chore: wip

Author: devthejo

examples/consumer-app/.npmrc

@@ -1,4 +1,5 @@
 ignore-scripts=true
 registry=http://localhost:4873/
 @*:registry=http://localhost:4873/
-//localhost:4873/:_authToken=npm-e4bbfe4f3db6a7b1ffe2cd2cf2c5dc00eddc8d07994ca95f
+//localhost:4873/:username=token
+//localhost:4873/:_password=bnBtLWU0YmJmZTRmM2RiNmE3YjFmZmUyY2QyY2YyYzVkYzAwZWRkYzhkMDc5OTRjYTk1Zg==

secure-registry/plugins/verdaccio-security-token-auth/src/index.ts

@@ -57,14 +57,30 @@ class SecurityTokenAuth implements AuthPlugin {
     password: string,
     cb: Callback
   ): Promise<void> {
-    const token = password;
+    let token = password;
 
     if (!token || typeof token !== 'string' || token.length === 0) {
       this.logger.warn('security-token-auth: empty token');
       cb(new Error('token required'), false);
       return;
     }
 
+    // npm sends `_authToken` as an `Authorization: Bearer <token>` header.
+    // Verdaccio forwards this as the `password` parameter, including the
+    // `Bearer ` prefix. The unified API stores only the raw token value, so we
+    // need to normalize here to accept both raw tokens and `Bearer`-prefixed
+    // forms transparently.
+    const lower = token.toLowerCase();
+    if (lower.startsWith('bearer ')) {
+      token = token.slice(7).trim();
+    }
+
+    if (token.length === 0) {
+      this.logger.warn('security-token-auth: empty token after Bearer strip');
+      cb(new Error('token required'), false);
+      return;
+    }
+
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), this.timeoutMs);
 

services/api/src/mongoClient.ts

@@ -1,6 +1,10 @@
 import { MongoClient, Db } from 'mongodb';
 
-const DEFAULT_URI = process.env.SECURITY_DB_URI || 'mongodb://127.0.0.1:27017';
+// In local dev, `pnpm infra:up` exposes MongoDB on host port 27018 by default
+// (see secure-registry/infra/docker-compose.yml). Using the same port here as
+// a fallback ensures that when SECURITY_DB_URI is unset, the unified API and
+// Verdaccio dev instances talk to the same database as the dev infra.
+const DEFAULT_URI = process.env.SECURITY_DB_URI || 'mongodb://127.0.0.1:27018';
 const DEFAULT_DB_NAME = process.env.SECURITY_DB_NAME || 'secure_registry';
 
 let clientPromise: Promise<MongoClient> | null = null;