jdx/npm-register

support private packages

jdx opened this issue · 14 comments

jdx commented

Originally this project was needed to ensure that only authenticated users could publish packages, but they needed to be installable by anyone. For most projects, however, you would want only authenticated users to be able to publish or install packages.

This will have to be a configurable option.

zeke commented

I'm watching this repo :)

raulb commented

Hi @zeke 👋

zeke commented

🙌

jdx commented

I've got an idea how to make this work and still have the CDN stuff. Hopefully I'll get some time to work on it soon-ish.

  • 👍8
ealves-pt commented

@dickeyxxx I don't know what is your plan but it would be nice if we could manage organizations, teams and users with it.

jdx commented

That would be pretty complicated. I wonder if I could piggyback on the existing npm commands to manage orgs though.

  • 👍1
danielo515 commented

I'm confused about this, are the published packages publicly available? There is no way to make them private?

milankinen commented

Hi @dickeyxxx!

I could make a PR making read/write auth configurable if it's ok for you. In my implementation there would be two environment variables:

  • AUTH_WRITE=true|false (defaults true)
    • All post/put/delete routes except auth (= basically routes having auth middleware enabled currently)
  • AUTH_READ=true|false (defaults false)
    • All get routes except index and auth

auth route authentication would remain as it is (non-configurable). No CDN support though.. 😕

Thoughts?

jdx commented

@milankinen that sounds reasonable, but maybe prefix the var with NPM_REGISTER_* so they won't conflict with anything else

milankinen commented

@dickeyxxx Absolutely! 👍

danielo515 commented

What is the state of this? I would love to use this in production,but I need packages to be totally private .

Regards

milankinen commented

Sorry I had other pending tasks that I had to complete first, but finally here is my first attempt: #62