@verdaccio/api 8.1.0-next-8.12 → 8.1.0-next-8.13

package/src/user.ts

@@ -1,179 +0,0 @@
-import buildDebug from 'debug';
-import { Response, Router } from 'express';
-
-import { getApiToken } from '@verdaccio/auth';
-import { Auth } from '@verdaccio/auth';
-import { createRemoteUser } from '@verdaccio/config';
-import {
-  API_ERROR,
-  API_MESSAGE,
-  HEADERS,
-  HTTP_STATUS,
-  errorUtils,
-  validatioUtils,
-} from '@verdaccio/core';
-import { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';
-import { Logger } from '@verdaccio/types';
-import { Config, RemoteUser } from '@verdaccio/types';
-import { getAuthenticatedMessage, mask } from '@verdaccio/utils';
-
-import { $NextFunctionVer, $RequestExtend } from '../types/custom';
-
-const debug = buildDebug('verdaccio:api:user');
-
-export default function (route: Router, auth: Auth, config: Config, logger: Logger): void {
-  route.get(
-    USER_API_ENDPOINTS.get_user,
-    rateLimit(config?.userRateLimit),
-    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
-      debug('verifying user');
-
-      if (
-        !req.remote_user ||
-        typeof req.remote_user.name !== 'string' ||
-        req.remote_user.name === ''
-      ) {
-        debug('user not logged in');
-        res.status(HTTP_STATUS.OK);
-        return next({ ok: false });
-      }
-
-      const username = req.params.org_couchdb_user.split(':')[1];
-      const message = getAuthenticatedMessage(req.remote_user.name);
-      debug('user authenticated message %o', message);
-      res.status(HTTP_STATUS.OK);
-      next({
-        // 'npm owner' requires user info
-        // TODO: we don't have the email
-        name: username,
-        email: '',
-        ok: message,
-      });
-    }
-  );
-
-  /**
- *  
- *  body example
- *  req.body = {
-      _id: "org.couchdb.user:jjjj",
-      name: "jjjj",
-      password: "jjjj",
-      type: "user",
-      roles: [],
-      date: "2022-07-08T15:51:04.002Z",
-    }
- * 
- * @export
- * @param {Router} route
- * @param {Auth} auth
- * @param {Config} config
- */
-  route.put(
-    USER_API_ENDPOINTS.add_user,
-    rateLimit(config?.userRateLimit),
-    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
-      const { name, password } = req.body;
-      debug('login or adduser');
-      const remoteName = req?.remote_user?.name;
-
-      if (!validatioUtils.validateUserName(req.params.org_couchdb_user, name)) {
-        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));
-      }
-
-      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {
-        debug('login: no remote user detected');
-        auth.authenticate(
-          name,
-          password,
-          async function callbackAuthenticate(err, user): Promise<void> {
-            if (err) {
-              logger.trace(
-                { name, err },
-                'authenticating for user @{username} failed. Error: @{err.message}'
-              );
-              return next(
-                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)
-              );
-            }
-
-            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);
-            const token = await getApiToken(auth, config, restoredRemoteUser, password);
-            debug('login: new token');
-            if (!token) {
-              return next(errorUtils.getUnauthorized());
-            }
-
-            res.status(HTTP_STATUS.CREATED);
-            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
-
-            const message = getAuthenticatedMessage(req.remote_user.name);
-            debug('login: created user message %o', message);
-
-            return next({
-              ok: message,
-              token,
-            });
-          }
-        );
-      } else {
-        debug('adduser: %o', name);
-        if (
-          validatioUtils.validatePassword(
-            password,
-            config?.serverSettings?.passwordValidationRegex
-          ) === false
-        ) {
-          debug('adduser: invalid password');
-          // eslint-disable-next-line new-cap
-          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));
-        }
-
-        auth.add_user(name, password, async function (err, user): Promise<void> {
-          if (err) {
-            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {
-              debug('adduser: error on create user');
-              // With npm registering is the same as logging in,
-              // and npm accepts only an 409 error.
-              // So, changing status code here.
-              return next(
-                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)
-              );
-            }
-            return next(err);
-          }
-
-          const token =
-            name && password
-              ? await getApiToken(auth, config, user as RemoteUser, password)
-              : undefined;
-          if (token) {
-            debug('adduser: new token %o', mask(token as string, 4));
-          }
-          if (!token) {
-            return next(errorUtils.getUnauthorized());
-          }
-
-          req.remote_user = user;
-          res.status(HTTP_STATUS.CREATED);
-          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
-          debug('adduser: user has been created');
-          return next({
-            ok: `user '${req.body.name}' created`,
-            token,
-          });
-        });
-      }
-    }
-  );
-
-  route.delete(
-    USER_API_ENDPOINTS.user_token,
-    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
-      res.status(HTTP_STATUS.OK);
-      next({
-        ok: API_MESSAGE.LOGGED_OUT,
-      });
-    }
-  );
-}

package/src/v1/profile.ts

@@ -1,113 +0,0 @@
-import { Response, Router } from 'express';
-import _ from 'lodash';
-
-import { Auth } from '@verdaccio/auth';
-import {
-  API_ERROR,
-  APP_ERROR,
-  HTTP_STATUS,
-  SUPPORT_ERRORS,
-  errorUtils,
-  validatioUtils,
-} from '@verdaccio/core';
-import { PROFILE_API_ENDPOINTS } from '@verdaccio/middleware';
-import { rateLimit } from '@verdaccio/middleware';
-import { Config } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend } from '../../types/custom';
-
-export interface Profile {
-  tfa: boolean;
-  name: string;
-  email: string;
-  email_verified: boolean;
-  created: string;
-  updated: string;
-  cidr_whitelist: string[] | null;
-  fullname: string;
-}
-
-export default function (route: Router, auth: Auth, config: Config): void {
-  function buildProfile(name: string): Profile {
-    return {
-      tfa: false,
-      name,
-      email: '',
-      email_verified: false,
-      created: '',
-      updated: '',
-      cidr_whitelist: null,
-      fullname: '',
-    };
-  }
-
-  route.get(
-    PROFILE_API_ENDPOINTS.get_profile,
-    rateLimit(config?.userRateLimit),
-    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
-      if (_.isNil(req.remote_user.name) === false) {
-        return next(buildProfile(req.remote_user.name));
-      }
-
-      res.status(HTTP_STATUS.UNAUTHORIZED);
-      return next({
-        message: API_ERROR.MUST_BE_LOGGED,
-      });
-    }
-  );
-
-  route.post(
-    PROFILE_API_ENDPOINTS.get_profile,
-    rateLimit(config?.userRateLimit),
-    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
-      if (_.isNil(req.remote_user.name)) {
-        res.status(HTTP_STATUS.UNAUTHORIZED);
-        return next({
-          message: API_ERROR.MUST_BE_LOGGED,
-        });
-      }
-
-      const { password, tfa } = req.body;
-      const { name } = req.remote_user;
-
-      if (_.isNil(password) === false) {
-        if (
-          validatioUtils.validatePassword(
-            password.new,
-            config?.serverSettings?.passwordValidationRegex
-          ) === false
-        ) {
-          /* eslint new-cap:off */
-          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));
-          /* eslint new-cap:off */
-        }
-
-        if (_.isEmpty(password.old)) {
-          return next(errorUtils.getBadRequest('old password is required'));
-        }
-
-        auth.changePassword(
-          name,
-          password.old,
-          password.new,
-          (err, isUpdated): $NextFunctionVer => {
-            if (_.isNull(err) === false) {
-              return next(errorUtils.getForbidden(err.message));
-            }
-
-            if (isUpdated) {
-              return next(buildProfile(req.remote_user.name));
-            }
-            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));
-          }
-        );
-      } else if (_.isNil(tfa) === false) {
-        return next(
-          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)
-        );
-      } else {
-        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));
-      }
-    }
-  );
-}

package/src/v1/search.ts

@@ -1,85 +0,0 @@
-import buildDebug from 'debug';
-import _ from 'lodash';
-
-import { Auth } from '@verdaccio/auth';
-import { HTTP_STATUS, searchUtils } from '@verdaccio/core';
-import { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Manifest } from '@verdaccio/types';
-import { Logger } from '@verdaccio/types';
-
-const debug = buildDebug('verdaccio:api:search');
-
-/**
- * Endpoint for npm search v1
- * Empty value
- *  - {"objects":[],"total":0,"time":"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)"}
- * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'
- */
-export default function (route, auth: Auth, storage: Storage, logger: Logger): void {
-  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {
-    return new Promise((resolve, reject) => {
-      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {
-        if (err) {
-          if (err.status && String(err.status).match(/^4\d\d$/)) {
-            // auth plugin returns 4xx user error,
-            // that's equivalent of !allowed basically
-            allowed = false;
-            return resolve(null);
-          } else {
-            reject(err);
-          }
-        } else {
-          return resolve(allowed ? pkg : null);
-        }
-      });
-    });
-  }
-
-  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {
-    const { query, url } = req;
-    let [size, from] = ['size', 'from'].map((k) => query[k]);
-    let data;
-    const abort = new AbortController();
-
-    req.socket.on('close', function () {
-      debug('search web aborted');
-      abort.abort();
-    });
-
-    size = parseInt(size, 10) || 20;
-    from = parseInt(from, 10) || 0;
-
-    try {
-      debug('storage search initiated');
-      data = await storage.search({
-        query,
-        url,
-        abort,
-      });
-      debug('storage items tota: %o', data.length);
-      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(
-        data.map((pkgItem) => {
-          return checkAccess(pkgItem, auth, req.remote_user);
-        })
-      );
-
-      const final: searchUtils.SearchItemPkg[] = checkAccessPromises
-        .filter((i) => !_.isNull(i))
-        .slice(from, size);
-      logger.debug(`search results ${final?.length}`);
-
-      const response: searchUtils.SearchResults = {
-        objects: final,
-        total: final.length,
-        time: new Date().toUTCString(),
-      };
-
-      res.status(HTTP_STATUS.OK).json(response);
-    } catch (error) {
-      logger.error({ error }, 'search endpoint has failed @{error.message}');
-      next(next);
-      return;
-    }
-  });
-}

package/src/v1/token.ts

@@ -1,157 +0,0 @@
-import { Response, Router } from 'express';
-import _ from 'lodash';
-
-import { getApiToken } from '@verdaccio/auth';
-import { Auth } from '@verdaccio/auth';
-import { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';
-import { rateLimit } from '@verdaccio/middleware';
-import { TOKEN_API_ENDPOINTS } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Config, RemoteUser, Token } from '@verdaccio/types';
-import { Logger } from '@verdaccio/types';
-import { mask, stringToMD5 } from '@verdaccio/utils';
-
-import { $NextFunctionVer, $RequestExtend } from '../../types/custom';
-
-export type NormalizeToken = Token & {
-  created: string;
-};
-
-function normalizeToken(token: Token): NormalizeToken {
-  return {
-    ...token,
-    created: new Date(token.created).toISOString(),
-  };
-}
-
-// https://github.com/npm/npm-profile/blob/latest/lib/index.js
-export default function (
-  route: Router,
-  auth: Auth,
-  storage: Storage,
-  config: Config,
-  logger: Logger
-): void {
-  route.get(
-    TOKEN_API_ENDPOINTS.get_tokens,
-    rateLimit(config?.userRateLimit),
-    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {
-      const { name } = req.remote_user;
-
-      if (_.isNil(name) === false) {
-        try {
-          const tokens = await storage.readTokens({ user: name });
-          const totalTokens = tokens.length;
-          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');
-
-          res.status(HTTP_STATUS.OK);
-          return next({
-            objects: tokens.map(normalizeToken),
-            urls: {
-              next: '', // TODO: pagination?
-            },
-          });
-        } catch (error: any) {
-          logger.error({ error: error.msg }, 'token list has failed: @{error}');
-          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));
-        }
-      }
-      return next(errorUtils.getUnauthorized());
-    }
-  );
-
-  route.post(
-    TOKEN_API_ENDPOINTS.get_tokens,
-    rateLimit(config?.userRateLimit),
-    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {
-      const { password, readonly, cidr_whitelist } = req.body;
-      const { name } = req.remote_user;
-
-      if (!_.isBoolean(readonly) || !_.isArray(cidr_whitelist)) {
-        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));
-      }
-
-      auth.authenticate(name, password, async (err, user?: RemoteUser) => {
-        if (err) {
-          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;
-          return next(errorUtils.getCode(errorCode, err.message));
-        }
-
-        req.remote_user = user;
-
-        if (!_.isFunction(storage.saveToken)) {
-          return next(
-            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)
-          );
-        }
-
-        try {
-          const token = await getApiToken(auth, config, user as RemoteUser, password);
-          if (!token) {
-            throw errorUtils.getInternalError();
-          }
-
-          const key = stringToMD5(token);
-          // TODO: use a utility here
-          const maskedToken = mask(token, 5);
-          const created = new Date().getTime();
-
-          /**
-           * cidr_whitelist: is not being used, we pass it through
-           * token: we do not store the real token (it is generated once and retrieved
-           * to the user), just a mask of it.
-           */
-          const saveToken: Token = {
-            user: name,
-            token: maskedToken,
-            key,
-            cidr: cidr_whitelist,
-            readonly,
-            created,
-          };
-
-          await storage.saveToken(saveToken);
-          logger.debug({ key, name }, 'token @{key} was created for user @{name}');
-          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
-          return next(
-            normalizeToken({
-              token,
-              user: name,
-              key: saveToken.key,
-              cidr: cidr_whitelist,
-              readonly,
-              created: saveToken.created,
-            })
-          );
-        } catch (error: any) {
-          logger.error({ error: error.msg }, 'token creation has failed: @{error}');
-          return next(errorUtils.getInternalError(error.message));
-        }
-      });
-    }
-  );
-
-  route.delete(
-    TOKEN_API_ENDPOINTS.delete_token,
-    rateLimit(config?.userRateLimit),
-    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {
-      const {
-        params: { tokenKey },
-      } = req;
-      const { name } = req.remote_user;
-
-      if (_.isNil(name) === false) {
-        logger.debug({ name }, '@{name} has requested remove a token');
-        try {
-          await storage.deleteToken(name, tokenKey);
-          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');
-          return next({});
-        } catch (error: any) {
-          logger.error({ error: error.msg }, 'token creation has failed: @{error}');
-          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));
-        }
-      }
-      return next(errorUtils.getUnauthorized());
-    }
-  );
-}

package/src/whoami.ts

@@ -1,26 +0,0 @@
-import buildDebug from 'debug';
-import { Response, Router } from 'express';
-
-import { errorUtils } from '@verdaccio/core';
-import { USER_API_ENDPOINTS } from '@verdaccio/middleware';
-
-import { $NextFunctionVer, $RequestExtend } from '../types/custom';
-
-const debug = buildDebug('verdaccio:api:user');
-
-export default function (route: Router): void {
-  route.get(
-    USER_API_ENDPOINTS.whoami,
-    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {
-      // remote_user is set by the auth middleware
-      const username = req?.remote_user?.name;
-      if (!username) {
-        debug('whoami: user not found');
-        return next(errorUtils.getUnauthorized('Unauthorized'));
-      }
-
-      debug('whoami: response %o', username);
-      return next({ username: username });
-    }
-  );
-}

package/test/.eslintrc

@@ -1,8 +0,0 @@
-{
-	"rules": {
-		"@typescript-eslint/explicit-function-return-type": 0,
-		"@typescript-eslint/explicit-member-accessibility": 0,
-		"@typescript-eslint/no-unused-vars": 2,
-		"no-console": 0
-	}
-}