@verdaccio/auth 6.0.0-6-next.41 → 6.0.0-6-next.42

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @verdaccio/auth
 
+## 6.0.0-6-next.42
+
+### Minor Changes
+
+- ddb6a223: feat: signature package
+
+### Patch Changes
+
+- Updated dependencies [ddb6a223]
+- Updated dependencies [dc571aab]
+  - @verdaccio/config@6.0.0-6-next.63
+  - @verdaccio/signature@6.0.0-6-next.2
+  - @verdaccio/core@6.0.0-6-next.63
+  - @verdaccio/loaders@6.0.0-6-next.32
+  - verdaccio-htpasswd@11.0.0-6-next.33
+  - @verdaccio/utils@6.0.0-6-next.31
+  - @verdaccio/logger@6.0.0-6-next.31
+
 ## 6.0.0-6-next.41
 
 ### Patch Changes

package/build/auth.js

@@ -11,10 +11,8 @@ var _config = require("@verdaccio/config");
 var _core = require("@verdaccio/core");
 var _loaders = require("@verdaccio/loaders");
 var _logger = require("@verdaccio/logger");
+var _signature = require("@verdaccio/signature");
 var _utils = require("@verdaccio/utils");
-var _jwtToken = require("./jwt-token");
-var _legacyToken = require("./legacy-token");
-var _token = require("./token");
 var _utils2 = require("./utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:auth');
@@ -343,7 +341,7 @@ class Auth {
       const {
         user,
         password
-      } = (0, _token.parseBasicPayload)(credentials);
+      } = (0, _signature.parseBasicPayload)(credentials);
       debug('authenticating %o', user);
       this.authenticate(user, password, (err, user) => {
         if (!err) {
@@ -467,7 +465,7 @@ class Auth {
       name,
       groups: groupedGroups
     };
-    const token = await (0, _jwtToken.signPayload)(payload, this.secret, signOptions);
+    const token = await (0, _signature.signPayload)(payload, this.secret, signOptions);
     return token;
   }
 
@@ -475,7 +473,7 @@ class Auth {
    * Encrypt a string.
    */
   aesEncrypt(value) {
-    return (0, _legacyToken.aesEncrypt)(value, this.secret);
+    return (0, _signature.aesEncrypt)(value, this.secret);
   }
 }
 exports.Auth = Auth;

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","adduser","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, RequestHandler, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport { signPayload } from './jwt-token';\nimport { aesEncrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      if (typeof plugin.adduser !== 'function') {\n        next();\n      } else {\n        // @ts-expect-error future major (7.x) should remove this section\n        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n          throw errorUtils.getInternalError(\n            'add_user method not longer supported, rename to adduser'\n          );\n        }\n\n        plugin.adduser(\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user  %o could not being added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as any;\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): RequestHandler {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n\n      const next = function (err?: VerdaccioError): any {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): RequestHandler {\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA;AAEA;AACA;AAEA;AACA;AASA;AACA;AAWA;AAEA;AACA;AACA;AACA;AAQiB;AAEjB,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;AAoB1C,MAAMC,IAAI,CAAqE;EAKtEC,WAAW,CAACC,MAAc,EAAE;IACjC,IAAI,CAACA,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,MAAM,GAAGD,MAAM,CAACC,MAAM;IAC3B,IAAI,CAACC,OAAO,GAAG,EAAE;IACjB,IAAI,CAAC,IAAI,CAACD,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,EAAkC;IACtET,KAAK,CAAC,uBAAuB,EAAEM,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,EAAE;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,EAAE;EAC7B;EAEQD,iBAAiB,GAAG;IAC1BX,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC;IACD,IAAIC,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBJ,aAAa,CACd;IACH,CAAC,CAAC,OAAOK,KAAU,EAAE;MACnBlB,KAAK,CAAC,iDAAiD,EAAEkB,KAAK,CAAC;MAC/DJ,cAAM,CAACK,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MAChD,OAAO,EAAE;IACX;IAEA,OAAO,CAACJ,UAAU,CAAC;EACrB;EAEA,MAAcN,UAAU,GAAG;IAAA;IACzB,OAAO,IAAAW,wBAAe,EACpB,IAAI,CAAChB,MAAM,CAACiB,IAAI,EAChB;MACEjB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC,EACAQ,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,kBACD,IAAI,CAACrB,MAAM,0EAAX,aAAasB,cAAc,0DAA3B,sBAA6BC,YAAY,CAC1C;EACH;EAEQf,oBAAoB,GAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAACsB,IAAI,CAAC,IAAAC,yBAAiB,EAACf,cAAM,CAAC,CAAC;EAC9C;EAEOgB,cAAc,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAAC/B,OAAO,EAAGgB,MAAM,IAAK,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,CAAC;IAE1F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMrB,MAAM,IAAIa,YAAY,EAAE;MACjC,IAAI,IAAAS,YAAK,EAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;QAChE9B,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAE+B,QAAQ,CAAC;QAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACP/B,cAAM,CAACI,KAAK,CACV;cAAEa,QAAQ;cAAEc;YAAI,CAAC,EAChB;AACf,yEAAyE,CAC5D;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEA7C,KAAK,CAAC,wCAAwC,EAAE+B,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAe,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,EAAE;EAC1B;EAEO7B,YAAY,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAM5B,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAA8B;MAE1D,IAAI,IAAAjB,iBAAU,EAAChB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAO+B,IAAI,EAAE;MACf;MAEAtD,KAAK,CAAC,mBAAmB,EAAE+B,QAAQ,CAAC;MACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACP7C,KAAK,CAAC,8CAA8C,EAAE+B,QAAQ,EAAEc,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAAC9C,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI0B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAIjD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMoD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAIpD,SAAS,CAACsD,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEA9D,KAAK,CAAC,yDAAyD,EAAE+B,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,EAAE;MACR,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;EAEOU,QAAQ,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAM5D,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrCrD,KAAK,CAAC,aAAa,EAAEiE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAA8B;MAC1D,IAAI,OAAOjC,MAAM,CAAC6C,OAAO,KAAK,UAAU,EAAE;QACxCb,IAAI,EAAE;MACR,CAAC,MAAM;QACL;QACA,IAAI,OAAOhC,MAAM,CAAC6C,OAAO,KAAK,WAAW,IAAI,OAAO7C,MAAM,CAAC0C,QAAQ,KAAK,UAAU,EAAE;UAClF,MAAMxB,gBAAU,CAACC,gBAAgB,CAC/B,yDAAyD,CAC1D;QACH;QAEAnB,MAAM,CAAC6C,OAAO,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAEuB,EAAqB,EAAQ;UACjE,IAAIvB,GAAG,EAAE;YACP7C,KAAK,CAAC,+CAA+C,EAAEiE,IAAI,EAAEpB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;YAC1E,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAIuB,EAAE,EAAE;YACNpE,KAAK,CAAC,4BAA4B,EAAEiE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC3C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACAoB,IAAI,EAAE;QACR,CAAC,CACF;MACH;IACF,CAAC,GAAG;EACN;;EAEA;AACF;AACA;EACS9B,YAAY,CACjB;IAAE6C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAoC,EAC9B;IACN,MAAMjE,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMmB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC;IAClF,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB,CAAC,CAAC,EACFL,cAAc,EACd,IAAAM,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CAC3B;IAChC/E,KAAK,CAAC,qBAAqB,EAAEqE,WAAW,CAAC;IAEzC,CAAC,SAASf,IAAI,GAAS;MACrB,MAAMhC,MAAiC,GAAGhB,OAAO,CAACiD,KAAK,EAA+B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO8B,IAAI,EAAE;MACf;MAEAhC,MAAM,CAACE,YAAY,CAAEyC,IAAI,EAAEU,GAAG,EAAE,UAAU9B,GAA0B,EAAEuB,EAAY,EAAQ;QACxF,IAAIvB,GAAG,EAAE;UACP7C,KAAK,CAAC,oCAAoC,EAAEqE,WAAW,EAAExB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UACtE,OAAOc,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNpE,KAAK,CAAC,uBAAuB,EAAEqE,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAd,IAAI,EAAE,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;;EAEO0B,eAAe,CACpB;IAAEX,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CAC1D;IACD/E,KAAK,CAAC,wBAAwB,EAAEqE,WAAW,CAAC;IAE5C,KAAK,MAAM/C,MAAM,IAAI,IAAI,CAAChB,OAAO,EAAE;MACjC,IAAI8B,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAAC0D,eAAe,CAAC,KAAK,KAAK,EAAE;QACnEhF,KAAK,CAAC,kEAAkE,EAAEqE,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACL;QACA/C,MAAM,CAAC0D,eAAe,CAAEf,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAAG,EAAEuB,EAAW,KAAW;UAC7D,IAAIvB,GAAG,EAAE;YACP7C,KAAK,CACH,qEAAqE,EACrEqE,WAAW,CACZ;YACD,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAACwB,EAAE,CAAC,KAAK,IAAI,EAAE;YACxBpE,KAAK,CAAC,yDAAyD,EAAEqE,WAAW,CAAC;YAC7E;YACA;YACA,OAAO,IAAI,CAAC5C,aAAa,CAAC,GAAGwD,SAAS,CAAC;UACzC;UAEA,IAAIb,EAAE,EAAE;YACNpE,KAAK,CAAC,0BAA0B,EAAEqE,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACS3C,aAAa,CAClB;IAAE4C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMjE,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMsB,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CACnD;IACR/E,KAAK,CAAC,yCAAyC,EAAEqE,WAAW,EAAE/D,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAAS4C,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAAE;MAE9B,IAAI,QAAOjC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,MAAK,UAAU,EAAE;QAC/CzB,KAAK,CAAC,8DAA8D,EAAEqE,WAAW,CAAC;QAClF,OAAOf,IAAI,EAAE;MACf;MAEAhC,MAAM,CAACG,aAAa,CAACwC,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAA0B,EAAEuB,EAAY,KAAW;QAClF,IAAIhC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAAC8C,OAAO,CAACrC,GAAG,CAAC,EAAE;UAC5C7C,KAAK,CAAC,0BAA0B,EAAEqE,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNpE,KAAK,CAAC,wBAAwB,EAAEqE,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEApE,KAAK,CAAC,sCAAsC,EAAEqE,WAAW,CAAC;QAC1Df,IAAI,EAAE,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;;EAEO6B,gBAAgB,GAAmB;IACxCnF,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMM,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM+B,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAEtB,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAMzC,MAAM,IAAIhB,OAAO,EAAE;MAC5B,IAAIgB,MAAM,CAAC6D,gBAAgB,EAAE;QAC3B,OAAO7D,MAAM,CAAC6D,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;;IAEA;IACA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,EAAE;MAEX,MAAMnC,IAAI,GAAG,UAAUT,GAAoB,EAAO;QAChDyC,GAAG,CAACI,MAAM,EAAE;QACZ;QACA;QACA;QACA;QACA,IAAI7C,GAAG,EAAE;UACPyC,GAAG,CAACK,WAAW,CAACzE,KAAK,GAAG2B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAO+B,KAAK,EAAE;MAChB,CAAC;MAED,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C3F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOsD,IAAI,EAAE;MACf;;MAEA;MACA,MAAMuC,UAAU,GAAG,IAAAR,iCAAyB,GAAE;MAC9CC,GAAG,CAACK,WAAW,GAAGE,UAAU;MAC5BN,GAAG,CAACO,MAAM,CAACH,WAAW,GAAGE,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B/F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOsD,IAAI,EAAE;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC/F,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAOsD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAE9F,MAAM;QAAE+F;MAAS,CAAC,GAAG,IAAI,CAAChG,MAAM;MAExC,IAAI,IAAAiG,mBAAW,EAACD,QAAQ,CAAC,EAAE;QACzBpG,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAACsG,oBAAoB,CAAChB,GAAG,EAAEc,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,EAAEzC,IAAI,CAAC;MACvE,CAAC,MAAM;QACLtD,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAACuG,uBAAuB,CAACjB,GAAG,EAAEc,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,EAAEzC,IAAI,CAAC;MAC1E;IACF,CAAC;EACH;EAEQiD,uBAAuB,CAC7BjB,GAAmB,EACnBc,QAAkB,EAClB/F,MAAc,EACd0F,aAAqB,EACrBzC,IAAc,EACR;IACNtD,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAEwG,MAAM;MAAExD;IAAM,CAAC,GAAG,IAAAyD,4BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,EAAE,KAAKC,iBAAW,CAACD,WAAW,EAAE,EAAE;MACtD1G,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAM4G,WAAW,GAAG,IAAAC,8BAAsB,EAAC7D,KAAK,CAAC,CAAC8D,QAAQ,EAAE;MAC5D,MAAM;QAAE7C,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAA+E,wBAAiB,EAACH,WAAW,CAAe;MACvE5G,KAAK,CAAC,mBAAmB,EAAEiE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACR7C,KAAK,CAAC,0BAA0B,CAAC;UACjCsF,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBX,IAAI,EAAE;QACR,CAAC,MAAM;UACLtD,KAAK,CAAC,2BAA2B,CAAC;UAClCsF,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;UAC7C/B,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL7C,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAM4G,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACAtB,GAAG,CAACK,WAAW,GAAGiB,WAAW;QAC7B5G,KAAK,CAAC,0BAA0B,CAAC;QACjCsD,IAAI,EAAE;MACR,CAAC,MAAM;QACL;QACAtD,KAAK,CAAC,mBAAmB,CAAC;QAC1BsD,IAAI,CAACd,gBAAU,CAACyE,YAAY,CAACpD,eAAS,CAACqD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,oBAAoB,CAC1BhB,GAAmB,EACnBc,QAAkB,EAClB/F,MAAc,EACd0F,aAAqB,EACrBzC,IAAc,EACR;IACNtD,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,0BAA0B,EAAE,OAAOK,MAAM,KAAK,QAAQ,CAAC;IAC7DL,KAAK,CAAC,iCAAiC,EAAE,OAAO+F,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,CAAC;IAClF/F,KAAK,CAAC,+BAA+B,EAAE4G,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAEnC,IAAI,CAAC;IACzD,IAAImC,WAAW,EAAE;MACf,MAAM;QAAE3C,IAAI;QAAEjC;MAAS,CAAC,GAAG4E,WAAW;MACtC5G,KAAK,CAAC,mBAAmB,EAAEiE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACRyC,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBjE,KAAK,CAAC,0BAA0B,CAAC;UACjCsD,IAAI,EAAE;QACR,CAAC,MAAM;UACLgC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;UAC7CrF,KAAK,CAAC,2BAA2B,CAAC;UAClCsD,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACA7C,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAOsD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQP,kBAAkB,CAACD,WAAwB,EAAW;IAC5D,OAAOvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,CAAC,KAAK,KAAK,IAAIvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAElB,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACS2C,kBAAkB,GAAmB;IAC1C;IACA,OAAO,CAAC9B,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,EAAE;MAChB;MAEAF,GAAG,CAACG,KAAK,EAAE;MACX,MAAMnC,IAAI,GAAIT,GAA0B,IAAW;QACjDyC,GAAG,CAACI,MAAM,EAAE;QACZ,IAAI7C,GAAG,EAAE;UACP;UACA0C,GAAG,CAAC8B,MAAM,CAACxE,GAAG,CAACyE,UAAU,CAAC,CAACC,IAAI,CAAC1E,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAO+B,KAAK,EAAE;MAChB,CAAC;MAED,MAAM;QAAEO;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B,OAAOzC,IAAI,EAAE;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAOzC,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMnD,KAAK,GAAG,CAAC+C,aAAa,IAAI,EAAE,EAAEyB,OAAO,CAAE,GAAEC,kBAAa,GAAE,EAAE,EAAE,CAAC;MACnE,IAAI,CAACzE,KAAK,EAAE;QACV,OAAOM,IAAI,EAAE;MACf;MAEA,IAAIsD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAgB,EAAC1E,KAAK,EAAE,IAAI,CAAC5C,MAAM,CAACC,MAAM,CAAC;MAC3D,CAAC,CAAC,OAAOwC,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAAC+C,kBAAkB,CAACgB,WAAW,CAAC,EAAE;QACxC,MAAM;UAAEnC,IAAI;UAAEjB;QAAO,CAAC,GAAGoD,WAAyB;QAClDtB,GAAG,CAACK,WAAW,GAAG,IAAA5B,wBAAgB,EAACU,IAAI,EAAYjB,MAAM,CAAC;MAC5D,CAAC,MAAM;QACL8B,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;MAC/C;MAEA/B,IAAI,EAAE;IACR,CAAC;EACH;EAEA,MAAaqE,UAAU,CAAC1D,IAAgB,EAAE2D,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAEpD,IAAI;MAAEjB;IAAO,CAAC,GAAGS,IAAI;IAC1CjE,KAAK,CAAC,gBAAgB,EAAEyE,IAAI,CAAC;IAC7B,MAAMqD,mBAAmB,GAAG1F,eAAC,CAACQ,KAAK,CAACiF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAG3F,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjCqE,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAG1E,MAAM,CAAC2E,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChCrD,IAAI;MACJjB,MAAM,EAAEuE;IACV,CAAC;IAED,MAAM/E,KAAa,GAAG,MAAM,IAAAqF,qBAAW,EAACD,OAAO,EAAE,IAAI,CAAC/H,MAAM,EAAEuH,WAAW,CAAC;IAE1E,OAAO5E,KAAK;EACd;;EAEA;AACF;AACA;EACSsF,UAAU,CAACC,KAAa,EAAiB;IAC9C,OAAO,IAAAD,uBAAU,EAACC,KAAK,EAAE,IAAI,CAAClI,MAAM,CAAC;EACvC;AACF;AAAC"}
+{"version":3,"file":"auth.js","names":["debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","adduser","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, RequestHandler, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\n// remove\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      if (typeof plugin.adduser !== 'function') {\n        next();\n      } else {\n        // @ts-expect-error future major (7.x) should remove this section\n        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n          throw errorUtils.getInternalError(\n            'add_user method not longer supported, rename to adduser'\n          );\n        }\n\n        plugin.adduser(\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user  %o could not being added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as any;\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): RequestHandler {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n\n      const next = function (err?: VerdaccioError): any {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): RequestHandler {\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA;AAEA;AACA;AAEA;AACA;AASA;AACA;AACA;AAWA;AAEA;AAQiB;AAEjB,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;AAqB1C,MAAMC,IAAI,CAAqE;EAKtEC,WAAW,CAACC,MAAc,EAAE;IACjC,IAAI,CAACA,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,MAAM,GAAGD,MAAM,CAACC,MAAM;IAC3B,IAAI,CAACC,OAAO,GAAG,EAAE;IACjB,IAAI,CAAC,IAAI,CAACD,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAI,GAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,EAAkC;IACtET,KAAK,CAAC,uBAAuB,EAAEM,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,EAAE;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,EAAE;EAC7B;EAEQD,iBAAiB,GAAG;IAC1BX,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC;IACD,IAAIC,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBJ,aAAa,CACd;IACH,CAAC,CAAC,OAAOK,KAAU,EAAE;MACnBlB,KAAK,CAAC,iDAAiD,EAAEkB,KAAK,CAAC;MAC/DJ,cAAM,CAACK,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MAChD,OAAO,EAAE;IACX;IAEA,OAAO,CAACJ,UAAU,CAAC;EACrB;EAEA,MAAcN,UAAU,GAAG;IAAA;IACzB,OAAO,IAAAW,wBAAe,EACpB,IAAI,CAAChB,MAAM,CAACiB,IAAI,EAChB;MACEjB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC,EACAQ,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,kBACD,IAAI,CAACrB,MAAM,0EAAX,aAAasB,cAAc,0DAA3B,sBAA6BC,YAAY,CAC1C;EACH;EAEQf,oBAAoB,GAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAACsB,IAAI,CAAC,IAAAC,yBAAiB,EAACf,cAAM,CAAC,CAAC;EAC9C;EAEOgB,cAAc,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAAC/B,OAAO,EAAGgB,MAAM,IAAK,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,CAAC;IAE1F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMrB,MAAM,IAAIa,YAAY,EAAE;MACjC,IAAI,IAAAS,YAAK,EAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;QAChE9B,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAE+B,QAAQ,CAAC;QAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACP/B,cAAM,CAACI,KAAK,CACV;cAAEa,QAAQ;cAAEc;YAAI,CAAC,EAChB;AACf,yEAAyE,CAC5D;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEA7C,KAAK,CAAC,wCAAwC,EAAE+B,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAe,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,EAAE;EAC1B;EAEO7B,YAAY,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAM5B,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAA8B;MAE1D,IAAI,IAAAjB,iBAAU,EAAChB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAO+B,IAAI,EAAE;MACf;MAEAtD,KAAK,CAAC,mBAAmB,EAAE+B,QAAQ,CAAC;MACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACP7C,KAAK,CAAC,8CAA8C,EAAE+B,QAAQ,EAAEc,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAAC9C,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI0B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAIjD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMoD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAIpD,SAAS,CAACsD,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEA9D,KAAK,CAAC,yDAAyD,EAAE+B,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,EAAE;MACR,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;EAEOU,QAAQ,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAM5D,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrCrD,KAAK,CAAC,aAAa,EAAEiE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAA8B;MAC1D,IAAI,OAAOjC,MAAM,CAAC6C,OAAO,KAAK,UAAU,EAAE;QACxCb,IAAI,EAAE;MACR,CAAC,MAAM;QACL;QACA,IAAI,OAAOhC,MAAM,CAAC6C,OAAO,KAAK,WAAW,IAAI,OAAO7C,MAAM,CAAC0C,QAAQ,KAAK,UAAU,EAAE;UAClF,MAAMxB,gBAAU,CAACC,gBAAgB,CAC/B,yDAAyD,CAC1D;QACH;QAEAnB,MAAM,CAAC6C,OAAO,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAEuB,EAAqB,EAAQ;UACjE,IAAIvB,GAAG,EAAE;YACP7C,KAAK,CAAC,+CAA+C,EAAEiE,IAAI,EAAEpB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;YAC1E,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAIuB,EAAE,EAAE;YACNpE,KAAK,CAAC,4BAA4B,EAAEiE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC3C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACAoB,IAAI,EAAE;QACR,CAAC,CACF;MACH;IACF,CAAC,GAAG;EACN;;EAEA;AACF;AACA;EACS9B,YAAY,CACjB;IAAE6C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAoC,EAC9B;IACN,MAAMjE,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMmB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC;IAClF,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB,CAAC,CAAC,EACFL,cAAc,EACd,IAAAM,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CAC3B;IAChC/E,KAAK,CAAC,qBAAqB,EAAEqE,WAAW,CAAC;IAEzC,CAAC,SAASf,IAAI,GAAS;MACrB,MAAMhC,MAAiC,GAAGhB,OAAO,CAACiD,KAAK,EAA+B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO8B,IAAI,EAAE;MACf;MAEAhC,MAAM,CAACE,YAAY,CAAEyC,IAAI,EAAEU,GAAG,EAAE,UAAU9B,GAA0B,EAAEuB,EAAY,EAAQ;QACxF,IAAIvB,GAAG,EAAE;UACP7C,KAAK,CAAC,oCAAoC,EAAEqE,WAAW,EAAExB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UACtE,OAAOc,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNpE,KAAK,CAAC,uBAAuB,EAAEqE,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAd,IAAI,EAAE,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;;EAEO0B,eAAe,CACpB;IAAEX,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CAC1D;IACD/E,KAAK,CAAC,wBAAwB,EAAEqE,WAAW,CAAC;IAE5C,KAAK,MAAM/C,MAAM,IAAI,IAAI,CAAChB,OAAO,EAAE;MACjC,IAAI8B,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAAC0D,eAAe,CAAC,KAAK,KAAK,EAAE;QACnEhF,KAAK,CAAC,kEAAkE,EAAEqE,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACL;QACA/C,MAAM,CAAC0D,eAAe,CAAEf,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAAG,EAAEuB,EAAW,KAAW;UAC7D,IAAIvB,GAAG,EAAE;YACP7C,KAAK,CACH,qEAAqE,EACrEqE,WAAW,CACZ;YACD,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAACwB,EAAE,CAAC,KAAK,IAAI,EAAE;YACxBpE,KAAK,CAAC,yDAAyD,EAAEqE,WAAW,CAAC;YAC7E;YACA;YACA,OAAO,IAAI,CAAC5C,aAAa,CAAC,GAAGwD,SAAS,CAAC;UACzC;UAEA,IAAIb,EAAE,EAAE;YACNpE,KAAK,CAAC,0BAA0B,EAAEqE,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACS3C,aAAa,CAClB;IAAE4C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMjE,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMsB,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACjE,MAAM,CAAC2E,QAAQ,CAAC,CACnD;IACR/E,KAAK,CAAC,yCAAyC,EAAEqE,WAAW,EAAE/D,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAAS4C,IAAI,GAAS;MACrB,MAAMhC,MAAM,GAAGhB,OAAO,CAACiD,KAAK,EAAE;MAE9B,IAAI,QAAOjC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,MAAK,UAAU,EAAE;QAC/CzB,KAAK,CAAC,8DAA8D,EAAEqE,WAAW,CAAC;QAClF,OAAOf,IAAI,EAAE;MACf;MAEAhC,MAAM,CAACG,aAAa,CAACwC,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAA0B,EAAEuB,EAAY,KAAW;QAClF,IAAIhC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAAC8C,OAAO,CAACrC,GAAG,CAAC,EAAE;UAC5C7C,KAAK,CAAC,0BAA0B,EAAEqE,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNpE,KAAK,CAAC,wBAAwB,EAAEqE,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEApE,KAAK,CAAC,sCAAsC,EAAEqE,WAAW,CAAC;QAC1Df,IAAI,EAAE,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,GAAG;EACN;;EAEO6B,gBAAgB,GAAmB;IACxCnF,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMM,OAAO,GAAG,IAAI,CAACA,OAAO,CAAC+C,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM+B,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAEtB,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAMzC,MAAM,IAAIhB,OAAO,EAAE;MAC5B,IAAIgB,MAAM,CAAC6D,gBAAgB,EAAE;QAC3B,OAAO7D,MAAM,CAAC6D,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;;IAEA;IACA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,EAAE;MAEX,MAAMnC,IAAI,GAAG,UAAUT,GAAoB,EAAO;QAChDyC,GAAG,CAACI,MAAM,EAAE;QACZ;QACA;QACA;QACA;QACA,IAAI7C,GAAG,EAAE;UACPyC,GAAG,CAACK,WAAW,CAACzE,KAAK,GAAG2B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAO+B,KAAK,EAAE;MAChB,CAAC;MAED,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C3F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOsD,IAAI,EAAE;MACf;;MAEA;MACA,MAAMuC,UAAU,GAAG,IAAAR,iCAAyB,GAAE;MAC9CC,GAAG,CAACK,WAAW,GAAGE,UAAU;MAC5BN,GAAG,CAACO,MAAM,CAACH,WAAW,GAAGE,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B/F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOsD,IAAI,EAAE;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC/F,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAOsD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAE9F,MAAM;QAAE+F;MAAS,CAAC,GAAG,IAAI,CAAChG,MAAM;MAExC,IAAI,IAAAiG,mBAAW,EAACD,QAAQ,CAAC,EAAE;QACzBpG,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAACsG,oBAAoB,CAAChB,GAAG,EAAEc,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,EAAEzC,IAAI,CAAC;MACvE,CAAC,MAAM;QACLtD,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAACuG,uBAAuB,CAACjB,GAAG,EAAEc,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,EAAEzC,IAAI,CAAC;MAC1E;IACF,CAAC;EACH;EAEQiD,uBAAuB,CAC7BjB,GAAmB,EACnBc,QAAkB,EAClB/F,MAAc,EACd0F,aAAqB,EACrBzC,IAAc,EACR;IACNtD,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAEwG,MAAM;MAAExD;IAAM,CAAC,GAAG,IAAAyD,4BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,EAAE,KAAKC,iBAAW,CAACD,WAAW,EAAE,EAAE;MACtD1G,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAM4G,WAAW,GAAG,IAAAC,8BAAsB,EAAC7D,KAAK,CAAC,CAAC8D,QAAQ,EAAE;MAC5D,MAAM;QAAE7C,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAA+E,4BAAiB,EAACH,WAAW,CAAe;MACvE5G,KAAK,CAAC,mBAAmB,EAAEiE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACR7C,KAAK,CAAC,0BAA0B,CAAC;UACjCsF,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBX,IAAI,EAAE;QACR,CAAC,MAAM;UACLtD,KAAK,CAAC,2BAA2B,CAAC;UAClCsF,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;UAC7C/B,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL7C,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAM4G,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACAtB,GAAG,CAACK,WAAW,GAAGiB,WAAW;QAC7B5G,KAAK,CAAC,0BAA0B,CAAC;QACjCsD,IAAI,EAAE;MACR,CAAC,MAAM;QACL;QACAtD,KAAK,CAAC,mBAAmB,CAAC;QAC1BsD,IAAI,CAACd,gBAAU,CAACyE,YAAY,CAACpD,eAAS,CAACqD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,oBAAoB,CAC1BhB,GAAmB,EACnBc,QAAkB,EAClB/F,MAAc,EACd0F,aAAqB,EACrBzC,IAAc,EACR;IACNtD,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,0BAA0B,EAAE,OAAOK,MAAM,KAAK,QAAQ,CAAC;IAC7DL,KAAK,CAAC,iCAAiC,EAAE,OAAO+F,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAE/F,MAAM,EAAE0F,aAAa,CAAC;IAClF/F,KAAK,CAAC,+BAA+B,EAAE4G,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAEnC,IAAI,CAAC;IACzD,IAAImC,WAAW,EAAE;MACf,MAAM;QAAE3C,IAAI;QAAEjC;MAAS,CAAC,GAAG4E,WAAW;MACtC5G,KAAK,CAAC,mBAAmB,EAAEiE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACRyC,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBjE,KAAK,CAAC,0BAA0B,CAAC;UACjCsD,IAAI,EAAE;QACR,CAAC,MAAM;UACLgC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;UAC7CrF,KAAK,CAAC,2BAA2B,CAAC;UAClCsD,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACA7C,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAOsD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQP,kBAAkB,CAACD,WAAwB,EAAW;IAC5D,OAAOvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,CAAC,KAAK,KAAK,IAAIvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAElB,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACS2C,kBAAkB,GAAmB;IAC1C;IACA,OAAO,CAAC9B,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,EAAE;MAChB;MAEAF,GAAG,CAACG,KAAK,EAAE;MACX,MAAMnC,IAAI,GAAIT,GAA0B,IAAW;QACjDyC,GAAG,CAACI,MAAM,EAAE;QACZ,IAAI7C,GAAG,EAAE;UACP;UACA0C,GAAG,CAAC8B,MAAM,CAACxE,GAAG,CAACyE,UAAU,CAAC,CAACC,IAAI,CAAC1E,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAO+B,KAAK,EAAE;MAChB,CAAC;MAED,MAAM;QAAEO;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B,OAAOzC,IAAI,EAAE;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAOzC,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMnD,KAAK,GAAG,CAAC+C,aAAa,IAAI,EAAE,EAAEyB,OAAO,CAAE,GAAEC,kBAAa,GAAE,EAAE,EAAE,CAAC;MACnE,IAAI,CAACzE,KAAK,EAAE;QACV,OAAOM,IAAI,EAAE;MACf;MAEA,IAAIsD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAgB,EAAC1E,KAAK,EAAE,IAAI,CAAC5C,MAAM,CAACC,MAAM,CAAC;MAC3D,CAAC,CAAC,OAAOwC,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAAC+C,kBAAkB,CAACgB,WAAW,CAAC,EAAE;QACxC,MAAM;UAAEnC,IAAI;UAAEjB;QAAO,CAAC,GAAGoD,WAAyB;QAClDtB,GAAG,CAACK,WAAW,GAAG,IAAA5B,wBAAgB,EAACU,IAAI,EAAYjB,MAAM,CAAC;MAC5D,CAAC,MAAM;QACL8B,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,GAAE;MAC/C;MAEA/B,IAAI,EAAE;IACR,CAAC;EACH;EAEA,MAAaqE,UAAU,CAAC1D,IAAgB,EAAE2D,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAEpD,IAAI;MAAEjB;IAAO,CAAC,GAAGS,IAAI;IAC1CjE,KAAK,CAAC,gBAAgB,EAAEyE,IAAI,CAAC;IAC7B,MAAMqD,mBAAmB,GAAG1F,eAAC,CAACQ,KAAK,CAACiF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAG3F,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjCqE,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAG1E,MAAM,CAAC2E,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChCrD,IAAI;MACJjB,MAAM,EAAEuE;IACV,CAAC;IAED,MAAM/E,KAAa,GAAG,MAAM,IAAAqF,sBAAW,EAACD,OAAO,EAAE,IAAI,CAAC/H,MAAM,EAAEuH,WAAW,CAAC;IAE1E,OAAO5E,KAAK;EACd;;EAEA;AACF;AACA;EACSsF,UAAU,CAACC,KAAa,EAAiB;IAC9C,OAAO,IAAAD,qBAAU,EAACC,KAAK,EAAE,IAAI,CAAClI,MAAM,CAAC;EACvC;AACF;AAAC"}

package/build/index.d.ts

@@ -1,5 +1,2 @@
-export { Auth, TokenEncryption } from './auth';
+export { Auth } from './auth';
 export * from './utils';
-export * from './legacy-token';
-export * from './jwt-token';
-export * from './token';

package/build/index.js

@@ -4,8 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 var _exportNames = {
-  Auth: true,
-  TokenEncryption: true
+  Auth: true
 };
 Object.defineProperty(exports, "Auth", {
   enumerable: true,
@@ -13,12 +12,6 @@ Object.defineProperty(exports, "Auth", {
     return _auth.Auth;
   }
 });
-Object.defineProperty(exports, "TokenEncryption", {
-  enumerable: true,
-  get: function () {
-    return _auth.TokenEncryption;
-  }
-});
 var _auth = require("./auth");
 var _utils = require("./utils");
 Object.keys(_utils).forEach(function (key) {
@@ -32,40 +25,4 @@ Object.keys(_utils).forEach(function (key) {
     }
   });
 });
-var _legacyToken = require("./legacy-token");
-Object.keys(_legacyToken).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _legacyToken[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _legacyToken[key];
-    }
-  });
-});
-var _jwtToken = require("./jwt-token");
-Object.keys(_jwtToken).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _jwtToken[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _jwtToken[key];
-    }
-  });
-});
-var _token = require("./token");
-Object.keys(_token).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _token[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _token[key];
-    }
-  });
-});
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { Auth, TokenEncryption } from './auth';\nexport * from './utils';\nexport * from './legacy-token';\nexport * from './jwt-token';\nexport * from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth';\nexport * from './utils';\n"],"mappings":";;;;;;;;;;;;;;AAAA;AACA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}

package/build/utils.js

@@ -20,9 +20,7 @@ var _debug = _interopRequireDefault(require("debug"));
 var _lodash = _interopRequireDefault(require("lodash"));
 var _config = require("@verdaccio/config");
 var _core = require("@verdaccio/core");
-var _jwtToken = require("./jwt-token");
-var _legacyToken = require("./legacy-token");
-var _token = require("./token");
+var _signature = require("@verdaccio/signature");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:auth:utils');
 /**
@@ -52,7 +50,7 @@ function parseAESCredentials(authorizationHeader, secret) {
     return credentials;
   } else if (scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
     debug('legacy header bearer');
-    const credentials = (0, _legacyToken.aesDecrypt)(token, secret);
+    const credentials = (0, _signature.aesDecrypt)(token, secret);
     return credentials;
   }
 }
@@ -66,7 +64,7 @@ function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
       debug('parse legacy credentials failed');
       return;
     }
-    const parsedCredentials = (0, _token.parseBasicPayload)(credentials);
+    const parsedCredentials = (0, _signature.parseBasicPayload)(credentials);
     if (!parsedCredentials) {
       debug('parse legacy basic payload credentials failed');
       return;
@@ -115,7 +113,7 @@ const expireReasons = ['JsonWebTokenError', 'TokenExpiredError'];
 exports.expireReasons = expireReasons;
 function verifyJWTPayload(token, secret) {
   try {
-    const payload = (0, _jwtToken.verifyPayload)(token, secret);
+    const payload = (0, _signature.verifyPayload)(token, secret);
     return payload;
   } catch (error) {
     // #168 this check should be removed as soon AES encrypt is removed.

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\nimport { verifyPayload } from './jwt-token';\nimport { aesDecrypt } from './legacy-token';\nimport { parseBasicPayload } from './token';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AACA;AAEA;AACA;AAYA;AACA;AACA;AAA4C;AAE5C,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAqBhD;AACA;AACA;AACA;AACO,SAASC,oBAAoB,CAACC,mBAA2B,EAAmB;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,MAAM,CAACC,MAAM,EAAEC,KAAK,CAAC,GAAGH,KAAK;EAE7B,OAAO;IAAEE,MAAM;IAAEC;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmB,CAACL,mBAA2B,EAAEM,MAAc,EAAE;EAC/ET,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEM,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIG,MAAM,CAACI,WAAW,EAAE,KAAKC,iBAAW,CAACD,WAAW,EAAE,EAAE;IACtDV,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAK,CAAC,CAACO,QAAQ,EAAE;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIN,MAAM,CAACI,WAAW,EAAE,KAAKK,kBAAY,CAACL,WAAW,EAAE,EAAE;IAC9DV,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMY,WAAW,GAAG,IAAAI,uBAAU,EAACT,KAAK,EAAEE,MAAM,CAAC;IAE7C,OAAOG,WAAW;EACpB;AACF;AAEO,SAASK,wBAAwB,CACtCC,QAAkB,EAClBC,SAAiB,EACjBhB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAIoB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAmB,EAAEgB,SAAS,CAAC;IACvE,IAAI,CAACP,WAAW,EAAE;MAChBZ,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMqB,iBAAiB,GAAG,IAAAC,wBAAiB,EAACV,WAAW,CAAC;IACxD,IAAI,CAACS,iBAAiB,EAAE;MACtBrB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOqB,iBAAiB;EAC1B;EACA,MAAM;IAAEf,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIuB,eAAC,CAACC,QAAQ,CAACjB,KAAK,CAAC,IAAID,MAAM,CAACI,WAAW,EAAE,KAAKK,kBAAY,CAACL,WAAW,EAAE,EAAE;IAC5E,OAAOe,gBAAgB,CAAClB,KAAK,EAAEY,SAAS,CAAC;EAC3C;AACF;AAEO,SAASC,WAAW,CAACF,QAAkB,EAAW;EACvD,MAAM;IAAEQ,MAAM;IAAEC;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAEpC,OAAOL,eAAC,CAACM,KAAK,CAACH,MAAM,CAAC,KAAK,KAAK,IAAIH,eAAC,CAACM,KAAK,CAACF,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAEO,eAAeI,WAAW,CAC/BC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB,EACK;EACxBlC,KAAK,CAAC,eAAe,CAAC;EACtB,MAAM;IAAEkB;EAAS,CAAC,GAAGc,MAAM;EAE3B,IAAIZ,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,yBAAyB,CAAC;IAChC;IACA,OAAO,MAAM,IAAImC,OAAO,CAAEC,OAAO,IAAW;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;EACJ;EACA,MAAM;IAAEP;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAE5B,IAAID,GAAG,aAAHA,GAAG,eAAHA,GAAG,CAAEa,IAAI,EAAE;IACb,OAAO,MAAMT,IAAI,CAACU,UAAU,CAACR,UAAU,EAAEN,GAAG,CAACa,IAAI,CAAC;EACpD;EACA,OAAO,MAAM,IAAIL,OAAO,CAAEC,OAAO,IAAW;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;AACJ;AAEO,MAAMQ,aAAuB,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAAC;AAE3E,SAASjB,gBAAgB,CAAClB,KAAa,EAAEE,MAAc,EAAc;EAC1E,IAAI;IACF,MAAMkC,OAAmB,GAAG,IAAAC,uBAAa,EAACrC,KAAK,EAAEE,MAAM,CAAC;IAExD,OAAOkC,OAAO;EAChB,CAAC,CAAC,OAAOE,KAAU,EAAE;IACnB;IACA,IAAIH,aAAa,CAACI,QAAQ,CAACD,KAAK,CAACN,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAQ,iCAAyB,GAAE;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiB,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAACjD,KAAK,CAAC,GAAG,CAAC,CAACkD,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiB,CAACC,MAAc,EAA4B;EAC1E,OAAO;IACLC,YAAY,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjFA,EAAE,CAACb,gBAAU,CAACc,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAO,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChF,OAAOA,EAAE,CAACb,gBAAU,CAACkB,WAAW,CAACH,eAAS,CAACC,qBAAqB,CAAC,CAAC;IACpE,CAAC;IAED;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEX,MAAM,CAAC;IAC5C;IACAY,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEX,MAAM,CAAC;IAC9Ca,eAAe,EAAEC,sBAAsB,CAACd,MAAM;EAChD,CAAC;AACH;AAIO,SAASW,YAAY,CAACI,MAAsB,EAAEf,MAAc,EAAe;EAChF,OAAO,SAASgB,mBAAmB,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNnB,MAAM,CAACoB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAACnC;IAAK,CAAC,EAAG,sCAAqC,CAAC;IAC3E,MAAM;MAAEA,IAAI;MAAEwC;IAAO,CAAC,GAAGL,IAAI;IAC7B,MAAMM,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3C,MAAMS,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAEC,KAAK,IAAK5C,IAAI,KAAK4C,KAAK,IAAIJ,MAAM,CAACjC,QAAQ,CAACqC,KAAK,CAAC,CAAC;IAC3F1B,MAAM,CAACoB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACpC,IAAI;MAAE0C,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAACnC,IAAI;MAAEyC;IAAY,CAAC,EACnE,+FAA8F,CAChG;IAED,IAAIC,aAAa,EAAE;MACjBxB,MAAM,CAACoB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAACnC;MAAK,CAAC,EAAG,iDAAgD,CAAC;MACtF,OAAOqC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAIrC,IAAI,EAAE;MACRqC,QAAQ,CACN5B,gBAAU,CAACc,YAAY,CAAE,QAAOvB,IAAK,sBAAqBiC,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAAC,CAAC,CACxF;IACH,CAAC,MAAM;MACLqC,QAAQ,CACN5B,gBAAU,CAACqC,eAAe,CAAE,6BAA4Bb,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAAC,CAAC,CACtF;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAASgC,sBAAsB,CAACd,MAAc,EAAO;EAC1D,OAAO,UAAUiB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,MAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,MAAMc,kBAA2B,GAAG/D,eAAC,CAACM,KAAK,CAAC8C,GAAG,CAACH,MAAM,CAAC,CAAC;IACxD,MAAMe,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIX,GAAG,CAACH,MAAM,CAAC,CAAcjB,MAAM,GAAG,CAAC;IAC5FE,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAI;MAAEA,IAAI,EAAEoC,GAAG,CAACpC,IAAI;MAAEgD;IAAU,CAAC,EAC7C,qEAAoE,CACtE;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOX,QAAQ,CAAC,IAAI,EAAEY,SAAS,CAAC;IAClC;IAEA/B,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAI;MAAEA,IAAI,EAAEoC,GAAG,CAACpC,IAAI;MAAEiC,MAAM;MAAEe;IAAU,CAAC,EACrD,6EAA4E,CAC9E;IACD,OAAOnB,YAAY,CAACI,MAAM,EAAEf,MAAM,CAAC,CAACiB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAAStC,SAAS,CAACC,IAAY,EAAEkD,QAAgB,EAAU;EAChE,OAAOC,MAAM,CAAE,GAAEnD,IAAK,IAAGkD,QAAS,EAAC,CAAC;AACtC;AAEO,SAAS5E,sBAAsB,CAAC8B,OAAe,EAAU;EAC9D,OAAOgD,MAAM,CAACC,IAAI,CAACjD,OAAO,EAAE,QAAQ,CAAC;AACvC"}
+{"version":3,"file":"utils.js","names":["debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;AACA;AAEA;AACA;AASA;AAAoF;AAKpF,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAqBhD;AACA;AACA;AACA;AACO,SAASC,oBAAoB,CAACC,mBAA2B,EAAmB;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,MAAM,CAACC,MAAM,EAAEC,KAAK,CAAC,GAAGH,KAAK;EAE7B,OAAO;IAAEE,MAAM;IAAEC;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmB,CAACL,mBAA2B,EAAEM,MAAc,EAAE;EAC/ET,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEM,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIG,MAAM,CAACI,WAAW,EAAE,KAAKC,iBAAW,CAACD,WAAW,EAAE,EAAE;IACtDV,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAK,CAAC,CAACO,QAAQ,EAAE;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIN,MAAM,CAACI,WAAW,EAAE,KAAKK,kBAAY,CAACL,WAAW,EAAE,EAAE;IAC9DV,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMY,WAAW,GAAG,IAAAI,qBAAU,EAACT,KAAK,EAAEE,MAAM,CAAC;IAE7C,OAAOG,WAAW;EACpB;AACF;AAEO,SAASK,wBAAwB,CACtCC,QAAkB,EAClBC,SAAiB,EACjBhB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAIoB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAmB,EAAEgB,SAAS,CAAC;IACvE,IAAI,CAACP,WAAW,EAAE;MAChBZ,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMqB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACV,WAAW,CAAC;IACxD,IAAI,CAACS,iBAAiB,EAAE;MACtBrB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOqB,iBAAiB;EAC1B;EACA,MAAM;IAAEf,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIuB,eAAC,CAACC,QAAQ,CAACjB,KAAK,CAAC,IAAID,MAAM,CAACI,WAAW,EAAE,KAAKK,kBAAY,CAACL,WAAW,EAAE,EAAE;IAC5E,OAAOe,gBAAgB,CAAClB,KAAK,EAAEY,SAAS,CAAC;EAC3C;AACF;AAEO,SAASC,WAAW,CAACF,QAAkB,EAAW;EACvD,MAAM;IAAEQ,MAAM;IAAEC;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAEpC,OAAOL,eAAC,CAACM,KAAK,CAACH,MAAM,CAAC,KAAK,KAAK,IAAIH,eAAC,CAACM,KAAK,CAACF,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAEO,eAAeI,WAAW,CAC/BC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB,EACK;EACxBlC,KAAK,CAAC,eAAe,CAAC;EACtB,MAAM;IAAEkB;EAAS,CAAC,GAAGc,MAAM;EAE3B,IAAIZ,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,yBAAyB,CAAC;IAChC;IACA,OAAO,MAAM,IAAImC,OAAO,CAAEC,OAAO,IAAW;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;EACJ;EACA,MAAM;IAAEP;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAE5B,IAAID,GAAG,aAAHA,GAAG,eAAHA,GAAG,CAAEa,IAAI,EAAE;IACb,OAAO,MAAMT,IAAI,CAACU,UAAU,CAACR,UAAU,EAAEN,GAAG,CAACa,IAAI,CAAC;EACpD;EACA,OAAO,MAAM,IAAIL,OAAO,CAAEC,OAAO,IAAW;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;AACJ;AAEO,MAAMQ,aAAuB,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAAC;AAE3E,SAASjB,gBAAgB,CAAClB,KAAa,EAAEE,MAAc,EAAc;EAC1E,IAAI;IACF,MAAMkC,OAAmB,GAAG,IAAAC,wBAAa,EAACrC,KAAK,EAAEE,MAAM,CAAC;IAExD,OAAOkC,OAAO;EAChB,CAAC,CAAC,OAAOE,KAAU,EAAE;IACnB;IACA,IAAIH,aAAa,CAACI,QAAQ,CAACD,KAAK,CAACN,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAQ,iCAAyB,GAAE;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiB,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAACjD,KAAK,CAAC,GAAG,CAAC,CAACkD,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiB,CAACC,MAAc,EAA4B;EAC1E,OAAO;IACLC,YAAY,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjFA,EAAE,CAACb,gBAAU,CAACc,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAO,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChF,OAAOA,EAAE,CAACb,gBAAU,CAACkB,WAAW,CAACH,eAAS,CAACC,qBAAqB,CAAC,CAAC;IACpE,CAAC;IAED;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEX,MAAM,CAAC;IAC5C;IACAY,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEX,MAAM,CAAC;IAC9Ca,eAAe,EAAEC,sBAAsB,CAACd,MAAM;EAChD,CAAC;AACH;AAIO,SAASW,YAAY,CAACI,MAAsB,EAAEf,MAAc,EAAe;EAChF,OAAO,SAASgB,mBAAmB,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNnB,MAAM,CAACoB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAACnC;IAAK,CAAC,EAAG,sCAAqC,CAAC;IAC3E,MAAM;MAAEA,IAAI;MAAEwC;IAAO,CAAC,GAAGL,IAAI;IAC7B,MAAMM,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3C,MAAMS,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAEC,KAAK,IAAK5C,IAAI,KAAK4C,KAAK,IAAIJ,MAAM,CAACjC,QAAQ,CAACqC,KAAK,CAAC,CAAC;IAC3F1B,MAAM,CAACoB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACpC,IAAI;MAAE0C,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAACnC,IAAI;MAAEyC;IAAY,CAAC,EACnE,+FAA8F,CAChG;IAED,IAAIC,aAAa,EAAE;MACjBxB,MAAM,CAACoB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAACnC;MAAK,CAAC,EAAG,iDAAgD,CAAC;MACtF,OAAOqC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAIrC,IAAI,EAAE;MACRqC,QAAQ,CACN5B,gBAAU,CAACc,YAAY,CAAE,QAAOvB,IAAK,sBAAqBiC,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAAC,CAAC,CACxF;IACH,CAAC,MAAM;MACLqC,QAAQ,CACN5B,gBAAU,CAACqC,eAAe,CAAE,6BAA4Bb,MAAO,YAAWG,GAAG,CAACpC,IAAK,EAAC,CAAC,CACtF;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAASgC,sBAAsB,CAACd,MAAc,EAAO;EAC1D,OAAO,UAAUiB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,MAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,MAAMc,kBAA2B,GAAG/D,eAAC,CAACM,KAAK,CAAC8C,GAAG,CAACH,MAAM,CAAC,CAAC;IACxD,MAAMe,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIX,GAAG,CAACH,MAAM,CAAC,CAAcjB,MAAM,GAAG,CAAC;IAC5FE,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAI;MAAEA,IAAI,EAAEoC,GAAG,CAACpC,IAAI;MAAEgD;IAAU,CAAC,EAC7C,qEAAoE,CACtE;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOX,QAAQ,CAAC,IAAI,EAAEY,SAAS,CAAC;IAClC;IAEA/B,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAI;MAAEA,IAAI,EAAEoC,GAAG,CAACpC,IAAI;MAAEiC,MAAM;MAAEe;IAAU,CAAC,EACrD,6EAA4E,CAC9E;IACD,OAAOnB,YAAY,CAACI,MAAM,EAAEf,MAAM,CAAC,CAACiB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAAStC,SAAS,CAACC,IAAY,EAAEkD,QAAgB,EAAU;EAChE,OAAOC,MAAM,CAAE,GAAEnD,IAAK,IAAGkD,QAAS,EAAC,CAAC;AACtC;AAEO,SAAS5E,sBAAsB,CAAC8B,OAAe,EAAU;EAC9D,OAAOgD,MAAM,CAACC,IAAI,CAACjD,OAAO,EAAE,QAAQ,CAAC;AACvC"}

package/jest.config.js

@@ -4,7 +4,7 @@ module.exports = Object.assign({}, config, {
   coverageThreshold: {
     global: {
       // FIXME: increase to 90
-      lines: 42,
+      lines: 30,
     },
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "6.0.0-6-next.41",
+  "version": "6.0.0-6-next.42",
   "description": "logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -30,19 +30,19 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "6.0.0-6-next.62",
-    "@verdaccio/config": "6.0.0-6-next.62",
-    "@verdaccio/loaders": "6.0.0-6-next.31",
-    "@verdaccio/logger": "6.0.0-6-next.30",
-    "@verdaccio/utils": "6.0.0-6-next.30",
+    "@verdaccio/core": "6.0.0-6-next.63",
+    "@verdaccio/config": "6.0.0-6-next.63",
+    "@verdaccio/loaders": "6.0.0-6-next.32",
+    "@verdaccio/logger": "6.0.0-6-next.31",
+    "@verdaccio/signature": "6.0.0-6-next.2",
+    "@verdaccio/utils": "6.0.0-6-next.31",
     "debug": "4.3.4",
     "express": "4.18.2",
-    "jsonwebtoken": "9.0.0",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "11.0.0-6-next.32"
+    "verdaccio-htpasswd": "11.0.0-6-next.33"
   },
   "devDependencies": {
-    "@verdaccio/types": "11.0.0-6-next.21"
+    "@verdaccio/types": "11.0.0-6-next.22"
   },
   "funding": {
     "type": "opencollective",

package/src/auth.ts

@@ -15,6 +15,7 @@ import {
 } from '@verdaccio/core';
 import { asyncLoadPlugin } from '@verdaccio/loaders';
 import { logger } from '@verdaccio/logger';
+import { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';
 import {
   AllowAccess,
   Callback,
@@ -27,9 +28,6 @@ import {
 } from '@verdaccio/types';
 import { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';
 
-import { signPayload } from './jwt-token';
-import { aesEncrypt } from './legacy-token';
-import { parseBasicPayload } from './token';
 import {
   convertPayloadToBase64,
   getDefaultPlugins,
@@ -47,6 +45,7 @@ export interface TokenEncryption {
   aesEncrypt(buf: string): string | void;
 }
 
+// remove
 export interface AESPayload {
   user: string;
   password: string;

package/src/index.ts

@@ -1,5 +1,2 @@
-export { Auth, TokenEncryption } from './auth';
+export { Auth } from './auth';
 export * from './utils';
-export * from './legacy-token';
-export * from './jwt-token';
-export * from './token';

package/src/utils.ts

@@ -11,12 +11,10 @@ import {
   errorUtils,
   pluginUtils,
 } from '@verdaccio/core';
+import { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';
 import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
 
 import { AESPayload, TokenEncryption } from './auth';
-import { verifyPayload } from './jwt-token';
-import { aesDecrypt } from './legacy-token';
-import { parseBasicPayload } from './token';
 
 const debug = buildDebug('verdaccio:auth:utils');
 

package/test/auth-utils.spec.ts

@@ -17,24 +17,22 @@ import {
   errorUtils,
 } from '@verdaccio/core';
 import { setup } from '@verdaccio/logger';
+import { aesDecrypt, signPayload, verifyPayload } from '@verdaccio/signature';
 import { Config, RemoteUser, Security } from '@verdaccio/types';
 import { buildToken, buildUserBuffer, getAuthenticatedMessage } from '@verdaccio/utils';
-import type { AllowActionCallbackResponse } from '@verdaccio/utils';
 
 import {
   ActionsAllowed,
+  AllowActionCallbackResponse,
   Auth,
-  aesDecrypt,
   allow_action,
   getApiToken,
   getDefaultPlugins,
   getMiddlewareCredentials,
-  signPayload,
   verifyJWTPayload,
-  verifyPayload,
 } from '../src';
 
-setup([]);
+setup({});
 
 const parseConfigurationFile = (conf) => {
   const { name, ext } = path.parse(conf);
@@ -452,6 +450,7 @@ describe('Auth utilities', () => {
         const config: Config = getConfig('security-legacy', secret);
         const auth: Auth = new Auth(config);
         await auth.init();
+        // @ts-expect-error
         const token = auth.aesEncrypt(null);
         const security: Security = config.security;
         const credentials = getMiddlewareCredentials(

package/tsconfig.json

@@ -19,6 +19,9 @@
     {
       "path": "../loaders"
     },
+    {
+      "path": "../signature"
+    },
     {
       "path": "../logger/logger"
     },

package/build/jwt-token.d.ts

@@ -1,10 +0,0 @@
-import { JWTSignOptions, RemoteUser } from '@verdaccio/types';
-/**
- * Sign the payload and return JWT
- * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback
- * @param payload
- * @param secretOrPrivateKey
- * @param options
- */
-export declare function signPayload(payload: RemoteUser, secretOrPrivateKey: string, options?: JWTSignOptions): Promise<string>;
-export declare function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser;

package/build/jwt-token.js

@@ -1,40 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.signPayload = signPayload;
-exports.verifyPayload = verifyPayload;
-var _debug = _interopRequireDefault(require("debug"));
-var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
-/**
- * Sign the payload and return JWT
- * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback
- * @param payload
- * @param secretOrPrivateKey
- * @param options
- */
-async function signPayload(payload, secretOrPrivateKey, options = {}) {
-  return new Promise(function (resolve, reject) {
-    debug('sign jwt token');
-    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey,
-    // FIXME: upgrade to the latest library and types
-    // @ts-ignore
-    {
-      // 1 === 1ms (one millisecond)
-      notBefore: '1',
-      // Make sure the time will not rollback :)
-      ...options
-    }, (error, token) => {
-      debug('error on sign jwt token');
-      return error ? reject(error) : resolve(token);
-    });
-  });
-}
-function verifyPayload(token, secretOrPrivateKey) {
-  debug('verify jwt token');
-  return _jsonwebtoken.default.verify(token, secretOrPrivateKey);
-}
-//# sourceMappingURL=jwt-token.js.map

package/build/jwt-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt-token.js","names":["debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      // FIXME: upgrade to the latest library and types\n      // @ts-ignore\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token: string) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AAA+B;AAI/B,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAW,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAAuB,GAAG,CAAC,CAAC,EACX;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAmB;IAC7DR,KAAK,CAAC,gBAAgB,CAAC;IACvB,OAAOS,qBAAG,CAACC,IAAI,CACbP,OAAO,EACPC,kBAAkB;IAClB;IACA;IACA;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAa,KAAK;MACxBb,KAAK,CAAC,yBAAyB,CAAC;MAChC,OAAOY,KAAK,GAAGJ,MAAM,CAACI,KAAK,CAAC,GAAGL,OAAO,CAACM,KAAK,CAAC;IAC/C,CAAC,CACF;EACH,CAAC,CAAC;AACJ;AAEO,SAASC,aAAa,CAACD,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,kBAAkB,CAAC;EACzB,OAAOS,qBAAG,CAACM,MAAM,CAACF,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}

package/build/legacy-token.d.ts

@@ -1,3 +0,0 @@
-export declare const defaultAlgorithm: string;
-export declare function aesEncrypt(value: string, key: string): string | void;
-export declare function aesDecrypt(value: string, key: string): string | void;

package/build/legacy-token.js

@@ -1,66 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.aesDecrypt = aesDecrypt;
-exports.aesEncrypt = aesEncrypt;
-exports.defaultAlgorithm = void 0;
-var _crypto = require("crypto");
-var _debug = _interopRequireDefault(require("debug"));
-var _config = require("@verdaccio/config");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-const debug = (0, _debug.default)('verdaccio:auth:token:legacy');
-const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
-exports.defaultAlgorithm = defaultAlgorithm;
-const inputEncoding = 'utf8';
-const outputEncoding = 'hex';
-// For AES, this is always 16
-const IV_LENGTH = 16;
-// Must be 256 bits (32 characters)
-// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356
-const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
-function aesEncrypt(value, key) {
-  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
-  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
-  debug('encrypt %o', value);
-  debug('algorithm %o', defaultAlgorithm);
-  const iv = Buffer.from((0, _crypto.randomBytes)(IV_LENGTH));
-  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
-  const isKeyValid = (secretKey === null || secretKey === void 0 ? void 0 : secretKey.length) === _config.TOKEN_VALID_LENGTH;
-  debug('length secret key %o', secretKey === null || secretKey === void 0 ? void 0 : secretKey.length);
-  debug('is valid secret %o', isKeyValid);
-  if (!value || !secretKey || !isKeyValid) {
-    return;
-  }
-  const cipher = (0, _crypto.createCipheriv)(defaultAlgorithm, secretKey, iv);
-  let encrypted = cipher.update(value, inputEncoding, outputEncoding);
-  // @ts-ignore
-  encrypted += cipher.final(outputEncoding);
-  const token = `${iv.toString('hex')}:${encrypted.toString()}`;
-  debug('token generated successfully');
-  return Buffer.from(token).toString('base64');
-}
-function aesDecrypt(value, key) {
-  try {
-    const buff = Buffer.from(value, 'base64');
-    const textParts = buff.toString().split(':');
-
-    // extract the IV from the first half of the value
-    // @ts-ignore
-    const IV = Buffer.from(textParts.shift(), outputEncoding);
-    // extract the encrypted text without the IV
-    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
-    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
-    // decipher the string
-    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV);
-    // FIXME: fix type here should allow Buffer
-    let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
-    decrypted += decipher.final(inputEncoding);
-    debug('token decrypted successfully');
-    return decrypted.toString();
-  } catch (_) {
-    return;
-  }
-}
-//# sourceMappingURL=legacy-token.js.map

package/build/legacy-token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"legacy-token.js","names":["debug","buildDebug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","IV_LENGTH","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/legacy-token.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// For AES, this is always 16\nconst IV_LENGTH = 16;\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  const iv = Buffer.from(randomBytes(IV_LENGTH));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA;AAOA;AAEA;AAAuD;AAEvD,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AAAC;AACxF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA,MAAMC,SAAS,GAAG,EAAE;AACpB;AACA;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAG,CAACK,+BAA+B;AAE5E,SAASC,UAAU,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAZ,KAAK,CAAC,YAAY,EAAEW,KAAK,CAAC;EAC1BX,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC,MAAMW,EAAE,GAAGC,MAAM,CAACC,IAAI,CAAC,IAAAC,mBAAW,EAACR,SAAS,CAAC,CAAC;EAC9C,MAAMS,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;EACxD,MAAMM,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DpB,KAAK,CAAC,sBAAsB,EAAEiB,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDnB,KAAK,CAAC,oBAAoB,EAAEkB,UAAU,CAAC;EACvC,IAAI,CAACP,KAAK,IAAI,CAACM,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAACpB,gBAAgB,EAAEe,SAAS,EAAEJ,EAAE,CAAC;EAC9D,IAAIU,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACb,KAAK,EAAEL,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAgB,SAAS,IAAIF,MAAM,CAACI,KAAK,CAAClB,cAAc,CAAC;EACzC,MAAMmB,KAAK,GAAI,GAAEb,EAAE,CAACc,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,EAAG,EAAC;EAC7D3B,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAOc,MAAM,CAACC,IAAI,CAACW,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASC,UAAU,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGf,MAAM,CAACC,IAAI,CAACJ,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACF,QAAQ,EAAE,CAACI,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGlB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACG,KAAK,EAAE,EAAE1B,cAAc,CAAC;IACzD;IACA,MAAM2B,aAAa,GAAGpB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE5B,cAAc,CAAC;IACtE,MAAMU,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAACnC,gBAAgB,EAAEe,SAAS,EAAEe,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACZ,MAAM,CAACU,aAAa,EAAS3B,cAAc,EAAED,aAAa,CAAC;IACpFgC,SAAS,IAAIF,QAAQ,CAACX,KAAK,CAACnB,aAAa,CAAC;IAC1CN,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOsC,SAAS,CAACX,QAAQ,EAAE;EAC7B,CAAC,CAAC,OAAOY,CAAM,EAAE;IACf;EACF;AACF"}

package/build/token.d.ts

@@ -1,2 +0,0 @@
-import { BasicPayload } from './utils';
-export declare function parseBasicPayload(credentials: string): BasicPayload;

package/build/token.js

@@ -1,19 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.parseBasicPayload = parseBasicPayload;
-function parseBasicPayload(credentials) {
-  const index = credentials.indexOf(':');
-  if (index < 0) {
-    return;
-  }
-  const user = credentials.slice(0, index);
-  const password = credentials.slice(index + 1);
-  return {
-    user,
-    password
-  };
-}
-//# sourceMappingURL=token.js.map

package/build/token.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"token.js","names":["parseBasicPayload","credentials","index","indexOf","user","slice","password"],"sources":["../src/token.ts"],"sourcesContent":["import { BasicPayload } from './utils';\n\nexport function parseBasicPayload(credentials: string): BasicPayload {\n  const index = credentials.indexOf(':');\n  if (index < 0) {\n    return;\n  }\n\n  const user: string = credentials.slice(0, index);\n  const password: string = credentials.slice(index + 1);\n\n  return { user, password };\n}\n"],"mappings":";;;;;;AAEO,SAASA,iBAAiB,CAACC,WAAmB,EAAgB;EACnE,MAAMC,KAAK,GAAGD,WAAW,CAACE,OAAO,CAAC,GAAG,CAAC;EACtC,IAAID,KAAK,GAAG,CAAC,EAAE;IACb;EACF;EAEA,MAAME,IAAY,GAAGH,WAAW,CAACI,KAAK,CAAC,CAAC,EAAEH,KAAK,CAAC;EAChD,MAAMI,QAAgB,GAAGL,WAAW,CAACI,KAAK,CAACH,KAAK,GAAG,CAAC,CAAC;EAErD,OAAO;IAAEE,IAAI;IAAEE;EAAS,CAAC;AAC3B"}

package/src/jwt-token.ts

@@ -1,42 +0,0 @@
-import buildDebug from 'debug';
-import jwt from 'jsonwebtoken';
-
-import { JWTSignOptions, RemoteUser } from '@verdaccio/types';
-
-const debug = buildDebug('verdaccio:auth:token:jwt');
-/**
- * Sign the payload and return JWT
- * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback
- * @param payload
- * @param secretOrPrivateKey
- * @param options
- */
-export async function signPayload(
-  payload: RemoteUser,
-  secretOrPrivateKey: string,
-  options: JWTSignOptions = {}
-): Promise<string> {
-  return new Promise(function (resolve, reject): Promise<string> {
-    debug('sign jwt token');
-    return jwt.sign(
-      payload,
-      secretOrPrivateKey,
-      // FIXME: upgrade to the latest library and types
-      // @ts-ignore
-      {
-        // 1 === 1ms (one millisecond)
-        notBefore: '1', // Make sure the time will not rollback :)
-        ...options,
-      },
-      (error, token: string) => {
-        debug('error on sign jwt token');
-        return error ? reject(error) : resolve(token);
-      }
-    );
-  });
-}
-
-export function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {
-  debug('verify jwt token');
-  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;
-}

package/src/legacy-token.ts

@@ -1,67 +0,0 @@
-import {
-  BinaryToTextEncoding,
-  CharacterEncoding,
-  createCipheriv,
-  createDecipheriv,
-  randomBytes,
-} from 'crypto';
-import buildDebug from 'debug';
-
-import { TOKEN_VALID_LENGTH } from '@verdaccio/config';
-
-const debug = buildDebug('verdaccio:auth:token:legacy');
-
-export const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
-const inputEncoding: CharacterEncoding = 'utf8';
-const outputEncoding: BinaryToTextEncoding = 'hex';
-// For AES, this is always 16
-const IV_LENGTH = 16;
-// Must be 256 bits (32 characters)
-// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356
-const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
-
-export function aesEncrypt(value: string, key: string): string | void {
-  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
-  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
-  debug('encrypt %o', value);
-  debug('algorithm %o', defaultAlgorithm);
-  const iv = Buffer.from(randomBytes(IV_LENGTH));
-  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
-  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;
-  debug('length secret key %o', secretKey?.length);
-  debug('is valid secret %o', isKeyValid);
-  if (!value || !secretKey || !isKeyValid) {
-    return;
-  }
-
-  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);
-  let encrypted = cipher.update(value, inputEncoding, outputEncoding);
-  // @ts-ignore
-  encrypted += cipher.final(outputEncoding);
-  const token = `${iv.toString('hex')}:${encrypted.toString()}`;
-  debug('token generated successfully');
-  return Buffer.from(token).toString('base64');
-}
-
-export function aesDecrypt(value: string, key: string): string | void {
-  try {
-    const buff = Buffer.from(value, 'base64');
-    const textParts = buff.toString().split(':');
-
-    // extract the IV from the first half of the value
-    // @ts-ignore
-    const IV = Buffer.from(textParts.shift(), outputEncoding);
-    // extract the encrypted text without the IV
-    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
-    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
-    // decipher the string
-    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);
-    // FIXME: fix type here should allow Buffer
-    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);
-    decrypted += decipher.final(inputEncoding);
-    debug('token decrypted successfully');
-    return decrypted.toString();
-  } catch (_: any) {
-    return;
-  }
-}

package/src/token.ts

@@ -1,13 +0,0 @@
-import { BasicPayload } from './utils';
-
-export function parseBasicPayload(credentials: string): BasicPayload {
-  const index = credentials.indexOf(':');
-  if (index < 0) {
-    return;
-  }
-
-  const user: string = credentials.slice(0, index);
-  const password: string = credentials.slice(index + 1);
-
-  return { user, password };
-}

package/test/legacy-token.spec.ts

@@ -1,19 +0,0 @@
-import { aesDecrypt, aesEncrypt } from '../src/legacy-token';
-
-describe('test crypto utils', () => {
-  test('decrypt payload flow', () => {
-    const secret = 'f5bb945cc57fea2f25961e1bd6fb3c89';
-    const payload = 'juan:password';
-    const token = aesEncrypt(payload, secret) as string;
-    const data = aesDecrypt(token, secret);
-
-    expect(payload).toEqual(data);
-  });
-
-  test('crypt fails if secret is incorrect', () => {
-    const secret = 'f5bb945cc57fea2f25961e1bd6fb3c89_TO_LONG';
-    const payload = 'juan';
-    const token = aesEncrypt(payload, secret) as string;
-    expect(token).toBeUndefined();
-  });
-});