n4bb12 / verdaccio-github-oauth-ui

📦🔐 GitHub OAuth plugin for Verdaccio
https://verdaccio.org
MIT License
73 stars 45 forks source link

use only team names in real_groups array #125

Closed melkosoft closed 3 years ago

melkosoft commented 3 years ago

Feature Request

As I can see in log after authentication real_groups is filled with ALL organizations which are visible for me even though I am not a member of any teams there. It's not good. The purpose of organization is to restrict access only for users who are members of any team in organization. Go even further use team filter to allow only members of particular teams in organization. Using only team_name instead of github/org_name/team_name will help with access templates, something like this

packages:
   "@*/*":
      access: $authenticated
      publish: $groups
      unpublish: admin_group

In this case member of team "developers" will have publish access for "@developers/package_1" instead of name like: "@github/my-org/developers/package_1"

n4bb12 commented 3 years ago

GitHub team names are not globally unique. Without the org_name/ prefix anybody can create a team in their own org and use it to log in to your registry

The github/ prefix is there to avoid conflict with other plugins in case someone wants to use multiple providers.

The prefix doesn't limit you in your ability to configure permissions.