@xemahq/xema-npm-auth-plugin

Verdaccio auth plugin enforcing JWT-based registry ACLs

Overview

A Verdaccio authentication plugin that validates Keycloak-issued JWTs and enforces a four-tier registry visibility model (System, System-shareable, Org, External) on every authenticate, read, and publish call. Cross-org access is structurally impossible: a request whose token org does not match the requested package scope is denied with a typed reason. Verdaccio loads the plugin through its standard plugin convention.

When to use it

• Use it to gate a Verdaccio npm registry behind Keycloak JWTs and per-tier access control.

Installation

pnpm add @xemahq/xema-npm-auth-plugin

Usage

# Verdaccio config.yaml — Verdaccio loads the plugin by name.
auth:
  xema-jwt:
    # plugin-specific options (e.g. JWKS endpoint, expected issuer)

License

Apache-2.0 © Xema — xema.dev