Repository navigation
Upgrade notes: npm and Yarn password logins of local accounts follow the local realm's client-password setting - #811
Merged
Conversation
…client-password setting In 2.1 the npm password login (`yarn npm login`, `npm login --auth-type=legacy`) walked every realm whatever `allow_password_basic` said. Since #647 it goes through the realms that accept client passwords (`PasswordFrom::Client`), and migration 0006 sets the local realm's setting from `allow_password_basic`, off by default. On such an install these logins answer 401 for every local account after the upgrade. 647.upgrade.md describes the change only for installs with a credential-forwarding realm, so the operators it hits read that nothing changes for them. A fragment of its own says so, and names the remedies: the local realm's setting, the browser login, or a token. Fixes #793 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012e6DJc1H3748D8sheqhKTV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #793
Problem
In 2.1,
cli_auth::password_login(yarn npm login,npm login --auth-type=legacy) calledverify_password_login. By its own doc that check was "Not gated byallow_password_basic", and it walked every realm (v2.1.0 crates/server/src/auth/mod.rs:981-987).Since #647 it passes
PasswordFrom::Client(crates/server/src/cli_auth.rs:154), so only the realms that accept client passwords take part. Migration 0006 sets the local realm'saccept_client_passwordsfromallow_password_basic, which defaulted tofalse(v2.1.0 crates/server/src/auth/settings.rs:147).So on a default 2.1 install,
yarn npm login(Yarn's only login) answers 401 for every local account after the upgrade.647.upgrade.mddescribes a change only for installs with a credential-forwarding realm, so those operators read that nothing changes for them.docs/npm.mdalready describes the new behaviour.Change
A new fragment,
docs/changes/2.2.0/793.upgrade.md, says:allow_password_basicwas off;It names the remedies: the setting under Admin → Authentication, the browser login (
npm login), or a token from the web UI.The note only helps in 2.2.0's own notes, so it belongs before the tag.
cargo xtask changelog --checkpasses.Generated by Claude Code