Ankit Jain

Hi 👋, I am also facing the same issue. I am using my own plugin [verdaccio-groups](https://github.com/ankitjain28may/verdaccio-groups) for managing authorization over authentication. So when I run-- ``` npm unpublish --registry http://localhost:4873...

Yeah, but I have also tried without my custom plugin, in that case as well `user.name` is also undefined but somehow the `hasPermission` returns true because of which it was...

Here are the trace logs foe the same: ``` info

@DanielRuf I have provided as much information as I can, let me know specifically what else do you need.

Trace as you asked for. ``` trace--- allowed access for @xyz/abc trace--- [local-storage/getPackageStorage]: storage selected: /verdaccio/storage/data trace--- [local-storage/getPackageStorage]: storage path: /verdaccio/storage/data/@xyz/abc debug--- [local-storage/readPackage] read a package: @xyz/abc trace--- [local-storage/_readStorageFile] read...

The default group ($all, $authenticated, all, authenticated, @all) is always passed and hence without being the defined user this [/src/lib/auth-utils.ts#L48]](https://github.com/verdaccio/verdaccio/blob/7b67bea4b8ec5de29ffc04b1f99c9d041c14ac57/src/lib/auth-utils.ts#L48) this is passed without any error. Moreover, the user should...

Using docker image tag: 4.4.1

Sure, will provide in some time :)

@DanielRuf Added my setup under this repo- https://github.com/ankitjain28may/verdaccio-experiments Run these commands to install: ``` mv data/conf/config.sample.yaml data/conf/config.yaml docker-compose up --build ``` Now try to publish some registry and unpublish it....

Hi @DanielRuf Any updates on this?