feat: authenticating when using remote archive

crates/weaver_codegen_test/build.rs

@@ -43,8 +43,8 @@ fn main() {
     let registry_path = VirtualDirectoryPath::LocalFolder {
         path: SEMCONV_REGISTRY_PATH.into(),
     };
-    let registry_repo =
-        RegistryRepo::try_new("main", &registry_path).unwrap_or_else(|e| process_error(&logger, e));
+    let registry_repo = RegistryRepo::try_new("main", &registry_path, None)
+        .unwrap_or_else(|e| process_error(&logger, e));
     let semconv_specs = SchemaResolver::load_semconv_specs(&registry_repo, true, FOLLOW_SYMLINKS)
         .ignore(|e| matches!(e.severity(), Some(miette::Severity::Warning)))
         .into_result_failing_non_fatal()

crates/weaver_common/src/test.rs

@@ -5,7 +5,7 @@
 use paris::error;
 use std::path::PathBuf;
 
-use rouille::{match_assets, Server};
+use rouille::{match_assets, Response, Server};
 use std::sync::mpsc::Sender;
 
 /// An error that can occur while starting the HTTP server.
@@ -33,13 +33,40 @@ impl ServeStaticFiles {
     /// Creates a new HTTP server that serves static files from a directory.
     /// Note: This server is only available for testing purposes.
     pub fn from(static_path: impl Into<PathBuf>) -> Result<Self, HttpServerError> {
+        Self::from_impl(static_path, None)
+    }
+
+    /// Same as [`Self::from`], but requires `Authorization: Bearer <token>` on every request.
+    /// Note: This server is only available for testing purposes.
+    pub fn from_with_bearer(
+        static_path: impl Into<PathBuf>,
+        token: impl Into<String>,
+    ) -> Result<Self, HttpServerError> {
+        Self::from_impl(static_path, Some(token.into()))
+    }
+
+    fn from_impl(
+        static_path: impl Into<PathBuf>,
+        token: Option<String>,
+    ) -> Result<Self, HttpServerError> {
         let static_path = static_path.into();
+
         let server = Server::new("127.0.0.1:0", move |request| {
+            if let Some(token) = token.as_ref() {
+                if !request
+                    .header("Authorization")
+                    .map(|h| h == format!("Bearer {}", token))
+                    .unwrap_or(false)
+                {
+                    return Response::text("Unauthorized").with_status_code(401);
+                }
+            }
             match_assets(request, &static_path)
         })
         .map_err(|e| HttpServerError {
             error: e.to_string(),
         })?;
+
         let port = server.server_addr().port();
         let (_, kill_switch) = server.stoppable();
         Ok(Self { kill_switch, port })
@@ -93,4 +120,27 @@ mod tests {
         assert!(result.is_err());
         assert!(matches!(result.unwrap_err(), ureq::Error::Status(404, _)));
     }
+
+    #[test]
+    fn test_http_server_with_bearer_auth() {
+        let token = "token";
+        let server = ServeStaticFiles::from_with_bearer("tests/test_data", token).unwrap();
+
+        let resp = ureq::get(&server.relative_path_to_url("file_a.yaml")).call();
+        assert!(resp.is_err());
+        assert!(matches!(resp.unwrap_err(), ureq::Error::Status(401, _)));
+
+        let resp = ureq::get(&server.relative_path_to_url("file_a.yaml"))
+            .set("Authorization", "wrong_token")
+            .call();
+        assert!(resp.is_err());
+        assert!(matches!(resp.unwrap_err(), ureq::Error::Status(401, _)));
+
+        let content = ureq::get(&server.relative_path_to_url("file_a.yaml"))
+            .set("Authorization", &format!("Bearer {}", token))
+            .call()
+            .unwrap();
+        assert_eq!(content.status(), 200);
+        assert_eq!(content.into_string().unwrap(), "file: A");
+    }
 }

crates/weaver_common/src/vdir.rs

@@ -276,7 +276,10 @@ impl VirtualDirectory {
     /// - Extracting local archives.
     ///
     /// Returns an [`Error`] if any operation fails (e.g. network issues, invalid paths, extraction failures).    
-    pub fn try_new(vdir_path: &VirtualDirectoryPath) -> Result<Self, Error> {
+    pub fn try_new(
+        vdir_path: &VirtualDirectoryPath,
+        auth_token: Option<&String>,
+    ) -> Result<Self, Error> {
         let vdir_path_repr = vdir_path.to_string();
         let vdir = match vdir_path {
             LocalFolder { path } => Ok(Self {
@@ -297,7 +300,13 @@ impl VirtualDirectory {
                 // Create a temporary directory for the virtual directory that will be deleted
                 // when the `VirtualDirectory` goes out of scope.
                 let tmp_dir = Self::create_tmp_repo()?;
-                Self::try_from_remote_archive(url, sub_folder.as_ref(), tmp_dir, vdir_path_repr)
+                Self::try_from_remote_archive(
+                    url,
+                    sub_folder.as_ref(),
+                    tmp_dir,
+                    vdir_path_repr,
+                    auth_token,
+                )
             }
         };
         vdir
@@ -593,6 +602,7 @@ impl VirtualDirectory {
     /// The sub_folder is used to filter the entries inside the archive to unpack.
     /// The temporary directory is created in the `.weaver/vdir_cache`.
     /// The temporary directory is deleted when the [`VirtualDirectory`] goes out of scope.
+    /// The auth_token is used to authenticate with the remote using Bearer schema.
     ///
     /// Arguments:
     /// - `id`: The unique identifier for the registry.
@@ -605,11 +615,18 @@ impl VirtualDirectory {
         sub_folder: Option<&String>,
         target_dir: TempDir,
         vdir_path: String,
+        auth_token: Option<&String>,
     ) -> Result<Self, Error> {
         let tmp_path = target_dir.path().to_path_buf();
 
+        let mut req = ureq::get(url);
+
+        if let Some(auth_token) = auth_token {
+            req = req.set("Authorization", format!("Bearer {}", auth_token).as_str());
+        };
+
         // Download the archive from the URL
-        let response = ureq::get(url).call().map_err(|e| InvalidRegistryArchive {
+        let response = req.call().map_err(|e| InvalidRegistryArchive {
             archive: url.to_owned(),
             error: e.to_string(),
         })?;
@@ -845,7 +862,7 @@ mod tests {
         let vdir_path = VirtualDirectoryPath::LocalFolder {
             path: "../../crates/weaver_codegen_test/semconv_registry".to_owned(),
         };
-        let repo = VirtualDirectory::try_new(&vdir_path).unwrap();
+        let repo = VirtualDirectory::try_new(&vdir_path, None).unwrap();
         let repo_path = repo.path().to_path_buf();
         assert!(repo_path.exists());
         assert!(
@@ -858,8 +875,12 @@ mod tests {
         assert!(repo_path.exists());
     }
 
-    fn check_archive(vdir_path: VirtualDirectoryPath, file_to_check: Option<&str>) {
-        let repo = VirtualDirectory::try_new(&vdir_path).unwrap();
+    fn check_archive(
+        vdir_path: VirtualDirectoryPath,
+        file_to_check: Option<&str>,
+        auth_token: Option<&String>,
+    ) {
+        let repo = VirtualDirectory::try_new(&vdir_path, auth_token).unwrap();
         let repo_path = repo.path().to_path_buf();
         // At this point, the repo should be cloned into a temporary directory.
         assert!(repo_path.exists());
@@ -885,23 +906,23 @@ mod tests {
             sub_folder: Some("model".to_owned()),
             refspec: None,
         };
-        check_archive(registry_path, None);
+        check_archive(registry_path, None, None);
     }
 
     #[test]
     fn test_semconv_registry_local_tar_gz_archive() {
         let registry_path = "../../test_data/semantic-conventions-1.26.0.tar.gz[model]"
             .parse::<VirtualDirectoryPath>()
             .unwrap();
-        check_archive(registry_path, Some("general.yaml"));
+        check_archive(registry_path, Some("general.yaml"), None);
     }
 
     #[test]
     fn test_semconv_registry_local_zip_archive() {
         let registry_path = "../../test_data/semantic-conventions-1.26.0.zip[model]"
             .parse::<VirtualDirectoryPath>()
             .unwrap();
-        check_archive(registry_path, Some("general.yaml"));
+        check_archive(registry_path, Some("general.yaml"), None);
     }
 
     #[test]
@@ -913,7 +934,7 @@ mod tests {
         )
         .parse::<VirtualDirectoryPath>()
         .unwrap();
-        check_archive(registry_path, Some("general.yaml"));
+        check_archive(registry_path, Some("general.yaml"), None);
     }
 
     #[test]
@@ -925,6 +946,23 @@ mod tests {
         )
         .parse::<VirtualDirectoryPath>()
         .unwrap();
-        check_archive(registry_path, Some("general.yaml"));
+        check_archive(registry_path, Some("general.yaml"), None);
+    }
+
+    #[test]
+    fn test_semconv_registry_authentication() {
+        let token = "token";
+        let server = ServeStaticFiles::from_with_bearer("tests/test_data", token).unwrap();
+        let registry_path = format!(
+            "{}[model]",
+            server.relative_path_to_url("semconv_registry_v1.26.0.zip")
+        )
+        .parse::<VirtualDirectoryPath>()
+        .unwrap();
+        check_archive(
+            registry_path,
+            Some("general.yaml"),
+            Some(&token.to_string()),
+        );
     }
 }

crates/weaver_resolver/src/lib.rs

@@ -449,7 +449,11 @@ impl SchemaResolver {
                         }))
                     } else {
                         let dependency = &dependencies[0];
-                        match RegistryRepo::try_new(&dependency.name, &dependency.registry_path) {
+                        match RegistryRepo::try_new(
+                            &dependency.name,
+                            &dependency.registry_path,
+                            None,
+                        ) {
                             Ok(registry_repo_dep) => Some(Self::load_semconv_specs_with_depth(
                                 &registry_repo_dep,
                                 true,
@@ -660,7 +664,7 @@ mod tests {
         let registry_path = VirtualDirectoryPath::LocalFolder {
             path: "data/multi-registry/custom_registry".to_owned(),
         };
-        let registry_repo = RegistryRepo::try_new("main", &registry_path)?;
+        let registry_repo = RegistryRepo::try_new("main", &registry_path, None)?;
         let result = SchemaResolver::load_semconv_specs(&registry_repo, true, true);
         match result {
             WResult::Ok(semconv_specs) => {
@@ -692,7 +696,7 @@ mod tests {
         let registry_path = VirtualDirectoryPath::LocalFolder {
             path: "data/multi-registry/app_registry".to_owned(),
         };
-        let registry_repo = RegistryRepo::try_new("app", &registry_path)?;
+        let registry_repo = RegistryRepo::try_new("app", &registry_path, None)?;
         let result = SchemaResolver::load_semconv_specs(&registry_repo, true, true);
 
         match result {
@@ -814,7 +818,7 @@ mod tests {
         let registry_path = VirtualDirectoryPath::LocalFolder {
             path: "data/multi-registry/app_registry".to_owned(),
         };
-        let registry_repo = RegistryRepo::try_new("app", &registry_path)?;
+        let registry_repo = RegistryRepo::try_new("app", &registry_path, None)?;
 
         // Try with depth limit of 1 - should fail at acme->otel transition
         let mut visited_registries = HashSet::new();
@@ -850,7 +854,7 @@ mod tests {
         let registry_path = VirtualDirectoryPath::LocalFolder {
             path: "data/circular-registry-test/registry_a".to_owned(),
         };
-        let registry_repo = RegistryRepo::try_new("registry_a", &registry_path)?;
+        let registry_repo = RegistryRepo::try_new("registry_a", &registry_path, None)?;
         let result = SchemaResolver::load_semconv_specs(&registry_repo, true, true);
 
         match result {

crates/weaver_semconv/src/registry.rs

@@ -389,7 +389,7 @@ mod tests {
         let registry_path = VirtualDirectoryPath::LocalFolder {
             path: "data".to_owned(),
         };
-        let registry_repo = RegistryRepo::try_new("test", &registry_path).unwrap();
+        let registry_repo = RegistryRepo::try_new("test", &registry_path, None).unwrap();
         let registry = SemConvRegistry::from_semconv_specs(&registry_repo, semconv_specs).unwrap();
         assert_eq!(registry.id(), "test");
         assert_eq!(registry.semconv_spec_count(), 2);

crates/weaver_semconv/src/registry_repo.rs

@@ -36,10 +36,11 @@ impl RegistryRepo {
     pub fn try_new(
         registry_id_if_no_manifest: &str,
         registry_path: &VirtualDirectoryPath,
+        auth_token: Option<&String>,
     ) -> Result<Self, Error> {
         let mut registry_repo = Self {
             id: Arc::from(registry_id_if_no_manifest),
-            registry: VirtualDirectory::try_new(registry_path)
+            registry: VirtualDirectory::try_new(registry_path, auth_token)
                 .map_err(Error::VirtualDirectoryError)?,
             manifest: None,
         };
@@ -115,7 +116,7 @@ mod tests {
         let registry_path = VirtualDirectoryPath::LocalFolder {
             path: "../../crates/weaver_codegen_test/semconv_registry".to_owned(),
         };
-        let repo = RegistryRepo::try_new("main", &registry_path).unwrap();
+        let repo = RegistryRepo::try_new("main", &registry_path, None).unwrap();
         let repo_path = repo.path().to_path_buf();
         assert!(repo_path.exists());
         assert!(

crates/weaver_semconv_gen/src/lib.rs

@@ -403,7 +403,7 @@ mod tests {
             path: "data".to_owned(),
         };
         let mut diag_msgs = DiagnosticMessages::empty();
-        let registry_repo = RegistryRepo::try_new("main", &registry_path)?;
+        let registry_repo = RegistryRepo::try_new("main", &registry_path, None)?;
         let generator = SnippetGenerator::try_from_registry_repo(
             &registry_repo,
             template,

src/registry/check.rs

@@ -52,7 +52,7 @@ pub(crate) fn command(args: &RegistryCheckArgs) -> Result<ExitDirectives, Diagno
 
     // Initialize the baseline registry if provided.
     let baseline_registry_repo = if let Some(baseline_registry) = &args.baseline_registry {
-        Some(RegistryRepo::try_new("baseline", baseline_registry)?)
+        Some(RegistryRepo::try_new("baseline", baseline_registry, None)?)
     } else {
         None
     };
@@ -142,6 +142,7 @@ mod tests {
                         },
                         follow_symlinks: false,
                         include_unreferenced: false,
+                        auth_token: None,
                     },
                     baseline_registry: None,
                     policy: PolicyArgs {
@@ -171,6 +172,7 @@ mod tests {
                         },
                         follow_symlinks: false,
                         include_unreferenced: false,
+                        auth_token: None,
                     },
                     baseline_registry: None,
                     policy: PolicyArgs {
@@ -198,6 +200,7 @@ mod tests {
                     },
                     follow_symlinks: false,
                     include_unreferenced: false,
+                    auth_token: None,
                 },
                 baseline_registry: None,
                 policy: PolicyArgs {

src/registry/diff.rs

@@ -88,8 +88,8 @@ pub(crate) fn command(args: &RegistryDiffArgs) -> Result<ExitDirectives, Diagnos
     info!("Checking registry `{}`", args.registry.registry);
 
     let registry_path = args.registry.registry.clone();
-    let main_registry_repo = RegistryRepo::try_new("main", &registry_path)?;
-    let baseline_registry_repo = RegistryRepo::try_new("baseline", &args.baseline_registry)?;
+    let main_registry_repo = RegistryRepo::try_new("main", &registry_path, None)?;
+    let baseline_registry_repo = RegistryRepo::try_new("baseline", &args.baseline_registry, None)?;
     let main_semconv_specs = load_semconv_specs(&main_registry_repo, args.registry.follow_symlinks)
         .capture_non_fatal_errors(&mut diag_msgs)?;
     let baseline_semconv_specs =
@@ -167,6 +167,7 @@ mod tests {
                         },
                         follow_symlinks: false,
                         include_unreferenced: false,
+                        auth_token: None,
                     },
                     baseline_registry: VirtualDirectoryPath::LocalFolder {
                         path: "tests/diff/registry_baseline/".to_owned(),
@@ -196,6 +197,7 @@ mod tests {
                     },
                     follow_symlinks: false,
                     include_unreferenced: false,
+                    auth_token: None,
                 },
                 baseline_registry: VirtualDirectoryPath::LocalFolder {
                     path: "tests/diff/registry_baseline/".to_owned(),

src/registry/emit.rs

@@ -98,6 +98,7 @@ mod tests {
                         },
                         follow_symlinks: false,
                         include_unreferenced: false,
+                        auth_token: None,
                     },
                     policy: PolicyArgs {
                         policies: vec![],