@verdaccio/auth 6.0.0-6-next.54 → 7.0.0-next-7.7

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["_debug","_interopRequireDefault","require","_lodash","_verdaccioHtpasswd","_config","_core","_loaders","_logger","_signature","_utils","_utils2","obj","__esModule","default","debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","_this$config","_this$config$serverSe","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","adduser","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","arguments","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","_isRemoteUserValid","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","_handleAESMiddleware","_handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value","exports"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, RequestHandler, Response } from 'express';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\n// remove\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      if (typeof plugin.adduser !== 'function') {\n        next();\n      } else {\n        // @ts-expect-error future major (7.x) should remove this section\n        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n          throw errorUtils.getInternalError(\n            'add_user method not longer supported, rename to adduser'\n          );\n        }\n\n        plugin.adduser(\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user  %o could not being added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (_.isNil(plugin) || isFunction(plugin.allow_unpublish) === false) {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        // @ts-ignore\n        plugin.allow_unpublish!(user, pkg, (err, ok: boolean): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            // @ts-ignore\n            // eslint-disable-next-line\n            return this.allow_publish(...arguments);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as any;\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): RequestHandler {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n\n      const next = function (err?: VerdaccioError): any {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next();\n      };\n\n      if (this._isRemoteUserValid(req.remote_user)) {\n        debug('jwt has a valid authentication header');\n        return next();\n      }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this._handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private _handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private _handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware(): RequestHandler {\n    // @ts-ignore\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          // req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    return aesEncrypt(value, this.secret);\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AASA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,OAAA,GAAAN,OAAA;AACA,IAAAO,UAAA,GAAAP,OAAA;AAWA,IAAAQ,MAAA,GAAAR,OAAA;AAEA,IAAAS,OAAA,GAAAT,OAAA;AAQiB,SAAAD,uBAAAW,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;;AAO1C;;AAcA,MAAMC,IAAI,CAAqE;EAKtEC,WAAWA,CAACC,MAAc,EAAE;IACjC,IAAI,CAACA,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,MAAM,GAAGD,MAAM,CAACC,MAAM;IAC3B,IAAI,CAACC,OAAO,GAAG,EAAE;IACjB,IAAI,CAAC,IAAI,CAACD,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAIA,CAAA,EAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,CAAC,CAAiC;IACtET,KAAK,CAAC,uBAAuB,EAAEM,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,CAAC,CAAC;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,CAAC,CAAC;EAC7B;EAEQD,iBAAiBA,CAAA,EAAG;IAC1BX,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC;IACD,IAAIC,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBJ,aACF,CAAC;IACH,CAAC,CAAC,OAAOK,KAAU,EAAE;MACnBlB,KAAK,CAAC,iDAAiD,EAAEkB,KAAK,CAAC;MAC/DJ,cAAM,CAACK,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MAChD,OAAO,EAAE;IACX;IAEA,OAAO,CAACJ,UAAU,CAAC;EACrB;EAEA,MAAcN,UAAUA,CAAA,EAAG;IAAA,IAAAW,YAAA,EAAAC,qBAAA;IACzB,OAAO,IAAAC,wBAAe,EACpB,IAAI,CAAClB,MAAM,CAACmB,IAAI,EAChB;MACEnB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC,EACAU,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,GAAAP,YAAA,GACD,IAAI,CAAChB,MAAM,cAAAgB,YAAA,wBAAAC,qBAAA,GAAXD,YAAA,CAAaQ,cAAc,cAAAP,qBAAA,uBAA3BA,qBAAA,CAA6BQ,YAC/B,CAAC;EACH;EAEQjB,oBAAoBA,CAAA,EAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAACwB,IAAI,CAAC,IAAAC,yBAAiB,EAACjB,cAAM,CAAC,CAAC;EAC9C;EAEOkB,cAAcA,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAACjC,OAAO,EAAGkB,MAAM,IAAK,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,CAAC;IAE1F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMrB,MAAM,IAAIa,YAAY,EAAE;MACjC,IAAI,IAAAS,YAAK,EAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;QAChEhC,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAEiC,QAAQ,CAAC;QAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACPjC,cAAM,CAACI,KAAK,CACV;cAAEe,QAAQ;cAAEc;YAAI,CAAC,EAChB;AACf,yEACY,CAAC;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEA/C,KAAK,CAAC,wCAAwC,EAAEiC,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAeA,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,CAAC,CAAC;EAC1B;EAEO7B,YAAYA,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAM9B,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAA6B;MAE1D,IAAI,IAAAjB,iBAAU,EAAChB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAO+B,IAAI,CAAC,CAAC;MACf;MAEAxD,KAAK,CAAC,mBAAmB,EAAEiC,QAAQ,CAAC;MACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACP/C,KAAK,CAAC,8CAA8C,EAAEiC,QAAQ,EAAEc,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAAChD,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI4B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAInD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMsD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAItD,SAAS,CAACwD,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEAhE,KAAK,CAAC,yDAAyD,EAAEiC,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOU,QAAQA,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAM9D,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrCvD,KAAK,CAAC,aAAa,EAAEmE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAA6B;MAC1D,IAAI,OAAOjC,MAAM,CAAC6C,OAAO,KAAK,UAAU,EAAE;QACxCb,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACA,IAAI,OAAOhC,MAAM,CAAC6C,OAAO,KAAK,WAAW,IAAI,OAAO7C,MAAM,CAAC0C,QAAQ,KAAK,UAAU,EAAE;UAClF,MAAMxB,gBAAU,CAACC,gBAAgB,CAC/B,yDACF,CAAC;QACH;QAEAnB,MAAM,CAAC6C,OAAO,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAEuB,EAAqB,EAAQ;UACjE,IAAIvB,GAAG,EAAE;YACP/C,KAAK,CAAC,+CAA+C,EAAEmE,IAAI,EAAEpB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;YAC1E,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAIuB,EAAE,EAAE;YACNtE,KAAK,CAAC,4BAA4B,EAAEmE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC3C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACAoB,IAAI,CAAC,CAAC;QACR,CACF,CAAC;MACH;IACF,CAAC,EAAE,CAAC;EACN;;EAEA;AACF;AACA;EACS9B,YAAYA,CACjB;IAAE6C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAoC,EAC9B;IACN,MAAMnE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMmB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC;IAClF,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB,CAAC,CAAC,EACFL,cAAc,EACd,IAAAM,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACnE,MAAM,CAAC6E,QAAQ,CAC1D,CAAgC;IAChCjF,KAAK,CAAC,qBAAqB,EAAEuE,WAAW,CAAC;IAEzC,CAAC,SAASf,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAiC,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAA8B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO8B,IAAI,CAAC,CAAC;MACf;MAEAhC,MAAM,CAACE,YAAY,CAAEyC,IAAI,EAAEU,GAAG,EAAE,UAAU9B,GAA0B,EAAEuB,EAAY,EAAQ;QACxF,IAAIvB,GAAG,EAAE;UACP/C,KAAK,CAAC,oCAAoC,EAAEuE,WAAW,EAAExB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UACtE,OAAOc,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNtE,KAAK,CAAC,uBAAuB,EAAEuE,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAd,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;;EAEO0B,eAAeA,CACpB;IAAEX,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACnE,MAAM,CAAC6E,QAAQ,CAC1D,CAAC;IACDjF,KAAK,CAAC,wBAAwB,EAAEuE,WAAW,CAAC;IAE5C,KAAK,MAAM/C,MAAM,IAAI,IAAI,CAAClB,OAAO,EAAE;MACjC,IAAIgC,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAAC0D,eAAe,CAAC,KAAK,KAAK,EAAE;QACnElF,KAAK,CAAC,kEAAkE,EAAEuE,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACL;QACA/C,MAAM,CAAC0D,eAAe,CAAEf,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAAG,EAAEuB,EAAW,KAAW;UAC7D,IAAIvB,GAAG,EAAE;YACP/C,KAAK,CACH,qEAAqE,EACrEuE,WACF,CAAC;YACD,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAACwB,EAAE,CAAC,KAAK,IAAI,EAAE;YACxBtE,KAAK,CAAC,yDAAyD,EAAEuE,WAAW,CAAC;YAC7E;YACA;YACA,OAAO,IAAI,CAAC5C,aAAa,CAAC,GAAGwD,SAAS,CAAC;UACzC;UAEA,IAAIb,EAAE,EAAE;YACNtE,KAAK,CAAC,0BAA0B,EAAEuE,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACS3C,aAAaA,CAClB;IAAE4C,WAAW;IAAEC;EAA8C,CAAC,EAC9DL,IAAgB,EAChBM,QAAkB,EACZ;IACN,MAAMnE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMsB,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACnE,MAAM,CAAC6E,QAAQ,CAC1D,CAAQ;IACRjF,KAAK,CAAC,yCAAyC,EAAEuE,WAAW,EAAEjE,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAAS8C,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAAC;MAE9B,IAAI,QAAOjC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,MAAK,UAAU,EAAE;QAC/C3B,KAAK,CAAC,8DAA8D,EAAEuE,WAAW,CAAC;QAClF,OAAOf,IAAI,CAAC,CAAC;MACf;MAEAhC,MAAM,CAACG,aAAa,CAACwC,IAAI,EAAEU,GAAG,EAAE,CAAC9B,GAA0B,EAAEuB,EAAY,KAAW;QAClF,IAAIhC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAAC8C,OAAO,CAACrC,GAAG,CAAC,EAAE;UAC5C/C,KAAK,CAAC,0BAA0B,EAAEuE,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC1B,GAAG,CAAC;QACtB;QAEA,IAAIuB,EAAE,EAAE;UACNtE,KAAK,CAAC,wBAAwB,EAAEuE,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAtE,KAAK,CAAC,sCAAsC,EAAEuE,WAAW,CAAC;QAC1Df,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;;EAEO6B,gBAAgBA,CAAA,EAAmB;IACxCrF,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMM,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM+B,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAEtB,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAMzC,MAAM,IAAIlB,OAAO,EAAE;MAC5B,IAAIkB,MAAM,CAAC6D,gBAAgB,EAAE;QAC3B,OAAO7D,MAAM,CAAC6D,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;;IAEA;IACA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,CAAC,CAAC;MAEX,MAAMnC,IAAI,GAAG,SAAAA,CAAUT,GAAoB,EAAO;QAChDyC,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ;QACA;QACA;QACA;QACA,IAAI7C,GAAG,EAAE;UACPyC,GAAG,CAACK,WAAW,CAAC3E,KAAK,GAAG6B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAO+B,KAAK,CAAC,CAAC;MAChB,CAAC;MAED,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C7F,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOwD,IAAI,CAAC,CAAC;MACf;;MAEA;MACA,MAAMuC,UAAU,GAAG,IAAAR,iCAAyB,EAAC,CAAC;MAC9CC,GAAG,CAACK,WAAW,GAAGE,UAAU;MAC5BN,GAAG,CAACO,MAAM,CAACH,WAAW,GAAGE,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1BjG,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOwD,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrCjG,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAOwD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAEhG,MAAM;QAAEiG;MAAS,CAAC,GAAG,IAAI,CAAClG,MAAM;MAExC,IAAI,IAAAmG,mBAAW,EAACD,QAAQ,CAAC,EAAE;QACzBtG,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAACwG,oBAAoB,CAAChB,GAAG,EAAEc,QAAQ,EAAEjG,MAAM,EAAE4F,aAAa,EAAEzC,IAAI,CAAC;MACvE,CAAC,MAAM;QACLxD,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAACyG,uBAAuB,CAACjB,GAAG,EAAEc,QAAQ,EAAEjG,MAAM,EAAE4F,aAAa,EAAEzC,IAAI,CAAC;MAC1E;IACF,CAAC;EACH;EAEQiD,uBAAuBA,CAC7BjB,GAAmB,EACnBc,QAAkB,EAClBjG,MAAc,EACd4F,aAAqB,EACrBzC,IAAc,EACR;IACNxD,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAE0G,MAAM;MAAExD;IAAM,CAAC,GAAG,IAAAyD,4BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;MACtD5G,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAM8G,WAAW,GAAG,IAAAC,8BAAsB,EAAC7D,KAAK,CAAC,CAAC8D,QAAQ,CAAC,CAAC;MAC5D,MAAM;QAAE7C,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAA+E,4BAAiB,EAACH,WAAW,CAAe;MACvE9G,KAAK,CAAC,mBAAmB,EAAEmE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACR/C,KAAK,CAAC,0BAA0B,CAAC;UACjCwF,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBX,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACLxD,KAAK,CAAC,2BAA2B,CAAC;UAClCwF,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7C/B,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL/C,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAM8G,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAEjG,MAAM,EAAE4F,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACAtB,GAAG,CAACK,WAAW,GAAGiB,WAAW;QAC7B9G,KAAK,CAAC,0BAA0B,CAAC;QACjCwD,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACAxD,KAAK,CAAC,mBAAmB,CAAC;QAC1BwD,IAAI,CAACd,gBAAU,CAACyE,YAAY,CAACpD,eAAS,CAACqD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,oBAAoBA,CAC1BhB,GAAmB,EACnBc,QAAkB,EAClBjG,MAAc,EACd4F,aAAqB,EACrBzC,IAAc,EACR;IACNxD,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,0BAA0B,EAAE,OAAOK,MAAM,KAAK,QAAQ,CAAC;IAC7DL,KAAK,CAAC,iCAAiC,EAAE,OAAOiG,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAEjG,MAAM,EAAE4F,aAAa,CAAC;IAClFjG,KAAK,CAAC,+BAA+B,EAAE8G,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAEnC,IAAI,CAAC;IACzD,IAAImC,WAAW,EAAE;MACf,MAAM;QAAE3C,IAAI;QAAEjC;MAAS,CAAC,GAAG4E,WAAW;MACtC9G,KAAK,CAAC,mBAAmB,EAAEmE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACRyC,GAAG,CAACK,WAAW,GAAG1B,IAAI;UACtBnE,KAAK,CAAC,0BAA0B,CAAC;UACjCwD,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACLgC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7CvF,KAAK,CAAC,2BAA2B,CAAC;UAClCwD,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACA/C,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAOwD,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQP,kBAAkBA,CAACD,WAAwB,EAAW;IAC5D,OAAOvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,CAAC,KAAK,KAAK,IAAIvD,eAAC,CAAC+E,WAAW,CAACxB,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAElB,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACS2C,kBAAkBA,CAAA,EAAmB;IAC1C;IACA,OAAO,CAAC9B,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAACI,kBAAkB,CAACN,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,CAAC,CAAC;MAChB;MAEAF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMnC,IAAI,GAAIT,GAA0B,IAAW;QACjDyC,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ,IAAI7C,GAAG,EAAE;UACP;UACA0C,GAAG,CAAC8B,MAAM,CAACxE,GAAG,CAACyE,UAAU,CAAC,CAACC,IAAI,CAAC1E,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAO+B,KAAK,CAAC,CAAC;MAChB,CAAC;MAED,MAAM;QAAEO;MAAc,CAAC,GAAGT,GAAG,CAACU,OAAO;MACrC,IAAI5D,eAAC,CAACQ,KAAK,CAACmD,aAAa,CAAC,EAAE;QAC1B,OAAOzC,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA2C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAOzC,IAAI,CAACd,gBAAU,CAAC0D,aAAa,CAACrC,eAAS,CAACsC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMnD,KAAK,GAAG,CAAC+C,aAAa,IAAI,EAAE,EAAEyB,OAAO,CAAE,GAAEC,kBAAa,GAAE,EAAE,EAAE,CAAC;MACnE,IAAI,CAACzE,KAAK,EAAE;QACV,OAAOM,IAAI,CAAC,CAAC;MACf;MAEA,IAAIsD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAc,wBAAgB,EAAC1E,KAAK,EAAE,IAAI,CAAC9C,MAAM,CAACC,MAAM,CAAC;MAC3D,CAAC,CAAC,OAAO0C,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAAC+C,kBAAkB,CAACgB,WAAW,CAAC,EAAE;QACxC,MAAM;UAAEnC,IAAI;UAAEjB;QAAO,CAAC,GAAGoD,WAAyB;QAClDtB,GAAG,CAACK,WAAW,GAAG,IAAA5B,wBAAgB,EAACU,IAAI,EAAYjB,MAAM,CAAC;MAC5D,CAAC,MAAM;QACL8B,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;MAC/C;MAEA/B,IAAI,CAAC,CAAC;IACR,CAAC;EACH;EAEA,MAAaqE,UAAUA,CAAC1D,IAAgB,EAAE2D,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAEpD,IAAI;MAAEjB;IAAO,CAAC,GAAGS,IAAI;IAC1CnE,KAAK,CAAC,gBAAgB,EAAE2E,IAAI,CAAC;IAC7B,MAAMqD,mBAAmB,GAAG1F,eAAC,CAACQ,KAAK,CAACiF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAG3F,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjCqE,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAG1E,MAAM,CAAC2E,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChCrD,IAAI;MACJjB,MAAM,EAAEuE;IACV,CAAC;IAED,MAAM/E,KAAa,GAAG,MAAM,IAAAqF,sBAAW,EAACD,OAAO,EAAE,IAAI,CAACjI,MAAM,EAAEyH,WAAW,CAAC;IAE1E,OAAO5E,KAAK;EACd;;EAEA;AACF;AACA;EACSsF,UAAUA,CAACC,KAAa,EAAiB;IAC9C,OAAO,IAAAD,qBAAU,EAACC,KAAK,EAAE,IAAI,CAACpI,MAAM,CAAC;EACvC;AACF;AAACqI,OAAA,CAAAxI,IAAA,GAAAA,IAAA"}
+{"version":3,"file":"auth.js","names":["_debug","_interopRequireDefault","require","_lodash","_verdaccioHtpasswd","_config","_core","_loaders","_logger","_signature","_utils","_utils2","obj","__esModule","default","debug","buildDebug","Auth","constructor","config","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","logger","authPlugin","HTPasswd","file","error","info","_this$config","_this$config$serverSe","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","adduser","warningUtils","emit","Codes","VERWAR006","ok","packageName","packageVersion","callback","pkgAllowAccess","name","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","handleAESMiddleware","handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","_this$config2","getEnhancedLegacySignature","_isRemoteUserValid","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value","_this$config3","aesEncryptDeprecated","Buffer","exports"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n  warningUtils,\n} from '@verdaccio/core';\nimport '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n} from '@verdaccio/signature';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config) {\n    this.config = config;\n    this.secret = config.secret;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.config?.serverSettings?.pluginPrefix\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not being added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        plugin.allow_unpublish(user, pkg, (err, ok): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            return this.allow_publish({ packageName, packageVersion }, user, callback);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware secret %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(\n      security,\n      secret,\n      authorization,\n      this.config?.getEnhancedLegacySignature()\n    );\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    // enhancedLegacySignature enables modern aes192 algorithm signature\n    if (this.config?.getEnhancedLegacySignature()) {\n      debug('signing with enhaced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhaced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AAWA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,OAAA,GAAAN,OAAA;AACA,IAAAO,UAAA,GAAAP,OAAA;AAeA,IAAAQ,MAAA,GAAAR,OAAA;AAUA,IAAAS,OAAA,GAAAT,OAAA;AAQiB,SAAAD,uBAAAW,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;AAE1C,MAAMC,IAAI,CAAqE;EAKtEC,WAAWA,CAACC,MAAc,EAAE;IACjC,IAAI,CAACA,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACC,MAAM,GAAGD,MAAM,CAACC,MAAM;IAC3B,IAAI,CAACC,OAAO,GAAG,EAAE;IACjB,IAAI,CAAC,IAAI,CAACD,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAIA,CAAA,EAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,CAAC,CAAiC;IAEtET,KAAK,CAAC,uBAAuB,EAAEM,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,CAAC,CAAC;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,CAAC,CAAC;EAC7B;EAEQD,iBAAiBA,CAAA,EAAG;IAC1BX,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMa,aAAwC,GAAG;MAC/CT,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC;IACD,IAAIC,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBJ,aACF,CAAC;IACH,CAAC,CAAC,OAAOK,KAAU,EAAE;MACnBlB,KAAK,CAAC,iDAAiD,EAAEkB,KAAK,CAAC;MAC/DJ,cAAM,CAACK,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MAChD,OAAO,EAAE;IACX;IAEA,OAAO,CAACJ,UAAU,CAAC;EACrB;EAEA,MAAcN,UAAUA,CAAA,EAAG;IAAA,IAAAW,YAAA,EAAAC,qBAAA;IACzB,OAAO,IAAAC,wBAAe,EACpB,IAAI,CAAClB,MAAM,CAACmB,IAAI,EAChB;MACEnB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBU,MAAM,EAANA;IACF,CAAC,EACAU,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,GAAAP,YAAA,GACD,IAAI,CAAChB,MAAM,cAAAgB,YAAA,wBAAAC,qBAAA,GAAXD,YAAA,CAAaQ,cAAc,cAAAP,qBAAA,uBAA3BA,qBAAA,CAA6BQ,YAC/B,CAAC;EACH;EAEQjB,oBAAoBA,CAAA,EAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAACwB,IAAI,CAAC,IAAAC,yBAAiB,EAACjB,cAAM,CAAC,CAAC;EAC9C;EAEOkB,cAAcA,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAACjC,OAAO,EAAGkB,MAAM,IAAK,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,CAAC;IAE1F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMrB,MAAM,IAAIa,YAAY,EAAE;MACjC,IAAI,IAAAS,YAAK,EAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;QAChEhC,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAEiC,QAAQ,CAAC;QAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACPjC,cAAM,CAACI,KAAK,CACV;cAAEe,QAAQ;cAAEc;YAAI,CAAC,EAChB;AACf,yEACY,CAAC;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEA/C,KAAK,CAAC,wCAAwC,EAAEiC,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAeA,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,CAAC,CAAC;EAC1B;EAEO7B,YAAYA,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAM9B,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAA6B;MAE1D,IAAI,IAAAjB,iBAAU,EAAChB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAO+B,IAAI,CAAC,CAAC;MACf;MAEAxD,KAAK,CAAC,mBAAmB,EAAEiC,QAAQ,CAAC;MACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACP/C,KAAK,CAAC,8CAA8C,EAAEiC,QAAQ,EAAEc,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAAChD,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI4B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAInD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMsD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAItD,SAAS,CAACwD,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEAhE,KAAK,CAAC,yDAAyD,EAAEiC,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOU,QAAQA,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAM9D,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrCvD,KAAK,CAAC,aAAa,EAAEmE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAIA,CAAA,EAAS;MACrB,IAAIa,MAAM,GAAG,SAAS;MACtB,MAAM7C,MAAM,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAA6B;MAC1D;MACA,IAAI,OAAOjC,MAAM,CAAC8C,OAAO,KAAK,WAAW,IAAI,OAAO9C,MAAM,CAAC0C,QAAQ,KAAK,UAAU,EAAE;QAClFG,MAAM,GAAG,UAAU;QACnBE,kBAAY,CAACC,IAAI,CAACD,kBAAY,CAACE,KAAK,CAACC,SAAS,CAAC;MACjD;MACA;MACA,IAAI,OAAOlD,MAAM,CAAC6C,MAAM,CAAC,KAAK,UAAU,EAAE;QACxCb,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACA;QACAhC,MAAM,CAAC6C,MAAM,CAAC,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAE4B,EAAqB,EAAQ;UACjE,IAAI5B,GAAG,EAAE;YACP/C,KAAK,CAAC,8CAA8C,EAAEmE,IAAI,EAAEpB,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;YACzE,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAI4B,EAAE,EAAE;YACN3E,KAAK,CAAC,4BAA4B,EAAEmE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC3C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACApC,KAAK,CAAC,mDAAmD,CAAC;UAC1DwD,IAAI,CAAC,CAAC;QACR,CACF,CAAC;MACH;IACF,CAAC,EAAE,CAAC;EACN;;EAEA;AACF;AACA;EACS9B,YAAYA,CACjB;IAAEkD,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAoC,EAC9B;IACN,MAAMxE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMwB,cAA2B,GAAG;MAAEC,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC;IAClF,MAAMK,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB,CAAC,CAAC,EACFL,cAAc,EACd,IAAAM,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACxE,MAAM,CAACkF,QAAQ,CAC1D,CAAgC;IAChCtF,KAAK,CAAC,qBAAqB,EAAE4E,WAAW,CAAC;IAEzC,CAAC,SAASpB,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAiC,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAA8B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO8B,IAAI,CAAC,CAAC;MACf;MAEAhC,MAAM,CAACE,YAAY,CAAEyC,IAAI,EAAEe,GAAG,EAAE,UAAUnC,GAA0B,EAAE4B,EAAY,EAAQ;QACxF,IAAI5B,GAAG,EAAE;UACP/C,KAAK,CAAC,oCAAoC,EAAE4E,WAAW,EAAE7B,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEY,OAAO,CAAC;UACtE,OAAOmB,QAAQ,CAAC/B,GAAG,CAAC;QACtB;QAEA,IAAI4B,EAAE,EAAE;UACN3E,KAAK,CAAC,uBAAuB,EAAE4E,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAnB,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEO+B,eAAeA,CACpB;IAAEX,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAkB,EACZ;IACN,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACxE,MAAM,CAACkF,QAAQ,CAC1D,CAAC;IACDtF,KAAK,CAAC,wBAAwB,EAAE4E,WAAW,CAAC;IAE5C,KAAK,MAAMpD,MAAM,IAAI,IAAI,CAAClB,OAAO,EAAE;MACjC,IAAI,QAAOkB,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE+D,eAAe,MAAK,UAAU,EAAE;QACjDvF,KAAK,CAAC,kEAAkE,EAAE4E,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACLpD,MAAM,CAAC+D,eAAe,CAACpB,IAAI,EAAEe,GAAG,EAAE,CAACnC,GAAG,EAAE4B,EAAE,KAAW;UACnD,IAAI5B,GAAG,EAAE;YACP/C,KAAK,CACH,qEAAqE,EACrE4E,WACF,CAAC;YACD,OAAOE,QAAQ,CAAC/B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAAC6B,EAAE,CAAC,KAAK,IAAI,EAAE;YACxB3E,KAAK,CAAC,yDAAyD,EAAE4E,WAAW,CAAC;YAC7E,OAAO,IAAI,CAACjD,aAAa,CAAC;cAAEiD,WAAW;cAAEC;YAAe,CAAC,EAAEV,IAAI,EAAEW,QAAQ,CAAC;UAC5E;UAEA,IAAIH,EAAE,EAAE;YACN3E,KAAK,CAAC,0BAA0B,EAAE4E,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACShD,aAAaA,CAClB;IAAEiD,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAkB,EACZ;IACN,MAAMxE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM2B,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAEJ,IAAI,EAAEJ,WAAW;MAAEK,OAAO,EAAEJ;IAAe,CAAC,EAC9C,IAAAQ,6BAAsB,EAACT,WAAW,EAAE,IAAI,CAACxE,MAAM,CAACkF,QAAQ,CAC1D,CAAC;IACDtF,KAAK,CAAC,yCAAyC,EAAE4E,WAAW,EAAEtE,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAAS8C,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGlB,OAAO,CAACmD,KAAK,CAAC,CAAC;MAE9B,IAAI,QAAOjC,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEG,aAAa,MAAK,UAAU,EAAE;QAC/C3B,KAAK,CAAC,8DAA8D,EAAE4E,WAAW,CAAC;QAClF,OAAOpB,IAAI,CAAC,CAAC;MACf;MAEAhC,MAAM,CAACG,aAAa,CAACwC,IAAI,EAAEe,GAAG,EAAE,CAACnC,GAA0B,EAAE4B,EAAY,KAAW;QAClF,IAAIrC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAACkD,OAAO,CAACzC,GAAG,CAAC,EAAE;UAC5C/C,KAAK,CAAC,0BAA0B,EAAE4E,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC/B,GAAG,CAAC;QACtB;QAEA,IAAI4B,EAAE,EAAE;UACN3E,KAAK,CAAC,wBAAwB,EAAE4E,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEA3E,KAAK,CAAC,sCAAsC,EAAE4E,WAAW,CAAC;QAC1DpB,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOiC,gBAAgBA,CAAA,EAAQ;IAC7BzF,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMM,OAAO,GAAG,IAAI,CAACA,OAAO,CAACiD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMmC,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAE1B,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAMzC,MAAM,IAAIlB,OAAO,EAAE;MAC5B,IAAIkB,MAAM,CAACiE,gBAAgB,EAAE;QAC3B,OAAOjE,MAAM,CAACiE,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;IAEA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMvC,IAAI,GAAG,SAAAA,CAAUT,GAAoB,EAAgB;QACzD6C,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ;QACA;QACA;QACA;QACA,IAAIjD,GAAG,EAAE;UACP6C,GAAG,CAACK,WAAW,CAAC/E,KAAK,GAAG6B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAOmC,KAAK,CAAC,CAAC;MAChB,CAAC;;MAED;MACA;MACA;MACA;MACA;;MAEA;MACA,MAAMI,UAAU,GAAG,IAAAP,iCAAyB,EAAC,CAAC;MAC9CC,GAAG,CAACK,WAAW,GAAGC,UAAU;MAC5BL,GAAG,CAACM,MAAM,CAACF,WAAW,GAAGC,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGR,GAAG,CAACS,OAAO;MACrC,IAAI/D,eAAC,CAACQ,KAAK,CAACsD,aAAa,CAAC,EAAE;QAC1BpG,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAOwD,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA8C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrCpG,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAOwD,IAAI,CAACd,gBAAU,CAAC6D,aAAa,CAACxC,eAAS,CAACyC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAEnG,MAAM;QAAEoG;MAAS,CAAC,GAAG,IAAI,CAACrG,MAAM;MAExC,IAAI,IAAAsG,mBAAW,EAACD,QAAQ,CAAC,EAAE;QACzBzG,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAAC2G,mBAAmB,CAACf,GAAG,EAAEa,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,EAAE5C,IAAI,CAAC;MACtE,CAAC,MAAM;QACLxD,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAAC4G,sBAAsB,CAAChB,GAAG,EAAEa,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,EAAE5C,IAAI,CAAC;MACzE;IACF,CAAC;EACH;EAEQoD,sBAAsBA,CAC5BhB,GAAmB,EACnBa,QAAkB,EAClBpG,MAAc,EACd+F,aAAqB,EACrB5C,IAAS,EACH;IACNxD,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAE6G,MAAM;MAAE3D;IAAM,CAAC,GAAG,IAAA4D,4BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;MACtD/G,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAMiH,WAAW,GAAG,IAAAC,8BAAsB,EAAChE,KAAK,CAAC,CAACiE,QAAQ,CAAC,CAAC;MAC5D,MAAM;QAAEhD,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAAkF,4BAAiB,EAACH,WAAW,CAAe;MACvEjH,KAAK,CAAC,mBAAmB,EAAEmE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACR/C,KAAK,CAAC,0BAA0B,CAAC;UACjC4F,GAAG,CAACK,WAAW,GAAG9B,IAAI;UACtBX,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACLxD,KAAK,CAAC,2BAA2B,CAAC;UAClC4F,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7CnC,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL/C,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAMiH,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACArB,GAAG,CAACK,WAAW,GAAGgB,WAAW;QAC7BjH,KAAK,CAAC,0BAA0B,CAAC;QACjCwD,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACAxD,KAAK,CAAC,mBAAmB,CAAC;QAC1BwD,IAAI,CAACd,gBAAU,CAAC4E,YAAY,CAACvD,eAAS,CAACwD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,mBAAmBA,CACzBf,GAAmB,EACnBa,QAAkB,EAClBpG,MAAc,EACd+F,aAAqB,EACrB5C,IAAc,EACR;IAAA,IAAAgE,aAAA;IACNxH,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,0BAA0B,EAAE,OAAOK,MAAM,KAAK,QAAQ,CAAC;IAC7DL,KAAK,CAAC,iCAAiC,EAAE,OAAOoG,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,gCAAwB,EAC/CZ,QAAQ,EACRpG,MAAM,EACN+F,aAAa,GAAAoB,aAAA,GACb,IAAI,CAACpH,MAAM,cAAAoH,aAAA,uBAAXA,aAAA,CAAaC,0BAA0B,CAAC,CAC1C,CAAC;IACDzH,KAAK,CAAC,+BAA+B,EAAEiH,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAEjC,IAAI,CAAC;IACzD,IAAIiC,WAAW,EAAE;MACf,MAAM;QAAE9C,IAAI;QAAEjC;MAAS,CAAC,GAAG+E,WAAW;MACtCjH,KAAK,CAAC,mBAAmB,EAAEmE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACR6C,GAAG,CAACK,WAAW,GAAG9B,IAAI;UACtBnE,KAAK,CAAC,0BAA0B,CAAC;UACjCwD,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACLoC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7C3F,KAAK,CAAC,2BAA2B,CAAC;UAClCwD,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACA/C,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAOwD,IAAI,CAACd,gBAAU,CAAC6D,aAAa,CAACxC,eAAS,CAACyC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQkB,kBAAkBA,CAACzB,WAAwB,EAAW;IAC5D,OAAO3D,eAAC,CAACqF,WAAW,CAAC1B,WAAW,CAAC,KAAK,KAAK,IAAI3D,eAAC,CAACqF,WAAW,CAAC1B,WAAW,aAAXA,WAAW,uBAAXA,WAAW,CAAEjB,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACS4C,kBAAkBA,CAAA,EAAG;IAC1B,OAAO,CAAChC,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAAC4B,kBAAkB,CAAC9B,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,CAAC,CAAC;MAChB;MAEAF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMvC,IAAI,GAAIT,GAA0B,IAAW;QACjD6C,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ,IAAIjD,GAAG,EAAE;UACP6C,GAAG,CAACK,WAAW,CAAC/E,KAAK,GAAG6B,GAAG,CAACY,OAAO;UACnCkC,GAAG,CAACgC,MAAM,CAAC9E,GAAG,CAAC+E,UAAU,CAAC,CAACC,IAAI,CAAChF,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAOmC,KAAK,CAAC,CAAC;MAChB,CAAC;MAED,MAAM;QAAEM;MAAc,CAAC,GAAGR,GAAG,CAACS,OAAO;MACrC,IAAI/D,eAAC,CAACQ,KAAK,CAACsD,aAAa,CAAC,EAAE;QAC1B,OAAO5C,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA8C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAO5C,IAAI,CAACd,gBAAU,CAAC6D,aAAa,CAACxC,eAAS,CAACyC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMtD,KAAK,GAAG,CAACkD,aAAa,IAAI,EAAE,EAAE4B,OAAO,CAAE,GAAEC,kBAAa,GAAE,EAAE,EAAE,CAAC;MACnE,IAAI,CAAC/E,KAAK,EAAE;QACV,OAAOM,IAAI,CAAC,CAAC;MACf;MAEA,IAAIyD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAiB,wBAAgB,EAAChF,KAAK,EAAE,IAAI,CAAC9C,MAAM,CAACC,MAAM,CAAC;MAC3D,CAAC,CAAC,OAAO0C,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAAC2E,kBAAkB,CAACT,WAAW,CAAC,EAAE;QACxC,MAAM;UAAEjC,IAAI;UAAEtB;QAAO,CAAC,GAAGuD,WAAyB;QAClDrB,GAAG,CAACK,WAAW,GAAG,IAAAhC,wBAAgB,EAACe,IAAI,EAAYtB,MAAM,CAAC;MAC5D,CAAC,MAAM;QACLkC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;MAC/C;MAEAnC,IAAI,CAAC,CAAC;IACR,CAAC;EACH;EAEA,MAAa2E,UAAUA,CAAChE,IAAgB,EAAEiE,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAErD,IAAI;MAAEtB;IAAO,CAAC,GAAGS,IAAI;IAC1CnE,KAAK,CAAC,gBAAgB,EAAEgF,IAAI,CAAC;IAC7B,MAAMsD,mBAAmB,GAAGhG,eAAC,CAACQ,KAAK,CAACuF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAGjG,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjC2E,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAGhF,MAAM,CAACiF,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChCtD,IAAI;MACJtB,MAAM,EAAE6E;IACV,CAAC;IACD,MAAMrF,KAAa,GAAG,MAAM,IAAA2F,sBAAW,EAACD,OAAO,EAAE,IAAI,CAACvI,MAAM,EAAE+H,WAAW,CAAC;IAE1E,OAAOlF,KAAK;EACd;;EAEA;AACF;AACA;EACS4F,UAAUA,CAACC,KAAa,EAAiB;IAAA,IAAAC,aAAA;IAC9C;IACA,KAAAA,aAAA,GAAI,IAAI,CAAC5I,MAAM,cAAA4I,aAAA,eAAXA,aAAA,CAAavB,0BAA0B,CAAC,CAAC,EAAE;MAC7CzH,KAAK,CAAC,iCAAiC,CAAC;MACxC,MAAMkD,KAAK,GAAG,IAAA4F,qBAAU,EAACC,KAAK,EAAE,IAAI,CAAC1I,MAAM,CAAC;MAC5C,OAAO6C,KAAK;IACd,CAAC,MAAM;MACLlD,KAAK,CAAC,4CAA4C,CAAC;MACnD;MACA,MAAMkD,KAAK,GAAG,IAAA+F,+BAAoB,EAACC,MAAM,CAACT,IAAI,CAACM,KAAK,CAAC,EAAE,IAAI,CAAC1I,MAAM,CAAC,CAAC8G,QAAQ,CAAC,QAAQ,CAAC;MACtF,OAAOjE,KAAK;IACd;EACF;AACF;AAACiG,OAAA,CAAAjJ,IAAA,GAAAA,IAAA"}

package/build/index.d.ts

@@ -1,2 +1,3 @@
 export { Auth } from './auth';
 export * from './utils';
+export * from './types';

package/build/index.js

@@ -25,4 +25,16 @@ Object.keys(_utils).forEach(function (key) {
     }
   });
 });
+var _types = require("./types");
+Object.keys(_types).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _types[key]) return;
+  Object.defineProperty(exports, key, {
+    enumerable: true,
+    get: function () {
+      return _types[key];
+    }
+  });
+});
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_auth","require","_utils","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get"],"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth';\nexport * from './utils';\n"],"mappings":";;;;;;;;;;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA"}
+{"version":3,"file":"index.js","names":["_auth","require","_utils","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_types"],"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth';\nexport * from './utils';\nexport * from './types';\n"],"mappings":";;;;;;;;;;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AACA,IAAAS,MAAA,GAAAd,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAW,MAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,MAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAC,MAAA,CAAAT,GAAA;IAAA;EAAA;AAAA"}

package/build/signature-legacy.d.ts

@@ -0,0 +1,5 @@
+/// <reference types="node" />
+import { Security } from '@verdaccio/types';
+import { AuthMiddlewarePayload } from './types';
+export declare function parseAESCredentials(authorizationHeader: string, secret: string): string | Buffer | undefined;
+export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string): AuthMiddlewarePayload;

package/build/signature-legacy.js

@@ -0,0 +1,60 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getMiddlewareCredentials = getMiddlewareCredentials;
+exports.parseAESCredentials = parseAESCredentials;
+var _debug = _interopRequireDefault(require("debug"));
+var _lodash = _interopRequireDefault(require("lodash"));
+var _core = require("@verdaccio/core");
+var _signature = require("@verdaccio/signature");
+var _utils = require("./utils");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+const debug = (0, _debug.default)('verdaccio:auth:utils');
+function parseAESCredentials(authorizationHeader, secret) {
+  debug('parseAESCredentials');
+  const {
+    scheme,
+    token
+  } = (0, _utils.parseAuthTokenHeader)(authorizationHeader);
+
+  // basic is deprecated and should not be enforced
+  // basic is currently being used for functional test
+  if (scheme.toUpperCase() === _core.TOKEN_BASIC.toUpperCase()) {
+    debug('legacy header basic');
+    const credentials = (0, _utils.convertPayloadToBase64)(token).toString();
+    return credentials;
+  } else if (scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
+    debug('legacy header bearer');
+    const credentials = (0, _signature.aesDecryptDeprecated)(Buffer.from(token), secret);
+    return credentials;
+  }
+}
+function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
+  debug('getMiddlewareCredentials');
+  // comment out for debugging purposes
+  if ((0, _utils.isAESLegacy)(security)) {
+    debug('is legacy');
+    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    if (typeof credentials !== 'string') {
+      debug('parse legacy credentials failed');
+      return;
+    }
+    const parsedCredentials = (0, _signature.parseBasicPayload)(credentials);
+    if (!parsedCredentials) {
+      debug('parse legacy basic payload credentials failed');
+      return;
+    }
+    return parsedCredentials;
+  }
+  const {
+    scheme,
+    token
+  } = (0, _utils.parseAuthTokenHeader)(authorizationHeader);
+  debug('is jwt');
+  if (_lodash.default.isString(token) && scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
+    return (0, _utils.verifyJWTPayload)(token, secretKey);
+  }
+}
+//# sourceMappingURL=signature-legacy.js.map

package/build/signature-legacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature-legacy.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_signature","_utils","obj","__esModule","default","debug","buildDebug","parseAESCredentials","authorizationHeader","secret","scheme","token","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","Buffer","from","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload"],"sources":["../src/signature-legacy.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';\nimport { aesDecryptDeprecated as aesDecrypt, parseBasicPayload } from '@verdaccio/signature';\nimport { Security } from '@verdaccio/types';\n\nimport { AuthMiddlewarePayload } from './types';\nimport {\n  convertPayloadToBase64,\n  isAESLegacy,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(Buffer.from(token), secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (typeof credentials !== 'string') {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAIA,IAAAI,MAAA,GAAAJ,OAAA;AAKiB,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEzC,SAASC,mBAAmBA,CAACC,mBAA2B,EAAEC,MAAc,EAAE;EAC/EJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEK,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIE,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDR,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMU,WAAW,GAAG,IAAAC,6BAAsB,EAACL,KAAK,CAAC,CAACM,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIL,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DR,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMU,WAAW,GAAG,IAAAI,+BAAU,EAACC,MAAM,CAACC,IAAI,CAACV,KAAK,CAAC,EAAEF,MAAM,CAAC;IAE1D,OAAOM,WAAW;EACpB;AACF;AAEO,SAASO,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBhB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAI,IAAAoB,kBAAW,EAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMU,WAAW,GAAGR,mBAAmB,CAACC,mBAAmB,EAAEgB,SAAS,CAAC;IACvE,IAAI,OAAOT,WAAW,KAAK,QAAQ,EAAE;MACnCV,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMqB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACZ,WAAW,CAAC;IACxD,IAAI,CAACW,iBAAiB,EAAE;MACtBrB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOqB,iBAAiB;EAC1B;EACA,MAAM;IAAEhB,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIuB,eAAC,CAACC,QAAQ,CAAClB,KAAK,CAAC,IAAID,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAO,IAAAiB,uBAAgB,EAACnB,KAAK,EAAEa,SAAS,CAAC;EAC3C;AACF"}

package/build/signature.d.ts

@@ -0,0 +1,4 @@
+import { Security } from '@verdaccio/types';
+import { AuthMiddlewarePayload } from './types';
+export declare function parseAESCredentials(authorizationHeader: string, secret: string): string | void;
+export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string): AuthMiddlewarePayload;

package/build/signature.js

@@ -0,0 +1,60 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getMiddlewareCredentials = getMiddlewareCredentials;
+exports.parseAESCredentials = parseAESCredentials;
+var _debug = _interopRequireDefault(require("debug"));
+var _lodash = _interopRequireDefault(require("lodash"));
+var _core = require("@verdaccio/core");
+var _signature = require("@verdaccio/signature");
+var _utils = require("./utils");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+const debug = (0, _debug.default)('verdaccio:auth:utils');
+function parseAESCredentials(authorizationHeader, secret) {
+  debug('parseAESCredentials');
+  const {
+    scheme,
+    token
+  } = (0, _utils.parseAuthTokenHeader)(authorizationHeader);
+
+  // basic is deprecated and should not be enforced
+  // basic is currently being used for functional test
+  if (scheme.toUpperCase() === _core.TOKEN_BASIC.toUpperCase()) {
+    debug('legacy header basic');
+    const credentials = (0, _utils.convertPayloadToBase64)(token).toString();
+    return credentials;
+  } else if (scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
+    debug('legacy header bearer');
+    const credentials = (0, _signature.aesDecrypt)(token, secret);
+    return credentials;
+  }
+}
+function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
+  debug('getMiddlewareCredentials');
+  // comment out for debugging purposes
+  if ((0, _utils.isAESLegacy)(security)) {
+    debug('is legacy');
+    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    if (!credentials) {
+      debug('parse legacy credentials failed');
+      return;
+    }
+    const parsedCredentials = (0, _signature.parseBasicPayload)(credentials);
+    if (!parsedCredentials) {
+      debug('parse legacy basic payload credentials failed');
+      return;
+    }
+    return parsedCredentials;
+  }
+  const {
+    scheme,
+    token
+  } = (0, _utils.parseAuthTokenHeader)(authorizationHeader);
+  debug('is jwt');
+  if (_lodash.default.isString(token) && scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
+    return (0, _utils.verifyJWTPayload)(token, secretKey);
+  }
+}
+//# sourceMappingURL=signature.js.map

package/build/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_signature","_utils","obj","__esModule","default","debug","buildDebug","parseAESCredentials","authorizationHeader","secret","scheme","token","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload"],"sources":["../src/signature.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload } from '@verdaccio/signature';\nimport { Security } from '@verdaccio/types';\n\nimport { AuthMiddlewarePayload } from './types';\nimport {\n  convertPayloadToBase64,\n  isAESLegacy,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAIA,IAAAI,MAAA,GAAAJ,OAAA;AAKiB,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEzC,SAASC,mBAAmBA,CAACC,mBAA2B,EAAEC,MAAc,EAAE;EAC/EJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEK,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIE,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDR,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMU,WAAW,GAAG,IAAAC,6BAAsB,EAACL,KAAK,CAAC,CAACM,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIL,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DR,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMU,WAAW,GAAG,IAAAI,qBAAU,EAACR,KAAK,EAAEF,MAAM,CAAC;IAE7C,OAAOM,WAAW;EACpB;AACF;AAEO,SAASK,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBd,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAI,IAAAkB,kBAAW,EAACF,QAAQ,CAAC,EAAE;IACzBhB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMU,WAAW,GAAGR,mBAAmB,CAACC,mBAAmB,EAAEc,SAAS,CAAC;IACvE,IAAI,CAACP,WAAW,EAAE;MAChBV,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMmB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACV,WAAW,CAAC;IACxD,IAAI,CAACS,iBAAiB,EAAE;MACtBnB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOmB,iBAAiB;EAC1B;EACA,MAAM;IAAEd,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIqB,eAAC,CAACC,QAAQ,CAAChB,KAAK,CAAC,IAAID,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAO,IAAAe,uBAAgB,EAACjB,KAAK,EAAEW,SAAS,CAAC;EAC3C;AACF"}

package/build/types.d.ts

@@ -0,0 +1,34 @@
+import { NextFunction, Request, Response } from 'express';
+import { VerdaccioError } from '@verdaccio/core';
+import { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
+export interface AESPayload {
+    user: string;
+    password: string;
+}
+export type BasicPayload = AESPayload | void;
+export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
+export interface AuthTokenHeader {
+    scheme: string;
+    token: string;
+}
+export type AllowActionCallbackResponse = boolean | undefined;
+export type AllowActionCallback = (error: VerdaccioError | null, allowed?: AllowActionCallbackResponse) => void;
+export type AllowAction = (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback) => void;
+export interface TokenEncryption {
+    jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
+    aesEncrypt(buf: string): string | void;
+}
+export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
+export interface IAuthMiddleware {
+    apiJWTmiddleware(): $NextFunctionVer;
+    webUIJWTmiddleware(): $NextFunctionVer;
+}
+export type $RequestExtend = Request & {
+    remote_user?: any;
+    log: Logger;
+};
+export type $ResponseExtend = Response & {
+    cookies?: any;
+};
+export type $NextFunctionVer = NextFunction & any;
+export { NextFunction };

package/build/types.js

@@ -0,0 +1,13 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "NextFunction", {
+  enumerable: true,
+  get: function () {
+    return _express.NextFunction;
+  }
+});
+var _express = require("express");
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":["_express","require"],"sources":["../src/types.ts"],"sourcesContent":["import { NextFunction, Request, Response } from 'express';\n\nimport { VerdaccioError } from '@verdaccio/core';\nimport { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\n// remove\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\nexport { NextFunction };\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA"}

package/build/utils.d.ts

@@ -1,23 +1,14 @@
 /// <reference types="node" />
-import { VerdaccioError, pluginUtils } from '@verdaccio/core';
-import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
-import { AESPayload, TokenEncryption } from './auth';
-export type BasicPayload = AESPayload | void;
-export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
-export interface AuthTokenHeader {
-    scheme: string;
-    token: string;
-}
-export type AllowActionCallbackResponse = boolean | undefined;
-export type AllowActionCallback = (error: VerdaccioError | null, allowed?: AllowActionCallbackResponse) => void;
-export type AllowAction = (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback) => void;
+import { pluginUtils } from '@verdaccio/core';
+import { Config, Logger, RemoteUser, Security } from '@verdaccio/types';
+import { ActionsAllowed, AllowAction, AuthMiddlewarePayload, AuthTokenHeader, TokenEncryption } from './types';
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token
  */
 export declare function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader;
-export declare function parseAESCredentials(authorizationHeader: string, secret: string): string | void;
-export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string): AuthMiddlewarePayload;
+export declare function parseAESCredentials(authorizationHeader: string, secret: string, enhanced: boolean): string | void;
+export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string, enhanced?: boolean): AuthMiddlewarePayload;
 export declare function isAESLegacy(security: Security): boolean;
 export declare function getApiToken(auth: TokenEncryption, config: Config, remoteUser: RemoteUser, aesPassword: string): Promise<string | void>;
 export declare const expireReasons: string[];
@@ -29,7 +20,6 @@ export declare function isAuthHeaderValid(authorization: string): boolean;
  * @returns object of default implementations.
  */
 export declare function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config>;
-export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
 export declare function allow_action(action: ActionsAllowed, logger: Logger): AllowAction;
 /**
  *

package/build/utils.js

@@ -23,6 +23,7 @@ var _core = require("@verdaccio/core");
 var _signature = require("@verdaccio/signature");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:auth:utils');
+
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token
@@ -35,7 +36,7 @@ function parseAuthTokenHeader(authorizationHeader) {
     token
   };
 }
-function parseAESCredentials(authorizationHeader, secret) {
+function parseAESCredentials(authorizationHeader, secret, enhanced) {
   debug('parseAESCredentials');
   const {
     scheme,
@@ -50,16 +51,19 @@ function parseAESCredentials(authorizationHeader, secret) {
     return credentials;
   } else if (scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
     debug('legacy header bearer');
-    const credentials = (0, _signature.aesDecrypt)(token, secret);
+    debug('legacy header enhanced?', enhanced);
+    const credentials = enhanced ? (0, _signature.aesDecrypt)(token.toString(), secret) :
+    // FUTURE: once deprecated legacy is removed this logic won't be longer need it
+    (0, _signature.aesDecryptDeprecated)(convertPayloadToBase64(token), secret).toString('utf-8');
     return credentials;
   }
 }
-function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
+function getMiddlewareCredentials(security, secretKey, authorizationHeader, enhanced = true) {
   debug('getMiddlewareCredentials');
   // comment out for debugging purposes
   if (isAESLegacy(security)) {
     debug('is legacy');
-    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    const credentials = parseAESCredentials(authorizationHeader, secretKey, enhanced);
     if (!credentials) {
       debug('parse legacy credentials failed');
       return;
@@ -109,8 +113,7 @@ async function getApiToken(auth, config, remoteUser, aesPassword) {
     resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
   });
 }
-const expireReasons = ['JsonWebTokenError', 'TokenExpiredError'];
-exports.expireReasons = expireReasons;
+const expireReasons = exports.expireReasons = ['JsonWebTokenError', 'TokenExpiredError'];
 function verifyJWTPayload(token, secret) {
   try {
     const payload = (0, _signature.verifyPayload)(token, secret);
@@ -138,12 +141,13 @@ function isAuthHeaderValid(authorization) {
 function getDefaultPlugins(logger) {
   return {
     authenticate(_user, _password, cb) {
+      debug('triggered default authenticate method');
       cb(_core.errorUtils.getForbidden(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
     adduser(_user, _password, cb) {
+      debug('triggered default adduser method');
       return cb(_core.errorUtils.getConflict(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
-    // FIXME: allow_action and allow_publish should be in the @verdaccio/types
     // @ts-ignore
     allow_access: allow_action('access', logger),
     // @ts-ignore
@@ -160,8 +164,13 @@ function allow_action(action, logger) {
       name,
       groups
     } = user;
+    debug('allow_action "%s": groups %s', action, groups);
     const groupAccess = pkg[action];
-    const hasPermission = groupAccess.some(group => name === group || groups.includes(group));
+    debug('allow_action "%s": groupAccess %s', action, groupAccess);
+    const hasPermission = groupAccess.some(group => {
+      return name === group || groups.includes(group);
+    });
+    debug('package "%s" has permission "%s"', name, hasPermission);
     logger.trace({
       pkgName: pkg.name,
       hasPermission,
@@ -189,7 +198,8 @@ function handleSpecialUnpublish(logger) {
   return function (user, pkg, callback) {
     const action = 'unpublish';
     // verify whether the unpublish prop has been defined
-    const isUnpublishMissing = _lodash.default.isNil(pkg[action]);
+    const isUnpublishMissing = !pkg[action];
+    debug('is unpublish method missing ? %s', isUnpublishMissing);
     const hasGroups = isUnpublishMissing ? false : pkg[action].length > 0;
     logger.trace({
       user: user.name,