Closed dantman closed 4 years ago
Thank you for the great description.
API JWT is supported with https://github.com/n4bb12/verdaccio-github-oauth-ui/releases/tag/2.3.0
Thanks for reporting this 🤝
Thanks. However there may be a bug.
I am getting the error user dantman is not allowed to publish package @company/package
when I use JWT but when I disable JWT and use a legacy token I can successfully publish a package.
Publishing this package only requires basic authentication.
packages:
'@company/*':
access: $authenticated
publish: $authenticated
unpublish: $authenticated
Ok, I examined the JWTs and I think this is because the groups are different.
htpasswd plugin returns the groups ci $all $authenticated @all @authenticated all
for the user ci
.
But the github-oauth-ui plugin just returns the organizations that the user belongs to as groups. The username is missing and the various forms of the all/authenticated groups are missing.
I also question using GitHub orgs as groups (rather than finding a way to use the org's GitHub teams), but that's a separate topic.
I think the groups are now handled correctly. Thanks for all the input.
https://github.com/n4bb12/verdaccio-github-oauth-ui/releases/tag/2.3.1
I'd love to discuss GitHub teams. If you're interested, maybe you could create a feature proposal describing how that would work: How would you like to be able to configure this? If you have used other plugins that do something similar, how do they configure it? Would that affect existing users of the org mechanism, or could we do this as an optional add-on? Thanks in advance.
Bug Report
When using the verdaccio-github-oauth-ui plugin auth is broken if you enable the jwt setting but do not set
legacy: true
(i.e. you move to JWT instead of using the deprecated legacy signature).Versions
Expected behavior
If JWT is enabled in the API then the npm tokens gh-oauth-ui generates should be JWT tokens, not legacy tokens.
Observed behaviour
I tried enabling the htaccess plugin alongside gh-oauth-ui and logging in with
npm login
. htaccess generates proper JWTs, so this is a gh-oauth-ui issue.This appears to be the code generating the npm token (I searched around the codebase and followed the code to confirm this was the specific function called).
https://github.com/n4bb12/verdaccio-github-oauth-ui/blob/9740bc5f0d3812432cffb9bc3598ff49acdb9e83/src/server/verdaccio/Verdaccio.ts#L36-L38
Steps to reproduce