find auth for shrinkwrapped deps (fixes #7011)

This is a tiny bit hacky, but for private registries using scopes and
tarball auth, it will ensure that the bearer token / basic auth
credentials are passed for tarball dependencies when all the credentials
are properly configured. See the test for details of how the
configuration should look.

1 files changed, 7 insertions, 1 deletions

diff --git a/lib/cache.js b/lib/cache.js
index 1c5495405..357063551 100644
--- a/lib/cache.js
+++ b/lib/cache.js
@@ -82,6 +82,7 @@ var npm = require("./npm.js")
   , npa = require("npm-package-arg")
   , getStat = require("./cache/get-stat.js")
   , cachedPackageRoot = require("./cache/cached-package-root.js")
+  , mapToRegistry = require("./utils/map-to-registry.js")
 
 cache.usage = "npm cache add <tarball file>"
             + "\nnpm cache add <folder>"
@@ -289,7 +290,12 @@ function add (args, where, cb) {
         addLocal(p, null, cb)
         break
       case "remote":
-        addRemoteTarball(p.spec, {name : p.name}, null, null, cb)
+        // get auth, if possible
+        mapToRegistry(spec, npm.config, function (err, uri, auth) {
+          if (err) return cb(err)
+
+          addRemoteTarball(p.spec, {name : p.name}, null, auth, cb)
+        })
         break
       case "git":
         addRemoteGit(p.spec, false, cb)