npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, πŸ‘‹, I’m Ryan HefnerΒ  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you πŸ™

Β© 2024 – Pkg Stats / Ryan Hefner

verdaccio-needle-github-oauth-ui

v3.1.1-pre.5

Published

<h1 align="center"> πŸ“¦πŸ” Verdaccio GitHub OAuth - With UI Support </h1>

Downloads

6

Readme

About

This is a Verdaccio plugin that offers GitHub OAuth integration for both the browser and the command line.

Features

  • The Verdaccio login button redirects you to GitHub. If you have access, you return as a logged-in user. Logout works, too.
  • The Verdaccio usage info is updated including copy-to-clipboard.
  • Use the built-in command-line tool for quick and easy npm configuration.
  • Use GitHub organizations, teams, or repositories to configure permissions.

Compatibility

  • Verdaccio 5
  • Node 14, 16
  • Chrome, Firefox, Firefox ESR, Edge, Safari

If you would like to use this with Verdaccio 3-4, Node.js 10-13, or IE you can use version 2 of the plugin.

Setup

Install

$ npm install verdaccio-github-oauth-ui

GitHub Config

  • Create an OAuth app at https://github.com/settings/developers
  • The callback URL should be YOUR_REGISTRY_URL/-/oauth/callback

Example:

Verdaccio Config

Merge the below options with your existing Verdaccio config:

middlewares:
  github-oauth-ui:
    enabled: true

auth:
  github-oauth-ui:
    org: GITHUB_ORG # (required)
    client-id: GITHUB_CLIENT_ID # (required)
    client-secret: GITHUB_CLIENT_SECRET # (required)
    enterprise-origin: GITHUB_ENTERPRISE_ORIGIN # (optional)

Notes

  • The plugin options can be actual values or the names of environment variables containing the values.
  • The plugin options can be specified under either the middlewares or the auth node.
  • The plugin name must be included under both middlewares and auth nodes.

org (required)

Members of this org will be able to authenticate.

client-id and client-secret (required)

These values can be obtained from the GitHub OAuth app page at https://github.com/settings/developers.

enterprise-origin (optional)

Set this if you are using GitHub Enterprise. Example: https://github.example.com

Package Access

The following groups are added during login and can be used to configure package permissions:

  • $authenticated
  • github/GITHUB_ORG for every GitHub org the user is a member of
  • github/GITHUB_ORG/team/GITHUB_TEAM for every GitHub team the user is a member of
  • github/GITHUB_ORG/repo/GITHUB_REPO for every GitHub repository the user has access to

You can use these groups as shown below:

packages:
  foo:
    # limit actions to logged-in users (works in combination with other plugins such as htpasswd)
    access: $authenticated

    # limit actions to org members
    publish: github/GITHUB_ORG

    # limit actions to team members
    unpublish: github/GITHUB_ORG/team/GITHUB_TEAM
  bar:
    # limit actions to repository members (does not work for outside collaborators)
    access: github/GITHUB_ORG/repo/GITHUB_REPO

See Package Access for more examples.

Proxy Config

If you are behind a proxy server, the plugin needs to know the proxy server to make GitHub requests.

Configure the below environment variable.

$ export GLOBAL_AGENT_HTTP_PROXY=http://127.0.0.1:8080

See the global-agent docs for detailed configuration instrcutions.

Login

Verdaccio UI

  • Click the login button and get redirected to GitHub.
  • Authorize the registry to access your GitHub user and org info. You only need to do this once. If your org is private, make sure to click the Request or Grant button to get read:org access when prompted to authorize.
  • Once completed, you'll be redirected back to the Verdaccio registry.

You are now logged in.

Command Line

Option A) Use the built-in CLI

The easiest way to configure npm is to use this short command:

$ npx verdaccio-github-oauth-ui --registry http://localhost:4873

Option B) Copy commands from the UI

  • Verdaccio 5:

Open the "Register Info" dialog and click "Copy to clipboard":

  • Run the copied commands on your terminal:
$ npm config set //localhost:4873:_authToken "SECRET_TOKEN"
$ npm config set //localhost:4873:always-auth true
  • Verify npm is set up correctly by running the whoami command. Example:
$ npm whoami --registry http://localhost:4873
n4bb12

If you see your GitHub username, you are ready to start installing and publishing packages.

Logout

Verdaccio UI

Click the Logout button as per usual.

Command Line

Unless OAuth access is revoked in the GitHub settings, the token is valid indefinitely.

Revoke Tokens

To invalidate your active login tokens you need to revoke access on the GitHub OAuth app:

  • Go to https://github.com/settings/applications
  • Find your Verdaccio app
  • Click the Revoke button as shown below

If you have created the GitHub OAuth app, you can also revoke access for all users:

  • Go to https://github.com/settings/applications
  • Find your Verdaccio app
  • Click the app name
  • On the app detail page click the Revoke all user tokens button

Troubleshooting

"Failed requesting GitHub user info"

  • Double-check that your configured client id and client secret are correct.
  • If you are behind a proxy, make sure you are also passing through the query parameters to Verdaccio, see https://github.com/n4bb12/verdaccio-github-oauth-ui/issues/47#issuecomment-643814163 for an nginx example.

Plugin not detected when installed globally

Verdaccio loads plugins by requiring them but global node_modules are NOT searched by the node resolve algorithm. Despite what examples or documentation might be suggesting, globally installed plugins are not supported. Some solutions that worked for others:

  • If you are using npm, switch to yarn. yarn installs modules a bit differently, such that globally installed plugins are found.
  • Create a package.json and install verdaccio + plugins locally.
  • Add your global node_modules folder to the NODE_PATH environment variable to give Node.js a hint to search for modules here, too.
  • Extend the official docker image. See this docker.sh and Dockerfile in this example.

More info: https://github.com/n4bb12/verdaccio-github-oauth-ui/issues/13#issuecomment-435296117

"Your auth token is no longer valid. Please log in again."

If your GitHub org is private, the org membership visibility might be restricted. If this is the case, your org members need to grant read:org permission during login.

They can request this during fist login by clicking the Request or Grant button when prompted to authorize Verdaccio with GitHub.

If you or a team member accidentally skipped this step, go to https://github.com/settings/applications, find your Verdaccio registry, and grant read:org access from there.