npm - @verdaccio/auth - Versions diffs - 6.0.0-6-next.27 → 6.0.0-6-next.28 - Mend

@verdaccio/auth 6.0.0-6-next.27 → 6.0.0-6-next.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/CHANGELOG.md CHANGED Viewed

@@ -1,5 +1,16 @@
 # @verdaccio/auth
+## 6.0.0-6-next.28
+### Patch Changes
+- @verdaccio/core@6.0.0-6-next.49
+- @verdaccio/config@6.0.0-6-next.49
+- @verdaccio/loaders@6.0.0-6-next.18
+- @verdaccio/logger@6.0.0-6-next.17
+- verdaccio-htpasswd@11.0.0-6-next.19
+- @verdaccio/utils@6.0.0-6-next.17
 ## 6.0.0-6-next.27
 ### Major Changes

package/build/auth.d.ts CHANGED Viewed

@@ -1,13 +1,6 @@
-import { NextFunction, Request, Response } from 'express';
-import { AuthPluginPackage, Callback, Config, IPluginAuth, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
-export interface IBasicAuth<T> {
-    config: T & Config;
-    authenticate(user: string, password: string, cb: Callback): void;
-    invalidateToken?(token: string): Promise<void>;
-    changePassword(user: string, password: string, newPassword: string, cb: Callback): void;
-    allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
-    add_user(user: string, password: string, cb: Callback): any;
-}
+import { NextFunction, Request, RequestHandler, Response } from 'express';
+import { VerdaccioError, pluginUtils } from '@verdaccio/core';
+import { Callback, Config, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
 export interface TokenEncryption {
     jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
     aesEncrypt(buf: string): string | void;
@@ -16,6 +9,10 @@ export interface AESPayload {
     user: string;
     password: string;
 }
+export interface IAuthMiddleware {
+    apiJWTmiddleware(): $NextFunctionVer;
+    webUIJWTmiddleware(): $NextFunctionVer;
+}
 export declare type $RequestExtend = Request & {
     remote_user?: any;
     log: Logger;
@@ -24,24 +21,10 @@ export declare type $ResponseExtend = Response & {
     cookies?: any;
 };
 export declare type $NextFunctionVer = NextFunction & any;
-export interface IAuthMiddleware {
-    apiJWTmiddleware(): $NextFunctionVer;
-    webUIJWTmiddleware(): $NextFunctionVer;
-}
-export interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {
-    config: Config;
-    logger: Logger;
-    secret: string;
-    plugins: any[];
-    allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
-    invalidateToken(token: string): Promise<void>;
-    init(): Promise<void>;
-}
-declare class Auth implements IAuth {
+declare class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     config: Config;
-    logger: Logger;
     secret: string;
-    plugins: IPluginAuth<Config>[];
+    plugins: pluginUtils.Auth<Config>[];
     constructor(config: Config);
     init(): Promise<void>;
     private loadDefaultPlugin;
@@ -49,25 +32,25 @@ declare class Auth implements IAuth {
     private _applyDefaultPlugins;
     changePassword(username: string, password: string, newPassword: string, cb: Callback): void;
     invalidateToken(token: string): Promise<void>;
-    authenticate(username: string, password: string, cb: Callback): void;
-    add_user(user: string, password: string, cb: Callback): void;
+    authenticate(username: string, password: string, cb: (error: VerdaccioError | null, user?: RemoteUser) => void): void;
+    add_user(user: string, password: string, cb: (error: VerdaccioError | null, user?: RemoteUser) => void): void;
     /**
      * Allow user to access a package.
      */
-    allow_access({ packageName, packageVersion }: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
-    allow_unpublish({ packageName, packageVersion }: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
+    allow_access({ packageName, packageVersion }: pluginUtils.AuthPluginPackage, user: RemoteUser, callback: pluginUtils.AccessCallback): void;
+    allow_unpublish({ packageName, packageVersion }: pluginUtils.AuthPluginPackage, user: RemoteUser, callback: Callback): void;
     /**
      * Allow user to publish a package.
      */
-    allow_publish({ packageName, packageVersion }: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
-    apiJWTmiddleware(): Function;
+    allow_publish({ packageName, packageVersion }: pluginUtils.AuthPluginPackage, user: RemoteUser, callback: Callback): void;
+    apiJWTmiddleware(): RequestHandler;
     private _handleJWTAPIMiddleware;
     private _handleAESMiddleware;
     private _isRemoteUserValid;
     /**
      * JWT middleware for WebUI
      */
-    webUIJWTmiddleware(): Function;
+    webUIJWTmiddleware(): RequestHandler;
     jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
     /**
      * Encrypt a string.

package/build/auth.js CHANGED Viewed

@@ -17,6 +17,8 @@ var _core = require("@verdaccio/core");
 var _loaders = require("@verdaccio/loaders");
+var _logger = require("@verdaccio/logger");
 var _utils = require("@verdaccio/utils");
 var _jwtToken = require("./jwt-token");
@@ -29,17 +31,11 @@ var _utils2 = require("./utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-/* eslint-disable @typescript-eslint/no-var-requires */
-const LoggerApi = require('@verdaccio/logger');
 const debug = (0, _debug.default)('verdaccio:auth');
 class Auth {
   constructor(config) {
     this.config = config;
-    this.logger = LoggerApi.logger.child({
-      sub: 'auth'
-    });
     this.secret = config.secret;
     this.plugins = [];
@@ -65,7 +61,7 @@ class Auth {
     debug('load default auth plugin');
     const pluginOptions = {
       config: this.config,
-      logger: this.logger
+      logger: _logger.logger
     };
     let authPlugin;
@@ -75,6 +71,9 @@ class Auth {
       }, pluginOptions);
     } catch (error) {
       debug('error on loading auth htpasswd plugin stack: %o', error);
+      _logger.logger.info({}, 'no auth plugin has been found');
       return [];
     }
@@ -86,21 +85,20 @@ class Auth {
     return (0, _loaders.asyncLoadPlugin)(this.config.auth, {
       config: this.config,
-      logger: this.logger
+      logger: _logger.logger
     }, plugin => {
       const {
         authenticate,
         allow_access,
         allow_publish
-      } = plugin; // @ts-ignore
-      return authenticate || allow_access || allow_publish;
+      } = plugin;
+      return typeof authenticate !== 'undefined' || typeof allow_access !== 'undefined' || typeof allow_publish !== 'undefined';
     }, (_this$config = this.config) === null || _this$config === void 0 ? void 0 : (_this$config$serverSe = _this$config.serverSettings) === null || _this$config$serverSe === void 0 ? void 0 : _this$config$serverSe.pluginPrefix);
   }
   _applyDefaultPlugins() {
     // TODO: rename to applyFallbackPluginMethods
-    this.plugins.push((0, _utils2.getDefaultPlugins)(this.logger));
+    this.plugins.push((0, _utils2.getDefaultPlugins)(_logger.logger));
   }
   changePassword(username, password, newPassword, cb) {
@@ -118,11 +116,12 @@ class Auth {
         debug('updating password for %o', username);
         plugin.changePassword(username, password, newPassword, (err, profile) => {
           if (err) {
-            this.logger.error({
+            _logger.logger.error({
               username,
               err
             }, `An error has been produced
             updating the password for @{username}. Error: @{err.message}`);
             return cb(err);
           }
@@ -191,18 +190,16 @@ class Auth {
     (function next() {
       const plugin = plugins.shift();
-      let method = 'adduser';
-      if ((0, _utils.isFunction)(plugin[method]) === false) {
-        method = 'add_user';
-        self.logger.warn('the plugin method add_user in the auth plugin is deprecated and will' + ' be removed in next major release, notify to the plugin author');
-      }
-      if ((0, _utils.isFunction)(plugin[method]) === false) {
+      if (typeof plugin.adduser !== 'function') {
         next();
       } else {
-        // p.add_user() execution
-        plugin[method](user, password, function (err, ok) {
+        // @ts-expect-error future major (7.x) should remove this section
+        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
+          throw _core.errorUtils.getInternalError('add_user method not longer supported, rename to adduser');
+        }
+        plugin.adduser(user, password, function (err, ok) {
           if (err) {
             debug('the user  %o could not being added. Error: %o', user, err === null || err === void 0 ? void 0 : err.message);
             return cb(err);
@@ -228,11 +225,11 @@ class Auth {
     packageVersion
   }, user, callback) {
     const plugins = this.plugins.slice(0);
-    const pkgAllowAcces = {
+    const pkgAllowAccess = {
       name: packageName,
       version: packageVersion
     };
-    const pkg = Object.assign({}, pkgAllowAcces, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
+    const pkg = Object.assign({}, pkgAllowAccess, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
     debug('allow access for %o', packageName);
     (function next() {
@@ -314,15 +311,12 @@ class Auth {
     (function next() {
       const plugin = plugins.shift();
-      if ((0, _utils.isFunction)(plugin === null || plugin === void 0 ? void 0 : plugin.allow_publish) === false) {
+      if (typeof (plugin === null || plugin === void 0 ? void 0 : plugin.allow_publish) !== 'function') {
         debug('allow publish for %o plugin does not implement allow_publish', packageName);
         return next();
-      } // @ts-ignore
+      }
-      plugin.allow_publish(user, // @ts-ignore
-      pkg, // @ts-ignore
-      (err, ok) => {
+      plugin.allow_publish(user, pkg, (err, ok) => {
         if (_lodash.default.isNil(err) === false && _lodash.default.isError(err)) {
           debug('forbidden publish for %o', packageName);
           return callback(err);
@@ -351,7 +345,8 @@ class Auth {
       if (plugin.apiJWTmiddleware) {
         return plugin.apiJWTmiddleware(helpers);
       }
-    }
+    } // @ts-ignore
     return (req, res, _next) => {
       req.pause();
@@ -485,7 +480,7 @@ class Auth {
   }
   _isRemoteUserValid(remote_user) {
-    return _lodash.default.isUndefined(remote_user) === false && _lodash.default.isUndefined(remote_user.name) === false;
+    return _lodash.default.isUndefined(remote_user) === false && _lodash.default.isUndefined(remote_user === null || remote_user === void 0 ? void 0 : remote_user.name) === false;
   }
   /**
    * JWT middleware for WebUI
@@ -493,6 +488,7 @@ class Auth {
   webUIJWTmiddleware() {
+    // @ts-ignore
     return (req, res, _next) => {
       if (this._isRemoteUserValid(req.remote_user)) {
         return _next();
@@ -540,8 +536,7 @@ class Auth {
         const {
           name,
           groups
-        } = credentials; // $FlowFixMe
+        } = credentials;
         req.remote_user = (0, _config.createRemoteUser)(name, groups);
       } else {
         req.remote_user = (0, _config.createAnonymousRemoteUser)();

package/build/auth.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"auth.js","names":["LoggerApi","require","debug","buildDebug","Auth","constructor","config","logger","child","sub","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","authPlugin","HTPasswd","file","error","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","warn","ok","packageName","packageVersion","callback","pkgAllowAcces","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n API_ERROR,\n SUPPORT_ERRORS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n AllowAccess,\n AuthPluginPackage,\n Callback,\n Config,\n IPluginAuth,\n JWTSignOptions,\n Logger,\n PackageAccess,\n PluginOptions,\n RemoteUser,\n Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n convertPayloadToBase64,\n getDefaultPlugins,\n getMiddlewareCredentials,\n isAESLegacy,\n isAuthHeaderValid,\n parseAuthTokenHeader,\n verifyJWTPayload,\n} from './utils';\n\n/* eslint-disable @typescript-eslint/no-var-requires /\nconst LoggerApi = require('@verdaccio/logger');\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface IBasicAuth<T> {\n config: T & Config;\n authenticate(user: string, password: string, cb: Callback): void;\n invalidateToken?(token: string): Promise<void>;\n changePassword(user: string, password: string, newPassword: string, cb: Callback): void;\n allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n add_user(user: string, password: string, cb: Callback): any;\n}\n\nexport interface TokenEncryption {\n jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n aesEncrypt(buf: string): string \| void;\n}\n\nexport interface AESPayload {\n user: string;\n password: string;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface IAuthMiddleware {\n apiJWTmiddleware(): $NextFunctionVer;\n webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport interface IAuth extends IBasicAuth<Config>, IAuthMiddleware, TokenEncryption {\n config: Config;\n logger: Logger;\n secret: string;\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n plugins: any[];\n allow_unpublish(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;\n invalidateToken(token: string): Promise<void>;\n init(): Promise<void>;\n}\n\nclass Auth implements IAuth {\n public config: Config;\n public logger: Logger;\n public secret: string;\n public plugins: IPluginAuth<Config>[];\n\n public constructor(config: Config) {\n this.config = config;\n this.logger = LoggerApi.logger.child({ sub: 'auth' });\n this.secret = config.secret;\n this.plugins = [];\n if (!this.secret) {\n throw new TypeError('secret it is required value on initialize the auth class');\n }\n }\n\n public async init() {\n let plugins = await this.loadPlugin();\n debug('auth plugins found %s', plugins.length);\n if (!plugins \|\| plugins.length === 0) {\n plugins = this.loadDefaultPlugin();\n }\n this.plugins = plugins;\n\n this._applyDefaultPlugins();\n }\n\n private loadDefaultPlugin() {\n debug('load default auth plugin');\n const pluginOptions: PluginOptions = {\n config: this.config,\n logger: this.logger,\n };\n let authPlugin;\n try {\n authPlugin = new HTPasswd({ file: './htpasswd' }, pluginOptions as any as PluginOptions);\n } catch (error: any) {\n debug('error on loading auth htpasswd plugin stack: %o', error);\n return [];\n }\n\n return [authPlugin];\n }\n\n private async loadPlugin(): Promise<IPluginAuth<Config>[]> {\n return asyncLoadPlugin<IPluginAuth<Config>>(\n this.config.auth,\n {\n config: this.config,\n logger: this.logger,\n },\n (plugin: IPluginAuth<Config>): boolean => {\n const { authenticate, allow_access, allow_publish } = plugin;\n\n // @ts-ignore\n return authenticate \|\| allow_access \|\| allow_publish;\n },\n this.config?.serverSettings?.pluginPrefix\n );\n }\n\n private _applyDefaultPlugins(): void {\n // TODO: rename to applyFallbackPluginMethods\n this.plugins.push(getDefaultPlugins(this.logger));\n }\n\n public changePassword(\n username: string,\n password: string,\n newPassword: string,\n cb: Callback\n ): void {\n const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n if (_.isEmpty(validPlugins)) {\n return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n }\n\n for (const plugin of validPlugins) {\n if (isNil(plugin) \|\| isFunction(plugin.changePassword) === false) {\n debug('auth plugin does not implement changePassword, trying next one');\n continue;\n } else {\n debug('updating password for %o', username);\n plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n if (err) {\n this.logger.error(\n { username, err },\n `An error has been produced\n updating the password for @{username}. Error: @{err.message}`\n );\n return cb(err);\n }\n\n debug('updated password for %o was successful', username);\n return cb(null, profile);\n });\n }\n }\n }\n\n public async invalidateToken(token: string) {\n // eslint-disable-next-line no-console\n console.log('invalidate token pending to implement', token);\n return Promise.resolve();\n }\n\n public authenticate(username: string, password: string, cb: Callback): void {\n const plugins = this.plugins.slice(0);\n (function next(): void {\n const plugin = plugins.shift() as IPluginAuth<Config>;\n\n if (isFunction(plugin.authenticate) === false) {\n return next();\n }\n\n debug('authenticating %o', username);\n plugin.authenticate(username, password, function (err, groups): void {\n if (err) {\n debug('authenticating for user %o failed. Error: %o', username, err?.message);\n return cb(err);\n }\n\n // Expect: SKIP if groups is falsey and not an array\n // with at least one item (truthy length)\n // Expect: CONTINUE otherwise (will error if groups is not\n // an array, but this is current behavior)\n // Caveat: STRING (if valid) will pass successfully\n // bug give unexpected results\n // Info: Cannot use `== false to check falsey values`\n if (!!groups && groups.length !== 0) {\n // TODO: create a better understanding of expectations\n if (_.isString(groups)) {\n throw new TypeError('plugin group error: invalid type for function');\n }\n const isGroupValid: boolean = _.isArray(groups);\n if (!isGroupValid) {\n throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n }\n\n debug('authentication for user %o was successfully. Groups: %o', username, groups);\n return cb(err, createRemoteUser(username, groups));\n }\n next();\n });\n })();\n }\n\n public add_user(user: string, password: string, cb: Callback): void {\n const self = this;\n const plugins = this.plugins.slice(0);\n debug('add user %o', user);\n\n (function next(): void {\n const plugin = plugins.shift() as IPluginAuth<Config>;\n let method = 'adduser';\n if (isFunction(plugin[method]) === false) {\n method = 'add_user';\n self.logger.warn(\n 'the plugin method add_user in the auth plugin is deprecated and will' +\n ' be removed in next major release, notify to the plugin author'\n );\n }\n\n if (isFunction(plugin[method]) === false) {\n next();\n } else {\n // p.add_user() execution\n plugin[method](user, password, function (err, ok): void {\n if (err) {\n debug('the user %o could not being added. Error: %o', user, err?.message);\n return cb(err);\n }\n if (ok) {\n debug('the user %o has been added', user);\n return self.authenticate(user, password, cb);\n }\n next();\n });\n }\n })();\n }\n\n /\n Allow user to access a package.\n /\n public allow_access(\n { packageName, packageVersion }: AuthPluginPackage,\n user: RemoteUser,\n callback: Callback\n ): void {\n const plugins = this.plugins.slice(0);\n const pkgAllowAcces: AllowAccess = { name: packageName, version: packageVersion };\n const pkg = Object.assign(\n {},\n pkgAllowAcces,\n getMatchedPackagesSpec(packageName, this.config.packages)\n ) as AllowAccess & PackageAccess;\n debug('allow access for %o', packageName);\n\n (function next(): void {\n const plugin: IPluginAuth<Config> = plugins.shift() as IPluginAuth<Config>;\n\n if (_.isNil(plugin) \|\| isFunction(plugin.allow_access) === false) {\n return next();\n }\n\n plugin.allow_access!(user, pkg, function (err, ok: boolean): void {\n if (err) {\n debug('forbidden access for %o. Error: %o', packageName, err?.message);\n return callback(err);\n }\n\n if (ok) {\n debug('allowed access for %o', packageName);\n return callback(null, ok);\n }\n\n next(); // cb(null, false) causes next plugin to roll\n });\n })();\n }\n\n public allow_unpublish(\n { packageName, packageVersion }: AuthPluginPackage,\n user: RemoteUser,\n callback: Callback\n ): void {\n const pkg = Object.assign(\n { name: packageName, version: packageVersion },\n getMatchedPackagesSpec(packageName, this.config.packages)\n );\n debug('allow unpublish for %o', packageName);\n\n for (const plugin of this.plugins) {\n if (_.isNil(plugin) \|\| isFunction(plugin.allow_unpublish) === false) {\n debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n continue;\n } else {\n // @ts-ignore\n plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n if (err) {\n debug(\n 'forbidden publish for %o, it will fallback on unpublish permissions',\n packageName\n );\n return callback(err);\n }\n\n if (_.isNil(ok) === true) {\n debug('bypass unpublish for %o, publish will handle the access', packageName);\n // @ts-ignore\n // eslint-disable-next-line\n return this.allow_publish(...arguments);\n }\n\n if (ok) {\n debug('allowed unpublish for %o', packageName);\n return callback(null, ok);\n }\n });\n }\n }\n }\n\n /\n Allow user to publish a package.\n /\n public allow_publish(\n { packageName, packageVersion }: AuthPluginPackage,\n user: RemoteUser,\n callback: Callback\n ): void {\n const plugins = this.plugins.slice(0);\n const pkg = Object.assign(\n { name: packageName, version: packageVersion },\n getMatchedPackagesSpec(packageName, this.config.packages)\n );\n debug('allow publish for %o init \| plugins: %o', packageName, plugins.length);\n\n (function next(): void {\n const plugin = plugins.shift();\n\n if (isFunction(plugin?.allow_publish) === false) {\n debug('allow publish for %o plugin does not implement allow_publish', packageName);\n return next();\n }\n\n // @ts-ignore\n plugin.allow_publish(\n user,\n // @ts-ignore\n pkg,\n // @ts-ignore\n (err: VerdaccioError, ok: boolean): void => {\n if (_.isNil(err) === false && _.isError(err)) {\n debug('forbidden publish for %o', packageName);\n return callback(err);\n }\n\n if (ok) {\n debug('allowed publish for %o', packageName);\n return callback(null, ok);\n }\n\n debug('allow publish skip validation for %o', packageName);\n next(); // cb(null, false) causes next plugin to roll\n }\n );\n })();\n }\n\n public apiJWTmiddleware(): Function {\n debug('jwt middleware');\n const plugins = this.plugins.slice(0);\n const helpers = { createAnonymousRemoteUser, createRemoteUser };\n for (const plugin of plugins) {\n if (plugin.apiJWTmiddleware) {\n return plugin.apiJWTmiddleware(helpers);\n }\n }\n\n return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n req.pause();\n\n const next = function (err: VerdaccioError \| void): void {\n req.resume();\n // uncomment this to reject users with bad auth headers\n // return _next.apply(null, arguments)\n // swallow error, user remains unauthorized\n // set remoteUserError to indicate that user was attempting authentication\n if (err) {\n req.remote_user.error = err.message;\n }\n return _next();\n };\n\n if (this._isRemoteUserValid(req.remote_user)) {\n debug('jwt has a valid authentication header');\n return next();\n }\n\n // in case auth header does not exist we return anonymous function\n const remoteUser = createAnonymousRemoteUser();\n req.remote_user = remoteUser;\n res.locals.remote_user = remoteUser;\n\n const { authorization } = req.headers;\n if (_.isNil(authorization)) {\n debug('jwt, authentication header is missing');\n return next();\n }\n\n if (!isAuthHeaderValid(authorization)) {\n debug('api middleware authentication heather is invalid');\n return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n }\n const { secret, security } = this.config;\n\n if (isAESLegacy(security)) {\n debug('api middleware using legacy auth token');\n this._handleAESMiddleware(req, security, secret, authorization, next);\n } else {\n debug('api middleware using JWT auth token');\n this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n }\n };\n }\n\n private _handleJWTAPIMiddleware(\n req: $RequestExtend,\n security: Security,\n secret: string,\n authorization: string,\n next: Function\n ): void {\n debug('handle JWT api middleware');\n const { scheme, token } = parseAuthTokenHeader(authorization);\n if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n debug('handle basic token');\n // this should happen when client tries to login with an existing user\n const credentials = convertPayloadToBase64(token).toString();\n const { user, password } = parseBasicPayload(credentials) as AESPayload;\n debug('authenticating %o', user);\n this.authenticate(user, password, (err, user): void => {\n if (!err) {\n debug('generating a remote user');\n req.remote_user = user;\n next();\n } else {\n debug('generating anonymous user');\n req.remote_user = createAnonymousRemoteUser();\n next(err);\n }\n });\n } else {\n debug('handle jwt token');\n const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n if (credentials) {\n // if the signature is valid we rely on it\n req.remote_user = credentials;\n debug('generating a remote user');\n next();\n } else {\n // with JWT throw 401\n debug('jwt invalid token');\n next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n }\n }\n }\n\n private _handleAESMiddleware(\n req: $RequestExtend,\n security: Security,\n secret: string,\n authorization: string,\n next: Function\n ): void {\n debug('handle legacy api middleware');\n debug('api middleware secret %o', typeof secret === 'string');\n debug('api middleware authorization %o', typeof authorization === 'string');\n const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n debug('api middleware credentials %o', credentials?.name);\n if (credentials) {\n const { user, password } = credentials;\n debug('authenticating %o', user);\n this.authenticate(user, password, (err, user): void => {\n if (!err) {\n req.remote_user = user;\n debug('generating a remote user');\n next();\n } else {\n req.remote_user = createAnonymousRemoteUser();\n debug('generating anonymous user');\n next(err);\n }\n });\n } else {\n // we force npm client to ask again with basic authentication\n debug('legacy invalid header');\n return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n }\n }\n\n private _isRemoteUserValid(remote_user: RemoteUser): boolean {\n return _.isUndefined(remote_user) === false && _.isUndefined(remote_user.name) === false;\n }\n\n /\n JWT middleware for WebUI\n /\n public webUIJWTmiddleware(): Function {\n return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n if (this._isRemoteUserValid(req.remote_user)) {\n return _next();\n }\n\n req.pause();\n const next = (err: VerdaccioError \| void): void => {\n req.resume();\n if (err) {\n // req.remote_user.error = err.message;\n res.status(err.statusCode).send(err.message);\n }\n\n return _next();\n };\n\n const { authorization } = req.headers;\n if (_.isNil(authorization)) {\n return next();\n }\n\n if (!isAuthHeaderValid(authorization)) {\n return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n }\n\n const token = (authorization \|\| '').replace(`${TOKEN_BEARER} `, '');\n if (!token) {\n return next();\n }\n\n let credentials;\n try {\n credentials = verifyJWTPayload(token, this.config.secret);\n } catch (err: any) {\n // FIXME: intended behaviour, do we want it?\n }\n\n if (this._isRemoteUserValid(credentials)) {\n const { name, groups } = credentials;\n // $FlowFixMe\n req.remote_user = createRemoteUser(name, groups);\n } else {\n req.remote_user = createAnonymousRemoteUser();\n }\n\n next();\n };\n }\n\n public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n const { real_groups, name, groups } = user;\n debug('jwt encrypt %o', name);\n const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n const payload: RemoteUser = {\n real_groups: realGroupsValidated,\n name,\n groups: groupedGroups,\n };\n\n const token: string = await signPayload(payload, this.secret, signOptions);\n\n return token;\n }\n\n /\n Encrypt a string.\n */\n public aesEncrypt(value: string): string \| void {\n return aesEncrypt(value, this.secret);\n }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AAQA;;AAcA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA;AACA,MAAMA,SAAS,GAAGC,OAAO,CAAC,mBAAD,CAAzB;;AAEA,MAAMC,KAAK,GAAG,IAAAC,cAAA,EAAW,gBAAX,CAAd;;AAyCA,MAAMC,IAAN,CAA4B;EAMnBC,WAAW,CAACC,MAAD,EAAiB;IACjC,KAAKA,MAAL,GAAcA,MAAd;IACA,KAAKC,MAAL,GAAcP,SAAS,CAACO,MAAV,CAAiBC,KAAjB,CAAuB;MAAEC,GAAG,EAAE;IAAP,CAAvB,CAAd;IACA,KAAKC,MAAL,GAAcJ,MAAM,CAACI,MAArB;IACA,KAAKC,OAAL,GAAe,EAAf;;IACA,IAAI,CAAC,KAAKD,MAAV,EAAkB;MAChB,MAAM,IAAIE,SAAJ,CAAc,0DAAd,CAAN;IACD;EACF;;EAEgB,MAAJC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAG,MAAM,KAAKG,UAAL,EAApB;IACAZ,KAAK,CAAC,uBAAD,EAA0BS,OAAO,CAACI,MAAlC,CAAL;;IACA,IAAI,CAACJ,OAAD,IAAYA,OAAO,CAACI,MAAR,KAAmB,CAAnC,EAAsC;MACpCJ,OAAO,GAAG,KAAKK,iBAAL,EAAV;IACD;;IACD,KAAKL,OAAL,GAAeA,OAAf;;IAEA,KAAKM,oBAAL;EACD;;EAEOD,iBAAiB,GAAG;IAC1Bd,KAAK,CAAC,0BAAD,CAAL;IACA,MAAMgB,aAA4B,GAAG;MACnCZ,MAAM,EAAE,KAAKA,MADsB;MAEnCC,MAAM,EAAE,KAAKA;IAFsB,CAArC;IAIA,IAAIY,UAAJ;;IACA,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAJ,CAAa;QAAEC,IAAI,EAAE;MAAR,CAAb,EAAqCH,aAArC,CAAb;IACD,CAFD,CAEE,OAAOI,KAAP,EAAmB;MACnBpB,KAAK,CAAC,iDAAD,EAAoDoB,KAApD,CAAL;MACA,OAAO,EAAP;IACD;;IAED,OAAO,CAACH,UAAD,CAAP;EACD;;EAEuB,MAAVL,UAAU,GAAmC;IAAA;;IACzD,OAAO,IAAAS,wBAAA,EACL,KAAKjB,MAAL,CAAYkB,IADP,EAEL;MACElB,MAAM,EAAE,KAAKA,MADf;MAEEC,MAAM,EAAE,KAAKA;IAFf,CAFK,EAMJkB,MAAD,IAA0C;MACxC,MAAM;QAAEC,YAAF;QAAgBC,YAAhB;QAA8BC;MAA9B,IAAgDH,MAAtD,CADwC,CAGxC;;MACA,OAAOC,YAAY,IAAIC,YAAhB,IAAgCC,aAAvC;IACD,CAXI,kBAYL,KAAKtB,MAZA,0EAYL,aAAauB,cAZR,0DAYL,sBAA6BC,YAZxB,CAAP;EAcD;;EAEOb,oBAAoB,GAAS;IACnC;IACA,KAAKN,OAAL,CAAaoB,IAAb,CAAkB,IAAAC,yBAAA,EAAkB,KAAKzB,MAAvB,CAAlB;EACD;;EAEM0B,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;IACN,MAAMC,YAAY,GAAGC,eAAA,CAAEC,MAAF,CAAS,KAAK7B,OAAd,EAAwBc,MAAD,IAAY,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,CAAnC,CAArB;;IAEA,IAAIM,eAAA,CAAEG,OAAF,CAAUJ,YAAV,CAAJ,EAA6B;MAC3B,OAAOD,EAAE,CAACM,gBAAA,CAAWC,gBAAX,CAA4BC,oBAAA,CAAeC,wBAA3C,CAAD,CAAT;IACD;;IAED,KAAK,MAAMrB,MAAX,IAAqBa,YAArB,EAAmC;MACjC,IAAI,IAAAS,YAAA,EAAMtB,MAAN,KAAiB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,MAAsC,KAA3D,EAAkE;QAChE/B,KAAK,CAAC,gEAAD,CAAL;QACA;MACD,CAHD,MAGO;QACLA,KAAK,CAAC,0BAAD,EAA6BgC,QAA7B,CAAL;QACAT,MAAM,CAACQ,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACY,GAAD,EAAMC,OAAN,KAAwB;UAC9E,IAAID,GAAJ,EAAS;YACP,KAAKzC,MAAL,CAAYe,KAAZ,CACE;cAAEY,QAAF;cAAYc;YAAZ,CADF,EAEG;AACf,yEAHY;YAKA,OAAOX,EAAE,CAACW,GAAD,CAAT;UACD;;UAED9C,KAAK,CAAC,wCAAD,EAA2CgC,QAA3C,CAAL;UACA,OAAOG,EAAE,CAAC,IAAD,EAAOY,OAAP,CAAT;QACD,CAZD;MAaD;IACF;EACF;;EAE2B,MAAfC,eAAe,CAACC,KAAD,EAAgB;IAC1C;IACAC,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;IACA,OAAOG,OAAO,CAACC,OAAR,EAAP;EACD;;EAEM7B,YAAY,CAACQ,QAAD,EAAmBC,QAAnB,EAAqCE,EAArC,EAAyD;IAC1E,MAAM1B,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;;IACA,CAAC,SAASC,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGd,OAAO,CAAC+C,KAAR,EAAf;;MAEA,IAAI,IAAAjB,iBAAA,EAAWhB,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;QAC7C,OAAO+B,IAAI,EAAX;MACD;;MAEDvD,KAAK,CAAC,mBAAD,EAAsBgC,QAAtB,CAAL;MACAT,MAAM,CAACC,YAAP,CAAoBQ,QAApB,EAA8BC,QAA9B,EAAwC,UAAUa,GAAV,EAAeW,MAAf,EAA6B;QACnE,IAAIX,GAAJ,EAAS;UACP9C,KAAK,CAAC,8CAAD,EAAiDgC,QAAjD,EAA2Dc,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;UACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;QACD,CAJkE,CAMnE;QACA;QACA;QACA;QACA;QACA;QACA;;;QACA,IAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAAC5C,MAAP,KAAkB,CAAlC,EAAqC;UACnC;UACA,IAAIwB,eAAA,CAAEsB,QAAF,CAAWF,MAAX,CAAJ,EAAwB;YACtB,MAAM,IAAI/C,SAAJ,CAAc,+CAAd,CAAN;UACD;;UACD,MAAMkD,YAAqB,GAAGvB,eAAA,CAAEwB,OAAF,CAAUJ,MAAV,CAA9B;;UACA,IAAI,CAACG,YAAL,EAAmB;YACjB,MAAM,IAAIlD,SAAJ,CAAcoD,eAAA,CAAUC,qBAAxB,CAAN;UACD;;UAED/D,KAAK,CAAC,yDAAD,EAA4DgC,QAA5D,EAAsEyB,MAAtE,CAAL;UACA,OAAOtB,EAAE,CAACW,GAAD,EAAM,IAAAkB,wBAAA,EAAiBhC,QAAjB,EAA2ByB,MAA3B,CAAN,CAAT;QACD;;QACDF,IAAI;MACL,CA3BD;IA4BD,CApCD;EAqCD;;EAEMU,QAAQ,CAACC,IAAD,EAAejC,QAAf,EAAiCE,EAAjC,EAAqD;IAClE,MAAMgC,IAAI,GAAG,IAAb;IACA,MAAM1D,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACAtD,KAAK,CAAC,aAAD,EAAgBkE,IAAhB,CAAL;;IAEA,CAAC,SAASX,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGd,OAAO,CAAC+C,KAAR,EAAf;MACA,IAAIY,MAAM,GAAG,SAAb;;MACA,IAAI,IAAA7B,iBAAA,EAAWhB,MAAM,CAAC6C,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;QACxCA,MAAM,GAAG,UAAT;QACAD,IAAI,CAAC9D,MAAL,CAAYgE,IAAZ,CACE,yEACE,gEAFJ;MAID;;MAED,IAAI,IAAA9B,iBAAA,EAAWhB,MAAM,CAAC6C,MAAD,CAAjB,MAA+B,KAAnC,EAA0C;QACxCb,IAAI;MACL,CAFD,MAEO;QACL;QACAhC,MAAM,CAAC6C,MAAD,CAAN,CAAeF,IAAf,EAAqBjC,QAArB,EAA+B,UAAUa,GAAV,EAAewB,EAAf,EAAyB;UACtD,IAAIxB,GAAJ,EAAS;YACP9C,KAAK,CAAC,+CAAD,EAAkDkE,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;YACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;UACD;;UACD,IAAIwB,EAAJ,EAAQ;YACNtE,KAAK,CAAC,4BAAD,EAA+BkE,IAA/B,CAAL;YACA,OAAOC,IAAI,CAAC3C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkCE,EAAlC,CAAP;UACD;;UACDoB,IAAI;QACL,CAVD;MAWD;IACF,CA3BD;EA4BD;EAED;AACF;AACA;;;EACS9B,YAAY,CACjB;IAAE8C,WAAF;IAAeC;EAAf,CADiB,EAEjBN,IAFiB,EAGjBO,QAHiB,EAIX;IACN,MAAMhE,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMoB,aAA0B,GAAG;MAAEC,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CAAnC;IACA,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,aAFU,EAGV,IAAAM,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKnE,MAAL,CAAY6E,QAAhD,CAHU,CAAZ;IAKAjF,KAAK,CAAC,qBAAD,EAAwBuE,WAAxB,CAAL;;IAEA,CAAC,SAAShB,IAAT,GAAsB;MACrB,MAAMhC,MAA2B,GAAGd,OAAO,CAAC+C,KAAR,EAApC;;MAEA,IAAInB,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;QAChE,OAAO8B,IAAI,EAAX;MACD;;MAEDhC,MAAM,CAACE,YAAP,CAAqByC,IAArB,EAA2BW,GAA3B,EAAgC,UAAU/B,GAAV,EAAewB,EAAf,EAAkC;QAChE,IAAIxB,GAAJ,EAAS;UACP9C,KAAK,CAAC,oCAAD,EAAuCuE,WAAvC,EAAoDzB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;UACA,OAAOe,QAAQ,CAAC3B,GAAD,CAAf;QACD;;QAED,IAAIwB,EAAJ,EAAQ;UACNtE,KAAK,CAAC,uBAAD,EAA0BuE,WAA1B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDf,IAAI,GAX4D,CAWxD;MACT,CAZD;IAaD,CApBD;EAqBD;;EAEM2B,eAAe,CACpB;IAAEX,WAAF;IAAeC;EAAf,CADoB,EAEpBN,IAFoB,EAGpBO,QAHoB,EAId;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKnE,MAAL,CAAY6E,QAAhD,CAFU,CAAZ;IAIAjF,KAAK,CAAC,wBAAD,EAA2BuE,WAA3B,CAAL;;IAEA,KAAK,MAAMhD,MAAX,IAAqB,KAAKd,OAA1B,EAAmC;MACjC,IAAI4B,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAAC2D,eAAlB,MAAuC,KAA9D,EAAqE;QACnElF,KAAK,CAAC,kEAAD,EAAqEuE,WAArE,CAAL;QACA;MACD,CAHD,MAGO;QACL;QACAhD,MAAM,CAAC2D,eAAP,CAAwBhB,IAAxB,EAA8BW,GAA9B,EAAmC,CAAC/B,GAAD,EAAMwB,EAAN,KAA4B;UAC7D,IAAIxB,GAAJ,EAAS;YACP9C,KAAK,CACH,qEADG,EAEHuE,WAFG,CAAL;YAIA,OAAOE,QAAQ,CAAC3B,GAAD,CAAf;UACD;;UAED,IAAIT,eAAA,CAAEQ,KAAF,CAAQyB,EAAR,MAAgB,IAApB,EAA0B;YACxBtE,KAAK,CAAC,yDAAD,EAA4DuE,WAA5D,CAAL,CADwB,CAExB;YACA;;YACA,OAAO,KAAK7C,aAAL,CAAmB,GAAGyD,SAAtB,CAAP;UACD;;UAED,IAAIb,EAAJ,EAAQ;YACNtE,KAAK,CAAC,0BAAD,EAA6BuE,WAA7B,CAAL;YACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;UACD;QACF,CApBD;MAqBD;IACF;EACF;EAED;AACF;AACA;;;EACS5C,aAAa,CAClB;IAAE6C,WAAF;IAAeC;EAAf,CADkB,EAElBN,IAFkB,EAGlBO,QAHkB,EAIZ;IACN,MAAMhE,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMuB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKnE,MAAL,CAAY6E,QAAhD,CAFU,CAAZ;IAIAjF,KAAK,CAAC,yCAAD,EAA4CuE,WAA5C,EAAyD9D,OAAO,CAACI,MAAjE,CAAL;;IAEA,CAAC,SAAS0C,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGd,OAAO,CAAC+C,KAAR,EAAf;;MAEA,IAAI,IAAAjB,iBAAA,EAAWhB,MAAX,aAAWA,MAAX,uBAAWA,MAAM,CAAEG,aAAnB,MAAsC,KAA1C,EAAiD;QAC/C1B,KAAK,CAAC,8DAAD,EAAiEuE,WAAjE,CAAL;QACA,OAAOhB,IAAI,EAAX;MACD,CANoB,CAQrB;;;MACAhC,MAAM,CAACG,aAAP,CACEwC,IADF,EAEE;MACAW,GAHF,EAIE;MACA,CAAC/B,GAAD,EAAsBwB,EAAtB,KAA4C;QAC1C,IAAIjC,eAAA,CAAEQ,KAAF,CAAQC,GAAR,MAAiB,KAAjB,IAA0BT,eAAA,CAAE+C,OAAF,CAAUtC,GAAV,CAA9B,EAA8C;UAC5C9C,KAAK,CAAC,0BAAD,EAA6BuE,WAA7B,CAAL;UACA,OAAOE,QAAQ,CAAC3B,GAAD,CAAf;QACD;;QAED,IAAIwB,EAAJ,EAAQ;UACNtE,KAAK,CAAC,wBAAD,EAA2BuE,WAA3B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDtE,KAAK,CAAC,sCAAD,EAAyCuE,WAAzC,CAAL;QACAhB,IAAI,GAZsC,CAYlC;MACT,CAlBH;IAoBD,CA7BD;EA8BD;;EAEM8B,gBAAgB,GAAa;IAClCrF,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMS,OAAO,GAAG,KAAKA,OAAL,CAAa6C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMgC,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAF;MAA6BvB,gBAAgB,EAAhBA;IAA7B,CAAhB;;IACA,KAAK,MAAMzC,MAAX,IAAqBd,OAArB,EAA8B;MAC5B,IAAIc,MAAM,CAAC8D,gBAAX,EAA6B;QAC3B,OAAO9D,MAAM,CAAC8D,gBAAP,CAAwBC,OAAxB,CAAP;MACD;IACF;;IAED,OAAO,CAACE,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/EF,GAAG,CAACG,KAAJ;;MAEA,MAAMpC,IAAI,GAAG,UAAUT,GAAV,EAA4C;QACvD0C,GAAG,CAACI,MAAJ,GADuD,CAEvD;QACA;QACA;QACA;;QACA,IAAI9C,GAAJ,EAAS;UACP0C,GAAG,CAACK,WAAJ,CAAgBzE,KAAhB,GAAwB0B,GAAG,CAACY,OAA5B;QACD;;QACD,OAAOgC,KAAK,EAAZ;MACD,CAVD;;MAYA,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C7F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOuD,IAAI,EAAX;MACD,CAlB8E,CAoB/E;;;MACA,MAAMwC,UAAU,GAAG,IAAAR,iCAAA,GAAnB;MACAC,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;MACAN,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;MAEA,MAAM;QAAEE;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI7D,eAAA,CAAEQ,KAAF,CAAQoD,aAAR,CAAJ,EAA4B;QAC1BjG,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOuD,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA4C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrCjG,KAAK,CAAC,kDAAD,CAAL;QACA,OAAOuD,IAAI,CAACd,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;MACD;;MACD,MAAM;QAAE7F,MAAF;QAAU8F;MAAV,IAAuB,KAAKlG,MAAlC;;MAEA,IAAI,IAAAmG,mBAAA,EAAYD,QAAZ,CAAJ,EAA2B;QACzBtG,KAAK,CAAC,wCAAD,CAAL;;QACA,KAAKwG,oBAAL,CAA0BhB,GAA1B,EAA+Bc,QAA/B,EAAyC9F,MAAzC,EAAiDyF,aAAjD,EAAgE1C,IAAhE;MACD,CAHD,MAGO;QACLvD,KAAK,CAAC,qCAAD,CAAL;;QACA,KAAKyG,uBAAL,CAA6BjB,GAA7B,EAAkCc,QAAlC,EAA4C9F,MAA5C,EAAoDyF,aAApD,EAAmE1C,IAAnE;MACD;IACF,CA5CD;EA6CD;;EAEOkD,uBAAuB,CAC7BjB,GAD6B,EAE7Bc,QAF6B,EAG7B9F,MAH6B,EAI7ByF,aAJ6B,EAK7B1C,IAL6B,EAMvB;IACNvD,KAAK,CAAC,2BAAD,CAAL;IACA,MAAM;MAAE0G,MAAF;MAAUzD;IAAV,IAAoB,IAAA0D,4BAAA,EAAqBV,aAArB,CAA1B;;IACA,IAAIS,MAAM,CAACE,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;MACtD5G,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;MACA,MAAM8G,WAAW,GAAG,IAAAC,8BAAA,EAAuB9D,KAAvB,EAA8B+D,QAA9B,EAApB;MACA,MAAM;QAAE9C,IAAF;QAAQjC;MAAR,IAAqB,IAAAgF,wBAAA,EAAkBH,WAAlB,CAA3B;MACA9G,KAAK,CAAC,mBAAD,EAAsBkE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAAMoB,IAAN,KAAqB;QACrD,IAAI,CAACpB,GAAL,EAAU;UACR9C,KAAK,CAAC,0BAAD,CAAL;UACAwF,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;UACAX,IAAI;QACL,CAJD,MAIO;UACLvD,KAAK,CAAC,2BAAD,CAAL;UACAwF,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACAhC,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAjBD,MAiBO;MACL9C,KAAK,CAAC,kBAAD,CAAL;MACA,MAAM8G,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC9F,MAAnC,EAA2CyF,aAA3C,CAAzB;;MACA,IAAIa,WAAJ,EAAiB;QACf;QACAtB,GAAG,CAACK,WAAJ,GAAkBiB,WAAlB;QACA9G,KAAK,CAAC,0BAAD,CAAL;QACAuD,IAAI;MACL,CALD,MAKO;QACL;QACAvD,KAAK,CAAC,mBAAD,CAAL;QACAuD,IAAI,CAACd,gBAAA,CAAW0E,YAAX,CAAwBrD,eAAA,CAAUsD,qBAAlC,CAAD,CAAJ;MACD;IACF;EACF;;EAEOZ,oBAAoB,CAC1BhB,GAD0B,EAE1Bc,QAF0B,EAG1B9F,MAH0B,EAI1ByF,aAJ0B,EAK1B1C,IAL0B,EAMpB;IACNvD,KAAK,CAAC,8BAAD,CAAL;IACAA,KAAK,CAAC,0BAAD,EAA6B,OAAOQ,MAAP,KAAkB,QAA/C,CAAL;IACAR,KAAK,CAAC,iCAAD,EAAoC,OAAOiG,aAAP,KAAyB,QAA7D,CAAL;IACA,MAAMa,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC9F,MAAnC,EAA2CyF,aAA3C,CAAzB;IACAjG,KAAK,CAAC,+BAAD,EAAkC8G,WAAlC,aAAkCA,WAAlC,uBAAkCA,WAAW,CAAEnC,IAA/C,CAAL;;IACA,IAAImC,WAAJ,EAAiB;MACf,MAAM;QAAE5C,IAAF;QAAQjC;MAAR,IAAqB6E,WAA3B;MACA9G,KAAK,CAAC,mBAAD,EAAsBkE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAAMoB,IAAN,KAAqB;QACrD,IAAI,CAACpB,GAAL,EAAU;UACR0C,GAAG,CAACK,WAAJ,GAAkB3B,IAAlB;UACAlE,KAAK,CAAC,0BAAD,CAAL;UACAuD,IAAI;QACL,CAJD,MAIO;UACLiC,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACAvF,KAAK,CAAC,2BAAD,CAAL;UACAuD,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAdD,MAcO;MACL;MACA9C,KAAK,CAAC,uBAAD,CAAL;MACA,OAAOuD,IAAI,CAACd,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;IACD;EACF;;EAEOP,kBAAkB,CAACD,WAAD,EAAmC;IAC3D,OAAOxD,eAAA,CAAEgF,WAAF,CAAcxB,WAAd,MAA+B,KAA/B,IAAwCxD,eAAA,CAAEgF,WAAF,CAAcxB,WAAW,CAAClB,IAA1B,MAAoC,KAAnF;EACD;EAED;AACF;AACA;;;EACS2C,kBAAkB,GAAa;IACpC,OAAO,CAAC9B,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/E,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C,OAAOH,KAAK,EAAZ;MACD;;MAEDF,GAAG,CAACG,KAAJ;;MACA,MAAMpC,IAAI,GAAIT,GAAD,IAAsC;QACjD0C,GAAG,CAACI,MAAJ;;QACA,IAAI9C,GAAJ,EAAS;UACP;UACA2C,GAAG,CAAC8B,MAAJ,CAAWzE,GAAG,CAAC0E,UAAf,EAA2BC,IAA3B,CAAgC3E,GAAG,CAACY,OAApC;QACD;;QAED,OAAOgC,KAAK,EAAZ;MACD,CARD;;MAUA,MAAM;QAAEO;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI7D,eAAA,CAAEQ,KAAF,CAAQoD,aAAR,CAAJ,EAA4B;QAC1B,OAAO1C,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA4C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC,OAAO1C,IAAI,CAACd,gBAAA,CAAW2D,aAAX,CAAyBtC,eAAA,CAAUuC,eAAnC,CAAD,CAAX;MACD;;MAED,MAAMpD,KAAK,GAAG,CAACgD,aAAa,IAAI,EAAlB,EAAsByB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;MACA,IAAI,CAAC1E,KAAL,EAAY;QACV,OAAOM,IAAI,EAAX;MACD;;MAED,IAAIuD,WAAJ;;MACA,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAA,EAAiB3E,KAAjB,EAAwB,KAAK7C,MAAL,CAAYI,MAApC,CAAd;MACD,CAFD,CAEE,OAAOsC,GAAP,EAAiB,CACjB;MACD;;MAED,IAAI,KAAKgD,kBAAL,CAAwBgB,WAAxB,CAAJ,EAA0C;QACxC,MAAM;UAAEnC,IAAF;UAAQlB;QAAR,IAAmBqD,WAAzB,CADwC,CAExC;;QACAtB,GAAG,CAACK,WAAJ,GAAkB,IAAA7B,wBAAA,EAAiBW,IAAjB,EAAuBlB,MAAvB,CAAlB;MACD,CAJD,MAIO;QACL+B,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;MACD;;MAEDhC,IAAI;IACL,CA9CD;EA+CD;;EAEsB,MAAVsE,UAAU,CAAC3D,IAAD,EAAmB4D,WAAnB,EAAiE;IACtF,MAAM;MAAEC,WAAF;MAAepD,IAAf;MAAqBlB;IAArB,IAAgCS,IAAtC;IACAlE,KAAK,CAAC,gBAAD,EAAmB2E,IAAnB,CAAL;IACA,MAAMqD,mBAAmB,GAAG3F,eAAA,CAAEQ,KAAF,CAAQkF,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;IACA,MAAME,aAAa,GAAG5F,eAAA,CAAEQ,KAAF,CAAQY,MAAR,IAAkBsE,WAAlB,GAAgCtE,MAAM,CAACyE,MAAP,CAAcF,mBAAd,CAAtD;IACA,MAAMG,OAAmB,GAAG;MAC1BJ,WAAW,EAAEC,mBADa;MAE1BrD,IAF0B;MAG1BlB,MAAM,EAAEwE;IAHkB,CAA5B;IAMA,MAAMhF,KAAa,GAAG,MAAM,IAAAmF,qBAAA,EAAYD,OAAZ,EAAqB,KAAK3H,MAA1B,EAAkCsH,WAAlC,CAA5B;IAEA,OAAO7E,KAAP;EACD;EAED;AACF;AACA;;;EACSoF,UAAU,CAACC,KAAD,EAA+B;IAC9C,OAAO,IAAAD,uBAAA,EAAWC,KAAX,EAAkB,KAAK9H,MAAvB,CAAP;EACD;;AA1gByB"}
1	+ {"version":3,"file":"auth.js","names":["debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","adduser","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, RequestHandler, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n API_ERROR,\n SUPPORT_ERRORS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n pluginUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport {\n AllowAccess,\n Callback,\n Config,\n JWTSignOptions,\n Logger,\n PackageAccess,\n RemoteUser,\n Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n convertPayloadToBase64,\n getDefaultPlugins,\n getMiddlewareCredentials,\n isAESLegacy,\n isAuthHeaderValid,\n parseAuthTokenHeader,\n verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface TokenEncryption {\n jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n aesEncrypt(buf: string): string \| void;\n}\n\nexport interface AESPayload {\n user: string;\n password: string;\n}\nexport interface IAuthMiddleware {\n apiJWTmiddleware(): $NextFunctionVer;\n webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n public config: Config;\n public secret: string;\n public plugins: pluginUtils.Auth<Config>[];\n\n public constructor(config: Config) {\n this.config = config;\n this.secret = config.secret;\n this.plugins = [];\n if (!this.secret) {\n throw new TypeError('secret it is required value on initialize the auth class');\n }\n }\n\n public async init() {\n let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n debug('auth plugins found %s', plugins.length);\n if (!plugins \|\| plugins.length === 0) {\n plugins = this.loadDefaultPlugin();\n }\n this.plugins = plugins;\n\n this._applyDefaultPlugins();\n }\n\n private loadDefaultPlugin() {\n debug('load default auth plugin');\n const pluginOptions: pluginUtils.PluginOptions = {\n config: this.config,\n logger,\n };\n let authPlugin;\n try {\n authPlugin = new HTPasswd(\n { file: './htpasswd' },\n pluginOptions as any as pluginUtils.PluginOptions\n );\n } catch (error: any) {\n debug('error on loading auth htpasswd plugin stack: %o', error);\n logger.info({}, 'no auth plugin has been found');\n return [];\n }\n\n return [authPlugin];\n }\n\n private async loadPlugin() {\n return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n this.config.auth,\n {\n config: this.config,\n logger,\n },\n (plugin): boolean => {\n const { authenticate, allow_access, allow_publish } = plugin;\n\n return (\n typeof authenticate !== 'undefined' \|\|\n typeof allow_access !== 'undefined' \|\|\n typeof allow_publish !== 'undefined'\n );\n },\n this.config?.serverSettings?.pluginPrefix\n );\n }\n\n private _applyDefaultPlugins(): void {\n // TODO: rename to applyFallbackPluginMethods\n this.plugins.push(getDefaultPlugins(logger));\n }\n\n public changePassword(\n username: string,\n password: string,\n newPassword: string,\n cb: Callback\n ): void {\n const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n if (_.isEmpty(validPlugins)) {\n return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n }\n\n for (const plugin of validPlugins) {\n if (isNil(plugin) \|\| isFunction(plugin.changePassword) === false) {\n debug('auth plugin does not implement changePassword, trying next one');\n continue;\n } else {\n debug('updating password for %o', username);\n plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n if (err) {\n logger.error(\n { username, err },\n `An error has been produced\n updating the password for @{username}. Error: @{err.message}`\n );\n return cb(err);\n }\n\n debug('updated password for %o was successful', username);\n return cb(null, profile);\n });\n }\n }\n }\n\n public async invalidateToken(token: string) {\n // eslint-disable-next-line no-console\n console.log('invalidate token pending to implement', token);\n return Promise.resolve();\n }\n\n public authenticate(\n username: string,\n password: string,\n cb: (error: VerdaccioError \| null, user?: RemoteUser) => void\n ): void {\n const plugins = this.plugins.slice(0);\n (function next(): void {\n const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n if (isFunction(plugin.authenticate) === false) {\n return next();\n }\n\n debug('authenticating %o', username);\n plugin.authenticate(username, password, function (err: VerdaccioError \| null, groups): void {\n if (err) {\n debug('authenticating for user %o failed. Error: %o', username, err?.message);\n return cb(err);\n }\n\n // Expect: SKIP if groups is falsey and not an array\n // with at least one item (truthy length)\n // Expect: CONTINUE otherwise (will error if groups is not\n // an array, but this is current behavior)\n // Caveat: STRING (if valid) will pass successfully\n // bug give unexpected results\n // Info: Cannot use `== false to check falsey values`\n if (!!groups && groups.length !== 0) {\n // TODO: create a better understanding of expectations\n if (_.isString(groups)) {\n throw new TypeError('plugin group error: invalid type for function');\n }\n const isGroupValid: boolean = _.isArray(groups);\n if (!isGroupValid) {\n throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n }\n\n debug('authentication for user %o was successfully. Groups: %o', username, groups);\n return cb(err, createRemoteUser(username, groups));\n }\n next();\n });\n })();\n }\n\n public add_user(\n user: string,\n password: string,\n cb: (error: VerdaccioError \| null, user?: RemoteUser) => void\n ): void {\n const self = this;\n const plugins = this.plugins.slice(0);\n debug('add user %o', user);\n\n (function next(): void {\n const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n if (typeof plugin.adduser !== 'function') {\n next();\n } else {\n // @ts-expect-error future major (7.x) should remove this section\n if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n throw errorUtils.getInternalError(\n 'add_user method not longer supported, rename to adduser'\n );\n }\n\n plugin.adduser(\n user,\n password,\n function (err: VerdaccioError \| null, ok?: boolean \| string): void {\n if (err) {\n debug('the user %o could not being added. Error: %o', user, err?.message);\n return cb(err);\n }\n if (ok) {\n debug('the user %o has been added', user);\n return self.authenticate(user, password, cb);\n }\n next();\n }\n );\n }\n })();\n }\n\n /*\n Allow user to access a package.\n /\n public allow_access(\n { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n user: RemoteUser,\n callback: pluginUtils.AccessCallback\n ): void {\n const plugins = this.plugins.slice(0);\n const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n const pkg = Object.assign(\n {},\n pkgAllowAccess,\n getMatchedPackagesSpec(packageName, this.config.packages)\n ) as AllowAccess & PackageAccess;\n debug('allow access for %o', packageName);\n\n (function next(): void {\n const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n if (_.isNil(plugin) \|\| isFunction(plugin.allow_access) === false) {\n return next();\n }\n\n plugin.allow_access!(user, pkg, function (err: VerdaccioError \| null, ok?: boolean): void {\n if (err) {\n debug('forbidden access for %o. Error: %o', packageName, err?.message);\n return callback(err);\n }\n\n if (ok) {\n debug('allowed access for %o', packageName);\n return callback(null, ok);\n }\n\n next(); // cb(null, false) causes next plugin to roll\n });\n })();\n }\n\n public allow_unpublish(\n { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n user: RemoteUser,\n callback: Callback\n ): void {\n const pkg = Object.assign(\n { name: packageName, version: packageVersion },\n getMatchedPackagesSpec(packageName, this.config.packages)\n );\n debug('allow unpublish for %o', packageName);\n\n for (const plugin of this.plugins) {\n if (_.isNil(plugin) \|\| isFunction(plugin.allow_unpublish) === false) {\n debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n continue;\n } else {\n // @ts-ignore\n plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n if (err) {\n debug(\n 'forbidden publish for %o, it will fallback on unpublish permissions',\n packageName\n );\n return callback(err);\n }\n\n if (_.isNil(ok) === true) {\n debug('bypass unpublish for %o, publish will handle the access', packageName);\n // @ts-ignore\n // eslint-disable-next-line\n return this.allow_publish(...arguments);\n }\n\n if (ok) {\n debug('allowed unpublish for %o', packageName);\n return callback(null, ok);\n }\n });\n }\n }\n }\n\n /\n Allow user to publish a package.\n /\n public allow_publish(\n { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n user: RemoteUser,\n callback: Callback\n ): void {\n const plugins = this.plugins.slice(0);\n const pkg = Object.assign(\n { name: packageName, version: packageVersion },\n getMatchedPackagesSpec(packageName, this.config.packages)\n ) as any;\n debug('allow publish for %o init \| plugins: %o', packageName, plugins.length);\n\n (function next(): void {\n const plugin = plugins.shift();\n\n if (typeof plugin?.allow_publish !== 'function') {\n debug('allow publish for %o plugin does not implement allow_publish', packageName);\n return next();\n }\n\n plugin.allow_publish(user, pkg, (err: VerdaccioError \| null, ok?: boolean): void => {\n if (_.isNil(err) === false && _.isError(err)) {\n debug('forbidden publish for %o', packageName);\n return callback(err);\n }\n\n if (ok) {\n debug('allowed publish for %o', packageName);\n return callback(null, ok);\n }\n\n debug('allow publish skip validation for %o', packageName);\n next(); // cb(null, false) causes next plugin to roll\n });\n })();\n }\n\n public apiJWTmiddleware(): RequestHandler {\n debug('jwt middleware');\n const plugins = this.plugins.slice(0);\n const helpers = { createAnonymousRemoteUser, createRemoteUser };\n for (const plugin of plugins) {\n if (plugin.apiJWTmiddleware) {\n return plugin.apiJWTmiddleware(helpers);\n }\n }\n\n // @ts-ignore\n return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n req.pause();\n\n const next = function (err?: VerdaccioError): any {\n req.resume();\n // uncomment this to reject users with bad auth headers\n // return _next.apply(null, arguments)\n // swallow error, user remains unauthorized\n // set remoteUserError to indicate that user was attempting authentication\n if (err) {\n req.remote_user.error = err.message;\n }\n\n return _next();\n };\n\n if (this._isRemoteUserValid(req.remote_user)) {\n debug('jwt has a valid authentication header');\n return next();\n }\n\n // in case auth header does not exist we return anonymous function\n const remoteUser = createAnonymousRemoteUser();\n req.remote_user = remoteUser;\n res.locals.remote_user = remoteUser;\n\n const { authorization } = req.headers;\n if (_.isNil(authorization)) {\n debug('jwt, authentication header is missing');\n return next();\n }\n\n if (!isAuthHeaderValid(authorization)) {\n debug('api middleware authentication heather is invalid');\n return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n }\n const { secret, security } = this.config;\n\n if (isAESLegacy(security)) {\n debug('api middleware using legacy auth token');\n this._handleAESMiddleware(req, security, secret, authorization, next);\n } else {\n debug('api middleware using JWT auth token');\n this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n }\n };\n }\n\n private _handleJWTAPIMiddleware(\n req: $RequestExtend,\n security: Security,\n secret: string,\n authorization: string,\n next: Function\n ): void {\n debug('handle JWT api middleware');\n const { scheme, token } = parseAuthTokenHeader(authorization);\n if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n debug('handle basic token');\n // this should happen when client tries to login with an existing user\n const credentials = convertPayloadToBase64(token).toString();\n const { user, password } = parseBasicPayload(credentials) as AESPayload;\n debug('authenticating %o', user);\n this.authenticate(user, password, (err: VerdaccioError \| null, user): void => {\n if (!err) {\n debug('generating a remote user');\n req.remote_user = user;\n next();\n } else {\n debug('generating anonymous user');\n req.remote_user = createAnonymousRemoteUser();\n next(err);\n }\n });\n } else {\n debug('handle jwt token');\n const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n if (credentials) {\n // if the signature is valid we rely on it\n req.remote_user = credentials;\n debug('generating a remote user');\n next();\n } else {\n // with JWT throw 401\n debug('jwt invalid token');\n next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n }\n }\n }\n\n private _handleAESMiddleware(\n req: $RequestExtend,\n security: Security,\n secret: string,\n authorization: string,\n next: Function\n ): void {\n debug('handle legacy api middleware');\n debug('api middleware secret %o', typeof secret === 'string');\n debug('api middleware authorization %o', typeof authorization === 'string');\n const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n debug('api middleware credentials %o', credentials?.name);\n if (credentials) {\n const { user, password } = credentials;\n debug('authenticating %o', user);\n this.authenticate(user, password, (err, user): void => {\n if (!err) {\n req.remote_user = user;\n debug('generating a remote user');\n next();\n } else {\n req.remote_user = createAnonymousRemoteUser();\n debug('generating anonymous user');\n next(err);\n }\n });\n } else {\n // we force npm client to ask again with basic authentication\n debug('legacy invalid header');\n return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n }\n }\n\n private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n }\n\n /\n JWT middleware for WebUI\n /\n public webUIJWTmiddleware(): RequestHandler {\n // @ts-ignore\n return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n if (this._isRemoteUserValid(req.remote_user)) {\n return _next();\n }\n\n req.pause();\n const next = (err: VerdaccioError \| void): void => {\n req.resume();\n if (err) {\n // req.remote_user.error = err.message;\n res.status(err.statusCode).send(err.message);\n }\n\n return _next();\n };\n\n const { authorization } = req.headers;\n if (_.isNil(authorization)) {\n return next();\n }\n\n if (!isAuthHeaderValid(authorization)) {\n return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n }\n\n const token = (authorization \|\| '').replace(`${TOKEN_BEARER} `, '');\n if (!token) {\n return next();\n }\n\n let credentials: RemoteUser \| undefined;\n try {\n credentials = verifyJWTPayload(token, this.config.secret);\n } catch (err: any) {\n // FIXME: intended behaviour, do we want it?\n }\n\n if (this._isRemoteUserValid(credentials)) {\n const { name, groups } = credentials as RemoteUser;\n req.remote_user = createRemoteUser(name as string, groups);\n } else {\n req.remote_user = createAnonymousRemoteUser();\n }\n\n next();\n };\n }\n\n public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n const { real_groups, name, groups } = user;\n debug('jwt encrypt %o', name);\n const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n const groupedGroups = _.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);\n const payload: RemoteUser = {\n real_groups: realGroupsValidated,\n name,\n groups: groupedGroups,\n };\n\n const token: string = await signPayload(payload, this.secret, signOptions);\n\n return token;\n }\n\n /\n Encrypt a string.\n */\n public aesEncrypt(value: string): string \| void {\n return aesEncrypt(value, this.secret);\n }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;AAAA;;AAEA;;AACA;;AAEA;;AACA;;AASA;;AACA;;AAWA;;AAEA;;AACA;;AACA;;AACA;;;;AAUA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,gBAAX,CAAd;;AAoBA,MAAMC,IAAN,CAA+E;EAKtEC,WAAW,CAACC,MAAD,EAAiB;IACjC,KAAKA,MAAL,GAAcA,MAAd;IACA,KAAKC,MAAL,GAAcD,MAAM,CAACC,MAArB;IACA,KAAKC,OAAL,GAAe,EAAf;;IACA,IAAI,CAAC,KAAKD,MAAV,EAAkB;MAChB,MAAM,IAAIE,SAAJ,CAAc,0DAAd,CAAN;IACD;EACF;;EAEgB,MAAJC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,KAAKG,UAAL,EAArB;IACAT,KAAK,CAAC,uBAAD,EAA0BM,OAAO,CAACI,MAAlC,CAAL;;IACA,IAAI,CAACJ,OAAD,IAAYA,OAAO,CAACI,MAAR,KAAmB,CAAnC,EAAsC;MACpCJ,OAAO,GAAG,KAAKK,iBAAL,EAAV;IACD;;IACD,KAAKL,OAAL,GAAeA,OAAf;;IAEA,KAAKM,oBAAL;EACD;;EAEOD,iBAAiB,GAAG;IAC1BX,KAAK,CAAC,0BAAD,CAAL;IACA,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,KAAKA,MADkC;MAE/CU,MAAM,EAANA;IAF+C,CAAjD;IAIA,IAAIC,UAAJ;;IACA,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAJ,CACX;QAAEC,IAAI,EAAE;MAAR,CADW,EAEXJ,aAFW,CAAb;IAID,CALD,CAKE,OAAOK,KAAP,EAAmB;MACnBlB,KAAK,CAAC,iDAAD,EAAoDkB,KAApD,CAAL;;MACAJ,cAAA,CAAOK,IAAP,CAAY,EAAZ,EAAgB,+BAAhB;;MACA,OAAO,EAAP;IACD;;IAED,OAAO,CAACJ,UAAD,CAAP;EACD;;EAEuB,MAAVN,UAAU,GAAG;IAAA;;IACzB,OAAO,IAAAW,wBAAA,EACL,KAAKhB,MAAL,CAAYiB,IADP,EAEL;MACEjB,MAAM,EAAE,KAAKA,MADf;MAEEU,MAAM,EAANA;IAFF,CAFK,EAMJQ,MAAD,IAAqB;MACnB,MAAM;QAAEC,YAAF;QAAgBC,YAAhB;QAA8BC;MAA9B,IAAgDH,MAAtD;MAEA,OACE,OAAOC,YAAP,KAAwB,WAAxB,IACA,OAAOC,YAAP,KAAwB,WADxB,IAEA,OAAOC,aAAP,KAAyB,WAH3B;IAKD,CAdI,kBAeL,KAAKrB,MAfA,0EAeL,aAAasB,cAfR,0DAeL,sBAA6BC,YAfxB,CAAP;EAiBD;;EAEOf,oBAAoB,GAAS;IACnC;IACA,KAAKN,OAAL,CAAasB,IAAb,CAAkB,IAAAC,yBAAA,EAAkBf,cAAlB,CAAlB;EACD;;EAEMgB,cAAc,CACnBC,QADmB,EAEnBC,QAFmB,EAGnBC,WAHmB,EAInBC,EAJmB,EAKb;IACN,MAAMC,YAAY,GAAGC,eAAA,CAAEC,MAAF,CAAS,KAAK/B,OAAd,EAAwBgB,MAAD,IAAY,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,CAAnC,CAArB;;IAEA,IAAIM,eAAA,CAAEG,OAAF,CAAUJ,YAAV,CAAJ,EAA6B;MAC3B,OAAOD,EAAE,CAACM,gBAAA,CAAWC,gBAAX,CAA4BC,oBAAA,CAAeC,wBAA3C,CAAD,CAAT;IACD;;IAED,KAAK,MAAMrB,MAAX,IAAqBa,YAArB,EAAmC;MACjC,IAAI,IAAAS,YAAA,EAAMtB,MAAN,KAAiB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACQ,cAAlB,MAAsC,KAA3D,EAAkE;QAChE9B,KAAK,CAAC,gEAAD,CAAL;QACA;MACD,CAHD,MAGO;QACLA,KAAK,CAAC,0BAAD,EAA6B+B,QAA7B,CAAL;QACAT,MAAM,CAACQ,cAAP,CAAuBC,QAAvB,EAAiCC,QAAjC,EAA2CC,WAA3C,EAAwD,CAACY,GAAD,EAAMC,OAAN,KAAwB;UAC9E,IAAID,GAAJ,EAAS;YACP/B,cAAA,CAAOI,KAAP,CACE;cAAEa,QAAF;cAAYc;YAAZ,CADF,EAEG;AACf,yEAHY;;YAKA,OAAOX,EAAE,CAACW,GAAD,CAAT;UACD;;UAED7C,KAAK,CAAC,wCAAD,EAA2C+B,QAA3C,CAAL;UACA,OAAOG,EAAE,CAAC,IAAD,EAAOY,OAAP,CAAT;QACD,CAZD;MAaD;IACF;EACF;;EAE2B,MAAfC,eAAe,CAACC,KAAD,EAAgB;IAC1C;IACAC,OAAO,CAACC,GAAR,CAAY,uCAAZ,EAAqDF,KAArD;IACA,OAAOG,OAAO,CAACC,OAAR,EAAP;EACD;;EAEM7B,YAAY,CACjBQ,QADiB,EAEjBC,QAFiB,EAGjBE,EAHiB,EAIX;IACN,MAAM5B,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;;IACA,CAAC,SAASC,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAR,EAAf;;MAEA,IAAI,IAAAjB,iBAAA,EAAWhB,MAAM,CAACC,YAAlB,MAAoC,KAAxC,EAA+C;QAC7C,OAAO+B,IAAI,EAAX;MACD;;MAEDtD,KAAK,CAAC,mBAAD,EAAsB+B,QAAtB,CAAL;MACAT,MAAM,CAACC,YAAP,CAAoBQ,QAApB,EAA8BC,QAA9B,EAAwC,UAAUa,GAAV,EAAsCW,MAAtC,EAAoD;QAC1F,IAAIX,GAAJ,EAAS;UACP7C,KAAK,CAAC,8CAAD,EAAiD+B,QAAjD,EAA2Dc,GAA3D,aAA2DA,GAA3D,uBAA2DA,GAAG,CAAEY,OAAhE,CAAL;UACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;QACD,CAJyF,CAM1F;QACA;QACA;QACA;QACA;QACA;QACA;;;QACA,IAAI,CAAC,CAACW,MAAF,IAAYA,MAAM,CAAC9C,MAAP,KAAkB,CAAlC,EAAqC;UACnC;UACA,IAAI0B,eAAA,CAAEsB,QAAF,CAAWF,MAAX,CAAJ,EAAwB;YACtB,MAAM,IAAIjD,SAAJ,CAAc,+CAAd,CAAN;UACD;;UACD,MAAMoD,YAAqB,GAAGvB,eAAA,CAAEwB,OAAF,CAAUJ,MAAV,CAA9B;;UACA,IAAI,CAACG,YAAL,EAAmB;YACjB,MAAM,IAAIpD,SAAJ,CAAcsD,eAAA,CAAUC,qBAAxB,CAAN;UACD;;UAED9D,KAAK,CAAC,yDAAD,EAA4D+B,QAA5D,EAAsEyB,MAAtE,CAAL;UACA,OAAOtB,EAAE,CAACW,GAAD,EAAM,IAAAkB,wBAAA,EAAiBhC,QAAjB,EAA2ByB,MAA3B,CAAN,CAAT;QACD;;QACDF,IAAI;MACL,CA3BD;IA4BD,CApCD;EAqCD;;EAEMU,QAAQ,CACbC,IADa,EAEbjC,QAFa,EAGbE,EAHa,EAIP;IACN,MAAMgC,IAAI,GAAG,IAAb;IACA,MAAM5D,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACArD,KAAK,CAAC,aAAD,EAAgBiE,IAAhB,CAAL;;IAEA,CAAC,SAASX,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAR,EAAf;;MACA,IAAI,OAAOjC,MAAM,CAAC6C,OAAd,KAA0B,UAA9B,EAA0C;QACxCb,IAAI;MACL,CAFD,MAEO;QACL;QACA,IAAI,OAAOhC,MAAM,CAAC6C,OAAd,KAA0B,WAA1B,IAAyC,OAAO7C,MAAM,CAAC0C,QAAd,KAA2B,UAAxE,EAAoF;UAClF,MAAMxB,gBAAA,CAAWC,gBAAX,CACJ,yDADI,CAAN;QAGD;;QAEDnB,MAAM,CAAC6C,OAAP,CACEF,IADF,EAEEjC,QAFF,EAGE,UAAUa,GAAV,EAAsCuB,EAAtC,EAAmE;UACjE,IAAIvB,GAAJ,EAAS;YACP7C,KAAK,CAAC,+CAAD,EAAkDiE,IAAlD,EAAwDpB,GAAxD,aAAwDA,GAAxD,uBAAwDA,GAAG,CAAEY,OAA7D,CAAL;YACA,OAAOvB,EAAE,CAACW,GAAD,CAAT;UACD;;UACD,IAAIuB,EAAJ,EAAQ;YACNpE,KAAK,CAAC,4BAAD,EAA+BiE,IAA/B,CAAL;YACA,OAAOC,IAAI,CAAC3C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkCE,EAAlC,CAAP;UACD;;UACDoB,IAAI;QACL,CAbH;MAeD;IACF,CA5BD;EA6BD;EAED;AACF;AACA;;;EACS9B,YAAY,CACjB;IAAE6C,WAAF;IAAeC;EAAf,CADiB,EAEjBL,IAFiB,EAGjBM,QAHiB,EAIX;IACN,MAAMjE,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMmB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CAApC;IACA,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV,EADU,EAEVL,cAFU,EAGV,IAAAM,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAHU,CAAZ;IAKA/E,KAAK,CAAC,qBAAD,EAAwBqE,WAAxB,CAAL;;IAEA,CAAC,SAASf,IAAT,GAAsB;MACrB,MAAMhC,MAAiC,GAAGhB,OAAO,CAACiD,KAAR,EAA1C;;MAEA,IAAInB,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAACE,YAAlB,MAAoC,KAA3D,EAAkE;QAChE,OAAO8B,IAAI,EAAX;MACD;;MAEDhC,MAAM,CAACE,YAAP,CAAqByC,IAArB,EAA2BU,GAA3B,EAAgC,UAAU9B,GAAV,EAAsCuB,EAAtC,EAA0D;QACxF,IAAIvB,GAAJ,EAAS;UACP7C,KAAK,CAAC,oCAAD,EAAuCqE,WAAvC,EAAoDxB,GAApD,aAAoDA,GAApD,uBAAoDA,GAAG,CAAEY,OAAzD,CAAL;UACA,OAAOc,QAAQ,CAAC1B,GAAD,CAAf;QACD;;QAED,IAAIuB,EAAJ,EAAQ;UACNpE,KAAK,CAAC,uBAAD,EAA0BqE,WAA1B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDd,IAAI,GAXoF,CAWhF;MACT,CAZD;IAaD,CApBD;EAqBD;;EAEM0B,eAAe,CACpB;IAAEX,WAAF;IAAeC;EAAf,CADoB,EAEpBL,IAFoB,EAGpBM,QAHoB,EAId;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAFU,CAAZ;IAIA/E,KAAK,CAAC,wBAAD,EAA2BqE,WAA3B,CAAL;;IAEA,KAAK,MAAM/C,MAAX,IAAqB,KAAKhB,OAA1B,EAAmC;MACjC,IAAI8B,eAAA,CAAEQ,KAAF,CAAQtB,MAAR,KAAmB,IAAAgB,iBAAA,EAAWhB,MAAM,CAAC0D,eAAlB,MAAuC,KAA9D,EAAqE;QACnEhF,KAAK,CAAC,kEAAD,EAAqEqE,WAArE,CAAL;QACA;MACD,CAHD,MAGO;QACL;QACA/C,MAAM,CAAC0D,eAAP,CAAwBf,IAAxB,EAA8BU,GAA9B,EAAmC,CAAC9B,GAAD,EAAMuB,EAAN,KAA4B;UAC7D,IAAIvB,GAAJ,EAAS;YACP7C,KAAK,CACH,qEADG,EAEHqE,WAFG,CAAL;YAIA,OAAOE,QAAQ,CAAC1B,GAAD,CAAf;UACD;;UAED,IAAIT,eAAA,CAAEQ,KAAF,CAAQwB,EAAR,MAAgB,IAApB,EAA0B;YACxBpE,KAAK,CAAC,yDAAD,EAA4DqE,WAA5D,CAAL,CADwB,CAExB;YACA;;YACA,OAAO,KAAK5C,aAAL,CAAmB,GAAGwD,SAAtB,CAAP;UACD;;UAED,IAAIb,EAAJ,EAAQ;YACNpE,KAAK,CAAC,0BAAD,EAA6BqE,WAA7B,CAAL;YACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;UACD;QACF,CApBD;MAqBD;IACF;EACF;EAED;AACF;AACA;;;EACS3C,aAAa,CAClB;IAAE4C,WAAF;IAAeC;EAAf,CADkB,EAElBL,IAFkB,EAGlBM,QAHkB,EAIZ;IACN,MAAMjE,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAMsB,GAAG,GAAGC,MAAM,CAACC,MAAP,CACV;MAAEJ,IAAI,EAAEJ,WAAR;MAAqBK,OAAO,EAAEJ;IAA9B,CADU,EAEV,IAAAQ,6BAAA,EAAuBT,WAAvB,EAAoC,KAAKjE,MAAL,CAAY2E,QAAhD,CAFU,CAAZ;IAIA/E,KAAK,CAAC,yCAAD,EAA4CqE,WAA5C,EAAyD/D,OAAO,CAACI,MAAjE,CAAL;;IAEA,CAAC,SAAS4C,IAAT,GAAsB;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAR,EAAf;;MAEA,IAAI,QAAOjC,MAAP,aAAOA,MAAP,uBAAOA,MAAM,CAAEG,aAAf,MAAiC,UAArC,EAAiD;QAC/CzB,KAAK,CAAC,8DAAD,EAAiEqE,WAAjE,CAAL;QACA,OAAOf,IAAI,EAAX;MACD;;MAEDhC,MAAM,CAACG,aAAP,CAAqBwC,IAArB,EAA2BU,GAA3B,EAAgC,CAAC9B,GAAD,EAA6BuB,EAA7B,KAAoD;QAClF,IAAIhC,eAAA,CAAEQ,KAAF,CAAQC,GAAR,MAAiB,KAAjB,IAA0BT,eAAA,CAAE8C,OAAF,CAAUrC,GAAV,CAA9B,EAA8C;UAC5C7C,KAAK,CAAC,0BAAD,EAA6BqE,WAA7B,CAAL;UACA,OAAOE,QAAQ,CAAC1B,GAAD,CAAf;QACD;;QAED,IAAIuB,EAAJ,EAAQ;UACNpE,KAAK,CAAC,wBAAD,EAA2BqE,WAA3B,CAAL;UACA,OAAOE,QAAQ,CAAC,IAAD,EAAOH,EAAP,CAAf;QACD;;QAEDpE,KAAK,CAAC,sCAAD,EAAyCqE,WAAzC,CAAL;QACAf,IAAI,GAZ8E,CAY1E;MACT,CAbD;IAcD,CAtBD;EAuBD;;EAEM6B,gBAAgB,GAAmB;IACxCnF,KAAK,CAAC,gBAAD,CAAL;IACA,MAAMM,OAAO,GAAG,KAAKA,OAAL,CAAa+C,KAAb,CAAmB,CAAnB,CAAhB;IACA,MAAM+B,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAF;MAA6BtB,gBAAgB,EAAhBA;IAA7B,CAAhB;;IACA,KAAK,MAAMzC,MAAX,IAAqBhB,OAArB,EAA8B;MAC5B,IAAIgB,MAAM,CAAC6D,gBAAX,EAA6B;QAC3B,OAAO7D,MAAM,CAAC6D,gBAAP,CAAwBC,OAAxB,CAAP;MACD;IACF,CARuC,CAUxC;;;IACA,OAAO,CAACE,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAAoE;MACzEF,GAAG,CAACG,KAAJ;;MAEA,MAAMnC,IAAI,GAAG,UAAUT,GAAV,EAAqC;QAChDyC,GAAG,CAACI,MAAJ,GADgD,CAEhD;QACA;QACA;QACA;;QACA,IAAI7C,GAAJ,EAAS;UACPyC,GAAG,CAACK,WAAJ,CAAgBzE,KAAhB,GAAwB2B,GAAG,CAACY,OAA5B;QACD;;QAED,OAAO+B,KAAK,EAAZ;MACD,CAXD;;MAaA,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C3F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOsD,IAAI,EAAX;MACD,CAnBwE,CAqBzE;;;MACA,MAAMuC,UAAU,GAAG,IAAAR,iCAAA,GAAnB;MACAC,GAAG,CAACK,WAAJ,GAAkBE,UAAlB;MACAN,GAAG,CAACO,MAAJ,CAAWH,WAAX,GAAyBE,UAAzB;MAEA,MAAM;QAAEE;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI5D,eAAA,CAAEQ,KAAF,CAAQmD,aAAR,CAAJ,EAA4B;QAC1B/F,KAAK,CAAC,uCAAD,CAAL;QACA,OAAOsD,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA2C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC/F,KAAK,CAAC,kDAAD,CAAL;QACA,OAAOsD,IAAI,CAACd,gBAAA,CAAW0D,aAAX,CAAyBrC,eAAA,CAAUsC,eAAnC,CAAD,CAAX;MACD;;MACD,MAAM;QAAE9F,MAAF;QAAU+F;MAAV,IAAuB,KAAKhG,MAAlC;;MAEA,IAAI,IAAAiG,mBAAA,EAAYD,QAAZ,CAAJ,EAA2B;QACzBpG,KAAK,CAAC,wCAAD,CAAL;;QACA,KAAKsG,oBAAL,CAA0BhB,GAA1B,EAA+Bc,QAA/B,EAAyC/F,MAAzC,EAAiD0F,aAAjD,EAAgEzC,IAAhE;MACD,CAHD,MAGO;QACLtD,KAAK,CAAC,qCAAD,CAAL;;QACA,KAAKuG,uBAAL,CAA6BjB,GAA7B,EAAkCc,QAAlC,EAA4C/F,MAA5C,EAAoD0F,aAApD,EAAmEzC,IAAnE;MACD;IACF,CA7CD;EA8CD;;EAEOiD,uBAAuB,CAC7BjB,GAD6B,EAE7Bc,QAF6B,EAG7B/F,MAH6B,EAI7B0F,aAJ6B,EAK7BzC,IAL6B,EAMvB;IACNtD,KAAK,CAAC,2BAAD,CAAL;IACA,MAAM;MAAEwG,MAAF;MAAUxD;IAAV,IAAoB,IAAAyD,4BAAA,EAAqBV,aAArB,CAA1B;;IACA,IAAIS,MAAM,CAACE,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;MACtD1G,KAAK,CAAC,oBAAD,CAAL,CADsD,CAEtD;;MACA,MAAM4G,WAAW,GAAG,IAAAC,8BAAA,EAAuB7D,KAAvB,EAA8B8D,QAA9B,EAApB;MACA,MAAM;QAAE7C,IAAF;QAAQjC;MAAR,IAAqB,IAAA+E,wBAAA,EAAkBH,WAAlB,CAA3B;MACA5G,KAAK,CAAC,mBAAD,EAAsBiE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAA6BoB,IAA7B,KAA4C;QAC5E,IAAI,CAACpB,GAAL,EAAU;UACR7C,KAAK,CAAC,0BAAD,CAAL;UACAsF,GAAG,CAACK,WAAJ,GAAkB1B,IAAlB;UACAX,IAAI;QACL,CAJD,MAIO;UACLtD,KAAK,CAAC,2BAAD,CAAL;UACAsF,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACA/B,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAjBD,MAiBO;MACL7C,KAAK,CAAC,kBAAD,CAAL;MACA,MAAM4G,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC/F,MAAnC,EAA2C0F,aAA3C,CAAzB;;MACA,IAAIa,WAAJ,EAAiB;QACf;QACAtB,GAAG,CAACK,WAAJ,GAAkBiB,WAAlB;QACA5G,KAAK,CAAC,0BAAD,CAAL;QACAsD,IAAI;MACL,CALD,MAKO;QACL;QACAtD,KAAK,CAAC,mBAAD,CAAL;QACAsD,IAAI,CAACd,gBAAA,CAAWyE,YAAX,CAAwBpD,eAAA,CAAUqD,qBAAlC,CAAD,CAAJ;MACD;IACF;EACF;;EAEOZ,oBAAoB,CAC1BhB,GAD0B,EAE1Bc,QAF0B,EAG1B/F,MAH0B,EAI1B0F,aAJ0B,EAK1BzC,IAL0B,EAMpB;IACNtD,KAAK,CAAC,8BAAD,CAAL;IACAA,KAAK,CAAC,0BAAD,EAA6B,OAAOK,MAAP,KAAkB,QAA/C,CAAL;IACAL,KAAK,CAAC,iCAAD,EAAoC,OAAO+F,aAAP,KAAyB,QAA7D,CAAL;IACA,MAAMa,WAAgB,GAAG,IAAAI,gCAAA,EAAyBZ,QAAzB,EAAmC/F,MAAnC,EAA2C0F,aAA3C,CAAzB;IACA/F,KAAK,CAAC,+BAAD,EAAkC4G,WAAlC,aAAkCA,WAAlC,uBAAkCA,WAAW,CAAEnC,IAA/C,CAAL;;IACA,IAAImC,WAAJ,EAAiB;MACf,MAAM;QAAE3C,IAAF;QAAQjC;MAAR,IAAqB4E,WAA3B;MACA5G,KAAK,CAAC,mBAAD,EAAsBiE,IAAtB,CAAL;MACA,KAAK1C,YAAL,CAAkB0C,IAAlB,EAAwBjC,QAAxB,EAAkC,CAACa,GAAD,EAAMoB,IAAN,KAAqB;QACrD,IAAI,CAACpB,GAAL,EAAU;UACRyC,GAAG,CAACK,WAAJ,GAAkB1B,IAAlB;UACAjE,KAAK,CAAC,0BAAD,CAAL;UACAsD,IAAI;QACL,CAJD,MAIO;UACLgC,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;UACArF,KAAK,CAAC,2BAAD,CAAL;UACAsD,IAAI,CAACT,GAAD,CAAJ;QACD;MACF,CAVD;IAWD,CAdD,MAcO;MACL;MACA7C,KAAK,CAAC,uBAAD,CAAL;MACA,OAAOsD,IAAI,CAACd,gBAAA,CAAW0D,aAAX,CAAyBrC,eAAA,CAAUsC,eAAnC,CAAD,CAAX;IACD;EACF;;EAEOP,kBAAkB,CAACD,WAAD,EAAoC;IAC5D,OAAOvD,eAAA,CAAE+E,WAAF,CAAcxB,WAAd,MAA+B,KAA/B,IAAwCvD,eAAA,CAAE+E,WAAF,CAAcxB,WAAd,aAAcA,WAAd,uBAAcA,WAAW,CAAElB,IAA3B,MAAqC,KAApF;EACD;EAED;AACF;AACA;;;EACS2C,kBAAkB,GAAmB;IAC1C;IACA,OAAO,CAAC9B,GAAD,EAAsBC,GAAtB,EAA4CC,KAA5C,KAA0E;MAC/E,IAAI,KAAKI,kBAAL,CAAwBN,GAAG,CAACK,WAA5B,CAAJ,EAA8C;QAC5C,OAAOH,KAAK,EAAZ;MACD;;MAEDF,GAAG,CAACG,KAAJ;;MACA,MAAMnC,IAAI,GAAIT,GAAD,IAAsC;QACjDyC,GAAG,CAACI,MAAJ;;QACA,IAAI7C,GAAJ,EAAS;UACP;UACA0C,GAAG,CAAC8B,MAAJ,CAAWxE,GAAG,CAACyE,UAAf,EAA2BC,IAA3B,CAAgC1E,GAAG,CAACY,OAApC;QACD;;QAED,OAAO+B,KAAK,EAAZ;MACD,CARD;;MAUA,MAAM;QAAEO;MAAF,IAAoBT,GAAG,CAACU,OAA9B;;MACA,IAAI5D,eAAA,CAAEQ,KAAF,CAAQmD,aAAR,CAAJ,EAA4B;QAC1B,OAAOzC,IAAI,EAAX;MACD;;MAED,IAAI,CAAC,IAAA2C,yBAAA,EAAkBF,aAAlB,CAAL,EAAuC;QACrC,OAAOzC,IAAI,CAACd,gBAAA,CAAW0D,aAAX,CAAyBrC,eAAA,CAAUsC,eAAnC,CAAD,CAAX;MACD;;MAED,MAAMnD,KAAK,GAAG,CAAC+C,aAAa,IAAI,EAAlB,EAAsByB,OAAtB,CAA+B,GAAEC,kBAAa,GAA9C,EAAkD,EAAlD,CAAd;;MACA,IAAI,CAACzE,KAAL,EAAY;QACV,OAAOM,IAAI,EAAX;MACD;;MAED,IAAIsD,WAAJ;;MACA,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAA,EAAiB1E,KAAjB,EAAwB,KAAK5C,MAAL,CAAYC,MAApC,CAAd;MACD,CAFD,CAEE,OAAOwC,GAAP,EAAiB,CACjB;MACD;;MAED,IAAI,KAAK+C,kBAAL,CAAwBgB,WAAxB,CAAJ,EAA0C;QACxC,MAAM;UAAEnC,IAAF;UAAQjB;QAAR,IAAmBoD,WAAzB;QACAtB,GAAG,CAACK,WAAJ,GAAkB,IAAA5B,wBAAA,EAAiBU,IAAjB,EAAiCjB,MAAjC,CAAlB;MACD,CAHD,MAGO;QACL8B,GAAG,CAACK,WAAJ,GAAkB,IAAAN,iCAAA,GAAlB;MACD;;MAED/B,IAAI;IACL,CA7CD;EA8CD;;EAEsB,MAAVqE,UAAU,CAAC1D,IAAD,EAAmB2D,WAAnB,EAAiE;IACtF,MAAM;MAAEC,WAAF;MAAepD,IAAf;MAAqBjB;IAArB,IAAgCS,IAAtC;IACAjE,KAAK,CAAC,gBAAD,EAAmByE,IAAnB,CAAL;IACA,MAAMqD,mBAAmB,GAAG1F,eAAA,CAAEQ,KAAF,CAAQiF,WAAR,IAAuB,EAAvB,GAA4BA,WAAxD;IACA,MAAME,aAAa,GAAG3F,eAAA,CAAEQ,KAAF,CAAQY,MAAR,IAAkBqE,WAAlB,GAAgCrE,MAAM,CAACwE,MAAP,CAAcF,mBAAd,CAAtD;IACA,MAAMG,OAAmB,GAAG;MAC1BJ,WAAW,EAAEC,mBADa;MAE1BrD,IAF0B;MAG1BjB,MAAM,EAAEuE;IAHkB,CAA5B;IAMA,MAAM/E,KAAa,GAAG,MAAM,IAAAkF,qBAAA,EAAYD,OAAZ,EAAqB,KAAK5H,MAA1B,EAAkCuH,WAAlC,CAA5B;IAEA,OAAO5E,KAAP;EACD;EAED;AACF;AACA;;;EACSmF,UAAU,CAACC,KAAD,EAA+B;IAC9C,OAAO,IAAAD,uBAAA,EAAWC,KAAX,EAAkB,KAAK/H,MAAvB,CAAP;EACD;;AAnhB4E"}

package/build/index.d.ts CHANGED Viewed

@@ -1,4 +1,4 @@
-export { Auth, IAuth, TokenEncryption, IBasicAuth } from './auth';
+export { Auth, TokenEncryption } from './auth';
 export * from './utils';
 export * from './legacy-token';
 export * from './jwt-token';

package/build/index.js CHANGED Viewed

@@ -5,9 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 var _exportNames = {
   Auth: true,
-  IAuth: true,
-  TokenEncryption: true,
-  IBasicAuth: true
+  TokenEncryption: true
 };
 Object.defineProperty(exports, "Auth", {
   enumerable: true,
@@ -15,18 +13,6 @@ Object.defineProperty(exports, "Auth", {
     return _auth.Auth;
   }
 });
-Object.defineProperty(exports, "IAuth", {
-  enumerable: true,
-  get: function () {
-    return _auth.IAuth;
-  }
-});
-Object.defineProperty(exports, "IBasicAuth", {
-  enumerable: true,
-  get: function () {
-    return _auth.IBasicAuth;
-  }
-});
 Object.defineProperty(exports, "TokenEncryption", {
   enumerable: true,
   get: function () {

package/build/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { Auth, ~~IAuth,~~ TokenEncryption, ~~IBasicAuth~~ } from './auth';\nexport * from './utils';\nexport * from './legacy-token';\nexport * from './jwt-token';\nexport * from './token';\n"],"mappings":"~~;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;~~AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
1	+ {"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { Auth, TokenEncryption } from './auth';\nexport * from './utils';\nexport * from './legacy-token';\nexport * from './jwt-token';\nexport * from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;;AACA;;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}

package/build/utils.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 /// <reference types="node" />
-import { VerdaccioError } from '@verdaccio/core';
-import { AuthPackageAllow, Config, IPluginAuth, RemoteUser, Security } from '@verdaccio/types';
+import { VerdaccioError, pluginUtils } from '@verdaccio/core';
+import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
 import { AESPayload, TokenEncryption } from './auth';
 export declare type BasicPayload = AESPayload | void;
 export declare type AuthMiddlewarePayload = RemoteUser | BasicPayload;
@@ -23,12 +23,17 @@ export declare function getApiToken(auth: TokenEncryption, config: Config, remot
 export declare const expireReasons: string[];
 export declare function verifyJWTPayload(token: string, secret: string): RemoteUser;
 export declare function isAuthHeaderValid(authorization: string): boolean;
-export declare function getDefaultPlugins(logger: any): IPluginAuth<Config>;
+/**
+ * Return a default configuration for authentication if none is provided.
+ * @param logger {Logger}
+ * @returns object of default implementations.
+ */
+export declare function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config>;
 export declare type ActionsAllowed = 'publish' | 'unpublish' | 'access';
-export declare function allow_action(action: ActionsAllowed, logger: any): AllowAction;
+export declare function allow_action(action: ActionsAllowed, logger: Logger): AllowAction;
 /**
  *
  */
-export declare function handleSpecialUnpublish(logger: any): any;
+export declare function handleSpecialUnpublish(logger: Logger): any;
 export declare function buildUser(name: string, password: string): string;
 export declare function convertPayloadToBase64(payload: string): Buffer;

package/build/utils.js CHANGED Viewed

@@ -158,14 +158,20 @@ function verifyJWTPayload(token, secret) {
 function isAuthHeaderValid(authorization) {
   return authorization.split(' ').length === 2;
 }
+/**
+ * Return a default configuration for authentication if none is provided.
+ * @param logger {Logger}
+ * @returns object of default implementations.
+ */
 function getDefaultPlugins(logger) {
   return {
-    authenticate(user, password, cb) {
+    authenticate(_user, _password, cb) {
       cb(_core.errorUtils.getForbidden(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
-    adduser(user, password, cb) {
+    adduser(_user, _password, cb) {
       return cb(_core.errorUtils.getConflict(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },

package/build/utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"utils.js","names":["debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","user","password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n API_ERROR,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport {\n AuthPackageAllow,\n Callback,\n Config,\n IPluginAuth,\n RemoteUser,\n Security,\n} from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\nimport { verifyPayload } from './jwt-token';\nimport { aesDecrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload \| void;\nexport type AuthMiddlewarePayload = RemoteUser \| BasicPayload;\n\nexport interface AuthTokenHeader {\n scheme: string;\n token: string;\n}\nexport type AllowActionCallbackResponse = boolean \| undefined;\nexport type AllowActionCallback = (\n error: VerdaccioError \| null,\n allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n user: RemoteUser,\n pkg: AuthPackageAllow,\n callback: AllowActionCallback\n) => void;\n\n/*\n Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n /\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n const parts = authorizationHeader.split(' ');\n const [scheme, token] = parts;\n\n return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n debug('parseAESCredentials');\n const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n // basic is deprecated and should not be enforced\n // basic is currently being used for functional test\n if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n debug('legacy header basic');\n const credentials = convertPayloadToBase64(token).toString();\n\n return credentials;\n } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n debug('legacy header bearer');\n const credentials = aesDecrypt(token, secret);\n\n return credentials;\n }\n}\n\nexport function getMiddlewareCredentials(\n security: Security,\n secretKey: string,\n authorizationHeader: string\n): AuthMiddlewarePayload {\n debug('getMiddlewareCredentials');\n // comment out for debugging purposes\n if (isAESLegacy(security)) {\n debug('is legacy');\n const credentials = parseAESCredentials(authorizationHeader, secretKey);\n if (!credentials) {\n debug('parse legacy credentials failed');\n return;\n }\n\n const parsedCredentials = parseBasicPayload(credentials);\n if (!parsedCredentials) {\n debug('parse legacy basic payload credentials failed');\n return;\n }\n\n return parsedCredentials;\n }\n const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n debug('is jwt');\n if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n return verifyJWTPayload(token, secretKey);\n }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n const { legacy, jwt } = security.api;\n\n return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n auth: TokenEncryption,\n config: Config,\n remoteUser: RemoteUser,\n aesPassword: string\n): Promise<string \| void> {\n debug('get api token');\n const { security } = config;\n\n if (isAESLegacy(security)) {\n debug('security legacy enabled');\n // fallback all goes to AES encryption\n return await new Promise((resolve): void => {\n resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n });\n }\n const { jwt } = security.api;\n\n if (jwt?.sign) {\n return await auth.jwtEncrypt(remoteUser, jwt.sign);\n }\n return await new Promise((resolve): void => {\n resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n try {\n const payload: RemoteUser = verifyPayload(token, secret);\n\n return payload;\n } catch (error: any) {\n // #168 this check should be removed as soon AES encrypt is removed.\n if (expireReasons.includes(error.name)) {\n // it might be possible the jwt configuration is enabled and\n // old tokens fails still remains in usage, thus\n // we return an anonymous user to force log in.\n return createAnonymousRemoteUser();\n }\n throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n return authorization.split(' ').length === 2;\n}\n\nexport function getDefaultPlugins(logger: any): IPluginAuth<Config> {\n return {\n authenticate(user: string, password: string, cb: Callback): void {\n cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n },\n\n adduser(user: string, password: string, cb: Callback): void {\n return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n },\n\n // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n // @ts-ignore\n allow_access: allow_action('access', logger),\n // @ts-ignore\n allow_publish: allow_action('publish', logger),\n allow_unpublish: handleSpecialUnpublish(logger),\n };\n}\n\nexport type ActionsAllowed = 'publish' \| 'unpublish' \| 'access';\n\nexport function allow_action(action: ActionsAllowed, logger): AllowAction {\n return function allowActionCallback(\n user: RemoteUser,\n pkg: AuthPackageAllow,\n callback: AllowActionCallback\n ): void {\n logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n const { name, groups } = user;\n const groupAccess = pkg[action] as string[];\n const hasPermission = groupAccess.some((group) => name === group \|\| groups.includes(group));\n logger.trace(\n { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n );\n\n if (hasPermission) {\n logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n return callback(null, true);\n }\n\n if (name) {\n callback(\n errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n );\n } else {\n callback(\n errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n );\n }\n };\n}\n\n/\n \n */\nexport function handleSpecialUnpublish(logger): any {\n return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n const action = 'unpublish';\n // verify whether the unpublish prop has been defined\n const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n logger.trace(\n { user: user.name, name: pkg.name, hasGroups },\n `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n );\n\n if (isUnpublishMissing \|\| hasGroups === false) {\n return callback(null, undefined);\n }\n\n logger.trace(\n { user: user.name, name: pkg.name, action, hasGroups },\n `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n );\n return allow_action(action, logger)(user, pkg, callback);\n };\n}\n\nexport function buildUser(name: string, password: string): string {\n return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AACA;;AAkBA;;AACA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAqBA;AACA;AACA;AACA;AACO,SAASC,oBAAT,CAA8BC,mBAA9B,EAA4E;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAApB,CAA0B,GAA1B,CAAd;EACA,MAAM,CAACC,MAAD,EAASC,KAAT,IAAkBH,KAAxB;EAEA,OAAO;IAAEE,MAAF;IAAUC;EAAV,CAAP;AACD;;AAEM,SAASC,mBAAT,CAA6BL,mBAA7B,EAA0DM,MAA1D,EAA0E;EAC/ET,KAAK,CAAC,qBAAD,CAAL;EACA,MAAM;IAAEM,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C,CAF+E,CAI/E;EACA;;EACA,IAAIG,MAAM,CAACI,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;IACtDV,KAAK,CAAC,qBAAD,CAAL;IACA,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAD,CAAtB,CAA8BO,QAA9B,EAApB;IAEA,OAAOF,WAAP;EACD,CALD,MAKO,IAAIN,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAA7B,EAAyD;IAC9DV,KAAK,CAAC,sBAAD,CAAL;IACA,MAAMY,WAAW,GAAG,IAAAI,uBAAA,EAAWT,KAAX,EAAkBE,MAAlB,CAApB;IAEA,OAAOG,WAAP;EACD;AACF;;AAEM,SAASK,wBAAT,CACLC,QADK,EAELC,SAFK,EAGLhB,mBAHK,EAIkB;EACvBH,KAAK,CAAC,0BAAD,CAAL,CADuB,CAEvB;;EACA,IAAIoB,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,WAAD,CAAL;IACA,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAD,EAAsBgB,SAAtB,CAAvC;;IACA,IAAI,CAACP,WAAL,EAAkB;MAChBZ,KAAK,CAAC,iCAAD,CAAL;MACA;IACD;;IAED,MAAMqB,iBAAiB,GAAG,IAAAC,wBAAA,EAAkBV,WAAlB,CAA1B;;IACA,IAAI,CAACS,iBAAL,EAAwB;MACtBrB,KAAK,CAAC,+CAAD,CAAL;MACA;IACD;;IAED,OAAOqB,iBAAP;EACD;;EACD,MAAM;IAAEf,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C;EAEAH,KAAK,CAAC,QAAD,CAAL;;EACA,IAAIuB,eAAA,CAAEC,QAAF,CAAWjB,KAAX,KAAqBD,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAAlD,EAA8E;IAC5E,OAAOe,gBAAgB,CAAClB,KAAD,EAAQY,SAAR,CAAvB;EACD;AACF;;AAEM,SAASC,WAAT,CAAqBF,QAArB,EAAkD;EACvD,MAAM;IAAEQ,MAAF;IAAUC;EAAV,IAAkBT,QAAQ,CAACU,GAAjC;EAEA,OAAOL,eAAA,CAAEM,KAAF,CAAQH,MAAR,MAAoB,KAApB,IAA6BH,eAAA,CAAEM,KAAF,CAAQF,GAAR,CAA7B,IAA6CD,MAAM,KAAK,IAA/D;AACD;;AAEM,eAAeI,WAAf,CACLC,IADK,EAELC,MAFK,EAGLC,UAHK,EAILC,WAJK,EAKmB;EACxBlC,KAAK,CAAC,eAAD,CAAL;EACA,MAAM;IAAEkB;EAAF,IAAec,MAArB;;EAEA,IAAIZ,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,yBAAD,CAAL,CADyB,CAEzB;;IACA,OAAO,MAAM,IAAImC,OAAJ,CAAaC,OAAD,IAAmB;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;IACD,CAFY,CAAb;EAGD;;EACD,MAAM;IAAEP;EAAF,IAAUT,QAAQ,CAACU,GAAzB;;EAEA,IAAID,GAAJ,aAAIA,GAAJ,eAAIA,GAAG,CAAEa,IAAT,EAAe;IACb,OAAO,MAAMT,IAAI,CAACU,UAAL,CAAgBR,UAAhB,EAA4BN,GAAG,CAACa,IAAhC,CAAb;EACD;;EACD,OAAO,MAAM,IAAIL,OAAJ,CAAaC,OAAD,IAAmB;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;EACD,CAFY,CAAb;AAGD;;AAEM,MAAMQ,aAAuB,GAAG,CAAC,mBAAD,EAAsB,mBAAtB,CAAhC;;;AAEA,SAASjB,gBAAT,CAA0BlB,KAA1B,EAAyCE,MAAzC,EAAqE;EAC1E,IAAI;IACF,MAAMkC,OAAmB,GAAG,IAAAC,uBAAA,EAAcrC,KAAd,EAAqBE,MAArB,CAA5B;IAEA,OAAOkC,OAAP;EACD,CAJD,CAIE,OAAOE,KAAP,EAAmB;IACnB;IACA,IAAIH,aAAa,CAACI,QAAd,CAAuBD,KAAK,CAACN,IAA7B,CAAJ,EAAwC;MACtC;MACA;MACA;MACA,OAAO,IAAAQ,iCAAA,GAAP;IACD;;IACD,MAAMC,gBAAA,CAAWC,OAAX,CAAmBC,iBAAA,CAAYC,YAA/B,EAA6CN,KAAK,CAACO,OAAnD,CAAN;EACD;AACF;;AAEM,SAASC,iBAAT,CAA2BC,aAA3B,EAA2D;EAChE,OAAOA,aAAa,CAACjD,KAAd,CAAoB,GAApB,EAAyBkD,MAAzB,KAAoC,CAA3C;AACD;;AAEM,SAASC,iBAAT,CAA2BC,MAA3B,EAA6D;EAClE,OAAO;IACLC,YAAY,CAACC,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;MAC/DA,EAAE,CAACb,gBAAA,CAAWc,YAAX,CAAwBC,eAAA,CAAUC,qBAAlC,CAAD,CAAF;IACD,CAHI;;IAKLC,OAAO,CAACN,IAAD,EAAeC,QAAf,EAAiCC,EAAjC,EAAqD;MAC1D,OAAOA,EAAE,CAACb,gBAAA,CAAWkB,WAAX,CAAuBH,eAAA,CAAUC,qBAAjC,CAAD,CAAT;IACD,CAPI;;IASL;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAD,EAAWX,MAAX,CAXrB;IAYL;IACAY,aAAa,EAAED,YAAY,CAAC,SAAD,EAAYX,MAAZ,CAbtB;IAcLa,eAAe,EAAEC,sBAAsB,CAACd,MAAD;EAdlC,CAAP;AAgBD;;AAIM,SAASW,YAAT,CAAsBI,MAAtB,EAA8Cf,MAA9C,EAAmE;EACxE,OAAO,SAASgB,mBAAT,CACLd,IADK,EAELe,GAFK,EAGLC,QAHK,EAIC;IACNlB,MAAM,CAACmB,KAAP,CAAa;MAAEC,MAAM,EAAElB,IAAI,CAACpB;IAAf,CAAb,EAAqC,sCAArC;IACA,MAAM;MAAEA,IAAF;MAAQuC;IAAR,IAAmBnB,IAAzB;IACA,MAAMoB,WAAW,GAAGL,GAAG,CAACF,MAAD,CAAvB;IACA,MAAMQ,aAAa,GAAGD,WAAW,CAACE,IAAZ,CAAkBC,KAAD,IAAW3C,IAAI,KAAK2C,KAAT,IAAkBJ,MAAM,CAAChC,QAAP,CAAgBoC,KAAhB,CAA9C,CAAtB;IACAzB,MAAM,CAACmB,KAAP,CACE;MAAEO,OAAO,EAAET,GAAG,CAACnC,IAAf;MAAqByC,aAArB;MAAoCH,MAAM,EAAElB,IAAI,CAACpB,IAAjD;MAAuDwC;IAAvD,CADF,EAEG,+FAFH;;IAKA,IAAIC,aAAJ,EAAmB;MACjBvB,MAAM,CAACmB,KAAP,CAAa;QAAEC,MAAM,EAAElB,IAAI,CAACpB;MAAf,CAAb,EAAqC,iDAArC;MACA,OAAOoC,QAAQ,CAAC,IAAD,EAAO,IAAP,CAAf;IACD;;IAED,IAAIpC,IAAJ,EAAU;MACRoC,QAAQ,CACN3B,gBAAA,CAAWc,YAAX,CAAyB,QAAOvB,IAAK,sBAAqBiC,MAAO,YAAWE,GAAG,CAACnC,IAAK,EAArF,CADM,CAAR;IAGD,CAJD,MAIO;MACLoC,QAAQ,CACN3B,gBAAA,CAAWoC,eAAX,CAA4B,6BAA4BZ,MAAO,YAAWE,GAAG,CAACnC,IAAK,EAAnF,CADM,CAAR;IAGD;EACF,CA5BD;AA6BD;AAED;AACA;AACA;;;AACO,SAASgC,sBAAT,CAAgCd,MAAhC,EAA6C;EAClD,OAAO,UAAUE,IAAV,EAA4Be,GAA5B,EAAmDC,QAAnD,EAAwF;IAC7F,MAAMH,MAAM,GAAG,WAAf,CAD6F,CAE7F;;IACA,MAAMa,kBAA2B,GAAG9D,eAAA,CAAEM,KAAF,CAAQ6C,GAAG,CAACF,MAAD,CAAX,CAApC;;IACA,MAAMc,SAAkB,GAAGD,kBAAkB,GAAG,KAAH,GAAYX,GAAG,CAACF,MAAD,CAAJ,CAA0BjB,MAA1B,GAAmC,CAA3F;IACAE,MAAM,CAACmB,KAAP,CACE;MAAEjB,IAAI,EAAEA,IAAI,CAACpB,IAAb;MAAmBA,IAAI,EAAEmC,GAAG,CAACnC,IAA7B;MAAmC+C;IAAnC,CADF,EAEG,qEAFH;;IAKA,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAxC,EAA+C;MAC7C,OAAOX,QAAQ,CAAC,IAAD,EAAOY,SAAP,CAAf;IACD;;IAED9B,MAAM,CAACmB,KAAP,CACE;MAAEjB,IAAI,EAAEA,IAAI,CAACpB,IAAb;MAAmBA,IAAI,EAAEmC,GAAG,CAACnC,IAA7B;MAAmCiC,MAAnC;MAA2Cc;IAA3C,CADF,EAEG,6EAFH;IAIA,OAAOlB,YAAY,CAACI,MAAD,EAASf,MAAT,CAAZ,CAA6BE,IAA7B,EAAmCe,GAAnC,EAAwCC,QAAxC,CAAP;EACD,CAnBD;AAoBD;;AAEM,SAASrC,SAAT,CAAmBC,IAAnB,EAAiCqB,QAAjC,EAA2D;EAChE,OAAO4B,MAAM,CAAE,GAAEjD,IAAK,IAAGqB,QAAS,EAArB,CAAb;AACD;;AAEM,SAAS/C,sBAAT,CAAgC8B,OAAhC,EAAyD;EAC9D,OAAO8C,MAAM,CAACC,IAAP,CAAY/C,OAAZ,EAAqB,QAArB,CAAP;AACD"}
1	+ {"version":3,"file":"utils.js","names":["debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n API_ERROR,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n pluginUtils,\n} from '@verdaccio/core';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\nimport { verifyPayload } from './jwt-token';\nimport { aesDecrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload \| void;\nexport type AuthMiddlewarePayload = RemoteUser \| BasicPayload;\n\nexport interface AuthTokenHeader {\n scheme: string;\n token: string;\n}\nexport type AllowActionCallbackResponse = boolean \| undefined;\nexport type AllowActionCallback = (\n error: VerdaccioError \| null,\n allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n user: RemoteUser,\n pkg: AuthPackageAllow,\n callback: AllowActionCallback\n) => void;\n\n/*\n Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n /\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n const parts = authorizationHeader.split(' ');\n const [scheme, token] = parts;\n\n return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n debug('parseAESCredentials');\n const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n // basic is deprecated and should not be enforced\n // basic is currently being used for functional test\n if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n debug('legacy header basic');\n const credentials = convertPayloadToBase64(token).toString();\n\n return credentials;\n } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n debug('legacy header bearer');\n const credentials = aesDecrypt(token, secret);\n\n return credentials;\n }\n}\n\nexport function getMiddlewareCredentials(\n security: Security,\n secretKey: string,\n authorizationHeader: string\n): AuthMiddlewarePayload {\n debug('getMiddlewareCredentials');\n // comment out for debugging purposes\n if (isAESLegacy(security)) {\n debug('is legacy');\n const credentials = parseAESCredentials(authorizationHeader, secretKey);\n if (!credentials) {\n debug('parse legacy credentials failed');\n return;\n }\n\n const parsedCredentials = parseBasicPayload(credentials);\n if (!parsedCredentials) {\n debug('parse legacy basic payload credentials failed');\n return;\n }\n\n return parsedCredentials;\n }\n const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n debug('is jwt');\n if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n return verifyJWTPayload(token, secretKey);\n }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n const { legacy, jwt } = security.api;\n\n return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n auth: TokenEncryption,\n config: Config,\n remoteUser: RemoteUser,\n aesPassword: string\n): Promise<string \| void> {\n debug('get api token');\n const { security } = config;\n\n if (isAESLegacy(security)) {\n debug('security legacy enabled');\n // fallback all goes to AES encryption\n return await new Promise((resolve): void => {\n resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n });\n }\n const { jwt } = security.api;\n\n if (jwt?.sign) {\n return await auth.jwtEncrypt(remoteUser, jwt.sign);\n }\n return await new Promise((resolve): void => {\n resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n try {\n const payload: RemoteUser = verifyPayload(token, secret);\n\n return payload;\n } catch (error: any) {\n // #168 this check should be removed as soon AES encrypt is removed.\n if (expireReasons.includes(error.name)) {\n // it might be possible the jwt configuration is enabled and\n // old tokens fails still remains in usage, thus\n // we return an anonymous user to force log in.\n return createAnonymousRemoteUser();\n }\n throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n return authorization.split(' ').length === 2;\n}\n\n/\n Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n /\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n return {\n authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n },\n\n adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n },\n\n // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n // @ts-ignore\n allow_access: allow_action('access', logger),\n // @ts-ignore\n allow_publish: allow_action('publish', logger),\n allow_unpublish: handleSpecialUnpublish(logger),\n };\n}\n\nexport type ActionsAllowed = 'publish' \| 'unpublish' \| 'access';\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n return function allowActionCallback(\n user: RemoteUser,\n pkg: AuthPackageAllow,\n callback: AllowActionCallback\n ): void {\n logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n const { name, groups } = user;\n const groupAccess = pkg[action] as string[];\n const hasPermission = groupAccess.some((group) => name === group \|\| groups.includes(group));\n logger.trace(\n { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n );\n\n if (hasPermission) {\n logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n return callback(null, true);\n }\n\n if (name) {\n callback(\n errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n );\n } else {\n callback(\n errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n );\n }\n };\n}\n\n/\n \n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n const action = 'unpublish';\n // verify whether the unpublish prop has been defined\n const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n logger.trace(\n { user: user.name, name: pkg.name, hasGroups },\n `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n );\n\n if (isUnpublishMissing \|\| hasGroups === false) {\n return callback(null, undefined);\n }\n\n logger.trace(\n { user: user.name, name: pkg.name, action, hasGroups },\n `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n );\n return allow_action(action, logger)(user, pkg, callback);\n };\n}\n\nexport function buildUser(name: string, password: string): string {\n return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AACA;;AAYA;;AACA;;AACA;;;;AAEA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAqBA;AACA;AACA;AACA;AACO,SAASC,oBAAT,CAA8BC,mBAA9B,EAA4E;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAApB,CAA0B,GAA1B,CAAd;EACA,MAAM,CAACC,MAAD,EAASC,KAAT,IAAkBH,KAAxB;EAEA,OAAO;IAAEE,MAAF;IAAUC;EAAV,CAAP;AACD;;AAEM,SAASC,mBAAT,CAA6BL,mBAA7B,EAA0DM,MAA1D,EAA0E;EAC/ET,KAAK,CAAC,qBAAD,CAAL;EACA,MAAM;IAAEM,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C,CAF+E,CAI/E;EACA;;EACA,IAAIG,MAAM,CAACI,WAAP,OAAyBC,iBAAA,CAAYD,WAAZ,EAA7B,EAAwD;IACtDV,KAAK,CAAC,qBAAD,CAAL;IACA,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAD,CAAtB,CAA8BO,QAA9B,EAApB;IAEA,OAAOF,WAAP;EACD,CALD,MAKO,IAAIN,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAA7B,EAAyD;IAC9DV,KAAK,CAAC,sBAAD,CAAL;IACA,MAAMY,WAAW,GAAG,IAAAI,uBAAA,EAAWT,KAAX,EAAkBE,MAAlB,CAApB;IAEA,OAAOG,WAAP;EACD;AACF;;AAEM,SAASK,wBAAT,CACLC,QADK,EAELC,SAFK,EAGLhB,mBAHK,EAIkB;EACvBH,KAAK,CAAC,0BAAD,CAAL,CADuB,CAEvB;;EACA,IAAIoB,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,WAAD,CAAL;IACA,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAD,EAAsBgB,SAAtB,CAAvC;;IACA,IAAI,CAACP,WAAL,EAAkB;MAChBZ,KAAK,CAAC,iCAAD,CAAL;MACA;IACD;;IAED,MAAMqB,iBAAiB,GAAG,IAAAC,wBAAA,EAAkBV,WAAlB,CAA1B;;IACA,IAAI,CAACS,iBAAL,EAAwB;MACtBrB,KAAK,CAAC,+CAAD,CAAL;MACA;IACD;;IAED,OAAOqB,iBAAP;EACD;;EACD,MAAM;IAAEf,MAAF;IAAUC;EAAV,IAAoBL,oBAAoB,CAACC,mBAAD,CAA9C;EAEAH,KAAK,CAAC,QAAD,CAAL;;EACA,IAAIuB,eAAA,CAAEC,QAAF,CAAWjB,KAAX,KAAqBD,MAAM,CAACI,WAAP,OAAyBK,kBAAA,CAAaL,WAAb,EAAlD,EAA8E;IAC5E,OAAOe,gBAAgB,CAAClB,KAAD,EAAQY,SAAR,CAAvB;EACD;AACF;;AAEM,SAASC,WAAT,CAAqBF,QAArB,EAAkD;EACvD,MAAM;IAAEQ,MAAF;IAAUC;EAAV,IAAkBT,QAAQ,CAACU,GAAjC;EAEA,OAAOL,eAAA,CAAEM,KAAF,CAAQH,MAAR,MAAoB,KAApB,IAA6BH,eAAA,CAAEM,KAAF,CAAQF,GAAR,CAA7B,IAA6CD,MAAM,KAAK,IAA/D;AACD;;AAEM,eAAeI,WAAf,CACLC,IADK,EAELC,MAFK,EAGLC,UAHK,EAILC,WAJK,EAKmB;EACxBlC,KAAK,CAAC,eAAD,CAAL;EACA,MAAM;IAAEkB;EAAF,IAAec,MAArB;;EAEA,IAAIZ,WAAW,CAACF,QAAD,CAAf,EAA2B;IACzBlB,KAAK,CAAC,yBAAD,CAAL,CADyB,CAEzB;;IACA,OAAO,MAAM,IAAImC,OAAJ,CAAaC,OAAD,IAAmB;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;IACD,CAFY,CAAb;EAGD;;EACD,MAAM;IAAEP;EAAF,IAAUT,QAAQ,CAACU,GAAzB;;EAEA,IAAID,GAAJ,aAAIA,GAAJ,eAAIA,GAAG,CAAEa,IAAT,EAAe;IACb,OAAO,MAAMT,IAAI,CAACU,UAAL,CAAgBR,UAAhB,EAA4BN,GAAG,CAACa,IAAhC,CAAb;EACD;;EACD,OAAO,MAAM,IAAIL,OAAJ,CAAaC,OAAD,IAAmB;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAL,CAAgBC,SAAS,CAACL,UAAU,CAACM,IAAZ,EAA4BL,WAA5B,CAAzB,CAAD,CAAP;EACD,CAFY,CAAb;AAGD;;AAEM,MAAMQ,aAAuB,GAAG,CAAC,mBAAD,EAAsB,mBAAtB,CAAhC;;;AAEA,SAASjB,gBAAT,CAA0BlB,KAA1B,EAAyCE,MAAzC,EAAqE;EAC1E,IAAI;IACF,MAAMkC,OAAmB,GAAG,IAAAC,uBAAA,EAAcrC,KAAd,EAAqBE,MAArB,CAA5B;IAEA,OAAOkC,OAAP;EACD,CAJD,CAIE,OAAOE,KAAP,EAAmB;IACnB;IACA,IAAIH,aAAa,CAACI,QAAd,CAAuBD,KAAK,CAACN,IAA7B,CAAJ,EAAwC;MACtC;MACA;MACA;MACA,OAAO,IAAAQ,iCAAA,GAAP;IACD;;IACD,MAAMC,gBAAA,CAAWC,OAAX,CAAmBC,iBAAA,CAAYC,YAA/B,EAA6CN,KAAK,CAACO,OAAnD,CAAN;EACD;AACF;;AAEM,SAASC,iBAAT,CAA2BC,aAA3B,EAA2D;EAChE,OAAOA,aAAa,CAACjD,KAAd,CAAoB,GAApB,EAAyBkD,MAAzB,KAAoC,CAA3C;AACD;AAED;AACA;AACA;AACA;AACA;;;AACO,SAASC,iBAAT,CAA2BC,MAA3B,EAAqE;EAC1E,OAAO;IACLC,YAAY,CAACC,KAAD,EAAgBC,SAAhB,EAAmCC,EAAnC,EAAuE;MACjFA,EAAE,CAACb,gBAAA,CAAWc,YAAX,CAAwBC,eAAA,CAAUC,qBAAlC,CAAD,CAAF;IACD,CAHI;;IAKLC,OAAO,CAACN,KAAD,EAAgBC,SAAhB,EAAmCC,EAAnC,EAA2E;MAChF,OAAOA,EAAE,CAACb,gBAAA,CAAWkB,WAAX,CAAuBH,eAAA,CAAUC,qBAAjC,CAAD,CAAT;IACD,CAPI;;IASL;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAD,EAAWX,MAAX,CAXrB;IAYL;IACAY,aAAa,EAAED,YAAY,CAAC,SAAD,EAAYX,MAAZ,CAbtB;IAcLa,eAAe,EAAEC,sBAAsB,CAACd,MAAD;EAdlC,CAAP;AAgBD;;AAIM,SAASW,YAAT,CAAsBI,MAAtB,EAA8Cf,MAA9C,EAA2E;EAChF,OAAO,SAASgB,mBAAT,CACLC,IADK,EAELC,GAFK,EAGLC,QAHK,EAIC;IACNnB,MAAM,CAACoB,KAAP,CAAa;MAAEC,MAAM,EAAEJ,IAAI,CAACnC;IAAf,CAAb,EAAqC,sCAArC;IACA,MAAM;MAAEA,IAAF;MAAQwC;IAAR,IAAmBL,IAAzB;IACA,MAAMM,WAAW,GAAGL,GAAG,CAACH,MAAD,CAAvB;IACA,MAAMS,aAAa,GAAGD,WAAW,CAACE,IAAZ,CAAkBC,KAAD,IAAW5C,IAAI,KAAK4C,KAAT,IAAkBJ,MAAM,CAACjC,QAAP,CAAgBqC,KAAhB,CAA9C,CAAtB;IACA1B,MAAM,CAACoB,KAAP,CACE;MAAEO,OAAO,EAAET,GAAG,CAACpC,IAAf;MAAqB0C,aAArB;MAAoCH,MAAM,EAAEJ,IAAI,CAACnC,IAAjD;MAAuDyC;IAAvD,CADF,EAEG,+FAFH;;IAKA,IAAIC,aAAJ,EAAmB;MACjBxB,MAAM,CAACoB,KAAP,CAAa;QAAEC,MAAM,EAAEJ,IAAI,CAACnC;MAAf,CAAb,EAAqC,iDAArC;MACA,OAAOqC,QAAQ,CAAC,IAAD,EAAO,IAAP,CAAf;IACD;;IAED,IAAIrC,IAAJ,EAAU;MACRqC,QAAQ,CACN5B,gBAAA,CAAWc,YAAX,CAAyB,QAAOvB,IAAK,sBAAqBiC,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAArF,CADM,CAAR;IAGD,CAJD,MAIO;MACLqC,QAAQ,CACN5B,gBAAA,CAAWqC,eAAX,CAA4B,6BAA4Bb,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAAnF,CADM,CAAR;IAGD;EACF,CA5BD;AA6BD;AAED;AACA;AACA;;;AACO,SAASgC,sBAAT,CAAgCd,MAAhC,EAAqD;EAC1D,OAAO,UAAUiB,IAAV,EAA4BC,GAA5B,EAAmDC,QAAnD,EAAwF;IAC7F,MAAMJ,MAAM,GAAG,WAAf,CAD6F,CAE7F;;IACA,MAAMc,kBAA2B,GAAG/D,eAAA,CAAEM,KAAF,CAAQ8C,GAAG,CAACH,MAAD,CAAX,CAApC;;IACA,MAAMe,SAAkB,GAAGD,kBAAkB,GAAG,KAAH,GAAYX,GAAG,CAACH,MAAD,CAAJ,CAA0BjB,MAA1B,GAAmC,CAA3F;IACAE,MAAM,CAACoB,KAAP,CACE;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAb;MAAmBA,IAAI,EAAEoC,GAAG,CAACpC,IAA7B;MAAmCgD;IAAnC,CADF,EAEG,qEAFH;;IAKA,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAxC,EAA+C;MAC7C,OAAOX,QAAQ,CAAC,IAAD,EAAOY,SAAP,CAAf;IACD;;IAED/B,MAAM,CAACoB,KAAP,CACE;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAb;MAAmBA,IAAI,EAAEoC,GAAG,CAACpC,IAA7B;MAAmCiC,MAAnC;MAA2Ce;IAA3C,CADF,EAEG,6EAFH;IAIA,OAAOnB,YAAY,CAACI,MAAD,EAASf,MAAT,CAAZ,CAA6BiB,IAA7B,EAAmCC,GAAnC,EAAwCC,QAAxC,CAAP;EACD,CAnBD;AAoBD;;AAEM,SAAStC,SAAT,CAAmBC,IAAnB,EAAiCkD,QAAjC,EAA2D;EAChE,OAAOC,MAAM,CAAE,GAAEnD,IAAK,IAAGkD,QAAS,EAArB,CAAb;AACD;;AAEM,SAAS5E,sBAAT,CAAgC8B,OAAhC,EAAyD;EAC9D,OAAOgD,MAAM,CAACC,IAAP,CAAYjD,OAAZ,EAAqB,QAArB,CAAP;AACD"}