Can't publish private npm package

[UchihaYuki]

Description

I published with npm publish --access=restricted. But it's still public. Everybody can download it, even if they are not logged in.

Gitea Version

Gitea version 1.22.0 built with GNU Make 4.4.1, go1.22.3 : bindata, timetzdata, sqlite, sqlite_unlock_notify

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

git version 2.31.1.windows.1

Operating System

Windows 10

How are you running Gitea?

docker

Database

MSSQL

[UchihaYuki]

The package I published:

npm notice Publishing to https://demo.gitea.com/api/packages/uchihayuki/npm/ with tag latest and restricted access       
+ @uchihayuki/test-gitea@0.1.0

[KN4CK3R]

Package permissions are inherited from the owner visibility and can't be set with npm publish --access=restricted.

[UchihaYuki]

Can this be a feature request? It's pretty useful, people always want both public and private npm packages.

[KN4CK3R]

Sure, but I don't think this will happen because it requires a new permission system.

[mlhynfield]

I'd just like to jump in and second this as a nice feature, not just for npm packages but for packages in general. For example, I just ran into this issue myself with some container images I pushed to the container registry, where, as a relatively new user, I had expected to find controls to modify the container image visibility but instead found that I needed to change the owning organization's visibility. I think it would be really great to have a bit more control over package visibility at some point so you don't have to have a separate user/organization for public and private packages.

[SashaGoncharov19]

@mlhynfield Agree with you. I also have public org which contains some private/public repos, but i want to have some private packages also with public org.

[bvandevliet]

This issue seems related, I'm quite sure it's even the root cause and touches a broader problem on handling permissions in the package feature as a whole: #20596