Add support for defining credentials for uv in an environment variable

[zanieb]

Adds UV_AUTH_URLS which defines credentials that should be used for URLs if we make a request there.

This is helpful for cases where, e.g., you want to provide credentials for an index but you don't want to change the index URL semantics by setting UV_INDEX_URL.

Implemented by seeding the URL authentication cache with the value of the variable.

Supports things like:

• UV_AUTH_URLS="username:password@hostname"
• UV_AUTH_URLS="username@hostname"
• UV_AUTH_URLS="username:password@hostname username:password@other-hostname"
• UV_AUTH_URLS="username:password@hostname/prefix"

There's a small caveat here, that if you use an index URL like foo@hostname/simple and you provide a password bar:password@hostname — the password should not be used but requests to fetch wheels from a different, parent path e.g.hostname/files can allow use of bar:password. This requires #4583 to address. In the meantime, credentials should just be properly scoped.

[zanieb]

I want to write documentation for this and make sure it's actually solving people's problems, but the implementation is ready for review.

[charliermarsh]

Maybe UV_BASIC_AUTH_URLS? Feel free to ignore though.

[zanieb]

I don't love my name, so maybe. Will consider...

[mkniewallner]

Since auto-merge was enabled, apart from test and clippy failures, is there anything preventing the merge of this PR, or was it maybe just forgotten?

[zanieb]

I'm not getting a ton of signal about how useful it would be so it's relatively low priority.

More relevant though, I was on vacation and am just now noticing auto-merge failed.

[charliermarsh]

@zanieb -- My gut is to punt on this until we see more demand, but ultimately defer to you.

[mkniewallner]

I'm not getting a ton of signal about how useful it would be so it's relatively low priority.

Definitely not high priority IMO. Personally I can leave without it, since we can pass the entire index including credentials with UV_INDEX_URL and UV_EXTRA_INDEX_URL. So it's really just like a convenient thing to have, as I like the idea of having the index explicitly set in [tool.uv]. On projects where a lot of developers work on, having this explicit configuration makes things more obvious (although in fact, even without the feature, you can still explicitly set the index in [tool.uv] and override the entire thing with the env var, but this kinda repeats something that is already set).

Do you think the feature would also fit what is planned in #171, or are we thinking about providing another mechanism to provide credentials for this other feature (e.g. what Poetry does, where the credentials are set for a source name by including the name in the header)? If we're not sure yet, maybe we can hold off on merging this PR until the other feature is implemented, to try to come up with something that would ideally fit both use cases?

[zanieb]

@charliermarsh is going to start working on #171 soon and I think that will probably supersede this and include a design for index credentials.