What's the default for "packages" in the config?

[mb720]

Hi and thanks for Verdaccio!

The documentation says this about packages in the config:

if none is specified, the default one remains

packages:
  '**':
    access: $all
    publish: $authenticated

I assumed that when I have no packages in the config, authenticated users would be able to publish but I got this error:

403 Forbidden - PUT http://localhost:4873/leftpad - user seconduser is not allowed to publish package leftpad

Adding the identical packages section into the config lets the user publish the package just fine.

I'm wondering what the default for package access is if there is no packages section specified in the config.

---

I'm using verdaccio@6.2.5 on Alpine Linux 3.23.3.

For completeness, this is my entire verdaccio-config.yaml:

storage: /verdaccio/storage
# Per default Verdaccio seems to listen on 127.0.0.1 only
listen: 0.0.0.0:4873
auth:
  # Contains auth data of users created with 'npm adduser'
  htpasswd:
    file: /verdaccio/conf/htpasswd
uplinks:
  npmjs:
    url: https://registry.npmjs.org/
# Not sure what the default settings are, but without this, also authenticated users can't publish packages
packages:
  '**':
    access: $all
    publish: $authenticated
    proxy: npmjs
server:
  keepAliveTimeout: 60
log: {type: stdout, format: pretty, level: warn}

[juanpicado]

Mmmm I am not sure yet if verdaccio overrides partial or your provided configuration, it relies in what you set the. So probably is not the complete or right answer but the default config is packages/config/src/conf/default.yaml

It is recommended you always set packages because probably would asume forbidden by default

[mbtools]

That part of the doc was misleading. Fix it in verdaccio/website#411