Security concerns about verdaccio-gitlab HOT 3 CLOSED

For the specific security concern I mentionned above, I choose this approach:

• Both allow_access and allow_publish use a method allow_action with different arguments.
• Added the special $owned-group permission that ensures the package is properly accessible by the user on Gitlab. This is the default behavior of allow_publish in the current code.
• Added handling of $authenticated properly: it can explicitly be set and, if found, will simply ensure user.name !== undefined. This is the default behavior for access permission. (But I don't like that access and publish have different permissions, it may make more sense to let both be $owned-group but I didn't want to change the behavior too much).
• Added handling of BUILTIN_ACCESS_LEVEL_ANONYMOUS for all actions. There is no reason a user shouldn't be able to config its Verdaccio so anyone can do anything for a specific action.
• Added dynamic and complete error message mentionning the potential reasons why the access was refused.

The new code can be found here.

from verdaccio-gitlab.

@bufferoverflow @dlouzan May I ask some feedback on this, please?

from verdaccio-gitlab.

see #101 (comment)

from verdaccio-gitlab.