How to send full publisher object (including groups and real_groups) via notify hook?

[98ritu]

Hi Verdaccio team,

I’m using the notify hook for triggering a webhook on publish. I noticed that in the hook (notify.ts), the publisher object passed into the Handlebars template only includes:
publisher: {
name: remoteUser.name
}
But both groups and real_groups are missing/empty when I try to use them in the notify content template in config.yaml.
How can I access the full RemoteUser object inside the notify template, including real_groups?

[juanpicado]

you refer to this one. https://github.com/verdaccio/verdaccio/blob/6.x/src/lib/notify/index.ts#L81

Docs says
https://verdaccio.org/docs/notifications#package-published

Maybe is a bug, I'll convert it to issue to check more in detail, please share full info, config file example specially.

[98ritu]

I referred https://github.com/verdaccio/verdaccio/blob/d945bfe99d8b939e264a6c850ed16d8242b1f839/packages/hooks/src/notify.ts

I have a use case where I need to send publisher.real_groups to a custom notify endpoint. However, on the API side, this field appears empty in the request body.

After inspecting the implementation, it seems that only remoteUser.name is passed as publisher, and fields like real_groups are not included.
Here's an excerpt from my config.yaml for reference:

storage: /verdaccio/storage
plugins: /verdaccio/plugins

middlewares:
  hd-auth:
    authApiAddress: /nodeapi/auth
    permissionsApiAddress: /nodeapi/publish/getallpermissions
    packageVisibility: all

web:
  enable: true
  title: my Registry
  logo: /verdaccio/conf/hd_logo.png
  primary_color: "#F05F40"
  darkMode: false
  favicon: /verdaccio/conf/favicon.ico
  showInfo: false
  showFooter: false

security:
  api:
    legacy: false
    jwt:
      sign:
        expiresIn: 29d
  web:
    sign:
      expiresIn: 7d

packages:
  "**":
    access: $authenticated
    publish: $authenticated
    unpublish: $authenticated

notify:
  publishToComponentList:
    method: POST
    headers: [{ "Content-Type": "application/json" }]
    endpoint: http://localhost:8001/nodeapi/publish/publishComponent
    content: '{
        "component": "{{name}}",
        "version": "{{publishedPackage}}",
        "publisher": "{{publisher.name}}",
        "scopes": "{{publisher.real_groups}}"
      }'

logs:
  type: stdout
  format: pretty-timestamped
  level: http

[mbtools]

There's a comment in the code:

don't override 'publisher' if package.json already has that

That's most likely why you don't get the groups.

[98ritu]

My package.json does not include a publisher field.
Looking at the code, it seems that when metadata.publisher is null or undefined, the publisher is set using only remoteUser.name:
if (_.isNil(metadata.publisher)) {
metadata = {
...metadata,
publishedPackage,
publisher: { name: remoteUser.name as string },
};
}
Would it be possible to include additional remoteUser fields here, like real_groups or groups or any custom field, to support more use cases?

[mbtools]

sure. feel free to create a PR