"Allow access" vs "Allow download/install"

[mbtools]

Scenario

1. All users should be able to view all packages via the web interface
2. Only authenticated users should be able to Install packages (i.e. download the tarball)

Config

For (1) it would need to be

packages:
  '**':
    access: $all

but for (2) it needs to be

packages:
  '**':
    access: $authenticated

Question

Can we implement this scenario using an auth plugin or do we need to enhance verdaccio to support such a scenario (for example by adding allow_tarball to the auth plugin interface)?

Ref: Config, Auth Plugin

[juanpicado]

Mmmm thinking how to make it in a way is not confusing, but I think make sense in some cases. Access give you rights to access either to tarball and metadata from the web ui you might want have different behavior but from cli would void any usage of package manager and I don't know if they are ready to handle such scenario.

If you may have noticed the security property split api and web for that reason but there is no such difference in package acccess. I am just describing the current status quo.