@verdaccio/auth 6.0.0-6-next.26 → 6.0.0-6-next.28

package/build/utils.js

@@ -158,14 +158,20 @@ function verifyJWTPayload(token, secret) {
 function isAuthHeaderValid(authorization) {
   return authorization.split(' ').length === 2;
 }
+/**
+ * Return a default configuration for authentication if none is provided.
+ * @param logger {Logger}
+ * @returns object of default implementations.
+ */
+
 
 function getDefaultPlugins(logger) {
   return {
-    authenticate(user, password, cb) {
+    authenticate(_user, _password, cb) {
       cb(_core.errorUtils.getForbidden(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
 
-    adduser(user, password, cb) {
+    adduser(_user, _password, cb) {
       return cb(_core.errorUtils.getConflict(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
 

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","user","password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n} from '@verdaccio/core';\nimport {\n  AuthPackageAllow,\n  Callback,\n  Config,\n  IPluginAuth,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\nimport { verifyPayload } from './jwt-token';\nimport { aesDecrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\nexport function getDefaultPlugins(logger: any): IPluginAuth<Config> {\n  return {\n    authenticate(user: string, password: string, cb: Callback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(user: string, password: string, cb: Callback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AACA;;AAkBA;;AACA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAqBA;AACA;AACA;AACA;AACO,SAASC,oBAAT,CAA8BC,mBAA9B,EAA4E;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAApB,CAA0B,GAA1B,CAAd;EACA,MAAM,CAACC,MAAD,EAASC,KAAT,IAAkBH,KAAxB;EAEA,OAAO;IAAEE,MAAF;IAAUC;EAAV,CAAP;AACD;;AAEM,SAASC,mBAAT,CAA6BL,mBAA7B,EAA0DM,MAA1D,EAA0E;EAC/ET,KAAK,CAAC,qBAAD,CAAL;EACA,MAAM;IAAEM,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C,CAF+E,CAI/E;EACA;;EACA,IAAIG,MAAM,CAACI,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;IACtDV,KAAK,CAAC,qBAAD,CAAL;IACA,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAD,CAAtB,CAA8BO,QAA9B,EAApB;IAEA,OAAOF,WAAP;EACD,CALD,MAKO,IAAIN,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAA7B,EAAyD;IAC9DV,KAAK,CAAC,sBAAD,CAAL;IACA,MAAMY,WAAW,GAAG,IAAAI,uBAAA,EAAWT,KAAX,EAAkBE,MAAlB,CAApB;IAEA,OAAOG,WAAP;EACD;AACF;;AAEM,SAASK,wBAAT,CACLC,QADK,EAELC,SAFK,EAGLhB,mBAHK,EAIkB;EACvBH,KAAK,CAAC,0BAAD,CAAL,CADuB,CAEvB;;EACA,IAAIoB,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,WAAD,CAAL;IACA,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAD,EAAsBgB,SAAtB,CAAvC;;IACA,IAAI,CAACP,WAAL,EAAkB;MAChBZ,KAAK,CAAC,iCAAD,CAAL;MACA;IACD;;IAED,MAAMqB,iBAAiB,GAAG,IAAAC,wBAAA,EAAkBV,WAAlB,CAA1B;;IACA,IAAI,CAACS,iBAAL,EAAwB;MACtBrB,KAAK,CAAC,+CAAD,CAAL;MACA;IACD;;IAED,OAAOqB,iBAAP;EACD;;EACD,MAAM;IAAEf,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C;EAEAH,KAAK,CAAC,QAAD,CAAL;;EACA,IAAIuB,eAAA,CAAEC,QAAF,CAAWjB,KAAX,KAAqBD,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAAlD,EAA8E;IAC5E,OAAOe,gBAAgB,CAAClB,KAAD,EAAQY,SAAR,CAAvB;EACD;AACF;;AAEM,SAASC,WAAT,CAAqBF,QAArB,EAAkD;EACvD,MAAM;IAAEQ,MAAF;IAAUC;EAAV,IAAkBT,QAAQ,CAACU,GAAjC;EAEA,OAAOL,eAAA,CAAEM,KAAF,CAAQH,MAAR,MAAoB,KAApB,IAA6BH,eAAA,CAAEM,KAAF,CAAQF,GAAR,CAA7B,IAA6CD,MAAM,KAAK,IAA/D;AACD;;AAEM,eAAeI,WAAf,CACLC,IADK,EAELC,MAFK,EAGLC,UAHK,EAILC,WAJK,EAKmB;EACxBlC,KAAK,CAAC,eAAD,CAAL;EACA,MAAM;IAAEkB;EAAF,IAAec,MAArB;;EAEA,IAAIZ,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,yBAAD,CAAL,CADyB,CAEzB;;IACA,OAAO,MAAM,IAAImC,OAAJ,CAAaC,OAAD,IAAmB;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;IACD,CAFY,CAAb;EAGD;;EACD,MAAM;IAAEP;EAAF,IAAUT,QAAQ,CAACU,GAAzB;;EAEA,IAAID,GAAJ,aAAIA,GAAJ,eAAIA,GAAG,CAAEa,IAAT,EAAe;IACb,OAAO,MAAMT,IAAI,CAACU,UAAL,CAAgBR,UAAhB,EAA4BN,GAAG,CAACa,IAAhC,CAAb;EACD;;EACD,OAAO,MAAM,IAAIL,OAAJ,CAAaC,OAAD,IAAmB;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;EACD,CAFY,CAAb;AAGD;;AAEM,MAAMQ,aAAuB,GAAG,CAAC,mBAAD,EAAsB,mBAAtB,CAAhC;;;AAEA,SAASjB,gBAAT,CAA0BlB,KAA1B,EAAyCE,MAAzC,EAAqE;EAC1E,IAAI;IACF,MAAMkC,OAAmB,GAAG,IAAAC,uBAAA,EAAcrC,KAAd,EAAqBE,MAArB,CAA5B;IAEA,OAAOkC,OAAP;EACD,CAJD,CAIE,OAAOE,KAAP,EAAmB;IACnB;IACA,IAAIH,aAAa,CAACI,QAAd,CAAuBD,KAAK,CAACN,IAA7B,CAAJ,EAAwC;MACtC;MACA;MACA;MACA,OAAO,IAAAQ,iCAAA,GAAP;IACD;;IACD,MAAMC,gBAAA,CAAWC,OAAX,CAAmBC,iBAAA,CAAYC,YAA/B,EAA6CN,KAAK,CAACO,OAAnD,CAAN;EACD;AACF;;AAEM,SAASC,iBAAT,CAA2BC,aAA3B,EAA2D;EAChE,OAAOA,aAAa,CAACjD,KAAd,CAAoB,GAApB,EAAyBkD,MAAzB,KAAoC,CAA3C;AACD;;AAEM,SAASC,iBAAT,CAA2BC,MAA3B,EAA6D;EAClE,OAAO;IACLC,YAAY,CAACC,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;MAC/DA,EAAE,CAACb,gBAAA,CAAWc,YAAX,CAAwBC,eAAA,CAAUC,qBAAlC,CAAD,CAAF;IACD,CAHI;;IAKLC,OAAO,CAACN,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;MAC1D,OAAOA,EAAE,CAACb,gBAAA,CAAWkB,WAAX,CAAuBH,eAAA,CAAUC,qBAAjC,CAAD,CAAT;IACD,CAPI;;IASL;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAD,EAAWX,MAAX,CAXrB;IAYL;IACAY,aAAa,EAAED,YAAY,CAAC,SAAD,EAAYX,MAAZ,CAbtB;IAcLa,eAAe,EAAEC,sBAAsB,CAACd,MAAD;EAdlC,CAAP;AAgBD;;AAIM,SAASW,YAAT,CAAsBI,MAAtB,EAA8Cf,MAA9C,EAAmE;EACxE,OAAO,SAASgB,mBAAT,CACLd,IADK,EAELe,GAFK,EAGLC,QAHK,EAIC;IACNlB,MAAM,CAACmB,KAAP,CAAa;MAAEC,MAAM,EAAElB,IAAI,CAACpB;IAAf,CAAb,EAAqC,sCAArC;IACA,MAAM;MAAEA,IAAF;MAAQuC;IAAR,IAAmBnB,IAAzB;IACA,MAAMoB,WAAW,GAAGL,GAAG,CAACF,MAAD,CAAvB;IACA,MAAMQ,aAAa,GAAGD,WAAW,CAACE,IAAZ,CAAkBC,KAAD,IAAW3C,IAAI,KAAK2C,KAAT,IAAkBJ,MAAM,CAAChC,QAAP,CAAgBoC,KAAhB,CAA9C,CAAtB;IACAzB,MAAM,CAACmB,KAAP,CACE;MAAEO,OAAO,EAAET,GAAG,CAACnC,IAAf;MAAqByC,aAArB;MAAoCH,MAAM,EAAElB,IAAI,CAACpB,IAAjD;MAAuDwC;IAAvD,CADF,EAEG,+FAFH;;IAKA,IAAIC,aAAJ,EAAmB;MACjBvB,MAAM,CAACmB,KAAP,CAAa;QAAEC,MAAM,EAAElB,IAAI,CAACpB;MAAf,CAAb,EAAqC,iDAArC;MACA,OAAOoC,QAAQ,CAAC,IAAD,EAAO,IAAP,CAAf;IACD;;IAED,IAAIpC,IAAJ,EAAU;MACRoC,QAAQ,CACN3B,gBAAA,CAAWc,YAAX,CAAyB,QAAOvB,IAAK,sBAAqBiC,MAAO,YAAWE,GAAG,CAACnC,IAAK,EAArF,CADM,CAAR;IAGD,CAJD,MAIO;MACLoC,QAAQ,CACN3B,gBAAA,CAAWoC,eAAX,CAA4B,6BAA4BZ,MAAO,YAAWE,GAAG,CAACnC,IAAK,EAAnF,CADM,CAAR;IAGD;EACF,CA5BD;AA6BD;AAED;AACA;AACA;;;AACO,SAASgC,sBAAT,CAAgCd,MAAhC,EAA6C;EAClD,OAAO,UAAUE,IAAV,EAA4Be,GAA5B,EAAmDC,QAAnD,EAAwF;IAC7F,MAAMH,MAAM,GAAG,WAAf,CAD6F,CAE7F;;IACA,MAAMa,kBAA2B,GAAG9D,eAAA,CAAEM,KAAF,CAAQ6C,GAAG,CAACF,MAAD,CAAX,CAApC;;IACA,MAAMc,SAAkB,GAAGD,kBAAkB,GAAG,KAAH,GAAYX,GAAG,CAACF,MAAD,CAAJ,CAA0BjB,MAA1B,GAAmC,CAA3F;IACAE,MAAM,CAACmB,KAAP,CACE;MAAEjB,IAAI,EAAEA,IAAI,CAACpB,IAAb;MAAmBA,IAAI,EAAEmC,GAAG,CAACnC,IAA7B;MAAmC+C;IAAnC,CADF,EAEG,qEAFH;;IAKA,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAxC,EAA+C;MAC7C,OAAOX,QAAQ,CAAC,IAAD,EAAOY,SAAP,CAAf;IACD;;IAED9B,MAAM,CAACmB,KAAP,CACE;MAAEjB,IAAI,EAAEA,IAAI,CAACpB,IAAb;MAAmBA,IAAI,EAAEmC,GAAG,CAACnC,IAA7B;MAAmCiC,MAAnC;MAA2Cc;IAA3C,CADF,EAEG,6EAFH;IAIA,OAAOlB,YAAY,CAACI,MAAD,EAASf,MAAT,CAAZ,CAA6BE,IAA7B,EAAmCe,GAAnC,EAAwCC,QAAxC,CAAP;EACD,CAnBD;AAoBD;;AAEM,SAASrC,SAAT,CAAmBC,IAAnB,EAAiCqB,QAAjC,EAA2D;EAChE,OAAO4B,MAAM,CAAE,GAAEjD,IAAK,IAAGqB,QAAS,EAArB,CAAb;AACD;;AAEM,SAAS/C,sBAAT,CAAgC8B,OAAhC,EAAyD;EAC9D,OAAO8C,MAAM,CAACC,IAAP,CAAY/C,OAAZ,EAAqB,QAArB,CAAP;AACD"}
+{"version":3,"file":"utils.js","names":["debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\nimport { verifyPayload } from './jwt-token';\nimport { aesDecrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AACA;;AAYA;;AACA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAqBA;AACA;AACA;AACA;AACO,SAASC,oBAAT,CAA8BC,mBAA9B,EAA4E;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAApB,CAA0B,GAA1B,CAAd;EACA,MAAM,CAACC,MAAD,EAASC,KAAT,IAAkBH,KAAxB;EAEA,OAAO;IAAEE,MAAF;IAAUC;EAAV,CAAP;AACD;;AAEM,SAASC,mBAAT,CAA6BL,mBAA7B,EAA0DM,MAA1D,EAA0E;EAC/ET,KAAK,CAAC,qBAAD,CAAL;EACA,MAAM;IAAEM,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C,CAF+E,CAI/E;EACA;;EACA,IAAIG,MAAM,CAACI,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;IACtDV,KAAK,CAAC,qBAAD,CAAL;IACA,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAD,CAAtB,CAA8BO,QAA9B,EAApB;IAEA,OAAOF,WAAP;EACD,CALD,MAKO,IAAIN,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAA7B,EAAyD;IAC9DV,KAAK,CAAC,sBAAD,CAAL;IACA,MAAMY,WAAW,GAAG,IAAAI,uBAAA,EAAWT,KAAX,EAAkBE,MAAlB,CAApB;IAEA,OAAOG,WAAP;EACD;AACF;;AAEM,SAASK,wBAAT,CACLC,QADK,EAELC,SAFK,EAGLhB,mBAHK,EAIkB;EACvBH,KAAK,CAAC,0BAAD,CAAL,CADuB,CAEvB;;EACA,IAAIoB,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,WAAD,CAAL;IACA,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAD,EAAsBgB,SAAtB,CAAvC;;IACA,IAAI,CAACP,WAAL,EAAkB;MAChBZ,KAAK,CAAC,iCAAD,CAAL;MACA;IACD;;IAED,MAAMqB,iBAAiB,GAAG,IAAAC,wBAAA,EAAkBV,WAAlB,CAA1B;;IACA,IAAI,CAACS,iBAAL,EAAwB;MACtBrB,KAAK,CAAC,+CAAD,CAAL;MACA;IACD;;IAED,OAAOqB,iBAAP;EACD;;EACD,MAAM;IAAEf,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C;EAEAH,KAAK,CAAC,QAAD,CAAL;;EACA,IAAIuB,eAAA,CAAEC,QAAF,CAAWjB,KAAX,KAAqBD,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAAlD,EAA8E;IAC5E,OAAOe,gBAAgB,CAAClB,KAAD,EAAQY,SAAR,CAAvB;EACD;AACF;;AAEM,SAASC,WAAT,CAAqBF,QAArB,EAAkD;EACvD,MAAM;IAAEQ,MAAF;IAAUC;EAAV,IAAkBT,QAAQ,CAACU,GAAjC;EAEA,OAAOL,eAAA,CAAEM,KAAF,CAAQH,MAAR,MAAoB,KAApB,IAA6BH,eAAA,CAAEM,KAAF,CAAQF,GAAR,CAA7B,IAA6CD,MAAM,KAAK,IAA/D;AACD;;AAEM,eAAeI,WAAf,CACLC,IADK,EAELC,MAFK,EAGLC,UAHK,EAILC,WAJK,EAKmB;EACxBlC,KAAK,CAAC,eAAD,CAAL;EACA,MAAM;IAAEkB;EAAF,IAAec,MAArB;;EAEA,IAAIZ,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,yBAAD,CAAL,CADyB,CAEzB;;IACA,OAAO,MAAM,IAAImC,OAAJ,CAAaC,OAAD,IAAmB;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;IACD,CAFY,CAAb;EAGD;;EACD,MAAM;IAAEP;EAAF,IAAUT,QAAQ,CAACU,GAAzB;;EAEA,IAAID,GAAJ,aAAIA,GAAJ,eAAIA,GAAG,CAAEa,IAAT,EAAe;IACb,OAAO,MAAMT,IAAI,CAACU,UAAL,CAAgBR,UAAhB,EAA4BN,GAAG,CAACa,IAAhC,CAAb;EACD;;EACD,OAAO,MAAM,IAAIL,OAAJ,CAAaC,OAAD,IAAmB;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;EACD,CAFY,CAAb;AAGD;;AAEM,MAAMQ,aAAuB,GAAG,CAAC,mBAAD,EAAsB,mBAAtB,CAAhC;;;AAEA,SAASjB,gBAAT,CAA0BlB,KAA1B,EAAyCE,MAAzC,EAAqE;EAC1E,IAAI;IACF,MAAMkC,OAAmB,GAAG,IAAAC,uBAAA,EAAcrC,KAAd,EAAqBE,MAArB,CAA5B;IAEA,OAAOkC,OAAP;EACD,CAJD,CAIE,OAAOE,KAAP,EAAmB;IACnB;IACA,IAAIH,aAAa,CAACI,QAAd,CAAuBD,KAAK,CAACN,IAA7B,CAAJ,EAAwC;MACtC;MACA;MACA;MACA,OAAO,IAAAQ,iCAAA,GAAP;IACD;;IACD,MAAMC,gBAAA,CAAWC,OAAX,CAAmBC,iBAAA,CAAYC,YAA/B,EAA6CN,KAAK,CAACO,OAAnD,CAAN;EACD;AACF;;AAEM,SAASC,iBAAT,CAA2BC,aAA3B,EAA2D;EAChE,OAAOA,aAAa,CAACjD,KAAd,CAAoB,GAApB,EAAyBkD,MAAzB,KAAoC,CAA3C;AACD;AAED;AACA;AACA;AACA;AACA;;;AACO,SAASC,iBAAT,CAA2BC,MAA3B,EAAqE;EAC1E,OAAO;IACLC,YAAY,CAACC,KAAD,EAAgBC,SAAhB,EAAmCC,EAAnC,EAAuE;MACjFA,EAAE,CAACb,gBAAA,CAAWc,YAAX,CAAwBC,eAAA,CAAUC,qBAAlC,CAAD,CAAF;IACD,CAHI;;IAKLC,OAAO,CAACN,KAAD,EAAgBC,SAAhB,EAAmCC,EAAnC,EAA2E;MAChF,OAAOA,EAAE,CAACb,gBAAA,CAAWkB,WAAX,CAAuBH,eAAA,CAAUC,qBAAjC,CAAD,CAAT;IACD,CAPI;;IASL;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAD,EAAWX,MAAX,CAXrB;IAYL;IACAY,aAAa,EAAED,YAAY,CAAC,SAAD,EAAYX,MAAZ,CAbtB;IAcLa,eAAe,EAAEC,sBAAsB,CAACd,MAAD;EAdlC,CAAP;AAgBD;;AAIM,SAASW,YAAT,CAAsBI,MAAtB,EAA8Cf,MAA9C,EAA2E;EAChF,OAAO,SAASgB,mBAAT,CACLC,IADK,EAELC,GAFK,EAGLC,QAHK,EAIC;IACNnB,MAAM,CAACoB,KAAP,CAAa;MAAEC,MAAM,EAAEJ,IAAI,CAACnC;IAAf,CAAb,EAAqC,sCAArC;IACA,MAAM;MAAEA,IAAF;MAAQwC;IAAR,IAAmBL,IAAzB;IACA,MAAMM,WAAW,GAAGL,GAAG,CAACH,MAAD,CAAvB;IACA,MAAMS,aAAa,GAAGD,WAAW,CAACE,IAAZ,CAAkBC,KAAD,IAAW5C,IAAI,KAAK4C,KAAT,IAAkBJ,MAAM,CAACjC,QAAP,CAAgBqC,KAAhB,CAA9C,CAAtB;IACA1B,MAAM,CAACoB,KAAP,CACE;MAAEO,OAAO,EAAET,GAAG,CAACpC,IAAf;MAAqB0C,aAArB;MAAoCH,MAAM,EAAEJ,IAAI,CAACnC,IAAjD;MAAuDyC;IAAvD,CADF,EAEG,+FAFH;;IAKA,IAAIC,aAAJ,EAAmB;MACjBxB,MAAM,CAACoB,KAAP,CAAa;QAAEC,MAAM,EAAEJ,IAAI,CAACnC;MAAf,CAAb,EAAqC,iDAArC;MACA,OAAOqC,QAAQ,CAAC,IAAD,EAAO,IAAP,CAAf;IACD;;IAED,IAAIrC,IAAJ,EAAU;MACRqC,QAAQ,CACN5B,gBAAA,CAAWc,YAAX,CAAyB,QAAOvB,IAAK,sBAAqBiC,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAArF,CADM,CAAR;IAGD,CAJD,MAIO;MACLqC,QAAQ,CACN5B,gBAAA,CAAWqC,eAAX,CAA4B,6BAA4Bb,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAAnF,CADM,CAAR;IAGD;EACF,CA5BD;AA6BD;AAED;AACA;AACA;;;AACO,SAASgC,sBAAT,CAAgCd,MAAhC,EAAqD;EAC1D,OAAO,UAAUiB,IAAV,EAA4BC,GAA5B,EAAmDC,QAAnD,EAAwF;IAC7F,MAAMJ,MAAM,GAAG,WAAf,CAD6F,CAE7F;;IACA,MAAMc,kBAA2B,GAAG/D,eAAA,CAAEM,KAAF,CAAQ8C,GAAG,CAACH,MAAD,CAAX,CAApC;;IACA,MAAMe,SAAkB,GAAGD,kBAAkB,GAAG,KAAH,GAAYX,GAAG,CAACH,MAAD,CAAJ,CAA0BjB,MAA1B,GAAmC,CAA3F;IACAE,MAAM,CAACoB,KAAP,CACE;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAb;MAAmBA,IAAI,EAAEoC,GAAG,CAACpC,IAA7B;MAAmCgD;IAAnC,CADF,EAEG,qEAFH;;IAKA,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAxC,EAA+C;MAC7C,OAAOX,QAAQ,CAAC,IAAD,EAAOY,SAAP,CAAf;IACD;;IAED/B,MAAM,CAACoB,KAAP,CACE;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAb;MAAmBA,IAAI,EAAEoC,GAAG,CAACpC,IAA7B;MAAmCiC,MAAnC;MAA2Ce;IAA3C,CADF,EAEG,6EAFH;IAIA,OAAOnB,YAAY,CAACI,MAAD,EAASf,MAAT,CAAZ,CAA6BiB,IAA7B,EAAmCC,GAAnC,EAAwCC,QAAxC,CAAP;EACD,CAnBD;AAoBD;;AAEM,SAAStC,SAAT,CAAmBC,IAAnB,EAAiCkD,QAAjC,EAA2D;EAChE,OAAOC,MAAM,CAAE,GAAEnD,IAAK,IAAGkD,QAAS,EAArB,CAAb;AACD;;AAEM,SAAS5E,sBAAT,CAAgC8B,OAAhC,EAAyD;EAC9D,OAAOgD,MAAM,CAACC,IAAP,CAAYjD,OAAZ,EAAqB,QAArB,CAAP;AACD"}

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@verdaccio/auth",
-  "version": "6.0.0-6-next.26",
+  "version": "6.0.0-6-next.28",
   "description": "logger",
   "main": "./build/index.js",
-  "types": "build/index.d.ts",
+  "types": "./build/index.d.ts",
   "author": {
     "name": "Juan Picado",
     "email": "juanpicado19@gmail.com"
@@ -30,19 +30,19 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "6.0.0-6-next.47",
-    "@verdaccio/config": "6.0.0-6-next.47",
-    "@verdaccio/loaders": "6.0.0-6-next.16",
-    "@verdaccio/logger": "6.0.0-6-next.15",
-    "@verdaccio/utils": "6.0.0-6-next.15",
+    "@verdaccio/core": "6.0.0-6-next.49",
+    "@verdaccio/config": "6.0.0-6-next.49",
+    "@verdaccio/loaders": "6.0.0-6-next.18",
+    "@verdaccio/logger": "6.0.0-6-next.17",
+    "@verdaccio/utils": "6.0.0-6-next.17",
     "debug": "4.3.4",
     "express": "4.18.1",
     "jsonwebtoken": "8.5.1",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "11.0.0-6-next.17"
+    "verdaccio-htpasswd": "11.0.0-6-next.19"
   },
   "devDependencies": {
-    "@verdaccio/types": "11.0.0-6-next.16"
+    "@verdaccio/types": "11.0.0-6-next.17"
   },
   "funding": {
     "type": "opencollective",

package/src/auth.ts

@@ -1,7 +1,7 @@
 import buildDebug from 'debug';
-import { NextFunction, Request, Response } from 'express';
+import { NextFunction, Request, RequestHandler, Response } from 'express';
 import _ from 'lodash';
-import { HTPasswd, HTPasswdConfig } from 'verdaccio-htpasswd';
+import { HTPasswd } from 'verdaccio-htpasswd';
 
 import { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';
 import {
@@ -11,18 +11,17 @@ import {
   TOKEN_BEARER,
   VerdaccioError,
   errorUtils,
+  pluginUtils,
 } from '@verdaccio/core';
-import { loadPlugin } from '@verdaccio/loaders';
+import { asyncLoadPlugin } from '@verdaccio/loaders';
+import { logger } from '@verdaccio/logger';
 import {
   AllowAccess,
-  AuthPluginPackage,
   Callback,
   Config,
-  IPluginAuth,
   JWTSignOptions,
   Logger,
   PackageAccess,
-  PluginOptions,
   RemoteUser,
   Security,
 } from '@verdaccio/types';
@@ -41,20 +40,8 @@ import {
   verifyJWTPayload,
 } from './utils';
 
-/* eslint-disable @typescript-eslint/no-var-requires */
-const LoggerApi = require('@verdaccio/logger');
-
 const debug = buildDebug('verdaccio:auth');
 
-export interface IBasicAuth<T> {
-  config: T & Config;
-  authenticate(user: string, password: string, cb: Callback): void;
-  invalidateToken?(token: string): Promise<void>;
-  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;
-  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
-  add_user(user: string, password: string, cb: Callback): any;
-}
-
 export interface TokenEncryption {
   jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
   aesEncrypt(buf: string): string | void;
@@ -64,84 +51,84 @@ export interface AESPayload {
   user: string;
   password: string;
 }
-
-export type $RequestExtend = Request & { remote_user?: any; log: Logger };
-export type $ResponseExtend = Response & { cookies?: any };
-export type $NextFunctionVer = NextFunction & any;
-
 export interface IAuthMiddleware {
   apiJWTmiddleware(): $NextFunctionVer;
   webUIJWTmiddleware(): $NextFunctionVer;
 }
 
-export interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {
-  config: Config;
-  logger: Logger;
-  secret: string;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  plugins: any[];
-  allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
-  invalidateToken(token: string): Promise<void>;
-}
+export type $RequestExtend = Request & { remote_user?: any; log: Logger };
+export type $ResponseExtend = Response & { cookies?: any };
+export type $NextFunctionVer = NextFunction & any;
 
-class Auth implements IAuth {
+class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   public config: Config;
-  public logger: Logger;
   public secret: string;
-  public plugins: IPluginAuth<Config>[];
+  public plugins: pluginUtils.Auth<Config>[];
 
   public constructor(config: Config) {
     this.config = config;
-    this.logger = LoggerApi.logger.child({ sub: 'auth' });
     this.secret = config.secret;
+    this.plugins = [];
     if (!this.secret) {
       throw new TypeError('secret it is required value on initialize the auth class');
     }
+  }
+
+  public async init() {
+    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];
+    debug('auth plugins found %s', plugins.length);
+    if (!plugins || plugins.length === 0) {
+      plugins = this.loadDefaultPlugin();
+    }
+    this.plugins = plugins;
 
-    this.plugins =
-      _.isNil(config?.auth) === false ? this._loadPlugin(config) : this.loadDefaultPlugin(config);
     this._applyDefaultPlugins();
   }
 
-  private loadDefaultPlugin(config: Config) {
-    const plugingConf: HTPasswdConfig = { ...config, file: './htpasswd' };
-    const pluginOptions: PluginOptions<{}> = {
-      config,
-      logger: this.logger,
+  private loadDefaultPlugin() {
+    debug('load default auth plugin');
+    const pluginOptions: pluginUtils.PluginOptions = {
+      config: this.config,
+      logger,
     };
     let authPlugin;
     try {
-      authPlugin = new HTPasswd(plugingConf, pluginOptions as any as PluginOptions<HTPasswdConfig>);
+      authPlugin = new HTPasswd(
+        { file: './htpasswd' },
+        pluginOptions as any as pluginUtils.PluginOptions
+      );
     } catch (error: any) {
       debug('error on loading auth htpasswd plugin stack: %o', error);
+      logger.info({}, 'no auth plugin has been found');
       return [];
     }
 
     return [authPlugin];
   }
 
-  private _loadPlugin(config: Config): IPluginAuth<Config>[] {
-    const pluginOptions = {
-      config,
-      logger: this.logger,
-    };
-
-    return loadPlugin<IPluginAuth<Config>>(
-      config,
-      config.auth,
-      pluginOptions,
-      (plugin: IPluginAuth<Config>): boolean => {
+  private async loadPlugin() {
+    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(
+      this.config.auth,
+      {
+        config: this.config,
+        logger,
+      },
+      (plugin): boolean => {
         const { authenticate, allow_access, allow_publish } = plugin;
 
-        // @ts-ignore
-        return authenticate || allow_access || allow_publish;
-      }
+        return (
+          typeof authenticate !== 'undefined' ||
+          typeof allow_access !== 'undefined' ||
+          typeof allow_publish !== 'undefined'
+        );
+      },
+      this.config?.serverSettings?.pluginPrefix
     );
   }
 
   private _applyDefaultPlugins(): void {
     // TODO: rename to applyFallbackPluginMethods
-    this.plugins.push(getDefaultPlugins(this.logger));
+    this.plugins.push(getDefaultPlugins(logger));
   }
 
   public changePassword(
@@ -164,7 +151,7 @@ class Auth implements IAuth {
         debug('updating password for %o', username);
         plugin.changePassword!(username, password, newPassword, (err, profile): void => {
           if (err) {
-            this.logger.error(
+            logger.error(
               { username, err },
               `An error has been produced
             updating the password for @{username}. Error: @{err.message}`
@@ -185,17 +172,21 @@ class Auth implements IAuth {
     return Promise.resolve();
   }
 
-  public authenticate(username: string, password: string, cb: Callback): void {
+  public authenticate(
+    username: string,
+    password: string,
+    cb: (error: VerdaccioError | null, user?: RemoteUser) => void
+  ): void {
     const plugins = this.plugins.slice(0);
     (function next(): void {
-      const plugin = plugins.shift() as IPluginAuth<Config>;
+      const plugin = plugins.shift() as pluginUtils.Auth<Config>;
 
       if (isFunction(plugin.authenticate) === false) {
         return next();
       }
 
       debug('authenticating %o', username);
-      plugin.authenticate(username, password, function (err, groups): void {
+      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {
         if (err) {
           debug('authenticating for user %o failed. Error: %o', username, err?.message);
           return cb(err);
@@ -226,37 +217,42 @@ class Auth implements IAuth {
     })();
   }
 
-  public add_user(user: string, password: string, cb: Callback): void {
+  public add_user(
+    user: string,
+    password: string,
+    cb: (error: VerdaccioError | null, user?: RemoteUser) => void
+  ): void {
     const self = this;
     const plugins = this.plugins.slice(0);
     debug('add user %o', user);
 
     (function next(): void {
-      const plugin = plugins.shift() as IPluginAuth<Config>;
-      let method = 'adduser';
-      if (isFunction(plugin[method]) === false) {
-        method = 'add_user';
-        self.logger.warn(
-          'the plugin method add_user in the auth plugin is deprecated and will' +
-            ' be removed in next major release, notify to the plugin author'
-        );
-      }
-
-      if (isFunction(plugin[method]) === false) {
+      const plugin = plugins.shift() as pluginUtils.Auth<Config>;
+      if (typeof plugin.adduser !== 'function') {
         next();
       } else {
-        // p.add_user() execution
-        plugin[method](user, password, function (err, ok): void {
-          if (err) {
-            debug('the user  %o could not being added. Error: %o', user, err?.message);
-            return cb(err);
-          }
-          if (ok) {
-            debug('the user %o has been added', user);
-            return self.authenticate(user, password, cb);
+        // @ts-expect-error future major (7.x) should remove this section
+        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
+          throw errorUtils.getInternalError(
+            'add_user method not longer supported, rename to adduser'
+          );
+        }
+
+        plugin.adduser(
+          user,
+          password,
+          function (err: VerdaccioError | null, ok?: boolean | string): void {
+            if (err) {
+              debug('the user  %o could not being added. Error: %o', user, err?.message);
+              return cb(err);
+            }
+            if (ok) {
+              debug('the user %o has been added', user);
+              return self.authenticate(user, password, cb);
+            }
+            next();
           }
-          next();
-        });
+        );
       }
     })();
   }
@@ -265,27 +261,27 @@ class Auth implements IAuth {
    * Allow user to access a package.
    */
   public allow_access(
-    { packageName, packageVersion }: AuthPluginPackage,
+    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,
     user: RemoteUser,
-    callback: Callback
+    callback: pluginUtils.AccessCallback
   ): void {
     const plugins = this.plugins.slice(0);
-    const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };
+    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };
     const pkg = Object.assign(
       {},
-      pkgAllowAcces,
+      pkgAllowAccess,
       getMatchedPackagesSpec(packageName, this.config.packages)
     ) as AllowAccess & PackageAccess;
     debug('allow access for %o', packageName);
 
     (function next(): void {
-      const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;
+      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;
 
       if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {
         return next();
       }
 
-      plugin.allow_access!(user, pkg, function (err, ok: boolean): void {
+      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {
         if (err) {
           debug('forbidden access for %o. Error: %o', packageName, err?.message);
           return callback(err);
@@ -302,7 +298,7 @@ class Auth implements IAuth {
   }
 
   public allow_unpublish(
-    { packageName, packageVersion }: AuthPluginPackage,
+    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,
     user: RemoteUser,
     callback: Callback
   ): void {
@@ -347,7 +343,7 @@ class Auth implements IAuth {
    * Allow user to publish a package.
    */
   public allow_publish(
-    { packageName, packageVersion }: AuthPluginPackage,
+    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,
     user: RemoteUser,
     callback: Callback
   ): void {
@@ -355,42 +351,35 @@ class Auth implements IAuth {
     const pkg = Object.assign(
       { name: packageName, version: packageVersion },
       getMatchedPackagesSpec(packageName, this.config.packages)
-    );
+    ) as any;
     debug('allow publish for %o init | plugins: %o', packageName, plugins.length);
 
     (function next(): void {
       const plugin = plugins.shift();
 
-      if (isFunction(plugin?.allow_publish) === false) {
+      if (typeof plugin?.allow_publish !== 'function') {
         debug('allow publish for %o plugin does not implement allow_publish', packageName);
         return next();
       }
 
-      // @ts-ignore
-      plugin.allow_publish(
-        user,
-        // @ts-ignore
-        pkg,
-        // @ts-ignore
-        (err: VerdaccioError, ok: boolean): void => {
-          if (_.isNil(err) === false && _.isError(err)) {
-            debug('forbidden publish for %o', packageName);
-            return callback(err);
-          }
-
-          if (ok) {
-            debug('allowed publish for %o', packageName);
-            return callback(null, ok);
-          }
+      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {
+        if (_.isNil(err) === false && _.isError(err)) {
+          debug('forbidden publish for %o', packageName);
+          return callback(err);
+        }
 
-          debug('allow publish skip validation for %o', packageName);
-          next(); // cb(null, false) causes next plugin to roll
+        if (ok) {
+          debug('allowed publish for %o', packageName);
+          return callback(null, ok);
         }
-      );
+
+        debug('allow publish skip validation for %o', packageName);
+        next(); // cb(null, false) causes next plugin to roll
+      });
     })();
   }
 
-  public apiJWTmiddleware(): Function {
+  public apiJWTmiddleware(): RequestHandler {
     debug('jwt middleware');
     const plugins = this.plugins.slice(0);
     const helpers = { createAnonymousRemoteUser, createRemoteUser };
@@ -400,10 +389,11 @@ class Auth implements IAuth {
       }
     }
 
-    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {
+    // @ts-ignore
+    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {
       req.pause();
 
-      const next = function (err: VerdaccioError | void): void {
+      const next = function (err?: VerdaccioError): any {
         req.resume();
         // uncomment this to reject users with bad auth headers
         // return _next.apply(null, arguments)
@@ -412,6 +402,7 @@ class Auth implements IAuth {
         if (err) {
           req.remote_user.error = err.message;
         }
+
         return _next();
       };
 
@@ -462,7 +453,7 @@ class Auth implements IAuth {
       const credentials = convertPayloadToBase64(token).toString();
       const { user, password } = parseBasicPayload(credentials) as AESPayload;
       debug('authenticating %o', user);
-      this.authenticate(user, password, (err, user): void => {
+      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {
         if (!err) {
           debug('generating a remote user');
           req.remote_user = user;
@@ -522,14 +513,15 @@ class Auth implements IAuth {
     }
   }
 
-  private _isRemoteUserValid(remote_user: RemoteUser): boolean {
-    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;
+  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {
+    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;
   }
 
   /**
    * JWT middleware for WebUI
    */
-  public webUIJWTmiddleware(): Function {
+  public webUIJWTmiddleware(): RequestHandler {
+    // @ts-ignore
     return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {
       if (this._isRemoteUserValid(req.remote_user)) {
         return _next();
@@ -560,7 +552,7 @@ class Auth implements IAuth {
         return next();
       }
 
-      let credentials;
+      let credentials: RemoteUser | undefined;
       try {
         credentials = verifyJWTPayload(token, this.config.secret);
       } catch (err: any) {
@@ -568,9 +560,8 @@ class Auth implements IAuth {
       }
 
       if (this._isRemoteUserValid(credentials)) {
-        const { name, groups } = credentials;
-        // $FlowFixMe
-        req.remote_user = createRemoteUser(name, groups);
+        const { name, groups } = credentials as RemoteUser;
+        req.remote_user = createRemoteUser(name as string, groups);
       } else {
         req.remote_user = createAnonymousRemoteUser();
       }

package/src/index.ts

@@ -1,4 +1,4 @@
-export { Auth, IAuth, TokenEncryption, IBasicAuth } from './auth';
+export { Auth, TokenEncryption } from './auth';
 export * from './utils';
 export * from './legacy-token';
 export * from './jwt-token';

package/src/utils.ts

@@ -9,15 +9,9 @@ import {
   TOKEN_BEARER,
   VerdaccioError,
   errorUtils,
+  pluginUtils,
 } from '@verdaccio/core';
-import {
-  AuthPackageAllow,
-  Callback,
-  Config,
-  IPluginAuth,
-  RemoteUser,
-  Security,
-} from '@verdaccio/types';
+import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
 
 import { AESPayload, TokenEncryption } from './auth';
 import { verifyPayload } from './jwt-token';
@@ -161,13 +155,18 @@ export function isAuthHeaderValid(authorization: string): boolean {
   return authorization.split(' ').length === 2;
 }
 
-export function getDefaultPlugins(logger: any): IPluginAuth<Config> {
+/**
+ * Return a default configuration for authentication if none is provided.
+ * @param logger {Logger}
+ * @returns object of default implementations.
+ */
+export function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {
   return {
-    authenticate(user: string, password: string, cb: Callback): void {
+    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {
       cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));
     },
 
-    adduser(user: string, password: string, cb: Callback): void {
+    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {
       return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));
     },
 
@@ -182,7 +181,7 @@ export function getDefaultPlugins(logger: any): IPluginAuth<Config> {
 
 export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
 
-export function allow_action(action: ActionsAllowed, logger): AllowAction {
+export function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {
   return function allowActionCallback(
     user: RemoteUser,
     pkg: AuthPackageAllow,
@@ -217,7 +216,7 @@ export function allow_action(action: ActionsAllowed, logger): AllowAction {
 /**
  *
  */
-export function handleSpecialUnpublish(logger): any {
+export function handleSpecialUnpublish(logger: Logger): any {
   return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {
     const action = 'unpublish';
     // verify whether the unpublish prop has been defined