How to set _auth for a scoped registry in .npmrc?

node.js authentication npm nexus npm-publish
Willem van Ketwich picture Willem van Ketwich · Mar 21, 2018 · Viewed 18.2k times · Source

I am wondering how to configure the .npmrc file so that I can have a default registry and a different scoped registry with authentication.

I am using Nexus for the private repository and I am not sure how to set authentication for the scoped registry, only the default registry.

For example my ~/.npmrc file is:

registry=https://registry.npmjs.org/
@test-scope:registry=http://nexus:8081/nexus/content/repositories/npm-test/
[email protected]
_auth="…"

If I do npm publish for a package scoped to test-scope, I get an authentication error.

AFAIK, the _auth only applies to the registry=... section. Is there a way of specifying an auth key for the @test-scope:registry=... section?

Thanks,

Answer

Willem van Ketwich picture Willem van Ketwich · Mar 25, 2018

So, after some digging through the NPM source code, it turns out there is a way to do this.

My solution is below:

registry=https://registry.npmjs.org/
@test-scope:registry=http://nexus:8081/nexus/content/repositories/npm-test/
//nexus:8081/nexus/content/repositories/npm-test/:username=admin
//nexus:8081/nexus/content/repositories/npm-test/:_password=YWRtaW4xMjM=
email=…

Explanation:

The scope @test-scope specifies that packages with the scope should be published to a different registry than the default registry= when executing the npm publish command.

The two lines starting with //nexus:8081/... are used to specify the credentials to the scoped repository for both username and _password where _password is the base64 encoded password component from the previously used _auth credentials.

Using this approach, only scoped packages will be published and installed from the private registry and all other packages will be installed from the default registry.

Edit:

Additional to this, the password can be specified as an environment variable so that it is not stored in plaintext in the file.

For example:

registry=https://registry.npmjs.org/
@test-scope:registry=http://nexus:8081/nexus/content/repositories/npm-test/
//nexus:8081/nexus/content/repositories/npm-test/:username=admin
//nexus:8081/nexus/content/repositories/npm-test/:_password=${BASE64_PASSWORD}
email=…

Also, when using Nexus, the email= line must be specified.

Related questions

How do I remove documents using Node.js Mongoose?

FBFriendModel.find({ id: 333 }, function (err, docs) { docs.remove(); //Remove all the documents that match! }); The above doesn't seem to work. The records are still there. Can someone fix?

Read More
JWT (JSON Web Token) automatic prolongation of expiration

I would like to implement JWT-based authentication to our new REST API. But since the expiration is set in the token, is it possible to automatically prolong it? I don't want users to need to sign in after every X …

Read More
Understanding passport serialize deserialize

How would you explain the workflow of Passport's serialize and deserialize methods to a layman. Where does user.id go after passport.serializeUser has been called? We are calling passport.deserializeUser right after it where does it fit in the …

Read More