@verdaccio/api 8.1.0-next-8.7 → 8.1.0-next-8.9

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @verdaccio/api
 
+## 8.1.0-next-8.9
+
+### Patch Changes
+
+- Updated dependencies [96e0011]
+  - @verdaccio/middleware@8.0.0-next-8.9
+  - @verdaccio/auth@8.0.0-next-8.9
+  - @verdaccio/core@8.0.0-next-8.9
+  - @verdaccio/config@8.0.0-next-8.9
+  - @verdaccio/store@8.0.0-next-8.9
+  - @verdaccio/utils@8.1.0-next-8.9
+  - @verdaccio/logger@8.0.0-next-8.9
+
+## 8.1.0-next-8.8
+
+### Patch Changes
+
+- Updated dependencies [0588605]
+- Updated dependencies [ca91b9a]
+  - @verdaccio/config@8.0.0-next-8.8
+  - @verdaccio/auth@8.0.0-next-8.8
+  - @verdaccio/middleware@8.0.0-next-8.8
+  - @verdaccio/store@8.0.0-next-8.8
+  - @verdaccio/core@8.0.0-next-8.8
+  - @verdaccio/logger@8.0.0-next-8.8
+  - @verdaccio/utils@8.1.0-next-8.8
+
 ## 8.1.0-next-8.7
 
 ### Patch Changes

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 Verdaccio contributors
+Copyright (c) 2025 Verdaccio contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -6,7 +6,6 @@
 [![Crowdin](https://d322cqt584bo4o.cloudfront.net/verdaccio/localized.svg)](https://crowdin.com/project/verdaccio)
 [![TODOs](https://badgen.net/https/api.tickgit.com/badgen/github.com/verdaccio/verdaccio)](https://www.tickgit.com/browse?repo=github.com/verdaccio/verdaccio)
 
-[![Twitter followers](https://img.shields.io/twitter/follow/verdaccio_npm.svg?style=social&label=Follow)](https://twitter.com/verdaccio_npm)
 [![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)
 
 ## Donations

package/build/user.js

@@ -13,7 +13,7 @@ var _utils = require("@verdaccio/utils");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:api:user');
 function _default(route, auth, config, logger) {
-  route.get('/-/user/:org_couchdb_user', (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
+  route.get(_middleware.USER_API_ENDPOINTS.get_user, (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
     debug('verifying user');
     if (!req.remote_user || typeof req.remote_user.name !== 'string' || req.remote_user.name === '') {
       debug('user not logged in');
@@ -52,7 +52,7 @@ function _default(route, auth, config, logger) {
   * @param {Auth} auth
   * @param {Config} config
   */
-  route.put('/-/user/:org_couchdb_user/:_rev?/:revision?', (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
+  route.put(_middleware.USER_API_ENDPOINTS.add_user, (0, _middleware.rateLimit)(config?.userRateLimit), function (req, res, next) {
     const {
       name,
       password
@@ -123,7 +123,7 @@ function _default(route, auth, config, logger) {
       });
     }
   });
-  route.delete('/-/user/token/*', function (req, res, next) {
+  route.delete(_middleware.USER_API_ENDPOINTS.user_token, function (req, res, next) {
     res.status(_core.HTTP_STATUS.OK);
     next({
       ok: _core.API_MESSAGE.LOGGED_OUT

package/build/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_auth","_config","_core","_middleware","_utils","e","__esModule","default","debug","buildDebug","_default","route","auth","config","logger","get","rateLimit","userRateLimit","req","res","next","remote_user","name","status","HTTP_STATUS","OK","ok","username","params","org_couchdb_user","split","message","getAuthenticatedMessage","email","put","password","body","remoteName","validatioUtils","validateUserName","errorUtils","getBadRequest","API_ERROR","USERNAME_MISMATCH","authenticate","callbackAuthenticate","err","user","trace","getCode","UNAUTHORIZED","BAD_USERNAME_PASSWORD","restoredRemoteUser","createRemoteUser","groups","token","getApiToken","getUnauthorized","CREATED","set","HEADERS","CACHE_CONTROL","validatePassword","serverSettings","passwordValidationRegex","BAD_REQUEST","PASSWORD_SHORT","add_user","INTERNAL_ERROR","getConflict","undefined","mask","delete","API_MESSAGE","LOGGED_OUT"],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Logger } from '@verdaccio/types';\nimport { Config, RemoteUser } from '@verdaccio/types';\nimport { getAuthenticatedMessage, mask } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config, logger: Logger): void {\n  route.get(\n    '/-/user/:org_couchdb_user',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (\n        !req.remote_user ||\n        typeof req.remote_user.name !== 'string' ||\n        req.remote_user.name === ''\n      ) {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    '/-/user/:org_couchdb_user/:_rev?/:revision?',\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validatioUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n\n            const message = getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validatioUtils.validatePassword(\n            password,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          debug('adduser: invalid password');\n          // eslint-disable-next-line new-cap\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    '/-/user/token/*',\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,WAAA,GAAAJ,OAAA;AAGA,IAAAK,MAAA,GAAAL,OAAA;AAAiE,SAAAD,uBAAAO,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAIjE,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAEC,MAAc,EAAQ;EACxFH,KAAK,CAACI,GAAG,CACP,2BAA2B,EAC3B,IAAAC,qBAAS,EAACH,MAAM,EAAEI,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1EZ,KAAK,CAAC,gBAAgB,CAAC;IAEvB,IACE,CAACU,GAAG,CAACG,WAAW,IAChB,OAAOH,GAAG,CAACG,WAAW,CAACC,IAAI,KAAK,QAAQ,IACxCJ,GAAG,CAACG,WAAW,CAACC,IAAI,KAAK,EAAE,EAC3B;MACAd,KAAK,CAAC,oBAAoB,CAAC;MAC3BW,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1B,OAAOL,IAAI,CAAC;QAAEM,EAAE,EAAE;MAAM,CAAC,CAAC;IAC5B;IAEA,MAAMC,QAAQ,GAAGT,GAAG,CAACU,MAAM,CAACC,gBAAgB,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAMC,OAAO,GAAG,IAAAC,8BAAuB,EAACd,GAAG,CAACG,WAAW,CAACC,IAAI,CAAC;IAC7Dd,KAAK,CAAC,+BAA+B,EAAEuB,OAAO,CAAC;IAC/CZ,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BL,IAAI,CAAC;MACH;MACA;MACAE,IAAI,EAAEK,QAAQ;MACdM,KAAK,EAAE,EAAE;MACTP,EAAE,EAAEK;IACN,CAAC,CAAC;EACJ,CACF,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEpB,KAAK,CAACuB,GAAG,CACP,6CAA6C,EAC7C,IAAAlB,qBAAS,EAACH,MAAM,EAAEI,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,MAAM;MAAEE,IAAI;MAAEa;IAAS,CAAC,GAAGjB,GAAG,CAACkB,IAAI;IACnC5B,KAAK,CAAC,kBAAkB,CAAC;IACzB,MAAM6B,UAAU,GAAGnB,GAAG,EAAEG,WAAW,EAAEC,IAAI;IAEzC,IAAI,CAACgB,oBAAc,CAACC,gBAAgB,CAACrB,GAAG,CAACU,MAAM,CAACC,gBAAgB,EAAEP,IAAI,CAAC,EAAE;MACvE,OAAOF,IAAI,CAACoB,gBAAU,CAACC,aAAa,CAACC,eAAS,CAACC,iBAAiB,CAAC,CAAC;IACpE;IAEA,IAAI,OAAON,UAAU,KAAK,WAAW,IAAI,OAAOf,IAAI,KAAK,QAAQ,IAAIe,UAAU,KAAKf,IAAI,EAAE;MACxFd,KAAK,CAAC,gCAAgC,CAAC;MACvCI,IAAI,CAACgC,YAAY,CACftB,IAAI,EACJa,QAAQ,EACR,eAAeU,oBAAoBA,CAACC,GAAG,EAAEC,IAAI,EAAiB;QAC5D,IAAID,GAAG,EAAE;UACPhC,MAAM,CAACkC,KAAK,CACV;YAAE1B,IAAI;YAAEwB;UAAI,CAAC,EACb,mEACF,CAAC;UACD,OAAO1B,IAAI,CACToB,gBAAU,CAACS,OAAO,CAACzB,iBAAW,CAAC0B,YAAY,EAAER,eAAS,CAACS,qBAAqB,CAC9E,CAAC;QACH;QAEA,MAAMC,kBAA8B,GAAG,IAAAC,wBAAgB,EAAC/B,IAAI,EAAEyB,IAAI,EAAEO,MAAM,IAAI,EAAE,CAAC;QACjF,MAAMC,KAAK,GAAG,MAAM,IAAAC,iBAAW,EAAC5C,IAAI,EAAEC,MAAM,EAAEuC,kBAAkB,EAAEjB,QAAQ,CAAC;QAC3E3B,KAAK,CAAC,kBAAkB,CAAC;QACzB,IAAI,CAAC+C,KAAK,EAAE;UACV,OAAOnC,IAAI,CAACoB,gBAAU,CAACiB,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAtC,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACkC,OAAO,CAAC;QAC/BvC,GAAG,CAACwC,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QAEpD,MAAM9B,OAAO,GAAG,IAAAC,8BAAuB,EAACd,GAAG,CAACG,WAAW,CAACC,IAAI,CAAC;QAC7Dd,KAAK,CAAC,gCAAgC,EAAEuB,OAAO,CAAC;QAEhD,OAAOX,IAAI,CAAC;UACVM,EAAE,EAAEK,OAAO;UACXwB;QACF,CAAC,CAAC;MACJ,CACF,CAAC;IACH,CAAC,MAAM;MACL/C,KAAK,CAAC,aAAa,EAAEc,IAAI,CAAC;MAC1B,IACEgB,oBAAc,CAACwB,gBAAgB,CAC7B3B,QAAQ,EACRtB,MAAM,EAAEkD,cAAc,EAAEC,uBAC1B,CAAC,KAAK,KAAK,EACX;QACAxD,KAAK,CAAC,2BAA2B,CAAC;QAClC;QACA,OAAOY,IAAI,CAACoB,gBAAU,CAACS,OAAO,CAACzB,iBAAW,CAACyC,WAAW,EAAEvB,eAAS,CAACwB,cAAc,CAAC,CAAC;MACpF;MAEAtD,IAAI,CAACuD,QAAQ,CAAC7C,IAAI,EAAEa,QAAQ,EAAE,gBAAgBW,GAAG,EAAEC,IAAI,EAAiB;QACtE,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACvB,MAAM,IAAIC,iBAAW,CAACyC,WAAW,IAAInB,GAAG,CAACvB,MAAM,GAAGC,iBAAW,CAAC4C,cAAc,EAAE;YACpF5D,KAAK,CAAC,+BAA+B,CAAC;YACtC;YACA;YACA;YACA,OAAOY,IAAI,CACToB,gBAAU,CAACS,OAAO,CAACH,GAAG,CAACvB,MAAM,EAAEuB,GAAG,CAACf,OAAO,CAAC,IAAIS,gBAAU,CAAC6B,WAAW,CAACvB,GAAG,CAACf,OAAO,CACnF,CAAC;UACH;UACA,OAAOX,IAAI,CAAC0B,GAAG,CAAC;QAClB;QAEA,MAAMS,KAAK,GACTjC,IAAI,IAAIa,QAAQ,GACZ,MAAM,IAAAqB,iBAAW,EAAC5C,IAAI,EAAEC,MAAM,EAAEkC,IAAI,EAAgBZ,QAAQ,CAAC,GAC7DmC,SAAS;QACf,IAAIf,KAAK,EAAE;UACT/C,KAAK,CAAC,uBAAuB,EAAE,IAAA+D,WAAI,EAAChB,KAAK,EAAY,CAAC,CAAC,CAAC;QAC1D;QACA,IAAI,CAACA,KAAK,EAAE;UACV,OAAOnC,IAAI,CAACoB,gBAAU,CAACiB,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAvC,GAAG,CAACG,WAAW,GAAG0B,IAAI;QACtB5B,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACkC,OAAO,CAAC;QAC/BvC,GAAG,CAACwC,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpDrD,KAAK,CAAC,gCAAgC,CAAC;QACvC,OAAOY,IAAI,CAAC;UACVM,EAAE,EAAE,SAASR,GAAG,CAACkB,IAAI,CAACd,IAAI,WAAW;UACrCiC;QACF,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ;EACF,CACF,CAAC;EAED5C,KAAK,CAAC6D,MAAM,CACV,iBAAiB,EACjB,UAAUtD,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1ED,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BL,IAAI,CAAC;MACHM,EAAE,EAAE+C,iBAAW,CAACC;IAClB,CAAC,CAAC;EACJ,CACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_auth","_config","_core","_middleware","_utils","e","__esModule","default","debug","buildDebug","_default","route","auth","config","logger","get","USER_API_ENDPOINTS","get_user","rateLimit","userRateLimit","req","res","next","remote_user","name","status","HTTP_STATUS","OK","ok","username","params","org_couchdb_user","split","message","getAuthenticatedMessage","email","put","add_user","password","body","remoteName","validatioUtils","validateUserName","errorUtils","getBadRequest","API_ERROR","USERNAME_MISMATCH","authenticate","callbackAuthenticate","err","user","trace","getCode","UNAUTHORIZED","BAD_USERNAME_PASSWORD","restoredRemoteUser","createRemoteUser","groups","token","getApiToken","getUnauthorized","CREATED","set","HEADERS","CACHE_CONTROL","validatePassword","serverSettings","passwordValidationRegex","BAD_REQUEST","PASSWORD_SHORT","INTERNAL_ERROR","getConflict","undefined","mask","delete","user_token","API_MESSAGE","LOGGED_OUT"],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Response, Router } from 'express';\n\nimport { getApiToken } from '@verdaccio/auth';\nimport { Auth } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport { Logger } from '@verdaccio/types';\nimport { Config, RemoteUser } from '@verdaccio/types';\nimport { getAuthenticatedMessage, mask } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config, logger: Logger): void {\n  route.get(\n    USER_API_ENDPOINTS.get_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (\n        !req.remote_user ||\n        typeof req.remote_user.name !== 'string' ||\n        req.remote_user.name === ''\n      ) {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    USER_API_ENDPOINTS.add_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validatioUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n\n            const message = getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validatioUtils.validatePassword(\n            password,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          debug('adduser: invalid password');\n          // eslint-disable-next-line new-cap\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    USER_API_ENDPOINTS.user_token,\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAGA,IAAAC,KAAA,GAAAD,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,WAAA,GAAAJ,OAAA;AAGA,IAAAK,MAAA,GAAAL,OAAA;AAAiE,SAAAD,uBAAAO,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAIjE,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,oBAAoB,CAAC;AAE/B,SAAAC,SAAUC,KAAa,EAAEC,IAAU,EAAEC,MAAc,EAAEC,MAAc,EAAQ;EACxFH,KAAK,CAACI,GAAG,CACPC,8BAAkB,CAACC,QAAQ,EAC3B,IAAAC,qBAAS,EAACL,MAAM,EAAEM,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1Ed,KAAK,CAAC,gBAAgB,CAAC;IAEvB,IACE,CAACY,GAAG,CAACG,WAAW,IAChB,OAAOH,GAAG,CAACG,WAAW,CAACC,IAAI,KAAK,QAAQ,IACxCJ,GAAG,CAACG,WAAW,CAACC,IAAI,KAAK,EAAE,EAC3B;MACAhB,KAAK,CAAC,oBAAoB,CAAC;MAC3Ba,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;MAC1B,OAAOL,IAAI,CAAC;QAAEM,EAAE,EAAE;MAAM,CAAC,CAAC;IAC5B;IAEA,MAAMC,QAAQ,GAAGT,GAAG,CAACU,MAAM,CAACC,gBAAgB,CAACC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAMC,OAAO,GAAG,IAAAC,8BAAuB,EAACd,GAAG,CAACG,WAAW,CAACC,IAAI,CAAC;IAC7DhB,KAAK,CAAC,+BAA+B,EAAEyB,OAAO,CAAC;IAC/CZ,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BL,IAAI,CAAC;MACH;MACA;MACAE,IAAI,EAAEK,QAAQ;MACdM,KAAK,EAAE,EAAE;MACTP,EAAE,EAAEK;IACN,CAAC,CAAC;EACJ,CACF,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACEtB,KAAK,CAACyB,GAAG,CACPpB,8BAAkB,CAACqB,QAAQ,EAC3B,IAAAnB,qBAAS,EAACL,MAAM,EAAEM,aAAa,CAAC,EAChC,UAAUC,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1E,MAAM;MAAEE,IAAI;MAAEc;IAAS,CAAC,GAAGlB,GAAG,CAACmB,IAAI;IACnC/B,KAAK,CAAC,kBAAkB,CAAC;IACzB,MAAMgC,UAAU,GAAGpB,GAAG,EAAEG,WAAW,EAAEC,IAAI;IAEzC,IAAI,CAACiB,oBAAc,CAACC,gBAAgB,CAACtB,GAAG,CAACU,MAAM,CAACC,gBAAgB,EAAEP,IAAI,CAAC,EAAE;MACvE,OAAOF,IAAI,CAACqB,gBAAU,CAACC,aAAa,CAACC,eAAS,CAACC,iBAAiB,CAAC,CAAC;IACpE;IAEA,IAAI,OAAON,UAAU,KAAK,WAAW,IAAI,OAAOhB,IAAI,KAAK,QAAQ,IAAIgB,UAAU,KAAKhB,IAAI,EAAE;MACxFhB,KAAK,CAAC,gCAAgC,CAAC;MACvCI,IAAI,CAACmC,YAAY,CACfvB,IAAI,EACJc,QAAQ,EACR,eAAeU,oBAAoBA,CAACC,GAAG,EAAEC,IAAI,EAAiB;QAC5D,IAAID,GAAG,EAAE;UACPnC,MAAM,CAACqC,KAAK,CACV;YAAE3B,IAAI;YAAEyB;UAAI,CAAC,EACb,mEACF,CAAC;UACD,OAAO3B,IAAI,CACTqB,gBAAU,CAACS,OAAO,CAAC1B,iBAAW,CAAC2B,YAAY,EAAER,eAAS,CAACS,qBAAqB,CAC9E,CAAC;QACH;QAEA,MAAMC,kBAA8B,GAAG,IAAAC,wBAAgB,EAAChC,IAAI,EAAE0B,IAAI,EAAEO,MAAM,IAAI,EAAE,CAAC;QACjF,MAAMC,KAAK,GAAG,MAAM,IAAAC,iBAAW,EAAC/C,IAAI,EAAEC,MAAM,EAAE0C,kBAAkB,EAAEjB,QAAQ,CAAC;QAC3E9B,KAAK,CAAC,kBAAkB,CAAC;QACzB,IAAI,CAACkD,KAAK,EAAE;UACV,OAAOpC,IAAI,CAACqB,gBAAU,CAACiB,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAvC,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACmC,OAAO,CAAC;QAC/BxC,GAAG,CAACyC,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QAEpD,MAAM/B,OAAO,GAAG,IAAAC,8BAAuB,EAACd,GAAG,CAACG,WAAW,CAACC,IAAI,CAAC;QAC7DhB,KAAK,CAAC,gCAAgC,EAAEyB,OAAO,CAAC;QAEhD,OAAOX,IAAI,CAAC;UACVM,EAAE,EAAEK,OAAO;UACXyB;QACF,CAAC,CAAC;MACJ,CACF,CAAC;IACH,CAAC,MAAM;MACLlD,KAAK,CAAC,aAAa,EAAEgB,IAAI,CAAC;MAC1B,IACEiB,oBAAc,CAACwB,gBAAgB,CAC7B3B,QAAQ,EACRzB,MAAM,EAAEqD,cAAc,EAAEC,uBAC1B,CAAC,KAAK,KAAK,EACX;QACA3D,KAAK,CAAC,2BAA2B,CAAC;QAClC;QACA,OAAOc,IAAI,CAACqB,gBAAU,CAACS,OAAO,CAAC1B,iBAAW,CAAC0C,WAAW,EAAEvB,eAAS,CAACwB,cAAc,CAAC,CAAC;MACpF;MAEAzD,IAAI,CAACyB,QAAQ,CAACb,IAAI,EAAEc,QAAQ,EAAE,gBAAgBW,GAAG,EAAEC,IAAI,EAAiB;QACtE,IAAID,GAAG,EAAE;UACP,IAAIA,GAAG,CAACxB,MAAM,IAAIC,iBAAW,CAAC0C,WAAW,IAAInB,GAAG,CAACxB,MAAM,GAAGC,iBAAW,CAAC4C,cAAc,EAAE;YACpF9D,KAAK,CAAC,+BAA+B,CAAC;YACtC;YACA;YACA;YACA,OAAOc,IAAI,CACTqB,gBAAU,CAACS,OAAO,CAACH,GAAG,CAACxB,MAAM,EAAEwB,GAAG,CAAChB,OAAO,CAAC,IAAIU,gBAAU,CAAC4B,WAAW,CAACtB,GAAG,CAAChB,OAAO,CACnF,CAAC;UACH;UACA,OAAOX,IAAI,CAAC2B,GAAG,CAAC;QAClB;QAEA,MAAMS,KAAK,GACTlC,IAAI,IAAIc,QAAQ,GACZ,MAAM,IAAAqB,iBAAW,EAAC/C,IAAI,EAAEC,MAAM,EAAEqC,IAAI,EAAgBZ,QAAQ,CAAC,GAC7DkC,SAAS;QACf,IAAId,KAAK,EAAE;UACTlD,KAAK,CAAC,uBAAuB,EAAE,IAAAiE,WAAI,EAACf,KAAK,EAAY,CAAC,CAAC,CAAC;QAC1D;QACA,IAAI,CAACA,KAAK,EAAE;UACV,OAAOpC,IAAI,CAACqB,gBAAU,CAACiB,eAAe,CAAC,CAAC,CAAC;QAC3C;QAEAxC,GAAG,CAACG,WAAW,GAAG2B,IAAI;QACtB7B,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACmC,OAAO,CAAC;QAC/BxC,GAAG,CAACyC,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpDxD,KAAK,CAAC,gCAAgC,CAAC;QACvC,OAAOc,IAAI,CAAC;UACVM,EAAE,EAAE,SAASR,GAAG,CAACmB,IAAI,CAACf,IAAI,WAAW;UACrCkC;QACF,CAAC,CAAC;MACJ,CAAC,CAAC;IACJ;EACF,CACF,CAAC;EAED/C,KAAK,CAAC+D,MAAM,CACV1D,8BAAkB,CAAC2D,UAAU,EAC7B,UAAUvD,GAAmB,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IAC1ED,GAAG,CAACI,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;IAC1BL,IAAI,CAAC;MACHM,EAAE,EAAEgD,iBAAW,CAACC;IAClB,CAAC,CAAC;EACJ,CACF,CAAC;AACH","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "8.1.0-next-8.7",
+  "version": "8.1.0-next-8.9",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,27 +29,26 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "8.0.0-next-8.7",
-    "@verdaccio/config": "8.0.0-next-8.7",
-    "@verdaccio/core": "8.0.0-next-8.7",
-    "@verdaccio/logger": "8.0.0-next-8.7",
-    "@verdaccio/middleware": "8.0.0-next-8.7",
-    "@verdaccio/store": "8.0.0-next-8.7",
-    "@verdaccio/utils": "8.1.0-next-8.7",
-    "abortcontroller-polyfill": "1.7.6",
+    "@verdaccio/auth": "8.0.0-next-8.9",
+    "@verdaccio/config": "8.0.0-next-8.9",
+    "@verdaccio/core": "8.0.0-next-8.9",
+    "@verdaccio/logger": "8.0.0-next-8.9",
+    "@verdaccio/middleware": "8.0.0-next-8.9",
+    "@verdaccio/store": "8.0.0-next-8.9",
+    "@verdaccio/utils": "8.1.0-next-8.9",
+    "abortcontroller-polyfill": "1.7.8",
     "body-parser": "1.20.3",
     "cookies": "0.9.1",
     "debug": "4.4.0",
     "express": "4.21.2",
     "lodash": "4.17.21",
     "mime": "2.6.0",
-    "semver": "7.6.3"
+    "semver": "7.7.1"
   },
   "devDependencies": {
     "@verdaccio/test-helper": "4.0.0-next-8.3",
-    "@verdaccio/types": "13.0.0-next-8.2",
+    "@verdaccio/types": "13.0.0-next-8.3",
     "mockdate": "3.0.5",
-    "nock": "13.5.1",
     "supertest": "7.0.0"
   },
   "funding": {

package/src/user.ts

@@ -12,7 +12,7 @@ import {
   errorUtils,
   validatioUtils,
 } from '@verdaccio/core';
-import { rateLimit } from '@verdaccio/middleware';
+import { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';
 import { Logger } from '@verdaccio/types';
 import { Config, RemoteUser } from '@verdaccio/types';
 import { getAuthenticatedMessage, mask } from '@verdaccio/utils';
@@ -23,7 +23,7 @@ const debug = buildDebug('verdaccio:api:user');
 
 export default function (route: Router, auth: Auth, config: Config, logger: Logger): void {
   route.get(
-    '/-/user/:org_couchdb_user',
+    USER_API_ENDPOINTS.get_user,
     rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       debug('verifying user');
@@ -70,7 +70,7 @@ export default function (route: Router, auth: Auth, config: Config, logger: Logg
  * @param {Config} config
  */
   route.put(
-    '/-/user/:org_couchdb_user/:_rev?/:revision?',
+    USER_API_ENDPOINTS.add_user,
     rateLimit(config?.userRateLimit),
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       const { name, password } = req.body;
@@ -168,7 +168,7 @@ export default function (route: Router, auth: Auth, config: Config, logger: Logg
   );
 
   route.delete(
-    '/-/user/token/*',
+    USER_API_ENDPOINTS.user_token,
     function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {
       res.status(HTTP_STATUS.OK);
       next({