# @drubin/verdaccio-gitlab

> private npm registry (Verdaccio) using gitlab-ce as authentication and authorization provider

Latest version **0.0.4** (published 2018-01-22) · MIT license · 0 weekly downloads

## Install

```sh
npm install @drubin/verdaccio-gitlab
pnpm add @drubin/verdaccio-gitlab
yarn add @drubin/verdaccio-gitlab
bun add @drubin/verdaccio-gitlab
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.0.4 |
| Published | 2018-01-22 |
| First published | 2018-01-22 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 2 |
| Known vulnerabilities | 0 (+1 in 1 direct dependencies) |
| Install scripts | no |
| GitHub stars | 160 |
| Author | Roger Meier |
| Maintainers | drubin |
| Keywords | sinopia, verdaccio, gitlab, auth, npm, registry, npm-registry |

## Links

- npm: https://www.npmjs.com/package/@drubin/verdaccio-gitlab
- Repository: https://github.com/bufferoverflow/verdaccio-gitlab
- Issues: https://github.com/bufferoverflow/verdaccio-gitlab/issues
- npm.io page: https://npm.io/package/@drubin/verdaccio-gitlab

## Dependencies (2)

- [verdaccio](https://npm.io/package/verdaccio.md) ^2.7.3
- [node-gitlab-api](https://npm.io/package/node-gitlab-api.md) ^2.1.1

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@oxyhq/services](https://npm.io/package/@oxyhq/services.md) — 2.3K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads

## Recent versions

- 0.0.4 (latest) — 2018-01-22

## README

# Verdaccio-GitLab

Use [GitLab Community Edition](https://gitlab.com/gitlab-org/gitlab-ce)
as authentication provider for the private npm registry
[verdaccio](https://github.com/verdaccio/verdaccio), the sinopia fork.

[![](https://badge.fury.io/js/verdaccio-gitlab.svg)](http://badge.fury.io/js/verdaccio-gitlab)
[![](https://travis-ci.org/bufferoverflow/verdaccio-gitlab.svg?branch=master)](https://travis-ci.org/bufferoverflow/verdaccio-gitlab)
[![](https://david-dm.org/bufferoverflow/verdaccio-gitlab/status.svg)](https://david-dm.org/bufferoverflow/verdaccio-gitlab)

The main goal and difference to other sinopia/verdaccio plugins is:

- no admin token required
- user authenticates with Personal Access Token
- owned groups (no subgroups) are added to the user
- publish packages if package scope or name is an owned group name

> This is experimental!

## Use it

```sh
git clone https://github.com/bufferoverflow/verdaccio-gitlab.git
cd verdaccio-gitlab
npm install
npm start
```

verdaccio is now up and running, now configure the following within
your `~/.config/verdaccio/config.yaml` to use this plugin

```yaml
auth:
  gitlab:
    url: https://gitlab.com

packages:
  '@*/*':
    # scoped packages
    access: $all
    publish: $authenticated
    proxy: npmjs
    gitlab: true

  '**':
    access: $all
    publish: $authenticated
    proxy: npmjs
    gitlab: true
```

restart verdaccio and authenticate with your credentials:

- gitlab username
- [Personal Access Token](https://gitlab.com/profile/personal_access_tokens)

on the web ui [http://localhost:4873](http://localhost:4873) or via npm

```sh
npm login --registry http://localhost:4873
```

and publish packages

```sh
npm publish --registry http://localhost:4873
```

> **NOTE**: you need a fresh login, so that verdaccio recognizes your owned groups

## Docker

```sh
git clone https://github.com/bufferoverflow/verdaccio-gitlab.git
cd verdaccio-gitlab
docker-compose up --build -d
```

- login with user `root` and password `verdaccio` on Gitlab via [http://localhost:50080](http://localhost:50080)
- create a Personal Access Token
- login to the npm registry [http://localhost:4873](http://localhost:4873) via browser
- publish your packages via command line

## Development

Setup development environment, `npm start` will do:

```sh
cd node_modules/verdaccio
npm link ../../
cd ../../
```

Run one of the following command to create a release:

```sh
npm run release:major
npm run release:minor
npm run release:patch
```

finally run

```sh
npm publish
```

## Todo

- [x] authenticate with personal access token
- [x] compare provided user name and GitLab username
- [x] get user groups from GitLab
- [x] authorize publish based on group ownership
- [x] Docker Compose setup of GitLab and Verdaccio
- [ ] how to handle group owner ship changes? timeout?
- [ ] use openid connect for web ui
- [ ] improve linting, eslint vs. jshint vs. babel ,etc.
- [ ] pass repolinter
- make it perfect ;-r

## Inspired by

- [verdaccio-ldap](https://github.com/Alexandre-io/verdaccio-ldap)
- [node-bacstack](https://github.com/fh1ch/node-bacstack)
- [verdaccio-bitbucket](https://github.com/idangozlan/verdaccio-bitbucket)

## License

[MIT](https://spdx.org/licenses/MIT)

---
_Source: https://npm.io/package/@drubin/verdaccio-gitlab · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._