Issues with User Authentication, Login and Package Publishing with Yarn 3.5

[vincent-herlemont]

I'm encountering problems while trying to publish packages on my private registry set up using Verdaccio. I have followed the necessary steps and related documentation but keep running into issues that seem interconnected.

My configuration is as follows:

1. htpasswd file: (test:test)

   test:$apr1$qro6h0iw$m/Om/ANZM.MbM3l4gslEB.
   

2. config.yaml file:

   storage: ./storage
   auth:
     htpasswd:
       file: ./htpasswd
   uplinks:
     npmjs:
       url: https://registry.npmjs.org/
   packages:
     '@*/*':
       access: $all
       proxy: npmjs
     '@myScope/*':
       access: $all
       publish: $authenticated
     '**':
       proxy: npmjs
   max_body_size: 100mb
   log: { type: stdout, format: pretty, level: http }

3. .yarnrc.yml file:

   npmScopes:
     "myScope":
       npmPublishRegistry: "http://localhost:4873"
       npmRegistryServer: "http://localhost:4873"
       npmAlwaysAuth: true
       npmAuthIdent: "test:test"
   unsafeHttpWhitelist:
     - localhost

Following the advice in the documentation, I attempt to generate a token using the yarn npm login --scope myScope command. However, I am met with an error stating that the username is already registered:

❯ yarn npm login --scope myScope
➤ YN0000: Logging in to http://localhost:4873
✔ Username: · test
✔ Password: · ****
➤ YN0035: username is already registered
➤ YN0035:   Response Code: 409 (Conflict)
➤ YN0035:   Request Method: PUT
➤ YN0035:   Request URL: http://localhost:4873/-/user/org.couchdb.user:test

The next issue arises when I try to publish a package:

❯ yarn npm publish
➤ YN0000: embedb-node.android-arm-eabi.node
➤ YN0000: embedb-node.linux-x64-gnu.node
➤ YN0000: index.js
➤ YN0000: package.json
➤ YN0035: user test is not allowed to publish package @myScope/embedb-node
➤ YN0035:   Response Code: 403 (Forbidden)
➤ YN0035:   Request Method: PUT
➤ YN0035:   Request URL: http://localhost:4873/@myScope%2fembedb-node
➤ YN0000: Failed with errors in 8s 747ms

The Verdaccio logs return the following errors:

verdaccio  | error--- test is forbidden publish for @myScope/embedb-node 
verdaccio  | http <-- 200, user: test(172.23.0.1), req: 'PUT /@myScope%2fembedb-node', bytes: 11187563/0 
verdaccio  | http <-- 403, user: test(172.23.0.1), req

: 'PUT /@myScope%2fembedb-node', error: user test is not allowed to publish package @myScope/embedb-node

After researching similar issues, I found a related GitHub issue indicating that _authToken may be required.

I have the following questions:

• Do I need to log in to the registry for publishing a package? The configuration file .yarnrc.yml seems to already contain the required npmAuthIdent: "test:test" field.
• Why does the yarn npm login command try to register an already existing user?
• Do I need to generate a token for _authToken? If yes, why? And how can I accomplish this given the issues I am facing with yarn npm login?

[vincent-herlemont]

A possible solution founded here yarnpkg/berry#1044 (comment)