Skip to content

Instantly share code, notes, and snippets.

@mbrevoort
Created July 26, 2012 03:08
Show Gist options
  • Save mbrevoort/3180014 to your computer and use it in GitHub Desktop.
Save mbrevoort/3180014 to your computer and use it in GitHub Desktop.
private npm repo namespace idea so that private registries don't have to replicate the entire public NPM registry or you don't have to do some sort of conditional proxying.
// A module published to a private registry would optionally have a "registry"
// property that is a reference to the registry where this module is published.
//
// A `npm publish` would publish to the registry in the registry property.
//
// Otherwise, `npm --registry http://private.me:5984/registry/_design/app/_rewrite publish`
//
{
"name": "foo",
"description": "a module published to a private registry",
"version": "1.0.1",
"dependencies": {},
"registry": "http://private.me:5984/registry/_design/app/_rewrite"
}
// If this module, `with-some-privates` depends on modules from a private registry (could be public too),
// it can register module namespaces that will be used when resolving dependencies by specifying the
// namespace and the URL of the registry in the `registries` property.
//
// The namespaces are meaningless outside of this package.json, they are simply and alias to the registry
// for dependencies.
//
// Dependencies would reference modules in the private registry by the namespace prefix and some delimiter,
// a hash (`#`) perhaps.
//
// After installing the module you could require it without the namespace like
// `require('foo') --- possible conflicts, but simplifies other things (?)
//
{
"name": "with-some-privates",
"description": "a module with private registry references",
"version": "0.2.0",s
"dependencies": {
"request": "2.9.x",
"myprivates#foo": "1.0.1",
"another#bar": "0.2.0"
},
registries: {
"myprivates": "http://private.me:5984/registry/_design/app/_rewrite",
"another": "http://another.com:5984/registry/_design/app/_rewrite"
}
}
@mbrevoort
Copy link
Author

@isaacs Good point on the package dependencies name and contents of node_modules.

What if we moved those details into the value of the dependency as you suggested. The private repo could be aliased by properties in the registries property or npm:// or npms:// protocols can used literally like npm://{http_reg_host}/{name}/{version}.

For example, I pretty much have this shoe stringed together and working:

"dependencies": {
  "foo":"myprivates#1.2.3",
  "bar":"npm://my.privates.com/bar/1.0.6",
  "baz":"npms://my.privates.com/bar/1.0.6"
},
"registries":{
  "myprivates":"http://my.privates.com"
}

@dominictarr
Copy link

you could implement this on the registry or the client side.
another factor to take into account is auth,
as this will be private code in the non private repos,
and you'll need auth for that anyway.

hmm, that is gonna need a change to the npm client anyway.
as you'll need support for different credentials per registry.

@dominictarr
Copy link

and if you are gonna configure the auth in the config, maybe you should configure the url there too.

[registry.joyent]
url= ...
auth= ...

and then when "trade-secrets@joyent": "1.0" appears in the package.json npm will know that it's at the url you've specified. otherwise, if you want to move the registry or something, you'll have to go and update ALL your modules.

@mbrevoort
Copy link
Author

@dominictarr The auth config is a good point. Currently when we've used a private registry at Pearson it was behind a firewall without auth to resolve modules. So how about if it finds _auth config for the alt registry it will always use it otherwise it will try without it.

So far in my hacked up npm client code I can have config that looks like this:

registry.myprivates.registry = http://registry.foo.org
registry.myprivates._auth = ....
registry.myprivates.username = ....
registry.myprivates._password = ....

If a package.json has a version dependency that's not a protocol URL but contains a hash, then it will assume the left side of the hash is the alias name of the alternate registry.

"dependencies": {
  "foo":"myprivates#1.2.3",
}

Can anyone think of any ramifications of specifying the dependency like "foo":"myprivates#1.2.3", with the alternate registry alias in the value of the dependency rather than the property name?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment