@verdaccio/api 6.0.0-6-next.30 → 6.0.0-6-next.32

package/CHANGELOG.md

@@ -1,5 +1,100 @@
 # @verdaccio/api
 
+## 6.0.0-6-next.32
+
+### Minor Changes
+
+- ce013d2f: refactor: npm star command support reimplemented
+
+### Patch Changes
+
+- Updated dependencies [ce013d2f]
+  - @verdaccio/store@6.0.0-6-next.29
+  - @verdaccio/core@6.0.0-6-next.49
+  - @verdaccio/config@6.0.0-6-next.49
+  - @verdaccio/auth@6.0.0-6-next.28
+  - @verdaccio/logger@6.0.0-6-next.17
+  - @verdaccio/middleware@6.0.0-6-next.28
+  - @verdaccio/utils@6.0.0-6-next.17
+
+## 6.0.0-6-next.31
+
+### Major Changes
+
+- 9fc2e796: feat(plugins): improve plugin loader
+
+  ### Changes
+
+  - Add scope plugin support to 6.x https://github.com/verdaccio/verdaccio/pull/3227
+  - Avoid config collisions https://github.com/verdaccio/verdaccio/issues/928
+  - https://github.com/verdaccio/verdaccio/issues/1394
+  - `config.plugins` plugin path validations
+  - Updated algorithm for plugin loader.
+  - improved documentation (included dev)
+
+  ## Features
+
+  - Add scope plugin support to 6.x https://github.com/verdaccio/verdaccio/pull/3227
+  - Custom prefix:
+
+  ```
+  // config.yaml
+  server:
+    pluginPrefix: mycompany
+  middleware:
+    audit:
+        foo: 1
+  ```
+
+  This configuration will look up for `mycompany-audit` instead `Verdaccio-audit`.
+
+  ## Breaking Changes
+
+  ### sinopia plugins
+
+  - `sinopia` fallback support is removed, but can be restored using `pluginPrefix`
+
+  ### plugin filter
+
+  - method rename `filter_metadata`->`filterMetadata`
+
+  ### Plugin constructor does not merge configs anymore https://github.com/verdaccio/verdaccio/issues/928
+
+  The plugin receives as first argument `config`, which represents the config of the plugin. Example:
+
+  ```
+  // config.yaml
+  auth:
+    plugin:
+       foo: 1
+       bar: 2
+
+  export class Plugin<T> {
+    public constructor(config: T, options: PluginOptions) {
+      console.log(config);
+      // {foo:1, bar: 2}
+   }
+  }
+  ```
+
+### Minor Changes
+
+- 62c24b63: feat: add passwordValidationRegex property
+
+### Patch Changes
+
+- 43f32687: fix: abbreviated headers handle quality values
+- Updated dependencies [43f32687]
+- Updated dependencies [9fc2e796]
+- Updated dependencies [62c24b63]
+  - @verdaccio/core@6.0.0-6-next.48
+  - @verdaccio/store@6.0.0-6-next.28
+  - @verdaccio/auth@6.0.0-6-next.27
+  - @verdaccio/config@6.0.0-6-next.48
+  - @verdaccio/utils@6.0.0-6-next.16
+  - @verdaccio/logger@6.0.0-6-next.16
+  - @verdaccio/middleware@6.0.0-6-next.27
+
 ## 6.0.0-6-next.30
 
 ### Patch Changes

package/build/dist-tags.d.ts

@@ -1,4 +1,4 @@
 import { Router } from 'express';
-import { IAuth } from '@verdaccio/auth';
+import { Auth } from '@verdaccio/auth';
 import { Storage } from '@verdaccio/store';
-export default function (route: Router, auth: IAuth, storage: Storage): void;
+export default function (route: Router, auth: Auth, storage: Storage): void;

package/build/dist-tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"dist-tags.js","names":["route","auth","storage","can","allow","addTagPackageVersionMiddleware","req","res","next","_","isString","body","errorUtils","getBadRequest","tags","params","tag","mergeTagsNext","package","status","constants","HTTP_STATUS","CREATED","ok","API_MESSAGE","TAG_ADDED","err","put","media","mime","getType","delete","TAG_REMOVED","get","name","requestOptions","protocol","headers","host","remoteAddress","socket","manifest","getPackageByOptions","uplinksLook","DIST_TAGS","post","TAG_UPDATED"],"sources":["../src/dist-tags.ts"],"sourcesContent":["import { Router } from 'express';\nimport _ from 'lodash';\nimport mime from 'mime';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { constants, errorUtils } from '@verdaccio/core';\nimport { allow, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (_.isString(req.body) === false) {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    '/:package/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    '/-/package/:package/dist-tags/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    '/-/package/:package/dist-tags/:tag',\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/-/package/:package/dist-tags',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.post(\n    '/-/package/:package/dist-tags',\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      try {\n        await storage.mergeTagsNext(req.params.package, req.body);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_UPDATED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AACA;;AACA;;AAGA;;AACA;;;;AAKe,kBAAUA,KAAV,EAAyBC,IAAzB,EAAsCC,OAAtC,EAA8D;EAC3E,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;;EACA,MAAMI,8BAA8B,GAAG,gBACrCC,GADqC,EAErCC,GAFqC,EAGrCC,IAHqC,EAIV;IAC3B,IAAIC,eAAA,CAAEC,QAAF,CAAWJ,GAAG,CAACK,IAAf,MAAyB,KAA7B,EAAoC;MAClC,OAAOH,IAAI,CAACI,gBAAA,CAAWC,aAAX,CAAyB,oBAAzB,CAAD,CAAX;IACD;;IAED,MAAMC,IAAI,GAAG,EAAb;IACAA,IAAI,CAACR,GAAG,CAACS,MAAJ,CAAWC,GAAZ,CAAJ,GAAuBV,GAAG,CAACK,IAA3B;;IACA,IAAI;MACF,MAAMT,OAAO,CAACe,aAAR,CAAsBX,GAAG,CAACS,MAAJ,CAAWG,OAAjC,EAA0CJ,IAA1C,CAAN;MACAP,GAAG,CAACY,MAAJ,CAAWC,eAAA,CAAUC,WAAV,CAAsBC,OAAjC;MACA,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAA,CAAUI,WAAV,CAAsBC;MADhB,CAAD,CAAX;IAGD,CAND,CAME,OAAOC,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CApBD,CAF2E,CAwB3E;;;EACA1B,KAAK,CAAC2B,GAAN,CACE,gBADF,EAEExB,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAyB,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEzB,8BAJF;EAOAL,KAAK,CAAC2B,GAAN,CACE,oCADF,EAEExB,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAyB,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEzB,8BAJF;EAOAL,KAAK,CAAC+B,MAAN,CACE,oCADF,EAEE5B,GAAG,CAAC,SAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMM,IAAI,GAAG,EAAb;IACAA,IAAI,CAACR,GAAG,CAACS,MAAJ,CAAWC,GAAZ,CAAJ,GAAuB,IAAvB;;IACA,IAAI;MACF,MAAMd,OAAO,CAACe,aAAR,CAAsBX,GAAG,CAACS,MAAJ,CAAWG,OAAjC,EAA0CJ,IAA1C,CAAN;MACAP,GAAG,CAACY,MAAJ,CAAWC,eAAA,CAAUC,WAAV,CAAsBC,OAAjC;MACA,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAA,CAAUI,WAAV,CAAsBQ;MADhB,CAAD,CAAX;IAGD,CAND,CAME,OAAON,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CAnBH;EAsBA1B,KAAK,CAACiC,GAAN,CACE,+BADF,EAEE9B,GAAG,CAAC,QAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAM0B,IAAI,GAAG5B,GAAG,CAACS,MAAJ,CAAWG,OAAxB;IACA,MAAMiB,cAAc,GAAG;MACrBC,QAAQ,EAAE9B,GAAG,CAAC8B,QADO;MAErBC,OAAO,EAAE/B,GAAG,CAAC+B,OAFQ;MAGrB;MACAC,IAAI,EAAEhC,GAAG,CAACgC,IAJW;MAKrBC,aAAa,EAAEjC,GAAG,CAACkC,MAAJ,CAAWD;IALL,CAAvB;;IAOA,IAAI;MACF,MAAME,QAAQ,GAAG,MAAMvC,OAAO,CAACwC,mBAAR,CAA4B;QACjDR,IADiD;QAEjDS,WAAW,EAAE,IAFoC;QAGjDR;MAHiD,CAA5B,CAAvB;MAKA3B,IAAI,CAACiC,QAAQ,CAACrB,eAAA,CAAUwB,SAAX,CAAT,CAAJ;IACD,CAPD,CAOE,OAAOlB,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CA1BH;EA6BA1B,KAAK,CAAC6C,IAAN,CACE,+BADF,EAEE1C,GAAG,CAAC,SAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,IAAI;MACF,MAAMN,OAAO,CAACe,aAAR,CAAsBX,GAAG,CAACS,MAAJ,CAAWG,OAAjC,EAA0CZ,GAAG,CAACK,IAA9C,CAAN;MACAJ,GAAG,CAACY,MAAJ,CAAWC,eAAA,CAAUC,WAAV,CAAsBC,OAAjC;MACA,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAA,CAAUI,WAAV,CAAsBsB;MADhB,CAAD,CAAX;IAGD,CAND,CAME,OAAOpB,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CAjBH;AAmBD"}
+{"version":3,"file":"dist-tags.js","names":["route","auth","storage","can","allow","addTagPackageVersionMiddleware","req","res","next","_","isString","body","errorUtils","getBadRequest","tags","params","tag","mergeTagsNext","package","status","constants","HTTP_STATUS","CREATED","ok","API_MESSAGE","TAG_ADDED","err","put","media","mime","getType","delete","TAG_REMOVED","get","name","requestOptions","protocol","headers","host","remoteAddress","socket","manifest","getPackageByOptions","uplinksLook","DIST_TAGS","post","TAG_UPDATED"],"sources":["../src/dist-tags.ts"],"sourcesContent":["import { Router } from 'express';\nimport _ from 'lodash';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { constants, errorUtils } from '@verdaccio/core';\nimport { allow, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth);\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (_.isString(req.body) === false) {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    '/:package/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    '/-/package/:package/dist-tags/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    '/-/package/:package/dist-tags/:tag',\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/-/package/:package/dist-tags',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.post(\n    '/-/package/:package/dist-tags',\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      try {\n        await storage.mergeTagsNext(req.params.package, req.body);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_UPDATED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AACA;;AACA;;AAGA;;AACA;;;;AAKe,kBAAUA,KAAV,EAAyBC,IAAzB,EAAqCC,OAArC,EAA6D;EAC1E,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;;EACA,MAAMI,8BAA8B,GAAG,gBACrCC,GADqC,EAErCC,GAFqC,EAGrCC,IAHqC,EAIV;IAC3B,IAAIC,eAAA,CAAEC,QAAF,CAAWJ,GAAG,CAACK,IAAf,MAAyB,KAA7B,EAAoC;MAClC,OAAOH,IAAI,CAACI,gBAAA,CAAWC,aAAX,CAAyB,oBAAzB,CAAD,CAAX;IACD;;IAED,MAAMC,IAAI,GAAG,EAAb;IACAA,IAAI,CAACR,GAAG,CAACS,MAAJ,CAAWC,GAAZ,CAAJ,GAAuBV,GAAG,CAACK,IAA3B;;IACA,IAAI;MACF,MAAMT,OAAO,CAACe,aAAR,CAAsBX,GAAG,CAACS,MAAJ,CAAWG,OAAjC,EAA0CJ,IAA1C,CAAN;MACAP,GAAG,CAACY,MAAJ,CAAWC,eAAA,CAAUC,WAAV,CAAsBC,OAAjC;MACA,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAA,CAAUI,WAAV,CAAsBC;MADhB,CAAD,CAAX;IAGD,CAND,CAME,OAAOC,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CApBD,CAF0E,CAwB1E;;;EACA1B,KAAK,CAAC2B,GAAN,CACE,gBADF,EAEExB,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAyB,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEzB,8BAJF;EAOAL,KAAK,CAAC2B,GAAN,CACE,oCADF,EAEExB,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAyB,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEzB,8BAJF;EAOAL,KAAK,CAAC+B,MAAN,CACE,oCADF,EAEE5B,GAAG,CAAC,SAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMM,IAAI,GAAG,EAAb;IACAA,IAAI,CAACR,GAAG,CAACS,MAAJ,CAAWC,GAAZ,CAAJ,GAAuB,IAAvB;;IACA,IAAI;MACF,MAAMd,OAAO,CAACe,aAAR,CAAsBX,GAAG,CAACS,MAAJ,CAAWG,OAAjC,EAA0CJ,IAA1C,CAAN;MACAP,GAAG,CAACY,MAAJ,CAAWC,eAAA,CAAUC,WAAV,CAAsBC,OAAjC;MACA,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAA,CAAUI,WAAV,CAAsBQ;MADhB,CAAD,CAAX;IAGD,CAND,CAME,OAAON,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CAnBH;EAsBA1B,KAAK,CAACiC,GAAN,CACE,+BADF,EAEE9B,GAAG,CAAC,QAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAM0B,IAAI,GAAG5B,GAAG,CAACS,MAAJ,CAAWG,OAAxB;IACA,MAAMiB,cAAc,GAAG;MACrBC,QAAQ,EAAE9B,GAAG,CAAC8B,QADO;MAErBC,OAAO,EAAE/B,GAAG,CAAC+B,OAFQ;MAGrB;MACAC,IAAI,EAAEhC,GAAG,CAACgC,IAJW;MAKrBC,aAAa,EAAEjC,GAAG,CAACkC,MAAJ,CAAWD;IALL,CAAvB;;IAOA,IAAI;MACF,MAAME,QAAQ,GAAG,MAAMvC,OAAO,CAACwC,mBAAR,CAA4B;QACjDR,IADiD;QAEjDS,WAAW,EAAE,IAFoC;QAGjDR;MAHiD,CAA5B,CAAvB;MAKA3B,IAAI,CAACiC,QAAQ,CAACrB,eAAA,CAAUwB,SAAX,CAAT,CAAJ;IACD,CAPD,CAOE,OAAOlB,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CA1BH;EA6BA1B,KAAK,CAAC6C,IAAN,CACE,+BADF,EAEE1C,GAAG,CAAC,SAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,IAAI;MACF,MAAMN,OAAO,CAACe,aAAR,CAAsBX,GAAG,CAACS,MAAJ,CAAWG,OAAjC,EAA0CZ,GAAG,CAACK,IAA9C,CAAN;MACAJ,GAAG,CAACY,MAAJ,CAAWC,eAAA,CAAUC,WAAV,CAAsBC,OAAjC;MACA,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAA,CAAUI,WAAV,CAAsBsB;MADhB,CAAD,CAAX;IAGD,CAND,CAME,OAAOpB,GAAP,EAAY;MACZlB,IAAI,CAACkB,GAAD,CAAJ;IACD;EACF,CAjBH;AAmBD"}

package/build/index.d.ts

@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { IAuth } from '@verdaccio/auth';
+import { Auth } from '@verdaccio/auth';
 import { Storage } from '@verdaccio/store';
 import { Config } from '@verdaccio/types';
-export default function (config: Config, auth: IAuth, storage: Storage): Router;
+export default function (config: Config, auth: Auth, storage: Storage): Router;

package/build/index.js

@@ -66,7 +66,7 @@ function _default(config, auth, storage) {
 
   (0, _whoami.default)(app);
   (0, _package.default)(app, auth, storage);
-  (0, _profile.default)(app, auth); // @deprecated endpoint, 404 by default
+  (0, _profile.default)(app, auth, config); // @deprecated endpoint, 404 by default
 
   (0, _search.default)(app);
   (0, _user.default)(app, auth, config);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["config","auth","storage","app","express","Router","param","validatePackage","validateName","match","use","apiJWTmiddleware","bodyParser","json","strict","limit","max_body_size","antiLoop","encodeScopePackage","whoami","pkg","profile","search","user","distTags","publish","ping","stars","v1Search","token"],"sources":["../src/index.ts"],"sourcesContent":["import bodyParser from 'body-parser';\nimport express, { Router } from 'express';\n\nimport { IAuth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  match,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: IAuth, storage: Storage): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n  /* eslint new-cap:off */\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // these can't be safely put into express url for some reason\n  // TODO: For some reason? what reason?\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n  app.param('anything', match(/.*/));\n  app.use(auth.apiJWTmiddleware());\n  app.use(bodyParser.json({ strict: false, limit: config.max_body_size || '10mb' }));\n  // @ts-ignore\n  app.use(antiLoop(config));\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  pkg(app, auth, storage);\n  profile(app, auth);\n  // @deprecated endpoint, 404 by default\n  search(app);\n  user(app, auth, config);\n  distTags(app, auth, storage);\n  publish(app, auth, storage);\n  ping(app);\n  stars(app, storage);\n  // @ts-ignore\n  v1Search(app, auth, storage);\n  token(app, auth, storage, config);\n  return app;\n}\n"],"mappings":";;;;;;;AAAA;;AACA;;AAGA;;AAUA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;;;AAEe,kBAAUA,MAAV,EAA0BC,IAA1B,EAAuCC,OAAvC,EAAiE;EAC9E;EACA,MAAMC,GAAG,GAAGC,gBAAA,CAAQC,MAAR,EAAZ;EACA;EAEA;EACA;;;EACAF,GAAG,CAACG,KAAJ,CAAU,SAAV,EAAqBC,2BAArB;EACAJ,GAAG,CAACG,KAAJ,CAAU,UAAV,EAAsBE,wBAAtB;EACAL,GAAG,CAACG,KAAJ,CAAU,KAAV,EAAiBE,wBAAjB;EACAL,GAAG,CAACG,KAAJ,CAAU,SAAV,EAAqBE,wBAArB;EACAL,GAAG,CAACG,KAAJ,CAAU,UAAV,EAAsBE,wBAAtB;EACAL,GAAG,CAACG,KAAJ,CAAU,OAAV,EAAmBE,wBAAnB,EAZ8E,CAc9E;EACA;;EACAL,GAAG,CAACG,KAAJ,CAAU,MAAV,EAAkB,IAAAG,iBAAA,EAAM,QAAN,CAAlB;EACAN,GAAG,CAACG,KAAJ,CAAU,kBAAV,EAA8B,IAAAG,iBAAA,EAAM,sBAAN,CAA9B;EACAN,GAAG,CAACG,KAAJ,CAAU,UAAV,EAAsB,IAAAG,iBAAA,EAAM,IAAN,CAAtB;EACAN,GAAG,CAACO,GAAJ,CAAQT,IAAI,CAACU,gBAAL,EAAR;EACAR,GAAG,CAACO,GAAJ,CAAQE,mBAAA,CAAWC,IAAX,CAAgB;IAAEC,MAAM,EAAE,KAAV;IAAiBC,KAAK,EAAEf,MAAM,CAACgB,aAAP,IAAwB;EAAhD,CAAhB,CAAR,EApB8E,CAqB9E;;EACAb,GAAG,CAACO,GAAJ,CAAQ,IAAAO,oBAAA,EAASjB,MAAT,CAAR,EAtB8E,CAuB9E;;EACAG,GAAG,CAACO,GAAJ,CAAQQ,8BAAR,EAxB8E,CAyB9E;;EACA,IAAAC,eAAA,EAAOhB,GAAP;EACA,IAAAiB,gBAAA,EAAIjB,GAAJ,EAASF,IAAT,EAAeC,OAAf;EACA,IAAAmB,gBAAA,EAAQlB,GAAR,EAAaF,IAAb,EA5B8E,CA6B9E;;EACA,IAAAqB,eAAA,EAAOnB,GAAP;EACA,IAAAoB,aAAA,EAAKpB,GAAL,EAAUF,IAAV,EAAgBD,MAAhB;EACA,IAAAwB,iBAAA,EAASrB,GAAT,EAAcF,IAAd,EAAoBC,OAApB;EACA,IAAAuB,gBAAA,EAAQtB,GAAR,EAAaF,IAAb,EAAmBC,OAAnB;EACA,IAAAwB,aAAA,EAAKvB,GAAL;EACA,IAAAwB,cAAA,EAAMxB,GAAN,EAAWD,OAAX,EAnC8E,CAoC9E;;EACA,IAAA0B,gBAAA,EAASzB,GAAT,EAAcF,IAAd,EAAoBC,OAApB;EACA,IAAA2B,cAAA,EAAM1B,GAAN,EAAWF,IAAX,EAAiBC,OAAjB,EAA0BF,MAA1B;EACA,OAAOG,GAAP;AACD"}
+{"version":3,"file":"index.js","names":["config","auth","storage","app","express","Router","param","validatePackage","validateName","match","use","apiJWTmiddleware","bodyParser","json","strict","limit","max_body_size","antiLoop","encodeScopePackage","whoami","pkg","profile","search","user","distTags","publish","ping","stars","v1Search","token"],"sources":["../src/index.ts"],"sourcesContent":["import bodyParser from 'body-parser';\nimport express, { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  match,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n  /* eslint new-cap:off */\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // these can't be safely put into express url for some reason\n  // TODO: For some reason? what reason?\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n  app.param('anything', match(/.*/));\n  app.use(auth.apiJWTmiddleware());\n  app.use(bodyParser.json({ strict: false, limit: config.max_body_size || '10mb' }));\n  // @ts-ignore\n  app.use(antiLoop(config));\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  pkg(app, auth, storage);\n  profile(app, auth, config);\n  // @deprecated endpoint, 404 by default\n  search(app);\n  user(app, auth, config);\n  distTags(app, auth, storage);\n  publish(app, auth, storage);\n  ping(app);\n  stars(app, storage);\n  // @ts-ignore\n  v1Search(app, auth, storage);\n  token(app, auth, storage, config);\n  return app;\n}\n"],"mappings":";;;;;;;AAAA;;AACA;;AAGA;;AAUA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;AACA;;;;AAEe,kBAAUA,MAAV,EAA0BC,IAA1B,EAAsCC,OAAtC,EAAgE;EAC7E;EACA,MAAMC,GAAG,GAAGC,gBAAA,CAAQC,MAAR,EAAZ;EACA;EAEA;EACA;;;EACAF,GAAG,CAACG,KAAJ,CAAU,SAAV,EAAqBC,2BAArB;EACAJ,GAAG,CAACG,KAAJ,CAAU,UAAV,EAAsBE,wBAAtB;EACAL,GAAG,CAACG,KAAJ,CAAU,KAAV,EAAiBE,wBAAjB;EACAL,GAAG,CAACG,KAAJ,CAAU,SAAV,EAAqBE,wBAArB;EACAL,GAAG,CAACG,KAAJ,CAAU,UAAV,EAAsBE,wBAAtB;EACAL,GAAG,CAACG,KAAJ,CAAU,OAAV,EAAmBE,wBAAnB,EAZ6E,CAc7E;EACA;;EACAL,GAAG,CAACG,KAAJ,CAAU,MAAV,EAAkB,IAAAG,iBAAA,EAAM,QAAN,CAAlB;EACAN,GAAG,CAACG,KAAJ,CAAU,kBAAV,EAA8B,IAAAG,iBAAA,EAAM,sBAAN,CAA9B;EACAN,GAAG,CAACG,KAAJ,CAAU,UAAV,EAAsB,IAAAG,iBAAA,EAAM,IAAN,CAAtB;EACAN,GAAG,CAACO,GAAJ,CAAQT,IAAI,CAACU,gBAAL,EAAR;EACAR,GAAG,CAACO,GAAJ,CAAQE,mBAAA,CAAWC,IAAX,CAAgB;IAAEC,MAAM,EAAE,KAAV;IAAiBC,KAAK,EAAEf,MAAM,CAACgB,aAAP,IAAwB;EAAhD,CAAhB,CAAR,EApB6E,CAqB7E;;EACAb,GAAG,CAACO,GAAJ,CAAQ,IAAAO,oBAAA,EAASjB,MAAT,CAAR,EAtB6E,CAuB7E;;EACAG,GAAG,CAACO,GAAJ,CAAQQ,8BAAR,EAxB6E,CAyB7E;;EACA,IAAAC,eAAA,EAAOhB,GAAP;EACA,IAAAiB,gBAAA,EAAIjB,GAAJ,EAASF,IAAT,EAAeC,OAAf;EACA,IAAAmB,gBAAA,EAAQlB,GAAR,EAAaF,IAAb,EAAmBD,MAAnB,EA5B6E,CA6B7E;;EACA,IAAAsB,eAAA,EAAOnB,GAAP;EACA,IAAAoB,aAAA,EAAKpB,GAAL,EAAUF,IAAV,EAAgBD,MAAhB;EACA,IAAAwB,iBAAA,EAASrB,GAAT,EAAcF,IAAd,EAAoBC,OAApB;EACA,IAAAuB,gBAAA,EAAQtB,GAAR,EAAaF,IAAb,EAAmBC,OAAnB;EACA,IAAAwB,aAAA,EAAKvB,GAAL;EACA,IAAAwB,cAAA,EAAMxB,GAAN,EAAWD,OAAX,EAnC6E,CAoC7E;;EACA,IAAA0B,gBAAA,EAASzB,GAAT,EAAcF,IAAd,EAAoBC,OAApB;EACA,IAAA2B,cAAA,EAAM1B,GAAN,EAAWF,IAAX,EAAiBC,OAAjB,EAA0BF,MAA1B;EACA,OAAOG,GAAP;AACD"}

package/build/package.d.ts

@@ -1,4 +1,4 @@
 import { Router } from 'express';
-import { IAuth } from '@verdaccio/auth';
+import { Auth } from '@verdaccio/auth';
 import { Storage } from '@verdaccio/store';
-export default function (route: Router, auth: IAuth, storage: Storage): void;
+export default function (route: Router, auth: Auth, storage: Storage): void;

package/build/package.js

@@ -25,7 +25,7 @@ function _default(route, auth, storage) {
     let version = req.params.version;
     const write = req.query.write === 'true';
 
-    const abbreviated = req.get('Accept') === _store.Storage.ABBREVIATED_HEADER;
+    const abbreviated = _core.stringUtils.getByQualityPriorityValue(req.get('Accept')) === _store.Storage.ABBREVIATED_HEADER;
 
     const requestOptions = {
       protocol: req.protocol,
@@ -44,6 +44,13 @@ function _default(route, auth, storage) {
         version,
         requestOptions
       });
+
+      if (abbreviated) {
+        _res.setHeader(_core.HEADER_TYPE.CONTENT_TYPE, _core.HEADERS.JSON_INSTALL_CHARSET);
+      } else {
+        _res.setHeader(_core.HEADER_TYPE.CONTENT_TYPE, _core.HEADERS.JSON);
+      }
+
       next(manifest);
     } catch (err) {
       next(err);

package/build/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":["debug","buildDebug","route","auth","storage","can","allow","get","req","_res","next","name","params","package","version","write","query","abbreviated","Storage","ABBREVIATED_HEADER","requestOptions","protocol","headers","host","remoteAddress","socket","byPassCache","manifest","getPackageByOptions","uplinksLook","err","res","pkg","filename","abort","AbortController","stream","getTarballNext","signal","on","size","header","HEADER_TYPE","CONTENT_LENGTH","once","locals","report_error","url","HEADERS","CONTENT_TYPE","OCTET_STREAM","pipe"],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE } from '@verdaccio/core';\nimport { allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n\n  route.get(\n    '/:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('init package by version');\n      const name = req.params.package;\n      let version = req.params.version;\n      const write = req.query.write === 'true';\n      const abbreviated = req.get('Accept') === Storage.ABBREVIATED_HEADER;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n        byPassCache: write,\n      };\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/:pkg/-/:filename',\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { pkg, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        const stream = (await storage.getTarballNext(pkg, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        // console.log('catch API error request', err);\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAAA;;AAIA;;AACA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;;AAEe,kBAAUC,KAAV,EAAyBC,IAAzB,EAAsCC,OAAtC,EAA8D;EAC3E,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;EAEAD,KAAK,CAACK,GAAN,CACE,qBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,IAFF,EAGEC,IAHF,EAIiB;IACfV,KAAK,CAAC,yBAAD,CAAL;IACA,MAAMW,IAAI,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAAxB;IACA,IAAIC,OAAO,GAAGN,GAAG,CAACI,MAAJ,CAAWE,OAAzB;IACA,MAAMC,KAAK,GAAGP,GAAG,CAACQ,KAAJ,CAAUD,KAAV,KAAoB,MAAlC;;IACA,MAAME,WAAW,GAAGT,GAAG,CAACD,GAAJ,CAAQ,QAAR,MAAsBW,cAAA,CAAQC,kBAAlD;;IACA,MAAMC,cAAc,GAAG;MACrBC,QAAQ,EAAEb,GAAG,CAACa,QADO;MAErBC,OAAO,EAAEd,GAAG,CAACc,OAFQ;MAGrB;MACAC,IAAI,EAAEf,GAAG,CAACe,IAJW;MAKrBC,aAAa,EAAEhB,GAAG,CAACiB,MAAJ,CAAWD,aALL;MAMrBE,WAAW,EAAEX;IANQ,CAAvB;;IASA,IAAI;MACF,MAAMY,QAAQ,GAAG,MAAMvB,OAAO,CAACwB,mBAAR,CAA4B;QACjDjB,IADiD;QAEjDkB,WAAW,EAAE,IAFoC;QAGjDZ,WAHiD;QAIjDH,OAJiD;QAKjDM;MALiD,CAA5B,CAAvB;MAOAV,IAAI,CAACiB,QAAD,CAAJ;IACD,CATD,CASE,OAAOG,GAAP,EAAY;MACZpB,IAAI,CAACoB,GAAD,CAAJ;IACD;EACF,CAlCH;EAqCA5B,KAAK,CAACK,GAAN,CACE,mBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBAAgBG,GAAhB,EAAqCuB,GAArC,EAA2DrB,IAA3D,EAAgF;IAC9E,MAAM;MAAEsB,GAAF;MAAOC;IAAP,IAAoBzB,GAAG,CAACI,MAA9B;IACA,MAAMsB,KAAK,GAAG,IAAIC,eAAJ,EAAd;;IACA,IAAI;MACF,MAAMC,MAAM,GAAI,MAAMhC,OAAO,CAACiC,cAAR,CAAuBL,GAAvB,EAA4BC,QAA5B,EAAsC;QAC1DK,MAAM,EAAEJ,KAAK,CAACI,MAD4C,CAE1D;QACA;;MAH0D,CAAtC,CAAtB;MAMAF,MAAM,CAACG,EAAP,CAAU,gBAAV,EAA6BC,IAAD,IAAU;QACpCT,GAAG,CAACU,MAAJ,CAAWC,iBAAA,CAAYC,cAAvB,EAAuCH,IAAvC;MACD,CAFD;MAIAJ,MAAM,CAACQ,IAAP,CAAY,OAAZ,EAAsBd,GAAD,IAAS;QAC5BC,GAAG,CAACc,MAAJ,CAAWC,YAAX,CAAwBhB,GAAxB;QACApB,IAAI,CAACoB,GAAD,CAAJ;MACD,CAHD;MAKAtB,GAAG,CAAC+B,EAAJ,CAAO,OAAP,EAAgB,MAAM;QACpBvC,KAAK,CAAC,wBAAD,EAA2BQ,GAAG,CAACuC,GAA/B,CAAL;QACAb,KAAK,CAACA,KAAN;MACD,CAHD;MAKAH,GAAG,CAACU,MAAJ,CAAWO,aAAA,CAAQC,YAAnB,EAAiCD,aAAA,CAAQE,YAAzC;MACAd,MAAM,CAACe,IAAP,CAAYpB,GAAZ;IACD,CAvBD,CAuBE,OAAOD,GAAP,EAAiB;MACjB;MACAC,GAAG,CAACc,MAAJ,CAAWC,YAAX,CAAwBhB,GAAxB;MACApB,IAAI,CAACoB,GAAD,CAAJ;IACD;EACF,CAlCH;AAoCD"}
+{"version":3,"file":"package.js","names":["debug","buildDebug","route","auth","storage","can","allow","get","req","_res","next","name","params","package","version","write","query","abbreviated","stringUtils","getByQualityPriorityValue","Storage","ABBREVIATED_HEADER","requestOptions","protocol","headers","host","remoteAddress","socket","byPassCache","manifest","getPackageByOptions","uplinksLook","setHeader","HEADER_TYPE","CONTENT_TYPE","HEADERS","JSON_INSTALL_CHARSET","JSON","err","res","pkg","filename","abort","AbortController","stream","getTarballNext","signal","on","size","header","CONTENT_LENGTH","once","locals","report_error","url","OCTET_STREAM","pipe"],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth);\n\n  route.get(\n    '/:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('init package by version');\n      const name = req.params.package;\n      let version = req.params.version;\n      const write = req.query.write === 'true';\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n        byPassCache: write,\n      };\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/:pkg/-/:filename',\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { pkg, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        const stream = (await storage.getTarballNext(pkg, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        // console.log('catch API error request', err);\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAAA;;AAIA;;AACA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;;AAEe,kBAAUC,KAAV,EAAyBC,IAAzB,EAAqCC,OAArC,EAA6D;EAC1E,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;EAEAD,KAAK,CAACK,GAAN,CACE,qBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBACEG,GADF,EAEEC,IAFF,EAGEC,IAHF,EAIiB;IACfV,KAAK,CAAC,yBAAD,CAAL;IACA,MAAMW,IAAI,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAAxB;IACA,IAAIC,OAAO,GAAGN,GAAG,CAACI,MAAJ,CAAWE,OAAzB;IACA,MAAMC,KAAK,GAAGP,GAAG,CAACQ,KAAJ,CAAUD,KAAV,KAAoB,MAAlC;;IACA,MAAME,WAAW,GACfC,iBAAA,CAAYC,yBAAZ,CAAsCX,GAAG,CAACD,GAAJ,CAAQ,QAAR,CAAtC,MAA6Da,cAAA,CAAQC,kBADvE;;IAEA,MAAMC,cAAc,GAAG;MACrBC,QAAQ,EAAEf,GAAG,CAACe,QADO;MAErBC,OAAO,EAAEhB,GAAG,CAACgB,OAFQ;MAGrB;MACAC,IAAI,EAAEjB,GAAG,CAACiB,IAJW;MAKrBC,aAAa,EAAElB,GAAG,CAACmB,MAAJ,CAAWD,aALL;MAMrBE,WAAW,EAAEb;IANQ,CAAvB;;IASA,IAAI;MACF,MAAMc,QAAQ,GAAG,MAAMzB,OAAO,CAAC0B,mBAAR,CAA4B;QACjDnB,IADiD;QAEjDoB,WAAW,EAAE,IAFoC;QAGjDd,WAHiD;QAIjDH,OAJiD;QAKjDQ;MALiD,CAA5B,CAAvB;;MAOA,IAAIL,WAAJ,EAAiB;QACfR,IAAI,CAACuB,SAAL,CAAeC,iBAAA,CAAYC,YAA3B,EAAyCC,aAAA,CAAQC,oBAAjD;MACD,CAFD,MAEO;QACL3B,IAAI,CAACuB,SAAL,CAAeC,iBAAA,CAAYC,YAA3B,EAAyCC,aAAA,CAAQE,IAAjD;MACD;;MAED3B,IAAI,CAACmB,QAAD,CAAJ;IACD,CAfD,CAeE,OAAOS,GAAP,EAAY;MACZ5B,IAAI,CAAC4B,GAAD,CAAJ;IACD;EACF,CAzCH;EA4CApC,KAAK,CAACK,GAAN,CACE,mBADF,EAEEF,GAAG,CAAC,QAAD,CAFL,EAGE,gBAAgBG,GAAhB,EAAqC+B,GAArC,EAA2D7B,IAA3D,EAAgF;IAC9E,MAAM;MAAE8B,GAAF;MAAOC;IAAP,IAAoBjC,GAAG,CAACI,MAA9B;IACA,MAAM8B,KAAK,GAAG,IAAIC,eAAJ,EAAd;;IACA,IAAI;MACF,MAAMC,MAAM,GAAI,MAAMxC,OAAO,CAACyC,cAAR,CAAuBL,GAAvB,EAA4BC,QAA5B,EAAsC;QAC1DK,MAAM,EAAEJ,KAAK,CAACI,MAD4C,CAE1D;QACA;;MAH0D,CAAtC,CAAtB;MAMAF,MAAM,CAACG,EAAP,CAAU,gBAAV,EAA6BC,IAAD,IAAU;QACpCT,GAAG,CAACU,MAAJ,CAAWhB,iBAAA,CAAYiB,cAAvB,EAAuCF,IAAvC;MACD,CAFD;MAIAJ,MAAM,CAACO,IAAP,CAAY,OAAZ,EAAsBb,GAAD,IAAS;QAC5BC,GAAG,CAACa,MAAJ,CAAWC,YAAX,CAAwBf,GAAxB;QACA5B,IAAI,CAAC4B,GAAD,CAAJ;MACD,CAHD;MAKA9B,GAAG,CAACuC,EAAJ,CAAO,OAAP,EAAgB,MAAM;QACpB/C,KAAK,CAAC,wBAAD,EAA2BQ,GAAG,CAAC8C,GAA/B,CAAL;QACAZ,KAAK,CAACA,KAAN;MACD,CAHD;MAKAH,GAAG,CAACU,MAAJ,CAAWd,aAAA,CAAQD,YAAnB,EAAiCC,aAAA,CAAQoB,YAAzC;MACAX,MAAM,CAACY,IAAP,CAAYjB,GAAZ;IACD,CAvBD,CAuBE,OAAOD,GAAP,EAAiB;MACjB;MACAC,GAAG,CAACa,MAAJ,CAAWC,YAAX,CAAwBf,GAAxB;MACA5B,IAAI,CAAC4B,GAAD,CAAJ;IACD;EACF,CAlCH;AAoCD"}

package/build/publish.d.ts

@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { IAuth } from '@verdaccio/auth';
+import { Auth } from '@verdaccio/auth';
 import { Storage } from '@verdaccio/store';
 /**
    * Publish a package / update package / un/start a package
@@ -79,5 +79,5 @@ import { Storage } from '@verdaccio/store';
     }
    *
    */
-export default function publish(router: Router, auth: IAuth, storage: Storage): void;
-export declare function publishPackageNext(storage: Storage): any;
+export default function publish(router: Router, auth: Auth, storage: Storage): void;
+export declare function publishPackage(storage: Storage): any;

package/build/publish.js

@@ -4,7 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = publish;
-exports.publishPackageNext = publishPackageNext;
+exports.publishPackage = publishPackage;
 
 var _debug = _interopRequireDefault(require("debug"));
 
@@ -19,7 +19,6 @@ var _middleware = require("@verdaccio/middleware");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 // import star from './star';
-// import { isPublishablePackage, isRelatedToDeprecation } from './utils';
 const debug = (0, _debug.default)('verdaccio:api:publish');
 /**
    * Publish a package / update package / un/start a package
@@ -101,11 +100,9 @@ const debug = (0, _debug.default)('verdaccio:api:publish');
    */
 
 function publish(router, auth, storage) {
-  const can = (0, _middleware.allow)(auth); // publish (update manifest) v6
-
-  router.put('/:package', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackageNext(storage)); // unpublish a pacakge v6
-
-  router.put('/:package/-rev/:revision', can('unpublish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackageNext(storage));
+  const can = (0, _middleware.allow)(auth);
+  router.put('/:package', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage));
+  router.put('/:package/-rev/:revision', can('unpublish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage));
   /**
    * Un-publishing an entire package.
    *
@@ -114,7 +111,6 @@ function publish(router, auth, storage) {
    * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)
    * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
    */
-  // v6
 
   router.delete('/:package/-rev/:revision', can('unpublish'), async function (req, res, next) {
     const packageName = req.params.package;
@@ -172,18 +168,20 @@ function publish(router, auth, storage) {
   });
 }
 
-function publishPackageNext(storage) {
-  return async function (req, _res, next) {
+function publishPackage(storage) {
+  return async function (req, res, next) {
+    var _req$remote_user;
+
     const ac = new AbortController();
     const packageName = req.params.package;
     const {
       revision
     } = req.params;
     const metadata = req.body;
+    const username = req === null || req === void 0 ? void 0 : (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
 
     try {
-      debug('publishing %s', packageName);
-      await storage.updateManifest(metadata, {
+      const message = await storage.updateManifest(metadata, {
         name: packageName,
         revision,
         signal: ac.signal,
@@ -191,18 +189,14 @@ function publishPackageNext(storage) {
           host: req.hostname,
           protocol: req.protocol,
           // @ts-ignore
-          headers: req.headers
+          headers: req.headers,
+          username
         }
       });
-
-      _res.status(_core.HTTP_STATUS.CREATED);
-
+      res.status(_core.HTTP_STATUS.CREATED);
       return next({
-        // TODO: this could be also Package Updated based on the
-        // action, deprecate, star, publish new version, or create a package
-        // the message some return from the method
-        ok: _core.API_MESSAGE.PKG_CREATED,
-        success: true
+        success: true,
+        ok: message
       });
     } catch (err) {
       // TODO: review if we need the abort controller here

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":["debug","buildDebug","publish","router","auth","storage","can","allow","put","media","mime","getType","expectJson","publishPackageNext","delete","req","res","next","packageName","params","package","rev","revision","logger","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_res","ac","AbortController","metadata","body","updateManifest","name","signal","requestOptions","host","hostname","protocol","headers","PKG_CREATED","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { IAuth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n// import { isPublishablePackage, isRelatedToDeprecation } from './utils';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: IAuth, storage: Storage): void {\n  const can = allow(auth);\n  // publish (update manifest) v6\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  // unpublish a pacakge v6\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackageNext(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  // v6\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackageNext(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    _res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n\n    try {\n      debug('publishing %s', packageName);\n      await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          // @ts-ignore\n          headers: req.headers,\n        },\n      });\n      _res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        // TODO: this could be also Package Updated based on the\n        // action, deprecate, star, publish new version, or create a package\n        // the message some return from the method\n        ok: API_MESSAGE.PKG_CREATED,\n        success: true,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAAA;;AAEA;;AAGA;;AACA;;AACA;;;;AAKA;AACA;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACe,SAASC,OAAT,CAAiBC,MAAjB,EAAiCC,IAAjC,EAA8CC,OAA9C,EAAsE;EACnF,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ,CADmF,CAEnF;;EACAD,MAAM,CAACK,GAAP,CACE,WADF,EAEEF,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB,EAHmF,CAWnF;;EACAF,MAAM,CAACK,GAAP,CACE,0BADF,EAEEF,GAAG,CAAC,WAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,kBAAkB,CAACR,OAAD,CALpB;EAQA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACE;;EACAF,MAAM,CAACW,MAAP,CACE,0BADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGE,gBAAgBS,GAAhB,EAAqCC,GAArC,EAA2DC,IAA3D,EAAmF;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAJ,CAAWG,QAAvB;;IAEAC,cAAA,CAAOvB,KAAP,CAAa;MAAEkB;IAAF,CAAb,EAA+B,6BAA/B;;IACA,IAAI;MACF,MAAMb,OAAO,CAACmB,aAAR,CAAsBN,WAAtB,EAAmCG,GAAnC,CAAN;MACArB,KAAK,CAAC,wBAAD,EAA2BkB,WAA3B,CAAL;MACAF,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;MACA,OAAOV,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYC;MAAlB,CAAD,CAAX;IACD,CALD,CAKE,OAAOC,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CAhBH;EAmBA;AACF;AACA;AACA;;EACE5B,MAAM,CAACW,MAAP,CACE,sCADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGEA,GAAG,CAAC,SAAD,CAHL,EAIE,gBACES,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEY,QAAF;MAAYV;IAAZ,IAAyBP,GAAG,CAACI,MAAnC;;IAEAI,cAAA,CAAOvB,KAAP,CACE;MAAEkB,WAAF;MAAec,QAAf;MAAyBV;IAAzB,CADF,EAEG,kEAFH;;IAIA,IAAI;MACF,MAAMjB,OAAO,CAAC4B,aAAR,CAAsBf,WAAtB,EAAmCc,QAAnC,EAA6CV,QAA7C,CAAN;MACAN,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;;MAEAJ,cAAA,CAAOvB,KAAP,CACE;QAAEkB,WAAF;QAAec,QAAf;QAAyBV;MAAzB,CADF,EAEG,sEAFH;;MAIA,OAAOL,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYK;MAAlB,CAAD,CAAX;IACD,CATD,CASE,OAAOH,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CA5BH;AA8BD;;AAEM,SAASlB,kBAAT,CAA4BR,OAA5B,EAAmD;EACxD,OAAO,gBACLU,GADK,EAELoB,IAFK,EAGLlB,IAHK,EAIU;IACf,MAAMmB,EAAE,GAAG,IAAIC,eAAJ,EAAX;IACA,MAAMnB,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEE;IAAF,IAAeP,GAAG,CAACI,MAAzB;IACA,MAAMmB,QAAQ,GAAGvB,GAAG,CAACwB,IAArB;;IAEA,IAAI;MACFvC,KAAK,CAAC,eAAD,EAAkBkB,WAAlB,CAAL;MACA,MAAMb,OAAO,CAACmC,cAAR,CAAuBF,QAAvB,EAAiC;QACrCG,IAAI,EAAEvB,WAD+B;QAErCI,QAFqC;QAGrCoB,MAAM,EAAEN,EAAE,CAACM,MAH0B;QAIrCC,cAAc,EAAE;UACdC,IAAI,EAAE7B,GAAG,CAAC8B,QADI;UAEdC,QAAQ,EAAE/B,GAAG,CAAC+B,QAFA;UAGd;UACAC,OAAO,EAAEhC,GAAG,CAACgC;QAJC;MAJqB,CAAjC,CAAN;;MAWAZ,IAAI,CAACV,MAAL,CAAYC,iBAAA,CAAYC,OAAxB;;MAEA,OAAOV,IAAI,CAAC;QACV;QACA;QACA;QACAW,EAAE,EAAEC,iBAAA,CAAYmB,WAJN;QAKVC,OAAO,EAAE;MALC,CAAD,CAAX;IAOD,CAtBD,CAsBE,OAAOlB,GAAP,EAAiB;MACjB;MACAd,IAAI,CAACc,GAAD,CAAJ;IACD;EACF,CApCD;AAqCD"}
+{"version":3,"file":"publish.js","names":["debug","buildDebug","publish","router","auth","storage","can","allow","put","media","mime","getType","expectJson","publishPackage","delete","req","res","next","packageName","params","package","rev","revision","logger","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","ac","AbortController","metadata","body","username","remote_user","name","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth);\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          // @ts-ignore\n          headers: req.headers,\n          username,\n        },\n      });\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAAA;;AAEA;;AAGA;;AACA;;AACA;;;;AAKA;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,uBAAX,CAAd;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACe,SAASC,OAAT,CAAiBC,MAAjB,EAAiCC,IAAjC,EAA6CC,OAA7C,EAAqE;EAClF,MAAMC,GAAG,GAAG,IAAAC,iBAAA,EAAMH,IAAN,CAAZ;EACAD,MAAM,CAACK,GAAP,CACE,WADF,EAEEF,GAAG,CAAC,SAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,cAAc,CAACR,OAAD,CALhB;EAQAF,MAAM,CAACK,GAAP,CACE,0BADF,EAEEF,GAAG,CAAC,WAAD,CAFL,EAGE,IAAAG,iBAAA,EAAMC,aAAA,CAAKC,OAAL,CAAa,MAAb,CAAN,CAHF,EAIEC,sBAJF,EAKEC,cAAc,CAACR,OAAD,CALhB;EAQA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;;EACEF,MAAM,CAACW,MAAP,CACE,0BADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGE,gBAAgBS,GAAhB,EAAqCC,GAArC,EAA2DC,IAA3D,EAAmF;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAJ,CAAWG,QAAvB;;IAEAC,cAAA,CAAOvB,KAAP,CAAa;MAAEkB;IAAF,CAAb,EAA+B,6BAA/B;;IACA,IAAI;MACF,MAAMb,OAAO,CAACmB,aAAR,CAAsBN,WAAtB,EAAmCG,GAAnC,CAAN;MACArB,KAAK,CAAC,wBAAD,EAA2BkB,WAA3B,CAAL;MACAF,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;MACA,OAAOV,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYC;MAAlB,CAAD,CAAX;IACD,CALD,CAKE,OAAOC,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CAhBH;EAmBA;AACF;AACA;AACA;;EACE5B,MAAM,CAACW,MAAP,CACE,sCADF,EAEER,GAAG,CAAC,WAAD,CAFL,EAGEA,GAAG,CAAC,SAAD,CAHL,EAIE,gBACES,GADF,EAEEC,GAFF,EAGEC,IAHF,EAIiB;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEY,QAAF;MAAYV;IAAZ,IAAyBP,GAAG,CAACI,MAAnC;;IAEAI,cAAA,CAAOvB,KAAP,CACE;MAAEkB,WAAF;MAAec,QAAf;MAAyBV;IAAzB,CADF,EAEG,kEAFH;;IAIA,IAAI;MACF,MAAMjB,OAAO,CAAC4B,aAAR,CAAsBf,WAAtB,EAAmCc,QAAnC,EAA6CV,QAA7C,CAAN;MACAN,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;;MAEAJ,cAAA,CAAOvB,KAAP,CACE;QAAEkB,WAAF;QAAec,QAAf;QAAyBV;MAAzB,CADF,EAEG,sEAFH;;MAIA,OAAOL,IAAI,CAAC;QAAEW,EAAE,EAAEC,iBAAA,CAAYK;MAAlB,CAAD,CAAX;IACD,CATD,CASE,OAAOH,GAAP,EAAY;MACZ,OAAOd,IAAI,CAACc,GAAD,CAAX;IACD;EACF,CA5BH;AA8BD;;AAEM,SAASlB,cAAT,CAAwBR,OAAxB,EAA+C;EACpD,OAAO,gBACLU,GADK,EAELC,GAFK,EAGLC,IAHK,EAIU;IAAA;;IACf,MAAMkB,EAAE,GAAG,IAAIC,eAAJ,EAAX;IACA,MAAMlB,WAAW,GAAGH,GAAG,CAACI,MAAJ,CAAWC,OAA/B;IACA,MAAM;MAAEE;IAAF,IAAeP,GAAG,CAACI,MAAzB;IACA,MAAMkB,QAAQ,GAAGtB,GAAG,CAACuB,IAArB;IACA,MAAMC,QAAQ,GAAGxB,GAAH,aAAGA,GAAH,2CAAGA,GAAG,CAAEyB,WAAR,qDAAG,iBAAkBC,IAAnC;;IAEA,IAAI;MACF,MAAMC,OAAO,GAAG,MAAMrC,OAAO,CAACsC,cAAR,CAAuBN,QAAvB,EAAiC;QACrDI,IAAI,EAAEvB,WAD+C;QAErDI,QAFqD;QAGrDsB,MAAM,EAAET,EAAE,CAACS,MAH0C;QAIrDC,cAAc,EAAE;UACdC,IAAI,EAAE/B,GAAG,CAACgC,QADI;UAEdC,QAAQ,EAAEjC,GAAG,CAACiC,QAFA;UAGd;UACAC,OAAO,EAAElC,GAAG,CAACkC,OAJC;UAKdV;QALc;MAJqC,CAAjC,CAAtB;MAaAvB,GAAG,CAACS,MAAJ,CAAWC,iBAAA,CAAYC,OAAvB;MAEA,OAAOV,IAAI,CAAC;QACViC,OAAO,EAAE,IADC;QAEVtB,EAAE,EAAEc;MAFM,CAAD,CAAX;IAID,CApBD,CAoBE,OAAOX,GAAP,EAAiB;MACjB;MACAd,IAAI,CAACc,GAAD,CAAJ;IACD;EACF,CAnCD;AAoCD"}

package/build/user.d.ts

@@ -1,4 +1,4 @@
 import { Router } from 'express';
-import { IAuth } from '@verdaccio/auth';
+import { Auth } from '@verdaccio/auth';
 import { Config } from '@verdaccio/types';
-export default function (route: Router, auth: IAuth, config: Config): void;
+export default function (route: Router, auth: Auth, config: Config): void;

package/build/user.js

@@ -7,8 +7,6 @@ exports.default = _default;
 
 var _debug = _interopRequireDefault(require("debug"));
 
-var _lodash = _interopRequireDefault(require("lodash"));
-
 var _auth = require("@verdaccio/auth");
 
 var _config = require("@verdaccio/config");
@@ -47,19 +45,21 @@ function _default(route, auth, config) {
   * 
   * @export
   * @param {Router} route
-  * @param {IAuth} auth
+  * @param {Auth} auth
   * @param {Config} config
   */
 
   route.put('/-/user/:org_couchdb_user/:_rev?/:revision?', function (req, res, next) {
+    var _req$remote_user;
+
     const {
       name,
       password
     } = req.body;
     debug('login or adduser');
-    const remoteName = req.remote_user.name;
+    const remoteName = req === null || req === void 0 ? void 0 : (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
 
-    if (_lodash.default.isNil(remoteName) === false && _lodash.default.isNil(name) === false && remoteName === name) {
+    if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {
       debug('login: no remote user detected');
       auth.authenticate(name, password, async function callbackAuthenticate(err, user) {
         if (err) {
@@ -71,7 +71,7 @@ function _default(route, auth, config) {
           return next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNAUTHORIZED, _core.API_ERROR.BAD_USERNAME_PASSWORD));
         }
 
-        const restoredRemoteUser = (0, _config.createRemoteUser)(name, user.groups || []);
+        const restoredRemoteUser = (0, _config.createRemoteUser)(name, (user === null || user === void 0 ? void 0 : user.groups) || []);
         const token = await (0, _auth.getApiToken)(auth, config, restoredRemoteUser, password);
         debug('login: new token');
 
@@ -88,10 +88,12 @@ function _default(route, auth, config) {
         });
       });
     } else {
-      if ((0, _utils.validatePassword)(password) === false) {
+      var _config$serverSetting;
+
+      if (_core.validatioUtils.validatePassword(password, config === null || config === void 0 ? void 0 : (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
         debug('adduser: invalid password'); // eslint-disable-next-line new-cap
 
-        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.PASSWORD_SHORT()));
+        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.PASSWORD_SHORT));
       }
 
       auth.add_user(name, password, async function (err, user) {
@@ -108,7 +110,10 @@ function _default(route, auth, config) {
         }
 
         const token = name && password ? await (0, _auth.getApiToken)(auth, config, user, password) : undefined;
-        debug('adduser: new token %o', (0, _utils.mask)(token, 4));
+
+        if (token) {
+          debug('adduser: new token %o', (0, _utils.mask)(token, 4));
+        }
 
         if (!token) {
           return next(_core.errorUtils.getUnauthorized());

package/build/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["debug","buildDebug","route","auth","config","get","req","res","next","message","getAuthenticatedMessage","remote_user","name","status","HTTP_STATUS","OK","ok","put","password","body","remoteName","_","isNil","authenticate","callbackAuthenticate","err","user","logger","trace","errorUtils","getCode","UNAUTHORIZED","API_ERROR","BAD_USERNAME_PASSWORD","restoredRemoteUser","createRemoteUser","groups","token","getApiToken","getUnauthorized","CREATED","validatePassword","BAD_REQUEST","PASSWORD_SHORT","add_user","INTERNAL_ERROR","getConflict","undefined","mask","delete","API_MESSAGE","LOGGED_OUT"],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { IAuth } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, API_MESSAGE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, RemoteUser } from '@verdaccio/types';\nimport { getAuthenticatedMessage, mask, validatePassword } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: IAuth, config: Config): void {\n  route.get(\n    '/-/user/:org_couchdb_user',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n      const message = getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {IAuth} auth\n * @param {Config} config\n */\n  route.put(\n    '/-/user/:org_couchdb_user/:_rev?/:revision?',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req.remote_user.name;\n\n      if (_.isNil(remoteName) === false && _.isNil(name) === false && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n\n            const message = getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        if (validatePassword(password) === false) {\n          debug('adduser: invalid password');\n          // eslint-disable-next-line new-cap\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT()));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password ? await getApiToken(auth, config, user, password) : undefined;\n          debug('adduser: new token %o', mask(token as string, 4));\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    '/-/user/token/*',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;;AAAA;;AAEA;;AAEA;;AAEA;;AACA;;AACA;;AAEA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,oBAAX,CAAd;;AAEe,kBAAUC,KAAV,EAAyBC,IAAzB,EAAsCC,MAAtC,EAA4D;EACzEF,KAAK,CAACG,GAAN,CACE,2BADF,EAEE,UAAUC,GAAV,EAA+BC,GAA/B,EAA8CC,IAA9C,EAA4E;IAC1ER,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMS,OAAO,GAAG,IAAAC,8BAAA,EAAwBJ,GAAG,CAACK,WAAJ,CAAgBC,IAAxC,CAAhB;IACAZ,KAAK,CAAC,+BAAD,EAAkCS,OAAlC,CAAL;IACAF,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAYC,EAAvB;IACAP,IAAI,CAAC;MACHQ,EAAE,EAAEP;IADD,CAAD,CAAJ;EAGD,CAVH;EAaA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EACEP,KAAK,CAACe,GAAN,CACE,6CADF,EAEE,UAAUX,GAAV,EAA+BC,GAA/B,EAA8CC,IAA9C,EAA4E;IAC1E,MAAM;MAAEI,IAAF;MAAQM;IAAR,IAAqBZ,GAAG,CAACa,IAA/B;IACAnB,KAAK,CAAC,kBAAD,CAAL;IACA,MAAMoB,UAAU,GAAGd,GAAG,CAACK,WAAJ,CAAgBC,IAAnC;;IAEA,IAAIS,eAAA,CAAEC,KAAF,CAAQF,UAAR,MAAwB,KAAxB,IAAiCC,eAAA,CAAEC,KAAF,CAAQV,IAAR,MAAkB,KAAnD,IAA4DQ,UAAU,KAAKR,IAA/E,EAAqF;MACnFZ,KAAK,CAAC,gCAAD,CAAL;MACAG,IAAI,CAACoB,YAAL,CACEX,IADF,EAEEM,QAFF,EAGE,eAAeM,oBAAf,CAAoCC,GAApC,EAAyCC,IAAzC,EAA8D;QAC5D,IAAID,GAAJ,EAAS;UACPE,cAAA,CAAOC,KAAP,CACE;YAAEhB,IAAF;YAAQa;UAAR,CADF,EAEE,mEAFF;;UAIA,OAAOjB,IAAI,CACTqB,gBAAA,CAAWC,OAAX,CAAmBhB,iBAAA,CAAYiB,YAA/B,EAA6CC,eAAA,CAAUC,qBAAvD,CADS,CAAX;QAGD;;QAED,MAAMC,kBAA8B,GAAG,IAAAC,wBAAA,EAAiBvB,IAAjB,EAAuBc,IAAI,CAACU,MAAL,IAAe,EAAtC,CAAvC;QACA,MAAMC,KAAK,GAAG,MAAM,IAAAC,iBAAA,EAAYnC,IAAZ,EAAkBC,MAAlB,EAA0B8B,kBAA1B,EAA8ChB,QAA9C,CAApB;QACAlB,KAAK,CAAC,kBAAD,CAAL;;QACA,IAAI,CAACqC,KAAL,EAAY;UACV,OAAO7B,IAAI,CAACqB,gBAAA,CAAWU,eAAX,EAAD,CAAX;QACD;;QAEDhC,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAY0B,OAAvB;QAEA,MAAM/B,OAAO,GAAG,IAAAC,8BAAA,EAAwBJ,GAAG,CAACK,WAAJ,CAAgBC,IAAxC,CAAhB;QACAZ,KAAK,CAAC,gCAAD,EAAmCS,OAAnC,CAAL;QAEA,OAAOD,IAAI,CAAC;UACVQ,EAAE,EAAEP,OADM;UAEV4B;QAFU,CAAD,CAAX;MAID,CA9BH;IAgCD,CAlCD,MAkCO;MACL,IAAI,IAAAI,uBAAA,EAAiBvB,QAAjB,MAA+B,KAAnC,EAA0C;QACxClB,KAAK,CAAC,2BAAD,CAAL,CADwC,CAExC;;QACA,OAAOQ,IAAI,CAACqB,gBAAA,CAAWC,OAAX,CAAmBhB,iBAAA,CAAY4B,WAA/B,EAA4CV,eAAA,CAAUW,cAAV,EAA5C,CAAD,CAAX;MACD;;MAEDxC,IAAI,CAACyC,QAAL,CAAchC,IAAd,EAAoBM,QAApB,EAA8B,gBAAgBO,GAAhB,EAAqBC,IAArB,EAA0C;QACtE,IAAID,GAAJ,EAAS;UACP,IAAIA,GAAG,CAACZ,MAAJ,IAAcC,iBAAA,CAAY4B,WAA1B,IAAyCjB,GAAG,CAACZ,MAAJ,GAAaC,iBAAA,CAAY+B,cAAtE,EAAsF;YACpF7C,KAAK,CAAC,+BAAD,CAAL,CADoF,CAEpF;YACA;YACA;;YACA,OAAOQ,IAAI,CACTqB,gBAAA,CAAWC,OAAX,CAAmBL,GAAG,CAACZ,MAAvB,EAA+BY,GAAG,CAAChB,OAAnC,KAA+CoB,gBAAA,CAAWiB,WAAX,CAAuBrB,GAAG,CAAChB,OAA3B,CADtC,CAAX;UAGD;;UACD,OAAOD,IAAI,CAACiB,GAAD,CAAX;QACD;;QAED,MAAMY,KAAK,GACTzB,IAAI,IAAIM,QAAR,GAAmB,MAAM,IAAAoB,iBAAA,EAAYnC,IAAZ,EAAkBC,MAAlB,EAA0BsB,IAA1B,EAAgCR,QAAhC,CAAzB,GAAqE6B,SADvE;QAEA/C,KAAK,CAAC,uBAAD,EAA0B,IAAAgD,WAAA,EAAKX,KAAL,EAAsB,CAAtB,CAA1B,CAAL;;QACA,IAAI,CAACA,KAAL,EAAY;UACV,OAAO7B,IAAI,CAACqB,gBAAA,CAAWU,eAAX,EAAD,CAAX;QACD;;QAEDjC,GAAG,CAACK,WAAJ,GAAkBe,IAAlB;QACAnB,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAY0B,OAAvB;QACAxC,KAAK,CAAC,gCAAD,CAAL;QACA,OAAOQ,IAAI,CAAC;UACVQ,EAAE,EAAG,SAAQV,GAAG,CAACa,IAAJ,CAASP,IAAK,WADjB;UAEVyB;QAFU,CAAD,CAAX;MAID,CA5BD;IA6BD;EACF,CA9EH;EAiFAnC,KAAK,CAAC+C,MAAN,CACE,iBADF,EAEE,UAAU3C,GAAV,EAA+BC,GAA/B,EAA8CC,IAA9C,EAA4E;IAC1ED,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAYC,EAAvB;IACAP,IAAI,CAAC;MACHQ,EAAE,EAAEkC,iBAAA,CAAYC;IADb,CAAD,CAAJ;EAGD,CAPH;AASD"}
+{"version":3,"file":"user.js","names":["debug","buildDebug","route","auth","config","get","req","res","next","message","getAuthenticatedMessage","remote_user","name","status","HTTP_STATUS","OK","ok","put","password","body","remoteName","authenticate","callbackAuthenticate","err","user","logger","trace","errorUtils","getCode","UNAUTHORIZED","API_ERROR","BAD_USERNAME_PASSWORD","restoredRemoteUser","createRemoteUser","groups","token","getApiToken","getUnauthorized","CREATED","validatioUtils","validatePassword","serverSettings","passwordValidationRegex","BAD_REQUEST","PASSWORD_SHORT","add_user","INTERNAL_ERROR","getConflict","undefined","mask","delete","API_MESSAGE","LOGGED_OUT"],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, API_MESSAGE, HTTP_STATUS, errorUtils, validatioUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, RemoteUser } from '@verdaccio/types';\nimport { getAuthenticatedMessage, mask } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  route.get(\n    '/-/user/:org_couchdb_user',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n      const message = getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    '/-/user/:org_couchdb_user/:_rev?/:revision?',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n\n            const message = getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        if (\n          validatioUtils.validatePassword(\n            password,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          debug('adduser: invalid password');\n          // eslint-disable-next-line new-cap\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    '/-/user/token/*',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;;AAAA;;AAGA;;AAEA;;AACA;;AACA;;AAEA;;;;AAIA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,oBAAX,CAAd;;AAEe,kBAAUC,KAAV,EAAyBC,IAAzB,EAAqCC,MAArC,EAA2D;EACxEF,KAAK,CAACG,GAAN,CACE,2BADF,EAEE,UAAUC,GAAV,EAA+BC,GAA/B,EAA8CC,IAA9C,EAA4E;IAC1ER,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMS,OAAO,GAAG,IAAAC,8BAAA,EAAwBJ,GAAG,CAACK,WAAJ,CAAgBC,IAAxC,CAAhB;IACAZ,KAAK,CAAC,+BAAD,EAAkCS,OAAlC,CAAL;IACAF,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAYC,EAAvB;IACAP,IAAI,CAAC;MACHQ,EAAE,EAAEP;IADD,CAAD,CAAJ;EAGD,CAVH;EAaA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;EACEP,KAAK,CAACe,GAAN,CACE,6CADF,EAEE,UAAUX,GAAV,EAA+BC,GAA/B,EAA8CC,IAA9C,EAA4E;IAAA;;IAC1E,MAAM;MAAEI,IAAF;MAAQM;IAAR,IAAqBZ,GAAG,CAACa,IAA/B;IACAnB,KAAK,CAAC,kBAAD,CAAL;IACA,MAAMoB,UAAU,GAAGd,GAAH,aAAGA,GAAH,2CAAGA,GAAG,CAAEK,WAAR,qDAAG,iBAAkBC,IAArC;;IAEA,IAAI,OAAOQ,UAAP,KAAsB,WAAtB,IAAqC,OAAOR,IAAP,KAAgB,QAArD,IAAiEQ,UAAU,KAAKR,IAApF,EAA0F;MACxFZ,KAAK,CAAC,gCAAD,CAAL;MACAG,IAAI,CAACkB,YAAL,CACET,IADF,EAEEM,QAFF,EAGE,eAAeI,oBAAf,CAAoCC,GAApC,EAAyCC,IAAzC,EAA8D;QAC5D,IAAID,GAAJ,EAAS;UACPE,cAAA,CAAOC,KAAP,CACE;YAAEd,IAAF;YAAQW;UAAR,CADF,EAEE,mEAFF;;UAIA,OAAOf,IAAI,CACTmB,gBAAA,CAAWC,OAAX,CAAmBd,iBAAA,CAAYe,YAA/B,EAA6CC,eAAA,CAAUC,qBAAvD,CADS,CAAX;QAGD;;QAED,MAAMC,kBAA8B,GAAG,IAAAC,wBAAA,EAAiBrB,IAAjB,EAAuB,CAAAY,IAAI,SAAJ,IAAAA,IAAI,WAAJ,YAAAA,IAAI,CAAEU,MAAN,KAAgB,EAAvC,CAAvC;QACA,MAAMC,KAAK,GAAG,MAAM,IAAAC,iBAAA,EAAYjC,IAAZ,EAAkBC,MAAlB,EAA0B4B,kBAA1B,EAA8Cd,QAA9C,CAApB;QACAlB,KAAK,CAAC,kBAAD,CAAL;;QACA,IAAI,CAACmC,KAAL,EAAY;UACV,OAAO3B,IAAI,CAACmB,gBAAA,CAAWU,eAAX,EAAD,CAAX;QACD;;QAED9B,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAYwB,OAAvB;QAEA,MAAM7B,OAAO,GAAG,IAAAC,8BAAA,EAAwBJ,GAAG,CAACK,WAAJ,CAAgBC,IAAxC,CAAhB;QACAZ,KAAK,CAAC,gCAAD,EAAmCS,OAAnC,CAAL;QAEA,OAAOD,IAAI,CAAC;UACVQ,EAAE,EAAEP,OADM;UAEV0B;QAFU,CAAD,CAAX;MAID,CA9BH;IAgCD,CAlCD,MAkCO;MAAA;;MACL,IACEI,oBAAA,CAAeC,gBAAf,CACEtB,QADF,EAEEd,MAFF,aAEEA,MAFF,gDAEEA,MAAM,CAAEqC,cAFV,0DAEE,sBAAwBC,uBAF1B,MAGM,KAJR,EAKE;QACA1C,KAAK,CAAC,2BAAD,CAAL,CADA,CAEA;;QACA,OAAOQ,IAAI,CAACmB,gBAAA,CAAWC,OAAX,CAAmBd,iBAAA,CAAY6B,WAA/B,EAA4Cb,eAAA,CAAUc,cAAtD,CAAD,CAAX;MACD;;MAEDzC,IAAI,CAAC0C,QAAL,CAAcjC,IAAd,EAAoBM,QAApB,EAA8B,gBAAgBK,GAAhB,EAAqBC,IAArB,EAA0C;QACtE,IAAID,GAAJ,EAAS;UACP,IAAIA,GAAG,CAACV,MAAJ,IAAcC,iBAAA,CAAY6B,WAA1B,IAAyCpB,GAAG,CAACV,MAAJ,GAAaC,iBAAA,CAAYgC,cAAtE,EAAsF;YACpF9C,KAAK,CAAC,+BAAD,CAAL,CADoF,CAEpF;YACA;YACA;;YACA,OAAOQ,IAAI,CACTmB,gBAAA,CAAWC,OAAX,CAAmBL,GAAG,CAACV,MAAvB,EAA+BU,GAAG,CAACd,OAAnC,KAA+CkB,gBAAA,CAAWoB,WAAX,CAAuBxB,GAAG,CAACd,OAA3B,CADtC,CAAX;UAGD;;UACD,OAAOD,IAAI,CAACe,GAAD,CAAX;QACD;;QAED,MAAMY,KAAK,GACTvB,IAAI,IAAIM,QAAR,GACI,MAAM,IAAAkB,iBAAA,EAAYjC,IAAZ,EAAkBC,MAAlB,EAA0BoB,IAA1B,EAA8CN,QAA9C,CADV,GAEI8B,SAHN;;QAIA,IAAIb,KAAJ,EAAW;UACTnC,KAAK,CAAC,uBAAD,EAA0B,IAAAiD,WAAA,EAAKd,KAAL,EAAsB,CAAtB,CAA1B,CAAL;QACD;;QACD,IAAI,CAACA,KAAL,EAAY;UACV,OAAO3B,IAAI,CAACmB,gBAAA,CAAWU,eAAX,EAAD,CAAX;QACD;;QAED/B,GAAG,CAACK,WAAJ,GAAkBa,IAAlB;QACAjB,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAYwB,OAAvB;QACAtC,KAAK,CAAC,gCAAD,CAAL;QACA,OAAOQ,IAAI,CAAC;UACVQ,EAAE,EAAG,SAAQV,GAAG,CAACa,IAAJ,CAASP,IAAK,WADjB;UAEVuB;QAFU,CAAD,CAAX;MAID,CAhCD;IAiCD;EACF,CAvFH;EA0FAjC,KAAK,CAACgD,MAAN,CACE,iBADF,EAEE,UAAU5C,GAAV,EAA+BC,GAA/B,EAA8CC,IAA9C,EAA4E;IAC1ED,GAAG,CAACM,MAAJ,CAAWC,iBAAA,CAAYC,EAAvB;IACAP,IAAI,CAAC;MACHQ,EAAE,EAAEmC,iBAAA,CAAYC;IADb,CAAD,CAAJ;EAGD,CAPH;AASD"}

package/build/v1/profile.d.ts

@@ -1,5 +1,6 @@
 import { Router } from 'express';
-import { IAuth } from '@verdaccio/auth';
+import { Auth } from '@verdaccio/auth';
+import { Config } from '@verdaccio/types';
 export interface Profile {
     tfa: boolean;
     name: string;
@@ -10,4 +11,4 @@ export interface Profile {
     cidr_whitelist: string[] | null;
     fullname: string;
 }
-export default function (route: Router, auth: IAuth): void;
+export default function (route: Router, auth: Auth, config: Config): void;

package/build/v1/profile.js

@@ -9,11 +9,9 @@ var _lodash = _interopRequireDefault(require("lodash"));
 
 var _core = require("@verdaccio/core");
 
-var _utils = require("@verdaccio/utils");
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
-function _default(route, auth) {
+function _default(route, auth, config) {
   function buildProfile(name) {
     return {
       tfa: false,
@@ -54,9 +52,11 @@ function _default(route, auth) {
     } = req.remote_user;
 
     if (_lodash.default.isNil(password) === false) {
-      if ((0, _utils.validatePassword)(password.new) === false) {
+      var _config$serverSetting;
+
+      if (_core.validatioUtils.validatePassword(password.new, config === null || config === void 0 ? void 0 : (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
         /* eslint new-cap:off */
-        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNAUTHORIZED, _core.API_ERROR.PASSWORD_SHORT()));
+        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNAUTHORIZED, _core.API_ERROR.PASSWORD_SHORT));
         /* eslint new-cap:off */
       }