{"_id":"@allior/verdaccio-gitlab","name":"@allior/verdaccio-gitlab","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@allior/verdaccio-gitlab","version":"0.1.0","description":"Verdaccio auth plugin backed by GitLab PATs and group membership","main":"dist/index.js","module":"dist/index.mjs","types":"dist/index.d.ts","exports":{".":{"import":"./dist/index.mjs","require":"./dist/index.js","types":"./dist/index.d.ts"}},"author":{"name":"An1by"},"repository":{"url":"git+https://gitlab.com/allior/forks/verdaccio-gitlab.git"},"scripts":{"build":"rimraf ./dist && bun build ./src/index.ts --outfile ./dist/index.js --target node --format cjs && bun build ./src/index.ts --outfile ./dist/index.mjs --target node --format esm && tsc --emitDeclarationOnly -p tsconfig.json","test":"echo \"Error: no test specified\" && exit 0","check":"bun run build && bun run test"},"keywords":["verdaccio","verdaccio-plugin","verdaccio-auth","gitlab","pat"],"license":"MIT","peerDependencies":{"verdaccio":">=5 <8"},"devDependencies":{"@types/node":"^25.8.0","rimraf":"^6.1.3","typescript":"^5.9.3"},"gitHead":"72c33722078d25dee9fd126d78c2d077b1a5d830","_id":"@allior/verdaccio-gitlab@0.1.0","bugs":{"url":"https://gitlab.com/allior/forks/verdaccio-gitlab/issues"},"homepage":"https://gitlab.com/allior/forks/verdaccio-gitlab#readme","_nodeVersion":"25.2.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-pIedRm1eHCfV4SNB0yAg8gQa/iGdBE1Fv/iNoK4ieGnKOgJnuHpn7Lu06u4f3lY/yjoe53NGznBrWQ3aMHvlRA==","shasum":"e2f1dfd931fe82894f65eb76b70ab93302741a9b","tarball":"https://registry.npmjs.org/@allior/verdaccio-gitlab/-/verdaccio-gitlab-0.1.0.tgz","fileCount":12,"unpackedSize":38109,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQCkcuj9eP5RrfW/dJUmWdcaxCAxHqjXodShybuGEHJJMgIgL8N6/OR5iv7bSNm+TSBO0I1Es5UM4zebpaFxoIGEz6E="}]},"_npmUser":{"name":"an1by","email":"mrkillermafia@gmail.com"},"directories":{},"maintainers":[{"name":"an1by","email":"mrkillermafia@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/verdaccio-gitlab_0.1.0_1778925838822_0.3580587269627269"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-16T10:03:58.704Z","0.1.0":"2026-05-16T10:03:58.992Z","modified":"2026-05-16T10:03:59.187Z"},"maintainers":[{"name":"an1by","email":"mrkillermafia@gmail.com"}],"description":"Verdaccio auth plugin backed by GitLab PATs and group membership","homepage":"https://gitlab.com/allior/forks/verdaccio-gitlab#readme","keywords":["verdaccio","verdaccio-plugin","verdaccio-auth","gitlab","pat"],"repository":{"url":"git+https://gitlab.com/allior/forks/verdaccio-gitlab.git"},"author":{"name":"An1by"},"bugs":{"url":"https://gitlab.com/allior/forks/verdaccio-gitlab/issues"},"license":"MIT","readme":"# verdaccio-gitlab\n\nA Verdaccio auth plugin for logging in via a GitLab Personal Access Token (PAT) and strictly restricting package access based on membership in specified groups or subgroups.\n\nUsers log into Verdaccio using their GitLab username and provide their PAT instead of a password. The plugin verifies the user via `GET /user`, then fetches their group list via `GET /groups`, and only allows those who are members of at least one group defined in `allowedGroups`. For package operations, `allow_access`, `allow_publish`, and `allow_unpublish` are additionally implemented, meaning anonymous users and users outside the GitLab group gate will not gain access, even if `access: $all` is configured.\n\n## Installation\n\n```bash\nnpm install\nnpm run build\n```\n\nAfter building, place the package in the Verdaccio plugins directory or install it globally next to Verdaccio.\n\n## Verdaccio Configuration\n\n```yaml\nauth:\n  gitlab:\n    gitlabUrl: https://gitlab.example.com\n    allowedGroups:\n      - platform\n      - frontend/packages\n    allowSubgroups: true\n    minAccessLevel: reporter\n    cacheTtlSeconds: 300\n\npackages:\n  '@*/*':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\n\n  '**':\n    access: $all\n    publish: $authenticated\n    unpublish: $authenticated\n```\n\n`access: $all` here is safe solely because the plugin first enforces its own gate. If the user is not in the allowed GitLab groups, `allow_access` will return `false`.\n\n## Options\n\n| Option | Default | Description |\n| --- | --- | --- |\n| `gitlabUrl` | `https://gitlab.com` | The base GitLab URL. |\n| `apiBaseUrl` | `${gitlabUrl}/api/v4` | Full API URL if a custom path is required. |\n| `allowedGroups` | `[]` | Allowed groups, subgroups, or group IDs. An empty list denies everyone. |\n| `allowSubgroups` | `true` | Allows `platform` to match `platform/frontend`. |\n| `minAccessLevel` | unset | Minimum GitLab access level: `guest`, `reporter`, `developer`, `maintainer`, `owner`, or a numeric value. |\n| `enforceUsernameMatch` | `true` | The Verdaccio username must match the GitLab username from the PAT. |\n| `cacheTtlSeconds` | `300` | How often to re-verify GitLab membership during package access. |\n| `storeTokens` | `true` | Keep PAT in process memory for membership re-verification. It is not written to disk. |\n| `requireActiveSession` | `true` | After a Verdaccio restart, old Verdaccio tokens won't work until a new login. |\n| `groupNamePrefix` | `gitlab:` | Prefix for groups returned to Verdaccio. |\n| `gateGroup` | `gitlab:allowed` | Internal group required for package operations. Without it, access is denied. |\n| `extraGroups` | `[]` | Additional Verdaccio groups for successfully authenticated GitLab users. |\n| `requestTimeoutMs` | `10000` | Timeout for GitLab API requests. |\n| `maxPages` | `100` | Maximum number of pages when fetching GitLab groups. |\n\nFor a PAT, the `read_api` scope is usually sufficient. If your GitLab instance does not allow reading groups with it, use the `api` scope instead.\n\n## Groups in package rules\n\nThe plugin returns groups to Verdaccio in the format `gitlab:<full_path>`. This allows you to create more granular rules on top of the general gate:\n\n```yaml\npackages:\n  '@frontend/*':\n    access: gitlab:frontend/packages\n    publish: gitlab:frontend/packages\n```\n\nIf GitLab returns the group `frontend/packages`, the user will receive the `gitlab:frontend/packages` group in Verdaccio.\n\n## Why not a middleware\n\nVerdaccio middleware plugins are registered after the built-in endpoints, meaning they cannot reliably replace the standard npm API access checks. The correct extension point for this requirement is an auth plugin implementing `authenticate`, `allow_access`, `allow_publish`, and `allow_unpublish`.\n","readmeFilename":"README.md","_rev":"1-5e887e4506442460b2f30920a815c12d"}