@verdaccio/api 9.0.0-next-9.21 → 9.0.0-next-9.22

package/build/dist-tags.d.ts

@@ -1,5 +1,5 @@
-import { Router } from 'express';
-import { Auth } from '@verdaccio/auth';
-import { Storage } from '@verdaccio/store';
-import { Logger } from '@verdaccio/types';
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Storage } from '@verdaccio/store';
+import type { Logger } from '@verdaccio/types';
 export default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void;

package/build/dist-tags.js

@@ -8,10 +8,12 @@ function dist_tags_default(route, auth, storage, logger) {
 	});
 	const addTagPackageVersionMiddleware = async function(req, res, next) {
 		if (typeof req.body !== "string") return next(_verdaccio_core.errorUtils.getBadRequest("version is missing"));
+		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const tag = _verdaccio_core.reqUtils.paramToString(req.params.tag);
 		const tags = {};
-		tags[req.params.tag] = req.body;
+		tags[tag] = req.body;
 		try {
-			await storage.mergeTagsNext(req.params.package, tags);
+			await storage.mergeTagsNext(packageName, tags);
 			res.status(_verdaccio_core.constants.HTTP_STATUS.CREATED);
 			return next({ ok: _verdaccio_core.constants.API_MESSAGE.TAG_ADDED });
 		} catch (err) {
@@ -21,10 +23,12 @@ function dist_tags_default(route, auth, storage, logger) {
 	route.put(_verdaccio_middleware.DIST_TAGS_API_ENDPOINTS.tagging, can("publish"), (0, _verdaccio_middleware.media)(_verdaccio_core.HEADERS.JSON), addTagPackageVersionMiddleware);
 	route.put(_verdaccio_middleware.DIST_TAGS_API_ENDPOINTS.tagging_package, can("publish"), (0, _verdaccio_middleware.media)(_verdaccio_core.HEADERS.JSON), addTagPackageVersionMiddleware);
 	route.delete(_verdaccio_middleware.DIST_TAGS_API_ENDPOINTS.tagging_package, can("publish"), async function(req, res, next) {
+		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const tag = _verdaccio_core.reqUtils.paramToString(req.params.tag);
 		const tags = {};
-		tags[req.params.tag] = null;
+		tags[tag] = null;
 		try {
-			await storage.mergeTagsNext(req.params.package, tags);
+			await storage.mergeTagsNext(packageName, tags);
 			res.status(_verdaccio_core.constants.HTTP_STATUS.CREATED);
 			return next({ ok: _verdaccio_core.constants.API_MESSAGE.TAG_REMOVED });
 		} catch (err) {
@@ -32,11 +36,11 @@ function dist_tags_default(route, auth, storage, logger) {
 		}
 	});
 	route.get(_verdaccio_middleware.DIST_TAGS_API_ENDPOINTS.get_dist_tags, can("access"), async function(req, res, next) {
-		const name = req.params.package;
+		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
 		const requestOptions = (0, _verdaccio_middleware.getRequestOptions)(req);
 		try {
 			next((await storage.getPackageByOptions({
-				name,
+				name: packageName,
 				uplinksLook: true,
 				requestOptions
 			}))[_verdaccio_core.constants.DIST_TAGS]);

package/build/dist-tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"dist-tags.js","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,gBAAA,WAAW,cAAc,oBAAoB,CAAC;EAG5D,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO,IAAI;EAC3B,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,sBAAA,wBAAwB,SACxB,IAAI,SAAS,IAAA,GAAA,sBAAA,OACP,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,IAAA,GAAA,sBAAA,OACP,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,GACb,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO;EACvB,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;GACF,CAAC,GACa,gBAAA,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}
+{"version":3,"file":"dist-tags.js","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils, reqUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n    const packageName = reqUtils.paramToString(req.params.package);\n    const tag = reqUtils.paramToString(req.params.tag);\n    const tags = {};\n    tags[tag] = req.body;\n    try {\n      await storage.mergeTagsNext(packageName, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const tag = reqUtils.paramToString(req.params.tag);\n      const tags = {};\n      tags[tag] = null;\n      try {\n        await storage.mergeTagsNext(packageName, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name: packageName,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,MAAA,CAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,gBAAA,WAAW,cAAc,oBAAoB,CAAC;EAE5D,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,gBAAA,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO,IAAI;EAChB,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC7C,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,sBAAA,wBAAwB,SACxB,IAAI,SAAS,IAAA,GAAA,sBAAA,MAAA,CACP,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,IAAA,GAAA,sBAAA,MAAA,CACP,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,GACb,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,gBAAA,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO;EACZ,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC7C,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,kBAAA,GAAA,sBAAA,kBAAA,CAAmC,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD,MAAM;IACN,aAAa;IACb;GACF,CAAC,EAAA,CACa,gBAAA,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/dist-tags.mjs

@@ -1,5 +1,5 @@
 import { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from "@verdaccio/middleware";
-import { HEADERS, constants, errorUtils } from "@verdaccio/core";
+import { HEADERS, constants, errorUtils, reqUtils } from "@verdaccio/core";
 //#region src/dist-tags.ts
 function dist_tags_default(route, auth, storage, logger) {
 	const can = allow(auth, {
@@ -8,10 +8,12 @@ function dist_tags_default(route, auth, storage, logger) {
 	});
 	const addTagPackageVersionMiddleware = async function(req, res, next) {
 		if (typeof req.body !== "string") return next(errorUtils.getBadRequest("version is missing"));
+		const packageName = reqUtils.paramToString(req.params.package);
+		const tag = reqUtils.paramToString(req.params.tag);
 		const tags = {};
-		tags[req.params.tag] = req.body;
+		tags[tag] = req.body;
 		try {
-			await storage.mergeTagsNext(req.params.package, tags);
+			await storage.mergeTagsNext(packageName, tags);
 			res.status(constants.HTTP_STATUS.CREATED);
 			return next({ ok: constants.API_MESSAGE.TAG_ADDED });
 		} catch (err) {
@@ -21,10 +23,12 @@ function dist_tags_default(route, auth, storage, logger) {
 	route.put(DIST_TAGS_API_ENDPOINTS.tagging, can("publish"), media(HEADERS.JSON), addTagPackageVersionMiddleware);
 	route.put(DIST_TAGS_API_ENDPOINTS.tagging_package, can("publish"), media(HEADERS.JSON), addTagPackageVersionMiddleware);
 	route.delete(DIST_TAGS_API_ENDPOINTS.tagging_package, can("publish"), async function(req, res, next) {
+		const packageName = reqUtils.paramToString(req.params.package);
+		const tag = reqUtils.paramToString(req.params.tag);
 		const tags = {};
-		tags[req.params.tag] = null;
+		tags[tag] = null;
 		try {
-			await storage.mergeTagsNext(req.params.package, tags);
+			await storage.mergeTagsNext(packageName, tags);
 			res.status(constants.HTTP_STATUS.CREATED);
 			return next({ ok: constants.API_MESSAGE.TAG_REMOVED });
 		} catch (err) {
@@ -32,11 +36,11 @@ function dist_tags_default(route, auth, storage, logger) {
 		}
 	});
 	route.get(DIST_TAGS_API_ENDPOINTS.get_dist_tags, can("access"), async function(req, res, next) {
-		const name = req.params.package;
+		const packageName = reqUtils.paramToString(req.params.package);
 		const requestOptions = getRequestOptions(req);
 		try {
 			next((await storage.getPackageByOptions({
-				name,
+				name: packageName,
 				uplinksLook: true,
 				requestOptions
 			}))[constants.DIST_TAGS]);

package/build/dist-tags.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dist-tags.mjs","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n\n    const tags = {};\n    tags[req.params.tag] = req.body;\n    try {\n      await storage.mergeTagsNext(req.params.package, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const tags = {};\n      tags[req.params.tag] = null;\n      try {\n        await storage.mergeTagsNext(req.params.package, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,WAAW,cAAc,oBAAoB,CAAC;EAG5D,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO,IAAI;EAC3B,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,wBAAwB,SACxB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,CAAC;EACd,KAAK,IAAI,OAAO,OAAO;EACvB,IAAI;GACF,MAAM,QAAQ,cAAc,IAAI,OAAO,SAAS,IAAI;GACpD,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;GACF,CAAC,GACa,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}
+{"version":3,"file":"dist-tags.mjs","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils, reqUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const addTagPackageVersionMiddleware = async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<$NextFunctionVer> {\n    if (typeof req.body !== 'string') {\n      return next(errorUtils.getBadRequest('version is missing'));\n    }\n    const packageName = reqUtils.paramToString(req.params.package);\n    const tag = reqUtils.paramToString(req.params.tag);\n    const tags = {};\n    tags[tag] = req.body;\n    try {\n      await storage.mergeTagsNext(packageName, tags);\n      res.status(constants.HTTP_STATUS.CREATED);\n      return next({\n        ok: constants.API_MESSAGE.TAG_ADDED,\n      });\n    } catch (err) {\n      next(err);\n    }\n  };\n\n  // tagging a package.\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.put(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    addTagPackageVersionMiddleware\n  );\n\n  route.delete(\n    DIST_TAGS_API_ENDPOINTS.tagging_package,\n    can('publish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const tag = reqUtils.paramToString(req.params.tag);\n      const tags = {};\n      tags[tag] = null;\n      try {\n        await storage.mergeTagsNext(packageName, tags);\n        res.status(constants.HTTP_STATUS.CREATED);\n        return next({\n          ok: constants.API_MESSAGE.TAG_REMOVED,\n        });\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name: packageName,\n          uplinksLook: true,\n          requestOptions,\n        });\n        next(manifest[constants.DIST_TAGS]);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;AAUA,SAAA,kBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,WAAW,cAAc,oBAAoB,CAAC;EAE5D,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO,IAAI;EAChB,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC7C,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,wBAAwB,SACxB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO;EACZ,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,IAAI;GAC7C,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD,MAAM;IACN,aAAa;IACb;GACF,CAAC,EAAA,CACa,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/index.d.ts

@@ -1,5 +1,5 @@
-import { Router } from 'express';
-import { Auth } from '@verdaccio/auth';
-import { Storage } from '@verdaccio/store';
-import { Config, Logger } from '@verdaccio/types';
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Storage } from '@verdaccio/store';
+import type { Config, Logger } from '@verdaccio/types';
 export default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router;

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, config, logger);\n  ping(app);\n  v1Search(app, auth, storage, config, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAA,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,sBAAA,eAAe;CACpC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,OAAO,sBAAA,YAAY;CAC7B,IAAI,MAAM,WAAW,sBAAA,YAAY;CACjC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,SAAS,sBAAA,YAAY;CAI/B,IAAI,MAAM,SAAA,GAAA,sBAAA,OAAc,QAAQ,CAAC;CACjC,IAAI,MAAM,qBAAA,GAAA,sBAAA,OAA0B,sBAAsB,CAAC;CAG3D,CAAA,GAAA,sBAAA,oBAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,KAAA,GAAA,sBAAA,+BAAkC,SAAS,MAAM,CAAC;CACtD,IAAI,KAAA,GAAA,sBAAA,UAAa,MAAM,CAAC;CACxB,IAAI,IAAI,sBAAA,eAAe;CAEvB,IAAI,IAAI,sBAAA,kBAAkB;CAE1B,eAAA,QAAO,GAAG;CACV,gBAAA,QAAQ,KAAK,MAAM,MAAM;CACzB,eAAA,QAAO,KAAK,MAAM;CAClB,aAAA,QAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,gBAAA,QAAQ,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC1C,aAAA,QAAK,GAAG;CACR,iBAAA,QAAS,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC3C,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAA,QAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { Router } from 'express';\nimport express from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport {\n  antiLoop,\n  encodeScopePackage,\n  enforceGeneratedTokenMetadata,\n  makeURLrelative,\n  match,\n  registerBodyParser,\n  validateName,\n  validatePackage,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nimport distTags from './dist-tags';\nimport pkg from './package';\nimport ping from './ping';\nimport publish from './publish';\nimport search from './search';\nimport user from './user';\nimport login from './v1/login';\nimport profile from './v1/profile';\nimport v1Search from './v1/search';\nimport token from './v1/token';\nimport whoami from './whoami';\n\nexport default function (config: Config, auth: Auth, storage: Storage, logger: Logger): Router {\n  /* eslint new-cap:off */\n  const app = express.Router();\n\n  // validate all of these params as a package name\n  // this might be too harsh, so ask if it causes trouble\n  app.param('package', validatePackage);\n  app.param('filename', validateName);\n  app.param('tag', validateName);\n  app.param('version', validateName);\n  app.param('revision', validateName);\n  app.param('token', validateName);\n\n  // Express route parameter names must be valid JavaScript identifiers, which means\n  // they cannot start with a hyphen (-) or contain special characters like dots (.)\n  app.param('_rev', match(/^-rev$/));\n  app.param('org_couchdb_user', match(/^org\\.couchdb\\.user:/));\n\n  // Body parser must be registered before JWT middleware which pauses/resumes the stream\n  registerBodyParser(app, config);\n\n  // Avoid executing JWT twice when the parent app already registered the JWT middleware\n  const apiJwtMiddleware = auth.apiJWTmiddleware();\n  app.use((req, res, next) => {\n    const remoteUser = (req as any).remote_user ?? (res.locals as any).remote_user;\n    if (remoteUser) {\n      return next();\n    }\n    return apiJwtMiddleware(req, res, next);\n  });\n\n  app.use(enforceGeneratedTokenMetadata(storage, logger));\n  app.use(antiLoop(config));\n  app.use(makeURLrelative);\n  // encode / in a scoped package name to be matched as a single parameter in routes\n  app.use(encodeScopePackage);\n  // for \"npm whoami\"\n  whoami(app);\n  profile(app, auth, config);\n  search(app, logger);\n  user(app, auth, config, logger);\n  distTags(app, auth, storage, logger);\n  publish(app, auth, storage, config, logger);\n  ping(app);\n  v1Search(app, auth, storage, config, logger);\n  token(app, auth, storage, config, logger);\n  pkg(app, auth, storage, logger);\n  if (config.flags?.webLogin) {\n    login(app, auth, storage, config, logger);\n  }\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA6BA,SAAA,YAAyB,QAAgB,MAAY,SAAkB,QAAwB;CAE7F,MAAM,MAAM,QAAA,QAAQ,OAAO;CAI3B,IAAI,MAAM,WAAW,sBAAA,eAAe;CACpC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,OAAO,sBAAA,YAAY;CAC7B,IAAI,MAAM,WAAW,sBAAA,YAAY;CACjC,IAAI,MAAM,YAAY,sBAAA,YAAY;CAClC,IAAI,MAAM,SAAS,sBAAA,YAAY;CAI/B,IAAI,MAAM,SAAA,GAAA,sBAAA,MAAA,CAAc,QAAQ,CAAC;CACjC,IAAI,MAAM,qBAAA,GAAA,sBAAA,MAAA,CAA0B,sBAAsB,CAAC;CAG3D,CAAA,GAAA,sBAAA,mBAAA,CAAmB,KAAK,MAAM;CAG9B,MAAM,mBAAmB,KAAK,iBAAiB;CAC/C,IAAI,KAAK,KAAK,KAAK,SAAS;EAE1B,IADoB,IAAY,eAAgB,IAAI,OAAe,aAEjE,OAAO,KAAK;EAEd,OAAO,iBAAiB,KAAK,KAAK,IAAI;CACxC,CAAC;CAED,IAAI,KAAA,GAAA,sBAAA,8BAAA,CAAkC,SAAS,MAAM,CAAC;CACtD,IAAI,KAAA,GAAA,sBAAA,SAAA,CAAa,MAAM,CAAC;CACxB,IAAI,IAAI,sBAAA,eAAe;CAEvB,IAAI,IAAI,sBAAA,kBAAkB;CAE1B,eAAA,QAAO,GAAG;CACV,gBAAA,QAAQ,KAAK,MAAM,MAAM;CACzB,eAAA,QAAO,KAAK,MAAM;CAClB,aAAA,QAAK,KAAK,MAAM,QAAQ,MAAM;CAC9B,kBAAA,QAAS,KAAK,MAAM,SAAS,MAAM;CACnC,gBAAA,QAAQ,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC1C,aAAA,QAAK,GAAG;CACR,iBAAA,QAAS,KAAK,MAAM,SAAS,QAAQ,MAAM;CAC3C,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CACxC,gBAAA,QAAI,KAAK,MAAM,SAAS,MAAM;CAC9B,IAAI,OAAO,OAAO,UAChB,cAAA,QAAM,KAAK,MAAM,SAAS,QAAQ,MAAM;CAE1C,OAAO;AACT"}

package/build/package.d.ts

@@ -1,5 +1,5 @@
-import { Router } from 'express';
-import { Auth } from '@verdaccio/auth';
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
 import { Storage } from '@verdaccio/store';
-import { Logger } from '@verdaccio/types';
+import type { Logger } from '@verdaccio/types';
 export default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void;

package/build/package.js

@@ -12,8 +12,8 @@ function package_default(route, auth, storage, logger) {
 		afterAll: (a, b) => logger.trace(a, b)
 	});
 	route.get(_verdaccio_middleware.PACKAGE_API_ENDPOINTS.get_package_by_version, can("access"), async function(req, _res, next) {
-		const name = req.params.package;
-		const version = req.params.version;
+		const name = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const version = _verdaccio_core.reqUtils.paramToString(req.params.version) || void 0;
 		debug$1("get package by version: %o %o", name, version);
 		const abbreviated = _verdaccio_core.stringUtils.getByQualityPriorityValue(req.get("Accept")) === _verdaccio_store.Storage.ABBREVIATED_HEADER;
 		debug$1("abbreviated: %o", abbreviated);
@@ -39,7 +39,8 @@ function package_default(route, auth, storage, logger) {
 		}
 	});
 	route.get(_verdaccio_middleware.PACKAGE_API_ENDPOINTS.get_package_tarball, can("access"), async function(req, res, next) {
-		const { package: pkgName, filename } = req.params;
+		const pkgName = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const filename = _verdaccio_core.reqUtils.paramToString(req.params.filename);
 		const abort = new AbortController();
 		try {
 			debug$1("downloading tarball %o", filename);

package/build/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const version = req.params.version;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAWA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;AAEhD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,IACJ,sBAAA,sBAAsB,wBACtB,IAAI,QAAQ,GACZ,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,UAAU,IAAI,OAAO;EAC3B,QAAM,iCAAiC,MAAM,OAAO;EACpD,MAAM,cACJ,gBAAA,YAAY,0BAA0B,IAAI,IAAI,QAAQ,CAAC,MAAM,iBAAA,QAAQ;EACvE,QAAM,mBAAmB,WAAW;EAEpC,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,GAAG;EAE5C,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;GACF,CAAC;GACD,IAAI,aAAa;IACf,QAAM,sBAAsB;IAC5B,KAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,oBAAoB;GACvE,OAAO;IACL,QAAM,eAAe;IACrB,KAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,IAAI;GACvD;GAEA,KAAK,QAAQ;EACf,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,sBAAsB,qBACtB,IAAI,QAAQ,GACZ,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,EAAE,SAAS,SAAS,aAAa,IAAI;EAC3C,MAAM,QAAQ,IAAI,gBAAgB;EAClC,IAAI;GACF,QAAM,0BAA0B,QAAQ;GACxC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,OAGhB,CAAC;GAED,OAAO,GAAG,mBAAmB,SAAS;IACpC,QAAM,mBAAmB,IAAI;IAC7B,IAAI,OAAO,gBAAA,YAAY,gBAAgB,IAAI;GAC7C,CAAC;GAED,OAAO,KAAK,UAAU,QAAQ;IAC5B,QAAM,gCAAgC,GAAG;IACzC,IAAI,OAAO,aAAa,GAAG;IAC3B,KAAK,GAAG;GACV,CAAC;GAED,IAAI,GAAG,eAAe;IACpB,QAAM,0BAA0B,IAAI,GAAG;IACvC,MAAM,MAAM;GACd,CAAC;GAED,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,YAAY;GACrD,OAAO,KAAK,GAAG;EACjB,SAAS,KAAU;GACjB,IAAI,OAAO,aAAa,GAAG;GAC3B,KAAK,GAAG;EACV;CACF,CACF;AACF"}
+{"version":3,"file":"package.js","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, reqUtils, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = reqUtils.paramToString(req.params.package);\n      const version = reqUtils.paramToString(req.params.version) || undefined;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const pkgName = reqUtils.paramToString(req.params.package);\n      const filename = reqUtils.paramToString(req.params.filename);\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;;;AAWA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,uBAAuB;AAEhD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,OAAA,GAAA,sBAAA,MAAA,CAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,IACJ,sBAAA,sBAAsB,wBACtB,IAAI,QAAQ,GACZ,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EACtD,MAAM,UAAU,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO,KAAK,KAAA;EAC9D,QAAM,iCAAiC,MAAM,OAAO;EACpD,MAAM,cACJ,gBAAA,YAAY,0BAA0B,IAAI,IAAI,QAAQ,CAAC,MAAM,iBAAA,QAAQ;EACvE,QAAM,mBAAmB,WAAW;EAEpC,MAAM,kBAAA,GAAA,sBAAA,kBAAA,CAAmC,GAAG;EAE5C,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;GACF,CAAC;GACD,IAAI,aAAa;IACf,QAAM,sBAAsB;IAC5B,KAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,oBAAoB;GACvE,OAAO;IACL,QAAM,eAAe;IACrB,KAAK,UAAU,gBAAA,YAAY,cAAc,gBAAA,QAAQ,IAAI;GACvD;GAEA,KAAK,QAAQ;EACf,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,sBAAsB,qBACtB,IAAI,QAAQ,GACZ,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,UAAU,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EACzD,MAAM,WAAW,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,QAAQ,IAAI,gBAAgB;EAClC,IAAI;GACF,QAAM,0BAA0B,QAAQ;GACxC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,OAGhB,CAAC;GAED,OAAO,GAAG,mBAAmB,SAAS;IACpC,QAAM,mBAAmB,IAAI;IAC7B,IAAI,OAAO,gBAAA,YAAY,gBAAgB,IAAI;GAC7C,CAAC;GAED,OAAO,KAAK,UAAU,QAAQ;IAC5B,QAAM,gCAAgC,GAAG;IACzC,IAAI,OAAO,aAAa,GAAG;IAC3B,KAAK,GAAG;GACV,CAAC;GAED,IAAI,GAAG,eAAe;IACpB,QAAM,0BAA0B,IAAI,GAAG;IACvC,MAAM,MAAM;GACd,CAAC;GAED,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,YAAY;GACrD,OAAO,KAAK,GAAG;EACjB,SAAS,KAAU;GACjB,IAAI,OAAO,aAAa,GAAG;GAC3B,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/package.mjs

@@ -1,5 +1,5 @@
 import { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from "@verdaccio/middleware";
-import { HEADERS, HEADER_TYPE, stringUtils } from "@verdaccio/core";
+import { HEADERS, HEADER_TYPE, reqUtils, stringUtils } from "@verdaccio/core";
 import buildDebug from "debug";
 import { Storage } from "@verdaccio/store";
 //#region src/package.ts
@@ -10,8 +10,8 @@ function package_default(route, auth, storage, logger) {
 		afterAll: (a, b) => logger.trace(a, b)
 	});
 	route.get(PACKAGE_API_ENDPOINTS.get_package_by_version, can("access"), async function(req, _res, next) {
-		const name = req.params.package;
-		const version = req.params.version;
+		const name = reqUtils.paramToString(req.params.package);
+		const version = reqUtils.paramToString(req.params.version) || void 0;
 		debug("get package by version: %o %o", name, version);
 		const abbreviated = stringUtils.getByQualityPriorityValue(req.get("Accept")) === Storage.ABBREVIATED_HEADER;
 		debug("abbreviated: %o", abbreviated);
@@ -37,7 +37,8 @@ function package_default(route, auth, storage, logger) {
 		}
 	});
 	route.get(PACKAGE_API_ENDPOINTS.get_package_tarball, can("access"), async function(req, res, next) {
-		const { package: pkgName, filename } = req.params;
+		const pkgName = reqUtils.paramToString(req.params.package);
+		const filename = reqUtils.paramToString(req.params.filename);
 		const abort = new AbortController();
 		try {
 			debug("downloading tarball %o", filename);

package/build/package.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"package.mjs","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = req.params.package;\n      const version = req.params.version;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const { package: pkgName, filename } = req.params;\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;AAWA,IAAM,QAAQ,WAAW,uBAAuB;AAEhD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,IACJ,sBAAsB,wBACtB,IAAI,QAAQ,GACZ,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,IAAI,OAAO;EACxB,MAAM,UAAU,IAAI,OAAO;EAC3B,MAAM,iCAAiC,MAAM,OAAO;EACpD,MAAM,cACJ,YAAY,0BAA0B,IAAI,IAAI,QAAQ,CAAC,MAAM,QAAQ;EACvE,MAAM,mBAAmB,WAAW;EAEpC,MAAM,iBAAiB,kBAAkB,GAAG;EAE5C,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;GACF,CAAC;GACD,IAAI,aAAa;IACf,MAAM,sBAAsB;IAC5B,KAAK,UAAU,YAAY,cAAc,QAAQ,oBAAoB;GACvE,OAAO;IACL,MAAM,eAAe;IACrB,KAAK,UAAU,YAAY,cAAc,QAAQ,IAAI;GACvD;GAEA,KAAK,QAAQ;EACf,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAsB,qBACtB,IAAI,QAAQ,GACZ,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,EAAE,SAAS,SAAS,aAAa,IAAI;EAC3C,MAAM,QAAQ,IAAI,gBAAgB;EAClC,IAAI;GACF,MAAM,0BAA0B,QAAQ;GACxC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,OAGhB,CAAC;GAED,OAAO,GAAG,mBAAmB,SAAS;IACpC,MAAM,mBAAmB,IAAI;IAC7B,IAAI,OAAO,YAAY,gBAAgB,IAAI;GAC7C,CAAC;GAED,OAAO,KAAK,UAAU,QAAQ;IAC5B,MAAM,gCAAgC,GAAG;IACzC,IAAI,OAAO,aAAa,GAAG;IAC3B,KAAK,GAAG;GACV,CAAC;GAED,IAAI,GAAG,eAAe;IACpB,MAAM,0BAA0B,IAAI,GAAG;IACvC,MAAM,MAAM;GACd,CAAC;GAED,IAAI,OAAO,QAAQ,cAAc,QAAQ,YAAY;GACrD,OAAO,KAAK,GAAG;EACjB,SAAS,KAAU;GACjB,IAAI,OAAO,aAAa,GAAG;GAC3B,KAAK,GAAG;EACV;CACF,CACF;AACF"}
+{"version":3,"file":"package.mjs","names":[],"sources":["../src/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE, reqUtils, stringUtils } from '@verdaccio/core';\nimport { PACKAGE_API_ENDPOINTS, allow, getRequestOptions } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:package');\n\nexport default function (route: Router, auth: Auth, storage: Storage, logger: Logger): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_by_version,\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      _res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = reqUtils.paramToString(req.params.package);\n      const version = reqUtils.paramToString(req.params.version) || undefined;\n      debug('get package by version: %o %o', name, version);\n      const abbreviated =\n        stringUtils.getByQualityPriorityValue(req.get('Accept')) === Storage.ABBREVIATED_HEADER;\n      debug('abbreviated: %o', abbreviated);\n\n      const requestOptions = getRequestOptions(req);\n\n      try {\n        const manifest = await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated,\n          version,\n          requestOptions,\n        });\n        if (abbreviated) {\n          debug('abbreviated response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_INSTALL_CHARSET);\n        } else {\n          debug('full response');\n          _res.setHeader(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON);\n        }\n\n        next(manifest);\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n\n  route.get(\n    PACKAGE_API_ENDPOINTS.get_package_tarball,\n    can('access'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next): Promise<void> {\n      const pkgName = reqUtils.paramToString(req.params.package);\n      const filename = reqUtils.paramToString(req.params.filename);\n      const abort = new AbortController();\n      try {\n        debug('downloading tarball %o', filename);\n        const stream = (await storage.getTarball(pkgName, filename, {\n          signal: abort.signal,\n          // TODO: review why this param\n          // enableRemote: true,\n        })) as any;\n\n        stream.on('content-length', (size) => {\n          debug('tarball size %o', size);\n          res.header(HEADER_TYPE.CONTENT_LENGTH, size);\n        });\n\n        stream.once('error', (err) => {\n          debug('error on download tarball %o', err);\n          res.locals.report_error(err);\n          next(err);\n        });\n\n        req.on('abort', () => {\n          debug('request aborted for %o', req.url);\n          abort.abort();\n        });\n\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.OCTET_STREAM);\n        stream.pipe(res);\n      } catch (err: any) {\n        res.locals.report_error(err);\n        next(err);\n      }\n    }\n  );\n}\n"],"mappings":";;;;;AAWA,IAAM,QAAQ,WAAW,uBAAuB;AAEhD,SAAA,gBAAyB,OAAe,MAAY,SAAkB,QAAsB;CAC1F,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,IACJ,sBAAsB,wBACtB,IAAI,QAAQ,GACZ,eACE,KACA,MACA,MACe;EACf,MAAM,OAAO,SAAS,cAAc,IAAI,OAAO,OAAO;EACtD,MAAM,UAAU,SAAS,cAAc,IAAI,OAAO,OAAO,KAAK,KAAA;EAC9D,MAAM,iCAAiC,MAAM,OAAO;EACpD,MAAM,cACJ,YAAY,0BAA0B,IAAI,IAAI,QAAQ,CAAC,MAAM,QAAQ;EACvE,MAAM,mBAAmB,WAAW;EAEpC,MAAM,iBAAiB,kBAAkB,GAAG;EAE5C,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,oBAAoB;IACjD;IACA,aAAa;IACb;IACA;IACA;GACF,CAAC;GACD,IAAI,aAAa;IACf,MAAM,sBAAsB;IAC5B,KAAK,UAAU,YAAY,cAAc,QAAQ,oBAAoB;GACvE,OAAO;IACL,MAAM,eAAe;IACrB,KAAK,UAAU,YAAY,cAAc,QAAQ,IAAI;GACvD;GAEA,KAAK,QAAQ;EACf,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAsB,qBACtB,IAAI,QAAQ,GACZ,eAAgB,KAAqB,KAAsB,MAAqB;EAC9E,MAAM,UAAU,SAAS,cAAc,IAAI,OAAO,OAAO;EACzD,MAAM,WAAW,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,QAAQ,IAAI,gBAAgB;EAClC,IAAI;GACF,MAAM,0BAA0B,QAAQ;GACxC,MAAM,SAAU,MAAM,QAAQ,WAAW,SAAS,UAAU,EAC1D,QAAQ,MAAM,OAGhB,CAAC;GAED,OAAO,GAAG,mBAAmB,SAAS;IACpC,MAAM,mBAAmB,IAAI;IAC7B,IAAI,OAAO,YAAY,gBAAgB,IAAI;GAC7C,CAAC;GAED,OAAO,KAAK,UAAU,QAAQ;IAC5B,MAAM,gCAAgC,GAAG;IACzC,IAAI,OAAO,aAAa,GAAG;IAC3B,KAAK,GAAG;GACV,CAAC;GAED,IAAI,GAAG,eAAe;IACpB,MAAM,0BAA0B,IAAI,GAAG;IACvC,MAAM,MAAM;GACd,CAAC;GAED,IAAI,OAAO,QAAQ,cAAc,QAAQ,YAAY;GACrD,OAAO,KAAK,GAAG;EACjB,SAAS,KAAU;GACjB,IAAI,OAAO,aAAa,GAAG;GAC3B,KAAK,GAAG;EACV;CACF,CACF;AACF"}

package/build/ping.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import type { Router } from 'express';
 export default function (route: Router): void;

package/build/publish.d.ts

@@ -1,7 +1,7 @@
-import { Router } from 'express';
-import { Auth } from '@verdaccio/auth';
-import { Storage } from '@verdaccio/store';
-import { Config, Logger } from '@verdaccio/types';
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Storage } from '@verdaccio/store';
+import type { Config, Logger } from '@verdaccio/types';
 /**
    * Publish a package / update package
    *

package/build/publish.js

@@ -108,8 +108,8 @@ function publish(router, auth, storage, config, logger) {
 	* npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
 	*/
 	router.delete(_verdaccio_middleware.PUBLISH_API_ENDPOINTS.publish_package, can("unpublish"), async function(req, res, next) {
-		const packageName = req.params.package;
-		const rev = req.params.revision;
+		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const rev = _verdaccio_core.reqUtils.paramToString(req.params.revision);
 		const username = req?.remote_user?.name;
 		logger.debug({ packageName }, `unpublishing @{packageName}`);
 		try {
@@ -128,8 +128,9 @@ function publish(router, auth, storage, config, logger) {
 		}
 	});
 	router.delete(_verdaccio_middleware.PUBLISH_API_ENDPOINTS.remove_tarball, can("unpublish"), async function(req, res, next) {
-		const packageName = req.params.package;
-		const { filename, revision } = req.params;
+		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const filename = _verdaccio_core.reqUtils.paramToString(req.params.filename);
+		const revision = _verdaccio_core.reqUtils.paramToString(req.params.revision);
 		const username = req?.remote_user?.name;
 		logger.debug({
 			packageName,
@@ -163,8 +164,8 @@ function publishPackage(storage, config, logger, origin) {
 	return async function(req, res, next) {
 		debug$1(origin);
 		const ac = new AbortController();
-		const packageName = req.params.package;
-		const { revision } = req.params;
+		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
+		const revision = _verdaccio_core.reqUtils.paramToString(req.params.revision);
 		debug$1("publishing package %s", packageName);
 		debug$1("revision %s", revision);
 		if (debug$1.enabled) debug$1("body %o", req.body);
@@ -196,5 +197,6 @@ function publishPackage(storage, config, logger, origin) {
 }
 //#endregion
 exports.default = publish;
+exports.publishPackage = publishPackage;
 
 //# sourceMappingURL=publish.js.map

package/build/publish.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish.js","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS, tarballUtils } from '@verdaccio/core';\nimport { notify } from '@verdaccio/hooks';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Change owners of a package\n   *\n   * Changing owners (maintainers) of a package uses the publish endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n\n        // send notification of package removal\n        const metadata: Partial<Manifest> = { name: packageName, _rev: rev };\n\n        void notify(metadata, config, req.remote_user, packageName, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n\n        // send notification of version removal\n        // getVersionFromTarball returns undefined when the filename is not parseable;\n        // fall back to the package name so we never report `name@undefined`\n        const version = tarballUtils.getVersionFromTarball(filename);\n        const metadata: Partial<Manifest> = { name: packageName, _rev: revision };\n        const publishedPackage = version ? `${packageName}@${version}` : packageName;\n\n        void notify(metadata, config, req.remote_user, publishedPackage, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(\n  storage: Storage,\n  config: Config,\n  logger: Logger,\n  origin: string\n): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n      res.status(HTTP_STATUS.CREATED);\n\n      // send notification of publication (notification step, non transactional)\n      // a publish body is a packument; the published version is the single entry\n      // under `versions` (see storage.updateManifest), not a top-level field\n      const [version] = Object.keys(metadata.versions ?? {});\n      void notify(\n        metadata,\n        config,\n        req.remote_user,\n        `${metadata.name}@${version}`,\n        'publish'\n      ).catch((error: any) => {\n        logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n      });\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EhD,SAAwB,QACtB,QACA,MACA,SACA,QACA,QACM;CACN,MAAM,OAAA,GAAA,sBAAA,OAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,OAAO,IACL,sBAAA,sBAAsB,aACtB,IAAI,SAAS,IAAA,GAAA,sBAAA,OACP,gBAAA,QAAQ,IAAI,GAClB,sBAAA,YACA,eAAe,SAAS,QAAQ,QAAQ,qBAAqB,CAC/D;CAEA,OAAO,IACL,sBAAA,sBAAsB,iBACtB,IAAI,WAAW,IAAA,GAAA,sBAAA,OACT,gBAAA,QAAQ,IAAI,GAClB,sBAAA,YACA,eAAe,SAAS,QAAQ,QAAQ,uBAAuB,CACjE;;;;;;;;;;;;;;;;;;CAmBA,OAAO,OACL,sBAAA,sBAAsB,iBACtB,IAAI,WAAW,GACf,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MAAM,EAAE,YAAY,GAAG,6BAA6B;EAC3D,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,KAAK,QAAQ;GACtD,QAAM,0BAA0B,WAAW;GAC3C,IAAI,OAAO,gBAAA,YAAY,OAAO;GAK9B,CAAA,GAAA,iBAAA,QAAY;IAF0B,MAAM;IAAa,MAAM;GAEnD,GAAU,QAAQ,IAAI,aAAa,aAAa,WAAW,EAAE,OACtE,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,YAAY,CAAC;EAC7C,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;CAMA,OAAO,OACL,sBAAA,sBAAsB,gBACtB,IAAI,WAAW,GACf,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MACL;GAAE;GAAa;GAAU;EAAS,GAClC,kEACF;EACA,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,QAAQ;GACrE,IAAI,OAAO,gBAAA,YAAY,OAAO;GAE9B,OAAO,MACL;IAAE;IAAa;IAAU;GAAS,GAClC,sEACF;GAKA,MAAM,UAAU,gBAAA,aAAa,sBAAsB,QAAQ;GAC3D,MAAM,WAA8B;IAAE,MAAM;IAAa,MAAM;GAAS;GACxE,MAAM,mBAAmB,UAAU,GAAG,YAAY,GAAG,YAAY;GAEjE,CAAA,GAAA,iBAAA,QAAY,UAAU,QAAQ,IAAI,aAAa,kBAAkB,WAAW,EAAE,OAC3E,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,gBAAgB,CAAC;EACjD,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF;AAEA,SAAgB,eACd,SACA,QACA,QACA,QACK;CACL,OAAO,eACL,KACA,KACA,MACe;EACf,QAAM,MAAM;EACZ,MAAM,KAAK,IAAI,gBAAgB;EAC/B,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;EACzB,QAAM,yBAAyB,WAAW;EAC1C,QAAM,eAAe,QAAQ;EAC7B,IAAI,QAAM,SACR,QAAM,WAAW,IAAI,IAAI;EAE3B,MAAM,WAAW,IAAI;EAErB,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;EAEjE,MAAM,kBAAA,GAAA,sBAAA,mBAAmC,GAAG;EAE5C,IAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;GACf,CAAC;GACD,QAAM,wBAAwB,WAAW;GACzC,IAAI,OAAO,gBAAA,YAAY,OAAO;GAK9B,MAAM,CAAC,WAAW,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC;GACrD,CAAA,GAAA,iBAAA,QACE,UACA,QACA,IAAI,aACJ,GAAG,SAAS,KAAK,GAAG,WACpB,SACF,EAAE,OAAO,UAAe;IACtB,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CAAC;GAED,OAAO,KAAK;IACV,SAAS;IACT,IAAI;GACN,CAAC;EACH,SAAS,KAAU;GAEjB,KAAK,GAAG;EACV;CACF;AACF"}
+{"version":3,"file":"publish.js","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS, reqUtils, tarballUtils } from '@verdaccio/core';\nimport { notify } from '@verdaccio/hooks';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Change owners of a package\n   *\n   * Changing owners (maintainers) of a package uses the publish endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const rev = reqUtils.paramToString(req.params.revision);\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n\n        // send notification of package removal\n        const metadata: Partial<Manifest> = { name: packageName, _rev: rev };\n\n        void notify(metadata, config, req.remote_user, packageName, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const filename = reqUtils.paramToString(req.params.filename);\n      const revision = reqUtils.paramToString(req.params.revision);\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n\n        // send notification of version removal\n        // getVersionFromTarball returns undefined when the filename is not parseable;\n        // fall back to the package name so we never report `name@undefined`\n        const version = tarballUtils.getVersionFromTarball(filename);\n        const metadata: Partial<Manifest> = { name: packageName, _rev: revision };\n        const publishedPackage = version ? `${packageName}@${version}` : packageName;\n\n        void notify(metadata, config, req.remote_user, publishedPackage, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(\n  storage: Storage,\n  config: Config,\n  logger: Logger,\n  origin: string\n): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = reqUtils.paramToString(req.params.package);\n    const revision = reqUtils.paramToString(req.params.revision);\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n      res.status(HTTP_STATUS.CREATED);\n\n      // send notification of publication (notification step, non transactional)\n      // a publish body is a packument; the published version is the single entry\n      // under `versions` (see storage.updateManifest), not a top-level field\n      const [version] = Object.keys(metadata.versions ?? {});\n      void notify(\n        metadata,\n        config,\n        req.remote_user,\n        `${metadata.name}@${version}`,\n        'publish'\n      ).catch((error: any) => {\n        logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n      });\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EhD,SAAwB,QACtB,QACA,MACA,SACA,QACA,QACM;CACN,MAAM,OAAA,GAAA,sBAAA,MAAA,CAAY,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,OAAO,IACL,sBAAA,sBAAsB,aACtB,IAAI,SAAS,IAAA,GAAA,sBAAA,MAAA,CACP,gBAAA,QAAQ,IAAI,GAClB,sBAAA,YACA,eAAe,SAAS,QAAQ,QAAQ,qBAAqB,CAC/D;CAEA,OAAO,IACL,sBAAA,sBAAsB,iBACtB,IAAI,WAAW,IAAA,GAAA,sBAAA,MAAA,CACT,gBAAA,QAAQ,IAAI,GAClB,sBAAA,YACA,eAAe,SAAS,QAAQ,QAAQ,uBAAuB,CACjE;;;;;;;;;;;;;;;;;;CAmBA,OAAO,OACL,sBAAA,sBAAsB,iBACtB,IAAI,WAAW,GACf,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;EACtD,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MAAM,EAAE,YAAY,GAAG,6BAA6B;EAC3D,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,KAAK,QAAQ;GACtD,QAAM,0BAA0B,WAAW;GAC3C,IAAI,OAAO,gBAAA,YAAY,OAAO;GAK9B,CAAA,GAAA,iBAAA,OAAA,CAAY;IAF0B,MAAM;IAAa,MAAM;GAEnD,GAAU,QAAQ,IAAI,aAAa,aAAa,WAAW,CAAC,CAAC,OACtE,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,YAAY,CAAC;EAC7C,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;CAMA,OAAO,OACL,sBAAA,sBAAsB,gBACtB,IAAI,WAAW,GACf,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,WAAW,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,WAAW,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MACL;GAAE;GAAa;GAAU;EAAS,GAClC,kEACF;EACA,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,QAAQ;GACrE,IAAI,OAAO,gBAAA,YAAY,OAAO;GAE9B,OAAO,MACL;IAAE;IAAa;IAAU;GAAS,GAClC,sEACF;GAKA,MAAM,UAAU,gBAAA,aAAa,sBAAsB,QAAQ;GAC3D,MAAM,WAA8B;IAAE,MAAM;IAAa,MAAM;GAAS;GACxE,MAAM,mBAAmB,UAAU,GAAG,YAAY,GAAG,YAAY;GAEjE,CAAA,GAAA,iBAAA,OAAA,CAAY,UAAU,QAAQ,IAAI,aAAa,kBAAkB,WAAW,CAAC,CAAC,OAC3E,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,gBAAA,YAAY,gBAAgB,CAAC;EACjD,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF;AAEA,SAAgB,eACd,SACA,QACA,QACA,QACK;CACL,OAAO,eACL,KACA,KACA,MACe;EACf,QAAM,MAAM;EACZ,MAAM,KAAK,IAAI,gBAAgB;EAC/B,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,WAAW,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,QAAM,yBAAyB,WAAW;EAC1C,QAAM,eAAe,QAAQ;EAC7B,IAAI,QAAM,SACR,QAAM,WAAW,IAAI,IAAI;EAE3B,MAAM,WAAW,IAAI;EAErB,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;EAEjE,MAAM,kBAAA,GAAA,sBAAA,kBAAA,CAAmC,GAAG;EAE5C,IAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;GACf,CAAC;GACD,QAAM,wBAAwB,WAAW;GACzC,IAAI,OAAO,gBAAA,YAAY,OAAO;GAK9B,MAAM,CAAC,WAAW,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC;GACrD,CAAA,GAAA,iBAAA,OAAA,CACE,UACA,QACA,IAAI,aACJ,GAAG,SAAS,KAAK,GAAG,WACpB,SACF,CAAC,CAAC,OAAO,UAAe;IACtB,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CAAC;GAED,OAAO,KAAK;IACV,SAAS;IACT,IAAI;GACN,CAAC;EACH,SAAS,KAAU;GAEjB,KAAK,GAAG;EACV;CACF;AACF"}

package/build/publish.mjs

@@ -1,5 +1,5 @@
 import { PUBLISH_API_ENDPOINTS, allow, expectJson, getRequestOptions, media } from "@verdaccio/middleware";
-import { API_MESSAGE, HEADERS, HTTP_STATUS, tarballUtils } from "@verdaccio/core";
+import { API_MESSAGE, HEADERS, HTTP_STATUS, reqUtils, tarballUtils } from "@verdaccio/core";
 import buildDebug from "debug";
 import { notify } from "@verdaccio/hooks";
 //#region src/publish.ts
@@ -106,8 +106,8 @@ function publish(router, auth, storage, config, logger) {
 	* npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms
 	*/
 	router.delete(PUBLISH_API_ENDPOINTS.publish_package, can("unpublish"), async function(req, res, next) {
-		const packageName = req.params.package;
-		const rev = req.params.revision;
+		const packageName = reqUtils.paramToString(req.params.package);
+		const rev = reqUtils.paramToString(req.params.revision);
 		const username = req?.remote_user?.name;
 		logger.debug({ packageName }, `unpublishing @{packageName}`);
 		try {
@@ -126,8 +126,9 @@ function publish(router, auth, storage, config, logger) {
 		}
 	});
 	router.delete(PUBLISH_API_ENDPOINTS.remove_tarball, can("unpublish"), async function(req, res, next) {
-		const packageName = req.params.package;
-		const { filename, revision } = req.params;
+		const packageName = reqUtils.paramToString(req.params.package);
+		const filename = reqUtils.paramToString(req.params.filename);
+		const revision = reqUtils.paramToString(req.params.revision);
 		const username = req?.remote_user?.name;
 		logger.debug({
 			packageName,
@@ -161,8 +162,8 @@ function publishPackage(storage, config, logger, origin) {
 	return async function(req, res, next) {
 		debug(origin);
 		const ac = new AbortController();
-		const packageName = req.params.package;
-		const { revision } = req.params;
+		const packageName = reqUtils.paramToString(req.params.package);
+		const revision = reqUtils.paramToString(req.params.revision);
 		debug("publishing package %s", packageName);
 		debug("revision %s", revision);
 		if (debug.enabled) debug("body %o", req.body);
@@ -193,6 +194,6 @@ function publishPackage(storage, config, logger, origin) {
 	};
 }
 //#endregion
-export { publish as default };
+export { publish as default, publishPackage };
 
 //# sourceMappingURL=publish.mjs.map

package/build/publish.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"publish.mjs","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS, tarballUtils } from '@verdaccio/core';\nimport { notify } from '@verdaccio/hooks';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Change owners of a package\n   *\n   * Changing owners (maintainers) of a package uses the publish endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = req.params.package;\n      const rev = req.params.revision;\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n\n        // send notification of package removal\n        const metadata: Partial<Manifest> = { name: packageName, _rev: rev };\n\n        void notify(metadata, config, req.remote_user, packageName, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = req.params.package;\n      const { filename, revision } = req.params;\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n\n        // send notification of version removal\n        // getVersionFromTarball returns undefined when the filename is not parseable;\n        // fall back to the package name so we never report `name@undefined`\n        const version = tarballUtils.getVersionFromTarball(filename);\n        const metadata: Partial<Manifest> = { name: packageName, _rev: revision };\n        const publishedPackage = version ? `${packageName}@${version}` : packageName;\n\n        void notify(metadata, config, req.remote_user, publishedPackage, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(\n  storage: Storage,\n  config: Config,\n  logger: Logger,\n  origin: string\n): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = req.params.package;\n    const { revision } = req.params;\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n      res.status(HTTP_STATUS.CREATED);\n\n      // send notification of publication (notification step, non transactional)\n      // a publish body is a packument; the published version is the single entry\n      // under `versions` (see storage.updateManifest), not a top-level field\n      const [version] = Object.keys(metadata.versions ?? {});\n      void notify(\n        metadata,\n        config,\n        req.remote_user,\n        `${metadata.name}@${version}`,\n        'publish'\n      ).catch((error: any) => {\n        logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n      });\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;AAkBA,IAAM,QAAQ,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EhD,SAAwB,QACtB,QACA,MACA,SACA,QACA,QACM;CACN,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,OAAO,IACL,sBAAsB,aACtB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,YACA,eAAe,SAAS,QAAQ,QAAQ,qBAAqB,CAC/D;CAEA,OAAO,IACL,sBAAsB,iBACtB,IAAI,WAAW,GACf,MAAM,QAAQ,IAAI,GAClB,YACA,eAAe,SAAS,QAAQ,QAAQ,uBAAuB,CACjE;;;;;;;;;;;;;;;;;;CAmBA,OAAO,OACL,sBAAsB,iBACtB,IAAI,WAAW,GACf,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,MAAM,IAAI,OAAO;EACvB,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MAAM,EAAE,YAAY,GAAG,6BAA6B;EAC3D,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,KAAK,QAAQ;GACtD,MAAM,0BAA0B,WAAW;GAC3C,IAAI,OAAO,YAAY,OAAO;GAK9B,OAAY;IAF0B,MAAM;IAAa,MAAM;GAEnD,GAAU,QAAQ,IAAI,aAAa,aAAa,WAAW,EAAE,OACtE,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,YAAY,YAAY,CAAC;EAC7C,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;CAMA,OAAO,OACL,sBAAsB,gBACtB,IAAI,WAAW,GACf,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MACL;GAAE;GAAa;GAAU;EAAS,GAClC,kEACF;EACA,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,QAAQ;GACrE,IAAI,OAAO,YAAY,OAAO;GAE9B,OAAO,MACL;IAAE;IAAa;IAAU;GAAS,GAClC,sEACF;GAKA,MAAM,UAAU,aAAa,sBAAsB,QAAQ;GAC3D,MAAM,WAA8B;IAAE,MAAM;IAAa,MAAM;GAAS;GACxE,MAAM,mBAAmB,UAAU,GAAG,YAAY,GAAG,YAAY;GAEjE,OAAY,UAAU,QAAQ,IAAI,aAAa,kBAAkB,WAAW,EAAE,OAC3E,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,YAAY,gBAAgB,CAAC;EACjD,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF;AAEA,SAAgB,eACd,SACA,QACA,QACA,QACK;CACL,OAAO,eACL,KACA,KACA,MACe;EACf,MAAM,MAAM;EACZ,MAAM,KAAK,IAAI,gBAAgB;EAC/B,MAAM,cAAc,IAAI,OAAO;EAC/B,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,yBAAyB,WAAW;EAC1C,MAAM,eAAe,QAAQ;EAC7B,IAAI,MAAM,SACR,MAAM,WAAW,IAAI,IAAI;EAE3B,MAAM,WAAW,IAAI;EAErB,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;EAEjE,MAAM,iBAAiB,kBAAkB,GAAG;EAE5C,IAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;GACf,CAAC;GACD,MAAM,wBAAwB,WAAW;GACzC,IAAI,OAAO,YAAY,OAAO;GAK9B,MAAM,CAAC,WAAW,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC;GACrD,OACE,UACA,QACA,IAAI,aACJ,GAAG,SAAS,KAAK,GAAG,WACpB,SACF,EAAE,OAAO,UAAe;IACtB,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CAAC;GAED,OAAO,KAAK;IACV,SAAS;IACT,IAAI;GACN,CAAC;EACH,SAAS,KAAU;GAEjB,KAAK,GAAG;EACV;CACF;AACF"}
+{"version":3,"file":"publish.mjs","names":[],"sources":["../src/publish.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { API_MESSAGE, HEADERS, HTTP_STATUS, reqUtils, tarballUtils } from '@verdaccio/core';\nimport { notify } from '@verdaccio/hooks';\nimport {\n  PUBLISH_API_ENDPOINTS,\n  allow,\n  expectJson,\n  getRequestOptions,\n  media,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:publish');\n\n/**\n   * Publish a package / update package\n   *\n   * There are multiples scenarios here to be considered:\n   *\n   * 1. Publish scenario\n   *\n   * Publish a package consist of at least 1 step (PUT) with a metadata payload.\n   * When a package is published, an _attachment property is present that contains the data\n   * of the tarball.\n   *\n   * Example flow of publish.\n   *\n   *  npm http fetch PUT 201 http://localhost:4873/@scope%2ftest1 9627ms\n      npm info lifecycle @scope/test1@1.0.1~publish: @scope/test1@1.0.1\n      npm info lifecycle @scope/test1@1.0.1~postpublish: @scope/test1@1.0.1\n      + @scope/test1@1.0.1\n      npm verb exit [ 0, true ]\n   *\n   *\n   * 2. Unpublish scenario\n   *\n   * Unpublish consist in 3 steps.\n   *  1. Try to fetch  metadata -> if it fails, return 404\n   *  2. Compute metadata locally (client side) and send a mutate payload excluding the version to\n   *    be unpublished\n   *    eg: if metadata reflects 1.0.1, 1.0.2 and 1.0.3, the computed metadata won't include 1.0.3.\n   *  3. Once the second step has been successfully finished, delete the tarball.\n   *\n   *  All these steps are consecutive and required, there is no transacions here, if step 3 fails,\n   *  metadata might get corrupted.\n   *\n   *  Note the unpublish call will suffix in the url a /-rev/14-5d500cfce92f90fd revision number,\n   *  this not\n   *  used internally.\n   *\n   *\n   * Example flow of unpublish.\n   *\n   * There are two possible flows:\n   *\n   * - Remove all packages (entirely)\n   *   eg: npm unpublish package-name@* --force\n   *   eg: npm unpublish package-name  --force\n   *\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * - Remove a specific version\n   *   eg: npm unpublish package-name@1.0.0 --force\n   *\n   * Get fresh manifest\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1680ms\n   * Update manifest without the version to be unpublished\n   * npm http fetch PUT 201 http://localhost:4873/custom-name/-rev/14-5d500cfce92f90fd 956606ms\n   * Get fresh manifest (revision should be different)\n   * npm http fetch GET 200 http://localhost:4873/custom-name?write=true 1601ms\n   * Remove the tarball\n   * npm http fetch DELETE 201 http://localhost:4873/custom-name/-/test1-1.0.3.tgz/-rev/16-e11c8db282b2d992 19ms\n   *\n   * 3. Change owners of a package\n   *\n   * Changing owners (maintainers) of a package uses the publish endpoint.\n   *\n   * The body includes a list of the new owners with the following format\n   *\n   * {\n      \"_id\": pkgName,\n      \"_rev\": \"4-b0cdaefc9bdb77c8\",\n      \"maintainers\": [\n        { \"name\": \"first owner\", \"email\": \"me@verdaccio.org\" },\n        { \"name\": \"second owner\", \"email\": \"you@verdaccio.org\" },\n        ...\n      ]\n     }\n   *\n   */\nexport default function publish(\n  router: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  router.put(\n    PUBLISH_API_ENDPOINTS.add_package,\n    can('publish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish one version')\n  );\n\n  router.put(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    media(HEADERS.JSON),\n    expectJson,\n    publishPackage(storage, config, logger, 'publish with revision')\n  );\n\n  /**\n   * Un-publishing an entire package.\n   *\n   * This scenario happens when any of these scenarios happens:\n   *  -  the first call detect there is only one version remaining\n   *  -  no version is specified in the unpublish call\n   *  -  all versions are removed npm unpublish package@*\n   *  -  there is no versions on the metadata\n\n   * then the client decides to DELETE the resource\n   * Example:\n   * Get fresh manifest (write=true is a flag to get the latest revision)\n   * npm http fetch GET 304 http://localhost:4873/package-name?write=true 1076ms (from cache)\n   * Send request to delete the package, this includes the revision number that must match\n   * and the package name, it will delete the entire package and all tarballs (or tarball depends the scenario)\n   * npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n   */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.publish_package,\n    can('unpublish'),\n    async function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const rev = reqUtils.paramToString(req.params.revision);\n      const username = req?.remote_user?.name;\n\n      logger.debug({ packageName }, `unpublishing @{packageName}`);\n      try {\n        await storage.removePackage(packageName, rev, username);\n        debug('package %s unpublished', packageName);\n        res.status(HTTP_STATUS.CREATED);\n\n        // send notification of package removal\n        const metadata: Partial<Manifest> = { name: packageName, _rev: rev };\n\n        void notify(metadata, config, req.remote_user, packageName, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.PKG_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n\n  /*\n   Remove a tarball, this happens when npm unpublish a package unique version.\n   npm http fetch DELETE 201 http://localhost:4873/package-name/-rev/18-d8ebe3020bd4ac9c 22ms\n  */\n  router.delete(\n    PUBLISH_API_ENDPOINTS.remove_tarball,\n    can('unpublish'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const packageName = reqUtils.paramToString(req.params.package);\n      const filename = reqUtils.paramToString(req.params.filename);\n      const revision = reqUtils.paramToString(req.params.revision);\n      const username = req?.remote_user?.name;\n\n      logger.debug(\n        { packageName, filename, revision },\n        `removing a tarball for @{packageName}-@{tarballName}-@{revision}`\n      );\n      try {\n        await storage.removeTarball(packageName, filename, revision, username);\n        res.status(HTTP_STATUS.CREATED);\n\n        logger.debug(\n          { packageName, filename, revision },\n          `success remove tarball for @{packageName}-@{tarballName}-@{revision}`\n        );\n\n        // send notification of version removal\n        // getVersionFromTarball returns undefined when the filename is not parseable;\n        // fall back to the package name so we never report `name@undefined`\n        const version = tarballUtils.getVersionFromTarball(filename);\n        const metadata: Partial<Manifest> = { name: packageName, _rev: revision };\n        const publishedPackage = version ? `${packageName}@${version}` : packageName;\n\n        void notify(metadata, config, req.remote_user, publishedPackage, 'unpublish').catch(\n          (error: any) => {\n            logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n          }\n        );\n\n        return next({ ok: API_MESSAGE.TARBALL_REMOVED });\n      } catch (err) {\n        return next(err);\n      }\n    }\n  );\n}\n\nexport function publishPackage(\n  storage: Storage,\n  config: Config,\n  logger: Logger,\n  origin: string\n): any {\n  return async function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): Promise<void> {\n    debug(origin);\n    const ac = new AbortController();\n    const packageName = reqUtils.paramToString(req.params.package);\n    const revision = reqUtils.paramToString(req.params.revision);\n    debug('publishing package %s', packageName);\n    debug('revision %s', revision);\n    if (debug.enabled) {\n      debug('body %o', req.body);\n    }\n    const metadata = req.body;\n\n    logger.debug({ packageName }, `publishing package @{packageName}`);\n\n    const requestOptions = getRequestOptions(req);\n\n    try {\n      const message = await storage.updateManifest(metadata, {\n        name: packageName,\n        revision,\n        signal: ac.signal,\n        requestOptions,\n        uplinksLook: false,\n      });\n      debug('package %s published', packageName);\n      res.status(HTTP_STATUS.CREATED);\n\n      // send notification of publication (notification step, non transactional)\n      // a publish body is a packument; the published version is the single entry\n      // under `versions` (see storage.updateManifest), not a top-level field\n      const [version] = Object.keys(metadata.versions ?? {});\n      void notify(\n        metadata,\n        config,\n        req.remote_user,\n        `${metadata.name}@${version}`,\n        'publish'\n      ).catch((error: any) => {\n        logger.error({ error: error?.message }, 'notify batch service has failed: @{error}');\n      });\n\n      return next({\n        success: true,\n        ok: message,\n      });\n    } catch (err: any) {\n      // TODO: review if we need the abort controller here\n      next(err);\n    }\n  };\n}\n"],"mappings":";;;;;AAkBA,IAAM,QAAQ,WAAW,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EhD,SAAwB,QACtB,QACA,MACA,SACA,QACA,QACM;CACN,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,OAAO,IACL,sBAAsB,aACtB,IAAI,SAAS,GACb,MAAM,QAAQ,IAAI,GAClB,YACA,eAAe,SAAS,QAAQ,QAAQ,qBAAqB,CAC/D;CAEA,OAAO,IACL,sBAAsB,iBACtB,IAAI,WAAW,GACf,MAAM,QAAQ,IAAI,GAClB,YACA,eAAe,SAAS,QAAQ,QAAQ,uBAAuB,CACjE;;;;;;;;;;;;;;;;;;CAmBA,OAAO,OACL,sBAAsB,iBACtB,IAAI,WAAW,GACf,eAAgB,KAAqB,KAAsB,MAAwB;EACjF,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,SAAS,cAAc,IAAI,OAAO,QAAQ;EACtD,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MAAM,EAAE,YAAY,GAAG,6BAA6B;EAC3D,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,KAAK,QAAQ;GACtD,MAAM,0BAA0B,WAAW;GAC3C,IAAI,OAAO,YAAY,OAAO;GAK9B,OAAY;IAF0B,MAAM;IAAa,MAAM;GAEnD,GAAU,QAAQ,IAAI,aAAa,aAAa,WAAW,CAAC,CAAC,OACtE,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,YAAY,YAAY,CAAC;EAC7C,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;CAMA,OAAO,OACL,sBAAsB,gBACtB,IAAI,WAAW,GACf,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,WAAW,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,WAAW,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,WAAW,KAAK,aAAa;EAEnC,OAAO,MACL;GAAE;GAAa;GAAU;EAAS,GAClC,kEACF;EACA,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,UAAU,UAAU,QAAQ;GACrE,IAAI,OAAO,YAAY,OAAO;GAE9B,OAAO,MACL;IAAE;IAAa;IAAU;GAAS,GAClC,sEACF;GAKA,MAAM,UAAU,aAAa,sBAAsB,QAAQ;GAC3D,MAAM,WAA8B;IAAE,MAAM;IAAa,MAAM;GAAS;GACxE,MAAM,mBAAmB,UAAU,GAAG,YAAY,GAAG,YAAY;GAEjE,OAAY,UAAU,QAAQ,IAAI,aAAa,kBAAkB,WAAW,CAAC,CAAC,OAC3E,UAAe;IACd,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CACF;GAEA,OAAO,KAAK,EAAE,IAAI,YAAY,gBAAgB,CAAC;EACjD,SAAS,KAAK;GACZ,OAAO,KAAK,GAAG;EACjB;CACF,CACF;AACF;AAEA,SAAgB,eACd,SACA,QACA,QACA,QACK;CACL,OAAO,eACL,KACA,KACA,MACe;EACf,MAAM,MAAM;EACZ,MAAM,KAAK,IAAI,gBAAgB;EAC/B,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,WAAW,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,yBAAyB,WAAW;EAC1C,MAAM,eAAe,QAAQ;EAC7B,IAAI,MAAM,SACR,MAAM,WAAW,IAAI,IAAI;EAE3B,MAAM,WAAW,IAAI;EAErB,OAAO,MAAM,EAAE,YAAY,GAAG,mCAAmC;EAEjE,MAAM,iBAAiB,kBAAkB,GAAG;EAE5C,IAAI;GACF,MAAM,UAAU,MAAM,QAAQ,eAAe,UAAU;IACrD,MAAM;IACN;IACA,QAAQ,GAAG;IACX;IACA,aAAa;GACf,CAAC;GACD,MAAM,wBAAwB,WAAW;GACzC,IAAI,OAAO,YAAY,OAAO;GAK9B,MAAM,CAAC,WAAW,OAAO,KAAK,SAAS,YAAY,CAAC,CAAC;GACrD,OACE,UACA,QACA,IAAI,aACJ,GAAG,SAAS,KAAK,GAAG,WACpB,SACF,CAAC,CAAC,OAAO,UAAe;IACtB,OAAO,MAAM,EAAE,OAAO,OAAO,QAAQ,GAAG,2CAA2C;GACrF,CAAC;GAED,OAAO,KAAK;IACV,SAAS;IACT,IAAI;GACN,CAAC;EACH,SAAS,KAAU;GAEjB,KAAK,GAAG;EACV;CACF;AACF"}

package/build/search.d.ts

@@ -1,2 +1,2 @@
-import { Logger } from '@verdaccio/types';
+import type { Logger } from '@verdaccio/types';
 export default function (route: any, logger: Logger): void;

package/build/user.d.ts

@@ -1,4 +1,4 @@
-import { Router } from 'express';
-import { Auth } from '@verdaccio/auth';
-import { Config, Logger } from '@verdaccio/types';
+import type { Router } from 'express';
+import type { Auth } from '@verdaccio/auth';
+import type { Config, Logger } from '@verdaccio/types';
 export default function (route: Router, auth: Auth, config: Config, logger: Logger): void;

package/build/user.js

@@ -15,12 +15,12 @@ function user_default(route, auth, config, logger) {
 			res.status(_verdaccio_core.HTTP_STATUS.OK);
 			return next({ ok: false });
 		}
-		const username = req.params.org_couchdb_user.split(":")[1];
+		const userName = _verdaccio_core.reqUtils.paramToString(req.params.org_couchdb_user)?.split(":")[1] ?? "";
 		const message = _verdaccio_core.authUtils.getAuthenticatedMessage(req.remote_user.name);
 		debug$1("user authenticated message %o", message);
 		res.status(_verdaccio_core.HTTP_STATUS.OK);
 		next({
-			name: username,
+			name: userName,
 			email: "",
 			ok: message
 		});
@@ -46,7 +46,8 @@ function user_default(route, auth, config, logger) {
 		const { name, password } = req.body;
 		debug$1("login or adduser");
 		const remoteName = req?.remote_user?.name;
-		if (!_verdaccio_core.validationUtils.validateUserName(req.params.org_couchdb_user, name)) return next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.USERNAME_MISMATCH));
+		const userName = _verdaccio_core.reqUtils.paramToString(req.params.org_couchdb_user);
+		if (!_verdaccio_core.validationUtils.validateUserName(userName, name)) return next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.USERNAME_MISMATCH));
 		if (typeof remoteName !== "undefined" && typeof name === "string" && remoteName === name) {
 			debug$1("login: no remote user detected");
 			auth.authenticate(name, password, async function callbackAuthenticate(err, user) {