@verdaccio/api 6.0.0-6-next.25 → 6.0.0-6-next.28

package/src/user.ts

@@ -8,7 +8,7 @@ import { createRemoteUser } from '@verdaccio/config';
 import { API_ERROR, API_MESSAGE, HTTP_STATUS, errorUtils } from '@verdaccio/core';
 import { logger } from '@verdaccio/logger';
 import { Config, RemoteUser } from '@verdaccio/types';
-import { getAuthenticatedMessage, validatePassword } from '@verdaccio/utils';
+import { getAuthenticatedMessage, mask, validatePassword } from '@verdaccio/utils';
 
 import { $NextFunctionVer, $RequestExtend } from '../types/custom';
 
@@ -28,6 +28,23 @@ export default function (route: Router, auth: IAuth, config: Config): void {
     }
   );
 
+  /**
+ *  
+ *  body example
+ *  req.body = {
+      _id: "org.couchdb.user:jjjj",
+      name: "jjjj",
+      password: "jjjj",
+      type: "user",
+      roles: [],
+      date: "2022-07-08T15:51:04.002Z",
+    }
+ * 
+ * @export
+ * @param {Router} route
+ * @param {IAuth} auth
+ * @param {Config} config
+ */
   route.put(
     '/-/user/:org_couchdb_user/:_rev?/:revision?',
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
@@ -92,7 +109,7 @@ export default function (route: Router, auth: IAuth, config: Config): void {
 
           const token =
             name && password ? await getApiToken(auth, config, user, password) : undefined;
-          debug('adduser: new token %o', token);
+          debug('adduser: new token %o', mask(token as string, 4));
           if (!token) {
             return next(errorUtils.getUnauthorized());
           }

package/src/v1/search.ts

@@ -5,7 +5,7 @@ import { IAuth } from '@verdaccio/auth';
 import { HTTP_STATUS, searchUtils } from '@verdaccio/core';
 import { logger } from '@verdaccio/logger';
 import { Storage } from '@verdaccio/store';
-import { Package } from '@verdaccio/types';
+import { Manifest } from '@verdaccio/types';
 
 const debug = buildDebug('verdaccio:api:search');
 
@@ -16,7 +16,7 @@ const debug = buildDebug('verdaccio:api:search');
  * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'
  */
 export default function (route, auth: IAuth, storage: Storage): void {
-  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Package | null> {
+  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {
     return new Promise((resolve, reject) => {
       auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {
         if (err) {
@@ -49,7 +49,7 @@ export default function (route, auth: IAuth, storage: Storage): void {
     from = parseInt(from, 10) || 0;
 
     try {
-      data = await storage.searchManager?.search({
+      data = await storage.search({
         query,
         url,
         abort,

package/src/whoami.ts

@@ -1,36 +1,20 @@
 import buildDebug from 'debug';
 import { Response, Router } from 'express';
 
+import { errorUtils } from '@verdaccio/core';
+
 import { $NextFunctionVer, $RequestExtend } from '../types/custom';
 
 const debug = buildDebug('verdaccio:api:user');
 
 export default function (route: Router): void {
-  route.get('/whoami', (req: $RequestExtend, res: Response, next: $NextFunctionVer): void => {
-    debug('whoami: reditect');
-    if (req.headers.referer === 'whoami') {
-      const username = req.remote_user.name;
-      // FIXME: this service should return 401 if user missing
-      // if (!username) {
-      //   debug('whoami: user not found');
-      //   return next(getUnauthorized('Unauthorized'));
-      // }
-      debug('whoami: logged by user');
-      return next({ username: username });
-    } else {
-      debug('whoami: redirect next route');
-      // redirect to the route below
-      return next('route');
+  route.get('/-/whoami', (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {
+    // remote_user is set by the auth middleware
+    const username = req?.remote_user?.name;
+    if (!username) {
+      debug('whoami: user not found');
+      return next(errorUtils.getUnauthorized('Unauthorized'));
     }
-  });
-
-  route.get('/-/whoami', (req: $RequestExtend, res: Response, next: $NextFunctionVer): any => {
-    const username = req.remote_user.name;
-    // FIXME: this service should return 401 if user missing
-    // if (!username) {
-    //   debug('whoami: user not found');
-    //   return next(getUnauthorized('Unauthorized'));
-    // }
 
     debug('whoami: response %o', username);
     return next({ username: username });

package/test/integration/_helper.ts

@@ -1,83 +1,126 @@
-import bodyParser from 'body-parser';
-import express, { Application } from 'express';
+import { Application } from 'express';
+import _ from 'lodash';
 import path from 'path';
 import supertest from 'supertest';
 
-import { Auth, IAuth } from '@verdaccio/auth';
-import { Config, parseConfigFile } from '@verdaccio/config';
-import { HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';
-import { errorReportingMiddleware, final, handleError } from '@verdaccio/middleware';
+import { parseConfigFile } from '@verdaccio/config';
+import { HEADERS, HEADER_TYPE, HTTP_STATUS, TOKEN_BEARER } from '@verdaccio/core';
+import { setup } from '@verdaccio/logger';
 import { Storage } from '@verdaccio/store';
-import { generatePackageMetadata } from '@verdaccio/test-helper';
+import {
+  generatePackageMetadata,
+  initializeServer as initializeServerHelper,
+} from '@verdaccio/test-helper';
+import { GenericBody } from '@verdaccio/types';
+import { buildToken, generateRandomHexString } from '@verdaccio/utils';
 
-import apiEndpoints from '../../src';
+import apiMiddleware from '../../src';
 
-const getConf = (conf) => {
-  const configPath = path.join(__dirname, 'config', conf);
+setup();
 
-  return parseConfigFile(configPath);
+export const getConf = (conf) => {
+  const configPath = path.join(__dirname, 'config', conf);
+  const config = parseConfigFile(configPath);
+  // custom config to avoid conflict with other tests
+  config.auth.htpasswd.file = `${config.auth.htpasswd.file}-${generateRandomHexString()}`;
+  return config;
 };
 
-// TODO: replace by @verdaccio/test-helper
 export async function initializeServer(configName): Promise<Application> {
-  const app = express();
-  const config = new Config(getConf(configName));
-  const storage = new Storage(config);
-  await storage.init(config, []);
-  const auth: IAuth = new Auth(config);
-  // TODO: this might not be need it, used in apiEndpoints
-  app.use(bodyParser.json({ strict: false, limit: '10mb' }));
-  // @ts-ignore
-  app.use(errorReportingMiddleware);
-  // @ts-ignore
-  app.use(apiEndpoints(config, auth, storage));
-  // @ts-ignore
-  app.use(handleError);
-  // @ts-ignore
-  app.use(final);
-
-  app.use(function (request, response) {
-    response.status(590);
-    console.log('respo', response);
-    response.json({ error: 'cannot handle this' });
-  });
-
-  return app;
+  return initializeServerHelper(getConf(configName), [apiMiddleware], Storage);
+}
+
+export function createUser(app, name: string, password: string): supertest.Test {
+  return supertest(app)
+    .put(`/-/user/org.couchdb.user:${name}`)
+    .send({
+      name: name,
+      password: password,
+    })
+    .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+    .expect(HTTP_STATUS.CREATED);
+}
+
+export async function getNewToken(app: any, credentials: any): Promise<string> {
+  const response = await createUser(app, credentials.name, credentials.password);
+  const { token, ok } = response.body;
+  expect(ok).toBeDefined();
+  expect(token).toBeDefined();
+  expect(typeof token).toBe('string');
+  return token;
+}
+
+export async function generateTokenCLI(app, token, payload): Promise<any> {
+  return supertest(app)
+    .post('/-/npm/v1/tokens')
+    .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+    .send(JSON.stringify(payload))
+    .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+    .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET);
+}
+
+export async function deleteTokenCLI(app, token, tokenToDelete): Promise<any> {
+  return supertest(app)
+    .delete(`/-/npm/v1/tokens/token/${tokenToDelete}`)
+    .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+    .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+    .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+    .expect(HTTP_STATUS.OK);
 }
 
-export function publishVersion(app, _configFile, pkgName, version): supertest.Test {
-  const pkgMetadata = generatePackageMetadata(pkgName, version);
+export function publishVersionWithToken(
+  app,
+  pkgName: string,
+  version: string,
+  token: string,
+  distTags?: GenericBody
+): supertest.Test {
+  const pkgMetadata = generatePackageMetadata(pkgName, version, distTags);
 
   return supertest(app)
     .put(`/${encodeURIComponent(pkgName)}`)
     .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+    .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
     .send(JSON.stringify(pkgMetadata))
     .set('accept', HEADERS.GZIP)
-    .set(HEADER_TYPE.ACCEPT_ENCODING, HEADERS.JSON)
-    .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);
+    .set(HEADER_TYPE.ACCEPT_ENCODING, HEADERS.JSON);
 }
 
-export async function publishTaggedVersion(
+export function publishVersion(
   app,
-  configFile,
   pkgName: string,
   version: string,
-  tag: string
-) {
-  const pkgMetadata = generatePackageMetadata(pkgName, version, {
-    [tag]: version,
-  });
+  distTags?: GenericBody
+): supertest.Test {
+  const pkgMetadata = generatePackageMetadata(pkgName, version, distTags);
 
   return supertest(app)
-    .put(
-      `/${encodeURIComponent(pkgName)}/${encodeURIComponent(version)}/-tag/${encodeURIComponent(
-        tag
-      )}`
-    )
+    .put(`/${encodeURIComponent(pkgName)}`)
     .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
     .send(JSON.stringify(pkgMetadata))
-    .expect(HTTP_STATUS.CREATED)
     .set('accept', HEADERS.GZIP)
-    .set(HEADER_TYPE.ACCEPT_ENCODING, HEADERS.JSON)
-    .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);
+    .set(HEADER_TYPE.ACCEPT_ENCODING, HEADERS.JSON);
+}
+
+export function getDisTags(app, pkgName) {
+  return supertest(app)
+    .get(`/-/package/${encodeURIComponent(pkgName)}/dist-tags`)
+    .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+    .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+    .expect(HTTP_STATUS.OK);
+}
+
+export function getPackage(
+  app: any,
+  token: string,
+  pkgName: string,
+  statusCode: number = HTTP_STATUS.OK
+): supertest.Test {
+  const test = supertest(app).get(`/${pkgName}`);
+
+  if (_.isNil(token) === false || _.isEmpty(token) === false) {
+    test.set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token));
+  }
+
+  return test.expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET).expect(statusCode);
 }

package/test/integration/config/distTag.yaml

@@ -0,0 +1,25 @@
+storage: ./storage
+
+auth:
+  htpasswd:
+    file: ./htpasswd-distTag
+
+web:
+  enable: true
+  title: verdaccio
+
+publish:
+  allow_offline: false
+
+uplinks:
+
+log: { type: stdout, format: pretty, level: trace }
+
+packages:
+  '@*/*':
+    access: $anonymous
+    publish: $anonymous
+  '**':
+    access: $anonymous
+    publish: $anonymous
+_debug: true

package/test/integration/config/package.yaml

@@ -1,13 +1,8 @@
-store:
-  memory:
-    limit: 1000
+storage: ./storage
 
 auth:
-  auth-memory:
-    users:
-      test:
-        name: test
-        password: test
+  htpasswd:
+    file: ./htpasswd-package
 
 web:
   enable: true

package/test/integration/config/ping.yaml

@@ -1,10 +1,6 @@
-store:
-  memory:
-    limit: 10
-
 auth:
-  auth-memory:
-    users:
+  htpasswd:
+    file: ./htpasswd-ping
 web:
   enable: true
   title: verdaccio

package/test/integration/config/publish.yaml

@@ -1,14 +1,6 @@
-store:
-  memory:
-    limit: 1000
-
 auth:
-  auth-memory:
-    users:
-      test:
-        name: test
-        password: test
-
+  htpasswd:
+    file: ./htpasswd-publish
 web:
   enable: true
   title: verdaccio
@@ -24,7 +16,9 @@ packages:
   '@*/*':
     access: $anonymous
     publish: $anonymous
+    unpublish: $anonymous
   '**':
     access: $anonymous
     publish: $anonymous
+    unpublish: $anonymous
 _debug: true

package/test/integration/config/search.yaml

@@ -0,0 +1,29 @@
+storage: ./storage
+
+auth:
+  htpasswd:
+    file: ./htpasswd-search
+
+web:
+  enable: true
+  title: verdaccio
+
+uplinks:
+
+log: { type: stdout, format: pretty, level: trace }
+
+packages:
+  'private-*':
+    access: $all
+    publish: jota
+  '@private/*':
+    access: $all
+    publish: jota
+  '@*/*':
+    access: $all
+    publish: $authenticated
+  '**':
+    access: $all
+    publish: $authenticated
+
+_debug: true

package/test/integration/config/token.jwt.yaml

@@ -0,0 +1,27 @@
+security:
+  api:
+    jwt:
+      sign:
+        expiresIn: 5m
+        # to avoid invalid verification token, more info on JWT page
+        notBefore: 0
+
+storage: ./storage
+
+auth:
+  htpasswd:
+    file: ./htpasswd
+
+packages:
+  '@token/*':
+    access: $authenticated
+    publish: $authenticated
+  'only-you-can-publish':
+    access: $authenticated
+    publish: $authenticated
+
+log: { type: stdout, format: pretty, level: debug }
+
+## enable token for testing
+flags:
+  token: true

package/test/integration/config/token.yaml

@@ -0,0 +1,19 @@
+storage: ./storage
+
+auth:
+  htpasswd:
+    file: ./htpasswd
+
+packages:
+  '@token/*':
+    access: $authenticated
+    publish: $authenticated
+  'only-you-can-publish':
+    access: $authenticated
+    publish: $authenticated
+
+log: { type: stdout, format: pretty, level: debug }
+
+## enable token for testing
+flags:
+  token: true

package/test/integration/config/user.jwt.yaml

@@ -0,0 +1,37 @@
+storage: ./storage
+plugins: ./plugins
+
+web:
+  title: Verdaccio
+
+auth:
+  htpasswd:
+    file: ./htpasswd
+
+uplinks:
+  ver:
+    url: https://registry.verdaccio.org
+
+security:
+  api:
+    jwt:
+      sign:
+        expiresIn: 10m
+        notBefore: 0
+packages:
+  '@*/*':
+    access: $all
+    publish: $authenticated
+  'vue':
+    access: $authenticated
+    publish: $authenticated
+    proxy: ver
+  '**':
+    access: $all
+    publish: $authenticated
+
+middlewares:
+  audit:
+    enabled: true
+
+log: { type: stdout, format: pretty, level: info }

package/test/integration/config/user.yaml

@@ -1,21 +1,13 @@
-store:
-  memory:
-    limit: 1000
-
 auth:
-  auth-memory:
-    users:
-      test:
-        name: test
-        password: test
-
+  htpasswd:
+    file: ./htpasswd-user
 web:
   enable: true
   title: verdaccio
 
 uplinks:
-  npmjs:
-    url: https://registry.npmjs.org/
+  ver:
+    url: https://registry.verdaccio.org
 
 log: { type: stdout, format: pretty, level: trace }
 
@@ -24,13 +16,15 @@ packages:
     access: $all
     publish: $all
     unpublish: $all
-    proxy: npmjs
   'verdaccio':
     access: $all
     publish: $all
+  'vue':
+    access: $authenticated
+    publish: $authenticated
+    proxy: ver
   '**':
     access: $all
     publish: $all
     unpublish: $all
-    proxy: npmjs
 _debug: true

package/test/integration/config/whoami.yaml

@@ -1,14 +1,3 @@
-store:
-  memory:
-    limit: 1000
-
-auth:
-  auth-memory:
-    users:
-      test:
-        name: test
-        password: test
-
 web:
   enable: true
   title: verdaccio
@@ -19,6 +8,10 @@ uplinks:
 
 log: { type: stdout, format: pretty, level: trace }
 
+auth:
+  htpasswd:
+    file: ./htpasswd-whoami
+
 packages:
   '@*/*':
     access: $all

package/test/integration/distTag.spec.ts

@@ -0,0 +1,76 @@
+import supertest from 'supertest';
+
+import { API_MESSAGE, HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';
+
+import { getDisTags, initializeServer, publishVersion } from './_helper';
+
+describe('package', () => {
+  let app;
+  beforeEach(async () => {
+    app = await initializeServer('distTag.yaml');
+  });
+
+  test.each([['foo'], ['@scope/foo']])('should display dist-tag (npm dist-tag ls)', async (pkg) => {
+    await publishVersion(app, pkg, '1.0.0');
+    await publishVersion(app, pkg, '1.0.1');
+    const response = await getDisTags(app, pkg);
+    expect(response.body).toEqual({ latest: '1.0.1' });
+  });
+
+  test('should add a version to a tag (npm dist-tag add)', async () => {
+    await publishVersion(app, encodeURIComponent('foo'), '1.0.0');
+    await publishVersion(app, encodeURIComponent('foo'), '1.0.1');
+
+    const response = await supertest(app)
+      .put(`/${encodeURIComponent('foo')}/test`)
+      .set(HEADERS.ACCEPT, HEADERS.GZIP)
+      .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+      .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+      .send(JSON.stringify('1.0.1'))
+      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+      .expect(HTTP_STATUS.CREATED);
+    expect(response.body.ok).toEqual(API_MESSAGE.TAG_ADDED);
+    const response2 = await getDisTags(app, 'foo');
+    expect(response2.body).toEqual({ latest: '1.0.1', test: '1.0.1' });
+  });
+
+  test('should fails if  a version is missing (npm dist-tag add)', async () => {
+    await publishVersion(app, encodeURIComponent('foo'), '1.0.0');
+    await publishVersion(app, encodeURIComponent('foo'), '1.0.1');
+
+    await supertest(app)
+      .put(`/${encodeURIComponent('foo')}/test`)
+      .set(HEADERS.ACCEPT, HEADERS.GZIP)
+      .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+      .send(JSON.stringify({}))
+      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+      .expect(HTTP_STATUS.BAD_REQUEST);
+  });
+
+  test('should delete a previous added tag (npm dist-tag rm)', async () => {
+    await publishVersion(app, encodeURIComponent('foo'), '1.0.0');
+    await publishVersion(app, encodeURIComponent('foo'), '1.0.1');
+
+    const response = await supertest(app)
+      .put(`/${encodeURIComponent('foo')}/beta`)
+      .set(HEADERS.ACCEPT, HEADERS.GZIP)
+      .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+      .send(JSON.stringify('1.0.1'))
+      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+      .expect(HTTP_STATUS.CREATED);
+    expect(response.body.ok).toEqual(API_MESSAGE.TAG_ADDED);
+
+    const response2 = await getDisTags(app, 'foo');
+    expect(response2.body).toEqual({ latest: '1.0.1', beta: '1.0.1' });
+
+    const response3 = await supertest(app)
+      .delete(`/-/package/${encodeURIComponent('foo')}/dist-tags/beta`)
+      .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+      .expect(HTTP_STATUS.CREATED);
+    expect(response3.body.ok).toEqual(API_MESSAGE.TAG_REMOVED);
+
+    const response4 = await getDisTags(app, 'foo');
+    expect(response4.body).toEqual({ latest: '1.0.1' });
+  });
+});