Summary

Models each package's access / publish permission as a list of tokens (verdaccio's space-separated groups) matched against the caller's identity, instead of a single rule. This adds per-user access (list usernames directly) and lays the matching groundwork for named groups.

packages:
  '@team/*':
    access:  alice bob        # only these users (+ they can read)
    publish: alice            # only alice can publish
  '@public/*':
    access:  $all
    publish: $authenticated

How verdaccio does it (and what we mirror)

verdaccio's access/publish/unpublish are space-separated lists; a request is allowed when the caller's group set intersects the list. A logged-in user's groups are the built-ins plus their username, plus whatever the auth plugin returns — and the default htpasswd plugin contributes only the username. Named groups beyond that come from other auth backends (LDAP/GitLab/…).

So there is intentionally no new groups: config key: that's not how verdaccio works with htpasswd. Usernames give per-user access today; group names will resolve here for free once a group-providing auth backend lands (the separate "pluggable auth" item in #11973).

What's in

• AccessRule (single enum) → AccessList (Vec<AccessToken>) + Identity. A permission is satisfied if the identity matches any token (union).
• Tokens: $all / @all / all, $authenticated / @authenticated, $anonymous / @anonymous, or a name. A name matches an authenticated caller whose username equals it.
• Each permission accepts both a space-separated string (access: alice bob) and a YAML sequence (access: [alice, bob]), like verdaccio.
• enforce_access: a denied anonymous caller gets 401 (can authenticate); a denied authenticated caller gets 403.

Behavior change to note

This reverses the InvalidAccessRule stopgap from #12043, which rejected bare names because groups weren't modeled yet. Bare names are now valid tokens (usernames/groups) — verdaccio's actual behavior. The error variant and its two "unknown token is a config error" tests are removed, replaced by per-user / list tests.

Scope

• Completes the mechanism for "Named groups, per-user group membership": usernames work fully today; group names beyond usernames await a group-providing auth backend (verdaccio is identical with htpasswd).
• unpublish is still parsed for config compatibility but folds into publish at enforcement (unchanged; separate item).

Test plan

• Unit tests: token parsing (built-ins + names), $all/$authenticated/$anonymous/username/empty-list semantics, mixed-list union, YAML string-vs-sequence equivalence, defaults, first-match-wins, and bundled-config protections preserved.
• Integration (tests/policy.rs): $authenticated gating, $anonymous admit/forbid, and a new username_in_access_list_grants_only_that_user (anon → 401, wrong user → 403, listed user → allowed).
• cargo test, cargo clippy --deny warnings, cargo dylint (perfectionist), cargo fmt --check, cargo doc -D warnings, typos all clean.

Refs #11973 (Access control → "Named groups, per-user group membership").

Written by an agent (Claude Code, claude-opus-4-8).

Summary by CodeRabbit

• New Features

  • Multi-token permission lists for package access, accepting both string and sequence YAML formats.
  • Username-specific access rules supported and enforced.

• Improvements

  • Clearer handling of unauthenticated vs forbidden authorization responses.

• Tests

  • Added integration tests covering username-based rules and token-list parsing.