yarn npm login is not compatible with verdaccio

Describe the bug

I have a private npm registry implemented by verdaccio which requires login for any access. When a certain user does not yet exist in the registry yarn npm login succeeds. However, as soon as this user tries to relogin with the same command there’s a http error 409 (conflict).

I had reported this against verdaccio (https://github.com/verdaccio/verdaccio/issues/1737), since yarn2 login works fine for registry.yarnpkg.com. However, this was before I realized that new users may be created without problems.

To Reproduce

I’m sorry that I don’t see like I could provide the repro with Sherlock 😦

1 You would have to install verdaccio, globally or locally, with yarn or npm and run it like this [yarn run] verdaccio -c conf.yml with this conf.yml:

storage: ./storage

auth:
  htpasswd:
    file: ./htpasswd

security:
  api:
    jwt:
      sign:
        expiresIn: 30d
        notBefore: 0
  web:
    sign:
      expiresIn: 7d

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@*/*':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

  '**':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

logs:
  - {type: file, path: verdaccio.log, level: trace}

2 Furthermore I save this as .yarnrc.yml (you’d have to correct yarnPath, obviously)

yarnPath: "...\\.yarn\\releases\\yarn-berry.js"

unsafeHttpWhitelist:
  - "localhost"

npmRegistryServer: "http://localhost:4873"

3 Execute yarn npm login two times - the first will succeed, the second fail with a message like this:

➤ YN0001: HTTPError: Response code 409 (Conflict) at EventEmitter. (…\releases\yarn-berry.js:24:327728) at processTicksAndRejections (internal/process/task_queues.js:97:5) ➤ YN0000: Failed with errors in 4.09s

Environment if relevant (please complete the following information):

• OS: [e.g. OSX, Linux, Windows, …] windows 10
• Node version [e.g. 8.15.0, 10.15.1, …] 12.16.1
• Yarn version [e.g. 2.0.0-rc1, …] 2.0.0rc29

const cp = require('child_process')
const fs = require('fs')


const verdaccioConf=`
storage: ./storage

auth:
  htpasswd:
    file: ./htpasswd

uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@*/*':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

  '**':
    access: $authenticated
    publish: $authenticated
    proxy: npmjs

logs:
  - {type: stdout, format: pretty, level: http}
`
fs.writeFileSync('config.yaml', verdaccioConf)


const htpasswd = `
test:$6FrCaT/v0dwE:autocreated 2020-06-09T16:43:43.706Z
`
fs.writeFileSync('htpasswd', htpasswd)


const  yarnrc = `
unsafeHttpWhitelist:
  - "localhost"

npmRegistryServer: "http://localhost:4873"
`
fs.writeFileSync('.yarnrc.yml', yarnrc)


await packageJsonAndInstall({
  dependencies: {
    'verdaccio': '4.5.1'
  }
})

cp.spawn('./node_modules/.bin/verdaccio')

await new Promise(resolve => setTimeout(resolve, 5000)) // a bit of a delay

const output = await yarn('yarn', 'npm', 'login') // test, test
expect(output).not.toContain('Response code 409 (Conflict)')

[korniychuk]

Temporary workaround:

1. Login with NPM
2. Copy-paste generated token from ~/.npmrc to ~/.yarnrc.yml.

❯ cat ~/.npmrc
//npm.my-project.pro/:_authToken="GAOEuaeouaoEUo+u3=="

❯ cat ~/.yarnrc.yml
npmRegistries:
  "https://npm.my-project.pro":
    npmAuthToken: GAOEuaeouaoEUo+u3==

Then yarn npm publish for verdaccio works fine.

[ringods]

I was able to reproduce this easily with Yarn 2.0.0-rc.31. I ran verdaccio via the default Docker image:

$ docker run -it --rm --name verdaccio -p 4873:4873 verdaccio/verdaccio

Then first create a user via:

$ npm adduser --registry http://localhost:4873

Then configure the local registry in your .yarnrc.yml file:

npmScopes:
  testscope:
    npmPublishRegistry: "http://localhost:4873"
    npmRegistryServer: "http://localhost:4873"
    npmAlwaysAuth: true
unsafeHttpWhitelist:
  - "localhost"

followed by:

$ yarn npm login -s testscope

If you use the same credentials from adduser, the yarn login will fail and you will see the following error message from the Verdaccio process:

http <-- 409, user: null(172.17.0.1), req: 'PUT /-/user/org.couchdb.user:ringods', error: username is already registered