@verdaccio/auth 6.0.0-6-next.13 → 6.0.0-6-next.17

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @verdaccio/auth
 
+## 6.0.0-6-next.17
+
+### Patch Changes
+
+- Updated dependencies [730b5d8c]
+  - @verdaccio/logger@6.0.0-6-next.9
+  - @verdaccio/loaders@6.0.0-6-next.9
+
+## 6.0.0-6-next.16
+
+### Patch Changes
+
+- Updated dependencies [a828271d]
+- Updated dependencies [24b9be02]
+- Updated dependencies [e75c0a3b]
+- Updated dependencies [b13a3fef]
+  - @verdaccio/utils@6.0.0-6-next.10
+  - @verdaccio/core@6.0.0-6-next.4
+  - @verdaccio/logger@6.0.0-6-next.8
+  - @verdaccio/config@6.0.0-6-next.12
+  - @verdaccio/loaders@6.0.0-6-next.8
+  - verdaccio-htpasswd@11.0.0-6-next.11
+
+## 6.0.0-6-next.15
+
+### Minor Changes
+
+- 20c9e43e: dist tags Implementation on Fastify
+
+### Patch Changes
+
+- Updated dependencies [f86c31ed]
+  - @verdaccio/utils@6.0.0-6-next.9
+  - @verdaccio/config@6.0.0-6-next.11
+  - @verdaccio/loaders@6.0.0-6-next.7
+
+## 6.0.0-6-next.14
+
+### Patch Changes
+
+- Updated dependencies [6c1eb021]
+  - @verdaccio/core@6.0.0-6-next.3
+  - @verdaccio/logger@6.0.0-6-next.7
+  - @verdaccio/config@6.0.0-6-next.10
+  - @verdaccio/loaders@6.0.0-6-next.7
+  - verdaccio-htpasswd@11.0.0-6-next.10
+  - @verdaccio/utils@6.0.0-6-next.8
+
 ## 6.0.0-6-next.13
 
 ### Major Changes

package/build/auth.d.ts

@@ -1,8 +1,9 @@
 import { NextFunction, Request, Response } from 'express';
-import { Config, Logger, Callback, IPluginAuth, RemoteUser, JWTSignOptions, AuthPluginPackage } from '@verdaccio/types';
+import { AuthPluginPackage, Callback, Config, IPluginAuth, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
 export interface IBasicAuth<T> {
     config: T & Config;
     authenticate(user: string, password: string, cb: Callback): void;
+    invalidateToken?(token: string): Promise<void>;
     changePassword(user: string, password: string, newPassword: string, cb: Callback): void;
     allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
     add_user(user: string, password: string, cb: Callback): any;
@@ -33,6 +34,7 @@ export interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncrypt
     secret: string;
     plugins: any[];
     allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
+    invalidateToken(token: string): Promise<void>;
 }
 declare class Auth implements IAuth {
     config: Config;
@@ -44,6 +46,7 @@ declare class Auth implements IAuth {
     private _loadPlugin;
     private _applyDefaultPlugins;
     changePassword(username: string, password: string, newPassword: string, cb: Callback): void;
+    invalidateToken(token: string): Promise<void>;
     authenticate(username: string, password: string, cb: Callback): void;
     add_user(user: string, password: string, cb: Callback): void;
     /**

package/build/auth.js

@@ -5,35 +5,29 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.Auth = void 0;
 
+var _debug = _interopRequireDefault(require("debug"));
+
 var _lodash = _interopRequireDefault(require("lodash"));
 
-var _debug = _interopRequireDefault(require("debug"));
+var _verdaccioHtpasswd = require("verdaccio-htpasswd");
+
+var _config = require("@verdaccio/config");
 
 var _core = require("@verdaccio/core");
 
 var _loaders = require("@verdaccio/loaders");
 
-var _verdaccioHtpasswd = require("verdaccio-htpasswd");
-
 var _utils = require("@verdaccio/utils");
 
-var _config = require("@verdaccio/config");
-
-var _utils2 = require("./utils");
-
 var _jwtToken = require("./jwt-token");
 
 var _legacyToken = require("./legacy-token");
 
 var _token = require("./token");
 
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) { symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); } keys.push.apply(keys, symbols); } return keys; }
-
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(Object(source), true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
+var _utils2 = require("./utils");
 
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 /* eslint-disable @typescript-eslint/no-var-requires */
 const LoggerApi = require('@verdaccio/logger');
@@ -42,29 +36,25 @@ const debug = (0, _debug.default)('verdaccio:auth');
 
 class Auth {
   constructor(config) {
-    _defineProperty(this, "config", void 0);
-
-    _defineProperty(this, "logger", void 0);
-
-    _defineProperty(this, "secret", void 0);
-
-    _defineProperty(this, "plugins", void 0);
-
     this.config = config;
     this.logger = LoggerApi.logger.child({
       sub: 'auth'
     });
     this.secret = config.secret;
+
+    if (!this.secret) {
+      throw new TypeError('secret it is required value on initialize the auth class');
+    }
+
     this.plugins = _lodash.default.isNil(config === null || config === void 0 ? void 0 : config.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);
 
     this._applyDefaultPlugins();
   }
 
   loadDefaultPlugin(config) {
-    const plugingConf = _objectSpread(_objectSpread({}, config), {}, {
+    const plugingConf = { ...config,
       file: './htpasswd'
-    });
-
+    };
     const pluginOptions = {
       config,
       logger: this.logger
@@ -132,6 +122,12 @@ class Auth {
     }
   }
 
+  async invalidateToken(token) {
+    // eslint-disable-next-line no-console
+    console.log('invalidate token pending to implement', token);
+    return Promise.resolve();
+  }
+
   authenticate(username, password, cb) {
     const plugins = this.plugins.slice(0);
 
@@ -368,7 +364,9 @@ class Auth {
       } // in case auth header does not exist we return anonymous function
 
 
-      req.remote_user = (0, _config.createAnonymousRemoteUser)();
+      const remoteUser = (0, _config.createAnonymousRemoteUser)();
+      req.remote_user = remoteUser;
+      res.locals.remote_user = remoteUser;
       const {
         authorization
       } = req.headers;

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth.ts"],"names":["LoggerApi","require","debug","Auth","constructor","config","logger","child","sub","secret","plugins","_","isNil","auth","_loadPlugin","loadDefaultPlugin","_applyDefaultPlugins","plugingConf","file","pluginOptions","authPlugin","HTPasswd","error","plugin","authenticate","allow_access","allow_publish","push","changePassword","username","password","newPassword","cb","validPlugins","filter","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","err","profile","slice","next","shift","groups","message","length","isString","TypeError","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","createRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","authorization","headers","getBadRequest","BAD_AUTH_HEADER","security","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","token","toUpperCase","TOKEN_BASIC","credentials","toString","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","aesEncrypt","value"],"mappings":";;;;;;;AAAA;;AAEA;;AAEA;;AAQA;;AACA;;AAgBA;;AACA;;AAEA;;AAUA;;AACA;;AACA;;;;;;;;;;AAEA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,oBAAW,gBAAX,CAAd;;AAsCA,MAAMC,IAAN,CAA4B;AAMnBC,EAAAA,WAAW,CAACC,MAAD,EAAiB;AAAA;;AAAA;;AAAA;;AAAA;;AACjC,SAAKA,MAAL,GAAcA,MAAd;AACA,SAAKC,MAAL,GAAcN,SAAS,CAACM,MAAV,CAAiBC,KAAjB,CAAuB;AAAEC,MAAAA,GAAG,EAAE;AAAP,KAAvB,CAAd;AACA,SAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;AAEA,SAAKC,OAAL,GACEC,gBAAEC,KAAF,CAAQP,MAAR,aAAQA,MAAR,uBAAQA,MAAM,CAAEQ,IAAhB,MAA0B,KAA1B,GAAkC,KAAKC,WAAL,CAAiBT,MAAjB,CAAlC,GAA6D,KAAKU,iBAAL,CAAuBV,MAAvB,CAD/D;;AAEA,SAAKW,oBAAL;AACD;;AAEOD,EAAAA,iBAAiB,CAACV,MAAD,EAAiB;AACxC,UAAMY,WAA2B,mCAAQZ,MAAR;AAAgBa,MAAAA,IAAI,EAAE;AAAtB,MAAjC;;AACA,UAAMC,aAAgC,GAAG;AACvCd,MAAAA,MADuC;AAEvCC,MAAAA,MAAM,EAAE,KAAKA;AAF0B,KAAzC;AAIA,QAAIc,UAAJ;;AACA,QAAI;AACFA,MAAAA,UAAU,GAAG,IAAIC,2BAAJ,CAAaJ,WAAb,EAA0BE,aAA1B,CAAb;AACD,KAFD,CAEE,OAAOG,KAAP,EAAmB;AACnBpB,MAAAA,KAAK,CAAC,iDAAD,EAAoDoB,KAApD,CAAL;AACA,aAAO,EAAP;AACD;;AAED,WAAO,CAACF,UAAD,CAAP;AACD;;AAEON,EAAAA,WAAW,CAACT,MAAD,EAAwC;AACzD,UAAMc,aAAa,GAAG;AACpBd,MAAAA,MADoB;AAEpBC,MAAAA,MAAM,EAAE,KAAKA;AAFO,KAAtB;AAKA,WAAO,yBACLD,MADK,EAELA,MAAM,CAACQ,IAFF,EAGLM,aAHK,EAIJI,MAAD,IAA0C;AACxC,YAAM;AAAEC,QAAAA,YAAF;AAAgBC,QAAAA,YAAhB;AAA8BC,QAAAA;AAA9B,UAAgDH,MAAtD,CADwC,CAGxC;;AACA,aAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;AACD,KATI,CAAP;AAWD;;AAEOV,EAAAA,oBAAoB,GAAS;AACnC;AACA,SAAKN,OAAL,CAAaiB,IAAb,CAAkB,+BAAkB,KAAKrB,MAAvB,CAAlB;AACD;;AAEMsB,EAAAA,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;AACN,UAAMC,YAAY,GAAGtB,gBAAEuB,MAAF,CAAS,KAAKxB,OAAd,EAAwBa,MAAD,IAAY,uBAAWA,MAAM,CAACK,cAAlB,CAAnC,CAArB;;AAEA,QAAIjB,gBAAEwB,OAAF,CAAUF,YAAV,CAAJ,EAA6B;AAC3B,aAAOD,EAAE,CAACI,iBAAWC,gBAAX,CAA4BC,qBAAeC,wBAA3C,CAAD,CAAT;AACD;;AAED,SAAK,MAAMhB,MAAX,IAAqBU,YAArB,EAAmC;AACjC,UAAI,kBAAMV,MAAN,KAAiB,uBAAWA,MAAM,CAACK,cAAlB,MAAsC,KAA3D,EAAkE;AAChE1B,QAAAA,KAAK,CAAC,gEAAD,CAAL;AACA;AACD,OAHD,MAGO;AACLA,QAAAA,KAAK,CAAC,0BAAD,EAA6B2B,QAA7B,CAAL;AACAN,QAAAA,MAAM,CAACK,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACS,GAAD,EAAMC,OAAN,KAAwB;AAC9E,cAAID,GAAJ,EAAS;AACP,iBAAKlC,MAAL,CAAYgB,KAAZ,CACE;AAAEO,cAAAA,QAAF;AAAYW,cAAAA;AAAZ,aADF,EAEG;AACf,yEAHY;AAKA,mBAAOR,EAAE,CAACQ,GAAD,CAAT;AACD;;AAEDtC,UAAAA,KAAK,CAAC,wCAAD,EAA2C2B,QAA3C,CAAL;AACA,iBAAOG,EAAE,CAAC,IAAD,EAAOS,OAAP,CAAT;AACD,SAZD;AAaD;AACF;AACF;;AAEMjB,EAAAA,YAAY,CAACK,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;AAC1E,UAAMtB,OAAO,GAAG,KAAKA,OAAL,CAAagC,KAAb,CAAmB,CAAnB,CAAhB;;AACA,KAAC,SAASC,IAAT,GAAsB;AACrB,YAAMpB,MAAM,GAAGb,OAAO,CAACkC,KAAR,EAAf;;AAEA,UAAI,uBAAWrB,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;AAC7C,eAAOmB,IAAI,EAAX;AACD;;AAEDzC,MAAAA,KAAK,CAAC,mBAAD,EAAsB2B,QAAtB,CAAL;AACAN,MAAAA,MAAM,CAACC,YAAP,CAAoBK,QAApB,EAA8BC,QAA9B,EAAwC,UAAUU,GAAV,EAAeK,MAAf,EAA6B;AACnE,YAAIL,GAAJ,EAAS;AACPtC,UAAAA,KAAK,CAAC,8CAAD,EAAiD2B,QAAjD,EAA2DW,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEM,OAAhE,CAAL;AACA,iBAAOd,EAAE,CAACQ,GAAD,CAAT;AACD,SAJkE,CAMnE;AACA;AACA;AACA;AACA;AACA;AACA;;;AACA,YAAI,CAAC,CAACK,MAAF,IAAYA,MAAM,CAACE,MAAP,KAAkB,CAAlC,EAAqC;AACnC;AACA,cAAIpC,gBAAEqC,QAAF,CAAWH,MAAX,CAAJ,EAAwB;AACtB,kBAAM,IAAII,SAAJ,CAAc,+CAAd,CAAN;AACD;;AACD,gBAAMC,YAAqB,GAAGvC,gBAAEwC,OAAF,CAAUN,MAAV,CAA9B;;AACA,cAAI,CAACK,YAAL,EAAmB;AACjB,kBAAM,IAAID,SAAJ,CAAcG,gBAAUC,qBAAxB,CAAN;AACD;;AAEDnD,UAAAA,KAAK,CAAC,yDAAD,EAA4D2B,QAA5D,EAAsEgB,MAAtE,CAAL;AACA,iBAAOb,EAAE,CAACQ,GAAD,EAAM,8BAAiBX,QAAjB,EAA2BgB,MAA3B,CAAN,CAAT;AACD;;AACDF,QAAAA,IAAI;AACL,OA3BD;AA4BD,KApCD;AAqCD;;AAEMW,EAAAA,QAAQ,CAACC,IAAD,EAAezB,QAAf,EAAiCE,EAAjC,EAAqD;AAClE,UAAMwB,IAAI,GAAG,IAAb;AACA,UAAM9C,OAAO,GAAG,KAAKA,OAAL,CAAagC,KAAb,CAAmB,CAAnB,CAAhB;AACAxC,IAAAA,KAAK,CAAC,aAAD,EAAgBqD,IAAhB,CAAL;;AAEA,KAAC,SAASZ,IAAT,GAAsB;AACrB,YAAMpB,MAAM,GAAGb,OAAO,CAACkC,KAAR,EAAf;AACA,UAAIa,MAAM,GAAG,SAAb;;AACA,UAAI,uBAAWlC,MAAM,CAACkC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCA,QAAAA,MAAM,GAAG,UAAT;AACAD,QAAAA,IAAI,CAAClD,MAAL,CAAYoD,IAAZ,CACE,yEACE,gEAFJ;AAID;;AAED,UAAI,uBAAWnC,MAAM,CAACkC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCd,QAAAA,IAAI;AACL,OAFD,MAEO;AACL;AACApB,QAAAA,MAAM,CAACkC,MAAD,CAAN,CAAeF,IAAf,EAAqBzB,QAArB,EAA+B,UAAUU,GAAV,EAAemB,EAAf,EAAyB;AACtD,cAAInB,GAAJ,EAAS;AACPtC,YAAAA,KAAK,CAAC,+CAAD,EAAkDqD,IAAlD,EAAwDf,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEM,OAA7D,CAAL;AACA,mBAAOd,EAAE,CAACQ,GAAD,CAAT;AACD;;AACD,cAAImB,EAAJ,EAAQ;AACNzD,YAAAA,KAAK,CAAC,4BAAD,EAA+BqD,IAA/B,CAAL;AACA,mBAAOC,IAAI,CAAChC,YAAL,CAAkB+B,IAAlB,EAAwBzB,QAAxB,EAAkCE,EAAlC,CAAP;AACD;;AACDW,UAAAA,IAAI;AACL,SAVD;AAWD;AACF,KA3BD;AA4BD;AAED;AACF;AACA;;;AACSlB,EAAAA,YAAY,CACjB;AAAEmC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;AACN,UAAMpD,OAAO,GAAG,KAAKA,OAAL,CAAagC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMqB,aAA0B,GAAG;AAAEC,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KAAnC;AACA,UAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,mCAAuBH,WAAvB,EAAoC,KAAKvD,MAAL,CAAYgE,QAAhD,CAHU,CAAZ;AAKAnE,IAAAA,KAAK,CAAC,qBAAD,EAAwB0D,WAAxB,CAAL;;AAEA,KAAC,SAASjB,IAAT,GAAsB;AACrB,YAAMpB,MAA2B,GAAGb,OAAO,CAACkC,KAAR,EAApC;;AAEA,UAAIjC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;AAChE,eAAOkB,IAAI,EAAX;AACD;;AAEDpB,MAAAA,MAAM,CAACE,YAAP,CAAqB8B,IAArB,EAA2BW,GAA3B,EAAgC,UAAU1B,GAAV,EAAemB,EAAf,EAAkC;AAChE,YAAInB,GAAJ,EAAS;AACPtC,UAAAA,KAAK,CAAC,oCAAD,EAAuC0D,WAAvC,EAAoDpB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEM,OAAzD,CAAL;AACA,iBAAOgB,QAAQ,CAACtB,GAAD,CAAf;AACD;;AAED,YAAImB,EAAJ,EAAQ;AACNzD,UAAAA,KAAK,CAAC,uBAAD,EAA0B0D,WAA1B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAEDhB,QAAAA,IAAI,GAX4D,CAWxD;AACT,OAZD;AAaD,KApBD;AAqBD;;AAEM2B,EAAAA,eAAe,CACpB;AAAEV,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;AACN,UAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAKvD,MAAL,CAAYgE,QAAhD,CAFU,CAAZ;AAIAnE,IAAAA,KAAK,CAAC,wBAAD,EAA2B0D,WAA3B,CAAL;;AAEA,SAAK,MAAMrC,MAAX,IAAqB,KAAKb,OAA1B,EAAmC;AACjC,UAAIC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAAC+C,eAAlB,MAAuC,KAA9D,EAAqE;AACnEpE,QAAAA,KAAK,CAAC,kEAAD,EAAqE0D,WAArE,CAAL;AACA;AACD,OAHD,MAGO;AACL;AACArC,QAAAA,MAAM,CAAC+C,eAAP,CAAwBf,IAAxB,EAA8BW,GAA9B,EAAmC,CAAC1B,GAAD,EAAMmB,EAAN,KAA4B;AAC7D,cAAInB,GAAJ,EAAS;AACPtC,YAAAA,KAAK,CACH,qEADG,EAEH0D,WAFG,CAAL;AAIA,mBAAOE,QAAQ,CAACtB,GAAD,CAAf;AACD;;AAED,cAAI7B,gBAAEC,KAAF,CAAQ+C,EAAR,MAAgB,IAApB,EAA0B;AACxBzD,YAAAA,KAAK,CAAC,yDAAD,EAA4D0D,WAA5D,CAAL,CADwB,CAExB;AACA;;AACA,mBAAO,KAAKlC,aAAL,CAAmB,GAAG6C,SAAtB,CAAP;AACD;;AAED,cAAIZ,EAAJ,EAAQ;AACNzD,YAAAA,KAAK,CAAC,0BAAD,EAA6B0D,WAA7B,CAAL;AACA,mBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;AACF,SApBD;AAqBD;AACF;AACF;AAED;AACF;AACA;;;AACSjC,EAAAA,aAAa,CAClB;AAAEkC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;AACN,UAAMpD,OAAO,GAAG,KAAKA,OAAL,CAAagC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMwB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAKvD,MAAL,CAAYgE,QAAhD,CAFU,CAAZ;AAIAnE,IAAAA,KAAK,CAAC,yCAAD,EAA4C0D,WAA5C,EAAyDlD,OAAO,CAACqC,MAAjE,CAAL;;AAEA,KAAC,SAASJ,IAAT,GAAsB;AACrB,YAAMpB,MAAM,GAAGb,OAAO,CAACkC,KAAR,EAAf;;AAEA,UAAI,uBAAWrB,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;AAC/CxB,QAAAA,KAAK,CAAC,8DAAD,EAAiE0D,WAAjE,CAAL;AACA,eAAOjB,IAAI,EAAX;AACD,OANoB,CAQrB;;;AACApB,MAAAA,MAAM,CAACG,aAAP,CACE6B,IADF,EAEE;AACAW,MAAAA,GAHF,EAIE;AACA,OAAC1B,GAAD,EAAsBmB,EAAtB,KAA4C;AAC1C,YAAIhD,gBAAEC,KAAF,CAAQ4B,GAAR,MAAiB,KAAjB,IAA0B7B,gBAAE6D,OAAF,CAAUhC,GAAV,CAA9B,EAA8C;AAC5CtC,UAAAA,KAAK,CAAC,0BAAD,EAA6B0D,WAA7B,CAAL;AACA,iBAAOE,QAAQ,CAACtB,GAAD,CAAf;AACD;;AAED,YAAImB,EAAJ,EAAQ;AACNzD,UAAAA,KAAK,CAAC,wBAAD,EAA2B0D,WAA3B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAEDzD,QAAAA,KAAK,CAAC,sCAAD,EAAyC0D,WAAzC,CAAL;AACAjB,QAAAA,IAAI,GAZsC,CAYlC;AACT,OAlBH;AAoBD,KA7BD;AA8BD;;AAEM8B,EAAAA,gBAAgB,GAAa;AAClCvE,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,UAAMQ,OAAO,GAAG,KAAKA,OAAL,CAAagC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMgC,OAAO,GAAG;AAAEC,MAAAA,yBAAyB,EAAzBA,iCAAF;AAA6BC,MAAAA,gBAAgB,EAAhBA;AAA7B,KAAhB;;AACA,SAAK,MAAMrD,MAAX,IAAqBb,OAArB,EAA8B;AAC5B,UAAIa,MAAM,CAACkD,gBAAX,EAA6B;AAC3B,eAAOlD,MAAM,CAACkD,gBAAP,CAAwBC,OAAxB,CAAP;AACD;AACF;;AAED,WAAO,CAACG,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/EF,MAAAA,GAAG,CAACG,KAAJ;;AAEA,YAAMrC,IAAI,GAAG,UAAUH,GAAV,EAA4C;AACvDqC,QAAAA,GAAG,CAACI,MAAJ,GADuD,CAEvD;AACA;AACA;AACA;;AACA,YAAIzC,GAAJ,EAAS;AACPqC,UAAAA,GAAG,CAACK,WAAJ,CAAgB5D,KAAhB,GAAwBkB,GAAG,CAACM,OAA5B;AACD;;AACD,eAAOiC,KAAK,EAAZ;AACD,OAVD;;AAYA,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5ChF,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOyC,IAAI,EAAX;AACD,OAlB8E,CAoB/E;;;AACAkC,MAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AAEA,YAAM;AAAEE,QAAAA;AAAF,UAAoBP,GAAG,CAACQ,OAA9B;;AACA,UAAI1E,gBAAEC,KAAF,CAAQwE,aAAR,CAAJ,EAA4B;AAC1BlF,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOyC,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkByC,aAAlB,CAAL,EAAuC;AACrClF,QAAAA,KAAK,CAAC,kDAAD,CAAL;AACA,eAAOyC,IAAI,CAACP,iBAAWkD,aAAX,CAAyBlC,gBAAUmC,eAAnC,CAAD,CAAX;AACD;;AACD,YAAM;AAAE9E,QAAAA,MAAF;AAAU+E,QAAAA;AAAV,UAAuB,KAAKnF,MAAlC;;AAEA,UAAI,yBAAYmF,QAAZ,CAAJ,EAA2B;AACzBtF,QAAAA,KAAK,CAAC,wCAAD,CAAL;;AACA,aAAKuF,oBAAL,CAA0BZ,GAA1B,EAA+BW,QAA/B,EAAyC/E,MAAzC,EAAiD2E,aAAjD,EAAgEzC,IAAhE;AACD,OAHD,MAGO;AACLzC,QAAAA,KAAK,CAAC,qCAAD,CAAL;;AACA,aAAKwF,uBAAL,CAA6Bb,GAA7B,EAAkCW,QAAlC,EAA4C/E,MAA5C,EAAoD2E,aAApD,EAAmEzC,IAAnE;AACD;AACF,KA1CD;AA2CD;;AAEO+C,EAAAA,uBAAuB,CAC7Bb,GAD6B,EAE7BW,QAF6B,EAG7B/E,MAH6B,EAI7B2E,aAJ6B,EAK7BzC,IAL6B,EAMvB;AACNzC,IAAAA,KAAK,CAAC,2BAAD,CAAL;AACA,UAAM;AAAEyF,MAAAA,MAAF;AAAUC,MAAAA;AAAV,QAAoB,kCAAqBR,aAArB,CAA1B;;AACA,QAAIO,MAAM,CAACE,WAAP,OAAyBC,kBAAYD,WAAZ,EAA7B,EAAwD;AACtD3F,MAAAA,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;AACA,YAAM6F,WAAW,GAAG,oCAAuBH,KAAvB,EAA8BI,QAA9B,EAApB;AACA,YAAM;AAAEzC,QAAAA,IAAF;AAAQzB,QAAAA;AAAR,UAAqB,8BAAkBiE,WAAlB,CAA3B;AACA7F,MAAAA,KAAK,CAAC,mBAAD,EAAsBqD,IAAtB,CAAL;AACA,WAAK/B,YAAL,CAAkB+B,IAAlB,EAAwBzB,QAAxB,EAAkC,CAACU,GAAD,EAAMe,IAAN,KAAqB;AACrD,YAAI,CAACf,GAAL,EAAU;AACRtC,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACA2E,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACAZ,UAAAA,IAAI;AACL,SAJD,MAIO;AACLzC,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACA2E,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAvC,UAAAA,IAAI,CAACH,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAjBD,MAiBO;AACLtC,MAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,YAAM6F,WAAgB,GAAG,sCAAyBP,QAAzB,EAAmC/E,MAAnC,EAA2C2E,aAA3C,CAAzB;;AACA,UAAIW,WAAJ,EAAiB;AACf;AACAlB,QAAAA,GAAG,CAACK,WAAJ,GAAkBa,WAAlB;AACA7F,QAAAA,KAAK,CAAC,0BAAD,CAAL;AACAyC,QAAAA,IAAI;AACL,OALD,MAKO;AACL;AACAzC,QAAAA,KAAK,CAAC,mBAAD,CAAL;AACAyC,QAAAA,IAAI,CAACP,iBAAW6D,YAAX,CAAwB7C,gBAAU8C,qBAAlC,CAAD,CAAJ;AACD;AACF;AACF;;AAEOT,EAAAA,oBAAoB,CAC1BZ,GAD0B,EAE1BW,QAF0B,EAG1B/E,MAH0B,EAI1B2E,aAJ0B,EAK1BzC,IAL0B,EAMpB;AACNzC,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACAA,IAAAA,KAAK,CAAC,0BAAD,EAA6BO,MAA7B,CAAL;AACAP,IAAAA,KAAK,CAAC,iCAAD,EAAoCkF,aAApC,CAAL;AACA,UAAMW,WAAgB,GAAG,sCAAyBP,QAAzB,EAAmC/E,MAAnC,EAA2C2E,aAA3C,CAAzB;AACAlF,IAAAA,KAAK,CAAC,+BAAD,EAAkC6F,WAAlC,CAAL;;AACA,QAAIA,WAAJ,EAAiB;AACf,YAAM;AAAExC,QAAAA,IAAF;AAAQzB,QAAAA;AAAR,UAAqBiE,WAA3B;AACA7F,MAAAA,KAAK,CAAC,mBAAD,EAAsBqD,IAAtB,CAAL;AACA,WAAK/B,YAAL,CAAkB+B,IAAlB,EAAwBzB,QAAxB,EAAkC,CAACU,GAAD,EAAMe,IAAN,KAAqB;AACrD,YAAI,CAACf,GAAL,EAAU;AACRqC,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACArD,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAyC,UAAAA,IAAI;AACL,SAJD,MAIO;AACLkC,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAhF,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAyC,UAAAA,IAAI,CAACH,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAdD,MAcO;AACL;AACAtC,MAAAA,KAAK,CAAC,uBAAD,CAAL;AACA,aAAOyC,IAAI,CAACP,iBAAWkD,aAAX,CAAyBlC,gBAAUmC,eAAnC,CAAD,CAAX;AACD;AACF;;AAEOJ,EAAAA,kBAAkB,CAACD,WAAD,EAAmC;AAC3D,WAAOvE,gBAAEwF,WAAF,CAAcjB,WAAd,MAA+B,KAA/B,IAAwCvE,gBAAEwF,WAAF,CAAcjB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;AACD;AAED;AACF;AACA;;;AACSoC,EAAAA,kBAAkB,GAAa;AACpC,WAAO,CAACvB,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/E,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5C,eAAOH,KAAK,EAAZ;AACD;;AAEDF,MAAAA,GAAG,CAACG,KAAJ;;AACA,YAAMrC,IAAI,GAAIH,GAAD,IAAsC;AACjDqC,QAAAA,GAAG,CAACI,MAAJ;;AACA,YAAIzC,GAAJ,EAAS;AACP;AACAsC,UAAAA,GAAG,CAACuB,MAAJ,CAAW7D,GAAG,CAAC8D,UAAf,EAA2BC,IAA3B,CAAgC/D,GAAG,CAACM,OAApC;AACD;;AAED,eAAOiC,KAAK,EAAZ;AACD,OARD;;AAUA,YAAM;AAAEK,QAAAA;AAAF,UAAoBP,GAAG,CAACQ,OAA9B;;AACA,UAAI1E,gBAAEC,KAAF,CAAQwE,aAAR,CAAJ,EAA4B;AAC1B,eAAOzC,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkByC,aAAlB,CAAL,EAAuC;AACrC,eAAOzC,IAAI,CAACP,iBAAWkD,aAAX,CAAyBlC,gBAAUmC,eAAnC,CAAD,CAAX;AACD;;AAED,YAAMK,KAAK,GAAG,CAACR,aAAa,IAAI,EAAlB,EAAsBoB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;AACA,UAAI,CAACb,KAAL,EAAY;AACV,eAAOjD,IAAI,EAAX;AACD;;AAED,UAAIoD,WAAJ;;AACA,UAAI;AACFA,QAAAA,WAAW,GAAG,8BAAiBH,KAAjB,EAAwB,KAAKvF,MAAL,CAAYI,MAApC,CAAd;AACD,OAFD,CAEE,OAAO+B,GAAP,EAAiB,CACjB;AACD;;AAED,UAAI,KAAK2C,kBAAL,CAAwBY,WAAxB,CAAJ,EAA0C;AACxC,cAAM;AAAE/B,UAAAA,IAAF;AAAQnB,UAAAA;AAAR,YAAmBkD,WAAzB,CADwC,CAExC;;AACAlB,QAAAA,GAAG,CAACK,WAAJ,GAAkB,8BAAiBlB,IAAjB,EAAuBnB,MAAvB,CAAlB;AACD,OAJD,MAIO;AACLgC,QAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACD;;AAEDvC,MAAAA,IAAI;AACL,KA9CD;AA+CD;;AAEsB,QAAV+D,UAAU,CAACnD,IAAD,EAAmBoD,WAAnB,EAAiE;AACtF,UAAM;AAAEC,MAAAA,WAAF;AAAe5C,MAAAA,IAAf;AAAqBnB,MAAAA;AAArB,QAAgCU,IAAtC;AACArD,IAAAA,KAAK,CAAC,gBAAD,EAAmB8D,IAAnB,CAAL;AACA,UAAM6C,mBAAmB,GAAGlG,gBAAEC,KAAF,CAAQgG,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;AACA,UAAME,aAAa,GAAGnG,gBAAEC,KAAF,CAAQiC,MAAR,IAAkB+D,WAAlB,GAAgC/D,MAAM,CAACkE,MAAP,CAAcF,mBAAd,CAAtD;AACA,UAAMG,OAAmB,GAAG;AAC1BJ,MAAAA,WAAW,EAAEC,mBADa;AAE1B7C,MAAAA,IAF0B;AAG1BnB,MAAAA,MAAM,EAAEiE;AAHkB,KAA5B;AAMA,UAAMlB,KAAa,GAAG,MAAM,2BAAYoB,OAAZ,EAAqB,KAAKvG,MAA1B,EAAkCkG,WAAlC,CAA5B;AAEA,WAAOf,KAAP;AACD;AAED;AACF;AACA;;;AACSqB,EAAAA,UAAU,CAACC,KAAD,EAA+B;AAC9C,WAAO,6BAAWA,KAAX,EAAkB,KAAKzG,MAAvB,CAAP;AACD;;AAzfyB","sourcesContent":["import _ from 'lodash';\nimport { NextFunction, Request, Response } from 'express';\nimport buildDebug from 'debug';\n\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport { loadPlugin } from '@verdaccio/loaders';\nimport { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';\n\nimport {\n  Config,\n  Logger,\n  Callback,\n  IPluginAuth,\n  RemoteUser,\n  JWTSignOptions,\n  Security,\n  AuthPluginPackage,\n  AllowAccess,\n  PackageAccess,\n  PluginOptions,\n} from '@verdaccio/types';\n\nimport { getMatchedPackagesSpec, isNil, isFunction } from '@verdaccio/utils';\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\n\nimport {\n  getMiddlewareCredentials,\n  getDefaultPlugins,\n  verifyJWTPayload,\n  parseAuthTokenHeader,\n  isAuthHeaderValid,\n  isAESLegacy,\n  convertPayloadToBase64,\n} from './utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\n/* eslint-disable @typescript-eslint/no-var-requires */\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n  config: T & Config;\n  authenticate(user: string, password: string, cb: Callback): void;\n  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n  config: Config;\n  logger: Logger;\n  secret: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  plugins: any[];\n  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n}\n\nclass Auth implements IAuth {\n  public config: Config;\n  public logger: Logger;\n  public secret: string;\n  public plugins: IPluginAuth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.logger = LoggerApi.logger.child({ sub: 'auth' });\n    this.secret = config.secret;\n\n    this.plugins =\n      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin(config: Config) {\n    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };\n    const pluginOptions: PluginOptions<{}> = {\n      config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(plugingConf, pluginOptions);\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private _loadPlugin(config: Config): IPluginAuth<Config>[] {\n    const pluginOptions = {\n      config,\n      logger: this.logger,\n    };\n\n    return loadPlugin<IPluginAuth<Config>>(\n      config,\n      config.auth,\n      pluginOptions,\n      (plugin: IPluginAuth<Config>): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        // @ts-ignore\n        return authenticate || allow_access || allow_publish;\n      }\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public authenticate(username: string, password: string, cb: Callback): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(user: string, password: string, cb: Callback): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n      let method = 'adduser';\n      if (isFunction(plugin[method]) === false) {\n        method = 'add_user';\n        self.logger.warn(\n          'the plugin method add_user in the auth plugin is deprecated and will' +\n            ' be removed in next major release, notify to the plugin author'\n        );\n      }\n\n      if (isFunction(plugin[method]) === false) {\n        next();\n      } else {\n        // p.add_user() execution\n        plugin[method](user, password, function (err, ok): void {\n          if (err) {\n            debug('the user  %o could not being added. Error: %o', user, err?.message);\n            return cb(err);\n          }\n          if (ok) {\n            debug('the user %o has been added', user);\n            return self.authenticate(user, password, cb);\n          }\n          next();\n        });\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAcces,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (isFunction(plugin?.allow_publish) === false) {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      // @ts-ignore\n      plugin.allow_publish(\n        user,\n        // @ts-ignore\n        pkg,\n        // @ts-ignore\n        (err: VerdaccioError, ok: boolean): void => {\n          if (_.isNil(err) === false && _.isError(err)) {\n            debug('forbidden publish for %o', packageName);\n            return callback(err);\n          }\n\n          if (ok) {\n            debug('allowed publish for %o', packageName);\n            return callback(null, ok);\n          }\n\n          debug('allow publish skip validation for %o', packageName);\n          next(); // cb(null, false) causes next plugin to roll\n        }\n      );\n    })();\n  }\n\n  public apiJWTmiddleware(): Function {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      req.pause();\n\n      const next = function (err: VerdaccioError | void): void {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      req.remote_user = createAnonymousRemoteUser();\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', secret);\n    debug('api middleware authorization %o', authorization);\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): Function {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials;\n        // $FlowFixMe\n        req.remote_user = createRemoteUser(name, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"file":"auth.js"}
+{"version":3,"sources":["../src/auth.ts"],"names":["LoggerApi","require","debug","Auth","constructor","config","logger","child","sub","secret","TypeError","plugins","_","isNil","auth","_loadPlugin","loadDefaultPlugin","_applyDefaultPlugins","plugingConf","file","pluginOptions","authPlugin","HTPasswd","error","plugin","authenticate","allow_access","allow_publish","push","changePassword","username","password","newPassword","cb","validPlugins","filter","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","length","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","createRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","getBadRequest","BAD_AUTH_HEADER","security","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","toUpperCase","TOKEN_BASIC","credentials","toString","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","aesEncrypt","value"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AAQA;;AAcA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,oBAAW,gBAAX,CAAd;;AAwCA,MAAMC,IAAN,CAA4B;AAMnBC,EAAAA,WAAW,CAACC,MAAD,EAAiB;AACjC,SAAKA,MAAL,GAAcA,MAAd;AACA,SAAKC,MAAL,GAAcN,SAAS,CAACM,MAAV,CAAiBC,KAAjB,CAAuB;AAAEC,MAAAA,GAAG,EAAE;AAAP,KAAvB,CAAd;AACA,SAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;;AACA,QAAI,CAAC,KAAKA,MAAV,EAAkB;AAChB,YAAM,IAAIC,SAAJ,CAAc,0DAAd,CAAN;AACD;;AAED,SAAKC,OAAL,GACEC,gBAAEC,KAAF,CAAQR,MAAR,aAAQA,MAAR,uBAAQA,MAAM,CAAES,IAAhB,MAA0B,KAA1B,GAAkC,KAAKC,WAAL,CAAiBV,MAAjB,CAAlC,GAA6D,KAAKW,iBAAL,CAAuBX,MAAvB,CAD/D;;AAEA,SAAKY,oBAAL;AACD;;AAEOD,EAAAA,iBAAiB,CAACX,MAAD,EAAiB;AACxC,UAAMa,WAA2B,GAAG,EAAE,GAAGb,MAAL;AAAac,MAAAA,IAAI,EAAE;AAAnB,KAApC;AACA,UAAMC,aAAgC,GAAG;AACvCf,MAAAA,MADuC;AAEvCC,MAAAA,MAAM,EAAE,KAAKA;AAF0B,KAAzC;AAIA,QAAIe,UAAJ;;AACA,QAAI;AACFA,MAAAA,UAAU,GAAG,IAAIC,2BAAJ,CAAaJ,WAAb,EAA0BE,aAA1B,CAAb;AACD,KAFD,CAEE,OAAOG,KAAP,EAAmB;AACnBrB,MAAAA,KAAK,CAAC,iDAAD,EAAoDqB,KAApD,CAAL;AACA,aAAO,EAAP;AACD;;AAED,WAAO,CAACF,UAAD,CAAP;AACD;;AAEON,EAAAA,WAAW,CAACV,MAAD,EAAwC;AACzD,UAAMe,aAAa,GAAG;AACpBf,MAAAA,MADoB;AAEpBC,MAAAA,MAAM,EAAE,KAAKA;AAFO,KAAtB;AAKA,WAAO,yBACLD,MADK,EAELA,MAAM,CAACS,IAFF,EAGLM,aAHK,EAIJI,MAAD,IAA0C;AACxC,YAAM;AAAEC,QAAAA,YAAF;AAAgBC,QAAAA,YAAhB;AAA8BC,QAAAA;AAA9B,UAAgDH,MAAtD,CADwC,CAGxC;;AACA,aAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;AACD,KATI,CAAP;AAWD;;AAEOV,EAAAA,oBAAoB,GAAS;AACnC;AACA,SAAKN,OAAL,CAAaiB,IAAb,CAAkB,+BAAkB,KAAKtB,MAAvB,CAAlB;AACD;;AAEMuB,EAAAA,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;AACN,UAAMC,YAAY,GAAGtB,gBAAEuB,MAAF,CAAS,KAAKxB,OAAd,EAAwBa,MAAD,IAAY,uBAAWA,MAAM,CAACK,cAAlB,CAAnC,CAArB;;AAEA,QAAIjB,gBAAEwB,OAAF,CAAUF,YAAV,CAAJ,EAA6B;AAC3B,aAAOD,EAAE,CAACI,iBAAWC,gBAAX,CAA4BC,qBAAeC,wBAA3C,CAAD,CAAT;AACD;;AAED,SAAK,MAAMhB,MAAX,IAAqBU,YAArB,EAAmC;AACjC,UAAI,kBAAMV,MAAN,KAAiB,uBAAWA,MAAM,CAACK,cAAlB,MAAsC,KAA3D,EAAkE;AAChE3B,QAAAA,KAAK,CAAC,gEAAD,CAAL;AACA;AACD,OAHD,MAGO;AACLA,QAAAA,KAAK,CAAC,0BAAD,EAA6B4B,QAA7B,CAAL;AACAN,QAAAA,MAAM,CAACK,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACS,GAAD,EAAMC,OAAN,KAAwB;AAC9E,cAAID,GAAJ,EAAS;AACP,iBAAKnC,MAAL,CAAYiB,KAAZ,CACE;AAAEO,cAAAA,QAAF;AAAYW,cAAAA;AAAZ,aADF,EAEG;AACf,yEAHY;AAKA,mBAAOR,EAAE,CAACQ,GAAD,CAAT;AACD;;AAEDvC,UAAAA,KAAK,CAAC,wCAAD,EAA2C4B,QAA3C,CAAL;AACA,iBAAOG,EAAE,CAAC,IAAD,EAAOS,OAAP,CAAT;AACD,SAZD;AAaD;AACF;AACF;;AAE2B,QAAfC,eAAe,CAACC,KAAD,EAAgB;AAC1C;AACAC,IAAAA,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;AACA,WAAOG,OAAO,CAACC,OAAR,EAAP;AACD;;AAEMvB,EAAAA,YAAY,CAACK,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;AAC1E,UAAMtB,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;;AACA,KAAC,SAASC,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;;AAEA,UAAI,uBAAW3B,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;AAC7C,eAAOyB,IAAI,EAAX;AACD;;AAEDhD,MAAAA,KAAK,CAAC,mBAAD,EAAsB4B,QAAtB,CAAL;AACAN,MAAAA,MAAM,CAACC,YAAP,CAAoBK,QAApB,EAA8BC,QAA9B,EAAwC,UAAUU,GAAV,EAAeW,MAAf,EAA6B;AACnE,YAAIX,GAAJ,EAAS;AACPvC,UAAAA,KAAK,CAAC,8CAAD,EAAiD4B,QAAjD,EAA2DW,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;AACA,iBAAOpB,EAAE,CAACQ,GAAD,CAAT;AACD,SAJkE,CAMnE;AACA;AACA;AACA;AACA;AACA;AACA;;;AACA,YAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAACE,MAAP,KAAkB,CAAlC,EAAqC;AACnC;AACA,cAAI1C,gBAAE2C,QAAF,CAAWH,MAAX,CAAJ,EAAwB;AACtB,kBAAM,IAAI1C,SAAJ,CAAc,+CAAd,CAAN;AACD;;AACD,gBAAM8C,YAAqB,GAAG5C,gBAAE6C,OAAF,CAAUL,MAAV,CAA9B;;AACA,cAAI,CAACI,YAAL,EAAmB;AACjB,kBAAM,IAAI9C,SAAJ,CAAcgD,gBAAUC,qBAAxB,CAAN;AACD;;AAEDzD,UAAAA,KAAK,CAAC,yDAAD,EAA4D4B,QAA5D,EAAsEsB,MAAtE,CAAL;AACA,iBAAOnB,EAAE,CAACQ,GAAD,EAAM,8BAAiBX,QAAjB,EAA2BsB,MAA3B,CAAN,CAAT;AACD;;AACDF,QAAAA,IAAI;AACL,OA3BD;AA4BD,KApCD;AAqCD;;AAEMU,EAAAA,QAAQ,CAACC,IAAD,EAAe9B,QAAf,EAAiCE,EAAjC,EAAqD;AAClE,UAAM6B,IAAI,GAAG,IAAb;AACA,UAAMnD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA/C,IAAAA,KAAK,CAAC,aAAD,EAAgB2D,IAAhB,CAAL;;AAEA,KAAC,SAASX,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;AACA,UAAIY,MAAM,GAAG,SAAb;;AACA,UAAI,uBAAWvC,MAAM,CAACuC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCA,QAAAA,MAAM,GAAG,UAAT;AACAD,QAAAA,IAAI,CAACxD,MAAL,CAAY0D,IAAZ,CACE,yEACE,gEAFJ;AAID;;AAED,UAAI,uBAAWxC,MAAM,CAACuC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCb,QAAAA,IAAI;AACL,OAFD,MAEO;AACL;AACA1B,QAAAA,MAAM,CAACuC,MAAD,CAAN,CAAeF,IAAf,EAAqB9B,QAArB,EAA+B,UAAUU,GAAV,EAAewB,EAAf,EAAyB;AACtD,cAAIxB,GAAJ,EAAS;AACPvC,YAAAA,KAAK,CAAC,+CAAD,EAAkD2D,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;AACA,mBAAOpB,EAAE,CAACQ,GAAD,CAAT;AACD;;AACD,cAAIwB,EAAJ,EAAQ;AACN/D,YAAAA,KAAK,CAAC,4BAAD,EAA+B2D,IAA/B,CAAL;AACA,mBAAOC,IAAI,CAACrC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkCE,EAAlC,CAAP;AACD;;AACDiB,UAAAA,IAAI;AACL,SAVD;AAWD;AACF,KA3BD;AA4BD;AAED;AACF;AACA;;;AACSxB,EAAAA,YAAY,CACjB;AAAEwC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;AACN,UAAMzD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMoB,aAA0B,GAAG;AAAEC,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KAAnC;AACA,UAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,mCAAuBH,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAHU,CAAZ;AAKAzE,IAAAA,KAAK,CAAC,qBAAD,EAAwBgE,WAAxB,CAAL;;AAEA,KAAC,SAAShB,IAAT,GAAsB;AACrB,YAAM1B,MAA2B,GAAGb,OAAO,CAACwC,KAAR,EAApC;;AAEA,UAAIvC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;AAChE,eAAOwB,IAAI,EAAX;AACD;;AAED1B,MAAAA,MAAM,CAACE,YAAP,CAAqBmC,IAArB,EAA2BW,GAA3B,EAAgC,UAAU/B,GAAV,EAAewB,EAAf,EAAkC;AAChE,YAAIxB,GAAJ,EAAS;AACPvC,UAAAA,KAAK,CAAC,oCAAD,EAAuCgE,WAAvC,EAAoDzB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;AACA,iBAAOe,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,YAAIwB,EAAJ,EAAQ;AACN/D,UAAAA,KAAK,CAAC,uBAAD,EAA0BgE,WAA1B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAEDf,QAAAA,IAAI,GAX4D,CAWxD;AACT,OAZD;AAaD,KApBD;AAqBD;;AAEM0B,EAAAA,eAAe,CACpB;AAAEV,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;AACN,UAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAFU,CAAZ;AAIAzE,IAAAA,KAAK,CAAC,wBAAD,EAA2BgE,WAA3B,CAAL;;AAEA,SAAK,MAAM1C,MAAX,IAAqB,KAAKb,OAA1B,EAAmC;AACjC,UAAIC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACoD,eAAlB,MAAuC,KAA9D,EAAqE;AACnE1E,QAAAA,KAAK,CAAC,kEAAD,EAAqEgE,WAArE,CAAL;AACA;AACD,OAHD,MAGO;AACL;AACA1C,QAAAA,MAAM,CAACoD,eAAP,CAAwBf,IAAxB,EAA8BW,GAA9B,EAAmC,CAAC/B,GAAD,EAAMwB,EAAN,KAA4B;AAC7D,cAAIxB,GAAJ,EAAS;AACPvC,YAAAA,KAAK,CACH,qEADG,EAEHgE,WAFG,CAAL;AAIA,mBAAOE,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,cAAI7B,gBAAEC,KAAF,CAAQoD,EAAR,MAAgB,IAApB,EAA0B;AACxB/D,YAAAA,KAAK,CAAC,yDAAD,EAA4DgE,WAA5D,CAAL,CADwB,CAExB;AACA;;AACA,mBAAO,KAAKvC,aAAL,CAAmB,GAAGkD,SAAtB,CAAP;AACD;;AAED,cAAIZ,EAAJ,EAAQ;AACN/D,YAAAA,KAAK,CAAC,0BAAD,EAA6BgE,WAA7B,CAAL;AACA,mBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;AACF,SApBD;AAqBD;AACF;AACF;AAED;AACF;AACA;;;AACStC,EAAAA,aAAa,CAClB;AAAEuC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;AACN,UAAMzD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMuB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAFU,CAAZ;AAIAzE,IAAAA,KAAK,CAAC,yCAAD,EAA4CgE,WAA5C,EAAyDvD,OAAO,CAAC2C,MAAjE,CAAL;;AAEA,KAAC,SAASJ,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;;AAEA,UAAI,uBAAW3B,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;AAC/CzB,QAAAA,KAAK,CAAC,8DAAD,EAAiEgE,WAAjE,CAAL;AACA,eAAOhB,IAAI,EAAX;AACD,OANoB,CAQrB;;;AACA1B,MAAAA,MAAM,CAACG,aAAP,CACEkC,IADF,EAEE;AACAW,MAAAA,GAHF,EAIE;AACA,OAAC/B,GAAD,EAAsBwB,EAAtB,KAA4C;AAC1C,YAAIrD,gBAAEC,KAAF,CAAQ4B,GAAR,MAAiB,KAAjB,IAA0B7B,gBAAEkE,OAAF,CAAUrC,GAAV,CAA9B,EAA8C;AAC5CvC,UAAAA,KAAK,CAAC,0BAAD,EAA6BgE,WAA7B,CAAL;AACA,iBAAOE,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,YAAIwB,EAAJ,EAAQ;AACN/D,UAAAA,KAAK,CAAC,wBAAD,EAA2BgE,WAA3B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAED/D,QAAAA,KAAK,CAAC,sCAAD,EAAyCgE,WAAzC,CAAL;AACAhB,QAAAA,IAAI,GAZsC,CAYlC;AACT,OAlBH;AAoBD,KA7BD;AA8BD;;AAEM6B,EAAAA,gBAAgB,GAAa;AAClC7E,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,UAAMS,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAM+B,OAAO,GAAG;AAAEC,MAAAA,yBAAyB,EAAzBA,iCAAF;AAA6BC,MAAAA,gBAAgB,EAAhBA;AAA7B,KAAhB;;AACA,SAAK,MAAM1D,MAAX,IAAqBb,OAArB,EAA8B;AAC5B,UAAIa,MAAM,CAACuD,gBAAX,EAA6B;AAC3B,eAAOvD,MAAM,CAACuD,gBAAP,CAAwBC,OAAxB,CAAP;AACD;AACF;;AAED,WAAO,CAACG,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/EF,MAAAA,GAAG,CAACG,KAAJ;;AAEA,YAAMpC,IAAI,GAAG,UAAUT,GAAV,EAA4C;AACvD0C,QAAAA,GAAG,CAACI,MAAJ,GADuD,CAEvD;AACA;AACA;AACA;;AACA,YAAI9C,GAAJ,EAAS;AACP0C,UAAAA,GAAG,CAACK,WAAJ,CAAgBjE,KAAhB,GAAwBkB,GAAG,CAACY,OAA5B;AACD;;AACD,eAAOgC,KAAK,EAAZ;AACD,OAVD;;AAYA,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5CtF,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOgD,IAAI,EAAX;AACD,OAlB8E,CAoB/E;;;AACA,YAAMwC,UAAU,GAAG,wCAAnB;AACAP,MAAAA,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;AACAN,MAAAA,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;AAEA,YAAM;AAAEE,QAAAA;AAAF,UAAoBT,GAAG,CAACU,OAA9B;;AACA,UAAIjF,gBAAEC,KAAF,CAAQ+E,aAAR,CAAJ,EAA4B;AAC1B1F,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOgD,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkB0C,aAAlB,CAAL,EAAuC;AACrC1F,QAAAA,KAAK,CAAC,kDAAD,CAAL;AACA,eAAOgD,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;;AACD,YAAM;AAAEtF,QAAAA,MAAF;AAAUuF,QAAAA;AAAV,UAAuB,KAAK3F,MAAlC;;AAEA,UAAI,yBAAY2F,QAAZ,CAAJ,EAA2B;AACzB9F,QAAAA,KAAK,CAAC,wCAAD,CAAL;;AACA,aAAK+F,oBAAL,CAA0Bd,GAA1B,EAA+Ba,QAA/B,EAAyCvF,MAAzC,EAAiDmF,aAAjD,EAAgE1C,IAAhE;AACD,OAHD,MAGO;AACLhD,QAAAA,KAAK,CAAC,qCAAD,CAAL;;AACA,aAAKgG,uBAAL,CAA6Bf,GAA7B,EAAkCa,QAAlC,EAA4CvF,MAA5C,EAAoDmF,aAApD,EAAmE1C,IAAnE;AACD;AACF,KA5CD;AA6CD;;AAEOgD,EAAAA,uBAAuB,CAC7Bf,GAD6B,EAE7Ba,QAF6B,EAG7BvF,MAH6B,EAI7BmF,aAJ6B,EAK7B1C,IAL6B,EAMvB;AACNhD,IAAAA,KAAK,CAAC,2BAAD,CAAL;AACA,UAAM;AAAEiG,MAAAA,MAAF;AAAUvD,MAAAA;AAAV,QAAoB,kCAAqBgD,aAArB,CAA1B;;AACA,QAAIO,MAAM,CAACC,WAAP,OAAyBC,kBAAYD,WAAZ,EAA7B,EAAwD;AACtDlG,MAAAA,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;AACA,YAAMoG,WAAW,GAAG,oCAAuB1D,KAAvB,EAA8B2D,QAA9B,EAApB;AACA,YAAM;AAAE1C,QAAAA,IAAF;AAAQ9B,QAAAA;AAAR,UAAqB,8BAAkBuE,WAAlB,CAA3B;AACApG,MAAAA,KAAK,CAAC,mBAAD,EAAsB2D,IAAtB,CAAL;AACA,WAAKpC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkC,CAACU,GAAD,EAAMoB,IAAN,KAAqB;AACrD,YAAI,CAACpB,GAAL,EAAU;AACRvC,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAiF,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACAX,UAAAA,IAAI;AACL,SAJD,MAIO;AACLhD,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAiF,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAtC,UAAAA,IAAI,CAACT,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAjBD,MAiBO;AACLvC,MAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,YAAMoG,WAAgB,GAAG,sCAAyBN,QAAzB,EAAmCvF,MAAnC,EAA2CmF,aAA3C,CAAzB;;AACA,UAAIU,WAAJ,EAAiB;AACf;AACAnB,QAAAA,GAAG,CAACK,WAAJ,GAAkBc,WAAlB;AACApG,QAAAA,KAAK,CAAC,0BAAD,CAAL;AACAgD,QAAAA,IAAI;AACL,OALD,MAKO;AACL;AACAhD,QAAAA,KAAK,CAAC,mBAAD,CAAL;AACAgD,QAAAA,IAAI,CAACb,iBAAWmE,YAAX,CAAwB9C,gBAAU+C,qBAAlC,CAAD,CAAJ;AACD;AACF;AACF;;AAEOR,EAAAA,oBAAoB,CAC1Bd,GAD0B,EAE1Ba,QAF0B,EAG1BvF,MAH0B,EAI1BmF,aAJ0B,EAK1B1C,IAL0B,EAMpB;AACNhD,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACAA,IAAAA,KAAK,CAAC,0BAAD,EAA6BO,MAA7B,CAAL;AACAP,IAAAA,KAAK,CAAC,iCAAD,EAAoC0F,aAApC,CAAL;AACA,UAAMU,WAAgB,GAAG,sCAAyBN,QAAzB,EAAmCvF,MAAnC,EAA2CmF,aAA3C,CAAzB;AACA1F,IAAAA,KAAK,CAAC,+BAAD,EAAkCoG,WAAlC,CAAL;;AACA,QAAIA,WAAJ,EAAiB;AACf,YAAM;AAAEzC,QAAAA,IAAF;AAAQ9B,QAAAA;AAAR,UAAqBuE,WAA3B;AACApG,MAAAA,KAAK,CAAC,mBAAD,EAAsB2D,IAAtB,CAAL;AACA,WAAKpC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkC,CAACU,GAAD,EAAMoB,IAAN,KAAqB;AACrD,YAAI,CAACpB,GAAL,EAAU;AACR0C,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACA3D,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAgD,UAAAA,IAAI;AACL,SAJD,MAIO;AACLiC,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAtF,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAgD,UAAAA,IAAI,CAACT,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAdD,MAcO;AACL;AACAvC,MAAAA,KAAK,CAAC,uBAAD,CAAL;AACA,aAAOgD,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;AACF;;AAEON,EAAAA,kBAAkB,CAACD,WAAD,EAAmC;AAC3D,WAAO5E,gBAAE8F,WAAF,CAAclB,WAAd,MAA+B,KAA/B,IAAwC5E,gBAAE8F,WAAF,CAAclB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;AACD;AAED;AACF;AACA;;;AACSqC,EAAAA,kBAAkB,GAAa;AACpC,WAAO,CAACxB,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/E,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5C,eAAOH,KAAK,EAAZ;AACD;;AAEDF,MAAAA,GAAG,CAACG,KAAJ;;AACA,YAAMpC,IAAI,GAAIT,GAAD,IAAsC;AACjD0C,QAAAA,GAAG,CAACI,MAAJ;;AACA,YAAI9C,GAAJ,EAAS;AACP;AACA2C,UAAAA,GAAG,CAACwB,MAAJ,CAAWnE,GAAG,CAACoE,UAAf,EAA2BC,IAA3B,CAAgCrE,GAAG,CAACY,OAApC;AACD;;AAED,eAAOgC,KAAK,EAAZ;AACD,OARD;;AAUA,YAAM;AAAEO,QAAAA;AAAF,UAAoBT,GAAG,CAACU,OAA9B;;AACA,UAAIjF,gBAAEC,KAAF,CAAQ+E,aAAR,CAAJ,EAA4B;AAC1B,eAAO1C,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkB0C,aAAlB,CAAL,EAAuC;AACrC,eAAO1C,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;;AAED,YAAMnD,KAAK,GAAG,CAACgD,aAAa,IAAI,EAAlB,EAAsBmB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;AACA,UAAI,CAACpE,KAAL,EAAY;AACV,eAAOM,IAAI,EAAX;AACD;;AAED,UAAIoD,WAAJ;;AACA,UAAI;AACFA,QAAAA,WAAW,GAAG,8BAAiB1D,KAAjB,EAAwB,KAAKvC,MAAL,CAAYI,MAApC,CAAd;AACD,OAFD,CAEE,OAAOgC,GAAP,EAAiB,CACjB;AACD;;AAED,UAAI,KAAKgD,kBAAL,CAAwBa,WAAxB,CAAJ,EAA0C;AACxC,cAAM;AAAEhC,UAAAA,IAAF;AAAQlB,UAAAA;AAAR,YAAmBkD,WAAzB,CADwC,CAExC;;AACAnB,QAAAA,GAAG,CAACK,WAAJ,GAAkB,8BAAiBlB,IAAjB,EAAuBlB,MAAvB,CAAlB;AACD,OAJD,MAIO;AACL+B,QAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACD;;AAEDtC,MAAAA,IAAI;AACL,KA9CD;AA+CD;;AAEsB,QAAV+D,UAAU,CAACpD,IAAD,EAAmBqD,WAAnB,EAAiE;AACtF,UAAM;AAAEC,MAAAA,WAAF;AAAe7C,MAAAA,IAAf;AAAqBlB,MAAAA;AAArB,QAAgCS,IAAtC;AACA3D,IAAAA,KAAK,CAAC,gBAAD,EAAmBoE,IAAnB,CAAL;AACA,UAAM8C,mBAAmB,GAAGxG,gBAAEC,KAAF,CAAQsG,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;AACA,UAAME,aAAa,GAAGzG,gBAAEC,KAAF,CAAQuC,MAAR,IAAkB+D,WAAlB,GAAgC/D,MAAM,CAACkE,MAAP,CAAcF,mBAAd,CAAtD;AACA,UAAMG,OAAmB,GAAG;AAC1BJ,MAAAA,WAAW,EAAEC,mBADa;AAE1B9C,MAAAA,IAF0B;AAG1BlB,MAAAA,MAAM,EAAEiE;AAHkB,KAA5B;AAMA,UAAMzE,KAAa,GAAG,MAAM,2BAAY2E,OAAZ,EAAqB,KAAK9G,MAA1B,EAAkCyG,WAAlC,CAA5B;AAEA,WAAOtE,KAAP;AACD;AAED;AACF;AACA;;;AACS4E,EAAAA,UAAU,CAACC,KAAD,EAA+B;AAC9C,WAAO,6BAAWA,KAAX,EAAkB,KAAKhH,MAAvB,CAAP;AACD;;AApgByB","sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport { loadPlugin } from '@verdaccio/loaders';\nimport {\n  AllowAccess,\n  AuthPluginPackage,\n  Callback,\n  Config,\n  IPluginAuth,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  PluginOptions,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\n/* eslint-disable @typescript-eslint/no-var-requires */\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n  config: T & Config;\n  authenticate(user: string, password: string, cb: Callback): void;\n  invalidateToken?(token: string): Promise<void>;\n  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n  config: Config;\n  logger: Logger;\n  secret: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  plugins: any[];\n  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  invalidateToken(token: string): Promise<void>;\n}\n\nclass Auth implements IAuth {\n  public config: Config;\n  public logger: Logger;\n  public secret: string;\n  public plugins: IPluginAuth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.logger = LoggerApi.logger.child({ sub: 'auth' });\n    this.secret = config.secret;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n\n    this.plugins =\n      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin(config: Config) {\n    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };\n    const pluginOptions: PluginOptions<{}> = {\n      config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(plugingConf, pluginOptions);\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private _loadPlugin(config: Config): IPluginAuth<Config>[] {\n    const pluginOptions = {\n      config,\n      logger: this.logger,\n    };\n\n    return loadPlugin<IPluginAuth<Config>>(\n      config,\n      config.auth,\n      pluginOptions,\n      (plugin: IPluginAuth<Config>): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        // @ts-ignore\n        return authenticate || allow_access || allow_publish;\n      }\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(username: string, password: string, cb: Callback): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(user: string, password: string, cb: Callback): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n      let method = 'adduser';\n      if (isFunction(plugin[method]) === false) {\n        method = 'add_user';\n        self.logger.warn(\n          'the plugin method add_user in the auth plugin is deprecated and will' +\n            ' be removed in next major release, notify to the plugin author'\n        );\n      }\n\n      if (isFunction(plugin[method]) === false) {\n        next();\n      } else {\n        // p.add_user() execution\n        plugin[method](user, password, function (err, ok): void {\n          if (err) {\n            debug('the user  %o could not being added. Error: %o', user, err?.message);\n            return cb(err);\n          }\n          if (ok) {\n            debug('the user %o has been added', user);\n            return self.authenticate(user, password, cb);\n          }\n          next();\n        });\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAcces,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (isFunction(plugin?.allow_publish) === false) {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      // @ts-ignore\n      plugin.allow_publish(\n        user,\n        // @ts-ignore\n        pkg,\n        // @ts-ignore\n        (err: VerdaccioError, ok: boolean): void => {\n          if (_.isNil(err) === false && _.isError(err)) {\n            debug('forbidden publish for %o', packageName);\n            return callback(err);\n          }\n\n          if (ok) {\n            debug('allowed publish for %o', packageName);\n            return callback(null, ok);\n          }\n\n          debug('allow publish skip validation for %o', packageName);\n          next(); // cb(null, false) causes next plugin to roll\n        }\n      );\n    })();\n  }\n\n  public apiJWTmiddleware(): Function {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      req.pause();\n\n      const next = function (err: VerdaccioError | void): void {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', secret);\n    debug('api middleware authorization %o', authorization);\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): Function {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials;\n        // $FlowFixMe\n        req.remote_user = createRemoteUser(name, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"file":"auth.js"}

package/build/index.js

@@ -21,16 +21,16 @@ Object.defineProperty(exports, "IAuth", {
     return _auth.IAuth;
   }
 });
-Object.defineProperty(exports, "TokenEncryption", {
+Object.defineProperty(exports, "IBasicAuth", {
   enumerable: true,
   get: function () {
-    return _auth.TokenEncryption;
+    return _auth.IBasicAuth;
   }
 });
-Object.defineProperty(exports, "IBasicAuth", {
+Object.defineProperty(exports, "TokenEncryption", {
   enumerable: true,
   get: function () {
-    return _auth.IBasicAuth;
+    return _auth.TokenEncryption;
   }
 });
 

package/build/jwt-token.js

@@ -6,17 +6,11 @@ Object.defineProperty(exports, "__esModule", {
 exports.signPayload = signPayload;
 exports.verifyPayload = verifyPayload;
 
-var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));
-
 var _debug = _interopRequireDefault(require("debug"));
 
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
-function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (Object.getOwnPropertySymbols) { var symbols = Object.getOwnPropertySymbols(object); if (enumerableOnly) { symbols = symbols.filter(function (sym) { return Object.getOwnPropertyDescriptor(object, sym).enumerable; }); } keys.push.apply(keys, symbols); } return keys; }
-
-function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(Object(source), true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
+var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));
 
-function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
 /**
@@ -30,10 +24,12 @@ const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
 async function signPayload(payload, secretOrPrivateKey, options = {}) {
   return new Promise(function (resolve, reject) {
     debug('sign jwt token');
-    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey, _objectSpread({
+    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey, {
       // 1 === 1ms (one millisecond)
-      notBefore: '1'
-    }, options), (error, token) => {
+      notBefore: '1',
+      // Make sure the time will not rollback :)
+      ...options
+    }, (error, token) => {
       debug('error on sign jwt token');
       return error ? reject(error) : resolve(token);
     });

package/build/jwt-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/jwt-token.ts"],"names":["debug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"mappings":";;;;;;;;AAAA;;AACA;;;;;;;;;;AAIA,MAAMA,KAAK,GAAG,oBAAW,0BAAX,CAAd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACO,eAAeC,WAAf,CACLC,OADK,EAELC,kBAFK,EAGLC,OAAuB,GAAG,EAHrB,EAIY;AACjB,SAAO,IAAIC,OAAJ,CAAY,UAAUC,OAAV,EAAmBC,MAAnB,EAA4C;AAC7DP,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,WAAOQ,sBAAIC,IAAJ,CACLP,OADK,EAELC,kBAFK;AAIH;AACAO,MAAAA,SAAS,EAAE;AALR,OAMAN,OANA,GAQL,CAACO,KAAD,EAAQC,KAAR,KAAkB;AAChBZ,MAAAA,KAAK,CAAC,yBAAD,CAAL;AACA,aAAOW,KAAK,GAAGJ,MAAM,CAACI,KAAD,CAAT,GAAmBL,OAAO,CAACM,KAAD,CAAtC;AACD,KAXI,CAAP;AAaD,GAfM,CAAP;AAgBD;;AAEM,SAASC,aAAT,CAAuBD,KAAvB,EAAsCT,kBAAtC,EAA8E;AACnFH,EAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,SAAOQ,sBAAIM,MAAJ,CAAWF,KAAX,EAAkBT,kBAAlB,CAAP;AACD","sourcesContent":["import jwt from 'jsonwebtoken';\nimport buildDebug from 'debug';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey);\n}\n"],"file":"jwt-token.js"}
+{"version":3,"sources":["../src/jwt-token.ts"],"names":["debug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"mappings":";;;;;;;;AAAA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,oBAAW,0BAAX,CAAd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACO,eAAeC,WAAf,CACLC,OADK,EAELC,kBAFK,EAGLC,OAAuB,GAAG,EAHrB,EAIY;AACjB,SAAO,IAAIC,OAAJ,CAAY,UAAUC,OAAV,EAAmBC,MAAnB,EAA4C;AAC7DP,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,WAAOQ,sBAAIC,IAAJ,CACLP,OADK,EAELC,kBAFK,EAGL;AACE;AACAO,MAAAA,SAAS,EAAE,GAFb;AAEkB;AAChB,SAAGN;AAHL,KAHK,EAQL,CAACO,KAAD,EAAQC,KAAR,KAAkB;AAChBZ,MAAAA,KAAK,CAAC,yBAAD,CAAL;AACA,aAAOW,KAAK,GAAGJ,MAAM,CAACI,KAAD,CAAT,GAAmBL,OAAO,CAACM,KAAD,CAAtC;AACD,KAXI,CAAP;AAaD,GAfM,CAAP;AAgBD;;AAEM,SAASC,aAAT,CAAuBD,KAAvB,EAAsCT,kBAAtC,EAA8E;AACnFH,EAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,SAAOQ,sBAAIM,MAAJ,CAAWF,KAAX,EAAkBT,kBAAlB,CAAP;AACD","sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey);\n}\n"],"file":"jwt-token.js"}

package/build/legacy-token.js

@@ -3,16 +3,16 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.aesEncrypt = aesEncrypt;
 exports.aesDecrypt = aesDecrypt;
+exports.aesEncrypt = aesEncrypt;
 exports.defaultAlgorithm = void 0;
 
 var _crypto = require("crypto");
 
-var _config = require("@verdaccio/config");
-
 var _debug = _interopRequireDefault(require("debug"));
 
+var _config = require("@verdaccio/config");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 const debug = (0, _debug.default)('verdaccio:auth:token:legacy');
@@ -61,7 +61,8 @@ function aesDecrypt(value, key) {
     const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
     const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key; // decipher the string
 
-    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV);
+    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV); // FIXME: fix type here should allow Buffer
+
     let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
     debug('token decrypted successfully');

package/build/legacy-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/legacy-token.ts"],"names":["debug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","decrypted","_"],"mappings":";;;;;;;;;AAAA;;AAOA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,aAAsC,GAAG,MAA/C;AACA,MAAMC,cAAuC,GAAG,KAAhD,C,CACA;;AACA,MAAMC,SAAS,GAAG,EAAlB,C,CACA;AACA;;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAR,CAAYK,+BAApD;;AAEO,SAASC,UAAT,CAAoBC,KAApB,EAAmCC,GAAnC,EAA+D;AACpE;AACA;AACAX,EAAAA,KAAK,CAAC,YAAD,EAAeU,KAAf,CAAL;AACAV,EAAAA,KAAK,CAAC,cAAD,EAAiBC,gBAAjB,CAAL;AACA,QAAMW,EAAE,GAAGC,MAAM,CAACC,IAAP,CAAY,yBAAYP,SAAZ,CAAZ,CAAX;AACA,QAAMQ,SAAS,GAAGP,+BAA+B,IAAIG,GAArD;AACA,QAAMK,UAAU,GAAG,CAAAD,SAAS,SAAT,IAAAA,SAAS,WAAT,YAAAA,SAAS,CAAEE,MAAX,MAAsBC,0BAAzC;AACAlB,EAAAA,KAAK,CAAC,sBAAD,EAAyBe,SAAzB,aAAyBA,SAAzB,uBAAyBA,SAAS,CAAEE,MAApC,CAAL;AACAjB,EAAAA,KAAK,CAAC,oBAAD,EAAuBgB,UAAvB,CAAL;;AACA,MAAI,CAACN,KAAD,IAAU,CAACK,SAAX,IAAwB,CAACC,UAA7B,EAAyC;AACvC;AACD;;AAED,QAAMG,MAAM,GAAG,4BAAelB,gBAAf,EAAiCc,SAAjC,EAA4CH,EAA5C,CAAf;AACA,MAAIQ,SAAS,GAAGD,MAAM,CAACE,MAAP,CAAcX,KAAd,EAAqBL,aAArB,EAAoCC,cAApC,CAAhB,CAfoE,CAgBpE;;AACAc,EAAAA,SAAS,IAAID,MAAM,CAACG,KAAP,CAAahB,cAAb,CAAb;AACA,QAAMiB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAH,CAAY,KAAZ,CAAmB,IAAGJ,SAAS,CAACI,QAAV,EAAqB,EAA5D;AACAxB,EAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,SAAOa,MAAM,CAACC,IAAP,CAAYS,KAAZ,EAAmBC,QAAnB,CAA4B,QAA5B,CAAP;AACD;;AAEM,SAASC,UAAT,CAAoBf,KAApB,EAAmCC,GAAnC,EAA+D;AACpE,MAAI;AACF,UAAMe,IAAI,GAAGb,MAAM,CAACC,IAAP,CAAYJ,KAAZ,EAAmB,QAAnB,CAAb;AACA,UAAMiB,SAAS,GAAGD,IAAI,CAACF,QAAL,GAAgBI,KAAhB,CAAsB,GAAtB,CAAlB,CAFE,CAIF;AACA;;AACA,UAAMC,EAAE,GAAGhB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACG,KAAV,EAAZ,EAA+BxB,cAA/B,CAAX,CANE,CAOF;;AACA,UAAMyB,aAAa,GAAGlB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACK,IAAV,CAAe,GAAf,CAAZ,EAAiC1B,cAAjC,CAAtB;AACA,UAAMS,SAAS,GAAGP,+BAA+B,IAAIG,GAArD,CATE,CAUF;;AACA,UAAMsB,QAAQ,GAAG,8BAAiBhC,gBAAjB,EAAmCc,SAAnC,EAA8Cc,EAA9C,CAAjB;AACA,QAAIK,SAAS,GAAGD,QAAQ,CAACZ,MAAT,CAAgBU,aAAhB,EAA+BzB,cAA/B,EAA+CD,aAA/C,CAAhB;AACA6B,IAAAA,SAAS,IAAID,QAAQ,CAACX,KAAT,CAAejB,aAAf,CAAb;AACAL,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,WAAOkC,SAAS,CAACV,QAAV,EAAP;AACD,GAhBD,CAgBE,OAAOW,CAAP,EAAe;AACf;AACD;AACF","sourcesContent":["import {\n  createCipheriv,\n  createDecipheriv,\n  HexBase64BinaryEncoding,\n  randomBytes,\n  Utf8AsciiBinaryEncoding,\n} from 'crypto';\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\nimport buildDebug from 'debug';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: Utf8AsciiBinaryEncoding = 'utf8';\nconst outputEncoding: HexBase64BinaryEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"file":"legacy-token.js"}
+{"version":3,"sources":["../src/legacy-token.ts"],"names":["debug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","decrypted","_"],"mappings":";;;;;;;;;AAAA;;AAOA;;AAEA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,aAAgC,GAAG,MAAzC;AACA,MAAMC,cAAoC,GAAG,KAA7C,C,CACA;;AACA,MAAMC,SAAS,GAAG,EAAlB,C,CACA;AACA;;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAR,CAAYK,+BAApD;;AAEO,SAASC,UAAT,CAAoBC,KAApB,EAAmCC,GAAnC,EAA+D;AACpE;AACA;AACAX,EAAAA,KAAK,CAAC,YAAD,EAAeU,KAAf,CAAL;AACAV,EAAAA,KAAK,CAAC,cAAD,EAAiBC,gBAAjB,CAAL;AACA,QAAMW,EAAE,GAAGC,MAAM,CAACC,IAAP,CAAY,yBAAYP,SAAZ,CAAZ,CAAX;AACA,QAAMQ,SAAS,GAAGP,+BAA+B,IAAIG,GAArD;AACA,QAAMK,UAAU,GAAG,CAAAD,SAAS,SAAT,IAAAA,SAAS,WAAT,YAAAA,SAAS,CAAEE,MAAX,MAAsBC,0BAAzC;AACAlB,EAAAA,KAAK,CAAC,sBAAD,EAAyBe,SAAzB,aAAyBA,SAAzB,uBAAyBA,SAAS,CAAEE,MAApC,CAAL;AACAjB,EAAAA,KAAK,CAAC,oBAAD,EAAuBgB,UAAvB,CAAL;;AACA,MAAI,CAACN,KAAD,IAAU,CAACK,SAAX,IAAwB,CAACC,UAA7B,EAAyC;AACvC;AACD;;AAED,QAAMG,MAAM,GAAG,4BAAelB,gBAAf,EAAiCc,SAAjC,EAA4CH,EAA5C,CAAf;AACA,MAAIQ,SAAS,GAAGD,MAAM,CAACE,MAAP,CAAcX,KAAd,EAAqBL,aAArB,EAAoCC,cAApC,CAAhB,CAfoE,CAgBpE;;AACAc,EAAAA,SAAS,IAAID,MAAM,CAACG,KAAP,CAAahB,cAAb,CAAb;AACA,QAAMiB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAH,CAAY,KAAZ,CAAmB,IAAGJ,SAAS,CAACI,QAAV,EAAqB,EAA5D;AACAxB,EAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,SAAOa,MAAM,CAACC,IAAP,CAAYS,KAAZ,EAAmBC,QAAnB,CAA4B,QAA5B,CAAP;AACD;;AAEM,SAASC,UAAT,CAAoBf,KAApB,EAAmCC,GAAnC,EAA+D;AACpE,MAAI;AACF,UAAMe,IAAI,GAAGb,MAAM,CAACC,IAAP,CAAYJ,KAAZ,EAAmB,QAAnB,CAAb;AACA,UAAMiB,SAAS,GAAGD,IAAI,CAACF,QAAL,GAAgBI,KAAhB,CAAsB,GAAtB,CAAlB,CAFE,CAIF;AACA;;AACA,UAAMC,EAAE,GAAGhB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACG,KAAV,EAAZ,EAA+BxB,cAA/B,CAAX,CANE,CAOF;;AACA,UAAMyB,aAAa,GAAGlB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACK,IAAV,CAAe,GAAf,CAAZ,EAAiC1B,cAAjC,CAAtB;AACA,UAAMS,SAAS,GAAGP,+BAA+B,IAAIG,GAArD,CATE,CAUF;;AACA,UAAMsB,QAAQ,GAAG,8BAAiBhC,gBAAjB,EAAmCc,SAAnC,EAA8Cc,EAA9C,CAAjB,CAXE,CAYF;;AACA,QAAIK,SAAS,GAAGD,QAAQ,CAACZ,MAAT,CAAgBU,aAAhB,EAAsCzB,cAAtC,EAAsDD,aAAtD,CAAhB;AACA6B,IAAAA,SAAS,IAAID,QAAQ,CAACX,KAAT,CAAejB,aAAf,CAAb;AACAL,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,WAAOkC,SAAS,CAACV,QAAV,EAAP;AACD,GAjBD,CAiBE,OAAOW,CAAP,EAAe;AACf;AACD;AACF","sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"file":"legacy-token.js"}

package/build/utils.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="node" />
-import { Config, IPluginAuth, RemoteUser, Security, AuthPackageAllow } from '@verdaccio/types';
 import { VerdaccioError } from '@verdaccio/core';
-import { TokenEncryption, AESPayload } from './auth';
+import { AuthPackageAllow, Config, IPluginAuth, RemoteUser, Security } from '@verdaccio/types';
+import { AESPayload, TokenEncryption } from './auth';
 export declare type BasicPayload = AESPayload | void;
 export declare type AuthMiddlewarePayload = RemoteUser | BasicPayload;
 export interface AuthTokenHeader {

package/build/utils.js

@@ -3,32 +3,32 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.parseAuthTokenHeader = parseAuthTokenHeader;
-exports.parseAESCredentials = parseAESCredentials;
-exports.getMiddlewareCredentials = getMiddlewareCredentials;
-exports.isAESLegacy = isAESLegacy;
-exports.getApiToken = getApiToken;
-exports.verifyJWTPayload = verifyJWTPayload;
-exports.isAuthHeaderValid = isAuthHeaderValid;
-exports.getDefaultPlugins = getDefaultPlugins;
 exports.allow_action = allow_action;
-exports.handleSpecialUnpublish = handleSpecialUnpublish;
 exports.buildUser = buildUser;
 exports.convertPayloadToBase64 = convertPayloadToBase64;
 exports.expireReasons = void 0;
-
-var _lodash = _interopRequireDefault(require("lodash"));
+exports.getApiToken = getApiToken;
+exports.getDefaultPlugins = getDefaultPlugins;
+exports.getMiddlewareCredentials = getMiddlewareCredentials;
+exports.handleSpecialUnpublish = handleSpecialUnpublish;
+exports.isAESLegacy = isAESLegacy;
+exports.isAuthHeaderValid = isAuthHeaderValid;
+exports.parseAESCredentials = parseAESCredentials;
+exports.parseAuthTokenHeader = parseAuthTokenHeader;
+exports.verifyJWTPayload = verifyJWTPayload;
 
 var _debug = _interopRequireDefault(require("debug"));
 
-var _core = require("@verdaccio/core");
+var _lodash = _interopRequireDefault(require("lodash"));
 
 var _config = require("@verdaccio/config");
 
-var _legacyToken = require("./legacy-token");
+var _core = require("@verdaccio/core");
 
 var _jwtToken = require("./jwt-token");
 
+var _legacyToken = require("./legacy-token");
+
 var _token = require("./token");
 
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/utils.ts"],"names":["debug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","error","includes","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","user","password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","String","Buffer","from"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AASA;;AASA;;AAEA;;AACA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,sBAAX,CAAd;;AAqBA;AACA;AACA;AACA;AACO,SAASC,oBAAT,CAA8BC,mBAA9B,EAA4E;AACjF,QAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAApB,CAA0B,GAA1B,CAAd;AACA,QAAM,CAACC,MAAD,EAASC,KAAT,IAAkBH,KAAxB;AAEA,SAAO;AAAEE,IAAAA,MAAF;AAAUC,IAAAA;AAAV,GAAP;AACD;;AAEM,SAASC,mBAAT,CAA6BL,mBAA7B,EAA0DM,MAA1D,EAA0E;AAC/ER,EAAAA,KAAK,CAAC,qBAAD,CAAL;AACA,QAAM;AAAEK,IAAAA,MAAF;AAAUC,IAAAA;AAAV,MAAoBL,oBAAoB,CAACC,mBAAD,CAA9C,CAF+E,CAI/E;AACA;;AACA,MAAIG,MAAM,CAACI,WAAP,OAAyBC,kBAAYD,WAAZ,EAA7B,EAAwD;AACtDT,IAAAA,KAAK,CAAC,qBAAD,CAAL;AACA,UAAMW,WAAW,GAAGC,sBAAsB,CAACN,KAAD,CAAtB,CAA8BO,QAA9B,EAApB;AAEA,WAAOF,WAAP;AACD,GALD,MAKO,IAAIN,MAAM,CAACI,WAAP,OAAyBK,mBAAaL,WAAb,EAA7B,EAAyD;AAC9DT,IAAAA,KAAK,CAAC,sBAAD,CAAL;AACA,UAAMW,WAAW,GAAG,6BAAWL,KAAX,EAAkBE,MAAlB,CAApB;AAEA,WAAOG,WAAP;AACD;AACF;;AAEM,SAASI,wBAAT,CACLC,QADK,EAELC,SAFK,EAGLf,mBAHK,EAIkB;AACvBF,EAAAA,KAAK,CAAC,0BAAD,CAAL,CADuB,CAEvB;;AACA,MAAIkB,WAAW,CAACF,QAAD,CAAf,EAA2B;AACzBhB,IAAAA,KAAK,CAAC,WAAD,CAAL;AACA,UAAMW,WAAW,GAAGJ,mBAAmB,CAACL,mBAAD,EAAsBe,SAAtB,CAAvC;;AACA,QAAI,CAACN,WAAL,EAAkB;AAChBX,MAAAA,KAAK,CAAC,iCAAD,CAAL;AACA;AACD;;AAED,UAAMmB,iBAAiB,GAAG,8BAAkBR,WAAlB,CAA1B;;AACA,QAAI,CAACQ,iBAAL,EAAwB;AACtBnB,MAAAA,KAAK,CAAC,+CAAD,CAAL;AACA;AACD;;AAED,WAAOmB,iBAAP;AACD;;AACD,QAAM;AAAEd,IAAAA,MAAF;AAAUC,IAAAA;AAAV,MAAoBL,oBAAoB,CAACC,mBAAD,CAA9C;AAEAF,EAAAA,KAAK,CAAC,QAAD,CAAL;;AACA,MAAIoB,gBAAEC,QAAF,CAAWf,KAAX,KAAqBD,MAAM,CAACI,WAAP,OAAyBK,mBAAaL,WAAb,EAAlD,EAA8E;AAC5E,WAAOa,gBAAgB,CAAChB,KAAD,EAAQW,SAAR,CAAvB;AACD;AACF;;AAEM,SAASC,WAAT,CAAqBF,QAArB,EAAkD;AACvD,QAAM;AAAEO,IAAAA,MAAF;AAAUC,IAAAA;AAAV,MAAkBR,QAAQ,CAACS,GAAjC;AAEA,SAAOL,gBAAEM,KAAF,CAAQH,MAAR,MAAoB,KAApB,IAA6BH,gBAAEM,KAAF,CAAQF,GAAR,CAA7B,IAA6CD,MAAM,KAAK,IAA/D;AACD;;AAEM,eAAeI,WAAf,CACLC,IADK,EAELC,MAFK,EAGLC,UAHK,EAILC,WAJK,EAKmB;AACxB/B,EAAAA,KAAK,CAAC,eAAD,CAAL;AACA,QAAM;AAAEgB,IAAAA;AAAF,MAAea,MAArB;;AAEA,MAAIX,WAAW,CAACF,QAAD,CAAf,EAA2B;AACzBhB,IAAAA,KAAK,CAAC,yBAAD,CAAL,CADyB,CAEzB;;AACA,WAAO,MAAM,IAAIgC,OAAJ,CAAaC,OAAD,IAAmB;AAC1CA,MAAAA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;AACD,KAFY,CAAb;AAGD;;AACD,QAAM;AAAEP,IAAAA;AAAF,MAAUR,QAAQ,CAACS,GAAzB;;AAEA,MAAID,GAAJ,aAAIA,GAAJ,eAAIA,GAAG,CAAEa,IAAT,EAAe;AACb,WAAO,MAAMT,IAAI,CAACU,UAAL,CAAgBR,UAAhB,EAA4BN,GAAG,CAACa,IAAhC,CAAb;AACD;;AACD,SAAO,MAAM,IAAIL,OAAJ,CAAaC,OAAD,IAAmB;AAC1CA,IAAAA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;AACD,GAFY,CAAb;AAGD;;AAEM,MAAMQ,aAAuB,GAAG,CAAC,mBAAD,EAAsB,mBAAtB,CAAhC;;;AAEA,SAASjB,gBAAT,CAA0BhB,KAA1B,EAAyCE,MAAzC,EAAqE;AAC1E,MAAI;AACF,UAAMgC,OAAmB,GAAG,6BAAclC,KAAd,EAAqBE,MAArB,CAA5B;AAEA,WAAOgC,OAAP;AACD,GAJD,CAIE,OAAOC,KAAP,EAAmB;AACnB;AACA,QAAIF,aAAa,CAACG,QAAd,CAAuBD,KAAK,CAACL,IAA7B,CAAJ,EAAwC;AACtC;AACA;AACA;AACA,aAAO,wCAAP;AACD;;AACD,UAAMO,iBAAWC,OAAX,CAAmBC,kBAAYC,YAA/B,EAA6CL,KAAK,CAACM,OAAnD,CAAN;AACD;AACF;;AAEM,SAASC,iBAAT,CAA2BC,aAA3B,EAA2D;AAChE,SAAOA,aAAa,CAAC7C,KAAd,CAAoB,GAApB,EAAyB8C,MAAzB,KAAoC,CAA3C;AACD;;AAEM,SAASC,iBAAT,CAA2BC,MAA3B,EAA6D;AAClE,SAAO;AACLC,IAAAA,YAAY,CAACC,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;AAC/DA,MAAAA,EAAE,CAACb,iBAAWc,YAAX,CAAwBC,gBAAUC,qBAAlC,CAAD,CAAF;AACD,KAHI;;AAKLC,IAAAA,OAAO,CAACN,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;AAC1D,aAAOA,EAAE,CAACb,iBAAWkB,WAAX,CAAuBH,gBAAUC,qBAAjC,CAAD,CAAT;AACD,KAPI;;AASL;AACA;AACAG,IAAAA,YAAY,EAAEC,YAAY,CAAC,QAAD,EAAWX,MAAX,CAXrB;AAYL;AACAY,IAAAA,aAAa,EAAED,YAAY,CAAC,SAAD,EAAYX,MAAZ,CAbtB;AAcLa,IAAAA,eAAe,EAAEC,sBAAsB,CAACd,MAAD;AAdlC,GAAP;AAgBD;;AAIM,SAASW,YAAT,CAAsBI,MAAtB,EAA8Cf,MAA9C,EAAmE;AACxE,SAAO,SAASgB,mBAAT,CACLd,IADK,EAELe,GAFK,EAGLC,QAHK,EAIC;AACNlB,IAAAA,MAAM,CAACmB,KAAP,CAAa;AAAEC,MAAAA,MAAM,EAAElB,IAAI,CAAClB;AAAf,KAAb,EAAqC,yCAArC;AACA,UAAM;AAAEA,MAAAA,IAAF;AAAQqC,MAAAA;AAAR,QAAmBnB,IAAzB;AACA,UAAMoB,WAAW,GAAGL,GAAG,CAACF,MAAD,CAAvB;AACA,UAAMQ,aAAa,GAAGD,WAAW,CAACE,IAAZ,CAAkBC,KAAD,IAAWzC,IAAI,KAAKyC,KAAT,IAAkBJ,MAAM,CAAC/B,QAAP,CAAgBmC,KAAhB,CAA9C,CAAtB;AACAzB,IAAAA,MAAM,CAACmB,KAAP,CACE;AAAEO,MAAAA,OAAO,EAAET,GAAG,CAACjC,IAAf;AAAqBuC,MAAAA,aAArB;AAAoCH,MAAAA,MAAM,EAAElB,IAAI,CAAClB,IAAjD;AAAuDsC,MAAAA;AAAvD,KADF,EAEG,wEAFH;;AAKA,QAAIC,aAAJ,EAAmB;AACjBvB,MAAAA,MAAM,CAACmB,KAAP,CAAa;AAAEC,QAAAA,MAAM,EAAElB,IAAI,CAAClB;AAAf,OAAb,EAAqC,+CAArC;AACA,aAAOkC,QAAQ,CAAC,IAAD,EAAO,IAAP,CAAf;AACD;;AAED,QAAIlC,IAAJ,EAAU;AACRkC,MAAAA,QAAQ,CACN3B,iBAAWc,YAAX,CAAyB,QAAOrB,IAAK,sBAAqB+B,MAAO,YAAWE,GAAG,CAACjC,IAAK,EAArF,CADM,CAAR;AAGD,KAJD,MAIO;AACLkC,MAAAA,QAAQ,CACN3B,iBAAWoC,eAAX,CAA4B,6BAA4BZ,MAAO,YAAWE,GAAG,CAACjC,IAAK,EAAnF,CADM,CAAR;AAGD;AACF,GA5BD;AA6BD;AAED;AACA;AACA;;;AACO,SAAS8B,sBAAT,CAAgCd,MAAhC,EAA6C;AAClD,SAAO,UAAUE,IAAV,EAA4Be,GAA5B,EAAmDC,QAAnD,EAAwF;AAC7F,UAAMH,MAAM,GAAG,WAAf,CAD6F,CAE7F;;AACA,UAAMa,kBAA2B,GAAG5D,gBAAEM,KAAF,CAAQ2C,GAAG,CAACF,MAAD,CAAX,CAApC;;AACA,UAAMc,SAAkB,GAAGD,kBAAkB,GAAG,KAAH,GAAYX,GAAG,CAACF,MAAD,CAAJ,CAA0BjB,MAA1B,GAAmC,CAA3F;AACAE,IAAAA,MAAM,CAACmB,KAAP,CACE;AAAEjB,MAAAA,IAAI,EAAEA,IAAI,CAAClB,IAAb;AAAmBA,MAAAA,IAAI,EAAEiC,GAAG,CAACjC,IAA7B;AAAmC6C,MAAAA;AAAnC,KADF,EAEG,qEAFH;;AAKA,QAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAxC,EAA+C;AAC7C,aAAOX,QAAQ,CAAC,IAAD,EAAOY,SAAP,CAAf;AACD;;AAED9B,IAAAA,MAAM,CAACmB,KAAP,CACE;AAAEjB,MAAAA,IAAI,EAAEA,IAAI,CAAClB,IAAb;AAAmBA,MAAAA,IAAI,EAAEiC,GAAG,CAACjC,IAA7B;AAAmC+B,MAAAA,MAAnC;AAA2Cc,MAAAA;AAA3C,KADF,EAEG,6EAFH;AAIA,WAAOlB,YAAY,CAACI,MAAD,EAASf,MAAT,CAAZ,CAA6BE,IAA7B,EAAmCe,GAAnC,EAAwCC,QAAxC,CAAP;AACD,GAnBD;AAoBD;;AAEM,SAASnC,SAAT,CAAmBC,IAAnB,EAAiCmB,QAAjC,EAA2D;AAChE,SAAO4B,MAAM,CAAE,GAAE/C,IAAK,IAAGmB,QAAS,EAArB,CAAb;AACD;;AAEM,SAAS3C,sBAAT,CAAgC4B,OAAhC,EAAyD;AAC9D,SAAO4C,MAAM,CAACC,IAAP,CAAY7C,OAAZ,EAAqB,QAArB,CAAP;AACD","sourcesContent":["import _ from 'lodash';\nimport buildDebug from 'debug';\nimport {\n  Callback,\n  Config,\n  IPluginAuth,\n  RemoteUser,\n  Security,\n  AuthPackageAllow,\n} from '@verdaccio/types';\nimport {\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  API_ERROR,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport { TokenEncryption, AESPayload } from './auth';\nimport { aesDecrypt } from './legacy-token';\nimport { verifyPayload } from './jwt-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\nexport function getDefaultPlugins(logger: any): IPluginAuth<Config> {\n  return {\n    authenticate(user: string, password: string, cb: Callback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(user: string, password: string, cb: Callback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{user.name}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{user}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{user}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"file":"utils.js"}
+{"version":3,"sources":["../src/utils.ts"],"names":["debug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","error","includes","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","user","password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","String","Buffer","from"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AACA;;AAkBA;;AACA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,sBAAX,CAAd;;AAqBA;AACA;AACA;AACA;AACO,SAASC,oBAAT,CAA8BC,mBAA9B,EAA4E;AACjF,QAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAApB,CAA0B,GAA1B,CAAd;AACA,QAAM,CAACC,MAAD,EAASC,KAAT,IAAkBH,KAAxB;AAEA,SAAO;AAAEE,IAAAA,MAAF;AAAUC,IAAAA;AAAV,GAAP;AACD;;AAEM,SAASC,mBAAT,CAA6BL,mBAA7B,EAA0DM,MAA1D,EAA0E;AAC/ER,EAAAA,KAAK,CAAC,qBAAD,CAAL;AACA,QAAM;AAAEK,IAAAA,MAAF;AAAUC,IAAAA;AAAV,MAAoBL,oBAAoB,CAACC,mBAAD,CAA9C,CAF+E,CAI/E;AACA;;AACA,MAAIG,MAAM,CAACI,WAAP,OAAyBC,kBAAYD,WAAZ,EAA7B,EAAwD;AACtDT,IAAAA,KAAK,CAAC,qBAAD,CAAL;AACA,UAAMW,WAAW,GAAGC,sBAAsB,CAACN,KAAD,CAAtB,CAA8BO,QAA9B,EAApB;AAEA,WAAOF,WAAP;AACD,GALD,MAKO,IAAIN,MAAM,CAACI,WAAP,OAAyBK,mBAAaL,WAAb,EAA7B,EAAyD;AAC9DT,IAAAA,KAAK,CAAC,sBAAD,CAAL;AACA,UAAMW,WAAW,GAAG,6BAAWL,KAAX,EAAkBE,MAAlB,CAApB;AAEA,WAAOG,WAAP;AACD;AACF;;AAEM,SAASI,wBAAT,CACLC,QADK,EAELC,SAFK,EAGLf,mBAHK,EAIkB;AACvBF,EAAAA,KAAK,CAAC,0BAAD,CAAL,CADuB,CAEvB;;AACA,MAAIkB,WAAW,CAACF,QAAD,CAAf,EAA2B;AACzBhB,IAAAA,KAAK,CAAC,WAAD,CAAL;AACA,UAAMW,WAAW,GAAGJ,mBAAmB,CAACL,mBAAD,EAAsBe,SAAtB,CAAvC;;AACA,QAAI,CAACN,WAAL,EAAkB;AAChBX,MAAAA,KAAK,CAAC,iCAAD,CAAL;AACA;AACD;;AAED,UAAMmB,iBAAiB,GAAG,8BAAkBR,WAAlB,CAA1B;;AACA,QAAI,CAACQ,iBAAL,EAAwB;AACtBnB,MAAAA,KAAK,CAAC,+CAAD,CAAL;AACA;AACD;;AAED,WAAOmB,iBAAP;AACD;;AACD,QAAM;AAAEd,IAAAA,MAAF;AAAUC,IAAAA;AAAV,MAAoBL,oBAAoB,CAACC,mBAAD,CAA9C;AAEAF,EAAAA,KAAK,CAAC,QAAD,CAAL;;AACA,MAAIoB,gBAAEC,QAAF,CAAWf,KAAX,KAAqBD,MAAM,CAACI,WAAP,OAAyBK,mBAAaL,WAAb,EAAlD,EAA8E;AAC5E,WAAOa,gBAAgB,CAAChB,KAAD,EAAQW,SAAR,CAAvB;AACD;AACF;;AAEM,SAASC,WAAT,CAAqBF,QAArB,EAAkD;AACvD,QAAM;AAAEO,IAAAA,MAAF;AAAUC,IAAAA;AAAV,MAAkBR,QAAQ,CAACS,GAAjC;AAEA,SAAOL,gBAAEM,KAAF,CAAQH,MAAR,MAAoB,KAApB,IAA6BH,gBAAEM,KAAF,CAAQF,GAAR,CAA7B,IAA6CD,MAAM,KAAK,IAA/D;AACD;;AAEM,eAAeI,WAAf,CACLC,IADK,EAELC,MAFK,EAGLC,UAHK,EAILC,WAJK,EAKmB;AACxB/B,EAAAA,KAAK,CAAC,eAAD,CAAL;AACA,QAAM;AAAEgB,IAAAA;AAAF,MAAea,MAArB;;AAEA,MAAIX,WAAW,CAACF,QAAD,CAAf,EAA2B;AACzBhB,IAAAA,KAAK,CAAC,yBAAD,CAAL,CADyB,CAEzB;;AACA,WAAO,MAAM,IAAIgC,OAAJ,CAAaC,OAAD,IAAmB;AAC1CA,MAAAA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;AACD,KAFY,CAAb;AAGD;;AACD,QAAM;AAAEP,IAAAA;AAAF,MAAUR,QAAQ,CAACS,GAAzB;;AAEA,MAAID,GAAJ,aAAIA,GAAJ,eAAIA,GAAG,CAAEa,IAAT,EAAe;AACb,WAAO,MAAMT,IAAI,CAACU,UAAL,CAAgBR,UAAhB,EAA4BN,GAAG,CAACa,IAAhC,CAAb;AACD;;AACD,SAAO,MAAM,IAAIL,OAAJ,CAAaC,OAAD,IAAmB;AAC1CA,IAAAA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;AACD,GAFY,CAAb;AAGD;;AAEM,MAAMQ,aAAuB,GAAG,CAAC,mBAAD,EAAsB,mBAAtB,CAAhC;;;AAEA,SAASjB,gBAAT,CAA0BhB,KAA1B,EAAyCE,MAAzC,EAAqE;AAC1E,MAAI;AACF,UAAMgC,OAAmB,GAAG,6BAAclC,KAAd,EAAqBE,MAArB,CAA5B;AAEA,WAAOgC,OAAP;AACD,GAJD,CAIE,OAAOC,KAAP,EAAmB;AACnB;AACA,QAAIF,aAAa,CAACG,QAAd,CAAuBD,KAAK,CAACL,IAA7B,CAAJ,EAAwC;AACtC;AACA;AACA;AACA,aAAO,wCAAP;AACD;;AACD,UAAMO,iBAAWC,OAAX,CAAmBC,kBAAYC,YAA/B,EAA6CL,KAAK,CAACM,OAAnD,CAAN;AACD;AACF;;AAEM,SAASC,iBAAT,CAA2BC,aAA3B,EAA2D;AAChE,SAAOA,aAAa,CAAC7C,KAAd,CAAoB,GAApB,EAAyB8C,MAAzB,KAAoC,CAA3C;AACD;;AAEM,SAASC,iBAAT,CAA2BC,MAA3B,EAA6D;AAClE,SAAO;AACLC,IAAAA,YAAY,CAACC,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;AAC/DA,MAAAA,EAAE,CAACb,iBAAWc,YAAX,CAAwBC,gBAAUC,qBAAlC,CAAD,CAAF;AACD,KAHI;;AAKLC,IAAAA,OAAO,CAACN,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;AAC1D,aAAOA,EAAE,CAACb,iBAAWkB,WAAX,CAAuBH,gBAAUC,qBAAjC,CAAD,CAAT;AACD,KAPI;;AASL;AACA;AACAG,IAAAA,YAAY,EAAEC,YAAY,CAAC,QAAD,EAAWX,MAAX,CAXrB;AAYL;AACAY,IAAAA,aAAa,EAAED,YAAY,CAAC,SAAD,EAAYX,MAAZ,CAbtB;AAcLa,IAAAA,eAAe,EAAEC,sBAAsB,CAACd,MAAD;AAdlC,GAAP;AAgBD;;AAIM,SAASW,YAAT,CAAsBI,MAAtB,EAA8Cf,MAA9C,EAAmE;AACxE,SAAO,SAASgB,mBAAT,CACLd,IADK,EAELe,GAFK,EAGLC,QAHK,EAIC;AACNlB,IAAAA,MAAM,CAACmB,KAAP,CAAa;AAAEC,MAAAA,MAAM,EAAElB,IAAI,CAAClB;AAAf,KAAb,EAAqC,yCAArC;AACA,UAAM;AAAEA,MAAAA,IAAF;AAAQqC,MAAAA;AAAR,QAAmBnB,IAAzB;AACA,UAAMoB,WAAW,GAAGL,GAAG,CAACF,MAAD,CAAvB;AACA,UAAMQ,aAAa,GAAGD,WAAW,CAACE,IAAZ,CAAkBC,KAAD,IAAWzC,IAAI,KAAKyC,KAAT,IAAkBJ,MAAM,CAAC/B,QAAP,CAAgBmC,KAAhB,CAA9C,CAAtB;AACAzB,IAAAA,MAAM,CAACmB,KAAP,CACE;AAAEO,MAAAA,OAAO,EAAET,GAAG,CAACjC,IAAf;AAAqBuC,MAAAA,aAArB;AAAoCH,MAAAA,MAAM,EAAElB,IAAI,CAAClB,IAAjD;AAAuDsC,MAAAA;AAAvD,KADF,EAEG,wEAFH;;AAKA,QAAIC,aAAJ,EAAmB;AACjBvB,MAAAA,MAAM,CAACmB,KAAP,CAAa;AAAEC,QAAAA,MAAM,EAAElB,IAAI,CAAClB;AAAf,OAAb,EAAqC,+CAArC;AACA,aAAOkC,QAAQ,CAAC,IAAD,EAAO,IAAP,CAAf;AACD;;AAED,QAAIlC,IAAJ,EAAU;AACRkC,MAAAA,QAAQ,CACN3B,iBAAWc,YAAX,CAAyB,QAAOrB,IAAK,sBAAqB+B,MAAO,YAAWE,GAAG,CAACjC,IAAK,EAArF,CADM,CAAR;AAGD,KAJD,MAIO;AACLkC,MAAAA,QAAQ,CACN3B,iBAAWoC,eAAX,CAA4B,6BAA4BZ,MAAO,YAAWE,GAAG,CAACjC,IAAK,EAAnF,CADM,CAAR;AAGD;AACF,GA5BD;AA6BD;AAED;AACA;AACA;;;AACO,SAAS8B,sBAAT,CAAgCd,MAAhC,EAA6C;AAClD,SAAO,UAAUE,IAAV,EAA4Be,GAA5B,EAAmDC,QAAnD,EAAwF;AAC7F,UAAMH,MAAM,GAAG,WAAf,CAD6F,CAE7F;;AACA,UAAMa,kBAA2B,GAAG5D,gBAAEM,KAAF,CAAQ2C,GAAG,CAACF,MAAD,CAAX,CAApC;;AACA,UAAMc,SAAkB,GAAGD,kBAAkB,GAAG,KAAH,GAAYX,GAAG,CAACF,MAAD,CAAJ,CAA0BjB,MAA1B,GAAmC,CAA3F;AACAE,IAAAA,MAAM,CAACmB,KAAP,CACE;AAAEjB,MAAAA,IAAI,EAAEA,IAAI,CAAClB,IAAb;AAAmBA,MAAAA,IAAI,EAAEiC,GAAG,CAACjC,IAA7B;AAAmC6C,MAAAA;AAAnC,KADF,EAEG,qEAFH;;AAKA,QAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAxC,EAA+C;AAC7C,aAAOX,QAAQ,CAAC,IAAD,EAAOY,SAAP,CAAf;AACD;;AAED9B,IAAAA,MAAM,CAACmB,KAAP,CACE;AAAEjB,MAAAA,IAAI,EAAEA,IAAI,CAAClB,IAAb;AAAmBA,MAAAA,IAAI,EAAEiC,GAAG,CAACjC,IAA7B;AAAmC+B,MAAAA,MAAnC;AAA2Cc,MAAAA;AAA3C,KADF,EAEG,6EAFH;AAIA,WAAOlB,YAAY,CAACI,MAAD,EAASf,MAAT,CAAZ,CAA6BE,IAA7B,EAAmCe,GAAnC,EAAwCC,QAAxC,CAAP;AACD,GAnBD;AAoBD;;AAEM,SAASnC,SAAT,CAAmBC,IAAnB,EAAiCmB,QAAjC,EAA2D;AAChE,SAAO4B,MAAM,CAAE,GAAE/C,IAAK,IAAGmB,QAAS,EAArB,CAAb;AACD;;AAEM,SAAS3C,sBAAT,CAAgC4B,OAAhC,EAAyD;AAC9D,SAAO4C,MAAM,CAACC,IAAP,CAAY7C,OAAZ,EAAqB,QAArB,CAAP;AACD","sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport {\n  AuthPackageAllow,\n  Callback,\n  Config,\n  IPluginAuth,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\nimport { verifyPayload } from './jwt-token';\nimport { aesDecrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\nexport function getDefaultPlugins(logger: any): IPluginAuth<Config> {\n  return {\n    authenticate(user: string, password: string, cb: Callback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(user: string, password: string, cb: Callback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{user.name}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{user}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{user}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"file":"utils.js"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@verdaccio/auth",
-	"version": "6.0.0-6-next.13",
+	"version": "6.0.0-6-next.17",
 	"description": "logger",
 	"main": "./build/index.js",
 	"types": "build/index.d.ts",
@@ -30,20 +30,20 @@
 	},
 	"license": "MIT",
 	"dependencies": {
-		"@verdaccio/core": "6.0.0-6-next.2",
-		"@verdaccio/config": "6.0.0-6-next.9",
-		"@verdaccio/loaders": "6.0.0-6-next.6",
-		"@verdaccio/logger": "6.0.0-6-next.6",
-		"@verdaccio/utils": "6.0.0-6-next.7",
-		"debug": "4.3.2",
-		"express": "4.17.1",
+		"@verdaccio/core": "6.0.0-6-next.4",
+		"@verdaccio/config": "6.0.0-6-next.12",
+		"@verdaccio/loaders": "6.0.0-6-next.9",
+		"@verdaccio/logger": "6.0.0-6-next.9",
+		"@verdaccio/utils": "6.0.0-6-next.10",
+		"debug": "4.3.3",
+		"express": "4.17.2",
 		"jsonwebtoken": "8.5.1",
 		"lodash": "4.17.21",
-		"verdaccio-htpasswd": "11.0.0-6-next.9"
+		"verdaccio-htpasswd": "11.0.0-6-next.11"
 	},
 	"devDependencies": {
-		"@verdaccio/mock": "6.0.0-6-next.10",
-		"@verdaccio/types": "11.0.0-6-next.9"
+		"@verdaccio/mock": "6.0.0-6-next.13",
+		"@verdaccio/types": "11.0.0-6-next.10"
 	},
 	"funding": {
 		"type": "opencollective",

package/src/auth.ts

@@ -1,7 +1,9 @@
-import _ from 'lodash';
-import { NextFunction, Request, Response } from 'express';
 import buildDebug from 'debug';
+import { NextFunction, Request, Response } from 'express';
+import _ from 'lodash';
+import { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';
 
+import { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';
 import {
   API_ERROR,
   SUPPORT_ERRORS,
@@ -11,39 +13,34 @@ import {
   errorUtils,
 } from '@verdaccio/core';
 import { loadPlugin } from '@verdaccio/loaders';
-import { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';
-
 import {
-  Config,
-  Logger,
+  AllowAccess,
+  AuthPluginPackage,
   Callback,
+  Config,
   IPluginAuth,
-  RemoteUser,
   JWTSignOptions,
-  Security,
-  AuthPluginPackage,
-  AllowAccess,
+  Logger,
   PackageAccess,
   PluginOptions,
+  RemoteUser,
+  Security,
 } from '@verdaccio/types';
+import { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';
 
-import { getMatchedPackagesSpec, isNil, isFunction } from '@verdaccio/utils';
-import { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';
-
+import { signPayload } from './jwt-token';
+import { aesEncrypt } from './legacy-token';
+import { parseBasicPayload } from './token';
 import {
-  getMiddlewareCredentials,
+  convertPayloadToBase64,
   getDefaultPlugins,
-  verifyJWTPayload,
-  parseAuthTokenHeader,
-  isAuthHeaderValid,
+  getMiddlewareCredentials,
   isAESLegacy,
-  convertPayloadToBase64,
+  isAuthHeaderValid,
+  parseAuthTokenHeader,
+  verifyJWTPayload,
 } from './utils';
 
-import { signPayload } from './jwt-token';
-import { aesEncrypt } from './legacy-token';
-import { parseBasicPayload } from './token';
-
 /* eslint-disable @typescript-eslint/no-var-requires */
 const LoggerApi = require('@verdaccio/logger');
 
@@ -52,6 +49,7 @@ const debug = buildDebug('verdaccio:auth');
 export interface IBasicAuth<T> {
   config: T & Config;
   authenticate(user: string, password: string, cb: Callback): void;
+  invalidateToken?(token: string): Promise<void>;
   changePassword(user: string, password: string, newPassword: string, cb: Callback): void;
   allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
   add_user(user: string, password: string, cb: Callback): any;
@@ -83,6 +81,7 @@ export interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncrypt
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   plugins: any[];
   allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
+  invalidateToken(token: string): Promise<void>;
 }
 
 class Auth implements IAuth {
@@ -95,6 +94,9 @@ class Auth implements IAuth {
     this.config = config;
     this.logger = LoggerApi.logger.child({ sub: 'auth' });
     this.secret = config.secret;
+    if (!this.secret) {
+      throw new TypeError('secret it is required value on initialize the auth class');
+    }
 
     this.plugins =
       _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);
@@ -177,6 +179,12 @@ class Auth implements IAuth {
     }
   }
 
+  public async invalidateToken(token: string) {
+    // eslint-disable-next-line no-console
+    console.log('invalidate token pending to implement', token);
+    return Promise.resolve();
+  }
+
   public authenticate(username: string, password: string, cb: Callback): void {
     const plugins = this.plugins.slice(0);
     (function next(): void {
@@ -413,7 +421,9 @@ class Auth implements IAuth {
       }
 
       // in case auth header does not exist we return anonymous function
-      req.remote_user = createAnonymousRemoteUser();
+      const remoteUser = createAnonymousRemoteUser();
+      req.remote_user = remoteUser;
+      res.locals.remote_user = remoteUser;
 
       const { authorization } = req.headers;
       if (_.isNil(authorization)) {

package/src/jwt-token.ts

@@ -1,5 +1,5 @@
-import jwt from 'jsonwebtoken';
 import buildDebug from 'debug';
+import jwt from 'jsonwebtoken';
 
 import { JWTSignOptions, RemoteUser } from '@verdaccio/types';
 

package/src/legacy-token.ts

@@ -1,18 +1,19 @@
 import {
+  BinaryToTextEncoding,
+  CharacterEncoding,
   createCipheriv,
   createDecipheriv,
-  HexBase64BinaryEncoding,
   randomBytes,
-  Utf8AsciiBinaryEncoding,
 } from 'crypto';
-import { TOKEN_VALID_LENGTH } from '@verdaccio/config';
 import buildDebug from 'debug';
 
+import { TOKEN_VALID_LENGTH } from '@verdaccio/config';
+
 const debug = buildDebug('verdaccio:auth:token:legacy');
 
 export const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
-const inputEncoding: Utf8AsciiBinaryEncoding = 'utf8';
-const outputEncoding: HexBase64BinaryEncoding = 'hex';
+const inputEncoding: CharacterEncoding = 'utf8';
+const outputEncoding: BinaryToTextEncoding = 'hex';
 // For AES, this is always 16
 const IV_LENGTH = 16;
 // Must be 256 bits (32 characters)
@@ -55,7 +56,8 @@ export function aesDecrypt(value: string, key: string): string | void {
     const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
     // decipher the string
     const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);
-    let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
+    // FIXME: fix type here should allow Buffer
+    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
     debug('token decrypted successfully');
     return decrypted.toString();

package/src/utils.ts

@@ -1,26 +1,27 @@
-import _ from 'lodash';
 import buildDebug from 'debug';
+import _ from 'lodash';
+
+import { createAnonymousRemoteUser } from '@verdaccio/config';
 import {
-  Callback,
-  Config,
-  IPluginAuth,
-  RemoteUser,
-  Security,
-  AuthPackageAllow,
-} from '@verdaccio/types';
-import {
+  API_ERROR,
   HTTP_STATUS,
   TOKEN_BASIC,
   TOKEN_BEARER,
-  API_ERROR,
   VerdaccioError,
   errorUtils,
 } from '@verdaccio/core';
+import {
+  AuthPackageAllow,
+  Callback,
+  Config,
+  IPluginAuth,
+  RemoteUser,
+  Security,
+} from '@verdaccio/types';
 
-import { createAnonymousRemoteUser } from '@verdaccio/config';
-import { TokenEncryption, AESPayload } from './auth';
-import { aesDecrypt } from './legacy-token';
+import { AESPayload, TokenEncryption } from './auth';
 import { verifyPayload } from './jwt-token';
+import { aesDecrypt } from './legacy-token';
 import { parseBasicPayload } from './token';
 
 const debug = buildDebug('verdaccio:auth:utils');

package/test/auth-utils.spec.ts

@@ -1,43 +1,42 @@
-import path from 'path';
 import _ from 'lodash';
+import path from 'path';
 
-import { configExample } from '@verdaccio/mock';
 import {
   Config as AppConfig,
-  parseConfigFile,
   ROLES,
-  createRemoteUser,
   createAnonymousRemoteUser,
+  createRemoteUser,
+  parseConfigFile,
 } from '@verdaccio/config';
-
 import {
-  getAuthenticatedMessage,
-  buildToken,
-  AllowActionCallbackResponse,
-  buildUserBuffer,
-} from '@verdaccio/utils';
-
-import { Config, Security, RemoteUser } from '@verdaccio/types';
-import {
-  VerdaccioError,
+  API_ERROR,
   CHARACTER_ENCODING,
   TOKEN_BEARER,
-  API_ERROR,
+  VerdaccioError,
   errorUtils,
 } from '@verdaccio/core';
 import { setup } from '@verdaccio/logger';
+import { configExample } from '@verdaccio/mock';
+import { Config, RemoteUser, Security } from '@verdaccio/types';
+import {
+  AllowActionCallbackResponse,
+  buildToken,
+  buildUserBuffer,
+  getAuthenticatedMessage,
+} from '@verdaccio/utils';
+
 import {
-  IAuth,
-  Auth,
   ActionsAllowed,
+  Auth,
+  IAuth,
+  aesDecrypt,
   allow_action,
+  getApiToken,
   getDefaultPlugins,
   getMiddlewareCredentials,
-  getApiToken,
+  signPayload,
   verifyJWTPayload,
-  aesDecrypt,
   verifyPayload,
-  signPayload,
 } from '../src';
 
 setup([]);

package/test/auth.spec.ts

@@ -1,19 +1,21 @@
 import _ from 'lodash';
-import { ROLES, Config as AppConfig } from '@verdaccio/config';
-import { setup } from '@verdaccio/logger';
+
 import { IAuth } from '@verdaccio/auth';
-import { Config } from '@verdaccio/types';
+import { Config as AppConfig, ROLES } from '@verdaccio/config';
 import { errorUtils } from '@verdaccio/core';
+import { setup } from '@verdaccio/logger';
+import { Config } from '@verdaccio/types';
 
 import { Auth } from '../src';
-
-import { authProfileConf, authPluginFailureConf, authPluginPassThrougConf } from './helper/plugin';
+import { authPluginFailureConf, authPluginPassThrougConf, authProfileConf } from './helper/plugin';
 
 setup([]);
 
 describe('AuthTest', () => {
   test('should be defined', () => {
     const config: Config = new AppConfig(_.cloneDeep(authProfileConf));
+    config.checkSecretKey('12345');
+
     const auth: IAuth = new Auth(config);
 
     expect(auth).toBeDefined();
@@ -23,6 +25,7 @@ describe('AuthTest', () => {
     describe('test authenticate states', () => {
       test('should be a success login', () => {
         const config: Config = new AppConfig(_.cloneDeep(authProfileConf));
+        config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
 
         expect(auth).toBeDefined();
@@ -49,6 +52,7 @@ describe('AuthTest', () => {
 
       test('should be a fail on login', () => {
         const config: Config = new AppConfig(_.cloneDeep(authPluginFailureConf));
+        config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
 
         expect(auth).toBeDefined();
@@ -67,6 +71,7 @@ describe('AuthTest', () => {
     describe('test authenticate out of control inputs from plugins', () => {
       test('should skip falsy values', () => {
         const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+        config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
 
         expect(auth).toBeDefined();
@@ -86,6 +91,7 @@ describe('AuthTest', () => {
 
       test('should error truthy non-array', () => {
         const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+        config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
 
         expect(auth).toBeDefined();
@@ -103,6 +109,7 @@ describe('AuthTest', () => {
 
       test('should skip empty array', () => {
         const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+        config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
 
         expect(auth).toBeDefined();
@@ -119,6 +126,7 @@ describe('AuthTest', () => {
 
       test('should accept valid array', () => {
         const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+        config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
 
         expect(auth).toBeDefined();

package/test/helper/plugin.ts

@@ -1,4 +1,5 @@
 import path from 'path';
+
 import { configExample as config } from '@verdaccio/mock';
 
 export const authProfileConf = config({