Closed bertrandmartel closed 3 years ago
Please format the code running yarn format
once you're done 👍
Hey, guys. Why do not use Teams as groups in verdaccio authentication like in verdaccio-github-team? In this case we still may use Team as filter in config:
"**":
access: team_name
publish: user_name
but also group people permissions by team membership. Unfortunately plugin mentioned above does not apply to github enterprize
Hey, guys. Why do not use Teams as groups in verdaccio authentication like in [verdaccio-github-team]
If I understand you correctly, this PR is about adding that feature 😉
createAuthenticatedUser(username: string): User {
// See https://verdaccio.org/docs/en/packages
return {
name: username,
groups: ["$all", "@all", "$authenticated", "@authenticated"],
real_groups: [username, this.requiredOrgName, this.requiredTeamName],
}
}
If I understand correctly only "Team Filter" is added to real_groups not whole list of user's teams - PR is about filterring by Organization and Team
Ah, you're right this PR only adds 1 team, but you would like all teams in order to be able to use them for granular permissions. Is that correct?
@bertrandmartel do you still plan on finishing this feature?
@n4bb12 I'm still uncertain about this function
authenticate(username: string, groups: string[]): boolean {
const success = groups.includes(this.requiredOrgName)
if (!success) {
logger.error(this.getDeniedMessage(username))
}
return success
}
In the previous discussion, you want the arguments to be unchanged, currently it's:
authenticate(username: string, groups: string[], teams: string[]): boolean {
let success = groups.includes(this.requiredOrgName)
if (success && this.requiredTeamName){
success = teams.includes(this.requiredTeamName)
}
if (!success) {
logger.error(this.getDeniedMessage(username))
}
return success
}
So you would want to have groups.includes(this.requiredOrgName)
and groups.includes(this.requiredTeamName)
, groups being the concatenation of the team and the org list is that right ?
The term "groups" is a Verdaccio term and relates to anything the user is part of. In our context this includes both GH orgs and GH teams.
I'm not sure how I can help understand, but I can offer finishing the PR.
@n4bb12 yes please do
@melkosoft I updated the docs with examples on how you can use team names: https://github.com/n4bb12/verdaccio-github-oauth-ui#verdaccio-config
@n4bb12 from the config parameters does this mean than there is no team parameter for the authentication ?
You can limit access to a team by using it in the packages
section. See https://github.com/n4bb12/verdaccio-github-oauth-ui/pull/120#issuecomment-810693336
The whole purpose of team filter was to authenticate only members of particular team(s). Without it owners of organization become authenticated too even though they may be restricted on package level they still have group $autheticated in their hands. and in case of config like:
"@*/*":
access: $authenticated
publish: $groups
they can publish packages in your registry
That's how it should work. If you want different behaviour, you need to configure your packages differently.
This PR makes it possible to filter by organization team using the following config
The authentication function has a new
teams
argument hereThe teams are provided using this
getTeams
function which calls this oneIt uses the following GraphQL query in order to get all the teams for the specfied organization for which the specified username is a member :
related
The team parameter is optional, it still works with only the organization filter