proxy mirror and mirror API jobs resolved download URLs with a bare fetch.NewResolver(), so npm, cargo, gem, golang, hex, pub, maven and nuget packages came from the public registries whatever upstream.* says. The resolver now takes the configured upstreams through fetch.WithBaseURLs (registries v0.11.0, git-pkgs/registries#103).
npm packages in upstream.npm_routes get their own resolver with the route as base URL, so a public package can't stand in for a routed one. They're stored under the route's filename prefix, the way the npm handler stores them; without that a client would never see the mirrored tarball. The test mirrors a routed package, stops the route and checks the npm handler serves it from the cache.
With PROXY_UPSTREAM_NPM=http://127.0.0.1:1, proxy mirror pkg:npm/[email protected] downloads from registry.npmjs.org on main and now fails on the unreachable upstream.
Only the mirror resolves through the resolver; handlers serving clients take URLs from upstream metadata, so they're unaffected.
This doesn't depend on #548. Both add the same handler.RoutedPackageURL, and merging #548, #549 and this onto main gave no conflicts in the three orders I tried.
The rest of #414, resolving pypi, composer, conda, helm and the other ecosystems, still needs registry clients registered on the resolver, so this refs the issue.
Refs #414