berry: yarn 3 ignores npmAuthTokens in ~/.yarnrc.yml: "Invalid authentication (as an anonymous user)" when using private repo, despite `yarn npm login`

Ok, so this seems to look like something attempted to be solved by the deep merge PR from #2106 which was rejected due to major breaking changes?

This is a bug, confirmed. The only way I can (so far) get yarn config to appear properly and yarn add to work properly is to include my token in the project’s yarnrc.yml (huge security hole) and specify my auth with BOTH the npmRegistries key AND npmScopes.

e.g.

nodeLinker: pnp

npmRegistries:
  "https://npm.pkg.github.com":
    npmAuthToken: xxxxx
    npmAlwaysAuth: true

npmScopes:
  alienfast:
    npmAlwaysAuth: true
    npmRegistryServer: "https://npm.pkg.github.com"

yarnPath: .yarn/releases/yarn-3.2.0.cjs

^^^ this works as a project yarnrc.yml but is unusable from a security perspective.

well this is problematic and commenters don’t quite grok what’s happening so hopefully this explanation clears it up:

if you have a npmScopes: your-company: block in your ~/.yarnrc.yml, any keys there will be completely ignored (not merged) if there’s also a npmScopes: your-company: block on your project’s .yarnrc.yml. Therefore, whatever you try to use inside the npmScopes: your-company: block in ~/.yarnrc.yml won’t work at all. It will only work if there’s no npmScopes: your-company: block in your project’s .yarnrc.yml

yarn 4 fixes this no merging issue and will apply the project’s .yarnrc.yml over ~/.yarnrc.yml but keeping the values of keys that are specified in ~/.yarnrc.yml but not in the project’s .yarnrc.yml. so if you have a npmAlwaysAuth: true for the your-company scope on ~/.yarnrc.yml and not in the project’s .yarnrc.yml where you have other keys for the your-company scope, on yarn 4 it will respect the npmAlwaysAuth from ~/.yarnrc.yml, while on yarn 3 it will be false as it is the default and it ignores the your-company scope block from your home’s .yarnrc.yml because no merging.

hope this helps anyone and hope yarn 4 comes out soon officially.

It doesn’t ignore the token, it just doesn’t support configuration merging. In other words, the npmRegistries you declare in your project yarnrc overrides the one in the global one (same for npmScopes).

That’s something we’ll fix in the next major, since it’s a breaking change, but it’s quite tricky to implement in a satisfying way, so it hasn’t been started yet.

Given the lack of reactions to this issue, I’ve added a Bash script to the original post which reproduces the error, using a local Nexus running in Docker. Enjoy!

It’ll not be backported to 3.x considering it’s a breaking change, and very difficult to cherry pick anyway. If you need it, please use the RCs.

I found a solution in another issue. It is required to specify the token inside npmRegistries field. So your ~/.yarnrc.yml should look like:

npmRegistries:
  "https://my-registry-url":
    npmAuthToken: ...

npmScopes:
  myscope:
    npmAuthToken: ...

Not sure if both are required, but the first one certainly is.

Wow, so the reason it works for people who use scopes is that it can take npmScopes from project .yarnrc.yml and npmRegistries from home dir .yarnrc.yml. This way it is possible to separate scopes/registries configuration from tokens.

I don’t see a workaround for people who don’t use scopes.

@arcanis IMHO the only practical reason for separating the config is auth tokens, so perhaps that could simplify the solution i.e. it doesn’t really need to be general.

@arcanis I see. I eagerly await 4.0 then!

I figured it out. I needed to add npmPublishRegistry: "https://registry.npmjs.org" to ~/.yarnrc.yml .

Can someone please summarize what has to go in project/.yarnrc.yml and ~/.yarnrc.yml in version 3.x to publish without including the authentication tokens as part of the project?

I tried the following and it did not work:

project/.yarnrc.yml:

npmScopes:
  public:
    npmRegistryServer: "https://registry.npmjs.org"
    npmAlwaysAuth: true

~/.yarnrc.yml

npmRegistries:
  "https://registry.npmjs.org":
    npmAuthToken: xxx

I still get YN0033: No authentication configured for request when I run yarn npm publish --access=public

it doesn’t work for me with scoped packages on yarn 3.2.3 @__@

having a .yarnrc.yml like this:

yarnPath: .yarn/releases/yarn-3.2.3.cjs
nodeLinker: node-modules
npmRegistries:
  "https://npm.pkg.github.com":
    npmAlwaysAuth: true
npmScopes:
  pkgscope:
    npmAlwaysAuth: true
    npmRegistryServer: "https://npm.pkg.github.com"

I still get ➤ YN0041: │ @pkgscope/package-name@npm:^0.1.0: Invalid authentication (as an anonymous user) on yarn add

It doesn’t ignore the token, it just doesn’t support configuration merging. In other words, the npmRegistries you declare in your project yarnrc overrides the one in the global one (same for npmScopes).

That’s something we’ll fix in the next major, since it’s a breaking change, but it’s quite tricky to implement in a satisfying way, so it hasn’t been started yet.

@arcanis Is there an issue for the configuration merging that can be tracked? Or should I create one? It is quite a roadblock for us and we are very keen to get this feature in.

@alamothe this issue is called “yarn 3 ignores npmAuthTokens in ~/.yarnrc.yml” 😃 Running yarn npm login adds the token to ~/.yarnrc.yml, so that’s not a problem; the problem is that yarn doesn’t use the token from ~/.yarnrc.yml´ when I run yarn install`.

Don’t know if adding npmScopeschanges anything, but we don’t use scopes so that’s an academic question. We use a Nexus server which both acts as proxy for the public NPM repo and serves our own private packages, no scopes involved, auth always required.

I am transitioning our projects to v3, and I have found the failure in authentication to the github package repo.

nodeLinker: pnp

npmScopes:
  alienfast:
    npmAlwaysAuth: true
    npmRegistryServer: "https://npm.pkg.github.com"

yarnPath: .yarn/releases/yarn-3.2.0.cjs

~/p/hello-world-yarn ❯❯❯ yarn npm publish
➤ YN0000: .editorconfig
➤ YN0000: Readme.md
➤ YN0000: bin.js
➤ YN0000: example.gif
➤ YN0000: lib/index.js
➤ YN0000: package.json
➤ YN0000: Package archive published
➤ YN0000: Done in 2s 773ms
~/p/hello-world-yarn ❯❯❯ npm whoami
rosskevin
~/p/hello-world-yarn ❯❯❯ yarn npm whoami
➤ YN0033: No authentication configured for request
➤ YN0000: Failed with errors in 0s 4ms

As you can see, I can publish a private package, but yarn npm whoami reports no auth whereas npm whoami reports my rosskevin user.

I investigated this path because previous packages published on https://npm.pkg.github.com/ are reporting unavailable with misleading messages such as:

~/p/hello-world-yarn ❯❯❯ yarn add @alienfast/eslint-config
➤ YN0000: ┌ Resolution step
➤ YN0033: │ eslint-config-prettier@npm:^8.5.0: No authentication configured for request
➤ YN0000: └ Completed in 3s 875ms
➤ YN0000: Failed with errors in 3s 880ms

whereas npm works fine:

~/p/hello-world-yarn ❯❯❯ npm add @alienfast/eslint-config                                                                                                                                                            ✘ 1 

added 195 packages, and audited 196 packages in 13s

64 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

TL;DR yarn 3 authentication is not working with older github artifacts, and yarn npm whoami is misreporting No authentication configured for request even though yarn npm publish successfully publishes to the github repository!

~/p/hello-world-yarn ❯❯❯ yarn npm whoami --scope alienfast                                                                                                                                                           ✘ 1 
➤ YN0000: rosskevin
➤ YN0000: Done in 0s 348ms

(as an aside, I tried publishing a current @alienfast/eslint-config with yarn npm publish which is also successful but no yarn command can pull from that repo, even though npm can).

SO … WHY can I publish but not install from the same config?