@powerhousedao/registry 6.2.2-dev.1 → 6.2.2-dev.11

package/dist/plugins/verdaccio-registry-auth.js

@@ -0,0 +1,241 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+let _verdaccio_core = require("@verdaccio/core");
+let bcryptjs = require("bcryptjs");
+bcryptjs = __toESM(bcryptjs);
+let pg = require("pg");
+let _renown_sdk = require("@renown/sdk");
+//#region src/auth/pg-store.ts
+/** Build a real Postgres pool from a connection string. */
+function createPgPool(databaseUrl) {
+	return new pg.Pool({ connectionString: databaseUrl });
+}
+/**
+* Postgres-backed AuthStore. Two small tables:
+*  - registry_users(username PK, password_hash, created_at)
+*  - registry_package_owners(package_name PK, owners text[], claimed_at)
+*
+* Ownership claim is race-free: `INSERT ... ON CONFLICT DO NOTHING` means the
+* first publisher wins atomically; the follow-up read returns the actual
+* owners so a losing racer is denied.
+*
+* Takes an already-built `pg.Pool` (tests inject a pg-mem pool cast to Pool).
+*/
+function createPgStore(pool) {
+	let initialized = null;
+	return {
+		init() {
+			initialized ??= (async () => {
+				await pool.query(`
+          CREATE TABLE IF NOT EXISTS registry_users (
+            username      text PRIMARY KEY,
+            password_hash text NOT NULL,
+            created_at    timestamptz NOT NULL DEFAULT now()
+          )`);
+				await pool.query(`
+          CREATE TABLE IF NOT EXISTS registry_package_owners (
+            package_name text PRIMARY KEY,
+            owners       text[] NOT NULL,
+            claimed_at   timestamptz NOT NULL DEFAULT now()
+          )`);
+			})();
+			return initialized;
+		},
+		async getUser(username) {
+			const row = (await pool.query("SELECT password_hash FROM registry_users WHERE username = $1", [username])).rows[0];
+			return row ? { passwordHash: row.password_hash } : null;
+		},
+		async createUser(username, passwordHash) {
+			try {
+				await pool.query("INSERT INTO registry_users (username, password_hash) VALUES ($1, $2)", [username, passwordHash]);
+				return true;
+			} catch (err) {
+				if (err.code === "23505") return false;
+				throw err;
+			}
+		},
+		async getOwners(pkg) {
+			return (await pool.query("SELECT owners FROM registry_package_owners WHERE package_name = $1", [pkg])).rows[0]?.owners ?? null;
+		},
+		async getOwnersFor(pkgs) {
+			if (pkgs.length === 0) return {};
+			const placeholders = pkgs.map((_, i) => `$${i + 1}`).join(",");
+			const res = await pool.query(`SELECT package_name, owners FROM registry_package_owners WHERE package_name IN (${placeholders})`, pkgs);
+			const out = {};
+			for (const row of res.rows) out[row.package_name] = row.owners;
+			return out;
+		},
+		async claimOwner(pkg, username) {
+			await pool.query(`INSERT INTO registry_package_owners (package_name, owners)
+         VALUES ($1, ARRAY[$2]::text[])
+         ON CONFLICT (package_name) DO NOTHING`, [pkg, username]);
+			return (await pool.query("SELECT owners FROM registry_package_owners WHERE package_name = $1", [pkg])).rows[0]?.owners ?? [];
+		},
+		close() {
+			return pool.end();
+		}
+	};
+}
+//#endregion
+//#region src/auth/store-handoff.ts
+const REGISTRY_KEY = Symbol.for("@powerhousedao/registry:auth-store-handoff");
+function registry() {
+	const g = globalThis;
+	return g[REGISTRY_KEY] ??= /* @__PURE__ */ new Map();
+}
+/** Resolve a stashed store by token (undefined if unknown). */
+function takeAuthStore(token) {
+	return registry().get(token)?.store;
+}
+/** Record that the plugin fully constructed with this token's store. */
+function markStoreLoaded(token) {
+	const entry = registry().get(token);
+	if (entry) entry.loaded = true;
+}
+//#endregion
+//#region src/auth/renown-verifier.ts
+function createRenownVerifier(config) {
+	const ttl = config.cacheTtlMs ?? 6e4;
+	const maxEntries = 1e3;
+	const cache = /* @__PURE__ */ new Map();
+	return async (token) => {
+		if (ttl > 0) {
+			const cached = cache.get(token);
+			if (cached) {
+				if (cached.expiresAt > Date.now()) return cached.did;
+				cache.delete(token);
+			}
+		}
+		const did = (await (0, _renown_sdk.verifyAuthCredential)(token, {
+			audience: config.publicUrl,
+			renownUrl: config.renownUrl
+		}))?.did;
+		if (ttl > 0 && did) {
+			cache.set(token, {
+				did,
+				expiresAt: Date.now() + ttl
+			});
+			if (cache.size > maxEntries) {
+				const oldest = cache.keys().next().value;
+				if (oldest !== void 0) cache.delete(oldest);
+			}
+		}
+		return did;
+	};
+}
+function renownApiJwtMiddleware(verify, helpers) {
+	return (req, res, next) => {
+		const anon = helpers.createAnonymousRemoteUser();
+		req.remote_user = anon;
+		res.locals.remote_user = anon;
+		const header = req.headers.authorization;
+		const token = header && /^Bearer /i.test(header) ? header.slice(7).trim() : void 0;
+		if (!token) {
+			next();
+			return;
+		}
+		req.pause();
+		verify(token).then((did) => {
+			if (did) {
+				const user = helpers.createRemoteUser(did, ["renown"]);
+				req.remote_user = user;
+				res.locals.remote_user = user;
+			}
+		}).catch(() => void 0).finally(() => {
+			req.resume();
+			next();
+		});
+	};
+}
+//#endregion
+//#region src/auth/registry-auth-plugin.ts
+const BCRYPT_ROUNDS = 10;
+function internal(err) {
+	const msg = err instanceof Error ? err.message : String(err);
+	return _verdaccio_core.errorUtils.getInternalError(msg);
+}
+/**
+* Pure plugin factory over an injected store — the unit-testable core.
+* `registryAuthPlugin` below wires it to a real Postgres store.
+*/
+function createRegistryAuthPlugin(store, renownVerifier) {
+	const ready = store.init();
+	return {
+		authenticate(user, password, cb) {
+			ready.then(() => store.getUser(user)).then((rec) => {
+				if (!rec) return cb(null, false);
+				if (!bcryptjs.default.compareSync(password, rec.passwordHash)) return cb(_verdaccio_core.errorUtils.getUnauthorized("bad username or password"));
+				return cb(null, [user]);
+			}).catch((err) => cb(internal(err)));
+		},
+		adduser(user, password, cb) {
+			ready.then(() => store.createUser(user, bcryptjs.default.hashSync(password, BCRYPT_ROUNDS))).then((created) => {
+				if (!created) return cb(_verdaccio_core.errorUtils.getConflict("username already registered"));
+				return cb(null, true);
+			}).catch((err) => cb(internal(err)));
+		},
+		allow_access(_user, _pkg, cb) {
+			cb(null, true);
+		},
+		allow_publish(user, pkg, cb) {
+			const name = pkg.name ?? "";
+			const username = user.name;
+			if (!username) return cb(_verdaccio_core.errorUtils.getForbidden("authentication required to publish"));
+			ready.then(() => store.claimOwner(name, username)).then((owners) => {
+				if (owners.includes(username)) return cb(null, true);
+				return cb(_verdaccio_core.errorUtils.getForbidden(`not authorized to publish "${name}" (owned by another user)`));
+			}).catch((err) => cb(internal(err)));
+		},
+		allow_unpublish(user, pkg, cb) {
+			const name = pkg.name ?? "";
+			const username = user.name;
+			if (!username) return cb(_verdaccio_core.errorUtils.getForbidden("authentication required to unpublish"));
+			ready.then(() => store.getOwners(name)).then((owners) => {
+				if (owners && owners.includes(username)) return cb(null, true);
+				return cb(_verdaccio_core.errorUtils.getForbidden(`not authorized to unpublish "${name}"`));
+			}).catch((err) => cb(internal(err)));
+		},
+		...renownVerifier ? { apiJWTmiddleware(helpers) {
+			return renownApiJwtMiddleware(renownVerifier, helpers);
+		} } : {}
+	};
+}
+/** Verdaccio plugin entry. The loader calls this factory (or `new`s the
+*  default export — both return the plugin object). */
+function registryAuthPlugin(config) {
+	const plugin = createRegistryAuthPlugin((config.storeToken ? takeAuthStore(config.storeToken) : void 0) ?? createPgStore(createPgPool(config.databaseUrl ?? (() => {
+		throw new Error("registry-auth plugin requires a databaseUrl (or a store token)");
+	})())), config.publicUrl ? createRenownVerifier({
+		publicUrl: config.publicUrl,
+		renownUrl: config.renownUrl
+	}) : void 0);
+	if (config.storeToken) markStoreLoaded(config.storeToken);
+	return plugin;
+}
+//#endregion
+exports.createRegistryAuthPlugin = createRegistryAuthPlugin;
+exports.default = registryAuthPlugin;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@powerhousedao/registry",
-  "version": "6.2.2-dev.1",
+  "version": "6.2.2-dev.11",
   "description": "Powerhouse package registry — resolves and manages document model package dependencies within the Powerhouse ecosystem.",
   "type": "module",
   "repository": {
@@ -29,21 +29,27 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
+    "@verdaccio/core": "8.0.0-next-8.37",
     "@verdaccio/signature": "8.0.0-next-8.29",
+    "bcryptjs": "^2.4.3",
     "cmd-ts": "0.15.0",
     "express": "^4.22.1",
     "find-up": "^8.0.0",
+    "pg": "8.18.0",
     "tar": "^7.5.11",
     "verdaccio": "^6.5.0",
     "verdaccio-aws-s3-storage": "^10.4.0",
-    "@powerhousedao/shared": "6.2.2-dev.1",
-    "@renown/sdk": "6.2.2-dev.1"
+    "@powerhousedao/shared": "6.2.2-dev.11",
+    "@renown/sdk": "6.2.2-dev.11"
   },
   "devDependencies": {
     "tsdown": "0.21.1",
+    "@types/bcryptjs": "^2.4.6",
     "@types/express": "^4.17.21",
     "@types/node": "25.2.3",
+    "@types/pg": "8.16.0",
     "@types/supertest": "^6.0.2",
+    "pg-mem": "^3.0.14",
     "supertest": "^7.1.0",
     "vitest": "4.1.1"
   },