unable to npm publish new package to artifact registry even though my logged in user as Owner access

Question

My organization is part of the Artifact Registry beta, and I'm proceeding through the quickstart fine, but when I attempt to publish my first package I'm getting:

npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://us-central1-npm.pkg.dev/[obsuring projectid]/npm-packages/security - Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/[obsuring projectid]/locations/us-central1/repositories/npm-packages" (or it may not exist)
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy.

my account has Owner access so not sure why I'm getting this error.

.npmrc file is in same directory as package.json for what I'm trying to publish:

registry=https://us-central1-npm.pkg.dev/[obscuring projectId]/npm-packages/
//us-central1-npm.pkg.dev/[obscuring projectId]/security/:_password="[obscuring password]"
//us-central1-npm.pkg.dev/[obscuring projectId]/security/:username=oauth2accesstoken
//us-central1-npm.pkg.dev/[obscuring projectId]/security/:email=[obscuring email]
//us-central1-npm.pkg.dev/[obscuring projectId]/security/:always-auth=true

before publishing I'm running this to update password in .npmrc file:

npm run artifactregistry-login ./.npmrc --registry https://registry.npmjs.org/

Answer 1

I had the very same issue (I work with Windows platform) and I fixed it by using Linux on Wsl2.

There's an issue with the Google Artifact Registry Auth package for Windows.

Everytime I executed:

npx google-artifactregistry-auth

I received this output:

npx: installed 47 in 4.24s
Retrieving application default credentials...
Success!

When I checked my .npmrc under my user folder, I discovered that no _authToken was produced for my private npm repo.

By repeating the same procedure under Linux Wsl2 (use this Install Node.js in Linux Wsl to install Node and NPM), the Google Artifact Registry Auth was correctly able to retrieve the _authToken and I was able to perform:

npm publish