Cargo: Allow requiring authentication for all operations

[jdemilledt]

Describe the problem you are trying to solve
Currently, for methods such as search, cargo does not offer authentication to alternative registries. For companies with private projects, this is an issue.

Describe the solution you'd like
Have a config option (or automatically) to pass Authorization headers to all API functions.

Notes
Adds on to #6843.

[jdemilledt]

I am beginning to program a solution to this.

[ehuss]

This may need an RFC process to move forward, since authentication can be a tricky thing, and different people may have different requirements.

I think ideally the authentication requirements for a registry would be defined in config.json. Just including the token in more requests would be trivial. But there may be more to do, and it would be good if was easy to extend in the future.

cc #6843

[jdemilledt]

The pre-RFC is here: https://internals.rust-lang.org/t/pre-rfc-configurable-authentication-requirements-and-non-git-indices/10513/10

[TimDiekmann]

This may need an RFC process to move forward, since authentication can be a tricky thing, and different people may have different requirements.

Currently, all methods but search and download passes the authentication token. It's inconsistent to not pass it to those methods, and - as you mentioned - it would be trivial to implement it.

Sure, token based authentication won't fulfill all users need, but when another authentication method will be implemented, the other API methods has to be changed as well and the tokens may be used as default.

[mcorbin]

I'm also waiting for this feature.
I had to disable authentication for search and download on my alternative registry, which feels a bit strange.

[lskillen]

:+1: from us at @cloudsmith-io; we've got customers that have asked us to implement the search endpoints, but without authentication this makes it difficult to do that.