feat(auth): refactor authentication handling for plugins and add tests

internal/pluginstore/auth.go

@@ -96,6 +96,37 @@ func AuthConfigured(auth []AuthConfig, requestURL string, kind string) bool {
 	}
 }
 
+func PluginAuthConfigured(source Source, plugin Plugin, auth []AuthConfig) bool {
+	if AuthConfigured(auth, source.URL, RequestKindRegistry) {
+		return true
+	}
+	switch PluginInstallType(plugin) {
+	case InstallTypeDirect:
+		for _, artifact := range PluginArtifacts(plugin) {
+			if AuthConfigured(auth, artifact.URL, RequestKindArtifact) {
+				return true
+			}
+		}
+	case InstallTypeGitHubRelease:
+		return pluginGitHubReleaseAuthConfigured(plugin, auth)
+	}
+	return false
+}
+
+func pluginGitHubReleaseAuthConfigured(plugin Plugin, auth []AuthConfig) bool {
+	owner, repo, errRepository := GitHubRepositoryParts(plugin.Repository)
+	if errRepository != nil {
+		return false
+	}
+	releasesURL := fmt.Sprintf(
+		"https://api.github.com/repos/%s/%s/releases/",
+		url.PathEscape(owner),
+		url.PathEscape(repo),
+	)
+	return AuthConfigured(auth, releasesURL+"latest", RequestKindMetadata) ||
+		AuthConfigured(auth, releasesURL+"tags/", RequestKindMetadata)
+}
+
 func applyPluginStoreAuth(headers http.Header, auth []AuthConfig, requestURL string, kind string) error {
 	item, ok := matchingAuthConfig(auth, requestURL, kind)
 	if !ok {

internal/pluginstore/auth_test.go

@@ -44,6 +44,73 @@ func TestPluginStoreAuthMatchesURLHostAndPathBoundaries(t *testing.T) {
 	}
 }
 
+func TestPluginAuthConfiguredCoversInstallRequestKinds(t *testing.T) {
+	t.Setenv("PLUGIN_STORE_TOKEN", "secret-token")
+
+	source := Source{URL: "https://registry.example/registry.json"}
+	directPlugin := Plugin{
+		ID:      "sample-provider",
+		Version: "1.0.0",
+		Install: InstallPlan{
+			Type: InstallTypeDirect,
+			Artifacts: []Artifact{{
+				GOOS:   "linux",
+				GOARCH: "amd64",
+				URL:    "https://downloads.example/private/sample-provider.zip",
+				SHA256: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+			}},
+		},
+	}
+	gitHubPlugin := Plugin{
+		ID:         "sample-provider",
+		Repository: "https://github.com/author-name/sample-provider",
+	}
+
+	tests := []struct {
+		name   string
+		plugin Plugin
+		auth   []AuthConfig
+	}{
+		{
+			name:   "registry",
+			plugin: gitHubPlugin,
+			auth: []AuthConfig{{
+				Match:    "https://registry.example/",
+				ApplyTo:  []string{RequestKindRegistry},
+				Type:     AuthTypeBearer,
+				TokenEnv: "PLUGIN_STORE_TOKEN",
+			}},
+		},
+		{
+			name:   "direct artifact",
+			plugin: directPlugin,
+			auth: []AuthConfig{{
+				Match:    "https://downloads.example/private/",
+				ApplyTo:  []string{RequestKindArtifact},
+				Type:     AuthTypeBearer,
+				TokenEnv: "PLUGIN_STORE_TOKEN",
+			}},
+		},
+		{
+			name:   "github metadata",
+			plugin: gitHubPlugin,
+			auth: []AuthConfig{{
+				Match:    "https://api.github.com/repos/author-name/sample-provider/releases/",
+				ApplyTo:  []string{RequestKindMetadata},
+				Type:     AuthTypeBearer,
+				TokenEnv: "PLUGIN_STORE_TOKEN",
+			}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if !PluginAuthConfigured(source, tt.plugin, tt.auth) {
+				t.Fatal("PluginAuthConfigured() = false, want true")
+			}
+		})
+	}
+}
+
 func TestPluginStoreAuthHeaderIsReevaluatedAcrossRedirect(t *testing.T) {
 	t.Setenv("PLUGIN_STORE_HEADER", "secret-token")