@verdaccio/auth 6.0.0-6-next.25 → 6.0.0-6-next.27

package/CHANGELOG.md

@@ -1,5 +1,92 @@
 # @verdaccio/auth
 
+## 6.0.0-6-next.27
+
+### Major Changes
+
+- 9fc2e796: feat(plugins): improve plugin loader
+
+  ### Changes
+
+  - Add scope plugin support to 6.x https://github.com/verdaccio/verdaccio/pull/3227
+  - Avoid config collisions https://github.com/verdaccio/verdaccio/issues/928
+  - https://github.com/verdaccio/verdaccio/issues/1394
+  - `config.plugins` plugin path validations
+  - Updated algorithm for plugin loader.
+  - improved documentation (included dev)
+
+  ## Features
+
+  - Add scope plugin support to 6.x https://github.com/verdaccio/verdaccio/pull/3227
+  - Custom prefix:
+
+  ```
+  // config.yaml
+  server:
+    pluginPrefix: mycompany
+  middleware:
+    audit:
+        foo: 1
+  ```
+
+  This configuration will look up for `mycompany-audit` instead `Verdaccio-audit`.
+
+  ## Breaking Changes
+
+  ### sinopia plugins
+
+  - `sinopia` fallback support is removed, but can be restored using `pluginPrefix`
+
+  ### plugin filter
+
+  - method rename `filter_metadata`->`filterMetadata`
+
+  ### Plugin constructor does not merge configs anymore https://github.com/verdaccio/verdaccio/issues/928
+
+  The plugin receives as first argument `config`, which represents the config of the plugin. Example:
+
+  ```
+  // config.yaml
+  auth:
+    plugin:
+       foo: 1
+       bar: 2
+
+  export class Plugin<T> {
+    public constructor(config: T, options: PluginOptions) {
+      console.log(config);
+      // {foo:1, bar: 2}
+   }
+  }
+  ```
+
+### Minor Changes
+
+- 62c24b63: feat: add passwordValidationRegex property
+
+### Patch Changes
+
+- Updated dependencies [43f32687]
+- Updated dependencies [9fc2e796]
+- Updated dependencies [62c24b63]
+  - @verdaccio/core@6.0.0-6-next.48
+  - @verdaccio/config@6.0.0-6-next.48
+  - @verdaccio/loaders@6.0.0-6-next.17
+  - verdaccio-htpasswd@11.0.0-6-next.18
+  - @verdaccio/utils@6.0.0-6-next.16
+  - @verdaccio/logger@6.0.0-6-next.16
+
+## 6.0.0-6-next.26
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.47
+- @verdaccio/config@6.0.0-6-next.47
+- @verdaccio/loaders@6.0.0-6-next.16
+- @verdaccio/logger@6.0.0-6-next.15
+- verdaccio-htpasswd@11.0.0-6-next.17
+- @verdaccio/utils@6.0.0-6-next.15
+
 ## 6.0.0-6-next.25
 
 ### Patch Changes

package/build/auth.d.ts

@@ -35,6 +35,7 @@ export interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncrypt
     plugins: any[];
     allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
     invalidateToken(token: string): Promise<void>;
+    init(): Promise<void>;
 }
 declare class Auth implements IAuth {
     config: Config;
@@ -42,8 +43,9 @@ declare class Auth implements IAuth {
     secret: string;
     plugins: IPluginAuth<Config>[];
     constructor(config: Config);
+    init(): Promise<void>;
     private loadDefaultPlugin;
-    private _loadPlugin;
+    private loadPlugin;
     private _applyDefaultPlugins;
     changePassword(username: string, password: string, newPassword: string, cb: Callback): void;
     invalidateToken(token: string): Promise<void>;

package/build/auth.js

@@ -41,28 +41,38 @@ class Auth {
       sub: 'auth'
     });
     this.secret = config.secret;
+    this.plugins = [];
 
     if (!this.secret) {
       throw new TypeError('secret it is required value on initialize the auth class');
     }
+  }
+
+  async init() {
+    let plugins = await this.loadPlugin();
+    debug('auth plugins found %s', plugins.length);
 
-    this.plugins = _lodash.default.isNil(config === null || config === void 0 ? void 0 : config.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);
+    if (!plugins || plugins.length === 0) {
+      plugins = this.loadDefaultPlugin();
+    }
+
+    this.plugins = plugins;
 
     this._applyDefaultPlugins();
   }
 
-  loadDefaultPlugin(config) {
-    const plugingConf = { ...config,
-      file: './htpasswd'
-    };
+  loadDefaultPlugin() {
+    debug('load default auth plugin');
     const pluginOptions = {
-      config,
+      config: this.config,
       logger: this.logger
     };
     let authPlugin;
 
     try {
-      authPlugin = new _verdaccioHtpasswd.HTPasswd(plugingConf, pluginOptions);
+      authPlugin = new _verdaccioHtpasswd.HTPasswd({
+        file: './htpasswd'
+      }, pluginOptions);
     } catch (error) {
       debug('error on loading auth htpasswd plugin stack: %o', error);
       return [];
@@ -71,12 +81,13 @@ class Auth {
     return [authPlugin];
   }
 
-  _loadPlugin(config) {
-    const pluginOptions = {
-      config,
+  async loadPlugin() {
+    var _this$config, _this$config$serverSe;
+
+    return (0, _loaders.asyncLoadPlugin)(this.config.auth, {
+      config: this.config,
       logger: this.logger
-    };
-    return (0, _loaders.loadPlugin)(config, config.auth, pluginOptions, plugin => {
+    }, plugin => {
       const {
         authenticate,
         allow_access,
@@ -84,7 +95,7 @@ class Auth {
       } = plugin; // @ts-ignore
 
       return authenticate || allow_access || allow_publish;
-    });
+    }, (_this$config = this.config) === null || _this$config === void 0 ? void 0 : (_this$config$serverSe = _this$config.serverSettings) === null || _this$config$serverSe === void 0 ? void 0 : _this$config$serverSe.pluginPrefix);
   }
 
   _applyDefaultPlugins() {

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["LoggerApi","require","debug","buildDebug","Auth","constructor","config","logger","child","sub","secret","TypeError","plugins","_","isNil","auth","_loadPlugin","loadDefaultPlugin","_applyDefaultPlugins","plugingConf","file","pluginOptions","authPlugin","HTPasswd","error","loadPlugin","plugin","authenticate","allow_access","allow_publish","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","length","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport { loadPlugin } from '@verdaccio/loaders';\nimport {\n  AllowAccess,\n  AuthPluginPackage,\n  Callback,\n  Config,\n  IPluginAuth,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  PluginOptions,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\n/* eslint-disable @typescript-eslint/no-var-requires */\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n  config: T & Config;\n  authenticate(user: string, password: string, cb: Callback): void;\n  invalidateToken?(token: string): Promise<void>;\n  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n  config: Config;\n  logger: Logger;\n  secret: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  plugins: any[];\n  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  invalidateToken(token: string): Promise<void>;\n}\n\nclass Auth implements IAuth {\n  public config: Config;\n  public logger: Logger;\n  public secret: string;\n  public plugins: IPluginAuth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.logger = LoggerApi.logger.child({ sub: 'auth' });\n    this.secret = config.secret;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n\n    this.plugins =\n      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin(config: Config) {\n    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };\n    const pluginOptions: PluginOptions<{}> = {\n      config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(plugingConf, pluginOptions as any as PluginOptions<HTPasswdConfig>);\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private _loadPlugin(config: Config): IPluginAuth<Config>[] {\n    const pluginOptions = {\n      config,\n      logger: this.logger,\n    };\n\n    return loadPlugin<IPluginAuth<Config>>(\n      config,\n      config.auth,\n      pluginOptions,\n      (plugin: IPluginAuth<Config>): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        // @ts-ignore\n        return authenticate || allow_access || allow_publish;\n      }\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(username: string, password: string, cb: Callback): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(user: string, password: string, cb: Callback): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n      let method = 'adduser';\n      if (isFunction(plugin[method]) === false) {\n        method = 'add_user';\n        self.logger.warn(\n          'the plugin method add_user in the auth plugin is deprecated and will' +\n            ' be removed in next major release, notify to the plugin author'\n        );\n      }\n\n      if (isFunction(plugin[method]) === false) {\n        next();\n      } else {\n        // p.add_user() execution\n        plugin[method](user, password, function (err, ok): void {\n          if (err) {\n            debug('the user  %o could not being added. Error: %o', user, err?.message);\n            return cb(err);\n          }\n          if (ok) {\n            debug('the user %o has been added', user);\n            return self.authenticate(user, password, cb);\n          }\n          next();\n        });\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAcces,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (isFunction(plugin?.allow_publish) === false) {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      // @ts-ignore\n      plugin.allow_publish(\n        user,\n        // @ts-ignore\n        pkg,\n        // @ts-ignore\n        (err: VerdaccioError, ok: boolean): void => {\n          if (_.isNil(err) === false && _.isError(err)) {\n            debug('forbidden publish for %o', packageName);\n            return callback(err);\n          }\n\n          if (ok) {\n            debug('allowed publish for %o', packageName);\n            return callback(null, ok);\n          }\n\n          debug('allow publish skip validation for %o', packageName);\n          next(); // cb(null, false) causes next plugin to roll\n        }\n      );\n    })();\n  }\n\n  public apiJWTmiddleware(): Function {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      req.pause();\n\n      const next = function (err: VerdaccioError | void): void {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): Function {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials;\n        // $FlowFixMe\n        req.remote_user = createRemoteUser(name, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AAQA;;AAcA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,IAAAC,cAAA,EAAW,gBAAX,CAAd;;AAwCA,MAAMC,IAAN,CAA4B;EAMnBC,WAAW,CAACC,MAAD,EAAiB;IACjC,KAAKA,MAAL,GAAcA,MAAd;IACA,KAAKC,MAAL,GAAcP,SAAS,CAACO,MAAV,CAAiBC,KAAjB,CAAuB;MAAEC,GAAG,EAAE;IAAP,CAAvB,CAAd;IACA,KAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;;IACA,IAAI,CAAC,KAAKA,MAAV,EAAkB;MAChB,MAAM,IAAIC,SAAJ,CAAc,0DAAd,CAAN;IACD;;IAED,KAAKC,OAAL,GACEC,eAAA,CAAEC,KAAF,CAAQR,MAAR,aAAQA,MAAR,uBAAQA,MAAM,CAAES,IAAhB,MAA0B,KAA1B,GAAkC,KAAKC,WAAL,CAAiBV,MAAjB,CAAlC,GAA6D,KAAKW,iBAAL,CAAuBX,MAAvB,CAD/D;;IAEA,KAAKY,oBAAL;EACD;;EAEOD,iBAAiB,CAACX,MAAD,EAAiB;IACxC,MAAMa,WAA2B,GAAG,EAAE,GAAGb,MAAL;MAAac,IAAI,EAAE;IAAnB,CAApC;IACA,MAAMC,aAAgC,GAAG;MACvCf,MADuC;MAEvCC,MAAM,EAAE,KAAKA;IAF0B,CAAzC;IAIA,IAAIe,UAAJ;;IACA,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAJ,CAAaJ,WAAb,EAA0BE,aAA1B,CAAb;IACD,CAFD,CAEE,OAAOG,KAAP,EAAmB;MACnBtB,KAAK,CAAC,iDAAD,EAAoDsB,KAApD,CAAL;MACA,OAAO,EAAP;IACD;;IAED,OAAO,CAACF,UAAD,CAAP;EACD;;EAEON,WAAW,CAACV,MAAD,EAAwC;IACzD,MAAMe,aAAa,GAAG;MACpBf,MADoB;MAEpBC,MAAM,EAAE,KAAKA;IAFO,CAAtB;IAKA,OAAO,IAAAkB,mBAAA,EACLnB,MADK,EAELA,MAAM,CAACS,IAFF,EAGLM,aAHK,EAIJK,MAAD,IAA0C;MACxC,MAAM;QAAEC,YAAF;QAAgBC,YAAhB;QAA8BC;MAA9B,IAAgDH,MAAtD,CADwC,CAGxC;;MACA,OAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;IACD,CATI,CAAP;EAWD;;EAEOX,oBAAoB,GAAS;IACnC;IACA,KAAKN,OAAL,CAAakB,IAAb,CAAkB,IAAAC,yBAAA,EAAkB,KAAKxB,MAAvB,CAAlB;EACD;;EAEMyB,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;IACN,MAAMC,YAAY,GAAGxB,eAAA,CAAEyB,MAAF,CAAS,KAAK1B,OAAd,EAAwBc,MAAD,IAAY,IAAAa,iBAAA,EAAWb,MAAM,CAACM,cAAlB,CAAnC,CAArB;;IAEA,IAAInB,eAAA,CAAE2B,OAAF,CAAUH,YAAV,CAAJ,EAA6B;MAC3B,OAAOD,EAAE,CAACK,gBAAA,CAAWC,gBAAX,CAA4BC,oBAAA,CAAeC,wBAA3C,CAAD,CAAT;IACD;;IAED,KAAK,MAAMlB,MAAX,IAAqBW,YAArB,EAAmC;MACjC,IAAI,IAAAvB,YAAA,EAAMY,MAAN,KAAiB,IAAAa,iBAAA,EAAWb,MAAM,CAACM,cAAlB,MAAsC,KAA3D,EAAkE;QAChE9B,KAAK,CAAC,gEAAD,CAAL;QACA;MACD,CAHD,MAGO;QACLA,KAAK,CAAC,0BAAD,EAA6B+B,QAA7B,CAAL;QACAP,MAAM,CAACM,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACU,GAAD,EAAMC,OAAN,KAAwB;UAC9E,IAAID,GAAJ,EAAS;YACP,KAAKtC,MAAL,CAAYiB,KAAZ,CACE;cAAES,QAAF;cAAYY;YAAZ,CADF,EAEG;AACf,yEAHY;YAKA,OAAOT,EAAE,CAACS,GAAD,CAAT;UACD;;UAED3C,KAAK,CAAC,wCAAD,EAA2C+B,QAA3C,CAAL;UACA,OAAOG,EAAE,CAAC,IAAD,EAAOU,OAAP,CAAT;QACD,CAZD;MAaD;IACF;EACF;;EAE2B,MAAfC,eAAe,CAACC,KAAD,EAAgB;IAC1C;IACAC,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;IACA,OAAOG,OAAO,CAACC,OAAR,EAAP;EACD;;EAEMzB,YAAY,CAACM,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;IAC1E,MAAMxB,OAAO,GAAG,KAAKA,OAAL,CAAayC,KAAb,CAAmB,CAAnB,CAAhB;;IACA,CAAC,SAASC,IAAT,GAAsB;MACrB,MAAM5B,MAAM,GAAGd,OAAO,CAAC2C,KAAR,EAAf;;MAEA,IAAI,IAAAhB,iBAAA,EAAWb,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;QAC7C,OAAO2B,IAAI,EAAX;MACD;;MAEDpD,KAAK,CAAC,mBAAD,EAAsB+B,QAAtB,CAAL;MACAP,MAAM,CAACC,YAAP,CAAoBM,QAApB,EAA8BC,QAA9B,EAAwC,UAAUW,GAAV,EAAeW,MAAf,EAA6B;QACnE,IAAIX,GAAJ,EAAS;UACP3C,KAAK,CAAC,8CAAD,EAAiD+B,QAAjD,EAA2DY,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;UACA,OAAOrB,EAAE,CAACS,GAAD,CAAT;QACD,CAJkE,CAMnE;QACA;QACA;QACA;QACA;QACA;QACA;;;QACA,IAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAACE,MAAP,KAAkB,CAAlC,EAAqC;UACnC;UACA,IAAI7C,eAAA,CAAE8C,QAAF,CAAWH,MAAX,CAAJ,EAAwB;YACtB,MAAM,IAAI7C,SAAJ,CAAc,+CAAd,CAAN;UACD;;UACD,MAAMiD,YAAqB,GAAG/C,eAAA,CAAEgD,OAAF,CAAUL,MAAV,CAA9B;;UACA,IAAI,CAACI,YAAL,EAAmB;YACjB,MAAM,IAAIjD,SAAJ,CAAcmD,eAAA,CAAUC,qBAAxB,CAAN;UACD;;UAED7D,KAAK,CAAC,yDAAD,EAA4D+B,QAA5D,EAAsEuB,MAAtE,CAAL;UACA,OAAOpB,EAAE,CAACS,GAAD,EAAM,IAAAmB,wBAAA,EAAiB/B,QAAjB,EAA2BuB,MAA3B,CAAN,CAAT;QACD;;QACDF,IAAI;MACL,CA3BD;IA4BD,CApCD;EAqCD;;EAEMW,QAAQ,CAACC,IAAD,EAAehC,QAAf,EAAiCE,EAAjC,EAAqD;IAClE,MAAM+B,IAAI,GAAG,IAAb;IACA,MAAMvD,OAAO,GAAG,KAAKA,OAAL,CAAayC,KAAb,CAAmB,CAAnB,CAAhB;IACAnD,KAAK,CAAC,aAAD,EAAgBgE,IAAhB,CAAL;;IAEA,CAAC,SAASZ,IAAT,GAAsB;MACrB,MAAM5B,MAAM,GAAGd,OAAO,CAAC2C,KAAR,EAAf;MACA,IAAIa,MAAM,GAAG,SAAb;;MACA,IAAI,IAAA7B,iBAAA,EAAWb,MAAM,CAAC0C,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;QACxCA,MAAM,GAAG,UAAT;QACAD,IAAI,CAAC5D,MAAL,CAAY8D,IAAZ,CACE,yEACE,gEAFJ;MAID;;MAED,IAAI,IAAA9B,iBAAA,EAAWb,MAAM,CAAC0C,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;QACxCd,IAAI;MACL,CAFD,MAEO;QACL;QACA5B,MAAM,CAAC0C,MAAD,CAAN,CAAeF,IAAf,EAAqBhC,QAArB,EAA+B,UAAUW,GAAV,EAAeyB,EAAf,EAAyB;UACtD,IAAIzB,GAAJ,EAAS;YACP3C,KAAK,CAAC,+CAAD,EAAkDgE,IAAlD,EAAwDrB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;YACA,OAAOrB,EAAE,CAACS,GAAD,CAAT;UACD;;UACD,IAAIyB,EAAJ,EAAQ;YACNpE,KAAK,CAAC,4BAAD,EAA+BgE,IAA/B,CAAL;YACA,OAAOC,IAAI,CAACxC,YAAL,CAAkBuC,IAAlB,EAAwBhC,QAAxB,EAAkCE,EAAlC,CAAP;UACD;;UACDkB,IAAI;QACL,CAVD;MAWD;IACF,CA3BD;EA4BD;EAED;AACF;AACA;;;EACS1B,YAAY,CACjB;IAAE2C,WAAF;IAAeC;EAAf,CADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;IACN,MAAM7D,OAAO,GAAG,KAAKA,OAAL,CAAayC,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMqB,aAA0B,GAAG;MAAEC,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CAAnC;IACA,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,IAAAM,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAHU,CAAZ;IAKA/E,KAAK,CAAC,qBAAD,EAAwBqE,WAAxB,CAAL;;IAEA,CAAC,SAASjB,IAAT,GAAsB;MACrB,MAAM5B,MAA2B,GAAGd,OAAO,CAAC2C,KAAR,EAApC;;MAEA,IAAI1C,eAAA,CAAEC,KAAF,CAAQY,MAAR,KAAmB,IAAAa,iBAAA,EAAWb,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;QAChE,OAAO0B,IAAI,EAAX;MACD;;MAED5B,MAAM,CAACE,YAAP,CAAqBsC,IAArB,EAA2BW,GAA3B,EAAgC,UAAUhC,GAAV,EAAeyB,EAAf,EAAkC;QAChE,IAAIzB,GAAJ,EAAS;UACP3C,KAAK,CAAC,oCAAD,EAAuCqE,WAAvC,EAAoD1B,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;UACA,OAAOgB,QAAQ,CAAC5B,GAAD,CAAf;QACD;;QAED,IAAIyB,EAAJ,EAAQ;UACNpE,KAAK,CAAC,uBAAD,EAA0BqE,WAA1B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDhB,IAAI,GAX4D,CAWxD;MACT,CAZD;IAaD,CApBD;EAqBD;;EAEM4B,eAAe,CACpB;IAAEX,WAAF;IAAeC;EAAf,CADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAFU,CAAZ;IAIA/E,KAAK,CAAC,wBAAD,EAA2BqE,WAA3B,CAAL;;IAEA,KAAK,MAAM7C,MAAX,IAAqB,KAAKd,OAA1B,EAAmC;MACjC,IAAIC,eAAA,CAAEC,KAAF,CAAQY,MAAR,KAAmB,IAAAa,iBAAA,EAAWb,MAAM,CAACwD,eAAlB,MAAuC,KAA9D,EAAqE;QACnEhF,KAAK,CAAC,kEAAD,EAAqEqE,WAArE,CAAL;QACA;MACD,CAHD,MAGO;QACL;QACA7C,MAAM,CAACwD,eAAP,CAAwBhB,IAAxB,EAA8BW,GAA9B,EAAmC,CAAChC,GAAD,EAAMyB,EAAN,KAA4B;UAC7D,IAAIzB,GAAJ,EAAS;YACP3C,KAAK,CACH,qEADG,EAEHqE,WAFG,CAAL;YAIA,OAAOE,QAAQ,CAAC5B,GAAD,CAAf;UACD;;UAED,IAAIhC,eAAA,CAAEC,KAAF,CAAQwD,EAAR,MAAgB,IAApB,EAA0B;YACxBpE,KAAK,CAAC,yDAAD,EAA4DqE,WAA5D,CAAL,CADwB,CAExB;YACA;;YACA,OAAO,KAAK1C,aAAL,CAAmB,GAAGsD,SAAtB,CAAP;UACD;;UAED,IAAIb,EAAJ,EAAQ;YACNpE,KAAK,CAAC,0BAAD,EAA6BqE,WAA7B,CAAL;YACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;UACD;QACF,CApBD;MAqBD;IACF;EACF;EAED;AACF;AACA;;;EACSzC,aAAa,CAClB;IAAE0C,WAAF;IAAeC;EAAf,CADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;IACN,MAAM7D,OAAO,GAAG,KAAKA,OAAL,CAAayC,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMwB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAFU,CAAZ;IAIA/E,KAAK,CAAC,yCAAD,EAA4CqE,WAA5C,EAAyD3D,OAAO,CAAC8C,MAAjE,CAAL;;IAEA,CAAC,SAASJ,IAAT,GAAsB;MACrB,MAAM5B,MAAM,GAAGd,OAAO,CAAC2C,KAAR,EAAf;;MAEA,IAAI,IAAAhB,iBAAA,EAAWb,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;QAC/C3B,KAAK,CAAC,8DAAD,EAAiEqE,WAAjE,CAAL;QACA,OAAOjB,IAAI,EAAX;MACD,CANoB,CAQrB;;;MACA5B,MAAM,CAACG,aAAP,CACEqC,IADF,EAEE;MACAW,GAHF,EAIE;MACA,CAAChC,GAAD,EAAsByB,EAAtB,KAA4C;QAC1C,IAAIzD,eAAA,CAAEC,KAAF,CAAQ+B,GAAR,MAAiB,KAAjB,IAA0BhC,eAAA,CAAEuE,OAAF,CAAUvC,GAAV,CAA9B,EAA8C;UAC5C3C,KAAK,CAAC,0BAAD,EAA6BqE,WAA7B,CAAL;UACA,OAAOE,QAAQ,CAAC5B,GAAD,CAAf;QACD;;QAED,IAAIyB,EAAJ,EAAQ;UACNpE,KAAK,CAAC,wBAAD,EAA2BqE,WAA3B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDpE,KAAK,CAAC,sCAAD,EAAyCqE,WAAzC,CAAL;QACAjB,IAAI,GAZsC,CAYlC;MACT,CAlBH;IAoBD,CA7BD;EA8BD;;EAEM+B,gBAAgB,GAAa;IAClCnF,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMU,OAAO,GAAG,KAAKA,OAAL,CAAayC,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMiC,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAF;MAA6BvB,gBAAgB,EAAhBA;IAA7B,CAAhB;;IACA,KAAK,MAAMtC,MAAX,IAAqBd,OAArB,EAA8B;MAC5B,IAAIc,MAAM,CAAC2D,gBAAX,EAA6B;QAC3B,OAAO3D,MAAM,CAAC2D,gBAAP,CAAwBC,OAAxB,CAAP;MACD;IACF;;IAED,OAAO,CAACE,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/EF,GAAG,CAACG,KAAJ;;MAEA,MAAMrC,IAAI,GAAG,UAAUT,GAAV,EAA4C;QACvD2C,GAAG,CAACI,MAAJ,GADuD,CAEvD;QACA;QACA;QACA;;QACA,IAAI/C,GAAJ,EAAS;UACP2C,GAAG,CAACK,WAAJ,CAAgBrE,KAAhB,GAAwBqB,GAAG,CAACY,OAA5B;QACD;;QACD,OAAOiC,KAAK,EAAZ;MACD,CAVD;;MAYA,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C3F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOoD,IAAI,EAAX;MACD,CAlB8E,CAoB/E;;;MACA,MAAMyC,UAAU,GAAG,IAAAR,iCAAA,GAAnB;MACAC,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;MACAN,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;MAEA,MAAM;QAAEE;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAIrF,eAAA,CAAEC,KAAF,CAAQmF,aAAR,CAAJ,EAA4B;QAC1B/F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOoD,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA6C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC/F,KAAK,CAAC,kDAAD,CAAL;QACA,OAAOoD,IAAI,CAACb,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;MACD;;MACD,MAAM;QAAE3F,MAAF;QAAU4F;MAAV,IAAuB,KAAKhG,MAAlC;;MAEA,IAAI,IAAAiG,mBAAA,EAAYD,QAAZ,CAAJ,EAA2B;QACzBpG,KAAK,CAAC,wCAAD,CAAL;;QACA,KAAKsG,oBAAL,CAA0BhB,GAA1B,EAA+Bc,QAA/B,EAAyC5F,MAAzC,EAAiDuF,aAAjD,EAAgE3C,IAAhE;MACD,CAHD,MAGO;QACLpD,KAAK,CAAC,qCAAD,CAAL;;QACA,KAAKuG,uBAAL,CAA6BjB,GAA7B,EAAkCc,QAAlC,EAA4C5F,MAA5C,EAAoDuF,aAApD,EAAmE3C,IAAnE;MACD;IACF,CA5CD;EA6CD;;EAEOmD,uBAAuB,CAC7BjB,GAD6B,EAE7Bc,QAF6B,EAG7B5F,MAH6B,EAI7BuF,aAJ6B,EAK7B3C,IAL6B,EAMvB;IACNpD,KAAK,CAAC,2BAAD,CAAL;IACA,MAAM;MAAEwG,MAAF;MAAU1D;IAAV,IAAoB,IAAA2D,4BAAA,EAAqBV,aAArB,CAA1B;;IACA,IAAIS,MAAM,CAACE,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;MACtD1G,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;MACA,MAAM4G,WAAW,GAAG,IAAAC,8BAAA,EAAuB/D,KAAvB,EAA8BgE,QAA9B,EAApB;MACA,MAAM;QAAE9C,IAAF;QAAQhC;MAAR,IAAqB,IAAA+E,wBAAA,EAAkBH,WAAlB,CAA3B;MACA5G,KAAK,CAAC,mBAAD,EAAsBgE,IAAtB,CAAL;MACA,KAAKvC,YAAL,CAAkBuC,IAAlB,EAAwBhC,QAAxB,EAAkC,CAACW,GAAD,EAAMqB,IAAN,KAAqB;QACrD,IAAI,CAACrB,GAAL,EAAU;UACR3C,KAAK,CAAC,0BAAD,CAAL;UACAsF,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;UACAZ,IAAI;QACL,CAJD,MAIO;UACLpD,KAAK,CAAC,2BAAD,CAAL;UACAsF,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACAjC,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAjBD,MAiBO;MACL3C,KAAK,CAAC,kBAAD,CAAL;MACA,MAAM4G,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC5F,MAAnC,EAA2CuF,aAA3C,CAAzB;;MACA,IAAIa,WAAJ,EAAiB;QACf;QACAtB,GAAG,CAACK,WAAJ,GAAkBiB,WAAlB;QACA5G,KAAK,CAAC,0BAAD,CAAL;QACAoD,IAAI;MACL,CALD,MAKO;QACL;QACApD,KAAK,CAAC,mBAAD,CAAL;QACAoD,IAAI,CAACb,gBAAA,CAAW0E,YAAX,CAAwBrD,eAAA,CAAUsD,qBAAlC,CAAD,CAAJ;MACD;IACF;EACF;;EAEOZ,oBAAoB,CAC1BhB,GAD0B,EAE1Bc,QAF0B,EAG1B5F,MAH0B,EAI1BuF,aAJ0B,EAK1B3C,IAL0B,EAMpB;IACNpD,KAAK,CAAC,8BAAD,CAAL;IACAA,KAAK,CAAC,0BAAD,EAA6B,OAAOQ,MAAP,KAAkB,QAA/C,CAAL;IACAR,KAAK,CAAC,iCAAD,EAAoC,OAAO+F,aAAP,KAAyB,QAA7D,CAAL;IACA,MAAMa,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC5F,MAAnC,EAA2CuF,aAA3C,CAAzB;IACA/F,KAAK,CAAC,+BAAD,EAAkC4G,WAAlC,aAAkCA,WAAlC,uBAAkCA,WAAW,CAAEnC,IAA/C,CAAL;;IACA,IAAImC,WAAJ,EAAiB;MACf,MAAM;QAAE5C,IAAF;QAAQhC;MAAR,IAAqB4E,WAA3B;MACA5G,KAAK,CAAC,mBAAD,EAAsBgE,IAAtB,CAAL;MACA,KAAKvC,YAAL,CAAkBuC,IAAlB,EAAwBhC,QAAxB,EAAkC,CAACW,GAAD,EAAMqB,IAAN,KAAqB;QACrD,IAAI,CAACrB,GAAL,EAAU;UACR2C,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;UACAhE,KAAK,CAAC,0BAAD,CAAL;UACAoD,IAAI;QACL,CAJD,MAIO;UACLkC,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACArF,KAAK,CAAC,2BAAD,CAAL;UACAoD,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAdD,MAcO;MACL;MACA3C,KAAK,CAAC,uBAAD,CAAL;MACA,OAAOoD,IAAI,CAACb,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;IACD;EACF;;EAEOP,kBAAkB,CAACD,WAAD,EAAmC;IAC3D,OAAOhF,eAAA,CAAEwG,WAAF,CAAcxB,WAAd,MAA+B,KAA/B,IAAwChF,eAAA,CAAEwG,WAAF,CAAcxB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;EACD;EAED;AACF;AACA;;;EACS2C,kBAAkB,GAAa;IACpC,OAAO,CAAC9B,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/E,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C,OAAOH,KAAK,EAAZ;MACD;;MAEDF,GAAG,CAACG,KAAJ;;MACA,MAAMrC,IAAI,GAAIT,GAAD,IAAsC;QACjD2C,GAAG,CAACI,MAAJ;;QACA,IAAI/C,GAAJ,EAAS;UACP;UACA4C,GAAG,CAAC8B,MAAJ,CAAW1E,GAAG,CAAC2E,UAAf,EAA2BC,IAA3B,CAAgC5E,GAAG,CAACY,OAApC;QACD;;QAED,OAAOiC,KAAK,EAAZ;MACD,CARD;;MAUA,MAAM;QAAEO;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAIrF,eAAA,CAAEC,KAAF,CAAQmF,aAAR,CAAJ,EAA4B;QAC1B,OAAO3C,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA6C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC,OAAO3C,IAAI,CAACb,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;MACD;;MAED,MAAMrD,KAAK,GAAG,CAACiD,aAAa,IAAI,EAAlB,EAAsByB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;MACA,IAAI,CAAC3E,KAAL,EAAY;QACV,OAAOM,IAAI,EAAX;MACD;;MAED,IAAIwD,WAAJ;;MACA,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAA,EAAiB5E,KAAjB,EAAwB,KAAK1C,MAAL,CAAYI,MAApC,CAAd;MACD,CAFD,CAEE,OAAOmC,GAAP,EAAiB,CACjB;MACD;;MAED,IAAI,KAAKiD,kBAAL,CAAwBgB,WAAxB,CAAJ,EAA0C;QACxC,MAAM;UAAEnC,IAAF;UAAQnB;QAAR,IAAmBsD,WAAzB,CADwC,CAExC;;QACAtB,GAAG,CAACK,WAAJ,GAAkB,IAAA7B,wBAAA,EAAiBW,IAAjB,EAAuBnB,MAAvB,CAAlB;MACD,CAJD,MAIO;QACLgC,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;MACD;;MAEDjC,IAAI;IACL,CA9CD;EA+CD;;EAEsB,MAAVuE,UAAU,CAAC3D,IAAD,EAAmB4D,WAAnB,EAAiE;IACtF,MAAM;MAAEC,WAAF;MAAepD,IAAf;MAAqBnB;IAArB,IAAgCU,IAAtC;IACAhE,KAAK,CAAC,gBAAD,EAAmByE,IAAnB,CAAL;IACA,MAAMqD,mBAAmB,GAAGnH,eAAA,CAAEC,KAAF,CAAQiH,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;IACA,MAAME,aAAa,GAAGpH,eAAA,CAAEC,KAAF,CAAQ0C,MAAR,IAAkBuE,WAAlB,GAAgCvE,MAAM,CAAC0E,MAAP,CAAcF,mBAAd,CAAtD;IACA,MAAMG,OAAmB,GAAG;MAC1BJ,WAAW,EAAEC,mBADa;MAE1BrD,IAF0B;MAG1BnB,MAAM,EAAEyE;IAHkB,CAA5B;IAMA,MAAMjF,KAAa,GAAG,MAAM,IAAAoF,qBAAA,EAAYD,OAAZ,EAAqB,KAAKzH,MAA1B,EAAkCoH,WAAlC,CAA5B;IAEA,OAAO9E,KAAP;EACD;EAED;AACF;AACA;;;EACSqF,UAAU,CAACC,KAAD,EAA+B;IAC9C,OAAO,IAAAD,uBAAA,EAAWC,KAAX,EAAkB,KAAK5H,MAAvB,CAAP;EACD;;AApgByB"}
+{"version":3,"file":"auth.js","names":["LoggerApi","require","debug","buildDebug","Auth","constructor","config","logger","child","sub","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","authPlugin","HTPasswd","file","error","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  AllowAccess,\n  AuthPluginPackage,\n  Callback,\n  Config,\n  IPluginAuth,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  PluginOptions,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\n/* eslint-disable @typescript-eslint/no-var-requires */\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n  config: T & Config;\n  authenticate(user: string, password: string, cb: Callback): void;\n  invalidateToken?(token: string): Promise<void>;\n  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n  config: Config;\n  logger: Logger;\n  secret: string;\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  plugins: any[];\n  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n  invalidateToken(token: string): Promise<void>;\n  init(): Promise<void>;\n}\n\nclass Auth implements IAuth {\n  public config: Config;\n  public logger: Logger;\n  public secret: string;\n  public plugins: IPluginAuth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.logger = LoggerApi.logger.child({ sub: 'auth' });\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: PluginOptions = {\n      config: this.config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd({ file: './htpasswd' }, pluginOptions as any as PluginOptions);\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin(): Promise<IPluginAuth<Config>[]> {\n    return asyncLoadPlugin<IPluginAuth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      (plugin: IPluginAuth<Config>): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        // @ts-ignore\n        return authenticate || allow_access || allow_publish;\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(username: string, password: string, cb: Callback): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(user: string, password: string, cb: Callback): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as IPluginAuth<Config>;\n      let method = 'adduser';\n      if (isFunction(plugin[method]) === false) {\n        method = 'add_user';\n        self.logger.warn(\n          'the plugin method add_user in the auth plugin is deprecated and will' +\n            ' be removed in next major release, notify to the plugin author'\n        );\n      }\n\n      if (isFunction(plugin[method]) === false) {\n        next();\n      } else {\n        // p.add_user() execution\n        plugin[method](user, password, function (err, ok): void {\n          if (err) {\n            debug('the user  %o could not being added. Error: %o', user, err?.message);\n            return cb(err);\n          }\n          if (ok) {\n            debug('the user %o has been added', user);\n            return self.authenticate(user, password, cb);\n          }\n          next();\n        });\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAcces,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (isFunction(plugin?.allow_publish) === false) {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      // @ts-ignore\n      plugin.allow_publish(\n        user,\n        // @ts-ignore\n        pkg,\n        // @ts-ignore\n        (err: VerdaccioError, ok: boolean): void => {\n          if (_.isNil(err) === false && _.isError(err)) {\n            debug('forbidden publish for %o', packageName);\n            return callback(err);\n          }\n\n          if (ok) {\n            debug('allowed publish for %o', packageName);\n            return callback(null, ok);\n          }\n\n          debug('allow publish skip validation for %o', packageName);\n          next(); // cb(null, false) causes next plugin to roll\n        }\n      );\n    })();\n  }\n\n  public apiJWTmiddleware(): Function {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      req.pause();\n\n      const next = function (err: VerdaccioError | void): void {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): Function {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials;\n        // $FlowFixMe\n        req.remote_user = createRemoteUser(name, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AAQA;;AAcA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,IAAAC,cAAA,EAAW,gBAAX,CAAd;;AAyCA,MAAMC,IAAN,CAA4B;EAMnBC,WAAW,CAACC,MAAD,EAAiB;IACjC,KAAKA,MAAL,GAAcA,MAAd;IACA,KAAKC,MAAL,GAAcP,SAAS,CAACO,MAAV,CAAiBC,KAAjB,CAAuB;MAAEC,GAAG,EAAE;IAAP,CAAvB,CAAd;IACA,KAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;IACA,KAAKC,OAAL,GAAe,EAAf;;IACA,IAAI,CAAC,KAAKD,MAAV,EAAkB;MAChB,MAAM,IAAIE,SAAJ,CAAc,0DAAd,CAAN;IACD;EACF;;EAEgB,MAAJC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAG,MAAM,KAAKG,UAAL,EAApB;IACAZ,KAAK,CAAC,uBAAD,EAA0BS,OAAO,CAACI,MAAlC,CAAL;;IACA,IAAI,CAACJ,OAAD,IAAYA,OAAO,CAACI,MAAR,KAAmB,CAAnC,EAAsC;MACpCJ,OAAO,GAAG,KAAKK,iBAAL,EAAV;IACD;;IACD,KAAKL,OAAL,GAAeA,OAAf;;IAEA,KAAKM,oBAAL;EACD;;EAEOD,iBAAiB,GAAG;IAC1Bd,KAAK,CAAC,0BAAD,CAAL;IACA,MAAMgB,aAA4B,GAAG;MACnCZ,MAAM,EAAE,KAAKA,MADsB;MAEnCC,MAAM,EAAE,KAAKA;IAFsB,CAArC;IAIA,IAAIY,UAAJ;;IACA,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAJ,CAAa;QAAEC,IAAI,EAAE;MAAR,CAAb,EAAqCH,aAArC,CAAb;IACD,CAFD,CAEE,OAAOI,KAAP,EAAmB;MACnBpB,KAAK,CAAC,iDAAD,EAAoDoB,KAApD,CAAL;MACA,OAAO,EAAP;IACD;;IAED,OAAO,CAACH,UAAD,CAAP;EACD;;EAEuB,MAAVL,UAAU,GAAmC;IAAA;;IACzD,OAAO,IAAAS,wBAAA,EACL,KAAKjB,MAAL,CAAYkB,IADP,EAEL;MACElB,MAAM,EAAE,KAAKA,MADf;MAEEC,MAAM,EAAE,KAAKA;IAFf,CAFK,EAMJkB,MAAD,IAA0C;MACxC,MAAM;QAAEC,YAAF;QAAgBC,YAAhB;QAA8BC;MAA9B,IAAgDH,MAAtD,CADwC,CAGxC;;MACA,OAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;IACD,CAXI,kBAYL,KAAKtB,MAZA,0EAYL,aAAauB,cAZR,0DAYL,sBAA6BC,YAZxB,CAAP;EAcD;;EAEOb,oBAAoB,GAAS;IACnC;IACA,KAAKN,OAAL,CAAaoB,IAAb,CAAkB,IAAAC,yBAAA,EAAkB,KAAKzB,MAAvB,CAAlB;EACD;;EAEM0B,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;IACN,MAAMC,YAAY,GAAGC,eAAA,CAAEC,MAAF,CAAS,KAAK7B,OAAd,EAAwBc,MAAD,IAAY,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,CAAnC,CAArB;;IAEA,IAAIM,eAAA,CAAEG,OAAF,CAAUJ,YAAV,CAAJ,EAA6B;MAC3B,OAAOD,EAAE,CAACM,gBAAA,CAAWC,gBAAX,CAA4BC,oBAAA,CAAeC,wBAA3C,CAAD,CAAT;IACD;;IAED,KAAK,MAAMrB,MAAX,IAAqBa,YAArB,EAAmC;MACjC,IAAI,IAAAS,YAAA,EAAMtB,MAAN,KAAiB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,MAAsC,KAA3D,EAAkE;QAChE/B,KAAK,CAAC,gEAAD,CAAL;QACA;MACD,CAHD,MAGO;QACLA,KAAK,CAAC,0BAAD,EAA6BgC,QAA7B,CAAL;QACAT,MAAM,CAACQ,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACY,GAAD,EAAMC,OAAN,KAAwB;UAC9E,IAAID,GAAJ,EAAS;YACP,KAAKzC,MAAL,CAAYe,KAAZ,CACE;cAAEY,QAAF;cAAYc;YAAZ,CADF,EAEG;AACf,yEAHY;YAKA,OAAOX,EAAE,CAACW,GAAD,CAAT;UACD;;UAED9C,KAAK,CAAC,wCAAD,EAA2CgC,QAA3C,CAAL;UACA,OAAOG,EAAE,CAAC,IAAD,EAAOY,OAAP,CAAT;QACD,CAZD;MAaD;IACF;EACF;;EAE2B,MAAfC,eAAe,CAACC,KAAD,EAAgB;IAC1C;IACAC,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;IACA,OAAOG,OAAO,CAACC,OAAR,EAAP;EACD;;EAEM7B,YAAY,CAACQ,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;IAC1E,MAAM1B,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;;IACA,CAAC,SAASC,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGd,OAAO,CAAC+C,KAAR,EAAf;;MAEA,IAAI,IAAAjB,iBAAA,EAAWhB,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;QAC7C,OAAO+B,IAAI,EAAX;MACD;;MAEDvD,KAAK,CAAC,mBAAD,EAAsBgC,QAAtB,CAAL;MACAT,MAAM,CAACC,YAAP,CAAoBQ,QAApB,EAA8BC,QAA9B,EAAwC,UAAUa,GAAV,EAAeW,MAAf,EAA6B;QACnE,IAAIX,GAAJ,EAAS;UACP9C,KAAK,CAAC,8CAAD,EAAiDgC,QAAjD,EAA2Dc,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;UACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;QACD,CAJkE,CAMnE;QACA;QACA;QACA;QACA;QACA;QACA;;;QACA,IAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAAC5C,MAAP,KAAkB,CAAlC,EAAqC;UACnC;UACA,IAAIwB,eAAA,CAAEsB,QAAF,CAAWF,MAAX,CAAJ,EAAwB;YACtB,MAAM,IAAI/C,SAAJ,CAAc,+CAAd,CAAN;UACD;;UACD,MAAMkD,YAAqB,GAAGvB,eAAA,CAAEwB,OAAF,CAAUJ,MAAV,CAA9B;;UACA,IAAI,CAACG,YAAL,EAAmB;YACjB,MAAM,IAAIlD,SAAJ,CAAcoD,eAAA,CAAUC,qBAAxB,CAAN;UACD;;UAED/D,KAAK,CAAC,yDAAD,EAA4DgC,QAA5D,EAAsEyB,MAAtE,CAAL;UACA,OAAOtB,EAAE,CAACW,GAAD,EAAM,IAAAkB,wBAAA,EAAiBhC,QAAjB,EAA2ByB,MAA3B,CAAN,CAAT;QACD;;QACDF,IAAI;MACL,CA3BD;IA4BD,CApCD;EAqCD;;EAEMU,QAAQ,CAACC,IAAD,EAAejC,QAAf,EAAiCE,EAAjC,EAAqD;IAClE,MAAMgC,IAAI,GAAG,IAAb;IACA,MAAM1D,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACAtD,KAAK,CAAC,aAAD,EAAgBkE,IAAhB,CAAL;;IAEA,CAAC,SAASX,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGd,OAAO,CAAC+C,KAAR,EAAf;MACA,IAAIY,MAAM,GAAG,SAAb;;MACA,IAAI,IAAA7B,iBAAA,EAAWhB,MAAM,CAAC6C,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;QACxCA,MAAM,GAAG,UAAT;QACAD,IAAI,CAAC9D,MAAL,CAAYgE,IAAZ,CACE,yEACE,gEAFJ;MAID;;MAED,IAAI,IAAA9B,iBAAA,EAAWhB,MAAM,CAAC6C,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;QACxCb,IAAI;MACL,CAFD,MAEO;QACL;QACAhC,MAAM,CAAC6C,MAAD,CAAN,CAAeF,IAAf,EAAqBjC,QAArB,EAA+B,UAAUa,GAAV,EAAewB,EAAf,EAAyB;UACtD,IAAIxB,GAAJ,EAAS;YACP9C,KAAK,CAAC,+CAAD,EAAkDkE,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;YACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;UACD;;UACD,IAAIwB,EAAJ,EAAQ;YACNtE,KAAK,CAAC,4BAAD,EAA+BkE,IAA/B,CAAL;YACA,OAAOC,IAAI,CAAC3C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkCE,EAAlC,CAAP;UACD;;UACDoB,IAAI;QACL,CAVD;MAWD;IACF,CA3BD;EA4BD;EAED;AACF;AACA;;;EACS9B,YAAY,CACjB;IAAE8C,WAAF;IAAeC;EAAf,CADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;IACN,MAAMhE,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMoB,aAA0B,GAAG;MAAEC,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CAAnC;IACA,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,IAAAM,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKnE,MAAL,CAAY6E,QAAhD,CAHU,CAAZ;IAKAjF,KAAK,CAAC,qBAAD,EAAwBuE,WAAxB,CAAL;;IAEA,CAAC,SAAShB,IAAT,GAAsB;MACrB,MAAMhC,MAA2B,GAAGd,OAAO,CAAC+C,KAAR,EAApC;;MAEA,IAAInB,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;QAChE,OAAO8B,IAAI,EAAX;MACD;;MAEDhC,MAAM,CAACE,YAAP,CAAqByC,IAArB,EAA2BW,GAA3B,EAAgC,UAAU/B,GAAV,EAAewB,EAAf,EAAkC;QAChE,IAAIxB,GAAJ,EAAS;UACP9C,KAAK,CAAC,oCAAD,EAAuCuE,WAAvC,EAAoDzB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;UACA,OAAOe,QAAQ,CAAC3B,GAAD,CAAf;QACD;;QAED,IAAIwB,EAAJ,EAAQ;UACNtE,KAAK,CAAC,uBAAD,EAA0BuE,WAA1B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDf,IAAI,GAX4D,CAWxD;MACT,CAZD;IAaD,CApBD;EAqBD;;EAEM2B,eAAe,CACpB;IAAEX,WAAF;IAAeC;EAAf,CADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKnE,MAAL,CAAY6E,QAAhD,CAFU,CAAZ;IAIAjF,KAAK,CAAC,wBAAD,EAA2BuE,WAA3B,CAAL;;IAEA,KAAK,MAAMhD,MAAX,IAAqB,KAAKd,OAA1B,EAAmC;MACjC,IAAI4B,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAAC2D,eAAlB,MAAuC,KAA9D,EAAqE;QACnElF,KAAK,CAAC,kEAAD,EAAqEuE,WAArE,CAAL;QACA;MACD,CAHD,MAGO;QACL;QACAhD,MAAM,CAAC2D,eAAP,CAAwBhB,IAAxB,EAA8BW,GAA9B,EAAmC,CAAC/B,GAAD,EAAMwB,EAAN,KAA4B;UAC7D,IAAIxB,GAAJ,EAAS;YACP9C,KAAK,CACH,qEADG,EAEHuE,WAFG,CAAL;YAIA,OAAOE,QAAQ,CAAC3B,GAAD,CAAf;UACD;;UAED,IAAIT,eAAA,CAAEQ,KAAF,CAAQyB,EAAR,MAAgB,IAApB,EAA0B;YACxBtE,KAAK,CAAC,yDAAD,EAA4DuE,WAA5D,CAAL,CADwB,CAExB;YACA;;YACA,OAAO,KAAK7C,aAAL,CAAmB,GAAGyD,SAAtB,CAAP;UACD;;UAED,IAAIb,EAAJ,EAAQ;YACNtE,KAAK,CAAC,0BAAD,EAA6BuE,WAA7B,CAAL;YACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;UACD;QACF,CApBD;MAqBD;IACF;EACF;EAED;AACF;AACA;;;EACS5C,aAAa,CAClB;IAAE6C,WAAF;IAAeC;EAAf,CADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;IACN,MAAMhE,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMuB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKnE,MAAL,CAAY6E,QAAhD,CAFU,CAAZ;IAIAjF,KAAK,CAAC,yCAAD,EAA4CuE,WAA5C,EAAyD9D,OAAO,CAACI,MAAjE,CAAL;;IAEA,CAAC,SAAS0C,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGd,OAAO,CAAC+C,KAAR,EAAf;;MAEA,IAAI,IAAAjB,iBAAA,EAAWhB,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;QAC/C1B,KAAK,CAAC,8DAAD,EAAiEuE,WAAjE,CAAL;QACA,OAAOhB,IAAI,EAAX;MACD,CANoB,CAQrB;;;MACAhC,MAAM,CAACG,aAAP,CACEwC,IADF,EAEE;MACAW,GAHF,EAIE;MACA,CAAC/B,GAAD,EAAsBwB,EAAtB,KAA4C;QAC1C,IAAIjC,eAAA,CAAEQ,KAAF,CAAQC,GAAR,MAAiB,KAAjB,IAA0BT,eAAA,CAAE+C,OAAF,CAAUtC,GAAV,CAA9B,EAA8C;UAC5C9C,KAAK,CAAC,0BAAD,EAA6BuE,WAA7B,CAAL;UACA,OAAOE,QAAQ,CAAC3B,GAAD,CAAf;QACD;;QAED,IAAIwB,EAAJ,EAAQ;UACNtE,KAAK,CAAC,wBAAD,EAA2BuE,WAA3B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDtE,KAAK,CAAC,sCAAD,EAAyCuE,WAAzC,CAAL;QACAhB,IAAI,GAZsC,CAYlC;MACT,CAlBH;IAoBD,CA7BD;EA8BD;;EAEM8B,gBAAgB,GAAa;IAClCrF,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMS,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMgC,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAF;MAA6BvB,gBAAgB,EAAhBA;IAA7B,CAAhB;;IACA,KAAK,MAAMzC,MAAX,IAAqBd,OAArB,EAA8B;MAC5B,IAAIc,MAAM,CAAC8D,gBAAX,EAA6B;QAC3B,OAAO9D,MAAM,CAAC8D,gBAAP,CAAwBC,OAAxB,CAAP;MACD;IACF;;IAED,OAAO,CAACE,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/EF,GAAG,CAACG,KAAJ;;MAEA,MAAMpC,IAAI,GAAG,UAAUT,GAAV,EAA4C;QACvD0C,GAAG,CAACI,MAAJ,GADuD,CAEvD;QACA;QACA;QACA;;QACA,IAAI9C,GAAJ,EAAS;UACP0C,GAAG,CAACK,WAAJ,CAAgBzE,KAAhB,GAAwB0B,GAAG,CAACY,OAA5B;QACD;;QACD,OAAOgC,KAAK,EAAZ;MACD,CAVD;;MAYA,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C7F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOuD,IAAI,EAAX;MACD,CAlB8E,CAoB/E;;;MACA,MAAMwC,UAAU,GAAG,IAAAR,iCAAA,GAAnB;MACAC,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;MACAN,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;MAEA,MAAM;QAAEE;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI7D,eAAA,CAAEQ,KAAF,CAAQoD,aAAR,CAAJ,EAA4B;QAC1BjG,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOuD,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA4C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrCjG,KAAK,CAAC,kDAAD,CAAL;QACA,OAAOuD,IAAI,CAACd,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;MACD;;MACD,MAAM;QAAE7F,MAAF;QAAU8F;MAAV,IAAuB,KAAKlG,MAAlC;;MAEA,IAAI,IAAAmG,mBAAA,EAAYD,QAAZ,CAAJ,EAA2B;QACzBtG,KAAK,CAAC,wCAAD,CAAL;;QACA,KAAKwG,oBAAL,CAA0BhB,GAA1B,EAA+Bc,QAA/B,EAAyC9F,MAAzC,EAAiDyF,aAAjD,EAAgE1C,IAAhE;MACD,CAHD,MAGO;QACLvD,KAAK,CAAC,qCAAD,CAAL;;QACA,KAAKyG,uBAAL,CAA6BjB,GAA7B,EAAkCc,QAAlC,EAA4C9F,MAA5C,EAAoDyF,aAApD,EAAmE1C,IAAnE;MACD;IACF,CA5CD;EA6CD;;EAEOkD,uBAAuB,CAC7BjB,GAD6B,EAE7Bc,QAF6B,EAG7B9F,MAH6B,EAI7ByF,aAJ6B,EAK7B1C,IAL6B,EAMvB;IACNvD,KAAK,CAAC,2BAAD,CAAL;IACA,MAAM;MAAE0G,MAAF;MAAUzD;IAAV,IAAoB,IAAA0D,4BAAA,EAAqBV,aAArB,CAA1B;;IACA,IAAIS,MAAM,CAACE,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;MACtD5G,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;MACA,MAAM8G,WAAW,GAAG,IAAAC,8BAAA,EAAuB9D,KAAvB,EAA8B+D,QAA9B,EAApB;MACA,MAAM;QAAE9C,IAAF;QAAQjC;MAAR,IAAqB,IAAAgF,wBAAA,EAAkBH,WAAlB,CAA3B;MACA9G,KAAK,CAAC,mBAAD,EAAsBkE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAAMoB,IAAN,KAAqB;QACrD,IAAI,CAACpB,GAAL,EAAU;UACR9C,KAAK,CAAC,0BAAD,CAAL;UACAwF,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;UACAX,IAAI;QACL,CAJD,MAIO;UACLvD,KAAK,CAAC,2BAAD,CAAL;UACAwF,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACAhC,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAjBD,MAiBO;MACL9C,KAAK,CAAC,kBAAD,CAAL;MACA,MAAM8G,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC9F,MAAnC,EAA2CyF,aAA3C,CAAzB;;MACA,IAAIa,WAAJ,EAAiB;QACf;QACAtB,GAAG,CAACK,WAAJ,GAAkBiB,WAAlB;QACA9G,KAAK,CAAC,0BAAD,CAAL;QACAuD,IAAI;MACL,CALD,MAKO;QACL;QACAvD,KAAK,CAAC,mBAAD,CAAL;QACAuD,IAAI,CAACd,gBAAA,CAAW0E,YAAX,CAAwBrD,eAAA,CAAUsD,qBAAlC,CAAD,CAAJ;MACD;IACF;EACF;;EAEOZ,oBAAoB,CAC1BhB,GAD0B,EAE1Bc,QAF0B,EAG1B9F,MAH0B,EAI1ByF,aAJ0B,EAK1B1C,IAL0B,EAMpB;IACNvD,KAAK,CAAC,8BAAD,CAAL;IACAA,KAAK,CAAC,0BAAD,EAA6B,OAAOQ,MAAP,KAAkB,QAA/C,CAAL;IACAR,KAAK,CAAC,iCAAD,EAAoC,OAAOiG,aAAP,KAAyB,QAA7D,CAAL;IACA,MAAMa,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC9F,MAAnC,EAA2CyF,aAA3C,CAAzB;IACAjG,KAAK,CAAC,+BAAD,EAAkC8G,WAAlC,aAAkCA,WAAlC,uBAAkCA,WAAW,CAAEnC,IAA/C,CAAL;;IACA,IAAImC,WAAJ,EAAiB;MACf,MAAM;QAAE5C,IAAF;QAAQjC;MAAR,IAAqB6E,WAA3B;MACA9G,KAAK,CAAC,mBAAD,EAAsBkE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAAMoB,IAAN,KAAqB;QACrD,IAAI,CAACpB,GAAL,EAAU;UACR0C,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;UACAlE,KAAK,CAAC,0BAAD,CAAL;UACAuD,IAAI;QACL,CAJD,MAIO;UACLiC,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACAvF,KAAK,CAAC,2BAAD,CAAL;UACAuD,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAdD,MAcO;MACL;MACA9C,KAAK,CAAC,uBAAD,CAAL;MACA,OAAOuD,IAAI,CAACd,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;IACD;EACF;;EAEOP,kBAAkB,CAACD,WAAD,EAAmC;IAC3D,OAAOxD,eAAA,CAAEgF,WAAF,CAAcxB,WAAd,MAA+B,KAA/B,IAAwCxD,eAAA,CAAEgF,WAAF,CAAcxB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;EACD;EAED;AACF;AACA;;;EACS2C,kBAAkB,GAAa;IACpC,OAAO,CAAC9B,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/E,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C,OAAOH,KAAK,EAAZ;MACD;;MAEDF,GAAG,CAACG,KAAJ;;MACA,MAAMpC,IAAI,GAAIT,GAAD,IAAsC;QACjD0C,GAAG,CAACI,MAAJ;;QACA,IAAI9C,GAAJ,EAAS;UACP;UACA2C,GAAG,CAAC8B,MAAJ,CAAWzE,GAAG,CAAC0E,UAAf,EAA2BC,IAA3B,CAAgC3E,GAAG,CAACY,OAApC;QACD;;QAED,OAAOgC,KAAK,EAAZ;MACD,CARD;;MAUA,MAAM;QAAEO;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI7D,eAAA,CAAEQ,KAAF,CAAQoD,aAAR,CAAJ,EAA4B;QAC1B,OAAO1C,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA4C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC,OAAO1C,IAAI,CAACd,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;MACD;;MAED,MAAMpD,KAAK,GAAG,CAACgD,aAAa,IAAI,EAAlB,EAAsByB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;MACA,IAAI,CAAC1E,KAAL,EAAY;QACV,OAAOM,IAAI,EAAX;MACD;;MAED,IAAIuD,WAAJ;;MACA,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAA,EAAiB3E,KAAjB,EAAwB,KAAK7C,MAAL,CAAYI,MAApC,CAAd;MACD,CAFD,CAEE,OAAOsC,GAAP,EAAiB,CACjB;MACD;;MAED,IAAI,KAAKgD,kBAAL,CAAwBgB,WAAxB,CAAJ,EAA0C;QACxC,MAAM;UAAEnC,IAAF;UAAQlB;QAAR,IAAmBqD,WAAzB,CADwC,CAExC;;QACAtB,GAAG,CAACK,WAAJ,GAAkB,IAAA7B,wBAAA,EAAiBW,IAAjB,EAAuBlB,MAAvB,CAAlB;MACD,CAJD,MAIO;QACL+B,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;MACD;;MAEDhC,IAAI;IACL,CA9CD;EA+CD;;EAEsB,MAAVsE,UAAU,CAAC3D,IAAD,EAAmB4D,WAAnB,EAAiE;IACtF,MAAM;MAAEC,WAAF;MAAepD,IAAf;MAAqBlB;IAArB,IAAgCS,IAAtC;IACAlE,KAAK,CAAC,gBAAD,EAAmB2E,IAAnB,CAAL;IACA,MAAMqD,mBAAmB,GAAG3F,eAAA,CAAEQ,KAAF,CAAQkF,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;IACA,MAAME,aAAa,GAAG5F,eAAA,CAAEQ,KAAF,CAAQY,MAAR,IAAkBsE,WAAlB,GAAgCtE,MAAM,CAACyE,MAAP,CAAcF,mBAAd,CAAtD;IACA,MAAMG,OAAmB,GAAG;MAC1BJ,WAAW,EAAEC,mBADa;MAE1BrD,IAF0B;MAG1BlB,MAAM,EAAEwE;IAHkB,CAA5B;IAMA,MAAMhF,KAAa,GAAG,MAAM,IAAAmF,qBAAA,EAAYD,OAAZ,EAAqB,KAAK3H,MAA1B,EAAkCsH,WAAlC,CAA5B;IAEA,OAAO7E,KAAP;EACD;EAED;AACF;AACA;;;EACSoF,UAAU,CAACC,KAAD,EAA+B;IAC9C,OAAO,IAAAD,uBAAA,EAAWC,KAAX,EAAkB,KAAK9H,MAAvB,CAAP;EACD;;AA1gByB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "6.0.0-6-next.25",
+  "version": "6.0.0-6-next.27",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -30,19 +30,19 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "6.0.0-6-next.8",
-    "@verdaccio/config": "6.0.0-6-next.17",
-    "@verdaccio/loaders": "6.0.0-6-next.15",
-    "@verdaccio/logger": "6.0.0-6-next.14",
-    "@verdaccio/utils": "6.0.0-6-next.14",
+    "@verdaccio/core": "6.0.0-6-next.48",
+    "@verdaccio/config": "6.0.0-6-next.48",
+    "@verdaccio/loaders": "6.0.0-6-next.17",
+    "@verdaccio/logger": "6.0.0-6-next.16",
+    "@verdaccio/utils": "6.0.0-6-next.16",
     "debug": "4.3.4",
     "express": "4.18.1",
     "jsonwebtoken": "8.5.1",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "11.0.0-6-next.16"
+    "verdaccio-htpasswd": "11.0.0-6-next.18"
   },
   "devDependencies": {
-    "@verdaccio/types": "11.0.0-6-next.16"
+    "@verdaccio/types": "11.0.0-6-next.17"
   },
   "funding": {
     "type": "opencollective",

package/src/auth.ts

@@ -1,7 +1,7 @@
 import buildDebug from 'debug';
 import { NextFunction, Request, Response } from 'express';
 import _ from 'lodash';
-import { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';
+import { HTPasswd } from 'verdaccio-htpasswd';
 
 import { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';
 import {
@@ -12,7 +12,7 @@ import {
   VerdaccioError,
   errorUtils,
 } from '@verdaccio/core';
-import { loadPlugin } from '@verdaccio/loaders';
+import { asyncLoadPlugin } from '@verdaccio/loaders';
 import {
   AllowAccess,
   AuthPluginPackage,
@@ -82,6 +82,7 @@ export interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncrypt
   plugins: any[];
   allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
   invalidateToken(token: string): Promise<void>;
+  init(): Promise<void>;
 }
 
 class Auth implements IAuth {
@@ -94,24 +95,32 @@ class Auth implements IAuth {
     this.config = config;
     this.logger = LoggerApi.logger.child({ sub: 'auth' });
     this.secret = config.secret;
+    this.plugins = [];
     if (!this.secret) {
       throw new TypeError('secret it is required value on initialize the auth class');
     }
+  }
+
+  public async init() {
+    let plugins = await this.loadPlugin();
+    debug('auth plugins found %s', plugins.length);
+    if (!plugins || plugins.length === 0) {
+      plugins = this.loadDefaultPlugin();
+    }
+    this.plugins = plugins;
 
-    this.plugins =
-      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);
     this._applyDefaultPlugins();
   }
 
-  private loadDefaultPlugin(config: Config) {
-    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };
-    const pluginOptions: PluginOptions<{}> = {
-      config,
+  private loadDefaultPlugin() {
+    debug('load default auth plugin');
+    const pluginOptions: PluginOptions = {
+      config: this.config,
       logger: this.logger,
     };
     let authPlugin;
     try {
-      authPlugin = new HTPasswd(plugingConf, pluginOptions as any as PluginOptions<HTPasswdConfig>);
+      authPlugin = new HTPasswd({ file: './htpasswd' }, pluginOptions as any as PluginOptions);
     } catch (error: any) {
       debug('error on loading auth htpasswd plugin stack: %o', error);
       return [];
@@ -120,22 +129,20 @@ class Auth implements IAuth {
     return [authPlugin];
   }
 
-  private _loadPlugin(config: Config): IPluginAuth<Config>[] {
-    const pluginOptions = {
-      config,
-      logger: this.logger,
-    };
-
-    return loadPlugin<IPluginAuth<Config>>(
-      config,
-      config.auth,
-      pluginOptions,
+  private async loadPlugin(): Promise<IPluginAuth<Config>[]> {
+    return asyncLoadPlugin<IPluginAuth<Config>>(
+      this.config.auth,
+      {
+        config: this.config,
+        logger: this.logger,
+      },
       (plugin: IPluginAuth<Config>): boolean => {
         const { authenticate, allow_access, allow_publish } = plugin;
 
         // @ts-ignore
         return authenticate || allow_access || allow_publish;
-      }
+      },
+      this.config?.serverSettings?.pluginPrefix
     );
   }
 

package/test/auth-utils.spec.ts

@@ -71,6 +71,7 @@ describe('Auth utilities', () => {
   ): Promise<string> {
     const config: Config = getConfig(configFileName, secret);
     const auth: IAuth = new Auth(config);
+    await auth.init();
     // @ts-ignore
     const spy = jest.spyOn(auth, methodToSpy);
     // @ts-ignore
@@ -409,6 +410,7 @@ describe('Auth utilities', () => {
         const secret = 'b2df428b9929d3ace7c598bbf4e496b2';
         const config: Config = getConfig('security-legacy', secret);
         const auth: IAuth = new Auth(config);
+        await auth.init();
         const token = auth.aesEncrypt(null);
         const security: Security = config.security;
         const credentials = getMiddlewareCredentials(

package/test/auth.spec.ts

@@ -1,7 +1,7 @@
-import _ from 'lodash';
+import path from 'path';
 
 import { IAuth } from '@verdaccio/auth';
-import { Config as AppConfig, ROLES } from '@verdaccio/config';
+import { Config as AppConfig, ROLES, getDefaultConfig } from '@verdaccio/config';
 import { errorUtils } from '@verdaccio/core';
 import { setup } from '@verdaccio/logger';
 import { Config } from '@verdaccio/types';
@@ -12,22 +12,31 @@ import { authPluginFailureConf, authPluginPassThrougConf, authProfileConf } from
 setup([]);
 
 describe('AuthTest', () => {
-  test('should be defined', () => {
-    const config: Config = new AppConfig(_.cloneDeep(authProfileConf));
+  test('should init correctly', async () => {
+    const config: Config = new AppConfig({ ...authProfileConf });
     config.checkSecretKey('12345');
 
     const auth: IAuth = new Auth(config);
+    await auth.init();
+    expect(auth).toBeDefined();
+  });
 
+  test('should load default auth plugin', async () => {
+    const config: Config = new AppConfig({ ...authProfileConf, auth: undefined });
+    config.checkSecretKey('12345');
+
+    const auth: IAuth = new Auth(config);
+    await auth.init();
     expect(auth).toBeDefined();
   });
 
   describe('test authenticate method', () => {
     describe('test authenticate states', () => {
-      test('should be a success login', () => {
-        const config: Config = new AppConfig(_.cloneDeep(authProfileConf));
+      test('should be a success login', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
         config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
-
+        await auth.init();
         expect(auth).toBeDefined();
 
         const callback = jest.fn();
@@ -50,11 +59,11 @@ describe('AuthTest', () => {
         });
       });
 
-      test('should be a fail on login', () => {
+      test('should be a fail on login', async () => {
         const config: Config = new AppConfig(authPluginFailureConf);
         config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
-
+        await auth.init();
         expect(auth).toBeDefined();
 
         const callback = jest.fn();
@@ -69,11 +78,11 @@ describe('AuthTest', () => {
     // that might make break the request
     // the @ts-ignore below are intended
     describe('test authenticate out of control inputs from plugins', () => {
-      test('should skip falsy values', () => {
-        const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+      test('should skip falsy values', async () => {
+        const config: Config = new AppConfig({ ...authPluginPassThrougConf });
         config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
-
+        await auth.init();
         expect(auth).toBeDefined();
 
         const callback = jest.fn();
@@ -89,11 +98,11 @@ describe('AuthTest', () => {
         }
       });
 
-      test('should error truthy non-array', () => {
-        const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+      test('should error truthy non-array', async () => {
+        const config: Config = new AppConfig({ ...authPluginPassThrougConf });
         config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
-
+        await auth.init();
         expect(auth).toBeDefined();
 
         const callback = jest.fn();
@@ -107,11 +116,11 @@ describe('AuthTest', () => {
         }
       });
 
-      test('should skip empty array', () => {
-        const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+      test('should skip empty array', async () => {
+        const config: Config = new AppConfig({ ...authPluginPassThrougConf });
         config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
-
+        await auth.init();
         expect(auth).toBeDefined();
 
         const callback = jest.fn();
@@ -124,11 +133,11 @@ describe('AuthTest', () => {
         expect(callback.mock.calls[0][1]).toBeUndefined();
       });
 
-      test('should accept valid array', () => {
-        const config: Config = new AppConfig(_.cloneDeep(authPluginPassThrougConf));
+      test('should accept valid array', async () => {
+        const config: Config = new AppConfig({ ...authPluginPassThrougConf });
         config.checkSecretKey('12345');
         const auth: IAuth = new Auth(config);
-
+        await auth.init();
         expect(auth).toBeDefined();
 
         const callback = jest.fn();
@@ -144,4 +153,31 @@ describe('AuthTest', () => {
       });
     });
   });
+
+  describe('test multiple authenticate methods', () => {
+    test('should skip falsy values', async () => {
+      const config: Config = new AppConfig({
+        ...getDefaultConfig(),
+        plugins: path.join(__dirname, './partials/plugin'),
+        auth: {
+          success: {},
+          'fail-invalid-method': {},
+        },
+      });
+      config.checkSecretKey('12345');
+      const auth: IAuth = new Auth(config);
+      await auth.init();
+
+      return new Promise((resolve) => {
+        auth.authenticate('foo', 'bar', (err, value) => {
+          expect(value).toEqual({
+            name: 'foo',
+            groups: ['test', '$all', '$authenticated', '@all', '@authenticated', 'all'],
+            real_groups: ['test'],
+          });
+          resolve(value);
+        });
+      });
+    });
+  });
 });

package/test/helper/plugin.ts

@@ -4,21 +4,32 @@ import { getDefaultConfig } from '@verdaccio/config';
 
 export const authProfileConf = {
   ...getDefaultConfig(),
+  plugins: path.join(__dirname, '../partials/plugin'),
   auth: {
-    [`${path.join(__dirname, '../partials/plugin/authenticate.success')}`]: {},
+    success: {},
   },
 };
 
 export const authPluginFailureConf = {
   ...getDefaultConfig(),
+  plugins: path.join(__dirname, '../partials/plugin'),
   auth: {
-    [`${path.join(__dirname, '../partials/plugin/authenticate.fail.js')}`]: {},
+    fail: {},
   },
 };
 
 export const authPluginPassThrougConf = {
   ...getDefaultConfig(),
+  plugins: path.join(__dirname, '../partials/plugin'),
   auth: {
-    [`${path.join(__dirname, '../partials/plugin/authenticate.passthroug')}`]: {},
+    passthroug: {},
+  },
+};
+
+export const authFailInvalidMethod = {
+  ...getDefaultConfig(),
+  plugins: path.join(__dirname, '../partials/plugin'),
+  auth: {
+    'fail-invalid-method': {},
   },
 };

package/test/partials/plugin/verdaccio-fail/fail.js

@@ -0,0 +1,11 @@
+const { errorUtils } = require('@verdaccio/core');
+
+module.exports = function () {
+  return {
+    authenticate(user, pass, callback) {
+      /* user and pass are used here to forward errors
+      and success types respectively for testing purposes */
+      callback(errorUtils.getInternalError(), false);
+    },
+  };
+};

package/test/partials/plugin/verdaccio-fail/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-fail",
+  "main": "fail.js",
+  "version": "1.0.0"
+}

package/test/partials/plugin/verdaccio-fail-invalid-method/fail.js

@@ -0,0 +1,11 @@
+const { errorUtils } = require('@verdaccio/core');
+
+module.exports = function () {
+  return {
+    authenticateFake(user, pass, callback) {
+      /* user and pass are used here to forward errors
+      and success types respectively for testing purposes */
+      callback(errorUtils.getInternalError(), false);
+    },
+  };
+};

package/test/partials/plugin/verdaccio-fail-invalid-method/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-fail",
+  "main": "fail.js",
+  "version": "1.0.0"
+}

package/test/partials/plugin/verdaccio-passthroug/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-passthroug",
+  "main": "passthroug.js",
+  "version": "1.0.0"
+}

package/test/partials/plugin/verdaccio-success/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-success",
+  "main": "success.js",
+  "version": "1.0.0"
+}

package/test/partials/plugin/authenticate.fail.js

@@ -1,11 +0,0 @@
-import { errorUtils } from '@verdaccio/core';
-
-module.exports = function () {
-  return {
-    authenticate(user, pass, callback) {
-      // we return an 500 error, the second argument must be false.
-      // https://verdaccio.org/docs/en/dev-plugins#onerror
-      callback(errorUtils.getInternalError(), false);
-    },
-  };
-};