Whitelist specific group/project about verdaccio-gitlab HOT 7 CLOSED

Any feedback on this issue, please?

from verdaccio-gitlab.

You could do someting like this

packages:
  '@telokis-group/*':
    # scoped packages
    access: $all
    publish: $authenticated
    proxy: npmjs
    gitlab: true

from verdaccio-gitlab.

@bufferoverflow Thank you for your answer!
By doing it like so, nobody would be able to publish anything to the registry (scoped or not scoped) except for people with access to the telokis-group group?

from verdaccio-gitlab.

@Telokis exactly

from verdaccio-gitlab.

Thank you very much, I will try this ASAP!

from verdaccio-gitlab.

Problem not solved. I didn't imagine to use it in production by security reason.
Situation: Hacker create babel group on gitlab with project plugin-proposal-decorators. Then add @babel/plugin-proposal-decorators to my register? And then my projects pull virus... This is a hole in security. Need mechanism to close access to people not in whitelist (gitlab group) to push any projects in register.

Maybe there is access rule to push like as $nobody. But I find nothing about this...

from verdaccio-gitlab.

Problem not solved. I didn't imagine to use it in production by security reason.
Situation: Hacker create babel group on gitlab with project plugin-proposal-decorators. Then add @babel/plugin-proposal-decorators to my register? And then my projects pull virus... This is a hole in security. Need mechanism to close access to people not in whitelist (gitlab group) to push any projects in register.

Maybe there is access rule to push like as $nobody. But I find nothing about this...

You can restrict publishing with the following config:

packages:
  '@my-awesome-company/*':
    access: $authenticated
    publish:
    gitlab: true
  '**':
    access: $all
    publish:
    proxy: yarnpkg
    gitlab: true

from verdaccio-gitlab.