@verdaccio/api 7.0.0-next.6 → 7.0.1-next-8.1

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_mime","_core","_logger","_middleware","obj","__esModule","default","debug","buildDebug","publish","router","auth","storage","can","allow","beforeAll","a","b","logger","trace","afterAll","put","media","mime","getType","expectJson","publishPackage","delete","req","res","next","packageName","params","package","rev","revision","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","_req$remote_user","ac","AbortController","metadata","body","username","remote_user","name","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","uplinksLook","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: start a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or un start.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for star a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t}\n   *\n   */\nexport default function publish(router: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          headers: req.headers as { [key: string]: string },\n          username,\n        },\n        uplinksLook: false,\n      });\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAAiE,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAKjE;;AAEA,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAACC,MAAc,EAAEC,IAAU,EAAEC,OAAgB,EAAQ;EAClF,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACH,IAAI,EAAE;IACtBI,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAEA,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFP,MAAM,CAACW,GAAG,CACR,WAAW,EACXR,GAAG,CAAC,SAAS,CAAC,EACd,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;EAEDF,MAAM,CAACW,GAAG,CACR,0BAA0B,EAC1BR,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEF,MAAM,CAACiB,MAAM,CACX,0BAA0B,EAC1Bd,GAAG,CAAC,WAAW,CAAC,EAChB,gBAAgBe,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAM,CAACG,QAAQ;IAE/BjB,cAAM,CAACX,KAAK,CAAC;MAAEwB;IAAY,CAAC,EAAG,6BAA4B,CAAC;IAC5D,IAAI;MACF,MAAMnB,OAAO,CAACwB,aAAa,CAACL,WAAW,EAAEG,GAAG,CAAC;MAC7C3B,KAAK,CAAC,wBAAwB,EAAEwB,WAAW,CAAC;MAC5CF,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAC/B,OAAOT,IAAI,CAAC;QAAEU,EAAE,EAAEC,iBAAW,CAACC;MAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,OAAOb,IAAI,CAACa,GAAG,CAAC;IAClB;EACF,CACF,CAAC;;EAED;AACF;AACA;AACA;EACEjC,MAAM,CAACiB,MAAM,CACX,sCAAsC,EACtCd,GAAG,CAAC,WAAW,CAAC,EAChBA,GAAG,CAAC,SAAS,CAAC,EACd,gBACEe,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEW,QAAQ;MAAET;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAEzCd,cAAM,CAACX,KAAK,CACV;MAAEwB,WAAW;MAAEa,QAAQ;MAAET;IAAS,CAAC,EAClC,kEACH,CAAC;IACD,IAAI;MACF,MAAMvB,OAAO,CAACiC,aAAa,CAACd,WAAW,EAAEa,QAAQ,EAAET,QAAQ,CAAC;MAC5DN,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/BrB,cAAM,CAACX,KAAK,CACV;QAAEwB,WAAW;QAAEa,QAAQ;QAAET;MAAS,CAAC,EAClC,sEACH,CAAC;MACD,OAAOL,IAAI,CAAC;QAAEU,EAAE,EAAEC,iBAAW,CAACK;MAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,OAAOH,GAAG,EAAE;MACZ,OAAOb,IAAI,CAACa,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH;AAEO,SAASjB,cAAcA,CAACd,OAAgB,EAAO;EACpD,OAAO,gBACLgB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IAAA,IAAAiB,gBAAA;IACf,MAAMC,EAAE,GAAG,IAAIC,eAAe,CAAC,CAAC;IAChC,MAAMlB,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEE;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAC/B,MAAMkB,QAAQ,GAAGtB,GAAG,CAACuB,IAAI;IACzB,MAAMC,QAAQ,GAAGxB,GAAG,aAAHA,GAAG,wBAAAmB,gBAAA,GAAHnB,GAAG,CAAEyB,WAAW,cAAAN,gBAAA,uBAAhBA,gBAAA,CAAkBO,IAAI;IAEvC,IAAI;MACF,MAAMC,OAAO,GAAG,MAAM3C,OAAO,CAAC4C,cAAc,CAACN,QAAQ,EAAE;QACrDI,IAAI,EAAEvB,WAAW;QACjBI,QAAQ;QACRsB,MAAM,EAAET,EAAE,CAACS,MAAM;QACjBC,cAAc,EAAE;UACdC,IAAI,EAAE/B,GAAG,CAACgC,QAAQ;UAClBC,QAAQ,EAAEjC,GAAG,CAACiC,QAAQ;UACtBC,OAAO,EAAElC,GAAG,CAACkC,OAAoC;UACjDV;QACF,CAAC;QACDW,WAAW,EAAE;MACf,CAAC,CAAC;MAEFlC,GAAG,CAACQ,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B,OAAOT,IAAI,CAAC;QACVkC,OAAO,EAAE,IAAI;QACbxB,EAAE,EAAEe;MACN,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOZ,GAAQ,EAAE;MACjB;MACAb,IAAI,CAACa,GAAG,CAAC;IACX;EACF,CAAC;AACH"}
+{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_mime","_core","_logger","_middleware","e","__esModule","default","debug","buildDebug","publish","router","auth","storage","can","allow","beforeAll","a","b","logger","trace","afterAll","put","media","mime","getType","expectJson","publishPackage","delete","req","res","next","_req$remote_user","packageName","params","package","rev","revision","username","remote_user","name","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","_req$remote_user2","filename","removeTarball","TARBALL_REMOVED","_req$remote_user3","ac","AbortController","metadata","body","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","uplinksLook","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   * \n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t   }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint. \n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"4-b0cdaefc9bdb77c8\",\n\t\t  \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n\t\t  ]\n\t   }\n   *\n   */\nexport default function publish(router: Router, auth: Auth, storage: Storage): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage)\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when the first call detect there is only one version remaining\n   * in the metadata, then the client decides to DELETE the resource\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    debug('publishing package %o for user %o', packageName, username);\n    logger.debug(\n      { packageName, username },\n      'publishing package @{packageName} for user @{username}'\n    );\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          headers: req.headers as { [key: string]: string },\n          username,\n        },\n        uplinksLook: false,\n      });\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAAiE,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAKjE;;AAEA,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAACC,MAAc,EAAEC,IAAU,EAAEC,OAAgB,EAAQ;EAClF,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACH,IAAI,EAAE;IACtBI,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAEA,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFP,MAAM,CAACW,GAAG,CACR,WAAW,EACXR,GAAG,CAAC,SAAS,CAAC,EACd,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;EAEDF,MAAM,CAACW,GAAG,CACR,0BAA0B,EAC1BR,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAS,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,CACxB,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;EACEF,MAAM,CAACiB,MAAM,CACX,0BAA0B,EAC1Bd,GAAG,CAAC,WAAW,CAAC,EAChB,gBAAgBe,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IAAA,IAAAC,gBAAA;IACjF,MAAMC,WAAW,GAAGJ,GAAG,CAACK,MAAM,CAACC,OAAO;IACtC,MAAMC,GAAG,GAAGP,GAAG,CAACK,MAAM,CAACG,QAAQ;IAC/B,MAAMC,QAAQ,GAAGT,GAAG,aAAHA,GAAG,gBAAAG,gBAAA,GAAHH,GAAG,CAAEU,WAAW,cAAAP,gBAAA,uBAAhBA,gBAAA,CAAkBQ,IAAI;IAEvCrB,cAAM,CAACX,KAAK,CAAC;MAAEyB;IAAY,CAAC,EAAE,6BAA6B,CAAC;IAC5D,IAAI;MACF,MAAMpB,OAAO,CAAC4B,aAAa,CAACR,WAAW,EAAEG,GAAG,EAAEE,QAAQ,CAAC;MACvD9B,KAAK,CAAC,wBAAwB,EAAEyB,WAAW,CAAC;MAC5CH,GAAG,CAACY,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAC/B,OAAOb,IAAI,CAAC;QAAEc,EAAE,EAAEC,iBAAW,CAACC;MAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,OAAOjB,IAAI,CAACiB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;;EAED;AACF;AACA;AACA;EACErC,MAAM,CAACiB,MAAM,CACX,sCAAsC,EACtCd,GAAG,CAAC,WAAW,CAAC,EAChBA,GAAG,CAAC,SAAS,CAAC,EACd,gBACEe,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IAAA,IAAAkB,iBAAA;IACf,MAAMhB,WAAW,GAAGJ,GAAG,CAACK,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEe,QAAQ;MAAEb;IAAS,CAAC,GAAGR,GAAG,CAACK,MAAM;IACzC,MAAMI,QAAQ,GAAGT,GAAG,aAAHA,GAAG,gBAAAoB,iBAAA,GAAHpB,GAAG,CAAEU,WAAW,cAAAU,iBAAA,uBAAhBA,iBAAA,CAAkBT,IAAI;IAEvCrB,cAAM,CAACX,KAAK,CACV;MAAEyB,WAAW;MAAEiB,QAAQ;MAAEb;IAAS,CAAC,EACnC,kEACF,CAAC;IACD,IAAI;MACF,MAAMxB,OAAO,CAACsC,aAAa,CAAClB,WAAW,EAAEiB,QAAQ,EAAEb,QAAQ,EAAEC,QAAQ,CAAC;MACtER,GAAG,CAACY,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/BzB,cAAM,CAACX,KAAK,CACV;QAAEyB,WAAW;QAAEiB,QAAQ;QAAEb;MAAS,CAAC,EACnC,sEACF,CAAC;MACD,OAAON,IAAI,CAAC;QAAEc,EAAE,EAAEC,iBAAW,CAACM;MAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,OAAOJ,GAAG,EAAE;MACZ,OAAOjB,IAAI,CAACiB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH;AAEO,SAASrB,cAAcA,CAACd,OAAgB,EAAO;EACpD,OAAO,gBACLgB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IAAA,IAAAsB,iBAAA;IACf,MAAMC,EAAE,GAAG,IAAIC,eAAe,CAAC,CAAC;IAChC,MAAMtB,WAAW,GAAGJ,GAAG,CAACK,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEE;IAAS,CAAC,GAAGR,GAAG,CAACK,MAAM;IAC/B,MAAMsB,QAAQ,GAAG3B,GAAG,CAAC4B,IAAI;IACzB,MAAMnB,QAAQ,GAAGT,GAAG,aAAHA,GAAG,gBAAAwB,iBAAA,GAAHxB,GAAG,CAAEU,WAAW,cAAAc,iBAAA,uBAAhBA,iBAAA,CAAkBb,IAAI;IAEvChC,KAAK,CAAC,mCAAmC,EAAEyB,WAAW,EAAEK,QAAQ,CAAC;IACjEnB,cAAM,CAACX,KAAK,CACV;MAAEyB,WAAW;MAAEK;IAAS,CAAC,EACzB,wDACF,CAAC;IAED,IAAI;MACF,MAAMoB,OAAO,GAAG,MAAM7C,OAAO,CAAC8C,cAAc,CAACH,QAAQ,EAAE;QACrDhB,IAAI,EAAEP,WAAW;QACjBI,QAAQ;QACRuB,MAAM,EAAEN,EAAE,CAACM,MAAM;QACjBC,cAAc,EAAE;UACdC,IAAI,EAAEjC,GAAG,CAACkC,QAAQ;UAClBC,QAAQ,EAAEnC,GAAG,CAACmC,QAAQ;UACtBC,OAAO,EAAEpC,GAAG,CAACoC,OAAoC;UACjD3B;QACF,CAAC;QACD4B,WAAW,EAAE;MACf,CAAC,CAAC;MAEFpC,GAAG,CAACY,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B,OAAOb,IAAI,CAAC;QACVoC,OAAO,EAAE,IAAI;QACbtB,EAAE,EAAEa;MACN,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOV,GAAQ,EAAE;MACjB;MACAjB,IAAI,CAACiB,GAAG,CAAC;IACX;EACF,CAAC;AACH","ignoreList":[]}

package/build/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":["_core","require","_logger","_default","route","get","_req","res","logger","warn","status","HTTP_STATUS","NOT_FOUND","json","error"],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\n\nexport default function (route): void {\n  // TODO: next major version, remove this\n  route.get('/-/all(/since)?', function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAEe,SAAAE,SAAUC,KAAK,EAAQ;EACpC;EACAA,KAAK,CAACC,GAAG,CAAC,iBAAiB,EAAE,UAAUC,IAAI,EAAEC,GAAG,EAAE;IAChDC,cAAM,CAACC,IAAI,CAAC,wDAAwD,CAAC;IACrEF,GAAG,CAACG,MAAM,CAACC,iBAAW,CAACC,SAAS,CAAC;IACjCL,GAAG,CAACM,IAAI,CAAC;MAAEC,KAAK,EAAE;IAAkC,CAAC,CAAC;EACxD,CAAC,CAAC;AACJ"}
+{"version":3,"file":"search.js","names":["_core","require","_logger","_default","route","get","_req","res","logger","warn","status","HTTP_STATUS","NOT_FOUND","json","error"],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\n\nexport default function (route): void {\n  // TODO: next major version, remove this\n  route.get('/-/all(/since)?', function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AAEe,SAAAE,SAAUC,KAAK,EAAQ;EACpC;EACAA,KAAK,CAACC,GAAG,CAAC,iBAAiB,EAAE,UAAUC,IAAI,EAAEC,GAAG,EAAE;IAChDC,cAAM,CAACC,IAAI,CAAC,wDAAwD,CAAC;IACrEF,GAAG,CAACG,MAAM,CAACC,iBAAW,CAACC,SAAS,CAAC;IACjCL,GAAG,CAACM,IAAI,CAAC;MAAEC,KAAK,EAAE;IAAkC,CAAC,CAAC;EACxD,CAAC,CAAC;AACJ","ignoreList":[]}

package/build/stars.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = _default;
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 function _default(route, storage) {
   route.get('/-/_view/starredByUser', async (req, res, next) => {
     const query = req.query;

package/build/stars.js.map

@@ -1 +1 @@
-{"version":3,"file":"stars.js","names":["_lodash","_interopRequireDefault","require","_core","obj","__esModule","default","_default","route","storage","get","req","res","next","query","key","errorUtils","getBadRequest","localPackages","getLocalDatabase","filteredPackages","filter","localPackage","_","keys","USERS","includes","toString","replace","status","HTTP_STATUS","OK","rows","map","filteredPackage","value","name","err"],"sources":["../src/stars.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { Storage } from '@verdaccio/store';\nimport { Version } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    '/-/_view/starredByUser',\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          _.keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAAiE,SAAAD,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAMlD,SAAAG,SAAUC,KAAa,EAAEC,OAAgB,EAAQ;EAC9DD,KAAK,CAACE,GAAG,CACP,wBAAwB,EACxB,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAoB;IACnF,MAAMC,KAAsB,GAAGH,GAAG,CAACG,KAAK;IACxC,IAAI,QAAOA,KAAK,aAALA,KAAK,uBAALA,KAAK,CAAEC,GAAG,MAAK,QAAQ,EAAE;MAClC,OAAOF,IAAI,CAACG,gBAAU,CAACC,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACrE;IAEA,IAAI;MACF,MAAMC,aAAwB,GAAG,MAAMT,OAAO,CAACU,gBAAgB,CAAC,CAAC;MACjE,MAAMC,gBAA2B,GAAGF,aAAa,CAACG,MAAM,CAAEC,YAAqB,IAC7EC,eAAC,CAACC,IAAI,CAACF,YAAY,CAACG,WAAK,CAAC,CAAC,CAACC,QAAQ,CAACZ,KAAK,aAALA,KAAK,uBAALA,KAAK,CAAEC,GAAG,CAACY,QAAQ,CAAC,CAAC,CAACC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAClF,CAAC;MAEDhB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1BlB,IAAI,CAAC;QACHmB,IAAI,EAAEZ,gBAAgB,CAACa,GAAG,CAAEC,eAAwB,KAAM;UACxDC,KAAK,EAAED,eAAe,CAACE;QACzB,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,GAAQ,EAAE;MACjB,OAAOxB,IAAI,CAACwB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH"}
+{"version":3,"file":"stars.js","names":["_lodash","_interopRequireDefault","require","_core","e","__esModule","default","_default","route","storage","get","req","res","next","query","key","errorUtils","getBadRequest","localPackages","getLocalDatabase","filteredPackages","filter","localPackage","_","keys","USERS","includes","toString","replace","status","HTTP_STATUS","OK","rows","map","filteredPackage","value","name","err"],"sources":["../src/stars.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { Storage } from '@verdaccio/store';\nimport { Version } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    '/-/_view/starredByUser',\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          _.keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAAiE,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAMlD,SAAAG,SAAUC,KAAa,EAAEC,OAAgB,EAAQ;EAC9DD,KAAK,CAACE,GAAG,CACP,wBAAwB,EACxB,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAoB;IACnF,MAAMC,KAAsB,GAAGH,GAAG,CAACG,KAAK;IACxC,IAAI,QAAOA,KAAK,aAALA,KAAK,uBAALA,KAAK,CAAEC,GAAG,MAAK,QAAQ,EAAE;MAClC,OAAOF,IAAI,CAACG,gBAAU,CAACC,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACrE;IAEA,IAAI;MACF,MAAMC,aAAwB,GAAG,MAAMT,OAAO,CAACU,gBAAgB,CAAC,CAAC;MACjE,MAAMC,gBAA2B,GAAGF,aAAa,CAACG,MAAM,CAAEC,YAAqB,IAC7EC,eAAC,CAACC,IAAI,CAACF,YAAY,CAACG,WAAK,CAAC,CAAC,CAACC,QAAQ,CAACZ,KAAK,aAALA,KAAK,uBAALA,KAAK,CAAEC,GAAG,CAACY,QAAQ,CAAC,CAAC,CAACC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAClF,CAAC;MAEDhB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1BlB,IAAI,CAAC;QACHmB,IAAI,EAAEZ,gBAAgB,CAACa,GAAG,CAAEC,eAAwB,KAAM;UACxDC,KAAK,EAAED,eAAe,CAACE;QACzB,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,GAAQ,EAAE;MACjB,OAAOxB,IAAI,CAACwB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH","ignoreList":[]}

package/build/user.js

@@ -11,15 +11,27 @@ var _core = require("@verdaccio/core");
 var _logger = require("@verdaccio/logger");
 var _middleware = require("@verdaccio/middleware");
 var _utils = require("@verdaccio/utils");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:api:user');
 function _default(route, auth, config) {
   route.get('/-/user/:org_couchdb_user', (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), function (req, res, next) {
     debug('verifying user');
+    if (typeof req.remote_user.name !== 'string' || req.remote_user.name === '') {
+      debug('user not logged in');
+      res.status(_core.HTTP_STATUS.OK);
+      return next({
+        ok: false
+      });
+    }
+    const username = req.params.org_couchdb_user.split(':')[1];
     const message = (0, _utils.getAuthenticatedMessage)(req.remote_user.name);
     debug('user authenticated message %o', message);
     res.status(_core.HTTP_STATUS.OK);
     next({
+      // 'npm owner' requires user info
+      // TODO: we don't have the email
+      name: username,
+      email: '',
       ok: message
     });
   });
@@ -48,7 +60,10 @@ function _default(route, auth, config) {
       password
     } = req.body;
     debug('login or adduser');
-    const remoteName = req === null || req === void 0 ? void 0 : (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
+    const remoteName = req === null || req === void 0 || (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
+    if (!_core.validatioUtils.validateUserName(req.params.org_couchdb_user, name)) {
+      return next(_core.errorUtils.getBadRequest(_core.API_ERROR.USERNAME_MISMATCH));
+    }
     if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {
       debug('login: no remote user detected');
       auth.authenticate(name, password, async function callbackAuthenticate(err, user) {
@@ -76,7 +91,8 @@ function _default(route, auth, config) {
       });
     } else {
       var _config$serverSetting;
-      if (_core.validatioUtils.validatePassword(password, config === null || config === void 0 ? void 0 : (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
+      debug('adduser: %o', name);
+      if (_core.validatioUtils.validatePassword(password, config === null || config === void 0 || (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
         debug('adduser: invalid password');
         // eslint-disable-next-line new-cap
         return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.PASSWORD_SHORT));

package/build/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_auth","_config","_core","_logger","_middleware","_utils","obj","__esModule","default","debug","buildDebug","_default","route","auth","config","get","rateLimit","userRateLimit","req","res","next","message","getAuthenticatedMessage","remote_user","name","status","HTTP_STATUS","OK","ok","put","_req$remote_user","password","body","remoteName","authenticate","callbackAuthenticate","err","user","logger","trace","errorUtils","getCode","UNAUTHORIZED","API_ERROR","BAD_USERNAME_PASSWORD","restoredRemoteUser","createRemoteUser","groups","token","getApiToken","getUnauthorized","CREATED","set","HEADERS","CACHE_CONTROL","_config$serverSetting","validatioUtils","validatePassword","serverSettings","passwordValidationRegex","BAD_REQUEST","PASSWORD_SHORT","add_user","INTERNAL_ERROR","getConflict","undefined","mask","delete","API_MESSAGE","LOGGED_OUT"],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config, RemoteUser } from '@verdaccio/types';\nimport { getAuthenticatedMessage, mask } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  route.get(\n    '/-/user/:org_couchdb_user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n      const message = getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    '/-/user/:org_couchdb_user/:_rev?/:revision?',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n\n            const message = getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        if (\n          validatioUtils.validatePassword(\n            password,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          debug('adduser: invalid password');\n          // eslint-disable-next-line new-cap\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    '/-/user/token/*',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AAAiE,SAAAD,uBAAAQ,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAIjE,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAQ;EACxEF,KAAK,CAACG,GAAG,CACP,2BAA2B,EAC3B,IAAAC,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1EX,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMY,OAAO,GAAG,IAAAC,8BAAuB,EAACJ,GAAG,CAACK,WAAW,CAACC,IAAI,CAAC;IAC7Df,KAAK,CAAC,+BAA+B,EAAEY,OAAO,CAAC;IAC/CF,GAAG,CAACM,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BP,IAAI,CAAC;MACHQ,EAAE,EAAEP;IACN,CAAC,CAAC;EACJ,CACF,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACET,KAAK,CAACiB,GAAG,CACP,6CAA6C,EAC7C,IAAAb,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAAA,IAAAU,gBAAA;IAC1E,MAAM;MAAEN,IAAI;MAAEO;IAAS,CAAC,GAAGb,GAAG,CAACc,IAAI;IACnCvB,KAAK,CAAC,kBAAkB,CAAC;IACzB,MAAMwB,UAAU,GAAGf,GAAG,aAAHA,GAAG,wBAAAY,gBAAA,GAAHZ,GAAG,CAAEK,WAAW,cAAAO,gBAAA,uBAAhBA,gBAAA,CAAkBN,IAAI;IAEzC,IAAI,OAAOS,UAAU,KAAK,WAAW,IAAI,OAAOT,IAAI,KAAK,QAAQ,IAAIS,UAAU,KAAKT,IAAI,EAAE;MACxFf,KAAK,CAAC,gCAAgC,CAAC;MACvCI,IAAI,CAACqB,YAAY,CACfV,IAAI,EACJO,QAAQ,EACR,eAAeI,oBAAoBA,CAACC,GAAG,EAAEC,IAAI,EAAiB;QAC5D,IAAID,GAAG,EAAE;UACPE,cAAM,CAACC,KAAK,CACV;YAAEf,IAAI;YAAEY;UAAI,CAAC,EACb,mEACF,CAAC;UACD,OAAOhB,IAAI,CACToB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAACgB,YAAY,EAAEC,eAAS,CAACC,qBAAqB,CAC9E,CAAC;QACH;QAEA,MAAMC,kBAA8B,GAAG,IAAAC,wBAAgB,EAACtB,IAAI,EAAE,CAAAa,IAAI,aAAJA,IAAI,uBAAJA,IAAI,CAAEU,MAAM,KAAI,EAAE,CAAC;QACjF,MAAMC,KAAK,GAAG,MAAM,IAAAC,iBAAW,EAACpC,IAAI,EAAEC,MAAM,EAAE+B,kBAAkB,EAAEd,QAAQ,CAAC;QAC3EtB,KAAK,CAAC,kBAAkB,CAAC;QACzB,IAAI,CAACuC,KAAK,EAAE;UACV,OAAO5B,IAAI,CAACoB,gBAAU,CAACU,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEA/B,GAAG,CAACM,MAAM,CAACC,iBAAW,CAACyB,OAAO,CAAC;QAC/BhC,GAAG,CAACiC,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QAEpD,MAAMjC,OAAO,GAAG,IAAAC,8BAAuB,EAACJ,GAAG,CAACK,WAAW,CAACC,IAAI,CAAC;QAC7Df,KAAK,CAAC,gCAAgC,EAAEY,OAAO,CAAC;QAEhD,OAAOD,IAAI,CAAC;UACVQ,EAAE,EAAEP,OAAO;UACX2B;QACF,CAAC,CAAC;MACJ,CACF,CAAC;IACH,CAAC,MAAM;MAAA,IAAAO,qBAAA;MACL,IACEC,oBAAc,CAACC,gBAAgB,CAC7B1B,QAAQ,EACRjB,MAAM,aAANA,MAAM,wBAAAyC,qBAAA,GAANzC,MAAM,CAAE4C,cAAc,cAAAH,qBAAA,uBAAtBA,qBAAA,CAAwBI,uBAC1B,CAAC,KAAK,KAAK,EACX;QACAlD,KAAK,CAAC,2BAA2B,CAAC;QAClC;QACA,OAAOW,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAACkC,WAAW,EAAEjB,eAAS,CAACkB,cAAc,CAAC,CAAC;MACpF;MAEAhD,IAAI,CAACiD,QAAQ,CAACtC,IAAI,EAAEO,QAAQ,EAAE,gBAAgBK,GAAG,EAAEC,IAAI,EAAiB;QACtE,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACX,MAAM,IAAIC,iBAAW,CAACkC,WAAW,IAAIxB,GAAG,CAACX,MAAM,GAAGC,iBAAW,CAACqC,cAAc,EAAE;YACpFtD,KAAK,CAAC,+BAA+B,CAAC;YACtC;YACA;YACA;YACA,OAAOW,IAAI,CACToB,gBAAU,CAACC,OAAO,CAACL,GAAG,CAACX,MAAM,EAAEW,GAAG,CAACf,OAAO,CAAC,IAAImB,gBAAU,CAACwB,WAAW,CAAC5B,GAAG,CAACf,OAAO,CACnF,CAAC;UACH;UACA,OAAOD,IAAI,CAACgB,GAAG,CAAC;QAClB;QAEA,MAAMY,KAAK,GACTxB,IAAI,IAAIO,QAAQ,GACZ,MAAM,IAAAkB,iBAAW,EAACpC,IAAI,EAAEC,MAAM,EAAEuB,IAAI,EAAgBN,QAAQ,CAAC,GAC7DkC,SAAS;QACf,IAAIjB,KAAK,EAAE;UACTvC,KAAK,CAAC,uBAAuB,EAAE,IAAAyD,WAAI,EAAClB,KAAK,EAAY,CAAC,CAAC,CAAC;QAC1D;QACA,IAAI,CAACA,KAAK,EAAE;UACV,OAAO5B,IAAI,CAACoB,gBAAU,CAACU,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAhC,GAAG,CAACK,WAAW,GAAGc,IAAI;QACtBlB,GAAG,CAACM,MAAM,CAACC,iBAAW,CAACyB,OAAO,CAAC;QAC/BhC,GAAG,CAACiC,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpD7C,KAAK,CAAC,gCAAgC,CAAC;QACvC,OAAOW,IAAI,CAAC;UACVQ,EAAE,EAAG,SAAQV,GAAG,CAACc,IAAI,CAACR,IAAK,WAAU;UACrCwB;QACF,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ;EACF,CACF,CAAC;EAEDpC,KAAK,CAACuD,MAAM,CACV,iBAAiB,EACjB,UAAUjD,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1ED,GAAG,CAACM,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BP,IAAI,CAAC;MACHQ,EAAE,EAAEwC,iBAAW,CAACC;IAClB,CAAC,CAAC;EACJ,CACF,CAAC;AACH"}
+{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_auth","_config","_core","_logger","_middleware","_utils","e","__esModule","default","debug","buildDebug","_default","route","auth","config","get","rateLimit","userRateLimit","req","res","next","remote_user","name","status","HTTP_STATUS","OK","ok","username","params","org_couchdb_user","split","message","getAuthenticatedMessage","email","put","_req$remote_user","password","body","remoteName","validatioUtils","validateUserName","errorUtils","getBadRequest","API_ERROR","USERNAME_MISMATCH","authenticate","callbackAuthenticate","err","user","logger","trace","getCode","UNAUTHORIZED","BAD_USERNAME_PASSWORD","restoredRemoteUser","createRemoteUser","groups","token","getApiToken","getUnauthorized","CREATED","set","HEADERS","CACHE_CONTROL","_config$serverSetting","validatePassword","serverSettings","passwordValidationRegex","BAD_REQUEST","PASSWORD_SHORT","add_user","INTERNAL_ERROR","getConflict","undefined","mask","delete","API_MESSAGE","LOGGED_OUT"],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config, RemoteUser } from '@verdaccio/types';\nimport { getAuthenticatedMessage, mask } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  route.get(\n    '/-/user/:org_couchdb_user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (typeof req.remote_user.name !== 'string' || req.remote_user.name === '') {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    '/-/user/:org_couchdb_user/:_rev?/:revision?',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validatioUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n\n            const message = getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validatioUtils.validatePassword(\n            password,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          debug('adduser: invalid password');\n          // eslint-disable-next-line new-cap\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    '/-/user/token/*',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AAAiE,SAAAD,uBAAAQ,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAIjE,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAQ;EACxEF,KAAK,CAACG,GAAG,CACP,2BAA2B,EAC3B,IAAAC,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1EX,KAAK,CAAC,gBAAgB,CAAC;IAEvB,IAAI,OAAOS,GAAG,CAACG,WAAW,CAACC,IAAI,KAAK,QAAQ,IAAIJ,GAAG,CAACG,WAAW,CAACC,IAAI,KAAK,EAAE,EAAE;MAC3Eb,KAAK,CAAC,oBAAoB,CAAC;MAC3BU,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1B,OAAOL,IAAI,CAAC;QAAEM,EAAE,EAAE;MAAM,CAAC,CAAC;IAC5B;IAEA,MAAMC,QAAQ,GAAGT,GAAG,CAACU,MAAM,CAACC,gBAAgB,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAMC,OAAO,GAAG,IAAAC,8BAAuB,EAACd,GAAG,CAACG,WAAW,CAACC,IAAI,CAAC;IAC7Db,KAAK,CAAC,+BAA+B,EAAEsB,OAAO,CAAC;IAC/CZ,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BL,IAAI,CAAC;MACH;MACA;MACAE,IAAI,EAAEK,QAAQ;MACdM,KAAK,EAAE,EAAE;MACTP,EAAE,EAAEK;IACN,CAAC,CAAC;EACJ,CACF,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEnB,KAAK,CAACsB,GAAG,CACP,6CAA6C,EAC7C,IAAAlB,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAAA,IAAAe,gBAAA;IAC1E,MAAM;MAAEb,IAAI;MAAEc;IAAS,CAAC,GAAGlB,GAAG,CAACmB,IAAI;IACnC5B,KAAK,CAAC,kBAAkB,CAAC;IACzB,MAAM6B,UAAU,GAAGpB,GAAG,aAAHA,GAAG,gBAAAiB,gBAAA,GAAHjB,GAAG,CAAEG,WAAW,cAAAc,gBAAA,uBAAhBA,gBAAA,CAAkBb,IAAI;IAEzC,IAAI,CAACiB,oBAAc,CAACC,gBAAgB,CAACtB,GAAG,CAACU,MAAM,CAACC,gBAAgB,EAAEP,IAAI,CAAC,EAAE;MACvE,OAAOF,IAAI,CAACqB,gBAAU,CAACC,aAAa,CAACC,eAAS,CAACC,iBAAiB,CAAC,CAAC;IACpE;IAEA,IAAI,OAAON,UAAU,KAAK,WAAW,IAAI,OAAOhB,IAAI,KAAK,QAAQ,IAAIgB,UAAU,KAAKhB,IAAI,EAAE;MACxFb,KAAK,CAAC,gCAAgC,CAAC;MACvCI,IAAI,CAACgC,YAAY,CACfvB,IAAI,EACJc,QAAQ,EACR,eAAeU,oBAAoBA,CAACC,GAAG,EAAEC,IAAI,EAAiB;QAC5D,IAAID,GAAG,EAAE;UACPE,cAAM,CAACC,KAAK,CACV;YAAE5B,IAAI;YAAEyB;UAAI,CAAC,EACb,mEACF,CAAC;UACD,OAAO3B,IAAI,CACTqB,gBAAU,CAACU,OAAO,CAAC3B,iBAAW,CAAC4B,YAAY,EAAET,eAAS,CAACU,qBAAqB,CAC9E,CAAC;QACH;QAEA,MAAMC,kBAA8B,GAAG,IAAAC,wBAAgB,EAACjC,IAAI,EAAE,CAAA0B,IAAI,aAAJA,IAAI,uBAAJA,IAAI,CAAEQ,MAAM,KAAI,EAAE,CAAC;QACjF,MAAMC,KAAK,GAAG,MAAM,IAAAC,iBAAW,EAAC7C,IAAI,EAAEC,MAAM,EAAEwC,kBAAkB,EAAElB,QAAQ,CAAC;QAC3E3B,KAAK,CAAC,kBAAkB,CAAC;QACzB,IAAI,CAACgD,KAAK,EAAE;UACV,OAAOrC,IAAI,CAACqB,gBAAU,CAACkB,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAxC,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACoC,OAAO,CAAC;QAC/BzC,GAAG,CAAC0C,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QAEpD,MAAMhC,OAAO,GAAG,IAAAC,8BAAuB,EAACd,GAAG,CAACG,WAAW,CAACC,IAAI,CAAC;QAC7Db,KAAK,CAAC,gCAAgC,EAAEsB,OAAO,CAAC;QAEhD,OAAOX,IAAI,CAAC;UACVM,EAAE,EAAEK,OAAO;UACX0B;QACF,CAAC,CAAC;MACJ,CACF,CAAC;IACH,CAAC,MAAM;MAAA,IAAAO,qBAAA;MACLvD,KAAK,CAAC,aAAa,EAAEa,IAAI,CAAC;MAC1B,IACEiB,oBAAc,CAAC0B,gBAAgB,CAC7B7B,QAAQ,EACRtB,MAAM,aAANA,MAAM,gBAAAkD,qBAAA,GAANlD,MAAM,CAAEoD,cAAc,cAAAF,qBAAA,uBAAtBA,qBAAA,CAAwBG,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA1D,KAAK,CAAC,2BAA2B,CAAC;QAClC;QACA,OAAOW,IAAI,CAACqB,gBAAU,CAACU,OAAO,CAAC3B,iBAAW,CAAC4C,WAAW,EAAEzB,eAAS,CAAC0B,cAAc,CAAC,CAAC;MACpF;MAEAxD,IAAI,CAACyD,QAAQ,CAAChD,IAAI,EAAEc,QAAQ,EAAE,gBAAgBW,GAAG,EAAEC,IAAI,EAAiB;QACtE,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACxB,MAAM,IAAIC,iBAAW,CAAC4C,WAAW,IAAIrB,GAAG,CAACxB,MAAM,GAAGC,iBAAW,CAAC+C,cAAc,EAAE;YACpF9D,KAAK,CAAC,+BAA+B,CAAC;YACtC;YACA;YACA;YACA,OAAOW,IAAI,CACTqB,gBAAU,CAACU,OAAO,CAACJ,GAAG,CAACxB,MAAM,EAAEwB,GAAG,CAAChB,OAAO,CAAC,IAAIU,gBAAU,CAAC+B,WAAW,CAACzB,GAAG,CAAChB,OAAO,CACnF,CAAC;UACH;UACA,OAAOX,IAAI,CAAC2B,GAAG,CAAC;QAClB;QAEA,MAAMU,KAAK,GACTnC,IAAI,IAAIc,QAAQ,GACZ,MAAM,IAAAsB,iBAAW,EAAC7C,IAAI,EAAEC,MAAM,EAAEkC,IAAI,EAAgBZ,QAAQ,CAAC,GAC7DqC,SAAS;QACf,IAAIhB,KAAK,EAAE;UACThD,KAAK,CAAC,uBAAuB,EAAE,IAAAiE,WAAI,EAACjB,KAAK,EAAY,CAAC,CAAC,CAAC;QAC1D;QACA,IAAI,CAACA,KAAK,EAAE;UACV,OAAOrC,IAAI,CAACqB,gBAAU,CAACkB,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAzC,GAAG,CAACG,WAAW,GAAG2B,IAAI;QACtB7B,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACoC,OAAO,CAAC;QAC/BzC,GAAG,CAAC0C,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpDtD,KAAK,CAAC,gCAAgC,CAAC;QACvC,OAAOW,IAAI,CAAC;UACVM,EAAE,EAAE,SAASR,GAAG,CAACmB,IAAI,CAACf,IAAI,WAAW;UACrCmC;QACF,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ;EACF,CACF,CAAC;EAED7C,KAAK,CAAC+D,MAAM,CACV,iBAAiB,EACjB,UAAUzD,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1ED,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BL,IAAI,CAAC;MACHM,EAAE,EAAEkD,iBAAW,CAACC;IAClB,CAAC,CAAC;EACJ,CACF,CAAC;AACH","ignoreList":[]}

package/build/v1/profile.js

@@ -7,7 +7,7 @@ exports.default = _default;
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
 var _middleware = require("@verdaccio/middleware");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 function _default(route, auth, config) {
   function buildProfile(name) {
     return {
@@ -46,14 +46,17 @@ function _default(route, auth, config) {
     } = req.remote_user;
     if (_lodash.default.isNil(password) === false) {
       var _config$serverSetting;
-      if (_core.validatioUtils.validatePassword(password.new, config === null || config === void 0 ? void 0 : (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
+      if (_core.validatioUtils.validatePassword(password.new, config === null || config === void 0 || (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.passwordValidationRegex) === false) {
         /* eslint new-cap:off */
         return next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNAUTHORIZED, _core.API_ERROR.PASSWORD_SHORT));
         /* eslint new-cap:off */
       }
+      if (_lodash.default.isEmpty(password.old)) {
+        return next(_core.errorUtils.getBadRequest('old password is required'));
+      }
       auth.changePassword(name, password.old, password.new, (err, isUpdated) => {
         if (_lodash.default.isNull(err) === false) {
-          return next(_core.errorUtils.getCode(err.status, err.message) || _core.errorUtils.getConflict(err.message));
+          return next(_core.errorUtils.getForbidden(err.message));
         }
         if (isUpdated) {
           return next(buildProfile(req.remote_user.name));

package/build/v1/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","names":["_lodash","_interopRequireDefault","require","_core","_middleware","obj","__esModule","default","_default","route","auth","config","buildProfile","name","tfa","email","email_verified","created","updated","cidr_whitelist","fullname","get","rateLimit","userRateLimit","req","res","next","_","isNil","remote_user","status","HTTP_STATUS","UNAUTHORIZED","message","API_ERROR","MUST_BE_LOGGED","post","password","body","_config$serverSetting","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","errorUtils","getCode","PASSWORD_SHORT","changePassword","old","err","isUpdated","isNull","getConflict","getInternalError","INTERNAL_SERVER_ERROR","SERVICE_UNAVAILABLE","SUPPORT_ERRORS","TFA_DISABLED","INTERNAL_ERROR","APP_ERROR","PROFILE_ERROR"],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    '/-/npm/v1/user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    '/-/npm/v1/user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (_.isNil(password) === false) {\n        if (\n          validatioUtils.validatePassword(\n            password.new,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n          /* eslint new-cap:off */\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (_.isNull(err) === false) {\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (_.isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAQA,IAAAE,WAAA,GAAAF,OAAA;AAAkD,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAgBnC,SAAAG,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAQ;EACxE,SAASC,YAAYA,CAACC,IAAY,EAAW;IAC3C,OAAO;MACLC,GAAG,EAAE,KAAK;MACVD,IAAI;MACJE,KAAK,EAAE,EAAE;MACTC,cAAc,EAAE,KAAK;MACrBC,OAAO,EAAE,EAAE;MACXC,OAAO,EAAE,EAAE;MACXC,cAAc,EAAE,IAAI;MACpBC,QAAQ,EAAE;IACZ,CAAC;EACH;EAEAX,KAAK,CAACY,GAAG,CACP,gBAAgB,EAChB,IAAAC,qBAAS,EAACX,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEY,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3C,OAAOa,IAAI,CAACd,YAAY,CAACY,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,CAAC;IACjD;IAEAY,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;IACpC,OAAON,IAAI,CAAC;MACVO,OAAO,EAAEC,eAAS,CAACC;IACrB,CAAC,CAAC;EACJ,CACF,CAAC;EAED1B,KAAK,CAAC2B,IAAI,CACR,gBAAgB,EAChB,IAAAd,qBAAS,EAACX,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEY,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,EAAE;MACjCY,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;MACpC,OAAON,IAAI,CAAC;QACVO,OAAO,EAAEC,eAAS,CAACC;MACrB,CAAC,CAAC;IACJ;IAEA,MAAM;MAAEE,QAAQ;MAAEvB;IAAI,CAAC,GAAGU,GAAG,CAACc,IAAI;IAClC,MAAM;MAAEzB;IAAK,CAAC,GAAGW,GAAG,CAACK,WAAW;IAEhC,IAAIF,eAAC,CAACC,KAAK,CAACS,QAAQ,CAAC,KAAK,KAAK,EAAE;MAAA,IAAAE,qBAAA;MAC/B,IACEC,oBAAc,CAACC,gBAAgB,CAC7BJ,QAAQ,CAACK,GAAG,EACZ/B,MAAM,aAANA,MAAM,wBAAA4B,qBAAA,GAAN5B,MAAM,CAAEgC,cAAc,cAAAJ,qBAAA,uBAAtBA,qBAAA,CAAwBK,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA;QACA,OAAOlB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAACC,YAAY,EAAEE,eAAS,CAACa,cAAc,CAAC,CAAC;QACnF;MACF;MAEArC,IAAI,CAACsC,cAAc,CACjBnC,IAAI,EACJwB,QAAQ,CAACY,GAAG,EACZZ,QAAQ,CAACK,GAAG,EACZ,CAACQ,GAAG,EAAEC,SAAS,KAAuB;QACpC,IAAIxB,eAAC,CAACyB,MAAM,CAACF,GAAG,CAAC,KAAK,KAAK,EAAE;UAC3B,OAAOxB,IAAI,CACTmB,gBAAU,CAACC,OAAO,CAACI,GAAG,CAACpB,MAAM,EAAEoB,GAAG,CAACjB,OAAO,CAAC,IAAIY,gBAAU,CAACQ,WAAW,CAACH,GAAG,CAACjB,OAAO,CACnF,CAAC;QACH;QAEA,IAAIkB,SAAS,EAAE;UACb,OAAOzB,IAAI,CAACd,YAAY,CAACY,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,CAAC;QACjD;QACA,OAAOa,IAAI,CAACmB,gBAAU,CAACS,gBAAgB,CAACpB,eAAS,CAACqB,qBAAqB,CAAC,CAAC;MAC3E,CACF,CAAC;IACH,CAAC,MAAM,IAAI5B,eAAC,CAACC,KAAK,CAACd,GAAG,CAAC,KAAK,KAAK,EAAE;MACjC,OAAOY,IAAI,CACTmB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAACyB,mBAAmB,EAAEC,oBAAc,CAACC,YAAY,CACjF,CAAC;IACH,CAAC,MAAM;MACL,OAAOhC,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAAC4B,cAAc,EAAEC,eAAS,CAACC,aAAa,CAAC,CAAC;IACtF;EACF,CACF,CAAC;AACH"}
+{"version":3,"file":"profile.js","names":["_lodash","_interopRequireDefault","require","_core","_middleware","e","__esModule","default","_default","route","auth","config","buildProfile","name","tfa","email","email_verified","created","updated","cidr_whitelist","fullname","get","rateLimit","userRateLimit","req","res","next","_","isNil","remote_user","status","HTTP_STATUS","UNAUTHORIZED","message","API_ERROR","MUST_BE_LOGGED","post","password","body","_config$serverSetting","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","errorUtils","getCode","PASSWORD_SHORT","isEmpty","old","getBadRequest","changePassword","err","isUpdated","isNull","getForbidden","getInternalError","INTERNAL_SERVER_ERROR","SERVICE_UNAVAILABLE","SUPPORT_ERRORS","TFA_DISABLED","INTERNAL_ERROR","APP_ERROR","PROFILE_ERROR"],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    '/-/npm/v1/user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    '/-/npm/v1/user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (_.isNil(password) === false) {\n        if (\n          validatioUtils.validatePassword(\n            password.new,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n          /* eslint new-cap:off */\n        }\n\n        if (_.isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (_.isNull(err) === false) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (_.isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAQA,IAAAE,WAAA,GAAAF,OAAA;AAAkD,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAgBnC,SAAAG,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAQ;EACxE,SAASC,YAAYA,CAACC,IAAY,EAAW;IAC3C,OAAO;MACLC,GAAG,EAAE,KAAK;MACVD,IAAI;MACJE,KAAK,EAAE,EAAE;MACTC,cAAc,EAAE,KAAK;MACrBC,OAAO,EAAE,EAAE;MACXC,OAAO,EAAE,EAAE;MACXC,cAAc,EAAE,IAAI;MACpBC,QAAQ,EAAE;IACZ,CAAC;EACH;EAEAX,KAAK,CAACY,GAAG,CACP,gBAAgB,EAChB,IAAAC,qBAAS,EAACX,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEY,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3C,OAAOa,IAAI,CAACd,YAAY,CAACY,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,CAAC;IACjD;IAEAY,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;IACpC,OAAON,IAAI,CAAC;MACVO,OAAO,EAAEC,eAAS,CAACC;IACrB,CAAC,CAAC;EACJ,CACF,CAAC;EAED1B,KAAK,CAAC2B,IAAI,CACR,gBAAgB,EAChB,IAAAd,qBAAS,EAACX,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEY,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,EAAE;MACjCY,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;MACpC,OAAON,IAAI,CAAC;QACVO,OAAO,EAAEC,eAAS,CAACC;MACrB,CAAC,CAAC;IACJ;IAEA,MAAM;MAAEE,QAAQ;MAAEvB;IAAI,CAAC,GAAGU,GAAG,CAACc,IAAI;IAClC,MAAM;MAAEzB;IAAK,CAAC,GAAGW,GAAG,CAACK,WAAW;IAEhC,IAAIF,eAAC,CAACC,KAAK,CAACS,QAAQ,CAAC,KAAK,KAAK,EAAE;MAAA,IAAAE,qBAAA;MAC/B,IACEC,oBAAc,CAACC,gBAAgB,CAC7BJ,QAAQ,CAACK,GAAG,EACZ/B,MAAM,aAANA,MAAM,gBAAA4B,qBAAA,GAAN5B,MAAM,CAAEgC,cAAc,cAAAJ,qBAAA,uBAAtBA,qBAAA,CAAwBK,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA;QACA,OAAOlB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAACC,YAAY,EAAEE,eAAS,CAACa,cAAc,CAAC,CAAC;QACnF;MACF;MAEA,IAAIpB,eAAC,CAACqB,OAAO,CAACX,QAAQ,CAACY,GAAG,CAAC,EAAE;QAC3B,OAAOvB,IAAI,CAACmB,gBAAU,CAACK,aAAa,CAAC,0BAA0B,CAAC,CAAC;MACnE;MAEAxC,IAAI,CAACyC,cAAc,CACjBtC,IAAI,EACJwB,QAAQ,CAACY,GAAG,EACZZ,QAAQ,CAACK,GAAG,EACZ,CAACU,GAAG,EAAEC,SAAS,KAAuB;QACpC,IAAI1B,eAAC,CAAC2B,MAAM,CAACF,GAAG,CAAC,KAAK,KAAK,EAAE;UAC3B,OAAO1B,IAAI,CAACmB,gBAAU,CAACU,YAAY,CAACH,GAAG,CAACnB,OAAO,CAAC,CAAC;QACnD;QAEA,IAAIoB,SAAS,EAAE;UACb,OAAO3B,IAAI,CAACd,YAAY,CAACY,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,CAAC;QACjD;QACA,OAAOa,IAAI,CAACmB,gBAAU,CAACW,gBAAgB,CAACtB,eAAS,CAACuB,qBAAqB,CAAC,CAAC;MAC3E,CACF,CAAC;IACH,CAAC,MAAM,IAAI9B,eAAC,CAACC,KAAK,CAACd,GAAG,CAAC,KAAK,KAAK,EAAE;MACjC,OAAOY,IAAI,CACTmB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAAC2B,mBAAmB,EAAEC,oBAAc,CAACC,YAAY,CACjF,CAAC;IACH,CAAC,MAAM;MACL,OAAOlC,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACf,iBAAW,CAAC8B,cAAc,EAAEC,eAAS,CAACC,aAAa,CAAC,CAAC;IACtF;EACF,CACF,CAAC;AACH","ignoreList":[]}

package/build/v1/search.js

@@ -8,7 +8,7 @@ var _debug = _interopRequireDefault(require("debug"));
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
 var _logger = require("@verdaccio/logger");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:api:search');
 
 /**
@@ -22,7 +22,7 @@ function _default(route, auth, storage) {
     return new Promise((resolve, reject) => {
       var _pkg$package;
       auth.allow_access({
-        packageName: pkg === null || pkg === void 0 ? void 0 : (_pkg$package = pkg.package) === null || _pkg$package === void 0 ? void 0 : _pkg$package.name
+        packageName: pkg === null || pkg === void 0 || (_pkg$package = pkg.package) === null || _pkg$package === void 0 ? void 0 : _pkg$package.name
       }, remoteUser, function (err, allowed) {
         if (err) {
           if (err.status && String(err.status).match(/^4\d\d$/)) {
@@ -54,12 +54,13 @@ function _default(route, auth, storage) {
     size = parseInt(size, 10) || 20;
     from = parseInt(from, 10) || 0;
     try {
+      debug('storage search initiated');
       data = await storage.search({
         query,
         url,
         abort
       });
-      debug('stream finish');
+      debug('storage items tota: %o', data.length);
       const checkAccessPromises = await Promise.all(data.map(pkgItem => {
         return checkAccess(pkgItem, auth, req.remote_user);
       }));

package/build/v1/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_logger","obj","__esModule","default","debug","buildDebug","_default","route","auth","storage","checkAccess","pkg","remoteUser","Promise","resolve","reject","_pkg$package","allow_access","packageName","package","name","err","allowed","status","String","match","get","req","res","next","query","url","size","from","map","k","data","abort","AbortController","socket","on","parseInt","search","checkAccessPromises","all","pkgItem","remote_user","final","filter","i","_","isNull","slice","logger","length","response","objects","total","time","Date","toUTCString","HTTP_STATUS","OK","json","error"],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HTTP_STATUS, searchUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Storage } from '@verdaccio/store';\nimport { Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            allowed = false;\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get('/-/v1/search', async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n\n    req.socket.on('close', function () {\n      debug('search web aborted');\n      abort.abort();\n    });\n\n    size = parseInt(size, 10) || 20;\n    from = parseInt(from, 10) || 0;\n\n    try {\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('stream finish');\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => !_.isNull(i))\n        .slice(from, size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(next);\n      return;\n    }\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AAA2C,SAAAD,uBAAAK,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAI3C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACe,SAAAC,SAAUC,KAAK,EAAEC,IAAU,EAAEC,OAAgB,EAAQ;EAClE,SAASC,WAAWA,CAACC,GAAQ,EAAEH,IAAS,EAAEI,UAAU,EAA4B;IAC9E,OAAO,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;MAAA,IAAAC,YAAA;MACtCR,IAAI,CAACS,YAAY,CAAC;QAAEC,WAAW,EAAEP,GAAG,aAAHA,GAAG,wBAAAK,YAAA,GAAHL,GAAG,CAAEQ,OAAO,cAAAH,YAAA,uBAAZA,YAAA,CAAcI;MAAK,CAAC,EAAER,UAAU,EAAE,UAAUS,GAAG,EAAEC,OAAO,EAAE;QACzF,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACE,MAAM,IAAIC,MAAM,CAACH,GAAG,CAACE,MAAM,CAAC,CAACE,KAAK,CAAC,SAAS,CAAC,EAAE;YACrD;YACA;YACAH,OAAO,GAAG,KAAK;YACf,OAAOR,OAAO,CAAC,IAAI,CAAC;UACtB,CAAC,MAAM;YACLC,MAAM,CAACM,GAAG,CAAC;UACb;QACF,CAAC,MAAM;UACL,OAAOP,OAAO,CAACQ,OAAO,GAAGX,GAAG,GAAG,IAAI,CAAC;QACtC;MACF,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEAJ,KAAK,CAACmB,GAAG,CAAC,cAAc,EAAE,OAAOC,GAAG,EAAEC,GAAG,EAAEC,IAAI,KAAK;IAClD,MAAM;MAAEC,KAAK;MAAEC;IAAI,CAAC,GAAGJ,GAAG;IAC1B,IAAI,CAACK,IAAI,EAAEC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAACC,GAAG,CAAEC,CAAC,IAAKL,KAAK,CAACK,CAAC,CAAC,CAAC;IACxD,IAAIC,IAAI;IACR,MAAMC,KAAK,GAAG,IAAIC,eAAe,CAAC,CAAC;IAEnCX,GAAG,CAACY,MAAM,CAACC,EAAE,CAAC,OAAO,EAAE,YAAY;MACjCpC,KAAK,CAAC,oBAAoB,CAAC;MAC3BiC,KAAK,CAACA,KAAK,CAAC,CAAC;IACf,CAAC,CAAC;IAEFL,IAAI,GAAGS,QAAQ,CAACT,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC/BC,IAAI,GAAGQ,QAAQ,CAACR,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IAE9B,IAAI;MACFG,IAAI,GAAG,MAAM3B,OAAO,CAACiC,MAAM,CAAC;QAC1BZ,KAAK;QACLC,GAAG;QACHM;MACF,CAAC,CAAC;MACFjC,KAAK,CAAC,eAAe,CAAC;MACtB,MAAMuC,mBAAgD,GAAG,MAAM9B,OAAO,CAAC+B,GAAG,CACxER,IAAI,CAACF,GAAG,CAAEW,OAAO,IAAK;QACpB,OAAOnC,WAAW,CAACmC,OAAO,EAAErC,IAAI,EAAEmB,GAAG,CAACmB,WAAW,CAAC;MACpD,CAAC,CACH,CAAC;MAED,MAAMC,KAAkC,GAAGJ,mBAAmB,CAC3DK,MAAM,CAAEC,CAAC,IAAK,CAACC,eAAC,CAACC,MAAM,CAACF,CAAC,CAAC,CAAC,CAC3BG,KAAK,CAACnB,IAAI,EAAED,IAAI,CAAC;MACpBqB,cAAM,CAACjD,KAAK,CAAE,kBAAiB2C,KAAK,aAALA,KAAK,uBAALA,KAAK,CAAEO,MAAO,EAAC,CAAC;MAE/C,MAAMC,QAAmC,GAAG;QAC1CC,OAAO,EAAET,KAAK;QACdU,KAAK,EAAEV,KAAK,CAACO,MAAM;QACnBI,IAAI,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC;MAC/B,CAAC;MAEDhC,GAAG,CAACL,MAAM,CAACsC,iBAAW,CAACC,EAAE,CAAC,CAACC,IAAI,CAACR,QAAQ,CAAC;IAC3C,CAAC,CAAC,OAAOS,KAAK,EAAE;MACdX,cAAM,CAACW,KAAK,CAAC;QAAEA;MAAM,CAAC,EAAE,6CAA6C,CAAC;MACtEnC,IAAI,CAACA,IAAI,CAAC;MACV;IACF;EACF,CAAC,CAAC;AACJ"}
+{"version":3,"file":"search.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_logger","e","__esModule","default","debug","buildDebug","_default","route","auth","storage","checkAccess","pkg","remoteUser","Promise","resolve","reject","_pkg$package","allow_access","packageName","package","name","err","allowed","status","String","match","get","req","res","next","query","url","size","from","map","k","data","abort","AbortController","socket","on","parseInt","search","length","checkAccessPromises","all","pkgItem","remote_user","final","filter","i","_","isNull","slice","logger","response","objects","total","time","Date","toUTCString","HTTP_STATUS","OK","json","error"],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HTTP_STATUS, searchUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Storage } from '@verdaccio/store';\nimport { Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            allowed = false;\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get('/-/v1/search', async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n\n    req.socket.on('close', function () {\n      debug('search web aborted');\n      abort.abort();\n    });\n\n    size = parseInt(size, 10) || 20;\n    from = parseInt(from, 10) || 0;\n\n    try {\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => !_.isNull(i))\n        .slice(from, size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(next);\n      return;\n    }\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AAA2C,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI3C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACe,SAAAC,SAAUC,KAAK,EAAEC,IAAU,EAAEC,OAAgB,EAAQ;EAClE,SAASC,WAAWA,CAACC,GAAQ,EAAEH,IAAS,EAAEI,UAAU,EAA4B;IAC9E,OAAO,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;MAAA,IAAAC,YAAA;MACtCR,IAAI,CAACS,YAAY,CAAC;QAAEC,WAAW,EAAEP,GAAG,aAAHA,GAAG,gBAAAK,YAAA,GAAHL,GAAG,CAAEQ,OAAO,cAAAH,YAAA,uBAAZA,YAAA,CAAcI;MAAK,CAAC,EAAER,UAAU,EAAE,UAAUS,GAAG,EAAEC,OAAO,EAAE;QACzF,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACE,MAAM,IAAIC,MAAM,CAACH,GAAG,CAACE,MAAM,CAAC,CAACE,KAAK,CAAC,SAAS,CAAC,EAAE;YACrD;YACA;YACAH,OAAO,GAAG,KAAK;YACf,OAAOR,OAAO,CAAC,IAAI,CAAC;UACtB,CAAC,MAAM;YACLC,MAAM,CAACM,GAAG,CAAC;UACb;QACF,CAAC,MAAM;UACL,OAAOP,OAAO,CAACQ,OAAO,GAAGX,GAAG,GAAG,IAAI,CAAC;QACtC;MACF,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEAJ,KAAK,CAACmB,GAAG,CAAC,cAAc,EAAE,OAAOC,GAAG,EAAEC,GAAG,EAAEC,IAAI,KAAK;IAClD,MAAM;MAAEC,KAAK;MAAEC;IAAI,CAAC,GAAGJ,GAAG;IAC1B,IAAI,CAACK,IAAI,EAAEC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAACC,GAAG,CAAEC,CAAC,IAAKL,KAAK,CAACK,CAAC,CAAC,CAAC;IACxD,IAAIC,IAAI;IACR,MAAMC,KAAK,GAAG,IAAIC,eAAe,CAAC,CAAC;IAEnCX,GAAG,CAACY,MAAM,CAACC,EAAE,CAAC,OAAO,EAAE,YAAY;MACjCpC,KAAK,CAAC,oBAAoB,CAAC;MAC3BiC,KAAK,CAACA,KAAK,CAAC,CAAC;IACf,CAAC,CAAC;IAEFL,IAAI,GAAGS,QAAQ,CAACT,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC/BC,IAAI,GAAGQ,QAAQ,CAACR,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IAE9B,IAAI;MACF7B,KAAK,CAAC,0BAA0B,CAAC;MACjCgC,IAAI,GAAG,MAAM3B,OAAO,CAACiC,MAAM,CAAC;QAC1BZ,KAAK;QACLC,GAAG;QACHM;MACF,CAAC,CAAC;MACFjC,KAAK,CAAC,wBAAwB,EAAEgC,IAAI,CAACO,MAAM,CAAC;MAC5C,MAAMC,mBAAgD,GAAG,MAAM/B,OAAO,CAACgC,GAAG,CACxET,IAAI,CAACF,GAAG,CAAEY,OAAO,IAAK;QACpB,OAAOpC,WAAW,CAACoC,OAAO,EAAEtC,IAAI,EAAEmB,GAAG,CAACoB,WAAW,CAAC;MACpD,CAAC,CACH,CAAC;MAED,MAAMC,KAAkC,GAAGJ,mBAAmB,CAC3DK,MAAM,CAAEC,CAAC,IAAK,CAACC,eAAC,CAACC,MAAM,CAACF,CAAC,CAAC,CAAC,CAC3BG,KAAK,CAACpB,IAAI,EAAED,IAAI,CAAC;MACpBsB,cAAM,CAAClD,KAAK,CAAC,kBAAkB4C,KAAK,aAALA,KAAK,uBAALA,KAAK,CAAEL,MAAM,EAAE,CAAC;MAE/C,MAAMY,QAAmC,GAAG;QAC1CC,OAAO,EAAER,KAAK;QACdS,KAAK,EAAET,KAAK,CAACL,MAAM;QACnBe,IAAI,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC;MAC/B,CAAC;MAEDhC,GAAG,CAACL,MAAM,CAACsC,iBAAW,CAACC,EAAE,CAAC,CAACC,IAAI,CAACR,QAAQ,CAAC;IAC3C,CAAC,CAAC,OAAOS,KAAK,EAAE;MACdV,cAAM,CAACU,KAAK,CAAC;QAAEA;MAAM,CAAC,EAAE,6CAA6C,CAAC;MACtEnC,IAAI,CAACA,IAAI,CAAC;MACV;IACF;EACF,CAAC,CAAC;AACJ","ignoreList":[]}

package/build/v1/token.js

@@ -10,7 +10,7 @@ var _core = require("@verdaccio/core");
 var _logger = require("@verdaccio/logger");
 var _middleware = require("@verdaccio/middleware");
 var _utils = require("@verdaccio/utils");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 function normalizeToken(token) {
   return {
     ...token,

package/build/v1/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["_lodash","_interopRequireDefault","require","_auth","_core","_logger","_middleware","_utils","obj","__esModule","default","normalizeToken","token","created","Date","toISOString","_default","route","auth","storage","config","get","rateLimit","userRateLimit","req","res","next","name","remote_user","_","isNil","tokens","readTokens","user","totalTokens","length","logger","debug","status","HTTP_STATUS","OK","objects","map","urls","error","msg","errorUtils","getCode","INTERNAL_ERROR","message","getUnauthorized","post","password","readonly","cidr_whitelist","body","isBoolean","isArray","BAD_DATA","SUPPORT_ERRORS","PARAMETERS_NOT_VALID","authenticate","err","errorCode","UNAUTHORIZED","isFunction","saveToken","NOT_IMPLEMENTED","STORAGE_NOT_IMPLEMENT","getApiToken","getInternalError","key","stringToMD5","maskedToken","mask","getTime","cidr","set","HEADERS","CACHE_CONTROL","delete","params","tokenKey","deleteToken","info"],"sources":["../../src/v1/token.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config, RemoteUser, Token } from '@verdaccio/types';\nimport { mask, stringToMD5 } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  created: string;\n};\n\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (route: Router, auth: Auth, storage: Storage, config: Config): void {\n  route.get(\n    '/-/npm/v1/tokens',\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    '/-/npm/v1/tokens',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!_.isBoolean(readonly) || !_.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (!_.isFunction(storage.saveToken)) {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const token = await getApiToken(auth, config, user as RemoteUser, password);\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          const key = stringToMD5(token);\n          // TODO: use a utility here\n          const maskedToken = mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    '/-/npm/v1/tokens/token/:tokenKey',\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAGA,IAAAK,MAAA,GAAAL,OAAA;AAAqD,SAAAD,uBAAAO,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAQrD,SAASG,cAAcA,CAACC,KAAY,EAAkB;EACpD,OAAO;IACL,GAAGA,KAAK;IACRC,OAAO,EAAE,IAAIC,IAAI,CAACF,KAAK,CAACC,OAAO,CAAC,CAACE,WAAW,CAAC;EAC/C,CAAC;AACH;;AAEA;AACe,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAC1FH,KAAK,CAACI,GAAG,CACP,kBAAkB,EAClB,IAAAC,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,gBAAgBC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IAC1E,MAAM;MAAEC;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3B,IAAI;QACF,MAAMI,MAAM,GAAG,MAAMZ,OAAO,CAACa,UAAU,CAAC;UAAEC,IAAI,EAAEN;QAAK,CAAC,CAAC;QACvD,MAAMO,WAAW,GAAGH,MAAM,CAACI,MAAM;QACjCC,cAAM,CAACC,KAAK,CAAC;UAAEH;QAAY,CAAC,EAAE,sCAAsC,CAAC;QAErET,GAAG,CAACa,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;QAC1B,OAAOd,IAAI,CAAC;UACVe,OAAO,EAAEV,MAAM,CAACW,GAAG,CAAC/B,cAAc,CAAC;UACnCgC,IAAI,EAAE;YACJjB,IAAI,EAAE,EAAE,CAAE;UACZ;QACF,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOkB,KAAU,EAAE;QACnBR,cAAM,CAACQ,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,iCAAiC,CAAC;QACrE,OAAOnB,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOvB,IAAI,CAACoB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;EAEDjC,KAAK,CAACkC,IAAI,CACR,kBAAkB,EAClB,IAAA7B,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IACpE,MAAM;MAAE0B,QAAQ;MAAEC,QAAQ;MAAEC;IAAe,CAAC,GAAG9B,GAAG,CAAC+B,IAAI;IACvD,MAAM;MAAE5B;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAI,CAACC,eAAC,CAAC2B,SAAS,CAACH,QAAQ,CAAC,IAAI,CAACxB,eAAC,CAAC4B,OAAO,CAACH,cAAc,CAAC,EAAE;MACxD,OAAO5B,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACmB,QAAQ,EAAEC,oBAAc,CAACC,oBAAoB,CAAC,CAAC;IAC5F;IAEA1C,IAAI,CAAC2C,YAAY,CAAClC,IAAI,EAAEyB,QAAQ,EAAE,OAAOU,GAAG,EAAE7B,IAAiB,KAAK;MAClE,IAAI6B,GAAG,EAAE;QACP,MAAMC,SAAS,GAAGD,GAAG,CAACb,OAAO,GAAGV,iBAAW,CAACyB,YAAY,GAAGzB,iBAAW,CAACS,cAAc;QACrF,OAAOtB,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACgB,SAAS,EAAED,GAAG,CAACb,OAAO,CAAC,CAAC;MACzD;MAEAzB,GAAG,CAACI,WAAW,GAAGK,IAAI;MAEtB,IAAI,CAACJ,eAAC,CAACoC,UAAU,CAAC9C,OAAO,CAAC+C,SAAS,CAAC,EAAE;QACpC,OAAOxC,IAAI,CACToB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAAC4B,eAAe,EAAER,oBAAc,CAACS,qBAAqB,CACtF,CAAC;MACH;MAEA,IAAI;QACF,MAAMxD,KAAK,GAAG,MAAM,IAAAyD,iBAAW,EAACnD,IAAI,EAAEE,MAAM,EAAEa,IAAI,EAAgBmB,QAAQ,CAAC;QAC3E,IAAI,CAACxC,KAAK,EAAE;UACV,MAAMkC,gBAAU,CAACwB,gBAAgB,CAAC,CAAC;QACrC;QAEA,MAAMC,GAAG,GAAG,IAAAC,kBAAW,EAAC5D,KAAK,CAAC;QAC9B;QACA,MAAM6D,WAAW,GAAG,IAAAC,WAAI,EAAC9D,KAAK,EAAE,CAAC,CAAC;QAClC,MAAMC,OAAO,GAAG,IAAIC,IAAI,CAAC,CAAC,CAAC6D,OAAO,CAAC,CAAC;;QAEpC;AACV;AACA;AACA;AACA;QACU,MAAMT,SAAgB,GAAG;UACvBjC,IAAI,EAAEN,IAAI;UACVf,KAAK,EAAE6D,WAAW;UAClBF,GAAG;UACHK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACRxC;QACF,CAAC;QAED,MAAMM,OAAO,CAAC+C,SAAS,CAACA,SAAS,CAAC;QAClC9B,cAAM,CAACC,KAAK,CAAC;UAAEkC,GAAG;UAAE5C;QAAK,CAAC,EAAE,2CAA2C,CAAC;QACxEF,GAAG,CAACoD,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpD,OAAOrD,IAAI,CACTf,cAAc,CAAC;UACbC,KAAK;UACLqB,IAAI,EAAEN,IAAI;UACV4C,GAAG,EAAEL,SAAS,CAACK,GAAG;UAClBK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACRxC,OAAO,EAAEqD,SAAS,CAACrD;QACrB,CAAC,CACH,CAAC;MACH,CAAC,CAAC,OAAO+B,KAAU,EAAE;QACnBR,cAAM,CAACQ,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOnB,IAAI,CAACoB,gBAAU,CAACwB,gBAAgB,CAAC1B,KAAK,CAACK,OAAO,CAAC,CAAC;MACzD;IACF,CAAC,CAAC;EACJ,CACF,CAAC;EAEDhC,KAAK,CAAC+D,MAAM,CACV,kCAAkC,EAClC,IAAA1D,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAK;IACpE,MAAM;MACJuD,MAAM,EAAE;QAAEC;MAAS;IACrB,CAAC,GAAG1D,GAAG;IACP,MAAM;MAAEG;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3BS,cAAM,CAACC,KAAK,CAAC;QAAEV;MAAK,CAAC,EAAE,sCAAsC,CAAC;MAC9D,IAAI;QACF,MAAMR,OAAO,CAACgE,WAAW,CAACxD,IAAI,EAAEuD,QAAQ,CAAC;QACzC9C,cAAM,CAACgD,IAAI,CAAC;UAAEF,QAAQ;UAAEvD;QAAK,CAAC,EAAE,mDAAmD,CAAC;QACpF,OAAOD,IAAI,CAAC,CAAC,CAAC,CAAC;MACjB,CAAC,CAAC,OAAOkB,KAAU,EAAE;QACnBR,cAAM,CAACQ,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOnB,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOvB,IAAI,CAACoB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;AACH"}
+{"version":3,"file":"token.js","names":["_lodash","_interopRequireDefault","require","_auth","_core","_logger","_middleware","_utils","e","__esModule","default","normalizeToken","token","created","Date","toISOString","_default","route","auth","storage","config","get","rateLimit","userRateLimit","req","res","next","name","remote_user","_","isNil","tokens","readTokens","user","totalTokens","length","logger","debug","status","HTTP_STATUS","OK","objects","map","urls","error","msg","errorUtils","getCode","INTERNAL_ERROR","message","getUnauthorized","post","password","readonly","cidr_whitelist","body","isBoolean","isArray","BAD_DATA","SUPPORT_ERRORS","PARAMETERS_NOT_VALID","authenticate","err","errorCode","UNAUTHORIZED","isFunction","saveToken","NOT_IMPLEMENTED","STORAGE_NOT_IMPLEMENT","getApiToken","getInternalError","key","stringToMD5","maskedToken","mask","getTime","cidr","set","HEADERS","CACHE_CONTROL","delete","params","tokenKey","deleteToken","info"],"sources":["../../src/v1/token.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config, RemoteUser, Token } from '@verdaccio/types';\nimport { mask, stringToMD5 } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  created: string;\n};\n\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (route: Router, auth: Auth, storage: Storage, config: Config): void {\n  route.get(\n    '/-/npm/v1/tokens',\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    '/-/npm/v1/tokens',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!_.isBoolean(readonly) || !_.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (!_.isFunction(storage.saveToken)) {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const token = await getApiToken(auth, config, user as RemoteUser, password);\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          const key = stringToMD5(token);\n          // TODO: use a utility here\n          const maskedToken = mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    '/-/npm/v1/tokens/token/:tokenKey',\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,WAAA,GAAAJ,OAAA;AAGA,IAAAK,MAAA,GAAAL,OAAA;AAAqD,SAAAD,uBAAAO,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAQrD,SAASG,cAAcA,CAACC,KAAY,EAAkB;EACpD,OAAO;IACL,GAAGA,KAAK;IACRC,OAAO,EAAE,IAAIC,IAAI,CAACF,KAAK,CAACC,OAAO,CAAC,CAACE,WAAW,CAAC;EAC/C,CAAC;AACH;;AAEA;AACe,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAC1FH,KAAK,CAACI,GAAG,CACP,kBAAkB,EAClB,IAAAC,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,gBAAgBC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IAC1E,MAAM;MAAEC;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3B,IAAI;QACF,MAAMI,MAAM,GAAG,MAAMZ,OAAO,CAACa,UAAU,CAAC;UAAEC,IAAI,EAAEN;QAAK,CAAC,CAAC;QACvD,MAAMO,WAAW,GAAGH,MAAM,CAACI,MAAM;QACjCC,cAAM,CAACC,KAAK,CAAC;UAAEH;QAAY,CAAC,EAAE,sCAAsC,CAAC;QAErET,GAAG,CAACa,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;QAC1B,OAAOd,IAAI,CAAC;UACVe,OAAO,EAAEV,MAAM,CAACW,GAAG,CAAC/B,cAAc,CAAC;UACnCgC,IAAI,EAAE;YACJjB,IAAI,EAAE,EAAE,CAAE;UACZ;QACF,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOkB,KAAU,EAAE;QACnBR,cAAM,CAACQ,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,iCAAiC,CAAC;QACrE,OAAOnB,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOvB,IAAI,CAACoB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;EAEDjC,KAAK,CAACkC,IAAI,CACR,kBAAkB,EAClB,IAAA7B,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IACpE,MAAM;MAAE0B,QAAQ;MAAEC,QAAQ;MAAEC;IAAe,CAAC,GAAG9B,GAAG,CAAC+B,IAAI;IACvD,MAAM;MAAE5B;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAI,CAACC,eAAC,CAAC2B,SAAS,CAACH,QAAQ,CAAC,IAAI,CAACxB,eAAC,CAAC4B,OAAO,CAACH,cAAc,CAAC,EAAE;MACxD,OAAO5B,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACmB,QAAQ,EAAEC,oBAAc,CAACC,oBAAoB,CAAC,CAAC;IAC5F;IAEA1C,IAAI,CAAC2C,YAAY,CAAClC,IAAI,EAAEyB,QAAQ,EAAE,OAAOU,GAAG,EAAE7B,IAAiB,KAAK;MAClE,IAAI6B,GAAG,EAAE;QACP,MAAMC,SAAS,GAAGD,GAAG,CAACb,OAAO,GAAGV,iBAAW,CAACyB,YAAY,GAAGzB,iBAAW,CAACS,cAAc;QACrF,OAAOtB,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACgB,SAAS,EAAED,GAAG,CAACb,OAAO,CAAC,CAAC;MACzD;MAEAzB,GAAG,CAACI,WAAW,GAAGK,IAAI;MAEtB,IAAI,CAACJ,eAAC,CAACoC,UAAU,CAAC9C,OAAO,CAAC+C,SAAS,CAAC,EAAE;QACpC,OAAOxC,IAAI,CACToB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAAC4B,eAAe,EAAER,oBAAc,CAACS,qBAAqB,CACtF,CAAC;MACH;MAEA,IAAI;QACF,MAAMxD,KAAK,GAAG,MAAM,IAAAyD,iBAAW,EAACnD,IAAI,EAAEE,MAAM,EAAEa,IAAI,EAAgBmB,QAAQ,CAAC;QAC3E,IAAI,CAACxC,KAAK,EAAE;UACV,MAAMkC,gBAAU,CAACwB,gBAAgB,CAAC,CAAC;QACrC;QAEA,MAAMC,GAAG,GAAG,IAAAC,kBAAW,EAAC5D,KAAK,CAAC;QAC9B;QACA,MAAM6D,WAAW,GAAG,IAAAC,WAAI,EAAC9D,KAAK,EAAE,CAAC,CAAC;QAClC,MAAMC,OAAO,GAAG,IAAIC,IAAI,CAAC,CAAC,CAAC6D,OAAO,CAAC,CAAC;;QAEpC;AACV;AACA;AACA;AACA;QACU,MAAMT,SAAgB,GAAG;UACvBjC,IAAI,EAAEN,IAAI;UACVf,KAAK,EAAE6D,WAAW;UAClBF,GAAG;UACHK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACRxC;QACF,CAAC;QAED,MAAMM,OAAO,CAAC+C,SAAS,CAACA,SAAS,CAAC;QAClC9B,cAAM,CAACC,KAAK,CAAC;UAAEkC,GAAG;UAAE5C;QAAK,CAAC,EAAE,2CAA2C,CAAC;QACxEF,GAAG,CAACoD,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpD,OAAOrD,IAAI,CACTf,cAAc,CAAC;UACbC,KAAK;UACLqB,IAAI,EAAEN,IAAI;UACV4C,GAAG,EAAEL,SAAS,CAACK,GAAG;UAClBK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACRxC,OAAO,EAAEqD,SAAS,CAACrD;QACrB,CAAC,CACH,CAAC;MACH,CAAC,CAAC,OAAO+B,KAAU,EAAE;QACnBR,cAAM,CAACQ,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOnB,IAAI,CAACoB,gBAAU,CAACwB,gBAAgB,CAAC1B,KAAK,CAACK,OAAO,CAAC,CAAC;MACzD;IACF,CAAC,CAAC;EACJ,CACF,CAAC;EAEDhC,KAAK,CAAC+D,MAAM,CACV,kCAAkC,EAClC,IAAA1D,qBAAS,EAACF,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,CAAC,EAChC,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAK;IACpE,MAAM;MACJuD,MAAM,EAAE;QAAEC;MAAS;IACrB,CAAC,GAAG1D,GAAG;IACP,MAAM;MAAEG;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3BS,cAAM,CAACC,KAAK,CAAC;QAAEV;MAAK,CAAC,EAAE,sCAAsC,CAAC;MAC9D,IAAI;QACF,MAAMR,OAAO,CAACgE,WAAW,CAACxD,IAAI,EAAEuD,QAAQ,CAAC;QACzC9C,cAAM,CAACgD,IAAI,CAAC;UAAEF,QAAQ;UAAEvD;QAAK,CAAC,EAAE,mDAAmD,CAAC;QACpF,OAAOD,IAAI,CAAC,CAAC,CAAC,CAAC;MACjB,CAAC,CAAC,OAAOkB,KAAU,EAAE;QACnBR,cAAM,CAACQ,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOnB,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOvB,IAAI,CAACoB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;AACH","ignoreList":[]}

package/build/whoami.js

@@ -6,13 +6,13 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = _default;
 var _debug = _interopRequireDefault(require("debug"));
 var _core = require("@verdaccio/core");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:api:user');
 function _default(route) {
   route.get('/-/whoami', (req, _res, next) => {
     var _req$remote_user;
     // remote_user is set by the auth middleware
-    const username = req === null || req === void 0 ? void 0 : (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
+    const username = req === null || req === void 0 || (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
     if (!username) {
       debug('whoami: user not found');
       return next(_core.errorUtils.getUnauthorized('Unauthorized'));

package/build/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","names":["_debug","_interopRequireDefault","require","_core","obj","__esModule","default","debug","buildDebug","_default","route","get","req","_res","next","_req$remote_user","username","remote_user","name","errorUtils","getUnauthorized"],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get('/-/whoami', (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n    // remote_user is set by the auth middleware\n    const username = req?.remote_user?.name;\n    if (!username) {\n      debug('whoami: user not found');\n      return next(errorUtils.getUnauthorized('Unauthorized'));\n    }\n\n    debug('whoami: response %o', username);\n    return next({ username: username });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAA6C,SAAAD,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAQ;EAC5CA,KAAK,CAACC,GAAG,CAAC,WAAW,EAAE,CAACC,GAAmB,EAAEC,IAAc,EAAEC,IAAsB,KAAU;IAAA,IAAAC,gBAAA;IAC3F;IACA,MAAMC,QAAQ,GAAGJ,GAAG,aAAHA,GAAG,wBAAAG,gBAAA,GAAHH,GAAG,CAAEK,WAAW,cAAAF,gBAAA,uBAAhBA,gBAAA,CAAkBG,IAAI;IACvC,IAAI,CAACF,QAAQ,EAAE;MACbT,KAAK,CAAC,wBAAwB,CAAC;MAC/B,OAAOO,IAAI,CAACK,gBAAU,CAACC,eAAe,CAAC,cAAc,CAAC,CAAC;IACzD;IAEAb,KAAK,CAAC,qBAAqB,EAAES,QAAQ,CAAC;IACtC,OAAOF,IAAI,CAAC;MAAEE,QAAQ,EAAEA;IAAS,CAAC,CAAC;EACrC,CAAC,CAAC;AACJ"}
+{"version":3,"file":"whoami.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","_default","route","get","req","_res","next","_req$remote_user","username","remote_user","name","errorUtils","getUnauthorized"],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get('/-/whoami', (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n    // remote_user is set by the auth middleware\n    const username = req?.remote_user?.name;\n    if (!username) {\n      debug('whoami: user not found');\n      return next(errorUtils.getUnauthorized('Unauthorized'));\n    }\n\n    debug('whoami: response %o', username);\n    return next({ username: username });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAA6C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAQ;EAC5CA,KAAK,CAACC,GAAG,CAAC,WAAW,EAAE,CAACC,GAAmB,EAAEC,IAAc,EAAEC,IAAsB,KAAU;IAAA,IAAAC,gBAAA;IAC3F;IACA,MAAMC,QAAQ,GAAGJ,GAAG,aAAHA,GAAG,gBAAAG,gBAAA,GAAHH,GAAG,CAAEK,WAAW,cAAAF,gBAAA,uBAAhBA,gBAAA,CAAkBG,IAAI;IACvC,IAAI,CAACF,QAAQ,EAAE;MACbT,KAAK,CAAC,wBAAwB,CAAC;MAC/B,OAAOO,IAAI,CAACK,gBAAU,CAACC,eAAe,CAAC,cAAc,CAAC,CAAC;IACzD;IAEAb,KAAK,CAAC,qBAAqB,EAAES,QAAQ,CAAC;IACtC,OAAOF,IAAI,CAAC;MAAEE,QAAQ,EAAEA;IAAS,CAAC,CAAC;EACrC,CAAC,CAAC;AACJ","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "7.0.0-next.6",
+  "version": "7.0.1-next-8.1",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,28 +29,28 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "7.0.0-next.6",
-    "@verdaccio/config": "7.0.0-next.6",
-    "@verdaccio/core": "7.0.0-next.6",
-    "@verdaccio/logger": "7.0.0-next.6",
-    "@verdaccio/middleware": "7.0.0-next.6",
-    "@verdaccio/store": "7.0.0-next.6",
-    "@verdaccio/utils": "7.0.0-next.6",
+    "@verdaccio/auth": "8.0.0-next-8.1",
+    "@verdaccio/config": "8.0.0-next-8.1",
+    "@verdaccio/core": "8.0.0-next-8.1",
+    "@verdaccio/logger": "8.0.0-next-8.1",
+    "@verdaccio/middleware": "8.0.0-next-8.1",
+    "@verdaccio/store": "8.0.0-next-8.1",
+    "@verdaccio/utils": "7.0.1-next-8.1",
     "abortcontroller-polyfill": "1.7.5",
-    "body-parser": "1.20.2",
+    "body-parser": "1.20.3",
     "cookies": "0.9.0",
-    "debug": "4.3.4",
-    "express": "4.18.2",
+    "debug": "4.3.7",
+    "express": "4.21.0",
     "lodash": "4.17.21",
     "mime": "2.6.0",
-    "semver": "7.5.4"
+    "semver": "7.6.3"
   },
   "devDependencies": {
-    "@verdaccio/test-helper": "3.0.0-next.1",
-    "@verdaccio/types": "12.0.0-next.2",
+    "@verdaccio/test-helper": "4.0.0-next-8.0",
+    "@verdaccio/types": "13.0.0-next-8.0",
     "mockdate": "3.0.5",
-    "nock": "13.4.0",
-    "supertest": "6.3.3"
+    "nock": "13.5.1",
+    "supertest": "7.0.0"
   },
   "funding": {
     "type": "opencollective",
@@ -58,7 +58,7 @@
   },
   "scripts": {
     "clean": "rimraf ./build",
-    "test": "jest",
+    "test": "vitest run",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",

package/src/index.ts

@@ -37,10 +37,11 @@ export default function (config: Config, auth: Auth, storage: Storage): Router {
   app.param('revision', validateName);
   app.param('token', validateName);
 
-  // these can't be safely put into express url for some reason
-  // TODO: For some reason? what reason?
+  // Express route parameter names must be valid JavaScript identifiers, which means
+  // they cannot start with a hyphen (-) or contain special characters like dots (.)
   app.param('_rev', match(/^-rev$/));
   app.param('org_couchdb_user', match(/^org\.couchdb\.user:/));
+
   app.use(auth.apiJWTmiddleware());
   app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));
   app.use(antiLoop(config));

package/src/package.ts

@@ -28,6 +28,7 @@ export default function (route: Router, auth: Auth, storage: Storage): void {
       const name = req.params.package;
       let version = req.params.version;
       const write = req.query.write === 'true';
+      const username = req?.remote_user?.name;
       const abbreviated =
         stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;
       const requestOptions = {
@@ -37,6 +38,7 @@ export default function (route: Router, auth: Auth, storage: Storage): void {
         host: req.host,
         remoteAddress: req.socket.remoteAddress,
         byPassCache: write,
+        username,
       };
 
       try {
@@ -67,7 +69,7 @@ export default function (route: Router, auth: Auth, storage: Storage): void {
       const { package: pkgName, filename } = req.params;
       const abort = new AbortController();
       try {
-        const stream = (await storage.getTarballNext(pkgName, filename, {
+        const stream = (await storage.getTarball(pkgName, filename, {
           signal: abort.signal,
           // TODO: review why this param
           // enableRemote: true,