@verdaccio/api 9.0.0-next-9.2 → 9.0.0-next-9.4

package/build/publish.js

@@ -1,274 +1,198 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports["default"] = publish;
-exports.publishPackage = publishPackage;
-var _debug = _interopRequireDefault(require("debug"));
-var _core = require("@verdaccio/core");
-var _middleware = require("@verdaccio/middleware");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
-function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
-function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
-function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
-function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
-// import star from './star';
-
-var debug = (0, _debug["default"])('verdaccio:api:publish');
-
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_middleware = require("@verdaccio/middleware");
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/publish.ts
+var debug$1 = (0, debug.default)("verdaccio:api:publish");
 /**
-   * Publish a package / update package / un/start a package
-   *
-   * There are multiples scenarios here to be considered:
-   *
-   * 1. Publish scenario
-   *
-   * Publish a package consist of at least 1 step (PUT) with a metadata payload.
-   * When a package is published, an _attachment property is present that contains the data
-   * of the tarball.
-   *
-   * Example flow of publish.
-   *
-   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms
-      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1
-      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1
-      + @scope/test1@1.0.1
-      npm verb exit [ 0, true ]
-   *
-   *
-   * 2. Unpublish scenario
-   *
-   * Unpublish consist in 3 steps.
-   *  1. Try to fetch  metadata -> if it fails, return 404
-   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to
-   *    be unpublished
-   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.
-   *  3. Once the second step has been successfully finished, delete the tarball.
-   *
-   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,
-   *  metadata might get corrupted.
-   *
-   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,
-   *  this not
-   *  used internally.
-   *
-   *
-   * Example flow of unpublish.
-   *
-   * There are two possible flows:
-   *
-   * - Remove all packages (entirely)
-   *   eg: npm unpublish package-name@* --force
-   *   eg: npm unpublish package-name  --force
-   *
-   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
-   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
-   *
-   * - Remove a specific version
-   *   eg: npm unpublish package-name@1.0.0 --force
-   *
-   * Get fresh manifest
-   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
-   * Update manifest without the version to be unpublished
-   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms
-   * Get fresh manifest (revision should be different)
-   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms
-   * Remove the tarball
-   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
-   *
-   * 3. Star a package
-   *
-   * Permissions: staring a package depends of the publish and unpublish permissions, there is no
-   * specific flag for star or unstar.
-   * The URL for star is similar to the unpublish (change package format)
-   *
-   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference
-   * is the users property which is part of the payload and the body only includes
-   *
-   * {
-      "_id": pkgName,
-      "_rev": "3-b0cdaefc9bdb77c8",
-      "users": {
-        [username]: boolean value (true, false)
-      }
-     }
-   *
-   * 4. Change owners of a package
-   *
-   * Similar to staring a package, changing owners (maintainers) of a package uses the publish
-   * endpoint.
-   *
-   * The body includes a list of the new owners with the following format
-   *
-   * {
-      "_id": pkgName,
-      "_rev": "4-b0cdaefc9bdb77c8",
-      "maintainers": [
-        { "name": "first owner", "email": "me@verdaccio.org" },
-        { "name": "second owner", "email": "you@verdaccio.org" },
-        ...
-      ]
-     }
-   *
-   */
+* Publish a package / update package / un/start a package
+*
+* There are multiples scenarios here to be considered:
+*
+* 1. Publish scenario
+*
+* Publish a package consist of at least 1 step (PUT) with a metadata payload.
+* When a package is published, an _attachment property is present that contains the data
+* of the tarball.
+*
+* Example flow of publish.
+*
+*  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms
+npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1
+npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1
++ @scope/test1@1.0.1
+npm verb exit [ 0, true ]
+*
+*
+* 2. Unpublish scenario
+*
+* Unpublish consist in 3 steps.
+*  1. Try to fetch  metadata -> if it fails, return 404
+*  2. Compute metadata locally (client side) and send a mutate payload excluding the version to
+*    be unpublished
+*    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.
+*  3. Once the second step has been successfully finished, delete the tarball.
+*
+*  All these steps are consecutive and required, there is no transacions here, if step 3 fails,
+*  metadata might get corrupted.
+*
+*  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,
+*  this not
+*  used internally.
+*
+*
+* Example flow of unpublish.
+*
+* There are two possible flows:
+*
+* - Remove all packages (entirely)
+*   eg: npm unpublish package-name@* --force
+*   eg: npm unpublish package-name  --force
+*
+* npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
+* npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
+*
+* - Remove a specific version
+*   eg: npm unpublish package-name@1.0.0 --force
+*
+* Get fresh manifest
+* npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms
+* Update manifest without the version to be unpublished
+* npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms
+* Get fresh manifest (revision should be different)
+* npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms
+* Remove the tarball
+* npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms
+*
+* 3. Star a package
+*
+* Permissions: staring a package depends of the publish and unpublish permissions, there is no
+* specific flag for star or unstar.
+* The URL for star is similar to the unpublish (change package format)
+*
+* npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference
+* is the users property which is part of the payload and the body only includes
+*
+* {
+"_id": pkgName,
+"_rev": "3-b0cdaefc9bdb77c8",
+"users": {
+[username]: boolean value (true, false)
+}
+}
+*
+* 4. Change owners of a package
+*
+* Similar to staring a package, changing owners (maintainers) of a package uses the publish
+* endpoint.
+*
+* The body includes a list of the new owners with the following format
+*
+* {
+"_id": pkgName,
+"_rev": "4-b0cdaefc9bdb77c8",
+"maintainers": [
+{ "name": "first owner", "email": "me@verdaccio.org" },
+{ "name": "second owner", "email": "you@verdaccio.org" },
+...
+]
+}
+*
+*/
 function publish(router, auth, storage, logger) {
-  var can = (0, _middleware.allow)(auth, {
-    beforeAll: function beforeAll(a, b) {
-      return logger.trace(a, b);
-    },
-    afterAll: function afterAll(a, b) {
-      return logger.trace(a, b);
-    }
-  });
-  router.put(_middleware.PUBLISH_API_ENDPOINTS.add_package, can('publish'), (0, _middleware.media)(_core.HEADERS.JSON), _middleware.expectJson, publishPackage(storage, logger, 'publish one version'));
-  router.put(_middleware.PUBLISH_API_ENDPOINTS.publish_package, can('unpublish'), (0, _middleware.media)(_core.HEADERS.JSON), _middleware.expectJson, publishPackage(storage, logger, 'publish with revision'));
-
-  /**
-   * Un-publishing an entire package.
-   *
-   * This scenario happens when any of these scenarios happens:
-   *  -  the first call detect there is only one version remaining
-   *  -  no version is specified in the unpublish call
-   *  -  all versions are removed npm unpublish package@*
-   *  -  there is no versions on the metadata
-    * then the client decides to DELETE the resource
-   * Example:
-   * Get fresh manifest (write=true is a flag to get the latest revision)
-   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)
-   * Send request to delete the package, this includes the revision number that must match
-   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)
-   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
-   */
-  router["delete"](_middleware.PUBLISH_API_ENDPOINTS.publish_package, can('unpublish'), /*#__PURE__*/function () {
-    var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(req, res, next) {
-      var _req$remote_user;
-      var packageName, rev, username, _t;
-      return _regenerator().w(function (_context) {
-        while (1) switch (_context.p = _context.n) {
-          case 0:
-            packageName = req.params["package"];
-            rev = req.params.revision;
-            username = req === null || req === void 0 || (_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name;
-            logger.debug({
-              packageName: packageName
-            }, "unpublishing @{packageName}");
-            _context.p = 1;
-            _context.n = 2;
-            return storage.removePackage(packageName, rev, username);
-          case 2:
-            debug('package %s unpublished', packageName);
-            res.status(_core.HTTP_STATUS.CREATED);
-            return _context.a(2, next({
-              ok: _core.API_MESSAGE.PKG_REMOVED
-            }));
-          case 3:
-            _context.p = 3;
-            _t = _context.v;
-            return _context.a(2, next(_t));
-        }
-      }, _callee, null, [[1, 3]]);
-    }));
-    return function (_x, _x2, _x3) {
-      return _ref.apply(this, arguments);
-    };
-  }());
-
-  /*
-   Remove a tarball, this happens when npm unpublish a package unique version.
-   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
-  */
-  router["delete"](_middleware.PUBLISH_API_ENDPOINTS.remove_tarball, can('unpublish'), /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(req, res, next) {
-      var _req$remote_user2;
-      var packageName, _req$params, filename, revision, username, _t2;
-      return _regenerator().w(function (_context2) {
-        while (1) switch (_context2.p = _context2.n) {
-          case 0:
-            packageName = req.params["package"];
-            _req$params = req.params, filename = _req$params.filename, revision = _req$params.revision;
-            username = req === null || req === void 0 || (_req$remote_user2 = req.remote_user) === null || _req$remote_user2 === void 0 ? void 0 : _req$remote_user2.name;
-            logger.debug({
-              packageName: packageName,
-              filename: filename,
-              revision: revision
-            }, "removing a tarball for @{packageName}-@{tarballName}-@{revision}");
-            _context2.p = 1;
-            _context2.n = 2;
-            return storage.removeTarball(packageName, filename, revision, username);
-          case 2:
-            res.status(_core.HTTP_STATUS.CREATED);
-            logger.debug({
-              packageName: packageName,
-              filename: filename,
-              revision: revision
-            }, "success remove tarball for @{packageName}-@{tarballName}-@{revision}");
-            return _context2.a(2, next({
-              ok: _core.API_MESSAGE.TARBALL_REMOVED
-            }));
-          case 3:
-            _context2.p = 3;
-            _t2 = _context2.v;
-            return _context2.a(2, next(_t2));
-        }
-      }, _callee2, null, [[1, 3]]);
-    }));
-    return function (_x4, _x5, _x6) {
-      return _ref2.apply(this, arguments);
-    };
-  }());
+	const can = (0, _verdaccio_middleware.allow)(auth, {
+		beforeAll: (a, b) => logger.trace(a, b),
+		afterAll: (a, b) => logger.trace(a, b)
+	});
+	router.put(_verdaccio_middleware.PUBLISH_API_ENDPOINTS.add_package, can("publish"), (0, _verdaccio_middleware.media)(_verdaccio_core.HEADERS.JSON), _verdaccio_middleware.expectJson, publishPackage(storage, logger, "publish one version"));
+	router.put(_verdaccio_middleware.PUBLISH_API_ENDPOINTS.publish_package, can("unpublish"), (0, _verdaccio_middleware.media)(_verdaccio_core.HEADERS.JSON), _verdaccio_middleware.expectJson, publishPackage(storage, logger, "publish with revision"));
+	/**
+	* Un-publishing an entire package.
+	*
+	* This scenario happens when any of these scenarios happens:
+	*  -  the first call detect there is only one version remaining
+	*  -  no version is specified in the unpublish call
+	*  -  all versions are removed npm unpublish package@*
+	*  -  there is no versions on the metadata
+	
+	* then the client decides to DELETE the resource
+	* Example:
+	* Get fresh manifest (write=true is a flag to get the latest revision)
+	* npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)
+	* Send request to delete the package, this includes the revision number that must match
+	* and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)
+	* npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
+	*/
+	router.delete(_verdaccio_middleware.PUBLISH_API_ENDPOINTS.publish_package, can("unpublish"), async function(req, res, next) {
+		const packageName = req.params.package;
+		const rev = req.params.revision;
+		const username = req?.remote_user?.name;
+		logger.debug({ packageName }, `unpublishing @{packageName}`);
+		try {
+			await storage.removePackage(packageName, rev, username);
+			debug$1("package %s unpublished", packageName);
+			res.status(_verdaccio_core.HTTP_STATUS.CREATED);
+			return next({ ok: _verdaccio_core.API_MESSAGE.PKG_REMOVED });
+		} catch (err) {
+			return next(err);
+		}
+	});
+	router.delete(_verdaccio_middleware.PUBLISH_API_ENDPOINTS.remove_tarball, can("unpublish"), async function(req, res, next) {
+		const packageName = req.params.package;
+		const { filename, revision } = req.params;
+		const username = req?.remote_user?.name;
+		logger.debug({
+			packageName,
+			filename,
+			revision
+		}, `removing a tarball for @{packageName}-@{tarballName}-@{revision}`);
+		try {
+			await storage.removeTarball(packageName, filename, revision, username);
+			res.status(_verdaccio_core.HTTP_STATUS.CREATED);
+			logger.debug({
+				packageName,
+				filename,
+				revision
+			}, `success remove tarball for @{packageName}-@{tarballName}-@{revision}`);
+			return next({ ok: _verdaccio_core.API_MESSAGE.TARBALL_REMOVED });
+		} catch (err) {
+			return next(err);
+		}
+	});
 }
 function publishPackage(storage, logger, origin) {
-  return /*#__PURE__*/function () {
-    var _ref3 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(req, res, next) {
-      var ac, packageName, revision, metadata, requestOptions, message, _t3;
-      return _regenerator().w(function (_context3) {
-        while (1) switch (_context3.p = _context3.n) {
-          case 0:
-            debug(origin);
-            ac = new AbortController();
-            packageName = req.params["package"];
-            revision = req.params.revision;
-            debug('publishing package %s', packageName);
-            debug('revision %s', revision);
-            if (debug.enabled) {
-              debug('body %o', req.body);
-            }
-            metadata = req.body;
-            logger.debug({
-              packageName: packageName
-            }, "publishing package @{packageName}");
-            requestOptions = (0, _middleware.getRequestOptions)(req);
-            _context3.p = 1;
-            _context3.n = 2;
-            return storage.updateManifest(metadata, {
-              name: packageName,
-              revision: revision,
-              signal: ac.signal,
-              requestOptions: requestOptions,
-              uplinksLook: false
-            });
-          case 2:
-            message = _context3.v;
-            debug('package %s published', packageName);
-            res.status(_core.HTTP_STATUS.CREATED);
-            return _context3.a(2, next({
-              success: true,
-              ok: message
-            }));
-          case 3:
-            _context3.p = 3;
-            _t3 = _context3.v;
-            // TODO: review if we need the abort controller here
-            next(_t3);
-          case 4:
-            return _context3.a(2);
-        }
-      }, _callee3, null, [[1, 3]]);
-    }));
-    return function (_x7, _x8, _x9) {
-      return _ref3.apply(this, arguments);
-    };
-  }();
+	return async function(req, res, next) {
+		debug$1(origin);
+		const ac = new AbortController();
+		const packageName = req.params.package;
+		const { revision } = req.params;
+		debug$1("publishing package %s", packageName);
+		debug$1("revision %s", revision);
+		if (debug$1.enabled) debug$1("body %o", req.body);
+		const metadata = req.body;
+		logger.debug({ packageName }, `publishing package @{packageName}`);
+		const requestOptions = (0, _verdaccio_middleware.getRequestOptions)(req);
+		try {
+			const message = await storage.updateManifest(metadata, {
+				name: packageName,
+				revision,
+				signal: ac.signal,
+				requestOptions,
+				uplinksLook: false
+			});
+			debug$1("package %s published", packageName);
+			res.status(_verdaccio_core.HTTP_STATUS.CREATED);
+			return next({
+				success: true,
+				ok: message
+			});
+		} catch (err) {
+			next(err);
+		}
+	};
 }
+//#endregion
+exports.default = publish;
+
 //# sourceMappingURL=publish.js.map

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":["_debug","_interopRequireDefault","require","_core","_middleware","e","__esModule","_regenerator","t","r","Symbol","n","iterator","o","toStringTag","i","c","prototype","Generator","u","Object","create","_regeneratorDefine2","f","p","y","G","v","a","d","bind","length","l","TypeError","call","done","value","GeneratorFunction","GeneratorFunctionPrototype","getPrototypeOf","setPrototypeOf","__proto__","displayName","w","m","defineProperty","_regeneratorDefine","_invoke","enumerable","configurable","writable","asyncGeneratorStep","Promise","resolve","then","_asyncToGenerator","arguments","apply","_next","_throw","debug","buildDebug","publish","router","auth","storage","logger","can","allow","beforeAll","b","trace","afterAll","put","PUBLISH_API_ENDPOINTS","add_package","media","HEADERS","JSON","expectJson","publishPackage","publish_package","_ref","_callee","req","res","next","_req$remote_user","packageName","rev","username","_t","_context","params","revision","remote_user","name","removePackage","status","HTTP_STATUS","CREATED","ok","API_MESSAGE","PKG_REMOVED","_x","_x2","_x3","remove_tarball","_ref2","_callee2","_req$remote_user2","_req$params","filename","_t2","_context2","removeTarball","TARBALL_REMOVED","_x4","_x5","_x6","origin","_ref3","_callee3","ac","metadata","requestOptions","message","_t3","_context3","AbortController","enabled","body","getRequestOptions","updateManifest","signal","uplinksLook","success","_x7","_x8","_x9"],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\n// import star from './star';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"3-b0cdaefc9bdb77c8\",\n      \"users\": {\n        [username]: boolean value (true, false)\n      }\n     }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAIA,IAAAC,KAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AAM+B,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,gBAAAA,CAAA;AAAA,SAAAE,aAAA,IAV/B,uKAAAF,CAAA,EAAAG,CAAA,EAAAC,CAAA,wBAAAC,MAAA,GAAAA,MAAA,OAAAC,CAAA,GAAAF,CAAA,CAAAG,QAAA,kBAAAC,CAAA,GAAAJ,CAAA,CAAAK,WAAA,8BAAAC,EAAAN,CAAA,EAAAE,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAC,CAAA,GAAAL,CAAA,IAAAA,CAAA,CAAAM,SAAA,YAAAC,SAAA,GAAAP,CAAA,GAAAO,SAAA,EAAAC,CAAA,GAAAC,MAAA,CAAAC,MAAA,CAAAL,CAAA,CAAAC,SAAA,UAAAK,mBAAA,CAAAH,CAAA,uBAAAV,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAE,CAAA,EAAAC,CAAA,EAAAG,CAAA,EAAAI,CAAA,MAAAC,CAAA,GAAAX,CAAA,QAAAY,CAAA,OAAAC,CAAA,KAAAF,CAAA,KAAAb,CAAA,KAAAgB,CAAA,EAAAtB,CAAA,EAAAuB,CAAA,EAAAC,CAAA,EAAAN,CAAA,EAAAM,CAAA,CAAAC,IAAA,CAAAzB,CAAA,MAAAwB,CAAA,WAAAA,EAAArB,CAAA,EAAAC,CAAA,WAAAM,CAAA,GAAAP,CAAA,EAAAQ,CAAA,MAAAG,CAAA,GAAAd,CAAA,EAAAqB,CAAA,CAAAf,CAAA,GAAAF,CAAA,EAAAmB,CAAA,gBAAAC,EAAApB,CAAA,EAAAE,CAAA,SAAAK,CAAA,GAAAP,CAAA,EAAAU,CAAA,GAAAR,CAAA,EAAAH,CAAA,OAAAiB,CAAA,IAAAF,CAAA,KAAAV,CAAA,IAAAL,CAAA,GAAAgB,CAAA,CAAAO,MAAA,EAAAvB,CAAA,UAAAK,CAAA,EAAAE,CAAA,GAAAS,CAAA,CAAAhB,CAAA,GAAAqB,CAAA,GAAAH,CAAA,CAAAF,CAAA,EAAAQ,CAAA,GAAAjB,CAAA,KAAAN,CAAA,QAAAI,CAAA,GAAAmB,CAAA,KAAArB,CAAA,MAAAQ,CAAA,GAAAJ,CAAA,EAAAC,CAAA,GAAAD,CAAA,YAAAC,CAAA,WAAAD,CAAA,MAAAA,CAAA,MAAAV,CAAA,IAAAU,CAAA,OAAAc,CAAA,MAAAhB,CAAA,GAAAJ,CAAA,QAAAoB,CAAA,GAAAd,CAAA,QAAAC,CAAA,MAAAU,CAAA,CAAAC,CAAA,GAAAhB,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAI,CAAA,OAAAc,CAAA,GAAAG,CAAA,KAAAnB,CAAA,GAAAJ,CAAA,QAAAM,CAAA,MAAAJ,CAAA,IAAAA,CAAA,GAAAqB,CAAA,MAAAjB,CAAA,MAAAN,CAAA,EAAAM,CAAA,MAAAJ,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAqB,CAAA,EAAAhB,CAAA,cAAAH,CAAA,IAAAJ,CAAA,aAAAmB,CAAA,QAAAH,CAAA,OAAAd,CAAA,qBAAAE,CAAA,EAAAW,CAAA,EAAAQ,CAAA,QAAAT,CAAA,YAAAU,SAAA,uCAAAR,CAAA,UAAAD,CAAA,IAAAK,CAAA,CAAAL,CAAA,EAAAQ,CAAA,GAAAhB,CAAA,GAAAQ,CAAA,EAAAL,CAAA,GAAAa,CAAA,GAAAxB,CAAA,GAAAQ,CAAA,OAAAX,CAAA,GAAAc,CAAA,MAAAM,CAAA,KAAAV,CAAA,KAAAC,CAAA,GAAAA,CAAA,QAAAA,CAAA,SAAAU,CAAA,CAAAf,CAAA,QAAAkB,CAAA,CAAAb,CAAA,EAAAG,CAAA,KAAAO,CAAA,CAAAf,CAAA,GAAAQ,CAAA,GAAAO,CAAA,CAAAC,CAAA,GAAAR,CAAA,aAAAI,CAAA,MAAAR,CAAA,QAAAC,CAAA,KAAAH,CAAA,YAAAL,CAAA,GAAAO,CAAA,CAAAF,CAAA,WAAAL,CAAA,GAAAA,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,EAAAI,CAAA,UAAAc,SAAA,2CAAAzB,CAAA,CAAA2B,IAAA,SAAA3B,CAAA,EAAAW,CAAA,GAAAX,CAAA,CAAA4B,KAAA,EAAApB,CAAA,SAAAA,CAAA,oBAAAA,CAAA,KAAAR,CAAA,GAAAO,CAAA,eAAAP,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,GAAAC,CAAA,SAAAG,CAAA,GAAAc,SAAA,uCAAApB,CAAA,gBAAAG,CAAA,OAAAD,CAAA,GAAAV,CAAA,cAAAG,CAAA,IAAAiB,CAAA,GAAAC,CAAA,CAAAf,CAAA,QAAAQ,CAAA,GAAAV,CAAA,CAAAyB,IAAA,CAAAvB,CAAA,EAAAe,CAAA,OAAAE,CAAA,kBAAApB,CAAA,IAAAO,CAAA,GAAAV,CAAA,EAAAW,CAAA,MAAAG,CAAA,GAAAX,CAAA,cAAAe,CAAA,mBAAAa,KAAA,EAAA5B,CAAA,EAAA2B,IAAA,EAAAV,CAAA,SAAAhB,CAAA,EAAAI,CAAA,EAAAE,CAAA,QAAAI,CAAA,QAAAS,CAAA,gBAAAV,UAAA,cAAAmB,kBAAA,cAAAC,2BAAA,KAAA9B,CAAA,GAAAY,MAAA,CAAAmB,cAAA,MAAAvB,CAAA,MAAAL,CAAA,IAAAH,CAAA,CAAAA,CAAA,IAAAG,CAAA,SAAAW,mBAAA,CAAAd,CAAA,OAAAG,CAAA,iCAAAH,CAAA,GAAAW,CAAA,GAAAmB,0BAAA,CAAArB,SAAA,GAAAC,SAAA,CAAAD,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAL,CAAA,YAAAO,EAAAlB,CAAA,WAAAe,MAAA,CAAAoB,cAAA,GAAApB,MAAA,CAAAoB,cAAA,CAAAnC,CAAA,EAAAiC,0BAAA,KAAAjC,CAAA,CAAAoC,SAAA,GAAAH,0BAAA,EAAAhB,mBAAA,CAAAjB,CAAA,EAAAQ,CAAA,yBAAAR,CAAA,CAAAY,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAF,CAAA,GAAAd,CAAA,WAAAgC,iBAAA,CAAApB,SAAA,GAAAqB,0BAAA,EAAAhB,mBAAA,CAAAH,CAAA,iBAAAmB,0BAAA,GAAAhB,mBAAA,CAAAgB,0BAAA,iBAAAD,iBAAA,GAAAA,iBAAA,CAAAK,WAAA,wBAAApB,mBAAA,CAAAgB,0BAAA,EAAAzB,CAAA,wBAAAS,mBAAA,CAAAH,CAAA,GAAAG,mBAAA,CAAAH,CAAA,EAAAN,CAAA,gBAAAS,mBAAA,CAAAH,CAAA,EAAAR,CAAA,iCAAAW,mBAAA,CAAAH,CAAA,8DAAAZ,YAAA,YAAAA,aAAA,aAAAoC,CAAA,EAAA5B,CAAA,EAAA6B,CAAA,EAAArB,CAAA;AAAA,SAAAD,oBAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,QAAAO,CAAA,GAAAK,MAAA,CAAAyB,cAAA,QAAA9B,CAAA,uBAAAV,CAAA,IAAAU,CAAA,QAAAO,mBAAA,YAAAwB,mBAAAzC,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,aAAAK,EAAAJ,CAAA,EAAAE,CAAA,IAAAW,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,YAAAJ,CAAA,gBAAA0C,OAAA,CAAAtC,CAAA,EAAAE,CAAA,EAAAN,CAAA,SAAAI,CAAA,GAAAM,CAAA,GAAAA,CAAA,CAAAV,CAAA,EAAAI,CAAA,IAAA2B,KAAA,EAAAzB,CAAA,EAAAqC,UAAA,GAAAxC,CAAA,EAAAyC,YAAA,GAAAzC,CAAA,EAAA0C,QAAA,GAAA1C,CAAA,MAAAH,CAAA,CAAAI,CAAA,IAAAE,CAAA,IAAAE,CAAA,aAAAA,CAAA,cAAAA,CAAA,mBAAAS,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA;AAAA,SAAA2C,mBAAAxC,CAAA,EAAAH,CAAA,EAAAH,CAAA,EAAAI,CAAA,EAAAI,CAAA,EAAAe,CAAA,EAAAZ,CAAA,cAAAD,CAAA,GAAAJ,CAAA,CAAAiB,CAAA,EAAAZ,CAAA,GAAAG,CAAA,GAAAJ,CAAA,CAAAqB,KAAA,WAAAzB,CAAA,gBAAAN,CAAA,CAAAM,CAAA,KAAAI,CAAA,CAAAoB,IAAA,GAAA3B,CAAA,CAAAW,CAAA,IAAAiC,OAAA,CAAAC,OAAA,CAAAlC,CAAA,EAAAmC,IAAA,CAAA7C,CAAA,EAAAI,CAAA;AAAA,SAAA0C,kBAAA5C,CAAA,6BAAAH,CAAA,SAAAH,CAAA,GAAAmD,SAAA,aAAAJ,OAAA,WAAA3C,CAAA,EAAAI,CAAA,QAAAe,CAAA,GAAAjB,CAAA,CAAA8C,KAAA,CAAAjD,CAAA,EAAAH,CAAA,YAAAqD,MAAA/C,CAAA,IAAAwC,kBAAA,CAAAvB,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA6C,KAAA,EAAAC,MAAA,UAAAhD,CAAA,cAAAgD,OAAAhD,CAAA,IAAAwC,kBAAA,CAAAvB,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA6C,KAAA,EAAAC,MAAA,WAAAhD,CAAA,KAAA+C,KAAA;AAWA;;AAMA,IAAME,KAAK,GAAG,IAAAC,iBAAU,EAAC,uBAAuB,CAAC;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACe,SAASC,OAAOA,CAC7BC,MAAc,EACdC,IAAU,EACVC,OAAgB,EAChBC,MAAc,EACR;EACN,IAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAE,SAAXA,SAASA,CAAGzC,CAAC,EAAE0C,CAAC;MAAA,OAAKJ,MAAM,CAACK,KAAK,CAAC3C,CAAC,EAAE0C,CAAC,CAAC;IAAA;IACvCE,QAAQ,EAAE,SAAVA,QAAQA,CAAG5C,CAAC,EAAE0C,CAAC;MAAA,OAAKJ,MAAM,CAACK,KAAK,CAAC3C,CAAC,EAAE0C,CAAC,CAAC;IAAA;EACxC,CAAC,CAAC;EACFP,MAAM,CAACU,GAAG,CACRC,iCAAqB,CAACC,WAAW,EACjCR,GAAG,CAAC,SAAS,CAAC,EACd,IAAAS,iBAAK,EAACC,aAAO,CAACC,IAAI,CAAC,EACnBC,sBAAU,EACVC,cAAc,CAACf,OAAO,EAAEC,MAAM,EAAE,qBAAqB,CACvD,CAAC;EAEDH,MAAM,CAACU,GAAG,CACRC,iCAAqB,CAACO,eAAe,EACrCd,GAAG,CAAC,WAAW,CAAC,EAChB,IAAAS,iBAAK,EAACC,aAAO,CAACC,IAAI,CAAC,EACnBC,sBAAU,EACVC,cAAc,CAACf,OAAO,EAAEC,MAAM,EAAE,uBAAuB,CACzD,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EAEEH,MAAM,UAAO,CACXW,iCAAqB,CAACO,eAAe,EACrCd,GAAG,CAAC,WAAW,CAAC;IAAA,IAAAe,IAAA,GAAA3B,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAChB,SAAAuC,QAAgBC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB;MAAA,IAAAC,gBAAA;MAAA,IAAAC,WAAA,EAAAC,GAAA,EAAAC,QAAA,EAAAC,EAAA;MAAA,OAAApF,YAAA,GAAAoC,CAAA,WAAAiD,QAAA;QAAA,kBAAAA,QAAA,CAAApE,CAAA,GAAAoE,QAAA,CAAAjF,CAAA;UAAA;YACzE6E,WAAW,GAAGJ,GAAG,CAACS,MAAM,WAAQ;YAChCJ,GAAG,GAAGL,GAAG,CAACS,MAAM,CAACC,QAAQ;YACzBJ,QAAQ,GAAGN,GAAG,aAAHA,GAAG,gBAAAG,gBAAA,GAAHH,GAAG,CAAEW,WAAW,cAAAR,gBAAA,uBAAhBA,gBAAA,CAAkBS,IAAI;YAEvC9B,MAAM,CAACN,KAAK,CAAC;cAAE4B,WAAW,EAAXA;YAAY,CAAC,+BAA+B,CAAC;YAACI,QAAA,CAAApE,CAAA;YAAAoE,QAAA,CAAAjF,CAAA;YAAA,OAErDsD,OAAO,CAACgC,aAAa,CAACT,WAAW,EAAEC,GAAG,EAAEC,QAAQ,CAAC;UAAA;YACvD9B,KAAK,CAAC,wBAAwB,EAAE4B,WAAW,CAAC;YAC5CH,GAAG,CAACa,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;YAAC,OAAAR,QAAA,CAAAhE,CAAA,IACzB0D,IAAI,CAAC;cAAEe,EAAE,EAAEC,iBAAW,CAACC;YAAY,CAAC,CAAC;UAAA;YAAAX,QAAA,CAAApE,CAAA;YAAAmE,EAAA,GAAAC,QAAA,CAAAjE,CAAA;YAAA,OAAAiE,QAAA,CAAAhE,CAAA,IAErC0D,IAAI,CAAAK,EAAI,CAAC;QAAA;MAAA,GAAAR,OAAA;IAAA,CAEnB;IAAA,iBAAAqB,EAAA,EAAAC,GAAA,EAAAC,GAAA;MAAA,OAAAxB,IAAA,CAAAzB,KAAA,OAAAD,SAAA;IAAA;EAAA,GACH,CAAC;;EAED;AACF;AACA;AACA;EACEO,MAAM,UAAO,CACXW,iCAAqB,CAACiC,cAAc,EACpCxC,GAAG,CAAC,WAAW,CAAC;IAAA,IAAAyC,KAAA,GAAArD,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAChB,SAAAiE,SACEzB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB;MAAA,IAAAwB,iBAAA;MAAA,IAAAtB,WAAA,EAAAuB,WAAA,EAAAC,QAAA,EAAAlB,QAAA,EAAAJ,QAAA,EAAAuB,GAAA;MAAA,OAAA1G,YAAA,GAAAoC,CAAA,WAAAuE,SAAA;QAAA,kBAAAA,SAAA,CAAA1F,CAAA,GAAA0F,SAAA,CAAAvG,CAAA;UAAA;YAEhB6E,WAAW,GAAGJ,GAAG,CAACS,MAAM,WAAQ;YAAAkB,WAAA,GACP3B,GAAG,CAACS,MAAM,EAAjCmB,QAAQ,GAAAD,WAAA,CAARC,QAAQ,EAAElB,QAAQ,GAAAiB,WAAA,CAARjB,QAAQ;YACpBJ,QAAQ,GAAGN,GAAG,aAAHA,GAAG,gBAAA0B,iBAAA,GAAH1B,GAAG,CAAEW,WAAW,cAAAe,iBAAA,uBAAhBA,iBAAA,CAAkBd,IAAI;YAEvC9B,MAAM,CAACN,KAAK,CACV;cAAE4B,WAAW,EAAXA,WAAW;cAAEwB,QAAQ,EAARA,QAAQ;cAAElB,QAAQ,EAARA;YAAS,CAAC,oEAErC,CAAC;YAACoB,SAAA,CAAA1F,CAAA;YAAA0F,SAAA,CAAAvG,CAAA;YAAA,OAEMsD,OAAO,CAACkD,aAAa,CAAC3B,WAAW,EAAEwB,QAAQ,EAAElB,QAAQ,EAAEJ,QAAQ,CAAC;UAAA;YACtEL,GAAG,CAACa,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;YAE/BlC,MAAM,CAACN,KAAK,CACV;cAAE4B,WAAW,EAAXA,WAAW;cAAEwB,QAAQ,EAARA,QAAQ;cAAElB,QAAQ,EAARA;YAAS,CAAC,wEAErC,CAAC;YAAC,OAAAoB,SAAA,CAAAtF,CAAA,IACK0D,IAAI,CAAC;cAAEe,EAAE,EAAEC,iBAAW,CAACc;YAAgB,CAAC,CAAC;UAAA;YAAAF,SAAA,CAAA1F,CAAA;YAAAyF,GAAA,GAAAC,SAAA,CAAAvF,CAAA;YAAA,OAAAuF,SAAA,CAAAtF,CAAA,IAEzC0D,IAAI,CAAA2B,GAAI,CAAC;QAAA;MAAA,GAAAJ,QAAA;IAAA,CAEnB;IAAA,iBAAAQ,GAAA,EAAAC,GAAA,EAAAC,GAAA;MAAA,OAAAX,KAAA,CAAAnD,KAAA,OAAAD,SAAA;IAAA;EAAA,GACH,CAAC;AACH;AAEO,SAASwB,cAAcA,CAACf,OAAgB,EAAEC,MAAc,EAAEsD,MAAc,EAAO;EACpF;IAAA,IAAAC,KAAA,GAAAlE,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAAO,SAAA8E,SACLtC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB;MAAA,IAAAqC,EAAA,EAAAnC,WAAA,EAAAM,QAAA,EAAA8B,QAAA,EAAAC,cAAA,EAAAC,OAAA,EAAAC,GAAA;MAAA,OAAAxH,YAAA,GAAAoC,CAAA,WAAAqF,SAAA;QAAA,kBAAAA,SAAA,CAAAxG,CAAA,GAAAwG,SAAA,CAAArH,CAAA;UAAA;YAEtBiD,KAAK,CAAC4D,MAAM,CAAC;YACPG,EAAE,GAAG,IAAIM,eAAe,CAAC,CAAC;YAC1BzC,WAAW,GAAGJ,GAAG,CAACS,MAAM,WAAQ;YAC9BC,QAAQ,GAAKV,GAAG,CAACS,MAAM,CAAvBC,QAAQ;YAChBlC,KAAK,CAAC,uBAAuB,EAAE4B,WAAW,CAAC;YAC3C5B,KAAK,CAAC,aAAa,EAAEkC,QAAQ,CAAC;YAC9B,IAAIlC,KAAK,CAACsE,OAAO,EAAE;cACjBtE,KAAK,CAAC,SAAS,EAAEwB,GAAG,CAAC+C,IAAI,CAAC;YAC5B;YACMP,QAAQ,GAAGxC,GAAG,CAAC+C,IAAI;YAEzBjE,MAAM,CAACN,KAAK,CAAC;cAAE4B,WAAW,EAAXA;YAAY,CAAC,qCAAqC,CAAC;YAE5DqC,cAAc,GAAG,IAAAO,6BAAiB,EAAChD,GAAG,CAAC;YAAA4C,SAAA,CAAAxG,CAAA;YAAAwG,SAAA,CAAArH,CAAA;YAAA,OAGrBsD,OAAO,CAACoE,cAAc,CAACT,QAAQ,EAAE;cACrD5B,IAAI,EAAER,WAAW;cACjBM,QAAQ,EAARA,QAAQ;cACRwC,MAAM,EAAEX,EAAE,CAACW,MAAM;cACjBT,cAAc,EAAdA,cAAc;cACdU,WAAW,EAAE;YACf,CAAC,CAAC;UAAA;YANIT,OAAO,GAAAE,SAAA,CAAArG,CAAA;YAObiC,KAAK,CAAC,sBAAsB,EAAE4B,WAAW,CAAC;YAE1CH,GAAG,CAACa,MAAM,CAACC,iBAAW,CAACC,OAAO,CAAC;YAAC,OAAA4B,SAAA,CAAApG,CAAA,IAEzB0D,IAAI,CAAC;cACVkD,OAAO,EAAE,IAAI;cACbnC,EAAE,EAAEyB;YACN,CAAC,CAAC;UAAA;YAAAE,SAAA,CAAAxG,CAAA;YAAAuG,GAAA,GAAAC,SAAA,CAAArG,CAAA;YAEF;YACA2D,IAAI,CAAAyC,GAAI,CAAC;UAAC;YAAA,OAAAC,SAAA,CAAApG,CAAA;QAAA;MAAA,GAAA8F,QAAA;IAAA,CAEb;IAAA,iBAAAe,GAAA,EAAAC,GAAA,EAAAC,GAAA;MAAA,OAAAlB,KAAA,CAAAhE,KAAA,OAAAD,SAAA;IAAA;EAAA;AACH","ignoreList":[]}
+{"version":3,"file":"publish.js","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\n// import star from './star';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package / un/start a package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Star a package\n   *\n   * Permissions: staring a package depends of the publish and unpublish permissions, there is no\n   * specific flag for star or unstar.\n   * The URL for star is similar to the unpublish (change package format)\n   *\n   * npm has no endpoint for staring a package, rather mutate the metadata and acts as, the difference\n   * is the users property which is part of the payload and the body only includes\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"3-b0cdaefc9bdb77c8\",\n      \"users\": {\n        [username]: boolean value (true, false)\n      }\n     }\n   *\n   * 4. Change owners of a package\n   *\n   * Similar to staring a package, changing owners (maintainers) of a package uses the publish\n   * endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(storage: Storage, logger: Logger, origin: string): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n\n      res.status(HTTP_STATUS.CREATED);\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiGjD,SAAwB,QACtB,QACA,MACA,SACA,QACM;CACN,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,EAAE;EACvC,CAAC;AACF,QAAO,IACL,sBAAA,sBAAsB,aACtB,IAAI,UAAU,GAAA,GAAA,sBAAA,OACR,gBAAA,QAAQ,KAAK,EACnB,sBAAA,YACA,eAAe,SAAS,QAAQ,sBAAsB,CACvD;AAED,QAAO,IACL,sBAAA,sBAAsB,iBACtB,IAAI,YAAY,GAAA,GAAA,sBAAA,OACV,gBAAA,QAAQ,KAAK,EACnB,sBAAA,YACA,eAAe,SAAS,QAAQ,wBAAwB,CACzD;;;;;;;;;;;;;;;;;;AAmBD,QAAO,OACL,sBAAA,sBAAsB,iBACtB,IAAI,YAAY,EAChB,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;AAEnC,SAAO,MAAM,EAAE,aAAa,EAAE,8BAA8B;AAC5D,MAAI;AACF,SAAM,QAAQ,cAAc,aAAa,KAAK,SAAS;AACvD,WAAM,0BAA0B,YAAY;AAC5C,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAC/B,UAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,aAAa,CAAC;WACrC,KAAK;AACZ,UAAO,KAAK,IAAI;;GAGrB;AAMD,QAAO,OACL,sBAAA,sBAAsB,gBACtB,IAAI,YAAY,EAChB,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;AAEnC,SAAO,MACL;GAAE;GAAa;GAAU;GAAU,EACnC,mEACD;AACD,MAAI;AACF,SAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,SAAS;AACtE,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAE/B,UAAO,MACL;IAAE;IAAa;IAAU;IAAU,EACnC,uEACD;AACD,UAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,iBAAiB,CAAC;WACzC,KAAK;AACZ,UAAO,KAAK,IAAI;;GAGrB;;AAGH,SAAgB,eAAe,SAAkB,QAAgB,QAAqB;AACpF,QAAO,eACL,KACA,KACA,MACe;AACf,UAAM,OAAO;EACb,MAAM,KAAK,IAAI,iBAAiB;EAChC,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;AACzB,UAAM,yBAAyB,YAAY;AAC3C,UAAM,eAAe,SAAS;AAC9B,MAAI,QAAM,QACR,SAAM,WAAW,IAAI,KAAK;EAE5B,MAAM,WAAW,IAAI;AAErB,SAAO,MAAM,EAAE,aAAa,EAAE,oCAAoC;EAElE,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,IAAI;AAE7C,MAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;IACd,CAAC;AACF,WAAM,wBAAwB,YAAY;AAE1C,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAE/B,UAAO,KAAK;IACV,SAAS;IACT,IAAI;IACL,CAAC;WACK,KAAU;AAEjB,QAAK,IAAI"}