@verdaccio/auth 6.0.0-6-next.29 → 6.0.0-6-next.31

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @verdaccio/auth
 
+## 6.0.0-6-next.31
+
+### Patch Changes
+
+- @verdaccio/core@6.0.0-6-next.52
+- @verdaccio/config@6.0.0-6-next.52
+- @verdaccio/loaders@6.0.0-6-next.21
+- @verdaccio/logger@6.0.0-6-next.20
+- verdaccio-htpasswd@11.0.0-6-next.22
+- @verdaccio/utils@6.0.0-6-next.20
+
+## 6.0.0-6-next.30
+
+### Minor Changes
+
+- 4b29d715: chore: move improvements from v5 to v6
+
+  Migrate improvements form v5 to v6:
+
+  - https://github.com/verdaccio/verdaccio/pull/3158
+  - https://github.com/verdaccio/verdaccio/pull/3151
+  - https://github.com/verdaccio/verdaccio/pull/2271
+  - https://github.com/verdaccio/verdaccio/pull/2787
+  - https://github.com/verdaccio/verdaccio/pull/2791
+  - https://github.com/verdaccio/verdaccio/pull/2205
+
+### Patch Changes
+
+- Updated dependencies [4b29d715]
+  - @verdaccio/config@6.0.0-6-next.51
+  - @verdaccio/core@6.0.0-6-next.51
+  - @verdaccio/loaders@6.0.0-6-next.20
+  - verdaccio-htpasswd@11.0.0-6-next.21
+  - @verdaccio/logger@6.0.0-6-next.19
+  - @verdaccio/utils@6.0.0-6-next.19
+
 ## 6.0.0-6-next.29
 
 ### Patch Changes

package/build/auth.d.ts

@@ -13,14 +13,14 @@ export interface IAuthMiddleware {
     apiJWTmiddleware(): $NextFunctionVer;
     webUIJWTmiddleware(): $NextFunctionVer;
 }
-export declare type $RequestExtend = Request & {
+export type $RequestExtend = Request & {
     remote_user?: any;
     log: Logger;
 };
-export declare type $ResponseExtend = Response & {
+export type $ResponseExtend = Response & {
     cookies?: any;
 };
-export declare type $NextFunctionVer = NextFunction & any;
+export type $NextFunctionVer = NextFunction & any;
 declare class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     config: Config;
     secret: string;

package/build/auth.js

@@ -4,59 +4,38 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.Auth = void 0;
-
 var _debug = _interopRequireDefault(require("debug"));
-
 var _lodash = _interopRequireDefault(require("lodash"));
-
 var _verdaccioHtpasswd = require("verdaccio-htpasswd");
-
 var _config = require("@verdaccio/config");
-
 var _core = require("@verdaccio/core");
-
 var _loaders = require("@verdaccio/loaders");
-
 var _logger = require("@verdaccio/logger");
-
 var _utils = require("@verdaccio/utils");
-
 var _jwtToken = require("./jwt-token");
-
 var _legacyToken = require("./legacy-token");
-
 var _token = require("./token");
-
 var _utils2 = require("./utils");
-
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-
 const debug = (0, _debug.default)('verdaccio:auth');
-
 class Auth {
   constructor(config) {
     this.config = config;
     this.secret = config.secret;
     this.plugins = [];
-
     if (!this.secret) {
       throw new TypeError('secret it is required value on initialize the auth class');
     }
   }
-
   async init() {
     let plugins = await this.loadPlugin();
     debug('auth plugins found %s', plugins.length);
-
     if (!plugins || plugins.length === 0) {
       plugins = this.loadDefaultPlugin();
     }
-
     this.plugins = plugins;
-
     this._applyDefaultPlugins();
   }
-
   loadDefaultPlugin() {
     debug('load default auth plugin');
     const pluginOptions = {
@@ -64,25 +43,19 @@ class Auth {
       logger: _logger.logger
     };
     let authPlugin;
-
     try {
       authPlugin = new _verdaccioHtpasswd.HTPasswd({
         file: './htpasswd'
       }, pluginOptions);
     } catch (error) {
       debug('error on loading auth htpasswd plugin stack: %o', error);
-
       _logger.logger.info({}, 'no auth plugin has been found');
-
       return [];
     }
-
     return [authPlugin];
   }
-
   async loadPlugin() {
     var _this$config, _this$config$serverSe;
-
     return (0, _loaders.asyncLoadPlugin)(this.config.auth, {
       config: this.config,
       logger: _logger.logger
@@ -95,19 +68,15 @@ class Auth {
       return typeof authenticate !== 'undefined' || typeof allow_access !== 'undefined' || typeof allow_publish !== 'undefined';
     }, (_this$config = this.config) === null || _this$config === void 0 ? void 0 : (_this$config$serverSe = _this$config.serverSettings) === null || _this$config$serverSe === void 0 ? void 0 : _this$config$serverSe.pluginPrefix);
   }
-
   _applyDefaultPlugins() {
     // TODO: rename to applyFallbackPluginMethods
     this.plugins.push((0, _utils2.getDefaultPlugins)(_logger.logger));
   }
-
   changePassword(username, password, newPassword, cb) {
     const validPlugins = _lodash.default.filter(this.plugins, plugin => (0, _utils.isFunction)(plugin.changePassword));
-
     if (_lodash.default.isEmpty(validPlugins)) {
       return cb(_core.errorUtils.getInternalError(_core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
     }
-
     for (const plugin of validPlugins) {
       if ((0, _utils.isNil)(plugin) || (0, _utils.isFunction)(plugin.changePassword) === false) {
         debug('auth plugin does not implement changePassword, trying next one');
@@ -121,76 +90,62 @@ class Auth {
               err
             }, `An error has been produced
             updating the password for @{username}. Error: @{err.message}`);
-
             return cb(err);
           }
-
           debug('updated password for %o was successful', username);
           return cb(null, profile);
         });
       }
     }
   }
-
   async invalidateToken(token) {
     // eslint-disable-next-line no-console
     console.log('invalidate token pending to implement', token);
     return Promise.resolve();
   }
-
   authenticate(username, password, cb) {
     const plugins = this.plugins.slice(0);
-
     (function next() {
       const plugin = plugins.shift();
-
       if ((0, _utils.isFunction)(plugin.authenticate) === false) {
         return next();
       }
-
       debug('authenticating %o', username);
       plugin.authenticate(username, password, function (err, groups) {
         if (err) {
           debug('authenticating for user %o failed. Error: %o', username, err === null || err === void 0 ? void 0 : err.message);
           return cb(err);
-        } // Expect: SKIP if groups is falsey and not an array
+        }
+
+        // Expect: SKIP if groups is falsey and not an array
         //         with at least one item (truthy length)
         // Expect: CONTINUE otherwise (will error if groups is not
         //         an array, but this is current behavior)
         // Caveat: STRING (if valid) will pass successfully
         //         bug give unexpected results
         // Info: Cannot use `== false to check falsey values`
-
-
         if (!!groups && groups.length !== 0) {
           // TODO: create a better understanding of expectations
           if (_lodash.default.isString(groups)) {
             throw new TypeError('plugin group error: invalid type for function');
           }
-
           const isGroupValid = _lodash.default.isArray(groups);
-
           if (!isGroupValid) {
             throw new TypeError(_core.API_ERROR.BAD_FORMAT_USER_GROUP);
           }
-
           debug('authentication for user %o was successfully. Groups: %o', username, groups);
           return cb(err, (0, _config.createRemoteUser)(username, groups));
         }
-
         next();
       });
     })();
   }
-
   add_user(user, password, cb) {
     const self = this;
     const plugins = this.plugins.slice(0);
     debug('add user %o', user);
-
     (function next() {
       const plugin = plugins.shift();
-
       if (typeof plugin.adduser !== 'function') {
         next();
       } else {
@@ -198,28 +153,24 @@ class Auth {
         if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
           throw _core.errorUtils.getInternalError('add_user method not longer supported, rename to adduser');
         }
-
         plugin.adduser(user, password, function (err, ok) {
           if (err) {
             debug('the user  %o could not being added. Error: %o', user, err === null || err === void 0 ? void 0 : err.message);
             return cb(err);
           }
-
           if (ok) {
             debug('the user %o has been added', user);
             return self.authenticate(user, password, cb);
           }
-
           next();
         });
       }
     })();
   }
+
   /**
    * Allow user to access a package.
    */
-
-
   allow_access({
     packageName,
     packageVersion
@@ -231,25 +182,20 @@ class Auth {
     };
     const pkg = Object.assign({}, pkgAllowAccess, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
     debug('allow access for %o', packageName);
-
     (function next() {
       const plugin = plugins.shift();
-
       if (_lodash.default.isNil(plugin) || (0, _utils.isFunction)(plugin.allow_access) === false) {
         return next();
       }
-
       plugin.allow_access(user, pkg, function (err, ok) {
         if (err) {
           debug('forbidden access for %o. Error: %o', packageName, err === null || err === void 0 ? void 0 : err.message);
           return callback(err);
         }
-
         if (ok) {
           debug('allowed access for %o', packageName);
           return callback(null, ok);
         }
-
         next(); // cb(null, false) causes next plugin to roll
       });
     })();
@@ -264,7 +210,6 @@ class Auth {
       version: packageVersion
     }, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
     debug('allow unpublish for %o', packageName);
-
     for (const plugin of this.plugins) {
       if (_lodash.default.isNil(plugin) || (0, _utils.isFunction)(plugin.allow_unpublish) === false) {
         debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);
@@ -276,14 +221,12 @@ class Auth {
             debug('forbidden publish for %o, it will fallback on unpublish permissions', packageName);
             return callback(err);
           }
-
           if (_lodash.default.isNil(ok) === true) {
-            debug('bypass unpublish for %o, publish will handle the access', packageName); // @ts-ignore
+            debug('bypass unpublish for %o, publish will handle the access', packageName);
+            // @ts-ignore
             // eslint-disable-next-line
-
             return this.allow_publish(...arguments);
           }
-
           if (ok) {
             debug('allowed unpublish for %o', packageName);
             return callback(null, ok);
@@ -292,11 +235,10 @@ class Auth {
       }
     }
   }
+
   /**
    * Allow user to publish a package.
    */
-
-
   allow_publish({
     packageName,
     packageVersion
@@ -307,26 +249,21 @@ class Auth {
       version: packageVersion
     }, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
     debug('allow publish for %o init | plugins: %o', packageName, plugins.length);
-
     (function next() {
       const plugin = plugins.shift();
-
       if (typeof (plugin === null || plugin === void 0 ? void 0 : plugin.allow_publish) !== 'function') {
         debug('allow publish for %o plugin does not implement allow_publish', packageName);
         return next();
       }
-
       plugin.allow_publish(user, pkg, (err, ok) => {
         if (_lodash.default.isNil(err) === false && _lodash.default.isError(err)) {
           debug('forbidden publish for %o', packageName);
           return callback(err);
         }
-
         if (ok) {
           debug('allowed publish for %o', packageName);
           return callback(null, ok);
         }
-
         debug('allow publish skip validation for %o', packageName);
         next(); // cb(null, false) causes next plugin to roll
       });
@@ -340,80 +277,68 @@ class Auth {
       createAnonymousRemoteUser: _config.createAnonymousRemoteUser,
       createRemoteUser: _config.createRemoteUser
     };
-
     for (const plugin of plugins) {
       if (plugin.apiJWTmiddleware) {
         return plugin.apiJWTmiddleware(helpers);
       }
-    } // @ts-ignore
-
+    }
 
+    // @ts-ignore
     return (req, res, _next) => {
       req.pause();
-
       const next = function (err) {
-        req.resume(); // uncomment this to reject users with bad auth headers
+        req.resume();
+        // uncomment this to reject users with bad auth headers
         // return _next.apply(null, arguments)
         // swallow error, user remains unauthorized
         // set remoteUserError to indicate that user was attempting authentication
-
         if (err) {
           req.remote_user.error = err.message;
         }
-
         return _next();
       };
-
       if (this._isRemoteUserValid(req.remote_user)) {
         debug('jwt has a valid authentication header');
         return next();
-      } // in case auth header does not exist we return anonymous function
-
+      }
 
+      // in case auth header does not exist we return anonymous function
       const remoteUser = (0, _config.createAnonymousRemoteUser)();
       req.remote_user = remoteUser;
       res.locals.remote_user = remoteUser;
       const {
         authorization
       } = req.headers;
-
       if (_lodash.default.isNil(authorization)) {
         debug('jwt, authentication header is missing');
         return next();
       }
-
       if (!(0, _utils2.isAuthHeaderValid)(authorization)) {
         debug('api middleware authentication heather is invalid');
         return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
       }
-
       const {
         secret,
         security
       } = this.config;
-
       if ((0, _utils2.isAESLegacy)(security)) {
         debug('api middleware using legacy auth token');
-
         this._handleAESMiddleware(req, security, secret, authorization, next);
       } else {
         debug('api middleware using JWT auth token');
-
         this._handleJWTAPIMiddleware(req, security, secret, authorization, next);
       }
     };
   }
-
   _handleJWTAPIMiddleware(req, security, secret, authorization, next) {
     debug('handle JWT api middleware');
     const {
       scheme,
       token
     } = (0, _utils2.parseAuthTokenHeader)(authorization);
-
     if (scheme.toUpperCase() === _core.TOKEN_BASIC.toUpperCase()) {
-      debug('handle basic token'); // this should happen when client tries to login with an existing user
-
+      debug('handle basic token');
+      // this should happen when client tries to login with an existing user
       const credentials = (0, _utils2.convertPayloadToBase64)(token).toString();
       const {
         user,
@@ -434,7 +359,6 @@ class Auth {
     } else {
       debug('handle jwt token');
       const credentials = (0, _utils2.getMiddlewareCredentials)(security, secret, authorization);
-
       if (credentials) {
         // if the signature is valid we rely on it
         req.remote_user = credentials;
@@ -447,14 +371,12 @@ class Auth {
       }
     }
   }
-
   _handleAESMiddleware(req, security, secret, authorization, next) {
     debug('handle legacy api middleware');
     debug('api middleware secret %o', typeof secret === 'string');
     debug('api middleware authorization %o', typeof authorization === 'string');
     const credentials = (0, _utils2.getMiddlewareCredentials)(security, secret, authorization);
     debug('api middleware credentials %o', credentials === null || credentials === void 0 ? void 0 : credentials.name);
-
     if (credentials) {
       const {
         user,
@@ -478,60 +400,47 @@ class Auth {
       return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
     }
   }
-
   _isRemoteUserValid(remote_user) {
     return _lodash.default.isUndefined(remote_user) === false && _lodash.default.isUndefined(remote_user === null || remote_user === void 0 ? void 0 : remote_user.name) === false;
   }
+
   /**
    * JWT middleware for WebUI
    */
-
-
   webUIJWTmiddleware() {
     // @ts-ignore
     return (req, res, _next) => {
       if (this._isRemoteUserValid(req.remote_user)) {
         return _next();
       }
-
       req.pause();
-
       const next = err => {
         req.resume();
-
         if (err) {
           // req.remote_user.error = err.message;
           res.status(err.statusCode).send(err.message);
         }
-
         return _next();
       };
-
       const {
         authorization
       } = req.headers;
-
       if (_lodash.default.isNil(authorization)) {
         return next();
       }
-
       if (!(0, _utils2.isAuthHeaderValid)(authorization)) {
         return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
       }
-
       const token = (authorization || '').replace(`${_core.TOKEN_BEARER} `, '');
-
       if (!token) {
         return next();
       }
-
       let credentials;
-
       try {
         credentials = (0, _utils2.verifyJWTPayload)(token, this.config.secret);
-      } catch (err) {// FIXME: intended behaviour, do we want it?
+      } catch (err) {
+        // FIXME: intended behaviour, do we want it?
       }
-
       if (this._isRemoteUserValid(credentials)) {
         const {
           name,
@@ -541,11 +450,9 @@ class Auth {
       } else {
         req.remote_user = (0, _config.createAnonymousRemoteUser)();
       }
-
       next();
     };
   }
-
   async jwtEncrypt(user, signOptions) {
     const {
       real_groups,
@@ -554,7 +461,7 @@ class Auth {
     } = user;
     debug('jwt encrypt %o', name);
     const realGroupsValidated = _lodash.default.isNil(real_groups) ? [] : real_groups;
-    const groupedGroups = _lodash.default.isNil(groups) ? real_groups : groups.concat(realGroupsValidated);
+    const groupedGroups = _lodash.default.isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]));
     const payload = {
       real_groups: realGroupsValidated,
       name,
@@ -563,16 +470,13 @@ class Auth {
     const token = await (0, _jwtToken.signPayload)(payload, this.secret, signOptions);
     return token;
   }
+
   /**
    * Encrypt a string.
    */
-
-
   aesEncrypt(value) {
     return (0, _legacyToken.aesEncrypt)(value, this.secret);
   }
-
 }
-
 exports.Auth = Auth;
 //# sourceMappingURL=auth.js.map