Use Private NPM modules with RHMAP

In this Blog post entry I will try to cover, how to use Red Hat Mobile Application Platform with private npm modules from registry.npmjs.org.

NPM

Private npm modules

With npm private modules, you can use the npm registry to host your own private code and use the npm command line to manage it. This makes it easy to use public modules like Express and Browserify side-by-side with your own private code.

Prerequisites

• Upgraded account with private packages
• Npm v 2.7.0 or greater

Setup the package

First log in with your username:

npm login

All private packages are scoped if the package name begins with @. The scope is everything in between the @ and the slash.

@scope/project-name

Packages for an individual user should be specified as follows:

@username/project-name

To publish a package:

npm publish

Setup Client and Cloud Apps/MBaaS Services

First of all we need to change the package.json file and add the new private modules:

{
  …
  "dependencies" : {
    "@username/project-name" : "1.0"
  }
}

When the Client or Cloud apps are being deployed, the server needs a way to download the private modules. This can be solved using the .npmrc file. The .npmrc file will authenticate your server with npm.

Npm uses auth tokens to authenticate in the cli, to generate the token:

npm login <username> <password>

This will generate the token in the following file:

~/.npmrcs

With the following information:

//registry.npmjs.org/:_authToken=00000000-0000-0000-0000-000000000000

Copy the .npmrc file generated and paste it to your root project(Cloud App/MBaaS or Mobile) folder.

Add the .npmrc to the git repository:

git add .npmrc

git commit -am “added .npmrc file”

git push

Note: The token is not derived from your password, but changing the password will invalidate all tokens, the token will be valid until the password is changed. Tokens can also be invalidated by logging out of a machine or revoking them from the npm portal.

Note 2: The token generated has write/read permissions, if someone gets the token, they could do malicious things, to prevent this, we can also create a read only permissions token and update the.npmrc file:

npm token create --read-only

Additional Step for Cloud Apps/MBaaS Services

The Studio uses fh-npm to download the packages, this ignores the .npmrc file, if we want to force the studio to use npm, we need to use shrinkwrap:

npm shrinkwrap

npm shrinkwrap lets you lock down the ver­sion num­bers for all the pack­ages and their descen­dant pack­ages in your node_modules direc­tory. It will generate an npm-shrinkwrap.json file.

git add npm-shrinkwrap.json

git commit -am “Added npm-shrinkwrap.json”

git push

Note: The file created and updated by this command will then take precedence over any other existing or future package-lock.json files.

Deploy Cloud App / MBaaS Service

When the Cloud App is deployed, you will be able to see in the console logs how the private modules are resolved automatically and downloaded.

Thanks to Darach Cawley for providing the information required to write this post.