Forced publish, failure

[carlosen14]

Describe the bug
When try to publish forced an already published pkg, i preffer to use --force instead of npm unpublish. But i kind of remember on previous version i could do that, now it just throw an NPM ERR.

Actually, this removes the pkg from Verdaccio, so, the problem is after the internal unpublish. Even the specific version is unpublished, doesn't allow me to publish it agait, it does not appear on Verdaccio UI, but says it is the same error Unexpected token u in JSON at position 0, like if the package wasn't completely removed.

To Reproduce
I'll reproduce my case, login with my user cvilla. ONLY root user can unpublish.

Steps to reproduce the behavior:

1. Publish a scoped package v 1.0.5 (example)
2. import it on other project by doing `npm i
3. make a change on project
4. republish using npm publish --force. This will fail.

Expected behavior
Unpublish the previous version, and publish the actual one.

Screenshots
If applicable, add screenshots to help explain your problem.

Docker || Kubernetes (please complete the following information):

• Docker verdaccio tag: verdaccio:4.2.0
• Docker commands [e.g. docker pull ...]
• Docker Version [e.g. v18.05.0-ce-rc1]

Configuration File (cat ~/.config/verdaccio/config.yaml)

#
# This is the config file used for the docker images.
# It allows all users to do anything, so don't use it on production systems.
#
# Do not configure host and port under `listen` in this file
# as it will be ignored when using docker.
# see https://verdaccio.org/docs/en/docker#docker-and-custom-port-configuration
#
# Look here for more config file examples:
# https://github.com/verdaccio/verdaccio/tree/master/conf
#

# path to a directory with all packages
storage: /verdaccio/storage/data
# path to a directory with plugins to include
plugins: /verdaccio/storage/plugins

web:
  # WebUI is enabled as default, if you want disable it, just uncomment this line
  #enable: false
  title: Package Repository
  # comment out to disable gravatar support
  gravatar: false
  # by default packages are ordercer ascendant (asc|desc)
  sort_packages: asc
  primary_color: "#006341"

auth:
  htpasswd:
    file: /verdaccio/storage/htpasswd
    # Maximum amount of users allowed to register, defaults to "+infinity".
    # You can set this to -1 to disable registration.
    max_users: 7

security:
  api:
    jwt:
      sign:
        expiresIn: 30d
        notBefore: 1
  web:
    sign:
      expiresIn: 7d
      notBefore: 1

# a list of other known repositories we can talk to
uplinks:
  npmjs:
    url: https://registry.npmjs.org/

packages:
  '@scope/*':
    # scoped packages
    access: $authenticated
    publish: cvilla
    unpublish: root

  '@*/*':
    # scoped packages
    access: $all
    publish: $authenticated
    unpublish: $authenticated
    proxy: npmjs

  '**':
    # allow all users (including non-authenticated users) to read and
    # publish all packages
    #
    # you can specify usernames/groupnames (depending on your auth plugin)
    # and three keywords: "$all", "$anonymous", "$authenticated"
    access: $all

    # allow all known users to publish/publish packages
    # (anyone can register by default, remember?)
    publish: $authenticated
    unpublish: $authenticated

    # if package is not available locally, proxy requests to 'npmjs' registry
    proxy: npmjs

# To use `npm audit` uncomment the following section
middlewares:
  audit:
    enabled: true

# log settings
logs:
  - { type: stdout, format: pretty, level: http }
  #- {type: file, path: verdaccio.log, level: info}

Environment information
verdaccio --info: sh: verdaccio: not found (on docker)

Debugging output

• $ NODE_DEBUG=request verdaccio display request calls (verdaccio <--> uplinks)
• $ DEBUG=express:* verdaccio enable extreme verdaccio debug mode (verdaccio api)
• $ npm -ddd prints:

npm info it worked if it ends with ok
npm verb cli [ '/home/user/.nvm/versions/node/v10.15.2/bin/node',
npm verb cli   '/home/user/.nvm/versions/node/v10.15.2/bin/npm',
npm verb cli   '-ddd' ]
npm info using [email protected]
npm info using [email protected]

• $ npm config get registry prints:

http://192.168.0.1:4873/

Additional context
This might be a NPM error, or a compatibility.

77 info attempt registry request try #1 at 11:37:43 AM
78 verbose request using bearer token for auth
79 http request GET http://192.168.0.1:4873/@scope%2fpackage
80 http 200 http://192.168.0.1:4873/@scope%2fpackage
81 verbose headers { 'x-powered-by': 'verdaccio/4.2.0',
81 verbose headers   'access-control-allow-origin': '*',
81 verbose headers   'content-type': 'application/json; charset=utf-8',
81 verbose headers   etag: '"24b5ca3601382e4ff1297fa91675e23b"',
81 verbose headers   vary: 'Accept-Encoding',
81 verbose headers   'content-encoding': 'gzip',
81 verbose headers   date: 'Tue, 30 Jul 2019 16:37:43 GMT',
81 verbose headers   connection: 'keep-alive',
81 verbose headers   'transfer-encoding': 'chunked' }
82 info detach /@scope%2fpackage/-/package-1.0.5.tgz/-rev/49-341c5788ca4104d2
83 verbose request uri http://192.168.0.1:4873/@scope%2fpackage/-/package-1.0.5.tgz/-rev/49-341c5788ca4104d2
84 verbose request sending authorization for write operation
85 info attempt registry request try #1 at 11:37:43 AM
86 verbose request using bearer token for auth
87 http request DELETE http://192.168.0.1:4873/@scope%2fpackage/-/package-1.0.5.tgz/-rev/49-341c5788ca4104d2
88 http 403 http://192.168.0.1:4873/@scope%2fpackage/-/package-1.0.5.tgz/-rev/49-341c5788ca4104d2
89 verbose headers { 'x-powered-by': 'verdaccio/4.2.0',
89 verbose headers   'access-control-allow-origin': '*',
89 verbose headers   'content-type': 'application/json; charset=utf-8',
89 verbose headers   'content-length': '81',
89 verbose headers   etag: 'W/"51-WKSeoxjvnfgXvh8O0ueFHSY01+s"',
89 verbose headers   vary: 'Accept-Encoding',
89 verbose headers   date: 'Tue, 30 Jul 2019 16:37:43 GMT',
89 verbose headers   connection: 'keep-alive' }
90 verbose getPublishConfig undefined
91 silly mapToRegistry name @scope/package
92 silly mapToRegistry scope (from package name) @scope
93 verbose mapToRegistry no registry URL found in name for scope @scope
94 silly mapToRegistry using default registry
95 silly mapToRegistry registry http://192.168.0.1:4873/
96 silly mapToRegistry data { type: 'tag',
96 silly mapToRegistry   registry: true,
96 silly mapToRegistry   where: undefined,
96 silly mapToRegistry   raw: '@scope/package',
96 silly mapToRegistry   name: '@scope/package',
96 silly mapToRegistry   escapedName: '@scope%2fpackage',
96 silly mapToRegistry   scope: '@scope',
96 silly mapToRegistry   rawSpec: '',
96 silly mapToRegistry   saveSpec: null,
96 silly mapToRegistry   fetchSpec: 'latest',
96 silly mapToRegistry   gitRange: undefined,
96 silly mapToRegistry   gitCommittish: undefined,
96 silly mapToRegistry   hosted: undefined }
97 silly mapToRegistry uri http://192.168.0.1:4873/@scope%2fpackage
98 verbose publish registryBase http://192.168.0.1:4873/
99 silly publish uploading /tmp/npm-15114-ea0f1372/tmp/fromDir-b493d46c/package.tgz
100 verbose request uri http://192.168.0.1:4873/@scope%2fpackage
101 verbose request sending authorization for write operation
102 info attempt registry request try #1 at 11:37:43 AM
103 verbose request using bearer token for auth
104 http request PUT http://192.168.0.1:4873/@scope%2fpackage
105 http 409 http://192.168.0.1:4873/@scope%2fpackage
106 verbose headers { 'x-powered-by': 'verdaccio/4.2.0',
106 verbose headers   'access-control-allow-origin': '*',
106 verbose headers   'content-type': 'application/json; charset=utf-8',
106 verbose headers   'content-length': '49',
106 verbose headers   etag: 'W/"31-u1Y+cupz+mmqz86SbSKFOrSYDs8"',
106 verbose headers   vary: 'Accept-Encoding',
106 verbose headers   date: 'Tue, 30 Jul 2019 16:37:43 GMT',
106 verbose headers   connection: 'keep-alive' }
107 verbose request uri http://192.168.0.1:4873/@scope%2fpackage?write=true
108 verbose request no auth needed
109 info attempt registry request try #1 at 11:37:43 AM
110 verbose request using bearer token for auth
111 http request GET http://192.168.0.1:4873/@scope%2fpackage?write=true
112 http 200 http://192.168.0.1:4873/@scope%2fpackage?write=true
113 verbose headers { 'x-powered-by': 'verdaccio/4.2.0',
113 verbose headers   'access-control-allow-origin': '*',
113 verbose headers   'content-type': 'application/json; charset=utf-8',
113 verbose headers   etag: '"24b5ca3601382e4ff1297fa91675e23b"',
113 verbose headers   vary: 'Accept-Encoding',
113 verbose headers   'content-encoding': 'gzip',
113 verbose headers   date: 'Tue, 30 Jul 2019 16:37:43 GMT',
113 verbose headers   connection: 'keep-alive',
113 verbose headers   'transfer-encoding': 'chunked' }
114 verbose stack SyntaxError: Unexpected token u in JSON at position 0
114 verbose stack     at JSON.parse (<anonymous>)
114 verbose stack     at RegClient.putNext (/home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/npm-registry-client/lib/publish.js:176:20)
114 verbose stack     at /home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/npm-registry-client/lib/publish.js:134:15
114 verbose stack     at f (/home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/once/once.js:25:25)
114 verbose stack     at /home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/npm-registry-client/lib/request.js:78:16
114 verbose stack     at /home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/npm-registry-client/lib/request.js:105:12
114 verbose stack     at f (/home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/once/once.js:25:25)
114 verbose stack     at RegClient.<anonymous> (/home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/npm-registry-client/lib/request.js:324:12)
114 verbose stack     at Gunzip.cb (/home/user/.nvm/versions/node/v10.15.2/lib/node_modules/npm/node_modules/npm-registry-client/lib/request.js:222:7)
114 verbose stack     at Gunzip.zlibBufferOnEnd (zlib.js:123:10)
114 verbose stack     at Gunzip.emit (events.js:194:15)
114 verbose stack     at endReadableNT (_stream_readable.js:1103:12)
114 verbose stack     at process._tickCallback (internal/process/next_tick.js:63:19)
115 verbose cwd /home/user/Documents/RAGASA/scope.package
116 verbose Linux 4.18.0-25-generic
117 verbose argv "/home/user/.nvm/versions/node/v10.15.2/bin/node" "/home/user/.nvm/versions/node/v10.15.2/bin/npm" "publish" "--force"
118 verbose node v10.15.2
119 verbose npm  v6.4.1
120 error Unexpected token u in JSON at position 0
121 verbose exit [ 1, true ]

[kopax]

I think this is good to not republish a package. Use test to avoid publishing a package with a wrong version. If you fix, then publish a new version. npm allow to unpublish and republish package in a short amount of time. This is because package maintainer can send hack in their republish version and other people won't notice.