How To Setup Private NPM Module With Firebase Cloud Functions .npmrc?

Question

I have created a private typings npm module that I am using for my firebase functions and app projects. When I went to deploy firebase functions, I get a big error for every function that basically says ERR: remote. Invalid username or password. ERR: remote. Invalid username or password.

For what I have read, it looks like I need to create a.npmrc file and put it in the /functions directory. ( https://cloud.google.com/functions/docs/writing/specifying-dependencies-nodejs#using_private_modules )

I cannot however find proper instructions on how to do this anywhere. From what I found, I have done the following:

• ran npm login
• ran npm token create --read-only

This then gave me a token that looks like this: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX .

I then create a file called.npmrc in my functions directory, and placed //registry.npmjs.org/:_authToken=XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX in it.

Additionally, I saw that the error message was trying to use ssh to install my private repo package, I have not setup ssh and am using https instead, because of this I changed my package file to git+https://github.com/accounts-name/repo#commit-num so that it uses HTTPS.

However, I still get the same error message. What am I missing? The above is what I have strung together from lots of google searching.

Answer 1

It seems that you have made too many different changes while trying to make it work, so let's just go through the whole process step by step.

1. Check the package.json of your npm module and publish it:

   • Remove "private" property or set it to false because private modules in the npm are meant to be never published. That is not obvious but that is true.
   • Next step is to apply restricted access to the package. In order to do that, add such property in the package.json file:

    "publishConfig": { "access": "restricted" },

   • Make sure that npm account you use for publishing supports private packages.
   • Now open the terminal in the root directory of your package, type npm login then sign in to npm. Check if you put the proper version in the package.json .
   • Run npm publish . The package should be published in few seconds. No worries, thanks to publishConfig property nobody can access it.

2. Now it is time to allow package installation in your project

   • Go to the directory of the project and open package.json file
   • Check that you have the name and version of your package in the dependencies list
   • Open browser, navigate to https://npmjs.com , login to your account, navigate to settings page of your account and open the tokens tab
   • Create new token and copy it
   • Now again go to the directory of your project, on same level where package.json file is situated (that is important!) and create .npmrc file there.
   • Put such string in the .npmrc file:

    //registry.npmjs.org/:_authToken=TOKEN_HERE

   You are done!

3. Deployment with remote CI/CD services

   • The easiest approach is not add .npmrc into .gitignore . In such case the file will be always in repository, so npm install will run smoothly on any machine where project was cloned
   • If you don't want to have token string in the repository, you can move it to the environment variable of your CI/CD service and then link.npmrc file to that variable. For example, you can put generated token into the NPM_TOKEN env variable (Just token from npmjs, not the whole string from.npmrc!) And then change the .npmrc file in the next way: //registry.npmjs.org/:_authToken=${NPM_TOKEN} .

So, with those steps you should be able to install your restricted packages without any issues. Good luck!

Answer 2

If you are trying to deploy you functions with firebase deploy from a CI and your .npmrc file looks like this.

@acmecorp:registry=https://npm.pkg.github.com/

//npm.pkg.github.com/:_authToken=${NPM_REGISTRY_TOKEN}

You will run into the problem even if you have the env var set.

Build failed: Error: Failed to replace env in config: ${NPM_REGISTRY_TOKEN}

Firebase for some reason needs access to that private repo. But the env var is not sent over to firebase.

Solution I've implemented was to replace ${NPM_REGISTRY_TOKEN} in the.npmrc file on every run of the CI pipeline.

sed -i.bak "s/\${NPM_REGISTRY_TOKEN}/${NPM_REGISTRY_TOKEN}/g" .npmrc

Answer 3

This breaks if you use Yarn . Took me a while to find a thread pointing to npm install in the firebase cli predeploy step. If there's no package-lock.json and you only use yarn, this will break. Remove yarn.lock and install using npm to resolve the issue.