@verdaccio/api 9.0.0-next-9.20 → 9.0.0-next-9.21

package/build/index.js

@@ -45,7 +45,7 @@ function src_default(config, auth, storage, logger) {
 	require_dist_tags.default(app, auth, storage, logger);
 	require_publish.default(app, auth, storage, config, logger);
 	require_ping.default(app);
-	require_search$1.default(app, auth, storage, logger);
+	require_search$1.default(app, auth, storage, config, logger);
 	require_token.default(app, auth, storage, config, logger);
 	require_package.default(app, auth, storage, logger);
 	if (config.flags?.webLogin) require_login.default(app, auth, storage, config, logger);

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, config, logger);\n  ping(app);\n  v1Search(app, auth, storage, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAA,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,sBAAA,eAAe;CACpC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,OAAO,sBAAA,YAAY;CAC7B,IAAI,MAAM,WAAW,sBAAA,YAAY;CACjC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,SAAS,sBAAA,YAAY;CAI/B,IAAI,MAAM,SAAA,GAAA,sBAAA,OAAc,QAAQ,CAAC;CACjC,IAAI,MAAM,qBAAA,GAAA,sBAAA,OAA0B,sBAAsB,CAAC;CAG3D,CAAA,GAAA,sBAAA,oBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,KAAA,GAAA,sBAAA,+BAAkC,SAAS,MAAM,CAAC;CACtD,IAAI,KAAA,GAAA,sBAAA,UAAa,MAAM,CAAC;CACxB,IAAI,IAAI,sBAAA,eAAe;CAEvB,IAAI,IAAI,sBAAA,kBAAkB;CAE1B,eAAA,QAAO,GAAG;CACV,gBAAA,QAAQ,KAAK,MAAM,MAAM;CACzB,eAAA,QAAO,KAAK,MAAM;CAClB,aAAA,QAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,gBAAA,QAAQ,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC1C,aAAA,QAAK,GAAG;CACR,iBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAA,QAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, config, logger);\n  ping(app);\n  v1Search(app, auth, storage, config, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAA,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,sBAAA,eAAe;CACpC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,OAAO,sBAAA,YAAY;CAC7B,IAAI,MAAM,WAAW,sBAAA,YAAY;CACjC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,SAAS,sBAAA,YAAY;CAI/B,IAAI,MAAM,SAAA,GAAA,sBAAA,OAAc,QAAQ,CAAC;CACjC,IAAI,MAAM,qBAAA,GAAA,sBAAA,OAA0B,sBAAsB,CAAC;CAG3D,CAAA,GAAA,sBAAA,oBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,KAAA,GAAA,sBAAA,+BAAkC,SAAS,MAAM,CAAC;CACtD,IAAI,KAAA,GAAA,sBAAA,UAAa,MAAM,CAAC;CACxB,IAAI,IAAI,sBAAA,eAAe;CAEvB,IAAI,IAAI,sBAAA,kBAAkB;CAE1B,eAAA,QAAO,GAAG;CACV,gBAAA,QAAQ,KAAK,MAAM,MAAM;CACzB,eAAA,QAAO,KAAK,MAAM;CAClB,aAAA,QAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,gBAAA,QAAQ,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC1C,aAAA,QAAK,GAAG;CACR,iBAAA,QAAS,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC3C,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAA,QAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}

package/build/index.mjs

@@ -39,7 +39,7 @@ function src_default(config, auth, storage, logger) {
 	dist_tags_default(app, auth, storage, logger);
 	publish(app, auth, storage, config, logger);
 	ping_default(app);
-	search_default$1(app, auth, storage, logger);
+	search_default$1(app, auth, storage, config, logger);
 	token_default(app, auth, storage, config, logger);
 	package_default(app, auth, storage, logger);
 	if (config.flags?.webLogin) login_default(app, auth, storage, config, logger);

package/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, config, logger);\n  ping(app);\n  v1Search(app, auth, storage, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,eAAe;CACpC,IAAI,MAAM,YAAY,YAAY;CAClC,IAAI,MAAM,OAAO,YAAY;CAC7B,IAAI,MAAM,WAAW,YAAY;CACjC,IAAI,MAAM,YAAY,YAAY;CAClC,IAAI,MAAM,SAAS,YAAY;CAI/B,IAAI,MAAM,QAAQ,MAAM,QAAQ,CAAC;CACjC,IAAI,MAAM,oBAAoB,MAAM,sBAAsB,CAAC;CAG3D,mBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,IAAI,8BAA8B,SAAS,MAAM,CAAC;CACtD,IAAI,IAAI,SAAS,MAAM,CAAC;CACxB,IAAI,IAAI,eAAe;CAEvB,IAAI,IAAI,kBAAkB;CAE1B,eAAO,GAAG;CACV,gBAAQ,KAAK,MAAM,MAAM;CACzB,eAAO,KAAK,MAAM;CAClB,aAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAS,KAAK,MAAM,SAAS,MAAM;CACnC,QAAQ,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC1C,aAAK,GAAG;CACR,iBAAS,KAAK,MAAM,SAAS,MAAM;CACnC,cAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, config, logger);\n  ping(app);\n  v1Search(app, auth, storage, config, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,eAAe;CACpC,IAAI,MAAM,YAAY,YAAY;CAClC,IAAI,MAAM,OAAO,YAAY;CAC7B,IAAI,MAAM,WAAW,YAAY;CACjC,IAAI,MAAM,YAAY,YAAY;CAClC,IAAI,MAAM,SAAS,YAAY;CAI/B,IAAI,MAAM,QAAQ,MAAM,QAAQ,CAAC;CACjC,IAAI,MAAM,oBAAoB,MAAM,sBAAsB,CAAC;CAG3D,mBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,IAAI,8BAA8B,SAAS,MAAM,CAAC;CACtD,IAAI,IAAI,SAAS,MAAM,CAAC;CACxB,IAAI,IAAI,eAAe;CAEvB,IAAI,IAAI,kBAAkB;CAE1B,eAAO,GAAG;CACV,gBAAQ,KAAK,MAAM,MAAM;CACzB,eAAO,KAAK,MAAM;CAClB,aAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAS,KAAK,MAAM,SAAS,MAAM;CACnC,QAAQ,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC1C,aAAK,GAAG;CACR,iBAAS,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC3C,cAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}

package/build/v1/search.d.ts

@@ -1,10 +1,10 @@
 import { Auth } from '@verdaccio/auth';
 import { Storage } from '@verdaccio/store';
-import { Logger } from '@verdaccio/types';
+import { Config, Logger } from '@verdaccio/types';
 /**
  * Endpoint for npm search v1
  * Empty value
  *  - {"objects":[],"total":0,"time":"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)"}
  * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'
  */
-export default function (route: any, auth: Auth, storage: Storage, logger: Logger): void;
+export default function (route: any, auth: Auth, storage: Storage, config: Config, logger: Logger): void;

package/build/v1/search.js

@@ -5,13 +5,22 @@ let debug = require("debug");
 debug = require_runtime.__toESM(debug);
 //#region src/v1/search.ts
 var debug$1 = (0, debug.default)("verdaccio:api:search");
+var DEFAULT_SIZE = 20;
+var MAX_SIZE = 250;
+var MAX_FROM = 1e4;
+var CHECK_ACCESS_BATCH_SIZE = 50;
+function parseQueryInt(value, defaultValue, max) {
+	const parsed = Number.parseInt(String(value), 10);
+	if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
+	return Math.min(parsed, max);
+}
 /**
 * Endpoint for npm search v1
 * Empty value
 *  - {"objects":[],"total":0,"time":"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)"}
 * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'
 */
-function search_default(route, auth, storage, logger) {
+function search_default(route, auth, storage, config, logger) {
 	function checkAccess(pkg, auth, remoteUser) {
 		return new Promise((resolve, reject) => {
 			auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function(err, allowed) {
@@ -21,10 +30,19 @@ function search_default(route, auth, storage, logger) {
 			});
 		});
 	}
-	route.get(_verdaccio_middleware.SEARCH_API_ENDPOINTS.search, async (req, res, next) => {
+	route.get(_verdaccio_middleware.SEARCH_API_ENDPOINTS.search, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), async (req, res, next) => {
 		const { query, url } = req;
-		let [size, from] = ["size", "from"].map((k) => query[k]);
-		let data;
+		const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);
+		const from = parseQueryInt(query.from, 0, MAX_FROM);
+		const safeQuery = {
+			...query,
+			size,
+			from
+		};
+		const searchParams = new URLSearchParams(query);
+		searchParams.set("size", String(size));
+		searchParams.set("from", String(from));
+		const safeUrl = `${url.split("?")[0]}?${searchParams.toString()}`;
 		const abort = new AbortController();
 		const onClientClose = () => {
 			debug$1("search web aborted");
@@ -32,18 +50,20 @@ function search_default(route, auth, storage, logger) {
 		};
 		req.socket.on("close", onClientClose);
 		try {
-			size = parseInt(Number.isFinite(size) ? size : "20", 10);
-			from = parseInt(Number.isFinite(from) ? from : "0", 10);
 			debug$1("storage search initiated");
-			data = await storage.search({
-				query,
-				url,
+			const data = await storage.search({
+				query: safeQuery,
+				url: safeUrl,
 				abort
 			});
-			debug$1("storage items tota: %o", data.length);
-			const final = (await Promise.all(data.map((pkgItem) => {
-				return checkAccess(pkgItem, auth, req.remote_user);
-			}))).filter((i) => i !== null).slice(from, from + size);
+			debug$1("storage items total: %o", data.length);
+			const requested = from + size;
+			const allowed = [];
+			for (let i = 0; i < data.length && allowed.length < requested && !abort.signal.aborted; i += CHECK_ACCESS_BATCH_SIZE) {
+				const batch = await Promise.all(data.slice(i, i + CHECK_ACCESS_BATCH_SIZE).map((pkgItem) => checkAccess(pkgItem, auth, req.remote_user)));
+				for (const item of batch) if (item !== null) allowed.push(item);
+			}
+			const final = allowed.slice(from, requested);
 			logger.debug(`search results ${final?.length}`);
 			const response = {
 				objects: final,

package/build/v1/search.js.map

@@ -1 +1 @@
-{"version":3,"file":"search.js","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n    const onClientClose = (): void => {\n      debug('search web aborted');\n      abort.abort();\n    };\n    req.socket.on('close', onClientClose);\n\n    try {\n      size = parseInt(Number.isFinite(size) ? size : '20', 10);\n      from = parseInt(Number.isFinite(from) ? from : '0', 10);\n\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => i !== null)\n        .slice(from, from + size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(error);\n      return;\n    } finally {\n      req.socket.off('close', onClientClose);\n    }\n  });\n}\n"],"mappings":";;;;;;AASA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;;;;;;;AAQ/C,SAAA,eAAyB,OAAO,MAAY,SAAkB,QAAsB;CAClF,SAAS,YAAY,KAAU,MAAW,YAAsC;EAC9E,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KACF,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,EAAE,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;SAEnB,OAAO,GAAG;SAGZ,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IAAI,sBAAA,qBAAqB,QAAQ,OAAO,KAAK,KAAK,SAAS;EAC/D,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,MAAM,EAAE,KAAK,MAAM,MAAM,EAAE;EACvD,IAAI;EACJ,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,QAAM,oBAAoB;GAC1B,MAAM,MAAM;EACd;EACA,IAAI,OAAO,GAAG,SAAS,aAAa;EAEpC,IAAI;GACF,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,MAAM,EAAE;GACvD,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,KAAK,EAAE;GAEtD,QAAM,0BAA0B;GAChC,OAAO,MAAM,QAAQ,OAAO;IAC1B;IACA;IACA;GACF,CAAC;GACD,QAAM,0BAA0B,KAAK,MAAM;GAO3C,MAAM,SAAqC,MANoB,QAAQ,IACrE,KAAK,KAAK,YAAY;IACpB,OAAO,YAAY,SAAS,MAAM,IAAI,WAAW;GACnD,CAAC,CACH,GAGG,QAAQ,MAAM,MAAM,IAAI,EACxB,MAAM,MAAM,OAAO,IAAI;GAC1B,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,GAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,gBAAA,YAAY,EAAE,EAAE,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,IAAI,OAAO,IAAI,SAAS,aAAa;EACvC;CACF,CAAC;AACH"}
+{"version":3,"file":"search.js","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\nconst DEFAULT_SIZE = 20;\n// the public npm registry caps page size at 250 as well\nconst MAX_SIZE = 250;\n// upper bound for the pagination offset so a single request cannot force\n// an access check on an arbitrarily large slice of the catalog\nconst MAX_FROM = 10_000;\n// access checks run in batches so the scan can stop early once the\n// requested page is filled\nconst CHECK_ACCESS_BATCH_SIZE = 50;\n\nfunction parseQueryInt(value: unknown, defaultValue: number, max: number): number {\n  const parsed = Number.parseInt(String(value), 10);\n  if (Number.isNaN(parsed) || parsed < 0) {\n    return defaultValue;\n  }\n  return Math.min(parsed, max);\n}\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (\n  route,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<searchUtils.SearchItemPkg | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(\n    SEARCH_API_ENDPOINTS.search,\n    rateLimit(config?.userRateLimit),\n    async (req, res, next) => {\n      const { query, url } = req;\n      // `size` and `from` are attacker-controlled: clamp them so a single\n      // request cannot demand unbounded work\n      const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);\n      const from = parseQueryInt(query.from, 0, MAX_FROM);\n      // rebuild the query and relative url from the clamped values so the\n      // bounds hold end-to-end: storage plugins read `query.size`/`query.from`\n      // and the uplink proxy forwards `url` verbatim to the remote registry\n      const safeQuery = { ...query, size, from };\n      const searchParams = new URLSearchParams(query);\n      searchParams.set('size', String(size));\n      searchParams.set('from', String(from));\n      const safeUrl = `${url.split('?')[0]}?${searchParams.toString()}`;\n      const abort = new AbortController();\n      const onClientClose = (): void => {\n        debug('search web aborted');\n        abort.abort();\n      };\n      req.socket.on('close', onClientClose);\n\n      try {\n        debug('storage search initiated');\n        const data = await storage.search({\n          query: safeQuery,\n          url: safeUrl,\n          abort,\n        });\n        debug('storage items total: %o', data.length);\n\n        // evaluate access in batches and stop as soon as the requested page\n        // is filled, instead of running an auth check on every result\n        const requested = from + size;\n        const allowed: searchUtils.SearchItemPkg[] = [];\n        for (\n          let i = 0;\n          i < data.length && allowed.length < requested && !abort.signal.aborted;\n          i += CHECK_ACCESS_BATCH_SIZE\n        ) {\n          const batch = await Promise.all(\n            data\n              .slice(i, i + CHECK_ACCESS_BATCH_SIZE)\n              .map((pkgItem) => checkAccess(pkgItem, auth, req.remote_user))\n          );\n          for (const item of batch) {\n            if (item !== null) {\n              allowed.push(item);\n            }\n          }\n        }\n\n        const final: searchUtils.SearchItemPkg[] = allowed.slice(from, requested);\n        logger.debug(`search results ${final?.length}`);\n\n        const response: searchUtils.SearchResults = {\n          objects: final,\n          total: final.length,\n          time: new Date().toUTCString(),\n        };\n\n        res.status(HTTP_STATUS.OK).json(response);\n      } catch (error) {\n        logger.error({ error }, 'search endpoint has failed @{error.message}');\n        next(error);\n        return;\n      } finally {\n        req.socket.off('close', onClientClose);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;AASA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;AAE/C,IAAM,eAAe;AAErB,IAAM,WAAW;AAGjB,IAAM,WAAW;AAGjB,IAAM,0BAA0B;AAEhC,SAAS,cAAc,OAAgB,cAAsB,KAAqB;CAChF,MAAM,SAAS,OAAO,SAAS,OAAO,KAAK,GAAG,EAAE;CAChD,IAAI,OAAO,MAAM,MAAM,KAAK,SAAS,GACnC,OAAO;CAET,OAAO,KAAK,IAAI,QAAQ,GAAG;AAC7B;;;;;;;AAQA,SAAA,eACE,OACA,MACA,SACA,QACA,QACM;CACN,SAAS,YAAY,KAAU,MAAW,YAAuD;EAC/F,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KACF,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,EAAE,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;SAEnB,OAAO,GAAG;SAGZ,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IACJ,sBAAA,qBAAqB,SAAA,GAAA,sBAAA,WACX,QAAQ,aAAa,GAC/B,OAAO,KAAK,KAAK,SAAS;EACxB,MAAM,EAAE,OAAO,QAAQ;EAGvB,MAAM,OAAO,cAAc,MAAM,MAAM,cAAc,QAAQ;EAC7D,MAAM,OAAO,cAAc,MAAM,MAAM,GAAG,QAAQ;EAIlD,MAAM,YAAY;GAAE,GAAG;GAAO;GAAM;EAAK;EACzC,MAAM,eAAe,IAAI,gBAAgB,KAAK;EAC9C,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,MAAM,UAAU,GAAG,IAAI,MAAM,GAAG,EAAE,GAAG,GAAG,aAAa,SAAS;EAC9D,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,QAAM,oBAAoB;GAC1B,MAAM,MAAM;EACd;EACA,IAAI,OAAO,GAAG,SAAS,aAAa;EAEpC,IAAI;GACF,QAAM,0BAA0B;GAChC,MAAM,OAAO,MAAM,QAAQ,OAAO;IAChC,OAAO;IACP,KAAK;IACL;GACF,CAAC;GACD,QAAM,2BAA2B,KAAK,MAAM;GAI5C,MAAM,YAAY,OAAO;GACzB,MAAM,UAAuC,CAAC;GAC9C,KACE,IAAI,IAAI,GACR,IAAI,KAAK,UAAU,QAAQ,SAAS,aAAa,CAAC,MAAM,OAAO,SAC/D,KAAK,yBACL;IACA,MAAM,QAAQ,MAAM,QAAQ,IAC1B,KACG,MAAM,GAAG,IAAI,uBAAuB,EACpC,KAAK,YAAY,YAAY,SAAS,MAAM,IAAI,WAAW,CAAC,CACjE;IACA,KAAK,MAAM,QAAQ,OACjB,IAAI,SAAS,MACX,QAAQ,KAAK,IAAI;GAGvB;GAEA,MAAM,QAAqC,QAAQ,MAAM,MAAM,SAAS;GACxE,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,GAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,gBAAA,YAAY,EAAE,EAAE,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,IAAI,OAAO,IAAI,SAAS,aAAa;EACvC;CACF,CACF;AACF"}

package/build/v1/search.mjs

@@ -1,15 +1,24 @@
-import { SEARCH_API_ENDPOINTS } from "@verdaccio/middleware";
+import { SEARCH_API_ENDPOINTS, rateLimit } from "@verdaccio/middleware";
 import { HTTP_STATUS } from "@verdaccio/core";
 import buildDebug from "debug";
 //#region src/v1/search.ts
 var debug = buildDebug("verdaccio:api:search");
+var DEFAULT_SIZE = 20;
+var MAX_SIZE = 250;
+var MAX_FROM = 1e4;
+var CHECK_ACCESS_BATCH_SIZE = 50;
+function parseQueryInt(value, defaultValue, max) {
+	const parsed = Number.parseInt(String(value), 10);
+	if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
+	return Math.min(parsed, max);
+}
 /**
 * Endpoint for npm search v1
 * Empty value
 *  - {"objects":[],"total":0,"time":"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)"}
 * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'
 */
-function search_default(route, auth, storage, logger) {
+function search_default(route, auth, storage, config, logger) {
 	function checkAccess(pkg, auth, remoteUser) {
 		return new Promise((resolve, reject) => {
 			auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function(err, allowed) {
@@ -19,10 +28,19 @@ function search_default(route, auth, storage, logger) {
 			});
 		});
 	}
-	route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {
+	route.get(SEARCH_API_ENDPOINTS.search, rateLimit(config?.userRateLimit), async (req, res, next) => {
 		const { query, url } = req;
-		let [size, from] = ["size", "from"].map((k) => query[k]);
-		let data;
+		const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);
+		const from = parseQueryInt(query.from, 0, MAX_FROM);
+		const safeQuery = {
+			...query,
+			size,
+			from
+		};
+		const searchParams = new URLSearchParams(query);
+		searchParams.set("size", String(size));
+		searchParams.set("from", String(from));
+		const safeUrl = `${url.split("?")[0]}?${searchParams.toString()}`;
 		const abort = new AbortController();
 		const onClientClose = () => {
 			debug("search web aborted");
@@ -30,18 +48,20 @@ function search_default(route, auth, storage, logger) {
 		};
 		req.socket.on("close", onClientClose);
 		try {
-			size = parseInt(Number.isFinite(size) ? size : "20", 10);
-			from = parseInt(Number.isFinite(from) ? from : "0", 10);
 			debug("storage search initiated");
-			data = await storage.search({
-				query,
-				url,
+			const data = await storage.search({
+				query: safeQuery,
+				url: safeUrl,
 				abort
 			});
-			debug("storage items tota: %o", data.length);
-			const final = (await Promise.all(data.map((pkgItem) => {
-				return checkAccess(pkgItem, auth, req.remote_user);
-			}))).filter((i) => i !== null).slice(from, from + size);
+			debug("storage items total: %o", data.length);
+			const requested = from + size;
+			const allowed = [];
+			for (let i = 0; i < data.length && allowed.length < requested && !abort.signal.aborted; i += CHECK_ACCESS_BATCH_SIZE) {
+				const batch = await Promise.all(data.slice(i, i + CHECK_ACCESS_BATCH_SIZE).map((pkgItem) => checkAccess(pkgItem, auth, req.remote_user)));
+				for (const item of batch) if (item !== null) allowed.push(item);
+			}
+			const final = allowed.slice(from, requested);
 			logger.debug(`search results ${final?.length}`);
 			const response = {
 				objects: final,

package/build/v1/search.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"search.mjs","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (route, auth: Auth, storage: Storage, logger: Logger): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(SEARCH_API_ENDPOINTS.search, async (req, res, next) => {\n    const { query, url } = req;\n    let [size, from] = ['size', 'from'].map((k) => query[k]);\n    let data;\n    const abort = new AbortController();\n    const onClientClose = (): void => {\n      debug('search web aborted');\n      abort.abort();\n    };\n    req.socket.on('close', onClientClose);\n\n    try {\n      size = parseInt(Number.isFinite(size) ? size : '20', 10);\n      from = parseInt(Number.isFinite(from) ? from : '0', 10);\n\n      debug('storage search initiated');\n      data = await storage.search({\n        query,\n        url,\n        abort,\n      });\n      debug('storage items tota: %o', data.length);\n      const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(\n        data.map((pkgItem) => {\n          return checkAccess(pkgItem, auth, req.remote_user);\n        })\n      );\n\n      const final: searchUtils.SearchItemPkg[] = checkAccessPromises\n        .filter((i) => i !== null)\n        .slice(from, from + size);\n      logger.debug(`search results ${final?.length}`);\n\n      const response: searchUtils.SearchResults = {\n        objects: final,\n        total: final.length,\n        time: new Date().toUTCString(),\n      };\n\n      res.status(HTTP_STATUS.OK).json(response);\n    } catch (error) {\n      logger.error({ error }, 'search endpoint has failed @{error.message}');\n      next(error);\n      return;\n    } finally {\n      req.socket.off('close', onClientClose);\n    }\n  });\n}\n"],"mappings":";;;;AASA,IAAM,QAAQ,WAAW,sBAAsB;;;;;;;AAQ/C,SAAA,eAAyB,OAAO,MAAY,SAAkB,QAAsB;CAClF,SAAS,YAAY,KAAU,MAAW,YAAsC;EAC9E,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KACF,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,EAAE,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;SAEnB,OAAO,GAAG;SAGZ,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IAAI,qBAAqB,QAAQ,OAAO,KAAK,KAAK,SAAS;EAC/D,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,MAAM,EAAE,KAAK,MAAM,MAAM,EAAE;EACvD,IAAI;EACJ,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,MAAM,oBAAoB;GAC1B,MAAM,MAAM;EACd;EACA,IAAI,OAAO,GAAG,SAAS,aAAa;EAEpC,IAAI;GACF,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,MAAM,EAAE;GACvD,OAAO,SAAS,OAAO,SAAS,IAAI,IAAI,OAAO,KAAK,EAAE;GAEtD,MAAM,0BAA0B;GAChC,OAAO,MAAM,QAAQ,OAAO;IAC1B;IACA;IACA;GACF,CAAC;GACD,MAAM,0BAA0B,KAAK,MAAM;GAO3C,MAAM,SAAqC,MANoB,QAAQ,IACrE,KAAK,KAAK,YAAY;IACpB,OAAO,YAAY,SAAS,MAAM,IAAI,WAAW;GACnD,CAAC,CACH,GAGG,QAAQ,MAAM,MAAM,IAAI,EACxB,MAAM,MAAM,OAAO,IAAI;GAC1B,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,GAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,YAAY,EAAE,EAAE,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,IAAI,OAAO,IAAI,SAAS,aAAa;EACvC;CACF,CAAC;AACH"}
+{"version":3,"file":"search.mjs","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:api:search');\n\nconst DEFAULT_SIZE = 20;\n// the public npm registry caps page size at 250 as well\nconst MAX_SIZE = 250;\n// upper bound for the pagination offset so a single request cannot force\n// an access check on an arbitrarily large slice of the catalog\nconst MAX_FROM = 10_000;\n// access checks run in batches so the scan can stop early once the\n// requested page is filled\nconst CHECK_ACCESS_BATCH_SIZE = 50;\n\nfunction parseQueryInt(value: unknown, defaultValue: number, max: number): number {\n  const parsed = Number.parseInt(String(value), 10);\n  if (Number.isNaN(parsed) || parsed < 0) {\n    return defaultValue;\n  }\n  return Math.min(parsed, max);\n}\n\n/**\n * Endpoint for npm search v1\n * Empty value\n *  - {\"objects\":[],\"total\":0,\"time\":\"Sun Jul 25 2021 14:09:11 GMT+0000 (Coordinated Universal Time)\"}\n * req: 'GET /-/v1/search?text=react&size=20&frpom=0&quality=0.65&popularity=0.98&maintenance=0.5'\n */\nexport default function (\n  route,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  function checkAccess(pkg: any, auth: any, remoteUser): Promise<searchUtils.SearchItemPkg | null> {\n    return new Promise((resolve, reject) => {\n      auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n        if (err) {\n          if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n            // auth plugin returns 4xx user error,\n            // that's equivalent of !allowed basically\n            return resolve(null);\n          } else {\n            reject(err);\n          }\n        } else {\n          return resolve(allowed ? pkg : null);\n        }\n      });\n    });\n  }\n\n  route.get(\n    SEARCH_API_ENDPOINTS.search,\n    rateLimit(config?.userRateLimit),\n    async (req, res, next) => {\n      const { query, url } = req;\n      // `size` and `from` are attacker-controlled: clamp them so a single\n      // request cannot demand unbounded work\n      const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);\n      const from = parseQueryInt(query.from, 0, MAX_FROM);\n      // rebuild the query and relative url from the clamped values so the\n      // bounds hold end-to-end: storage plugins read `query.size`/`query.from`\n      // and the uplink proxy forwards `url` verbatim to the remote registry\n      const safeQuery = { ...query, size, from };\n      const searchParams = new URLSearchParams(query);\n      searchParams.set('size', String(size));\n      searchParams.set('from', String(from));\n      const safeUrl = `${url.split('?')[0]}?${searchParams.toString()}`;\n      const abort = new AbortController();\n      const onClientClose = (): void => {\n        debug('search web aborted');\n        abort.abort();\n      };\n      req.socket.on('close', onClientClose);\n\n      try {\n        debug('storage search initiated');\n        const data = await storage.search({\n          query: safeQuery,\n          url: safeUrl,\n          abort,\n        });\n        debug('storage items total: %o', data.length);\n\n        // evaluate access in batches and stop as soon as the requested page\n        // is filled, instead of running an auth check on every result\n        const requested = from + size;\n        const allowed: searchUtils.SearchItemPkg[] = [];\n        for (\n          let i = 0;\n          i < data.length && allowed.length < requested && !abort.signal.aborted;\n          i += CHECK_ACCESS_BATCH_SIZE\n        ) {\n          const batch = await Promise.all(\n            data\n              .slice(i, i + CHECK_ACCESS_BATCH_SIZE)\n              .map((pkgItem) => checkAccess(pkgItem, auth, req.remote_user))\n          );\n          for (const item of batch) {\n            if (item !== null) {\n              allowed.push(item);\n            }\n          }\n        }\n\n        const final: searchUtils.SearchItemPkg[] = allowed.slice(from, requested);\n        logger.debug(`search results ${final?.length}`);\n\n        const response: searchUtils.SearchResults = {\n          objects: final,\n          total: final.length,\n          time: new Date().toUTCString(),\n        };\n\n        res.status(HTTP_STATUS.OK).json(response);\n      } catch (error) {\n        logger.error({ error }, 'search endpoint has failed @{error.message}');\n        next(error);\n        return;\n      } finally {\n        req.socket.off('close', onClientClose);\n      }\n    }\n  );\n}\n"],"mappings":";;;;AASA,IAAM,QAAQ,WAAW,sBAAsB;AAE/C,IAAM,eAAe;AAErB,IAAM,WAAW;AAGjB,IAAM,WAAW;AAGjB,IAAM,0BAA0B;AAEhC,SAAS,cAAc,OAAgB,cAAsB,KAAqB;CAChF,MAAM,SAAS,OAAO,SAAS,OAAO,KAAK,GAAG,EAAE;CAChD,IAAI,OAAO,MAAM,MAAM,KAAK,SAAS,GACnC,OAAO;CAET,OAAO,KAAK,IAAI,QAAQ,GAAG;AAC7B;;;;;;;AAQA,SAAA,eACE,OACA,MACA,SACA,QACA,QACM;CACN,SAAS,YAAY,KAAU,MAAW,YAAuD;EAC/F,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KACF,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,EAAE,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;SAEnB,OAAO,GAAG;SAGZ,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IACJ,qBAAqB,QACrB,UAAU,QAAQ,aAAa,GAC/B,OAAO,KAAK,KAAK,SAAS;EACxB,MAAM,EAAE,OAAO,QAAQ;EAGvB,MAAM,OAAO,cAAc,MAAM,MAAM,cAAc,QAAQ;EAC7D,MAAM,OAAO,cAAc,MAAM,MAAM,GAAG,QAAQ;EAIlD,MAAM,YAAY;GAAE,GAAG;GAAO;GAAM;EAAK;EACzC,MAAM,eAAe,IAAI,gBAAgB,KAAK;EAC9C,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,MAAM,UAAU,GAAG,IAAI,MAAM,GAAG,EAAE,GAAG,GAAG,aAAa,SAAS;EAC9D,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,MAAM,oBAAoB;GAC1B,MAAM,MAAM;EACd;EACA,IAAI,OAAO,GAAG,SAAS,aAAa;EAEpC,IAAI;GACF,MAAM,0BAA0B;GAChC,MAAM,OAAO,MAAM,QAAQ,OAAO;IAChC,OAAO;IACP,KAAK;IACL;GACF,CAAC;GACD,MAAM,2BAA2B,KAAK,MAAM;GAI5C,MAAM,YAAY,OAAO;GACzB,MAAM,UAAuC,CAAC;GAC9C,KACE,IAAI,IAAI,GACR,IAAI,KAAK,UAAU,QAAQ,SAAS,aAAa,CAAC,MAAM,OAAO,SAC/D,KAAK,yBACL;IACA,MAAM,QAAQ,MAAM,QAAQ,IAC1B,KACG,MAAM,GAAG,IAAI,uBAAuB,EACpC,KAAK,YAAY,YAAY,SAAS,MAAM,IAAI,WAAW,CAAC,CACjE;IACA,KAAK,MAAM,QAAQ,OACjB,IAAI,SAAS,MACX,QAAQ,KAAK,IAAI;GAGvB;GAEA,MAAM,QAAqC,QAAQ,MAAM,MAAM,SAAS;GACxE,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAsC;IAC1C,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,GAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,YAAY,EAAE,EAAE,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,IAAI,OAAO,IAAI,SAAS,aAAa;EACvC;CACF,CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "9.0.0-next-9.20",
+  "version": "9.0.0-next-9.21",
   "description": "Verdaccio Registry API",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,26 +33,26 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "9.0.0-next-9.20",
-    "@verdaccio/config": "9.0.0-next-9.20",
-    "@verdaccio/core": "9.0.0-next-9.20",
-    "@verdaccio/hooks": "9.0.0-next-9.20",
-    "@verdaccio/logger": "9.0.0-next-9.20",
-    "@verdaccio/middleware": "9.0.0-next-9.20",
-    "@verdaccio/store": "9.0.0-next-9.20",
+    "@verdaccio/auth": "9.0.0-next-9.21",
+    "@verdaccio/config": "9.0.0-next-9.21",
+    "@verdaccio/core": "9.0.0-next-9.21",
+    "@verdaccio/hooks": "9.0.0-next-9.21",
+    "@verdaccio/logger": "9.0.0-next-9.21",
+    "@verdaccio/middleware": "9.0.0-next-9.21",
+    "@verdaccio/store": "9.0.0-next-9.21",
     "debug": "4.4.3",
     "express": "5.2.1",
     "lodash-es": "4.18.1"
   },
   "devDependencies": {
     "@types/lodash-es": "4.17.12",
-    "@verdaccio/test-helper": "5.0.0-next-9.21",
+    "@verdaccio/test-helper": "5.0.0-next-9.22",
     "@verdaccio/types": "14.0.0-next-9.11",
     "mockdate": "3.0.5",
     "nock": "13.5.6",
     "rimraf": "6.1.3",
     "supertest": "7.1.4",
-    "vite": "8.0.14",
+    "vite": "8.0.16",
     "vitest": "4.1.7"
   },
   "funding": {