@verdaccio/api 8.1.0-next-8.12 → 8.1.0-next-8.13

package/src/dist-tags.ts

@@ -1,106 +0,0 @@
-import { Router } from 'express';
-import _ from 'lodash';
-import mime from 'mime';
-
-import { Auth } from '@verdaccio/auth';
-import { constants, errorUtils } from '@verdaccio/core';
-import { allow, media } from '@verdaccio/middleware';
-import { DIST_TAGS_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Logger } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
-
-export default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {
-  const can = allow(auth, {
-    beforeAll: (a, b) => logger.trace(a, b),
-    afterAll: (a, b) => logger.trace(a, b),
-  });
-  const addTagPackageVersionMiddleware = async function (
-    req: $RequestExtend,
-    res: $ResponseExtend,
-    next: $NextFunctionVer
-  ): Promise<$NextFunctionVer> {
-    if (_.isString(req.body) === false) {
-      return next(errorUtils.getBadRequest('version is missing'));
-    }
-
-    const tags = {};
-    tags[req.params.tag] = req.body;
-    try {
-      await storage.mergeTagsNext(req.params.package, tags);
-      res.status(constants.HTTP_STATUS.CREATED);
-      return next({
-        ok: constants.API_MESSAGE.TAG_ADDED,
-      });
-    } catch (err) {
-      next(err);
-    }
-  };
-
-  // tagging a package.
-  route.put(
-    DIST_TAGS_API_ENDPOINTS.tagging,
-    can('publish'),
-    media(mime.getType('json')),
-    addTagPackageVersionMiddleware
-  );
-
-  route.put(
-    DIST_TAGS_API_ENDPOINTS.tagging_package,
-    can('publish'),
-    media(mime.getType('json')),
-    addTagPackageVersionMiddleware
-  );
-
-  route.delete(
-    DIST_TAGS_API_ENDPOINTS.tagging_package,
-    can('publish'),
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      const tags = {};
-      tags[req.params.tag] = null;
-      try {
-        await storage.mergeTagsNext(req.params.package, tags);
-        res.status(constants.HTTP_STATUS.CREATED);
-        return next({
-          ok: constants.API_MESSAGE.TAG_REMOVED,
-        });
-      } catch (err) {
-        next(err);
-      }
-    }
-  );
-
-  route.get(
-    DIST_TAGS_API_ENDPOINTS.get_dist_tags,
-    can('access'),
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      const name = req.params.package;
-      const requestOptions = {
-        protocol: req.protocol,
-        headers: req.headers as any,
-        // FIXME: if we migrate to req.hostname, the port is not longer included.
-        host: req.host,
-        remoteAddress: req.socket.remoteAddress,
-      };
-      try {
-        const manifest = await storage.getPackageByOptions({
-          name,
-          uplinksLook: true,
-          requestOptions,
-        });
-        next(manifest[constants.DIST_TAGS]);
-      } catch (err) {
-        next(err);
-      }
-    }
-  );
-}

package/src/index.ts

@@ -1,65 +0,0 @@
-import express, { Router } from 'express';
-
-import { Auth } from '@verdaccio/auth';
-import {
-  antiLoop,
-  encodeScopePackage,
-  makeURLrelative,
-  match,
-  validateName,
-  validatePackage,
-} from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Config, Logger } from '@verdaccio/types';
-
-import distTags from './dist-tags';
-import pkg from './package';
-import ping from './ping';
-import publish from './publish';
-import search from './search';
-import stars from './stars';
-import user from './user';
-import profile from './v1/profile';
-import v1Search from './v1/search';
-import token from './v1/token';
-import whoami from './whoami';
-
-export default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {
-  /* eslint new-cap:off */
-  const app = express.Router();
-  /* eslint new-cap:off */
-
-  // validate all of these params as a package name
-  // this might be too harsh, so ask if it causes trouble
-  app.param('package', validatePackage);
-  app.param('filename', validateName);
-  app.param('tag', validateName);
-  app.param('version', validateName);
-  app.param('revision', validateName);
-  app.param('token', validateName);
-
-  // Express route parameter names must be valid JavaScript identifiers, which means
-  // they cannot start with a hyphen (-) or contain special characters like dots (.)
-  app.param('_rev', match(/^-rev$/));
-  app.param('org_couchdb_user', match(/^org\.couchdb\.user:/));
-
-  app.use(auth.apiJWTmiddleware());
-  app.use(express.json({ strict: false, limit: config.max_body_size || '10mb' }));
-  app.use(antiLoop(config));
-  app.use(makeURLrelative);
-  // encode / in a scoped package name to be matched as a single parameter in routes
-  app.use(encodeScopePackage);
-  // for "npm whoami"
-  whoami(app);
-  profile(app, auth, config);
-  search(app, logger);
-  user(app, auth, config, logger);
-  distTags(app, auth, storage, logger);
-  publish(app, auth, storage, logger);
-  ping(app);
-  stars(app, storage);
-  v1Search(app, auth, storage, logger);
-  token(app, auth, storage, config, logger);
-  pkg(app, auth, storage, logger);
-  return app;
-}

package/src/package.ts

@@ -1,117 +0,0 @@
-import buildDebug from 'debug';
-import { Router } from 'express';
-
-import { Auth } from '@verdaccio/auth';
-import { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';
-import { allow } from '@verdaccio/middleware';
-import { PACKAGE_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Logger } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
-
-const debug = buildDebug('verdaccio:api:package');
-
-export default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {
-  const can = allow(auth, {
-    beforeAll: (a, b) => logger.trace(a, b),
-    afterAll: (a, b) => logger.trace(a, b),
-  });
-  route.get(
-    PACKAGE_API_ENDPOINTS.get_package_by_version,
-    can('access'),
-    async function (
-      req: $RequestExtend,
-      _res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      debug('get package by version');
-      const name = req.params.package;
-      let version = req.params.version;
-      const write = req.query.write === 'true';
-      const username = req?.remote_user?.name;
-      const abbreviated =
-        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;
-      if (debug.enabled) {
-        debug('is write %o', write);
-        debug('is abbreviated %o', abbreviated);
-        debug('package %o', name);
-        debug('version %o', version);
-        debug('username %o', username);
-        debug('remote address %o', req.socket.remoteAddress);
-        debug('host %o', req.host);
-        debug('protocol %o', req.protocol);
-        debug('url %o', req.url);
-      }
-      const requestOptions = {
-        protocol: req.protocol,
-        headers: req.headers as any,
-        // FIXME: if we migrate to req.hostname, the port is not longer included.
-        host: req.host,
-        remoteAddress: req.socket.remoteAddress,
-        byPassCache: write,
-        username,
-      };
-
-      try {
-        const manifest = await storage.getPackageByOptions({
-          name,
-          uplinksLook: true,
-          abbreviated,
-          version,
-          requestOptions,
-        });
-        if (abbreviated) {
-          debug('abbreviated response');
-          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);
-        } else {
-          debug('full response');
-          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);
-        }
-
-        next(manifest);
-      } catch (err) {
-        next(err);
-      }
-    }
-  );
-
-  route.get(
-    PACKAGE_API_ENDPOINTS.get_package_tarball,
-    can('access'),
-    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {
-      const { package: pkgName, filename } = req.params;
-      const abort = new AbortController();
-      try {
-        debug('downloading tarball %o', filename);
-        const stream = (await storage.getTarball(pkgName, filename, {
-          signal: abort.signal,
-          // TODO: review why this param
-          // enableRemote: true,
-        })) as any;
-
-        stream.on('content-length', (size) => {
-          debug('tarball size %o', size);
-          res.header(HEADER_TYPE.CONTENT_LENGTH, size);
-        });
-
-        stream.once('error', (err) => {
-          debug('error on download tarball %o', err);
-          res.locals.report_error(err);
-          next(err);
-        });
-
-        req.on('abort', () => {
-          debug('request aborted for %o', req.url);
-          abort.abort();
-        });
-
-        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);
-        stream.pipe(res);
-      } catch (err: any) {
-        res.locals.report_error(err);
-        next(err);
-      }
-    }
-  );
-}

package/src/ping.ts

@@ -1,14 +0,0 @@
-import { Router } from 'express';
-
-import { PING_API_ENDPOINTS } from '@verdaccio/middleware';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
-
-export default function (route: Router): void {
-  route.get(
-    PING_API_ENDPOINTS.ping,
-    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {
-      next({});
-    }
-  );
-}

package/src/publish.ts

@@ -1,262 +0,0 @@
-import buildDebug from 'debug';
-import { Router } from 'express';
-import mime from 'mime';
-
-import { Auth } from '@verdaccio/auth';
-import { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';
-import { allow, expectJson, media } from '@verdaccio/middleware';
-// import star from './star';
-import { PUBLISH_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Logger } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
-
-const debug = buildDebug('verdaccio:api:publish');
-
-/**
-   * Publish a package / update package / un/start a package
-   *
-   * There are multiples scenarios here to be considered:
-   *
-   * 1. Publish scenario
-   *
-   * Publish a package consist of at least 1 step (PUT) with a metadata payload.
-   * When a package is published, an _attachment property is present that contains the data
-   * of the tarball.
-   *
-   * Example flow of publish.
-   *
-   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms
-      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1
-      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1
-      + @scope/test1@1.0.1
-      npm verb exit [ 0, true ]
-   *
-   *
-   * 2. Unpublish scenario
-   *
-   * Unpublish consist in 3 steps.
-   *  1. Try to fetch  metadata -> if it fails, return 404
-   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to
-   *    be unpublished
-   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.
-   *  3. Once the second step has been successfully finished, delete the tarball.
-   *
-   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,
-   *  metadata might get corrupted.
-   *
-   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,
-   *  this not
-   *  used internally.
-   *
-   *
-   * Example flow of unpublish.
-   *
-   * There are two possible flows:
-   *
-   * - Remove all packages (entirely)
-   *   eg: npm unpublish package-name@* --force
-   *   eg: npm unpublish package-name  --force
-   *
-   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
-   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
-   *
-   * - Remove a specific version
-   *   eg: npm unpublish package-name@1.0.0 --force
-   *
-   * Get fresh manifest
-   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
-   * Update manifest without the version to be unpublished
-   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms
-   * Get fresh manifest (revision should be different)
-   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms
-   * Remove the tarball
-   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
-   *
-   * 3. Star a package
-   *
-   * Permissions: staring a package depends of the publish and unpublish permissions, there is no
-   * specific flag for star or unstar.
-   * The URL for star is similar to the unpublish (change package format)
-   *
-   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference
-   * is the users property which is part of the payload and the body only includes
-   *
-   * {
-		  "_id": pkgName,
-	  	"_rev": "3-b0cdaefc9bdb77c8",
-		  "users": {
-		    [username]: boolean value (true, false)
-		  }
-	   }
-   *
-   * 4. Change owners of a package
-   *
-   * Similar to staring a package, changing owners (maintainers) of a package uses the publish
-   * endpoint.
-   *
-   * The body includes a list of the new owners with the following format
-   *
-   * {
-		  "_id": pkgName,
-	  	"_rev": "4-b0cdaefc9bdb77c8",
-		  "maintainers": [
-        { "name": "first owner", "email": "me@verdaccio.org" },
-        { "name": "second owner", "email": "you@verdaccio.org" },
-        ...
-		  ]
-	   }
-   *
-   */
-export default function publish(
-  router: Router,
-  auth: Auth,
-  storage: Storage,
-  logger: Logger
-): void {
-  const can = allow(auth, {
-    beforeAll: (a, b) => logger.trace(a, b),
-    afterAll: (a, b) => logger.trace(a, b),
-  });
-  router.put(
-    PUBLISH_API_ENDPOINTS.add_package,
-    can('publish'),
-    media(mime.getType('json')),
-    expectJson,
-    publishPackage(storage, logger, 'publish one version')
-  );
-
-  router.put(
-    PUBLISH_API_ENDPOINTS.publish_package,
-    can('unpublish'),
-    media(mime.getType('json')),
-    expectJson,
-    publishPackage(storage, logger, 'publish with revision')
-  );
-
-  /**
-   * Un-publishing an entire package.
-   *
-   * This scenario happens when any of these scenarios happens:
-   *  -  the first call detect there is only one version remaining
-   *  -  no version is specified in the unpublish call
-   *  -  all versions are removed npm unpublish package@*
-   *  -  there is no versions on the metadata
-
-   * then the client decides to DELETE the resource
-   * Example:
-   * Get fresh manifest (write=true is a flag to get the latest revision)
-   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)
-   * Send request to delete the package, this includes the revision number that must match
-   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)
-   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
-   */
-  router.delete(
-    PUBLISH_API_ENDPOINTS.publish_package,
-    can('unpublish'),
-    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {
-      const packageName = req.params.package;
-      const rev = req.params.revision;
-      const username = req?.remote_user?.name;
-
-      logger.debug({ packageName }, `unpublishing @{packageName}`);
-      try {
-        await storage.removePackage(packageName, rev, username);
-        debug('package %s unpublished', packageName);
-        res.status(HTTP_STATUS.CREATED);
-        return next({ ok: API_MESSAGE.PKG_REMOVED });
-      } catch (err) {
-        return next(err);
-      }
-    }
-  );
-
-  /*
-   Remove a tarball, this happens when npm unpublish a package unique version.
-   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
-  */
-  router.delete(
-    PUBLISH_API_ENDPOINTS.remove_tarball,
-    can('unpublish'),
-    can('publish'),
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      const packageName = req.params.package;
-      const { filename, revision } = req.params;
-      const username = req?.remote_user?.name;
-
-      logger.debug(
-        { packageName, filename, revision },
-        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`
-      );
-      try {
-        await storage.removeTarball(packageName, filename, revision, username);
-        res.status(HTTP_STATUS.CREATED);
-
-        logger.debug(
-          { packageName, filename, revision },
-          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`
-        );
-        return next({ ok: API_MESSAGE.TARBALL_REMOVED });
-      } catch (err) {
-        return next(err);
-      }
-    }
-  );
-}
-
-export function publishPackage(storage: Storage, logger: Logger, origin: string): any {
-  return async function (
-    req: $RequestExtend,
-    res: $ResponseExtend,
-    next: $NextFunctionVer
-  ): Promise<void> {
-    debug(origin);
-    const ac = new AbortController();
-    const packageName = req.params.package;
-    const { revision } = req.params;
-    debug('publishing package %s', packageName);
-    debug('revision %s', revision);
-    if (debug.enabled) {
-      debug('body %o', req.body);
-    }
-    const metadata = req.body;
-    const username = req?.remote_user?.name;
-
-    debug('publishing package %o for user %o', packageName, username);
-    logger.debug(
-      { packageName, username },
-      'publishing package @{packageName} for user @{username}'
-    );
-
-    try {
-      const message = await storage.updateManifest(metadata, {
-        name: packageName,
-        revision,
-        signal: ac.signal,
-        requestOptions: {
-          host: req.hostname,
-          protocol: req.protocol,
-          headers: req.headers as { [key: string]: string },
-          username,
-        },
-        uplinksLook: false,
-      });
-      debug('package %s published', packageName);
-
-      res.status(HTTP_STATUS.CREATED);
-
-      return next({
-        success: true,
-        ok: message,
-      });
-    } catch (err: any) {
-      // TODO: review if we need the abort controller here
-      next(err);
-    }
-  };
-}

package/src/search.ts

@@ -1,12 +0,0 @@
-import { HTTP_STATUS } from '@verdaccio/core';
-import { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Logger } from '@verdaccio/types';
-
-export default function (route, logger: Logger): void {
-  // TODO: next major version, remove this
-  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {
-    logger.warn('search endpoint has been removed, please use search v1');
-    res.status(HTTP_STATUS.NOT_FOUND);
-    res.json({ error: 'not found, endpoint was removed' });
-  });
-}

package/src/stars.ts

@@ -1,37 +0,0 @@
-import { Response, Router } from 'express';
-import _ from 'lodash';
-
-import { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';
-import { STARS_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Version } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend } from '../types/custom';
-
-export default function (route: Router, storage: Storage): void {
-  route.get(
-    STARS_API_ENDPOINTS.get_user_starred_packages,
-    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {
-      const query: { key: string } = req.query;
-      if (typeof query?.key !== 'string') {
-        return next(errorUtils.getBadRequest('missing query key username'));
-      }
-
-      try {
-        const localPackages: Version[] = await storage.getLocalDatabase();
-        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>
-          _.keys(localPackage[USERS]).includes(query?.key.toString().replace(/['"]+/g, ''))
-        );
-
-        res.status(HTTP_STATUS.OK);
-        next({
-          rows: filteredPackages.map((filteredPackage: Version) => ({
-            value: filteredPackage.name,
-          })),
-        });
-      } catch (err: any) {
-        return next(err);
-      }
-    }
-  );
-}