{"record":{"id":"ab916940b500c68d","repo":"nodejs/node","slug":"at-least-one-permission-flag-is-required-allow","errorCode":null,"errorMessage":"At least one permission flag is required (--allow-publish, --allow-stage-publish)","messagePattern":"At least one permission flag is required \\(--allow-publish, --allow-stage-publish\\)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"deps/npm/lib/trust-cmd.js","lineNumber":215,"sourceCode":"\n  // generic\n  static bodyToOptions (body) {\n    return {\n      ...(body.id) && { id: body.id },\n      ...(body.type) && { type: body.type },\n    }\n  }\n\n  async createConfigCommand ({ positionalArgs, flags }) {\n    const { providerName, providerEntity, providerHostname } = this.constructor\n    const dryRun = this.config.get('dry-run')\n    const yes = this.config.get('yes') // deep-lore this allows for --no-yes\n\n    const allowPublish = flags['allow-publish']\n    const allowStagePublish = flags['allow-stage-publish']\n\n    if (!allowPublish && !allowStagePublish) {\n      throw new Error('At least one permission flag is required (--allow-publish, --allow-stage-publish)')\n    }\n\n    const permissions = []\n    if (allowPublish) {\n      permissions.push(PERMISSIONS.CREATE_PACKAGE)\n    }\n    if (allowStagePublish) {\n      permissions.push(PERMISSIONS.CREATE_STAGED_PACKAGE)\n    }\n\n    const options = await this.flagsToOptions({ positionalArgs, flags, providerHostname })\n    this.dialogue`Establishing trust between ${options.values.package} package and ${providerName}`\n    this.dialogue`Anyone with ${providerEntity} write access can publish to ${options.values.package}`\n    this.dialogue`Two-factor authentication is required for this operation`\n    if (!this.registryIsDefault) {\n      this.warn`Registry ${this.npm.config.get('registry')} may not support trusted publishing`\n    }\n    this.logOptions({ ...options, permissions })","sourceCodeStart":197,"sourceCodeEnd":233,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/trust-cmd.js#L197-L233","documentation":"Thrown by TrustCommand.createConfigCommand when neither `--allow-publish` nor `--allow-stage-publish` is set to true. A trust config must grant at least one publish permission to be meaningful; with both false the permissions array would be empty, so the command rejects the invocation before calling flagsToOptions.","triggerScenarios":"Running `npm trust gitlab --file .gitlab-ci.yml --project g/p` with no permission flag, or with `--no-allow-publish --no-allow-stage-publish`. The check reads flags['allow-publish'] and flags['allow-stage-publish'] which default to false.","commonSituations":"First-time users unfamiliar with the required flags; copy-paste from docs that omitted the permission flags; assuming the command would default to allow-publish.","solutions":["Add `--allow-publish` (to allow `npm publish`) and/or `--allow-stage-publish` (to allow staged publishing).","Check `npm trust gitlab --usage` / help output for the full flag set.","Run with `--dry-run --allow-publish` first to preview the body that would be sent."],"exampleFix":"// before\nnpm trust gitlab --file .gitlab-ci.yml --project g/p\n// after\nnpm trust gitlab --file .gitlab-ci.yml --project g/p --allow-publish","handlingStrategy":"validation","validationCode":"const allowPublish = flags['allow-publish']\nconst allowStagePublish = flags['allow-stage-publish']\nif (!allowPublish && !allowStagePublish) {\n  throw new Error('At least one of --allow-publish or --allow-stage-publish is required')\n}","typeGuard":"const hasPublishPermission = (flags) =>\n  Boolean(flags && (flags['allow-publish'] || flags['allow-stage-publish']))","tryCatchPattern":"try {\n  await createConfigCommand(...)\n} catch (err) {\n  if (/permission flag is required/i.test(err.message)) {\n    // prompt: 'Allow publish? (y/N)' then set the flag and retry\n  } else { throw err }\n}","preventionTips":["Decide upfront which publish permission the trust relationship should grant.","Include the permission flag in any scripted/templated trust command.","Use --dry-run with the flag first to preview the resulting body."],"tags":["validation","trust","cli-args","permissions"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}