Publish permission ignored allowing any authenticated user to publish

[moll]

Hey,

Am I doing something wrong or is the publish permission totally ignored?

packages:
  "@*/*":
    access: $authenticated
    publish: none

  "*":
    access: $authenticated
    publish: none

I realize none isn't a special token, but both none and leaving publish empty still allows me to publish packages with npm --registry example.com publish.

[rlidwka]

Yep, I messed up with auth refactoring two weeks ago.

Fixed, added tests for it and published as sinopia@1.2.2. Thanks for reporting!

[moll]

Thank you!