Legacy auth tokens not working with auth plugin?

[GoaMind]

Good day,

I'm migrating my Verdaccio from 5.3.2 to 5.26.1

My config.yaml:

security:
  api:
    legacy: true
    jwt:
      sign:
        expiresIn: 365d
        notBefore: 0
  web:
    sign:
      expiresIn: 30d
      notBefore: 0

...

middlewares:
  github-oauth-ui:
    enabled: true

Question

How Verdaccio actually check if user is authorized if auth plugin is in use? And why legacy tokens are not working with auth plugin, but works without?

Debug

Case 1 (using JWT, Legacy, verdaccio-github-oauth-ui)

Auth using verdaccio-github-oauth-ui plugin:

> npx verdaccio-github-oauth-ui --registry http://localhost:4873/
[github-oauth-ui] Version: [email protected]
[github-oauth-ui] Running command: npm config list --json
[github-oauth-ui] Running command: npm config set //localhost:4873/:_authToken "===JWT TOKEN HERE==="
[github-oauth-ui] All done! We've updated your npm configuration.

npm whoami --registry=http://localhost:4873/
=== my Github loging returned ===

While old Legacy tokens, that were created with old version of Verdaccio not working.

Case 2 (Legacy, verdaccio-github-oauth-ui, NO JWT)

Auth using verdaccio-github-oauth-ui plugin:

> npx verdaccio-github-oauth-ui --registry http://localhost:4873/
[github-oauth-ui] Version: [email protected]
[github-oauth-ui] Running command: npm config list --json
[github-oauth-ui] Running command: npm config set //localhost:4873/:_authToken "===legacy-token-here==="
[github-oauth-ui] All done! We've updated your npm configuration.

> npm whoami --registry=http://localhost:4873/
npm ERR! code ENEEDAUTH
npm ERR! need auth This command requires you to be logged in.
npm ERR! need auth You need to authorize this machine using `npm adduser`

So despite that authentication where successful:

   name: 'My Github Username',
   groups: [ '$all', '@all', '$authenticated', '@authenticated' ],
   real_groups: []
 }
 

I still cannot auth

npm-registry-proxy: error--- authenticating for user "MY GITHUB USERNAME" failed. Error: bad username/password, access denied

Case 3 (Legacy, no auth plugin, no JWT)

auth:
  htpasswd:
    file: /storage/htpasswd
    algorithm: bcrypt
    max_users: 1
    rounds: 10

Creating new user:

> npm adduser --registry http://localhost:4873 
npm notice Log in on http://localhost:4873/
Username: test
Email: (this IS public) [email protected]
Logged in on http://localhost:4873/.

> npm whoami --registry=http://localhost:4873/
test

> rm ~/.npmrc

> npm login --registry=http://localhost:4873/  
npm notice Log in on http://localhost:4873/
Username: test
Password: Logged in on http://localhost:4873/.

> npm whoami --registry=http://localhost:4873/
test

> cat ~/.npmrc
//localhost:4873/:_authToken="==legacy token=="