@verdaccio/api 9.0.0-next-9.2 → 9.0.0-next-9.4

package/build/v1/login.js

@@ -1,248 +1,117 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports["default"] = _default;
-var _debug = _interopRequireDefault(require("debug"));
-var _nodeCrypto = require("node:crypto");
-var _auth = require("@verdaccio/auth");
-var _config = require("@verdaccio/config");
-var _core = require("@verdaccio/core");
-var _middleware = require("@verdaccio/middleware");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
-function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
-function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
-function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
-function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
-var debug = (0, _debug["default"])('verdaccio:api:login');
-var WEB_LOGIN_SESSION_ID = 'web-login-sessionId';
-
-// https://github.com/npm/npm-profile/blob/main/lib/index.js
-function _default(route, auth, storage, config, logger) {
-  route.post(_middleware.LOGIN_API_ENDPOINTS.login, (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), /*#__PURE__*/function () {
-    var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(req, res) {
-      var sessionId, protocol, host, port, loginUrl, doneUrl;
-      return _regenerator().w(function (_context) {
-        while (1) switch (_context.n) {
-          case 0:
-            // create new login session (without token)
-            sessionId = (0, _nodeCrypto.randomUUID)();
-            debug('creating login session %o', sessionId);
-            _context.n = 1;
-            return storage.saveToken({
-              user: sessionId,
-              token: '',
-              key: WEB_LOGIN_SESSION_ID,
-              readonly: false,
-              created: new Date().getTime()
-            });
-          case 1:
-            res.status(_core.HTTP_STATUS.OK);
-
-            // Assuming Web UI is running on the same address as API
-            protocol = req.protocol;
-            host = req.hostname;
-            port = req.socket.localPort;
-            loginUrl = "".concat(protocol, "://").concat(host, ":").concat(port, "/-/web/login?next=").concat(_middleware.LOGIN_API_ENDPOINTS.login_cli, "/").concat(sessionId);
-            doneUrl = "".concat(protocol, "://").concat(host, ":").concat(port).concat(_middleware.LOGIN_API_ENDPOINTS.login_done, "/").concat(sessionId);
-            debug('loginUrl: %o', loginUrl);
-            debug('doneUrl: %o', doneUrl);
-            res.json({
-              loginUrl: loginUrl,
-              doneUrl: doneUrl
-            });
-          case 2:
-            return _context.a(2);
-        }
-      }, _callee);
-    }));
-    return function (_x, _x2) {
-      return _ref.apply(this, arguments);
-    };
-  }());
-  route.get(_middleware.LOGIN_API_ENDPOINTS.login_done_session, (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(req, res, next) {
-      var sessionId, tokens, tokenCreatedDate, minutesAgo, _t;
-      return _regenerator().w(function (_context2) {
-        while (1) switch (_context2.p = _context2.n) {
-          case 0:
-            debug('polling login session %o', req.params.sessionId);
-            if (req.params.sessionId) {
-              _context2.n = 1;
-              break;
-            }
-            debug('sessionId is missing');
-            return _context2.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.SESSION_ID_REQUIRED)));
-          case 1:
-            sessionId = req.params.sessionId;
-            if (!(sessionId.length !== 36)) {
-              _context2.n = 2;
-              break;
-            }
-            debug('sessionId is invalid length: %o', sessionId.length);
-            return _context2.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.SESSION_ID_INVALID)));
-          case 2:
-            _context2.p = 2;
-            _context2.n = 3;
-            return storage.readTokens({
-              user: sessionId
-            });
-          case 3:
-            tokens = _context2.v;
-            debug('tokens found for sessionId %o: %o', sessionId, tokens.length);
-            if (!(tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID)) {
-              _context2.n = 8;
-              break;
-            }
-            if (!(tokens[0].token.length === 0)) {
-              _context2.n = 4;
-              break;
-            }
-            debug('waiting for authentication');
-            // Poll again after short delay
-            // TODO: make this configurable (default 5 seconds)
-            res.status(_core.HTTP_STATUS.ACCEPTED);
-            res.set(_core.HEADERS.RETRY_AFTER, '5');
-            res.json({});
-            _context2.n = 7;
-            break;
-          case 4:
-            // session token can only be used once
-            debug('deleting session token');
-            _context2.n = 5;
-            return storage.deleteToken(sessionId, tokens[0].key);
-          case 5:
-            // Check if token has expired
-            // TODO: make this configurable (default 2 minutes)
-            tokenCreatedDate = new Date(tokens[0].created);
-            minutesAgo = new Date(Date.now() - 2 * 60 * 1000);
-            if (!(tokenCreatedDate < minutesAgo)) {
-              _context2.n = 6;
-              break;
-            }
-            debug('session token expired');
-            return _context2.a(2, next(_core.errorUtils.getUnauthorized(_core.API_ERROR.SESSION_TOKEN_EXPIRED)));
-          case 6:
-            debug('session token is valid, login successful');
-            res.status(_core.HTTP_STATUS.OK);
-            res.json({
-              token: tokens[0].token
-            });
-          case 7:
-            _context2.n = 9;
-            break;
-          case 8:
-            return _context2.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.SESSION_ID_INVALID)));
-          case 9:
-            _context2.n = 11;
-            break;
-          case 10:
-            _context2.p = 10;
-            _t = _context2.v;
-            logger.error({
-              error: _t.msg
-            }, 'token list has failed: @{error}');
-            return _context2.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.INTERNAL_ERROR, _t.message)));
-          case 11:
-            return _context2.a(2);
-        }
-      }, _callee2, null, [[2, 10]]);
-    }));
-    return function (_x3, _x4, _x5) {
-      return _ref2.apply(this, arguments);
-    };
-  }());
-  route.post(_middleware.LOGIN_API_ENDPOINTS.login_cli_session, (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), /*#__PURE__*/function () {
-    var _ref3 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(req, res, next) {
-      var _req$body, username, password, sessionId;
-      return _regenerator().w(function (_context4) {
-        while (1) switch (_context4.n) {
-          case 0:
-            _req$body = req.body, username = _req$body.username, password = _req$body.password;
-            debug('authenticating login session %o for user %o', req.params.sessionId, username);
-            if (req.params.sessionId) {
-              _context4.n = 1;
-              break;
-            }
-            debug('sessionId is missing');
-            return _context4.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.SESSION_ID_REQUIRED)));
-          case 1:
-            sessionId = req.params.sessionId;
-            if (!(sessionId.length !== 36)) {
-              _context4.n = 2;
-              break;
-            }
-            debug('sessionId is invalid length: %o', sessionId.length);
-            return _context4.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.SESSION_ID_INVALID)));
-          case 2:
-            auth.authenticate(username, password, /*#__PURE__*/function () {
-              var _callbackAuthenticate = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(err, user) {
-                var _remoteUser$name;
-                var remoteUser, token, message;
-                return _regenerator().w(function (_context3) {
-                  while (1) switch (_context3.n) {
-                    case 0:
-                      if (!err) {
-                        _context3.n = 1;
-                        break;
-                      }
-                      logger.trace({
-                        username: username,
-                        err: err
-                      }, 'authenticating for user @{username} failed. Error: @{err.message}');
-                      return _context3.a(2, next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNAUTHORIZED, err.message)));
-                    case 1:
-                      remoteUser = (0, _config.createRemoteUser)(username, (user === null || user === void 0 ? void 0 : user.groups) || []);
-                      _context3.n = 2;
-                      return (0, _auth.getApiToken)(auth, config, remoteUser, password);
-                    case 2:
-                      token = _context3.v;
-                      if (token) {
-                        _context3.n = 3;
-                        break;
-                      }
-                      return _context3.a(2, next(_core.errorUtils.getUnauthorized()));
-                    case 3:
-                      // Replace login session with token (to be picked up by the "done" endpoint)
-                      debug('saving token for sessionId %o', sessionId);
-                      _context3.n = 4;
-                      return storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);
-                    case 4:
-                      _context3.n = 5;
-                      return storage.saveToken({
-                        user: sessionId,
-                        token: token,
-                        key: WEB_LOGIN_SESSION_ID,
-                        readonly: false,
-                        created: new Date().getTime()
-                      });
-                    case 5:
-                      message = _core.authUtils.getAuthenticatedMessage((_remoteUser$name = remoteUser.name) !== null && _remoteUser$name !== void 0 ? _remoteUser$name : '');
-                      res.status(_core.HTTP_STATUS.CREATED);
-                      res.set(_core.HEADERS.CACHE_CONTROL, 'no-cache, no-store');
-                      res.json({
-                        ok: message,
-                        token: token
-                      });
-                    case 6:
-                      return _context3.a(2);
-                  }
-                }, _callee3);
-              }));
-              function callbackAuthenticate(_x9, _x0) {
-                return _callbackAuthenticate.apply(this, arguments);
-              }
-              return callbackAuthenticate;
-            }());
-          case 3:
-            return _context4.a(2);
-        }
-      }, _callee4);
-    }));
-    return function (_x6, _x7, _x8) {
-      return _ref3.apply(this, arguments);
-    };
-  }());
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_middleware = require("@verdaccio/middleware");
+let _verdaccio_core = require("@verdaccio/core");
+let _verdaccio_auth = require("@verdaccio/auth");
+let _verdaccio_config = require("@verdaccio/config");
+let node_crypto = require("node:crypto");
+//#region src/v1/login.ts
+var debug$1 = (0, debug.default)("verdaccio:api:login");
+var WEB_LOGIN_SESSION_ID = "web-login-sessionId";
+function login_default(route, auth, storage, config, logger) {
+	route.post(_verdaccio_middleware.LOGIN_API_ENDPOINTS.login, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), async function(req, res) {
+		const sessionId = (0, node_crypto.randomUUID)();
+		debug$1("creating login session %o", sessionId);
+		await storage.saveToken({
+			user: sessionId,
+			token: "",
+			key: WEB_LOGIN_SESSION_ID,
+			readonly: false,
+			created: (/* @__PURE__ */ new Date()).getTime()
+		});
+		res.status(_verdaccio_core.HTTP_STATUS.OK);
+		const protocol = req.protocol;
+		const host = req.hostname;
+		const port = req.socket.localPort;
+		const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${_verdaccio_middleware.LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;
+		const doneUrl = `${protocol}://${host}:${port}${_verdaccio_middleware.LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;
+		debug$1("loginUrl: %o", loginUrl);
+		debug$1("doneUrl: %o", doneUrl);
+		res.json({
+			loginUrl,
+			doneUrl
+		});
+	});
+	route.get(_verdaccio_middleware.LOGIN_API_ENDPOINTS.login_done_session, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), async function(req, res, next) {
+		debug$1("polling login session %o", req.params.sessionId);
+		if (!req.params.sessionId) {
+			debug$1("sessionId is missing");
+			return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.SESSION_ID_REQUIRED));
+		}
+		const sessionId = req.params.sessionId;
+		if (sessionId.length !== 36) {
+			debug$1("sessionId is invalid length: %o", sessionId.length);
+			return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.SESSION_ID_INVALID));
+		}
+		try {
+			const tokens = await storage.readTokens({ user: sessionId });
+			debug$1("tokens found for sessionId %o: %o", sessionId, tokens.length);
+			if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) if (tokens[0].token.length === 0) {
+				debug$1("waiting for authentication");
+				res.status(_verdaccio_core.HTTP_STATUS.ACCEPTED);
+				res.set(_verdaccio_core.HEADERS.RETRY_AFTER, "5");
+				res.json({});
+			} else {
+				debug$1("deleting session token");
+				await storage.deleteToken(sessionId, tokens[0].key);
+				if (new Date(tokens[0].created) < /* @__PURE__ */ new Date(Date.now() - 120 * 1e3)) {
+					debug$1("session token expired");
+					return next(_verdaccio_core.errorUtils.getUnauthorized(_verdaccio_core.API_ERROR.SESSION_TOKEN_EXPIRED));
+				}
+				debug$1("session token is valid, login successful");
+				res.status(_verdaccio_core.HTTP_STATUS.OK);
+				res.json({ token: tokens[0].token });
+			}
+			else return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.SESSION_ID_INVALID));
+		} catch (error) {
+			logger.error({ error: error.msg }, "token list has failed: @{error}");
+			return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.INTERNAL_ERROR, error.message));
+		}
+	});
+	route.post(_verdaccio_middleware.LOGIN_API_ENDPOINTS.login_cli_session, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), async function(req, res, next) {
+		const { username, password } = req.body;
+		debug$1("authenticating login session %o for user %o", req.params.sessionId, username);
+		if (!req.params.sessionId) {
+			debug$1("sessionId is missing");
+			return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.SESSION_ID_REQUIRED));
+		}
+		const sessionId = req.params.sessionId;
+		if (sessionId.length !== 36) {
+			debug$1("sessionId is invalid length: %o", sessionId.length);
+			return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.SESSION_ID_INVALID));
+		}
+		auth.authenticate(username, password, async function callbackAuthenticate(err, user) {
+			if (err) {
+				logger.trace({
+					username,
+					err
+				}, "authenticating for user @{username} failed. Error: @{err.message}");
+				return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.UNAUTHORIZED, err.message));
+			}
+			const remoteUser = (0, _verdaccio_config.createRemoteUser)(username, user?.groups || []);
+			const token = await (0, _verdaccio_auth.getApiToken)(auth, config, remoteUser, password);
+			if (!token) return next(_verdaccio_core.errorUtils.getUnauthorized());
+			debug$1("saving token for sessionId %o", sessionId);
+			await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);
+			await storage.saveToken({
+				user: sessionId,
+				token,
+				key: WEB_LOGIN_SESSION_ID,
+				readonly: false,
+				created: (/* @__PURE__ */ new Date()).getTime()
+			});
+			const message = _verdaccio_core.authUtils.getAuthenticatedMessage(remoteUser.name ?? "");
+			res.status(_verdaccio_core.HTTP_STATUS.CREATED);
+			res.set(_verdaccio_core.HEADERS.CACHE_CONTROL, "no-cache, no-store");
+			res.json({
+				ok: message,
+				token
+			});
+		});
+	});
 }
+//#endregion
+exports.default = login_default;
+
 //# sourceMappingURL=login.js.map

package/build/v1/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","names":["_debug","_interopRequireDefault","require","_nodeCrypto","_auth","_config","_core","_middleware","e","__esModule","_regenerator","t","r","Symbol","n","iterator","o","toStringTag","i","c","prototype","Generator","u","Object","create","_regeneratorDefine2","f","p","y","G","v","a","d","bind","length","l","TypeError","call","done","value","GeneratorFunction","GeneratorFunctionPrototype","getPrototypeOf","setPrototypeOf","__proto__","displayName","w","m","defineProperty","_regeneratorDefine","_invoke","enumerable","configurable","writable","asyncGeneratorStep","Promise","resolve","then","_asyncToGenerator","arguments","apply","_next","_throw","debug","buildDebug","WEB_LOGIN_SESSION_ID","_default","route","auth","storage","config","logger","post","LOGIN_API_ENDPOINTS","login","rateLimit","userRateLimit","_ref","_callee","req","res","sessionId","protocol","host","port","loginUrl","doneUrl","_context","randomUUID","saveToken","user","token","key","readonly","created","Date","getTime","status","HTTP_STATUS","OK","hostname","socket","localPort","concat","login_cli","login_done","json","_x","_x2","get","login_done_session","_ref2","_callee2","next","tokens","tokenCreatedDate","minutesAgo","_t","_context2","params","errorUtils","getCode","BAD_REQUEST","API_ERROR","SESSION_ID_REQUIRED","SESSION_ID_INVALID","readTokens","ACCEPTED","set","HEADERS","RETRY_AFTER","deleteToken","now","getUnauthorized","SESSION_TOKEN_EXPIRED","error","msg","INTERNAL_ERROR","message","_x3","_x4","_x5","login_cli_session","_ref3","_callee4","_req$body","username","password","_context4","body","authenticate","_callbackAuthenticate","_callee3","err","_remoteUser$name","remoteUser","_context3","trace","UNAUTHORIZED","createRemoteUser","groups","getApiToken","authUtils","getAuthenticatedMessage","name","CREATED","CACHE_CONTROL","ok","callbackAuthenticate","_x9","_x0","_x6","_x7","_x8"],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,WAAA,GAAAD,OAAA;AAGA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AAAuE,SAAAD,uBAAAO,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,gBAAAA,CAAA;AAAA,SAAAE,aAAA,IAPvE,uKAAAF,CAAA,EAAAG,CAAA,EAAAC,CAAA,wBAAAC,MAAA,GAAAA,MAAA,OAAAC,CAAA,GAAAF,CAAA,CAAAG,QAAA,kBAAAC,CAAA,GAAAJ,CAAA,CAAAK,WAAA,8BAAAC,EAAAN,CAAA,EAAAE,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAC,CAAA,GAAAL,CAAA,IAAAA,CAAA,CAAAM,SAAA,YAAAC,SAAA,GAAAP,CAAA,GAAAO,SAAA,EAAAC,CAAA,GAAAC,MAAA,CAAAC,MAAA,CAAAL,CAAA,CAAAC,SAAA,UAAAK,mBAAA,CAAAH,CAAA,uBAAAV,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAE,CAAA,EAAAC,CAAA,EAAAG,CAAA,EAAAI,CAAA,MAAAC,CAAA,GAAAX,CAAA,QAAAY,CAAA,OAAAC,CAAA,KAAAF,CAAA,KAAAb,CAAA,KAAAgB,CAAA,EAAAtB,CAAA,EAAAuB,CAAA,EAAAC,CAAA,EAAAN,CAAA,EAAAM,CAAA,CAAAC,IAAA,CAAAzB,CAAA,MAAAwB,CAAA,WAAAA,EAAArB,CAAA,EAAAC,CAAA,WAAAM,CAAA,GAAAP,CAAA,EAAAQ,CAAA,MAAAG,CAAA,GAAAd,CAAA,EAAAqB,CAAA,CAAAf,CAAA,GAAAF,CAAA,EAAAmB,CAAA,gBAAAC,EAAApB,CAAA,EAAAE,CAAA,SAAAK,CAAA,GAAAP,CAAA,EAAAU,CAAA,GAAAR,CAAA,EAAAH,CAAA,OAAAiB,CAAA,IAAAF,CAAA,KAAAV,CAAA,IAAAL,CAAA,GAAAgB,CAAA,CAAAO,MAAA,EAAAvB,CAAA,UAAAK,CAAA,EAAAE,CAAA,GAAAS,CAAA,CAAAhB,CAAA,GAAAqB,CAAA,GAAAH,CAAA,CAAAF,CAAA,EAAAQ,CAAA,GAAAjB,CAAA,KAAAN,CAAA,QAAAI,CAAA,GAAAmB,CAAA,KAAArB,CAAA,MAAAQ,CAAA,GAAAJ,CAAA,EAAAC,CAAA,GAAAD,CAAA,YAAAC,CAAA,WAAAD,CAAA,MAAAA,CAAA,MAAAV,CAAA,IAAAU,CAAA,OAAAc,CAAA,MAAAhB,CAAA,GAAAJ,CAAA,QAAAoB,CAAA,GAAAd,CAAA,QAAAC,CAAA,MAAAU,CAAA,CAAAC,CAAA,GAAAhB,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAI,CAAA,OAAAc,CAAA,GAAAG,CAAA,KAAAnB,CAAA,GAAAJ,CAAA,QAAAM,CAAA,MAAAJ,CAAA,IAAAA,CAAA,GAAAqB,CAAA,MAAAjB,CAAA,MAAAN,CAAA,EAAAM,CAAA,MAAAJ,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAqB,CAAA,EAAAhB,CAAA,cAAAH,CAAA,IAAAJ,CAAA,aAAAmB,CAAA,QAAAH,CAAA,OAAAd,CAAA,qBAAAE,CAAA,EAAAW,CAAA,EAAAQ,CAAA,QAAAT,CAAA,YAAAU,SAAA,uCAAAR,CAAA,UAAAD,CAAA,IAAAK,CAAA,CAAAL,CAAA,EAAAQ,CAAA,GAAAhB,CAAA,GAAAQ,CAAA,EAAAL,CAAA,GAAAa,CAAA,GAAAxB,CAAA,GAAAQ,CAAA,OAAAX,CAAA,GAAAc,CAAA,MAAAM,CAAA,KAAAV,CAAA,KAAAC,CAAA,GAAAA,CAAA,QAAAA,CAAA,SAAAU,CAAA,CAAAf,CAAA,QAAAkB,CAAA,CAAAb,CAAA,EAAAG,CAAA,KAAAO,CAAA,CAAAf,CAAA,GAAAQ,CAAA,GAAAO,CAAA,CAAAC,CAAA,GAAAR,CAAA,aAAAI,CAAA,MAAAR,CAAA,QAAAC,CAAA,KAAAH,CAAA,YAAAL,CAAA,GAAAO,CAAA,CAAAF,CAAA,WAAAL,CAAA,GAAAA,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,EAAAI,CAAA,UAAAc,SAAA,2CAAAzB,CAAA,CAAA2B,IAAA,SAAA3B,CAAA,EAAAW,CAAA,GAAAX,CAAA,CAAA4B,KAAA,EAAApB,CAAA,SAAAA,CAAA,oBAAAA,CAAA,KAAAR,CAAA,GAAAO,CAAA,eAAAP,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,GAAAC,CAAA,SAAAG,CAAA,GAAAc,SAAA,uCAAApB,CAAA,gBAAAG,CAAA,OAAAD,CAAA,GAAAV,CAAA,cAAAG,CAAA,IAAAiB,CAAA,GAAAC,CAAA,CAAAf,CAAA,QAAAQ,CAAA,GAAAV,CAAA,CAAAyB,IAAA,CAAAvB,CAAA,EAAAe,CAAA,OAAAE,CAAA,kBAAApB,CAAA,IAAAO,CAAA,GAAAV,CAAA,EAAAW,CAAA,MAAAG,CAAA,GAAAX,CAAA,cAAAe,CAAA,mBAAAa,KAAA,EAAA5B,CAAA,EAAA2B,IAAA,EAAAV,CAAA,SAAAhB,CAAA,EAAAI,CAAA,EAAAE,CAAA,QAAAI,CAAA,QAAAS,CAAA,gBAAAV,UAAA,cAAAmB,kBAAA,cAAAC,2BAAA,KAAA9B,CAAA,GAAAY,MAAA,CAAAmB,cAAA,MAAAvB,CAAA,MAAAL,CAAA,IAAAH,CAAA,CAAAA,CAAA,IAAAG,CAAA,SAAAW,mBAAA,CAAAd,CAAA,OAAAG,CAAA,iCAAAH,CAAA,GAAAW,CAAA,GAAAmB,0BAAA,CAAArB,SAAA,GAAAC,SAAA,CAAAD,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAL,CAAA,YAAAO,EAAAlB,CAAA,WAAAe,MAAA,CAAAoB,cAAA,GAAApB,MAAA,CAAAoB,cAAA,CAAAnC,CAAA,EAAAiC,0BAAA,KAAAjC,CAAA,CAAAoC,SAAA,GAAAH,0BAAA,EAAAhB,mBAAA,CAAAjB,CAAA,EAAAQ,CAAA,yBAAAR,CAAA,CAAAY,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAF,CAAA,GAAAd,CAAA,WAAAgC,iBAAA,CAAApB,SAAA,GAAAqB,0BAAA,EAAAhB,mBAAA,CAAAH,CAAA,iBAAAmB,0BAAA,GAAAhB,mBAAA,CAAAgB,0BAAA,iBAAAD,iBAAA,GAAAA,iBAAA,CAAAK,WAAA,wBAAApB,mBAAA,CAAAgB,0BAAA,EAAAzB,CAAA,wBAAAS,mBAAA,CAAAH,CAAA,GAAAG,mBAAA,CAAAH,CAAA,EAAAN,CAAA,gBAAAS,mBAAA,CAAAH,CAAA,EAAAR,CAAA,iCAAAW,mBAAA,CAAAH,CAAA,8DAAAZ,YAAA,YAAAA,aAAA,aAAAoC,CAAA,EAAA5B,CAAA,EAAA6B,CAAA,EAAArB,CAAA;AAAA,SAAAD,oBAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,QAAAO,CAAA,GAAAK,MAAA,CAAAyB,cAAA,QAAA9B,CAAA,uBAAAV,CAAA,IAAAU,CAAA,QAAAO,mBAAA,YAAAwB,mBAAAzC,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,aAAAK,EAAAJ,CAAA,EAAAE,CAAA,IAAAW,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,YAAAJ,CAAA,gBAAA0C,OAAA,CAAAtC,CAAA,EAAAE,CAAA,EAAAN,CAAA,SAAAI,CAAA,GAAAM,CAAA,GAAAA,CAAA,CAAAV,CAAA,EAAAI,CAAA,IAAA2B,KAAA,EAAAzB,CAAA,EAAAqC,UAAA,GAAAxC,CAAA,EAAAyC,YAAA,GAAAzC,CAAA,EAAA0C,QAAA,GAAA1C,CAAA,MAAAH,CAAA,CAAAI,CAAA,IAAAE,CAAA,IAAAE,CAAA,aAAAA,CAAA,cAAAA,CAAA,mBAAAS,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA;AAAA,SAAA2C,mBAAAxC,CAAA,EAAAH,CAAA,EAAAH,CAAA,EAAAI,CAAA,EAAAI,CAAA,EAAAe,CAAA,EAAAZ,CAAA,cAAAD,CAAA,GAAAJ,CAAA,CAAAiB,CAAA,EAAAZ,CAAA,GAAAG,CAAA,GAAAJ,CAAA,CAAAqB,KAAA,WAAAzB,CAAA,gBAAAN,CAAA,CAAAM,CAAA,KAAAI,CAAA,CAAAoB,IAAA,GAAA3B,CAAA,CAAAW,CAAA,IAAAiC,OAAA,CAAAC,OAAA,CAAAlC,CAAA,EAAAmC,IAAA,CAAA7C,CAAA,EAAAI,CAAA;AAAA,SAAA0C,kBAAA5C,CAAA,6BAAAH,CAAA,SAAAH,CAAA,GAAAmD,SAAA,aAAAJ,OAAA,WAAA3C,CAAA,EAAAI,CAAA,QAAAe,CAAA,GAAAjB,CAAA,CAAA8C,KAAA,CAAAjD,CAAA,EAAAH,CAAA,YAAAqD,MAAA/C,CAAA,IAAAwC,kBAAA,CAAAvB,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA6C,KAAA,EAAAC,MAAA,UAAAhD,CAAA,cAAAgD,OAAAhD,CAAA,IAAAwC,kBAAA,CAAAvB,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA6C,KAAA,EAAAC,MAAA,WAAAhD,CAAA,KAAA+C,KAAA;AAaA,IAAME,KAAK,GAAG,IAAAC,iBAAU,EAAC,qBAAqB,CAAC;AAE/C,IAAMC,oBAAoB,GAAG,qBAAqB;;AAElD;AACe,SAAAC,SACbC,KAAa,EACbC,IAAU,EACVC,OAAgB,EAChBC,MAAc,EACdC,MAAc,EACR;EACNJ,KAAK,CAACK,IAAI,CACRC,+BAAmB,CAACC,KAAK,EACzB,IAAAC,qBAAS,EAACL,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEM,aAAa,CAAC;IAAA,IAAAC,IAAA,GAAAnB,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAChC,SAAA+B,QAAgBC,GAAmB,EAAEC,GAAa;MAAA,IAAAC,SAAA,EAAAC,QAAA,EAAAC,IAAA,EAAAC,IAAA,EAAAC,QAAA,EAAAC,OAAA;MAAA,OAAA5E,YAAA,GAAAoC,CAAA,WAAAyC,QAAA;QAAA,kBAAAA,QAAA,CAAAzE,CAAA;UAAA;YAChD;YACMmE,SAAS,GAAG,IAAAO,sBAAU,EAAC,CAAC;YAC9BzB,KAAK,CAAC,2BAA2B,EAAEkB,SAAS,CAAC;YAACM,QAAA,CAAAzE,CAAA;YAAA,OAExCuD,OAAO,CAACoB,SAAS,CAAC;cACtBC,IAAI,EAAET,SAAS;cACfU,KAAK,EAAE,EAAE;cACTC,GAAG,EAAE3B,oBAAoB;cACzB4B,QAAQ,EAAE,KAAK;cACfC,OAAO,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,OAAO,CAAC;YAC9B,CAAC,CAAC;UAAA;YAEFhB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;;YAE1B;YACMjB,QAAQ,GAAGH,GAAG,CAACG,QAAQ;YACvBC,IAAI,GAAGJ,GAAG,CAACqB,QAAQ;YACnBhB,IAAI,GAAGL,GAAG,CAACsB,MAAM,CAACC,SAAS;YAE3BjB,QAAQ,MAAAkB,MAAA,CAAMrB,QAAQ,SAAAqB,MAAA,CAAMpB,IAAI,OAAAoB,MAAA,CAAInB,IAAI,wBAAAmB,MAAA,CAAqB9B,+BAAmB,CAAC+B,SAAS,OAAAD,MAAA,CAAItB,SAAS;YACvGK,OAAO,MAAAiB,MAAA,CAAMrB,QAAQ,SAAAqB,MAAA,CAAMpB,IAAI,OAAAoB,MAAA,CAAInB,IAAI,EAAAmB,MAAA,CAAG9B,+BAAmB,CAACgC,UAAU,OAAAF,MAAA,CAAItB,SAAS;YAC3FlB,KAAK,CAAC,cAAc,EAAEsB,QAAQ,CAAC;YAC/BtB,KAAK,CAAC,aAAa,EAAEuB,OAAO,CAAC;YAE7BN,GAAG,CAAC0B,IAAI,CAAC;cACPrB,QAAQ,EAARA,QAAQ;cACRC,OAAO,EAAPA;YACF,CAAC,CAAC;UAAC;YAAA,OAAAC,QAAA,CAAAxD,CAAA;QAAA;MAAA,GAAA+C,OAAA;IAAA,CACJ;IAAA,iBAAA6B,EAAA,EAAAC,GAAA;MAAA,OAAA/B,IAAA,CAAAjB,KAAA,OAAAD,SAAA;IAAA;EAAA,GACH,CAAC;EAEDQ,KAAK,CAAC0C,GAAG,CACPpC,+BAAmB,CAACqC,kBAAkB,EACtC,IAAAnC,qBAAS,EAACL,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEM,aAAa,CAAC;IAAA,IAAAmC,KAAA,GAAArD,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAChC,SAAAiE,SAAgBjC,GAAmB,EAAEC,GAAa,EAAEiC,IAAsB;MAAA,IAAAhC,SAAA,EAAAiC,MAAA,EAAAC,gBAAA,EAAAC,UAAA,EAAAC,EAAA;MAAA,OAAA3G,YAAA,GAAAoC,CAAA,WAAAwE,SAAA;QAAA,kBAAAA,SAAA,CAAA3F,CAAA,GAAA2F,SAAA,CAAAxG,CAAA;UAAA;YACxEiD,KAAK,CAAC,0BAA0B,EAAEgB,GAAG,CAACwC,MAAM,CAACtC,SAAS,CAAC;YAAC,IAEnDF,GAAG,CAACwC,MAAM,CAACtC,SAAS;cAAAqC,SAAA,CAAAxG,CAAA;cAAA;YAAA;YACvBiD,KAAK,CAAC,sBAAsB,CAAC;YAAC,OAAAuD,SAAA,CAAAvF,CAAA,IACvBkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACC,mBAAmB,CAAC,CAAC;UAAA;YAEnF3C,SAAS,GAAGF,GAAG,CAACwC,MAAM,CAACtC,SAAS;YAAA,MAClCA,SAAS,CAAC/C,MAAM,KAAK,EAAE;cAAAoF,SAAA,CAAAxG,CAAA;cAAA;YAAA;YACzBiD,KAAK,CAAC,iCAAiC,EAAEkB,SAAS,CAAC/C,MAAM,CAAC;YAAC,OAAAoF,SAAA,CAAAvF,CAAA,IACpDkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACE,kBAAkB,CAAC,CAAC;UAAA;YAAAP,SAAA,CAAA3F,CAAA;YAAA2F,SAAA,CAAAxG,CAAA;YAAA,OAIjEuD,OAAO,CAACyD,UAAU,CAAC;cAAEpC,IAAI,EAAET;YAAU,CAAC,CAAC;UAAA;YAAtDiC,MAAM,GAAAI,SAAA,CAAAxF,CAAA;YACZiC,KAAK,CAAC,mCAAmC,EAAEkB,SAAS,EAAEiC,MAAM,CAAChF,MAAM,CAAC;YAAC,MACjEgF,MAAM,IAAIA,MAAM,CAAChF,MAAM,KAAK,CAAC,IAAIgF,MAAM,CAAC,CAAC,CAAC,CAACtB,GAAG,KAAK3B,oBAAoB;cAAAqD,SAAA,CAAAxG,CAAA;cAAA;YAAA;YAAA,MACrEoG,MAAM,CAAC,CAAC,CAAC,CAACvB,KAAK,CAACzD,MAAM,KAAK,CAAC;cAAAoF,SAAA,CAAAxG,CAAA;cAAA;YAAA;YAC9BiD,KAAK,CAAC,4BAA4B,CAAC;YACnC;YACA;YACAiB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAAC6B,QAAQ,CAAC;YAChC/C,GAAG,CAACgD,GAAG,CAACC,aAAO,CAACC,WAAW,EAAE,GAAG,CAAC;YACjClD,GAAG,CAAC0B,IAAI,CAAC,CAAC,CAAC,CAAC;YAACY,SAAA,CAAAxG,CAAA;YAAA;UAAA;YAEb;YACAiD,KAAK,CAAC,wBAAwB,CAAC;YAACuD,SAAA,CAAAxG,CAAA;YAAA,OAC1BuD,OAAO,CAAC8D,WAAW,CAAClD,SAAS,EAAEiC,MAAM,CAAC,CAAC,CAAC,CAACtB,GAAG,CAAC;UAAA;YAEnD;YACA;YACMuB,gBAAgB,GAAG,IAAIpB,IAAI,CAACmB,MAAM,CAAC,CAAC,CAAC,CAACpB,OAAO,CAAC;YAC9CsB,UAAU,GAAG,IAAIrB,IAAI,CAACA,IAAI,CAACqC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAA,MACnDjB,gBAAgB,GAAGC,UAAU;cAAAE,SAAA,CAAAxG,CAAA;cAAA;YAAA;YAC/BiD,KAAK,CAAC,uBAAuB,CAAC;YAAC,OAAAuD,SAAA,CAAAvF,CAAA,IACxBkF,IAAI,CAACO,gBAAU,CAACa,eAAe,CAACV,eAAS,CAACW,qBAAqB,CAAC,CAAC;UAAA;YAG1EvE,KAAK,CAAC,0CAA0C,CAAC;YAEjDiB,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACC,EAAE,CAAC;YAC1BnB,GAAG,CAAC0B,IAAI,CAAC;cAAEf,KAAK,EAAEuB,MAAM,CAAC,CAAC,CAAC,CAACvB;YAAM,CAAC,CAAC;UAAC;YAAA2B,SAAA,CAAAxG,CAAA;YAAA;UAAA;YAAA,OAAAwG,SAAA,CAAAvF,CAAA,IAGhCkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACE,kBAAkB,CAAC,CAAC;UAAA;YAAAP,SAAA,CAAAxG,CAAA;YAAA;UAAA;YAAAwG,SAAA,CAAA3F,CAAA;YAAA0F,EAAA,GAAAC,SAAA,CAAAxF,CAAA;YAGxFyC,MAAM,CAACgE,KAAK,CAAC;cAAEA,KAAK,EAAElB,EAAA,CAAMmB;YAAI,CAAC,EAAE,iCAAiC,CAAC;YAAC,OAAAlB,SAAA,CAAAvF,CAAA,IAC/DkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAACuC,cAAc,EAAEpB,EAAA,CAAMqB,OAAO,CAAC,CAAC;UAAA;YAAA,OAAApB,SAAA,CAAAvF,CAAA;QAAA;MAAA,GAAAiF,QAAA;IAAA,CAE7E;IAAA,iBAAA2B,GAAA,EAAAC,GAAA,EAAAC,GAAA;MAAA,OAAA9B,KAAA,CAAAnD,KAAA,OAAAD,SAAA;IAAA;EAAA,GACH,CAAC;EAEDQ,KAAK,CAACK,IAAI,CACRC,+BAAmB,CAACqE,iBAAiB,EACrC,IAAAnE,qBAAS,EAACL,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEM,aAAa,CAAC;IAAA,IAAAmE,KAAA,GAAArF,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAChC,SAAAiG,SAAgBjE,GAAmB,EAAEC,GAAa,EAAEiC,IAAsB;MAAA,IAAAgC,SAAA,EAAAC,QAAA,EAAAC,QAAA,EAAAlE,SAAA;MAAA,OAAAvE,YAAA,GAAAoC,CAAA,WAAAsG,SAAA;QAAA,kBAAAA,SAAA,CAAAtI,CAAA;UAAA;YAAAmI,SAAA,GACzClE,GAAG,CAACsE,IAAI,EAA/BH,QAAQ,GAAAD,SAAA,CAARC,QAAQ,EAAEC,QAAQ,GAAAF,SAAA,CAARE,QAAQ;YAC1BpF,KAAK,CAAC,6CAA6C,EAAEgB,GAAG,CAACwC,MAAM,CAACtC,SAAS,EAAEiE,QAAQ,CAAC;YAAC,IAEhFnE,GAAG,CAACwC,MAAM,CAACtC,SAAS;cAAAmE,SAAA,CAAAtI,CAAA;cAAA;YAAA;YACvBiD,KAAK,CAAC,sBAAsB,CAAC;YAAC,OAAAqF,SAAA,CAAArH,CAAA,IACvBkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACC,mBAAmB,CAAC,CAAC;UAAA;YAEnF3C,SAAS,GAAGF,GAAG,CAACwC,MAAM,CAACtC,SAAS;YAAA,MAClCA,SAAS,CAAC/C,MAAM,KAAK,EAAE;cAAAkH,SAAA,CAAAtI,CAAA;cAAA;YAAA;YACzBiD,KAAK,CAAC,iCAAiC,EAAEkB,SAAS,CAAC/C,MAAM,CAAC;YAAC,OAAAkH,SAAA,CAAArH,CAAA,IACpDkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACE,kBAAkB,CAAC,CAAC;UAAA;YAGxFzD,IAAI,CAACkF,YAAY,CACfJ,QAAQ,EACRC,QAAQ;cAAA,IAAAI,qBAAA,GAAA7F,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CACR,SAAAyG,SAAoCC,GAAG,EAAE/D,IAAI;gBAAA,IAAAgE,gBAAA;gBAAA,IAAAC,UAAA,EAAAhE,KAAA,EAAA+C,OAAA;gBAAA,OAAAhI,YAAA,GAAAoC,CAAA,WAAA8G,SAAA;kBAAA,kBAAAA,SAAA,CAAA9I,CAAA;oBAAA;sBAAA,KACvC2I,GAAG;wBAAAG,SAAA,CAAA9I,CAAA;wBAAA;sBAAA;sBACLyD,MAAM,CAACsF,KAAK,CACV;wBAAEX,QAAQ,EAARA,QAAQ;wBAAEO,GAAG,EAAHA;sBAAI,CAAC,EACjB,mEACF,CAAC;sBAAC,OAAAG,SAAA,CAAA7H,CAAA,IACKkF,IAAI,CAACO,gBAAU,CAACC,OAAO,CAACvB,iBAAW,CAAC4D,YAAY,EAAEL,GAAG,CAACf,OAAO,CAAC,CAAC;oBAAA;sBAGlEiB,UAAU,GAAG,IAAAI,wBAAgB,EAACb,QAAQ,EAAE,CAAAxD,IAAI,aAAJA,IAAI,uBAAJA,IAAI,CAAEsE,MAAM,KAAI,EAAE,CAAC;sBAAAJ,SAAA,CAAA9I,CAAA;sBAAA,OAC7C,IAAAmJ,iBAAW,EAAC7F,IAAI,EAAEE,MAAM,EAAEqF,UAAU,EAAER,QAAQ,CAAC;oBAAA;sBAA7DxD,KAAK,GAAAiE,SAAA,CAAA9H,CAAA;sBAAA,IAEN6D,KAAK;wBAAAiE,SAAA,CAAA9I,CAAA;wBAAA;sBAAA;sBAAA,OAAA8I,SAAA,CAAA7H,CAAA,IACDkF,IAAI,CAACO,gBAAU,CAACa,eAAe,CAAC,CAAC,CAAC;oBAAA;sBAG3C;sBACAtE,KAAK,CAAC,+BAA+B,EAAEkB,SAAS,CAAC;sBAAC2E,SAAA,CAAA9I,CAAA;sBAAA,OAC5CuD,OAAO,CAAC8D,WAAW,CAAClD,SAAS,EAAEhB,oBAAoB,CAAC;oBAAA;sBAAA2F,SAAA,CAAA9I,CAAA;sBAAA,OACpDuD,OAAO,CAACoB,SAAS,CAAC;wBACtBC,IAAI,EAAET,SAAS;wBACfU,KAAK,EAALA,KAAK;wBACLC,GAAG,EAAE3B,oBAAoB;wBACzB4B,QAAQ,EAAE,KAAK;wBACfC,OAAO,EAAE,IAAIC,IAAI,CAAC,CAAC,CAACC,OAAO,CAAC;sBAC9B,CAAC,CAAC;oBAAA;sBAEI0C,OAAO,GAAGwB,eAAS,CAACC,uBAAuB,EAAAT,gBAAA,GAACC,UAAU,CAACS,IAAI,cAAAV,gBAAA,cAAAA,gBAAA,GAAI,EAAE,CAAC;sBAExE1E,GAAG,CAACiB,MAAM,CAACC,iBAAW,CAACmE,OAAO,CAAC;sBAC/BrF,GAAG,CAACgD,GAAG,CAACC,aAAO,CAACqC,aAAa,EAAE,oBAAoB,CAAC;sBACpDtF,GAAG,CAAC0B,IAAI,CAAC;wBAAE6D,EAAE,EAAE7B,OAAO;wBAAE/C,KAAK,EAALA;sBAAM,CAAC,CAAC;oBAAC;sBAAA,OAAAiE,SAAA,CAAA7H,CAAA;kBAAA;gBAAA,GAAAyH,QAAA;cAAA,CAClC;cAAA,SAhCcgB,oBAAoBA,CAAAC,GAAA,EAAAC,GAAA;gBAAA,OAAAnB,qBAAA,CAAA3F,KAAA,OAAAD,SAAA;cAAA;cAAA,OAApB6G,oBAAoB;YAAA,GAiCrC,CAAC;UAAC;YAAA,OAAApB,SAAA,CAAArH,CAAA;QAAA;MAAA,GAAAiH,QAAA;IAAA,CACH;IAAA,iBAAA2B,GAAA,EAAAC,GAAA,EAAAC,GAAA;MAAA,OAAA9B,KAAA,CAAAnF,KAAA,OAAAD,SAAA;IAAA;EAAA,GACH,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"login.js","names":[],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;;;;AAcA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;AAE/C,IAAM,uBAAuB;AAG7B,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;AACN,OAAM,KACJ,sBAAA,oBAAoB,QAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAA8B;EAEjE,MAAM,aAAA,GAAA,YAAA,aAAwB;AAC9B,UAAM,6BAA6B,UAAU;AAE7C,QAAM,QAAQ,UAAU;GACtB,MAAM;GACN,OAAO;GACP,KAAK;GACL,UAAU;GACV,0BAAS,IAAI,MAAM,EAAC,SAAS;GAC9B,CAAC;AAEF,MAAI,OAAO,gBAAA,YAAY,GAAG;EAG1B,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,OAAO,IAAI,OAAO;EAExB,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK,oBAAoB,sBAAA,oBAAoB,UAAU,GAAG;EACpG,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,GAAG,OAAO,sBAAA,oBAAoB,WAAW,GAAG;AAClF,UAAM,gBAAgB,SAAS;AAC/B,UAAM,eAAe,QAAQ;AAE7B,MAAI,KAAK;GACP;GACA;GACD,CAAC;GAEL;AAED,OAAM,IACJ,sBAAA,oBAAoB,qBAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;AACzF,UAAM,4BAA4B,IAAI,OAAO,UAAU;AAEvD,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,WAAM,uBAAuB;AAC7B,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,WAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;;AAGxF,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,WAAM,qCAAqC,WAAW,OAAO,OAAO;AACpE,OAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,qBACrD,KAAI,OAAO,GAAG,MAAM,WAAW,GAAG;AAChC,YAAM,6BAA6B;AAGnC,QAAI,OAAO,gBAAA,YAAY,SAAS;AAChC,QAAI,IAAI,gBAAA,QAAQ,aAAa,IAAI;AACjC,QAAI,KAAK,EAAE,CAAC;UACP;AAEL,YAAM,yBAAyB;AAC/B,UAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,IAAI;AAMnD,QAFyB,IAAI,KAAK,OAAO,GAAG,QAAQ,mBACjC,IAAI,KAAK,KAAK,KAAK,GAAG,MAAS,IAAK,EACpB;AACjC,aAAM,wBAAwB;AAC9B,YAAO,KAAK,gBAAA,WAAW,gBAAgB,gBAAA,UAAU,sBAAsB,CAAC;;AAG1E,YAAM,2CAA2C;AAEjD,QAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,QAAI,KAAK,EAAE,OAAO,OAAO,GAAG,OAAO,CAAC;;OAGtC,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;WAEjF,OAAY;AACnB,UAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,kCAAkC;AACrE,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;GAG/E;AAED,OAAM,KACJ,sBAAA,oBAAoB,oBAAA,GAAA,sBAAA,WACV,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,EAAE,UAAU,aAAa,IAAI;AACnC,UAAM,+CAA+C,IAAI,OAAO,WAAW,SAAS;AAEpF,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,WAAM,uBAAuB;AAC7B,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,WAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;;AAGxF,OAAK,aACH,UACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;AAC5D,OAAI,KAAK;AACP,WAAO,MACL;KAAE;KAAU;KAAK,EACjB,oEACD;AACD,WAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,IAAI,QAAQ,CAAC;;GAGxE,MAAM,cAAA,GAAA,kBAAA,kBAA8B,UAAU,MAAM,UAAU,EAAE,CAAC;GACjE,MAAM,QAAQ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,YAAY,SAAS;AAEnE,OAAI,CAAC,MACH,QAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;AAI3C,WAAM,iCAAiC,UAAU;AACjD,SAAM,QAAQ,YAAY,WAAW,qBAAqB;AAC1D,SAAM,QAAQ,UAAU;IACtB,MAAM;IACN;IACA,KAAK;IACL,UAAU;IACV,0BAAS,IAAI,MAAM,EAAC,SAAS;IAC9B,CAAC;GAEF,MAAM,UAAU,gBAAA,UAAU,wBAAwB,WAAW,QAAQ,GAAG;AAExE,OAAI,OAAO,gBAAA,YAAY,QAAQ;AAC/B,OAAI,IAAI,gBAAA,QAAQ,eAAe,qBAAqB;AACpD,OAAI,KAAK;IAAE,IAAI;IAAS;IAAO,CAAC;IAEnC;GAEJ"}

package/build/v1/login.mjs

@@ -0,0 +1,115 @@
+import buildDebug from "debug";
+import { LOGIN_API_ENDPOINTS, rateLimit } from "@verdaccio/middleware";
+import { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from "@verdaccio/core";
+import { getApiToken } from "@verdaccio/auth";
+import { createRemoteUser } from "@verdaccio/config";
+import { randomUUID } from "node:crypto";
+//#region src/v1/login.ts
+var debug = buildDebug("verdaccio:api:login");
+var WEB_LOGIN_SESSION_ID = "web-login-sessionId";
+function login_default(route, auth, storage, config, logger) {
+	route.post(LOGIN_API_ENDPOINTS.login, rateLimit(config?.userRateLimit), async function(req, res) {
+		const sessionId = randomUUID();
+		debug("creating login session %o", sessionId);
+		await storage.saveToken({
+			user: sessionId,
+			token: "",
+			key: WEB_LOGIN_SESSION_ID,
+			readonly: false,
+			created: (/* @__PURE__ */ new Date()).getTime()
+		});
+		res.status(HTTP_STATUS.OK);
+		const protocol = req.protocol;
+		const host = req.hostname;
+		const port = req.socket.localPort;
+		const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;
+		const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;
+		debug("loginUrl: %o", loginUrl);
+		debug("doneUrl: %o", doneUrl);
+		res.json({
+			loginUrl,
+			doneUrl
+		});
+	});
+	route.get(LOGIN_API_ENDPOINTS.login_done_session, rateLimit(config?.userRateLimit), async function(req, res, next) {
+		debug("polling login session %o", req.params.sessionId);
+		if (!req.params.sessionId) {
+			debug("sessionId is missing");
+			return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));
+		}
+		const sessionId = req.params.sessionId;
+		if (sessionId.length !== 36) {
+			debug("sessionId is invalid length: %o", sessionId.length);
+			return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));
+		}
+		try {
+			const tokens = await storage.readTokens({ user: sessionId });
+			debug("tokens found for sessionId %o: %o", sessionId, tokens.length);
+			if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) if (tokens[0].token.length === 0) {
+				debug("waiting for authentication");
+				res.status(HTTP_STATUS.ACCEPTED);
+				res.set(HEADERS.RETRY_AFTER, "5");
+				res.json({});
+			} else {
+				debug("deleting session token");
+				await storage.deleteToken(sessionId, tokens[0].key);
+				if (new Date(tokens[0].created) < /* @__PURE__ */ new Date(Date.now() - 120 * 1e3)) {
+					debug("session token expired");
+					return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));
+				}
+				debug("session token is valid, login successful");
+				res.status(HTTP_STATUS.OK);
+				res.json({ token: tokens[0].token });
+			}
+			else return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));
+		} catch (error) {
+			logger.error({ error: error.msg }, "token list has failed: @{error}");
+			return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));
+		}
+	});
+	route.post(LOGIN_API_ENDPOINTS.login_cli_session, rateLimit(config?.userRateLimit), async function(req, res, next) {
+		const { username, password } = req.body;
+		debug("authenticating login session %o for user %o", req.params.sessionId, username);
+		if (!req.params.sessionId) {
+			debug("sessionId is missing");
+			return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));
+		}
+		const sessionId = req.params.sessionId;
+		if (sessionId.length !== 36) {
+			debug("sessionId is invalid length: %o", sessionId.length);
+			return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));
+		}
+		auth.authenticate(username, password, async function callbackAuthenticate(err, user) {
+			if (err) {
+				logger.trace({
+					username,
+					err
+				}, "authenticating for user @{username} failed. Error: @{err.message}");
+				return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));
+			}
+			const remoteUser = createRemoteUser(username, user?.groups || []);
+			const token = await getApiToken(auth, config, remoteUser, password);
+			if (!token) return next(errorUtils.getUnauthorized());
+			debug("saving token for sessionId %o", sessionId);
+			await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);
+			await storage.saveToken({
+				user: sessionId,
+				token,
+				key: WEB_LOGIN_SESSION_ID,
+				readonly: false,
+				created: (/* @__PURE__ */ new Date()).getTime()
+			});
+			const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? "");
+			res.status(HTTP_STATUS.CREATED);
+			res.set(HEADERS.CACHE_CONTROL, "no-cache, no-store");
+			res.json({
+				ok: message,
+				token
+			});
+		});
+	});
+}
+//#endregion
+export { login_default as default };
+
+//# sourceMappingURL=login.mjs.map

package/build/v1/login.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.mjs","names":[],"sources":["../../src/v1/login.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\nimport { randomUUID } from 'node:crypto';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { createRemoteUser } from '@verdaccio/config';\nimport { API_ERROR, HEADERS, HTTP_STATUS, authUtils, errorUtils } from '@verdaccio/core';\nimport { LOGIN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\nconst debug = buildDebug('verdaccio:api:login');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\n// https://github.com/npm/npm-profile/blob/main/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.post(\n    LOGIN_API_ENDPOINTS.login,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response): Promise<void> {\n      // create new login session (without token)\n      const sessionId = randomUUID();\n      debug('creating login session %o', sessionId);\n\n      await storage.saveToken({\n        user: sessionId,\n        token: '',\n        key: WEB_LOGIN_SESSION_ID,\n        readonly: false,\n        created: new Date().getTime(),\n      });\n\n      res.status(HTTP_STATUS.OK);\n\n      // Assuming Web UI is running on the same address as API\n      const protocol = req.protocol;\n      const host = req.hostname;\n      const port = req.socket.localPort;\n\n      const loginUrl = `${protocol}://${host}:${port}/-/web/login?next=${LOGIN_API_ENDPOINTS.login_cli}/${sessionId}`;\n      const doneUrl = `${protocol}://${host}:${port}${LOGIN_API_ENDPOINTS.login_done}/${sessionId}`;\n      debug('loginUrl: %o', loginUrl);\n      debug('doneUrl: %o', doneUrl);\n\n      res.json({\n        loginUrl,\n        doneUrl,\n      });\n    }\n  );\n\n  route.get(\n    LOGIN_API_ENDPOINTS.login_done_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      debug('polling login session %o', req.params.sessionId);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      try {\n        const tokens = await storage.readTokens({ user: sessionId });\n        debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n        if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n          if (tokens[0].token.length === 0) {\n            debug('waiting for authentication');\n            // Poll again after short delay\n            // TODO: make this configurable (default 5 seconds)\n            res.status(HTTP_STATUS.ACCEPTED);\n            res.set(HEADERS.RETRY_AFTER, '5');\n            res.json({});\n          } else {\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n          }\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n      } catch (error: any) {\n        logger.error({ error: error.msg }, 'token list has failed: @{error}');\n        return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n      }\n    }\n  );\n\n  route.post(\n    LOGIN_API_ENDPOINTS.login_cli_session,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer): Promise<void> {\n      const { username, password } = req.body;\n      debug('authenticating login session %o for user %o', req.params.sessionId, username);\n\n      if (!req.params.sessionId) {\n        debug('sessionId is missing');\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_REQUIRED));\n      }\n      const sessionId = req.params.sessionId;\n      if (sessionId.length !== 36) {\n        debug('sessionId is invalid length: %o', sessionId.length);\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n      }\n\n      auth.authenticate(\n        username,\n        password,\n        async function callbackAuthenticate(err, user): Promise<void> {\n          if (err) {\n            logger.trace(\n              { username, err },\n              'authenticating for user @{username} failed. Error: @{err.message}'\n            );\n            return next(errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, err.message));\n          }\n\n          const remoteUser = createRemoteUser(username, user?.groups || []);\n          const token = await getApiToken(auth, config, remoteUser, password);\n\n          if (!token) {\n            return next(errorUtils.getUnauthorized());\n          }\n\n          // Replace login session with token (to be picked up by the \"done\" endpoint)\n          debug('saving token for sessionId %o', sessionId);\n          await storage.deleteToken(sessionId, WEB_LOGIN_SESSION_ID);\n          await storage.saveToken({\n            user: sessionId,\n            token,\n            key: WEB_LOGIN_SESSION_ID,\n            readonly: false,\n            created: new Date().getTime(),\n          });\n\n          const message = authUtils.getAuthenticatedMessage(remoteUser.name ?? '');\n\n          res.status(HTTP_STATUS.CREATED);\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          res.json({ ok: message, token });\n        }\n      );\n    }\n  );\n}\n"],"mappings":";;;;;;;AAcA,IAAM,QAAQ,WAAW,sBAAsB;AAE/C,IAAM,uBAAuB;AAG7B,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;AACN,OAAM,KACJ,oBAAoB,OACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAA8B;EAEjE,MAAM,YAAY,YAAY;AAC9B,QAAM,6BAA6B,UAAU;AAE7C,QAAM,QAAQ,UAAU;GACtB,MAAM;GACN,OAAO;GACP,KAAK;GACL,UAAU;GACV,0BAAS,IAAI,MAAM,EAAC,SAAS;GAC9B,CAAC;AAEF,MAAI,OAAO,YAAY,GAAG;EAG1B,MAAM,WAAW,IAAI;EACrB,MAAM,OAAO,IAAI;EACjB,MAAM,OAAO,IAAI,OAAO;EAExB,MAAM,WAAW,GAAG,SAAS,KAAK,KAAK,GAAG,KAAK,oBAAoB,oBAAoB,UAAU,GAAG;EACpG,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,GAAG,OAAO,oBAAoB,WAAW,GAAG;AAClF,QAAM,gBAAgB,SAAS;AAC/B,QAAM,eAAe,QAAQ;AAE7B,MAAI,KAAK;GACP;GACA;GACD,CAAC;GAEL;AAED,OAAM,IACJ,oBAAoB,oBACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;AACzF,QAAM,4BAA4B,IAAI,OAAO,UAAU;AAEvD,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,SAAM,uBAAuB;AAC7B,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,SAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;;AAGxF,MAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,SAAM,qCAAqC,WAAW,OAAO,OAAO;AACpE,OAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,qBACrD,KAAI,OAAO,GAAG,MAAM,WAAW,GAAG;AAChC,UAAM,6BAA6B;AAGnC,QAAI,OAAO,YAAY,SAAS;AAChC,QAAI,IAAI,QAAQ,aAAa,IAAI;AACjC,QAAI,KAAK,EAAE,CAAC;UACP;AAEL,UAAM,yBAAyB;AAC/B,UAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,IAAI;AAMnD,QAFyB,IAAI,KAAK,OAAO,GAAG,QAAQ,mBACjC,IAAI,KAAK,KAAK,KAAK,GAAG,MAAS,IAAK,EACpB;AACjC,WAAM,wBAAwB;AAC9B,YAAO,KAAK,WAAW,gBAAgB,UAAU,sBAAsB,CAAC;;AAG1E,UAAM,2CAA2C;AAEjD,QAAI,OAAO,YAAY,GAAG;AAC1B,QAAI,KAAK,EAAE,OAAO,OAAO,GAAG,OAAO,CAAC;;OAGtC,QAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;WAEjF,OAAY;AACnB,UAAO,MAAM,EAAE,OAAO,MAAM,KAAK,EAAE,kCAAkC;AACrE,UAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,QAAQ,CAAC;;GAG/E;AAED,OAAM,KACJ,oBAAoB,mBACpB,UAAU,QAAQ,cAAc,EAChC,eAAgB,KAAqB,KAAe,MAAuC;EACzF,MAAM,EAAE,UAAU,aAAa,IAAI;AACnC,QAAM,+CAA+C,IAAI,OAAO,WAAW,SAAS;AAEpF,MAAI,CAAC,IAAI,OAAO,WAAW;AACzB,SAAM,uBAAuB;AAC7B,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,oBAAoB,CAAC;;EAEzF,MAAM,YAAY,IAAI,OAAO;AAC7B,MAAI,UAAU,WAAW,IAAI;AAC3B,SAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;;AAGxF,OAAK,aACH,UACA,UACA,eAAe,qBAAqB,KAAK,MAAqB;AAC5D,OAAI,KAAK;AACP,WAAO,MACL;KAAE;KAAU;KAAK,EACjB,oEACD;AACD,WAAO,KAAK,WAAW,QAAQ,YAAY,cAAc,IAAI,QAAQ,CAAC;;GAGxE,MAAM,aAAa,iBAAiB,UAAU,MAAM,UAAU,EAAE,CAAC;GACjE,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,YAAY,SAAS;AAEnE,OAAI,CAAC,MACH,QAAO,KAAK,WAAW,iBAAiB,CAAC;AAI3C,SAAM,iCAAiC,UAAU;AACjD,SAAM,QAAQ,YAAY,WAAW,qBAAqB;AAC1D,SAAM,QAAQ,UAAU;IACtB,MAAM;IACN;IACA,KAAK;IACL,UAAU;IACV,0BAAS,IAAI,MAAM,EAAC,SAAS;IAC9B,CAAC;GAEF,MAAM,UAAU,UAAU,wBAAwB,WAAW,QAAQ,GAAG;AAExE,OAAI,OAAO,YAAY,QAAQ;AAC/B,OAAI,IAAI,QAAQ,eAAe,qBAAqB;AACpD,OAAI,KAAK;IAAE,IAAI;IAAS;IAAO,CAAC;IAEnC;GAEJ"}

package/build/v1/profile.d.ts

@@ -1,6 +1,6 @@
-import type { Router } from 'express';
-import type { Auth } from '@verdaccio/auth';
-import type { Config } from '@verdaccio/types';
+import { Router } from 'express';
+import { Auth } from '@verdaccio/auth';
+import { Config } from '@verdaccio/types';
 export interface Profile {
     tfa: boolean;
     name: string;