Support setting Proxy-Authorization HTTP headers. - #3916

--header is never sent on the CONNECT request, so this gets a 407 for every https:// download. Worse, when the proxy is authenticated some other way, the header goes through the tunnel to the origin server. curl has --proxy-header for exactly this (since 7.37.0, 2014). It's sent to the proxy only, both on CONNECT and on plain HTTP requests.

wget has no way to send an arbitrary header to the proxy (only --proxy-user/--proxy-password, which are Basic), so under wget this should fail clearly rather than fall back to --header:

(I checked this in sh/dash/bash/zsh against the mock proxy: an HTTPS download through it succeeds, the header appears only on the CONNECT and not on the request to the origin, and under wget it errors without running wget.)

This example is Basic auth, which already works with no nvm change: export https_proxy="http://user:password@proxy.example.com:3128" (and the same for http_proxy). I think this section should lead with that, and present $NVM_PROXY_AUTH_HEADER as being for other schemes (eg, Bearer), noting that it requires curl.

All of these use a plain http:// origin, so the proxy only ever sees absolute-form requests, and mock-proxy.js's CONNECT handler never runs. That's the path that's broken (and that nvm actually uses for nodejs.org). Please add an HTTPS case that goes through CONNECT, and ideally assert that Proxy-Authorization reaches the proxy but not the origin, eg by having httpbin echo the headers it received.

This installs a full Node release from the network inside a fast test, only to run the mock proxy, and never uninstalls it, so it stays in $NVM_DIR/versions. If Node can't be installed, the test exits 0, so it "passes" without testing anything. Can the mock run some lighter way, or the test move out of fast and clean up after itself?

Alternatively, a much cheaper test wouldn't need a proxy at all: put an executable curl stub first on PATH that records its arguments (like the MOCK_BIN in test/fast/Unit tests/nvm_echo), then assert that nvm_download passes --proxy-header 'Proxy-Authorization: …' and never --header 'Proxy-Authorization: …'. (A shell function named curl won't work: nvm_download runs command curl, which skips functions; see test/fast/Unit tests/nvm_download and curl helpers bypass shadowed curl.) That only proves nvm passes the right flag, not that curl sends it to the proxy, but the mock proxy doesn't prove that either until the test has an HTTPS case.

This moves the real $NVM_DIR/alias aside under set -ex, but cleanup only runs from die or at the very end; there's no trap. If any command fails outside an || die, the script exits with the aliases still sitting in alias.test-bak. A trap cleanup EXIT (or avoiding the move entirely) would make this safe.