Anonymous publishing failing for non-scoped package on port other than 4173

[thekevinscott]

Your Environment

• verdaccio version: ^5.26.1
• node version v16.20.2
• package manager: pnpm@8.7.0
• os: mac
• platform: node

Describe the bug

I cannot publish a non-scoped package anonymously, but I can publish a scoped package anonymously.

To Reproduce

I'm attempting to support anonymous publishing via pnpm for local packages. I'm trying to support this in a CI environment, so without the ability to run npm adduser.

According to this comment a fake token needs to be added to .npmrc, e.g.:

//localhost:4173/:_authToken="faketoken"

Which I've added to the .npmrc at the root of my monorepo.

If I publish a scoped package, i.e. @bar/baz, publishing works successfully. However, if I attempt to publish a non-scoped package (foo), the command fails.

The specific command I am running:

pnpm publish  --ignore-scripts --no-git-checks --registry http://localhost:4173 --force

This succeeds for @bar/baz, but fails for foo with:

npm ERR! code ENEEDAUTH
npm ERR! need auth This command requires you to be logged in to http://localhost:4173/
npm ERR! need auth You need to authorize this machine using `npm adduser`

Manually logging in with npm adduser resolves the issue, but I can't run npm adduser interactively in a CI environment.

Expected behavior

I would like to be able to publish all packages anonymously.

Configuration File (cat ~/.config/verdaccio/config.yaml)

uplinks:
  npmjs:
    url: https://registry.npmjs.org/
packages:
  foo:
    access: $all
    publish: $all
  '@bar/*':
    access: $all
    publish: $all
  '**':
    access: $all
    proxy: npmjs
security: {}
storage: .storage
max_body_size: 1000mb

I've also tried with $anonymous, but since I'm not logged in, I think that $anonymous and $all are equivalent. In any case, the end result is the same (foo fails to publish).

Environment information

Environment Info:
  System:
    OS: macOS 13.4
    CPU: (16) x64 Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz
  Binaries:
    npm: 9.8.1 - /usr/local/bin/npm
    pnpm: 8.7.0 - ~/Library/pnpm/pnpm
  Virtualization:
    Docker: 20.10.17 - /usr/local/bin/docker
  Browsers:
    Chrome: 116.0.5845.140
    Edge: 108.0.1462.54
    Safari: 16.5

[thekevinscott]

I've also tried with configuration file:

packages:
  '**':
    access: $all
    publish: $all
storage: .storage
max_body_size: 1000mb

With the same result. Looks like there's something specific about scoped packages vs. non that is resulting in the discrepancies in behaviors.

[realfresh]

Initially I had issues, but now it seems to work fine with this configuration.

.npmrc

registry=http://localhost:4873
//localhost:4873/:_authToken=anon

I don't think it matters what the authToken is, I just used anon.

config.yaml (Verdaccio config)

....
uplinks:
  npmjs:
    url: https://registry.npmjs.org/
packages:
  '**':
    access: $all
    publish: $all
    proxy: npmjs

Then I just run npm publish and it works.