@verdaccio/api 9.0.0-next-9.21 → 9.0.0-next-9.23

package/build/v1/token.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"token.mjs","names":[],"sources":["../../src/v1/token.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isBoolean, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport { HEADERS, HTTP_STATUS, SUPPORT_ERRORS, cryptoUtils, errorUtils } from '@verdaccio/core';\nimport { TOKEN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, RemoteUser, Token } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\n// Granular access token options (npm >= 11) that Verdaccio does not implement\n// yet. They are accepted so `npm token create` succeeds, but the restrictions\n// they express are NOT enforced — warn so the operator is not misled.\nconst UNSUPPORTED_TOKEN_OPTIONS = [\n  'packages_and_scopes_permission',\n  'packages',\n  'packages_all',\n  'scopes',\n  'orgs',\n  'orgs_permission',\n  'expires',\n  'description',\n  'bypass_2fa',\n];\n\nexport type NormalizeToken = Token & {\n  cidr_whitelist: string[];\n  created: string;\n};\n\n// npm expects \"cidr_whitelist\" for token list\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    cidr_whitelist: token.cidr || [],\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password } = req.body;\n      const { name } = req.remote_user;\n      // `readonly` and `cidr_whitelist` are optional: npm >= 11 rewrote\n      // `npm token create` to omit them (and only sends `cidr_whitelist` with\n      // `--cidr`), so default them rather than rejecting the request. A wrong\n      // type is still rejected.\n      const readonly = req.body.readonly ?? false;\n      const cidr_whitelist = req.body.cidr_whitelist ?? [];\n\n      if (!isBoolean(readonly) || !Array.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      const unsupportedOptions = UNSUPPORTED_TOKEN_OPTIONS.filter(\n        (option) => isNil(req.body[option]) === false\n      );\n      if (unsupportedOptions.length > 0) {\n        logger.warn(\n          { options: unsupportedOptions.join(', '), userAgent: req.get('user-agent') ?? 'unknown' },\n          'granular access token options are not supported yet and will be ignored: @{options} (client: @{userAgent})'\n        );\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (typeof storage.saveToken !== 'function') {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const key = cryptoUtils.generateRandomHexString(16);\n          const token = await getApiToken(auth, config, user as RemoteUser, password, {\n            tokenKey: key,\n          });\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          // TODO: use a utility here\n          const maskedToken = cryptoUtils.mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const {\n        params: { tokenKey },\n      } = req;\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;AAeA,IAAM,4BAA4B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAQA,SAAS,eAAe,OAA8B;CACpD,OAAO;EACL,GAAG;EACH,gBAAgB,MAAM,QAAQ,CAAC;EAC/B,SAAS,IAAI,KAAK,MAAM,OAAO,EAAE,YAAY;CAC/C;AACF;AAGA,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;CACN,MAAM,IACJ,oBAAoB,YACpB,UAAU,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAwB;EAC1E,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,IAAI,MAAM,OAClB,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,KAAK,CAAC;GACtD,MAAM,cAAc,OAAO;GAC3B,OAAO,MAAM,EAAE,YAAY,GAAG,sCAAsC;GAEpE,IAAI,OAAO,YAAY,EAAE;GACzB,OAAO,KAAK;IACV,SAAS,OAAO,IAAI,cAAc;IAClC,MAAM,EACJ,MAAM,GACR;GACF,CAAC;EACH,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,iCAAiC;GACpE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;EAC3E;EAEF,OAAO,KAAK,WAAW,gBAAgB,CAAC;CAC1C,CACF;CAEA,MAAM,KACJ,oBAAoB,YACpB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAAwB;EACpE,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;EAKrB,MAAM,WAAW,IAAI,KAAK,YAAY;EACtC,MAAM,iBAAiB,IAAI,KAAK,kBAAkB,CAAC;EAEnD,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,QAAQ,cAAc,GACvD,OAAO,KAAK,WAAW,QAAQ,YAAY,UAAU,eAAe,oBAAoB,CAAC;EAG3F,MAAM,qBAAqB,0BAA0B,QAClD,WAAW,MAAM,IAAI,KAAK,OAAO,MAAM,KAC1C;EACA,IAAI,mBAAmB,SAAS,GAC9B,OAAO,KACL;GAAE,SAAS,mBAAmB,KAAK,IAAI;GAAG,WAAW,IAAI,IAAI,YAAY,KAAK;EAAU,GACxF,4GACF;EAGF,KAAK,aAAa,MAAM,UAAU,OAAO,KAAK,SAAsB;GAClE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;IACvE,OAAO,KAAK,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD;GAEA,IAAI,cAAc;GAElB,IAAI,OAAO,QAAQ,cAAc,YAC/B,OAAO,KACL,WAAW,QAAQ,YAAY,iBAAiB,eAAe,qBAAqB,CACtF;GAGF,IAAI;IACF,MAAM,MAAM,YAAY,wBAAwB,EAAE;IAClD,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,MAAoB,UAAU,EAC1E,UAAU,IACZ,CAAC;IACD,IAAI,CAAC,OACH,MAAM,WAAW,iBAAiB;;;;;;IAYpC,MAAM,YAAmB;KACvB,MAAM;KACN,OAVkB,YAAY,KAAK,OAAO,CAUnC;KACP;KACA,MAAM;KACN;KACA,0BAbc,IAAI,KAAK,GAAE,QAazB;IACF;IAEA,MAAM,QAAQ,UAAU,SAAS;IACjC,OAAO,MAAM;KAAE;KAAK;IAAK,GAAG,2CAA2C;IACvE,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAC/C,OAAO,KACL,eAAe;KACb;KACA,MAAM;KACN,KAAK,UAAU;KACf,MAAM;KACN;KACA,SAAS,UAAU;IACrB,CAAC,CACH;GACF,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,WAAW,iBAAiB,MAAM,OAAO,CAAC;GACxD;EACF,CAAC;CACH,CACF;CAEA,MAAM,OACJ,oBAAoB,cACpB,UAAU,QAAQ,aAAa,GAC/B,OAAO,KAAqB,KAAe,SAA2B;EACpE,MAAM,EACJ,QAAQ,EAAE,eACR;EACJ,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,IAAI,MAAM,OAAO;GACzB,OAAO,MAAM,EAAE,KAAK,GAAG,sCAAsC;GAC7D,IAAI;IACF,MAAM,QAAQ,YAAY,MAAM,QAAQ;IACxC,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,mDAAmD;IACnF,OAAO,KAAK,CAAC,CAAC;GAChB,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;GAC3E;EACF;EACA,OAAO,KAAK,WAAW,gBAAgB,CAAC;CAC1C,CACF;AACF"}
+{"version":3,"file":"token.mjs","names":[],"sources":["../../src/v1/token.ts"],"sourcesContent":["import type { Response, Router } from 'express';\nimport { isBoolean, isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { getApiToken } from '@verdaccio/auth';\nimport {\n  HEADERS,\n  HTTP_STATUS,\n  SUPPORT_ERRORS,\n  cryptoUtils,\n  errorUtils,\n  reqUtils,\n} from '@verdaccio/core';\nimport { TOKEN_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger, RemoteUser, Token } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../../types/custom';\n\n// Granular access token options (npm >= 11) that Verdaccio does not implement\n// yet. They are accepted so `npm token create` succeeds, but the restrictions\n// they express are NOT enforced — warn so the operator is not misled.\nconst UNSUPPORTED_TOKEN_OPTIONS = [\n  'packages_and_scopes_permission',\n  'packages',\n  'packages_all',\n  'scopes',\n  'orgs',\n  'orgs_permission',\n  'expires',\n  'description',\n  'bypass_2fa',\n];\n\nexport type NormalizeToken = Token & {\n  cidr_whitelist: string[];\n  created: string;\n};\n\n// npm expects \"cidr_whitelist\" for token list\nfunction normalizeToken(token: Token): NormalizeToken {\n  return {\n    ...token,\n    cidr_whitelist: token.cidr || [],\n    created: new Date(token.created).toISOString(),\n  };\n}\n\n// https://github.com/npm/npm-profile/blob/latest/lib/index.js\nexport default function (\n  route: Router,\n  auth: Auth,\n  storage: Storage,\n  config: Config,\n  logger: Logger\n): void {\n  route.get(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    async function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        try {\n          const tokens = await storage.readTokens({ user: name });\n          const totalTokens = tokens.length;\n          logger.debug({ totalTokens }, 'token list retrieved: @{totalTokens}');\n\n          res.status(HTTP_STATUS.OK);\n          return next({\n            objects: tokens.map(normalizeToken),\n            urls: {\n              next: '', // TODO: pagination?\n            },\n          });\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token list has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n\n  route.post(\n    TOKEN_API_ENDPOINTS.get_tokens,\n    rateLimit(config?.userRateLimit),\n    function (req: $RequestExtend, res: Response, next: $NextFunctionVer) {\n      const { password } = req.body;\n      const { name } = req.remote_user;\n      // `readonly` and `cidr_whitelist` are optional: npm >= 11 rewrote\n      // `npm token create` to omit them (and only sends `cidr_whitelist` with\n      // `--cidr`), so default them rather than rejecting the request. A wrong\n      // type is still rejected.\n      const readonly = req.body.readonly ?? false;\n      const cidr_whitelist = req.body.cidr_whitelist ?? [];\n\n      if (!isBoolean(readonly) || !Array.isArray(cidr_whitelist)) {\n        return next(errorUtils.getCode(HTTP_STATUS.BAD_DATA, SUPPORT_ERRORS.PARAMETERS_NOT_VALID));\n      }\n\n      const unsupportedOptions = UNSUPPORTED_TOKEN_OPTIONS.filter(\n        (option) => isNil(req.body[option]) === false\n      );\n      if (unsupportedOptions.length > 0) {\n        logger.warn(\n          { options: unsupportedOptions.join(', '), userAgent: req.get('user-agent') ?? 'unknown' },\n          'granular access token options are not supported yet and will be ignored: @{options} (client: @{userAgent})'\n        );\n      }\n\n      auth.authenticate(name, password, async (err, user?: RemoteUser) => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          return next(errorUtils.getCode(errorCode, err.message));\n        }\n\n        req.remote_user = user;\n\n        if (typeof storage.saveToken !== 'function') {\n          return next(\n            errorUtils.getCode(HTTP_STATUS.NOT_IMPLEMENTED, SUPPORT_ERRORS.STORAGE_NOT_IMPLEMENT)\n          );\n        }\n\n        try {\n          const key = cryptoUtils.generateRandomHexString(16);\n          const token = await getApiToken(auth, config, user as RemoteUser, password, {\n            tokenKey: key,\n          });\n          if (!token) {\n            throw errorUtils.getInternalError();\n          }\n\n          // TODO: use a utility here\n          const maskedToken = cryptoUtils.mask(token, 5);\n          const created = new Date().getTime();\n\n          /**\n           * cidr_whitelist: is not being used, we pass it through\n           * token: we do not store the real token (it is generated once and retrieved\n           * to the user), just a mask of it.\n           */\n          const saveToken: Token = {\n            user: name,\n            token: maskedToken,\n            key,\n            cidr: cidr_whitelist,\n            readonly,\n            created,\n          };\n\n          await storage.saveToken(saveToken);\n          logger.debug({ key, name }, 'token @{key} was created for user @{name}');\n          res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n          return next(\n            normalizeToken({\n              token,\n              user: name,\n              key: saveToken.key,\n              cidr: cidr_whitelist,\n              readonly,\n              created: saveToken.created,\n            })\n          );\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getInternalError(error.message));\n        }\n      });\n    }\n  );\n\n  route.delete(\n    TOKEN_API_ENDPOINTS.delete_token,\n    rateLimit(config?.userRateLimit),\n    async (req: $RequestExtend, res: Response, next: $NextFunctionVer) => {\n      const tokenKey = reqUtils.paramToString(req.params.tokenKey);\n      const { name } = req.remote_user;\n\n      if (isNil(name) === false) {\n        logger.debug({ name }, '@{name} has requested remove a token');\n        try {\n          await storage.deleteToken(name, tokenKey);\n          logger.info({ tokenKey, name }, 'token id @{tokenKey} was revoked for user @{name}');\n          return next({});\n        } catch (error: any) {\n          logger.error({ error: error.msg }, 'token creation has failed: @{error}');\n          return next(errorUtils.getCode(HTTP_STATUS.INTERNAL_ERROR, error.message));\n        }\n      }\n      return next(errorUtils.getUnauthorized());\n    }\n  );\n}\n"],"mappings":";;;;;AAsBA,IAAM,4BAA4B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AAQA,SAAS,eAAe,OAA8B;CACpD,OAAO;EACL,GAAG;EACH,gBAAgB,MAAM,QAAQ,CAAC;EAC/B,SAAS,IAAI,KAAK,MAAM,OAAO,CAAC,CAAC,YAAY;CAC/C;AACF;AAGA,SAAA,cACE,OACA,MACA,SACA,QACA,QACM;CACN,MAAM,IACJ,oBAAoB,YACpB,UAAU,QAAQ,aAAa,GAC/B,eAAgB,KAAqB,KAAe,MAAwB;EAC1E,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,IAAI,MAAM,OAClB,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,KAAK,CAAC;GACtD,MAAM,cAAc,OAAO;GAC3B,OAAO,MAAM,EAAE,YAAY,GAAG,sCAAsC;GAEpE,IAAI,OAAO,YAAY,EAAE;GACzB,OAAO,KAAK;IACV,SAAS,OAAO,IAAI,cAAc;IAClC,MAAM,EACJ,MAAM,GACR;GACF,CAAC;EACH,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,iCAAiC;GACpE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;EAC3E;EAEF,OAAO,KAAK,WAAW,gBAAgB,CAAC;CAC1C,CACF;CAEA,MAAM,KACJ,oBAAoB,YACpB,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAqB,KAAe,MAAwB;EACpE,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;EAKrB,MAAM,WAAW,IAAI,KAAK,YAAY;EACtC,MAAM,iBAAiB,IAAI,KAAK,kBAAkB,CAAC;EAEnD,IAAI,CAAC,UAAU,QAAQ,KAAK,CAAC,MAAM,QAAQ,cAAc,GACvD,OAAO,KAAK,WAAW,QAAQ,YAAY,UAAU,eAAe,oBAAoB,CAAC;EAG3F,MAAM,qBAAqB,0BAA0B,QAClD,WAAW,MAAM,IAAI,KAAK,OAAO,MAAM,KAC1C;EACA,IAAI,mBAAmB,SAAS,GAC9B,OAAO,KACL;GAAE,SAAS,mBAAmB,KAAK,IAAI;GAAG,WAAW,IAAI,IAAI,YAAY,KAAK;EAAU,GACxF,4GACF;EAGF,KAAK,aAAa,MAAM,UAAU,OAAO,KAAK,SAAsB;GAClE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;IACvE,OAAO,KAAK,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD;GAEA,IAAI,cAAc;GAElB,IAAI,OAAO,QAAQ,cAAc,YAC/B,OAAO,KACL,WAAW,QAAQ,YAAY,iBAAiB,eAAe,qBAAqB,CACtF;GAGF,IAAI;IACF,MAAM,MAAM,YAAY,wBAAwB,EAAE;IAClD,MAAM,QAAQ,MAAM,YAAY,MAAM,QAAQ,MAAoB,UAAU,EAC1E,UAAU,IACZ,CAAC;IACD,IAAI,CAAC,OACH,MAAM,WAAW,iBAAiB;IAIpC,MAAM,cAAc,YAAY,KAAK,OAAO,CAAC;IAC7C,MAAM,2BAAU,IAAI,KAAK,EAAA,CAAE,QAAQ;;;;;;IAOnC,MAAM,YAAmB;KACvB,MAAM;KACN,OAAO;KACP;KACA,MAAM;KACN;KACA;IACF;IAEA,MAAM,QAAQ,UAAU,SAAS;IACjC,OAAO,MAAM;KAAE;KAAK;IAAK,GAAG,2CAA2C;IACvE,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAC/C,OAAO,KACL,eAAe;KACb;KACA,MAAM;KACN,KAAK,UAAU;KACf,MAAM;KACN;KACA,SAAS,UAAU;IACrB,CAAC,CACH;GACF,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,WAAW,iBAAiB,MAAM,OAAO,CAAC;GACxD;EACF,CAAC;CACH,CACF;CAEA,MAAM,OACJ,oBAAoB,cACpB,UAAU,QAAQ,aAAa,GAC/B,OAAO,KAAqB,KAAe,SAA2B;EACpE,MAAM,WAAW,SAAS,cAAc,IAAI,OAAO,QAAQ;EAC3D,MAAM,EAAE,SAAS,IAAI;EAErB,IAAI,MAAM,IAAI,MAAM,OAAO;GACzB,OAAO,MAAM,EAAE,KAAK,GAAG,sCAAsC;GAC7D,IAAI;IACF,MAAM,QAAQ,YAAY,MAAM,QAAQ;IACxC,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,mDAAmD;IACnF,OAAO,KAAK,CAAC,CAAC;GAChB,SAAS,OAAY;IACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,qCAAqC;IACxE,OAAO,KAAK,WAAW,QAAQ,YAAY,gBAAgB,MAAM,OAAO,CAAC;GAC3E;EACF;EACA,OAAO,KAAK,WAAW,gBAAgB,CAAC;CAC1C,CACF;AACF"}

package/build/whoami.d.ts

@@ -1,2 +1,2 @@
-import { Router } from 'express';
+import type { Router } from 'express';
 export default function (route: Router): void;

package/build/whoami.js.map

@@ -1 +1 @@
-{"version":3,"file":"whoami.js","names":[],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;;;AAQA,IAAM,WAAA,GAAA,MAAA,SAAmB,oBAAoB;AAE7C,SAAA,eAAyB,OAAqB;CAC5C,MAAM,IACJ,sBAAA,mBAAmB,SAClB,KAAqB,MAAgB,SAAgC;EAEpE,MAAM,WAAW,KAAK,aAAa;EACnC,IAAI,CAAC,UAAU;GACb,QAAM,wBAAwB;GAC9B,OAAO,KAAK,gBAAA,WAAW,gBAAgB,cAAc,CAAC;EACxD;EAEA,QAAM,uBAAuB,QAAQ;EACrC,OAAO,KAAK,EAAY,SAAS,CAAC;CACpC,CACF;AACF"}
+{"version":3,"file":"whoami.js","names":[],"sources":["../src/whoami.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response, Router } from 'express';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { USER_API_ENDPOINTS } from '@verdaccio/middleware';\n\nimport type { $NextFunctionVer, $RequestExtend } from '../types/custom';\n\nconst debug = buildDebug('verdaccio:api:user');\n\nexport default function (route: Router): void {\n  route.get(\n    USER_API_ENDPOINTS.whoami,\n    (req: $RequestExtend, _res: Response, next: $NextFunctionVer): any => {\n      // remote_user is set by the auth middleware\n      const username = req?.remote_user?.name;\n      if (!username) {\n        debug('whoami: user not found');\n        return next(errorUtils.getUnauthorized('Unauthorized'));\n      }\n\n      debug('whoami: response %o', username);\n      return next({ username: username });\n    }\n  );\n}\n"],"mappings":";;;;;;AAQA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,oBAAoB;AAE7C,SAAA,eAAyB,OAAqB;CAC5C,MAAM,IACJ,sBAAA,mBAAmB,SAClB,KAAqB,MAAgB,SAAgC;EAEpE,MAAM,WAAW,KAAK,aAAa;EACnC,IAAI,CAAC,UAAU;GACb,QAAM,wBAAwB;GAC9B,OAAO,KAAK,gBAAA,WAAW,gBAAgB,cAAc,CAAC;EACxD;EAEA,QAAM,uBAAuB,QAAQ;EACrC,OAAO,KAAK,EAAY,SAAS,CAAC;CACpC,CACF;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "9.0.0-next-9.21",
+  "version": "9.0.0-next-9.23",
   "description": "Verdaccio Registry API",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,27 +33,27 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "9.0.0-next-9.21",
-    "@verdaccio/config": "9.0.0-next-9.21",
-    "@verdaccio/core": "9.0.0-next-9.21",
-    "@verdaccio/hooks": "9.0.0-next-9.21",
-    "@verdaccio/logger": "9.0.0-next-9.21",
-    "@verdaccio/middleware": "9.0.0-next-9.21",
-    "@verdaccio/store": "9.0.0-next-9.21",
+    "@verdaccio/auth": "9.0.0-next-9.23",
+    "@verdaccio/config": "9.0.0-next-9.23",
+    "@verdaccio/core": "9.0.0-next-9.23",
+    "@verdaccio/hooks": "9.0.0-next-9.23",
+    "@verdaccio/logger": "9.0.0-next-9.23",
+    "@verdaccio/middleware": "9.0.0-next-9.23",
+    "@verdaccio/store": "9.0.0-next-9.23",
     "debug": "4.4.3",
     "express": "5.2.1",
     "lodash-es": "4.18.1"
   },
   "devDependencies": {
     "@types/lodash-es": "4.17.12",
-    "@verdaccio/test-helper": "5.0.0-next-9.22",
+    "@verdaccio/test-helper": "5.0.0-next-9.24",
     "@verdaccio/types": "14.0.0-next-9.11",
     "mockdate": "3.0.5",
     "nock": "13.5.6",
     "rimraf": "6.1.3",
     "supertest": "7.1.4",
-    "vite": "8.0.16",
-    "vitest": "4.1.7"
+    "vite": "8.1.5",
+    "vitest": "4.1.10"
   },
   "funding": {
     "type": "opencollective",