@verdaccio/api 8.1.0-next-8.6 → 8.1.0-next-8.8

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @verdaccio/api
 
+## 8.1.0-next-8.8
+
+### Patch Changes
+
+- Updated dependencies [0588605]
+- Updated dependencies [ca91b9a]
+  - @verdaccio/config@8.0.0-next-8.8
+  - @verdaccio/auth@8.0.0-next-8.8
+  - @verdaccio/middleware@8.0.0-next-8.8
+  - @verdaccio/store@8.0.0-next-8.8
+  - @verdaccio/core@8.0.0-next-8.8
+  - @verdaccio/logger@8.0.0-next-8.8
+  - @verdaccio/utils@8.1.0-next-8.8
+
+## 8.1.0-next-8.7
+
+### Patch Changes
+
+- 139861e: fix: crashes with path-to-regexp v0.1.12 express
+- Updated dependencies [589ea7f]
+- Updated dependencies [139861e]
+  - @verdaccio/core@8.0.0-next-8.7
+  - @verdaccio/utils@8.1.0-next-8.7
+  - @verdaccio/middleware@8.0.0-next-8.7
+  - @verdaccio/store@8.0.0-next-8.7
+  - @verdaccio/auth@8.0.0-next-8.7
+  - @verdaccio/config@8.0.0-next-8.7
+  - @verdaccio/logger@8.0.0-next-8.7
+
 ## 8.1.0-next-8.6
 
 ### Patch Changes

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Verdaccio contributors
+Copyright (c) 2025 Verdaccio contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -6,7 +6,6 @@
 [![Crowdin](https://d322cqt584bo4o.cloudfront.net/verdaccio/localized.svg)](https://crowdin.com/project/verdaccio)
 [![TODOs](https://badgen.net/https/api.tickgit.com/badgen/github.com/verdaccio/verdaccio)](https://www.tickgit.com/browse?repo=github.com/verdaccio/verdaccio)
 
-[![Twitter followers](https://img.shields.io/twitter/follow/verdaccio_npm.svg?style=social&label=Follow)](https://twitter.com/verdaccio_npm)
 [![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)
 
 ## Donations

package/build/dist-tags.js

@@ -32,9 +32,9 @@ function _default(route, auth, storage, logger) {
   };
 
   // tagging a package.
-  route.put('/:package/:tag', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), addTagPackageVersionMiddleware);
-  route.put('/-/package/:package/dist-tags/:tag', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), addTagPackageVersionMiddleware);
-  route.delete('/-/package/:package/dist-tags/:tag', can('publish'), async function (req, res, next) {
+  route.put(_middleware.DIST_TAGS_API_ENDPOINTS.tagging, can('publish'), (0, _middleware.media)(_mime.default.getType('json')), addTagPackageVersionMiddleware);
+  route.put(_middleware.DIST_TAGS_API_ENDPOINTS.tagging_package, can('publish'), (0, _middleware.media)(_mime.default.getType('json')), addTagPackageVersionMiddleware);
+  route.delete(_middleware.DIST_TAGS_API_ENDPOINTS.tagging_package, can('publish'), async function (req, res, next) {
     const tags = {};
     tags[req.params.tag] = null;
     try {
@@ -47,7 +47,7 @@ function _default(route, auth, storage, logger) {
       next(err);
     }
   });
-  route.get('/-/package/:package/dist-tags', can('access'), async function (req, res, next) {
+  route.get(_middleware.DIST_TAGS_API_ENDPOINTS.get_dist_tags, can('access'), async function (req, res, next) {
     const name = req.params.package;
     const requestOptions = {
       protocol: req.protocol,

package/build/dist-tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"dist-tags.js","names":["_lodash","_interopRequireDefault","require","_mime","_core","_middleware","e","__esModule","default","_default","route","auth","storage","logger","can","allow","beforeAll","a","b","trace","afterAll","addTagPackageVersionMiddleware","req","res","next","_","isString","body","errorUtils","getBadRequest","tags","params","tag","mergeTagsNext","package","status","constants","HTTP_STATUS","CREATED","ok","API_MESSAGE","TAG_ADDED","err","put","media","mime","getType","delete","TAG_REMOVED","get","name","requestOptions","protocol","headers","host","remoteAddress","socket","manifest","getPackageByOptions","uplinksLook","DIST_TAGS"],"sources":["../src/dist-tags.ts"],"sourcesContent":["import { Router } from 'express';\nimport _ from 'lodash';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { constants, errorUtils } from '@verdaccio/core';\nimport { allow, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Logger } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (_.isString(req.body) === false) {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    '/:package/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    '/-/package/:package/dist-tags/:tag',\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    '/-/package/:package/dist-tags/:tag',\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/-/package/:package/dist-tags',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAAqD,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAMtC,SAAAG,SAAUC,KAAa,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAC1F,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC,CAAC;IACvCE,QAAQ,EAAEA,CAACH,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACF,MAAMG,8BAA8B,GAAG,eAAAA,CACrCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACK;IAC3B,IAAIC,eAAC,CAACC,QAAQ,CAACJ,GAAG,CAACK,IAAI,CAAC,KAAK,KAAK,EAAE;MAClC,OAAOH,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D;IAEA,MAAMC,IAAI,GAAG,CAAC,CAAC;IACfA,IAAI,CAACR,GAAG,CAACS,MAAM,CAACC,GAAG,CAAC,GAAGV,GAAG,CAACK,IAAI;IAC/B,IAAI;MACF,MAAMf,OAAO,CAACqB,aAAa,CAACX,GAAG,CAACS,MAAM,CAACG,OAAO,EAAEJ,IAAI,CAAC;MACrDP,GAAG,CAACY,MAAM,CAACC,eAAS,CAACC,WAAW,CAACC,OAAO,CAAC;MACzC,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAS,CAACI,WAAW,CAACC;MAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZlB,IAAI,CAACkB,GAAG,CAAC;IACX;EACF,CAAC;;EAED;EACAhC,KAAK,CAACiC,GAAG,CACP,gBAAgB,EAChB7B,GAAG,CAAC,SAAS,CAAC,EACd,IAAA8B,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BzB,8BACF,CAAC;EAEDX,KAAK,CAACiC,GAAG,CACP,oCAAoC,EACpC7B,GAAG,CAAC,SAAS,CAAC,EACd,IAAA8B,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BzB,8BACF,CAAC;EAEDX,KAAK,CAACqC,MAAM,CACV,oCAAoC,EACpCjC,GAAG,CAAC,SAAS,CAAC,EACd,gBACEQ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMM,IAAI,GAAG,CAAC,CAAC;IACfA,IAAI,CAACR,GAAG,CAACS,MAAM,CAACC,GAAG,CAAC,GAAG,IAAI;IAC3B,IAAI;MACF,MAAMpB,OAAO,CAACqB,aAAa,CAACX,GAAG,CAACS,MAAM,CAACG,OAAO,EAAEJ,IAAI,CAAC;MACrDP,GAAG,CAACY,MAAM,CAACC,eAAS,CAACC,WAAW,CAACC,OAAO,CAAC;MACzC,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAS,CAACI,WAAW,CAACQ;MAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,OAAON,GAAG,EAAE;MACZlB,IAAI,CAACkB,GAAG,CAAC;IACX;EACF,CACF,CAAC;EAEDhC,KAAK,CAACuC,GAAG,CACP,+BAA+B,EAC/BnC,GAAG,CAAC,QAAQ,CAAC,EACb,gBACEQ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAM0B,IAAI,GAAG5B,GAAG,CAACS,MAAM,CAACG,OAAO;IAC/B,MAAMiB,cAAc,GAAG;MACrBC,QAAQ,EAAE9B,GAAG,CAAC8B,QAAQ;MACtBC,OAAO,EAAE/B,GAAG,CAAC+B,OAAc;MAC3B;MACAC,IAAI,EAAEhC,GAAG,CAACgC,IAAI;MACdC,aAAa,EAAEjC,GAAG,CAACkC,MAAM,CAACD;IAC5B,CAAC;IACD,IAAI;MACF,MAAME,QAAQ,GAAG,MAAM7C,OAAO,CAAC8C,mBAAmB,CAAC;QACjDR,IAAI;QACJS,WAAW,EAAE,IAAI;QACjBR;MACF,CAAC,CAAC;MACF3B,IAAI,CAACiC,QAAQ,CAACrB,eAAS,CAACwB,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,OAAOlB,GAAG,EAAE;MACZlB,IAAI,CAACkB,GAAG,CAAC;IACX;EACF,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"dist-tags.js","names":["_lodash","_interopRequireDefault","require","_mime","_core","_middleware","e","__esModule","default","_default","route","auth","storage","logger","can","allow","beforeAll","a","b","trace","afterAll","addTagPackageVersionMiddleware","req","res","next","_","isString","body","errorUtils","getBadRequest","tags","params","tag","mergeTagsNext","package","status","constants","HTTP_STATUS","CREATED","ok","API_MESSAGE","TAG_ADDED","err","put","DIST_TAGS_API_ENDPOINTS","tagging","media","mime","getType","tagging_package","delete","TAG_REMOVED","get","get_dist_tags","name","requestOptions","protocol","headers","host","remoteAddress","socket","manifest","getPackageByOptions","uplinksLook","DIST_TAGS"],"sources":["../src/dist-tags.ts"],"sourcesContent":["import { Router } from 'express';\nimport _ from 'lodash';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { constants, errorUtils } from '@verdaccio/core';\nimport { allow, media } from '@verdaccio/middleware';\nimport { DIST_TAGS_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Logger } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (_.isString(req.body) === false) {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(mime.getType('json')),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAAqD,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAOtC,SAAAG,SAAUC,KAAa,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAC1F,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC,CAAC;IACvCE,QAAQ,EAAEA,CAACH,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACF,MAAMG,8BAA8B,GAAG,eAAAA,CACrCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACK;IAC3B,IAAIC,eAAC,CAACC,QAAQ,CAACJ,GAAG,CAACK,IAAI,CAAC,KAAK,KAAK,EAAE;MAClC,OAAOH,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC7D;IAEA,MAAMC,IAAI,GAAG,CAAC,CAAC;IACfA,IAAI,CAACR,GAAG,CAACS,MAAM,CAACC,GAAG,CAAC,GAAGV,GAAG,CAACK,IAAI;IAC/B,IAAI;MACF,MAAMf,OAAO,CAACqB,aAAa,CAACX,GAAG,CAACS,MAAM,CAACG,OAAO,EAAEJ,IAAI,CAAC;MACrDP,GAAG,CAACY,MAAM,CAACC,eAAS,CAACC,WAAW,CAACC,OAAO,CAAC;MACzC,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAS,CAACI,WAAW,CAACC;MAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZlB,IAAI,CAACkB,GAAG,CAAC;IACX;EACF,CAAC;;EAED;EACAhC,KAAK,CAACiC,GAAG,CACPC,mCAAuB,CAACC,OAAO,EAC/B/B,GAAG,CAAC,SAAS,CAAC,EACd,IAAAgC,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3B3B,8BACF,CAAC;EAEDX,KAAK,CAACiC,GAAG,CACPC,mCAAuB,CAACK,eAAe,EACvCnC,GAAG,CAAC,SAAS,CAAC,EACd,IAAAgC,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3B3B,8BACF,CAAC;EAEDX,KAAK,CAACwC,MAAM,CACVN,mCAAuB,CAACK,eAAe,EACvCnC,GAAG,CAAC,SAAS,CAAC,EACd,gBACEQ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMM,IAAI,GAAG,CAAC,CAAC;IACfA,IAAI,CAACR,GAAG,CAACS,MAAM,CAACC,GAAG,CAAC,GAAG,IAAI;IAC3B,IAAI;MACF,MAAMpB,OAAO,CAACqB,aAAa,CAACX,GAAG,CAACS,MAAM,CAACG,OAAO,EAAEJ,IAAI,CAAC;MACrDP,GAAG,CAACY,MAAM,CAACC,eAAS,CAACC,WAAW,CAACC,OAAO,CAAC;MACzC,OAAOd,IAAI,CAAC;QACVe,EAAE,EAAEH,eAAS,CAACI,WAAW,CAACW;MAC5B,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOT,GAAG,EAAE;MACZlB,IAAI,CAACkB,GAAG,CAAC;IACX;EACF,CACF,CAAC;EAEDhC,KAAK,CAAC0C,GAAG,CACPR,mCAAuB,CAACS,aAAa,EACrCvC,GAAG,CAAC,QAAQ,CAAC,EACb,gBACEQ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAM8B,IAAI,GAAGhC,GAAG,CAACS,MAAM,CAACG,OAAO;IAC/B,MAAMqB,cAAc,GAAG;MACrBC,QAAQ,EAAElC,GAAG,CAACkC,QAAQ;MACtBC,OAAO,EAAEnC,GAAG,CAACmC,OAAc;MAC3B;MACAC,IAAI,EAAEpC,GAAG,CAACoC,IAAI;MACdC,aAAa,EAAErC,GAAG,CAACsC,MAAM,CAACD;IAC5B,CAAC;IACD,IAAI;MACF,MAAME,QAAQ,GAAG,MAAMjD,OAAO,CAACkD,mBAAmB,CAAC;QACjDR,IAAI;QACJS,WAAW,EAAE,IAAI;QACjBR;MACF,CAAC,CAAC;MACF/B,IAAI,CAACqC,QAAQ,CAACzB,eAAS,CAAC4B,SAAS,CAAC,CAAC;IACrC,CAAC,CAAC,OAAOtB,GAAG,EAAE;MACZlB,IAAI,CAACkB,GAAG,CAAC;IACX;EACF,CACF,CAAC;AACH","ignoreList":[]}

package/build/package.js

@@ -15,7 +15,7 @@ function _default(route, auth, storage, logger) {
     beforeAll: (a, b) => logger.trace(a, b),
     afterAll: (a, b) => logger.trace(a, b)
   });
-  route.get('/:package/:version?', can('access'), async function (req, _res, next) {
+  route.get(_middleware.PACKAGE_API_ENDPOINTS.get_package_by_version, can('access'), async function (req, _res, next) {
     debug('get package by version');
     const name = req.params.package;
     let version = req.params.version;
@@ -62,7 +62,7 @@ function _default(route, auth, storage, logger) {
       next(err);
     }
   });
-  route.get('/:package/-/:filename', can('access'), async function (req, res, next) {
+  route.get(_middleware.PACKAGE_API_ENDPOINTS.get_package_tarball, can('access'), async function (req, res, next) {
     const {
       package: pkgName,
       filename

package/build/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":["_debug","_interopRequireDefault","require","_core","_middleware","_store","e","__esModule","default","debug","buildDebug","_default","route","auth","storage","logger","can","allow","beforeAll","a","b","trace","afterAll","get","req","_res","next","name","params","package","version","write","query","username","remote_user","abbreviated","stringUtils","getByQualityPriorityValue","Storage","ABBREVIATED_HEADER","enabled","socket","remoteAddress","host","protocol","url","requestOptions","headers","byPassCache","manifest","getPackageByOptions","uplinksLook","setHeader","HEADER_TYPE","CONTENT_TYPE","HEADERS","JSON_INSTALL_CHARSET","JSON","err","res","pkgName","filename","abort","AbortController","stream","getTarball","signal","on","size","header","CONTENT_LENGTH","once","locals","report_error","OCTET_STREAM","pipe"],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Logger } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    '/:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('get package by version');\n      const name = req.params.package;\n      let version = req.params.version;\n      const write = req.query.write === 'true';\n      const username = req?.remote_user?.name;\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      if (debug.enabled) {\n        debug('is write %o', write);\n        debug('is abbreviated %o', abbreviated);\n        debug('package %o', name);\n        debug('version %o', version);\n        debug('username %o', username);\n        debug('remote address %o', req.socket.remoteAddress);\n        debug('host %o', req.host);\n        debug('protocol %o', req.protocol);\n        debug('url %o', req.url);\n      }\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n        byPassCache: write,\n        username,\n      };\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    '/:package/-/:filename',\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AAA2C,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAK3C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;AAElC,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAC1F,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC,CAAC;IACvCE,QAAQ,EAAEA,CAACH,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFR,KAAK,CAACW,GAAG,CACP,qBAAqB,EACrBP,GAAG,CAAC,QAAQ,CAAC,EACb,gBACEQ,GAAmB,EACnBC,IAAqB,EACrBC,IAAsB,EACP;IACfjB,KAAK,CAAC,wBAAwB,CAAC;IAC/B,MAAMkB,IAAI,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IAC/B,IAAIC,OAAO,GAAGN,GAAG,CAACI,MAAM,CAACE,OAAO;IAChC,MAAMC,KAAK,GAAGP,GAAG,CAACQ,KAAK,CAACD,KAAK,KAAK,MAAM;IACxC,MAAME,QAAQ,GAAGT,GAAG,EAAEU,WAAW,EAAEP,IAAI;IACvC,MAAMQ,WAAW,GACfC,iBAAW,CAACC,yBAAyB,CAACb,GAAG,CAACD,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAKe,cAAO,CAACC,kBAAkB;IACzF,IAAI9B,KAAK,CAAC+B,OAAO,EAAE;MACjB/B,KAAK,CAAC,aAAa,EAAEsB,KAAK,CAAC;MAC3BtB,KAAK,CAAC,mBAAmB,EAAE0B,WAAW,CAAC;MACvC1B,KAAK,CAAC,YAAY,EAAEkB,IAAI,CAAC;MACzBlB,KAAK,CAAC,YAAY,EAAEqB,OAAO,CAAC;MAC5BrB,KAAK,CAAC,aAAa,EAAEwB,QAAQ,CAAC;MAC9BxB,KAAK,CAAC,mBAAmB,EAAEe,GAAG,CAACiB,MAAM,CAACC,aAAa,CAAC;MACpDjC,KAAK,CAAC,SAAS,EAAEe,GAAG,CAACmB,IAAI,CAAC;MAC1BlC,KAAK,CAAC,aAAa,EAAEe,GAAG,CAACoB,QAAQ,CAAC;MAClCnC,KAAK,CAAC,QAAQ,EAAEe,GAAG,CAACqB,GAAG,CAAC;IAC1B;IACA,MAAMC,cAAc,GAAG;MACrBF,QAAQ,EAAEpB,GAAG,CAACoB,QAAQ;MACtBG,OAAO,EAAEvB,GAAG,CAACuB,OAAc;MAC3B;MACAJ,IAAI,EAAEnB,GAAG,CAACmB,IAAI;MACdD,aAAa,EAAElB,GAAG,CAACiB,MAAM,CAACC,aAAa;MACvCM,WAAW,EAAEjB,KAAK;MAClBE;IACF,CAAC;IAED,IAAI;MACF,MAAMgB,QAAQ,GAAG,MAAMnC,OAAO,CAACoC,mBAAmB,CAAC;QACjDvB,IAAI;QACJwB,WAAW,EAAE,IAAI;QACjBhB,WAAW;QACXL,OAAO;QACPgB;MACF,CAAC,CAAC;MACF,IAAIX,WAAW,EAAE;QACf1B,KAAK,CAAC,sBAAsB,CAAC;QAC7BgB,IAAI,CAAC2B,SAAS,CAACC,iBAAW,CAACC,YAAY,EAAEC,aAAO,CAACC,oBAAoB,CAAC;MACxE,CAAC,MAAM;QACL/C,KAAK,CAAC,eAAe,CAAC;QACtBgB,IAAI,CAAC2B,SAAS,CAACC,iBAAW,CAACC,YAAY,EAAEC,aAAO,CAACE,IAAI,CAAC;MACxD;MAEA/B,IAAI,CAACuB,QAAQ,CAAC;IAChB,CAAC,CAAC,OAAOS,GAAG,EAAE;MACZhC,IAAI,CAACgC,GAAG,CAAC;IACX;EACF,CACF,CAAC;EAED9C,KAAK,CAACW,GAAG,CACP,uBAAuB,EACvBP,GAAG,CAAC,QAAQ,CAAC,EACb,gBAAgBQ,GAAmB,EAAEmC,GAAoB,EAAEjC,IAAI,EAAiB;IAC9E,MAAM;MAAEG,OAAO,EAAE+B,OAAO;MAAEC;IAAS,CAAC,GAAGrC,GAAG,CAACI,MAAM;IACjD,MAAMkC,KAAK,GAAG,IAAIC,eAAe,CAAC,CAAC;IACnC,IAAI;MACFtD,KAAK,CAAC,wBAAwB,EAAEoD,QAAQ,CAAC;MACzC,MAAMG,MAAM,GAAI,MAAMlD,OAAO,CAACmD,UAAU,CAACL,OAAO,EAAEC,QAAQ,EAAE;QAC1DK,MAAM,EAAEJ,KAAK,CAACI;QACd;QACA;MACF,CAAC,CAAS;MAEVF,MAAM,CAACG,EAAE,CAAC,gBAAgB,EAAGC,IAAI,IAAK;QACpC3D,KAAK,CAAC,iBAAiB,EAAE2D,IAAI,CAAC;QAC9BT,GAAG,CAACU,MAAM,CAAChB,iBAAW,CAACiB,cAAc,EAAEF,IAAI,CAAC;MAC9C,CAAC,CAAC;MAEFJ,MAAM,CAACO,IAAI,CAAC,OAAO,EAAGb,GAAG,IAAK;QAC5BjD,KAAK,CAAC,8BAA8B,EAAEiD,GAAG,CAAC;QAC1CC,GAAG,CAACa,MAAM,CAACC,YAAY,CAACf,GAAG,CAAC;QAC5BhC,IAAI,CAACgC,GAAG,CAAC;MACX,CAAC,CAAC;MAEFlC,GAAG,CAAC2C,EAAE,CAAC,OAAO,EAAE,MAAM;QACpB1D,KAAK,CAAC,wBAAwB,EAAEe,GAAG,CAACqB,GAAG,CAAC;QACxCiB,KAAK,CAACA,KAAK,CAAC,CAAC;MACf,CAAC,CAAC;MAEFH,GAAG,CAACU,MAAM,CAACd,aAAO,CAACD,YAAY,EAAEC,aAAO,CAACmB,YAAY,CAAC;MACtDV,MAAM,CAACW,IAAI,CAAChB,GAAG,CAAC;IAClB,CAAC,CAAC,OAAOD,GAAQ,EAAE;MACjBC,GAAG,CAACa,MAAM,CAACC,YAAY,CAACf,GAAG,CAAC;MAC5BhC,IAAI,CAACgC,GAAG,CAAC;IACX;EACF,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"package.js","names":["_debug","_interopRequireDefault","require","_core","_middleware","_store","e","__esModule","default","debug","buildDebug","_default","route","auth","storage","logger","can","allow","beforeAll","a","b","trace","afterAll","get","PACKAGE_API_ENDPOINTS","get_package_by_version","req","_res","next","name","params","package","version","write","query","username","remote_user","abbreviated","stringUtils","getByQualityPriorityValue","Storage","ABBREVIATED_HEADER","enabled","socket","remoteAddress","host","protocol","url","requestOptions","headers","byPassCache","manifest","getPackageByOptions","uplinksLook","setHeader","HEADER_TYPE","CONTENT_TYPE","HEADERS","JSON_INSTALL_CHARSET","JSON","err","get_package_tarball","res","pkgName","filename","abort","AbortController","stream","getTarball","signal","on","size","header","CONTENT_LENGTH","once","locals","report_error","OCTET_STREAM","pipe"],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { allow } from '@verdaccio/middleware';\nimport { PACKAGE_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Logger } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('get package by version');\n      const name = req.params.package;\n      let version = req.params.version;\n      const write = req.query.write === 'true';\n      const username = req?.remote_user?.name;\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      if (debug.enabled) {\n        debug('is write %o', write);\n        debug('is abbreviated %o', abbreviated);\n        debug('package %o', name);\n        debug('version %o', version);\n        debug('username %o', username);\n        debug('remote address %o', req.socket.remoteAddress);\n        debug('host %o', req.host);\n        debug('protocol %o', req.protocol);\n        debug('url %o', req.url);\n      }\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n        byPassCache: write,\n        username,\n      };\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AAEA,IAAAG,MAAA,GAAAH,OAAA;AAA2C,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAK3C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;AAElC,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAC1F,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC,CAAC;IACvCE,QAAQ,EAAEA,CAACH,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFR,KAAK,CAACW,GAAG,CACPC,iCAAqB,CAACC,sBAAsB,EAC5CT,GAAG,CAAC,QAAQ,CAAC,EACb,gBACEU,GAAmB,EACnBC,IAAqB,EACrBC,IAAsB,EACP;IACfnB,KAAK,CAAC,wBAAwB,CAAC;IAC/B,MAAMoB,IAAI,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IAC/B,IAAIC,OAAO,GAAGN,GAAG,CAACI,MAAM,CAACE,OAAO;IAChC,MAAMC,KAAK,GAAGP,GAAG,CAACQ,KAAK,CAACD,KAAK,KAAK,MAAM;IACxC,MAAME,QAAQ,GAAGT,GAAG,EAAEU,WAAW,EAAEP,IAAI;IACvC,MAAMQ,WAAW,GACfC,iBAAW,CAACC,yBAAyB,CAACb,GAAG,CAACH,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAKiB,cAAO,CAACC,kBAAkB;IACzF,IAAIhC,KAAK,CAACiC,OAAO,EAAE;MACjBjC,KAAK,CAAC,aAAa,EAAEwB,KAAK,CAAC;MAC3BxB,KAAK,CAAC,mBAAmB,EAAE4B,WAAW,CAAC;MACvC5B,KAAK,CAAC,YAAY,EAAEoB,IAAI,CAAC;MACzBpB,KAAK,CAAC,YAAY,EAAEuB,OAAO,CAAC;MAC5BvB,KAAK,CAAC,aAAa,EAAE0B,QAAQ,CAAC;MAC9B1B,KAAK,CAAC,mBAAmB,EAAEiB,GAAG,CAACiB,MAAM,CAACC,aAAa,CAAC;MACpDnC,KAAK,CAAC,SAAS,EAAEiB,GAAG,CAACmB,IAAI,CAAC;MAC1BpC,KAAK,CAAC,aAAa,EAAEiB,GAAG,CAACoB,QAAQ,CAAC;MAClCrC,KAAK,CAAC,QAAQ,EAAEiB,GAAG,CAACqB,GAAG,CAAC;IAC1B;IACA,MAAMC,cAAc,GAAG;MACrBF,QAAQ,EAAEpB,GAAG,CAACoB,QAAQ;MACtBG,OAAO,EAAEvB,GAAG,CAACuB,OAAc;MAC3B;MACAJ,IAAI,EAAEnB,GAAG,CAACmB,IAAI;MACdD,aAAa,EAAElB,GAAG,CAACiB,MAAM,CAACC,aAAa;MACvCM,WAAW,EAAEjB,KAAK;MAClBE;IACF,CAAC;IAED,IAAI;MACF,MAAMgB,QAAQ,GAAG,MAAMrC,OAAO,CAACsC,mBAAmB,CAAC;QACjDvB,IAAI;QACJwB,WAAW,EAAE,IAAI;QACjBhB,WAAW;QACXL,OAAO;QACPgB;MACF,CAAC,CAAC;MACF,IAAIX,WAAW,EAAE;QACf5B,KAAK,CAAC,sBAAsB,CAAC;QAC7BkB,IAAI,CAAC2B,SAAS,CAACC,iBAAW,CAACC,YAAY,EAAEC,aAAO,CAACC,oBAAoB,CAAC;MACxE,CAAC,MAAM;QACLjD,KAAK,CAAC,eAAe,CAAC;QACtBkB,IAAI,CAAC2B,SAAS,CAACC,iBAAW,CAACC,YAAY,EAAEC,aAAO,CAACE,IAAI,CAAC;MACxD;MAEA/B,IAAI,CAACuB,QAAQ,CAAC;IAChB,CAAC,CAAC,OAAOS,GAAG,EAAE;MACZhC,IAAI,CAACgC,GAAG,CAAC;IACX;EACF,CACF,CAAC;EAEDhD,KAAK,CAACW,GAAG,CACPC,iCAAqB,CAACqC,mBAAmB,EACzC7C,GAAG,CAAC,QAAQ,CAAC,EACb,gBAAgBU,GAAmB,EAAEoC,GAAoB,EAAElC,IAAI,EAAiB;IAC9E,MAAM;MAAEG,OAAO,EAAEgC,OAAO;MAAEC;IAAS,CAAC,GAAGtC,GAAG,CAACI,MAAM;IACjD,MAAMmC,KAAK,GAAG,IAAIC,eAAe,CAAC,CAAC;IACnC,IAAI;MACFzD,KAAK,CAAC,wBAAwB,EAAEuD,QAAQ,CAAC;MACzC,MAAMG,MAAM,GAAI,MAAMrD,OAAO,CAACsD,UAAU,CAACL,OAAO,EAAEC,QAAQ,EAAE;QAC1DK,MAAM,EAAEJ,KAAK,CAACI;QACd;QACA;MACF,CAAC,CAAS;MAEVF,MAAM,CAACG,EAAE,CAAC,gBAAgB,EAAGC,IAAI,IAAK;QACpC9D,KAAK,CAAC,iBAAiB,EAAE8D,IAAI,CAAC;QAC9BT,GAAG,CAACU,MAAM,CAACjB,iBAAW,CAACkB,cAAc,EAAEF,IAAI,CAAC;MAC9C,CAAC,CAAC;MAEFJ,MAAM,CAACO,IAAI,CAAC,OAAO,EAAGd,GAAG,IAAK;QAC5BnD,KAAK,CAAC,8BAA8B,EAAEmD,GAAG,CAAC;QAC1CE,GAAG,CAACa,MAAM,CAACC,YAAY,CAAChB,GAAG,CAAC;QAC5BhC,IAAI,CAACgC,GAAG,CAAC;MACX,CAAC,CAAC;MAEFlC,GAAG,CAAC4C,EAAE,CAAC,OAAO,EAAE,MAAM;QACpB7D,KAAK,CAAC,wBAAwB,EAAEiB,GAAG,CAACqB,GAAG,CAAC;QACxCkB,KAAK,CAACA,KAAK,CAAC,CAAC;MACf,CAAC,CAAC;MAEFH,GAAG,CAACU,MAAM,CAACf,aAAO,CAACD,YAAY,EAAEC,aAAO,CAACoB,YAAY,CAAC;MACtDV,MAAM,CAACW,IAAI,CAAChB,GAAG,CAAC;IAClB,CAAC,CAAC,OAAOF,GAAQ,EAAE;MACjBE,GAAG,CAACa,MAAM,CAACC,YAAY,CAAChB,GAAG,CAAC;MAC5BhC,IAAI,CAACgC,GAAG,CAAC;IACX;EACF,CACF,CAAC;AACH","ignoreList":[]}

package/build/ping.js

@@ -4,8 +4,9 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.default = _default;
+var _middleware = require("@verdaccio/middleware");
 function _default(route) {
-  route.get('/-/ping', function (req, res, next) {
+  route.get(_middleware.PING_API_ENDPOINTS.ping, function (req, res, next) {
     next({});
   });
 }

package/build/ping.js.map

@@ -1 +1 @@
-{"version":3,"file":"ping.js","names":["_default","route","get","req","res","next"],"sources":["../src/ping.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router): void {\n  route.get(\n    '/-/ping',\n    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      next({});\n    }\n  );\n}\n"],"mappings":";;;;;;AAIe,SAAAA,SAAUC,KAAa,EAAQ;EAC5CA,KAAK,CAACC,GAAG,CACP,SAAS,EACT,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IAC3EA,IAAI,CAAC,CAAC,CAAC,CAAC;EACV,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"ping.js","names":["_middleware","require","_default","route","get","PING_API_ENDPOINTS","ping","req","res","next"],"sources":["../src/ping.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { PING_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router): void {\n  route.get(\n    PING_API_ENDPOINTS.ping,\n    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      next({});\n    }\n  );\n}\n"],"mappings":";;;;;;AAEA,IAAAA,WAAA,GAAAC,OAAA;AAIe,SAAAC,SAAUC,KAAa,EAAQ;EAC5CA,KAAK,CAACC,GAAG,CACPC,8BAAkB,CAACC,IAAI,EACvB,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IAC3EA,IAAI,CAAC,CAAC,CAAC,CAAC;EACV,CACF,CAAC;AACH","ignoreList":[]}

package/build/publish.js

@@ -114,8 +114,8 @@ function publish(router, auth, storage, logger) {
     beforeAll: (a, b) => logger.trace(a, b),
     afterAll: (a, b) => logger.trace(a, b)
   });
-  router.put('/:package', can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage, logger, 'publish one version'));
-  router.put('/:package/-rev/:revision', can('unpublish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage, logger, 'publish with revision'));
+  router.put(_middleware.PUBLISH_API_ENDPOINTS.add_package, can('publish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage, logger, 'publish one version'));
+  router.put(_middleware.PUBLISH_API_ENDPOINTS.publish_package, can('unpublish'), (0, _middleware.media)(_mime.default.getType('json')), _middleware.expectJson, publishPackage(storage, logger, 'publish with revision'));
 
   /**
    * Un-publishing an entire package.
@@ -125,8 +125,7 @@ function publish(router, auth, storage, logger) {
    *  -  no version is specified in the unpublish call
    *  -  all versions are removed npm unpublish package@*
    *  -  there is no versions on the metadata
-   
-   * then the client decides to DELETE the resource
+    * then the client decides to DELETE the resource
    * Example:
    * Get fresh manifest (write=true is a flag to get the latest revision)
    * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)
@@ -134,7 +133,7 @@ function publish(router, auth, storage, logger) {
    * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)
    * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
    */
-  router.delete('/:package/-rev/:revision', can('unpublish'), async function (req, res, next) {
+  router.delete(_middleware.PUBLISH_API_ENDPOINTS.publish_package, can('unpublish'), async function (req, res, next) {
     const packageName = req.params.package;
     const rev = req.params.revision;
     const username = req?.remote_user?.name;
@@ -157,7 +156,7 @@ function publish(router, auth, storage, logger) {
    Remove a tarball, this happens when npm unpublish a package unique version.
    npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
   */
-  router.delete('/:package/-/:filename/-rev/:revision', can('unpublish'), can('publish'), async function (req, res, next) {
+  router.delete(_middleware.PUBLISH_API_ENDPOINTS.remove_tarball, can('unpublish'), can('publish'), async function (req, res, next) {
     const packageName = req.params.package;
     const {
       filename,

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_mime","_core","_middleware","e","__esModule","default","debug","buildDebug","publish","router","auth","storage","logger","can","allow","beforeAll","a","b","trace","afterAll","put","media","mime","getType","expectJson","publishPackage","delete","req","res","next","packageName","params","package","rev","revision","username","remote_user","name","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","filename","removeTarball","TARBALL_REMOVED","origin","ac","AbortController","enabled","body","metadata","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","uplinksLook","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Logger } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\n// import star from './star';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t   }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"4-b0cdaefc9bdb77c8\",\n\t\t  \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n\t\t  ]\n\t   }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    '/:package',\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n   \n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    '/:package/-rev/:revision',\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    '/:package/-/:filename/-rev/:revision',\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    debug('publishing package %o for user %o', packageName, username);\n    logger.debug(\n      { packageName, username },\n      'publishing package @{packageName} for user @{username}'\n    );\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          headers: req.headers as { [key: string]: string },\n          username,\n        },\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAAiE,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAMjE;;AAEA,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAC7BC,MAAc,EACdC,IAAU,EACVC,OAAgB,EAChBC,MAAc,EACR;EACN,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC,CAAC;IACvCE,QAAQ,EAAEA,CAACH,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFR,MAAM,CAACW,GAAG,CACR,WAAW,EACXP,GAAG,CAAC,SAAS,CAAC,EACd,IAAAQ,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,EAAEC,MAAM,EAAE,qBAAqB,CACvD,CAAC;EAEDH,MAAM,CAACW,GAAG,CACR,0BAA0B,EAC1BP,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAQ,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAACd,OAAO,EAAEC,MAAM,EAAE,uBAAuB,CACzD,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEH,MAAM,CAACiB,MAAM,CACX,0BAA0B,EAC1Bb,GAAG,CAAC,WAAW,CAAC,EAChB,gBAAgBc,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAM,CAACG,QAAQ;IAC/B,MAAMC,QAAQ,GAAGR,GAAG,EAAES,WAAW,EAAEC,IAAI;IAEvCzB,MAAM,CAACN,KAAK,CAAC;MAAEwB;IAAY,CAAC,EAAE,6BAA6B,CAAC;IAC5D,IAAI;MACF,MAAMnB,OAAO,CAAC2B,aAAa,CAACR,WAAW,EAAEG,GAAG,EAAEE,QAAQ,CAAC;MACvD7B,KAAK,CAAC,wBAAwB,EAAEwB,WAAW,CAAC;MAC5CF,GAAG,CAACW,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAC/B,OAAOZ,IAAI,CAAC;QAAEa,EAAE,EAAEC,iBAAW,CAACC;MAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,OAAOhB,IAAI,CAACgB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;;EAED;AACF;AACA;AACA;EACEpC,MAAM,CAACiB,MAAM,CACX,sCAAsC,EACtCb,GAAG,CAAC,WAAW,CAAC,EAChBA,GAAG,CAAC,SAAS,CAAC,EACd,gBACEc,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEc,QAAQ;MAAEZ;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IACzC,MAAMI,QAAQ,GAAGR,GAAG,EAAES,WAAW,EAAEC,IAAI;IAEvCzB,MAAM,CAACN,KAAK,CACV;MAAEwB,WAAW;MAAEgB,QAAQ;MAAEZ;IAAS,CAAC,EACnC,kEACF,CAAC;IACD,IAAI;MACF,MAAMvB,OAAO,CAACoC,aAAa,CAACjB,WAAW,EAAEgB,QAAQ,EAAEZ,QAAQ,EAAEC,QAAQ,CAAC;MACtEP,GAAG,CAACW,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B7B,MAAM,CAACN,KAAK,CACV;QAAEwB,WAAW;QAAEgB,QAAQ;QAAEZ;MAAS,CAAC,EACnC,sEACF,CAAC;MACD,OAAOL,IAAI,CAAC;QAAEa,EAAE,EAAEC,iBAAW,CAACK;MAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,OAAOH,GAAG,EAAE;MACZ,OAAOhB,IAAI,CAACgB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH;AAEO,SAASpB,cAAcA,CAACd,OAAgB,EAAEC,MAAc,EAAEqC,MAAc,EAAO;EACpF,OAAO,gBACLtB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACfvB,KAAK,CAAC2C,MAAM,CAAC;IACb,MAAMC,EAAE,GAAG,IAAIC,eAAe,CAAC,CAAC;IAChC,MAAMrB,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEE;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAC/BzB,KAAK,CAAC,uBAAuB,EAAEwB,WAAW,CAAC;IAC3CxB,KAAK,CAAC,aAAa,EAAE4B,QAAQ,CAAC;IAC9B,IAAI5B,KAAK,CAAC8C,OAAO,EAAE;MACjB9C,KAAK,CAAC,SAAS,EAAEqB,GAAG,CAAC0B,IAAI,CAAC;IAC5B;IACA,MAAMC,QAAQ,GAAG3B,GAAG,CAAC0B,IAAI;IACzB,MAAMlB,QAAQ,GAAGR,GAAG,EAAES,WAAW,EAAEC,IAAI;IAEvC/B,KAAK,CAAC,mCAAmC,EAAEwB,WAAW,EAAEK,QAAQ,CAAC;IACjEvB,MAAM,CAACN,KAAK,CACV;MAAEwB,WAAW;MAAEK;IAAS,CAAC,EACzB,wDACF,CAAC;IAED,IAAI;MACF,MAAMoB,OAAO,GAAG,MAAM5C,OAAO,CAAC6C,cAAc,CAACF,QAAQ,EAAE;QACrDjB,IAAI,EAAEP,WAAW;QACjBI,QAAQ;QACRuB,MAAM,EAAEP,EAAE,CAACO,MAAM;QACjBC,cAAc,EAAE;UACdC,IAAI,EAAEhC,GAAG,CAACiC,QAAQ;UAClBC,QAAQ,EAAElC,GAAG,CAACkC,QAAQ;UACtBC,OAAO,EAAEnC,GAAG,CAACmC,OAAoC;UACjD3B;QACF,CAAC;QACD4B,WAAW,EAAE;MACf,CAAC,CAAC;MACFzD,KAAK,CAAC,sBAAsB,EAAEwB,WAAW,CAAC;MAE1CF,GAAG,CAACW,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B,OAAOZ,IAAI,CAAC;QACVmC,OAAO,EAAE,IAAI;QACbtB,EAAE,EAAEa;MACN,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOV,GAAQ,EAAE;MACjB;MACAhB,IAAI,CAACgB,GAAG,CAAC;IACX;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_mime","_core","_middleware","e","__esModule","default","debug","buildDebug","publish","router","auth","storage","logger","can","allow","beforeAll","a","b","trace","afterAll","put","PUBLISH_API_ENDPOINTS","add_package","media","mime","getType","expectJson","publishPackage","publish_package","delete","req","res","next","packageName","params","package","rev","revision","username","remote_user","name","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","err","remove_tarball","filename","removeTarball","TARBALL_REMOVED","origin","ac","AbortController","enabled","body","metadata","message","updateManifest","signal","requestOptions","host","hostname","protocol","headers","uplinksLook","success"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport mime from 'mime';\n\nimport { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';\nimport { allow, expectJson, media } from '@verdaccio/middleware';\n// import star from './star';\nimport { PUBLISH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Logger } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"3-b0cdaefc9bdb77c8\",\n\t\t  \"users\": {\n\t\t    [username]: boolean value (true, false)\n\t\t  }\n\t   }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n\t\t  \"_id\": pkgName,\n\t  \t\"_rev\": \"4-b0cdaefc9bdb77c8\",\n\t\t  \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n\t\t  ]\n\t   }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(mime.getType('json')),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n    const username = req?.remote_user?.name;\n\n    debug('publishing package %o for user %o', packageName, username);\n    logger.debug(\n      { packageName, username },\n      'publishing package @{packageName} for user @{username}'\n    );\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions: {\n          host: req.hostname,\n          protocol: req.protocol,\n          headers: req.headers as { [key: string]: string },\n          username,\n        },\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAAiE,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AACjE;;AAOA,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAC7BC,MAAc,EACdC,IAAU,EACVC,OAAgB,EAChBC,MAAc,EACR;EACN,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAEA,CAACC,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC,CAAC;IACvCE,QAAQ,EAAEA,CAACH,CAAC,EAAEC,CAAC,KAAKL,MAAM,CAACM,KAAK,CAACF,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACFR,MAAM,CAACW,GAAG,CACRC,iCAAqB,CAACC,WAAW,EACjCT,GAAG,CAAC,SAAS,CAAC,EACd,IAAAU,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAAChB,OAAO,EAAEC,MAAM,EAAE,qBAAqB,CACvD,CAAC;EAEDH,MAAM,CAACW,GAAG,CACRC,iCAAqB,CAACO,eAAe,EACrCf,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAU,iBAAK,EAACC,aAAI,CAACC,OAAO,CAAC,MAAM,CAAC,CAAC,EAC3BC,sBAAU,EACVC,cAAc,CAAChB,OAAO,EAAEC,MAAM,EAAE,uBAAuB,CACzD,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EAEEH,MAAM,CAACoB,MAAM,CACXR,iCAAqB,CAACO,eAAe,EACrCf,GAAG,CAAC,WAAW,CAAC,EAChB,gBAAgBiB,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAE;IACjF,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAMC,GAAG,GAAGN,GAAG,CAACI,MAAM,CAACG,QAAQ;IAC/B,MAAMC,QAAQ,GAAGR,GAAG,EAAES,WAAW,EAAEC,IAAI;IAEvC5B,MAAM,CAACN,KAAK,CAAC;MAAE2B;IAAY,CAAC,EAAE,6BAA6B,CAAC;IAC5D,IAAI;MACF,MAAMtB,OAAO,CAAC8B,aAAa,CAACR,WAAW,EAAEG,GAAG,EAAEE,QAAQ,CAAC;MACvDhC,KAAK,CAAC,wBAAwB,EAAE2B,WAAW,CAAC;MAC5CF,GAAG,CAACW,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAC/B,OAAOZ,IAAI,CAAC;QAAEa,EAAE,EAAEC,iBAAW,CAACC;MAAY,CAAC,CAAC;IAC9C,CAAC,CAAC,OAAOC,GAAG,EAAE;MACZ,OAAOhB,IAAI,CAACgB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;;EAED;AACF;AACA;AACA;EACEvC,MAAM,CAACoB,MAAM,CACXR,iCAAqB,CAAC4B,cAAc,EACpCpC,GAAG,CAAC,WAAW,CAAC,EAChBA,GAAG,CAAC,SAAS,CAAC,EACd,gBACEiB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEe,QAAQ;MAAEb;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IACzC,MAAMI,QAAQ,GAAGR,GAAG,EAAES,WAAW,EAAEC,IAAI;IAEvC5B,MAAM,CAACN,KAAK,CACV;MAAE2B,WAAW;MAAEiB,QAAQ;MAAEb;IAAS,CAAC,EACnC,kEACF,CAAC;IACD,IAAI;MACF,MAAM1B,OAAO,CAACwC,aAAa,CAAClB,WAAW,EAAEiB,QAAQ,EAAEb,QAAQ,EAAEC,QAAQ,CAAC;MACtEP,GAAG,CAACW,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/BhC,MAAM,CAACN,KAAK,CACV;QAAE2B,WAAW;QAAEiB,QAAQ;QAAEb;MAAS,CAAC,EACnC,sEACF,CAAC;MACD,OAAOL,IAAI,CAAC;QAAEa,EAAE,EAAEC,iBAAW,CAACM;MAAgB,CAAC,CAAC;IAClD,CAAC,CAAC,OAAOJ,GAAG,EAAE;MACZ,OAAOhB,IAAI,CAACgB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH;AAEO,SAASrB,cAAcA,CAAChB,OAAgB,EAAEC,MAAc,EAAEyC,MAAc,EAAO;EACpF,OAAO,gBACLvB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf1B,KAAK,CAAC+C,MAAM,CAAC;IACb,MAAMC,EAAE,GAAG,IAAIC,eAAe,CAAC,CAAC;IAChC,MAAMtB,WAAW,GAAGH,GAAG,CAACI,MAAM,CAACC,OAAO;IACtC,MAAM;MAAEE;IAAS,CAAC,GAAGP,GAAG,CAACI,MAAM;IAC/B5B,KAAK,CAAC,uBAAuB,EAAE2B,WAAW,CAAC;IAC3C3B,KAAK,CAAC,aAAa,EAAE+B,QAAQ,CAAC;IAC9B,IAAI/B,KAAK,CAACkD,OAAO,EAAE;MACjBlD,KAAK,CAAC,SAAS,EAAEwB,GAAG,CAAC2B,IAAI,CAAC;IAC5B;IACA,MAAMC,QAAQ,GAAG5B,GAAG,CAAC2B,IAAI;IACzB,MAAMnB,QAAQ,GAAGR,GAAG,EAAES,WAAW,EAAEC,IAAI;IAEvClC,KAAK,CAAC,mCAAmC,EAAE2B,WAAW,EAAEK,QAAQ,CAAC;IACjE1B,MAAM,CAACN,KAAK,CACV;MAAE2B,WAAW;MAAEK;IAAS,CAAC,EACzB,wDACF,CAAC;IAED,IAAI;MACF,MAAMqB,OAAO,GAAG,MAAMhD,OAAO,CAACiD,cAAc,CAACF,QAAQ,EAAE;QACrDlB,IAAI,EAAEP,WAAW;QACjBI,QAAQ;QACRwB,MAAM,EAAEP,EAAE,CAACO,MAAM;QACjBC,cAAc,EAAE;UACdC,IAAI,EAAEjC,GAAG,CAACkC,QAAQ;UAClBC,QAAQ,EAAEnC,GAAG,CAACmC,QAAQ;UACtBC,OAAO,EAAEpC,GAAG,CAACoC,OAAoC;UACjD5B;QACF,CAAC;QACD6B,WAAW,EAAE;MACf,CAAC,CAAC;MACF7D,KAAK,CAAC,sBAAsB,EAAE2B,WAAW,CAAC;MAE1CF,GAAG,CAACW,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;MAE/B,OAAOZ,IAAI,CAAC;QACVoC,OAAO,EAAE,IAAI;QACbvB,EAAE,EAAEc;MACN,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOX,GAAQ,EAAE;MACjB;MACAhB,IAAI,CAACgB,GAAG,CAAC;IACX;EACF,CAAC;AACH","ignoreList":[]}

package/build/search.js

@@ -5,9 +5,10 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.default = _default;
 var _core = require("@verdaccio/core");
+var _middleware = require("@verdaccio/middleware");
 function _default(route, logger) {
   // TODO: next major version, remove this
-  route.get('/-/all(/since)?', function (_req, res) {
+  route.get(_middleware.SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {
     logger.warn('search endpoint has been removed, please use search v1');
     res.status(_core.HTTP_STATUS.NOT_FOUND);
     res.json({

package/build/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":["_core","require","_default","route","logger","get","_req","res","warn","status","HTTP_STATUS","NOT_FOUND","json","error"],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { Logger } from '@verdaccio/types';\n\nexport default function (route, logger: Logger): void {\n  // TODO: next major version, remove this\n  route.get('/-/all(/since)?', function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAGe,SAAAC,SAAUC,KAAK,EAAEC,MAAc,EAAQ;EACpD;EACAD,KAAK,CAACE,GAAG,CAAC,iBAAiB,EAAE,UAAUC,IAAI,EAAEC,GAAG,EAAE;IAChDH,MAAM,CAACI,IAAI,CAAC,wDAAwD,CAAC;IACrED,GAAG,CAACE,MAAM,CAACC,iBAAW,CAACC,SAAS,CAAC;IACjCJ,GAAG,CAACK,IAAI,CAAC;MAAEC,KAAK,EAAE;IAAkC,CAAC,CAAC;EACxD,CAAC,CAAC;AACJ","ignoreList":[]}
+{"version":3,"file":"search.js","names":["_core","require","_middleware","_default","route","logger","get","SEARCH_API_ENDPOINTS","deprecated_search","_req","res","warn","status","HTTP_STATUS","NOT_FOUND","json","error"],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Logger } from '@verdaccio/types';\n\nexport default function (route, logger: Logger): void {\n  // TODO: next major version, remove this\n  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AAGe,SAAAE,SAAUC,KAAK,EAAEC,MAAc,EAAQ;EACpD;EACAD,KAAK,CAACE,GAAG,CAACC,gCAAoB,CAACC,iBAAiB,EAAE,UAAUC,IAAI,EAAEC,GAAG,EAAE;IACrEL,MAAM,CAACM,IAAI,CAAC,wDAAwD,CAAC;IACrED,GAAG,CAACE,MAAM,CAACC,iBAAW,CAACC,SAAS,CAAC;IACjCJ,GAAG,CAACK,IAAI,CAAC;MAAEC,KAAK,EAAE;IAAkC,CAAC,CAAC;EACxD,CAAC,CAAC;AACJ","ignoreList":[]}

package/build/stars.js

@@ -6,9 +6,10 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = _default;
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
+var _middleware = require("@verdaccio/middleware");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 function _default(route, storage) {
-  route.get('/-/_view/starredByUser', async (req, res, next) => {
+  route.get(_middleware.STARS_API_ENDPOINTS.get_user_starred_packages, async (req, res, next) => {
     const query = req.query;
     if (typeof query?.key !== 'string') {
       return next(_core.errorUtils.getBadRequest('missing query key username'));

package/build/stars.js.map

@@ -1 +1 @@
-{"version":3,"file":"stars.js","names":["_lodash","_interopRequireDefault","require","_core","e","__esModule","default","_default","route","storage","get","req","res","next","query","key","errorUtils","getBadRequest","localPackages","getLocalDatabase","filteredPackages","filter","localPackage","_","keys","USERS","includes","toString","replace","status","HTTP_STATUS","OK","rows","map","filteredPackage","value","name","err"],"sources":["../src/stars.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { Storage } from '@verdaccio/store';\nimport { Version } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    '/-/_view/starredByUser',\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          _.keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAAiE,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAMlD,SAAAG,SAAUC,KAAa,EAAEC,OAAgB,EAAQ;EAC9DD,KAAK,CAACE,GAAG,CACP,wBAAwB,EACxB,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAoB;IACnF,MAAMC,KAAsB,GAAGH,GAAG,CAACG,KAAK;IACxC,IAAI,OAAOA,KAAK,EAAEC,GAAG,KAAK,QAAQ,EAAE;MAClC,OAAOF,IAAI,CAACG,gBAAU,CAACC,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACrE;IAEA,IAAI;MACF,MAAMC,aAAwB,GAAG,MAAMT,OAAO,CAACU,gBAAgB,CAAC,CAAC;MACjE,MAAMC,gBAA2B,GAAGF,aAAa,CAACG,MAAM,CAAEC,YAAqB,IAC7EC,eAAC,CAACC,IAAI,CAACF,YAAY,CAACG,WAAK,CAAC,CAAC,CAACC,QAAQ,CAACZ,KAAK,EAAEC,GAAG,CAACY,QAAQ,CAAC,CAAC,CAACC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAClF,CAAC;MAEDhB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1BlB,IAAI,CAAC;QACHmB,IAAI,EAAEZ,gBAAgB,CAACa,GAAG,CAAEC,eAAwB,KAAM;UACxDC,KAAK,EAAED,eAAe,CAACE;QACzB,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,GAAQ,EAAE;MACjB,OAAOxB,IAAI,CAACwB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"stars.js","names":["_lodash","_interopRequireDefault","require","_core","_middleware","e","__esModule","default","_default","route","storage","get","STARS_API_ENDPOINTS","get_user_starred_packages","req","res","next","query","key","errorUtils","getBadRequest","localPackages","getLocalDatabase","filteredPackages","filter","localPackage","_","keys","USERS","includes","toString","replace","status","HTTP_STATUS","OK","rows","map","filteredPackage","value","name","err"],"sources":["../src/stars.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { STARS_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Version } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    STARS_API_ENDPOINTS.get_user_starred_packages,\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          _.keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AAA4D,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAM7C,SAAAG,SAAUC,KAAa,EAAEC,OAAgB,EAAQ;EAC9DD,KAAK,CAACE,GAAG,CACPC,+BAAmB,CAACC,yBAAyB,EAC7C,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAoB;IACnF,MAAMC,KAAsB,GAAGH,GAAG,CAACG,KAAK;IACxC,IAAI,OAAOA,KAAK,EAAEC,GAAG,KAAK,QAAQ,EAAE;MAClC,OAAOF,IAAI,CAACG,gBAAU,CAACC,aAAa,CAAC,4BAA4B,CAAC,CAAC;IACrE;IAEA,IAAI;MACF,MAAMC,aAAwB,GAAG,MAAMX,OAAO,CAACY,gBAAgB,CAAC,CAAC;MACjE,MAAMC,gBAA2B,GAAGF,aAAa,CAACG,MAAM,CAAEC,YAAqB,IAC7EC,eAAC,CAACC,IAAI,CAACF,YAAY,CAACG,WAAK,CAAC,CAAC,CAACC,QAAQ,CAACZ,KAAK,EAAEC,GAAG,CAACY,QAAQ,CAAC,CAAC,CAACC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAClF,CAAC;MAEDhB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1BlB,IAAI,CAAC;QACHmB,IAAI,EAAEZ,gBAAgB,CAACa,GAAG,CAAEC,eAAwB,KAAM;UACxDC,KAAK,EAAED,eAAe,CAACE;QACzB,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOC,GAAQ,EAAE;MACjB,OAAOxB,IAAI,CAACwB,GAAG,CAAC;IAClB;EACF,CACF,CAAC;AACH","ignoreList":[]}

package/build/v1/profile.js

@@ -21,7 +21,7 @@ function _default(route, auth, config) {
       fullname: ''
     };
   }
-  route.get('/-/npm/v1/user', (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
+  route.get(_middleware.PROFILE_API_ENDPOINTS.get_profile, (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
     if (_lodash.default.isNil(req.remote_user.name) === false) {
       return next(buildProfile(req.remote_user.name));
     }
@@ -30,7 +30,7 @@ function _default(route, auth, config) {
       message: _core.API_ERROR.MUST_BE_LOGGED
     });
   });
-  route.post('/-/npm/v1/user', (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
+  route.post(_middleware.PROFILE_API_ENDPOINTS.get_profile, (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
     if (_lodash.default.isNil(req.remote_user.name)) {
       res.status(_core.HTTP_STATUS.UNAUTHORIZED);
       return next({

package/build/v1/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","names":["_lodash","_interopRequireDefault","require","_core","_middleware","e","__esModule","default","_default","route","auth","config","buildProfile","name","tfa","email","email_verified","created","updated","cidr_whitelist","fullname","get","rateLimit","userRateLimit","req","res","next","_","isNil","remote_user","status","HTTP_STATUS","UNAUTHORIZED","message","API_ERROR","MUST_BE_LOGGED","post","password","body","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","errorUtils","getCode","PASSWORD_SHORT","isEmpty","old","getBadRequest","changePassword","err","isUpdated","isNull","getForbidden","getInternalError","INTERNAL_SERVER_ERROR","SERVICE_UNAVAILABLE","SUPPORT_ERRORS","TFA_DISABLED","INTERNAL_ERROR","APP_ERROR","PROFILE_ERROR"],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    '/-/npm/v1/user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    '/-/npm/v1/user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (_.isNil(password) === false) {\n        if (\n          validatioUtils.validatePassword(\n            password.new,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n          /* eslint new-cap:off */\n        }\n\n        if (_.isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (_.isNull(err) === false) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (_.isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAQA,IAAAE,WAAA,GAAAF,OAAA;AAAkD,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAgBnC,SAAAG,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAQ;EACxE,SAASC,YAAYA,CAACC,IAAY,EAAW;IAC3C,OAAO;MACLC,GAAG,EAAE,KAAK;MACVD,IAAI;MACJE,KAAK,EAAE,EAAE;MACTC,cAAc,EAAE,KAAK;MACrBC,OAAO,EAAE,EAAE;MACXC,OAAO,EAAE,EAAE;MACXC,cAAc,EAAE,IAAI;MACpBC,QAAQ,EAAE;IACZ,CAAC;EACH;EAEAX,KAAK,CAACY,GAAG,CACP,gBAAgB,EAChB,IAAAC,qBAAS,EAACX,MAAM,EAAEY,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3C,OAAOa,IAAI,CAACd,YAAY,CAACY,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,CAAC;IACjD;IAEAY,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;IACpC,OAAON,IAAI,CAAC;MACVO,OAAO,EAAEC,eAAS,CAACC;IACrB,CAAC,CAAC;EACJ,CACF,CAAC;EAED1B,KAAK,CAAC2B,IAAI,CACR,gBAAgB,EAChB,IAAAd,qBAAS,EAACX,MAAM,EAAEY,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,EAAE;MACjCY,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;MACpC,OAAON,IAAI,CAAC;QACVO,OAAO,EAAEC,eAAS,CAACC;MACrB,CAAC,CAAC;IACJ;IAEA,MAAM;MAAEE,QAAQ;MAAEvB;IAAI,CAAC,GAAGU,GAAG,CAACc,IAAI;IAClC,MAAM;MAAEzB;IAAK,CAAC,GAAGW,GAAG,CAACK,WAAW;IAEhC,IAAIF,eAAC,CAACC,KAAK,CAACS,QAAQ,CAAC,KAAK,KAAK,EAAE;MAC/B,IACEE,oBAAc,CAACC,gBAAgB,CAC7BH,QAAQ,CAACI,GAAG,EACZ9B,MAAM,EAAE+B,cAAc,EAAEC,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA;QACA,OAAOjB,IAAI,CAACkB,gBAAU,CAACC,OAAO,CAACd,iBAAW,CAACC,YAAY,EAAEE,eAAS,CAACY,cAAc,CAAC,CAAC;QACnF;MACF;MAEA,IAAInB,eAAC,CAACoB,OAAO,CAACV,QAAQ,CAACW,GAAG,CAAC,EAAE;QAC3B,OAAOtB,IAAI,CAACkB,gBAAU,CAACK,aAAa,CAAC,0BAA0B,CAAC,CAAC;MACnE;MAEAvC,IAAI,CAACwC,cAAc,CACjBrC,IAAI,EACJwB,QAAQ,CAACW,GAAG,EACZX,QAAQ,CAACI,GAAG,EACZ,CAACU,GAAG,EAAEC,SAAS,KAAuB;QACpC,IAAIzB,eAAC,CAAC0B,MAAM,CAACF,GAAG,CAAC,KAAK,KAAK,EAAE;UAC3B,OAAOzB,IAAI,CAACkB,gBAAU,CAACU,YAAY,CAACH,GAAG,CAAClB,OAAO,CAAC,CAAC;QACnD;QAEA,IAAImB,SAAS,EAAE;UACb,OAAO1B,IAAI,CAACd,YAAY,CAACY,GAAG,CAACK,WAAW,CAAChB,IAAI,CAAC,CAAC;QACjD;QACA,OAAOa,IAAI,CAACkB,gBAAU,CAACW,gBAAgB,CAACrB,eAAS,CAACsB,qBAAqB,CAAC,CAAC;MAC3E,CACF,CAAC;IACH,CAAC,MAAM,IAAI7B,eAAC,CAACC,KAAK,CAACd,GAAG,CAAC,KAAK,KAAK,EAAE;MACjC,OAAOY,IAAI,CACTkB,gBAAU,CAACC,OAAO,CAACd,iBAAW,CAAC0B,mBAAmB,EAAEC,oBAAc,CAACC,YAAY,CACjF,CAAC;IACH,CAAC,MAAM;MACL,OAAOjC,IAAI,CAACkB,gBAAU,CAACC,OAAO,CAACd,iBAAW,CAAC6B,cAAc,EAAEC,eAAS,CAACC,aAAa,CAAC,CAAC;IACtF;EACF,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"profile.js","names":["_lodash","_interopRequireDefault","require","_core","_middleware","e","__esModule","default","_default","route","auth","config","buildProfile","name","tfa","email","email_verified","created","updated","cidr_whitelist","fullname","get","PROFILE_API_ENDPOINTS","get_profile","rateLimit","userRateLimit","req","res","next","_","isNil","remote_user","status","HTTP_STATUS","UNAUTHORIZED","message","API_ERROR","MUST_BE_LOGGED","post","password","body","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","errorUtils","getCode","PASSWORD_SHORT","isEmpty","old","getBadRequest","changePassword","err","isUpdated","isNull","getForbidden","getInternalError","INTERNAL_SERVER_ERROR","SERVICE_UNAVAILABLE","SUPPORT_ERRORS","TFA_DISABLED","INTERNAL_ERROR","APP_ERROR","PROFILE_ERROR"],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { PROFILE_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (_.isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (_.isNil(password) === false) {\n        if (\n          validatioUtils.validatePassword(\n            password.new,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n          /* eslint new-cap:off */\n        }\n\n        if (_.isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (_.isNull(err) === false) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (_.isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAQA,IAAAE,WAAA,GAAAF,OAAA;AAA8D,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAiB/C,SAAAG,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAQ;EACxE,SAASC,YAAYA,CAACC,IAAY,EAAW;IAC3C,OAAO;MACLC,GAAG,EAAE,KAAK;MACVD,IAAI;MACJE,KAAK,EAAE,EAAE;MACTC,cAAc,EAAE,KAAK;MACrBC,OAAO,EAAE,EAAE;MACXC,OAAO,EAAE,EAAE;MACXC,cAAc,EAAE,IAAI;MACpBC,QAAQ,EAAE;IACZ,CAAC;EACH;EAEAX,KAAK,CAACY,GAAG,CACPC,iCAAqB,CAACC,WAAW,EACjC,IAAAC,qBAAS,EAACb,MAAM,EAAEc,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAClB,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3C,OAAOe,IAAI,CAAChB,YAAY,CAACc,GAAG,CAACK,WAAW,CAAClB,IAAI,CAAC,CAAC;IACjD;IAEAc,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;IACpC,OAAON,IAAI,CAAC;MACVO,OAAO,EAAEC,eAAS,CAACC;IACrB,CAAC,CAAC;EACJ,CACF,CAAC;EAED5B,KAAK,CAAC6B,IAAI,CACRhB,iCAAqB,CAACC,WAAW,EACjC,IAAAC,qBAAS,EAACb,MAAM,EAAEc,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,IAAIC,eAAC,CAACC,KAAK,CAACJ,GAAG,CAACK,WAAW,CAAClB,IAAI,CAAC,EAAE;MACjCc,GAAG,CAACK,MAAM,CAACC,iBAAW,CAACC,YAAY,CAAC;MACpC,OAAON,IAAI,CAAC;QACVO,OAAO,EAAEC,eAAS,CAACC;MACrB,CAAC,CAAC;IACJ;IAEA,MAAM;MAAEE,QAAQ;MAAEzB;IAAI,CAAC,GAAGY,GAAG,CAACc,IAAI;IAClC,MAAM;MAAE3B;IAAK,CAAC,GAAGa,GAAG,CAACK,WAAW;IAEhC,IAAIF,eAAC,CAACC,KAAK,CAACS,QAAQ,CAAC,KAAK,KAAK,EAAE;MAC/B,IACEE,oBAAc,CAACC,gBAAgB,CAC7BH,QAAQ,CAACI,GAAG,EACZhC,MAAM,EAAEiC,cAAc,EAAEC,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA;QACA,OAAOjB,IAAI,CAACkB,gBAAU,CAACC,OAAO,CAACd,iBAAW,CAACC,YAAY,EAAEE,eAAS,CAACY,cAAc,CAAC,CAAC;QACnF;MACF;MAEA,IAAInB,eAAC,CAACoB,OAAO,CAACV,QAAQ,CAACW,GAAG,CAAC,EAAE;QAC3B,OAAOtB,IAAI,CAACkB,gBAAU,CAACK,aAAa,CAAC,0BAA0B,CAAC,CAAC;MACnE;MAEAzC,IAAI,CAAC0C,cAAc,CACjBvC,IAAI,EACJ0B,QAAQ,CAACW,GAAG,EACZX,QAAQ,CAACI,GAAG,EACZ,CAACU,GAAG,EAAEC,SAAS,KAAuB;QACpC,IAAIzB,eAAC,CAAC0B,MAAM,CAACF,GAAG,CAAC,KAAK,KAAK,EAAE;UAC3B,OAAOzB,IAAI,CAACkB,gBAAU,CAACU,YAAY,CAACH,GAAG,CAAClB,OAAO,CAAC,CAAC;QACnD;QAEA,IAAImB,SAAS,EAAE;UACb,OAAO1B,IAAI,CAAChB,YAAY,CAACc,GAAG,CAACK,WAAW,CAAClB,IAAI,CAAC,CAAC;QACjD;QACA,OAAOe,IAAI,CAACkB,gBAAU,CAACW,gBAAgB,CAACrB,eAAS,CAACsB,qBAAqB,CAAC,CAAC;MAC3E,CACF,CAAC;IACH,CAAC,MAAM,IAAI7B,eAAC,CAACC,KAAK,CAAChB,GAAG,CAAC,KAAK,KAAK,EAAE;MACjC,OAAOc,IAAI,CACTkB,gBAAU,CAACC,OAAO,CAACd,iBAAW,CAAC0B,mBAAmB,EAAEC,oBAAc,CAACC,YAAY,CACjF,CAAC;IACH,CAAC,MAAM;MACL,OAAOjC,IAAI,CAACkB,gBAAU,CAACC,OAAO,CAACd,iBAAW,CAAC6B,cAAc,EAAEC,eAAS,CAACC,aAAa,CAAC,CAAC;IACtF;EACF,CACF,CAAC;AACH","ignoreList":[]}

package/build/v1/search.js

@@ -7,6 +7,7 @@ exports.default = _default;
 var _debug = _interopRequireDefault(require("debug"));
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
+var _middleware = require("@verdaccio/middleware");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:api:search');
 
@@ -37,7 +38,7 @@ function _default(route, auth, storage, logger) {
       });
     });
   }
-  route.get('/-/v1/search', async (req, res, next) => {
+  route.get(_middleware.SEARCH_API_ENDPOINTS.search, async (req, res, next) => {
     const {
       query,
       url

package/build/v1/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","e","__esModule","default","debug","buildDebug","_default","route","auth","storage","logger","checkAccess","pkg","remoteUser","Promise","resolve","reject","allow_access","packageName","package","name","err","allowed","status","String","match","get","req","res","next","query","url","size","from","map","k","data","abort","AbortController","socket","on","parseInt","search","length","checkAccessPromises","all","pkgItem","remote_user","final","filter","i","_","isNull","slice","response","objects","total","time","Date","toUTCString","HTTP_STATUS","OK","json","error"],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HTTP_STATUS, searchUtils } from '@verdaccio/core';\nimport { Storage } from '@verdaccio/store';\nimport { Manifest } from '@verdaccio/types';\nimport { Logger } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            allowed = false;\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get('/-/v1/search', async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n\n    req.socket.on('close', function () {\n      debug('search web aborted');\n      abort.abort();\n    });\n\n    size = parseInt(size, 10) || 20;\n    from = parseInt(from, 10) || 0;\n\n    try {\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => !_.isNull(i))\n        .slice(from, size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(next);\n      return;\n    }\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AAA2D,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAK3D,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACe,SAAAC,SAAUC,KAAK,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAClF,SAASC,WAAWA,CAACC,GAAQ,EAAEJ,IAAS,EAAEK,UAAU,EAA4B;IAC9E,OAAO,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;MACtCR,IAAI,CAACS,YAAY,CAAC;QAAEC,WAAW,EAAEN,GAAG,EAAEO,OAAO,EAAEC;MAAK,CAAC,EAAEP,UAAU,EAAE,UAAUQ,GAAG,EAAEC,OAAO,EAAE;QACzF,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACE,MAAM,IAAIC,MAAM,CAACH,GAAG,CAACE,MAAM,CAAC,CAACE,KAAK,CAAC,SAAS,CAAC,EAAE;YACrD;YACA;YACAH,OAAO,GAAG,KAAK;YACf,OAAOP,OAAO,CAAC,IAAI,CAAC;UACtB,CAAC,MAAM;YACLC,MAAM,CAACK,GAAG,CAAC;UACb;QACF,CAAC,MAAM;UACL,OAAON,OAAO,CAACO,OAAO,GAAGV,GAAG,GAAG,IAAI,CAAC;QACtC;MACF,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEAL,KAAK,CAACmB,GAAG,CAAC,cAAc,EAAE,OAAOC,GAAG,EAAEC,GAAG,EAAEC,IAAI,KAAK;IAClD,MAAM;MAAEC,KAAK;MAAEC;IAAI,CAAC,GAAGJ,GAAG;IAC1B,IAAI,CAACK,IAAI,EAAEC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAACC,GAAG,CAAEC,CAAC,IAAKL,KAAK,CAACK,CAAC,CAAC,CAAC;IACxD,IAAIC,IAAI;IACR,MAAMC,KAAK,GAAG,IAAIC,eAAe,CAAC,CAAC;IAEnCX,GAAG,CAACY,MAAM,CAACC,EAAE,CAAC,OAAO,EAAE,YAAY;MACjCpC,KAAK,CAAC,oBAAoB,CAAC;MAC3BiC,KAAK,CAACA,KAAK,CAAC,CAAC;IACf,CAAC,CAAC;IAEFL,IAAI,GAAGS,QAAQ,CAACT,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC/BC,IAAI,GAAGQ,QAAQ,CAACR,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IAE9B,IAAI;MACF7B,KAAK,CAAC,0BAA0B,CAAC;MACjCgC,IAAI,GAAG,MAAM3B,OAAO,CAACiC,MAAM,CAAC;QAC1BZ,KAAK;QACLC,GAAG;QACHM;MACF,CAAC,CAAC;MACFjC,KAAK,CAAC,wBAAwB,EAAEgC,IAAI,CAACO,MAAM,CAAC;MAC5C,MAAMC,mBAAgD,GAAG,MAAM9B,OAAO,CAAC+B,GAAG,CACxET,IAAI,CAACF,GAAG,CAAEY,OAAO,IAAK;QACpB,OAAOnC,WAAW,CAACmC,OAAO,EAAEtC,IAAI,EAAEmB,GAAG,CAACoB,WAAW,CAAC;MACpD,CAAC,CACH,CAAC;MAED,MAAMC,KAAkC,GAAGJ,mBAAmB,CAC3DK,MAAM,CAAEC,CAAC,IAAK,CAACC,eAAC,CAACC,MAAM,CAACF,CAAC,CAAC,CAAC,CAC3BG,KAAK,CAACpB,IAAI,EAAED,IAAI,CAAC;MACpBtB,MAAM,CAACN,KAAK,CAAC,kBAAkB4C,KAAK,EAAEL,MAAM,EAAE,CAAC;MAE/C,MAAMW,QAAmC,GAAG;QAC1CC,OAAO,EAAEP,KAAK;QACdQ,KAAK,EAAER,KAAK,CAACL,MAAM;QACnBc,IAAI,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC;MAC/B,CAAC;MAED/B,GAAG,CAACL,MAAM,CAACqC,iBAAW,CAACC,EAAE,CAAC,CAACC,IAAI,CAACR,QAAQ,CAAC;IAC3C,CAAC,CAAC,OAAOS,KAAK,EAAE;MACdrD,MAAM,CAACqD,KAAK,CAAC;QAAEA;MAAM,CAAC,EAAE,6CAA6C,CAAC;MACtElC,IAAI,CAACA,IAAI,CAAC;MACV;IACF;EACF,CAAC,CAAC;AACJ","ignoreList":[]}
+{"version":3,"file":"search.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_middleware","e","__esModule","default","debug","buildDebug","_default","route","auth","storage","logger","checkAccess","pkg","remoteUser","Promise","resolve","reject","allow_access","packageName","package","name","err","allowed","status","String","match","get","SEARCH_API_ENDPOINTS","search","req","res","next","query","url","size","from","map","k","data","abort","AbortController","socket","on","parseInt","length","checkAccessPromises","all","pkgItem","remote_user","final","filter","i","_","isNull","slice","response","objects","total","time","Date","toUTCString","HTTP_STATUS","OK","json","error"],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HTTP_STATUS, searchUtils } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Manifest } from '@verdaccio/types';\nimport { Logger } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            allowed = false;\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n\n    req.socket.on('close', function () {\n      debug('search web aborted');\n      abort.abort();\n    });\n\n    size = parseInt(size, 10) || 20;\n    from = parseInt(from, 10) || 0;\n\n    try {\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => !_.isNull(i))\n        .slice(from, size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(next);\n      return;\n    }\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAA6D,SAAAD,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAK7D,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACA;AACA;AACe,SAAAC,SAAUC,KAAK,EAAEC,IAAU,EAAEC,OAAgB,EAAEC,MAAc,EAAQ;EAClF,SAASC,WAAWA,CAACC,GAAQ,EAAEJ,IAAS,EAAEK,UAAU,EAA4B;IAC9E,OAAO,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAK;MACtCR,IAAI,CAACS,YAAY,CAAC;QAAEC,WAAW,EAAEN,GAAG,EAAEO,OAAO,EAAEC;MAAK,CAAC,EAAEP,UAAU,EAAE,UAAUQ,GAAG,EAAEC,OAAO,EAAE;QACzF,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACE,MAAM,IAAIC,MAAM,CAACH,GAAG,CAACE,MAAM,CAAC,CAACE,KAAK,CAAC,SAAS,CAAC,EAAE;YACrD;YACA;YACAH,OAAO,GAAG,KAAK;YACf,OAAOP,OAAO,CAAC,IAAI,CAAC;UACtB,CAAC,MAAM;YACLC,MAAM,CAACK,GAAG,CAAC;UACb;QACF,CAAC,MAAM;UACL,OAAON,OAAO,CAACO,OAAO,GAAGV,GAAG,GAAG,IAAI,CAAC;QACtC;MACF,CAAC,CAAC;IACJ,CAAC,CAAC;EACJ;EAEAL,KAAK,CAACmB,GAAG,CAACC,gCAAoB,CAACC,MAAM,EAAE,OAAOC,GAAG,EAAEC,GAAG,EAAEC,IAAI,KAAK;IAC/D,MAAM;MAAEC,KAAK;MAAEC;IAAI,CAAC,GAAGJ,GAAG;IAC1B,IAAI,CAACK,IAAI,EAAEC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAACC,GAAG,CAAEC,CAAC,IAAKL,KAAK,CAACK,CAAC,CAAC,CAAC;IACxD,IAAIC,IAAI;IACR,MAAMC,KAAK,GAAG,IAAIC,eAAe,CAAC,CAAC;IAEnCX,GAAG,CAACY,MAAM,CAACC,EAAE,CAAC,OAAO,EAAE,YAAY;MACjCtC,KAAK,CAAC,oBAAoB,CAAC;MAC3BmC,KAAK,CAACA,KAAK,CAAC,CAAC;IACf,CAAC,CAAC;IAEFL,IAAI,GAAGS,QAAQ,CAACT,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;IAC/BC,IAAI,GAAGQ,QAAQ,CAACR,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IAE9B,IAAI;MACF/B,KAAK,CAAC,0BAA0B,CAAC;MACjCkC,IAAI,GAAG,MAAM7B,OAAO,CAACmB,MAAM,CAAC;QAC1BI,KAAK;QACLC,GAAG;QACHM;MACF,CAAC,CAAC;MACFnC,KAAK,CAAC,wBAAwB,EAAEkC,IAAI,CAACM,MAAM,CAAC;MAC5C,MAAMC,mBAAgD,GAAG,MAAM/B,OAAO,CAACgC,GAAG,CACxER,IAAI,CAACF,GAAG,CAAEW,OAAO,IAAK;QACpB,OAAOpC,WAAW,CAACoC,OAAO,EAAEvC,IAAI,EAAEqB,GAAG,CAACmB,WAAW,CAAC;MACpD,CAAC,CACH,CAAC;MAED,MAAMC,KAAkC,GAAGJ,mBAAmB,CAC3DK,MAAM,CAAEC,CAAC,IAAK,CAACC,eAAC,CAACC,MAAM,CAACF,CAAC,CAAC,CAAC,CAC3BG,KAAK,CAACnB,IAAI,EAAED,IAAI,CAAC;MACpBxB,MAAM,CAACN,KAAK,CAAC,kBAAkB6C,KAAK,EAAEL,MAAM,EAAE,CAAC;MAE/C,MAAMW,QAAmC,GAAG;QAC1CC,OAAO,EAAEP,KAAK;QACdQ,KAAK,EAAER,KAAK,CAACL,MAAM;QACnBc,IAAI,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,WAAW,CAAC;MAC/B,CAAC;MAED9B,GAAG,CAACP,MAAM,CAACsC,iBAAW,CAACC,EAAE,CAAC,CAACC,IAAI,CAACR,QAAQ,CAAC;IAC3C,CAAC,CAAC,OAAOS,KAAK,EAAE;MACdtD,MAAM,CAACsD,KAAK,CAAC;QAAEA;MAAM,CAAC,EAAE,6CAA6C,CAAC;MACtEjC,IAAI,CAACA,IAAI,CAAC;MACV;IACF;EACF,CAAC,CAAC;AACJ","ignoreList":[]}

package/build/v1/token.js

@@ -19,7 +19,7 @@ function normalizeToken(token) {
 
 // https://github.com/npm/npm-profile/blob/latest/lib/index.js
 function _default(route, auth, storage, config, logger) {
-  route.get('/-/npm/v1/tokens', (0, _middleware.rateLimit)(config?.userRateLimit), async function (req, res, next) {
+  route.get(_middleware.TOKEN_API_ENDPOINTS.get_tokens, (0, _middleware.rateLimit)(config?.userRateLimit), async function (req, res, next) {
     const {
       name
     } = req.remote_user;
@@ -48,7 +48,7 @@ function _default(route, auth, storage, config, logger) {
     }
     return next(_core.errorUtils.getUnauthorized());
   });
-  route.post('/-/npm/v1/tokens', (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
+  route.post(_middleware.TOKEN_API_ENDPOINTS.get_tokens, (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
     const {
       password,
       readonly,
@@ -114,7 +114,7 @@ function _default(route, auth, storage, config, logger) {
       }
     });
   });
-  route.delete('/-/npm/v1/tokens/token/:tokenKey', (0, _middleware.rateLimit)(config?.userRateLimit), async (req, res, next) => {
+  route.delete(_middleware.TOKEN_API_ENDPOINTS.delete_token, (0, _middleware.rateLimit)(config?.userRateLimit), async (req, res, next) => {
     const {
       params: {
         tokenKey

package/build/v1/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["_lodash","_interopRequireDefault","require","_auth","_core","_middleware","_utils","e","__esModule","default","normalizeToken","token","created","Date","toISOString","_default","route","auth","storage","config","logger","get","rateLimit","userRateLimit","req","res","next","name","remote_user","_","isNil","tokens","readTokens","user","totalTokens","length","debug","status","HTTP_STATUS","OK","objects","map","urls","error","msg","errorUtils","getCode","INTERNAL_ERROR","message","getUnauthorized","post","password","readonly","cidr_whitelist","body","isBoolean","isArray","BAD_DATA","SUPPORT_ERRORS","PARAMETERS_NOT_VALID","authenticate","err","errorCode","UNAUTHORIZED","isFunction","saveToken","NOT_IMPLEMENTED","STORAGE_NOT_IMPLEMENT","getApiToken","getInternalError","key","stringToMD5","maskedToken","mask","getTime","cidr","set","HEADERS","CACHE_CONTROL","delete","params","tokenKey","deleteToken","info"],"sources":["../../src/v1/token.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config, RemoteUser, Token } from '@verdaccio/types';\nimport { Logger } from '@verdaccio/types';\nimport { mask, stringToMD5 } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  created: string;\n};\n\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    '/-/npm/v1/tokens',\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    '/-/npm/v1/tokens',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!_.isBoolean(readonly) || !_.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (!_.isFunction(storage.saveToken)) {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const token = await getApiToken(auth, config, user as RemoteUser, password);\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          const key = stringToMD5(token);\n          // TODO: use a utility here\n          const maskedToken = mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    '/-/npm/v1/tokens/token/:tokenKey',\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAIA,IAAAI,MAAA,GAAAJ,OAAA;AAAqD,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAQrD,SAASG,cAAcA,CAACC,KAAY,EAAkB;EACpD,OAAO;IACL,GAAGA,KAAK;IACRC,OAAO,EAAE,IAAIC,IAAI,CAACF,KAAK,CAACC,OAAO,CAAC,CAACE,WAAW,CAAC;EAC/C,CAAC;AACH;;AAEA;AACe,SAAAC,SACbC,KAAa,EACbC,IAAU,EACVC,OAAgB,EAChBC,MAAc,EACdC,MAAc,EACR;EACNJ,KAAK,CAACK,GAAG,CACP,kBAAkB,EAClB,IAAAC,qBAAS,EAACH,MAAM,EAAEI,aAAa,CAAC,EAChC,gBAAgBC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IAC1E,MAAM;MAAEC;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3B,IAAI;QACF,MAAMI,MAAM,GAAG,MAAMb,OAAO,CAACc,UAAU,CAAC;UAAEC,IAAI,EAAEN;QAAK,CAAC,CAAC;QACvD,MAAMO,WAAW,GAAGH,MAAM,CAACI,MAAM;QACjCf,MAAM,CAACgB,KAAK,CAAC;UAAEF;QAAY,CAAC,EAAE,sCAAsC,CAAC;QAErET,GAAG,CAACY,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;QAC1B,OAAOb,IAAI,CAAC;UACVc,OAAO,EAAET,MAAM,CAACU,GAAG,CAAC/B,cAAc,CAAC;UACnCgC,IAAI,EAAE;YACJhB,IAAI,EAAE,EAAE,CAAE;UACZ;QACF,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOiB,KAAU,EAAE;QACnBvB,MAAM,CAACuB,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,iCAAiC,CAAC;QACrE,OAAOlB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOtB,IAAI,CAACmB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;EAEDjC,KAAK,CAACkC,IAAI,CACR,kBAAkB,EAClB,IAAA5B,qBAAS,EAACH,MAAM,EAAEI,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IACpE,MAAM;MAAEyB,QAAQ;MAAEC,QAAQ;MAAEC;IAAe,CAAC,GAAG7B,GAAG,CAAC8B,IAAI;IACvD,MAAM;MAAE3B;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAI,CAACC,eAAC,CAAC0B,SAAS,CAACH,QAAQ,CAAC,IAAI,CAACvB,eAAC,CAAC2B,OAAO,CAACH,cAAc,CAAC,EAAE;MACxD,OAAO3B,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACmB,QAAQ,EAAEC,oBAAc,CAACC,oBAAoB,CAAC,CAAC;IAC5F;IAEA1C,IAAI,CAAC2C,YAAY,CAACjC,IAAI,EAAEwB,QAAQ,EAAE,OAAOU,GAAG,EAAE5B,IAAiB,KAAK;MAClE,IAAI4B,GAAG,EAAE;QACP,MAAMC,SAAS,GAAGD,GAAG,CAACb,OAAO,GAAGV,iBAAW,CAACyB,YAAY,GAAGzB,iBAAW,CAACS,cAAc;QACrF,OAAOrB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACgB,SAAS,EAAED,GAAG,CAACb,OAAO,CAAC,CAAC;MACzD;MAEAxB,GAAG,CAACI,WAAW,GAAGK,IAAI;MAEtB,IAAI,CAACJ,eAAC,CAACmC,UAAU,CAAC9C,OAAO,CAAC+C,SAAS,CAAC,EAAE;QACpC,OAAOvC,IAAI,CACTmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAAC4B,eAAe,EAAER,oBAAc,CAACS,qBAAqB,CACtF,CAAC;MACH;MAEA,IAAI;QACF,MAAMxD,KAAK,GAAG,MAAM,IAAAyD,iBAAW,EAACnD,IAAI,EAAEE,MAAM,EAAEc,IAAI,EAAgBkB,QAAQ,CAAC;QAC3E,IAAI,CAACxC,KAAK,EAAE;UACV,MAAMkC,gBAAU,CAACwB,gBAAgB,CAAC,CAAC;QACrC;QAEA,MAAMC,GAAG,GAAG,IAAAC,kBAAW,EAAC5D,KAAK,CAAC;QAC9B;QACA,MAAM6D,WAAW,GAAG,IAAAC,WAAI,EAAC9D,KAAK,EAAE,CAAC,CAAC;QAClC,MAAMC,OAAO,GAAG,IAAIC,IAAI,CAAC,CAAC,CAAC6D,OAAO,CAAC,CAAC;;QAEpC;AACV;AACA;AACA;AACA;QACU,MAAMT,SAAgB,GAAG;UACvBhC,IAAI,EAAEN,IAAI;UACVhB,KAAK,EAAE6D,WAAW;UAClBF,GAAG;UACHK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACRxC;QACF,CAAC;QAED,MAAMM,OAAO,CAAC+C,SAAS,CAACA,SAAS,CAAC;QAClC7C,MAAM,CAACgB,KAAK,CAAC;UAAEkC,GAAG;UAAE3C;QAAK,CAAC,EAAE,2CAA2C,CAAC;QACxEF,GAAG,CAACmD,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpD,OAAOpD,IAAI,CACThB,cAAc,CAAC;UACbC,KAAK;UACLsB,IAAI,EAAEN,IAAI;UACV2C,GAAG,EAAEL,SAAS,CAACK,GAAG;UAClBK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACRxC,OAAO,EAAEqD,SAAS,CAACrD;QACrB,CAAC,CACH,CAAC;MACH,CAAC,CAAC,OAAO+B,KAAU,EAAE;QACnBvB,MAAM,CAACuB,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOlB,IAAI,CAACmB,gBAAU,CAACwB,gBAAgB,CAAC1B,KAAK,CAACK,OAAO,CAAC,CAAC;MACzD;IACF,CAAC,CAAC;EACJ,CACF,CAAC;EAEDhC,KAAK,CAAC+D,MAAM,CACV,kCAAkC,EAClC,IAAAzD,qBAAS,EAACH,MAAM,EAAEI,aAAa,CAAC,EAChC,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAK;IACpE,MAAM;MACJsD,MAAM,EAAE;QAAEC;MAAS;IACrB,CAAC,GAAGzD,GAAG;IACP,MAAM;MAAEG;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3BP,MAAM,CAACgB,KAAK,CAAC;QAAET;MAAK,CAAC,EAAE,sCAAsC,CAAC;MAC9D,IAAI;QACF,MAAMT,OAAO,CAACgE,WAAW,CAACvD,IAAI,EAAEsD,QAAQ,CAAC;QACzC7D,MAAM,CAAC+D,IAAI,CAAC;UAAEF,QAAQ;UAAEtD;QAAK,CAAC,EAAE,mDAAmD,CAAC;QACpF,OAAOD,IAAI,CAAC,CAAC,CAAC,CAAC;MACjB,CAAC,CAAC,OAAOiB,KAAU,EAAE;QACnBvB,MAAM,CAACuB,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOlB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOtB,IAAI,CAACmB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"token.js","names":["_lodash","_interopRequireDefault","require","_auth","_core","_middleware","_utils","e","__esModule","default","normalizeToken","token","created","Date","toISOString","_default","route","auth","storage","config","logger","get","TOKEN_API_ENDPOINTS","get_tokens","rateLimit","userRateLimit","req","res","next","name","remote_user","_","isNil","tokens","readTokens","user","totalTokens","length","debug","status","HTTP_STATUS","OK","objects","map","urls","error","msg","errorUtils","getCode","INTERNAL_ERROR","message","getUnauthorized","post","password","readonly","cidr_whitelist","body","isBoolean","isArray","BAD_DATA","SUPPORT_ERRORS","PARAMETERS_NOT_VALID","authenticate","err","errorCode","UNAUTHORIZED","isFunction","saveToken","NOT_IMPLEMENTED","STORAGE_NOT_IMPLEMENT","getApiToken","getInternalError","key","stringToMD5","maskedToken","mask","getTime","cidr","set","HEADERS","CACHE_CONTROL","delete","delete_token","params","tokenKey","deleteToken","info"],"sources":["../../src/v1/token.ts"],"sourcesContent":["import { Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { TOKEN_API_ENDPOINTS } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Config, RemoteUser, Token } from '@verdaccio/types';\nimport { Logger } from '@verdaccio/types';\nimport { mask, stringToMD5 } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  created: string;\n};\n\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!_.isBoolean(readonly) || !_.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (!_.isFunction(storage.saveToken)) {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const token = await getApiToken(auth, config, user as RemoteUser, password);\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          const key = stringToMD5(token);\n          // TODO: use a utility here\n          const maskedToken = mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (_.isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;;AACA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,WAAA,GAAAH,OAAA;AAKA,IAAAI,MAAA,GAAAJ,OAAA;AAAqD,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAQrD,SAASG,cAAcA,CAACC,KAAY,EAAkB;EACpD,OAAO;IACL,GAAGA,KAAK;IACRC,OAAO,EAAE,IAAIC,IAAI,CAACF,KAAK,CAACC,OAAO,CAAC,CAACE,WAAW,CAAC;EAC/C,CAAC;AACH;;AAEA;AACe,SAAAC,SACbC,KAAa,EACbC,IAAU,EACVC,OAAgB,EAChBC,MAAc,EACdC,MAAc,EACR;EACNJ,KAAK,CAACK,GAAG,CACPC,+BAAmB,CAACC,UAAU,EAC9B,IAAAC,qBAAS,EAACL,MAAM,EAAEM,aAAa,CAAC,EAChC,gBAAgBC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IAC1E,MAAM;MAAEC;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3B,IAAI;QACF,MAAMI,MAAM,GAAG,MAAMf,OAAO,CAACgB,UAAU,CAAC;UAAEC,IAAI,EAAEN;QAAK,CAAC,CAAC;QACvD,MAAMO,WAAW,GAAGH,MAAM,CAACI,MAAM;QACjCjB,MAAM,CAACkB,KAAK,CAAC;UAAEF;QAAY,CAAC,EAAE,sCAAsC,CAAC;QAErET,GAAG,CAACY,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;QAC1B,OAAOb,IAAI,CAAC;UACVc,OAAO,EAAET,MAAM,CAACU,GAAG,CAACjC,cAAc,CAAC;UACnCkC,IAAI,EAAE;YACJhB,IAAI,EAAE,EAAE,CAAE;UACZ;QACF,CAAC,CAAC;MACJ,CAAC,CAAC,OAAOiB,KAAU,EAAE;QACnBzB,MAAM,CAACyB,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,iCAAiC,CAAC;QACrE,OAAOlB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOtB,IAAI,CAACmB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;EAEDnC,KAAK,CAACoC,IAAI,CACR9B,+BAAmB,CAACC,UAAU,EAC9B,IAAAC,qBAAS,EAACL,MAAM,EAAEM,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAE;IACpE,MAAM;MAAEyB,QAAQ;MAAEC,QAAQ;MAAEC;IAAe,CAAC,GAAG7B,GAAG,CAAC8B,IAAI;IACvD,MAAM;MAAE3B;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAI,CAACC,eAAC,CAAC0B,SAAS,CAACH,QAAQ,CAAC,IAAI,CAACvB,eAAC,CAAC2B,OAAO,CAACH,cAAc,CAAC,EAAE;MACxD,OAAO3B,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACmB,QAAQ,EAAEC,oBAAc,CAACC,oBAAoB,CAAC,CAAC;IAC5F;IAEA5C,IAAI,CAAC6C,YAAY,CAACjC,IAAI,EAAEwB,QAAQ,EAAE,OAAOU,GAAG,EAAE5B,IAAiB,KAAK;MAClE,IAAI4B,GAAG,EAAE;QACP,MAAMC,SAAS,GAAGD,GAAG,CAACb,OAAO,GAAGV,iBAAW,CAACyB,YAAY,GAAGzB,iBAAW,CAACS,cAAc;QACrF,OAAOrB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACgB,SAAS,EAAED,GAAG,CAACb,OAAO,CAAC,CAAC;MACzD;MAEAxB,GAAG,CAACI,WAAW,GAAGK,IAAI;MAEtB,IAAI,CAACJ,eAAC,CAACmC,UAAU,CAAChD,OAAO,CAACiD,SAAS,CAAC,EAAE;QACpC,OAAOvC,IAAI,CACTmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAAC4B,eAAe,EAAER,oBAAc,CAACS,qBAAqB,CACtF,CAAC;MACH;MAEA,IAAI;QACF,MAAM1D,KAAK,GAAG,MAAM,IAAA2D,iBAAW,EAACrD,IAAI,EAAEE,MAAM,EAAEgB,IAAI,EAAgBkB,QAAQ,CAAC;QAC3E,IAAI,CAAC1C,KAAK,EAAE;UACV,MAAMoC,gBAAU,CAACwB,gBAAgB,CAAC,CAAC;QACrC;QAEA,MAAMC,GAAG,GAAG,IAAAC,kBAAW,EAAC9D,KAAK,CAAC;QAC9B;QACA,MAAM+D,WAAW,GAAG,IAAAC,WAAI,EAAChE,KAAK,EAAE,CAAC,CAAC;QAClC,MAAMC,OAAO,GAAG,IAAIC,IAAI,CAAC,CAAC,CAAC+D,OAAO,CAAC,CAAC;;QAEpC;AACV;AACA;AACA;AACA;QACU,MAAMT,SAAgB,GAAG;UACvBhC,IAAI,EAAEN,IAAI;UACVlB,KAAK,EAAE+D,WAAW;UAClBF,GAAG;UACHK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACR1C;QACF,CAAC;QAED,MAAMM,OAAO,CAACiD,SAAS,CAACA,SAAS,CAAC;QAClC/C,MAAM,CAACkB,KAAK,CAAC;UAAEkC,GAAG;UAAE3C;QAAK,CAAC,EAAE,2CAA2C,CAAC;QACxEF,GAAG,CAACmD,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpD,OAAOpD,IAAI,CACTlB,cAAc,CAAC;UACbC,KAAK;UACLwB,IAAI,EAAEN,IAAI;UACV2C,GAAG,EAAEL,SAAS,CAACK,GAAG;UAClBK,IAAI,EAAEtB,cAAc;UACpBD,QAAQ;UACR1C,OAAO,EAAEuD,SAAS,CAACvD;QACrB,CAAC,CACH,CAAC;MACH,CAAC,CAAC,OAAOiC,KAAU,EAAE;QACnBzB,MAAM,CAACyB,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOlB,IAAI,CAACmB,gBAAU,CAACwB,gBAAgB,CAAC1B,KAAK,CAACK,OAAO,CAAC,CAAC;MACzD;IACF,CAAC,CAAC;EACJ,CACF,CAAC;EAEDlC,KAAK,CAACiE,MAAM,CACV3D,+BAAmB,CAAC4D,YAAY,EAChC,IAAA1D,qBAAS,EAACL,MAAM,EAAEM,aAAa,CAAC,EAChC,OAAOC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,KAAK;IACpE,MAAM;MACJuD,MAAM,EAAE;QAAEC;MAAS;IACrB,CAAC,GAAG1D,GAAG;IACP,MAAM;MAAEG;IAAK,CAAC,GAAGH,GAAG,CAACI,WAAW;IAEhC,IAAIC,eAAC,CAACC,KAAK,CAACH,IAAI,CAAC,KAAK,KAAK,EAAE;MAC3BT,MAAM,CAACkB,KAAK,CAAC;QAAET;MAAK,CAAC,EAAE,sCAAsC,CAAC;MAC9D,IAAI;QACF,MAAMX,OAAO,CAACmE,WAAW,CAACxD,IAAI,EAAEuD,QAAQ,CAAC;QACzChE,MAAM,CAACkE,IAAI,CAAC;UAAEF,QAAQ;UAAEvD;QAAK,CAAC,EAAE,mDAAmD,CAAC;QACpF,OAAOD,IAAI,CAAC,CAAC,CAAC,CAAC;MACjB,CAAC,CAAC,OAAOiB,KAAU,EAAE;QACnBzB,MAAM,CAACyB,KAAK,CAAC;UAAEA,KAAK,EAAEA,KAAK,CAACC;QAAI,CAAC,EAAE,qCAAqC,CAAC;QACzE,OAAOlB,IAAI,CAACmB,gBAAU,CAACC,OAAO,CAACR,iBAAW,CAACS,cAAc,EAAEJ,KAAK,CAACK,OAAO,CAAC,CAAC;MAC5E;IACF;IACA,OAAOtB,IAAI,CAACmB,gBAAU,CAACI,eAAe,CAAC,CAAC,CAAC;EAC3C,CACF,CAAC;AACH","ignoreList":[]}

package/build/whoami.js

@@ -6,10 +6,11 @@ Object.defineProperty(exports, "__esModule", {
 exports.default = _default;
 var _debug = _interopRequireDefault(require("debug"));
 var _core = require("@verdaccio/core");
+var _middleware = require("@verdaccio/middleware");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:api:user');
 function _default(route) {
-  route.get('/-/whoami', (req, _res, next) => {
+  route.get(_middleware.USER_API_ENDPOINTS.whoami, (req, _res, next) => {
     // remote_user is set by the auth middleware
     const username = req?.remote_user?.name;
     if (!username) {

package/build/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","_default","route","get","req","_res","next","username","remote_user","name","errorUtils","getUnauthorized"],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get('/-/whoami', (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n    // remote_user is set by the auth middleware\n    const username = req?.remote_user?.name;\n    if (!username) {\n      debug('whoami: user not found');\n      return next(errorUtils.getUnauthorized('Unauthorized'));\n    }\n\n    debug('whoami: response %o', username);\n    return next({ username: username });\n  });\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAA6C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAQ;EAC5CA,KAAK,CAACC,GAAG,CAAC,WAAW,EAAE,CAACC,GAAmB,EAAEC,IAAc,EAAEC,IAAsB,KAAU;IAC3F;IACA,MAAMC,QAAQ,GAAGH,GAAG,EAAEI,WAAW,EAAEC,IAAI;IACvC,IAAI,CAACF,QAAQ,EAAE;MACbR,KAAK,CAAC,wBAAwB,CAAC;MAC/B,OAAOO,IAAI,CAACI,gBAAU,CAACC,eAAe,CAAC,cAAc,CAAC,CAAC;IACzD;IAEAZ,KAAK,CAAC,qBAAqB,EAAEQ,QAAQ,CAAC;IACtC,OAAOD,IAAI,CAAC;MAAEC,QAAQ,EAAEA;IAAS,CAAC,CAAC;EACrC,CAAC,CAAC;AACJ","ignoreList":[]}
+{"version":3,"file":"whoami.js","names":["_debug","_interopRequireDefault","require","_core","_middleware","e","__esModule","default","debug","buildDebug","_default","route","get","USER_API_ENDPOINTS","whoami","req","_res","next","username","remote_user","name","errorUtils","getUnauthorized"],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AAA2D,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI3D,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAQ;EAC5CA,KAAK,CAACC,GAAG,CACPC,8BAAkB,CAACC,MAAM,EACzB,CAACC,GAAmB,EAAEC,IAAc,EAAEC,IAAsB,KAAU;IACpE;IACA,MAAMC,QAAQ,GAAGH,GAAG,EAAEI,WAAW,EAAEC,IAAI;IACvC,IAAI,CAACF,QAAQ,EAAE;MACbV,KAAK,CAAC,wBAAwB,CAAC;MAC/B,OAAOS,IAAI,CAACI,gBAAU,CAACC,eAAe,CAAC,cAAc,CAAC,CAAC;IACzD;IAEAd,KAAK,CAAC,qBAAqB,EAAEU,QAAQ,CAAC;IACtC,OAAOD,IAAI,CAAC;MAAEC,QAAQ,EAAEA;IAAS,CAAC,CAAC;EACrC,CACF,CAAC;AACH","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "8.1.0-next-8.6",
+  "version": "8.1.0-next-8.8",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,27 +29,26 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "8.0.0-next-8.6",
-    "@verdaccio/config": "8.0.0-next-8.6",
-    "@verdaccio/core": "8.0.0-next-8.6",
-    "@verdaccio/logger": "8.0.0-next-8.6",
-    "@verdaccio/middleware": "8.0.0-next-8.6",
-    "@verdaccio/store": "8.0.0-next-8.6",
-    "@verdaccio/utils": "8.1.0-next-8.6",
-    "abortcontroller-polyfill": "1.7.6",
+    "@verdaccio/auth": "8.0.0-next-8.8",
+    "@verdaccio/config": "8.0.0-next-8.8",
+    "@verdaccio/core": "8.0.0-next-8.8",
+    "@verdaccio/logger": "8.0.0-next-8.8",
+    "@verdaccio/middleware": "8.0.0-next-8.8",
+    "@verdaccio/store": "8.0.0-next-8.8",
+    "@verdaccio/utils": "8.1.0-next-8.8",
+    "abortcontroller-polyfill": "1.7.8",
     "body-parser": "1.20.3",
     "cookies": "0.9.1",
-    "debug": "4.3.7",
+    "debug": "4.4.0",
     "express": "4.21.2",
     "lodash": "4.17.21",
     "mime": "2.6.0",
     "semver": "7.6.3"
   },
   "devDependencies": {
-    "@verdaccio/test-helper": "4.0.0-next-8.2",
-    "@verdaccio/types": "13.0.0-next-8.2",
+    "@verdaccio/test-helper": "4.0.0-next-8.3",
+    "@verdaccio/types": "13.0.0-next-8.3",
     "mockdate": "3.0.5",
-    "nock": "13.5.1",
     "supertest": "7.0.0"
   },
   "funding": {

package/src/dist-tags.ts

@@ -5,6 +5,7 @@ import mime from 'mime';
 import { Auth } from '@verdaccio/auth';
 import { constants, errorUtils } from '@verdaccio/core';
 import { allow, media } from '@verdaccio/middleware';
+import { DIST_TAGS_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Logger } from '@verdaccio/types';
 
@@ -39,21 +40,21 @@ export default function (route: Router, auth: Auth, storage: Storage, logger: Lo
 
   // tagging a package.
   route.put(
-    '/:package/:tag',
+    DIST_TAGS_API_ENDPOINTS.tagging,
     can('publish'),
     media(mime.getType('json')),
     addTagPackageVersionMiddleware
   );
 
   route.put(
-    '/-/package/:package/dist-tags/:tag',
+    DIST_TAGS_API_ENDPOINTS.tagging_package,
     can('publish'),
     media(mime.getType('json')),
     addTagPackageVersionMiddleware
   );
 
   route.delete(
-    '/-/package/:package/dist-tags/:tag',
+    DIST_TAGS_API_ENDPOINTS.tagging_package,
     can('publish'),
     async function (
       req: $RequestExtend,
@@ -75,7 +76,7 @@ export default function (route: Router, auth: Auth, storage: Storage, logger: Lo
   );
 
   route.get(
-    '/-/package/:package/dist-tags',
+    DIST_TAGS_API_ENDPOINTS.get_dist_tags,
     can('access'),
     async function (
       req: $RequestExtend,

package/src/package.ts

@@ -4,6 +4,7 @@ import { Router } from 'express';
 import { Auth } from '@verdaccio/auth';
 import { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';
 import { allow } from '@verdaccio/middleware';
+import { PACKAGE_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Logger } from '@verdaccio/types';
 
@@ -17,7 +18,7 @@ export default function (route: Router, auth: Auth, storage: Storage, logger: Lo
     afterAll: (a, b) => logger.trace(a, b),
   });
   route.get(
-    '/:package/:version?',
+    PACKAGE_API_ENDPOINTS.get_package_by_version,
     can('access'),
     async function (
       req: $RequestExtend,
@@ -76,7 +77,7 @@ export default function (route: Router, auth: Auth, storage: Storage, logger: Lo
   );
 
   route.get(
-    '/:package/-/:filename',
+    PACKAGE_API_ENDPOINTS.get_package_tarball,
     can('access'),
     async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {
       const { package: pkgName, filename } = req.params;

package/src/ping.ts

@@ -1,10 +1,12 @@
 import { Router } from 'express';
 
+import { PING_API_ENDPOINTS } from '@verdaccio/middleware';
+
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
 
 export default function (route: Router): void {
   route.get(
-    '/-/ping',
+    PING_API_ENDPOINTS.ping,
     function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {
       next({});
     }

package/src/publish.ts

@@ -5,13 +5,13 @@ import mime from 'mime';
 import { Auth } from '@verdaccio/auth';
 import { API_MESSAGE, HTTP_STATUS } from '@verdaccio/core';
 import { allow, expectJson, media } from '@verdaccio/middleware';
+// import star from './star';
+import { PUBLISH_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Logger } from '@verdaccio/types';
 
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';
 
-// import star from './star';
-
 const debug = buildDebug('verdaccio:api:publish');
 
 /**
@@ -120,7 +120,7 @@ export default function publish(
     afterAll: (a, b) => logger.trace(a, b),
   });
   router.put(
-    '/:package',
+    PUBLISH_API_ENDPOINTS.add_package,
     can('publish'),
     media(mime.getType('json')),
     expectJson,
@@ -128,7 +128,7 @@ export default function publish(
   );
 
   router.put(
-    '/:package/-rev/:revision',
+    PUBLISH_API_ENDPOINTS.publish_package,
     can('unpublish'),
     media(mime.getType('json')),
     expectJson,
@@ -143,7 +143,7 @@ export default function publish(
    *  -  no version is specified in the unpublish call
    *  -  all versions are removed npm unpublish package@*
    *  -  there is no versions on the metadata
-   
+
    * then the client decides to DELETE the resource
    * Example:
    * Get fresh manifest (write=true is a flag to get the latest revision)
@@ -153,7 +153,7 @@ export default function publish(
    * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
    */
   router.delete(
-    '/:package/-rev/:revision',
+    PUBLISH_API_ENDPOINTS.publish_package,
     can('unpublish'),
     async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {
       const packageName = req.params.package;
@@ -177,7 +177,7 @@ export default function publish(
    npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
   */
   router.delete(
-    '/:package/-/:filename/-rev/:revision',
+    PUBLISH_API_ENDPOINTS.remove_tarball,
     can('unpublish'),
     can('publish'),
     async function (

package/src/search.ts

@@ -1,9 +1,10 @@
 import { HTTP_STATUS } from '@verdaccio/core';
+import { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Logger } from '@verdaccio/types';
 
 export default function (route, logger: Logger): void {
   // TODO: next major version, remove this
-  route.get('/-/all(/since)?', function (_req, res) {
+  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {
     logger.warn('search endpoint has been removed, please use search v1');
     res.status(HTTP_STATUS.NOT_FOUND);
     res.json({ error: 'not found, endpoint was removed' });

package/src/stars.ts

@@ -2,6 +2,7 @@ import { Response, Router } from 'express';
 import _ from 'lodash';
 
 import { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';
+import { STARS_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Version } from '@verdaccio/types';
 
@@ -9,7 +10,7 @@ import { $NextFunctionVer, $RequestExtend } from '../types/custom';
 
 export default function (route: Router, storage: Storage): void {
   route.get(
-    '/-/_view/starredByUser',
+    STARS_API_ENDPOINTS.get_user_starred_packages,
     async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {
       const query: { key: string } = req.query;
       if (typeof query?.key !== 'string') {

package/src/v1/profile.ts

@@ -10,6 +10,7 @@ import {
   errorUtils,
   validatioUtils,
 } from '@verdaccio/core';
+import { PROFILE_API_ENDPOINTS } from '@verdaccio/middleware';
 import { rateLimit } from '@verdaccio/middleware';
 import { Config } from '@verdaccio/types';
 
@@ -41,7 +42,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
   }
 
   route.get(
-    '/-/npm/v1/user',
+    PROFILE_API_ENDPOINTS.get_profile,
     rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       if (_.isNil(req.remote_user.name) === false) {
@@ -56,7 +57,7 @@ export default function (route: Router, auth: Auth, config: Config): void {
   );
 
   route.post(
-    '/-/npm/v1/user',
+    PROFILE_API_ENDPOINTS.get_profile,
     rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       if (_.isNil(req.remote_user.name)) {

package/src/v1/search.ts

@@ -3,6 +3,7 @@ import _ from 'lodash';
 
 import { Auth } from '@verdaccio/auth';
 import { HTTP_STATUS, searchUtils } from '@verdaccio/core';
+import { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Manifest } from '@verdaccio/types';
 import { Logger } from '@verdaccio/types';
@@ -35,7 +36,7 @@ export default function (route, auth: Auth, storage: Storage, logger: Logger): v
     });
   }
 
-  route.get('/-/v1/search', async (req, res, next) => {
+  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {
     const { query, url } = req;
     let [size, from] = ['size', 'from'].map((k) => query[k]);
     let data;

package/src/v1/token.ts

@@ -5,6 +5,7 @@ import { getApiToken } from '@verdaccio/auth';
 import { Auth } from '@verdaccio/auth';
 import { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, errorUtils } from '@verdaccio/core';
 import { rateLimit } from '@verdaccio/middleware';
+import { TOKEN_API_ENDPOINTS } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Config, RemoteUser, Token } from '@verdaccio/types';
 import { Logger } from '@verdaccio/types';
@@ -32,7 +33,7 @@ export default function (
   logger: Logger
 ): void {
   route.get(
-    '/-/npm/v1/tokens',
+    TOKEN_API_ENDPOINTS.get_tokens,
     rateLimit(config?.userRateLimit),
     async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {
       const { name } = req.remote_user;
@@ -60,7 +61,7 @@ export default function (
   );
 
   route.post(
-    '/-/npm/v1/tokens',
+    TOKEN_API_ENDPOINTS.get_tokens,
     rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {
       const { password, readonly, cidr_whitelist } = req.body;
@@ -131,7 +132,7 @@ export default function (
   );
 
   route.delete(
-    '/-/npm/v1/tokens/token/:tokenKey',
+    TOKEN_API_ENDPOINTS.delete_token,
     rateLimit(config?.userRateLimit),
     async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {
       const {

package/src/whoami.ts

@@ -2,21 +2,25 @@ import buildDebug from 'debug';
 import { Response, Router } from 'express';
 
 import { errorUtils } from '@verdaccio/core';
+import { USER_API_ENDPOINTS } from '@verdaccio/middleware';
 
 import { $NextFunctionVer, $RequestExtend } from '../types/custom';
 
 const debug = buildDebug('verdaccio:api:user');
 
 export default function (route: Router): void {
-  route.get('/-/whoami', (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {
-    // remote_user is set by the auth middleware
-    const username = req?.remote_user?.name;
-    if (!username) {
-      debug('whoami: user not found');
-      return next(errorUtils.getUnauthorized('Unauthorized'));
-    }
+  route.get(
+    USER_API_ENDPOINTS.whoami,
+    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {
+      // remote_user is set by the auth middleware
+      const username = req?.remote_user?.name;
+      if (!username) {
+        debug('whoami: user not found');
+        return next(errorUtils.getUnauthorized('Unauthorized'));
+      }
 
-    debug('whoami: response %o', username);
-    return next({ username: username });
-  });
+      debug('whoami: response %o', username);
+      return next({ username: username });
+    }
+  );
 }