bower-auth

BOWER for private organizations

Adapted version of Bower package manager in order to provide support for private hosted + authenticated Web components dependencies.

It implements a initial version of the authrc specification.

Note that this is an experimental implementation, use it under your own risk

About

Bower is a package manager for the web. It offers a generic, unopinionated solution to the problem of front-end package management, while exposing the package dependency model via an API that can be consumed by a more opinionated build stack. There are no system wide dependencies, no dependencies are shared between different apps, and the dependency tree is flat.

Bower runs over Git, and is package-agnostic. A packaged component can be made up of any type of asset, and use any type of transport (e.g., AMD, CommonJS, etc.).

View all packages available through Bower's registry.

Installing Bower

Bower depends on Node and npm. It's installed globally using npm:

npm install -g bower-auth

Also make sure that git is installed as some bower packages require it to be fetched and installed.

Usage

Much more information is available via bower-auth help once it's installed. This is just enough to get you started.

Warning

On prezto or oh-my-zsh, do not forget to alias bower-auth='noglob bower-auth' or bower-auth install jquery\#1.9.1

Running commands with sudo

Bower is a user command, there is no need to execute it with superuser permissions. However, if you still want to run commands with sudo, use --allow-root option.

Installing packages and dependencies

Bower offers several ways to install packages:

# Using the dependencies listed in the current directory's bower.json
bower-auth install
# Using a local or remote package
bower-auth install <package>
# Using a specific version of a package
bower-auth install <package>#<version>
# Using a different name and a specific version of a package
bower-auth install <name>=<package>#<version>

Where <package> can be any one of the following:

• A name that maps to a package registered with Bower, e.g, jquery. ‡
• A remote Git endpoint, e.g., git://github.com/someone/some-package.git. Can be public or private. ‡
• A local endpoint, i.e., a folder that's a Git repository. ‡
• A shorthand endpoint, e.g., someone/some-package (defaults to GitHub). ‡
• A URL to a file, including zip and tar files. Its contents will be extracted.

‡ These types of <package> might have versions available. You can specify a semver compatible version to fetch a specific release, and lock the package to that version. You can also use ranges to specify a range of versions.

All package contents are installed in the bower_components directory by default. You should never directly modify the contents of this directory.

Using bower-auth list will show all the packages that are installed locally.

N.B. If you aren't authoring a package that is intended to be consumed by others (e.g., you're building a web app), you should always check installed packages into source control.

Finding packages

To search for packages registered with Bower:

bower-auth search [<name>]

Using just bower-auth search will list all packages in the registry.

Using packages

The easiest approach is to use Bower statically, just reference the package's installed components manually using a script tag:

<script src="/bower_components/jquery/index.js"></script>

For more complex projects, you'll probably want to concatenate your scripts or use a module loader. Bower is just a package manager, but there are plenty of other tools -- such as Sprockets and RequireJS -- that will help you do this.

Registering packages

To register a new package:

• There must be a valid manifest JSON in the current working directory.
• Your package should use semver Git tags.
• Your package must be available at a Git endpoint (e.g., GitHub); remember to push your Git tags!

Then use the following command:

bower-auth register <my-package-name> <git-endpoint>

The Bower registry does not have authentication or user management at this point in time. It's on a first come, first served basis. Think of it like a URL shortener. Now anyone can run bower-auth install <my-package-name>, and get your library installed.

There is no direct way to unregister a package yet. For now, you can request a package be unregistered.

Uninstalling packages

To uninstall a locally installed package:

bower-auth uninstall <package-name>

Configuration

Bower can be configured using JSON in a .bowerrc file.

The current spec can be read here in the Configuration section.

Defining a package

You must create a bower.json in your project's root, and specify all of its dependencies. This is similar to Node's package.json, or Ruby's Gemfile, and is useful for locking down a project's dependencies.

NOTE: In versions of Bower before 0.9.0 the package metadata file was called component.json rather than bower.json. This has changed to avoid a name clash with another tool. You can still use component.json for now but it is deprecated and the automatic fallback is likely to be removed in an upcoming release.

You can interactively create a bower.json with the following command:

bower-auth init

The bower.json defines several options:

• name (required): The name of your package.
• version: A semantic version number (see semver).
• main [string|array]: The primary endpoints of your package.
• ignore [array]: An array of paths not needed in production that you want Bower to ignore when installing your package.
• dependencies [hash]: Packages your package depends upon in production.
• devDependencies [hash]: Development dependencies.
• private [boolean]: Set to true if you want to keep the package private and do not want to register the package in future.

{
  "name": "my-project",
  "version": "1.0.0",
  "main": "path/to/main.css",
  "ignore": [
    ".jshintrc",
    "**/*.txt"
  ],
  "dependencies": {
    "<name>": "<version>",
    "<name>": "<folder>",
    "<name>": "<package>"
  },
  "devDependencies": {
    "<test-framework-name>": "<version>"
  }
}

Consuming a package

Bower also makes available a source mapping. This can be used by build tools to easily consume Bower packages.

If you pass the --paths option to Bower's list command, you will get a simple path-to-name mapping:

{
  "backbone": "bower_components/backbone/index.js",
  "jquery": "bower_components/jquery/index.js",
  "underscore": "bower_components/underscore/index.js"
}

Alternatively, every command supports the --json option that makes bower output JSON. Command result is outputted to stdout and error/logs to stderr.

Programmatic API

Bower provides a powerful, programmatic API. All commands can be accessed through the bower.commands object.

var bower = require('bower-auth');

bower.commands
.install(['jquery'], { save: true }, { /* custom config */ })
.on('end', function (installed) {
    console.log(installed);
});

bower.commands
.search('jquery', {})
.on('end', function (results) {
    console.log(results);
});

Commands emit four types of events: log, prompt, end, error.

• log is emitted to report the state/progress of the command.
• prompt is emitted whenever the user needs to be prompted.
• error will only be emitted if something goes wrong.
• end is emitted when the command successfully ends.

For a better of idea how this works, you may want to check out our bin file.

When using bower programmatically, prompting is disabled by default. Though you can enable it when calling commands with interactive: true in the config. This requires you to listen for the prompt event and handle the prompting yourself. The easiest way is to use the inquirer npm module like so:

var inquirer =  require('inquirer');

bower.commands
.install(['jquery'], { save: true }, { interactive: true })
// ..
.on('prompt', function (prompts, callback) {
    inquirer.prompt(prompts, callback);
});

Completion (experimental)

NOTE: Completion is still not implemented for the 1.0.0 release

Bower now has an experimental completion command that is based on, and works similarly to the npm completion. It is not available for Windows users.

This command will output a Bash / ZSH script to put into your ~/.bashrc, ~/.bash_profile, or ~/.zshrc file.

bower-auth completion >> ~/.bash_profile

A note for Windows users

To use Bower on Windows, you must install msysgit correctly. Be sure to check the option shown below:

Note that if you use TortoiseGit and if Bower keeps asking for your SSH password, you should add the following environment variable: GIT_SSH - C:\Program Files\TortoiseGit\bin\TortoisePlink.exe. Adjust the TortoisePlink path if needed.

Contact

Have a question?

• StackOverflow
• Mailinglist - [e-mail]
• #bower on Freenode

Contributing to this project

Anyone and everyone is welcome to contribute. Please take a moment to review the guidelines for contributing.

• Bug reports
• Feature requests
• Pull requests

Authors

• @fat
• @maccman
• @satazor

Thanks for assistance and contributions:

@addyosmani, @angus-c, @borismus, @carsonmcdonald, @chriseppstein, @danwrong, @davidmaxwaterman, @desandro, @hemanth, @isaacs, @josh, @jrburke, @marcelombc, @marcooliveira, @mklabs, @MrDHat, @necolas, @paulirish, @richo, @rvagg, @sindresorhus, @SlexAxton, @sstephenson, @svnlto, @tomdale, @uzquiano, @visionmedia, @wagenet, @wibblymat, @wycats

License

Copyright 2013 Twitter, Inc.

Licensed under the MIT License

Changelog

1.2.7 - 2013-09-29

• Do not swallow sync errors when using the programmatic API (#849)
• Fix resolutions not being saved if --force-latest is specified (#861)
• Fix bower register warning about URL conversion, even if no conversion occurred
• Fix bower update not correctly catching up branch commits
• Add configured directory in .bowerrc to the ignores in bower init (#854)
• Fix some case sensitive issues with data stored in registry cache (e.g.: jquery/jQuery, #859)
• Fix bower not checking out a tag if it looks like a semver (e.g.: 1.0, #872)
• Fix install & update commands printing the wrong versions in some cases (#879)
• Give priority to mime type headers when deciding if a package need to be extracted, except if it is octet-stream

NOTE: It's advisable that users run bower cache clean.