Override npm project auth token with user auth token? - npm

Question

I've got a project that includes a $PROJECT/.npmrc that has an auth token granting read-only access to the proviat repos required by the project:
$ cat .npmrc
//registry.npmjs.org/:_authToken={read-only-token}
How can I override that token with my user token so I can publish packages?
$ cat ~/.npmrc
//registry.npmjs.org/:_authToken={my-token}
The documentation states that config files will be loaded in "priority order", where the project configuration has the highest priority, and there doesn't seem to be any way to override this:
$ cd my-project/
$ npm whoami
project-readonly-user
$ cd ~
$ npm whoami
wolever
I know that it's possible to define an NPM_TOKEN environment variable:
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
But this means that every user of the project will need to define the NPM_TOKEN environment variable, which is undesirable (ie, because it means that every user - including read-only users - will need to define an NPM_TOKEN environment variable before they can use the project).

Answer 1

Just found a solution.
Edit your .npmrc file:
//registry.npmjs.org/:_authToken=${NPM_TOKEN}
Every time you want to publish(powershell):
$env:NPM_TOKEN="the-token"
npm publish --access public --registry https://registry.npmjs.org

Answer 2

Obviously the docs have change and setting the auth Token via CLI is not possible anymore on npm publish, so I provide more solution for using NPM with Github Actions + Font Awesome PRO + Github Package Registry:
name: Node.js Package
on:
release:
types: [created]
workflow_dispatch:
jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- name: Checkout 🛎
uses: actions/checkout#master
- name: Setup node env 🏗
uses: actions/setup-node#v2
with:
node-version: '14.x'
registry-url: 'https://npm.pkg.github.com'
scope: '#mindfuel'
- name: Install Packages 🦺
run: npm ci
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Build 👷🏼
run: npm run build
- name: Prepare NPM Config 👮🏽‍♂️
run: rm -f .npmrc
- name: Setup publishing Env 🏗
uses: actions/setup-node#v2
with:
node-version: '14.x'
registry-url: 'https://npm.pkg.github.com'
scope: '#mindfuel'
- name: Publish Package 🚀
run: npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
For me the trick is to recall setup-node after deleting the existing .npmrc.
We have a shared .npmrc that all developers use. It includes a READ ONLY token to our companies registry:
# Font Awesome Pro Config
#fortawesome:registry=https://npm.fontawesome.com/
//npm.fontawesome.com/:_authToken=<your-token>
# Private Packages
#<github-username-or-org>:registry=https://npm.pkg.github.com/
//npm.pkg.github.com/:_authToken=<the-read-only-token>

Answer 3

CLI arguments have precedence over local .npmrc config, so you could overwrite it this way:
npm publish --registry=https://registry.npmjs.org/:_authToken={my-token}
You could add an npm script for publishing that depends on an environment variable with a private token:
{
"scripts": {
"publish": "npm publish --registry=https://registry.npmjs.org/:_authToken=${NPM_PUBLISH_TOKEN}"
}
}