From ee23b87eb696bb51f774065e8b811a9ac0b92eec Mon Sep 17 00:00:00 2001
From: Mitchell Hashimoto <mitchell.hashimoto@gmail.com>
Date: Sun, 9 Mar 2014 19:24:54 -0700
Subject: [PATCH] core: Private boxes authenticate metadata box URLs too

---
 lib/vagrant/action/builtin/box_add.rb         | 26 ++++++++++++++++---
 .../vagrant/action/builtin/box_add_test.rb    | 13 +++++++---
 2 files changed, 32 insertions(+), 7 deletions(-)

diff --git a/lib/vagrant/action/builtin/box_add.rb b/lib/vagrant/action/builtin/box_add.rb
index 2483aa65e..634015e26 100644
--- a/lib/vagrant/action/builtin/box_add.rb
+++ b/lib/vagrant/action/builtin/box_add.rb
@@ -241,8 +241,19 @@ module Vagrant
               providers[choice-1])
           end
 
+          provider_url = metadata_provider.url
+          if url != authenticated_url
+            # Authenticate the provider URL since we're using auth
+            hook_env    = env[:hook].call(:authenticate_box_url, box_urls: [provider_url])
+            authed_urls = hook_env[:box_urls]
+            if !authed_urls || authed_urls.length != 1
+              raise "Bad box authentication hook, did not generate proper results."
+            end
+            provider_url = authed_urls[0]
+          end
+
           box_add(
-            [metadata_provider.url],
+            [[provider_url, metadata_provider.url]],
             metadata.name,
             metadata_version.version,
             metadata_provider.name,
@@ -289,8 +300,14 @@ module Vagrant
             box_url = nil
 
             urls.each do |url|
+              show_url = nil
+              if url.is_a?(Array)
+                show_url = url[1]
+                url      = url[0]
+              end
+
               begin
-                box_url = download(url, env)
+                box_url = download(url, env, show_url: show_url)
                 break
               rescue Errors::DownloaderError => e
                 env[:ui].error(I18n.t(
@@ -383,9 +400,12 @@ module Vagrant
           # path as an instance variable so that the `#recover` method can
           # access it.
           if opts[:ui]
+            show_url = opts[:show_url]
+            show_url ||= url
+
             env[:ui].detail(I18n.t(
               "vagrant.box_downloading",
-              url: url))
+              url: show_url))
             if File.file?(d.destination)
               env[:ui].info(I18n.t("vagrant.actions.box.download.resuming"))
             end
diff --git a/test/unit/vagrant/action/builtin/box_add_test.rb b/test/unit/vagrant/action/builtin/box_add_test.rb
index b690f00bd..a1e479865 100644
--- a/test/unit/vagrant/action/builtin/box_add_test.rb
+++ b/test/unit/vagrant/action/builtin/box_add_test.rb
@@ -293,7 +293,7 @@ describe Vagrant::Action::Builtin::BoxAdd do
               "providers": [
                 {
                   "name": "virtualbox",
-                  "url":  "#{box_path}"
+                  "url":  "bar"
                 }
               ]
             }
@@ -311,10 +311,15 @@ describe Vagrant::Action::Builtin::BoxAdd do
         env[:box_url] = "foo"
 
         env[:hook] = double("hook")
-        env[:hook].should_receive(:call) do |name, opts|
+        env[:hook].stub(:call) do |name, opts|
           expect(name).to eq(:authenticate_box_url)
-          expect(opts[:box_urls]).to eq(["foo"])
-          { box_urls: [real_url] }
+          if opts[:box_urls] == ["foo"]
+            next { box_urls: [real_url] }
+          elsif opts[:box_urls] == ["bar"]
+            next { box_urls: [box_path.to_s] }
+          else
+            raise "UNKNOWN: #{opts[:box_urls].inspect}"
+          end
         end
 
         box_collection.should_receive(:add).with do |path, name, version, **opts|