@verdaccio/api 6.0.0-6-next.25 → 6.0.0-6-next.28

package/build/publish.js

@@ -3,42 +3,25 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.addVersion = addVersion;
 exports.default = publish;
-exports.publishPackage = publishPackage;
-exports.removeTarball = removeTarball;
-exports.unPublishPackage = unPublishPackage;
-exports.uploadPackageTarball = uploadPackageTarball;
+exports.publishPackageNext = publishPackageNext;
 
 var _debug = _interopRequireDefault(require("debug"));
 
-var _lodash = _interopRequireDefault(require("lodash"));
-
 var _mime = _interopRequireDefault(require("mime"));
 
-var _path = _interopRequireDefault(require("path"));
-
 var _core = require("@verdaccio/core");
 
-var _hooks = require("@verdaccio/hooks");
-
 var _logger = require("@verdaccio/logger");
 
 var _middleware = require("@verdaccio/middleware");
 
-var _utils = require("@verdaccio/utils");
-
-var _star = _interopRequireDefault(require("./star"));
-
-var _utils2 = require("./utils");
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
+// import star from './star';
+// import { isPublishablePackage, isRelatedToDeprecation } from './utils';
 const debug = (0, _debug.default)('verdaccio:api:publish');
-
-function publish(router, auth, storage, config) {
-  const can = (0, _middleware.allow)(auth);
-  /**
+/**
    * Publish a package / update package / un/start a package
    *
    * There are multiples scenarios here to be considered:
@@ -77,13 +60,27 @@ function publish(router, auth, storage, config) {
    *
    * Example flow of unpublish.
    *
-   * npm http fetch GET 200 http://localhost:4873/@scope%2ftest1?write=true 1680ms
-   * npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1/-rev/14-5d500cfce92f90fd
-   * 956606ms attempt #2
-   * npm http fetch GET 200 http://localhost:4873/@scope%2ftest1?write=true 1601ms
-   * npm http fetch DELETE 201 http://localhost:4873/@scope%2ftest1/-/test1-1.0.3.tgz/-rev/16
-   * -e11c8db282b2d992 19ms
+   * There are two possible flows:
+   *
+   * - Remove all packages (entirely)
+   *   eg: npm unpublish package-name@* --force
+   *   eg: npm unpublish package-name  --force
    *
+   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
+   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
+   *
+   * - Remove a specific version
+   *   eg: npm unpublish package-name@1.0.0 --force
+   *
+   * Get fresh manifest
+   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
+   * Update manifest without the version to be unpublished
+   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms
+   * Get fresh manifest (revision should be different)
+   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms
+   * Remove the tarball
+   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
+   * 
    * 3. Star a package
    *
    * Permissions: start a package depends of the publish and unpublish permissions, there is no
@@ -94,257 +91,56 @@ function publish(router, auth, storage, config) {
    * is the users property which is part of the payload and the body only includes
    *
    * {
-    "_id": pkgName,
-   	"_rev": "3-b0cdaefc9bdb77c8",
-    "users": {
-      [username]: boolean value (true, false)
-    }
-  }
+		  "_id": pkgName,
+	  	"_rev": "3-b0cdaefc9bdb77c8",
+		  "users": {
+		    [username]: boolean value (true, false)
+		  }
+	}
    *
    */
 
-  router.put('/:package/:_rev?/:revision?', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage, config, auth));
+function publish(router, auth, storage) {
+  const can = (0, _middleware.allow)(auth); // publish (update manifest) v6
+
+  router.put('/:package', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackageNext(storage)); // unpublish a pacakge v6
+
+  router.put('/:package/-rev/:revision', can('unpublish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackageNext(storage));
   /**
    * Un-publishing an entire package.
    *
    * This scenario happens when the first call detect there is only one version remaining
    * in the metadata, then the client decides to DELETE the resource
-   * npm http fetch GET 304 http://localhost:4873/@scope%2ftest1?write=true 1076ms (from cache)
-     npm http fetch DELETE 201 http://localhost:4873/@scope%2ftest1/-rev/18-d8ebe3020bd4ac9c 22ms
+   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)
+   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
    */
+  // v6
 
-  router.delete('/:package/-rev/*', can('unpublish'), unPublishPackage(storage)); // removing a tarball
-
-  router.delete('/:package/-/:filename/-rev/:revision', can('unpublish'), can('publish'), removeTarball(storage)); // uploading package tarball
-
-  router.put('/:package/-/:filename/*', can('publish'), (0, _middleware.media)(_core.HEADERS.OCTET_STREAM), uploadPackageTarball(storage)); // adding a version
-
-  router.put('/:package/:version/-tag/:tag', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, addVersion(storage));
-}
-/**
- * Publish a package
- */
-
-
-function publishPackage(storage, config, auth) {
-  const starApi = (0, _star.default)(storage);
-  return function (req, res, next) {
-    const packageName = req.params.package;
-    debug('publishing or updating a new version for %o', packageName);
-    /**
-     * Write tarball of stream data from package clients.
-     */
-
-    const createTarball = function (filename, data, cb) {
-      const stream = storage.addTarball(packageName, filename);
-      stream.on('error', function (err) {
-        debug('error on stream a tarball %o for %o with error %o', filename, packageName, err.message);
-        cb(err);
-      });
-      stream.on('success', function () {
-        debug('success on stream a tarball %o for %o', filename, packageName);
-        cb();
-      }); // this is dumb and memory-consuming, but what choices do we have?
-      // flow: we need first refactor this file before decides which type use here
-
-      stream.end(Buffer.from(data.data, 'base64'));
-      stream.done();
-    };
-    /**
-     * Add new package version in storage
-     */
-
-
-    const createVersion = function (version, metadata, cb) {
-      debug('add a new package version %o to storage %o', version, metadata);
-      storage.addVersion(packageName, version, metadata, null, cb);
-    };
-    /**
-     * Add new tags in storage
-     */
-
-
-    const addTags = function (tags, cb) {
-      debug('add new tag %o to storage', packageName);
-      storage.mergeTags(packageName, tags, cb);
-    };
-
-    const afterChange = function (error, okMessage, metadata) {
-      const metadataCopy = { ...metadata
-      };
-      debug('after change metadata %o', metadata);
-      const {
-        _attachments,
-        versions
-      } = metadataCopy; // `npm star` wouldn't have attachments
-      // and `npm deprecate` would have attachments as a empty object, i.e {}
-
-      if (_lodash.default.isNil(_attachments) || JSON.stringify(_attachments) === '{}') {
-        debug('no attachments detected');
-
-        if (error) {
-          debug('no_attachments: after change error with %o', error.message);
-          return next(error);
-        }
-
-        debug('no_attachments: after change success');
-        res.status(_core.HTTP_STATUS.CREATED);
-        return next({
-          ok: okMessage,
-          success: true
-        });
-      }
-      /**
-       * npm-registry-client 0.3+ embeds tarball into the json upload
-       * issue https://github.com/rlidwka/sinopia/issues/31, dealing with it here:
-       */
-
-
-      const isInvalidBodyFormat = (0, _utils.isObject)(_attachments) === false || (0, _utils.hasDiffOneKey)(_attachments) || (0, _utils.isObject)(versions) === false || (0, _utils.hasDiffOneKey)(versions);
-
-      if (isInvalidBodyFormat) {
-        // npm is doing something strange again
-        // if this happens in normal circumstances, report it as a bug
-        debug('invalid body format');
-
-        _logger.logger.info({
-          packageName
-        }, `wrong package format on publish a package @{packageName}`);
-
-        return next(_core.errorUtils.getBadRequest(_core.API_ERROR.UNSUPORTED_REGISTRY_CALL));
-      }
-
-      if (error && error.status !== _core.HTTP_STATUS.CONFLICT) {
-        debug('error on change or update a package with %o', error.message);
-        return next(error);
-      } // at this point document is either created or existed before
-
-
-      const [firstAttachmentKey] = Object.keys(_attachments);
-      createTarball(_path.default.basename(firstAttachmentKey), _attachments[firstAttachmentKey], function (error) {
-        debug('creating a tarball %o', firstAttachmentKey);
-
-        if (error) {
-          debug('error on create a tarball for %o with error %o', packageName, error.message);
-          return next(error);
-        }
-
-        const versionToPublish = Object.keys(versions)[0];
-        versions[versionToPublish].readme = _lodash.default.isNil(metadataCopy.readme) === false ? String(metadataCopy.readme) : '';
-        createVersion(versionToPublish, versions[versionToPublish], function (error) {
-          if (error) {
-            debug('error on create a version for %o with error %o', packageName, error.message);
-            return next(error);
-          }
-
-          addTags(metadataCopy[_core.DIST_TAGS], async function (error) {
-            if (error) {
-              debug('error on create a tag for %o with error %o', packageName, error.message);
-              return next(error);
-            }
-
-            try {
-              await (0, _hooks.notify)(metadataCopy, config, req.remote_user, `${metadataCopy.name}@${versionToPublish}`);
-            } catch (error) {
-              debug('error on notify add a new tag %o', `${metadataCopy.name}@${versionToPublish}`);
-
-              _logger.logger.error({
-                error
-              }, 'notify batch service has failed: @{error}');
-            }
-
-            debug('add a tag succesfully for %o', `${metadataCopy.name}@${versionToPublish}`);
-            res.status(_core.HTTP_STATUS.CREATED);
-            return next({
-              ok: okMessage,
-              success: true
-            });
-          });
-        });
-      });
-    };
-
-    if ((0, _utils2.isPublishablePackage)(req.body) === false && (0, _utils.isObject)(req.body.users)) {
-      debug('starting star a package');
-      return starApi(req, res, next);
-    }
-
-    try {
-      debug('pre validation metadata to publish %o', req.body);
-      const metadata = (0, _utils.validateMetadata)(req.body, packageName);
-      debug('post validation metadata to publish %o', metadata); // treating deprecation as updating a package
-
-      if (req.params._rev || (0, _utils2.isRelatedToDeprecation)(req.body)) {
-        debug('updating a new version for %o', packageName); // we check unpublish permissions, an update is basically remove versions
-
-        const remote = req.remote_user;
-        auth.allow_unpublish({
-          packageName
-        }, remote, error => {
-          debug('allowed to unpublish a package %o', packageName);
-
-          if (error) {
-            debug('not allowed to unpublish a version for  %o', packageName);
-            return next(error);
-          }
-
-          debug('update a package');
-          storage.changePackage(packageName, metadata, req.params.revision, function (error) {
-            afterChange(error, _core.API_MESSAGE.PKG_CHANGED, metadata);
-          });
-        });
-      } else {
-        debug('adding a new version for the package %o', packageName);
-        storage.addPackage(packageName, metadata, function (error) {
-          debug('package metadata updated %o', metadata);
-          afterChange(error, _core.API_MESSAGE.PKG_CREATED, metadata);
-        });
-      }
-    } catch (error) {
-      debug('error on publish, bad package format %o', packageName);
-
-      _logger.logger.error({
-        packageName
-      }, 'error on publish, bad package data for @{packageName}');
-
-      return next(_core.errorUtils.getBadData(_core.API_ERROR.BAD_PACKAGE_DATA));
-    }
-  };
-}
-/**
- * un-publish a package
- */
-
-
-function unPublishPackage(storage) {
-  return async function (req, res, next) {
+  router.delete('/:package/-rev/:revision', can('unpublish'), async function (req, res, next) {
     const packageName = req.params.package;
+    const rev = req.params.revision;
 
     _logger.logger.debug({
       packageName
     }, `unpublishing @{packageName}`);
 
     try {
-      await storage.removePackage(packageName);
+      await storage.removePackage(packageName, rev);
+      debug('package %s unpublished', packageName);
+      res.status(_core.HTTP_STATUS.CREATED);
+      return next({
+        ok: _core.API_MESSAGE.PKG_REMOVED
+      });
     } catch (err) {
-      if (err) {
-        return next(err);
-      }
+      return next(err);
     }
+  });
+  /*
+   Remove a tarball, this happens when npm unpublish a package unique version.
+   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
+  */
 
-    res.status(_core.HTTP_STATUS.CREATED);
-    return next({
-      ok: _core.API_MESSAGE.PKG_REMOVED
-    });
-  };
-}
-/**
- * Delete tarball
- */
-
-
-function removeTarball(storage) {
-  return function (req, res, next) {
+  router.delete('/:package/-/:filename/-rev/:revision', can('unpublish'), can('publish'), async function (req, res, next) {
     const packageName = req.params.package;
     const {
       filename,
@@ -357,11 +153,8 @@ function removeTarball(storage) {
       revision
     }, `removing a tarball for @{packageName}-@{tarballName}-@{revision}`);
 
-    storage.removeTarball(packageName, filename, revision, function (err) {
-      if (err) {
-        return next(err);
-      }
-
+    try {
+      await storage.removeTarball(packageName, filename, revision);
       res.status(_core.HTTP_STATUS.CREATED);
 
       _logger.logger.debug({
@@ -373,66 +166,49 @@ function removeTarball(storage) {
       return next({
         ok: _core.API_MESSAGE.TARBALL_REMOVED
       });
-    });
-  };
+    } catch (err) {
+      return next(err);
+    }
+  });
 }
-/**
- * Adds a new version
- */
-
 
-function addVersion(storage) {
-  return function (req, res, next) {
+function publishPackageNext(storage) {
+  return async function (req, _res, next) {
+    const ac = new AbortController();
+    const packageName = req.params.package;
     const {
-      version,
-      tag
+      revision
     } = req.params;
-    const packageName = req.params.package;
-    debug('add a new version %o and tag %o for %o', version, tag, packageName);
-    storage.addVersion(packageName, version, req.body, tag, function (error) {
-      if (error) {
-        debug('error on add new version');
-        return next(error);
-      }
+    const metadata = req.body;
 
-      debug('success on add new version');
-      res.status(_core.HTTP_STATUS.CREATED);
-      return next({
-        ok: _core.API_MESSAGE.PKG_PUBLISHED
+    try {
+      debug('publishing %s', packageName);
+      await storage.updateManifest(metadata, {
+        name: packageName,
+        revision,
+        signal: ac.signal,
+        requestOptions: {
+          host: req.hostname,
+          protocol: req.protocol,
+          // @ts-ignore
+          headers: req.headers
+        }
       });
-    });
-  };
-}
-/**
- * uploadPackageTarball
- */
-
 
-function uploadPackageTarball(storage) {
-  return function (req, res, next) {
-    const packageName = req.params.package;
-    const stream = storage.addTarball(packageName, req.params.filename);
-    req.pipe(stream); // checking if end event came before closing
+      _res.status(_core.HTTP_STATUS.CREATED);
 
-    let complete = false;
-    req.on('end', function () {
-      complete = true;
-      stream.done();
-    });
-    req.on('close', function () {
-      if (!complete) {
-        stream.abort();
-      }
-    });
-    stream.on('error', function (err) {
-      return res.locals.report_error(err);
-    });
-    stream.on('success', function () {
-      res.status(_core.HTTP_STATUS.CREATED);
       return next({
-        ok: _core.API_MESSAGE.TARBALL_UPLOADED
+        // TODO: this could be also Package Updated based on the
+        // action, deprecate, star, publish new version, or create a package
+        // the mssage some return from the method
+        ok: _core.API_MESSAGE.PKG_CREATED,
+        success: true
       });
-    });
+    } catch (err) {
+      // TODO: review if we need the abort controller here
+      ac.abort();
+      next(err);
+    }
   };
 }
 //# sourceMappingURL=publish.js.map

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/publish.ts"],"names":["debug","publish","router","auth","storage","config","can","put","mime","getType","expectJson","publishPackage","delete","unPublishPackage","removeTarball","HEADERS","OCTET_STREAM","uploadPackageTarball","addVersion","starApi","req","res","next","packageName","params","package","createTarball","filename","data","cb","stream","addTarball","on","err","message","end","Buffer","from","done","createVersion","version","metadata","addTags","tags","mergeTags","afterChange","error","okMessage","metadataCopy","_attachments","versions","_","isNil","JSON","stringify","status","HTTP_STATUS","CREATED","ok","success","isInvalidBodyFormat","logger","info","errorUtils","getBadRequest","API_ERROR","UNSUPORTED_REGISTRY_CALL","CONFLICT","firstAttachmentKey","Object","keys","Path","basename","versionToPublish","readme","String","DIST_TAGS","remote_user","name","body","users","_rev","remote","allow_unpublish","changePackage","revision","API_MESSAGE","PKG_CHANGED","addPackage","PKG_CREATED","getBadData","BAD_PACKAGE_DATA","removePackage","PKG_REMOVED","TARBALL_REMOVED","tag","PKG_PUBLISHED","pipe","complete","abort","locals","report_error","TARBALL_UPLOADED"],"mappings":";;;;;;;;;;;;AAAA;;AAEA;;AACA;;AACA;;AAGA;;AAQA;;AACA;;AACA;;AAGA;;AAGA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,uBAAX,CAAd;;AAEe,SAASC,OAAT,CACbC,MADa,EAEbC,IAFa,EAGbC,OAHa,EAIbC,MAJa,EAKP;AACN,QAAMC,GAAG,GAAG,uBAAMH,IAAN,CAAZ;AAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACED,EAAAA,MAAM,CAACK,GAAP,CACE,6BADF,EAEED,GAAG,CAAC,SAAD,CAFL,EAGE,uBAAME,cAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,cAAc,CAACP,OAAD,EAAUC,MAAV,EAAkBF,IAAlB,CALhB;AAQA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;;AACED,EAAAA,MAAM,CAACU,MAAP,CAAc,kBAAd,EAAkCN,GAAG,CAAC,WAAD,CAArC,EAAoDO,gBAAgB,CAACT,OAAD,CAApE,EAnFM,CAqFN;;AACAF,EAAAA,MAAM,CAACU,MAAP,CACE,sCADF,EAEEN,GAAG,CAAC,WAAD,CAFL,EAGEA,GAAG,CAAC,SAAD,CAHL,EAIEQ,aAAa,CAACV,OAAD,CAJf,EAtFM,CA6FN;;AACAF,EAAAA,MAAM,CAACK,GAAP,CACE,yBADF,EAEED,GAAG,CAAC,SAAD,CAFL,EAGE,uBAAMS,cAAQC,YAAd,CAHF,EAIEC,oBAAoB,CAACb,OAAD,CAJtB,EA9FM,CAqGN;;AACAF,EAAAA,MAAM,CAACK,GAAP,CACE,8BADF,EAEED,GAAG,CAAC,SAAD,CAFL,EAGE,uBAAME,cAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEQ,UAAU,CAACd,OAAD,CALZ;AAOD;AAED;AACA;AACA;;;AACO,SAASO,cAAT,CAAwBP,OAAxB,EAA0CC,MAA1C,EAA0DF,IAA1D,EAA4E;AACjF,QAAMgB,OAAO,GAAG,mBAAKf,OAAL,CAAhB;AACA,SAAO,UAAUgB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,UAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;AAEAzB,IAAAA,KAAK,CAAC,6CAAD,EAAgDuB,WAAhD,CAAL;AAEA;AACJ;AACA;;AACI,UAAMG,aAAa,GAAG,UAAUC,QAAV,EAA4BC,IAA5B,EAAkCC,EAAlC,EAAsD;AAC1E,YAAMC,MAAM,GAAG1B,OAAO,CAAC2B,UAAR,CAAmBR,WAAnB,EAAgCI,QAAhC,CAAf;AACAG,MAAAA,MAAM,CAACE,EAAP,CAAU,OAAV,EAAmB,UAAUC,GAAV,EAAe;AAChCjC,QAAAA,KAAK,CACH,mDADG,EAEH2B,QAFG,EAGHJ,WAHG,EAIHU,GAAG,CAACC,OAJD,CAAL;AAMAL,QAAAA,EAAE,CAACI,GAAD,CAAF;AACD,OARD;AASAH,MAAAA,MAAM,CAACE,EAAP,CAAU,SAAV,EAAqB,YAAY;AAC/BhC,QAAAA,KAAK,CAAC,uCAAD,EAA0C2B,QAA1C,EAAoDJ,WAApD,CAAL;AACAM,QAAAA,EAAE;AACH,OAHD,EAX0E,CAe1E;AACA;;AACAC,MAAAA,MAAM,CAACK,GAAP,CAAWC,MAAM,CAACC,IAAP,CAAYT,IAAI,CAACA,IAAjB,EAAuB,QAAvB,CAAX;AACAE,MAAAA,MAAM,CAACQ,IAAP;AACD,KAnBD;AAqBA;AACJ;AACA;;;AACI,UAAMC,aAAa,GAAG,UAAUC,OAAV,EAA2BC,QAA3B,EAA8CZ,EAA9C,EAAwE;AAC5F7B,MAAAA,KAAK,CAAC,4CAAD,EAA+CwC,OAA/C,EAAwDC,QAAxD,CAAL;AACArC,MAAAA,OAAO,CAACc,UAAR,CAAmBK,WAAnB,EAAgCiB,OAAhC,EAAyCC,QAAzC,EAAmD,IAAnD,EAAyDZ,EAAzD;AACD,KAHD;AAKA;AACJ;AACA;;;AACI,UAAMa,OAAO,GAAG,UAAUC,IAAV,EAA2Bd,EAA3B,EAAqD;AACnE7B,MAAAA,KAAK,CAAC,2BAAD,EAA8BuB,WAA9B,CAAL;AACAnB,MAAAA,OAAO,CAACwC,SAAR,CAAkBrB,WAAlB,EAA+BoB,IAA/B,EAAqCd,EAArC;AACD,KAHD;;AAKA,UAAMgB,WAAW,GAAG,UAAUC,KAAV,EAAiBC,SAAjB,EAA4BN,QAA5B,EAAqD;AACvE,YAAMO,YAAqB,GAAG,EAAE,GAAGP;AAAL,OAA9B;AACAzC,MAAAA,KAAK,CAAC,0BAAD,EAA6ByC,QAA7B,CAAL;AAEA,YAAM;AAAEQ,QAAAA,YAAF;AAAgBC,QAAAA;AAAhB,UAA6BF,YAAnC,CAJuE,CAMvE;AACA;;AACA,UAAIG,gBAAEC,KAAF,CAAQH,YAAR,KAAyBI,IAAI,CAACC,SAAL,CAAeL,YAAf,MAAiC,IAA9D,EAAoE;AAClEjD,QAAAA,KAAK,CAAC,yBAAD,CAAL;;AACA,YAAI8C,KAAJ,EAAW;AACT9C,UAAAA,KAAK,CAAC,4CAAD,EAA+C8C,KAAK,CAACZ,OAArD,CAAL;AACA,iBAAOZ,IAAI,CAACwB,KAAD,CAAX;AACD;;AAED9C,QAAAA,KAAK,CAAC,sCAAD,CAAL;AACAqB,QAAAA,GAAG,CAACkC,MAAJ,CAAWC,kBAAYC,OAAvB;AACA,eAAOnC,IAAI,CAAC;AACVoC,UAAAA,EAAE,EAAEX,SADM;AAEVY,UAAAA,OAAO,EAAE;AAFC,SAAD,CAAX;AAID;AAED;AACN;AACA;AACA;;;AAEM,YAAMC,mBAAmB,GACvB,qBAASX,YAAT,MAA2B,KAA3B,IACA,0BAAcA,YAAd,CADA,IAEA,qBAASC,QAAT,MAAuB,KAFvB,IAGA,0BAAcA,QAAd,CAJF;;AAMA,UAAIU,mBAAJ,EAAyB;AACvB;AACA;AACA5D,QAAAA,KAAK,CAAC,qBAAD,CAAL;;AACA6D,uBAAOC,IAAP,CAAY;AAAEvC,UAAAA;AAAF,SAAZ,EAA8B,0DAA9B;;AACA,eAAOD,IAAI,CAACyC,iBAAWC,aAAX,CAAyBC,gBAAUC,wBAAnC,CAAD,CAAX;AACD;;AAED,UAAIpB,KAAK,IAAIA,KAAK,CAACS,MAAN,KAAiBC,kBAAYW,QAA1C,EAAoD;AAClDnE,QAAAA,KAAK,CAAC,6CAAD,EAAgD8C,KAAK,CAACZ,OAAtD,CAAL;AACA,eAAOZ,IAAI,CAACwB,KAAD,CAAX;AACD,OA7CsE,CA+CvE;;;AACA,YAAM,CAACsB,kBAAD,IAAuBC,MAAM,CAACC,IAAP,CAAYrB,YAAZ,CAA7B;AAEAvB,MAAAA,aAAa,CACX6C,cAAKC,QAAL,CAAcJ,kBAAd,CADW,EAEXnB,YAAY,CAACmB,kBAAD,CAFD,EAGX,UAAUtB,KAAV,EAAiB;AACf9C,QAAAA,KAAK,CAAC,uBAAD,EAA0BoE,kBAA1B,CAAL;;AACA,YAAItB,KAAJ,EAAW;AACT9C,UAAAA,KAAK,CAAC,gDAAD,EAAmDuB,WAAnD,EAAgEuB,KAAK,CAACZ,OAAtE,CAAL;AACA,iBAAOZ,IAAI,CAACwB,KAAD,CAAX;AACD;;AAED,cAAM2B,gBAAgB,GAAGJ,MAAM,CAACC,IAAP,CAAYpB,QAAZ,EAAsB,CAAtB,CAAzB;AAEAA,QAAAA,QAAQ,CAACuB,gBAAD,CAAR,CAA2BC,MAA3B,GACEvB,gBAAEC,KAAF,CAAQJ,YAAY,CAAC0B,MAArB,MAAiC,KAAjC,GAAyCC,MAAM,CAAC3B,YAAY,CAAC0B,MAAd,CAA/C,GAAuE,EADzE;AAGAnC,QAAAA,aAAa,CAACkC,gBAAD,EAAmBvB,QAAQ,CAACuB,gBAAD,CAA3B,EAA+C,UAAU3B,KAAV,EAAiB;AAC3E,cAAIA,KAAJ,EAAW;AACT9C,YAAAA,KAAK,CAAC,gDAAD,EAAmDuB,WAAnD,EAAgEuB,KAAK,CAACZ,OAAtE,CAAL;AACA,mBAAOZ,IAAI,CAACwB,KAAD,CAAX;AACD;;AAEDJ,UAAAA,OAAO,CAACM,YAAY,CAAC4B,eAAD,CAAb,EAA0B,gBAAgB9B,KAAhB,EAAuB;AACtD,gBAAIA,KAAJ,EAAW;AACT9C,cAAAA,KAAK,CAAC,4CAAD,EAA+CuB,WAA/C,EAA4DuB,KAAK,CAACZ,OAAlE,CAAL;AACA,qBAAOZ,IAAI,CAACwB,KAAD,CAAX;AACD;;AAED,gBAAI;AACF,oBAAM,mBACJE,YADI,EAEJ3C,MAFI,EAGJe,GAAG,CAACyD,WAHA,EAIH,GAAE7B,YAAY,CAAC8B,IAAK,IAAGL,gBAAiB,EAJrC,CAAN;AAMD,aAPD,CAOE,OAAO3B,KAAP,EAAmB;AACnB9C,cAAAA,KAAK,CACH,kCADG,EAEF,GAAEgD,YAAY,CAAC8B,IAAK,IAAGL,gBAAiB,EAFtC,CAAL;;AAIAZ,6BAAOf,KAAP,CAAa;AAAEA,gBAAAA;AAAF,eAAb,EAAwB,2CAAxB;AACD;;AAED9C,YAAAA,KAAK,CAAC,8BAAD,EAAkC,GAAEgD,YAAY,CAAC8B,IAAK,IAAGL,gBAAiB,EAA1E,CAAL;AACApD,YAAAA,GAAG,CAACkC,MAAJ,CAAWC,kBAAYC,OAAvB;AACA,mBAAOnC,IAAI,CAAC;AAAEoC,cAAAA,EAAE,EAAEX,SAAN;AAAiBY,cAAAA,OAAO,EAAE;AAA1B,aAAD,CAAX;AACD,WAxBM,CAAP;AAyBD,SA/BY,CAAb;AAgCD,OA/CU,CAAb;AAiDD,KAnGD;;AAqGA,QAAI,kCAAqBvC,GAAG,CAAC2D,IAAzB,MAAmC,KAAnC,IAA4C,qBAAS3D,GAAG,CAAC2D,IAAJ,CAASC,KAAlB,CAAhD,EAA0E;AACxEhF,MAAAA,KAAK,CAAC,yBAAD,CAAL;AACA,aAAOmB,OAAO,CAACC,GAAD,EAAMC,GAAN,EAAWC,IAAX,CAAd;AACD;;AAED,QAAI;AACFtB,MAAAA,KAAK,CAAC,uCAAD,EAA0CoB,GAAG,CAAC2D,IAA9C,CAAL;AACA,YAAMtC,QAAQ,GAAG,6BAAiBrB,GAAG,CAAC2D,IAArB,EAA2BxD,WAA3B,CAAjB;AACAvB,MAAAA,KAAK,CAAC,wCAAD,EAA2CyC,QAA3C,CAAL,CAHE,CAIF;;AACA,UAAIrB,GAAG,CAACI,MAAJ,CAAWyD,IAAX,IAAmB,oCAAuB7D,GAAG,CAAC2D,IAA3B,CAAvB,EAAyD;AACvD/E,QAAAA,KAAK,CAAC,+BAAD,EAAkCuB,WAAlC,CAAL,CADuD,CAEvD;;AACA,cAAM2D,MAAM,GAAG9D,GAAG,CAACyD,WAAnB;AACA1E,QAAAA,IAAI,CAACgF,eAAL,CAAqB;AAAE5D,UAAAA;AAAF,SAArB,EAAsC2D,MAAtC,EAA+CpC,KAAD,IAAW;AACvD9C,UAAAA,KAAK,CAAC,mCAAD,EAAsCuB,WAAtC,CAAL;;AACA,cAAIuB,KAAJ,EAAW;AACT9C,YAAAA,KAAK,CAAC,4CAAD,EAA+CuB,WAA/C,CAAL;AACA,mBAAOD,IAAI,CAACwB,KAAD,CAAX;AACD;;AAED9C,UAAAA,KAAK,CAAC,kBAAD,CAAL;AACAI,UAAAA,OAAO,CAACgF,aAAR,CAAsB7D,WAAtB,EAAmCkB,QAAnC,EAA6CrB,GAAG,CAACI,MAAJ,CAAW6D,QAAxD,EAAkE,UAAUvC,KAAV,EAAiB;AACjFD,YAAAA,WAAW,CAACC,KAAD,EAAQwC,kBAAYC,WAApB,EAAiC9C,QAAjC,CAAX;AACD,WAFD;AAGD,SAXD;AAYD,OAhBD,MAgBO;AACLzC,QAAAA,KAAK,CAAC,yCAAD,EAA4CuB,WAA5C,CAAL;AACAnB,QAAAA,OAAO,CAACoF,UAAR,CAAmBjE,WAAnB,EAAgCkB,QAAhC,EAA0C,UAAUK,KAAV,EAAiB;AACzD9C,UAAAA,KAAK,CAAC,6BAAD,EAAgCyC,QAAhC,CAAL;AACAI,UAAAA,WAAW,CAACC,KAAD,EAAQwC,kBAAYG,WAApB,EAAiChD,QAAjC,CAAX;AACD,SAHD;AAID;AACF,KA5BD,CA4BE,OAAOK,KAAP,EAAmB;AACnB9C,MAAAA,KAAK,CAAC,yCAAD,EAA4CuB,WAA5C,CAAL;;AACAsC,qBAAOf,KAAP,CAAa;AAAEvB,QAAAA;AAAF,OAAb,EAA8B,uDAA9B;;AACA,aAAOD,IAAI,CAACyC,iBAAW2B,UAAX,CAAsBzB,gBAAU0B,gBAAhC,CAAD,CAAX;AACD;AACF,GAxLD;AAyLD;AAED;AACA;AACA;;;AACO,SAAS9E,gBAAT,CAA0BT,OAA1B,EAA4C;AACjD,SAAO,gBAAgBgB,GAAhB,EAAqCC,GAArC,EAA2DC,IAA3D,EAAmF;AACxF,UAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;;AAEAoC,mBAAO7D,KAAP,CAAa;AAAEuB,MAAAA;AAAF,KAAb,EAA+B,6BAA/B;;AACA,QAAI;AACF,YAAMnB,OAAO,CAACwF,aAAR,CAAsBrE,WAAtB,CAAN;AACD,KAFD,CAEE,OAAOU,GAAP,EAAY;AACZ,UAAIA,GAAJ,EAAS;AACP,eAAOX,IAAI,CAACW,GAAD,CAAX;AACD;AACF;;AACDZ,IAAAA,GAAG,CAACkC,MAAJ,CAAWC,kBAAYC,OAAvB;AACA,WAAOnC,IAAI,CAAC;AAAEoC,MAAAA,EAAE,EAAE4B,kBAAYO;AAAlB,KAAD,CAAX;AACD,GAbD;AAcD;AAED;AACA;AACA;;;AACO,SAAS/E,aAAT,CAAuBV,OAAvB,EAAyC;AAC9C,SAAO,UAAUgB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,UAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;AACA,UAAM;AAAEE,MAAAA,QAAF;AAAY0D,MAAAA;AAAZ,QAAyBjE,GAAG,CAACI,MAAnC;;AAEAqC,mBAAO7D,KAAP,CACE;AAAEuB,MAAAA,WAAF;AAAeI,MAAAA,QAAf;AAAyB0D,MAAAA;AAAzB,KADF,EAEG,kEAFH;;AAIAjF,IAAAA,OAAO,CAACU,aAAR,CAAsBS,WAAtB,EAAmCI,QAAnC,EAA6C0D,QAA7C,EAAuD,UAAUpD,GAAV,EAAe;AACpE,UAAIA,GAAJ,EAAS;AACP,eAAOX,IAAI,CAACW,GAAD,CAAX;AACD;;AACDZ,MAAAA,GAAG,CAACkC,MAAJ,CAAWC,kBAAYC,OAAvB;;AAEAI,qBAAO7D,KAAP,CACE;AAAEuB,QAAAA,WAAF;AAAeI,QAAAA,QAAf;AAAyB0D,QAAAA;AAAzB,OADF,EAEG,sEAFH;;AAIA,aAAO/D,IAAI,CAAC;AAAEoC,QAAAA,EAAE,EAAE4B,kBAAYQ;AAAlB,OAAD,CAAX;AACD,KAXD;AAYD,GApBD;AAqBD;AACD;AACA;AACA;;;AACO,SAAS5E,UAAT,CAAoBd,OAApB,EAAsC;AAC3C,SAAO,UAAUgB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,UAAM;AAAEkB,MAAAA,OAAF;AAAWuD,MAAAA;AAAX,QAAmB3E,GAAG,CAACI,MAA7B;AACA,UAAMD,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;AACAzB,IAAAA,KAAK,CAAC,wCAAD,EAA2CwC,OAA3C,EAAoDuD,GAApD,EAAyDxE,WAAzD,CAAL;AAEAnB,IAAAA,OAAO,CAACc,UAAR,CAAmBK,WAAnB,EAAgCiB,OAAhC,EAAyCpB,GAAG,CAAC2D,IAA7C,EAAmDgB,GAAnD,EAAwD,UAAUjD,KAAV,EAAiB;AACvE,UAAIA,KAAJ,EAAW;AACT9C,QAAAA,KAAK,CAAC,0BAAD,CAAL;AACA,eAAOsB,IAAI,CAACwB,KAAD,CAAX;AACD;;AAED9C,MAAAA,KAAK,CAAC,4BAAD,CAAL;AACAqB,MAAAA,GAAG,CAACkC,MAAJ,CAAWC,kBAAYC,OAAvB;AACA,aAAOnC,IAAI,CAAC;AACVoC,QAAAA,EAAE,EAAE4B,kBAAYU;AADN,OAAD,CAAX;AAGD,KAXD;AAYD,GAjBD;AAkBD;AAED;AACA;AACA;;;AACO,SAAS/E,oBAAT,CAA8Bb,OAA9B,EAAgD;AACrD,SAAO,UAAUgB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,UAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;AACA,UAAMK,MAAM,GAAG1B,OAAO,CAAC2B,UAAR,CAAmBR,WAAnB,EAAgCH,GAAG,CAACI,MAAJ,CAAWG,QAA3C,CAAf;AACAP,IAAAA,GAAG,CAAC6E,IAAJ,CAASnE,MAAT,EAHwF,CAKxF;;AACA,QAAIoE,QAAQ,GAAG,KAAf;AACA9E,IAAAA,GAAG,CAACY,EAAJ,CAAO,KAAP,EAAc,YAAY;AACxBkE,MAAAA,QAAQ,GAAG,IAAX;AACApE,MAAAA,MAAM,CAACQ,IAAP;AACD,KAHD;AAKAlB,IAAAA,GAAG,CAACY,EAAJ,CAAO,OAAP,EAAgB,YAAY;AAC1B,UAAI,CAACkE,QAAL,EAAe;AACbpE,QAAAA,MAAM,CAACqE,KAAP;AACD;AACF,KAJD;AAMArE,IAAAA,MAAM,CAACE,EAAP,CAAU,OAAV,EAAmB,UAAUC,GAAV,EAAe;AAChC,aAAOZ,GAAG,CAAC+E,MAAJ,CAAWC,YAAX,CAAwBpE,GAAxB,CAAP;AACD,KAFD;AAIAH,IAAAA,MAAM,CAACE,EAAP,CAAU,SAAV,EAAqB,YAAY;AAC/BX,MAAAA,GAAG,CAACkC,MAAJ,CAAWC,kBAAYC,OAAvB;AACA,aAAOnC,IAAI,CAAC;AACVoC,QAAAA,EAAE,EAAE4B,kBAAYgB;AADN,OAAD,CAAX;AAGD,KALD;AAMD,GA5BD;AA6BD","sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport _ from 'lodash';\nimport mime from 'mime';\nimport Path from 'path';\n\nimport { IAuth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  DIST_TAGS,\n  HEADERS,\n  HTTP_STATUS,\n  errorUtils,\n} from '@verdaccio/core';\nimport { notify } from '@verdaccio/hooks';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Callback, CallbackAction, Config, MergeTags, Package, Version } from '@verdaccio/types';\nimport { hasDiffOneKey, isObject, validateMetadata } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\nimport star from './star';\nimport { isPublishablePackage, isRelatedToDeprecation } from './utils';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\nexport default function publish(\n  router: Router,\n  auth: IAuth,\n  storage: Storage,\n  config: Config\n): void {\n  const can = allow(auth);\n\n  /**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * npm http fetch GET 200 http://localhost:4873/@scope%2ftest1?write=true 1680ms\n   * npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1/-rev/14-5d500cfce92f90fd\n   * 956606ms attempt #2\n   * npm http fetch GET 200 http://localhost:4873/@scope%2ftest1?write=true 1601ms\n   * npm http fetch DELETE 201 http://localhost:4873/@scope%2ftest1/-/test1-1.0.3.tgz/-rev/16\n   * -e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no enpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\n  router.put(\n    '/:package/:_rev?/:revision?',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage, config, auth)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/@scope%2ftest1?write=true 1076ms (from cache)\n     npm http fetch DELETE 201 http://localhost:4873/@scope%2ftest1/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete('/:package/-rev/*', can('unpublish'), unPublishPackage(storage));\n\n  // removing a tarball\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    removeTarball(storage)\n  );\n\n  // uploading package tarball\n  router.put(\n    '/:package/-/:filename/*',\n    can('publish'),\n    media(HEADERS.OCTET_STREAM),\n    uploadPackageTarball(storage)\n  );\n\n  // adding a version\n  router.put(\n    '/:package/:version/-tag/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    addVersion(storage)\n  );\n}\n\n/**\n * Publish a package\n */\nexport function publishPackage(storage: Storage, config: Config, auth: IAuth): any {\n  const starApi = star(storage);\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const packageName = req.params.package;\n\n    debug('publishing or updating a new version for %o', packageName);\n\n    /**\n     * Write tarball of stream data from package clients.\n     */\n    const createTarball = function (filename: string, data, cb: Callback): void {\n      const stream = storage.addTarball(packageName, filename);\n      stream.on('error', function (err) {\n        debug(\n          'error on stream a tarball %o for %o with error %o',\n          filename,\n          packageName,\n          err.message\n        );\n        cb(err);\n      });\n      stream.on('success', function () {\n        debug('success on stream a tarball %o for %o', filename, packageName);\n        cb();\n      });\n      // this is dumb and memory-consuming, but what choices do we have?\n      // flow: we need first refactor this file before decides which type use here\n      stream.end(Buffer.from(data.data, 'base64'));\n      stream.done();\n    };\n\n    /**\n     * Add new package version in storage\n     */\n    const createVersion = function (version: string, metadata: Version, cb: CallbackAction): void {\n      debug('add a new package version %o to storage %o', version, metadata);\n      storage.addVersion(packageName, version, metadata, null, cb);\n    };\n\n    /**\n     * Add new tags in storage\n     */\n    const addTags = function (tags: MergeTags, cb: CallbackAction): void {\n      debug('add new tag %o to storage', packageName);\n      storage.mergeTags(packageName, tags, cb);\n    };\n\n    const afterChange = function (error, okMessage, metadata: Package): void {\n      const metadataCopy: Package = { ...metadata };\n      debug('after change metadata %o', metadata);\n\n      const { _attachments, versions } = metadataCopy;\n\n      // `npm star` wouldn't have attachments\n      // and `npm deprecate` would have attachments as a empty object, i.e {}\n      if (_.isNil(_attachments) || JSON.stringify(_attachments) === '{}') {\n        debug('no attachments detected');\n        if (error) {\n          debug('no_attachments: after change error with %o', error.message);\n          return next(error);\n        }\n\n        debug('no_attachments: after change success');\n        res.status(HTTP_STATUS.CREATED);\n        return next({\n          ok: okMessage,\n          success: true,\n        });\n      }\n\n      /**\n       * npm-registry-client 0.3+ embeds tarball into the json upload\n       * issue https://github.com/rlidwka/sinopia/issues/31, dealing with it here:\n       */\n\n      const isInvalidBodyFormat =\n        isObject(_attachments) === false ||\n        hasDiffOneKey(_attachments) ||\n        isObject(versions) === false ||\n        hasDiffOneKey(versions);\n\n      if (isInvalidBodyFormat) {\n        // npm is doing something strange again\n        // if this happens in normal circumstances, report it as a bug\n        debug('invalid body format');\n        logger.info({ packageName }, `wrong package format on publish a package @{packageName}`);\n        return next(errorUtils.getBadRequest(API_ERROR.UNSUPORTED_REGISTRY_CALL));\n      }\n\n      if (error && error.status !== HTTP_STATUS.CONFLICT) {\n        debug('error on change or update a package with %o', error.message);\n        return next(error);\n      }\n\n      // at this point document is either created or existed before\n      const [firstAttachmentKey] = Object.keys(_attachments);\n\n      createTarball(\n        Path.basename(firstAttachmentKey),\n        _attachments[firstAttachmentKey],\n        function (error) {\n          debug('creating a tarball %o', firstAttachmentKey);\n          if (error) {\n            debug('error on create a tarball for %o with error %o', packageName, error.message);\n            return next(error);\n          }\n\n          const versionToPublish = Object.keys(versions)[0];\n\n          versions[versionToPublish].readme =\n            _.isNil(metadataCopy.readme) === false ? String(metadataCopy.readme) : '';\n\n          createVersion(versionToPublish, versions[versionToPublish], function (error) {\n            if (error) {\n              debug('error on create a version for %o with error %o', packageName, error.message);\n              return next(error);\n            }\n\n            addTags(metadataCopy[DIST_TAGS], async function (error) {\n              if (error) {\n                debug('error on create a tag for %o with error %o', packageName, error.message);\n                return next(error);\n              }\n\n              try {\n                await notify(\n                  metadataCopy,\n                  config,\n                  req.remote_user,\n                  `${metadataCopy.name}@${versionToPublish}`\n                );\n              } catch (error: any) {\n                debug(\n                  'error on notify add a new tag %o',\n                  `${metadataCopy.name}@${versionToPublish}`\n                );\n                logger.error({ error }, 'notify batch service has failed: @{error}');\n              }\n\n              debug('add a tag succesfully for %o', `${metadataCopy.name}@${versionToPublish}`);\n              res.status(HTTP_STATUS.CREATED);\n              return next({ ok: okMessage, success: true });\n            });\n          });\n        }\n      );\n    };\n\n    if (isPublishablePackage(req.body) === false && isObject(req.body.users)) {\n      debug('starting star a package');\n      return starApi(req, res, next);\n    }\n\n    try {\n      debug('pre validation metadata to publish %o', req.body);\n      const metadata = validateMetadata(req.body, packageName);\n      debug('post validation metadata to publish %o', metadata);\n      // treating deprecation as updating a package\n      if (req.params._rev || isRelatedToDeprecation(req.body)) {\n        debug('updating a new version for %o', packageName);\n        // we check unpublish permissions, an update is basically remove versions\n        const remote = req.remote_user;\n        auth.allow_unpublish({ packageName }, remote, (error) => {\n          debug('allowed to unpublish a package %o', packageName);\n          if (error) {\n            debug('not allowed to unpublish a version for  %o', packageName);\n            return next(error);\n          }\n\n          debug('update a package');\n          storage.changePackage(packageName, metadata, req.params.revision, function (error) {\n            afterChange(error, API_MESSAGE.PKG_CHANGED, metadata);\n          });\n        });\n      } else {\n        debug('adding a new version for the package %o', packageName);\n        storage.addPackage(packageName, metadata, function (error) {\n          debug('package metadata updated %o', metadata);\n          afterChange(error, API_MESSAGE.PKG_CREATED, metadata);\n        });\n      }\n    } catch (error: any) {\n      debug('error on publish, bad package format %o', packageName);\n      logger.error({ packageName }, 'error on publish, bad package data for @{packageName}');\n      return next(errorUtils.getBadData(API_ERROR.BAD_PACKAGE_DATA));\n    }\n  };\n}\n\n/**\n * un-publish a package\n */\nexport function unPublishPackage(storage: Storage) {\n  return async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n    const packageName = req.params.package;\n\n    logger.debug({ packageName }, `unpublishing @{packageName}`);\n    try {\n      await storage.removePackage(packageName);\n    } catch (err) {\n      if (err) {\n        return next(err);\n      }\n    }\n    res.status(HTTP_STATUS.CREATED);\n    return next({ ok: API_MESSAGE.PKG_REMOVED });\n  };\n}\n\n/**\n * Delete tarball\n */\nexport function removeTarball(storage: Storage) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const packageName = req.params.package;\n    const { filename, revision } = req.params;\n\n    logger.debug(\n      { packageName, filename, revision },\n      `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n    );\n    storage.removeTarball(packageName, filename, revision, function (err) {\n      if (err) {\n        return next(err);\n      }\n      res.status(HTTP_STATUS.CREATED);\n\n      logger.debug(\n        { packageName, filename, revision },\n        `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n    });\n  };\n}\n/**\n * Adds a new version\n */\nexport function addVersion(storage: Storage) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const { version, tag } = req.params;\n    const packageName = req.params.package;\n    debug('add a new version %o and tag %o for %o', version, tag, packageName);\n\n    storage.addVersion(packageName, version, req.body, tag, function (error) {\n      if (error) {\n        debug('error on add new version');\n        return next(error);\n      }\n\n      debug('success on add new version');\n      res.status(HTTP_STATUS.CREATED);\n      return next({\n        ok: API_MESSAGE.PKG_PUBLISHED,\n      });\n    });\n  };\n}\n\n/**\n * uploadPackageTarball\n */\nexport function uploadPackageTarball(storage: Storage) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const packageName = req.params.package;\n    const stream = storage.addTarball(packageName, req.params.filename);\n    req.pipe(stream);\n\n    // checking if end event came before closing\n    let complete = false;\n    req.on('end', function () {\n      complete = true;\n      stream.done();\n    });\n\n    req.on('close', function () {\n      if (!complete) {\n        stream.abort();\n      }\n    });\n\n    stream.on('error', function (err) {\n      return res.locals.report_error(err);\n    });\n\n    stream.on('success', function () {\n      res.status(HTTP_STATUS.CREATED);\n      return next({\n        ok: API_MESSAGE.TARBALL_UPLOADED,\n      });\n    });\n  };\n}\n"],"file":"publish.js"}
+{"version":3,"file":"publish.js","names":["debug","buildDebug","publish","router","auth","storage","can","allow","put","media","mime","getType","expectJson","publishPackageNext","delete","req","res","next","packageName","params","package","rev","revision","logger","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_res","ac","AbortController","metadata","body","updateManifest","name","signal","requestOptions","host","hostname","protocol","headers","PKG_CREATED","success","abort"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n// import { isPublishablePackage, isRelatedToDeprecation } from './utils';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no enpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n  // publish (update manifest) v6\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  // unpublish a pacakge v6\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  // v6\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackageNext(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    _res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n\n    try {\n      debug('publishing %s', packageName);\n      await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          // @ts-ignore\n          headers: req.headers,\n        },\n      });\n      _res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        // TODO: this could be also Package Updated based on the\n        // action, deprecate, star, publish new version, or create a package\n        // the mssage some return from the method\n        ok: API_MESSAGE.PKG_CREATED,\n        success: true,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      ac.abort();\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAAA;;AAEA;;AAGA;;AACA;;AACA;;;;AAKA;AACA;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACe,SAASC,OAAT,CAAiBC,MAAjB,EAAiCC,IAAjC,EAA8CC,OAA9C,EAAsE;EACnF,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ,CADmF,CAEnF;;EACAD,MAAM,CAACK,GAAP,CACE,WADF,EAEEF,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB,EAHmF,CAWnF;;EACAF,MAAM,CAACK,GAAP,CACE,0BADF,EAEEF,GAAG,CAAC,WAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB;EAQA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE;;EACAF,MAAM,CAACW,MAAP,CACE,0BADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGE,gBAAgBS,GAAhB,EAAqCC,GAArC,EAA2DC,IAA3D,EAAmF;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAJ,CAAWG,QAAvB;;IAEAC,cAAA,CAAOvB,KAAP,CAAa;MAAEkB;IAAF,CAAb,EAA+B,6BAA/B;;IACA,IAAI;MACF,MAAMb,OAAO,CAACmB,aAAR,CAAsBN,WAAtB,EAAmCG,GAAnC,CAAN;MACArB,KAAK,CAAC,wBAAD,EAA2BkB,WAA3B,CAAL;MACAF,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;MACA,OAAOV,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYC;MAAlB,CAAD,CAAX;IACD,CALD,CAKE,OAAOC,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CAhBH;EAmBA;AACF;AACA;AACA;;EACE5B,MAAM,CAACW,MAAP,CACE,sCADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGEA,GAAG,CAAC,SAAD,CAHL,EAIE,gBACES,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEY,QAAF;MAAYV;IAAZ,IAAyBP,GAAG,CAACI,MAAnC;;IAEAI,cAAA,CAAOvB,KAAP,CACE;MAAEkB,WAAF;MAAec,QAAf;MAAyBV;IAAzB,CADF,EAEG,kEAFH;;IAIA,IAAI;MACF,MAAMjB,OAAO,CAAC4B,aAAR,CAAsBf,WAAtB,EAAmCc,QAAnC,EAA6CV,QAA7C,CAAN;MACAN,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;;MAEAJ,cAAA,CAAOvB,KAAP,CACE;QAAEkB,WAAF;QAAec,QAAf;QAAyBV;MAAzB,CADF,EAEG,sEAFH;;MAIA,OAAOL,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYK;MAAlB,CAAD,CAAX;IACD,CATD,CASE,OAAOH,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CA5BH;AA8BD;;AAEM,SAASlB,kBAAT,CAA4BR,OAA5B,EAAmD;EACxD,OAAO,gBACLU,GADK,EAELoB,IAFK,EAGLlB,IAHK,EAIU;IACf,MAAMmB,EAAE,GAAG,IAAIC,eAAJ,EAAX;IACA,MAAMnB,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEE;IAAF,IAAeP,GAAG,CAACI,MAAzB;IACA,MAAMmB,QAAQ,GAAGvB,GAAG,CAACwB,IAArB;;IAEA,IAAI;MACFvC,KAAK,CAAC,eAAD,EAAkBkB,WAAlB,CAAL;MACA,MAAMb,OAAO,CAACmC,cAAR,CAAuBF,QAAvB,EAAiC;QACrCG,IAAI,EAAEvB,WAD+B;QAErCI,QAFqC;QAGrCoB,MAAM,EAAEN,EAAE,CAACM,MAH0B;QAIrCC,cAAc,EAAE;UACdC,IAAI,EAAE7B,GAAG,CAAC8B,QADI;UAEdC,QAAQ,EAAE/B,GAAG,CAAC+B,QAFA;UAGd;UACAC,OAAO,EAAEhC,GAAG,CAACgC;QAJC;MAJqB,CAAjC,CAAN;;MAWAZ,IAAI,CAACV,MAAL,CAAYC,iBAAA,CAAYC,OAAxB;;MAEA,OAAOV,IAAI,CAAC;QACV;QACA;QACA;QACAW,EAAE,EAAEC,iBAAA,CAAYmB,WAJN;QAKVC,OAAO,EAAE;MALC,CAAD,CAAX;IAOD,CAtBD,CAsBE,OAAOlB,GAAP,EAAiB;MACjB;MACAK,EAAE,CAACc,KAAH;MACAjC,IAAI,CAACc,GAAD,CAAJ;IACD;EACF,CArCD;AAsCD"}

package/build/search.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/search.ts"],"names":["route","get","_req","res","logger","warn","status","HTTP_STATUS","NOT_FOUND","json","error"],"mappings":";;;;;;;AAAA;;AACA;;AAEe,kBAAUA,KAAV,EAAuB;AACpC;AACAA,EAAAA,KAAK,CAACC,GAAN,CAAU,iBAAV,EAA6B,UAAUC,IAAV,EAAgBC,GAAhB,EAAqB;AAChDC,mBAAOC,IAAP,CAAY,wDAAZ;;AACAF,IAAAA,GAAG,CAACG,MAAJ,CAAWC,kBAAYC,SAAvB;AACAL,IAAAA,GAAG,CAACM,IAAJ,CAAS;AAAEC,MAAAA,KAAK,EAAE;AAAT,KAAT;AACD,GAJD;AAKD","sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\n\nexport default function (route): void {\n  // TODO: next major version, remove this\n  route.get('/-/all(/since)?', function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"file":"search.js"}
+{"version":3,"file":"search.js","names":["route","get","_req","res","logger","warn","status","HTTP_STATUS","NOT_FOUND","json","error"],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\n\nexport default function (route): void {\n  // TODO: next major version, remove this\n  route.get('/-/all(/since)?', function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;;;;;AAAA;;AACA;;AAEe,kBAAUA,KAAV,EAAuB;EACpC;EACAA,KAAK,CAACC,GAAN,CAAU,iBAAV,EAA6B,UAAUC,IAAV,EAAgBC,GAAhB,EAAqB;IAChDC,cAAA,CAAOC,IAAP,CAAY,wDAAZ;;IACAF,GAAG,CAACG,MAAJ,CAAWC,iBAAA,CAAYC,SAAvB;IACAL,GAAG,CAACM,IAAJ,CAAS;MAAEC,KAAK,EAAE;IAAT,CAAT;EACD,CAJD;AAKD"}