@verdaccio/api 6.0.0-6-next.28 → 6.0.0-6-next.29

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @verdaccio/api
 
+## 6.0.0-6-next.29
+
+### Patch Changes
+
+- b849128d: fix: handle upload scoped tarball
+- Updated dependencies [b849128d]
+  - @verdaccio/core@6.0.0-6-next.8
+  - @verdaccio/store@6.0.0-6-next.26
+  - @verdaccio/auth@6.0.0-6-next.25
+  - @verdaccio/config@6.0.0-6-next.17
+  - @verdaccio/logger@6.0.0-6-next.14
+  - @verdaccio/middleware@6.0.0-6-next.25
+  - @verdaccio/utils@6.0.0-6-next.14
+
 ## 6.0.0-6-next.28
 
 ### Patch Changes

package/build/package.js

@@ -58,7 +58,8 @@ function _default(route, auth, storage) {
 
     try {
       const stream = await storage.getTarballNext(pkg, filename, {
-        signal: abort.signal // enableRemote: true,
+        signal: abort.signal // TODO: review why this param
+        // enableRemote: true,
 
       });
       stream.on('content-length', size => {

package/build/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":["debug","buildDebug","route","auth","storage","can","allow","get","req","_res","next","name","params","package","version","write","query","abbreviated","Storage","ABBREVIATED_HEADER","requestOptions","protocol","headers","host","remoteAddress","socket","byPassCache","manifest","getPackageByOptions","uplinksLook","err","res","pkg","filename","abort","AbortController","stream","getTarballNext","signal","on","size","header","HEADER_TYPE","CONTENT_LENGTH","once","locals","report_error","url","HEADERS","CONTENT_TYPE","OCTET_STREAM","pipe"],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE } from '@verdaccio/core';\nimport { allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n\n  route.get(\n    '/:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('init package by version');\n      const name = req.params.package;\n      let version = req.params.version;\n      const write = req.query.write === 'true';\n      const abbreviated = req.get('Accept') === Storage.ABBREVIATED_HEADER;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n        byPassCache: write,\n      };\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/:pkg/-/:filename',\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { pkg, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        const stream = (await storage.getTarballNext(pkg, filename, {\n          signal: abort.signal,\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        // console.log('catch API error request', err);\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAAA;;AAIA;;AACA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;;AAEe,kBAAUC,KAAV,EAAyBC,IAAzB,EAAsCC,OAAtC,EAA8D;EAC3E,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;EAEAD,KAAK,CAACK,GAAN,CACE,qBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,IAFF,EAGEC,IAHF,EAIiB;IACfV,KAAK,CAAC,yBAAD,CAAL;IACA,MAAMW,IAAI,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAAxB;IACA,IAAIC,OAAO,GAAGN,GAAG,CAACI,MAAJ,CAAWE,OAAzB;IACA,MAAMC,KAAK,GAAGP,GAAG,CAACQ,KAAJ,CAAUD,KAAV,KAAoB,MAAlC;;IACA,MAAME,WAAW,GAAGT,GAAG,CAACD,GAAJ,CAAQ,QAAR,MAAsBW,cAAA,CAAQC,kBAAlD;;IACA,MAAMC,cAAc,GAAG;MACrBC,QAAQ,EAAEb,GAAG,CAACa,QADO;MAErBC,OAAO,EAAEd,GAAG,CAACc,OAFQ;MAGrB;MACAC,IAAI,EAAEf,GAAG,CAACe,IAJW;MAKrBC,aAAa,EAAEhB,GAAG,CAACiB,MAAJ,CAAWD,aALL;MAMrBE,WAAW,EAAEX;IANQ,CAAvB;;IASA,IAAI;MACF,MAAMY,QAAQ,GAAG,MAAMvB,OAAO,CAACwB,mBAAR,CAA4B;QACjDjB,IADiD;QAEjDkB,WAAW,EAAE,IAFoC;QAGjDZ,WAHiD;QAIjDH,OAJiD;QAKjDM;MALiD,CAA5B,CAAvB;MAOAV,IAAI,CAACiB,QAAD,CAAJ;IACD,CATD,CASE,OAAOG,GAAP,EAAY;MACZpB,IAAI,CAACoB,GAAD,CAAJ;IACD;EACF,CAlCH;EAqCA5B,KAAK,CAACK,GAAN,CACE,mBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBAAgBG,GAAhB,EAAqCuB,GAArC,EAA2DrB,IAA3D,EAAgF;IAC9E,MAAM;MAAEsB,GAAF;MAAOC;IAAP,IAAoBzB,GAAG,CAACI,MAA9B;IACA,MAAMsB,KAAK,GAAG,IAAIC,eAAJ,EAAd;;IACA,IAAI;MACF,MAAMC,MAAM,GAAI,MAAMhC,OAAO,CAACiC,cAAR,CAAuBL,GAAvB,EAA4BC,QAA5B,EAAsC;QAC1DK,MAAM,EAAEJ,KAAK,CAACI,MAD4C,CAE1D;;MAF0D,CAAtC,CAAtB;MAKAF,MAAM,CAACG,EAAP,CAAU,gBAAV,EAA6BC,IAAD,IAAU;QACpCT,GAAG,CAACU,MAAJ,CAAWC,iBAAA,CAAYC,cAAvB,EAAuCH,IAAvC;MACD,CAFD;MAIAJ,MAAM,CAACQ,IAAP,CAAY,OAAZ,EAAsBd,GAAD,IAAS;QAC5BC,GAAG,CAACc,MAAJ,CAAWC,YAAX,CAAwBhB,GAAxB;QACApB,IAAI,CAACoB,GAAD,CAAJ;MACD,CAHD;MAKAtB,GAAG,CAAC+B,EAAJ,CAAO,OAAP,EAAgB,MAAM;QACpBvC,KAAK,CAAC,wBAAD,EAA2BQ,GAAG,CAACuC,GAA/B,CAAL;QACAb,KAAK,CAACA,KAAN;MACD,CAHD;MAKAH,GAAG,CAACU,MAAJ,CAAWO,aAAA,CAAQC,YAAnB,EAAiCD,aAAA,CAAQE,YAAzC;MACAd,MAAM,CAACe,IAAP,CAAYpB,GAAZ;IACD,CAtBD,CAsBE,OAAOD,GAAP,EAAiB;MACjB;MACAC,GAAG,CAACc,MAAJ,CAAWC,YAAX,CAAwBhB,GAAxB;MACApB,IAAI,CAACoB,GAAD,CAAJ;IACD;EACF,CAjCH;AAmCD"}
+{"version":3,"file":"package.js","names":["debug","buildDebug","route","auth","storage","can","allow","get","req","_res","next","name","params","package","version","write","query","abbreviated","Storage","ABBREVIATED_HEADER","requestOptions","protocol","headers","host","remoteAddress","socket","byPassCache","manifest","getPackageByOptions","uplinksLook","err","res","pkg","filename","abort","AbortController","stream","getTarballNext","signal","on","size","header","HEADER_TYPE","CONTENT_LENGTH","once","locals","report_error","url","HEADERS","CONTENT_TYPE","OCTET_STREAM","pipe"],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE } from '@verdaccio/core';\nimport { allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n\n  route.get(\n    '/:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('init package by version');\n      const name = req.params.package;\n      let version = req.params.version;\n      const write = req.query.write === 'true';\n      const abbreviated = req.get('Accept') === Storage.ABBREVIATED_HEADER;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n        byPassCache: write,\n      };\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/:pkg/-/:filename',\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { pkg, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        const stream = (await storage.getTarballNext(pkg, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        // console.log('catch API error request', err);\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAAA;;AAIA;;AACA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;;AAEe,kBAAUC,KAAV,EAAyBC,IAAzB,EAAsCC,OAAtC,EAA8D;EAC3E,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;EAEAD,KAAK,CAACK,GAAN,CACE,qBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,IAFF,EAGEC,IAHF,EAIiB;IACfV,KAAK,CAAC,yBAAD,CAAL;IACA,MAAMW,IAAI,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAAxB;IACA,IAAIC,OAAO,GAAGN,GAAG,CAACI,MAAJ,CAAWE,OAAzB;IACA,MAAMC,KAAK,GAAGP,GAAG,CAACQ,KAAJ,CAAUD,KAAV,KAAoB,MAAlC;;IACA,MAAME,WAAW,GAAGT,GAAG,CAACD,GAAJ,CAAQ,QAAR,MAAsBW,cAAA,CAAQC,kBAAlD;;IACA,MAAMC,cAAc,GAAG;MACrBC,QAAQ,EAAEb,GAAG,CAACa,QADO;MAErBC,OAAO,EAAEd,GAAG,CAACc,OAFQ;MAGrB;MACAC,IAAI,EAAEf,GAAG,CAACe,IAJW;MAKrBC,aAAa,EAAEhB,GAAG,CAACiB,MAAJ,CAAWD,aALL;MAMrBE,WAAW,EAAEX;IANQ,CAAvB;;IASA,IAAI;MACF,MAAMY,QAAQ,GAAG,MAAMvB,OAAO,CAACwB,mBAAR,CAA4B;QACjDjB,IADiD;QAEjDkB,WAAW,EAAE,IAFoC;QAGjDZ,WAHiD;QAIjDH,OAJiD;QAKjDM;MALiD,CAA5B,CAAvB;MAOAV,IAAI,CAACiB,QAAD,CAAJ;IACD,CATD,CASE,OAAOG,GAAP,EAAY;MACZpB,IAAI,CAACoB,GAAD,CAAJ;IACD;EACF,CAlCH;EAqCA5B,KAAK,CAACK,GAAN,CACE,mBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBAAgBG,GAAhB,EAAqCuB,GAArC,EAA2DrB,IAA3D,EAAgF;IAC9E,MAAM;MAAEsB,GAAF;MAAOC;IAAP,IAAoBzB,GAAG,CAACI,MAA9B;IACA,MAAMsB,KAAK,GAAG,IAAIC,eAAJ,EAAd;;IACA,IAAI;MACF,MAAMC,MAAM,GAAI,MAAMhC,OAAO,CAACiC,cAAR,CAAuBL,GAAvB,EAA4BC,QAA5B,EAAsC;QAC1DK,MAAM,EAAEJ,KAAK,CAACI,MAD4C,CAE1D;QACA;;MAH0D,CAAtC,CAAtB;MAMAF,MAAM,CAACG,EAAP,CAAU,gBAAV,EAA6BC,IAAD,IAAU;QACpCT,GAAG,CAACU,MAAJ,CAAWC,iBAAA,CAAYC,cAAvB,EAAuCH,IAAvC;MACD,CAFD;MAIAJ,MAAM,CAACQ,IAAP,CAAY,OAAZ,EAAsBd,GAAD,IAAS;QAC5BC,GAAG,CAACc,MAAJ,CAAWC,YAAX,CAAwBhB,GAAxB;QACApB,IAAI,CAACoB,GAAD,CAAJ;MACD,CAHD;MAKAtB,GAAG,CAAC+B,EAAJ,CAAO,OAAP,EAAgB,MAAM;QACpBvC,KAAK,CAAC,wBAAD,EAA2BQ,GAAG,CAACuC,GAA/B,CAAL;QACAb,KAAK,CAACA,KAAN;MACD,CAHD;MAKAH,GAAG,CAACU,MAAJ,CAAWO,aAAA,CAAQC,YAAnB,EAAiCD,aAAA,CAAQE,YAAzC;MACAd,MAAM,CAACe,IAAP,CAAYpB,GAAZ;IACD,CAvBD,CAuBE,OAAOD,GAAP,EAAiB;MACjB;MACAC,GAAG,CAACc,MAAJ,CAAWC,YAAX,CAAwBhB,GAAxB;MACApB,IAAI,CAACoB,GAAD,CAAJ;IACD;EACF,CAlCH;AAoCD"}

package/build/publish.d.ts

@@ -67,7 +67,7 @@ import { Storage } from '@verdaccio/store';
    * specific flag for star or un start.
    * The URL for star is similar to the unpublish (change package format)
    *
-   * npm has no enpoint for star a package, rather mutate the metadata and acts as, the difference
+   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference
    * is the users property which is part of the payload and the body only includes
    *
    * {

package/build/publish.js

@@ -87,7 +87,7 @@ const debug = (0, _debug.default)('verdaccio:api:publish');
    * specific flag for star or un start.
    * The URL for star is similar to the unpublish (change package format)
    *
-   * npm has no enpoint for star a package, rather mutate the metadata and acts as, the difference
+   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference
    * is the users property which is part of the payload and the body only includes
    *
    * {
@@ -200,13 +200,12 @@ function publishPackageNext(storage) {
       return next({
         // TODO: this could be also Package Updated based on the
         // action, deprecate, star, publish new version, or create a package
-        // the mssage some return from the method
+        // the message some return from the method
         ok: _core.API_MESSAGE.PKG_CREATED,
         success: true
       });
     } catch (err) {
       // TODO: review if we need the abort controller here
-      ac.abort();
       next(err);
     }
   };

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":["debug","buildDebug","publish","router","auth","storage","can","allow","put","media","mime","getType","expectJson","publishPackageNext","delete","req","res","next","packageName","params","package","rev","revision","logger","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_res","ac","AbortController","metadata","body","updateManifest","name","signal","requestOptions","host","hostname","protocol","headers","PKG_CREATED","success","abort"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n// import { isPublishablePackage, isRelatedToDeprecation } from './utils';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no enpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n  // publish (update manifest) v6\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  // unpublish a pacakge v6\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  // v6\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackageNext(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    _res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n\n    try {\n      debug('publishing %s', packageName);\n      await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          // @ts-ignore\n          headers: req.headers,\n        },\n      });\n      _res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        // TODO: this could be also Package Updated based on the\n        // action, deprecate, star, publish new version, or create a package\n        // the mssage some return from the method\n        ok: API_MESSAGE.PKG_CREATED,\n        success: true,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      ac.abort();\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAAA;;AAEA;;AAGA;;AACA;;AACA;;;;AAKA;AACA;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACe,SAASC,OAAT,CAAiBC,MAAjB,EAAiCC,IAAjC,EAA8CC,OAA9C,EAAsE;EACnF,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ,CADmF,CAEnF;;EACAD,MAAM,CAACK,GAAP,CACE,WADF,EAEEF,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB,EAHmF,CAWnF;;EACAF,MAAM,CAACK,GAAP,CACE,0BADF,EAEEF,GAAG,CAAC,WAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB;EAQA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE;;EACAF,MAAM,CAACW,MAAP,CACE,0BADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGE,gBAAgBS,GAAhB,EAAqCC,GAArC,EAA2DC,IAA3D,EAAmF;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAJ,CAAWG,QAAvB;;IAEAC,cAAA,CAAOvB,KAAP,CAAa;MAAEkB;IAAF,CAAb,EAA+B,6BAA/B;;IACA,IAAI;MACF,MAAMb,OAAO,CAACmB,aAAR,CAAsBN,WAAtB,EAAmCG,GAAnC,CAAN;MACArB,KAAK,CAAC,wBAAD,EAA2BkB,WAA3B,CAAL;MACAF,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;MACA,OAAOV,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYC;MAAlB,CAAD,CAAX;IACD,CALD,CAKE,OAAOC,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CAhBH;EAmBA;AACF;AACA;AACA;;EACE5B,MAAM,CAACW,MAAP,CACE,sCADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGEA,GAAG,CAAC,SAAD,CAHL,EAIE,gBACES,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEY,QAAF;MAAYV;IAAZ,IAAyBP,GAAG,CAACI,MAAnC;;IAEAI,cAAA,CAAOvB,KAAP,CACE;MAAEkB,WAAF;MAAec,QAAf;MAAyBV;IAAzB,CADF,EAEG,kEAFH;;IAIA,IAAI;MACF,MAAMjB,OAAO,CAAC4B,aAAR,CAAsBf,WAAtB,EAAmCc,QAAnC,EAA6CV,QAA7C,CAAN;MACAN,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;;MAEAJ,cAAA,CAAOvB,KAAP,CACE;QAAEkB,WAAF;QAAec,QAAf;QAAyBV;MAAzB,CADF,EAEG,sEAFH;;MAIA,OAAOL,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYK;MAAlB,CAAD,CAAX;IACD,CATD,CASE,OAAOH,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CA5BH;AA8BD;;AAEM,SAASlB,kBAAT,CAA4BR,OAA5B,EAAmD;EACxD,OAAO,gBACLU,GADK,EAELoB,IAFK,EAGLlB,IAHK,EAIU;IACf,MAAMmB,EAAE,GAAG,IAAIC,eAAJ,EAAX;IACA,MAAMnB,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEE;IAAF,IAAeP,GAAG,CAACI,MAAzB;IACA,MAAMmB,QAAQ,GAAGvB,GAAG,CAACwB,IAArB;;IAEA,IAAI;MACFvC,KAAK,CAAC,eAAD,EAAkBkB,WAAlB,CAAL;MACA,MAAMb,OAAO,CAACmC,cAAR,CAAuBF,QAAvB,EAAiC;QACrCG,IAAI,EAAEvB,WAD+B;QAErCI,QAFqC;QAGrCoB,MAAM,EAAEN,EAAE,CAACM,MAH0B;QAIrCC,cAAc,EAAE;UACdC,IAAI,EAAE7B,GAAG,CAAC8B,QADI;UAEdC,QAAQ,EAAE/B,GAAG,CAAC+B,QAFA;UAGd;UACAC,OAAO,EAAEhC,GAAG,CAACgC;QAJC;MAJqB,CAAjC,CAAN;;MAWAZ,IAAI,CAACV,MAAL,CAAYC,iBAAA,CAAYC,OAAxB;;MAEA,OAAOV,IAAI,CAAC;QACV;QACA;QACA;QACAW,EAAE,EAAEC,iBAAA,CAAYmB,WAJN;QAKVC,OAAO,EAAE;MALC,CAAD,CAAX;IAOD,CAtBD,CAsBE,OAAOlB,GAAP,EAAiB;MACjB;MACAK,EAAE,CAACc,KAAH;MACAjC,IAAI,CAACc,GAAD,CAAJ;IACD;EACF,CArCD;AAsCD"}
+{"version":3,"file":"publish.js","names":["debug","buildDebug","publish","router","auth","storage","can","allow","put","media","mime","getType","expectJson","publishPackageNext","delete","req","res","next","packageName","params","package","rev","revision","logger","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_res","ac","AbortController","metadata","body","updateManifest","name","signal","requestOptions","host","hostname","protocol","headers","PKG_CREATED","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n// import { isPublishablePackage, isRelatedToDeprecation } from './utils';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n  // publish (update manifest) v6\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  // unpublish a pacakge v6\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  // v6\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackageNext(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    _res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n\n    try {\n      debug('publishing %s', packageName);\n      await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          // @ts-ignore\n          headers: req.headers,\n        },\n      });\n      _res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        // TODO: this could be also Package Updated based on the\n        // action, deprecate, star, publish new version, or create a package\n        // the message some return from the method\n        ok: API_MESSAGE.PKG_CREATED,\n        success: true,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAAA;;AAEA;;AAGA;;AACA;;AACA;;;;AAKA;AACA;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACe,SAASC,OAAT,CAAiBC,MAAjB,EAAiCC,IAAjC,EAA8CC,OAA9C,EAAsE;EACnF,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ,CADmF,CAEnF;;EACAD,MAAM,CAACK,GAAP,CACE,WADF,EAEEF,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB,EAHmF,CAWnF;;EACAF,MAAM,CAACK,GAAP,CACE,0BADF,EAEEF,GAAG,CAAC,WAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB;EAQA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE;;EACAF,MAAM,CAACW,MAAP,CACE,0BADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGE,gBAAgBS,GAAhB,EAAqCC,GAArC,EAA2DC,IAA3D,EAAmF;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAJ,CAAWG,QAAvB;;IAEAC,cAAA,CAAOvB,KAAP,CAAa;MAAEkB;IAAF,CAAb,EAA+B,6BAA/B;;IACA,IAAI;MACF,MAAMb,OAAO,CAACmB,aAAR,CAAsBN,WAAtB,EAAmCG,GAAnC,CAAN;MACArB,KAAK,CAAC,wBAAD,EAA2BkB,WAA3B,CAAL;MACAF,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;MACA,OAAOV,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYC;MAAlB,CAAD,CAAX;IACD,CALD,CAKE,OAAOC,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CAhBH;EAmBA;AACF;AACA;AACA;;EACE5B,MAAM,CAACW,MAAP,CACE,sCADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGEA,GAAG,CAAC,SAAD,CAHL,EAIE,gBACES,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEY,QAAF;MAAYV;IAAZ,IAAyBP,GAAG,CAACI,MAAnC;;IAEAI,cAAA,CAAOvB,KAAP,CACE;MAAEkB,WAAF;MAAec,QAAf;MAAyBV;IAAzB,CADF,EAEG,kEAFH;;IAIA,IAAI;MACF,MAAMjB,OAAO,CAAC4B,aAAR,CAAsBf,WAAtB,EAAmCc,QAAnC,EAA6CV,QAA7C,CAAN;MACAN,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;;MAEAJ,cAAA,CAAOvB,KAAP,CACE;QAAEkB,WAAF;QAAec,QAAf;QAAyBV;MAAzB,CADF,EAEG,sEAFH;;MAIA,OAAOL,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYK;MAAlB,CAAD,CAAX;IACD,CATD,CASE,OAAOH,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CA5BH;AA8BD;;AAEM,SAASlB,kBAAT,CAA4BR,OAA5B,EAAmD;EACxD,OAAO,gBACLU,GADK,EAELoB,IAFK,EAGLlB,IAHK,EAIU;IACf,MAAMmB,EAAE,GAAG,IAAIC,eAAJ,EAAX;IACA,MAAMnB,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEE;IAAF,IAAeP,GAAG,CAACI,MAAzB;IACA,MAAMmB,QAAQ,GAAGvB,GAAG,CAACwB,IAArB;;IAEA,IAAI;MACFvC,KAAK,CAAC,eAAD,EAAkBkB,WAAlB,CAAL;MACA,MAAMb,OAAO,CAACmC,cAAR,CAAuBF,QAAvB,EAAiC;QACrCG,IAAI,EAAEvB,WAD+B;QAErCI,QAFqC;QAGrCoB,MAAM,EAAEN,EAAE,CAACM,MAH0B;QAIrCC,cAAc,EAAE;UACdC,IAAI,EAAE7B,GAAG,CAAC8B,QADI;UAEdC,QAAQ,EAAE/B,GAAG,CAAC+B,QAFA;UAGd;UACAC,OAAO,EAAEhC,GAAG,CAACgC;QAJC;MAJqB,CAAjC,CAAN;;MAWAZ,IAAI,CAACV,MAAL,CAAYC,iBAAA,CAAYC,OAAxB;;MAEA,OAAOV,IAAI,CAAC;QACV;QACA;QACA;QACAW,EAAE,EAAEC,iBAAA,CAAYmB,WAJN;QAKVC,OAAO,EAAE;MALC,CAAD,CAAX;IAOD,CAtBD,CAsBE,OAAOlB,GAAP,EAAiB;MACjB;MACAd,IAAI,CAACc,GAAD,CAAJ;IACD;EACF,CApCD;AAqCD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "6.0.0-6-next.28",
+  "version": "6.0.0-6-next.29",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -30,13 +30,13 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "6.0.0-6-next.24",
-    "@verdaccio/config": "6.0.0-6-next.16",
-    "@verdaccio/core": "6.0.0-6-next.7",
-    "@verdaccio/logger": "6.0.0-6-next.13",
-    "@verdaccio/middleware": "6.0.0-6-next.24",
-    "@verdaccio/store": "6.0.0-6-next.25",
-    "@verdaccio/utils": "6.0.0-6-next.13",
+    "@verdaccio/auth": "6.0.0-6-next.25",
+    "@verdaccio/config": "6.0.0-6-next.17",
+    "@verdaccio/core": "6.0.0-6-next.8",
+    "@verdaccio/logger": "6.0.0-6-next.14",
+    "@verdaccio/middleware": "6.0.0-6-next.25",
+    "@verdaccio/store": "6.0.0-6-next.26",
+    "@verdaccio/utils": "6.0.0-6-next.14",
     "abortcontroller-polyfill": "1.7.3",
     "cookies": "0.8.0",
     "debug": "4.3.4",
@@ -48,9 +48,9 @@
   },
   "devDependencies": {
     "@types/node": "16.11.56",
-    "@verdaccio/server": "6.0.0-6-next.34",
-    "@verdaccio/types": "11.0.0-6-next.15",
-    "@verdaccio/test-helper": "1.1.0-6-next.3",
+    "@verdaccio/server": "6.0.0-6-next.35",
+    "@verdaccio/types": "11.0.0-6-next.16",
+    "@verdaccio/test-helper": "1.1.0-6-next.4",
     "supertest": "6.2.4",
     "nock": "13.2.9",
     "mockdate": "3.0.5"

package/src/package.ts

@@ -59,6 +59,7 @@ export default function (route: Router, auth: IAuth, storage: Storage): void {
       try {
         const stream = (await storage.getTarballNext(pkg, filename, {
           signal: abort.signal,
+          // TODO: review why this param
           // enableRemote: true,
         })) as any;
 

package/src/publish.ts

@@ -81,7 +81,7 @@ const debug = buildDebug('verdaccio:api:publish');
    * specific flag for star or un start.
    * The URL for star is similar to the unpublish (change package format)
    *
-   * npm has no enpoint for star a package, rather mutate the metadata and acts as, the difference
+   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference
    * is the users property which is part of the payload and the body only includes
    *
    * {
@@ -206,13 +206,12 @@ export function publishPackageNext(storage: Storage): any {
       return next({
         // TODO: this could be also Package Updated based on the
         // action, deprecate, star, publish new version, or create a package
-        // the mssage some return from the method
+        // the message some return from the method
         ok: API_MESSAGE.PKG_CREATED,
         success: true,
       });
     } catch (err: any) {
       // TODO: review if we need the abort controller here
-      ac.abort();
       next(err);
     }
   };

package/test/integration/config/publish-proxy.yaml

@@ -0,0 +1,26 @@
+auth:
+  htpasswd:
+    file: ./htpasswd-publish-proxy
+web:
+  enable: true
+  title: verdaccio
+
+uplinks:
+  npmjs:
+    url: https://registry.npmjs.org/
+
+log: { type: stdout, format: pretty, level: trace }
+
+packages:
+  '@*/*':
+    access: $all
+    publish: $anonymous
+    unpublish: $anonymous
+    proxy: npmjs
+  '**':
+    access: $all
+    publish: $anonymous
+    unpublish: $anonymous
+    proxy: npmjs
+
+_debug: true

package/test/integration/package.spec.ts

@@ -6,64 +6,100 @@ import { Storage } from '@verdaccio/store';
 import { initializeServer, publishVersion } from './_helper';
 
 describe('package', () => {
-  let app;
-  beforeEach(async () => {
-    app = await initializeServer('package.yaml');
-  });
-
-  test.each([['foo'], ['@scope/foo']])('should return a foo private package', async (pkg) => {
-    await publishVersion(app, pkg, '1.0.0');
-    const response = await supertest(app)
-      .get(`/${pkg}`)
-      .set(HEADERS.ACCEPT, HEADERS.JSON)
-      .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-      .expect(HTTP_STATUS.OK);
-    expect(response.body.name).toEqual(pkg);
-  });
+  describe('get tarball', () => {
+    let app;
+    beforeEach(async () => {
+      app = await initializeServer('package.yaml');
+    });
 
-  test.each([['foo'], ['@scope/foo']])(
-    'should return a foo private package by version',
-    async (pkg) => {
+    test.each([
+      ['foo', 'foo-1.0.0.tgz'],
+      ['@scope/foo', 'foo-1.0.0.tgz'],
+    ])('should return a file tarball', async (pkg, fileName) => {
       await publishVersion(app, pkg, '1.0.0');
       const response = await supertest(app)
-        .get(`/${pkg}`)
+        .get(`/${pkg}/-/${fileName}`)
         .set(HEADERS.ACCEPT, HEADERS.JSON)
-        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.OCTET_STREAM)
         .expect(HTTP_STATUS.OK);
-      expect(response.body.name).toEqual(pkg);
-    }
-  );
+      expect(Buffer.from(response.body).toString('utf8')).toBeDefined();
+    });
 
-  test.each([['foo'], ['@scope/foo']])(
-    'should return a foo private package by version',
-    async (pkg) => {
-      await publishVersion(app, pkg, '1.0.0');
-      const response = await supertest(app)
-        .get(`/${pkg}`)
+    test.each([
+      ['foo', 'foo-1.0.0.tgz'],
+      ['@scope/foo', 'foo-1.0.0.tgz'],
+    ])('should fails if tarball does not exist', async (pkg, fileName) => {
+      await publishVersion(app, pkg, '1.0.1');
+      return await supertest(app)
+        .get(`/${pkg}/-/${fileName}`)
         .set(HEADERS.ACCEPT, HEADERS.JSON)
-        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
-        .expect(HTTP_STATUS.OK);
-      expect(response.body.name).toEqual(pkg);
-    }
-  );
+        .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.OCTET_STREAM)
+        .expect(HTTP_STATUS.NOT_FOUND);
+    });
+    test.todo('check content length file header');
+    test.todo('fails on file was aborted');
+  });
+
+  describe('get package', () => {
+    let app;
+    beforeEach(async () => {
+      app = await initializeServer('package.yaml');
+    });
 
-  test.each([['foo-abbreviated'], ['@scope/foo-abbreviated']])(
-    'should return abbreviated local manifest',
-    async (pkg) => {
+    test.each([['foo'], ['@scope/foo']])('should return a foo private package', async (pkg) => {
       await publishVersion(app, pkg, '1.0.0');
       const response = await supertest(app)
         .get(`/${pkg}`)
         .set(HEADERS.ACCEPT, HEADERS.JSON)
-        .set(HEADERS.ACCEPT, Storage.ABBREVIATED_HEADER)
         .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
         .expect(HTTP_STATUS.OK);
       expect(response.body.name).toEqual(pkg);
-      expect(response.body.time).toBeDefined();
-      expect(response.body.modified).toBeDefined();
-      expect(response.body[DIST_TAGS]).toEqual({ latest: '1.0.0' });
-      expect(response.body.readme).not.toBeDefined();
-      expect(response.body._rev).not.toBeDefined();
-      expect(response.body.users).not.toBeDefined();
-    }
-  );
+    });
+
+    test.each([['foo'], ['@scope/foo']])(
+      'should return a foo private package by version',
+      async (pkg) => {
+        await publishVersion(app, pkg, '1.0.0');
+        const response = await supertest(app)
+          .get(`/${pkg}`)
+          .set(HEADERS.ACCEPT, HEADERS.JSON)
+          .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+          .expect(HTTP_STATUS.OK);
+        expect(response.body.name).toEqual(pkg);
+      }
+    );
+
+    test.each([['foo'], ['@scope/foo']])(
+      'should return a foo private package by version',
+      async (pkg) => {
+        await publishVersion(app, pkg, '1.0.0');
+        const response = await supertest(app)
+          .get(`/${pkg}`)
+          .set(HEADERS.ACCEPT, HEADERS.JSON)
+          .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+          .expect(HTTP_STATUS.OK);
+        expect(response.body.name).toEqual(pkg);
+      }
+    );
+
+    test.each([['foo-abbreviated'], ['@scope/foo-abbreviated']])(
+      'should return abbreviated local manifest',
+      async (pkg) => {
+        await publishVersion(app, pkg, '1.0.0');
+        const response = await supertest(app)
+          .get(`/${pkg}`)
+          .set(HEADERS.ACCEPT, HEADERS.JSON)
+          .set(HEADERS.ACCEPT, Storage.ABBREVIATED_HEADER)
+          .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
+          .expect(HTTP_STATUS.OK);
+        expect(response.body.name).toEqual(pkg);
+        expect(response.body.time).toBeDefined();
+        expect(response.body.modified).toBeDefined();
+        expect(response.body[DIST_TAGS]).toEqual({ latest: '1.0.0' });
+        expect(response.body.readme).not.toBeDefined();
+        expect(response.body._rev).not.toBeDefined();
+        expect(response.body.users).not.toBeDefined();
+      }
+    );
+  });
 });

package/test/integration/publish.spec.ts

@@ -1,11 +1,13 @@
+import nock from 'nock';
+import { basename } from 'path';
 import supertest from 'supertest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 import { API_ERROR, API_MESSAGE, HEADERS, HEADER_TYPE } from '@verdaccio/core';
-import { generatePackageMetadata } from '@verdaccio/test-helper';
+import { generatePackageMetadata, generateRemotePackageMetadata } from '@verdaccio/test-helper';
 
 import { $RequestExtend, $ResponseExtend } from '../../types/custom';
-import { initializeServer, publishVersion } from './_helper';
+import { getPackage, initializeServer, publishVersion } from './_helper';
 
 const mockApiJWTmiddleware = jest.fn(
   () =>
@@ -33,31 +35,8 @@ jest.mock('@verdaccio/auth', () => ({
   },
 }));
 
-// const mockStorage = jest.fn(() => {
-// 	const { Storage } = jest.requireActual('@verdaccio/store');
-// 	return {
-// 		Storage: class extends Storage {
-// 			addPackage(name, metadata, cb) {
-// 				super.addPackage(name, metadata, cb);
-// 			}
-// 		}
-// 	};
-// });
-
-// jest.mock('@verdaccio/store', () => {
-// 	const { Storage } = jest.requireActual('@verdaccio/store');
-// 	return ({
-// 		Storage: class extends Storage {
-// 			addPackage(name, metadata, cb) {
-// 				// super.addPackage(name, metadata, cb);
-// 				return mockStorage(name, metadata, cb);
-// 			}
-// 		}
-// 	})
-// });
-
 describe('publish', () => {
-  describe('handle invalid publish formats', () => {
+  describe('handle errors', () => {
     const pkgName = 'test';
     const pkgMetadata = generatePackageMetadata(pkgName, '1.0.0');
     test('should fail on publish a bad _attachments package', async () => {
@@ -101,134 +80,179 @@ describe('publish', () => {
   });
 
   describe('publish a package', () => {
-    test('should publish a package', async () => {
-      const app = await initializeServer('publish.yaml');
-      return new Promise((resolve) => {
-        publishVersion(app, 'foo', '1.0.0')
-          .expect(HTTP_STATUS.CREATED)
-          .then((response) => {
-            expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
-            resolve(response);
-          });
+    describe('no proxies setup', () => {
+      test.each([['foo', '@scope/foo']])('should publish a package', async (pkgName) => {
+        const app = await initializeServer('publish.yaml');
+        return new Promise((resolve) => {
+          publishVersion(app, pkgName, '1.0.0')
+            .expect(HTTP_STATUS.CREATED)
+            .then((response) => {
+              expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
+              resolve(response);
+            });
+        });
       });
-    });
 
-    test('should publish a new package', async () => {
-      const pkgName = 'test';
-      const pkgMetadata = generatePackageMetadata(pkgName, '1.0.0');
-      const app = await initializeServer('publish.yaml');
-      return new Promise((resolve) => {
-        supertest(app)
-          .put(`/${encodeURIComponent(pkgName)}`)
-          .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-          .send(JSON.stringify(Object.assign({}, pkgMetadata)))
-          .set('accept', HEADERS.GZIP)
-          .expect(HTTP_STATUS.CREATED)
-          .then((response) => {
-            expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
-            resolve(response);
-          });
+      test.each([['foo', '@scope/foo']])('should publish a new package', async (pkgName) => {
+        const pkgMetadata = generatePackageMetadata(pkgName, '1.0.0');
+        const app = await initializeServer('publish.yaml');
+        return new Promise((resolve) => {
+          supertest(app)
+            .put(`/${encodeURIComponent(pkgName)}`)
+            .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+            .send(JSON.stringify(Object.assign({}, pkgMetadata)))
+            .set('accept', HEADERS.GZIP)
+            .expect(HTTP_STATUS.CREATED)
+            .then((response) => {
+              expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
+              resolve(response);
+            });
+        });
       });
+
+      test('should publish a new package with no readme', async () => {
+        const pkgName = 'test';
+        const pkgMetadata = generatePackageMetadata(pkgName, '1.0.0');
+        const app = await initializeServer('publish.yaml');
+        return new Promise((resolve) => {
+          supertest(app)
+            .put(`/${encodeURIComponent(pkgName)}`)
+            .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+            .send(
+              JSON.stringify(
+                Object.assign({}, pkgMetadata, {
+                  versions: {
+                    ['1.0.0']: {
+                      readme: null,
+                    },
+                  },
+                })
+              )
+            )
+            .set('accept', HEADERS.GZIP)
+            .expect(HTTP_STATUS.CREATED)
+            .then((response) => {
+              expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
+              resolve(response);
+            });
+        });
+      });
+    });
+    describe('proxies setup', () => {
+      test.each([['foo', '@scope%2Ffoo']])(
+        'should publish a a patch package that already exist on a remote',
+        async (pkgName) => {
+          const upstreamManifest = generateRemotePackageMetadata(
+            pkgName,
+            '1.0.0',
+            'https://registry.npmjs.org',
+            ['1.0.1', '1.0.2', '1.0.3']
+          );
+          nock('https://registry.npmjs.org').get(`/${pkgName}`).reply(200, upstreamManifest);
+          const app = await initializeServer('publish-proxy.yaml');
+          const manifest = await getPackage(app, '', decodeURIComponent(pkgName));
+          expect(manifest.body.name).toEqual(decodeURIComponent(pkgName));
+          const response = await publishVersion(
+            app,
+            decodeURIComponent(pkgName),
+            '1.0.1-patch'
+          ).expect(HTTP_STATUS.CREATED);
+          expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
+          const response2 = await publishVersion(
+            app,
+            decodeURIComponent(pkgName),
+            '1.0.2-patch'
+          ).expect(HTTP_STATUS.CREATED);
+          expect(response2.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
+        }
+      );
     });
+  });
 
-    test('should publish a new package with no readme', async () => {
-      const pkgName = 'test';
-      const pkgMetadata = generatePackageMetadata(pkgName, '1.0.0');
+  test.each([['foo', '@scope/foo']])(
+    'should fails on publish a duplicated package',
+    async (pkgName) => {
       const app = await initializeServer('publish.yaml');
+      await publishVersion(app, pkgName, '1.0.0');
       return new Promise((resolve) => {
-        supertest(app)
-          .put(`/${encodeURIComponent(pkgName)}`)
-          .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-          .send(
-            JSON.stringify(
-              Object.assign({}, pkgMetadata, {
-                versions: {
-                  ['1.0.0']: {
-                    readme: null,
-                  },
-                },
-              })
-            )
-          )
-          .set('accept', HEADERS.GZIP)
-          .expect(HTTP_STATUS.CREATED)
+        publishVersion(app, pkgName, '1.0.0')
+          .expect(HTTP_STATUS.CONFLICT)
           .then((response) => {
-            expect(response.body.ok).toEqual(API_MESSAGE.PKG_CREATED);
+            expect(response.body.error).toEqual(API_ERROR.PACKAGE_EXIST);
             resolve(response);
           });
       });
-    });
-  });
-
-  test('should fails on publish a duplicated package', async () => {
-    const app = await initializeServer('publish.yaml');
-    await publishVersion(app, 'foo', '1.0.0');
-    return new Promise((resolve) => {
-      publishVersion(app, 'foo', '1.0.0')
-        .expect(HTTP_STATUS.CONFLICT)
-        .then((response) => {
-          expect(response.body.error).toEqual(API_ERROR.PACKAGE_EXIST);
-          resolve(response);
-        });
-    });
-  });
+    }
+  );
 
   describe('unpublish a package', () => {
-    test('should unpublish entirely a package', async () => {
+    test.each([['foo', '@scope/foo']])('should unpublish entirely a package', async (pkgName) => {
       const app = await initializeServer('publish.yaml');
-      await publishVersion(app, 'foo', '1.0.0');
+      await publishVersion(app, pkgName, '1.0.0');
       const response = await supertest(app)
         // FIXME: should be filtered by revision to avoid
         // conflicts
-        .delete(`/${encodeURIComponent('foo')}/-rev/xxx`)
+        .delete(`/${encodeURIComponent(pkgName)}/-rev/xxx`)
         .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
         .expect(HTTP_STATUS.CREATED);
       expect(response.body.ok).toEqual(API_MESSAGE.PKG_REMOVED);
       // package should be completely un published
       await supertest(app)
-        .get('/foo')
+        .get(`/${pkgName}`)
         .set('Accept', HEADERS.JSON)
         .expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
         .expect(HTTP_STATUS.NOT_FOUND);
     });
 
-    test('should fails unpublish entirely a package', async () => {
-      const app = await initializeServer('publish.yaml');
-      const response = await supertest(app)
-        .delete(`/${encodeURIComponent('foo')}/-rev/1cf3-fe3`)
-        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-        .expect(HTTP_STATUS.NOT_FOUND);
-      expect(response.body.error).toEqual(API_ERROR.NO_PACKAGE);
-    });
+    test.each([['foo', '@scope/foo']])(
+      'should fails unpublish entirely a package',
+      async (pkgName) => {
+        const app = await initializeServer('publish.yaml');
+        const response = await supertest(app)
+          .delete(`/${encodeURIComponent(pkgName)}/-rev/1cf3-fe3`)
+          .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+          .expect(HTTP_STATUS.NOT_FOUND);
+        expect(response.body.error).toEqual(API_ERROR.NO_PACKAGE);
+      }
+    );
 
-    test('should fails remove a tarball of a package does not exist', async () => {
-      const app = await initializeServer('publish.yaml');
-      const response = await supertest(app)
-        .delete(`/foo/-/foo-1.0.3.tgz/-rev/revision`)
-        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-        .expect(HTTP_STATUS.NOT_FOUND);
-      expect(response.body.error).toEqual(API_ERROR.NO_PACKAGE);
-    });
+    test.each([['foo', '@scope/foo']])(
+      'should fails remove a tarball of a package does not exist',
+      async (pkgName) => {
+        const app = await initializeServer('publish.yaml');
+        const response = await supertest(app)
+          .delete(`/${pkgName}/-/${basename(pkgName)}-1.0.3.tgz/-rev/revision`)
+          .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+          .expect(HTTP_STATUS.NOT_FOUND);
+        expect(response.body.error).toEqual(API_ERROR.NO_PACKAGE);
+      }
+    );
 
-    test('should fails on try remove a tarball does not exist', async () => {
-      const app = await initializeServer('publish.yaml');
-      await publishVersion(app, 'foo', '1.0.0');
-      const response = await supertest(app)
-        .delete(`/foo/-/foo-1.0.3.tgz/-rev/revision`)
-        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-        .expect(HTTP_STATUS.NOT_FOUND);
-      expect(response.body.error).toEqual(API_ERROR.NO_SUCH_FILE);
-    });
+    test.each([['foo', '@scope/foo']])(
+      'should fails on try remove a tarball does not exist',
+      async (pkgName) => {
+        const app = await initializeServer('publish.yaml');
+        await publishVersion(app, pkgName, '1.0.0');
+        const response = await supertest(app)
+          .delete(`/${pkgName}/-/${basename(pkgName)}-1.0.3.tgz/-rev/revision`)
+          .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+          .expect(HTTP_STATUS.NOT_FOUND);
+        expect(response.body.error).toEqual(API_ERROR.NO_SUCH_FILE);
+      }
+    );
 
-    test('should remove a tarball that does exist', async () => {
-      const app = await initializeServer('publish.yaml');
-      await publishVersion(app, 'foo', '1.0.0');
-      const response = await supertest(app)
-        .delete(`/foo/-/foo-1.0.0.tgz/-rev/revision`)
-        .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
-        .expect(HTTP_STATUS.CREATED);
-      expect(response.body.ok).toEqual(API_MESSAGE.TARBALL_REMOVED);
-    });
+    test.each([['foo', '@scope/foo']])(
+      'should remove a tarball that does exist',
+      async (pkgName) => {
+        const app = await initializeServer('publish.yaml');
+        await publishVersion(app, pkgName, '1.0.0');
+        const response = await supertest(app)
+          .delete(`/${pkgName}/-/${basename(pkgName)}-1.0.0.tgz/-rev/revision`)
+          .set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
+          .expect(HTTP_STATUS.CREATED);
+        expect(response.body.ok).toEqual(API_MESSAGE.TARBALL_REMOVED);
+      }
+    );
   });
 
   describe('star a package', () => {});

package/test/integration/user.jwt.spec.ts

@@ -1,8 +1,6 @@
-import nock from 'nock';
 import supertest from 'supertest';
 
 import { API_ERROR, HEADERS, HEADER_TYPE, HTTP_STATUS, TOKEN_BEARER } from '@verdaccio/core';
-import { generateRemotePackageMetadata } from '@verdaccio/test-helper';
 import { buildToken } from '@verdaccio/utils';
 
 import { createUser, getPackage, initializeServer } from './_helper';
@@ -13,13 +11,6 @@ describe('token', () => {
   describe('basics', () => {
     const FAKE_TOKEN: string = buildToken(TOKEN_BEARER, 'fake');
     test.each([['user.yaml'], ['user.jwt.yaml']])('should test add a new user', async (conf) => {
-      const upstreamManifest = generateRemotePackageMetadata(
-        'vue',
-        '1.0.0',
-        'https://registry.verdaccio.org'
-      );
-      nock('https://registry.verdaccio.org').get(`/vue`).reply(201, upstreamManifest);
-
       const app = await initializeServer(conf);
       const credentials = { name: 'JotaJWT', password: 'secretPass' };
       const response = await createUser(app, credentials.name, credentials.password);