[BUG] npm whoami allow empty username

[sosoba]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm whoami

undefined

cli/lib/utils/get-identity.js

Lines 12 to 21 in dc8e6bd

	// No username, but we have other credentials; fetch the username from registry
	if (creds.token || creds.certfile && creds.keyfile) {
	const registryData = await npmFetch.json('/-/whoami', { ...opts })
	return registryData.username
	}
	// At this point, even if they have a credentials object, it doesn't have a
	// valid token.
	throw Object.assign(
	new Error('This command requires you to be logged in.'),

Expected Behavior

npm whoami

npm ERR! This command requires you to be logged in.

It seems to me, that there should be condition on return at line 15

if (registryData?.username) {
  return registryData.username;
}

Steps To Reproduce

1. Config registry=https://verdaccio.example.com
2. Run 'npm whoami'
3. See result

Environment

• npm: 8.19.2
• Node.js: 18.12.1
• OS Name: Windows 11
• System Model Name: Other
• npm config:

registry=https://verdaccio.example.com

[wraithgar]

Is verdaccio returning a 2xx response when you are not logged in? npm assumes that whoami will return an http error if you are not logged in. This seems like a verdaccio bug if it is not properly telling clients the situation.

[sosoba]

Is verdaccio returning a 2xx response when you are not logged in? npm assumes that whoami will return an http error if you are not logged in. This seems like a verdaccio bug if it is not properly telling clients the situation.

Yes. You are right, This third-party registy has different behaviour that registry.npmjs.org. But in general the client should not assume that the server always returns valid values. It should validate them.

[juanpicado]

I think is a mix both, I will also include some improvements in verdaccio. Thanks @sosoba .