@verdaccio/api 7.0.0-next.2 → 7.0.0-next.4

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @verdaccio/api
 
+## 7.0.0-next.4
+
+### Patch Changes
+
+- @verdaccio/auth@7.0.0-next.4
+- @verdaccio/core@7.0.0-next.4
+- @verdaccio/config@7.0.0-next.4
+- @verdaccio/middleware@7.0.0-next.4
+- @verdaccio/store@7.0.0-next.4
+- @verdaccio/utils@7.0.0-next.4
+- @verdaccio/logger@7.0.0-next.4
+
+## 7.0.0-next.3
+
+### Major Changes
+
+- e7ebccb61: update major dependencies, remove old nodejs support
+
+### Patch Changes
+
+- Updated dependencies [daceb6d87]
+- Updated dependencies [e7ebccb61]
+  - @verdaccio/config@7.0.0-next.3
+  - @verdaccio/core@7.0.0-next.3
+  - @verdaccio/middleware@7.0.0-next.3
+  - @verdaccio/utils@7.0.0-next.3
+  - @verdaccio/auth@7.0.0-next.3
+  - @verdaccio/logger@7.0.0-next.3
+  - @verdaccio/store@7.0.0-next.3
+
 ## 7.0.0-next.2
 
 ### Patch Changes

package/build/index.js

@@ -41,7 +41,6 @@ function _default(config, auth, storage) {
     strict: false,
     limit: config.max_body_size || '10mb'
   }));
-  // @ts-ignore
   app.use((0, _middleware.antiLoop)(config));
   // encode / in a scoped package name to be matched as a single parameter in routes
   app.use(_middleware.encodeScopePackage);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_express","_interopRequireDefault","require","_middleware","_distTags","_package","_ping","_publish","_search","_stars","_user","_profile","_search2","_token","_whoami","obj","__esModule","default","_default","config","auth","storage","app","express","Router","param","validatePackage","validateName","match","use","apiJWTmiddleware","json","strict","limit","max_body_size","antiLoop","encodeScopePackage","whoami","profile","search","user","distTags","publish","ping","stars","v1Search","token","pkg"],"sources":["../src/index.ts"],"sourcesContent":["import express, { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  match,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n  /* eslint new-cap:off */\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // these can't be safely put into express url for some reason\n  // TODO: For some reason? what reason?\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n  app.use(auth.apiJWTmiddleware());\n  app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));\n  // @ts-ignore\n  app.use(antiLoop(config));\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app);\n  user(app, auth, config);\n  distTags(app, auth, storage);\n  publish(app, auth, storage);\n  ping(app);\n  stars(app, storage);\n  v1Search(app, auth, storage);\n  token(app, auth, storage, config);\n  pkg(app, auth, storage);\n  return app;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,WAAA,GAAAD,OAAA;AAUA,IAAAE,SAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,QAAA,GAAAJ,sBAAA,CAAAC,OAAA;AACA,IAAAI,KAAA,GAAAL,sBAAA,CAAAC,OAAA;AACA,IAAAK,QAAA,GAAAN,sBAAA,CAAAC,OAAA;AACA,IAAAM,OAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,MAAA,GAAAR,sBAAA,CAAAC,OAAA;AACA,IAAAQ,KAAA,GAAAT,sBAAA,CAAAC,OAAA;AACA,IAAAS,QAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,QAAA,GAAAX,sBAAA,CAAAC,OAAA;AACA,IAAAW,MAAA,GAAAZ,sBAAA,CAAAC,OAAA;AACA,IAAAY,OAAA,GAAAb,sBAAA,CAAAC,OAAA;AAA8B,SAAAD,uBAAAc,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEf,SAAAG,SAAUC,MAAc,EAAEC,IAAU,EAAEC,OAAgB,EAAU;EAC7E;EACA,MAAMC,GAAG,GAAGC,gBAAO,CAACC,MAAM,CAAC,CAAC;EAC5B;;EAEA;EACA;EACAF,GAAG,CAACG,KAAK,CAAC,SAAS,EAAEC,2BAAe,CAAC;EACrCJ,GAAG,CAACG,KAAK,CAAC,UAAU,EAAEE,wBAAY,CAAC;EACnCL,GAAG,CAACG,KAAK,CAAC,KAAK,EAAEE,wBAAY,CAAC;EAC9BL,GAAG,CAACG,KAAK,CAAC,SAAS,EAAEE,wBAAY,CAAC;EAClCL,GAAG,CAACG,KAAK,CAAC,UAAU,EAAEE,wBAAY,CAAC;EACnCL,GAAG,CAACG,KAAK,CAAC,OAAO,EAAEE,wBAAY,CAAC;;EAEhC;EACA;EACAL,GAAG,CAACG,KAAK,CAAC,MAAM,EAAE,IAAAG,iBAAK,EAAC,QAAQ,CAAC,CAAC;EAClCN,GAAG,CAACG,KAAK,CAAC,kBAAkB,EAAE,IAAAG,iBAAK,EAAC,sBAAsB,CAAC,CAAC;EAC5DN,GAAG,CAACO,GAAG,CAACT,IAAI,CAACU,gBAAgB,CAAC,CAAC,CAAC;EAChCR,GAAG,CAACO,GAAG,CAACN,gBAAO,CAACQ,IAAI,CAAC;IAAEC,MAAM,EAAE,KAAK;IAAEC,KAAK,EAAEd,MAAM,CAACe,aAAa,IAAI;EAAO,CAAC,CAAC,CAAC;EAC/E;EACAZ,GAAG,CAACO,GAAG,CAAC,IAAAM,oBAAQ,EAAChB,MAAM,CAAC,CAAC;EACzB;EACAG,GAAG,CAACO,GAAG,CAACO,8BAAkB,CAAC;EAC3B;EACA,IAAAC,eAAM,EAACf,GAAG,CAAC;EACX,IAAAgB,gBAAO,EAAChB,GAAG,EAAEF,IAAI,EAAED,MAAM,CAAC;EAC1B,IAAAoB,eAAM,EAACjB,GAAG,CAAC;EACX,IAAAkB,aAAI,EAAClB,GAAG,EAAEF,IAAI,EAAED,MAAM,CAAC;EACvB,IAAAsB,iBAAQ,EAACnB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EAC5B,IAAAqB,gBAAO,EAACpB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EAC3B,IAAAsB,aAAI,EAACrB,GAAG,CAAC;EACT,IAAAsB,cAAK,EAACtB,GAAG,EAAED,OAAO,CAAC;EACnB,IAAAwB,gBAAQ,EAACvB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EAC5B,IAAAyB,cAAK,EAACxB,GAAG,EAAEF,IAAI,EAAEC,OAAO,EAAEF,MAAM,CAAC;EACjC,IAAA4B,gBAAG,EAACzB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EACvB,OAAOC,GAAG;AACZ"}
+{"version":3,"file":"index.js","names":["_express","_interopRequireDefault","require","_middleware","_distTags","_package","_ping","_publish","_search","_stars","_user","_profile","_search2","_token","_whoami","obj","__esModule","default","_default","config","auth","storage","app","express","Router","param","validatePackage","validateName","match","use","apiJWTmiddleware","json","strict","limit","max_body_size","antiLoop","encodeScopePackage","whoami","profile","search","user","distTags","publish","ping","stars","v1Search","token","pkg"],"sources":["../src/index.ts"],"sourcesContent":["import express, { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  match,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n  /* eslint new-cap:off */\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // these can't be safely put into express url for some reason\n  // TODO: For some reason? what reason?\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n  app.use(auth.apiJWTmiddleware());\n  app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));\n  app.use(antiLoop(config));\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app);\n  user(app, auth, config);\n  distTags(app, auth, storage);\n  publish(app, auth, storage);\n  ping(app);\n  stars(app, storage);\n  v1Search(app, auth, storage);\n  token(app, auth, storage, config);\n  pkg(app, auth, storage);\n  return app;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,WAAA,GAAAD,OAAA;AAUA,IAAAE,SAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,QAAA,GAAAJ,sBAAA,CAAAC,OAAA;AACA,IAAAI,KAAA,GAAAL,sBAAA,CAAAC,OAAA;AACA,IAAAK,QAAA,GAAAN,sBAAA,CAAAC,OAAA;AACA,IAAAM,OAAA,GAAAP,sBAAA,CAAAC,OAAA;AACA,IAAAO,MAAA,GAAAR,sBAAA,CAAAC,OAAA;AACA,IAAAQ,KAAA,GAAAT,sBAAA,CAAAC,OAAA;AACA,IAAAS,QAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,QAAA,GAAAX,sBAAA,CAAAC,OAAA;AACA,IAAAW,MAAA,GAAAZ,sBAAA,CAAAC,OAAA;AACA,IAAAY,OAAA,GAAAb,sBAAA,CAAAC,OAAA;AAA8B,SAAAD,uBAAAc,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEf,SAAAG,SAAUC,MAAc,EAAEC,IAAU,EAAEC,OAAgB,EAAU;EAC7E;EACA,MAAMC,GAAG,GAAGC,gBAAO,CAACC,MAAM,CAAC,CAAC;EAC5B;;EAEA;EACA;EACAF,GAAG,CAACG,KAAK,CAAC,SAAS,EAAEC,2BAAe,CAAC;EACrCJ,GAAG,CAACG,KAAK,CAAC,UAAU,EAAEE,wBAAY,CAAC;EACnCL,GAAG,CAACG,KAAK,CAAC,KAAK,EAAEE,wBAAY,CAAC;EAC9BL,GAAG,CAACG,KAAK,CAAC,SAAS,EAAEE,wBAAY,CAAC;EAClCL,GAAG,CAACG,KAAK,CAAC,UAAU,EAAEE,wBAAY,CAAC;EACnCL,GAAG,CAACG,KAAK,CAAC,OAAO,EAAEE,wBAAY,CAAC;;EAEhC;EACA;EACAL,GAAG,CAACG,KAAK,CAAC,MAAM,EAAE,IAAAG,iBAAK,EAAC,QAAQ,CAAC,CAAC;EAClCN,GAAG,CAACG,KAAK,CAAC,kBAAkB,EAAE,IAAAG,iBAAK,EAAC,sBAAsB,CAAC,CAAC;EAC5DN,GAAG,CAACO,GAAG,CAACT,IAAI,CAACU,gBAAgB,CAAC,CAAC,CAAC;EAChCR,GAAG,CAACO,GAAG,CAACN,gBAAO,CAACQ,IAAI,CAAC;IAAEC,MAAM,EAAE,KAAK;IAAEC,KAAK,EAAEd,MAAM,CAACe,aAAa,IAAI;EAAO,CAAC,CAAC,CAAC;EAC/EZ,GAAG,CAACO,GAAG,CAAC,IAAAM,oBAAQ,EAAChB,MAAM,CAAC,CAAC;EACzB;EACAG,GAAG,CAACO,GAAG,CAACO,8BAAkB,CAAC;EAC3B;EACA,IAAAC,eAAM,EAACf,GAAG,CAAC;EACX,IAAAgB,gBAAO,EAAChB,GAAG,EAAEF,IAAI,EAAED,MAAM,CAAC;EAC1B,IAAAoB,eAAM,EAACjB,GAAG,CAAC;EACX,IAAAkB,aAAI,EAAClB,GAAG,EAAEF,IAAI,EAAED,MAAM,CAAC;EACvB,IAAAsB,iBAAQ,EAACnB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EAC5B,IAAAqB,gBAAO,EAACpB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EAC3B,IAAAsB,aAAI,EAACrB,GAAG,CAAC;EACT,IAAAsB,cAAK,EAACtB,GAAG,EAAED,OAAO,CAAC;EACnB,IAAAwB,gBAAQ,EAACvB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EAC5B,IAAAyB,cAAK,EAACxB,GAAG,EAAEF,IAAI,EAAEC,OAAO,EAAEF,MAAM,CAAC;EACjC,IAAA4B,gBAAG,EAACzB,GAAG,EAAEF,IAAI,EAAEC,OAAO,CAAC;EACvB,OAAOC,GAAG;AACZ"}

package/build/publish.js

@@ -176,10 +176,10 @@ function publishPackage(storage) {
         requestOptions: {
           host: req.hostname,
           protocol: req.protocol,
-          // @ts-ignore
           headers: req.headers,
           username
-        }
+        },
+        uplinksLook: false
       });
       res.status(_core.HTTP_STATUS.CREATED);
       return next({

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_mime","_core","_logger","_middleware","obj","__esModule","default","debug","buildDebug","publish","router","auth","storage","can","allow","beforeAll","a","b","logger","trace","afterAll","put","media","mime","getType","expectJson","publishPackage","delete","req","res","next","packageName","params","package","rev","revision","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_req$remote_user","ac","AbortController","metadata","body","username","remote_user","name","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          // @ts-ignore\n          headers: req.headers,\n          username,\n        },\n      });\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAAiE,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAKjE;;AAEA,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAACC,MAAc,EAAEC,IAAU,EAAEC,OAAgB,EAAQ;EAClF,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACH,IAAI,EAAE;IACtBI,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAEA,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFP,MAAM,CAACW,GAAG,CACR,WAAW,EACXR,GAAG,CAAC,SAAS,CAAC,EACd,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;EAEDF,MAAM,CAACW,GAAG,CACR,0BAA0B,EAC1BR,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEF,MAAM,CAACiB,MAAM,CACX,0BAA0B,EAC1Bd,GAAG,CAAC,WAAW,CAAC,EAChB,gBAAgBe,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAM,CAACG,QAAQ;IAE/BjB,cAAM,CAACX,KAAK,CAAC;MAAEwB;IAAY,CAAC,EAAG,6BAA4B,CAAC;IAC5D,IAAI;MACF,MAAMnB,OAAO,CAACwB,aAAa,CAACL,WAAW,EAAEG,GAAG,CAAC;MAC7C3B,KAAK,CAAC,wBAAwB,EAAEwB,WAAW,CAAC;MAC5CF,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAC/B,OAAOT,IAAI,CAAC;QAAEU,EAAE,EAAEC,iBAAW,CAACC;MAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,OAAOb,IAAI,CAACa,GAAG,CAAC;IAClB;EACF,CACF,CAAC;;EAED;AACF;AACA;AACA;EACEjC,MAAM,CAACiB,MAAM,CACX,sCAAsC,EACtCd,GAAG,CAAC,WAAW,CAAC,EAChBA,GAAG,CAAC,SAAS,CAAC,EACd,gBACEe,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEW,QAAQ;MAAET;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAEzCd,cAAM,CAACX,KAAK,CACV;MAAEwB,WAAW;MAAEa,QAAQ;MAAET;IAAS,CAAC,EAClC,kEACH,CAAC;IACD,IAAI;MACF,MAAMvB,OAAO,CAACiC,aAAa,CAACd,WAAW,EAAEa,QAAQ,EAAET,QAAQ,CAAC;MAC5DN,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/BrB,cAAM,CAACX,KAAK,CACV;QAAEwB,WAAW;QAAEa,QAAQ;QAAET;MAAS,CAAC,EAClC,sEACH,CAAC;MACD,OAAOL,IAAI,CAAC;QAAEU,EAAE,EAAEC,iBAAW,CAACK;MAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,OAAOH,GAAG,EAAE;MACZ,OAAOb,IAAI,CAACa,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH;AAEO,SAASjB,cAAcA,CAACd,OAAgB,EAAO;EACpD,OAAO,gBACLgB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IAAA,IAAAiB,gBAAA;IACf,MAAMC,EAAE,GAAG,IAAIC,eAAe,CAAC,CAAC;IAChC,MAAMlB,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEE;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAC/B,MAAMkB,QAAQ,GAAGtB,GAAG,CAACuB,IAAI;IACzB,MAAMC,QAAQ,GAAGxB,GAAG,aAAHA,GAAG,wBAAAmB,gBAAA,GAAHnB,GAAG,CAAEyB,WAAW,cAAAN,gBAAA,uBAAhBA,gBAAA,CAAkBO,IAAI;IAEvC,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM3C,OAAO,CAAC4C,cAAc,CAACN,QAAQ,EAAE;QACrDI,IAAI,EAAEvB,WAAW;QACjBI,QAAQ;QACRsB,MAAM,EAAET,EAAE,CAACS,MAAM;QACjBC,cAAc,EAAE;UACdC,IAAI,EAAE/B,GAAG,CAACgC,QAAQ;UAClBC,QAAQ,EAAEjC,GAAG,CAACiC,QAAQ;UACtB;UACAC,OAAO,EAAElC,GAAG,CAACkC,OAAO;UACpBV;QACF;MACF,CAAC,CAAC;MAEFvB,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B,OAAOT,IAAI,CAAC;QACViC,OAAO,EAAE,IAAI;QACbvB,EAAE,EAAEe;MACN,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOZ,GAAQ,EAAE;MACjB;MACAb,IAAI,CAACa,GAAG,CAAC;IACX;EACF,CAAC;AACH"}
+{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_mime","_core","_logger","_middleware","obj","__esModule","default","debug","buildDebug","publish","router","auth","storage","can","allow","beforeAll","a","b","logger","trace","afterAll","put","media","mime","getType","expectJson","publishPackage","delete","req","res","next","packageName","params","package","rev","revision","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_req$remote_user","ac","AbortController","metadata","body","username","remote_user","name","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","uplinksLook","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          headers: req.headers as { [key: string]: string },\n          username,\n        },\n        uplinksLook: false,\n      });\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAAiE,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAKjE;;AAEA,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAACC,MAAc,EAAEC,IAAU,EAAEC,OAAgB,EAAQ;EAClF,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACH,IAAI,EAAE;IACtBI,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAEA,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFP,MAAM,CAACW,GAAG,CACR,WAAW,EACXR,GAAG,CAAC,SAAS,CAAC,EACd,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;EAEDF,MAAM,CAACW,GAAG,CACR,0BAA0B,EAC1BR,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEF,MAAM,CAACiB,MAAM,CACX,0BAA0B,EAC1Bd,GAAG,CAAC,WAAW,CAAC,EAChB,gBAAgBe,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAM,CAACG,QAAQ;IAE/BjB,cAAM,CAACX,KAAK,CAAC;MAAEwB;IAAY,CAAC,EAAG,6BAA4B,CAAC;IAC5D,IAAI;MACF,MAAMnB,OAAO,CAACwB,aAAa,CAACL,WAAW,EAAEG,GAAG,CAAC;MAC7C3B,KAAK,CAAC,wBAAwB,EAAEwB,WAAW,CAAC;MAC5CF,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAC/B,OAAOT,IAAI,CAAC;QAAEU,EAAE,EAAEC,iBAAW,CAACC;MAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,OAAOb,IAAI,CAACa,GAAG,CAAC;IAClB;EACF,CACF,CAAC;;EAED;AACF;AACA;AACA;EACEjC,MAAM,CAACiB,MAAM,CACX,sCAAsC,EACtCd,GAAG,CAAC,WAAW,CAAC,EAChBA,GAAG,CAAC,SAAS,CAAC,EACd,gBACEe,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEW,QAAQ;MAAET;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAEzCd,cAAM,CAACX,KAAK,CACV;MAAEwB,WAAW;MAAEa,QAAQ;MAAET;IAAS,CAAC,EAClC,kEACH,CAAC;IACD,IAAI;MACF,MAAMvB,OAAO,CAACiC,aAAa,CAACd,WAAW,EAAEa,QAAQ,EAAET,QAAQ,CAAC;MAC5DN,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/BrB,cAAM,CAACX,KAAK,CACV;QAAEwB,WAAW;QAAEa,QAAQ;QAAET;MAAS,CAAC,EAClC,sEACH,CAAC;MACD,OAAOL,IAAI,CAAC;QAAEU,EAAE,EAAEC,iBAAW,CAACK;MAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,OAAOH,GAAG,EAAE;MACZ,OAAOb,IAAI,CAACa,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH;AAEO,SAASjB,cAAcA,CAACd,OAAgB,EAAO;EACpD,OAAO,gBACLgB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IAAA,IAAAiB,gBAAA;IACf,MAAMC,EAAE,GAAG,IAAIC,eAAe,CAAC,CAAC;IAChC,MAAMlB,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEE;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAC/B,MAAMkB,QAAQ,GAAGtB,GAAG,CAACuB,IAAI;IACzB,MAAMC,QAAQ,GAAGxB,GAAG,aAAHA,GAAG,wBAAAmB,gBAAA,GAAHnB,GAAG,CAAEyB,WAAW,cAAAN,gBAAA,uBAAhBA,gBAAA,CAAkBO,IAAI;IAEvC,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM3C,OAAO,CAAC4C,cAAc,CAACN,QAAQ,EAAE;QACrDI,IAAI,EAAEvB,WAAW;QACjBI,QAAQ;QACRsB,MAAM,EAAET,EAAE,CAACS,MAAM;QACjBC,cAAc,EAAE;UACdC,IAAI,EAAE/B,GAAG,CAACgC,QAAQ;UAClBC,QAAQ,EAAEjC,GAAG,CAACiC,QAAQ;UACtBC,OAAO,EAAElC,GAAG,CAACkC,OAAoC;UACjDV;QACF,CAAC;QACDW,WAAW,EAAE;MACf,CAAC,CAAC;MAEFlC,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B,OAAOT,IAAI,CAAC;QACVkC,OAAO,EAAE,IAAI;QACbxB,EAAE,EAAEe;MACN,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOZ,GAAQ,EAAE;MACjB;MACAb,IAAI,CAACa,GAAG,CAAC;IACX;EACF,CAAC;AACH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "7.0.0-next.2",
+  "version": "7.0.0-next.4",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -25,34 +25,33 @@
     "verdaccio"
   ],
   "engines": {
-    "node": ">=14",
-    "npm": ">=6"
+    "node": ">=18"
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "7.0.0-next.2",
-    "@verdaccio/config": "7.0.0-next.2",
-    "@verdaccio/core": "7.0.0-next.2",
-    "@verdaccio/logger": "7.0.0-next.2",
-    "@verdaccio/middleware": "7.0.0-next.2",
-    "@verdaccio/store": "7.0.0-next.2",
-    "@verdaccio/utils": "7.0.0-next.2",
+    "@verdaccio/auth": "7.0.0-next.4",
+    "@verdaccio/config": "7.0.0-next.4",
+    "@verdaccio/core": "7.0.0-next.4",
+    "@verdaccio/logger": "7.0.0-next.4",
+    "@verdaccio/middleware": "7.0.0-next.4",
+    "@verdaccio/store": "7.0.0-next.4",
+    "@verdaccio/utils": "7.0.0-next.4",
     "abortcontroller-polyfill": "1.7.5",
+    "body-parser": "1.20.2",
     "cookies": "0.8.0",
     "debug": "4.3.4",
-    "body-parser": "1.20.2",
     "express": "4.18.2",
     "lodash": "4.17.21",
     "mime": "2.6.0",
     "semver": "7.5.4"
   },
   "devDependencies": {
-    "@verdaccio/server": "7.0.0-next.2",
-    "@verdaccio/types": "12.0.0-next.0",
+    "@verdaccio/server": "7.0.0-next.4",
     "@verdaccio/test-helper": "3.0.0-next.0",
-    "supertest": "6.3.3",
-    "nock": "13.2.9",
-    "mockdate": "3.0.5"
+    "@verdaccio/types": "12.0.0-next.1",
+    "mockdate": "3.0.5",
+    "nock": "13.3.3",
+    "supertest": "6.3.3"
   },
   "funding": {
     "type": "opencollective",

package/src/index.ts

@@ -43,7 +43,6 @@ export default function (config: Config, auth: Auth, storage: Storage): Router {
   app.param('org_couchdb_user', match(/^org\.couchdb\.user:/));
   app.use(auth.apiJWTmiddleware());
   app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));
-  // @ts-ignore
   app.use(antiLoop(config));
   // encode / in a scoped package name to be matched as a single parameter in routes
   app.use(encodeScopePackage);

package/src/publish.ts

@@ -196,10 +196,10 @@ export function publishPackage(storage: Storage): any {
         requestOptions: {
           host: req.hostname,
           protocol: req.protocol,
-          // @ts-ignore
-          headers: req.headers,
+          headers: req.headers as { [key: string]: string },
           username,
         },
+        uplinksLook: false,
       });
 
       res.status(HTTP_STATUS.CREATED);