@verdaccio/auth 6.0.0-6-next.16 → 6.0.0-6-next.19

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # @verdaccio/auth
 
+## 6.0.0-6-next.19
+
+### Patch Changes
+
+- aeff267d: Refactor htpasswd plugin to use the bcryptjs 'compare' api call instead of 'comparSync'. Add a new configuration value named 'slow_verify_ms' to the htpasswd plugin that when exceeded during password verification will log a warning message.
+- Updated dependencies [aeff267d]
+  - verdaccio-htpasswd@11.0.0-6-next.12
+
+## 6.0.0-6-next.18
+
+### Patch Changes
+
+- Updated dependencies [b78f3525]
+  - @verdaccio/logger@6.0.0-6-next.10
+  - @verdaccio/loaders@6.0.0-6-next.10
+
+## 6.0.0-6-next.17
+
+### Patch Changes
+
+- Updated dependencies [730b5d8c]
+  - @verdaccio/logger@6.0.0-6-next.9
+  - @verdaccio/loaders@6.0.0-6-next.9
+
 ## 6.0.0-6-next.16
 
 ### Patch Changes

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth.ts"],"names":["LoggerApi","require","debug","Auth","constructor","config","logger","child","sub","secret","TypeError","plugins","_","isNil","auth","_loadPlugin","loadDefaultPlugin","_applyDefaultPlugins","plugingConf","file","pluginOptions","authPlugin","HTPasswd","error","plugin","authenticate","allow_access","allow_publish","push","changePassword","username","password","newPassword","cb","validPlugins","filter","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","length","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","createRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","getBadRequest","BAD_AUTH_HEADER","security","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","toUpperCase","TOKEN_BASIC","credentials","toString","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","aesEncrypt","value"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AAQA;;AAcA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,oBAAW,gBAAX,CAAd;;AAwCA,MAAMC,IAAN,CAA4B;AAMnBC,EAAAA,WAAW,CAACC,MAAD,EAAiB;AACjC,SAAKA,MAAL,GAAcA,MAAd;AACA,SAAKC,MAAL,GAAcN,SAAS,CAACM,MAAV,CAAiBC,KAAjB,CAAuB;AAAEC,MAAAA,GAAG,EAAE;AAAP,KAAvB,CAAd;AACA,SAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;;AACA,QAAI,CAAC,KAAKA,MAAV,EAAkB;AAChB,YAAM,IAAIC,SAAJ,CAAc,0DAAd,CAAN;AACD;;AAED,SAAKC,OAAL,GACEC,gBAAEC,KAAF,CAAQR,MAAR,aAAQA,MAAR,uBAAQA,MAAM,CAAES,IAAhB,MAA0B,KAA1B,GAAkC,KAAKC,WAAL,CAAiBV,MAAjB,CAAlC,GAA6D,KAAKW,iBAAL,CAAuBX,MAAvB,CAD/D;;AAEA,SAAKY,oBAAL;AACD;;AAEOD,EAAAA,iBAAiB,CAACX,MAAD,EAAiB;AACxC,UAAMa,WAA2B,GAAG,EAAE,GAAGb,MAAL;AAAac,MAAAA,IAAI,EAAE;AAAnB,KAApC;AACA,UAAMC,aAAgC,GAAG;AACvCf,MAAAA,MADuC;AAEvCC,MAAAA,MAAM,EAAE,KAAKA;AAF0B,KAAzC;AAIA,QAAIe,UAAJ;;AACA,QAAI;AACFA,MAAAA,UAAU,GAAG,IAAIC,2BAAJ,CAAaJ,WAAb,EAA0BE,aAA1B,CAAb;AACD,KAFD,CAEE,OAAOG,KAAP,EAAmB;AACnBrB,MAAAA,KAAK,CAAC,iDAAD,EAAoDqB,KAApD,CAAL;AACA,aAAO,EAAP;AACD;;AAED,WAAO,CAACF,UAAD,CAAP;AACD;;AAEON,EAAAA,WAAW,CAACV,MAAD,EAAwC;AACzD,UAAMe,aAAa,GAAG;AACpBf,MAAAA,MADoB;AAEpBC,MAAAA,MAAM,EAAE,KAAKA;AAFO,KAAtB;AAKA,WAAO,yBACLD,MADK,EAELA,MAAM,CAACS,IAFF,EAGLM,aAHK,EAIJI,MAAD,IAA0C;AACxC,YAAM;AAAEC,QAAAA,YAAF;AAAgBC,QAAAA,YAAhB;AAA8BC,QAAAA;AAA9B,UAAgDH,MAAtD,CADwC,CAGxC;;AACA,aAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;AACD,KATI,CAAP;AAWD;;AAEOV,EAAAA,oBAAoB,GAAS;AACnC;AACA,SAAKN,OAAL,CAAaiB,IAAb,CAAkB,+BAAkB,KAAKtB,MAAvB,CAAlB;AACD;;AAEMuB,EAAAA,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;AACN,UAAMC,YAAY,GAAGtB,gBAAEuB,MAAF,CAAS,KAAKxB,OAAd,EAAwBa,MAAD,IAAY,uBAAWA,MAAM,CAACK,cAAlB,CAAnC,CAArB;;AAEA,QAAIjB,gBAAEwB,OAAF,CAAUF,YAAV,CAAJ,EAA6B;AAC3B,aAAOD,EAAE,CAACI,iBAAWC,gBAAX,CAA4BC,qBAAeC,wBAA3C,CAAD,CAAT;AACD;;AAED,SAAK,MAAMhB,MAAX,IAAqBU,YAArB,EAAmC;AACjC,UAAI,kBAAMV,MAAN,KAAiB,uBAAWA,MAAM,CAACK,cAAlB,MAAsC,KAA3D,EAAkE;AAChE3B,QAAAA,KAAK,CAAC,gEAAD,CAAL;AACA;AACD,OAHD,MAGO;AACLA,QAAAA,KAAK,CAAC,0BAAD,EAA6B4B,QAA7B,CAAL;AACAN,QAAAA,MAAM,CAACK,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACS,GAAD,EAAMC,OAAN,KAAwB;AAC9E,cAAID,GAAJ,EAAS;AACP,iBAAKnC,MAAL,CAAYiB,KAAZ,CACE;AAAEO,cAAAA,QAAF;AAAYW,cAAAA;AAAZ,aADF,EAEG;AACf,yEAHY;AAKA,mBAAOR,EAAE,CAACQ,GAAD,CAAT;AACD;;AAEDvC,UAAAA,KAAK,CAAC,wCAAD,EAA2C4B,QAA3C,CAAL;AACA,iBAAOG,EAAE,CAAC,IAAD,EAAOS,OAAP,CAAT;AACD,SAZD;AAaD;AACF;AACF;;AAE2B,QAAfC,eAAe,CAACC,KAAD,EAAgB;AAC1C;AACAC,IAAAA,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;AACA,WAAOG,OAAO,CAACC,OAAR,EAAP;AACD;;AAEMvB,EAAAA,YAAY,CAACK,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;AAC1E,UAAMtB,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;;AACA,KAAC,SAASC,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;;AAEA,UAAI,uBAAW3B,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;AAC7C,eAAOyB,IAAI,EAAX;AACD;;AAEDhD,MAAAA,KAAK,CAAC,mBAAD,EAAsB4B,QAAtB,CAAL;AACAN,MAAAA,MAAM,CAACC,YAAP,CAAoBK,QAApB,EAA8BC,QAA9B,EAAwC,UAAUU,GAAV,EAAeW,MAAf,EAA6B;AACnE,YAAIX,GAAJ,EAAS;AACPvC,UAAAA,KAAK,CAAC,8CAAD,EAAiD4B,QAAjD,EAA2DW,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;AACA,iBAAOpB,EAAE,CAACQ,GAAD,CAAT;AACD,SAJkE,CAMnE;AACA;AACA;AACA;AACA;AACA;AACA;;;AACA,YAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAACE,MAAP,KAAkB,CAAlC,EAAqC;AACnC;AACA,cAAI1C,gBAAE2C,QAAF,CAAWH,MAAX,CAAJ,EAAwB;AACtB,kBAAM,IAAI1C,SAAJ,CAAc,+CAAd,CAAN;AACD;;AACD,gBAAM8C,YAAqB,GAAG5C,gBAAE6C,OAAF,CAAUL,MAAV,CAA9B;;AACA,cAAI,CAACI,YAAL,EAAmB;AACjB,kBAAM,IAAI9C,SAAJ,CAAcgD,gBAAUC,qBAAxB,CAAN;AACD;;AAEDzD,UAAAA,KAAK,CAAC,yDAAD,EAA4D4B,QAA5D,EAAsEsB,MAAtE,CAAL;AACA,iBAAOnB,EAAE,CAACQ,GAAD,EAAM,8BAAiBX,QAAjB,EAA2BsB,MAA3B,CAAN,CAAT;AACD;;AACDF,QAAAA,IAAI;AACL,OA3BD;AA4BD,KApCD;AAqCD;;AAEMU,EAAAA,QAAQ,CAACC,IAAD,EAAe9B,QAAf,EAAiCE,EAAjC,EAAqD;AAClE,UAAM6B,IAAI,GAAG,IAAb;AACA,UAAMnD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA/C,IAAAA,KAAK,CAAC,aAAD,EAAgB2D,IAAhB,CAAL;;AAEA,KAAC,SAASX,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;AACA,UAAIY,MAAM,GAAG,SAAb;;AACA,UAAI,uBAAWvC,MAAM,CAACuC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCA,QAAAA,MAAM,GAAG,UAAT;AACAD,QAAAA,IAAI,CAACxD,MAAL,CAAY0D,IAAZ,CACE,yEACE,gEAFJ;AAID;;AAED,UAAI,uBAAWxC,MAAM,CAACuC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCb,QAAAA,IAAI;AACL,OAFD,MAEO;AACL;AACA1B,QAAAA,MAAM,CAACuC,MAAD,CAAN,CAAeF,IAAf,EAAqB9B,QAArB,EAA+B,UAAUU,GAAV,EAAewB,EAAf,EAAyB;AACtD,cAAIxB,GAAJ,EAAS;AACPvC,YAAAA,KAAK,CAAC,+CAAD,EAAkD2D,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;AACA,mBAAOpB,EAAE,CAACQ,GAAD,CAAT;AACD;;AACD,cAAIwB,EAAJ,EAAQ;AACN/D,YAAAA,KAAK,CAAC,4BAAD,EAA+B2D,IAA/B,CAAL;AACA,mBAAOC,IAAI,CAACrC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkCE,EAAlC,CAAP;AACD;;AACDiB,UAAAA,IAAI;AACL,SAVD;AAWD;AACF,KA3BD;AA4BD;AAED;AACF;AACA;;;AACSxB,EAAAA,YAAY,CACjB;AAAEwC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;AACN,UAAMzD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMoB,aAA0B,GAAG;AAAEC,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KAAnC;AACA,UAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,mCAAuBH,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAHU,CAAZ;AAKAzE,IAAAA,KAAK,CAAC,qBAAD,EAAwBgE,WAAxB,CAAL;;AAEA,KAAC,SAAShB,IAAT,GAAsB;AACrB,YAAM1B,MAA2B,GAAGb,OAAO,CAACwC,KAAR,EAApC;;AAEA,UAAIvC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;AAChE,eAAOwB,IAAI,EAAX;AACD;;AAED1B,MAAAA,MAAM,CAACE,YAAP,CAAqBmC,IAArB,EAA2BW,GAA3B,EAAgC,UAAU/B,GAAV,EAAewB,EAAf,EAAkC;AAChE,YAAIxB,GAAJ,EAAS;AACPvC,UAAAA,KAAK,CAAC,oCAAD,EAAuCgE,WAAvC,EAAoDzB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;AACA,iBAAOe,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,YAAIwB,EAAJ,EAAQ;AACN/D,UAAAA,KAAK,CAAC,uBAAD,EAA0BgE,WAA1B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAEDf,QAAAA,IAAI,GAX4D,CAWxD;AACT,OAZD;AAaD,KApBD;AAqBD;;AAEM0B,EAAAA,eAAe,CACpB;AAAEV,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;AACN,UAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAFU,CAAZ;AAIAzE,IAAAA,KAAK,CAAC,wBAAD,EAA2BgE,WAA3B,CAAL;;AAEA,SAAK,MAAM1C,MAAX,IAAqB,KAAKb,OAA1B,EAAmC;AACjC,UAAIC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACoD,eAAlB,MAAuC,KAA9D,EAAqE;AACnE1E,QAAAA,KAAK,CAAC,kEAAD,EAAqEgE,WAArE,CAAL;AACA;AACD,OAHD,MAGO;AACL;AACA1C,QAAAA,MAAM,CAACoD,eAAP,CAAwBf,IAAxB,EAA8BW,GAA9B,EAAmC,CAAC/B,GAAD,EAAMwB,EAAN,KAA4B;AAC7D,cAAIxB,GAAJ,EAAS;AACPvC,YAAAA,KAAK,CACH,qEADG,EAEHgE,WAFG,CAAL;AAIA,mBAAOE,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,cAAI7B,gBAAEC,KAAF,CAAQoD,EAAR,MAAgB,IAApB,EAA0B;AACxB/D,YAAAA,KAAK,CAAC,yDAAD,EAA4DgE,WAA5D,CAAL,CADwB,CAExB;AACA;;AACA,mBAAO,KAAKvC,aAAL,CAAmB,GAAGkD,SAAtB,CAAP;AACD;;AAED,cAAIZ,EAAJ,EAAQ;AACN/D,YAAAA,KAAK,CAAC,0BAAD,EAA6BgE,WAA7B,CAAL;AACA,mBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;AACF,SApBD;AAqBD;AACF;AACF;AAED;AACF;AACA;;;AACStC,EAAAA,aAAa,CAClB;AAAEuC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;AACN,UAAMzD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMuB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAFU,CAAZ;AAIAzE,IAAAA,KAAK,CAAC,yCAAD,EAA4CgE,WAA5C,EAAyDvD,OAAO,CAAC2C,MAAjE,CAAL;;AAEA,KAAC,SAASJ,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;;AAEA,UAAI,uBAAW3B,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;AAC/CzB,QAAAA,KAAK,CAAC,8DAAD,EAAiEgE,WAAjE,CAAL;AACA,eAAOhB,IAAI,EAAX;AACD,OANoB,CAQrB;;;AACA1B,MAAAA,MAAM,CAACG,aAAP,CACEkC,IADF,EAEE;AACAW,MAAAA,GAHF,EAIE;AACA,OAAC/B,GAAD,EAAsBwB,EAAtB,KAA4C;AAC1C,YAAIrD,gBAAEC,KAAF,CAAQ4B,GAAR,MAAiB,KAAjB,IAA0B7B,gBAAEkE,OAAF,CAAUrC,GAAV,CAA9B,EAA8C;AAC5CvC,UAAAA,KAAK,CAAC,0BAAD,EAA6BgE,WAA7B,CAAL;AACA,iBAAOE,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,YAAIwB,EAAJ,EAAQ;AACN/D,UAAAA,KAAK,CAAC,wBAAD,EAA2BgE,WAA3B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAED/D,QAAAA,KAAK,CAAC,sCAAD,EAAyCgE,WAAzC,CAAL;AACAhB,QAAAA,IAAI,GAZsC,CAYlC;AACT,OAlBH;AAoBD,KA7BD;AA8BD;;AAEM6B,EAAAA,gBAAgB,GAAa;AAClC7E,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,UAAMS,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAM+B,OAAO,GAAG;AAAEC,MAAAA,yBAAyB,EAAzBA,iCAAF;AAA6BC,MAAAA,gBAAgB,EAAhBA;AAA7B,KAAhB;;AACA,SAAK,MAAM1D,MAAX,IAAqBb,OAArB,EAA8B;AAC5B,UAAIa,MAAM,CAACuD,gBAAX,EAA6B;AAC3B,eAAOvD,MAAM,CAACuD,gBAAP,CAAwBC,OAAxB,CAAP;AACD;AACF;;AAED,WAAO,CAACG,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/EF,MAAAA,GAAG,CAACG,KAAJ;;AAEA,YAAMpC,IAAI,GAAG,UAAUT,GAAV,EAA4C;AACvD0C,QAAAA,GAAG,CAACI,MAAJ,GADuD,CAEvD;AACA;AACA;AACA;;AACA,YAAI9C,GAAJ,EAAS;AACP0C,UAAAA,GAAG,CAACK,WAAJ,CAAgBjE,KAAhB,GAAwBkB,GAAG,CAACY,OAA5B;AACD;;AACD,eAAOgC,KAAK,EAAZ;AACD,OAVD;;AAYA,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5CtF,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOgD,IAAI,EAAX;AACD,OAlB8E,CAoB/E;;;AACA,YAAMwC,UAAU,GAAG,wCAAnB;AACAP,MAAAA,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;AACAN,MAAAA,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;AAEA,YAAM;AAAEE,QAAAA;AAAF,UAAoBT,GAAG,CAACU,OAA9B;;AACA,UAAIjF,gBAAEC,KAAF,CAAQ+E,aAAR,CAAJ,EAA4B;AAC1B1F,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOgD,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkB0C,aAAlB,CAAL,EAAuC;AACrC1F,QAAAA,KAAK,CAAC,kDAAD,CAAL;AACA,eAAOgD,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;;AACD,YAAM;AAAEtF,QAAAA,MAAF;AAAUuF,QAAAA;AAAV,UAAuB,KAAK3F,MAAlC;;AAEA,UAAI,yBAAY2F,QAAZ,CAAJ,EAA2B;AACzB9F,QAAAA,KAAK,CAAC,wCAAD,CAAL;;AACA,aAAK+F,oBAAL,CAA0Bd,GAA1B,EAA+Ba,QAA/B,EAAyCvF,MAAzC,EAAiDmF,aAAjD,EAAgE1C,IAAhE;AACD,OAHD,MAGO;AACLhD,QAAAA,KAAK,CAAC,qCAAD,CAAL;;AACA,aAAKgG,uBAAL,CAA6Bf,GAA7B,EAAkCa,QAAlC,EAA4CvF,MAA5C,EAAoDmF,aAApD,EAAmE1C,IAAnE;AACD;AACF,KA5CD;AA6CD;;AAEOgD,EAAAA,uBAAuB,CAC7Bf,GAD6B,EAE7Ba,QAF6B,EAG7BvF,MAH6B,EAI7BmF,aAJ6B,EAK7B1C,IAL6B,EAMvB;AACNhD,IAAAA,KAAK,CAAC,2BAAD,CAAL;AACA,UAAM;AAAEiG,MAAAA,MAAF;AAAUvD,MAAAA;AAAV,QAAoB,kCAAqBgD,aAArB,CAA1B;;AACA,QAAIO,MAAM,CAACC,WAAP,OAAyBC,kBAAYD,WAAZ,EAA7B,EAAwD;AACtDlG,MAAAA,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;AACA,YAAMoG,WAAW,GAAG,oCAAuB1D,KAAvB,EAA8B2D,QAA9B,EAApB;AACA,YAAM;AAAE1C,QAAAA,IAAF;AAAQ9B,QAAAA;AAAR,UAAqB,8BAAkBuE,WAAlB,CAA3B;AACApG,MAAAA,KAAK,CAAC,mBAAD,EAAsB2D,IAAtB,CAAL;AACA,WAAKpC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkC,CAACU,GAAD,EAAMoB,IAAN,KAAqB;AACrD,YAAI,CAACpB,GAAL,EAAU;AACRvC,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAiF,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACAX,UAAAA,IAAI;AACL,SAJD,MAIO;AACLhD,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAiF,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAtC,UAAAA,IAAI,CAACT,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAjBD,MAiBO;AACLvC,MAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,YAAMoG,WAAgB,GAAG,sCAAyBN,QAAzB,EAAmCvF,MAAnC,EAA2CmF,aAA3C,CAAzB;;AACA,UAAIU,WAAJ,EAAiB;AACf;AACAnB,QAAAA,GAAG,CAACK,WAAJ,GAAkBc,WAAlB;AACApG,QAAAA,KAAK,CAAC,0BAAD,CAAL;AACAgD,QAAAA,IAAI;AACL,OALD,MAKO;AACL;AACAhD,QAAAA,KAAK,CAAC,mBAAD,CAAL;AACAgD,QAAAA,IAAI,CAACb,iBAAWmE,YAAX,CAAwB9C,gBAAU+C,qBAAlC,CAAD,CAAJ;AACD;AACF;AACF;;AAEOR,EAAAA,oBAAoB,CAC1Bd,GAD0B,EAE1Ba,QAF0B,EAG1BvF,MAH0B,EAI1BmF,aAJ0B,EAK1B1C,IAL0B,EAMpB;AACNhD,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACAA,IAAAA,KAAK,CAAC,0BAAD,EAA6BO,MAA7B,CAAL;AACAP,IAAAA,KAAK,CAAC,iCAAD,EAAoC0F,aAApC,CAAL;AACA,UAAMU,WAAgB,GAAG,sCAAyBN,QAAzB,EAAmCvF,MAAnC,EAA2CmF,aAA3C,CAAzB;AACA1F,IAAAA,KAAK,CAAC,+BAAD,EAAkCoG,WAAlC,CAAL;;AACA,QAAIA,WAAJ,EAAiB;AACf,YAAM;AAAEzC,QAAAA,IAAF;AAAQ9B,QAAAA;AAAR,UAAqBuE,WAA3B;AACApG,MAAAA,KAAK,CAAC,mBAAD,EAAsB2D,IAAtB,CAAL;AACA,WAAKpC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkC,CAACU,GAAD,EAAMoB,IAAN,KAAqB;AACrD,YAAI,CAACpB,GAAL,EAAU;AACR0C,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACA3D,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAgD,UAAAA,IAAI;AACL,SAJD,MAIO;AACLiC,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAtF,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAgD,UAAAA,IAAI,CAACT,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAdD,MAcO;AACL;AACAvC,MAAAA,KAAK,CAAC,uBAAD,CAAL;AACA,aAAOgD,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;AACF;;AAEON,EAAAA,kBAAkB,CAACD,WAAD,EAAmC;AAC3D,WAAO5E,gBAAE8F,WAAF,CAAclB,WAAd,MAA+B,KAA/B,IAAwC5E,gBAAE8F,WAAF,CAAclB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;AACD;AAED;AACF;AACA;;;AACSqC,EAAAA,kBAAkB,GAAa;AACpC,WAAO,CAACxB,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/E,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5C,eAAOH,KAAK,EAAZ;AACD;;AAEDF,MAAAA,GAAG,CAACG,KAAJ;;AACA,YAAMpC,IAAI,GAAIT,GAAD,IAAsC;AACjD0C,QAAAA,GAAG,CAACI,MAAJ;;AACA,YAAI9C,GAAJ,EAAS;AACP;AACA2C,UAAAA,GAAG,CAACwB,MAAJ,CAAWnE,GAAG,CAACoE,UAAf,EAA2BC,IAA3B,CAAgCrE,GAAG,CAACY,OAApC;AACD;;AAED,eAAOgC,KAAK,EAAZ;AACD,OARD;;AAUA,YAAM;AAAEO,QAAAA;AAAF,UAAoBT,GAAG,CAACU,OAA9B;;AACA,UAAIjF,gBAAEC,KAAF,CAAQ+E,aAAR,CAAJ,EAA4B;AAC1B,eAAO1C,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkB0C,aAAlB,CAAL,EAAuC;AACrC,eAAO1C,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;;AAED,YAAMnD,KAAK,GAAG,CAACgD,aAAa,IAAI,EAAlB,EAAsBmB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;AACA,UAAI,CAACpE,KAAL,EAAY;AACV,eAAOM,IAAI,EAAX;AACD;;AAED,UAAIoD,WAAJ;;AACA,UAAI;AACFA,QAAAA,WAAW,GAAG,8BAAiB1D,KAAjB,EAAwB,KAAKvC,MAAL,CAAYI,MAApC,CAAd;AACD,OAFD,CAEE,OAAOgC,GAAP,EAAiB,CACjB;AACD;;AAED,UAAI,KAAKgD,kBAAL,CAAwBa,WAAxB,CAAJ,EAA0C;AACxC,cAAM;AAAEhC,UAAAA,IAAF;AAAQlB,UAAAA;AAAR,YAAmBkD,WAAzB,CADwC,CAExC;;AACAnB,QAAAA,GAAG,CAACK,WAAJ,GAAkB,8BAAiBlB,IAAjB,EAAuBlB,MAAvB,CAAlB;AACD,OAJD,MAIO;AACL+B,QAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACD;;AAEDtC,MAAAA,IAAI;AACL,KA9CD;AA+CD;;AAEsB,QAAV+D,UAAU,CAACpD,IAAD,EAAmBqD,WAAnB,EAAiE;AACtF,UAAM;AAAEC,MAAAA,WAAF;AAAe7C,MAAAA,IAAf;AAAqBlB,MAAAA;AAArB,QAAgCS,IAAtC;AACA3D,IAAAA,KAAK,CAAC,gBAAD,EAAmBoE,IAAnB,CAAL;AACA,UAAM8C,mBAAmB,GAAGxG,gBAAEC,KAAF,CAAQsG,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;AACA,UAAME,aAAa,GAAGzG,gBAAEC,KAAF,CAAQuC,MAAR,IAAkB+D,WAAlB,GAAgC/D,MAAM,CAACkE,MAAP,CAAcF,mBAAd,CAAtD;AACA,UAAMG,OAAmB,GAAG;AAC1BJ,MAAAA,WAAW,EAAEC,mBADa;AAE1B9C,MAAAA,IAF0B;AAG1BlB,MAAAA,MAAM,EAAEiE;AAHkB,KAA5B;AAMA,UAAMzE,KAAa,GAAG,MAAM,2BAAY2E,OAAZ,EAAqB,KAAK9G,MAA1B,EAAkCyG,WAAlC,CAA5B;AAEA,WAAOtE,KAAP;AACD;AAED;AACF;AACA;;;AACS4E,EAAAA,UAAU,CAACC,KAAD,EAA+B;AAC9C,WAAO,6BAAWA,KAAX,EAAkB,KAAKhH,MAAvB,CAAP;AACD;;AApgByB","sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport { loadPlugin } from '@verdaccio/loaders';\nimport {\n  AllowAccess,\n  AuthPluginPackage,\n  Callback,\n  Config,\n  IPluginAuth,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  PluginOptions,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\n/* eslint-disable @typescript-eslint/no-var-requires */\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n  config: T & Config;\n  authenticate(user: string, password: string, cb: Callback): void;\n  invalidateToken?(token: string): Promise<void>;\n  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n  config: Config;\n  logger: Logger;\n  secret: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  plugins: any[];\n  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  invalidateToken(token: string): Promise<void>;\n}\n\nclass Auth implements IAuth {\n  public config: Config;\n  public logger: Logger;\n  public secret: string;\n  public plugins: IPluginAuth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.logger = LoggerApi.logger.child({ sub: 'auth' });\n    this.secret = config.secret;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n\n    this.plugins =\n      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin(config: Config) {\n    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };\n    const pluginOptions: PluginOptions<{}> = {\n      config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(plugingConf, pluginOptions);\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private _loadPlugin(config: Config): IPluginAuth<Config>[] {\n    const pluginOptions = {\n      config,\n      logger: this.logger,\n    };\n\n    return loadPlugin<IPluginAuth<Config>>(\n      config,\n      config.auth,\n      pluginOptions,\n      (plugin: IPluginAuth<Config>): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        // @ts-ignore\n        return authenticate || allow_access || allow_publish;\n      }\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(username: string, password: string, cb: Callback): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(user: string, password: string, cb: Callback): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n      let method = 'adduser';\n      if (isFunction(plugin[method]) === false) {\n        method = 'add_user';\n        self.logger.warn(\n          'the plugin method add_user in the auth plugin is deprecated and will' +\n            ' be removed in next major release, notify to the plugin author'\n        );\n      }\n\n      if (isFunction(plugin[method]) === false) {\n        next();\n      } else {\n        // p.add_user() execution\n        plugin[method](user, password, function (err, ok): void {\n          if (err) {\n            debug('the user  %o could not being added. Error: %o', user, err?.message);\n            return cb(err);\n          }\n          if (ok) {\n            debug('the user %o has been added', user);\n            return self.authenticate(user, password, cb);\n          }\n          next();\n        });\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAcces,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (isFunction(plugin?.allow_publish) === false) {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      // @ts-ignore\n      plugin.allow_publish(\n        user,\n        // @ts-ignore\n        pkg,\n        // @ts-ignore\n        (err: VerdaccioError, ok: boolean): void => {\n          if (_.isNil(err) === false && _.isError(err)) {\n            debug('forbidden publish for %o', packageName);\n            return callback(err);\n          }\n\n          if (ok) {\n            debug('allowed publish for %o', packageName);\n            return callback(null, ok);\n          }\n\n          debug('allow publish skip validation for %o', packageName);\n          next(); // cb(null, false) causes next plugin to roll\n        }\n      );\n    })();\n  }\n\n  public apiJWTmiddleware(): Function {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      req.pause();\n\n      const next = function (err: VerdaccioError | void): void {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', secret);\n    debug('api middleware authorization %o', authorization);\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): Function {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials;\n        // $FlowFixMe\n        req.remote_user = createRemoteUser(name, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"file":"auth.js"}
+{"version":3,"sources":["../src/auth.ts"],"names":["LoggerApi","require","debug","Auth","constructor","config","logger","child","sub","secret","TypeError","plugins","_","isNil","auth","_loadPlugin","loadDefaultPlugin","_applyDefaultPlugins","plugingConf","file","pluginOptions","authPlugin","HTPasswd","error","plugin","authenticate","allow_access","allow_publish","push","changePassword","username","password","newPassword","cb","validPlugins","filter","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","length","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","createRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","getBadRequest","BAD_AUTH_HEADER","security","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","toUpperCase","TOKEN_BASIC","credentials","toString","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","aesEncrypt","value"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AAQA;;AAcA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,oBAAW,gBAAX,CAAd;;AAwCA,MAAMC,IAAN,CAA4B;AAMnBC,EAAAA,WAAW,CAACC,MAAD,EAAiB;AACjC,SAAKA,MAAL,GAAcA,MAAd;AACA,SAAKC,MAAL,GAAcN,SAAS,CAACM,MAAV,CAAiBC,KAAjB,CAAuB;AAAEC,MAAAA,GAAG,EAAE;AAAP,KAAvB,CAAd;AACA,SAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;;AACA,QAAI,CAAC,KAAKA,MAAV,EAAkB;AAChB,YAAM,IAAIC,SAAJ,CAAc,0DAAd,CAAN;AACD;;AAED,SAAKC,OAAL,GACEC,gBAAEC,KAAF,CAAQR,MAAR,aAAQA,MAAR,uBAAQA,MAAM,CAAES,IAAhB,MAA0B,KAA1B,GAAkC,KAAKC,WAAL,CAAiBV,MAAjB,CAAlC,GAA6D,KAAKW,iBAAL,CAAuBX,MAAvB,CAD/D;;AAEA,SAAKY,oBAAL;AACD;;AAEOD,EAAAA,iBAAiB,CAACX,MAAD,EAAiB;AACxC,UAAMa,WAA2B,GAAG,EAAE,GAAGb,MAAL;AAAac,MAAAA,IAAI,EAAE;AAAnB,KAApC;AACA,UAAMC,aAAgC,GAAG;AACvCf,MAAAA,MADuC;AAEvCC,MAAAA,MAAM,EAAE,KAAKA;AAF0B,KAAzC;AAIA,QAAIe,UAAJ;;AACA,QAAI;AACFA,MAAAA,UAAU,GAAG,IAAIC,2BAAJ,CAAaJ,WAAb,EAA0BE,aAA1B,CAAb;AACD,KAFD,CAEE,OAAOG,KAAP,EAAmB;AACnBrB,MAAAA,KAAK,CAAC,iDAAD,EAAoDqB,KAApD,CAAL;AACA,aAAO,EAAP;AACD;;AAED,WAAO,CAACF,UAAD,CAAP;AACD;;AAEON,EAAAA,WAAW,CAACV,MAAD,EAAwC;AACzD,UAAMe,aAAa,GAAG;AACpBf,MAAAA,MADoB;AAEpBC,MAAAA,MAAM,EAAE,KAAKA;AAFO,KAAtB;AAKA,WAAO,yBACLD,MADK,EAELA,MAAM,CAACS,IAFF,EAGLM,aAHK,EAIJI,MAAD,IAA0C;AACxC,YAAM;AAAEC,QAAAA,YAAF;AAAgBC,QAAAA,YAAhB;AAA8BC,QAAAA;AAA9B,UAAgDH,MAAtD,CADwC,CAGxC;;AACA,aAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;AACD,KATI,CAAP;AAWD;;AAEOV,EAAAA,oBAAoB,GAAS;AACnC;AACA,SAAKN,OAAL,CAAaiB,IAAb,CAAkB,+BAAkB,KAAKtB,MAAvB,CAAlB;AACD;;AAEMuB,EAAAA,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;AACN,UAAMC,YAAY,GAAGtB,gBAAEuB,MAAF,CAAS,KAAKxB,OAAd,EAAwBa,MAAD,IAAY,uBAAWA,MAAM,CAACK,cAAlB,CAAnC,CAArB;;AAEA,QAAIjB,gBAAEwB,OAAF,CAAUF,YAAV,CAAJ,EAA6B;AAC3B,aAAOD,EAAE,CAACI,iBAAWC,gBAAX,CAA4BC,qBAAeC,wBAA3C,CAAD,CAAT;AACD;;AAED,SAAK,MAAMhB,MAAX,IAAqBU,YAArB,EAAmC;AACjC,UAAI,kBAAMV,MAAN,KAAiB,uBAAWA,MAAM,CAACK,cAAlB,MAAsC,KAA3D,EAAkE;AAChE3B,QAAAA,KAAK,CAAC,gEAAD,CAAL;AACA;AACD,OAHD,MAGO;AACLA,QAAAA,KAAK,CAAC,0BAAD,EAA6B4B,QAA7B,CAAL;AACAN,QAAAA,MAAM,CAACK,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACS,GAAD,EAAMC,OAAN,KAAwB;AAC9E,cAAID,GAAJ,EAAS;AACP,iBAAKnC,MAAL,CAAYiB,KAAZ,CACE;AAAEO,cAAAA,QAAF;AAAYW,cAAAA;AAAZ,aADF,EAEG;AACf,yEAHY;AAKA,mBAAOR,EAAE,CAACQ,GAAD,CAAT;AACD;;AAEDvC,UAAAA,KAAK,CAAC,wCAAD,EAA2C4B,QAA3C,CAAL;AACA,iBAAOG,EAAE,CAAC,IAAD,EAAOS,OAAP,CAAT;AACD,SAZD;AAaD;AACF;AACF;;AAE2B,QAAfC,eAAe,CAACC,KAAD,EAAgB;AAC1C;AACAC,IAAAA,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;AACA,WAAOG,OAAO,CAACC,OAAR,EAAP;AACD;;AAEMvB,EAAAA,YAAY,CAACK,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;AAC1E,UAAMtB,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;;AACA,KAAC,SAASC,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;;AAEA,UAAI,uBAAW3B,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;AAC7C,eAAOyB,IAAI,EAAX;AACD;;AAEDhD,MAAAA,KAAK,CAAC,mBAAD,EAAsB4B,QAAtB,CAAL;AACAN,MAAAA,MAAM,CAACC,YAAP,CAAoBK,QAApB,EAA8BC,QAA9B,EAAwC,UAAUU,GAAV,EAAeW,MAAf,EAA6B;AACnE,YAAIX,GAAJ,EAAS;AACPvC,UAAAA,KAAK,CAAC,8CAAD,EAAiD4B,QAAjD,EAA2DW,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;AACA,iBAAOpB,EAAE,CAACQ,GAAD,CAAT;AACD,SAJkE,CAMnE;AACA;AACA;AACA;AACA;AACA;AACA;;;AACA,YAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAACE,MAAP,KAAkB,CAAlC,EAAqC;AACnC;AACA,cAAI1C,gBAAE2C,QAAF,CAAWH,MAAX,CAAJ,EAAwB;AACtB,kBAAM,IAAI1C,SAAJ,CAAc,+CAAd,CAAN;AACD;;AACD,gBAAM8C,YAAqB,GAAG5C,gBAAE6C,OAAF,CAAUL,MAAV,CAA9B;;AACA,cAAI,CAACI,YAAL,EAAmB;AACjB,kBAAM,IAAI9C,SAAJ,CAAcgD,gBAAUC,qBAAxB,CAAN;AACD;;AAEDzD,UAAAA,KAAK,CAAC,yDAAD,EAA4D4B,QAA5D,EAAsEsB,MAAtE,CAAL;AACA,iBAAOnB,EAAE,CAACQ,GAAD,EAAM,8BAAiBX,QAAjB,EAA2BsB,MAA3B,CAAN,CAAT;AACD;;AACDF,QAAAA,IAAI;AACL,OA3BD;AA4BD,KApCD;AAqCD;;AAEMU,EAAAA,QAAQ,CAACC,IAAD,EAAe9B,QAAf,EAAiCE,EAAjC,EAAqD;AAClE,UAAM6B,IAAI,GAAG,IAAb;AACA,UAAMnD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA/C,IAAAA,KAAK,CAAC,aAAD,EAAgB2D,IAAhB,CAAL;;AAEA,KAAC,SAASX,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;AACA,UAAIY,MAAM,GAAG,SAAb;;AACA,UAAI,uBAAWvC,MAAM,CAACuC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCA,QAAAA,MAAM,GAAG,UAAT;AACAD,QAAAA,IAAI,CAACxD,MAAL,CAAY0D,IAAZ,CACE,yEACE,gEAFJ;AAID;;AAED,UAAI,uBAAWxC,MAAM,CAACuC,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;AACxCb,QAAAA,IAAI;AACL,OAFD,MAEO;AACL;AACA1B,QAAAA,MAAM,CAACuC,MAAD,CAAN,CAAeF,IAAf,EAAqB9B,QAArB,EAA+B,UAAUU,GAAV,EAAewB,EAAf,EAAyB;AACtD,cAAIxB,GAAJ,EAAS;AACPvC,YAAAA,KAAK,CAAC,+CAAD,EAAkD2D,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;AACA,mBAAOpB,EAAE,CAACQ,GAAD,CAAT;AACD;;AACD,cAAIwB,EAAJ,EAAQ;AACN/D,YAAAA,KAAK,CAAC,4BAAD,EAA+B2D,IAA/B,CAAL;AACA,mBAAOC,IAAI,CAACrC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkCE,EAAlC,CAAP;AACD;;AACDiB,UAAAA,IAAI;AACL,SAVD;AAWD;AACF,KA3BD;AA4BD;AAED;AACF;AACA;;;AACSxB,EAAAA,YAAY,CACjB;AAAEwC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;AACN,UAAMzD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMoB,aAA0B,GAAG;AAAEC,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KAAnC;AACA,UAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,mCAAuBH,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAHU,CAAZ;AAKAzE,IAAAA,KAAK,CAAC,qBAAD,EAAwBgE,WAAxB,CAAL;;AAEA,KAAC,SAAShB,IAAT,GAAsB;AACrB,YAAM1B,MAA2B,GAAGb,OAAO,CAACwC,KAAR,EAApC;;AAEA,UAAIvC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;AAChE,eAAOwB,IAAI,EAAX;AACD;;AAED1B,MAAAA,MAAM,CAACE,YAAP,CAAqBmC,IAArB,EAA2BW,GAA3B,EAAgC,UAAU/B,GAAV,EAAewB,EAAf,EAAkC;AAChE,YAAIxB,GAAJ,EAAS;AACPvC,UAAAA,KAAK,CAAC,oCAAD,EAAuCgE,WAAvC,EAAoDzB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;AACA,iBAAOe,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,YAAIwB,EAAJ,EAAQ;AACN/D,UAAAA,KAAK,CAAC,uBAAD,EAA0BgE,WAA1B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAEDf,QAAAA,IAAI,GAX4D,CAWxD;AACT,OAZD;AAaD,KApBD;AAqBD;;AAEM0B,EAAAA,eAAe,CACpB;AAAEV,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;AACN,UAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAFU,CAAZ;AAIAzE,IAAAA,KAAK,CAAC,wBAAD,EAA2BgE,WAA3B,CAAL;;AAEA,SAAK,MAAM1C,MAAX,IAAqB,KAAKb,OAA1B,EAAmC;AACjC,UAAIC,gBAAEC,KAAF,CAAQW,MAAR,KAAmB,uBAAWA,MAAM,CAACoD,eAAlB,MAAuC,KAA9D,EAAqE;AACnE1E,QAAAA,KAAK,CAAC,kEAAD,EAAqEgE,WAArE,CAAL;AACA;AACD,OAHD,MAGO;AACL;AACA1C,QAAAA,MAAM,CAACoD,eAAP,CAAwBf,IAAxB,EAA8BW,GAA9B,EAAmC,CAAC/B,GAAD,EAAMwB,EAAN,KAA4B;AAC7D,cAAIxB,GAAJ,EAAS;AACPvC,YAAAA,KAAK,CACH,qEADG,EAEHgE,WAFG,CAAL;AAIA,mBAAOE,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,cAAI7B,gBAAEC,KAAF,CAAQoD,EAAR,MAAgB,IAApB,EAA0B;AACxB/D,YAAAA,KAAK,CAAC,yDAAD,EAA4DgE,WAA5D,CAAL,CADwB,CAExB;AACA;;AACA,mBAAO,KAAKvC,aAAL,CAAmB,GAAGkD,SAAtB,CAAP;AACD;;AAED,cAAIZ,EAAJ,EAAQ;AACN/D,YAAAA,KAAK,CAAC,0BAAD,EAA6BgE,WAA7B,CAAL;AACA,mBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;AACF,SApBD;AAqBD;AACF;AACF;AAED;AACF;AACA;;;AACStC,EAAAA,aAAa,CAClB;AAAEuC,IAAAA,WAAF;AAAeC,IAAAA;AAAf,GADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;AACN,UAAMzD,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAMuB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;AAAEJ,MAAAA,IAAI,EAAEJ,WAAR;AAAqBK,MAAAA,OAAO,EAAEJ;AAA9B,KADU,EAEV,mCAAuBD,WAAvB,EAAoC,KAAK7D,MAAL,CAAYsE,QAAhD,CAFU,CAAZ;AAIAzE,IAAAA,KAAK,CAAC,yCAAD,EAA4CgE,WAA5C,EAAyDvD,OAAO,CAAC2C,MAAjE,CAAL;;AAEA,KAAC,SAASJ,IAAT,GAAsB;AACrB,YAAM1B,MAAM,GAAGb,OAAO,CAACwC,KAAR,EAAf;;AAEA,UAAI,uBAAW3B,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;AAC/CzB,QAAAA,KAAK,CAAC,8DAAD,EAAiEgE,WAAjE,CAAL;AACA,eAAOhB,IAAI,EAAX;AACD,OANoB,CAQrB;;;AACA1B,MAAAA,MAAM,CAACG,aAAP,CACEkC,IADF,EAEE;AACAW,MAAAA,GAHF,EAIE;AACA,OAAC/B,GAAD,EAAsBwB,EAAtB,KAA4C;AAC1C,YAAIrD,gBAAEC,KAAF,CAAQ4B,GAAR,MAAiB,KAAjB,IAA0B7B,gBAAEkE,OAAF,CAAUrC,GAAV,CAA9B,EAA8C;AAC5CvC,UAAAA,KAAK,CAAC,0BAAD,EAA6BgE,WAA7B,CAAL;AACA,iBAAOE,QAAQ,CAAC3B,GAAD,CAAf;AACD;;AAED,YAAIwB,EAAJ,EAAQ;AACN/D,UAAAA,KAAK,CAAC,wBAAD,EAA2BgE,WAA3B,CAAL;AACA,iBAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;AACD;;AAED/D,QAAAA,KAAK,CAAC,sCAAD,EAAyCgE,WAAzC,CAAL;AACAhB,QAAAA,IAAI,GAZsC,CAYlC;AACT,OAlBH;AAoBD,KA7BD;AA8BD;;AAEM6B,EAAAA,gBAAgB,GAAa;AAClC7E,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,UAAMS,OAAO,GAAG,KAAKA,OAAL,CAAasC,KAAb,CAAmB,CAAnB,CAAhB;AACA,UAAM+B,OAAO,GAAG;AAAEC,MAAAA,yBAAyB,EAAzBA,iCAAF;AAA6BC,MAAAA,gBAAgB,EAAhBA;AAA7B,KAAhB;;AACA,SAAK,MAAM1D,MAAX,IAAqBb,OAArB,EAA8B;AAC5B,UAAIa,MAAM,CAACuD,gBAAX,EAA6B;AAC3B,eAAOvD,MAAM,CAACuD,gBAAP,CAAwBC,OAAxB,CAAP;AACD;AACF;;AAED,WAAO,CAACG,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/EF,MAAAA,GAAG,CAACG,KAAJ;;AAEA,YAAMpC,IAAI,GAAG,UAAUT,GAAV,EAA4C;AACvD0C,QAAAA,GAAG,CAACI,MAAJ,GADuD,CAEvD;AACA;AACA;AACA;;AACA,YAAI9C,GAAJ,EAAS;AACP0C,UAAAA,GAAG,CAACK,WAAJ,CAAgBjE,KAAhB,GAAwBkB,GAAG,CAACY,OAA5B;AACD;;AACD,eAAOgC,KAAK,EAAZ;AACD,OAVD;;AAYA,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5CtF,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOgD,IAAI,EAAX;AACD,OAlB8E,CAoB/E;;;AACA,YAAMwC,UAAU,GAAG,wCAAnB;AACAP,MAAAA,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;AACAN,MAAAA,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;AAEA,YAAM;AAAEE,QAAAA;AAAF,UAAoBT,GAAG,CAACU,OAA9B;;AACA,UAAIjF,gBAAEC,KAAF,CAAQ+E,aAAR,CAAJ,EAA4B;AAC1B1F,QAAAA,KAAK,CAAC,uCAAD,CAAL;AACA,eAAOgD,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkB0C,aAAlB,CAAL,EAAuC;AACrC1F,QAAAA,KAAK,CAAC,kDAAD,CAAL;AACA,eAAOgD,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;;AACD,YAAM;AAAEtF,QAAAA,MAAF;AAAUuF,QAAAA;AAAV,UAAuB,KAAK3F,MAAlC;;AAEA,UAAI,yBAAY2F,QAAZ,CAAJ,EAA2B;AACzB9F,QAAAA,KAAK,CAAC,wCAAD,CAAL;;AACA,aAAK+F,oBAAL,CAA0Bd,GAA1B,EAA+Ba,QAA/B,EAAyCvF,MAAzC,EAAiDmF,aAAjD,EAAgE1C,IAAhE;AACD,OAHD,MAGO;AACLhD,QAAAA,KAAK,CAAC,qCAAD,CAAL;;AACA,aAAKgG,uBAAL,CAA6Bf,GAA7B,EAAkCa,QAAlC,EAA4CvF,MAA5C,EAAoDmF,aAApD,EAAmE1C,IAAnE;AACD;AACF,KA5CD;AA6CD;;AAEOgD,EAAAA,uBAAuB,CAC7Bf,GAD6B,EAE7Ba,QAF6B,EAG7BvF,MAH6B,EAI7BmF,aAJ6B,EAK7B1C,IAL6B,EAMvB;AACNhD,IAAAA,KAAK,CAAC,2BAAD,CAAL;AACA,UAAM;AAAEiG,MAAAA,MAAF;AAAUvD,MAAAA;AAAV,QAAoB,kCAAqBgD,aAArB,CAA1B;;AACA,QAAIO,MAAM,CAACC,WAAP,OAAyBC,kBAAYD,WAAZ,EAA7B,EAAwD;AACtDlG,MAAAA,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;AACA,YAAMoG,WAAW,GAAG,oCAAuB1D,KAAvB,EAA8B2D,QAA9B,EAApB;AACA,YAAM;AAAE1C,QAAAA,IAAF;AAAQ9B,QAAAA;AAAR,UAAqB,8BAAkBuE,WAAlB,CAA3B;AACApG,MAAAA,KAAK,CAAC,mBAAD,EAAsB2D,IAAtB,CAAL;AACA,WAAKpC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkC,CAACU,GAAD,EAAMoB,IAAN,KAAqB;AACrD,YAAI,CAACpB,GAAL,EAAU;AACRvC,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAiF,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACAX,UAAAA,IAAI;AACL,SAJD,MAIO;AACLhD,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAiF,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAtC,UAAAA,IAAI,CAACT,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAjBD,MAiBO;AACLvC,MAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,YAAMoG,WAAgB,GAAG,sCAAyBN,QAAzB,EAAmCvF,MAAnC,EAA2CmF,aAA3C,CAAzB;;AACA,UAAIU,WAAJ,EAAiB;AACf;AACAnB,QAAAA,GAAG,CAACK,WAAJ,GAAkBc,WAAlB;AACApG,QAAAA,KAAK,CAAC,0BAAD,CAAL;AACAgD,QAAAA,IAAI;AACL,OALD,MAKO;AACL;AACAhD,QAAAA,KAAK,CAAC,mBAAD,CAAL;AACAgD,QAAAA,IAAI,CAACb,iBAAWmE,YAAX,CAAwB9C,gBAAU+C,qBAAlC,CAAD,CAAJ;AACD;AACF;AACF;;AAEOR,EAAAA,oBAAoB,CAC1Bd,GAD0B,EAE1Ba,QAF0B,EAG1BvF,MAH0B,EAI1BmF,aAJ0B,EAK1B1C,IAL0B,EAMpB;AACNhD,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACAA,IAAAA,KAAK,CAAC,0BAAD,EAA6BO,MAA7B,CAAL;AACAP,IAAAA,KAAK,CAAC,iCAAD,EAAoC0F,aAApC,CAAL;AACA,UAAMU,WAAgB,GAAG,sCAAyBN,QAAzB,EAAmCvF,MAAnC,EAA2CmF,aAA3C,CAAzB;AACA1F,IAAAA,KAAK,CAAC,+BAAD,EAAkCoG,WAAlC,CAAL;;AACA,QAAIA,WAAJ,EAAiB;AACf,YAAM;AAAEzC,QAAAA,IAAF;AAAQ9B,QAAAA;AAAR,UAAqBuE,WAA3B;AACApG,MAAAA,KAAK,CAAC,mBAAD,EAAsB2D,IAAtB,CAAL;AACA,WAAKpC,YAAL,CAAkBoC,IAAlB,EAAwB9B,QAAxB,EAAkC,CAACU,GAAD,EAAMoB,IAAN,KAAqB;AACrD,YAAI,CAACpB,GAAL,EAAU;AACR0C,UAAAA,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;AACA3D,UAAAA,KAAK,CAAC,0BAAD,CAAL;AACAgD,UAAAA,IAAI;AACL,SAJD,MAIO;AACLiC,UAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACAtF,UAAAA,KAAK,CAAC,2BAAD,CAAL;AACAgD,UAAAA,IAAI,CAACT,GAAD,CAAJ;AACD;AACF,OAVD;AAWD,KAdD,MAcO;AACL;AACAvC,MAAAA,KAAK,CAAC,uBAAD,CAAL;AACA,aAAOgD,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;AACF;;AAEON,EAAAA,kBAAkB,CAACD,WAAD,EAAmC;AAC3D,WAAO5E,gBAAE8F,WAAF,CAAclB,WAAd,MAA+B,KAA/B,IAAwC5E,gBAAE8F,WAAF,CAAclB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;AACD;AAED;AACF;AACA;;;AACSqC,EAAAA,kBAAkB,GAAa;AACpC,WAAO,CAACxB,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;AAC/E,UAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;AAC5C,eAAOH,KAAK,EAAZ;AACD;;AAEDF,MAAAA,GAAG,CAACG,KAAJ;;AACA,YAAMpC,IAAI,GAAIT,GAAD,IAAsC;AACjD0C,QAAAA,GAAG,CAACI,MAAJ;;AACA,YAAI9C,GAAJ,EAAS;AACP;AACA2C,UAAAA,GAAG,CAACwB,MAAJ,CAAWnE,GAAG,CAACoE,UAAf,EAA2BC,IAA3B,CAAgCrE,GAAG,CAACY,OAApC;AACD;;AAED,eAAOgC,KAAK,EAAZ;AACD,OARD;;AAUA,YAAM;AAAEO,QAAAA;AAAF,UAAoBT,GAAG,CAACU,OAA9B;;AACA,UAAIjF,gBAAEC,KAAF,CAAQ+E,aAAR,CAAJ,EAA4B;AAC1B,eAAO1C,IAAI,EAAX;AACD;;AAED,UAAI,CAAC,+BAAkB0C,aAAlB,CAAL,EAAuC;AACrC,eAAO1C,IAAI,CAACb,iBAAWyD,aAAX,CAAyBpC,gBAAUqC,eAAnC,CAAD,CAAX;AACD;;AAED,YAAMnD,KAAK,GAAG,CAACgD,aAAa,IAAI,EAAlB,EAAsBmB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;AACA,UAAI,CAACpE,KAAL,EAAY;AACV,eAAOM,IAAI,EAAX;AACD;;AAED,UAAIoD,WAAJ;;AACA,UAAI;AACFA,QAAAA,WAAW,GAAG,8BAAiB1D,KAAjB,EAAwB,KAAKvC,MAAL,CAAYI,MAApC,CAAd;AACD,OAFD,CAEE,OAAOgC,GAAP,EAAiB,CACjB;AACD;;AAED,UAAI,KAAKgD,kBAAL,CAAwBa,WAAxB,CAAJ,EAA0C;AACxC,cAAM;AAAEhC,UAAAA,IAAF;AAAQlB,UAAAA;AAAR,YAAmBkD,WAAzB,CADwC,CAExC;;AACAnB,QAAAA,GAAG,CAACK,WAAJ,GAAkB,8BAAiBlB,IAAjB,EAAuBlB,MAAvB,CAAlB;AACD,OAJD,MAIO;AACL+B,QAAAA,GAAG,CAACK,WAAJ,GAAkB,wCAAlB;AACD;;AAEDtC,MAAAA,IAAI;AACL,KA9CD;AA+CD;;AAEsB,QAAV+D,UAAU,CAACpD,IAAD,EAAmBqD,WAAnB,EAAiE;AACtF,UAAM;AAAEC,MAAAA,WAAF;AAAe7C,MAAAA,IAAf;AAAqBlB,MAAAA;AAArB,QAAgCS,IAAtC;AACA3D,IAAAA,KAAK,CAAC,gBAAD,EAAmBoE,IAAnB,CAAL;AACA,UAAM8C,mBAAmB,GAAGxG,gBAAEC,KAAF,CAAQsG,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;AACA,UAAME,aAAa,GAAGzG,gBAAEC,KAAF,CAAQuC,MAAR,IAAkB+D,WAAlB,GAAgC/D,MAAM,CAACkE,MAAP,CAAcF,mBAAd,CAAtD;AACA,UAAMG,OAAmB,GAAG;AAC1BJ,MAAAA,WAAW,EAAEC,mBADa;AAE1B9C,MAAAA,IAF0B;AAG1BlB,MAAAA,MAAM,EAAEiE;AAHkB,KAA5B;AAMA,UAAMzE,KAAa,GAAG,MAAM,2BAAY2E,OAAZ,EAAqB,KAAK9G,MAA1B,EAAkCyG,WAAlC,CAA5B;AAEA,WAAOtE,KAAP;AACD;AAED;AACF;AACA;;;AACS4E,EAAAA,UAAU,CAACC,KAAD,EAA+B;AAC9C,WAAO,6BAAWA,KAAX,EAAkB,KAAKhH,MAAvB,CAAP;AACD;;AApgByB","sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport { loadPlugin } from '@verdaccio/loaders';\nimport {\n  AllowAccess,\n  AuthPluginPackage,\n  Callback,\n  Config,\n  IPluginAuth,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  PluginOptions,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\n/* eslint-disable @typescript-eslint/no-var-requires */\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n  config: T & Config;\n  authenticate(user: string, password: string, cb: Callback): void;\n  invalidateToken?(token: string): Promise<void>;\n  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n  config: Config;\n  logger: Logger;\n  secret: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  plugins: any[];\n  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  invalidateToken(token: string): Promise<void>;\n}\n\nclass Auth implements IAuth {\n  public config: Config;\n  public logger: Logger;\n  public secret: string;\n  public plugins: IPluginAuth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.logger = LoggerApi.logger.child({ sub: 'auth' });\n    this.secret = config.secret;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n\n    this.plugins =\n      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin(config: Config) {\n    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };\n    const pluginOptions: PluginOptions<{}> = {\n      config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(plugingConf, pluginOptions as any as PluginOptions<HTPasswdConfig>);\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private _loadPlugin(config: Config): IPluginAuth<Config>[] {\n    const pluginOptions = {\n      config,\n      logger: this.logger,\n    };\n\n    return loadPlugin<IPluginAuth<Config>>(\n      config,\n      config.auth,\n      pluginOptions,\n      (plugin: IPluginAuth<Config>): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        // @ts-ignore\n        return authenticate || allow_access || allow_publish;\n      }\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(username: string, password: string, cb: Callback): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(user: string, password: string, cb: Callback): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n      let method = 'adduser';\n      if (isFunction(plugin[method]) === false) {\n        method = 'add_user';\n        self.logger.warn(\n          'the plugin method add_user in the auth plugin is deprecated and will' +\n            ' be removed in next major release, notify to the plugin author'\n        );\n      }\n\n      if (isFunction(plugin[method]) === false) {\n        next();\n      } else {\n        // p.add_user() execution\n        plugin[method](user, password, function (err, ok): void {\n          if (err) {\n            debug('the user  %o could not being added. Error: %o', user, err?.message);\n            return cb(err);\n          }\n          if (ok) {\n            debug('the user %o has been added', user);\n            return self.authenticate(user, password, cb);\n          }\n          next();\n        });\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAcces,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (isFunction(plugin?.allow_publish) === false) {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      // @ts-ignore\n      plugin.allow_publish(\n        user,\n        // @ts-ignore\n        pkg,\n        // @ts-ignore\n        (err: VerdaccioError, ok: boolean): void => {\n          if (_.isNil(err) === false && _.isError(err)) {\n            debug('forbidden publish for %o', packageName);\n            return callback(err);\n          }\n\n          if (ok) {\n            debug('allowed publish for %o', packageName);\n            return callback(null, ok);\n          }\n\n          debug('allow publish skip validation for %o', packageName);\n          next(); // cb(null, false) causes next plugin to roll\n        }\n      );\n    })();\n  }\n\n  public apiJWTmiddleware(): Function {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      req.pause();\n\n      const next = function (err: VerdaccioError | void): void {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', secret);\n    debug('api middleware authorization %o', authorization);\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): Function {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials;\n        // $FlowFixMe\n        req.remote_user = createRemoteUser(name, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"file":"auth.js"}

package/build/jwt-token.js

@@ -24,7 +24,9 @@ const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
 async function signPayload(payload, secretOrPrivateKey, options = {}) {
   return new Promise(function (resolve, reject) {
     debug('sign jwt token');
-    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey, {
+    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey, // FIXME: upgrade to the latest library and types
+    // @ts-ignore
+    {
       // 1 === 1ms (one millisecond)
       notBefore: '1',
       // Make sure the time will not rollback :)

package/build/jwt-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/jwt-token.ts"],"names":["debug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"mappings":";;;;;;;;AAAA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,oBAAW,0BAAX,CAAd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACO,eAAeC,WAAf,CACLC,OADK,EAELC,kBAFK,EAGLC,OAAuB,GAAG,EAHrB,EAIY;AACjB,SAAO,IAAIC,OAAJ,CAAY,UAAUC,OAAV,EAAmBC,MAAnB,EAA4C;AAC7DP,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,WAAOQ,sBAAIC,IAAJ,CACLP,OADK,EAELC,kBAFK,EAGL;AACE;AACAO,MAAAA,SAAS,EAAE,GAFb;AAEkB;AAChB,SAAGN;AAHL,KAHK,EAQL,CAACO,KAAD,EAAQC,KAAR,KAAkB;AAChBZ,MAAAA,KAAK,CAAC,yBAAD,CAAL;AACA,aAAOW,KAAK,GAAGJ,MAAM,CAACI,KAAD,CAAT,GAAmBL,OAAO,CAACM,KAAD,CAAtC;AACD,KAXI,CAAP;AAaD,GAfM,CAAP;AAgBD;;AAEM,SAASC,aAAT,CAAuBD,KAAvB,EAAsCT,kBAAtC,EAA8E;AACnFH,EAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,SAAOQ,sBAAIM,MAAJ,CAAWF,KAAX,EAAkBT,kBAAlB,CAAP;AACD","sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey);\n}\n"],"file":"jwt-token.js"}
+{"version":3,"sources":["../src/jwt-token.ts"],"names":["debug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"mappings":";;;;;;;;AAAA;;AACA;;;;AAIA,MAAMA,KAAK,GAAG,oBAAW,0BAAX,CAAd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AACO,eAAeC,WAAf,CACLC,OADK,EAELC,kBAFK,EAGLC,OAAuB,GAAG,EAHrB,EAIY;AACjB,SAAO,IAAIC,OAAJ,CAAY,UAAUC,OAAV,EAAmBC,MAAnB,EAA4C;AAC7DP,IAAAA,KAAK,CAAC,gBAAD,CAAL;AACA,WAAOQ,sBAAIC,IAAJ,CACLP,OADK,EAELC,kBAFK,EAGL;AACA;AACA;AACE;AACAO,MAAAA,SAAS,EAAE,GAFb;AAEkB;AAChB,SAAGN;AAHL,KALK,EAUL,CAACO,KAAD,EAAQC,KAAR,KAA0B;AACxBZ,MAAAA,KAAK,CAAC,yBAAD,CAAL;AACA,aAAOW,KAAK,GAAGJ,MAAM,CAACI,KAAD,CAAT,GAAmBL,OAAO,CAACM,KAAD,CAAtC;AACD,KAbI,CAAP;AAeD,GAjBM,CAAP;AAkBD;;AAEM,SAASC,aAAT,CAAuBD,KAAvB,EAAsCT,kBAAtC,EAA8E;AACnFH,EAAAA,KAAK,CAAC,kBAAD,CAAL;AACA,SAAOQ,sBAAIM,MAAJ,CAAWF,KAAX,EAAkBT,kBAAlB,CAAP;AACD","sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      // FIXME: upgrade to the latest library and types\n      // @ts-ignore\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token: string) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"file":"jwt-token.js"}

package/build/legacy-token.js

@@ -61,7 +61,8 @@ function aesDecrypt(value, key) {
     const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
     const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key; // decipher the string
 
-    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV);
+    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV); // FIXME: fix type here should allow Buffer
+
     let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
     debug('token decrypted successfully');

package/build/legacy-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/legacy-token.ts"],"names":["debug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","decrypted","_"],"mappings":";;;;;;;;;AAAA;;AAOA;;AAEA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,aAAsC,GAAG,MAA/C;AACA,MAAMC,cAAuC,GAAG,KAAhD,C,CACA;;AACA,MAAMC,SAAS,GAAG,EAAlB,C,CACA;AACA;;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAR,CAAYK,+BAApD;;AAEO,SAASC,UAAT,CAAoBC,KAApB,EAAmCC,GAAnC,EAA+D;AACpE;AACA;AACAX,EAAAA,KAAK,CAAC,YAAD,EAAeU,KAAf,CAAL;AACAV,EAAAA,KAAK,CAAC,cAAD,EAAiBC,gBAAjB,CAAL;AACA,QAAMW,EAAE,GAAGC,MAAM,CAACC,IAAP,CAAY,yBAAYP,SAAZ,CAAZ,CAAX;AACA,QAAMQ,SAAS,GAAGP,+BAA+B,IAAIG,GAArD;AACA,QAAMK,UAAU,GAAG,CAAAD,SAAS,SAAT,IAAAA,SAAS,WAAT,YAAAA,SAAS,CAAEE,MAAX,MAAsBC,0BAAzC;AACAlB,EAAAA,KAAK,CAAC,sBAAD,EAAyBe,SAAzB,aAAyBA,SAAzB,uBAAyBA,SAAS,CAAEE,MAApC,CAAL;AACAjB,EAAAA,KAAK,CAAC,oBAAD,EAAuBgB,UAAvB,CAAL;;AACA,MAAI,CAACN,KAAD,IAAU,CAACK,SAAX,IAAwB,CAACC,UAA7B,EAAyC;AACvC;AACD;;AAED,QAAMG,MAAM,GAAG,4BAAelB,gBAAf,EAAiCc,SAAjC,EAA4CH,EAA5C,CAAf;AACA,MAAIQ,SAAS,GAAGD,MAAM,CAACE,MAAP,CAAcX,KAAd,EAAqBL,aAArB,EAAoCC,cAApC,CAAhB,CAfoE,CAgBpE;;AACAc,EAAAA,SAAS,IAAID,MAAM,CAACG,KAAP,CAAahB,cAAb,CAAb;AACA,QAAMiB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAH,CAAY,KAAZ,CAAmB,IAAGJ,SAAS,CAACI,QAAV,EAAqB,EAA5D;AACAxB,EAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,SAAOa,MAAM,CAACC,IAAP,CAAYS,KAAZ,EAAmBC,QAAnB,CAA4B,QAA5B,CAAP;AACD;;AAEM,SAASC,UAAT,CAAoBf,KAApB,EAAmCC,GAAnC,EAA+D;AACpE,MAAI;AACF,UAAMe,IAAI,GAAGb,MAAM,CAACC,IAAP,CAAYJ,KAAZ,EAAmB,QAAnB,CAAb;AACA,UAAMiB,SAAS,GAAGD,IAAI,CAACF,QAAL,GAAgBI,KAAhB,CAAsB,GAAtB,CAAlB,CAFE,CAIF;AACA;;AACA,UAAMC,EAAE,GAAGhB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACG,KAAV,EAAZ,EAA+BxB,cAA/B,CAAX,CANE,CAOF;;AACA,UAAMyB,aAAa,GAAGlB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACK,IAAV,CAAe,GAAf,CAAZ,EAAiC1B,cAAjC,CAAtB;AACA,UAAMS,SAAS,GAAGP,+BAA+B,IAAIG,GAArD,CATE,CAUF;;AACA,UAAMsB,QAAQ,GAAG,8BAAiBhC,gBAAjB,EAAmCc,SAAnC,EAA8Cc,EAA9C,CAAjB;AACA,QAAIK,SAAS,GAAGD,QAAQ,CAACZ,MAAT,CAAgBU,aAAhB,EAA+BzB,cAA/B,EAA+CD,aAA/C,CAAhB;AACA6B,IAAAA,SAAS,IAAID,QAAQ,CAACX,KAAT,CAAejB,aAAf,CAAb;AACAL,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,WAAOkC,SAAS,CAACV,QAAV,EAAP;AACD,GAhBD,CAgBE,OAAOW,CAAP,EAAe;AACf;AACD;AACF","sourcesContent":["import {\n  HexBase64BinaryEncoding,\n  Utf8AsciiBinaryEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: Utf8AsciiBinaryEncoding = 'utf8';\nconst outputEncoding: HexBase64BinaryEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"file":"legacy-token.js"}
+{"version":3,"sources":["../src/legacy-token.ts"],"names":["debug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","decrypted","_"],"mappings":";;;;;;;;;AAAA;;AAOA;;AAEA;;;;AAEA,MAAMA,KAAK,GAAG,oBAAW,6BAAX,CAAd;AAEO,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAR,CAAYC,0BAAZ,IAA0C,aAAnE;;AACP,MAAMC,aAAgC,GAAG,MAAzC;AACA,MAAMC,cAAoC,GAAG,KAA7C,C,CACA;;AACA,MAAMC,SAAS,GAAG,EAAlB,C,CACA;AACA;;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAR,CAAYK,+BAApD;;AAEO,SAASC,UAAT,CAAoBC,KAApB,EAAmCC,GAAnC,EAA+D;AACpE;AACA;AACAX,EAAAA,KAAK,CAAC,YAAD,EAAeU,KAAf,CAAL;AACAV,EAAAA,KAAK,CAAC,cAAD,EAAiBC,gBAAjB,CAAL;AACA,QAAMW,EAAE,GAAGC,MAAM,CAACC,IAAP,CAAY,yBAAYP,SAAZ,CAAZ,CAAX;AACA,QAAMQ,SAAS,GAAGP,+BAA+B,IAAIG,GAArD;AACA,QAAMK,UAAU,GAAG,CAAAD,SAAS,SAAT,IAAAA,SAAS,WAAT,YAAAA,SAAS,CAAEE,MAAX,MAAsBC,0BAAzC;AACAlB,EAAAA,KAAK,CAAC,sBAAD,EAAyBe,SAAzB,aAAyBA,SAAzB,uBAAyBA,SAAS,CAAEE,MAApC,CAAL;AACAjB,EAAAA,KAAK,CAAC,oBAAD,EAAuBgB,UAAvB,CAAL;;AACA,MAAI,CAACN,KAAD,IAAU,CAACK,SAAX,IAAwB,CAACC,UAA7B,EAAyC;AACvC;AACD;;AAED,QAAMG,MAAM,GAAG,4BAAelB,gBAAf,EAAiCc,SAAjC,EAA4CH,EAA5C,CAAf;AACA,MAAIQ,SAAS,GAAGD,MAAM,CAACE,MAAP,CAAcX,KAAd,EAAqBL,aAArB,EAAoCC,cAApC,CAAhB,CAfoE,CAgBpE;;AACAc,EAAAA,SAAS,IAAID,MAAM,CAACG,KAAP,CAAahB,cAAb,CAAb;AACA,QAAMiB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAH,CAAY,KAAZ,CAAmB,IAAGJ,SAAS,CAACI,QAAV,EAAqB,EAA5D;AACAxB,EAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,SAAOa,MAAM,CAACC,IAAP,CAAYS,KAAZ,EAAmBC,QAAnB,CAA4B,QAA5B,CAAP;AACD;;AAEM,SAASC,UAAT,CAAoBf,KAApB,EAAmCC,GAAnC,EAA+D;AACpE,MAAI;AACF,UAAMe,IAAI,GAAGb,MAAM,CAACC,IAAP,CAAYJ,KAAZ,EAAmB,QAAnB,CAAb;AACA,UAAMiB,SAAS,GAAGD,IAAI,CAACF,QAAL,GAAgBI,KAAhB,CAAsB,GAAtB,CAAlB,CAFE,CAIF;AACA;;AACA,UAAMC,EAAE,GAAGhB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACG,KAAV,EAAZ,EAA+BxB,cAA/B,CAAX,CANE,CAOF;;AACA,UAAMyB,aAAa,GAAGlB,MAAM,CAACC,IAAP,CAAYa,SAAS,CAACK,IAAV,CAAe,GAAf,CAAZ,EAAiC1B,cAAjC,CAAtB;AACA,UAAMS,SAAS,GAAGP,+BAA+B,IAAIG,GAArD,CATE,CAUF;;AACA,UAAMsB,QAAQ,GAAG,8BAAiBhC,gBAAjB,EAAmCc,SAAnC,EAA8Cc,EAA9C,CAAjB,CAXE,CAYF;;AACA,QAAIK,SAAS,GAAGD,QAAQ,CAACZ,MAAT,CAAgBU,aAAhB,EAAsCzB,cAAtC,EAAsDD,aAAtD,CAAhB;AACA6B,IAAAA,SAAS,IAAID,QAAQ,CAACX,KAAT,CAAejB,aAAf,CAAb;AACAL,IAAAA,KAAK,CAAC,8BAAD,CAAL;AACA,WAAOkC,SAAS,CAACV,QAAV,EAAP;AACD,GAjBD,CAiBE,OAAOW,CAAP,EAAe;AACf;AACD;AACF","sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"file":"legacy-token.js"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@verdaccio/auth",
-	"version": "6.0.0-6-next.16",
+	"version": "6.0.0-6-next.19",
 	"description": "logger",
 	"main": "./build/index.js",
 	"types": "build/index.d.ts",
@@ -32,14 +32,14 @@
 	"dependencies": {
 		"@verdaccio/core": "6.0.0-6-next.4",
 		"@verdaccio/config": "6.0.0-6-next.12",
-		"@verdaccio/loaders": "6.0.0-6-next.8",
-		"@verdaccio/logger": "6.0.0-6-next.8",
+		"@verdaccio/loaders": "6.0.0-6-next.10",
+		"@verdaccio/logger": "6.0.0-6-next.10",
 		"@verdaccio/utils": "6.0.0-6-next.10",
 		"debug": "4.3.3",
-		"express": "4.17.1",
+		"express": "4.17.2",
 		"jsonwebtoken": "8.5.1",
 		"lodash": "4.17.21",
-		"verdaccio-htpasswd": "11.0.0-6-next.11"
+		"verdaccio-htpasswd": "11.0.0-6-next.12"
 	},
 	"devDependencies": {
 		"@verdaccio/mock": "6.0.0-6-next.13",

package/src/auth.ts

@@ -111,7 +111,7 @@ class Auth implements IAuth {
     };
     let authPlugin;
     try {
-      authPlugin = new HTPasswd(plugingConf, pluginOptions);
+      authPlugin = new HTPasswd(plugingConf, pluginOptions as any as PluginOptions<HTPasswdConfig>);
     } catch (error: any) {
       debug('error on loading auth htpasswd plugin stack: %o', error);
       return [];

package/src/jwt-token.ts

@@ -21,12 +21,14 @@ export async function signPayload(
     return jwt.sign(
       payload,
       secretOrPrivateKey,
+      // FIXME: upgrade to the latest library and types
+      // @ts-ignore
       {
         // 1 === 1ms (one millisecond)
         notBefore: '1', // Make sure the time will not rollback :)
         ...options,
       },
-      (error, token) => {
+      (error, token: string) => {
         debug('error on sign jwt token');
         return error ? reject(error) : resolve(token);
       }
@@ -36,5 +38,5 @@ export async function signPayload(
 
 export function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {
   debug('verify jwt token');
-  return jwt.verify(token, secretOrPrivateKey);
+  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;
 }

package/src/legacy-token.ts

@@ -1,6 +1,6 @@
 import {
-  HexBase64BinaryEncoding,
-  Utf8AsciiBinaryEncoding,
+  BinaryToTextEncoding,
+  CharacterEncoding,
   createCipheriv,
   createDecipheriv,
   randomBytes,
@@ -12,8 +12,8 @@ import { TOKEN_VALID_LENGTH } from '@verdaccio/config';
 const debug = buildDebug('verdaccio:auth:token:legacy');
 
 export const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
-const inputEncoding: Utf8AsciiBinaryEncoding = 'utf8';
-const outputEncoding: HexBase64BinaryEncoding = 'hex';
+const inputEncoding: CharacterEncoding = 'utf8';
+const outputEncoding: BinaryToTextEncoding = 'hex';
 // For AES, this is always 16
 const IV_LENGTH = 16;
 // Must be 256 bits (32 characters)
@@ -56,7 +56,8 @@ export function aesDecrypt(value: string, key: string): string | void {
     const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
     // decipher the string
     const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);
-    let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
+    // FIXME: fix type here should allow Buffer
+    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
     debug('token decrypted successfully');
     return decrypted.toString();