@verdaccio/auth 7.0.0-next.4 → 7.0.0-next.5

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":["_express","require"],"sources":["../src/types.ts"],"sourcesContent":["import { NextFunction, Request, Response } from 'express';\n\nimport { VerdaccioError } from '@verdaccio/core';\nimport { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\n// remove\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\nexport { NextFunction };\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA"}

package/build/utils.d.ts

@@ -1,23 +1,14 @@
 /// <reference types="node" />
-import { VerdaccioError, pluginUtils } from '@verdaccio/core';
-import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
-import { AESPayload, TokenEncryption } from './auth';
-export type BasicPayload = AESPayload | void;
-export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
-export interface AuthTokenHeader {
-    scheme: string;
-    token: string;
-}
-export type AllowActionCallbackResponse = boolean | undefined;
-export type AllowActionCallback = (error: VerdaccioError | null, allowed?: AllowActionCallbackResponse) => void;
-export type AllowAction = (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback) => void;
+import { pluginUtils } from '@verdaccio/core';
+import { Config, Logger, RemoteUser, Security } from '@verdaccio/types';
+import { ActionsAllowed, AllowAction, AuthMiddlewarePayload, AuthTokenHeader, TokenEncryption } from './types';
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token
  */
 export declare function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader;
-export declare function parseAESCredentials(authorizationHeader: string, secret: string): string | void;
-export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string): AuthMiddlewarePayload;
+export declare function parseAESCredentials(authorizationHeader: string, secret: string, enhanced: boolean): string | void;
+export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string, enhanced?: boolean): AuthMiddlewarePayload;
 export declare function isAESLegacy(security: Security): boolean;
 export declare function getApiToken(auth: TokenEncryption, config: Config, remoteUser: RemoteUser, aesPassword: string): Promise<string | void>;
 export declare const expireReasons: string[];
@@ -29,7 +20,6 @@ export declare function isAuthHeaderValid(authorization: string): boolean;
  * @returns object of default implementations.
  */
 export declare function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config>;
-export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
 export declare function allow_action(action: ActionsAllowed, logger: Logger): AllowAction;
 /**
  *

package/build/utils.js

@@ -23,6 +23,7 @@ var _core = require("@verdaccio/core");
 var _signature = require("@verdaccio/signature");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:auth:utils');
+
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token
@@ -35,7 +36,7 @@ function parseAuthTokenHeader(authorizationHeader) {
     token
   };
 }
-function parseAESCredentials(authorizationHeader, secret) {
+function parseAESCredentials(authorizationHeader, secret, enhanced) {
   debug('parseAESCredentials');
   const {
     scheme,
@@ -50,16 +51,19 @@ function parseAESCredentials(authorizationHeader, secret) {
     return credentials;
   } else if (scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
     debug('legacy header bearer');
-    const credentials = (0, _signature.aesDecrypt)(token, secret);
+    debug('legacy header enhanced?', enhanced);
+    const credentials = enhanced ? (0, _signature.aesDecrypt)(token.toString(), secret) :
+    // FUTURE: once deprecated legacy is removed this logic won't be longer need it
+    (0, _signature.aesDecryptDeprecated)(convertPayloadToBase64(token), secret).toString('utf-8');
     return credentials;
   }
 }
-function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
+function getMiddlewareCredentials(security, secretKey, authorizationHeader, enhanced = true) {
   debug('getMiddlewareCredentials');
   // comment out for debugging purposes
   if (isAESLegacy(security)) {
     debug('is legacy');
-    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    const credentials = parseAESCredentials(authorizationHeader, secretKey, enhanced);
     if (!credentials) {
       debug('parse legacy credentials failed');
       return;
@@ -137,12 +141,13 @@ function isAuthHeaderValid(authorization) {
 function getDefaultPlugins(logger) {
   return {
     authenticate(_user, _password, cb) {
+      debug('triggered default authenticate method');
       cb(_core.errorUtils.getForbidden(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
     adduser(_user, _password, cb) {
+      debug('triggered default adduser method');
       return cb(_core.errorUtils.getConflict(_core.API_ERROR.BAD_USERNAME_PASSWORD));
     },
-    // FIXME: allow_action and allow_publish should be in the @verdaccio/types
     // @ts-ignore
     allow_access: allow_action('access', logger),
     // @ts-ignore
@@ -159,8 +164,13 @@ function allow_action(action, logger) {
       name,
       groups
     } = user;
+    debug('allow_action "%s": groups %s', action, groups);
     const groupAccess = pkg[action];
-    const hasPermission = groupAccess.some(group => name === group || groups.includes(group));
+    debug('allow_action "%s": groupAccess %s', action, groupAccess);
+    const hasPermission = groupAccess.some(group => {
+      return name === group || groups.includes(group);
+    });
+    debug('package "%s" has permission "%s"', name, hasPermission);
     logger.trace({
       pkgName: pkg.name,
       hasPermission,
@@ -188,7 +198,8 @@ function handleSpecialUnpublish(logger) {
   return function (user, pkg, callback) {
     const action = 'unpublish';
     // verify whether the unpublish prop has been defined
-    const isUnpublishMissing = _lodash.default.isNil(pkg[action]);
+    const isUnpublishMissing = !pkg[action];
+    debug('is unpublish method missing ? %s', isUnpublishMissing);
     const hasGroups = isUnpublishMissing ? false : pkg[action].length > 0;
     logger.trace({
       user: user.name,

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["_debug","_interopRequireDefault","require","_lodash","_config","_core","_signature","obj","__esModule","default","debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","exports","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport { AESPayload, TokenEncryption } from './auth';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(token, secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // FIXME: allow_action and allow_publish should be in the @verdaccio/types\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    const groupAccess = pkg[action] as string[];\n    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = _.isNil(pkg[action]);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AASA,IAAAI,UAAA,GAAAJ,OAAA;AAAoF,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAKpF,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAqBhD;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,mBAA2B,EAAmB;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,MAAM,CAACC,MAAM,EAAEC,KAAK,CAAC,GAAGH,KAAK;EAE7B,OAAO;IAAEE,MAAM;IAAEC;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmBA,CAACL,mBAA2B,EAAEM,MAAc,EAAE;EAC/ET,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEM,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIG,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDV,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAK,CAAC,CAACO,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIN,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DV,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMY,WAAW,GAAG,IAAAI,qBAAU,EAACT,KAAK,EAAEE,MAAM,CAAC;IAE7C,OAAOG,WAAW;EACpB;AACF;AAEO,SAASK,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBhB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAIoB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAmB,EAAEgB,SAAS,CAAC;IACvE,IAAI,CAACP,WAAW,EAAE;MAChBZ,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMqB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACV,WAAW,CAAC;IACxD,IAAI,CAACS,iBAAiB,EAAE;MACtBrB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOqB,iBAAiB;EAC1B;EACA,MAAM;IAAEf,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIuB,eAAC,CAACC,QAAQ,CAACjB,KAAK,CAAC,IAAID,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAOe,gBAAgB,CAAClB,KAAK,EAAEY,SAAS,CAAC;EAC3C;AACF;AAEO,SAASC,WAAWA,CAACF,QAAkB,EAAW;EACvD,MAAM;IAAEQ,MAAM;IAAEC;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAEpC,OAAOL,eAAC,CAACM,KAAK,CAACH,MAAM,CAAC,KAAK,KAAK,IAAIH,eAAC,CAACM,KAAK,CAACF,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAEO,eAAeI,WAAWA,CAC/BC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB,EACK;EACxBlC,KAAK,CAAC,eAAe,CAAC;EACtB,MAAM;IAAEkB;EAAS,CAAC,GAAGc,MAAM;EAE3B,IAAIZ,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,yBAAyB,CAAC;IAChC;IACA,OAAO,MAAM,IAAImC,OAAO,CAAEC,OAAO,IAAW;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;EACJ;EACA,MAAM;IAAEP;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAE5B,IAAID,GAAG,aAAHA,GAAG,eAAHA,GAAG,CAAEa,IAAI,EAAE;IACb,OAAO,MAAMT,IAAI,CAACU,UAAU,CAACR,UAAU,EAAEN,GAAG,CAACa,IAAI,CAAC;EACpD;EACA,OAAO,MAAM,IAAIL,OAAO,CAAEC,OAAO,IAAW;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;AACJ;AAEO,MAAMQ,aAAuB,GAAAC,OAAA,CAAAD,aAAA,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAE1E,SAASjB,gBAAgBA,CAAClB,KAAa,EAAEE,MAAc,EAAc;EAC1E,IAAI;IACF,MAAMmC,OAAmB,GAAG,IAAAC,wBAAa,EAACtC,KAAK,EAAEE,MAAM,CAAC;IAExD,OAAOmC,OAAO;EAChB,CAAC,CAAC,OAAOE,KAAU,EAAE;IACnB;IACA,IAAIJ,aAAa,CAACK,QAAQ,CAACD,KAAK,CAACP,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAS,iCAAyB,EAAC,CAAC;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiBA,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAAClD,KAAK,CAAC,GAAG,CAAC,CAACmD,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACC,MAAc,EAA4B;EAC1E,OAAO;IACLC,YAAYA,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjFA,EAAE,CAACb,gBAAU,CAACc,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAOA,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChF,OAAOA,EAAE,CAACb,gBAAU,CAACkB,WAAW,CAACH,eAAS,CAACC,qBAAqB,CAAC,CAAC;IACpE,CAAC;IAED;IACA;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEX,MAAM,CAAC;IAC5C;IACAY,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEX,MAAM,CAAC;IAC9Ca,eAAe,EAAEC,sBAAsB,CAACd,MAAM;EAChD,CAAC;AACH;AAIO,SAASW,YAAYA,CAACI,MAAsB,EAAEf,MAAc,EAAe;EAChF,OAAO,SAASgB,mBAAmBA,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNnB,MAAM,CAACoB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAACpC;IAAK,CAAC,EAAG,sCAAqC,CAAC;IAC3E,MAAM;MAAEA,IAAI;MAAEyC;IAAO,CAAC,GAAGL,IAAI;IAC7B,MAAMM,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3C,MAAMS,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAEC,KAAK,IAAK7C,IAAI,KAAK6C,KAAK,IAAIJ,MAAM,CAACjC,QAAQ,CAACqC,KAAK,CAAC,CAAC;IAC3F1B,MAAM,CAACoB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACrC,IAAI;MAAE2C,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAACpC,IAAI;MAAE0C;IAAY,CAAC,EACnE,+FACH,CAAC;IAED,IAAIC,aAAa,EAAE;MACjBxB,MAAM,CAACoB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAACpC;MAAK,CAAC,EAAG,iDAAgD,CAAC;MACtF,OAAOsC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAItC,IAAI,EAAE;MACRsC,QAAQ,CACN5B,gBAAU,CAACc,YAAY,CAAE,QAAOxB,IAAK,sBAAqBkC,MAAO,YAAWG,GAAG,CAACrC,IAAK,EAAC,CACxF,CAAC;IACH,CAAC,MAAM;MACLsC,QAAQ,CACN5B,gBAAU,CAACqC,eAAe,CAAE,6BAA4Bb,MAAO,YAAWG,GAAG,CAACrC,IAAK,EAAC,CACtF,CAAC;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAASiC,sBAAsBA,CAACd,MAAc,EAAO;EAC1D,OAAO,UAAUiB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,MAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,MAAMc,kBAA2B,GAAGhE,eAAC,CAACM,KAAK,CAAC+C,GAAG,CAACH,MAAM,CAAC,CAAC;IACxD,MAAMe,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIX,GAAG,CAACH,MAAM,CAAC,CAAcjB,MAAM,GAAG,CAAC;IAC5FE,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACpC,IAAI;MAAEA,IAAI,EAAEqC,GAAG,CAACrC,IAAI;MAAEiD;IAAU,CAAC,EAC7C,qEACH,CAAC;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOX,QAAQ,CAAC,IAAI,EAAEY,SAAS,CAAC;IAClC;IAEA/B,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACpC,IAAI;MAAEA,IAAI,EAAEqC,GAAG,CAACrC,IAAI;MAAEkC,MAAM;MAAEe;IAAU,CAAC,EACrD,6EACH,CAAC;IACD,OAAOnB,YAAY,CAACI,MAAM,EAAEf,MAAM,CAAC,CAACiB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAASvC,SAASA,CAACC,IAAY,EAAEmD,QAAgB,EAAU;EAChE,OAAOC,MAAM,CAAE,GAAEpD,IAAK,IAAGmD,QAAS,EAAC,CAAC;AACtC;AAEO,SAAS7E,sBAAsBA,CAAC+B,OAAe,EAAU;EAC9D,OAAOgD,MAAM,CAACC,IAAI,CAACjD,OAAO,EAAE,QAAQ,CAAC;AACvC"}
+{"version":3,"file":"utils.js","names":["_debug","_interopRequireDefault","require","_lodash","_config","_core","_signature","obj","__esModule","default","debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","enhanced","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","aesDecryptDeprecated","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","exports","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","length","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","getConflict","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport {\n  aesDecrypt,\n  aesDecryptDeprecated,\n  parseBasicPayload,\n  verifyPayload,\n} from '@verdaccio/signature';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(\n  authorizationHeader: string,\n  secret: string,\n  enhanced: boolean\n) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    debug('legacy header enhanced?', enhanced);\n    const credentials = enhanced\n      ? aesDecrypt(token.toString(), secret)\n      : // FUTURE: once deprecated legacy is removed this logic won't be longer need it\n        aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string,\n  enhanced: boolean = true\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey, enhanced);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,UAAA,GAAAJ,OAAA;AAK8B,SAAAD,uBAAAM,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAY9B,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,mBAA2B,EAAmB;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,MAAM,CAACC,MAAM,EAAEC,KAAK,CAAC,GAAGH,KAAK;EAE7B,OAAO;IAAEE,MAAM;IAAEC;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmBA,CACjCL,mBAA2B,EAC3BM,MAAc,EACdC,QAAiB,EACjB;EACAV,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEM,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIG,MAAM,CAACK,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDX,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMa,WAAW,GAAGC,sBAAsB,CAACP,KAAK,CAAC,CAACQ,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIP,MAAM,CAACK,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DX,KAAK,CAAC,sBAAsB,CAAC;IAC7BA,KAAK,CAAC,yBAAyB,EAAEU,QAAQ,CAAC;IAC1C,MAAMG,WAAW,GAAGH,QAAQ,GACxB,IAAAO,qBAAU,EAACV,KAAK,CAACQ,QAAQ,CAAC,CAAC,EAAEN,MAAM,CAAC;IACpC;IACA,IAAAS,+BAAoB,EAACJ,sBAAsB,CAACP,KAAK,CAAC,EAAEE,MAAM,CAAC,CAACM,QAAQ,CAAC,OAAO,CAAC;IAEjF,OAAOF,WAAW;EACpB;AACF;AAEO,SAASM,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBlB,mBAA2B,EAC3BO,QAAiB,GAAG,IAAI,EACD;EACvBV,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAIsB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBpB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMa,WAAW,GAAGL,mBAAmB,CAACL,mBAAmB,EAAEkB,SAAS,EAAEX,QAAQ,CAAC;IACjF,IAAI,CAACG,WAAW,EAAE;MAChBb,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMuB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACX,WAAW,CAAC;IACxD,IAAI,CAACU,iBAAiB,EAAE;MACtBvB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOuB,iBAAiB;EAC1B;EACA,MAAM;IAAEjB,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIyB,eAAC,CAACC,QAAQ,CAACnB,KAAK,CAAC,IAAID,MAAM,CAACK,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAOgB,gBAAgB,CAACpB,KAAK,EAAEc,SAAS,CAAC;EAC3C;AACF;AAEO,SAASC,WAAWA,CAACF,QAAkB,EAAW;EACvD,MAAM;IAAEQ,MAAM;IAAEC;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAEpC,OAAOL,eAAC,CAACM,KAAK,CAACH,MAAM,CAAC,KAAK,KAAK,IAAIH,eAAC,CAACM,KAAK,CAACF,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAEO,eAAeI,WAAWA,CAC/BC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB,EACK;EACxBpC,KAAK,CAAC,eAAe,CAAC;EACtB,MAAM;IAAEoB;EAAS,CAAC,GAAGc,MAAM;EAE3B,IAAIZ,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBpB,KAAK,CAAC,yBAAyB,CAAC;IAChC;IACA,OAAO,MAAM,IAAIqC,OAAO,CAAEC,OAAO,IAAW;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;EACJ;EACA,MAAM;IAAEP;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAE5B,IAAID,GAAG,aAAHA,GAAG,eAAHA,GAAG,CAAEa,IAAI,EAAE;IACb,OAAO,MAAMT,IAAI,CAACU,UAAU,CAACR,UAAU,EAAEN,GAAG,CAACa,IAAI,CAAC;EACpD;EACA,OAAO,MAAM,IAAIL,OAAO,CAAEC,OAAO,IAAW;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;AACJ;AAEO,MAAMQ,aAAuB,GAAAC,OAAA,CAAAD,aAAA,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAE1E,SAASjB,gBAAgBA,CAACpB,KAAa,EAAEE,MAAc,EAAc;EAC1E,IAAI;IACF,MAAMqC,OAAmB,GAAG,IAAAC,wBAAa,EAACxC,KAAK,EAAEE,MAAM,CAAC;IAExD,OAAOqC,OAAO;EAChB,CAAC,CAAC,OAAOE,KAAU,EAAE;IACnB;IACA,IAAIJ,aAAa,CAACK,QAAQ,CAACD,KAAK,CAACP,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAS,iCAAyB,EAAC,CAAC;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiBA,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAACpD,KAAK,CAAC,GAAG,CAAC,CAACqD,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAACC,MAAc,EAA4B;EAC1E,OAAO;IACLC,YAAYA,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjFhE,KAAK,CAAC,uCAAuC,CAAC;MAC9CgE,EAAE,CAACb,gBAAU,CAACc,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAOA,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChFhE,KAAK,CAAC,kCAAkC,CAAC;MACzC,OAAOgE,EAAE,CAACb,gBAAU,CAACkB,WAAW,CAACH,eAAS,CAACC,qBAAqB,CAAC,CAAC;IACpE,CAAC;IAED;IACAG,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEX,MAAM,CAAC;IAC5C;IACAY,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEX,MAAM,CAAC;IAC9Ca,eAAe,EAAEC,sBAAsB,CAACd,MAAM;EAChD,CAAC;AACH;AAEO,SAASW,YAAYA,CAACI,MAAsB,EAAEf,MAAc,EAAe;EAChF,OAAO,SAASgB,mBAAmBA,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNnB,MAAM,CAACoB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAACpC;IAAK,CAAC,EAAG,sCAAqC,CAAC;IAC3E,MAAM;MAAEA,IAAI;MAAEyC;IAAO,CAAC,GAAGL,IAAI;IAC7B7E,KAAK,CAAC,8BAA8B,EAAE2E,MAAM,EAAEO,MAAM,CAAC;IACrD,MAAMC,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3C3E,KAAK,CAAC,mCAAmC,EAAE2E,MAAM,EAAEQ,WAAW,CAAC;IAC/D,MAAMC,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAEC,KAAK,IAAK;MAChD,OAAO7C,IAAI,KAAK6C,KAAK,IAAIJ,MAAM,CAACjC,QAAQ,CAACqC,KAAK,CAAC;IACjD,CAAC,CAAC;IACFtF,KAAK,CAAC,kCAAkC,EAAEyC,IAAI,EAAE2C,aAAa,CAAC;IAC9DxB,MAAM,CAACoB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACrC,IAAI;MAAE2C,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAACpC,IAAI;MAAE0C;IAAY,CAAC,EACnE,+FACH,CAAC;IAED,IAAIC,aAAa,EAAE;MACjBxB,MAAM,CAACoB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAACpC;MAAK,CAAC,EAAG,iDAAgD,CAAC;MACtF,OAAOsC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAItC,IAAI,EAAE;MACRsC,QAAQ,CACN5B,gBAAU,CAACc,YAAY,CAAE,QAAOxB,IAAK,sBAAqBkC,MAAO,YAAWG,GAAG,CAACrC,IAAK,EAAC,CACxF,CAAC;IACH,CAAC,MAAM;MACLsC,QAAQ,CACN5B,gBAAU,CAACqC,eAAe,CAAE,6BAA4Bb,MAAO,YAAWG,GAAG,CAACrC,IAAK,EAAC,CACtF,CAAC;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAASiC,sBAAsBA,CAACd,MAAc,EAAO;EAC1D,OAAO,UAAUiB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,MAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,MAAMc,kBAA2B,GAAG,CAACX,GAAG,CAACH,MAAM,CAAC;IAChD3E,KAAK,CAAC,kCAAkC,EAAEyF,kBAAkB,CAAC;IAC7D,MAAMC,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIX,GAAG,CAACH,MAAM,CAAC,CAAcjB,MAAM,GAAG,CAAC;IAC5FE,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACpC,IAAI;MAAEA,IAAI,EAAEqC,GAAG,CAACrC,IAAI;MAAEiD;IAAU,CAAC,EAC7C,qEACH,CAAC;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOX,QAAQ,CAAC,IAAI,EAAEY,SAAS,CAAC;IAClC;IAEA/B,MAAM,CAACoB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACpC,IAAI;MAAEA,IAAI,EAAEqC,GAAG,CAACrC,IAAI;MAAEkC,MAAM;MAAEe;IAAU,CAAC,EACrD,6EACH,CAAC;IACD,OAAOnB,YAAY,CAACI,MAAM,EAAEf,MAAM,CAAC,CAACiB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAASvC,SAASA,CAACC,IAAY,EAAEmD,QAAgB,EAAU;EAChE,OAAOC,MAAM,CAAE,GAAEpD,IAAK,IAAGmD,QAAS,EAAC,CAAC;AACtC;AAEO,SAAS9E,sBAAsBA,CAACgC,OAAe,EAAU;EAC9D,OAAOgD,MAAM,CAACC,IAAI,CAACjD,OAAO,EAAE,QAAQ,CAAC;AACvC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -29,19 +29,21 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next.4",
-    "@verdaccio/config": "7.0.0-next.4",
-    "@verdaccio/loaders": "7.0.0-next.4",
-    "@verdaccio/logger": "7.0.0-next.4",
-    "@verdaccio/signature": "7.0.0-next.2",
-    "@verdaccio/utils": "7.0.0-next.4",
+    "@verdaccio/core": "7.0.0-next.5",
+    "@verdaccio/config": "7.0.0-next.5",
+    "@verdaccio/loaders": "7.0.0-next.5",
+    "@verdaccio/logger": "7.0.0-next.5",
+    "@verdaccio/signature": "7.0.0-next.3",
+    "@verdaccio/utils": "7.0.0-next.5",
     "debug": "4.3.4",
-    "express": "4.18.2",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "12.0.0-next.4"
+    "verdaccio-htpasswd": "12.0.0-next.5"
   },
   "devDependencies": {
-    "@verdaccio/types": "12.0.0-next.1"
+    "express": "4.18.2",
+    "supertest": "6.3.3",
+    "@verdaccio/middleware": "7.0.0-next.5",
+    "@verdaccio/types": "12.0.0-next.2"
   },
   "funding": {
     "type": "opencollective",

package/src/auth.ts

@@ -1,5 +1,4 @@
 import buildDebug from 'debug';
-import { NextFunction, Request, Response } from 'express';
 import _ from 'lodash';
 import { HTPasswd } from 'verdaccio-htpasswd';
 
@@ -12,22 +11,36 @@ import {
   VerdaccioError,
   errorUtils,
   pluginUtils,
+  warningUtils,
 } from '@verdaccio/core';
+import '@verdaccio/core';
 import { asyncLoadPlugin } from '@verdaccio/loaders';
 import { logger } from '@verdaccio/logger';
-import { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';
+import {
+  aesEncrypt,
+  aesEncryptDeprecated,
+  parseBasicPayload,
+  signPayload,
+} from '@verdaccio/signature';
 import {
   AllowAccess,
   Callback,
   Config,
   JWTSignOptions,
-  Logger,
   PackageAccess,
   RemoteUser,
   Security,
 } from '@verdaccio/types';
 import { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';
 
+import {
+  $RequestExtend,
+  $ResponseExtend,
+  AESPayload,
+  IAuthMiddleware,
+  NextFunction,
+  TokenEncryption,
+} from './types';
 import {
   convertPayloadToBase64,
   getDefaultPlugins,
@@ -40,25 +53,6 @@ import {
 
 const debug = buildDebug('verdaccio:auth');
 
-export interface TokenEncryption {
-  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
-  aesEncrypt(buf: string): string | void;
-}
-
-// remove
-export interface AESPayload {
-  user: string;
-  password: string;
-}
-export interface IAuthMiddleware {
-  apiJWTmiddleware(): $NextFunctionVer;
-  webUIJWTmiddleware(): $NextFunctionVer;
-}
-
-export type $RequestExtend = Request & { remote_user?: any; log: Logger };
-export type $ResponseExtend = Response & { cookies?: any };
-export type $NextFunctionVer = NextFunction & any;
-
 class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   public config: Config;
   public secret: string;
@@ -75,6 +69,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
   public async init() {
     let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];
+
     debug('auth plugins found %s', plugins.length);
     if (!plugins || plugins.length === 0) {
       plugins = this.loadDefaultPlugin();
@@ -226,29 +221,32 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     debug('add user %o', user);
 
     (function next(): void {
+      let method = 'adduser';
       const plugin = plugins.shift() as pluginUtils.Auth<Config>;
-      if (typeof plugin.adduser !== 'function') {
+      // @ts-expect-error future major (7.x) should remove this section
+      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
+        method = 'add_user';
+        warningUtils.emit(warningUtils.Codes.VERWAR006);
+      }
+      // @ts-ignore
+      if (typeof plugin[method] !== 'function') {
         next();
       } else {
-        // @ts-expect-error future major (7.x) should remove this section
-        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
-          throw errorUtils.getInternalError(
-            'add_user method not longer supported, rename to adduser'
-          );
-        }
-
-        plugin.adduser(
+        // TODO: replace by adduser whenever add_user deprecation method has been removed
+        // @ts-ignore
+        plugin[method](
           user,
           password,
           function (err: VerdaccioError | null, ok?: boolean | string): void {
             if (err) {
-              debug('the user  %o could not being added. Error: %o', user, err?.message);
+              debug('the user %o could not being added. Error: %o', user, err?.message);
               return cb(err);
             }
             if (ok) {
               debug('the user %o has been added', user);
               return self.authenticate(user, password, cb);
             }
+            debug('user could not be added, skip to next auth plugin');
             next();
           }
         );
@@ -375,7 +373,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     })();
   }
 
-  public apiJWTmiddleware() {
+  public apiJWTmiddleware(): any {
     debug('jwt middleware');
     const plugins = this.plugins.slice(0);
     const helpers = { createAnonymousRemoteUser, createRemoteUser };
@@ -387,8 +385,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
     return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {
       req.pause();
-
-      const next = function (err?: VerdaccioError): any {
+      const next = function (err?: VerdaccioError): NextFunction {
         req.resume();
         // uncomment this to reject users with bad auth headers
         // return _next.apply(null, arguments)
@@ -398,13 +395,14 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
           req.remote_user.error = err.message;
         }
 
-        return _next();
+        return _next() as unknown as NextFunction;
       };
 
-      if (this._isRemoteUserValid(req.remote_user)) {
-        debug('jwt has a valid authentication header');
-        return next();
-      }
+      // FUTURE: disabled, not removed yet but seems unreacable code
+      // if (this._isRemoteUserValid(req.remote_user)) {
+      //   debug('jwt has a valid authentication header');
+      //   return next();
+      // }
 
       // in case auth header does not exist we return anonymous function
       const remoteUser = createAnonymousRemoteUser();
@@ -425,20 +423,20 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
       if (isAESLegacy(security)) {
         debug('api middleware using legacy auth token');
-        this._handleAESMiddleware(req, security, secret, authorization, next);
+        this.handleAESMiddleware(req, security, secret, authorization, next);
       } else {
         debug('api middleware using JWT auth token');
-        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);
+        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);
       }
     };
   }
 
-  private _handleJWTAPIMiddleware(
+  private handleJWTAPIMiddleware(
     req: $RequestExtend,
     security: Security,
     secret: string,
     authorization: string,
-    next: Function
+    next: any
   ): void {
     debug('handle JWT api middleware');
     const { scheme, token } = parseAuthTokenHeader(authorization);
@@ -475,7 +473,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     }
   }
 
-  private _handleAESMiddleware(
+  private handleAESMiddleware(
     req: $RequestExtend,
     security: Security,
     secret: string,
@@ -485,7 +483,12 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     debug('handle legacy api middleware');
     debug('api middleware secret %o', typeof secret === 'string');
     debug('api middleware authorization %o', typeof authorization === 'string');
-    const credentials: any = getMiddlewareCredentials(security, secret, authorization);
+    const credentials: any = getMiddlewareCredentials(
+      security,
+      secret,
+      authorization,
+      this.config?.getEnhancedLegacySignature()
+    );
     debug('api middleware credentials %o', credentials?.name);
     if (credentials) {
       const { user, password } = credentials;
@@ -515,7 +518,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   /**
    * JWT middleware for WebUI
    */
-  public webUIJWTmiddleware(): $NextFunctionVer {
+  public webUIJWTmiddleware() {
     return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {
       if (this._isRemoteUserValid(req.remote_user)) {
         return _next();
@@ -525,7 +528,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
       const next = (err: VerdaccioError | void): void => {
         req.resume();
         if (err) {
-          // req.remote_user.error = err.message;
+          req.remote_user.error = err.message;
           res.status(err.statusCode).send(err.message);
         }
 
@@ -576,7 +579,6 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
       name,
       groups: groupedGroups,
     };
-
     const token: string = await signPayload(payload, this.secret, signOptions);
 
     return token;
@@ -586,7 +588,17 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
    * Encrypt a string.
    */
   public aesEncrypt(value: string): string | void {
-    return aesEncrypt(value, this.secret);
+    // enhancedLegacySignature enables modern aes192 algorithm signature
+    if (this.config?.getEnhancedLegacySignature()) {
+      debug('signing with enhaced aes legacy');
+      const token = aesEncrypt(value, this.secret);
+      return token;
+    } else {
+      debug('signing with enhaced aes deprecated legacy');
+      // deprecated aes (legacy) signature, only must be used for legacy version
+      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');
+      return token;
+    }
   }
 }
 

package/src/index.ts

@@ -1,2 +1,3 @@
 export { Auth } from './auth';
 export * from './utils';
+export * from './types';

package/src/signature-legacy.ts

@@ -0,0 +1,66 @@
+import buildDebug from 'debug';
+import _ from 'lodash';
+
+import { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
+import { aesDecryptDeprecated as aesDecrypt, parseBasicPayload } from '@verdaccio/signature';
+import { Security } from '@verdaccio/types';
+
+import { AuthMiddlewarePayload } from './types';
+import {
+  convertPayloadToBase64,
+  isAESLegacy,
+  parseAuthTokenHeader,
+  verifyJWTPayload,
+} from './utils';
+
+const debug = buildDebug('verdaccio:auth:utils');
+
+export function parseAESCredentials(authorizationHeader: string, secret: string) {
+  debug('parseAESCredentials');
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  // basic is deprecated and should not be enforced
+  // basic is currently being used for functional test
+  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
+    debug('legacy header basic');
+    const credentials = convertPayloadToBase64(token).toString();
+
+    return credentials;
+  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    debug('legacy header bearer');
+    const credentials = aesDecrypt(Buffer.from(token), secret);
+
+    return credentials;
+  }
+}
+
+export function getMiddlewareCredentials(
+  security: Security,
+  secretKey: string,
+  authorizationHeader: string
+): AuthMiddlewarePayload {
+  debug('getMiddlewareCredentials');
+  // comment out for debugging purposes
+  if (isAESLegacy(security)) {
+    debug('is legacy');
+    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    if (typeof credentials !== 'string') {
+      debug('parse legacy credentials failed');
+      return;
+    }
+
+    const parsedCredentials = parseBasicPayload(credentials);
+    if (!parsedCredentials) {
+      debug('parse legacy basic payload credentials failed');
+      return;
+    }
+
+    return parsedCredentials;
+  }
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  debug('is jwt');
+  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    return verifyJWTPayload(token, secretKey);
+  }
+}

package/src/signature.ts

@@ -0,0 +1,66 @@
+import buildDebug from 'debug';
+import _ from 'lodash';
+
+import { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
+import { aesDecrypt, parseBasicPayload } from '@verdaccio/signature';
+import { Security } from '@verdaccio/types';
+
+import { AuthMiddlewarePayload } from './types';
+import {
+  convertPayloadToBase64,
+  isAESLegacy,
+  parseAuthTokenHeader,
+  verifyJWTPayload,
+} from './utils';
+
+const debug = buildDebug('verdaccio:auth:utils');
+
+export function parseAESCredentials(authorizationHeader: string, secret: string) {
+  debug('parseAESCredentials');
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  // basic is deprecated and should not be enforced
+  // basic is currently being used for functional test
+  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
+    debug('legacy header basic');
+    const credentials = convertPayloadToBase64(token).toString();
+
+    return credentials;
+  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    debug('legacy header bearer');
+    const credentials = aesDecrypt(token, secret);
+
+    return credentials;
+  }
+}
+
+export function getMiddlewareCredentials(
+  security: Security,
+  secretKey: string,
+  authorizationHeader: string
+): AuthMiddlewarePayload {
+  debug('getMiddlewareCredentials');
+  // comment out for debugging purposes
+  if (isAESLegacy(security)) {
+    debug('is legacy');
+    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    if (!credentials) {
+      debug('parse legacy credentials failed');
+      return;
+    }
+
+    const parsedCredentials = parseBasicPayload(credentials);
+    if (!parsedCredentials) {
+      debug('parse legacy basic payload credentials failed');
+      return;
+    }
+
+    return parsedCredentials;
+  }
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  debug('is jwt');
+  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    return verifyJWTPayload(token, secretKey);
+  }
+}