@verdaccio/api 9.0.0-next-9.32 → 9.0.0-next-9.34
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/dist-tags.js +2 -2
- package/build/dist-tags.js.map +1 -1
- package/build/dist-tags.mjs +2 -2
- package/build/dist-tags.mjs.map +1 -1
- package/build/v1/search.js +16 -2
- package/build/v1/search.js.map +1 -1
- package/build/v1/search.mjs +16 -2
- package/build/v1/search.mjs.map +1 -1
- package/package.json +10 -10
package/build/dist-tags.js
CHANGED
|
@@ -13,7 +13,7 @@ function dist_tags_default(route, auth, storage, logger, requireOtp = (_req, _re
|
|
|
13
13
|
const tags = {};
|
|
14
14
|
tags[tag] = req.body;
|
|
15
15
|
try {
|
|
16
|
-
await storage.mergeTagsNext(packageName, tags);
|
|
16
|
+
await storage.mergeTagsNext(packageName, tags, (0, _verdaccio_middleware.getRequestOptions)(req));
|
|
17
17
|
res.status(_verdaccio_core.constants.HTTP_STATUS.CREATED);
|
|
18
18
|
return next({ ok: _verdaccio_core.constants.API_MESSAGE.TAG_ADDED });
|
|
19
19
|
} catch (err) {
|
|
@@ -28,7 +28,7 @@ function dist_tags_default(route, auth, storage, logger, requireOtp = (_req, _re
|
|
|
28
28
|
const tags = {};
|
|
29
29
|
tags[tag] = null;
|
|
30
30
|
try {
|
|
31
|
-
await storage.mergeTagsNext(packageName, tags);
|
|
31
|
+
await storage.mergeTagsNext(packageName, tags, (0, _verdaccio_middleware.getRequestOptions)(req));
|
|
32
32
|
res.status(_verdaccio_core.constants.HTTP_STATUS.CREATED);
|
|
33
33
|
return next({ ok: _verdaccio_core.constants.API_MESSAGE.TAG_REMOVED });
|
|
34
34
|
} catch (err) {
|
package/build/dist-tags.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dist-tags.js","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { RequestHandler, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils, reqUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (\n route: Router,\n auth: Auth,\n storage: Storage,\n logger: Logger,\n /** No-op unless the caller has two-factor enabled for this operation. */\n requireOtp: RequestHandler = (_req, _res, next) => next()\n): void {\n const can = allow(auth, {\n beforeAll: (a, b) => logger.trace(a, b),\n afterAll: (a, b) => logger.trace(a, b),\n });\n const addTagPackageVersionMiddleware = async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<$NextFunctionVer> {\n if (typeof req.body !== 'string') {\n return next(errorUtils.getBadRequest('version is missing'));\n }\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = req.body;\n try {\n await storage.mergeTagsNext(packageName, tags);\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_ADDED,\n });\n } catch (err) {\n next(err);\n }\n };\n\n // tagging a package.\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.delete(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = null;\n try {\n await storage.mergeTagsNext(packageName, tags);\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_REMOVED,\n });\n } catch (err) {\n next(err);\n }\n }\n );\n\n route.get(\n DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n can('access'),\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const requestOptions = getRequestOptions(req);\n try {\n const manifest = await storage.getPackageByOptions({\n name: packageName,\n uplinksLook: true,\n requestOptions,\n });\n next(manifest[constants.DIST_TAGS]);\n } catch (err) {\n next(err);\n }\n }\n );\n}\n"],"mappings":";;;AAUA,SAAA,kBACE,OACA,MACA,SACA,QAEA,cAA8B,MAAM,MAAM,SAAS,KAAK,GAClD;CACN,MAAM,OAAA,GAAM,sBAAA,MAAA,CAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,gBAAA,WAAW,cAAc,oBAAoB,CAAC;EAE5D,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,gBAAA,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO,IAAI;EAChB,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,
|
|
1
|
+
{"version":3,"file":"dist-tags.js","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { RequestHandler, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils, reqUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (\n route: Router,\n auth: Auth,\n storage: Storage,\n logger: Logger,\n /** No-op unless the caller has two-factor enabled for this operation. */\n requireOtp: RequestHandler = (_req, _res, next) => next()\n): void {\n const can = allow(auth, {\n beforeAll: (a, b) => logger.trace(a, b),\n afterAll: (a, b) => logger.trace(a, b),\n });\n const addTagPackageVersionMiddleware = async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<$NextFunctionVer> {\n if (typeof req.body !== 'string') {\n return next(errorUtils.getBadRequest('version is missing'));\n }\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = req.body;\n try {\n await storage.mergeTagsNext(packageName, tags, getRequestOptions(req));\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_ADDED,\n });\n } catch (err) {\n next(err);\n }\n };\n\n // tagging a package.\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.delete(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = null;\n try {\n await storage.mergeTagsNext(packageName, tags, getRequestOptions(req));\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_REMOVED,\n });\n } catch (err) {\n next(err);\n }\n }\n );\n\n route.get(\n DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n can('access'),\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const requestOptions = getRequestOptions(req);\n try {\n const manifest = await storage.getPackageByOptions({\n name: packageName,\n uplinksLook: true,\n requestOptions,\n });\n next(manifest[constants.DIST_TAGS]);\n } catch (err) {\n next(err);\n }\n }\n );\n}\n"],"mappings":";;;AAUA,SAAA,kBACE,OACA,MACA,SACA,QAEA,cAA8B,MAAM,MAAM,SAAS,KAAK,GAClD;CACN,MAAM,OAAA,GAAM,sBAAA,MAAA,CAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,gBAAA,WAAW,cAAc,oBAAoB,CAAC;EAE5D,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,gBAAA,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO,IAAI;EAChB,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,OAAA,GAAM,sBAAA,kBAAA,CAAkB,GAAG,CAAC;GACrE,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,sBAAA,wBAAwB,SACxB,IAAI,SAAS,GACb,aAAA,GACA,sBAAA,MAAA,CAAM,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,GACb,aAAA,GACA,sBAAA,MAAA,CAAM,gBAAA,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,sBAAA,wBAAwB,iBACxB,IAAI,SAAS,GACb,YACA,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,gBAAA,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO;EACZ,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,OAAA,GAAM,sBAAA,kBAAA,CAAkB,GAAG,CAAC;GACrE,IAAI,OAAO,gBAAA,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,gBAAA,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,sBAAA,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,kBAAA,GAAiB,sBAAA,kBAAA,CAAkB,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD,MAAM;IACN,aAAa;IACb;GACF,CAAC,EAAA,CACa,gBAAA,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}
|
package/build/dist-tags.mjs
CHANGED
|
@@ -13,7 +13,7 @@ function dist_tags_default(route, auth, storage, logger, requireOtp = (_req, _re
|
|
|
13
13
|
const tags = {};
|
|
14
14
|
tags[tag] = req.body;
|
|
15
15
|
try {
|
|
16
|
-
await storage.mergeTagsNext(packageName, tags);
|
|
16
|
+
await storage.mergeTagsNext(packageName, tags, getRequestOptions(req));
|
|
17
17
|
res.status(constants.HTTP_STATUS.CREATED);
|
|
18
18
|
return next({ ok: constants.API_MESSAGE.TAG_ADDED });
|
|
19
19
|
} catch (err) {
|
|
@@ -28,7 +28,7 @@ function dist_tags_default(route, auth, storage, logger, requireOtp = (_req, _re
|
|
|
28
28
|
const tags = {};
|
|
29
29
|
tags[tag] = null;
|
|
30
30
|
try {
|
|
31
|
-
await storage.mergeTagsNext(packageName, tags);
|
|
31
|
+
await storage.mergeTagsNext(packageName, tags, getRequestOptions(req));
|
|
32
32
|
res.status(constants.HTTP_STATUS.CREATED);
|
|
33
33
|
return next({ ok: constants.API_MESSAGE.TAG_REMOVED });
|
|
34
34
|
} catch (err) {
|
package/build/dist-tags.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"dist-tags.mjs","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { RequestHandler, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils, reqUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (\n route: Router,\n auth: Auth,\n storage: Storage,\n logger: Logger,\n /** No-op unless the caller has two-factor enabled for this operation. */\n requireOtp: RequestHandler = (_req, _res, next) => next()\n): void {\n const can = allow(auth, {\n beforeAll: (a, b) => logger.trace(a, b),\n afterAll: (a, b) => logger.trace(a, b),\n });\n const addTagPackageVersionMiddleware = async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<$NextFunctionVer> {\n if (typeof req.body !== 'string') {\n return next(errorUtils.getBadRequest('version is missing'));\n }\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = req.body;\n try {\n await storage.mergeTagsNext(packageName, tags);\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_ADDED,\n });\n } catch (err) {\n next(err);\n }\n };\n\n // tagging a package.\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.delete(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = null;\n try {\n await storage.mergeTagsNext(packageName, tags);\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_REMOVED,\n });\n } catch (err) {\n next(err);\n }\n }\n );\n\n route.get(\n DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n can('access'),\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const requestOptions = getRequestOptions(req);\n try {\n const manifest = await storage.getPackageByOptions({\n name: packageName,\n uplinksLook: true,\n requestOptions,\n });\n next(manifest[constants.DIST_TAGS]);\n } catch (err) {\n next(err);\n }\n }\n );\n}\n"],"mappings":";;;AAUA,SAAA,kBACE,OACA,MACA,SACA,QAEA,cAA8B,MAAM,MAAM,SAAS,KAAK,GAClD;CACN,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,WAAW,cAAc,oBAAoB,CAAC;EAE5D,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO,IAAI;EAChB,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,
|
|
1
|
+
{"version":3,"file":"dist-tags.mjs","names":[],"sources":["../src/dist-tags.ts"],"sourcesContent":["import type { RequestHandler, Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { HEADERS, constants, errorUtils, reqUtils } from '@verdaccio/core';\nimport { DIST_TAGS_API_ENDPOINTS, allow, getRequestOptions, media } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types/custom';\n\nexport default function (\n route: Router,\n auth: Auth,\n storage: Storage,\n logger: Logger,\n /** No-op unless the caller has two-factor enabled for this operation. */\n requireOtp: RequestHandler = (_req, _res, next) => next()\n): void {\n const can = allow(auth, {\n beforeAll: (a, b) => logger.trace(a, b),\n afterAll: (a, b) => logger.trace(a, b),\n });\n const addTagPackageVersionMiddleware = async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<$NextFunctionVer> {\n if (typeof req.body !== 'string') {\n return next(errorUtils.getBadRequest('version is missing'));\n }\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = req.body;\n try {\n await storage.mergeTagsNext(packageName, tags, getRequestOptions(req));\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_ADDED,\n });\n } catch (err) {\n next(err);\n }\n };\n\n // tagging a package.\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.put(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n media(HEADERS.JSON),\n addTagPackageVersionMiddleware\n );\n\n route.delete(\n DIST_TAGS_API_ENDPOINTS.tagging_package,\n can('publish'),\n requireOtp,\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const tag = reqUtils.paramToString(req.params.tag);\n const tags = {};\n tags[tag] = null;\n try {\n await storage.mergeTagsNext(packageName, tags, getRequestOptions(req));\n res.status(constants.HTTP_STATUS.CREATED);\n return next({\n ok: constants.API_MESSAGE.TAG_REMOVED,\n });\n } catch (err) {\n next(err);\n }\n }\n );\n\n route.get(\n DIST_TAGS_API_ENDPOINTS.get_dist_tags,\n can('access'),\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n const packageName = reqUtils.paramToString(req.params.package);\n const requestOptions = getRequestOptions(req);\n try {\n const manifest = await storage.getPackageByOptions({\n name: packageName,\n uplinksLook: true,\n requestOptions,\n });\n next(manifest[constants.DIST_TAGS]);\n } catch (err) {\n next(err);\n }\n }\n );\n}\n"],"mappings":";;;AAUA,SAAA,kBACE,OACA,MACA,SACA,QAEA,cAA8B,MAAM,MAAM,SAAS,KAAK,GAClD;CACN,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,iCAAiC,eACrC,KACA,KACA,MAC2B;EAC3B,IAAI,OAAO,IAAI,SAAS,UACtB,OAAO,KAAK,WAAW,cAAc,oBAAoB,CAAC;EAE5D,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO,IAAI;EAChB,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,MAAM,kBAAkB,GAAG,CAAC;GACrE,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,UAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF;CAGA,MAAM,IACJ,wBAAwB,SACxB,IAAI,SAAS,GACb,YACA,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,IACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,YACA,MAAM,QAAQ,IAAI,GAClB,8BACF;CAEA,MAAM,OACJ,wBAAwB,iBACxB,IAAI,SAAS,GACb,YACA,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,MAAM,SAAS,cAAc,IAAI,OAAO,GAAG;EACjD,MAAM,OAAO,CAAC;EACd,KAAK,OAAO;EACZ,IAAI;GACF,MAAM,QAAQ,cAAc,aAAa,MAAM,kBAAkB,GAAG,CAAC;GACrE,IAAI,OAAO,UAAU,YAAY,OAAO;GACxC,OAAO,KAAK,EACV,IAAI,UAAU,YAAY,YAC5B,CAAC;EACH,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CAEA,MAAM,IACJ,wBAAwB,eACxB,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GAMF,MAAK,MALkB,QAAQ,oBAAoB;IACjD,MAAM;IACN,aAAa;IACb;GACF,CAAC,EAAA,CACa,UAAU,UAAU;EACpC,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;AACF"}
|
package/build/v1/search.js
CHANGED
|
@@ -7,7 +7,8 @@ var MAX_FROM = 1e4;
|
|
|
7
7
|
var CHECK_ACCESS_BATCH_SIZE = 50;
|
|
8
8
|
var SEARCH_TIMEOUT_MS = 3e4;
|
|
9
9
|
function parseQueryInt(value, defaultValue, max) {
|
|
10
|
-
|
|
10
|
+
if (typeof value !== "string") return defaultValue;
|
|
11
|
+
const parsed = Number.parseInt(value, 10);
|
|
11
12
|
if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
|
|
12
13
|
return Math.min(parsed, max);
|
|
13
14
|
}
|
|
@@ -25,6 +26,14 @@ function search_default(route, auth, storage, config, logger) {
|
|
|
25
26
|
}
|
|
26
27
|
route.get(_verdaccio_middleware.SEARCH_API_ENDPOINTS.search, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), async (req, res, next) => {
|
|
27
28
|
const { query, url } = req;
|
|
29
|
+
if (typeof query.text !== "string" || query.text.trim().length === 0) {
|
|
30
|
+
const error = _verdaccio_core.errorUtils.getBadRequest("'text' query parameter is required");
|
|
31
|
+
res.status(error.status).json({
|
|
32
|
+
error: error.message,
|
|
33
|
+
code: "ERR_TEXT_MISSING"
|
|
34
|
+
});
|
|
35
|
+
return;
|
|
36
|
+
}
|
|
28
37
|
const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);
|
|
29
38
|
const from = parseQueryInt(query.from, 0, MAX_FROM);
|
|
30
39
|
const safeQuery = {
|
|
@@ -32,6 +41,11 @@ function search_default(route, auth, storage, config, logger) {
|
|
|
32
41
|
size,
|
|
33
42
|
from
|
|
34
43
|
};
|
|
44
|
+
const searchParams = new URLSearchParams();
|
|
45
|
+
for (const [key, value] of Object.entries(query)) if (typeof value === "string") searchParams.set(key, value);
|
|
46
|
+
searchParams.set("size", String(size));
|
|
47
|
+
searchParams.set("from", String(from));
|
|
48
|
+
const safeUrl = `${url.split("?")[0]}?${searchParams.toString()}`;
|
|
35
49
|
const abort = new AbortController();
|
|
36
50
|
const onClientClose = () => {
|
|
37
51
|
if (!res.writableEnded) abort.abort(/* @__PURE__ */ new Error("search client disconnected"));
|
|
@@ -54,7 +68,7 @@ function search_default(route, auth, storage, config, logger) {
|
|
|
54
68
|
let allowed = [];
|
|
55
69
|
for await (const data of storage.searchPages({
|
|
56
70
|
query: safeQuery,
|
|
57
|
-
url,
|
|
71
|
+
url: safeUrl,
|
|
58
72
|
abort
|
|
59
73
|
})) {
|
|
60
74
|
abort.signal.throwIfAborted();
|
package/build/v1/search.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"search.js","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nconst DEFAULT_SIZE = 20;\n// the public npm registry caps page size at 250 as well\nconst MAX_SIZE = 250;\n// upper bound for the pagination offset so a single request cannot force\n// an access check on an arbitrarily large slice of the catalog\nconst MAX_FROM = 10_000;\n// access checks run in batches so the scan can stop early once the\n// requested page is filled\nconst CHECK_ACCESS_BATCH_SIZE = 50;\nconst SEARCH_TIMEOUT_MS = 30_000;\n\nfunction parseQueryInt(value: unknown, defaultValue: number, max: number): number {\n const parsed = Number.parseInt(
|
|
1
|
+
{"version":3,"file":"search.js","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nconst DEFAULT_SIZE = 20;\n// the public npm registry caps page size at 250 as well\nconst MAX_SIZE = 250;\n// upper bound for the pagination offset so a single request cannot force\n// an access check on an arbitrarily large slice of the catalog\nconst MAX_FROM = 10_000;\n// access checks run in batches so the scan can stop early once the\n// requested page is filled\nconst CHECK_ACCESS_BATCH_SIZE = 50;\nconst SEARCH_TIMEOUT_MS = 30_000;\n\nfunction parseQueryInt(value: unknown, defaultValue: number, max: number): number {\n if (typeof value !== 'string') {\n return defaultValue;\n }\n const parsed = Number.parseInt(value, 10);\n if (Number.isNaN(parsed) || parsed < 0) {\n return defaultValue;\n }\n return Math.min(parsed, max);\n}\n\n/** Search v1 includes the response time as an ISO 8601 UTC timestamp. */\nexport default function (\n route,\n auth: Auth,\n storage: Storage,\n config: Config,\n logger: Logger\n): void {\n function checkAccess(\n pkg: any,\n auth: any,\n remoteUser\n ): Promise<searchUtils.SearchPackageItem | null> {\n return new Promise((resolve, reject) => {\n auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n if (err) {\n if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n // auth plugin returns 4xx user error,\n // that's equivalent of !allowed basically\n return resolve(null);\n } else {\n reject(err);\n }\n } else {\n return resolve(allowed ? pkg : null);\n }\n });\n });\n }\n\n route.get(\n SEARCH_API_ENDPOINTS.search,\n rateLimit(config?.userRateLimit),\n async (req, res, next) => {\n const { query, url } = req;\n if (typeof query.text !== 'string' || query.text.trim().length === 0) {\n const error = errorUtils.getBadRequest(\"'text' query parameter is required\");\n res.status(error.status).json({\n error: error.message,\n code: 'ERR_TEXT_MISSING',\n });\n return;\n }\n\n // `size` and `from` are attacker-controlled: clamp them so a single\n // request cannot demand unbounded work\n const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);\n const from = parseQueryInt(query.from, 0, MAX_FROM);\n const safeQuery = { ...query, size, from };\n // forward only plain string parameters to the uplinks, with the clamped pagination\n const searchParams = new URLSearchParams();\n for (const [key, value] of Object.entries(query)) {\n if (typeof value === 'string') {\n searchParams.set(key, value);\n }\n }\n searchParams.set('size', String(size));\n searchParams.set('from', String(from));\n const safeUrl = `${url.split('?')[0]}?${searchParams.toString()}`;\n const abort = new AbortController();\n const onClientClose = (): void => {\n if (!res.writableEnded) abort.abort(new Error('search client disconnected'));\n };\n res.on('close', onClientClose);\n const timeout = setTimeout(() => {\n abort.abort(errorUtils.getServiceUnavailable('search pagination timed out'));\n }, SEARCH_TIMEOUT_MS);\n timeout.unref();\n let onAbort: () => void;\n const cancelled = new Promise<never>((_resolve, reject) => {\n onAbort = () => reject(abort.signal.reason);\n abort.signal.addEventListener('abort', onAbort, { once: true });\n });\n\n try {\n const requested = from + size;\n const access = new Map<string, Promise<boolean>>();\n const collect = async (): Promise<searchUtils.SearchPackageItem[]> => {\n if (size === 0) return [];\n let allowed: searchUtils.SearchPackageItem[] = [];\n for await (const data of storage.searchPages({ query: safeQuery, url: safeUrl, abort })) {\n abort.signal.throwIfAborted();\n allowed = [];\n for (\n let i = 0;\n i < data.length && allowed.length < requested;\n i += CHECK_ACCESS_BATCH_SIZE\n ) {\n abort.signal.throwIfAborted();\n const batch = await Promise.race([\n Promise.all(\n data.slice(i, i + CHECK_ACCESS_BATCH_SIZE).map(async (item) => {\n const name = item.package.name;\n let permission = access.get(name);\n if (!permission) {\n permission = checkAccess(item, auth, req.remote_user).then(\n (result) => result !== null\n );\n access.set(name, permission);\n }\n return (await permission) ? item : null;\n })\n ),\n cancelled,\n ]);\n for (const item of batch) if (item !== null) allowed.push(item);\n }\n if (allowed.length >= requested) break;\n }\n abort.signal.throwIfAborted();\n return allowed.slice(from, requested);\n };\n const final = await Promise.race([collect(), cancelled]);\n logger.debug(`search results ${final?.length}`);\n\n const response = {\n objects: final,\n total: final.length,\n time: new Date().toISOString(),\n };\n\n res.status(HTTP_STATUS.OK).json(response);\n } catch (error) {\n if (res.destroyed) return;\n logger.error({ error }, 'search endpoint has failed @{error.message}');\n next(error);\n return;\n } finally {\n clearTimeout(timeout);\n abort.signal.removeEventListener('abort', onAbort!);\n res.off('close', onClientClose);\n abort.abort();\n }\n }\n );\n}\n"],"mappings":";;;AAOA,IAAM,eAAe;AAErB,IAAM,WAAW;AAGjB,IAAM,WAAW;AAGjB,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAE1B,SAAS,cAAc,OAAgB,cAAsB,KAAqB;CAChF,IAAI,OAAO,UAAU,UACnB,OAAO;CAET,MAAM,SAAS,OAAO,SAAS,OAAO,EAAE;CACxC,IAAI,OAAO,MAAM,MAAM,KAAK,SAAS,GACnC,OAAO;CAET,OAAO,KAAK,IAAI,QAAQ,GAAG;AAC7B;;AAGA,SAAA,eACE,OACA,MACA,SACA,QACA,QACM;CACN,SAAS,YACP,KACA,MACA,YAC+C;EAC/C,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KAAK;KACP,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,CAAC,CAAC,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;UAEnB,OAAO,GAAG;IAEd,OACE,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IACJ,sBAAA,qBAAqB,SAAA,GACrB,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,OAAO,KAAK,KAAK,SAAS;EACxB,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG;GACpE,MAAM,QAAQ,gBAAA,WAAW,cAAc,oCAAoC;GAC3E,IAAI,OAAO,MAAM,MAAM,CAAC,CAAC,KAAK;IAC5B,OAAO,MAAM;IACb,MAAM;GACR,CAAC;GACD;EACF;EAIA,MAAM,OAAO,cAAc,MAAM,MAAM,cAAc,QAAQ;EAC7D,MAAM,OAAO,cAAc,MAAM,MAAM,GAAG,QAAQ;EAClD,MAAM,YAAY;GAAE,GAAG;GAAO;GAAM;EAAK;EAEzC,MAAM,eAAe,IAAI,gBAAgB;EACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,OAAO,UAAU,UACnB,aAAa,IAAI,KAAK,KAAK;EAG/B,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,MAAM,UAAU,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,aAAa,SAAS;EAC9D,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,IAAI,CAAC,IAAI,eAAe,MAAM,sBAAM,IAAI,MAAM,4BAA4B,CAAC;EAC7E;EACA,IAAI,GAAG,SAAS,aAAa;EAC7B,MAAM,UAAU,iBAAiB;GAC/B,MAAM,MAAM,gBAAA,WAAW,sBAAsB,6BAA6B,CAAC;EAC7E,GAAG,iBAAiB;EACpB,QAAQ,MAAM;EACd,IAAI;EACJ,MAAM,YAAY,IAAI,SAAgB,UAAU,WAAW;GACzD,gBAAgB,OAAO,MAAM,OAAO,MAAM;GAC1C,MAAM,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAChE,CAAC;EAED,IAAI;GACF,MAAM,YAAY,OAAO;GACzB,MAAM,yBAAS,IAAI,IAA8B;GACjD,MAAM,UAAU,YAAsD;IACpE,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,UAA2C,CAAC;IAChD,WAAW,MAAM,QAAQ,QAAQ,YAAY;KAAE,OAAO;KAAW,KAAK;KAAS;IAAM,CAAC,GAAG;KACvF,MAAM,OAAO,eAAe;KAC5B,UAAU,CAAC;KACX,KACE,IAAI,IAAI,GACR,IAAI,KAAK,UAAU,QAAQ,SAAS,WACpC,KAAK,yBACL;MACA,MAAM,OAAO,eAAe;MAC5B,MAAM,QAAQ,MAAM,QAAQ,KAAK,CAC/B,QAAQ,IACN,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,CAAC,IAAI,OAAO,SAAS;OAC7D,MAAM,OAAO,KAAK,QAAQ;OAC1B,IAAI,aAAa,OAAO,IAAI,IAAI;OAChC,IAAI,CAAC,YAAY;QACf,aAAa,YAAY,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,MACnD,WAAW,WAAW,IACzB;QACA,OAAO,IAAI,MAAM,UAAU;OAC7B;OACA,OAAQ,MAAM,aAAc,OAAO;MACrC,CAAC,CACH,GACA,SACF,CAAC;MACD,KAAK,MAAM,QAAQ,OAAO,IAAI,SAAS,MAAM,QAAQ,KAAK,IAAI;KAChE;KACA,IAAI,QAAQ,UAAU,WAAW;IACnC;IACA,MAAM,OAAO,eAAe;IAC5B,OAAO,QAAQ,MAAM,MAAM,SAAS;GACtC;GACA,MAAM,QAAQ,MAAM,QAAQ,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;GACvD,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAW;IACf,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,gBAAA,YAAY,EAAE,CAAC,CAAC,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,IAAI,IAAI,WAAW;GACnB,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,aAAa,OAAO;GACpB,MAAM,OAAO,oBAAoB,SAAS,OAAQ;GAClD,IAAI,IAAI,SAAS,aAAa;GAC9B,MAAM,MAAM;EACd;CACF,CACF;AACF"}
|
package/build/v1/search.mjs
CHANGED
|
@@ -7,7 +7,8 @@ var MAX_FROM = 1e4;
|
|
|
7
7
|
var CHECK_ACCESS_BATCH_SIZE = 50;
|
|
8
8
|
var SEARCH_TIMEOUT_MS = 3e4;
|
|
9
9
|
function parseQueryInt(value, defaultValue, max) {
|
|
10
|
-
|
|
10
|
+
if (typeof value !== "string") return defaultValue;
|
|
11
|
+
const parsed = Number.parseInt(value, 10);
|
|
11
12
|
if (Number.isNaN(parsed) || parsed < 0) return defaultValue;
|
|
12
13
|
return Math.min(parsed, max);
|
|
13
14
|
}
|
|
@@ -25,6 +26,14 @@ function search_default(route, auth, storage, config, logger) {
|
|
|
25
26
|
}
|
|
26
27
|
route.get(SEARCH_API_ENDPOINTS.search, rateLimit(config?.userRateLimit), async (req, res, next) => {
|
|
27
28
|
const { query, url } = req;
|
|
29
|
+
if (typeof query.text !== "string" || query.text.trim().length === 0) {
|
|
30
|
+
const error = errorUtils.getBadRequest("'text' query parameter is required");
|
|
31
|
+
res.status(error.status).json({
|
|
32
|
+
error: error.message,
|
|
33
|
+
code: "ERR_TEXT_MISSING"
|
|
34
|
+
});
|
|
35
|
+
return;
|
|
36
|
+
}
|
|
28
37
|
const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);
|
|
29
38
|
const from = parseQueryInt(query.from, 0, MAX_FROM);
|
|
30
39
|
const safeQuery = {
|
|
@@ -32,6 +41,11 @@ function search_default(route, auth, storage, config, logger) {
|
|
|
32
41
|
size,
|
|
33
42
|
from
|
|
34
43
|
};
|
|
44
|
+
const searchParams = new URLSearchParams();
|
|
45
|
+
for (const [key, value] of Object.entries(query)) if (typeof value === "string") searchParams.set(key, value);
|
|
46
|
+
searchParams.set("size", String(size));
|
|
47
|
+
searchParams.set("from", String(from));
|
|
48
|
+
const safeUrl = `${url.split("?")[0]}?${searchParams.toString()}`;
|
|
35
49
|
const abort = new AbortController();
|
|
36
50
|
const onClientClose = () => {
|
|
37
51
|
if (!res.writableEnded) abort.abort(/* @__PURE__ */ new Error("search client disconnected"));
|
|
@@ -54,7 +68,7 @@ function search_default(route, auth, storage, config, logger) {
|
|
|
54
68
|
let allowed = [];
|
|
55
69
|
for await (const data of storage.searchPages({
|
|
56
70
|
query: safeQuery,
|
|
57
|
-
url,
|
|
71
|
+
url: safeUrl,
|
|
58
72
|
abort
|
|
59
73
|
})) {
|
|
60
74
|
abort.signal.throwIfAborted();
|
package/build/v1/search.mjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"search.mjs","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nconst DEFAULT_SIZE = 20;\n// the public npm registry caps page size at 250 as well\nconst MAX_SIZE = 250;\n// upper bound for the pagination offset so a single request cannot force\n// an access check on an arbitrarily large slice of the catalog\nconst MAX_FROM = 10_000;\n// access checks run in batches so the scan can stop early once the\n// requested page is filled\nconst CHECK_ACCESS_BATCH_SIZE = 50;\nconst SEARCH_TIMEOUT_MS = 30_000;\n\nfunction parseQueryInt(value: unknown, defaultValue: number, max: number): number {\n const parsed = Number.parseInt(
|
|
1
|
+
{"version":3,"file":"search.mjs","names":[],"sources":["../../src/v1/search.ts"],"sourcesContent":["import type { Auth } from '@verdaccio/auth';\nimport type { searchUtils } from '@verdaccio/core';\nimport { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport { SEARCH_API_ENDPOINTS, rateLimit } from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Logger } from '@verdaccio/types';\n\nconst DEFAULT_SIZE = 20;\n// the public npm registry caps page size at 250 as well\nconst MAX_SIZE = 250;\n// upper bound for the pagination offset so a single request cannot force\n// an access check on an arbitrarily large slice of the catalog\nconst MAX_FROM = 10_000;\n// access checks run in batches so the scan can stop early once the\n// requested page is filled\nconst CHECK_ACCESS_BATCH_SIZE = 50;\nconst SEARCH_TIMEOUT_MS = 30_000;\n\nfunction parseQueryInt(value: unknown, defaultValue: number, max: number): number {\n if (typeof value !== 'string') {\n return defaultValue;\n }\n const parsed = Number.parseInt(value, 10);\n if (Number.isNaN(parsed) || parsed < 0) {\n return defaultValue;\n }\n return Math.min(parsed, max);\n}\n\n/** Search v1 includes the response time as an ISO 8601 UTC timestamp. */\nexport default function (\n route,\n auth: Auth,\n storage: Storage,\n config: Config,\n logger: Logger\n): void {\n function checkAccess(\n pkg: any,\n auth: any,\n remoteUser\n ): Promise<searchUtils.SearchPackageItem | null> {\n return new Promise((resolve, reject) => {\n auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {\n if (err) {\n if (err.status && String(err.status).match(/^4\\d\\d$/)) {\n // auth plugin returns 4xx user error,\n // that's equivalent of !allowed basically\n return resolve(null);\n } else {\n reject(err);\n }\n } else {\n return resolve(allowed ? pkg : null);\n }\n });\n });\n }\n\n route.get(\n SEARCH_API_ENDPOINTS.search,\n rateLimit(config?.userRateLimit),\n async (req, res, next) => {\n const { query, url } = req;\n if (typeof query.text !== 'string' || query.text.trim().length === 0) {\n const error = errorUtils.getBadRequest(\"'text' query parameter is required\");\n res.status(error.status).json({\n error: error.message,\n code: 'ERR_TEXT_MISSING',\n });\n return;\n }\n\n // `size` and `from` are attacker-controlled: clamp them so a single\n // request cannot demand unbounded work\n const size = parseQueryInt(query.size, DEFAULT_SIZE, MAX_SIZE);\n const from = parseQueryInt(query.from, 0, MAX_FROM);\n const safeQuery = { ...query, size, from };\n // forward only plain string parameters to the uplinks, with the clamped pagination\n const searchParams = new URLSearchParams();\n for (const [key, value] of Object.entries(query)) {\n if (typeof value === 'string') {\n searchParams.set(key, value);\n }\n }\n searchParams.set('size', String(size));\n searchParams.set('from', String(from));\n const safeUrl = `${url.split('?')[0]}?${searchParams.toString()}`;\n const abort = new AbortController();\n const onClientClose = (): void => {\n if (!res.writableEnded) abort.abort(new Error('search client disconnected'));\n };\n res.on('close', onClientClose);\n const timeout = setTimeout(() => {\n abort.abort(errorUtils.getServiceUnavailable('search pagination timed out'));\n }, SEARCH_TIMEOUT_MS);\n timeout.unref();\n let onAbort: () => void;\n const cancelled = new Promise<never>((_resolve, reject) => {\n onAbort = () => reject(abort.signal.reason);\n abort.signal.addEventListener('abort', onAbort, { once: true });\n });\n\n try {\n const requested = from + size;\n const access = new Map<string, Promise<boolean>>();\n const collect = async (): Promise<searchUtils.SearchPackageItem[]> => {\n if (size === 0) return [];\n let allowed: searchUtils.SearchPackageItem[] = [];\n for await (const data of storage.searchPages({ query: safeQuery, url: safeUrl, abort })) {\n abort.signal.throwIfAborted();\n allowed = [];\n for (\n let i = 0;\n i < data.length && allowed.length < requested;\n i += CHECK_ACCESS_BATCH_SIZE\n ) {\n abort.signal.throwIfAborted();\n const batch = await Promise.race([\n Promise.all(\n data.slice(i, i + CHECK_ACCESS_BATCH_SIZE).map(async (item) => {\n const name = item.package.name;\n let permission = access.get(name);\n if (!permission) {\n permission = checkAccess(item, auth, req.remote_user).then(\n (result) => result !== null\n );\n access.set(name, permission);\n }\n return (await permission) ? item : null;\n })\n ),\n cancelled,\n ]);\n for (const item of batch) if (item !== null) allowed.push(item);\n }\n if (allowed.length >= requested) break;\n }\n abort.signal.throwIfAborted();\n return allowed.slice(from, requested);\n };\n const final = await Promise.race([collect(), cancelled]);\n logger.debug(`search results ${final?.length}`);\n\n const response = {\n objects: final,\n total: final.length,\n time: new Date().toISOString(),\n };\n\n res.status(HTTP_STATUS.OK).json(response);\n } catch (error) {\n if (res.destroyed) return;\n logger.error({ error }, 'search endpoint has failed @{error.message}');\n next(error);\n return;\n } finally {\n clearTimeout(timeout);\n abort.signal.removeEventListener('abort', onAbort!);\n res.off('close', onClientClose);\n abort.abort();\n }\n }\n );\n}\n"],"mappings":";;;AAOA,IAAM,eAAe;AAErB,IAAM,WAAW;AAGjB,IAAM,WAAW;AAGjB,IAAM,0BAA0B;AAChC,IAAM,oBAAoB;AAE1B,SAAS,cAAc,OAAgB,cAAsB,KAAqB;CAChF,IAAI,OAAO,UAAU,UACnB,OAAO;CAET,MAAM,SAAS,OAAO,SAAS,OAAO,EAAE;CACxC,IAAI,OAAO,MAAM,MAAM,KAAK,SAAS,GACnC,OAAO;CAET,OAAO,KAAK,IAAI,QAAQ,GAAG;AAC7B;;AAGA,SAAA,eACE,OACA,MACA,SACA,QACA,QACM;CACN,SAAS,YACP,KACA,MACA,YAC+C;EAC/C,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,KAAK,aAAa,EAAE,aAAa,KAAK,SAAS,KAAK,GAAG,YAAY,SAAU,KAAK,SAAS;IACzF,IAAI,KAAK;KACP,IAAI,IAAI,UAAU,OAAO,IAAI,MAAM,CAAC,CAAC,MAAM,SAAS,GAGlD,OAAO,QAAQ,IAAI;UAEnB,OAAO,GAAG;IAEd,OACE,OAAO,QAAQ,UAAU,MAAM,IAAI;GAEvC,CAAC;EACH,CAAC;CACH;CAEA,MAAM,IACJ,qBAAqB,QACrB,UAAU,QAAQ,aAAa,GAC/B,OAAO,KAAK,KAAK,SAAS;EACxB,MAAM,EAAE,OAAO,QAAQ;EACvB,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,KAAK,CAAC,CAAC,WAAW,GAAG;GACpE,MAAM,QAAQ,WAAW,cAAc,oCAAoC;GAC3E,IAAI,OAAO,MAAM,MAAM,CAAC,CAAC,KAAK;IAC5B,OAAO,MAAM;IACb,MAAM;GACR,CAAC;GACD;EACF;EAIA,MAAM,OAAO,cAAc,MAAM,MAAM,cAAc,QAAQ;EAC7D,MAAM,OAAO,cAAc,MAAM,MAAM,GAAG,QAAQ;EAClD,MAAM,YAAY;GAAE,GAAG;GAAO;GAAM;EAAK;EAEzC,MAAM,eAAe,IAAI,gBAAgB;EACzC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,GAC7C,IAAI,OAAO,UAAU,UACnB,aAAa,IAAI,KAAK,KAAK;EAG/B,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,aAAa,IAAI,QAAQ,OAAO,IAAI,CAAC;EACrC,MAAM,UAAU,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,aAAa,SAAS;EAC9D,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,sBAA4B;GAChC,IAAI,CAAC,IAAI,eAAe,MAAM,sBAAM,IAAI,MAAM,4BAA4B,CAAC;EAC7E;EACA,IAAI,GAAG,SAAS,aAAa;EAC7B,MAAM,UAAU,iBAAiB;GAC/B,MAAM,MAAM,WAAW,sBAAsB,6BAA6B,CAAC;EAC7E,GAAG,iBAAiB;EACpB,QAAQ,MAAM;EACd,IAAI;EACJ,MAAM,YAAY,IAAI,SAAgB,UAAU,WAAW;GACzD,gBAAgB,OAAO,MAAM,OAAO,MAAM;GAC1C,MAAM,OAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EAChE,CAAC;EAED,IAAI;GACF,MAAM,YAAY,OAAO;GACzB,MAAM,yBAAS,IAAI,IAA8B;GACjD,MAAM,UAAU,YAAsD;IACpE,IAAI,SAAS,GAAG,OAAO,CAAC;IACxB,IAAI,UAA2C,CAAC;IAChD,WAAW,MAAM,QAAQ,QAAQ,YAAY;KAAE,OAAO;KAAW,KAAK;KAAS;IAAM,CAAC,GAAG;KACvF,MAAM,OAAO,eAAe;KAC5B,UAAU,CAAC;KACX,KACE,IAAI,IAAI,GACR,IAAI,KAAK,UAAU,QAAQ,SAAS,WACpC,KAAK,yBACL;MACA,MAAM,OAAO,eAAe;MAC5B,MAAM,QAAQ,MAAM,QAAQ,KAAK,CAC/B,QAAQ,IACN,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,CAAC,IAAI,OAAO,SAAS;OAC7D,MAAM,OAAO,KAAK,QAAQ;OAC1B,IAAI,aAAa,OAAO,IAAI,IAAI;OAChC,IAAI,CAAC,YAAY;QACf,aAAa,YAAY,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,MACnD,WAAW,WAAW,IACzB;QACA,OAAO,IAAI,MAAM,UAAU;OAC7B;OACA,OAAQ,MAAM,aAAc,OAAO;MACrC,CAAC,CACH,GACA,SACF,CAAC;MACD,KAAK,MAAM,QAAQ,OAAO,IAAI,SAAS,MAAM,QAAQ,KAAK,IAAI;KAChE;KACA,IAAI,QAAQ,UAAU,WAAW;IACnC;IACA,MAAM,OAAO,eAAe;IAC5B,OAAO,QAAQ,MAAM,MAAM,SAAS;GACtC;GACA,MAAM,QAAQ,MAAM,QAAQ,KAAK,CAAC,QAAQ,GAAG,SAAS,CAAC;GACvD,OAAO,MAAM,kBAAkB,OAAO,QAAQ;GAE9C,MAAM,WAAW;IACf,SAAS;IACT,OAAO,MAAM;IACb,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;GAC/B;GAEA,IAAI,OAAO,YAAY,EAAE,CAAC,CAAC,KAAK,QAAQ;EAC1C,SAAS,OAAO;GACd,IAAI,IAAI,WAAW;GACnB,OAAO,MAAM,EAAE,MAAM,GAAG,6CAA6C;GACrE,KAAK,KAAK;GACV;EACF,UAAU;GACR,aAAa,OAAO;GACpB,MAAM,OAAO,oBAAoB,SAAS,OAAQ;GAClD,IAAI,IAAI,SAAS,aAAa;GAC9B,MAAM,MAAM;EACd;CACF,CACF;AACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/api",
|
|
3
|
-
"version": "9.0.0-next-9.
|
|
3
|
+
"version": "9.0.0-next-9.34",
|
|
4
4
|
"description": "Verdaccio Registry API",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -33,21 +33,21 @@
|
|
|
33
33
|
},
|
|
34
34
|
"license": "MIT",
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"@verdaccio/auth": "9.0.0-next-9.
|
|
37
|
-
"@verdaccio/config": "9.0.0-next-9.
|
|
38
|
-
"@verdaccio/core": "9.0.0-next-9.
|
|
39
|
-
"@verdaccio/hooks": "9.0.0-next-9.
|
|
40
|
-
"@verdaccio/logger": "9.0.0-next-9.
|
|
41
|
-
"@verdaccio/middleware": "9.0.0-next-9.
|
|
42
|
-
"@verdaccio/store": "9.0.0-next-9.
|
|
36
|
+
"@verdaccio/auth": "9.0.0-next-9.34",
|
|
37
|
+
"@verdaccio/config": "9.0.0-next-9.34",
|
|
38
|
+
"@verdaccio/core": "9.0.0-next-9.34",
|
|
39
|
+
"@verdaccio/hooks": "9.0.0-next-9.34",
|
|
40
|
+
"@verdaccio/logger": "9.0.0-next-9.34",
|
|
41
|
+
"@verdaccio/middleware": "9.0.0-next-9.34",
|
|
42
|
+
"@verdaccio/store": "9.0.0-next-9.34",
|
|
43
43
|
"debug": "4.4.3",
|
|
44
44
|
"express": "5.2.1",
|
|
45
45
|
"lodash-es": "4.18.1"
|
|
46
46
|
},
|
|
47
47
|
"devDependencies": {
|
|
48
48
|
"@types/lodash-es": "4.17.12",
|
|
49
|
-
"@verdaccio/test-helper": "5.0.0-next-9.
|
|
50
|
-
"@verdaccio/types": "14.0.0-next-9.
|
|
49
|
+
"@verdaccio/test-helper": "5.0.0-next-9.35",
|
|
50
|
+
"@verdaccio/types": "14.0.0-next-9.16",
|
|
51
51
|
"mockdate": "3.0.5",
|
|
52
52
|
"nock": "13.5.6",
|
|
53
53
|
"otpauth": "9.5.1",
|