Overly strict access level mappings about verdaccio-gitlab HOT 2 CLOSED

Yes, this should be handled by the people maintaining the verdaccio instance. Overwriting packages could be an issue and security risk for other using the same verdaccio instance.

from verdaccio-gitlab.

I do understand that overwriting packages that use the same name could be an issue and security risk. But I'm making the assumption that most verdaccio instances are for internal use only. Hence the point of a private npm registry and that information about overwritten packages would've been communicated to the team using the instance. Anyone else using the instance that isn't authorised to do so would have another thing coming.

After I posted, I realised that the way you mapped it, is basically assuming that if you own the url path of a group, you would be able to publish to said scope. However, could the access be reworked such that you could do something like the following?

  '**':
    access: $all
    publish: $maintainer@group
    proxy: npmjs
    gitlab: true

Otherwise the ** scope with this plugin wouldn't be useful except for being able to publish as the group url path and username

Even package names that do not overwrite any upstream registry would not work and you would probably have to end up creating pseudo groups to be able to do so. But if you create a pseudo group, no one else will be able to create a pseudo group unless of course they are running their own GitLab instance.

from verdaccio-gitlab.