works for managing both composer and npm packages, next is to add auth + payment gateway

.gitignore

@@ -3,6 +3,8 @@
 .env.backup
 .phpunit.result.cache
 .pnpm-store
+.npmrc
+*/.npmrc
 docker-compose.override.yml
 npm-debug.log
 yarn-error.log
@@ -23,4 +25,7 @@ packages/flespi-engine
 packages/flespi-integration
 packages/projectargus-engine
 docker/database/*
-docker/database/mysql/*
+docker/database/mysql/*
+verdaccio/storage/*
+verdaccio/config/htpasswd
+verdaccio/plugins/*/node_modules

.gitmodules

@@ -39,3 +39,12 @@
 [submodule "docs/api-reference"]
 	path = docs/api-reference
 	url = git@github.com:fleetbase/api-reference.git
+[submodule "verdaccio/plugins/verdaccio-composer-middleware"]
+	path = verdaccio/plugins/verdaccio-composer-middleware
+	url = git@github.com:fleetbase/verdaccio-composer-middleware.git
+[submodule "verdaccio/plugins/verdaccio-fleetbase-extensions-middleware"]
+	path = verdaccio/plugins/verdaccio-fleetbase-extensions-middleware
+	url = git@github.com:fleetbase/verdaccio-fleetbase-extensions-middleware.git
+[submodule "verdaccio/plugins/verdaccio-fleetbase-s3-storage"]
+	path = verdaccio/plugins/verdaccio-fleetbase-s3-storage
+	url = git@github.com:fleetbase/verdaccio-fleetbase-s3-storage.git

console/app/controllers/console.js

@@ -77,7 +77,7 @@ export default class ConsoleController extends Controller {
      *
      * @var {Array}
      */
-    @tracked hiddenSidebarRoutes = ['console.home', 'console.extensions', 'console.notifications'];
+    @tracked hiddenSidebarRoutes = ['console.home', 'console.extensions', 'console.extensions.index', 'console.notifications'];
 
     /**
      * Installed extensions.

console/app/routes/console/extensions/index.js

@@ -0,0 +1,10 @@
+import Route from '@ember/routing/route';
+import { inject as service } from '@ember/service';
+
+export default class ConsoleExtensionsIndexRoute extends Route {
+    @service fetch;
+
+    model(params) {
+        return this.fetch.get('extensions');
+    }
+}

console/app/templates/console/extensions/index.hbs

@@ -0,0 +1,2 @@
+{{page-title "Index"}}
+{{outlet}}

console/router.map.js

@@ -21,7 +21,7 @@ Router.map(function () {
     });
     this.route('console', { path: '/' }, function () {
         this.route('home', { path: '/' });
-        this.route('extensions');
+        this.route('extensions', function () {});
         this.route('notifications');
         this.route('account', function () {
             this.route('virtual', { path: '/:slug/:view' });

console/tests/unit/routes/console/extensions/index-test.js

@@ -0,0 +1,11 @@
+import { module, test } from 'qunit';
+import { setupTest } from '@fleetbase/console/tests/helpers';
+
+module('Unit | Route | console/extensions/index', function (hooks) {
+    setupTest(hooks);
+
+    test('it exists', function (assert) {
+        let route = this.owner.lookup('route:console/extensions/index');
+        assert.ok(route);
+    });
+});

docker-compose.yml

@@ -23,6 +23,34 @@ services:
       SOCKETCLUSTER_WORKERS: 10
       SOCKETCLUSTER_BROKERS: 10
 
+  verdaccio:
+    # image: verdaccio/verdaccio
+    build:
+      context: ./verdaccio
+      dockerfile: Dockerfile
+    user: root
+    environment:
+      - VERDACCIO_PORT=4873
+    ports:
+      - '4873:4873'
+    volumes:
+      - './verdaccio/storage:/verdaccio/storage'
+      - './verdaccio/config:/verdaccio/conf'
+      - './verdaccio/plugins:/verdaccio/plugins'
+
+  minio:
+    image: minio/minio
+    restart: always
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ACCESS_KEY: 'foobar'
+      MINIO_SECRET_KEY: '1234567e'
+    ports:
+      - 9000:9000
+      - 9001:9001
+    volumes:
+      - ./verdaccio/minio:/data
+
   console:
     ports:
       - "4200:4200"

verdaccio/Dockerfile

@@ -0,0 +1,5 @@
+FROM verdaccio/verdaccio
+USER root
+ADD plugins /verdaccio/plugins
+RUN cd /verdaccio/plugins && sh install.sh
+ADD config/config.yaml /verdaccio/conf/config.yaml

verdaccio/config/config.yaml

@@ -0,0 +1,229 @@
+#
+# This is the default configuration file. It allows all users to do anything,
+# please read carefully the documentation and best practices to
+# improve security.
+#
+# Look here for more config file examples:
+# https://github.com/verdaccio/verdaccio/tree/5.x/conf
+#
+# Read about the best practices
+# https://verdaccio.org/docs/best
+
+# path to a directory with all packages
+storage: ../storage
+# path to a directory with plugins to include
+plugins: ../plugins
+
+# https://verdaccio.org/docs/webui
+web:
+  title: Fleetbase Extensions
+  # comment out to disable gravatar support
+  # gravatar: false
+  # by default packages are ordercer ascendant (asc|desc)
+  # sort_packages: asc
+  # convert your UI to the dark side
+  # darkMode: true
+  # html_cache: true
+  # by default all features are displayed
+  # login: true
+  # showInfo: true
+  # showSettings: true
+  # In combination with darkMode you can force specific theme
+  # showThemeSwitch: true
+  # showFooter: true
+  # showSearch: true
+  # showRaw: true
+  # showDownloadTarball: true
+  #  HTML tags injected after manifest <scripts/>
+  # scriptsBodyAfter:
+  #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
+  #  HTML tags injected before ends </head>
+  #  metaScripts:
+  #    - '<script type="text/javascript" src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>'
+  #    - '<script type="text/javascript" src="https://browser.sentry-cdn.com/5.15.5/bundle.min.js"></script>'
+  #    - '<meta name="robots" content="noindex" />'
+  #  HTML tags injected first child at <body/>
+  #  bodyBefore:
+  #    - '<div id="myId">html before webpack scripts</div>'
+  #  Public path for template manifest scripts (only manifest)
+  #  publicPath: http://somedomain.org/
+
+# customized storage
+store:
+  '@fleetbase/verdaccio-fleetbase-s3-storage':
+    bucket: fleetbase-registry
+    keyPrefix: flb
+    region: ap-southeast-1
+    endpoint: http://minio:9000
+    accessKeyId: foobar
+    secretAccessKey: 1234567e
+    s3ForcePathStyle: true
+
+# https://verdaccio.org/docs/configuration#authentication
+auth:
+  htpasswd:
+    file: ./htpasswd
+    # Maximum amount of users allowed to register, defaults to "+inf".
+    # You can set this to -1 to disable registration.
+    # max_users: 1000
+    # Hash algorithm, possible options are: "bcrypt", "md5", "sha1", "crypt".
+    algorithm: bcrypt # by default is crypt, but is recommended use bcrypt for new installations
+    # Rounds number for "bcrypt", will be ignored for other algorithms.
+    # rounds: 10
+
+# https://verdaccio.org/docs/configuration#uplinks
+# a list of other known repositories we can talk to
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+
+# Learn how to protect your packages
+# https://verdaccio.org/docs/protect-your-dependencies/
+# https://verdaccio.org/docs/configuration#packages
+packages:
+  '@fleetbase/*':
+    access: $authenticated
+    publish: $authenticated
+    storage: local-storage
+
+  '@flb/*':
+    access: $authenticated
+    publish: $authenticated
+    storage: local-storage
+
+  '@flb-extension/*':
+    access: $authenticated
+    publish: $authenticated
+    storage: local-storage
+
+  '@*/*':
+    # scoped packages
+    access: $all
+    publish: $authenticated
+    unpublish: $authenticated
+    proxy: npmjs
+
+  '**':
+    # allow all users (including non-authenticated users) to read and
+    # publish all packages
+    #
+    # you can specify usernames/groupnames (depending on your auth plugin)
+    # and three keywords: "$all", "$anonymous", "$authenticated"
+    access: $all
+
+    # allow all known users to publish/publish packages
+    # (anyone can register by default, remember?)
+    publish: $authenticated
+    unpublish: $authenticated
+
+    # if package is not available locally, proxy requests to 'npmjs' registry
+    proxy: npmjs
+
+# To improve your security configuration and  avoid dependency confusion
+# consider removing the proxy property for private packages
+# https://verdaccio.org/docs/best#remove-proxy-to-increase-security-at-private-packages
+
+# https://verdaccio.org/docs/configuration#server
+# You can specify HTTP/1.1 server keep alive timeout in seconds for incoming connections.
+# A value of 0 makes the http server behave similarly to Node.js versions prior to 8.0.0, which did not have a keep-alive timeout.
+# WORKAROUND: Through given configuration you can workaround following issue https://github.com/verdaccio/verdaccio/issues/301. Set to 0 in case 60 is not enough.
+server:
+  keepAliveTimeout: 60
+  # Allow `req.ip` to resolve properly when Verdaccio is behind a proxy or load-balancer
+  # See: https://expressjs.com/en/guide/behind-proxies.html
+  # trustProxy: '127.0.0.1'
+
+# https://verdaccio.org/docs/configuration#offline-publish
+# publish:
+#   allow_offline: false
+
+# https://verdaccio.org/docs/configuration#url-prefix
+# url_prefix: /verdaccio/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+# url_prefix: '/my_prefix'
+# // url -> https://somedomain.org/my_prefix/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org';
+# url_prefix: '/'
+# // url -> https://somedomain.org/
+# VERDACCIO_PUBLIC_URL='https://somedomain.org/first_prefix';
+# url_prefix: '/second_prefix'
+# // url -> https://somedomain.org/second_prefix/'
+
+# https://verdaccio.org/docs/configuration#security
+# security:
+#   api:
+#     legacy: true
+#     jwt:
+#       sign:
+#         expiresIn: 29d
+#       verify:
+#         someProp: [value]
+#    web:
+#      sign:
+#        expiresIn: 1h # 1 hour by default
+#      verify:
+#         someProp: [value]
+
+# https://verdaccio.org/docs/configuration#user-rate-limit
+# userRateLimit:
+#   windowMs: 50000
+#   max: 1000
+
+# https://verdaccio.org/docs/configuration#max-body-size
+max_body_size: 300mb
+
+# https://verdaccio.org/docs/configuration#listen-port
+# listen:
+# - localhost:4873            # default value
+# - http://localhost:4873     # same thing
+# - 0.0.0.0:4873              # listen on all addresses (INADDR_ANY)
+# - https://example.org:4873  # if you want to use https
+# - "[::1]:4873"                # ipv6
+# - unix:/tmp/verdaccio.sock    # unix socket
+
+# The HTTPS configuration is useful if you do not consider use a HTTP Proxy
+# https://verdaccio.org/docs/configuration#https
+# https:
+#   key: ./path/verdaccio-key.pem
+#   cert: ./path/verdaccio-cert.pem
+#   ca: ./path/verdaccio-csr.pem
+
+# https://verdaccio.org/docs/configuration#proxy
+# http_proxy: http://something.local/
+# https_proxy: https://something.local/
+
+# https://verdaccio.org/docs/configuration#notifications
+# notify:
+#   method: POST
+#   headers: [{ "Content-Type": "application/json" }]
+#   endpoint: https://usagge.hipchat.com/v2/room/3729485/notification?auth_token=mySecretToken
+#   content: '{"color":"green","message":"New package published: * {{ name }}*","notify":true,"message_format":"text"}'
+
+middlewares:
+  audit:
+    enabled: true
+  '@fleetbase/verdaccio-fleetbase-extensions-middleware':
+    enabled: true
+  '@fleetbase/verdaccio-composer-middleware':
+    enabled: true
+
+# https://verdaccio.org/docs/logger
+# log settings
+log: { type: stdout, format: pretty, level: debug }
+#experiments:
+#  # support for npm token command
+#  token: false
+#  # disable writing body size to logs, read more on ticket 1912
+#  bytesin_off: false
+#  # enable tarball URL redirect for hosting tarball with a different server, the tarball_url_redirect can be a template string
+#  tarball_url_redirect: 'https://mycdn.com/verdaccio/${packageName}/${filename}'
+#  # the tarball_url_redirect can be a function, takes packageName and filename and returns the url, when working with a js configuration file
+#  tarball_url_redirect(packageName, filename) {
+#    const signedUrl = // generate a signed url
+#    return signedUrl;
+#  }
+
+# translate your registry, api i18n not available yet
+# i18n:
+# list of the available translations https://github.com/verdaccio/verdaccio/blob/master/packages/plugins/ui-theme/src/i18n/ABOUT_TRANSLATIONS.md
+#   web: en-US

verdaccio/plugins/install.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# Save the current working directory
+current_dir=$(pwd)
+
+# Navigate to the directory containing the plugins
+cd /verdaccio/plugins
+
+# Find all child directories and run npm install if package.json exists
+for dir in */; do
+    if [[ -f "${dir}package.json" ]]; then
+        echo "Running npm install in $dir"
+        cd "$dir"
+        npm install
+        npm run build
+        cd "$current_dir" # Go back to the original directory
+    else
+        echo "No package.json found in $dir, skipping..."
+    fi
+done
+
+echo "npm install completed for all verdaccio plugins."
+
+# Install verdaccio-* directories globally
+for dir in verdaccio-*; do
+    if [ -d "$dir" ]; then
+        echo "Installing $dir globally..."
+        npm install -g "./$dir"
+    fi
+done
+
+echo "Global installation of verdaccio plugins completed."

verdaccio/plugins/rebuild.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# Save the current working directory
+current_dir=$(pwd)
+
+# Navigate to the directory containing the plugins
+cd /verdaccio/plugins
+
+# Find all child directories and run npm install if package.json exists
+for dir in */; do
+    if [[ -f "${dir}package-lock.json" ]]; then
+        echo "Running npm build in $dir"
+        cd "$dir"
+        npm run build
+        cd "$current_dir"
+    else
+        echo "No package-lock.json found in $dir, skipping..."
+    fi
+done