feat(pypi): builder for netrc and auth_patterns

With this we move closer towards starting playing with the API to fully
replace `pip.parse` with `pip.configure` builder pattern for better
expressiveness.

Work towards #2747

Author: aignas

CHANGELOG.md

@@ -115,7 +115,8 @@ END_UNRELEASED_TEMPLATE
   ([#3114](https://github.com/bazel-contrib/rules_python/pull/3114)).
 * (pypi) To configure the environment for `requirements.txt` evaluation, use the newly added
   developer preview of the `pip.default` tag class. Only `rules_python` and root modules can use
-  this feature. You can also configure custom `config_settings` using `pip.default`.
+  this feature. You can also configure custom `config_settings` using `pip.default`. It
+  can also be used to set the global `netrc` or `auth_patterns` variables.
 * (pypi) PyPI dependencies now expose an `:extracted_whl_files` filegroup target
   of all the files extracted from the wheel. This can be used in lieu of
   {obj}`whl_filegroup` to avoid copying/extracting wheel multiple times to

python/private/pypi/extension.bzl

@@ -288,8 +288,8 @@ def _create_whl_repos(
                 src = src,
                 whl_library_args = whl_library_args,
                 download_only = pip_attr.download_only,
-                netrc = pip_attr.netrc,
-                auth_patterns = pip_attr.auth_patterns,
+                netrc = config.netrc or pip_attr.netrc,
+                auth_patterns = config.auth_patterns or pip_attr.auth_patterns,
                 python_version = major_minor,
                 is_multiple_versions = whl.is_multiple_versions,
                 enable_pipstar = config.enable_pipstar,
@@ -376,7 +376,7 @@ def _whl_repo(*, src, whl_library_args, is_multiple_versions, download_only, net
         ),
     )
 
-def _configure(config, *, platform, os_name, arch_name, config_settings, env = {}, override = False):
+def _configure(config, *, platform, os_name, arch_name, config_settings, env = {}, override = False, **kwargs):
     """Set the value in the config if the value is provided"""
     config.setdefault("platforms", {})
     if platform and (os_name or arch_name or config_settings or env):
@@ -402,9 +402,13 @@ def _configure(config, *, platform, os_name, arch_name, config_settings, env = {
                 continue
 
             config["platforms"][platform][key] = value
-    else:
+    elif platform and override:
         config["platforms"].pop(platform)
 
+    for key, value in kwargs.items():
+        if value and (override or key not in config):
+            config[key] = value
+
 def _plat(*, name, arch_name, os_name, config_settings = [], env = {}):
     return struct(
         name = name,
@@ -444,16 +448,19 @@ def build_config(
                 os_name = tag.os_name,
                 platform = tag.platform,
                 override = mod.is_root,
+                # extra values that we just add
+                auth_patterns = tag.auth_patterns,
+                netrc = tag.netrc,
                 # TODO @aignas 2025-05-19: add more attr groups:
-                # * for AUTH - the default `netrc` usage could be configured through a common
-                # attribute.
                 # * for index/downloader config. This includes all of those attributes for
                 # overrides, etc. Index overrides per platform could be also used here.
                 # * for whl selection - selecting preferences of which `platform_tag`s we should use
                 # for what. We could also model the `cp313t` freethreaded as separate platforms.
             )
 
     return struct(
+        auth_patterns = defaults.get("auth_patterns", {}),
+        netrc = defaults.get("netrc", None),
         platforms = {
             name: _plat(**values)
             for name, values in defaults["platforms"].items()
@@ -856,7 +863,7 @@ This is only used if the {envvar}`RULES_PYTHON_ENABLE_PIPSTAR` is enabled.
 """,
     ),
     # The values for PEP508 env marker evaluation during the lock file parsing
-}
+} | AUTH_ATTRS
 
 _SUPPORTED_PEP508_KEYS = [
     "implementation_name",

tests/pypi/extension/extension_tests.bzl

@@ -99,27 +99,33 @@ def _build_config(env, enable_pipstar = 0, **kwargs):
             **kwargs
         ),
         attrs = dict(
-            platforms = subjects.dict,
+            auth_patterns = subjects.dict,
             enable_pipstar = subjects.bool,
+            netrc = subjects.str,
+            platforms = subjects.dict,
         ),
     )
 
 def _default(
         arch_name = None,
+        auth_patterns = None,
         config_settings = None,
+        env = None,
+        netrc = None,
         os_name = None,
         platform = None,
-        env = None,
         whl_limit = None,
         whl_platforms = None):
     return struct(
         arch_name = arch_name,
-        os_name = os_name,
-        platform = platform,
+        auth_patterns = auth_patterns or {},
         config_settings = config_settings,
         env = env or {},
-        whl_platforms = whl_platforms,
+        netrc = netrc,
+        os_name = os_name,
+        platform = platform,
         whl_limit = whl_limit,
+        whl_platforms = whl_platforms,
     )
 
 def _parse(
@@ -1234,11 +1240,17 @@ def _test_build_pipstar_platform(env):
                             "@platforms//cpu:x86_64",
                         ],
                     ),
+                    _default(
+                        netrc = "my_netrc",
+                        auth_patterns = {"foo": "bar"},
+                    ),
                 ],
             ),
         ),
         enable_pipstar = True,
     )
+    config.auth_patterns().contains_exactly({"foo": "bar"})
+    config.netrc().equals("my_netrc")
     config.enable_pipstar().equals(True)
     config.platforms().contains_exactly({
         "myplat": struct(