@verdaccio/api 9.0.0-next-9.17 → 9.0.0-next-9.18

package/build/dist-tags.js

@@ -1,4 +1,3 @@
-require("./_virtual/_rolldown/runtime.js");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/dist-tags.ts

package/build/dist-tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"dist-tags.js","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;CACF,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;AAC3B,MAAI,OAAO,IAAI,SAAS,SACtB,QAAO,KAAK,gBAAA,WAAW,cAAc,qBAAqB,CAAC;EAG7D,MAAM,OAAO,EAAE;AACf,OAAK,IAAI,OAAO,OAAO,IAAI;AAC3B,MAAI;AACF,SAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,KAAK;AACrD,OAAI,OAAO,gBAAA,UAAU,YAAY,QAAQ;AACzC,UAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,WAC3B,CAAC;WACK,KAAK;AACZ,QAAK,IAAI;;;AAKb,OAAM,IACJ,sBAAA,wBAAwB,SACxB,IAAI,UAAU,GAAA,GAAA,sBAAA,OACR,gBAAA,QAAQ,KAAK,EACnB,+BACD;AAED,OAAM,IACJ,sBAAA,wBAAwB,iBACxB,IAAI,UAAU,GAAA,GAAA,sBAAA,OACR,gBAAA,QAAQ,KAAK,EACnB,+BACD;AAED,OAAM,OACJ,sBAAA,wBAAwB,iBACxB,IAAI,UAAU,EACd,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,EAAE;AACf,OAAK,IAAI,OAAO,OAAO;AACvB,MAAI;AACF,SAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,KAAK;AACrD,OAAI,OAAO,gBAAA,UAAU,YAAY,QAAQ;AACzC,UAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,aAC3B,CAAC;WACK,KAAK;AACZ,QAAK,IAAI;;GAGd;AAED,OAAM,IACJ,sBAAA,wBAAwB,eACxB,IAAI,SAAS,EACb,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,IAAI;AAC7C,MAAI;AAMF,SALiB,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACD,CAAC,EACY,gBAAA,UAAU,WAAW;WAC5B,KAAK;AACZ,QAAK,IAAI;;GAGd"}
+{"version":3,"file":"dist-tags.js","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,gBAAA,WAAW,cAAc,oBAAoB,CAAC;EAG5D,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO,IAAI;EAC3B,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,sBAAA,wBAAwB,SACxB,IAAI,SAAS,IAAA,GAAA,sBAAA,OACP,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,IAAA,GAAA,sBAAA,OACP,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,GACb,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO;EACvB,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;GACF,CAAC,GACa,gBAAA,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/dist-tags.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dist-tags.mjs","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;CACF,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;AAC3B,MAAI,OAAO,IAAI,SAAS,SACtB,QAAO,KAAK,WAAW,cAAc,qBAAqB,CAAC;EAG7D,MAAM,OAAO,EAAE;AACf,OAAK,IAAI,OAAO,OAAO,IAAI;AAC3B,MAAI;AACF,SAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,KAAK;AACrD,OAAI,OAAO,UAAU,YAAY,QAAQ;AACzC,UAAO,KAAK,EACV,IAAI,UAAU,YAAY,WAC3B,CAAC;WACK,KAAK;AACZ,QAAK,IAAI;;;AAKb,OAAM,IACJ,wBAAwB,SACxB,IAAI,UAAU,EACd,MAAM,QAAQ,KAAK,EACnB,+BACD;AAED,OAAM,IACJ,wBAAwB,iBACxB,IAAI,UAAU,EACd,MAAM,QAAQ,KAAK,EACnB,+BACD;AAED,OAAM,OACJ,wBAAwB,iBACxB,IAAI,UAAU,EACd,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,EAAE;AACf,OAAK,IAAI,OAAO,OAAO;AACvB,MAAI;AACF,SAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,KAAK;AACrD,OAAI,OAAO,UAAU,YAAY,QAAQ;AACzC,UAAO,KAAK,EACV,IAAI,UAAU,YAAY,aAC3B,CAAC;WACK,KAAK;AACZ,QAAK,IAAI;;GAGd;AAED,OAAM,IACJ,wBAAwB,eACxB,IAAI,SAAS,EACb,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,iBAAiB,kBAAkB,IAAI;AAC7C,MAAI;AAMF,SALiB,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACD,CAAC,EACY,UAAU,WAAW;WAC5B,KAAK;AACZ,QAAK,IAAI;;GAGd"}
+{"version":3,"file":"dist-tags.mjs","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,WAAW,cAAc,oBAAoB,CAAC;EAG5D,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO,IAAI;EAC3B,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,wBAAwB,SACxB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO;EACvB,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;GACF,CAAC,GACa,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/index.js

@@ -30,7 +30,12 @@ function src_default(config, auth, storage, logger) {
 	app.param("_rev", (0, _verdaccio_middleware.match)(/^-rev$/));
 	app.param("org_couchdb_user", (0, _verdaccio_middleware.match)(/^org\.couchdb\.user:/));
 	(0, _verdaccio_middleware.registerBodyParser)(app, config);
-	app.use(auth.apiJWTmiddleware());
+	const apiJwtMiddleware = auth.apiJWTmiddleware();
+	app.use((req, res, next) => {
+		if (req.remote_user ?? res.locals.remote_user) return next();
+		return apiJwtMiddleware(req, res, next);
+	});
+	app.use((0, _verdaccio_middleware.enforceGeneratedTokenMetadata)(storage, logger));
 	app.use((0, _verdaccio_middleware.antiLoop)(config));
 	app.use(_verdaccio_middleware.makeURLrelative);
 	app.use(_verdaccio_middleware.encodeScopePackage);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  app.use(auth.apiJWTmiddleware());\n\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, logger);\n  ping(app);\n  stars(app, storage);\n  v1Search(app, auth, storage, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAA,QAAQ,QAAQ;AAI5B,KAAI,MAAM,WAAW,sBAAA,gBAAgB;AACrC,KAAI,MAAM,YAAY,sBAAA,aAAa;AACnC,KAAI,MAAM,OAAO,sBAAA,aAAa;AAC9B,KAAI,MAAM,WAAW,sBAAA,aAAa;AAClC,KAAI,MAAM,YAAY,sBAAA,aAAa;AACnC,KAAI,MAAM,SAAS,sBAAA,aAAa;AAIhC,KAAI,MAAM,SAAA,GAAA,sBAAA,OAAc,SAAS,CAAC;AAClC,KAAI,MAAM,qBAAA,GAAA,sBAAA,OAA0B,uBAAuB,CAAC;AAG5D,EAAA,GAAA,sBAAA,oBAAmB,KAAK,OAAO;AAE/B,KAAI,IAAI,KAAK,kBAAkB,CAAC;AAEhC,KAAI,KAAA,GAAA,sBAAA,UAAa,OAAO,CAAC;AACzB,KAAI,IAAI,sBAAA,gBAAgB;AAExB,KAAI,IAAI,sBAAA,mBAAmB;AAE3B,gBAAA,QAAO,IAAI;AACX,iBAAA,QAAQ,KAAK,MAAM,OAAO;AAC1B,gBAAA,QAAO,KAAK,OAAO;AACnB,cAAA,QAAK,KAAK,MAAM,QAAQ,OAAO;AAC/B,mBAAA,QAAS,KAAK,MAAM,SAAS,OAAO;AACpC,iBAAA,QAAQ,KAAK,MAAM,SAAS,OAAO;AACnC,cAAA,QAAK,IAAI;AACT,eAAA,QAAM,KAAK,QAAQ;AACnB,kBAAA,QAAS,KAAK,MAAM,SAAS,OAAO;AACpC,eAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,OAAO;AACzC,iBAAA,QAAI,KAAK,MAAM,SAAS,OAAO;AAC/B,KAAI,OAAO,OAAO,SAChB,eAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,OAAO;AAE3C,QAAO"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, logger);\n  ping(app);\n  stars(app, storage);\n  v1Search(app, auth, storage, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA8BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAA,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,sBAAA,eAAe;CACpC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,OAAO,sBAAA,YAAY;CAC7B,IAAI,MAAM,WAAW,sBAAA,YAAY;CACjC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,SAAS,sBAAA,YAAY;CAI/B,IAAI,MAAM,SAAA,GAAA,sBAAA,OAAc,QAAQ,CAAC;CACjC,IAAI,MAAM,qBAAA,GAAA,sBAAA,OAA0B,sBAAsB,CAAC;CAG3D,CAAA,GAAA,sBAAA,oBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,KAAA,GAAA,sBAAA,+BAAkC,SAAS,MAAM,CAAC;CACtD,IAAI,KAAA,GAAA,sBAAA,UAAa,MAAM,CAAC;CACxB,IAAI,IAAI,sBAAA,eAAe;CAEvB,IAAI,IAAI,sBAAA,kBAAkB;CAE1B,eAAA,QAAO,GAAG;CACV,gBAAA,QAAQ,KAAK,MAAM,MAAM;CACzB,eAAA,QAAO,KAAK,MAAM;CAClB,aAAA,QAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,gBAAA,QAAQ,KAAK,MAAM,SAAS,MAAM;CAClC,aAAA,QAAK,GAAG;CACR,cAAA,QAAM,KAAK,OAAO;CAClB,iBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAA,QAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}

package/build/index.mjs

@@ -11,7 +11,7 @@ import search_default$1 from "./v1/search.mjs";
 import token_default from "./v1/token.mjs";
 import whoami_default from "./whoami.mjs";
 import express from "express";
-import { antiLoop, encodeScopePackage, makeURLrelative, match, registerBodyParser, validateName, validatePackage } from "@verdaccio/middleware";
+import { antiLoop, encodeScopePackage, enforceGeneratedTokenMetadata, makeURLrelative, match, registerBodyParser, validateName, validatePackage } from "@verdaccio/middleware";
 //#region src/index.ts
 function src_default(config, auth, storage, logger) {
 	const app = express.Router();
@@ -24,7 +24,12 @@ function src_default(config, auth, storage, logger) {
 	app.param("_rev", match(/^-rev$/));
 	app.param("org_couchdb_user", match(/^org\.couchdb\.user:/));
 	registerBodyParser(app, config);
-	app.use(auth.apiJWTmiddleware());
+	const apiJwtMiddleware = auth.apiJWTmiddleware();
+	app.use((req, res, next) => {
+		if (req.remote_user ?? res.locals.remote_user) return next();
+		return apiJwtMiddleware(req, res, next);
+	});
+	app.use(enforceGeneratedTokenMetadata(storage, logger));
 	app.use(antiLoop(config));
 	app.use(makeURLrelative);
 	app.use(encodeScopePackage);

package/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  app.use(auth.apiJWTmiddleware());\n\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, logger);\n  ping(app);\n  stars(app, storage);\n  v1Search(app, auth, storage, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAQ,QAAQ;AAI5B,KAAI,MAAM,WAAW,gBAAgB;AACrC,KAAI,MAAM,YAAY,aAAa;AACnC,KAAI,MAAM,OAAO,aAAa;AAC9B,KAAI,MAAM,WAAW,aAAa;AAClC,KAAI,MAAM,YAAY,aAAa;AACnC,KAAI,MAAM,SAAS,aAAa;AAIhC,KAAI,MAAM,QAAQ,MAAM,SAAS,CAAC;AAClC,KAAI,MAAM,oBAAoB,MAAM,uBAAuB,CAAC;AAG5D,oBAAmB,KAAK,OAAO;AAE/B,KAAI,IAAI,KAAK,kBAAkB,CAAC;AAEhC,KAAI,IAAI,SAAS,OAAO,CAAC;AACzB,KAAI,IAAI,gBAAgB;AAExB,KAAI,IAAI,mBAAmB;AAE3B,gBAAO,IAAI;AACX,iBAAQ,KAAK,MAAM,OAAO;AAC1B,gBAAO,KAAK,OAAO;AACnB,cAAK,KAAK,MAAM,QAAQ,OAAO;AAC/B,mBAAS,KAAK,MAAM,SAAS,OAAO;AACpC,SAAQ,KAAK,MAAM,SAAS,OAAO;AACnC,cAAK,IAAI;AACT,eAAM,KAAK,QAAQ;AACnB,kBAAS,KAAK,MAAM,SAAS,OAAO;AACpC,eAAM,KAAK,MAAM,SAAS,QAAQ,OAAO;AACzC,iBAAI,KAAK,MAAM,SAAS,OAAO;AAC/B,KAAI,OAAO,OAAO,SAChB,eAAM,KAAK,MAAM,SAAS,QAAQ,OAAO;AAE3C,QAAO"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport stars from './stars';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, logger);\n  ping(app);\n  stars(app, storage);\n  v1Search(app, auth, storage, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;AA8BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,eAAe;CACpC,IAAI,MAAM,YAAY,YAAY;CAClC,IAAI,MAAM,OAAO,YAAY;CAC7B,IAAI,MAAM,WAAW,YAAY;CACjC,IAAI,MAAM,YAAY,YAAY;CAClC,IAAI,MAAM,SAAS,YAAY;CAI/B,IAAI,MAAM,QAAQ,MAAM,QAAQ,CAAC;CACjC,IAAI,MAAM,oBAAoB,MAAM,sBAAsB,CAAC;CAG3D,mBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,IAAI,8BAA8B,SAAS,MAAM,CAAC;CACtD,IAAI,IAAI,SAAS,MAAM,CAAC;CACxB,IAAI,IAAI,eAAe;CAEvB,IAAI,IAAI,kBAAkB;CAE1B,eAAO,GAAG;CACV,gBAAQ,KAAK,MAAM,MAAM;CACzB,eAAO,KAAK,MAAM;CAClB,aAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAS,KAAK,MAAM,SAAS,MAAM;CACnC,QAAQ,KAAK,MAAM,SAAS,MAAM;CAClC,aAAK,GAAG;CACR,cAAM,KAAK,OAAO;CAClB,iBAAS,KAAK,MAAM,SAAS,MAAM;CACnC,cAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}

package/build/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const version = req.params.version;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAWA,IAAM,WAAA,GAAA,MAAA,SAAmB,wBAAwB;AAEjD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;AACF,OAAM,IACJ,sBAAA,sBAAsB,wBACtB,IAAI,SAAS,EACb,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,UAAU,IAAI,OAAO;AAC3B,UAAM,iCAAiC,MAAM,QAAQ;EACrD,MAAM,cACJ,gBAAA,YAAY,0BAA0B,IAAI,IAAI,SAAS,CAAC,KAAK,iBAAA,QAAQ;AACvE,UAAM,mBAAmB,YAAY;EAErC,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,IAAI;AAE7C,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;IACD,CAAC;AACF,OAAI,aAAa;AACf,YAAM,uBAAuB;AAC7B,SAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,qBAAqB;UACjE;AACL,YAAM,gBAAgB;AACtB,SAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,KAAK;;AAGxD,QAAK,SAAS;WACP,KAAK;AACZ,QAAK,IAAI;;GAGd;AAED,OAAM,IACJ,sBAAA,sBAAsB,qBACtB,IAAI,SAAS,EACb,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,EAAE,SAAS,SAAS,aAAa,IAAI;EAC3C,MAAM,QAAQ,IAAI,iBAAiB;AACnC,MAAI;AACF,WAAM,0BAA0B,SAAS;GACzC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,QAGf,CAAC;AAEF,UAAO,GAAG,mBAAmB,SAAS;AACpC,YAAM,mBAAmB,KAAK;AAC9B,QAAI,OAAO,gBAAA,YAAY,gBAAgB,KAAK;KAC5C;AAEF,UAAO,KAAK,UAAU,QAAQ;AAC5B,YAAM,gCAAgC,IAAI;AAC1C,QAAI,OAAO,aAAa,IAAI;AAC5B,SAAK,IAAI;KACT;AAEF,OAAI,GAAG,eAAe;AACpB,YAAM,0BAA0B,IAAI,IAAI;AACxC,UAAM,OAAO;KACb;AAEF,OAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,aAAa;AACtD,UAAO,KAAK,IAAI;WACT,KAAU;AACjB,OAAI,OAAO,aAAa,IAAI;AAC5B,QAAK,IAAI;;GAGd"}
+{"version":3,"file":"package.js","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const version = req.params.version;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAWA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;AAEhD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,IACJ,sBAAA,sBAAsB,wBACtB,IAAI,QAAQ,GACZ,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,UAAU,IAAI,OAAO;EAC3B,QAAM,iCAAiC,MAAM,OAAO;EACpD,MAAM,cACJ,gBAAA,YAAY,0BAA0B,IAAI,IAAI,QAAQ,CAAC,MAAM,iBAAA,QAAQ;EACvE,QAAM,mBAAmB,WAAW;EAEpC,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,GAAG;EAE5C,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;GACF,CAAC;GACD,IAAI,aAAa;IACf,QAAM,sBAAsB;IAC5B,KAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,oBAAoB;GACvE,OAAO;IACL,QAAM,eAAe;IACrB,KAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,IAAI;GACvD;GAEA,KAAK,QAAQ;EACf,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,sBAAsB,qBACtB,IAAI,QAAQ,GACZ,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,EAAE,SAAS,SAAS,aAAa,IAAI;EAC3C,MAAM,QAAQ,IAAI,gBAAgB;EAClC,IAAI;GACF,QAAM,0BAA0B,QAAQ;GACxC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,OAGhB,CAAC;GAED,OAAO,GAAG,mBAAmB,SAAS;IACpC,QAAM,mBAAmB,IAAI;IAC7B,IAAI,OAAO,gBAAA,YAAY,gBAAgB,IAAI;GAC7C,CAAC;GAED,OAAO,KAAK,UAAU,QAAQ;IAC5B,QAAM,gCAAgC,GAAG;IACzC,IAAI,OAAO,aAAa,GAAG;IAC3B,KAAK,GAAG;GACV,CAAC;GAED,IAAI,GAAG,eAAe;IACpB,QAAM,0BAA0B,IAAI,GAAG;IACvC,MAAM,MAAM;GACd,CAAC;GAED,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,YAAY;GACrD,OAAO,KAAK,GAAG;EACjB,SAAS,KAAU;GACjB,IAAI,OAAO,aAAa,GAAG;GAC3B,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/package.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"package.mjs","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const version = req.params.version;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;AAWA,IAAM,QAAQ,WAAW,wBAAwB;AAEjD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;AACF,OAAM,IACJ,sBAAsB,wBACtB,IAAI,SAAS,EACb,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,UAAU,IAAI,OAAO;AAC3B,QAAM,iCAAiC,MAAM,QAAQ;EACrD,MAAM,cACJ,YAAY,0BAA0B,IAAI,IAAI,SAAS,CAAC,KAAK,QAAQ;AACvE,QAAM,mBAAmB,YAAY;EAErC,MAAM,iBAAiB,kBAAkB,IAAI;AAE7C,MAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;IACD,CAAC;AACF,OAAI,aAAa;AACf,UAAM,uBAAuB;AAC7B,SAAK,UAAU,YAAY,cAAc,QAAQ,qBAAqB;UACjE;AACL,UAAM,gBAAgB;AACtB,SAAK,UAAU,YAAY,cAAc,QAAQ,KAAK;;AAGxD,QAAK,SAAS;WACP,KAAK;AACZ,QAAK,IAAI;;GAGd;AAED,OAAM,IACJ,sBAAsB,qBACtB,IAAI,SAAS,EACb,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,EAAE,SAAS,SAAS,aAAa,IAAI;EAC3C,MAAM,QAAQ,IAAI,iBAAiB;AACnC,MAAI;AACF,SAAM,0BAA0B,SAAS;GACzC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,QAGf,CAAC;AAEF,UAAO,GAAG,mBAAmB,SAAS;AACpC,UAAM,mBAAmB,KAAK;AAC9B,QAAI,OAAO,YAAY,gBAAgB,KAAK;KAC5C;AAEF,UAAO,KAAK,UAAU,QAAQ;AAC5B,UAAM,gCAAgC,IAAI;AAC1C,QAAI,OAAO,aAAa,IAAI;AAC5B,SAAK,IAAI;KACT;AAEF,OAAI,GAAG,eAAe;AACpB,UAAM,0BAA0B,IAAI,IAAI;AACxC,UAAM,OAAO;KACb;AAEF,OAAI,OAAO,QAAQ,cAAc,QAAQ,aAAa;AACtD,UAAO,KAAK,IAAI;WACT,KAAU;AACjB,OAAI,OAAO,aAAa,IAAI;AAC5B,QAAK,IAAI;;GAGd"}
+{"version":3,"file":"package.mjs","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const version = req.params.version;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;AAWA,IAAM,QAAQ,WAAW,uBAAuB;AAEhD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,IACJ,sBAAsB,wBACtB,IAAI,QAAQ,GACZ,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,UAAU,IAAI,OAAO;EAC3B,MAAM,iCAAiC,MAAM,OAAO;EACpD,MAAM,cACJ,YAAY,0BAA0B,IAAI,IAAI,QAAQ,CAAC,MAAM,QAAQ;EACvE,MAAM,mBAAmB,WAAW;EAEpC,MAAM,iBAAiB,kBAAkB,GAAG;EAE5C,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;GACF,CAAC;GACD,IAAI,aAAa;IACf,MAAM,sBAAsB;IAC5B,KAAK,UAAU,YAAY,cAAc,QAAQ,oBAAoB;GACvE,OAAO;IACL,MAAM,eAAe;IACrB,KAAK,UAAU,YAAY,cAAc,QAAQ,IAAI;GACvD;GAEA,KAAK,QAAQ;EACf,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAsB,qBACtB,IAAI,QAAQ,GACZ,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,EAAE,SAAS,SAAS,aAAa,IAAI;EAC3C,MAAM,QAAQ,IAAI,gBAAgB;EAClC,IAAI;GACF,MAAM,0BAA0B,QAAQ;GACxC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,OAGhB,CAAC;GAED,OAAO,GAAG,mBAAmB,SAAS;IACpC,MAAM,mBAAmB,IAAI;IAC7B,IAAI,OAAO,YAAY,gBAAgB,IAAI;GAC7C,CAAC;GAED,OAAO,KAAK,UAAU,QAAQ;IAC5B,MAAM,gCAAgC,GAAG;IACzC,IAAI,OAAO,aAAa,GAAG;IAC3B,KAAK,GAAG;GACV,CAAC;GAED,IAAI,GAAG,eAAe;IACpB,MAAM,0BAA0B,IAAI,GAAG;IACvC,MAAM,MAAM;GACd,CAAC;GAED,IAAI,OAAO,QAAQ,cAAc,QAAQ,YAAY;GACrD,OAAO,KAAK,GAAG;EACjB,SAAS,KAAU;GACjB,IAAI,OAAO,aAAa,GAAG;GAC3B,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/ping.js

@@ -1,4 +1,3 @@
-require("./_virtual/_rolldown/runtime.js");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 //#region src/ping.ts
 function ping_default(route) {

package/build/ping.js.map

@@ -1 +1 @@
-{"version":3,"file":"ping.js","names":[],"sources":["../src/ping.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport { PING_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router): void {\n  route.get(\n    PING_API_ENDPOINTS.ping,\n    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      next({});\n    }\n  );\n}\n"],"mappings":";;;AAMA,SAAA,aAAyB,OAAqB;AAC5C,OAAM,IACJ,sBAAA,mBAAmB,MACnB,SAAU,KAAqB,KAAsB,MAAwB;AAC3E,OAAK,EAAE,CAAC;GAEX"}
+{"version":3,"file":"ping.js","names":[],"sources":["../src/ping.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport { PING_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router): void {\n  route.get(\n    PING_API_ENDPOINTS.ping,\n    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      next({});\n    }\n  );\n}\n"],"mappings":";;AAMA,SAAA,aAAyB,OAAqB;CAC5C,MAAM,IACJ,sBAAA,mBAAmB,MACnB,SAAU,KAAqB,KAAsB,MAAwB;EAC3E,KAAK,CAAC,CAAC;CACT,CACF;AACF"}

package/build/ping.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ping.mjs","names":[],"sources":["../src/ping.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport { PING_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router): void {\n  route.get(\n    PING_API_ENDPOINTS.ping,\n    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      next({});\n    }\n  );\n}\n"],"mappings":";;AAMA,SAAA,aAAyB,OAAqB;AAC5C,OAAM,IACJ,mBAAmB,MACnB,SAAU,KAAqB,KAAsB,MAAwB;AAC3E,OAAK,EAAE,CAAC;GAEX"}
+{"version":3,"file":"ping.mjs","names":[],"sources":["../src/ping.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport { PING_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router): void {\n  route.get(\n    PING_API_ENDPOINTS.ping,\n    function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      next({});\n    }\n  );\n}\n"],"mappings":";;AAMA,SAAA,aAAyB,OAAqB;CAC5C,MAAM,IACJ,mBAAmB,MACnB,SAAU,KAAqB,KAAsB,MAAwB;EAC3E,KAAK,CAAC,CAAC;CACT,CACF;AACF"}

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\n// import star from './star';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"3-b0cdaefc9bdb77c8\",\n      \"users\": {\n        [username]: boolean value (true, false)\n      }\n     }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGjD,SAAwB,QACtB,QACA,MACA,SACA,QACM;CACN,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;AACF,QAAO,IACL,sBAAA,sBAAsB,aACtB,IAAI,UAAU,GAAA,GAAA,sBAAA,OACR,gBAAA,QAAQ,KAAK,EACnB,sBAAA,YACA,eAAe,SAAS,QAAQ,sBAAsB,CACvD;AAED,QAAO,IACL,sBAAA,sBAAsB,iBACtB,IAAI,YAAY,GAAA,GAAA,sBAAA,OACV,gBAAA,QAAQ,KAAK,EACnB,sBAAA,YACA,eAAe,SAAS,QAAQ,wBAAwB,CACzD;;;;;;;;;;;;;;;;;;AAmBD,QAAO,OACL,sBAAA,sBAAsB,iBACtB,IAAI,YAAY,EAChB,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;AAEnC,SAAO,MAAM,EAAE,aAAa,EAAE,8BAA8B;AAC5D,MAAI;AACF,SAAM,QAAQ,cAAc,aAAa,KAAK,SAAS;AACvD,WAAM,0BAA0B,YAAY;AAC5C,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAC/B,UAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,aAAa,CAAC;WACrC,KAAK;AACZ,UAAO,KAAK,IAAI;;GAGrB;AAMD,QAAO,OACL,sBAAA,sBAAsB,gBACtB,IAAI,YAAY,EAChB,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;AAEnC,SAAO,MACL;GAAE;GAAa;GAAU;GAAU,EACnC,mEACD;AACD,MAAI;AACF,SAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,SAAS;AACtE,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAE/B,UAAO,MACL;IAAE;IAAa;IAAU;IAAU,EACnC,uEACD;AACD,UAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,iBAAiB,CAAC;WACzC,KAAK;AACZ,UAAO,KAAK,IAAI;;GAGrB;;AAGH,SAAgB,eAAe,SAAkB,QAAgB,QAAqB;AACpF,QAAO,eACL,KACA,KACA,MACe;AACf,UAAM,OAAO;EACb,MAAM,KAAK,IAAI,iBAAiB;EAChC,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;AACzB,UAAM,yBAAyB,YAAY;AAC3C,UAAM,eAAe,SAAS;AAC9B,MAAI,QAAM,QACR,SAAM,WAAW,IAAI,KAAK;EAE5B,MAAM,WAAW,IAAI;AAErB,SAAO,MAAM,EAAE,aAAa,EAAE,oCAAoC;EAElE,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,IAAI;AAE7C,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;IACd,CAAC;AACF,WAAM,wBAAwB,YAAY;AAE1C,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAE/B,UAAO,KAAK;IACV,SAAS;IACT,IAAI;IACL,CAAC;WACK,KAAU;AAEjB,QAAK,IAAI"}
+{"version":3,"file":"publish.js","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\n// import star from './star';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"3-b0cdaefc9bdb77c8\",\n      \"users\": {\n        [username]: boolean value (true, false)\n      }\n     }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGhD,SAAwB,QACtB,QACA,MACA,SACA,QACM;CACN,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,OAAO,IACL,sBAAA,sBAAsB,aACtB,IAAI,SAAS,IAAA,GAAA,sBAAA,OACP,gBAAA,QAAQ,IAAI,GAClB,sBAAA,YACA,eAAe,SAAS,QAAQ,qBAAqB,CACvD;CAEA,OAAO,IACL,sBAAA,sBAAsB,iBACtB,IAAI,WAAW,IAAA,GAAA,sBAAA,OACT,gBAAA,QAAQ,IAAI,GAClB,sBAAA,YACA,eAAe,SAAS,QAAQ,uBAAuB,CACzD;;;;;;;;;;;;;;;;;;CAmBA,OAAO,OACL,sBAAA,sBAAsB,iBACtB,IAAI,WAAW,GACf,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MAAM,EAAE,YAAY,GAAG,6BAA6B;EAC3D,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,KAAK,QAAQ;GACtD,QAAM,0BAA0B,WAAW;GAC3C,IAAI,OAAO,gBAAA,YAAY,OAAO;GAC9B,OAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,YAAY,CAAC;EAC7C,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;CAMA,OAAO,OACL,sBAAA,sBAAsB,gBACtB,IAAI,WAAW,GACf,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MACL;GAAE;GAAa;GAAU;EAAS,GAClC,kEACF;EACA,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,QAAQ;GACrE,IAAI,OAAO,gBAAA,YAAY,OAAO;GAE9B,OAAO,MACL;IAAE;IAAa;IAAU;GAAS,GAClC,sEACF;GACA,OAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,gBAAgB,CAAC;EACjD,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF;AAEA,SAAgB,eAAe,SAAkB,QAAgB,QAAqB;CACpF,OAAO,eACL,KACA,KACA,MACe;EACf,QAAM,MAAM;EACZ,MAAM,KAAK,IAAI,gBAAgB;EAC/B,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;EACzB,QAAM,yBAAyB,WAAW;EAC1C,QAAM,eAAe,QAAQ;EAC7B,IAAI,QAAM,SACR,QAAM,WAAW,IAAI,IAAI;EAE3B,MAAM,WAAW,IAAI;EAErB,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;EAEjE,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,GAAG;EAE5C,IAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;GACf,CAAC;GACD,QAAM,wBAAwB,WAAW;GAEzC,IAAI,OAAO,gBAAA,YAAY,OAAO;GAE9B,OAAO,KAAK;IACV,SAAS;IACT,IAAI;GACN,CAAC;EACH,SAAS,KAAU;GAEjB,KAAK,GAAG;EACV;CACF;AACF"}

package/build/publish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"publish.mjs","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\n// import star from './star';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"3-b0cdaefc9bdb77c8\",\n      \"users\": {\n        [username]: boolean value (true, false)\n      }\n     }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;AAkBA,IAAM,QAAQ,WAAW,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGjD,SAAwB,QACtB,QACA,MACA,SACA,QACM;CACN,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;AACF,QAAO,IACL,sBAAsB,aACtB,IAAI,UAAU,EACd,MAAM,QAAQ,KAAK,EACnB,YACA,eAAe,SAAS,QAAQ,sBAAsB,CACvD;AAED,QAAO,IACL,sBAAsB,iBACtB,IAAI,YAAY,EAChB,MAAM,QAAQ,KAAK,EACnB,YACA,eAAe,SAAS,QAAQ,wBAAwB,CACzD;;;;;;;;;;;;;;;;;;AAmBD,QAAO,OACL,sBAAsB,iBACtB,IAAI,YAAY,EAChB,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;AAEnC,SAAO,MAAM,EAAE,aAAa,EAAE,8BAA8B;AAC5D,MAAI;AACF,SAAM,QAAQ,cAAc,aAAa,KAAK,SAAS;AACvD,SAAM,0BAA0B,YAAY;AAC5C,OAAI,OAAO,YAAY,QAAQ;AAC/B,UAAO,KAAK,EAAE,IAAI,YAAY,aAAa,CAAC;WACrC,KAAK;AACZ,UAAO,KAAK,IAAI;;GAGrB;AAMD,QAAO,OACL,sBAAsB,gBACtB,IAAI,YAAY,EAChB,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;AAEnC,SAAO,MACL;GAAE;GAAa;GAAU;GAAU,EACnC,mEACD;AACD,MAAI;AACF,SAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,SAAS;AACtE,OAAI,OAAO,YAAY,QAAQ;AAE/B,UAAO,MACL;IAAE;IAAa;IAAU;IAAU,EACnC,uEACD;AACD,UAAO,KAAK,EAAE,IAAI,YAAY,iBAAiB,CAAC;WACzC,KAAK;AACZ,UAAO,KAAK,IAAI;;GAGrB;;AAGH,SAAgB,eAAe,SAAkB,QAAgB,QAAqB;AACpF,QAAO,eACL,KACA,KACA,MACe;AACf,QAAM,OAAO;EACb,MAAM,KAAK,IAAI,iBAAiB;EAChC,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;AACzB,QAAM,yBAAyB,YAAY;AAC3C,QAAM,eAAe,SAAS;AAC9B,MAAI,MAAM,QACR,OAAM,WAAW,IAAI,KAAK;EAE5B,MAAM,WAAW,IAAI;AAErB,SAAO,MAAM,EAAE,aAAa,EAAE,oCAAoC;EAElE,MAAM,iBAAiB,kBAAkB,IAAI;AAE7C,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;IACd,CAAC;AACF,SAAM,wBAAwB,YAAY;AAE1C,OAAI,OAAO,YAAY,QAAQ;AAE/B,UAAO,KAAK;IACV,SAAS;IACT,IAAI;IACL,CAAC;WACK,KAAU;AAEjB,QAAK,IAAI"}
+{"version":3,"file":"publish.mjs","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\n// import star from './star';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"3-b0cdaefc9bdb77c8\",\n      \"users\": {\n        [username]: boolean value (true, false)\n      }\n     }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;AAkBA,IAAM,QAAQ,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGhD,SAAwB,QACtB,QACA,MACA,SACA,QACM;CACN,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,OAAO,IACL,sBAAsB,aACtB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,YACA,eAAe,SAAS,QAAQ,qBAAqB,CACvD;CAEA,OAAO,IACL,sBAAsB,iBACtB,IAAI,WAAW,GACf,MAAM,QAAQ,IAAI,GAClB,YACA,eAAe,SAAS,QAAQ,uBAAuB,CACzD;;;;;;;;;;;;;;;;;;CAmBA,OAAO,OACL,sBAAsB,iBACtB,IAAI,WAAW,GACf,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MAAM,EAAE,YAAY,GAAG,6BAA6B;EAC3D,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,KAAK,QAAQ;GACtD,MAAM,0BAA0B,WAAW;GAC3C,IAAI,OAAO,YAAY,OAAO;GAC9B,OAAO,KAAK,EAAE,IAAI,YAAY,YAAY,CAAC;EAC7C,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;CAMA,OAAO,OACL,sBAAsB,gBACtB,IAAI,WAAW,GACf,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MACL;GAAE;GAAa;GAAU;EAAS,GAClC,kEACF;EACA,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,QAAQ;GACrE,IAAI,OAAO,YAAY,OAAO;GAE9B,OAAO,MACL;IAAE;IAAa;IAAU;GAAS,GAClC,sEACF;GACA,OAAO,KAAK,EAAE,IAAI,YAAY,gBAAgB,CAAC;EACjD,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF;AAEA,SAAgB,eAAe,SAAkB,QAAgB,QAAqB;CACpF,OAAO,eACL,KACA,KACA,MACe;EACf,MAAM,MAAM;EACZ,MAAM,KAAK,IAAI,gBAAgB;EAC/B,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,yBAAyB,WAAW;EAC1C,MAAM,eAAe,QAAQ;EAC7B,IAAI,MAAM,SACR,MAAM,WAAW,IAAI,IAAI;EAE3B,MAAM,WAAW,IAAI;EAErB,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;EAEjE,MAAM,iBAAiB,kBAAkB,GAAG;EAE5C,IAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;GACf,CAAC;GACD,MAAM,wBAAwB,WAAW;GAEzC,IAAI,OAAO,YAAY,OAAO;GAE9B,OAAO,KAAK;IACV,SAAS;IACT,IAAI;GACN,CAAC;EACH,SAAS,KAAU;GAEjB,KAAK,GAAG;EACV;CACF;AACF"}

package/build/search.js

@@ -1,4 +1,3 @@
-require("./_virtual/_rolldown/runtime.js");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/search.ts

package/build/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":[],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Logger } from '@verdaccio/types';\n\nexport default function (route, logger: Logger): void {\n  // TODO: next major version, remove this\n  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;;AAIA,SAAA,eAAyB,OAAO,QAAsB;AAEpD,OAAM,IAAI,sBAAA,qBAAqB,mBAAmB,SAAU,MAAM,KAAK;AACrE,SAAO,KAAK,yDAAyD;AACrE,MAAI,OAAO,gBAAA,YAAY,UAAU;AACjC,MAAI,KAAK,EAAE,OAAO,mCAAmC,CAAC;GACtD"}
+{"version":3,"file":"search.js","names":[],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Logger } from '@verdaccio/types';\n\nexport default function (route, logger: Logger): void {\n  // TODO: next major version, remove this\n  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;AAIA,SAAA,eAAyB,OAAO,QAAsB;CAEpD,MAAM,IAAI,sBAAA,qBAAqB,mBAAmB,SAAU,MAAM,KAAK;EACrE,OAAO,KAAK,wDAAwD;EACpE,IAAI,OAAO,gBAAA,YAAY,SAAS;EAChC,IAAI,KAAK,EAAE,OAAO,kCAAkC,CAAC;CACvD,CAAC;AACH"}

package/build/search.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"search.mjs","names":[],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Logger } from '@verdaccio/types';\n\nexport default function (route, logger: Logger): void {\n  // TODO: next major version, remove this\n  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;AAIA,SAAA,eAAyB,OAAO,QAAsB;AAEpD,OAAM,IAAI,qBAAqB,mBAAmB,SAAU,MAAM,KAAK;AACrE,SAAO,KAAK,yDAAyD;AACrE,MAAI,OAAO,YAAY,UAAU;AACjC,MAAI,KAAK,EAAE,OAAO,mCAAmC,CAAC;GACtD"}
+{"version":3,"file":"search.mjs","names":[],"sources":["../src/search.ts"],"sourcesContent":["import { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Logger } from '@verdaccio/types';\n\nexport default function (route, logger: Logger): void {\n  // TODO: next major version, remove this\n  route.get(SEARCH_API_ENDPOINTS.deprecated_search, function (_req, res) {\n    logger.warn('search endpoint has been removed, please use search v1');\n    res.status(HTTP_STATUS.NOT_FOUND);\n    res.json({ error: 'not found, endpoint was removed' });\n  });\n}\n"],"mappings":";;;AAIA,SAAA,eAAyB,OAAO,QAAsB;CAEpD,MAAM,IAAI,qBAAqB,mBAAmB,SAAU,MAAM,KAAK;EACrE,OAAO,KAAK,wDAAwD;EACpE,IAAI,OAAO,YAAY,SAAS;EAChC,IAAI,KAAK,EAAE,OAAO,kCAAkC,CAAC;CACvD,CAAC;AACH"}

package/build/stars.js

@@ -1,4 +1,3 @@
-require("./_virtual/_rolldown/runtime.js");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 let _verdaccio_core = require("@verdaccio/core");
 let lodash_es = require("lodash-es");

package/build/stars.js.map

@@ -1 +1 @@
-{"version":3,"file":"stars.js","names":[],"sources":["../src/stars.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { keys } from 'lodash-es';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { STARS_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Version } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    STARS_API_ENDPOINTS.get_user_starred_packages,\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;AAUA,SAAA,cAAyB,OAAe,SAAwB;AAC9D,OAAM,IACJ,sBAAA,oBAAoB,2BACpB,OAAO,KAAqB,KAAe,SAA0C;EACnF,MAAM,QAAyB,IAAI;AACnC,MAAI,OAAO,OAAO,QAAQ,SACxB,QAAO,KAAK,gBAAA,WAAW,cAAc,6BAA6B,CAAC;AAGrE,MAAI;GAEF,MAAM,oBAD2B,MAAM,QAAQ,kBAAkB,EACf,QAAQ,kBAAA,GAAA,UAAA,MACnD,aAAa,gBAAA,OAAO,CAAC,SAAS,OAAO,IAAI,UAAU,CAAC,QAAQ,UAAU,GAAG,CAAC,CAChF;AAED,OAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,QAAK,EACH,MAAM,iBAAiB,KAAK,qBAA8B,EACxD,OAAO,gBAAgB,MACxB,EAAE,EACJ,CAAC;WACK,KAAU;AACjB,UAAO,KAAK,IAAI;;GAGrB"}
+{"version":3,"file":"stars.js","names":[],"sources":["../src/stars.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { keys } from 'lodash-es';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { STARS_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Version } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    STARS_API_ENDPOINTS.get_user_starred_packages,\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;AAUA,SAAA,cAAyB,OAAe,SAAwB;CAC9D,MAAM,IACJ,sBAAA,oBAAoB,2BACpB,OAAO,KAAqB,KAAe,SAA0C;EACnF,MAAM,QAAyB,IAAI;EACnC,IAAI,OAAO,OAAO,QAAQ,UACxB,OAAO,KAAK,gBAAA,WAAW,cAAc,4BAA4B,CAAC;EAGpE,IAAI;GAEF,MAAM,oBAA8B,MADG,QAAQ,iBAAiB,GACd,QAAQ,kBAAA,GAAA,UAAA,MACnD,aAAa,gBAAA,MAAM,EAAE,SAAS,OAAO,IAAI,SAAS,EAAE,QAAQ,UAAU,EAAE,CAAC,CAChF;GAEA,IAAI,OAAO,gBAAA,YAAY,EAAE;GACzB,KAAK,EACH,MAAM,iBAAiB,KAAK,qBAA8B,EACxD,OAAO,gBAAgB,KACzB,EAAE,EACJ,CAAC;EACH,SAAS,KAAU;GACjB,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF"}

package/build/stars.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"stars.mjs","names":[],"sources":["../src/stars.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { keys } from 'lodash-es';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { STARS_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Version } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    STARS_API_ENDPOINTS.get_user_starred_packages,\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;AAUA,SAAA,cAAyB,OAAe,SAAwB;AAC9D,OAAM,IACJ,oBAAoB,2BACpB,OAAO,KAAqB,KAAe,SAA0C;EACnF,MAAM,QAAyB,IAAI;AACnC,MAAI,OAAO,OAAO,QAAQ,SACxB,QAAO,KAAK,WAAW,cAAc,6BAA6B,CAAC;AAGrE,MAAI;GAEF,MAAM,oBAD2B,MAAM,QAAQ,kBAAkB,EACf,QAAQ,iBACxD,KAAK,aAAa,OAAO,CAAC,SAAS,OAAO,IAAI,UAAU,CAAC,QAAQ,UAAU,GAAG,CAAC,CAChF;AAED,OAAI,OAAO,YAAY,GAAG;AAC1B,QAAK,EACH,MAAM,iBAAiB,KAAK,qBAA8B,EACxD,OAAO,gBAAgB,MACxB,EAAE,EACJ,CAAC;WACK,KAAU;AACjB,UAAO,KAAK,IAAI;;GAGrB"}
+{"version":3,"file":"stars.mjs","names":[],"sources":["../src/stars.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { keys } from 'lodash-es';\n\nimport { HTTP_STATUS, USERS, errorUtils } from '@verdaccio/core';\nimport { STARS_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Version } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nexport default function (route: Router, storage: Storage): void {\n  route.get(\n    STARS_API_ENDPOINTS.get_user_starred_packages,\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> => {\n      const query: { key: string } = req.query;\n      if (typeof query?.key !== 'string') {\n        return next(errorUtils.getBadRequest('missing query key username'));\n      }\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n        const filteredPackages: Version[] = localPackages.filter((localPackage: Version) =>\n          keys(localPackage[USERS]).includes(query?.key.toString().replace(/['\"]+/g, ''))\n        );\n\n        res.status(HTTP_STATUS.OK);\n        next({\n          rows: filteredPackages.map((filteredPackage: Version) => ({\n            value: filteredPackage.name,\n          })),\n        });\n      } catch (err: any) {\n        return next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;AAUA,SAAA,cAAyB,OAAe,SAAwB;CAC9D,MAAM,IACJ,oBAAoB,2BACpB,OAAO,KAAqB,KAAe,SAA0C;EACnF,MAAM,QAAyB,IAAI;EACnC,IAAI,OAAO,OAAO,QAAQ,UACxB,OAAO,KAAK,WAAW,cAAc,4BAA4B,CAAC;EAGpE,IAAI;GAEF,MAAM,oBAA8B,MADG,QAAQ,iBAAiB,GACd,QAAQ,iBACxD,KAAK,aAAa,MAAM,EAAE,SAAS,OAAO,IAAI,SAAS,EAAE,QAAQ,UAAU,EAAE,CAAC,CAChF;GAEA,IAAI,OAAO,YAAY,EAAE;GACzB,KAAK,EACH,MAAM,iBAAiB,KAAK,qBAA8B,EACxD,OAAO,gBAAgB,KACzB,EAAE,EACJ,CAAC;EACH,SAAS,KAAU;GACjB,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF"}

package/build/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":[],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  authUtils,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config, Logger, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config, logger: Logger): void {\n  route.get(\n    USER_API_ENDPOINTS.get_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (\n        !req.remote_user ||\n        typeof req.remote_user.name !== 'string' ||\n        req.remote_user.name === ''\n      ) {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    USER_API_ENDPOINTS.add_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validationUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n\n            const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validationUtils.validatePassword(password, config?.server?.passwordValidationRegex) ===\n          false\n        ) {\n          debug('adduser: invalid password');\n\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    USER_API_ENDPOINTS.user_token,\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;;;AAqBA,IAAM,WAAA,GAAA,MAAA,SAAmB,qBAAqB;AAE9C,SAAA,aAAyB,OAAe,MAAY,QAAgB,QAAsB;AACxF,OAAM,IACJ,sBAAA,mBAAmB,WAAA,GAAA,sBAAA,WACT,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;AAC1E,UAAM,iBAAiB;AAEvB,MACE,CAAC,IAAI,eACL,OAAO,IAAI,YAAY,SAAS,YAChC,IAAI,YAAY,SAAS,IACzB;AACA,WAAM,qBAAqB;AAC3B,OAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,UAAO,KAAK,EAAE,IAAI,OAAO,CAAC;;EAG5B,MAAM,WAAW,IAAI,OAAO,iBAAiB,MAAM,IAAI,CAAC;EACxD,MAAM,UAAU,gBAAA,UAAU,wBAAwB,IAAI,YAAY,KAAK;AACvE,UAAM,iCAAiC,QAAQ;AAC/C,MAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,OAAK;GAGH,MAAM;GACN,OAAO;GACP,IAAI;GACL,CAAC;GAEL;;;;;;;;;;;;;;;;;;AAmBD,OAAM,IACJ,sBAAA,mBAAmB,WAAA,GAAA,sBAAA,WACT,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;EAC1E,MAAM,EAAE,MAAM,aAAa,IAAI;AAC/B,UAAM,mBAAmB;EACzB,MAAM,aAAa,KAAK,aAAa;AAErC,MAAI,CAAC,gBAAA,gBAAgB,iBAAiB,IAAI,OAAO,kBAAkB,KAAK,CACtE,QAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,kBAAkB,CAAC;AAGpE,MAAI,OAAO,eAAe,eAAe,OAAO,SAAS,YAAY,eAAe,MAAM;AACxF,WAAM,iCAAiC;AACvC,QAAK,aACH,MACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;AAC5D,QAAI,KAAK;AACP,YAAO,MACL;MAAE;MAAM;MAAK,EACb,oEACD;AACD,YAAO,KACL,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,gBAAA,UAAU,sBAAsB,CAC9E;;IAIH,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,SAAA,GAAA,kBAAA,kBADkB,MAAM,MAAM,UAAU,EAAE,CAAC,EACf,SAAS;AAC3E,YAAM,mBAAmB;AACzB,QAAI,CAAC,MACH,QAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;AAG3C,QAAI,OAAO,gBAAA,YAAY,QAAQ;AAC/B,QAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,SAAS;IAEhD,MAAM,UAAU,gBAAA,UAAU,wBAAwB,IAAI,YAAY,KAAK;AACvE,YAAM,kCAAkC,QAAQ;AAEhD,WAAO,KAAK;KACV,IAAI;KACJ;KACD,CAAC;KAEL;SACI;AACL,WAAM,eAAe,KAAK;AAC1B,OACE,gBAAA,gBAAgB,iBAAiB,UAAU,QAAQ,QAAQ,wBAAwB,KACnF,OACA;AACA,YAAM,4BAA4B;AAElC,WAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,eAAe,CAAC;;AAGpF,QAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;AACtE,QAAI,KAAK;AACP,SAAI,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,gBAAA,YAAY,gBAAgB;AACpF,cAAM,gCAAgC;AAItC,aAAO,KACL,gBAAA,WAAW,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,gBAAA,WAAW,YAAY,IAAI,QAAQ,CACnF;;AAEH,YAAO,KAAK,IAAI;;IAGlB,MAAM,QACJ,QAAQ,WACJ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,MAAoB,SAAS,GAC7D,KAAA;AACN,QAAI,MACF,SAAM,yBAAyB,gBAAA,YAAY,KAAK,OAAiB,EAAE,CAAC;AAEtE,QAAI,CAAC,MACH,QAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;AAG3C,QAAI,cAAc;AAClB,QAAI,OAAO,gBAAA,YAAY,QAAQ;AAC/B,QAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,SAAS;AAChD,YAAM,iCAAiC;AACvC,WAAO,KAAK;KACV,IAAI,SAAS,IAAI,KAAK,KAAK;KAC3B;KACD,CAAC;KACF;;GAGP;AAED,OAAM,OACJ,sBAAA,mBAAmB,YACnB,SAAU,KAAqB,KAAe,MAA8B;AAC1E,MAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,OAAK,EACH,IAAI,gBAAA,YAAY,YACjB,CAAC;GAEL"}
+{"version":3,"file":"user.js","names":[],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  authUtils,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config, Logger, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config, logger: Logger): void {\n  route.get(\n    USER_API_ENDPOINTS.get_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (\n        !req.remote_user ||\n        typeof req.remote_user.name !== 'string' ||\n        req.remote_user.name === ''\n      ) {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    USER_API_ENDPOINTS.add_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validationUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n\n            const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validationUtils.validatePassword(password, config?.server?.passwordValidationRegex) ===\n          false\n        ) {\n          debug('adduser: invalid password');\n\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    USER_API_ENDPOINTS.user_token,\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;;;AAqBA,IAAM,WAAA,GAAA,MAAA,SAAmB,oBAAoB;AAE7C,SAAA,aAAyB,OAAe,MAAY,QAAgB,QAAsB;CACxF,MAAM,IACJ,sBAAA,mBAAmB,WAAA,GAAA,sBAAA,WACT,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,QAAM,gBAAgB;EAEtB,IACE,CAAC,IAAI,eACL,OAAO,IAAI,YAAY,SAAS,YAChC,IAAI,YAAY,SAAS,IACzB;GACA,QAAM,oBAAoB;GAC1B,IAAI,OAAO,gBAAA,YAAY,EAAE;GACzB,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC;EAC3B;EAEA,MAAM,WAAW,IAAI,OAAO,iBAAiB,MAAM,GAAG,EAAE;EACxD,MAAM,UAAU,gBAAA,UAAU,wBAAwB,IAAI,YAAY,IAAI;EACtE,QAAM,iCAAiC,OAAO;EAC9C,IAAI,OAAO,gBAAA,YAAY,EAAE;EACzB,KAAK;GAGH,MAAM;GACN,OAAO;GACP,IAAI;EACN,CAAC;CACH,CACF;;;;;;;;;;;;;;;;;;CAmBA,MAAM,IACJ,sBAAA,mBAAmB,WAAA,GAAA,sBAAA,WACT,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,MAAM,EAAE,MAAM,aAAa,IAAI;EAC/B,QAAM,kBAAkB;EACxB,MAAM,aAAa,KAAK,aAAa;EAErC,IAAI,CAAC,gBAAA,gBAAgB,iBAAiB,IAAI,OAAO,kBAAkB,IAAI,GACrE,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,iBAAiB,CAAC;EAGnE,IAAI,OAAO,eAAe,eAAe,OAAO,SAAS,YAAY,eAAe,MAAM;GACxF,QAAM,gCAAgC;GACtC,KAAK,aACH,MACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;IAC5D,IAAI,KAAK;KACP,OAAO,MACL;MAAE;MAAM;KAAI,GACZ,mEACF;KACA,OAAO,KACL,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,gBAAA,UAAU,qBAAqB,CAC9E;IACF;IAGA,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,SAAA,GAAA,kBAAA,kBADkB,MAAM,MAAM,UAAU,CAAC,CACjC,GAAoB,QAAQ;IAC1E,QAAM,kBAAkB;IACxB,IAAI,CAAC,OACH,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;IAG1C,IAAI,OAAO,gBAAA,YAAY,OAAO;IAC9B,IAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;IAE/C,MAAM,UAAU,gBAAA,UAAU,wBAAwB,IAAI,YAAY,IAAI;IACtE,QAAM,kCAAkC,OAAO;IAE/C,OAAO,KAAK;KACV,IAAI;KACJ;IACF,CAAC;GACH,CACF;EACF,OAAO;GACL,QAAM,eAAe,IAAI;GACzB,IACE,gBAAA,gBAAgB,iBAAiB,UAAU,QAAQ,QAAQ,uBAAuB,MAClF,OACA;IACA,QAAM,2BAA2B;IAEjC,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,cAAc,CAAC;GACnF;GAEA,KAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;IACtE,IAAI,KAAK;KACP,IAAI,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,gBAAA,YAAY,gBAAgB;MACpF,QAAM,+BAA+B;MAIrC,OAAO,KACL,gBAAA,WAAW,QAAQ,IAAI,QAAQ,IAAI,OAAO,KAAK,gBAAA,WAAW,YAAY,IAAI,OAAO,CACnF;KACF;KACA,OAAO,KAAK,GAAG;IACjB;IAEA,MAAM,QACJ,QAAQ,WACJ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,MAAoB,QAAQ,IAC5D,KAAA;IACN,IAAI,OACF,QAAM,yBAAyB,gBAAA,YAAY,KAAK,OAAiB,CAAC,CAAC;IAErE,IAAI,CAAC,OACH,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;IAG1C,IAAI,cAAc;IAClB,IAAI,OAAO,gBAAA,YAAY,OAAO;IAC9B,IAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;IAC/C,QAAM,gCAAgC;IACtC,OAAO,KAAK;KACV,IAAI,SAAS,IAAI,KAAK,KAAK;KAC3B;IACF,CAAC;GACH,CAAC;EACH;CACF,CACF;CAEA,MAAM,OACJ,sBAAA,mBAAmB,YACnB,SAAU,KAAqB,KAAe,MAA8B;EAC1E,IAAI,OAAO,gBAAA,YAAY,EAAE;EACzB,KAAK,EACH,IAAI,gBAAA,YAAY,WAClB,CAAC;CACH,CACF;AACF"}

package/build/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","names":[],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  authUtils,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config, Logger, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config, logger: Logger): void {\n  route.get(\n    USER_API_ENDPOINTS.get_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (\n        !req.remote_user ||\n        typeof req.remote_user.name !== 'string' ||\n        req.remote_user.name === ''\n      ) {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    USER_API_ENDPOINTS.add_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validationUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n\n            const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validationUtils.validatePassword(password, config?.server?.passwordValidationRegex) ===\n          false\n        ) {\n          debug('adduser: invalid password');\n\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    USER_API_ENDPOINTS.user_token,\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;AAqBA,IAAM,QAAQ,WAAW,qBAAqB;AAE9C,SAAA,aAAyB,OAAe,MAAY,QAAgB,QAAsB;AACxF,OAAM,IACJ,mBAAmB,UACnB,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;AAC1E,QAAM,iBAAiB;AAEvB,MACE,CAAC,IAAI,eACL,OAAO,IAAI,YAAY,SAAS,YAChC,IAAI,YAAY,SAAS,IACzB;AACA,SAAM,qBAAqB;AAC3B,OAAI,OAAO,YAAY,GAAG;AAC1B,UAAO,KAAK,EAAE,IAAI,OAAO,CAAC;;EAG5B,MAAM,WAAW,IAAI,OAAO,iBAAiB,MAAM,IAAI,CAAC;EACxD,MAAM,UAAU,UAAU,wBAAwB,IAAI,YAAY,KAAK;AACvE,QAAM,iCAAiC,QAAQ;AAC/C,MAAI,OAAO,YAAY,GAAG;AAC1B,OAAK;GAGH,MAAM;GACN,OAAO;GACP,IAAI;GACL,CAAC;GAEL;;;;;;;;;;;;;;;;;;AAmBD,OAAM,IACJ,mBAAmB,UACnB,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;EAC1E,MAAM,EAAE,MAAM,aAAa,IAAI;AAC/B,QAAM,mBAAmB;EACzB,MAAM,aAAa,KAAK,aAAa;AAErC,MAAI,CAAC,gBAAgB,iBAAiB,IAAI,OAAO,kBAAkB,KAAK,CACtE,QAAO,KAAK,WAAW,cAAc,UAAU,kBAAkB,CAAC;AAGpE,MAAI,OAAO,eAAe,eAAe,OAAO,SAAS,YAAY,eAAe,MAAM;AACxF,SAAM,iCAAiC;AACvC,QAAK,aACH,MACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;AAC5D,QAAI,KAAK;AACP,YAAO,MACL;MAAE;MAAM;MAAK,EACb,oEACD;AACD,YAAO,KACL,WAAW,QAAQ,YAAY,cAAc,UAAU,sBAAsB,CAC9E;;IAIH,MAAM,QAAQ,MAAM,YAAY,MAAM,QADC,iBAAiB,MAAM,MAAM,UAAU,EAAE,CAAC,EACf,SAAS;AAC3E,UAAM,mBAAmB;AACzB,QAAI,CAAC,MACH,QAAO,KAAK,WAAW,iBAAiB,CAAC;AAG3C,QAAI,OAAO,YAAY,QAAQ;AAC/B,QAAI,IAAI,QAAQ,eAAe,QAAQ,SAAS;IAEhD,MAAM,UAAU,UAAU,wBAAwB,IAAI,YAAY,KAAK;AACvE,UAAM,kCAAkC,QAAQ;AAEhD,WAAO,KAAK;KACV,IAAI;KACJ;KACD,CAAC;KAEL;SACI;AACL,SAAM,eAAe,KAAK;AAC1B,OACE,gBAAgB,iBAAiB,UAAU,QAAQ,QAAQ,wBAAwB,KACnF,OACA;AACA,UAAM,4BAA4B;AAElC,WAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,eAAe,CAAC;;AAGpF,QAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;AACtE,QAAI,KAAK;AACP,SAAI,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,YAAY,gBAAgB;AACpF,YAAM,gCAAgC;AAItC,aAAO,KACL,WAAW,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,WAAW,YAAY,IAAI,QAAQ,CACnF;;AAEH,YAAO,KAAK,IAAI;;IAGlB,MAAM,QACJ,QAAQ,WACJ,MAAM,YAAY,MAAM,QAAQ,MAAoB,SAAS,GAC7D,KAAA;AACN,QAAI,MACF,OAAM,yBAAyB,YAAY,KAAK,OAAiB,EAAE,CAAC;AAEtE,QAAI,CAAC,MACH,QAAO,KAAK,WAAW,iBAAiB,CAAC;AAG3C,QAAI,cAAc;AAClB,QAAI,OAAO,YAAY,QAAQ;AAC/B,QAAI,IAAI,QAAQ,eAAe,QAAQ,SAAS;AAChD,UAAM,iCAAiC;AACvC,WAAO,KAAK;KACV,IAAI,SAAS,IAAI,KAAK,KAAK;KAC3B;KACD,CAAC;KACF;;GAGP;AAED,OAAM,OACJ,mBAAmB,YACnB,SAAU,KAAqB,KAAe,MAA8B;AAC1E,MAAI,OAAO,YAAY,GAAG;AAC1B,OAAK,EACH,IAAI,YAAY,YACjB,CAAC;GAEL"}
+{"version":3,"file":"user.mjs","names":[],"sources":["../src/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  API_MESSAGE,\n  HEADERS,\n  HTTP_STATUS,\n  authUtils,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { USER_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config, Logger, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router, auth: Auth, config: Config, logger: Logger): void {\n  route.get(\n    USER_API_ENDPOINTS.get_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      debug('verifying user');\n\n      if (\n        !req.remote_user ||\n        typeof req.remote_user.name !== 'string' ||\n        req.remote_user.name === ''\n      ) {\n        debug('user not logged in');\n        res.status(HTTP_STATUS.OK);\n        return next({ ok: false });\n      }\n\n      const username = req.params.org_couchdb_user.split(':')[1];\n      const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n      debug('user authenticated message %o', message);\n      res.status(HTTP_STATUS.OK);\n      next({\n        // 'npm owner' requires user info\n        // TODO: we don't have the email\n        name: username,\n        email: '',\n        ok: message,\n      });\n    }\n  );\n\n  /**\n *  \n *  body example\n *  req.body = {\n      _id: \"org.couchdb.user:jjjj\",\n      name: \"jjjj\",\n      password: \"jjjj\",\n      type: \"user\",\n      roles: [],\n      date: \"2022-07-08T15:51:04.002Z\",\n    }\n * \n * @export\n * @param {Router} route\n * @param {Auth} auth\n * @param {Config} config\n */\n  route.put(\n    USER_API_ENDPOINTS.add_user,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      const { name, password } = req.body;\n      debug('login or adduser');\n      const remoteName = req?.remote_user?.name;\n\n      if (!validationUtils.validateUserName(req.params.org_couchdb_user, name)) {\n        return next(errorUtils.getBadRequest(API_ERROR.USERNAME_MISMATCH));\n      }\n\n      if (typeof remoteName !== 'undefined' && typeof name === 'string' && remoteName === name) {\n        debug('login: no remote user detected');\n        auth.authenticate(\n          name,\n          password,\n          async function callbackAuthenticate(err, user): Promise<void> {\n            if (err) {\n              logger.trace(\n                { name, err },\n                'authenticating for user @{username} failed. Error: @{err.message}'\n              );\n              return next(\n                errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.BAD_USERNAME_PASSWORD)\n              );\n            }\n\n            const restoredRemoteUser: RemoteUser = createRemoteUser(name, user?.groups || []);\n            const token = await getApiToken(auth, config, restoredRemoteUser, password);\n            debug('login: new token');\n            if (!token) {\n              return next(errorUtils.getUnauthorized());\n            }\n\n            res.status(HTTP_STATUS.CREATED);\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n\n            const message = authUtils.getAuthenticatedMessage(req.remote_user.name);\n            debug('login: created user message %o', message);\n\n            return next({\n              ok: message,\n              token,\n            });\n          }\n        );\n      } else {\n        debug('adduser: %o', name);\n        if (\n          validationUtils.validatePassword(password, config?.server?.passwordValidationRegex) ===\n          false\n        ) {\n          debug('adduser: invalid password');\n\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.PASSWORD_SHORT));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n          }\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          req.remote_user = user;\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          debug('adduser: user has been created');\n          return next({\n            ok: `user '${req.body.name}' created`,\n            token,\n          });\n        });\n      }\n    }\n  );\n\n  route.delete(\n    USER_API_ENDPOINTS.user_token,\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      res.status(HTTP_STATUS.OK);\n      next({\n        ok: API_MESSAGE.LOGGED_OUT,\n      });\n    }\n  );\n}\n"],"mappings":";;;;;;AAqBA,IAAM,QAAQ,WAAW,oBAAoB;AAE7C,SAAA,aAAyB,OAAe,MAAY,QAAgB,QAAsB;CACxF,MAAM,IACJ,mBAAmB,UACnB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,MAAM,gBAAgB;EAEtB,IACE,CAAC,IAAI,eACL,OAAO,IAAI,YAAY,SAAS,YAChC,IAAI,YAAY,SAAS,IACzB;GACA,MAAM,oBAAoB;GAC1B,IAAI,OAAO,YAAY,EAAE;GACzB,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC;EAC3B;EAEA,MAAM,WAAW,IAAI,OAAO,iBAAiB,MAAM,GAAG,EAAE;EACxD,MAAM,UAAU,UAAU,wBAAwB,IAAI,YAAY,IAAI;EACtE,MAAM,iCAAiC,OAAO;EAC9C,IAAI,OAAO,YAAY,EAAE;EACzB,KAAK;GAGH,MAAM;GACN,OAAO;GACP,IAAI;EACN,CAAC;CACH,CACF;;;;;;;;;;;;;;;;;;CAmBA,MAAM,IACJ,mBAAmB,UACnB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,MAAM,EAAE,MAAM,aAAa,IAAI;EAC/B,MAAM,kBAAkB;EACxB,MAAM,aAAa,KAAK,aAAa;EAErC,IAAI,CAAC,gBAAgB,iBAAiB,IAAI,OAAO,kBAAkB,IAAI,GACrE,OAAO,KAAK,WAAW,cAAc,UAAU,iBAAiB,CAAC;EAGnE,IAAI,OAAO,eAAe,eAAe,OAAO,SAAS,YAAY,eAAe,MAAM;GACxF,MAAM,gCAAgC;GACtC,KAAK,aACH,MACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;IAC5D,IAAI,KAAK;KACP,OAAO,MACL;MAAE;MAAM;KAAI,GACZ,mEACF;KACA,OAAO,KACL,WAAW,QAAQ,YAAY,cAAc,UAAU,qBAAqB,CAC9E;IACF;IAGA,MAAM,QAAQ,MAAM,YAAY,MAAM,QADC,iBAAiB,MAAM,MAAM,UAAU,CAAC,CACjC,GAAoB,QAAQ;IAC1E,MAAM,kBAAkB;IACxB,IAAI,CAAC,OACH,OAAO,KAAK,WAAW,gBAAgB,CAAC;IAG1C,IAAI,OAAO,YAAY,OAAO;IAC9B,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAE/C,MAAM,UAAU,UAAU,wBAAwB,IAAI,YAAY,IAAI;IACtE,MAAM,kCAAkC,OAAO;IAE/C,OAAO,KAAK;KACV,IAAI;KACJ;IACF,CAAC;GACH,CACF;EACF,OAAO;GACL,MAAM,eAAe,IAAI;GACzB,IACE,gBAAgB,iBAAiB,UAAU,QAAQ,QAAQ,uBAAuB,MAClF,OACA;IACA,MAAM,2BAA2B;IAEjC,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,cAAc,CAAC;GACnF;GAEA,KAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;IACtE,IAAI,KAAK;KACP,IAAI,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,YAAY,gBAAgB;MACpF,MAAM,+BAA+B;MAIrC,OAAO,KACL,WAAW,QAAQ,IAAI,QAAQ,IAAI,OAAO,KAAK,WAAW,YAAY,IAAI,OAAO,CACnF;KACF;KACA,OAAO,KAAK,GAAG;IACjB;IAEA,MAAM,QACJ,QAAQ,WACJ,MAAM,YAAY,MAAM,QAAQ,MAAoB,QAAQ,IAC5D,KAAA;IACN,IAAI,OACF,MAAM,yBAAyB,YAAY,KAAK,OAAiB,CAAC,CAAC;IAErE,IAAI,CAAC,OACH,OAAO,KAAK,WAAW,gBAAgB,CAAC;IAG1C,IAAI,cAAc;IAClB,IAAI,OAAO,YAAY,OAAO;IAC9B,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAC/C,MAAM,gCAAgC;IACtC,OAAO,KAAK;KACV,IAAI,SAAS,IAAI,KAAK,KAAK;KAC3B;IACF,CAAC;GACH,CAAC;EACH;CACF,CACF;CAEA,MAAM,OACJ,mBAAmB,YACnB,SAAU,KAAqB,KAAe,MAA8B;EAC1E,IAAI,OAAO,YAAY,EAAE;EACzB,KAAK,EACH,IAAI,YAAY,WAClB,CAAC;CACH,CACF;AACF"}

package/build/v1/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","names":[],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;;;;AAcA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;AAE/C,IAAM,uBAAuB;AAG7B,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;AACN,OAAM,KACJ,sBAAA,oBAAoB,QAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAA8B;EAEjE,MAAM,aAAA,GAAA,YAAA,aAAwB;AAC9B,UAAM,6BAA6B,UAAU;AAE7C,QAAM,QAAQ,UAAU;GACtB,MAAM;GACN,OAAO;GACP,KAAK;GACL,UAAU;GACV,0BAAS,IAAI,MAAM,EAAC,SAAS;GAC9B,CAAC;AAEF,MAAI,OAAO,gBAAA,YAAY,GAAG;EAG1B,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,OAAO,IAAI,OAAO;EAExB,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK,oBAAoB,sBAAA,oBAAoB,UAAU,GAAG;EACpG,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,GAAG,OAAO,sBAAA,oBAAoB,WAAW,GAAG;AAClF,UAAM,gBAAgB,SAAS;AAC/B,UAAM,eAAe,QAAQ;AAE7B,MAAI,KAAK;GACP;GACA;GACD,CAAC;GAEL;AAED,OAAM,IACJ,sBAAA,oBAAoB,qBAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;AACzF,UAAM,4BAA4B,IAAI,OAAO,UAAU;AAEvD,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,WAAM,uBAAuB;AAC7B,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,WAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;;AAGxF,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,WAAM,qCAAqC,WAAW,OAAO,OAAO;AACpE,OAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,qBACrD,KAAI,OAAO,GAAG,MAAM,WAAW,GAAG;AAChC,YAAM,6BAA6B;AAGnC,QAAI,OAAO,gBAAA,YAAY,SAAS;AAChC,QAAI,IAAI,gBAAA,QAAQ,aAAa,IAAI;AACjC,QAAI,KAAK,EAAE,CAAC;UACP;AAEL,YAAM,yBAAyB;AAC/B,UAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,IAAI;AAMnD,QAFyB,IAAI,KAAK,OAAO,GAAG,QAAQ,mBACjC,IAAI,KAAK,KAAK,KAAK,GAAG,MAAS,IAAK,EACpB;AACjC,aAAM,wBAAwB;AAC9B,YAAO,KAAK,gBAAA,WAAW,gBAAgB,gBAAA,UAAU,sBAAsB,CAAC;;AAG1E,YAAM,2CAA2C;AAEjD,QAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,QAAI,KAAK,EAAE,OAAO,OAAO,GAAG,OAAO,CAAC;;OAGtC,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;WAEjF,OAAY;AACnB,UAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,kCAAkC;AACrE,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;GAG/E;AAED,OAAM,KACJ,sBAAA,oBAAoB,oBAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,EAAE,UAAU,aAAa,IAAI;AACnC,UAAM,+CAA+C,IAAI,OAAO,WAAW,SAAS;AAEpF,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,WAAM,uBAAuB;AAC7B,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,WAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;;AAGxF,OAAK,aACH,UACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;AAC5D,OAAI,KAAK;AACP,WAAO,MACL;KAAE;KAAU;KAAK,EACjB,oEACD;AACD,WAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,IAAI,QAAQ,CAAC;;GAGxE,MAAM,cAAA,GAAA,kBAAA,kBAA8B,UAAU,MAAM,UAAU,EAAE,CAAC;GACjE,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,YAAY,SAAS;AAEnE,OAAI,CAAC,MACH,QAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;AAI3C,WAAM,iCAAiC,UAAU;AACjD,SAAM,QAAQ,YAAY,WAAW,qBAAqB;AAC1D,SAAM,QAAQ,UAAU;IACtB,MAAM;IACN;IACA,KAAK;IACL,UAAU;IACV,0BAAS,IAAI,MAAM,EAAC,SAAS;IAC9B,CAAC;GAEF,MAAM,UAAU,gBAAA,UAAU,wBAAwB,WAAW,QAAQ,GAAG;AAExE,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAC/B,OAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,SAAS;AAChD,OAAI,KAAK;IAAE,IAAI;IAAS;IAAO,CAAC;IAEnC;GAEJ"}
+{"version":3,"file":"login.js","names":[],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;;;;AAcA,IAAM,WAAA,GAAA,MAAA,SAAmB,qBAAqB;AAE9C,IAAM,uBAAuB;AAG7B,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;CACN,MAAM,KACJ,sBAAA,oBAAoB,QAAA,GAAA,sBAAA,WACV,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAA8B;EAEjE,MAAM,aAAA,GAAA,YAAA,YAAuB;EAC7B,QAAM,6BAA6B,SAAS;EAE5C,MAAM,QAAQ,UAAU;GACtB,MAAM;GACN,OAAO;GACP,KAAK;GACL,UAAU;GACV,0BAAS,IAAI,KAAK,GAAE,QAAQ;EAC9B,CAAC;EAED,IAAI,OAAO,gBAAA,YAAY,EAAE;EAGzB,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,OAAO,IAAI,OAAO;EAExB,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK,oBAAoB,sBAAA,oBAAoB,UAAU,GAAG;EACpG,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,GAAG,OAAO,sBAAA,oBAAoB,WAAW,GAAG;EAClF,QAAM,gBAAgB,QAAQ;EAC9B,QAAM,eAAe,OAAO;EAE5B,IAAI,KAAK;GACP;GACA;EACF,CAAC;CACH,CACF;CAEA,MAAM,IACJ,sBAAA,oBAAoB,qBAAA,GAAA,sBAAA,WACV,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAuC;EACzF,QAAM,4BAA4B,IAAI,OAAO,SAAS;EAEtD,IAAI,CAAC,IAAI,OAAO,WAAW;GACzB,QAAM,sBAAsB;GAC5B,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EACxF;EACA,MAAM,YAAY,IAAI,OAAO;EAC7B,IAAI,UAAU,WAAW,IAAI;GAC3B,QAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,kBAAkB,CAAC;EACvF;EAEA,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,UAAU,CAAC;GAC3D,QAAM,qCAAqC,WAAW,OAAO,MAAM;GACnE,IAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,sBACrD,IAAI,OAAO,GAAG,MAAM,WAAW,GAAG;IAChC,QAAM,4BAA4B;IAGlC,IAAI,OAAO,gBAAA,YAAY,QAAQ;IAC/B,IAAI,IAAI,gBAAA,QAAQ,aAAa,GAAG;IAChC,IAAI,KAAK,CAAC,CAAC;GACb,OAAO;IAEL,QAAM,wBAAwB;IAC9B,MAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,GAAG;IAMlD,IAAI,IAFyB,KAAK,OAAO,GAAG,OAExC,oBAAmB,IADA,KAAK,KAAK,IAAI,IAAI,MAAS,GAC3B,GAAY;KACjC,QAAM,uBAAuB;KAC7B,OAAO,KAAK,gBAAA,WAAW,gBAAgB,gBAAA,UAAU,qBAAqB,CAAC;IACzE;IAEA,QAAM,0CAA0C;IAEhD,IAAI,OAAO,gBAAA,YAAY,EAAE;IACzB,IAAI,KAAK,EAAE,OAAO,OAAO,GAAG,MAAM,CAAC;GACrC;QAEA,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,kBAAkB,CAAC;EAEzF,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,iCAAiC;GACpE,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,OAAO,CAAC;EAC3E;CACF,CACF;CAEA,MAAM,KACJ,sBAAA,oBAAoB,oBAAA,GAAA,sBAAA,WACV,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,QAAM,+CAA+C,IAAI,OAAO,WAAW,QAAQ;EAEnF,IAAI,CAAC,IAAI,OAAO,WAAW;GACzB,QAAM,sBAAsB;GAC5B,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EACxF;EACA,MAAM,YAAY,IAAI,OAAO;EAC7B,IAAI,UAAU,WAAW,IAAI;GAC3B,QAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,kBAAkB,CAAC;EACvF;EAEA,KAAK,aACH,UACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;GAC5D,IAAI,KAAK;IACP,OAAO,MACL;KAAE;KAAU;IAAI,GAChB,mEACF;IACA,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,IAAI,OAAO,CAAC;GACvE;GAEA,MAAM,cAAA,GAAA,kBAAA,kBAA8B,UAAU,MAAM,UAAU,CAAC,CAAC;GAChE,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,YAAY,QAAQ;GAElE,IAAI,CAAC,OACH,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;GAI1C,QAAM,iCAAiC,SAAS;GAChD,MAAM,QAAQ,YAAY,WAAW,oBAAoB;GACzD,MAAM,QAAQ,UAAU;IACtB,MAAM;IACN;IACA,KAAK;IACL,UAAU;IACV,0BAAS,IAAI,KAAK,GAAE,QAAQ;GAC9B,CAAC;GAED,MAAM,UAAU,gBAAA,UAAU,wBAAwB,WAAW,QAAQ,EAAE;GAEvE,IAAI,OAAO,gBAAA,YAAY,OAAO;GAC9B,IAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;GAC/C,IAAI,KAAK;IAAE,IAAI;IAAS;GAAM,CAAC;EACjC,CACF;CACF,CACF;AACF"}

package/build/v1/login.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"login.mjs","names":[],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;;AAcA,IAAM,QAAQ,WAAW,sBAAsB;AAE/C,IAAM,uBAAuB;AAG7B,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;AACN,OAAM,KACJ,oBAAoB,OACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAA8B;EAEjE,MAAM,YAAY,YAAY;AAC9B,QAAM,6BAA6B,UAAU;AAE7C,QAAM,QAAQ,UAAU;GACtB,MAAM;GACN,OAAO;GACP,KAAK;GACL,UAAU;GACV,0BAAS,IAAI,MAAM,EAAC,SAAS;GAC9B,CAAC;AAEF,MAAI,OAAO,YAAY,GAAG;EAG1B,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,OAAO,IAAI,OAAO;EAExB,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK,oBAAoB,oBAAoB,UAAU,GAAG;EACpG,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,GAAG,OAAO,oBAAoB,WAAW,GAAG;AAClF,QAAM,gBAAgB,SAAS;AAC/B,QAAM,eAAe,QAAQ;AAE7B,MAAI,KAAK;GACP;GACA;GACD,CAAC;GAEL;AAED,OAAM,IACJ,oBAAoB,oBACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;AACzF,QAAM,4BAA4B,IAAI,OAAO,UAAU;AAEvD,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,SAAM,uBAAuB;AAC7B,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,SAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;;AAGxF,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,SAAM,qCAAqC,WAAW,OAAO,OAAO;AACpE,OAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,qBACrD,KAAI,OAAO,GAAG,MAAM,WAAW,GAAG;AAChC,UAAM,6BAA6B;AAGnC,QAAI,OAAO,YAAY,SAAS;AAChC,QAAI,IAAI,QAAQ,aAAa,IAAI;AACjC,QAAI,KAAK,EAAE,CAAC;UACP;AAEL,UAAM,yBAAyB;AAC/B,UAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,IAAI;AAMnD,QAFyB,IAAI,KAAK,OAAO,GAAG,QAAQ,mBACjC,IAAI,KAAK,KAAK,KAAK,GAAG,MAAS,IAAK,EACpB;AACjC,WAAM,wBAAwB;AAC9B,YAAO,KAAK,WAAW,gBAAgB,UAAU,sBAAsB,CAAC;;AAG1E,UAAM,2CAA2C;AAEjD,QAAI,OAAO,YAAY,GAAG;AAC1B,QAAI,KAAK,EAAE,OAAO,OAAO,GAAG,OAAO,CAAC;;OAGtC,QAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;WAEjF,OAAY;AACnB,UAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,kCAAkC;AACrE,UAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;GAG/E;AAED,OAAM,KACJ,oBAAoB,mBACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,EAAE,UAAU,aAAa,IAAI;AACnC,QAAM,+CAA+C,IAAI,OAAO,WAAW,SAAS;AAEpF,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,SAAM,uBAAuB;AAC7B,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,SAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;;AAGxF,OAAK,aACH,UACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;AAC5D,OAAI,KAAK;AACP,WAAO,MACL;KAAE;KAAU;KAAK,EACjB,oEACD;AACD,WAAO,KAAK,WAAW,QAAQ,YAAY,cAAc,IAAI,QAAQ,CAAC;;GAGxE,MAAM,aAAa,iBAAiB,UAAU,MAAM,UAAU,EAAE,CAAC;GACjE,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,YAAY,SAAS;AAEnE,OAAI,CAAC,MACH,QAAO,KAAK,WAAW,iBAAiB,CAAC;AAI3C,SAAM,iCAAiC,UAAU;AACjD,SAAM,QAAQ,YAAY,WAAW,qBAAqB;AAC1D,SAAM,QAAQ,UAAU;IACtB,MAAM;IACN;IACA,KAAK;IACL,UAAU;IACV,0BAAS,IAAI,MAAM,EAAC,SAAS;IAC9B,CAAC;GAEF,MAAM,UAAU,UAAU,wBAAwB,WAAW,QAAQ,GAAG;AAExE,OAAI,OAAO,YAAY,QAAQ;AAC/B,OAAI,IAAI,QAAQ,eAAe,QAAQ,SAAS;AAChD,OAAI,KAAK;IAAE,IAAI;IAAS;IAAO,CAAC;IAEnC;GAEJ"}
+{"version":3,"file":"login.mjs","names":[],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;;AAcA,IAAM,QAAQ,WAAW,qBAAqB;AAE9C,IAAM,uBAAuB;AAG7B,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;CACN,MAAM,KACJ,oBAAoB,OACpB,UAAU,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAA8B;EAEjE,MAAM,YAAY,WAAW;EAC7B,MAAM,6BAA6B,SAAS;EAE5C,MAAM,QAAQ,UAAU;GACtB,MAAM;GACN,OAAO;GACP,KAAK;GACL,UAAU;GACV,0BAAS,IAAI,KAAK,GAAE,QAAQ;EAC9B,CAAC;EAED,IAAI,OAAO,YAAY,EAAE;EAGzB,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,OAAO,IAAI,OAAO;EAExB,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK,oBAAoB,oBAAoB,UAAU,GAAG;EACpG,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,GAAG,OAAO,oBAAoB,WAAW,GAAG;EAClF,MAAM,gBAAgB,QAAQ;EAC9B,MAAM,eAAe,OAAO;EAE5B,IAAI,KAAK;GACP;GACA;EACF,CAAC;CACH,CACF;CAEA,MAAM,IACJ,oBAAoB,oBACpB,UAAU,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,4BAA4B,IAAI,OAAO,SAAS;EAEtD,IAAI,CAAC,IAAI,OAAO,WAAW;GACzB,MAAM,sBAAsB;GAC5B,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;EACxF;EACA,MAAM,YAAY,IAAI,OAAO;EAC7B,IAAI,UAAU,WAAW,IAAI;GAC3B,MAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,kBAAkB,CAAC;EACvF;EAEA,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,UAAU,CAAC;GAC3D,MAAM,qCAAqC,WAAW,OAAO,MAAM;GACnE,IAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,sBACrD,IAAI,OAAO,GAAG,MAAM,WAAW,GAAG;IAChC,MAAM,4BAA4B;IAGlC,IAAI,OAAO,YAAY,QAAQ;IAC/B,IAAI,IAAI,QAAQ,aAAa,GAAG;IAChC,IAAI,KAAK,CAAC,CAAC;GACb,OAAO;IAEL,MAAM,wBAAwB;IAC9B,MAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,GAAG;IAMlD,IAAI,IAFyB,KAAK,OAAO,GAAG,OAExC,oBAAmB,IADA,KAAK,KAAK,IAAI,IAAI,MAAS,GAC3B,GAAY;KACjC,MAAM,uBAAuB;KAC7B,OAAO,KAAK,WAAW,gBAAgB,UAAU,qBAAqB,CAAC;IACzE;IAEA,MAAM,0CAA0C;IAEhD,IAAI,OAAO,YAAY,EAAE;IACzB,IAAI,KAAK,EAAE,OAAO,OAAO,GAAG,MAAM,CAAC;GACrC;QAEA,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,kBAAkB,CAAC;EAEzF,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,iCAAiC;GACpE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;EAC3E;CACF,CACF;CAEA,MAAM,KACJ,oBAAoB,mBACpB,UAAU,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,+CAA+C,IAAI,OAAO,WAAW,QAAQ;EAEnF,IAAI,CAAC,IAAI,OAAO,WAAW;GACzB,MAAM,sBAAsB;GAC5B,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;EACxF;EACA,MAAM,YAAY,IAAI,OAAO;EAC7B,IAAI,UAAU,WAAW,IAAI;GAC3B,MAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,kBAAkB,CAAC;EACvF;EAEA,KAAK,aACH,UACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;GAC5D,IAAI,KAAK;IACP,OAAO,MACL;KAAE;KAAU;IAAI,GAChB,mEACF;IACA,OAAO,KAAK,WAAW,QAAQ,YAAY,cAAc,IAAI,OAAO,CAAC;GACvE;GAEA,MAAM,aAAa,iBAAiB,UAAU,MAAM,UAAU,CAAC,CAAC;GAChE,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,YAAY,QAAQ;GAElE,IAAI,CAAC,OACH,OAAO,KAAK,WAAW,gBAAgB,CAAC;GAI1C,MAAM,iCAAiC,SAAS;GAChD,MAAM,QAAQ,YAAY,WAAW,oBAAoB;GACzD,MAAM,QAAQ,UAAU;IACtB,MAAM;IACN;IACA,KAAK;IACL,UAAU;IACV,0BAAS,IAAI,KAAK,GAAE,QAAQ;GAC9B,CAAC;GAED,MAAM,UAAU,UAAU,wBAAwB,WAAW,QAAQ,EAAE;GAEvE,IAAI,OAAO,YAAY,OAAO;GAC9B,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;GAC/C,IAAI,KAAK;IAAE,IAAI;IAAS;GAAM,CAAC;EACjC,CACF;CACF,CACF;AACF"}

package/build/v1/profile.js

@@ -1,4 +1,3 @@
-require("../_virtual/_rolldown/runtime.js");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 let _verdaccio_core = require("@verdaccio/core");
 let lodash_es = require("lodash-es");

package/build/v1/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","names":[],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isEmpty, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { PROFILE_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (isNil(password) === false) {\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n        }\n\n        if (isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (err !== null) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;;AA4BA,SAAA,gBAAyB,OAAe,MAAY,QAAsB;CACxE,SAAS,aAAa,MAAuB;AAC3C,SAAO;GACL,KAAK;GACL;GACA,OAAO;GACP,gBAAgB;GAChB,SAAS;GACT,SAAS;GACT,gBAAgB;GAChB,UAAU;GACX;;AAGH,OAAM,IACJ,sBAAA,sBAAsB,cAAA,GAAA,sBAAA,WACZ,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;AAC1E,OAAA,GAAA,UAAA,OAAU,IAAI,YAAY,KAAK,KAAK,MAClC,QAAO,KAAK,aAAa,IAAI,YAAY,KAAK,CAAC;AAGjD,MAAI,OAAO,gBAAA,YAAY,aAAa;AACpC,SAAO,KAAK,EACV,SAAS,gBAAA,UAAU,gBACpB,CAAC;GAEL;AAED,OAAM,KACJ,sBAAA,sBAAsB,cAAA,GAAA,sBAAA,WACZ,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;AAC1E,OAAA,GAAA,UAAA,OAAU,IAAI,YAAY,KAAK,EAAE;AAC/B,OAAI,OAAO,gBAAA,YAAY,aAAa;AACpC,UAAO,KAAK,EACV,SAAS,gBAAA,UAAU,gBACpB,CAAC;;EAGJ,MAAM,EAAE,UAAU,QAAQ,IAAI;EAC9B,MAAM,EAAE,SAAS,IAAI;AAErB,OAAA,GAAA,UAAA,OAAU,SAAS,KAAK,OAAO;AAC7B,OACE,gBAAA,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,wBACjB,KAAK,MAGN,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,gBAAA,UAAU,eAAe,CAAC;AAGrF,QAAA,GAAA,UAAA,SAAY,SAAS,IAAI,CACvB,QAAO,KAAK,gBAAA,WAAW,cAAc,2BAA2B,CAAC;AAGnE,QAAK,eACH,MACA,SAAS,KACT,SAAS,MACR,KAAK,cAAgC;AACpC,QAAI,QAAQ,KACV,QAAO,KAAK,gBAAA,WAAW,aAAa,IAAI,QAAQ,CAAC;AAGnD,QAAI,UACF,QAAO,KAAK,aAAa,IAAI,YAAY,KAAK,CAAC;AAEjD,WAAO,KAAK,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,sBAAsB,CAAC;KAE5E;kCACc,IAAI,KAAK,MACxB,QAAO,KACL,gBAAA,WAAW,QAAQ,gBAAA,YAAY,qBAAqB,gBAAA,eAAe,aAAa,CACjF;MAED,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,gBAAA,UAAU,cAAc,CAAC;GAGzF"}
+{"version":3,"file":"profile.js","names":[],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isEmpty, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { PROFILE_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (isNil(password) === false) {\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n        }\n\n        if (isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (err !== null) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;AA4BA,SAAA,gBAAyB,OAAe,MAAY,QAAsB;CACxE,SAAS,aAAa,MAAuB;EAC3C,OAAO;GACL,KAAK;GACL;GACA,OAAO;GACP,gBAAgB;GAChB,SAAS;GACT,SAAS;GACT,gBAAgB;GAChB,UAAU;EACZ;CACF;CAEA,MAAM,IACJ,sBAAA,sBAAsB,cAAA,GAAA,sBAAA,WACZ,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,KAAA,GAAA,UAAA,OAAU,IAAI,YAAY,IAAI,MAAM,OAClC,OAAO,KAAK,aAAa,IAAI,YAAY,IAAI,CAAC;EAGhD,IAAI,OAAO,gBAAA,YAAY,YAAY;EACnC,OAAO,KAAK,EACV,SAAS,gBAAA,UAAU,eACrB,CAAC;CACH,CACF;CAEA,MAAM,KACJ,sBAAA,sBAAsB,cAAA,GAAA,sBAAA,WACZ,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,KAAA,GAAA,UAAA,OAAU,IAAI,YAAY,IAAI,GAAG;GAC/B,IAAI,OAAO,gBAAA,YAAY,YAAY;GACnC,OAAO,KAAK,EACV,SAAS,gBAAA,UAAU,eACrB,CAAC;EACH;EAEA,MAAM,EAAE,UAAU,QAAQ,IAAI;EAC9B,MAAM,EAAE,SAAS,IAAI;EAErB,KAAA,GAAA,UAAA,OAAU,QAAQ,MAAM,OAAO;GAC7B,IACE,gBAAA,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,uBAClB,MAAM,OAGN,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,gBAAA,UAAU,cAAc,CAAC;GAGpF,KAAA,GAAA,UAAA,SAAY,SAAS,GAAG,GACtB,OAAO,KAAK,gBAAA,WAAW,cAAc,0BAA0B,CAAC;GAGlE,KAAK,eACH,MACA,SAAS,KACT,SAAS,MACR,KAAK,cAAgC;IACpC,IAAI,QAAQ,MACV,OAAO,KAAK,gBAAA,WAAW,aAAa,IAAI,OAAO,CAAC;IAGlD,IAAI,WACF,OAAO,KAAK,aAAa,IAAI,YAAY,IAAI,CAAC;IAEhD,OAAO,KAAK,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,qBAAqB,CAAC;GAC1E,CACF;EACF,OAAO,KAAA,GAAA,UAAA,OAAU,GAAG,MAAM,OACxB,OAAO,KACL,gBAAA,WAAW,QAAQ,gBAAA,YAAY,qBAAqB,gBAAA,eAAe,YAAY,CACjF;OAEA,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,gBAAA,UAAU,aAAa,CAAC;CAEvF,CACF;AACF"}

package/build/v1/profile.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"profile.mjs","names":[],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isEmpty, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { PROFILE_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (isNil(password) === false) {\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n        }\n\n        if (isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (err !== null) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;AA4BA,SAAA,gBAAyB,OAAe,MAAY,QAAsB;CACxE,SAAS,aAAa,MAAuB;AAC3C,SAAO;GACL,KAAK;GACL;GACA,OAAO;GACP,gBAAgB;GAChB,SAAS;GACT,SAAS;GACT,gBAAgB;GAChB,UAAU;GACX;;AAGH,OAAM,IACJ,sBAAsB,aACtB,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;AAC1E,MAAI,MAAM,IAAI,YAAY,KAAK,KAAK,MAClC,QAAO,KAAK,aAAa,IAAI,YAAY,KAAK,CAAC;AAGjD,MAAI,OAAO,YAAY,aAAa;AACpC,SAAO,KAAK,EACV,SAAS,UAAU,gBACpB,CAAC;GAEL;AAED,OAAM,KACJ,sBAAsB,aACtB,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAA8B;AAC1E,MAAI,MAAM,IAAI,YAAY,KAAK,EAAE;AAC/B,OAAI,OAAO,YAAY,aAAa;AACpC,UAAO,KAAK,EACV,SAAS,UAAU,gBACpB,CAAC;;EAGJ,MAAM,EAAE,UAAU,QAAQ,IAAI;EAC9B,MAAM,EAAE,SAAS,IAAI;AAErB,MAAI,MAAM,SAAS,KAAK,OAAO;AAC7B,OACE,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,wBACjB,KAAK,MAGN,QAAO,KAAK,WAAW,QAAQ,YAAY,cAAc,UAAU,eAAe,CAAC;AAGrF,OAAI,QAAQ,SAAS,IAAI,CACvB,QAAO,KAAK,WAAW,cAAc,2BAA2B,CAAC;AAGnE,QAAK,eACH,MACA,SAAS,KACT,SAAS,MACR,KAAK,cAAgC;AACpC,QAAI,QAAQ,KACV,QAAO,KAAK,WAAW,aAAa,IAAI,QAAQ,CAAC;AAGnD,QAAI,UACF,QAAO,KAAK,aAAa,IAAI,YAAY,KAAK,CAAC;AAEjD,WAAO,KAAK,WAAW,iBAAiB,UAAU,sBAAsB,CAAC;KAE5E;aACQ,MAAM,IAAI,KAAK,MACxB,QAAO,KACL,WAAW,QAAQ,YAAY,qBAAqB,eAAe,aAAa,CACjF;MAED,QAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,UAAU,cAAc,CAAC;GAGzF"}
+{"version":3,"file":"profile.mjs","names":[],"sources":["../../src/v1/profile.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isEmpty, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { PROFILE_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport interface Profile {\n  tfa: boolean;\n  name: string;\n  email: string;\n  email_verified: boolean;\n  created: string;\n  updated: string;\n  cidr_whitelist: string[] | null;\n  fullname: string;\n}\n\nexport default function (route: Router, auth: Auth, config: Config): void {\n  function buildProfile(name: string): Profile {\n    return {\n      tfa: false,\n      name,\n      email: '',\n      email_verified: false,\n      created: '',\n      updated: '',\n      cidr_whitelist: null,\n      fullname: '',\n    };\n  }\n\n  route.get(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name) === false) {\n        return next(buildProfile(req.remote_user.name));\n      }\n\n      res.status(HTTP_STATUS.UNAUTHORIZED);\n      return next({\n        message: API_ERROR.MUST_BE_LOGGED,\n      });\n    }\n  );\n\n  route.post(\n    PROFILE_API_ENDPOINTS.get_profile,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer): void {\n      if (isNil(req.remote_user.name)) {\n        res.status(HTTP_STATUS.UNAUTHORIZED);\n        return next({\n          message: API_ERROR.MUST_BE_LOGGED,\n        });\n      }\n\n      const { password, tfa } = req.body;\n      const { name } = req.remote_user;\n\n      if (isNil(password) === false) {\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          /* eslint new-cap:off */\n          return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, API_ERROR.PASSWORD_SHORT));\n        }\n\n        if (isEmpty(password.old)) {\n          return next(errorUtils.getBadRequest('old password is required'));\n        }\n\n        auth.changePassword(\n          name,\n          password.old,\n          password.new,\n          (err, isUpdated): $NextFunctionVer => {\n            if (err !== null) {\n              return next(errorUtils.getForbidden(err.message));\n            }\n\n            if (isUpdated) {\n              return next(buildProfile(req.remote_user.name));\n            }\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        );\n      } else if (isNil(tfa) === false) {\n        return next(\n          errorUtils.getCode(HTTP_STATUS.SERVICE_UNAVAILABLE, SUPPORT_ERRORS.TFA_DISABLED)\n        );\n      } else {\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, APP_ERROR.PROFILE_ERROR));\n      }\n    }\n  );\n}\n"],"mappings":";;;;AA4BA,SAAA,gBAAyB,OAAe,MAAY,QAAsB;CACxE,SAAS,aAAa,MAAuB;EAC3C,OAAO;GACL,KAAK;GACL;GACA,OAAO;GACP,gBAAgB;GAChB,SAAS;GACT,SAAS;GACT,gBAAgB;GAChB,UAAU;EACZ;CACF;CAEA,MAAM,IACJ,sBAAsB,aACtB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,IAAI,MAAM,IAAI,YAAY,IAAI,MAAM,OAClC,OAAO,KAAK,aAAa,IAAI,YAAY,IAAI,CAAC;EAGhD,IAAI,OAAO,YAAY,YAAY;EACnC,OAAO,KAAK,EACV,SAAS,UAAU,eACrB,CAAC;CACH,CACF;CAEA,MAAM,KACJ,sBAAsB,aACtB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAA8B;EAC1E,IAAI,MAAM,IAAI,YAAY,IAAI,GAAG;GAC/B,IAAI,OAAO,YAAY,YAAY;GACnC,OAAO,KAAK,EACV,SAAS,UAAU,eACrB,CAAC;EACH;EAEA,MAAM,EAAE,UAAU,QAAQ,IAAI;EAC9B,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,QAAQ,MAAM,OAAO;GAC7B,IACE,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,uBAClB,MAAM,OAGN,OAAO,KAAK,WAAW,QAAQ,YAAY,cAAc,UAAU,cAAc,CAAC;GAGpF,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,cAAc,0BAA0B,CAAC;GAGlE,KAAK,eACH,MACA,SAAS,KACT,SAAS,MACR,KAAK,cAAgC;IACpC,IAAI,QAAQ,MACV,OAAO,KAAK,WAAW,aAAa,IAAI,OAAO,CAAC;IAGlD,IAAI,WACF,OAAO,KAAK,aAAa,IAAI,YAAY,IAAI,CAAC;IAEhD,OAAO,KAAK,WAAW,iBAAiB,UAAU,qBAAqB,CAAC;GAC1E,CACF;EACF,OAAO,IAAI,MAAM,GAAG,MAAM,OACxB,OAAO,KACL,WAAW,QAAQ,YAAY,qBAAqB,eAAe,YAAY,CACjF;OAEA,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,UAAU,aAAa,CAAC;CAEvF,CACF;AACF"}

package/build/v1/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n    const onClientClose = (): void => {\n      debug('search web aborted');\n      abort.abort();\n    };\n    req.socket.on('close', onClientClose);\n\n    try {\n      size = parseInt(Number.isFinite(size) ? size : '20', 10);\n      from = parseInt(Number.isFinite(from) ? from : '0', 10);\n\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => i !== null)\n        .slice(from, from + size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(error);\n      return;\n    } finally {\n      req.socket.off('close', onClientClose);\n    }\n  });\n}\n"],"mappings":";;;;;;AASA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;;;;;;;AAQhD,SAAA,eAAyB,OAAO,MAAY,SAAkB,QAAsB;CAClF,SAAS,YAAY,KAAU,MAAW,YAAsC;AAC9E,SAAO,IAAI,SAAS,SAAS,WAAW;AACtC,QAAK,aAAa,EAAE,aAAa,KAAK,SAAS,MAAM,EAAE,YAAY,SAAU,KAAK,SAAS;AACzF,QAAI,IACF,KAAI,IAAI,UAAU,OAAO,IAAI,OAAO,CAAC,MAAM,UAAU,CAGnD,QAAO,QAAQ,KAAK;QAEpB,QAAO,IAAI;QAGb,QAAO,QAAQ,UAAU,MAAM,KAAK;KAEtC;IACF;;AAGJ,OAAM,IAAI,sBAAA,qBAAqB,QAAQ,OAAO,KAAK,KAAK,SAAS;EAC/D,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,GAAG;EACxD,IAAI;EACJ,MAAM,QAAQ,IAAI,iBAAiB;EACnC,MAAM,sBAA4B;AAChC,WAAM,qBAAqB;AAC3B,SAAM,OAAO;;AAEf,MAAI,OAAO,GAAG,SAAS,cAAc;AAErC,MAAI;AACF,UAAO,SAAS,OAAO,SAAS,KAAK,GAAG,OAAO,MAAM,GAAG;AACxD,UAAO,SAAS,OAAO,SAAS,KAAK,GAAG,OAAO,KAAK,GAAG;AAEvD,WAAM,2BAA2B;AACjC,UAAO,MAAM,QAAQ,OAAO;IAC1B;IACA;IACA;IACD,CAAC;AACF,WAAM,0BAA0B,KAAK,OAAO;GAO5C,MAAM,SANmD,MAAM,QAAQ,IACrE,KAAK,KAAK,YAAY;AACpB,WAAO,YAAY,SAAS,MAAM,IAAI,YAAY;KAClD,CACH,EAGE,QAAQ,MAAM,MAAM,KAAK,CACzB,MAAM,MAAM,OAAO,KAAK;AAC3B,UAAO,MAAM,kBAAkB,OAAO,SAAS;GAE/C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,MAAM,EAAC,aAAa;IAC/B;AAED,OAAI,OAAO,gBAAA,YAAY,GAAG,CAAC,KAAK,SAAS;WAClC,OAAO;AACd,UAAO,MAAM,EAAE,OAAO,EAAE,8CAA8C;AACtE,QAAK,MAAM;AACX;YACQ;AACR,OAAI,OAAO,IAAI,SAAS,cAAc;;GAExC"}
+{"version":3,"file":"search.js","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n    const onClientClose = (): void => {\n      debug('search web aborted');\n      abort.abort();\n    };\n    req.socket.on('close', onClientClose);\n\n    try {\n      size = parseInt(Number.isFinite(size) ? size : '20', 10);\n      from = parseInt(Number.isFinite(from) ? from : '0', 10);\n\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => i !== null)\n        .slice(from, from + size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(error);\n      return;\n    } finally {\n      req.socket.off('close', onClientClose);\n    }\n  });\n}\n"],"mappings":";;;;;;AASA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;;;;;;;AAQ/C,SAAA,eAAyB,OAAO,MAAY,SAAkB,QAAsB;CAClF,SAAS,YAAY,KAAU,MAAW,YAAsC;EAC9E,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KACF,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,EAAE,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;SAEnB,OAAO,GAAG;SAGZ,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IAAI,sBAAA,qBAAqB,QAAQ,OAAO,KAAK,KAAK,SAAS;EAC/D,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,MAAM,EAAE,KAAK,MAAM,MAAM,EAAE;EACvD,IAAI;EACJ,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,QAAM,oBAAoB;GAC1B,MAAM,MAAM;EACd;EACA,IAAI,OAAO,GAAG,SAAS,aAAa;EAEpC,IAAI;GACF,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,MAAM,EAAE;GACvD,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,KAAK,EAAE;GAEtD,QAAM,0BAA0B;GAChC,OAAO,MAAM,QAAQ,OAAO;IAC1B;IACA;IACA;GACF,CAAC;GACD,QAAM,0BAA0B,KAAK,MAAM;GAO3C,MAAM,SAAqC,MANoB,QAAQ,IACrE,KAAK,KAAK,YAAY;IACpB,OAAO,YAAY,SAAS,MAAM,IAAI,WAAW;GACnD,CAAC,CACH,GAGG,QAAQ,MAAM,MAAM,IAAI,EACxB,MAAM,MAAM,OAAO,IAAI;GAC1B,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,GAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,gBAAA,YAAY,EAAE,EAAE,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,IAAI,OAAO,IAAI,SAAS,aAAa;EACvC;CACF,CAAC;AACH"}

package/build/v1/search.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"search.mjs","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n    const onClientClose = (): void => {\n      debug('search web aborted');\n      abort.abort();\n    };\n    req.socket.on('close', onClientClose);\n\n    try {\n      size = parseInt(Number.isFinite(size) ? size : '20', 10);\n      from = parseInt(Number.isFinite(from) ? from : '0', 10);\n\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => i !== null)\n        .slice(from, from + size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(error);\n      return;\n    } finally {\n      req.socket.off('close', onClientClose);\n    }\n  });\n}\n"],"mappings":";;;;AASA,IAAM,QAAQ,WAAW,uBAAuB;;;;;;;AAQhD,SAAA,eAAyB,OAAO,MAAY,SAAkB,QAAsB;CAClF,SAAS,YAAY,KAAU,MAAW,YAAsC;AAC9E,SAAO,IAAI,SAAS,SAAS,WAAW;AACtC,QAAK,aAAa,EAAE,aAAa,KAAK,SAAS,MAAM,EAAE,YAAY,SAAU,KAAK,SAAS;AACzF,QAAI,IACF,KAAI,IAAI,UAAU,OAAO,IAAI,OAAO,CAAC,MAAM,UAAU,CAGnD,QAAO,QAAQ,KAAK;QAEpB,QAAO,IAAI;QAGb,QAAO,QAAQ,UAAU,MAAM,KAAK;KAEtC;IACF;;AAGJ,OAAM,IAAI,qBAAqB,QAAQ,OAAO,KAAK,KAAK,SAAS;EAC/D,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,OAAO,CAAC,KAAK,MAAM,MAAM,GAAG;EACxD,IAAI;EACJ,MAAM,QAAQ,IAAI,iBAAiB;EACnC,MAAM,sBAA4B;AAChC,SAAM,qBAAqB;AAC3B,SAAM,OAAO;;AAEf,MAAI,OAAO,GAAG,SAAS,cAAc;AAErC,MAAI;AACF,UAAO,SAAS,OAAO,SAAS,KAAK,GAAG,OAAO,MAAM,GAAG;AACxD,UAAO,SAAS,OAAO,SAAS,KAAK,GAAG,OAAO,KAAK,GAAG;AAEvD,SAAM,2BAA2B;AACjC,UAAO,MAAM,QAAQ,OAAO;IAC1B;IACA;IACA;IACD,CAAC;AACF,SAAM,0BAA0B,KAAK,OAAO;GAO5C,MAAM,SANmD,MAAM,QAAQ,IACrE,KAAK,KAAK,YAAY;AACpB,WAAO,YAAY,SAAS,MAAM,IAAI,YAAY;KAClD,CACH,EAGE,QAAQ,MAAM,MAAM,KAAK,CACzB,MAAM,MAAM,OAAO,KAAK;AAC3B,UAAO,MAAM,kBAAkB,OAAO,SAAS;GAE/C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,MAAM,EAAC,aAAa;IAC/B;AAED,OAAI,OAAO,YAAY,GAAG,CAAC,KAAK,SAAS;WAClC,OAAO;AACd,UAAO,MAAM,EAAE,OAAO,EAAE,8CAA8C;AACtE,QAAK,MAAM;AACX;YACQ;AACR,OAAI,OAAO,IAAI,SAAS,cAAc;;GAExC"}
+{"version":3,"file":"search.mjs","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n    const onClientClose = (): void => {\n      debug('search web aborted');\n      abort.abort();\n    };\n    req.socket.on('close', onClientClose);\n\n    try {\n      size = parseInt(Number.isFinite(size) ? size : '20', 10);\n      from = parseInt(Number.isFinite(from) ? from : '0', 10);\n\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => i !== null)\n        .slice(from, from + size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(error);\n      return;\n    } finally {\n      req.socket.off('close', onClientClose);\n    }\n  });\n}\n"],"mappings":";;;;AASA,IAAM,QAAQ,WAAW,sBAAsB;;;;;;;AAQ/C,SAAA,eAAyB,OAAO,MAAY,SAAkB,QAAsB;CAClF,SAAS,YAAY,KAAU,MAAW,YAAsC;EAC9E,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KACF,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,EAAE,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;SAEnB,OAAO,GAAG;SAGZ,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IAAI,qBAAqB,QAAQ,OAAO,KAAK,KAAK,SAAS;EAC/D,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,MAAM,EAAE,KAAK,MAAM,MAAM,EAAE;EACvD,IAAI;EACJ,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,MAAM,oBAAoB;GAC1B,MAAM,MAAM;EACd;EACA,IAAI,OAAO,GAAG,SAAS,aAAa;EAEpC,IAAI;GACF,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,MAAM,EAAE;GACvD,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,KAAK,EAAE;GAEtD,MAAM,0BAA0B;GAChC,OAAO,MAAM,QAAQ,OAAO;IAC1B;IACA;IACA;GACF,CAAC;GACD,MAAM,0BAA0B,KAAK,MAAM;GAO3C,MAAM,SAAqC,MANoB,QAAQ,IACrE,KAAK,KAAK,YAAY;IACpB,OAAO,YAAY,SAAS,MAAM,IAAI,WAAW;GACnD,CAAC,CACH,GAGG,QAAQ,MAAM,MAAM,IAAI,EACxB,MAAM,MAAM,OAAO,IAAI;GAC1B,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,GAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,YAAY,EAAE,EAAE,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,IAAI,OAAO,IAAI,SAAS,aAAa;EACvC;CACF,CAAC;AACH"}

package/build/v1/token.js

@@ -1,4 +1,3 @@
-require("../_virtual/_rolldown/runtime.js");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 let _verdaccio_core = require("@verdaccio/core");
 let lodash_es = require("lodash-es");
@@ -41,9 +40,9 @@ function token_default(route, auth, storage, config, logger) {
 			req.remote_user = user;
 			if (typeof storage.saveToken !== "function") return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.NOT_IMPLEMENTED, _verdaccio_core.SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT));
 			try {
-				const token = await (0, _verdaccio_auth.getApiToken)(auth, config, user, password);
+				const key = _verdaccio_core.cryptoUtils.generateRandomHexString(16);
+				const token = await (0, _verdaccio_auth.getApiToken)(auth, config, user, password, { tokenKey: key });
 				if (!token) throw _verdaccio_core.errorUtils.getInternalError();
-				const key = _verdaccio_core.cryptoUtils.stringToMD5(token);
 				/**
 				* cidr_whitelist: is not being used, we pass it through
 				* token: we do not store the real token (it is generated once and retrieved

package/build/v1/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":[],"sources":["../../src/v1/token.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isBoolean, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, cryptoUtils, errorUtils } from '@verdaccio/core';\nimport { TOKEN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, RemoteUser, Token } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  cidr_whitelist: string[];\n  created: string;\n};\n\n// npm expects \"cidr_whitelist\" for token list\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    cidr_whitelist: token.cidr || [],\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!isBoolean(readonly) || !Array.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (typeof storage.saveToken !== 'function') {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const token = await getApiToken(auth, config, user as RemoteUser, password);\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          const key = cryptoUtils.stringToMD5(token);\n          // TODO: use a utility here\n          const maskedToken = cryptoUtils.mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;;AAkBA,SAAS,eAAe,OAA8B;AACpD,QAAO;EACL,GAAG;EACH,gBAAgB,MAAM,QAAQ,EAAE;EAChC,SAAS,IAAI,KAAK,MAAM,QAAQ,CAAC,aAAa;EAC/C;;AAIH,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;AACN,OAAM,IACJ,sBAAA,oBAAoB,aAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAwB;EAC1E,MAAM,EAAE,SAAS,IAAI;AAErB,OAAA,GAAA,UAAA,OAAU,KAAK,KAAK,MAClB,KAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,MAAM,CAAC;GACvD,MAAM,cAAc,OAAO;AAC3B,UAAO,MAAM,EAAE,aAAa,EAAE,uCAAuC;AAErE,OAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,UAAO,KAAK;IACV,SAAS,OAAO,IAAI,eAAe;IACnC,MAAM,EACJ,MAAM,IACP;IACF,CAAC;WACK,OAAY;AACnB,UAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,kCAAkC;AACrE,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;AAG9E,SAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;GAE5C;AAED,OAAM,KACJ,sBAAA,oBAAoB,aAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAAwB;EACpE,MAAM,EAAE,UAAU,UAAU,mBAAmB,IAAI;EACnD,MAAM,EAAE,SAAS,IAAI;AAErB,MAAI,EAAA,GAAA,UAAA,WAAW,SAAS,IAAI,CAAC,MAAM,QAAQ,eAAe,CACxD,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,UAAU,gBAAA,eAAe,qBAAqB,CAAC;AAG5F,OAAK,aAAa,MAAM,UAAU,OAAO,KAAK,SAAsB;AAClE,OAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,gBAAA,YAAY,eAAe,gBAAA,YAAY;AACvE,WAAO,KAAK,gBAAA,WAAW,QAAQ,WAAW,IAAI,QAAQ,CAAC;;AAGzD,OAAI,cAAc;AAElB,OAAI,OAAO,QAAQ,cAAc,WAC/B,QAAO,KACL,gBAAA,WAAW,QAAQ,gBAAA,YAAY,iBAAiB,gBAAA,eAAe,sBAAsB,CACtF;AAGH,OAAI;IACF,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,MAAoB,SAAS;AAC3E,QAAI,CAAC,MACH,OAAM,gBAAA,WAAW,kBAAkB;IAGrC,MAAM,MAAM,gBAAA,YAAY,YAAY,MAAM;;;;;;IAU1C,MAAM,YAAmB;KACvB,MAAM;KACN,OAVkB,gBAAA,YAAY,KAAK,OAAO,EAAE;KAW5C;KACA,MAAM;KACN;KACA,0BAbc,IAAI,MAAM,EAAC,SAAS;KAcnC;AAED,UAAM,QAAQ,UAAU,UAAU;AAClC,WAAO,MAAM;KAAE;KAAK;KAAM,EAAE,4CAA4C;AACxE,QAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,SAAS;AAChD,WAAO,KACL,eAAe;KACb;KACA,MAAM;KACN,KAAK,UAAU;KACf,MAAM;KACN;KACA,SAAS,UAAU;KACpB,CAAC,CACH;YACM,OAAY;AACnB,WAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,sCAAsC;AACzE,WAAO,KAAK,gBAAA,WAAW,iBAAiB,MAAM,QAAQ,CAAC;;IAEzD;GAEL;AAED,OAAM,OACJ,sBAAA,oBAAoB,eAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,OAAO,KAAqB,KAAe,SAA2B;EACpE,MAAM,EACJ,QAAQ,EAAE,eACR;EACJ,MAAM,EAAE,SAAS,IAAI;AAErB,OAAA,GAAA,UAAA,OAAU,KAAK,KAAK,OAAO;AACzB,UAAO,MAAM,EAAE,MAAM,EAAE,uCAAuC;AAC9D,OAAI;AACF,UAAM,QAAQ,YAAY,MAAM,SAAS;AACzC,WAAO,KAAK;KAAE;KAAU;KAAM,EAAE,oDAAoD;AACpF,WAAO,KAAK,EAAE,CAAC;YACR,OAAY;AACnB,WAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,sCAAsC;AACzE,WAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;;AAG9E,SAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;GAE5C"}
+{"version":3,"file":"token.js","names":[],"sources":["../../src/v1/token.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isBoolean, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, cryptoUtils, errorUtils } from '@verdaccio/core';\nimport { TOKEN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, RemoteUser, Token } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  cidr_whitelist: string[];\n  created: string;\n};\n\n// npm expects \"cidr_whitelist\" for token list\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    cidr_whitelist: token.cidr || [],\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!isBoolean(readonly) || !Array.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (typeof storage.saveToken !== 'function') {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const key = cryptoUtils.generateRandomHexString(16);\n          const token = await getApiToken(auth, config, user as RemoteUser, password, {\n            tokenKey: key,\n          });\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          // TODO: use a utility here\n          const maskedToken = cryptoUtils.mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;AAkBA,SAAS,eAAe,OAA8B;CACpD,OAAO;EACL,GAAG;EACH,gBAAgB,MAAM,QAAQ,CAAC;EAC/B,SAAS,IAAI,KAAK,MAAM,OAAO,EAAE,YAAY;CAC/C;AACF;AAGA,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;CACN,MAAM,IACJ,sBAAA,oBAAoB,aAAA,GAAA,sBAAA,WACV,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAwB;EAC1E,MAAM,EAAE,SAAS,IAAI;EAErB,KAAA,GAAA,UAAA,OAAU,IAAI,MAAM,OAClB,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,KAAK,CAAC;GACtD,MAAM,cAAc,OAAO;GAC3B,OAAO,MAAM,EAAE,YAAY,GAAG,sCAAsC;GAEpE,IAAI,OAAO,gBAAA,YAAY,EAAE;GACzB,OAAO,KAAK;IACV,SAAS,OAAO,IAAI,cAAc;IAClC,MAAM,EACJ,MAAM,GACR;GACF,CAAC;EACH,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,iCAAiC;GACpE,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,OAAO,CAAC;EAC3E;EAEF,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;CAC1C,CACF;CAEA,MAAM,KACJ,sBAAA,oBAAoB,aAAA,GAAA,sBAAA,WACV,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAAwB;EACpE,MAAM,EAAE,UAAU,UAAU,mBAAmB,IAAI;EACnD,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,EAAA,GAAA,UAAA,WAAW,QAAQ,KAAK,CAAC,MAAM,QAAQ,cAAc,GACvD,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,UAAU,gBAAA,eAAe,oBAAoB,CAAC;EAG3F,KAAK,aAAa,MAAM,UAAU,OAAO,KAAK,SAAsB;GAClE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,gBAAA,YAAY,eAAe,gBAAA,YAAY;IACvE,OAAO,KAAK,gBAAA,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD;GAEA,IAAI,cAAc;GAElB,IAAI,OAAO,QAAQ,cAAc,YAC/B,OAAO,KACL,gBAAA,WAAW,QAAQ,gBAAA,YAAY,iBAAiB,gBAAA,eAAe,qBAAqB,CACtF;GAGF,IAAI;IACF,MAAM,MAAM,gBAAA,YAAY,wBAAwB,EAAE;IAClD,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,MAAoB,UAAU,EAC1E,UAAU,IACZ,CAAC;IACD,IAAI,CAAC,OACH,MAAM,gBAAA,WAAW,iBAAiB;;;;;;IAYpC,MAAM,YAAmB;KACvB,MAAM;KACN,OAVkB,gBAAA,YAAY,KAAK,OAAO,CAUnC;KACP;KACA,MAAM;KACN;KACA,0BAbc,IAAI,KAAK,GAAE,QAazB;IACF;IAEA,MAAM,QAAQ,UAAU,SAAS;IACjC,OAAO,MAAM;KAAE;KAAK;IAAK,GAAG,2CAA2C;IACvE,IAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;IAC/C,OAAO,KACL,eAAe;KACb;KACA,MAAM;KACN,KAAK,UAAU;KACf,MAAM;KACN;KACA,SAAS,UAAU;IACrB,CAAC,CACH;GACF,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,gBAAA,WAAW,iBAAiB,MAAM,OAAO,CAAC;GACxD;EACF,CAAC;CACH,CACF;CAEA,MAAM,OACJ,sBAAA,oBAAoB,eAAA,GAAA,sBAAA,WACV,QAAQ,aAAa,GAC/B,OAAO,KAAqB,KAAe,SAA2B;EACpE,MAAM,EACJ,QAAQ,EAAE,eACR;EACJ,MAAM,EAAE,SAAS,IAAI;EAErB,KAAA,GAAA,UAAA,OAAU,IAAI,MAAM,OAAO;GACzB,OAAO,MAAM,EAAE,KAAK,GAAG,sCAAsC;GAC7D,IAAI;IACF,MAAM,QAAQ,YAAY,MAAM,QAAQ;IACxC,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,mDAAmD;IACnF,OAAO,KAAK,CAAC,CAAC;GAChB,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,OAAO,CAAC;GAC3E;EACF;EACA,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;CAC1C,CACF;AACF"}

package/build/v1/token.mjs

@@ -40,9 +40,9 @@ function token_default(route, auth, storage, config, logger) {
 			req.remote_user = user;
 			if (typeof storage.saveToken !== "function") return next(errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT));
 			try {
-				const token = await getApiToken(auth, config, user, password);
+				const key = cryptoUtils.generateRandomHexString(16);
+				const token = await getApiToken(auth, config, user, password, { tokenKey: key });
 				if (!token) throw errorUtils.getInternalError();
-				const key = cryptoUtils.stringToMD5(token);
 				/**
 				* cidr_whitelist: is not being used, we pass it through
 				* token: we do not store the real token (it is generated once and retrieved

package/build/v1/token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"token.mjs","names":[],"sources":["../../src/v1/token.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isBoolean, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, cryptoUtils, errorUtils } from '@verdaccio/core';\nimport { TOKEN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, RemoteUser, Token } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  cidr_whitelist: string[];\n  created: string;\n};\n\n// npm expects \"cidr_whitelist\" for token list\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    cidr_whitelist: token.cidr || [],\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!isBoolean(readonly) || !Array.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (typeof storage.saveToken !== 'function') {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const token = await getApiToken(auth, config, user as RemoteUser, password);\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          const key = cryptoUtils.stringToMD5(token);\n          // TODO: use a utility here\n          const maskedToken = cryptoUtils.mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;AAkBA,SAAS,eAAe,OAA8B;AACpD,QAAO;EACL,GAAG;EACH,gBAAgB,MAAM,QAAQ,EAAE;EAChC,SAAS,IAAI,KAAK,MAAM,QAAQ,CAAC,aAAa;EAC/C;;AAIH,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;AACN,OAAM,IACJ,oBAAoB,YACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAwB;EAC1E,MAAM,EAAE,SAAS,IAAI;AAErB,MAAI,MAAM,KAAK,KAAK,MAClB,KAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,MAAM,CAAC;GACvD,MAAM,cAAc,OAAO;AAC3B,UAAO,MAAM,EAAE,aAAa,EAAE,uCAAuC;AAErE,OAAI,OAAO,YAAY,GAAG;AAC1B,UAAO,KAAK;IACV,SAAS,OAAO,IAAI,eAAe;IACnC,MAAM,EACJ,MAAM,IACP;IACF,CAAC;WACK,OAAY;AACnB,UAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,kCAAkC;AACrE,UAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;AAG9E,SAAO,KAAK,WAAW,iBAAiB,CAAC;GAE5C;AAED,OAAM,KACJ,oBAAoB,YACpB,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAqB,KAAe,MAAwB;EACpE,MAAM,EAAE,UAAU,UAAU,mBAAmB,IAAI;EACnD,MAAM,EAAE,SAAS,IAAI;AAErB,MAAI,CAAC,UAAU,SAAS,IAAI,CAAC,MAAM,QAAQ,eAAe,CACxD,QAAO,KAAK,WAAW,QAAQ,YAAY,UAAU,eAAe,qBAAqB,CAAC;AAG5F,OAAK,aAAa,MAAM,UAAU,OAAO,KAAK,SAAsB;AAClE,OAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;AACvE,WAAO,KAAK,WAAW,QAAQ,WAAW,IAAI,QAAQ,CAAC;;AAGzD,OAAI,cAAc;AAElB,OAAI,OAAO,QAAQ,cAAc,WAC/B,QAAO,KACL,WAAW,QAAQ,YAAY,iBAAiB,eAAe,sBAAsB,CACtF;AAGH,OAAI;IACF,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,MAAoB,SAAS;AAC3E,QAAI,CAAC,MACH,OAAM,WAAW,kBAAkB;IAGrC,MAAM,MAAM,YAAY,YAAY,MAAM;;;;;;IAU1C,MAAM,YAAmB;KACvB,MAAM;KACN,OAVkB,YAAY,KAAK,OAAO,EAAE;KAW5C;KACA,MAAM;KACN;KACA,0BAbc,IAAI,MAAM,EAAC,SAAS;KAcnC;AAED,UAAM,QAAQ,UAAU,UAAU;AAClC,WAAO,MAAM;KAAE;KAAK;KAAM,EAAE,4CAA4C;AACxE,QAAI,IAAI,QAAQ,eAAe,QAAQ,SAAS;AAChD,WAAO,KACL,eAAe;KACb;KACA,MAAM;KACN,KAAK,UAAU;KACf,MAAM;KACN;KACA,SAAS,UAAU;KACpB,CAAC,CACH;YACM,OAAY;AACnB,WAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,sCAAsC;AACzE,WAAO,KAAK,WAAW,iBAAiB,MAAM,QAAQ,CAAC;;IAEzD;GAEL;AAED,OAAM,OACJ,oBAAoB,cACpB,UAAU,QAAQ,cAAc,EAChC,OAAO,KAAqB,KAAe,SAA2B;EACpE,MAAM,EACJ,QAAQ,EAAE,eACR;EACJ,MAAM,EAAE,SAAS,IAAI;AAErB,MAAI,MAAM,KAAK,KAAK,OAAO;AACzB,UAAO,MAAM,EAAE,MAAM,EAAE,uCAAuC;AAC9D,OAAI;AACF,UAAM,QAAQ,YAAY,MAAM,SAAS;AACzC,WAAO,KAAK;KAAE;KAAU;KAAM,EAAE,oDAAoD;AACpF,WAAO,KAAK,EAAE,CAAC;YACR,OAAY;AACnB,WAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,sCAAsC;AACzE,WAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;;AAG9E,SAAO,KAAK,WAAW,iBAAiB,CAAC;GAE5C"}
+{"version":3,"file":"token.mjs","names":[],"sources":["../../src/v1/token.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isBoolean, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, cryptoUtils, errorUtils } from '@verdaccio/core';\nimport { TOKEN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, RemoteUser, Token } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nexport type NormalizeToken = Token & {\n  cidr_whitelist: string[];\n  created: string;\n};\n\n// npm expects \"cidr_whitelist\" for token list\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    cidr_whitelist: token.cidr || [],\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password, readonly, cidr_whitelist } = req.body;\n      const { name } = req.remote_user;\n\n      if (!isBoolean(readonly) || !Array.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (typeof storage.saveToken !== 'function') {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const key = cryptoUtils.generateRandomHexString(16);\n          const token = await getApiToken(auth, config, user as RemoteUser, password, {\n            tokenKey: key,\n          });\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          // TODO: use a utility here\n          const maskedToken = cryptoUtils.mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;AAkBA,SAAS,eAAe,OAA8B;CACpD,OAAO;EACL,GAAG;EACH,gBAAgB,MAAM,QAAQ,CAAC;EAC/B,SAAS,IAAI,KAAK,MAAM,OAAO,EAAE,YAAY;CAC/C;AACF;AAGA,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;CACN,MAAM,IACJ,oBAAoB,YACpB,UAAU,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAwB;EAC1E,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,IAAI,MAAM,OAClB,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,KAAK,CAAC;GACtD,MAAM,cAAc,OAAO;GAC3B,OAAO,MAAM,EAAE,YAAY,GAAG,sCAAsC;GAEpE,IAAI,OAAO,YAAY,EAAE;GACzB,OAAO,KAAK;IACV,SAAS,OAAO,IAAI,cAAc;IAClC,MAAM,EACJ,MAAM,GACR;GACF,CAAC;EACH,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,iCAAiC;GACpE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;EAC3E;EAEF,OAAO,KAAK,WAAW,gBAAgB,CAAC;CAC1C,CACF;CAEA,MAAM,KACJ,oBAAoB,YACpB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAAwB;EACpE,MAAM,EAAE,UAAU,UAAU,mBAAmB,IAAI;EACnD,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,QAAQ,cAAc,GACvD,OAAO,KAAK,WAAW,QAAQ,YAAY,UAAU,eAAe,oBAAoB,CAAC;EAG3F,KAAK,aAAa,MAAM,UAAU,OAAO,KAAK,SAAsB;GAClE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;IACvE,OAAO,KAAK,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD;GAEA,IAAI,cAAc;GAElB,IAAI,OAAO,QAAQ,cAAc,YAC/B,OAAO,KACL,WAAW,QAAQ,YAAY,iBAAiB,eAAe,qBAAqB,CACtF;GAGF,IAAI;IACF,MAAM,MAAM,YAAY,wBAAwB,EAAE;IAClD,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,MAAoB,UAAU,EAC1E,UAAU,IACZ,CAAC;IACD,IAAI,CAAC,OACH,MAAM,WAAW,iBAAiB;;;;;;IAYpC,MAAM,YAAmB;KACvB,MAAM;KACN,OAVkB,YAAY,KAAK,OAAO,CAUnC;KACP;KACA,MAAM;KACN;KACA,0BAbc,IAAI,KAAK,GAAE,QAazB;IACF;IAEA,MAAM,QAAQ,UAAU,SAAS;IACjC,OAAO,MAAM;KAAE;KAAK;IAAK,GAAG,2CAA2C;IACvE,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAC/C,OAAO,KACL,eAAe;KACb;KACA,MAAM;KACN,KAAK,UAAU;KACf,MAAM;KACN;KACA,SAAS,UAAU;IACrB,CAAC,CACH;GACF,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,WAAW,iBAAiB,MAAM,OAAO,CAAC;GACxD;EACF,CAAC;CACH,CACF;CAEA,MAAM,OACJ,oBAAoB,cACpB,UAAU,QAAQ,aAAa,GAC/B,OAAO,KAAqB,KAAe,SAA2B;EACpE,MAAM,EACJ,QAAQ,EAAE,eACR;EACJ,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,IAAI,MAAM,OAAO;GACzB,OAAO,MAAM,EAAE,KAAK,GAAG,sCAAsC;GAC7D,IAAI;IACF,MAAM,QAAQ,YAAY,MAAM,QAAQ;IACxC,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,mDAAmD;IACnF,OAAO,KAAK,CAAC,CAAC;GAChB,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;GAC3E;EACF;EACA,OAAO,KAAK,WAAW,gBAAgB,CAAC;CAC1C,CACF;AACF"}

package/build/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","names":[],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;;;AAQA,IAAM,WAAA,GAAA,MAAA,SAAmB,qBAAqB;AAE9C,SAAA,eAAyB,OAAqB;AAC5C,OAAM,IACJ,sBAAA,mBAAmB,SAClB,KAAqB,MAAgB,SAAgC;EAEpE,MAAM,WAAW,KAAK,aAAa;AACnC,MAAI,CAAC,UAAU;AACb,WAAM,yBAAyB;AAC/B,UAAO,KAAK,gBAAA,WAAW,gBAAgB,eAAe,CAAC;;AAGzD,UAAM,uBAAuB,SAAS;AACtC,SAAO,KAAK,EAAY,UAAU,CAAC;GAEtC"}
+{"version":3,"file":"whoami.js","names":[],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;;;AAQA,IAAM,WAAA,GAAA,MAAA,SAAmB,oBAAoB;AAE7C,SAAA,eAAyB,OAAqB;CAC5C,MAAM,IACJ,sBAAA,mBAAmB,SAClB,KAAqB,MAAgB,SAAgC;EAEpE,MAAM,WAAW,KAAK,aAAa;EACnC,IAAI,CAAC,UAAU;GACb,QAAM,wBAAwB;GAC9B,OAAO,KAAK,gBAAA,WAAW,gBAAgB,cAAc,CAAC;EACxD;EAEA,QAAM,uBAAuB,QAAQ;EACrC,OAAO,KAAK,EAAY,SAAS,CAAC;CACpC,CACF;AACF"}

package/build/whoami.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.mjs","names":[],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;AAQA,IAAM,QAAQ,WAAW,qBAAqB;AAE9C,SAAA,eAAyB,OAAqB;AAC5C,OAAM,IACJ,mBAAmB,SAClB,KAAqB,MAAgB,SAAgC;EAEpE,MAAM,WAAW,KAAK,aAAa;AACnC,MAAI,CAAC,UAAU;AACb,SAAM,yBAAyB;AAC/B,UAAO,KAAK,WAAW,gBAAgB,eAAe,CAAC;;AAGzD,QAAM,uBAAuB,SAAS;AACtC,SAAO,KAAK,EAAY,UAAU,CAAC;GAEtC"}
+{"version":3,"file":"whoami.mjs","names":[],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;AAQA,IAAM,QAAQ,WAAW,oBAAoB;AAE7C,SAAA,eAAyB,OAAqB;CAC5C,MAAM,IACJ,mBAAmB,SAClB,KAAqB,MAAgB,SAAgC;EAEpE,MAAM,WAAW,KAAK,aAAa;EACnC,IAAI,CAAC,UAAU;GACb,MAAM,wBAAwB;GAC9B,OAAO,KAAK,WAAW,gBAAgB,cAAc,CAAC;EACxD;EAEA,MAAM,uBAAuB,QAAQ;EACrC,OAAO,KAAK,EAAY,SAAS,CAAC;CACpC,CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "9.0.0-next-9.17",
+  "version": "9.0.0-next-9.18",
   "description": "Verdaccio Registry API",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,24 +33,24 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "9.0.0-next-9.17",
-    "@verdaccio/config": "9.0.0-next-9.17",
-    "@verdaccio/core": "9.0.0-next-9.17",
-    "@verdaccio/logger": "9.0.0-next-9.17",
-    "@verdaccio/middleware": "9.0.0-next-9.17",
-    "@verdaccio/store": "9.0.0-next-9.17",
+    "@verdaccio/auth": "9.0.0-next-9.18",
+    "@verdaccio/config": "9.0.0-next-9.18",
+    "@verdaccio/core": "9.0.0-next-9.18",
+    "@verdaccio/logger": "9.0.0-next-9.18",
+    "@verdaccio/middleware": "9.0.0-next-9.18",
+    "@verdaccio/store": "9.0.0-next-9.18",
     "debug": "4.4.3",
     "express": "5.2.1",
     "lodash-es": "4.18.1"
   },
   "devDependencies": {
-    "@verdaccio/test-helper": "5.0.0-next-9.18",
-    "@verdaccio/types": "14.0.0-next-9.8",
     "@types/lodash-es": "4.17.12",
+    "@verdaccio/test-helper": "5.0.0-next-9.19",
+    "@verdaccio/types": "14.0.0-next-9.9",
     "mockdate": "3.0.5",
     "nock": "13.5.6",
     "supertest": "7.1.4",
-    "vitest": "4.1.0"
+    "vitest": "4.1.7"
   },
   "funding": {
     "type": "opencollective",