plugin allow_publish (pkg) got a undefined version

[sheweifan]

 allow_publish(user, pkg, callback) {
    console.log(`pkg`, pkg)
      callback(null, true)
  }

how can i get the publish version? thank you

---

I am deploying the NPM privatization service for my company. Our workflow needs to allow only some members to push the official version, while others can only push the beta version.

npm link:
The code is very simple. I created a new plugin:

class DynamicPublishPlugin {
  constructor(config, stuff) {
    this.config = config;
  }

  allow_publish(user, pkg, callback) {
    const userName = user.name
    const pkgVersion = pkg.version
    const { users } = this.config

    console.log(`pkg`, pkg)

    if (pkgVersion.indexOf('beta')) {
      callback(null, true)
    }
  
    callback(null, users.split(' ').indexOf(userName) > -1)
  }
}

module.exports = (cfg, stuff) => new DynamicPublishPlugin(cfg, stuff);

config.yaml like this:

storage: /Users/dolor/.local/share/verdaccio/storage
plugins: ./plugins

web:
  title: Verdaccio

auth:
  publishauth:
    users: sheweifan
  htpasswd:
    file: ./htpasswd

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@*/*':
    access: $all
    publish: $authenticated
    unpublish: $authenticated
    proxy: npmjs

  '**':
    access: $all

    publish: $authenticated
    unpublish: $authenticated

    proxy: npmjs

server:
  keepAliveTimeout: 60

middlewares:
  audit:
    enabled: true

logs:
  - { type: stdout, format: pretty, level: http }

node: v10.24.0
verdaccio: v4.12.2

[juanpicado]

hi @sheweifan could you provide a full example? describe what exactly you are doing would be the better.

[sheweifan]

I try to understand the source code, found in

verdaccio/packages/middleware/src/middleware.ts

Lines 172 to 174 in 15c6941

	const packageVersion = req.params.filename
	? getVersionFromTarball(req.params.filename)
	: undefined;

Package version is already undefined. Moreover, no version information was found on req.params, but it was found on req.body.

allow -- req.params {
  package: 'verdaccio-publishauth',
  _rev: undefined,
  revision: undefined
}
allow -- req.body {
  _id: 'verdaccio-publishauth',
  name: 'verdaccio-publishauth',
  'dist-tags': { latest: '0.0.8' },
  versions: {
    '0.0.8': {
      version: '0.0.8',
      name: 'verdaccio-publishauth',
      private: false,
      main: 'index.js',
      scripts: [Object],
      readme: 'ERROR: No README data found!',
      readmeFilename: 'README.md',
      _id: '[email protected]',
      _nodeVersion: '12.12.0',
      _npmVersion: '6.11.3',
      dist: [Object]
    }
  },
  readme: 'ERROR: No README data found!',
  _attachments: {
    'verdaccio-publishauth-0.0.8.tgz': {
      content_type: 'application/octet-stream',
      data: '...',
      length: 14531
    }
  }
}

I tried to modify the code and it worked, but it was very strange.

  let packageVersion
  if (req.body['dist-tags']) {
    const tagName = Object.keys(req.body['dist-tags'])[0]
    const tagVersion = req.body['dist-tags'][tagName]
    packageVersion = (tagVersion + (tagName === 'latest' ? '' : '-' + tagName))
  } else {
    packageVersion = undefined
  }

Maybe is it because the requester lose params? That's all I know

[sheweifan]

hi @juanpicado

sorry to trouble you, can you please help me to deal with it when you have time? i have no idea, thanks.

[juanpicado]

Be patience, help will come ;-)

[juanpicado]

#1189 well it seems this is not working anymore. I'd need to dive more.

[juanpicado]

It seems this feature never worked somehow, I don't remember, anyway, it will require rework, it might take some time. If you are willing to contribute I can help you how to achieve it to make it faster

[juanpicado]

@sheweifan to give light to your issue, currently this version is accessible only if user try to download a tarball from the UI, but if the request comes from a package manager then you will get undefined.

In a nutshell:

• Publishing a package npm publish ❌
• Downloading a package (UI, or package manager) npm install jquery only tarballs requests ✔️
• Fetching metadata npm info) ❌

Thus, the feature you are looking for is not fully developed, I've created a ticket #2313 and add some details there.

[juanpicado]

@sheweifan I just noticed you are using v4. In any case, this will be fixed on v5 or next, but never on v4. Consider migrating.
https://verdaccio.org/blog/2021/04/14/verdaccio-5-migration-guide

[sheweifan]

OK, I'll use V5 in docker.

I'm trying to understand the source code based on the information you provided.

thanks.

[juanpicado]

Fixed ecfc4c3