unkin-agent
f0ee593164
Local repo writes (file uploads/deletes, object evictions, native publishes, docker push) are open to anyone who can reach the service; only remote/virtual config is token-gated. - add `ARTIFACTAPI_AUTH_UPLOADS` (default false) gating every local write path behind the OIDC verifier - accept the token as Bearer, Token, Basic password (any user) or bare header value on every gated path, including remote/virtual config writes - serve a `/v2/token` Bearer challenge flow so `docker login` with the token enables push; missing, expired or invalid credentials get an anonymous token so pulls stay open - document minting a Vault identity token and passing it per client Reviewed-on: #169 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
16 lines
588 B
Markdown
16 lines
588 B
Markdown
# Local npm registry
|
|
|
|
A local `npm` repo is a real npm registry: `npm publish` (scoped and unscoped)
|
|
and `npm install` work against `/api/v1/local/<repo>/`. npm requires an
|
|
`_authToken` for the registry before it will publish; any value works unless
|
|
[uploads are gated](../common/auth.md).
|
|
|
|
```ini
|
|
# .npmrc
|
|
registry=https://artifactapi.example.com/api/v1/local/<repo>/
|
|
//artifactapi.example.com/api/v1/local/<repo>/:_authToken=unused
|
|
```
|
|
|
|
Versions are immutable: republishing an existing version is rejected. The
|
|
dist-tags sent with a publish (`latest`, or `--tag`) move to that version.
|