From 3f3861d41fa346a821588d7189cd1ff1a13c21f0 Mon Sep 17 00:00:00 2001
From: robobun <117481402+robobun@users.noreply.github.com>
Date: Sun, 23 Aug 2026 15:38:20 +0000
Subject: [PATCH] test: keep verdaccio users alive across createTestDir() calls

VerdaccioRegistry.createTestDir() deleted the htpasswd file and forgot the users the file had
generated. Verdaccio checks every authenticated request against that file, so a call from
one test logged out every other test that was running at the same time. The registry
already starts with a fresh htpasswd in start() and removes it in stop(), and no test file
creates the same user twice, so the per-call reset is not needed.
---
 test/harness.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/test/harness.ts b/test/harness.ts
index b3167919ec84..78ad62509d08 100644
--- a/test/harness.ts
+++ b/test/harness.ts
@@ -1895,6 +1895,7 @@ export class VerdaccioRegistry {
 
   async start(silent: boolean = true) {
     await rm(join(dirname(this.configPath), "htpasswd"), { force: true });
+    this.users = {};
     // Bind the IPv4 loopback explicitly: a bare port makes verdaccio listen on
     // whatever `localhost` resolves to, which is `::1` on hosts that list it first,
     // while the install client connects to 127.0.0.1 and every request is refused.
@@ -1993,12 +1994,10 @@ export class VerdaccioRegistry {
       files: {},
     },
   ) {
-    await rm(join(dirname(this.configPath), "htpasswd"), { force: true });
     await rm(join(this.packagesPath, "private-pkg-dont-touch"), { force: true });
     const packageDir = tempDir("verdaccio-test-", opts.files ?? {});
     const packageJson = join(packageDir, "package.json");
     await this.writeBunfig(packageDir, opts.bunfigOpts);
-    this.users = {};
     return { packageDir: String(packageDir), packageJson };
   }