]).map(function (arg) {
+        // exclude anything that might be a URL, path, or private module
+        // Those things will always have a slash in them somewhere
+        if (arg && arg.match(/\/|\\/)) {
+          return "[REDACTED]"
+        } else {
+          return arg
+        }
+      }).filter(function (arg) {
+        return arg
+      }).join(" ")
+
       cmd.apply(npm, args)
     }
+
     Object.keys(cmd).forEach(function (k) {
       commandCache[a][k] = cmd[k]
     })
+
     return commandCache[a]
   }, enumerable: fullList.indexOf(c) !== -1 })
 
diff --git a/test/tap/referer.js b/test/tap/referer.js
new file mode 100644
index 000000000..1b55ab026
--- /dev/null
+++ b/test/tap/referer.js
@@ -0,0 +1,24 @@
+var common = require("../common-tap.js")
+var test = require("tap").test
+var http = require("http")
+var server
+
+test("should send referer http header", function (t) {
+  var server = http.createServer(function (q, s) {
+    t.equal(q.headers.referer, "install foo")
+    s.statusCode = 404
+    s.end(JSON.stringify({error: "whatever"}))
+    this.close()
+  }).listen(common.port, function () {
+    var reg = "--registry=http://localhost:" + common.port
+    var args = [ "install", "foo", reg ]
+    common.npm(args, {}, function (er, code, so, se) {
+      if (er) {
+        throw er
+      }
+      // should not have ended nicely, since we returned an error
+      t.ok(code)
+      t.end()
+    })
+  })
+})