Requests: Proxy Auth Credentials Stripped by prepend_scheme_if_needed

You are working in the psf/requests repository at commit 0192aac24123735b3eaf9b08df46429bb770c283 (v2.27.0).

Problem

A regression introduced in requests 2.27 causes proxy URLs that include authentication credentials (in the form user:pass@host or user@host) to silently lose those credentials when passed through prepend_scheme_if_needed. This causes real-world HTTP 407 Proxy Authentication Required failures: the proxy credentials are present in the configured proxy URL, but by the time the URL is used to open a connection, the user:pass@ segment has been discarded.

The root cause lives in requests/utils.py, in the prepend_scheme_if_needed function. The function was refactored to use urllib3.util.url.parse_url (instead of urllib.parse.urlparse) to decompose the URL, then reassembles the result with urllib.parse.urlunparse. The problem is that parse_url returns an auth component separately, and that component is never woven back into netloc before urlunparse is called. As a result, any user:pass@ prefix that was part of the original netloc is silently dropped.

Reproduction

from requests.utils import prepend_scheme_if_needed

# Both of these should round-trip unchanged (scheme is already present,
# so prepend_scheme_if_needed should return the URL as-is):
result = prepend_scheme_if_needed("http://user:pass@proxy.example.com/", "http")
assert result == "http://user:pass@proxy.example.com/", repr(result)

result = prepend_scheme_if_needed("http://user@proxy.example.com/", "http")
assert result == "http://user@proxy.example.com/", repr(result)

Without the fix, both assertions fail because the returned URLs are missing the user:pass@ / user@ segment.

Requirements / Interface

• •File to modify: requests/utils.py
• •Function to fix: prepend_scheme_if_needed(value, default_scheme)
• •The function must preserve the auth component (username and optional password) when it reconstructs the URL.
• •The fix must work for all three credential forms: user:pass@host, user@host, and no credentials at all.
• •The function signature and all other observable behavior must remain unchanged.

Examples

| Input value | default_scheme | Expected return |
|---|---|---|
| "http://user:pass@example.com/path?query" | "http" | "http://user:pass@example.com/path?query" |
| "http://user@example.com/path?query" | "http" | "http://user@example.com/path?query" |
| "example.com/path" | "http" | "http://example.com/path" |
| "//example.com/path" | "http" | "http://example.com/path" |
| "example.com:80" | "http" | "http://example.com:80" |

The first two rows are the new regression cases. The last three rows are existing passing cases that must continue to work.

Constraints

• •Change only requests/utils.py unless you have a compelling reason to touch another file.
• •Do not change the function's public signature.
• •Do not introduce new dependencies (urllib3 is already a dependency).
• •Do not break any other tests in tests/test_utils.py.
• •The hidden grader applies its own test patch; do not rely on modifying the test file to make tests pass.

Scoring

A submission is accepted when:
1. Both new test_prepend_scheme_if_needed parametrize cases for URLs containing auth credentials pass.
2. All listed pass_to_pass tests in tests/test_utils.py continue to pass.

Accepted runs are additionally ranked on the leaderboard by token count, estimated cost, and wall-clock time; a minimal, focused patch scores best.