1

Hello I would like to know if a special npm configuration could

  • enable npm publish
  • disable npm unpublish --force [IDEAL]
  • disable all npm unpublish commands

I am using Verdaccio as a private package repository, and I know that they are working on a special configuration that can achieve this. But does that feature/configuration exist already on client computer using npm ?

gyc
  • 4,300
  • 5
  • 32
  • 54
Deunz
  • 1,776
  • 19
  • 32

1 Answers1

2

This feature is available in Verdaccio since v4.0.0-alpha.5

https://github.com/verdaccio/verdaccio/blob/4.x/CHANGELOG.md#features

For instance

 'vue':
    access: $all
    publish: $authenticated
    unpublish: admin
    proxy: npmjs

We are introducing a new property called unpublish to be able to handle such a situation. For backward compatibility, if unpublish is not defined will be relying on publish as it works in previous versions.

For more info check our docs

https://verdaccio.org/docs/en/packages#unpublishing-packages

Juan Picado
  • 1,823
  • 18
  • 33
  • Hello and thank you for the answer. Yes I am aware of this POC, I also asked them for a date but no answer yet :) I am just exploring another way which is to tune the developer computer so he CANNOT use unpublish --force – Deunz Feb 21 '19 at 08:08
  • 1
    It will be part of V4 really soon, check our milestone https://github.com/verdaccio/verdaccio/milestone/15 – Juan Picado Feb 21 '19 at 08:09
  • AH ok that's awsome April 30 apparently ! Thank's a lot for the information. In the mean time if you know about another way, Dont hesitate communicate I will come back here to mark your answer as accepted when I managed to secure npm unpublish --force – Deunz Feb 21 '19 at 08:13
  • 1
    Sure, fair enough :-) (April 30 is our deadline), next alpha will be released next week) – Juan Picado Feb 21 '19 at 08:14
  • 1
    Waw very nice ! I am gonna try to use this, but it's my client who owns their Verdaccio so I am not sure if the will accept to use alpha version :) (giving you maximum point so you can create Verdaccio tag lol) – Deunz Feb 21 '19 at 08:16
  • Hello again, they wont use the alpha version :) we'll wait until April 30 :) In the mean time I hope I can try another (but the best is the upcoming Verdaccio version) – Deunz Feb 21 '19 at 10:24
  • 1
    Thanks a lot @Juan Picado ! https://github.com/verdaccio/verdaccio/releases Is this just the 4.0.0.alpha.5 that is released ? I am sorry I didnt catch the time to be able to try this :( And the client won't test the alpha, he will wait for the RC – Deunz Mar 06 '19 at 16:02
  • 1
    Not working for the same client. But I forward the info to related teams. Anyway I use a Verdaccio in MY company, so i'll try new version and the feature. Thanks for the followup – Deunz Jun 17 '19 at 08:51