publish/whoami authorisation with Workspaces + Scoped packages + Custom Registry seems broken.

It's difficult to provide a reproduction for this issue, considering that it requires a custom NPM registry, but I have described as much as possible.

Describe the bug

I have a Yarn 2 Workspaces projects, under the scope 'obsidian' set up like the following

.
├── .yarn
│   └── **
├── packages
│   ├── a
│   │   ├── src
│   │   └── package.json
│   └── b
│       ├── src
│       └── package.json
├── package.json
└── .yarnrc.yaml

My .yarnrc.yaml looks like the following (with redactions)

enableGlobalCache: true

npmScopes:
  obsidian:
    npmPublishRegistry: "https://my.custom.publish.repo/"
    npmRegistryServer: "https://my.custom.repo/"

plugins:
  - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
    spec: "@yarnpkg/plugin-workspace-tools"

pnpMode: loose

yarnPath: .yarn/releases/yarn-2.3.3.cjs

I am at the point where I'm ready to publish, and started going through the yarn npm login flow, and cannot seem to successfully login to a custom registry with a scope and successfully publish.

To Reproduce

C:\Projects\__\tool>yarn npm login --publish --scope obsidian
➤ YN0000: Logging in to https://my.custom.repo/publish

√ Username: · me
√ Password: · ***********

➤ YN0000: Successfully logged in
➤ YN0000: Done in 4s 710ms

I now have the following in my user .yarnrc.yaml

npmScopes:
  obsidian:
    npmAuthToken: <AUTH_TOKEN>

All seems good at this point. Lets try and do a whoami to confirm the login

C:\Projects\__\tool>yarn npm whoami --scope obsidian --publish
➤ YN0033: No authentication configured for request
➤ YN0000: Failed with errors in 0s 3ms

From the subpackages?

C:\Projects\__\tool\packages\a>yarn npm whoami --scope obsidian --publish
➤ YN0033: No authentication configured for request
➤ YN0000: Failed with errors in 0s 4ms

Lets look at the yarn config that combines the project and the user settings

C:\Projects\Personal\CPITAutoDeploy\AutoDeploy\tool>yarn config --why
***
***
➤ YN0000: npmAlwaysAuth                 <default>                                                                                                 false
➤ YN0000: npmAuthIdent                  <default>                                                                                                 null
➤ YN0000: npmAuthToken                  <default>                                                                                                 null
➤ YN0000: npmPublishAccess              <default>                                                                                                 null
➤ YN0000: npmPublishRegistry            <default>                                                                                                 null
➤ YN0000: npmRegistries                 <default>                                                                                                 Map {}
➤ YN0000: npmRegistryServer             <default>                                                                                                 'https://registry.yarnpkg.com'
➤ YN0000: npmScopes                     undefined, /C:/Projects/__/tool/.yarnrc.yml, /C:/Users/me/.yarnrc.yml   Map { 'obsidian' => Map { 'npmAlwaysAuth' => false, 'npmAuthIdent' => null, 'npmAuthToken' => null, 'npmPublishRegistry' => 'https://my.custom.publish.repo/', 'npmRegistryServer' => 'https://my.custom.repo/' } }
***
***
➤ YN0000: Done in 0s 130ms

Looks like it's not picking up the scoped npmAuthToken from the user .yarnrc? Normally the auth token shows up as ********* in the list.

We are now in non-useful debug territory, but lets try dumping the npmAuthToken in the project .yarnrc for this scope

enableGlobalCache: true

npmScopes:
  obsidian:
    npmPublishRegistry: "https://my.custom.publish.repo/"
    npmRegistryServer: "https://my.custom.repo/"
    npmAuthToken: <AUTH_TOKEN>


plugins:
  - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
    spec: "@yarnpkg/plugin-workspace-tools"

pnpMode: loose

yarnPath: .yarn/releases/yarn-2.3.3.cjs

Try again?

C:\Projects\__\tool>yarn npm whoami --scope obsidian --publish
➤ YN0033: No authentication configured for request
➤ YN0000: Failed with errors in 0s 3ms

Config list?

➤ YN0000: npmScopes                     undefined, /C:/Projects/Personal/CPITAutoDeploy/AutoDeploy/tool/.yarnrc.yml, /C:/Users/euro/.yarnrc.yml   Map { 'obsidian' => Map { 'npmAlwaysAuth' => false, 'npmAuthIdent' => null, 'npmAuthToken' => '********', 'npmPublishRegistry' => 'https://my.custom.publish.repo/', 'npmRegistryServer' => 'https://my.custom.repo/' } }

So it's picking up the npmAuthToken now but not using it?

Finally what if we just add the auth token to the top level of the .yarnrc?

enableGlobalCache: true

npmAuthToken: <AUTH_TOKEN>

npmScopes:
  obsidian:
    npmPublishRegistry: "https://my.custom.publish.repo/"
    npmRegistryServer: "https://my.custom.repo/"


plugins:
  - path: .yarn/plugins/@yarnpkg/plugin-workspace-tools.cjs
    spec: "@yarnpkg/plugin-workspace-tools"

pnpMode: loose

yarnPath: .yarn/releases/yarn-2.3.3.cjs

Try again

C:\Projects\__\tool>yarn npm whoami --scope obsidian --publish
➤ YN0000: me
➤ YN0000: Done in 0s 292ms

Looks like thats the only way to get this to work?

I can confirm that trying to yarn npm publish produces the same results as using yarn npm whoami, can only get it to work with putting the npmAuthToken at the root of the project .yarnrc

Environment if relevant (please complete the following information):

• OS: Windows 10
• Node version: 12.18.3
• Yarn version: 2.3.3

Start by reproducing the Yarn 2.3.3 behavior with the shown .yarnrc.yaml, a scoped custom registry, and the yarn npm login, whoami, and publish commands. Compare scoped npmAuthToken handling with the root-level token; done means scoped authentication works for both whoami and publish without moving the token to the project root.