@verdaccio/auth 6.0.0-6-next.16 → 6.0.0-6-next.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +8 -0
- package/build/legacy-token.js +2 -1
- package/build/legacy-token.js.map +1 -1
- package/package.json +4 -4
- package/src/legacy-token.ts +6 -5
package/CHANGELOG.md
CHANGED
package/build/legacy-token.js
CHANGED
|
@@ -61,7 +61,8 @@ function aesDecrypt(value, key) {
|
|
|
61
61
|
const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
|
|
62
62
|
const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key; // decipher the string
|
|
63
63
|
|
|
64
|
-
const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV);
|
|
64
|
+
const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV); // FIXME: fix type here should allow Buffer
|
|
65
|
+
|
|
65
66
|
let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
|
|
66
67
|
decrypted += decipher.final(inputEncoding);
|
|
67
68
|
debug('token decrypted successfully');
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/legacy-token.ts"],"names":["debug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","decrypted","_"],"mappings":";;;;;;;;;AAAA;;AAOA;;AAEA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,
|
|
1
|
+
{"version":3,"sources":["../src/legacy-token.ts"],"names":["debug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","decrypted","_"],"mappings":";;;;;;;;;AAAA;;AAOA;;AAEA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,aAAgC,GAAG,MAAzC;AACA,MAAMC,cAAoC,GAAG,KAA7C,C,CACA;;AACA,MAAMC,SAAS,GAAG,EAAlB,C,CACA;AACA;;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAR,CAAYK,+BAApD;;AAEO,SAASC,UAAT,CAAoBC,KAApB,EAAmCC,GAAnC,EAA+D;AACpE;AACA;AACAX,EAAAA,KAAK,CAAC,YAAD,EAAeU,KAAf,CAAL;AACAV,EAAAA,KAAK,CAAC,cAAD,EAAiBC,gBAAjB,CAAL;AACA,QAAMW,EAAE,GAAGC,MAAM,CAACC,IAAP,CAAY,yBAAYP,SAAZ,CAAZ,CAAX;AACA,QAAMQ,SAAS,GAAGP,+BAA+B,IAAIG,GAArD;AACA,QAAMK,UAAU,GAAG,CAAAD,SAAS,SAAT,IAAAA,SAAS,WAAT,YAAAA,SAAS,CAAEE,MAAX,MAAsBC,0BAAzC;AACAlB,EAAAA,KAAK,CAAC,sBAAD,EAAyBe,SAAzB,aAAyBA,SAAzB,uBAAyBA,SAAS,CAAEE,MAApC,CAAL;AACAjB,EAAAA,KAAK,CAAC,oBAAD,EAAuBgB,UAAvB,CAAL;;AACA,MAAI,CAACN,KAAD,IAAU,CAACK,SAAX,IAAwB,CAACC,UAA7B,EAAyC;AACvC;AACD;;AAED,QAAMG,MAAM,GAAG,4BAAelB,gBAAf,EAAiCc,SAAjC,EAA4CH,EAA5C,CAAf;AACA,MAAIQ,SAAS,GAAGD,MAAM,CAACE,MAAP,CAAcX,KAAd,EAAqBL,aAArB,EAAoCC,cAApC,CAAhB,CAfoE,CAgBpE;;AACAc,EAAAA,SAAS,IAAID,MAAM,CAACG,KAAP,CAAahB,cAAb,CAAb;AACA,QAAMiB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAH,CAAY,KAAZ,CAAmB,IAAGJ,SAAS,CAACI,QAAV,EAAqB,EAA5D;AACAxB,EAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,SAAOa,MAAM,CAACC,IAAP,CAAYS,KAAZ,EAAmBC,QAAnB,CAA4B,QAA5B,CAAP;AACD;;AAEM,SAASC,UAAT,CAAoBf,KAApB,EAAmCC,GAAnC,EAA+D;AACpE,MAAI;AACF,UAAMe,IAAI,GAAGb,MAAM,CAACC,IAAP,CAAYJ,KAAZ,EAAmB,QAAnB,CAAb;AACA,UAAMiB,SAAS,GAAGD,IAAI,CAACF,QAAL,GAAgBI,KAAhB,CAAsB,GAAtB,CAAlB,CAFE,CAIF;AACA;;AACA,UAAMC,EAAE,GAAGhB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACG,KAAV,EAAZ,EAA+BxB,cAA/B,CAAX,CANE,CAOF;;AACA,UAAMyB,aAAa,GAAGlB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACK,IAAV,CAAe,GAAf,CAAZ,EAAiC1B,cAAjC,CAAtB;AACA,UAAMS,SAAS,GAAGP,+BAA+B,IAAIG,GAArD,CATE,CAUF;;AACA,UAAMsB,QAAQ,GAAG,8BAAiBhC,gBAAjB,EAAmCc,SAAnC,EAA8Cc,EAA9C,CAAjB,CAXE,CAYF;;AACA,QAAIK,SAAS,GAAGD,QAAQ,CAACZ,MAAT,CAAgBU,aAAhB,EAAsCzB,cAAtC,EAAsDD,aAAtD,CAAhB;AACA6B,IAAAA,SAAS,IAAID,QAAQ,CAACX,KAAT,CAAejB,aAAf,CAAb;AACAL,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,WAAOkC,SAAS,CAACV,QAAV,EAAP;AACD,GAjBD,CAiBE,OAAOW,CAAP,EAAe;AACf;AACD;AACF","sourcesContent":["import {\n BinaryToTextEncoding,\n CharacterEncoding,\n createCipheriv,\n createDecipheriv,\n randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n debug('encrypt %o', value);\n debug('algorithm %o', defaultAlgorithm);\n const iv = Buffer.from(randomBytes(IV_LENGTH));\n const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n debug('length secret key %o', secretKey?.length);\n debug('is valid secret %o', isKeyValid);\n if (!value || !secretKey || !isKeyValid) {\n return;\n }\n\n const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n // @ts-ignore\n encrypted += cipher.final(outputEncoding);\n const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n debug('token generated successfully');\n return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n try {\n const buff = Buffer.from(value, 'base64');\n const textParts = buff.toString().split(':');\n\n // extract the IV from the first half of the value\n // @ts-ignore\n const IV = Buffer.from(textParts.shift(), outputEncoding);\n // extract the encrypted text without the IV\n const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n // decipher the string\n const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n // FIXME: fix type here should allow Buffer\n let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n decrypted += decipher.final(inputEncoding);\n debug('token decrypted successfully');\n return decrypted.toString();\n } catch (_: any) {\n return;\n }\n}\n"],"file":"legacy-token.js"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/auth",
|
|
3
|
-
"version": "6.0.0-6-next.
|
|
3
|
+
"version": "6.0.0-6-next.17",
|
|
4
4
|
"description": "logger",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -32,11 +32,11 @@
|
|
|
32
32
|
"dependencies": {
|
|
33
33
|
"@verdaccio/core": "6.0.0-6-next.4",
|
|
34
34
|
"@verdaccio/config": "6.0.0-6-next.12",
|
|
35
|
-
"@verdaccio/loaders": "6.0.0-6-next.
|
|
36
|
-
"@verdaccio/logger": "6.0.0-6-next.
|
|
35
|
+
"@verdaccio/loaders": "6.0.0-6-next.9",
|
|
36
|
+
"@verdaccio/logger": "6.0.0-6-next.9",
|
|
37
37
|
"@verdaccio/utils": "6.0.0-6-next.10",
|
|
38
38
|
"debug": "4.3.3",
|
|
39
|
-
"express": "4.17.
|
|
39
|
+
"express": "4.17.2",
|
|
40
40
|
"jsonwebtoken": "8.5.1",
|
|
41
41
|
"lodash": "4.17.21",
|
|
42
42
|
"verdaccio-htpasswd": "11.0.0-6-next.11"
|
package/src/legacy-token.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import {
|
|
2
|
-
|
|
3
|
-
|
|
2
|
+
BinaryToTextEncoding,
|
|
3
|
+
CharacterEncoding,
|
|
4
4
|
createCipheriv,
|
|
5
5
|
createDecipheriv,
|
|
6
6
|
randomBytes,
|
|
@@ -12,8 +12,8 @@ import { TOKEN_VALID_LENGTH } from '@verdaccio/config';
|
|
|
12
12
|
const debug = buildDebug('verdaccio:auth:token:legacy');
|
|
13
13
|
|
|
14
14
|
export const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
|
|
15
|
-
const inputEncoding:
|
|
16
|
-
const outputEncoding:
|
|
15
|
+
const inputEncoding: CharacterEncoding = 'utf8';
|
|
16
|
+
const outputEncoding: BinaryToTextEncoding = 'hex';
|
|
17
17
|
// For AES, this is always 16
|
|
18
18
|
const IV_LENGTH = 16;
|
|
19
19
|
// Must be 256 bits (32 characters)
|
|
@@ -56,7 +56,8 @@ export function aesDecrypt(value: string, key: string): string | void {
|
|
|
56
56
|
const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
|
|
57
57
|
// decipher the string
|
|
58
58
|
const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);
|
|
59
|
-
|
|
59
|
+
// FIXME: fix type here should allow Buffer
|
|
60
|
+
let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);
|
|
60
61
|
decrypted += decipher.final(inputEncoding);
|
|
61
62
|
debug('token decrypted successfully');
|
|
62
63
|
return decrypted.toString();
|