@verdaccio/auth 8.0.0-next-8.14 → 8.0.0-next-8.16

package/build/auth.d.ts

@@ -6,7 +6,12 @@ declare class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBas
     secret: string;
     logger: Logger;
     plugins: pluginUtils.Auth<Config>[];
-    constructor(config: Config, logger: Logger);
+    options: {
+        legacyMergeConfigs: boolean;
+    };
+    constructor(config: Config, logger: Logger, options?: {
+        legacyMergeConfigs: boolean;
+    });
     init(): Promise<void>;
     private loadDefaultPlugin;
     private loadPlugin;

package/build/auth.js

@@ -5,22 +5,26 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.Auth = void 0;
 var _debug = _interopRequireDefault(require("debug"));
-var _lodash = _interopRequireDefault(require("lodash"));
+var _lodash = _interopRequireWildcard(require("lodash"));
 var _verdaccioHtpasswd = require("verdaccio-htpasswd");
 var _config = require("@verdaccio/config");
 var _core = require("@verdaccio/core");
 var _loaders = require("@verdaccio/loaders");
 var _signature = require("@verdaccio/signature");
-var _utils = require("@verdaccio/utils");
-var _utils2 = require("./utils");
+var _utils = require("./utils");
+function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
+function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:auth');
 class Auth {
-  constructor(config, logger) {
+  constructor(config, logger, options = {
+    legacyMergeConfigs: false
+  }) {
     this.config = config;
     this.secret = config.secret;
     this.logger = logger;
     this.plugins = [];
+    this.options = options;
     if (!this.secret) {
       throw new TypeError('secret it is required value on initialize the auth class');
     }
@@ -67,19 +71,19 @@ class Auth {
         allow_publish
       } = plugin;
       return typeof authenticate !== 'undefined' || typeof allow_access !== 'undefined' || typeof allow_publish !== 'undefined';
-    }, false, this.config?.serverSettings?.pluginPrefix, _core.PLUGIN_CATEGORY.AUTHENTICATION);
+    }, this.options.legacyMergeConfigs, this.config?.server?.pluginPrefix ?? _core.PLUGIN_PREFIX, _core.PLUGIN_CATEGORY.AUTHENTICATION);
   }
   _applyDefaultPlugins() {
     // TODO: rename to applyFallbackPluginMethods
-    this.plugins.push((0, _utils2.getDefaultPlugins)(this.logger));
+    this.plugins.push((0, _utils.getDefaultPlugins)(this.logger));
   }
   changePassword(username, password, newPassword, cb) {
-    const validPlugins = _lodash.default.filter(this.plugins, plugin => (0, _utils.isFunction)(plugin.changePassword));
+    const validPlugins = _lodash.default.filter(this.plugins, plugin => _lodash.default.isFunction(plugin.changePassword));
     if (_lodash.default.isEmpty(validPlugins)) {
       return cb(_core.errorUtils.getInternalError(_core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
     }
     for (const plugin of validPlugins) {
-      if ((0, _utils.isNil)(plugin) || (0, _utils.isFunction)(plugin.changePassword) === false) {
+      if (_lodash.default.isNil(plugin) || _lodash.default.isFunction(plugin.changePassword) === false) {
         debug('auth plugin does not implement changePassword, trying next one');
         continue;
       } else {
@@ -108,7 +112,7 @@ class Auth {
     const plugins = this.plugins.slice(0);
     (function next() {
       const plugin = plugins.shift();
-      if ((0, _utils.isFunction)(plugin.authenticate) === false) {
+      if ((0, _lodash.isFunction)(plugin.authenticate) === false) {
         return next();
       }
       debug('authenticating %o', username);
@@ -187,11 +191,11 @@ class Auth {
       name: packageName,
       version: packageVersion
     };
-    const pkg = Object.assign({}, pkgAllowAccess, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
+    const pkg = Object.assign({}, pkgAllowAccess, _core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
     debug('allow access for %o', packageName);
     (function next() {
       const plugin = plugins.shift();
-      if (_lodash.default.isNil(plugin) || (0, _utils.isFunction)(plugin.allow_access) === false) {
+      if (_lodash.default.isNil(plugin) || (0, _lodash.isFunction)(plugin.allow_access) === false) {
         return next();
       }
       plugin.allow_access(user, pkg, function (err, ok) {
@@ -214,7 +218,7 @@ class Auth {
     const pkg = Object.assign({
       name: packageName,
       version: packageVersion
-    }, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
+    }, _core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
     debug('allow unpublish for %o', packageName);
     for (const plugin of this.plugins) {
       if (typeof plugin?.allow_unpublish !== 'function') {
@@ -253,7 +257,7 @@ class Auth {
     const pkg = Object.assign({
       name: packageName,
       version: packageVersion
-    }, (0, _utils.getMatchedPackagesSpec)(packageName, this.config.packages));
+    }, _core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
     debug('allow publish for %o init | plugins: %o', packageName, plugins.length);
     (function next() {
       const plugin = plugins.shift();
@@ -318,7 +322,7 @@ class Auth {
         debug('jwt, authentication header is missing');
         return next();
       }
-      if (!(0, _utils2.isAuthHeaderValid)(authorization)) {
+      if (!(0, _utils.isAuthHeaderValid)(authorization)) {
         debug('api middleware authentication heather is invalid');
         return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
       }
@@ -326,7 +330,7 @@ class Auth {
         secret,
         security
       } = this.config;
-      if ((0, _utils2.isAESLegacy)(security)) {
+      if ((0, _utils.isAESLegacy)(security)) {
         debug('api middleware using legacy auth token');
         this.handleAESMiddleware(req, security, secret, authorization, next);
       } else {
@@ -340,11 +344,11 @@ class Auth {
     const {
       scheme,
       token
-    } = (0, _utils2.parseAuthTokenHeader)(authorization);
+    } = (0, _utils.parseAuthTokenHeader)(authorization);
     if (scheme.toUpperCase() === _core.TOKEN_BASIC.toUpperCase()) {
       debug('handle basic token');
       // this should happen when client tries to login with an existing user
-      const credentials = (0, _utils2.convertPayloadToBase64)(token).toString();
+      const credentials = (0, _utils.convertPayloadToBase64)(token).toString();
       const {
         user,
         password
@@ -363,7 +367,7 @@ class Auth {
       });
     } else {
       debug('handle jwt token');
-      const credentials = (0, _utils2.getMiddlewareCredentials)(security, secret, authorization);
+      const credentials = (0, _utils.getMiddlewareCredentials)(security, secret, authorization);
       if (credentials) {
         // if the signature is valid we rely on it
         req.remote_user = credentials;
@@ -380,7 +384,7 @@ class Auth {
     debug('handle legacy api middleware');
     debug('api middleware has a secret? %o', typeof secret === 'string');
     debug('api middleware authorization %o', typeof authorization === 'string');
-    const credentials = (0, _utils2.getMiddlewareCredentials)(security, secret, authorization);
+    const credentials = (0, _utils.getMiddlewareCredentials)(security, secret, authorization);
     debug('api middleware credentials %o', credentials?.name);
     if (credentials) {
       const {
@@ -432,7 +436,7 @@ class Auth {
       if (_lodash.default.isNil(authorization)) {
         return next();
       }
-      if (!(0, _utils2.isAuthHeaderValid)(authorization)) {
+      if (!(0, _utils.isAuthHeaderValid)(authorization)) {
         return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
       }
       const token = (authorization || '').replace(`${_core.TOKEN_BEARER} `, '');
@@ -441,7 +445,7 @@ class Auth {
       }
       let credentials;
       try {
-        credentials = (0, _utils2.verifyJWTPayload)(token, this.config.secret);
+        credentials = (0, _utils.verifyJWTPayload)(token, this.config.secret, this.config.security);
       } catch (err) {
         // FIXME: intended behaviour, do we want it?
       }
@@ -479,7 +483,7 @@ class Auth {
    * Encrypt a string.
    */
   aesEncrypt(value) {
-    if (this.secret.length === _signature.utils.TOKEN_VALID_LENGTH) {
+    if (this.secret.length === _config.TOKEN_VALID_LENGTH) {
       debug('signing with enhanced aes legacy');
       const token = (0, _signature.aesEncrypt)(value, this.secret);
       return token;

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":["_debug","_interopRequireDefault","require","_lodash","_verdaccioHtpasswd","_config","_core","_loaders","_signature","_utils","_utils2","e","__esModule","default","debug","buildDebug","Auth","constructor","config","logger","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","authPlugin","HTPasswd","file","info","name","pluginCategory","PLUGIN_CATEGORY","AUTHENTICATION","error","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","serverSettings","pluginPrefix","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","adduser","warningUtils","emit","Codes","VERWAR006","ok","packageName","packageVersion","callback","pkgAllowAccess","version","pkg","Object","assign","getMatchedPackagesSpec","packages","allow_unpublish","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","handleAESMiddleware","handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","_isRemoteUserValid","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value","signatureUtils","TOKEN_VALID_LENGTH","aesEncryptDeprecated","Buffer","exports"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  errorUtils,\n  pluginUtils,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n  utils as signatureUtils,\n} from '@verdaccio/signature';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\nimport { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';\n\nimport {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n\n  public constructor(config: Config, logger: Logger) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      false,\n      this.config?.serverSettings?.pluginPrefix,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        plugin.allow_unpublish(user, pkg, (err, ok): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            return this.allow_publish({ packageName, packageVersion }, user, callback);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    if (this.secret.length === signatureUtils.TOKEN_VALID_LENGTH) {\n      debug('signing with enhanced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhanced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,kBAAA,GAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,KAAA,GAAAJ,OAAA;AAWA,IAAAK,QAAA,GAAAL,OAAA;AACA,IAAAM,UAAA,GAAAN,OAAA;AAiBA,IAAAO,MAAA,GAAAP,OAAA;AAUA,IAAAQ,OAAA,GAAAR,OAAA;AAQiB,SAAAD,uBAAAU,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;AAE1C,MAAMC,IAAI,CAAqE;EAMtEC,WAAWA,CAACC,MAAc,EAAEC,MAAc,EAAE;IACjD,IAAI,CAACD,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACE,MAAM,GAAGF,MAAM,CAACE,MAAM;IAC3B,IAAI,CAACD,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACE,OAAO,GAAG,EAAE;IACjB,IAAI,CAAC,IAAI,CAACD,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAIA,CAAA,EAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,CAAC,CAAiC;IAEtEV,KAAK,CAAC,uBAAuB,EAAEO,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,CAAC,CAAC;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,CAAC,CAAC;EAC7B;EAEQD,iBAAiBA,CAAA,EAAG;IAC1BZ,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMc,aAAwC,GAAG;MAC/CV,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBC,MAAM,EAAE,IAAI,CAACA;IACf,CAAC;IACD,IAAIU,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBH,aACF,CAAC;MACD,IAAI,CAACT,MAAM,CAACa,IAAI,CACd;QAAEC,IAAI,EAAE,oBAAoB;QAAEC,cAAc,EAAEC,qBAAe,CAACC;MAAe,CAAC,EAC9E,wDACF,CAAC;IACH,CAAC,CAAC,OAAOC,KAAU,EAAE;MACnBvB,KAAK,CAAC,iDAAiD,EAAEuB,KAAK,CAAC;MAC/D,IAAI,CAAClB,MAAM,CAACa,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MACrD,OAAO,EAAE;IACX;IAEA,OAAO,CAACH,UAAU,CAAC;EACrB;EAEA,MAAcL,UAAUA,CAAA,EAAG;IACzB,OAAO,IAAAc,wBAAe,EACpB,IAAI,CAACpB,MAAM,CAACqB,IAAI,EAChB;MACErB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBC,MAAM,EAAE,IAAI,CAACA;IACf,CAAC,EACAqB,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,EACD,KAAK,EACL,IAAI,CAACzB,MAAM,EAAE0B,cAAc,EAAEC,YAAY,EACzCV,qBAAe,CAACC,cAClB,CAAC;EACH;EAEQT,oBAAoBA,CAAA,EAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAACyB,IAAI,CAAC,IAAAC,yBAAiB,EAAC,IAAI,CAAC5B,MAAM,CAAC,CAAC;EACnD;EAEO6B,cAAcA,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAAClC,OAAO,EAAGmB,MAAM,IAAK,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,CAAC;IAE1F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMrB,MAAM,IAAIa,YAAY,EAAE;MACjC,IAAI,IAAAS,YAAK,EAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACQ,cAAc,CAAC,KAAK,KAAK,EAAE;QAChElC,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAEmC,QAAQ,CAAC;QAC3CT,MAAM,CAACQ,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACP,IAAI,CAAC5C,MAAM,CAACkB,KAAK,CACf;cAAEY,QAAQ;cAAEc;YAAI,CAAC,EACjB;AACd,yEACY,CAAC;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEAjD,KAAK,CAAC,wCAAwC,EAAEmC,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAeA,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,CAAC,CAAC;EAC1B;EAEO7B,YAAYA,CACjBQ,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAM/B,OAAO,GAAG,IAAI,CAACA,OAAO,CAACkD,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGnB,OAAO,CAACoD,KAAK,CAAC,CAA6B;MAE1D,IAAI,IAAAjB,iBAAU,EAAChB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAO+B,IAAI,CAAC,CAAC;MACf;MAEA1D,KAAK,CAAC,mBAAmB,EAAEmC,QAAQ,CAAC;MACpCT,MAAM,CAACC,YAAY,CAACQ,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACPjD,KAAK,CAAC,8CAA8C,EAAEmC,QAAQ,EAAEc,GAAG,EAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAACjD,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI6B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAIpD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMuD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAIvD,SAAS,CAACyD,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEAlE,KAAK,CAAC,yDAAyD,EAAEmC,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOU,QAAQA,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAM/D,OAAO,GAAG,IAAI,CAACA,OAAO,CAACkD,KAAK,CAAC,CAAC,CAAC;IACrCzD,KAAK,CAAC,aAAa,EAAEqE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAIA,CAAA,EAAS;MACrB,IAAIa,MAAM,GAAG,SAAS;MACtB,MAAM7C,MAAM,GAAGnB,OAAO,CAACoD,KAAK,CAAC,CAA6B;MAC1D;MACA,IAAI,OAAOjC,MAAM,CAAC8C,OAAO,KAAK,WAAW,IAAI,OAAO9C,MAAM,CAAC0C,QAAQ,KAAK,UAAU,EAAE;QAClFG,MAAM,GAAG,UAAU;QACnBE,kBAAY,CAACC,IAAI,CAACD,kBAAY,CAACE,KAAK,CAACC,SAAS,CAAC;MACjD;MACA;MACA,IAAI,OAAOlD,MAAM,CAAC6C,MAAM,CAAC,KAAK,UAAU,EAAE;QACxCb,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACA;QACAhC,MAAM,CAAC6C,MAAM,CAAC,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAE4B,EAAqB,EAAQ;UACjE,IAAI5B,GAAG,EAAE;YACPjD,KAAK,CAAC,2CAA2C,EAAEqE,IAAI,EAAEpB,GAAG,EAAEY,OAAO,CAAC;YACtE,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAI4B,EAAE,EAAE;YACN7E,KAAK,CAAC,4BAA4B,EAAEqE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC3C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACAtC,KAAK,CAAC,mDAAmD,CAAC;UAC1D0D,IAAI,CAAC,CAAC;QACR,CACF,CAAC;MACH;IACF,CAAC,EAAE,CAAC;EACN;;EAEA;AACF;AACA;EACS9B,YAAYA,CACjB;IAAEkD,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAoC,EAC9B;IACN,MAAMzE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACkD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMwB,cAA2B,GAAG;MAAE9D,IAAI,EAAE2D,WAAW;MAAEI,OAAO,EAAEH;IAAe,CAAC;IAClF,MAAMI,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB,CAAC,CAAC,EACFJ,cAAc,EACd,IAAAK,6BAAsB,EAACR,WAAW,EAAE,IAAI,CAAC1E,MAAM,CAACmF,QAAQ,CAC1D,CAAgC;IAChCvF,KAAK,CAAC,qBAAqB,EAAE8E,WAAW,CAAC;IAEzC,CAAC,SAASpB,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAiC,GAAGnB,OAAO,CAACoD,KAAK,CAAC,CAA8B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACtB,MAAM,CAAC,IAAI,IAAAgB,iBAAU,EAAChB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO8B,IAAI,CAAC,CAAC;MACf;MAEAhC,MAAM,CAACE,YAAY,CAAEyC,IAAI,EAAEc,GAAG,EAAE,UAAUlC,GAA0B,EAAE4B,EAAY,EAAQ;QACxF,IAAI5B,GAAG,EAAE;UACPjD,KAAK,CAAC,oCAAoC,EAAE8E,WAAW,EAAE7B,GAAG,EAAEY,OAAO,CAAC;UACtE,OAAOmB,QAAQ,CAAC/B,GAAG,CAAC;QACtB;QAEA,IAAI4B,EAAE,EAAE;UACN7E,KAAK,CAAC,uBAAuB,EAAE8E,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAnB,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEO8B,eAAeA,CACpB;IAAEV,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAkB,EACZ;IACN,MAAMG,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAElE,IAAI,EAAE2D,WAAW;MAAEI,OAAO,EAAEH;IAAe,CAAC,EAC9C,IAAAO,6BAAsB,EAACR,WAAW,EAAE,IAAI,CAAC1E,MAAM,CAACmF,QAAQ,CAC1D,CAAC;IACDvF,KAAK,CAAC,wBAAwB,EAAE8E,WAAW,CAAC;IAE5C,KAAK,MAAMpD,MAAM,IAAI,IAAI,CAACnB,OAAO,EAAE;MACjC,IAAI,OAAOmB,MAAM,EAAE8D,eAAe,KAAK,UAAU,EAAE;QACjDxF,KAAK,CAAC,kEAAkE,EAAE8E,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACLpD,MAAM,CAAC8D,eAAe,CAACnB,IAAI,EAAEc,GAAG,EAAE,CAAClC,GAAG,EAAE4B,EAAE,KAAW;UACnD,IAAI5B,GAAG,EAAE;YACPjD,KAAK,CACH,qEAAqE,EACrE8E,WACF,CAAC;YACD,OAAOE,QAAQ,CAAC/B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAAC6B,EAAE,CAAC,KAAK,IAAI,EAAE;YACxB7E,KAAK,CAAC,yDAAyD,EAAE8E,WAAW,CAAC;YAC7E,OAAO,IAAI,CAACjD,aAAa,CAAC;cAAEiD,WAAW;cAAEC;YAAe,CAAC,EAAEV,IAAI,EAAEW,QAAQ,CAAC;UAC5E;UAEA,IAAIH,EAAE,EAAE;YACN7E,KAAK,CAAC,0BAA0B,EAAE8E,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACShD,aAAaA,CAClB;IAAEiD,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAkB,EACZ;IACN,MAAMzE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACkD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM0B,GAAG,GAAGC,MAAM,CAACC,MAAM,CACvB;MAAElE,IAAI,EAAE2D,WAAW;MAAEI,OAAO,EAAEH;IAAe,CAAC,EAC9C,IAAAO,6BAAsB,EAACR,WAAW,EAAE,IAAI,CAAC1E,MAAM,CAACmF,QAAQ,CAC1D,CAAC;IACDvF,KAAK,CAAC,yCAAyC,EAAE8E,WAAW,EAAEvE,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAAS+C,IAAIA,CAAA,EAAS;MACrB,MAAMhC,MAAM,GAAGnB,OAAO,CAACoD,KAAK,CAAC,CAAC;MAE9B,IAAI,OAAOjC,MAAM,EAAEG,aAAa,KAAK,UAAU,EAAE;QAC/C7B,KAAK,CAAC,8DAA8D,EAAE8E,WAAW,CAAC;QAClF,OAAOpB,IAAI,CAAC,CAAC;MACf;MAEAhC,MAAM,CAACG,aAAa,CAACwC,IAAI,EAAEc,GAAG,EAAE,CAAClC,GAA0B,EAAE4B,EAAY,KAAW;QAClF,IAAIrC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAACiD,OAAO,CAACxC,GAAG,CAAC,EAAE;UAC5CjD,KAAK,CAAC,0BAA0B,EAAE8E,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC/B,GAAG,CAAC;QACtB;QAEA,IAAI4B,EAAE,EAAE;UACN7E,KAAK,CAAC,wBAAwB,EAAE8E,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEA7E,KAAK,CAAC,sCAAsC,EAAE8E,WAAW,CAAC;QAC1DpB,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOgC,gBAAgBA,CAAA,EAAQ;IAC7B1F,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMO,OAAO,GAAG,IAAI,CAACA,OAAO,CAACkD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMkC,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAEzB,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAMzC,MAAM,IAAInB,OAAO,EAAE;MAC5B,IAAImB,MAAM,CAACgE,gBAAgB,EAAE;QAC3B,OAAOhE,MAAM,CAACgE,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;IAEA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMtC,IAAI,GAAG,SAAAA,CAAUT,GAAoB,EAAgB;QACzD4C,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ;QACA;QACA;QACA;QACA,IAAIhD,GAAG,EAAE;UACP4C,GAAG,CAACK,WAAW,CAAC3E,KAAK,GAAG0B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAOkC,KAAK,CAAC,CAAC;MAChB,CAAC;;MAED;MACA;MACA;MACA;MACA;;MAEA;MACA,MAAMI,UAAU,GAAG,IAAAP,iCAAyB,EAAC,CAAC;MAC9CC,GAAG,CAACK,WAAW,GAAGC,UAAU;MAC5BL,GAAG,CAACM,MAAM,CAACF,WAAW,GAAGC,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGR,GAAG,CAACS,OAAO;MACrC,IAAI9D,eAAC,CAACQ,KAAK,CAACqD,aAAa,CAAC,EAAE;QAC1BrG,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAO0D,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA6C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrCrG,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAO0D,IAAI,CAACd,gBAAU,CAAC4D,aAAa,CAACvC,eAAS,CAACwC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAEnG,MAAM;QAAEoG;MAAS,CAAC,GAAG,IAAI,CAACtG,MAAM;MAExC,IAAI,IAAAuG,mBAAW,EAACD,QAAQ,CAAC,EAAE;QACzB1G,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAAC4G,mBAAmB,CAACf,GAAG,EAAEa,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,EAAE3C,IAAI,CAAC;MACtE,CAAC,MAAM;QACL1D,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAAC6G,sBAAsB,CAAChB,GAAG,EAAEa,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,EAAE3C,IAAI,CAAC;MACzE;IACF,CAAC;EACH;EAEQmD,sBAAsBA,CAC5BhB,GAAmB,EACnBa,QAAkB,EAClBpG,MAAc,EACd+F,aAAqB,EACrB3C,IAAS,EACH;IACN1D,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAE8G,MAAM;MAAE1D;IAAM,CAAC,GAAG,IAAA2D,4BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;MACtDhH,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAMkH,WAAW,GAAG,IAAAC,8BAAsB,EAAC/D,KAAK,CAAC,CAACgE,QAAQ,CAAC,CAAC;MAC5D,MAAM;QAAE/C,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAAiF,4BAAiB,EAACH,WAAW,CAAe;MACvElH,KAAK,CAAC,mBAAmB,EAAEqE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACRjD,KAAK,CAAC,0BAA0B,CAAC;UACjC6F,GAAG,CAACK,WAAW,GAAG7B,IAAI;UACtBX,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACL1D,KAAK,CAAC,2BAA2B,CAAC;UAClC6F,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7ClC,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACLjD,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAMkH,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACArB,GAAG,CAACK,WAAW,GAAGgB,WAAW;QAC7BlH,KAAK,CAAC,0BAA0B,CAAC;QACjC0D,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACA1D,KAAK,CAAC,mBAAmB,CAAC;QAC1B0D,IAAI,CAACd,gBAAU,CAAC2E,YAAY,CAACtD,eAAS,CAACuD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,mBAAmBA,CACzBf,GAAmB,EACnBa,QAAkB,EAClBpG,MAAc,EACd+F,aAAqB,EACrB3C,IAAc,EACR;IACN1D,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,iCAAiC,EAAE,OAAOM,MAAM,KAAK,QAAQ,CAAC;IACpEN,KAAK,CAAC,iCAAiC,EAAE,OAAOqG,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,gCAAwB,EAACZ,QAAQ,EAAEpG,MAAM,EAAE+F,aAAa,CAAC;IAClFrG,KAAK,CAAC,+BAA+B,EAAEkH,WAAW,EAAE/F,IAAI,CAAC;IACzD,IAAI+F,WAAW,EAAE;MACf,MAAM;QAAE7C,IAAI;QAAEjC;MAAS,CAAC,GAAG8E,WAAW;MACtClH,KAAK,CAAC,mBAAmB,EAAEqE,IAAI,CAAC;MAChC,IAAI,CAAC1C,YAAY,CAAC0C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACR4C,GAAG,CAACK,WAAW,GAAG7B,IAAI;UACtBrE,KAAK,CAAC,0BAA0B,CAAC;UACjC0D,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACLmC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7C5F,KAAK,CAAC,2BAA2B,CAAC;UAClC0D,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACAjD,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAO0D,IAAI,CAACd,gBAAU,CAAC4D,aAAa,CAACvC,eAAS,CAACwC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQgB,kBAAkBA,CAACvB,WAAwB,EAAW;IAC5D,OAAO1D,eAAC,CAACkF,WAAW,CAACxB,WAAW,CAAC,KAAK,KAAK,IAAI1D,eAAC,CAACkF,WAAW,CAACxB,WAAW,EAAE/E,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACSwG,kBAAkBA,CAAA,EAAG;IAC1B,OAAO,CAAC9B,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAAC0B,kBAAkB,CAAC5B,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,CAAC,CAAC;MAChB;MAEAF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMtC,IAAI,GAAIT,GAA0B,IAAW;QACjD4C,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ,IAAIhD,GAAG,EAAE;UACP4C,GAAG,CAACK,WAAW,CAAC3E,KAAK,GAAG0B,GAAG,CAACY,OAAO;UACnCiC,GAAG,CAAC8B,MAAM,CAAC3E,GAAG,CAAC4E,UAAU,CAAC,CAACC,IAAI,CAAC7E,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAOkC,KAAK,CAAC,CAAC;MAChB,CAAC;MAED,MAAM;QAAEM;MAAc,CAAC,GAAGR,GAAG,CAACS,OAAO;MACrC,IAAI9D,eAAC,CAACQ,KAAK,CAACqD,aAAa,CAAC,EAAE;QAC1B,OAAO3C,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA6C,yBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAO3C,IAAI,CAACd,gBAAU,CAAC4D,aAAa,CAACvC,eAAS,CAACwC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMrD,KAAK,GAAG,CAACiD,aAAa,IAAI,EAAE,EAAE0B,OAAO,CAAC,GAAGC,kBAAY,GAAG,EAAE,EAAE,CAAC;MACnE,IAAI,CAAC5E,KAAK,EAAE;QACV,OAAOM,IAAI,CAAC,CAAC;MACf;MAEA,IAAIwD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAe,wBAAgB,EAAC7E,KAAK,EAAE,IAAI,CAAChD,MAAM,CAACE,MAAM,CAAC;MAC3D,CAAC,CAAC,OAAO2C,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAACwE,kBAAkB,CAACP,WAAW,CAAC,EAAE;QACxC,MAAM;UAAE/F,IAAI;UAAEyC;QAAO,CAAC,GAAGsD,WAAyB;QAClDrB,GAAG,CAACK,WAAW,GAAG,IAAA/B,wBAAgB,EAAChD,IAAI,EAAYyC,MAAM,CAAC;MAC5D,CAAC,MAAM;QACLiC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;MAC/C;MAEAlC,IAAI,CAAC,CAAC;IACR,CAAC;EACH;EAEA,MAAawE,UAAUA,CAAC7D,IAAgB,EAAE8D,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAEjH,IAAI;MAAEyC;IAAO,CAAC,GAAGS,IAAI;IAC1CrE,KAAK,CAAC,gBAAgB,EAAEmB,IAAI,CAAC;IAC7B,MAAMkH,mBAAmB,GAAG7F,eAAC,CAACQ,KAAK,CAACoF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAG9F,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjCwE,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAG7E,MAAM,CAAC8E,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChClH,IAAI;MACJyC,MAAM,EAAE0E;IACV,CAAC;IACD,MAAMlF,KAAa,GAAG,MAAM,IAAAwF,sBAAW,EAACD,OAAO,EAAE,IAAI,CAACrI,MAAM,EAAE6H,WAAW,CAAC;IAE1E,OAAO/E,KAAK;EACd;;EAEA;AACF;AACA;EACSyF,UAAUA,CAACC,KAAa,EAAiB;IAC9C,IAAI,IAAI,CAACxI,MAAM,CAACK,MAAM,KAAKoI,gBAAc,CAACC,kBAAkB,EAAE;MAC5DhJ,KAAK,CAAC,kCAAkC,CAAC;MACzC,MAAMoD,KAAK,GAAG,IAAAyF,qBAAU,EAACC,KAAK,EAAE,IAAI,CAACxI,MAAM,CAAC;MAC5C,OAAO8C,KAAK;IACd,CAAC,MAAM;MACLpD,KAAK,CAAC,6CAA6C,CAAC;MACpD;MACA,MAAMoD,KAAK,GAAG,IAAA6F,+BAAoB,EAACC,MAAM,CAACV,IAAI,CAACM,KAAK,CAAC,EAAE,IAAI,CAACxI,MAAM,CAAC,CAAC8G,QAAQ,CAAC,QAAQ,CAAC;MACtF,OAAOhE,KAAK;IACd;EACF;AACF;AAAC+F,OAAA,CAAAjJ,IAAA,GAAAA,IAAA","ignoreList":[]}
+{"version":3,"file":"auth.js","names":["_debug","_interopRequireDefault","require","_lodash","_interopRequireWildcard","_verdaccioHtpasswd","_config","_core","_loaders","_signature","_utils","_getRequireWildcardCache","e","WeakMap","r","t","__esModule","default","has","get","n","__proto__","a","Object","defineProperty","getOwnPropertyDescriptor","u","hasOwnProperty","call","i","set","debug","buildDebug","Auth","constructor","config","logger","options","legacyMergeConfigs","secret","plugins","TypeError","init","loadPlugin","length","loadDefaultPlugin","_applyDefaultPlugins","pluginOptions","authPlugin","HTPasswd","file","info","name","pluginCategory","PLUGIN_CATEGORY","AUTHENTICATION","error","asyncLoadPlugin","auth","plugin","authenticate","allow_access","allow_publish","server","pluginPrefix","PLUGIN_PREFIX","push","getDefaultPlugins","changePassword","username","password","newPassword","cb","validPlugins","_","filter","isFunction","isEmpty","errorUtils","getInternalError","SUPPORT_ERRORS","PLUGIN_MISSING_INTERFACE","isNil","err","profile","invalidateToken","token","console","log","Promise","resolve","slice","next","shift","groups","message","isString","isGroupValid","isArray","API_ERROR","BAD_FORMAT_USER_GROUP","createRemoteUser","add_user","user","self","method","adduser","warningUtils","emit","Codes","VERWAR006","ok","packageName","packageVersion","callback","pkgAllowAccess","version","pkg","assign","authUtils","getMatchedPackagesSpec","packages","allow_unpublish","isError","apiJWTmiddleware","helpers","createAnonymousRemoteUser","req","res","_next","pause","resume","remote_user","remoteUser","locals","authorization","headers","isAuthHeaderValid","getBadRequest","BAD_AUTH_HEADER","security","isAESLegacy","handleAESMiddleware","handleJWTAPIMiddleware","scheme","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","parseBasicPayload","getMiddlewareCredentials","getForbidden","BAD_USERNAME_PASSWORD","_isRemoteUserValid","isUndefined","webUIJWTmiddleware","status","statusCode","send","replace","TOKEN_BEARER","verifyJWTPayload","jwtEncrypt","signOptions","real_groups","realGroupsValidated","groupedGroups","Array","from","Set","concat","payload","signPayload","aesEncrypt","value","TOKEN_VALID_LENGTH","aesEncryptDeprecated","Buffer","exports"],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _, { isFunction } from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  VerdaccioError,\n  authUtils,\n  errorUtils,\n  pluginUtils,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n} from '@verdaccio/signature';\nimport {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPlugins,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];\n\n    debug('auth plugins found %s', plugins.length);\n    if (!plugins || plugins.length === 0) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this._applyDefaultPlugins();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    const pluginOptions: pluginUtils.PluginOptions = {\n      config: this.config,\n      logger: this.logger,\n    };\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        pluginOptions as any as pluginUtils.PluginOptions\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<unknown>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private _applyDefaultPlugins(): void {\n    // TODO: rename to applyFallbackPluginMethods\n    this.plugins.push(getDefaultPlugins(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n\n      if (isFunction(plugin.authenticate) === false) {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift() as pluginUtils.Auth<Config>;\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkgAllowAccess: AllowAccess = { name: packageName, version: packageVersion };\n    const pkg = Object.assign(\n      {},\n      pkgAllowAccess,\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n    debug('allow access for %o', packageName);\n\n    (function next(): void {\n      const plugin: pluginUtils.Auth<unknown> = plugins.shift() as pluginUtils.Auth<unknown>;\n\n      if (_.isNil(plugin) || isFunction(plugin.allow_access) === false) {\n        return next();\n      }\n\n      plugin.allow_access!(user, pkg, function (err: VerdaccioError | null, ok?: boolean): void {\n        if (err) {\n          debug('forbidden access for %o. Error: %o', packageName, err?.message);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed access for %o', packageName);\n          return callback(null, ok);\n        }\n\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow unpublish for %o', packageName);\n\n    for (const plugin of this.plugins) {\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('allow unpublish for %o plugin does not implement allow_unpublish', packageName);\n        continue;\n      } else {\n        plugin.allow_unpublish(user, pkg, (err, ok): void => {\n          if (err) {\n            debug(\n              'forbidden publish for %o, it will fallback on unpublish permissions',\n              packageName\n            );\n            return callback(err);\n          }\n\n          if (_.isNil(ok) === true) {\n            debug('bypass unpublish for %o, publish will handle the access', packageName);\n            return this.allow_publish({ packageName, packageVersion }, user, callback);\n          }\n\n          if (ok) {\n            debug('allowed unpublish for %o', packageName);\n            return callback(null, ok);\n          }\n        });\n      }\n    }\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n    debug('allow publish for %o init | plugins: %o', packageName, plugins.length);\n\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('allow publish for %o plugin does not implement allow_publish', packageName);\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (_.isNil(err) === false && _.isError(err)) {\n          debug('forbidden publish for %o', packageName);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('allowed publish for %o', packageName);\n          return callback(null, ok);\n        }\n\n        debug('allow publish skip validation for %o', packageName);\n        next(); // cb(null, false) causes next plugin to roll\n      });\n    })();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const { user, password } = parseBasicPayload(credentials) as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch (err: any) {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(payload, this.secret, signOptions);\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    if (this.secret.length === TOKEN_VALID_LENGTH) {\n      debug('signing with enhanced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhanced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAC,uBAAA,CAAAF,OAAA;AACA,IAAAG,kBAAA,GAAAH,OAAA;AAEA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AAaA,IAAAM,QAAA,GAAAN,OAAA;AACA,IAAAO,UAAA,GAAAP,OAAA;AAyBA,IAAAQ,MAAA,GAAAR,OAAA;AAQiB,SAAAS,yBAAAC,CAAA,6BAAAC,OAAA,mBAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,CAAA,WAAAA,CAAA,GAAAG,CAAA,GAAAD,CAAA,KAAAF,CAAA;AAAA,SAAAR,wBAAAQ,CAAA,EAAAE,CAAA,SAAAA,CAAA,IAAAF,CAAA,IAAAA,CAAA,CAAAI,UAAA,SAAAJ,CAAA,eAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,WAAAK,OAAA,EAAAL,CAAA,QAAAG,CAAA,GAAAJ,wBAAA,CAAAG,CAAA,OAAAC,CAAA,IAAAA,CAAA,CAAAG,GAAA,CAAAN,CAAA,UAAAG,CAAA,CAAAI,GAAA,CAAAP,CAAA,OAAAQ,CAAA,KAAAC,SAAA,UAAAC,CAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,CAAA,IAAAd,CAAA,oBAAAc,CAAA,OAAAC,cAAA,CAAAC,IAAA,CAAAhB,CAAA,EAAAc,CAAA,SAAAG,CAAA,GAAAP,CAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAb,CAAA,EAAAc,CAAA,UAAAG,CAAA,KAAAA,CAAA,CAAAV,GAAA,IAAAU,CAAA,CAAAC,GAAA,IAAAP,MAAA,CAAAC,cAAA,CAAAJ,CAAA,EAAAM,CAAA,EAAAG,CAAA,IAAAT,CAAA,CAAAM,CAAA,IAAAd,CAAA,CAAAc,CAAA,YAAAN,CAAA,CAAAH,OAAA,GAAAL,CAAA,EAAAG,CAAA,IAAAA,CAAA,CAAAe,GAAA,CAAAlB,CAAA,EAAAQ,CAAA,GAAAA,CAAA;AAAA,SAAAnB,uBAAAW,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAI,UAAA,GAAAJ,CAAA,KAAAK,OAAA,EAAAL,CAAA;AAEjB,MAAMmB,KAAK,GAAG,IAAAC,cAAU,EAAC,gBAAgB,CAAC;AAE1C,MAAMC,IAAI,CAAqE;EAOtEC,WAAWA,CAACC,MAAc,EAAEC,MAAc,EAAEC,OAAO,GAAG;IAAEC,kBAAkB,EAAE;EAAM,CAAC,EAAE;IAC1F,IAAI,CAACH,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACI,MAAM,GAAGJ,MAAM,CAACI,MAAM;IAC3B,IAAI,CAACH,MAAM,GAAGA,MAAM;IACpB,IAAI,CAACI,OAAO,GAAG,EAAE;IACjB,IAAI,CAACH,OAAO,GAAGA,OAAO;IACtB,IAAI,CAAC,IAAI,CAACE,MAAM,EAAE;MAChB,MAAM,IAAIE,SAAS,CAAC,0DAA0D,CAAC;IACjF;EACF;EAEA,MAAaC,IAAIA,CAAA,EAAG;IAClB,IAAIF,OAAO,GAAI,MAAM,IAAI,CAACG,UAAU,CAAC,CAAiC;IAEtEZ,KAAK,CAAC,uBAAuB,EAAES,OAAO,CAACI,MAAM,CAAC;IAC9C,IAAI,CAACJ,OAAO,IAAIA,OAAO,CAACI,MAAM,KAAK,CAAC,EAAE;MACpCJ,OAAO,GAAG,IAAI,CAACK,iBAAiB,CAAC,CAAC;IACpC;IACA,IAAI,CAACL,OAAO,GAAGA,OAAO;IAEtB,IAAI,CAACM,oBAAoB,CAAC,CAAC;EAC7B;EAEQD,iBAAiBA,CAAA,EAAG;IAC1Bd,KAAK,CAAC,0BAA0B,CAAC;IACjC,MAAMgB,aAAwC,GAAG;MAC/CZ,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBC,MAAM,EAAE,IAAI,CAACA;IACf,CAAC;IACD,IAAIY,UAAU;IACd,IAAI;MACFA,UAAU,GAAG,IAAIC,2BAAQ,CACvB;QAAEC,IAAI,EAAE;MAAa,CAAC,EACtBH,aACF,CAAC;MACD,IAAI,CAACX,MAAM,CAACe,IAAI,CACd;QAAEC,IAAI,EAAE,oBAAoB;QAAEC,cAAc,EAAEC,qBAAe,CAACC;MAAe,CAAC,EAC9E,wDACF,CAAC;IACH,CAAC,CAAC,OAAOC,KAAU,EAAE;MACnBzB,KAAK,CAAC,iDAAiD,EAAEyB,KAAK,CAAC;MAC/D,IAAI,CAACpB,MAAM,CAACe,IAAI,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;MACrD,OAAO,EAAE;IACX;IAEA,OAAO,CAACH,UAAU,CAAC;EACrB;EAEA,MAAcL,UAAUA,CAAA,EAAG;IACzB,OAAO,IAAAc,wBAAe,EACpB,IAAI,CAACtB,MAAM,CAACuB,IAAI,EAChB;MACEvB,MAAM,EAAE,IAAI,CAACA,MAAM;MACnBC,MAAM,EAAE,IAAI,CAACA;IACf,CAAC,EACAuB,MAAM,IAAc;MACnB,MAAM;QAAEC,YAAY;QAAEC,YAAY;QAAEC;MAAc,CAAC,GAAGH,MAAM;MAE5D,OACE,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,YAAY,KAAK,WAAW,IACnC,OAAOC,aAAa,KAAK,WAAW;IAExC,CAAC,EACD,IAAI,CAACzB,OAAO,CAACC,kBAAkB,EAC/B,IAAI,CAACH,MAAM,EAAE4B,MAAM,EAAEC,YAAY,IAAIC,mBAAa,EAClDX,qBAAe,CAACC,cAClB,CAAC;EACH;EAEQT,oBAAoBA,CAAA,EAAS;IACnC;IACA,IAAI,CAACN,OAAO,CAAC0B,IAAI,CAAC,IAAAC,wBAAiB,EAAC,IAAI,CAAC/B,MAAM,CAAC,CAAC;EACnD;EAEOgC,cAAcA,CACnBC,QAAgB,EAChBC,QAAgB,EAChBC,WAAmB,EACnBC,EAAY,EACN;IACN,MAAMC,YAAY,GAAGC,eAAC,CAACC,MAAM,CAAC,IAAI,CAACnC,OAAO,EAAGmB,MAAM,IAAKe,eAAC,CAACE,UAAU,CAACjB,MAAM,CAACS,cAAc,CAAC,CAAC;IAE5F,IAAIM,eAAC,CAACG,OAAO,CAACJ,YAAY,CAAC,EAAE;MAC3B,OAAOD,EAAE,CAACM,gBAAU,CAACC,gBAAgB,CAACC,oBAAc,CAACC,wBAAwB,CAAC,CAAC;IACjF;IAEA,KAAK,MAAMtB,MAAM,IAAIc,YAAY,EAAE;MACjC,IAAIC,eAAC,CAACQ,KAAK,CAACvB,MAAM,CAAC,IAAIe,eAAC,CAACE,UAAU,CAACjB,MAAM,CAACS,cAAc,CAAC,KAAK,KAAK,EAAE;QACpErC,KAAK,CAAC,gEAAgE,CAAC;QACvE;MACF,CAAC,MAAM;QACLA,KAAK,CAAC,0BAA0B,EAAEsC,QAAQ,CAAC;QAC3CV,MAAM,CAACS,cAAc,CAAEC,QAAQ,EAAEC,QAAQ,EAAEC,WAAW,EAAE,CAACY,GAAG,EAAEC,OAAO,KAAW;UAC9E,IAAID,GAAG,EAAE;YACP,IAAI,CAAC/C,MAAM,CAACoB,KAAK,CACf;cAAEa,QAAQ;cAAEc;YAAI,CAAC,EACjB;AACd,yEACY,CAAC;YACD,OAAOX,EAAE,CAACW,GAAG,CAAC;UAChB;UAEApD,KAAK,CAAC,wCAAwC,EAAEsC,QAAQ,CAAC;UACzD,OAAOG,EAAE,CAAC,IAAI,EAAEY,OAAO,CAAC;QAC1B,CAAC,CAAC;MACJ;IACF;EACF;EAEA,MAAaC,eAAeA,CAACC,KAAa,EAAE;IAC1C;IACAC,OAAO,CAACC,GAAG,CAAC,uCAAuC,EAAEF,KAAK,CAAC;IAC3D,OAAOG,OAAO,CAACC,OAAO,CAAC,CAAC;EAC1B;EAEO9B,YAAYA,CACjBS,QAAgB,EAChBC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMhC,OAAO,GAAG,IAAI,CAACA,OAAO,CAACmD,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC,SAASC,IAAIA,CAAA,EAAS;MACrB,MAAMjC,MAAM,GAAGnB,OAAO,CAACqD,KAAK,CAAC,CAA6B;MAE1D,IAAI,IAAAjB,kBAAU,EAACjB,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;QAC7C,OAAOgC,IAAI,CAAC,CAAC;MACf;MAEA7D,KAAK,CAAC,mBAAmB,EAAEsC,QAAQ,CAAC;MACpCV,MAAM,CAACC,YAAY,CAACS,QAAQ,EAAEC,QAAQ,EAAE,UAAUa,GAA0B,EAAEW,MAAM,EAAQ;QAC1F,IAAIX,GAAG,EAAE;UACPpD,KAAK,CAAC,8CAA8C,EAAEsC,QAAQ,EAAEc,GAAG,EAAEY,OAAO,CAAC;UAC7E,OAAOvB,EAAE,CAACW,GAAG,CAAC;QAChB;;QAEA;QACA;QACA;QACA;QACA;QACA;QACA;QACA,IAAI,CAAC,CAACW,MAAM,IAAIA,MAAM,CAAClD,MAAM,KAAK,CAAC,EAAE;UACnC;UACA,IAAI8B,eAAC,CAACsB,QAAQ,CAACF,MAAM,CAAC,EAAE;YACtB,MAAM,IAAIrD,SAAS,CAAC,+CAA+C,CAAC;UACtE;UACA,MAAMwD,YAAqB,GAAGvB,eAAC,CAACwB,OAAO,CAACJ,MAAM,CAAC;UAC/C,IAAI,CAACG,YAAY,EAAE;YACjB,MAAM,IAAIxD,SAAS,CAAC0D,eAAS,CAACC,qBAAqB,CAAC;UACtD;UAEArE,KAAK,CAAC,yDAAyD,EAAEsC,QAAQ,EAAEyB,MAAM,CAAC;UAClF,OAAOtB,EAAE,CAACW,GAAG,EAAE,IAAAkB,wBAAgB,EAAChC,QAAQ,EAAEyB,MAAM,CAAC,CAAC;QACpD;QACAF,IAAI,CAAC,CAAC;MACR,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOU,QAAQA,CACbC,IAAY,EACZjC,QAAgB,EAChBE,EAA6D,EACvD;IACN,MAAMgC,IAAI,GAAG,IAAI;IACjB,MAAMhE,OAAO,GAAG,IAAI,CAACA,OAAO,CAACmD,KAAK,CAAC,CAAC,CAAC;IACrC5D,KAAK,CAAC,aAAa,EAAEwE,IAAI,CAAC;IAE1B,CAAC,SAASX,IAAIA,CAAA,EAAS;MACrB,IAAIa,MAAM,GAAG,SAAS;MACtB,MAAM9C,MAAM,GAAGnB,OAAO,CAACqD,KAAK,CAAC,CAA6B;MAC1D;MACA,IAAI,OAAOlC,MAAM,CAAC+C,OAAO,KAAK,WAAW,IAAI,OAAO/C,MAAM,CAAC2C,QAAQ,KAAK,UAAU,EAAE;QAClFG,MAAM,GAAG,UAAU;QACnBE,kBAAY,CAACC,IAAI,CAACD,kBAAY,CAACE,KAAK,CAACC,SAAS,CAAC;MACjD;MACA;MACA,IAAI,OAAOnD,MAAM,CAAC8C,MAAM,CAAC,KAAK,UAAU,EAAE;QACxCb,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACA;QACAjC,MAAM,CAAC8C,MAAM,CAAC,CACZF,IAAI,EACJjC,QAAQ,EACR,UAAUa,GAA0B,EAAE4B,EAAqB,EAAQ;UACjE,IAAI5B,GAAG,EAAE;YACPpD,KAAK,CAAC,2CAA2C,EAAEwE,IAAI,EAAEpB,GAAG,EAAEY,OAAO,CAAC;YACtE,OAAOvB,EAAE,CAACW,GAAG,CAAC;UAChB;UACA,IAAI4B,EAAE,EAAE;YACNhF,KAAK,CAAC,4BAA4B,EAAEwE,IAAI,CAAC;YACzC,OAAOC,IAAI,CAAC5C,YAAY,CAAC2C,IAAI,EAAEjC,QAAQ,EAAEE,EAAE,CAAC;UAC9C;UACAzC,KAAK,CAAC,mDAAmD,CAAC;UAC1D6D,IAAI,CAAC,CAAC;QACR,CACF,CAAC;MACH;IACF,CAAC,EAAE,CAAC;EACN;;EAEA;AACF;AACA;EACS/B,YAAYA,CACjB;IAAEmD,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAoC,EAC9B;IACN,MAAM1E,OAAO,GAAG,IAAI,CAACA,OAAO,CAACmD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMwB,cAA2B,GAAG;MAAE/D,IAAI,EAAE4D,WAAW;MAAEI,OAAO,EAAEH;IAAe,CAAC;IAClF,MAAMI,GAAG,GAAG9F,MAAM,CAAC+F,MAAM,CACvB,CAAC,CAAC,EACFH,cAAc,EACdI,eAAS,CAACC,sBAAsB,CAACR,WAAW,EAAE,IAAI,CAAC7E,MAAM,CAACsF,QAAQ,CACpE,CAAgC;IAChC1F,KAAK,CAAC,qBAAqB,EAAEiF,WAAW,CAAC;IAEzC,CAAC,SAASpB,IAAIA,CAAA,EAAS;MACrB,MAAMjC,MAAiC,GAAGnB,OAAO,CAACqD,KAAK,CAAC,CAA8B;MAEtF,IAAInB,eAAC,CAACQ,KAAK,CAACvB,MAAM,CAAC,IAAI,IAAAiB,kBAAU,EAACjB,MAAM,CAACE,YAAY,CAAC,KAAK,KAAK,EAAE;QAChE,OAAO+B,IAAI,CAAC,CAAC;MACf;MAEAjC,MAAM,CAACE,YAAY,CAAE0C,IAAI,EAAEc,GAAG,EAAE,UAAUlC,GAA0B,EAAE4B,EAAY,EAAQ;QACxF,IAAI5B,GAAG,EAAE;UACPpD,KAAK,CAAC,oCAAoC,EAAEiF,WAAW,EAAE7B,GAAG,EAAEY,OAAO,CAAC;UACtE,OAAOmB,QAAQ,CAAC/B,GAAG,CAAC;QACtB;QAEA,IAAI4B,EAAE,EAAE;UACNhF,KAAK,CAAC,uBAAuB,EAAEiF,WAAW,CAAC;UAC3C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAnB,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEO8B,eAAeA,CACpB;IAAEV,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAkB,EACZ;IACN,MAAMG,GAAG,GAAG9F,MAAM,CAAC+F,MAAM,CACvB;MAAElE,IAAI,EAAE4D,WAAW;MAAEI,OAAO,EAAEH;IAAe,CAAC,EAC9CM,eAAS,CAACC,sBAAsB,CAACR,WAAW,EAAE,IAAI,CAAC7E,MAAM,CAACsF,QAAQ,CACpE,CAAC;IACD1F,KAAK,CAAC,wBAAwB,EAAEiF,WAAW,CAAC;IAE5C,KAAK,MAAMrD,MAAM,IAAI,IAAI,CAACnB,OAAO,EAAE;MACjC,IAAI,OAAOmB,MAAM,EAAE+D,eAAe,KAAK,UAAU,EAAE;QACjD3F,KAAK,CAAC,kEAAkE,EAAEiF,WAAW,CAAC;QACtF;MACF,CAAC,MAAM;QACLrD,MAAM,CAAC+D,eAAe,CAACnB,IAAI,EAAEc,GAAG,EAAE,CAAClC,GAAG,EAAE4B,EAAE,KAAW;UACnD,IAAI5B,GAAG,EAAE;YACPpD,KAAK,CACH,qEAAqE,EACrEiF,WACF,CAAC;YACD,OAAOE,QAAQ,CAAC/B,GAAG,CAAC;UACtB;UAEA,IAAIT,eAAC,CAACQ,KAAK,CAAC6B,EAAE,CAAC,KAAK,IAAI,EAAE;YACxBhF,KAAK,CAAC,yDAAyD,EAAEiF,WAAW,CAAC;YAC7E,OAAO,IAAI,CAAClD,aAAa,CAAC;cAAEkD,WAAW;cAAEC;YAAe,CAAC,EAAEV,IAAI,EAAEW,QAAQ,CAAC;UAC5E;UAEA,IAAIH,EAAE,EAAE;YACNhF,KAAK,CAAC,0BAA0B,EAAEiF,WAAW,CAAC;YAC9C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;UAC3B;QACF,CAAC,CAAC;MACJ;IACF;EACF;;EAEA;AACF;AACA;EACSjD,aAAaA,CAClB;IAAEkD,WAAW;IAAEC;EAA8C,CAAC,EAC9DV,IAAgB,EAChBW,QAAkB,EACZ;IACN,MAAM1E,OAAO,GAAG,IAAI,CAACA,OAAO,CAACmD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAM0B,GAAG,GAAG9F,MAAM,CAAC+F,MAAM,CACvB;MAAElE,IAAI,EAAE4D,WAAW;MAAEI,OAAO,EAAEH;IAAe,CAAC,EAC9CM,eAAS,CAACC,sBAAsB,CAACR,WAAW,EAAE,IAAI,CAAC7E,MAAM,CAACsF,QAAQ,CACpE,CAAC;IACD1F,KAAK,CAAC,yCAAyC,EAAEiF,WAAW,EAAExE,OAAO,CAACI,MAAM,CAAC;IAE7E,CAAC,SAASgD,IAAIA,CAAA,EAAS;MACrB,MAAMjC,MAAM,GAAGnB,OAAO,CAACqD,KAAK,CAAC,CAAC;MAE9B,IAAI,OAAOlC,MAAM,EAAEG,aAAa,KAAK,UAAU,EAAE;QAC/C/B,KAAK,CAAC,8DAA8D,EAAEiF,WAAW,CAAC;QAClF,OAAOpB,IAAI,CAAC,CAAC;MACf;MAEAjC,MAAM,CAACG,aAAa,CAACyC,IAAI,EAAEc,GAAG,EAAE,CAAClC,GAA0B,EAAE4B,EAAY,KAAW;QAClF,IAAIrC,eAAC,CAACQ,KAAK,CAACC,GAAG,CAAC,KAAK,KAAK,IAAIT,eAAC,CAACiD,OAAO,CAACxC,GAAG,CAAC,EAAE;UAC5CpD,KAAK,CAAC,0BAA0B,EAAEiF,WAAW,CAAC;UAC9C,OAAOE,QAAQ,CAAC/B,GAAG,CAAC;QACtB;QAEA,IAAI4B,EAAE,EAAE;UACNhF,KAAK,CAAC,wBAAwB,EAAEiF,WAAW,CAAC;UAC5C,OAAOE,QAAQ,CAAC,IAAI,EAAEH,EAAE,CAAC;QAC3B;QAEAhF,KAAK,CAAC,sCAAsC,EAAEiF,WAAW,CAAC;QAC1DpB,IAAI,CAAC,CAAC,CAAC,CAAC;MACV,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC;EACN;EAEOgC,gBAAgBA,CAAA,EAAQ;IAC7B7F,KAAK,CAAC,gBAAgB,CAAC;IACvB,MAAMS,OAAO,GAAG,IAAI,CAACA,OAAO,CAACmD,KAAK,CAAC,CAAC,CAAC;IACrC,MAAMkC,OAAO,GAAG;MAAEC,yBAAyB,EAAzBA,iCAAyB;MAAEzB,gBAAgB,EAAhBA;IAAiB,CAAC;IAC/D,KAAK,MAAM1C,MAAM,IAAInB,OAAO,EAAE;MAC5B,IAAImB,MAAM,CAACiE,gBAAgB,EAAE;QAC3B,OAAOjE,MAAM,CAACiE,gBAAgB,CAACC,OAAO,CAAC;MACzC;IACF;IAEA,OAAO,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAK;MACzEF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMtC,IAAI,GAAG,SAAAA,CAAUT,GAAoB,EAAgB;QACzD4C,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ;QACA;QACA;QACA;QACA,IAAIhD,GAAG,EAAE;UACP4C,GAAG,CAACK,WAAW,CAAC5E,KAAK,GAAG2B,GAAG,CAACY,OAAO;QACrC;QAEA,OAAOkC,KAAK,CAAC,CAAC;MAChB,CAAC;;MAED;MACA;MACA;MACA;MACA;;MAEA;MACA,MAAMI,UAAU,GAAG,IAAAP,iCAAyB,EAAC,CAAC;MAC9CC,GAAG,CAACK,WAAW,GAAGC,UAAU;MAC5BL,GAAG,CAACM,MAAM,CAACF,WAAW,GAAGC,UAAU;MAEnC,MAAM;QAAEE;MAAc,CAAC,GAAGR,GAAG,CAACS,OAAO;MACrC,IAAI9D,eAAC,CAACQ,KAAK,CAACqD,aAAa,CAAC,EAAE;QAC1BxG,KAAK,CAAC,uCAAuC,CAAC;QAC9C,OAAO6D,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA6C,wBAAiB,EAACF,aAAa,CAAC,EAAE;QACrCxG,KAAK,CAAC,kDAAkD,CAAC;QACzD,OAAO6D,IAAI,CAACd,gBAAU,CAAC4D,aAAa,CAACvC,eAAS,CAACwC,eAAe,CAAC,CAAC;MAClE;MACA,MAAM;QAAEpG,MAAM;QAAEqG;MAAS,CAAC,GAAG,IAAI,CAACzG,MAAM;MAExC,IAAI,IAAA0G,kBAAW,EAACD,QAAQ,CAAC,EAAE;QACzB7G,KAAK,CAAC,wCAAwC,CAAC;QAC/C,IAAI,CAAC+G,mBAAmB,CAACf,GAAG,EAAEa,QAAQ,EAAErG,MAAM,EAAEgG,aAAa,EAAE3C,IAAI,CAAC;MACtE,CAAC,MAAM;QACL7D,KAAK,CAAC,qCAAqC,CAAC;QAC5C,IAAI,CAACgH,sBAAsB,CAAChB,GAAG,EAAEa,QAAQ,EAAErG,MAAM,EAAEgG,aAAa,EAAE3C,IAAI,CAAC;MACzE;IACF,CAAC;EACH;EAEQmD,sBAAsBA,CAC5BhB,GAAmB,EACnBa,QAAkB,EAClBrG,MAAc,EACdgG,aAAqB,EACrB3C,IAAS,EACH;IACN7D,KAAK,CAAC,2BAA2B,CAAC;IAClC,MAAM;MAAEiH,MAAM;MAAE1D;IAAM,CAAC,GAAG,IAAA2D,2BAAoB,EAACV,aAAa,CAAC;IAC7D,IAAIS,MAAM,CAACE,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;MACtDnH,KAAK,CAAC,oBAAoB,CAAC;MAC3B;MACA,MAAMqH,WAAW,GAAG,IAAAC,6BAAsB,EAAC/D,KAAK,CAAC,CAACgE,QAAQ,CAAC,CAAC;MAC5D,MAAM;QAAE/C,IAAI;QAAEjC;MAAS,CAAC,GAAG,IAAAiF,4BAAiB,EAACH,WAAW,CAAe;MACvErH,KAAK,CAAC,mBAAmB,EAAEwE,IAAI,CAAC;MAChC,IAAI,CAAC3C,YAAY,CAAC2C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAA0B,EAAEoB,IAAI,KAAW;QAC5E,IAAI,CAACpB,GAAG,EAAE;UACRpD,KAAK,CAAC,0BAA0B,CAAC;UACjCgG,GAAG,CAACK,WAAW,GAAG7B,IAAI;UACtBX,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACL7D,KAAK,CAAC,2BAA2B,CAAC;UAClCgG,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7ClC,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACLpD,KAAK,CAAC,kBAAkB,CAAC;MACzB,MAAMqH,WAAgB,GAAG,IAAAI,+BAAwB,EAACZ,QAAQ,EAAErG,MAAM,EAAEgG,aAAa,CAAC;MAClF,IAAIa,WAAW,EAAE;QACf;QACArB,GAAG,CAACK,WAAW,GAAGgB,WAAW;QAC7BrH,KAAK,CAAC,0BAA0B,CAAC;QACjC6D,IAAI,CAAC,CAAC;MACR,CAAC,MAAM;QACL;QACA7D,KAAK,CAAC,mBAAmB,CAAC;QAC1B6D,IAAI,CAACd,gBAAU,CAAC2E,YAAY,CAACtD,eAAS,CAACuD,qBAAqB,CAAC,CAAC;MAChE;IACF;EACF;EAEQZ,mBAAmBA,CACzBf,GAAmB,EACnBa,QAAkB,EAClBrG,MAAc,EACdgG,aAAqB,EACrB3C,IAAc,EACR;IACN7D,KAAK,CAAC,8BAA8B,CAAC;IACrCA,KAAK,CAAC,iCAAiC,EAAE,OAAOQ,MAAM,KAAK,QAAQ,CAAC;IACpER,KAAK,CAAC,iCAAiC,EAAE,OAAOwG,aAAa,KAAK,QAAQ,CAAC;IAC3E,MAAMa,WAAgB,GAAG,IAAAI,+BAAwB,EAACZ,QAAQ,EAAErG,MAAM,EAAEgG,aAAa,CAAC;IAClFxG,KAAK,CAAC,+BAA+B,EAAEqH,WAAW,EAAEhG,IAAI,CAAC;IACzD,IAAIgG,WAAW,EAAE;MACf,MAAM;QAAE7C,IAAI;QAAEjC;MAAS,CAAC,GAAG8E,WAAW;MACtCrH,KAAK,CAAC,mBAAmB,EAAEwE,IAAI,CAAC;MAChC,IAAI,CAAC3C,YAAY,CAAC2C,IAAI,EAAEjC,QAAQ,EAAE,CAACa,GAAG,EAAEoB,IAAI,KAAW;QACrD,IAAI,CAACpB,GAAG,EAAE;UACR4C,GAAG,CAACK,WAAW,GAAG7B,IAAI;UACtBxE,KAAK,CAAC,0BAA0B,CAAC;UACjC6D,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACLmC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;UAC7C/F,KAAK,CAAC,2BAA2B,CAAC;UAClC6D,IAAI,CAACT,GAAG,CAAC;QACX;MACF,CAAC,CAAC;IACJ,CAAC,MAAM;MACL;MACApD,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAO6D,IAAI,CAACd,gBAAU,CAAC4D,aAAa,CAACvC,eAAS,CAACwC,eAAe,CAAC,CAAC;IAClE;EACF;EAEQgB,kBAAkBA,CAACvB,WAAwB,EAAW;IAC5D,OAAO1D,eAAC,CAACkF,WAAW,CAACxB,WAAW,CAAC,KAAK,KAAK,IAAI1D,eAAC,CAACkF,WAAW,CAACxB,WAAW,EAAEhF,IAAI,CAAC,KAAK,KAAK;EAC3F;;EAEA;AACF;AACA;EACSyG,kBAAkBA,CAAA,EAAG;IAC1B,OAAO,CAAC9B,GAAmB,EAAEC,GAAoB,EAAEC,KAAmB,KAAW;MAC/E,IAAI,IAAI,CAAC0B,kBAAkB,CAAC5B,GAAG,CAACK,WAAW,CAAC,EAAE;QAC5C,OAAOH,KAAK,CAAC,CAAC;MAChB;MAEAF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMtC,IAAI,GAAIT,GAA0B,IAAW;QACjD4C,GAAG,CAACI,MAAM,CAAC,CAAC;QACZ,IAAIhD,GAAG,EAAE;UACP4C,GAAG,CAACK,WAAW,CAAC5E,KAAK,GAAG2B,GAAG,CAACY,OAAO;UACnCiC,GAAG,CAAC8B,MAAM,CAAC3E,GAAG,CAAC4E,UAAU,CAAC,CAACC,IAAI,CAAC7E,GAAG,CAACY,OAAO,CAAC;QAC9C;QAEA,OAAOkC,KAAK,CAAC,CAAC;MAChB,CAAC;MAED,MAAM;QAAEM;MAAc,CAAC,GAAGR,GAAG,CAACS,OAAO;MACrC,IAAI9D,eAAC,CAACQ,KAAK,CAACqD,aAAa,CAAC,EAAE;QAC1B,OAAO3C,IAAI,CAAC,CAAC;MACf;MAEA,IAAI,CAAC,IAAA6C,wBAAiB,EAACF,aAAa,CAAC,EAAE;QACrC,OAAO3C,IAAI,CAACd,gBAAU,CAAC4D,aAAa,CAACvC,eAAS,CAACwC,eAAe,CAAC,CAAC;MAClE;MAEA,MAAMrD,KAAK,GAAG,CAACiD,aAAa,IAAI,EAAE,EAAE0B,OAAO,CAAC,GAAGC,kBAAY,GAAG,EAAE,EAAE,CAAC;MACnE,IAAI,CAAC5E,KAAK,EAAE;QACV,OAAOM,IAAI,CAAC,CAAC;MACf;MAEA,IAAIwD,WAAmC;MACvC,IAAI;QACFA,WAAW,GAAG,IAAAe,uBAAgB,EAAC7E,KAAK,EAAE,IAAI,CAACnD,MAAM,CAACI,MAAM,EAAE,IAAI,CAACJ,MAAM,CAACyG,QAAQ,CAAC;MACjF,CAAC,CAAC,OAAOzD,GAAQ,EAAE;QACjB;MAAA;MAGF,IAAI,IAAI,CAACwE,kBAAkB,CAACP,WAAW,CAAC,EAAE;QACxC,MAAM;UAAEhG,IAAI;UAAE0C;QAAO,CAAC,GAAGsD,WAAyB;QAClDrB,GAAG,CAACK,WAAW,GAAG,IAAA/B,wBAAgB,EAACjD,IAAI,EAAY0C,MAAM,CAAC;MAC5D,CAAC,MAAM;QACLiC,GAAG,CAACK,WAAW,GAAG,IAAAN,iCAAyB,EAAC,CAAC;MAC/C;MAEAlC,IAAI,CAAC,CAAC;IACR,CAAC;EACH;EAEA,MAAawE,UAAUA,CAAC7D,IAAgB,EAAE8D,WAA2B,EAAmB;IACtF,MAAM;MAAEC,WAAW;MAAElH,IAAI;MAAE0C;IAAO,CAAC,GAAGS,IAAI;IAC1CxE,KAAK,CAAC,gBAAgB,EAAEqB,IAAI,CAAC;IAC7B,MAAMmH,mBAAmB,GAAG7F,eAAC,CAACQ,KAAK,CAACoF,WAAW,CAAC,GAAG,EAAE,GAAGA,WAAW;IACnE,MAAME,aAAa,GAAG9F,eAAC,CAACQ,KAAK,CAACY,MAAM,CAAC,GACjCwE,WAAW,GACXG,KAAK,CAACC,IAAI,CAAC,IAAIC,GAAG,CAAC,CAAC,GAAG7E,MAAM,CAAC8E,MAAM,CAACL,mBAAmB,CAAC,CAAC,CAAC,CAAC;IAChE,MAAMM,OAAmB,GAAG;MAC1BP,WAAW,EAAEC,mBAAmB;MAChCnH,IAAI;MACJ0C,MAAM,EAAE0E;IACV,CAAC;IACD,MAAMlF,KAAa,GAAG,MAAM,IAAAwF,sBAAW,EAACD,OAAO,EAAE,IAAI,CAACtI,MAAM,EAAE8H,WAAW,CAAC;IAE1E,OAAO/E,KAAK;EACd;;EAEA;AACF;AACA;EACSyF,UAAUA,CAACC,KAAa,EAAiB;IAC9C,IAAI,IAAI,CAACzI,MAAM,CAACK,MAAM,KAAKqI,0BAAkB,EAAE;MAC7ClJ,KAAK,CAAC,kCAAkC,CAAC;MACzC,MAAMuD,KAAK,GAAG,IAAAyF,qBAAU,EAACC,KAAK,EAAE,IAAI,CAACzI,MAAM,CAAC;MAC5C,OAAO+C,KAAK;IACd,CAAC,MAAM;MACLvD,KAAK,CAAC,6CAA6C,CAAC;MACpD;MACA,MAAMuD,KAAK,GAAG,IAAA4F,+BAAoB,EAACC,MAAM,CAACT,IAAI,CAACM,KAAK,CAAC,EAAE,IAAI,CAACzI,MAAM,CAAC,CAAC+G,QAAQ,CAAC,QAAQ,CAAC;MACtF,OAAOhE,KAAK;IACd;EACF;AACF;AAAC8F,OAAA,CAAAnJ,IAAA,GAAAA,IAAA","ignoreList":[]}

package/build/signature-legacy.js

@@ -54,7 +54,7 @@ function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
   } = (0, _utils.parseAuthTokenHeader)(authorizationHeader);
   debug('is jwt');
   if (_lodash.default.isString(token) && scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
-    return (0, _utils.verifyJWTPayload)(token, secretKey);
+    return (0, _utils.verifyJWTPayload)(token, secretKey, security);
   }
 }
 //# sourceMappingURL=signature-legacy.js.map

package/build/signature-legacy.js.map

@@ -1 +1 @@
-{"version":3,"file":"signature-legacy.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_signature","_utils","e","__esModule","default","debug","buildDebug","parseAESCredentials","authorizationHeader","secret","scheme","token","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","Buffer","from","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload"],"sources":["../src/signature-legacy.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';\nimport { aesDecryptDeprecated as aesDecrypt, parseBasicPayload } from '@verdaccio/signature';\nimport { Security } from '@verdaccio/types';\n\nimport { AuthMiddlewarePayload } from './types';\nimport {\n  convertPayloadToBase64,\n  isAESLegacy,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(Buffer.from(token), secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (typeof credentials !== 'string') {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAIA,IAAAI,MAAA,GAAAJ,OAAA;AAKiB,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEzC,SAASC,mBAAmBA,CAACC,mBAA2B,EAAEC,MAAc,EAAE;EAC/EJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEK,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIE,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDR,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMU,WAAW,GAAG,IAAAC,6BAAsB,EAACL,KAAK,CAAC,CAACM,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIL,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DR,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMU,WAAW,GAAG,IAAAI,+BAAU,EAACC,MAAM,CAACC,IAAI,CAACV,KAAK,CAAC,EAAEF,MAAM,CAAC;IAE1D,OAAOM,WAAW;EACpB;AACF;AAEO,SAASO,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBhB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAI,IAAAoB,kBAAW,EAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMU,WAAW,GAAGR,mBAAmB,CAACC,mBAAmB,EAAEgB,SAAS,CAAC;IACvE,IAAI,OAAOT,WAAW,KAAK,QAAQ,EAAE;MACnCV,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMqB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACZ,WAAW,CAAC;IACxD,IAAI,CAACW,iBAAiB,EAAE;MACtBrB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOqB,iBAAiB;EAC1B;EACA,MAAM;IAAEhB,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIuB,eAAC,CAACC,QAAQ,CAAClB,KAAK,CAAC,IAAID,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAO,IAAAiB,uBAAgB,EAACnB,KAAK,EAAEa,SAAS,CAAC;EAC3C;AACF","ignoreList":[]}
+{"version":3,"file":"signature-legacy.js","names":["_debug","_interopRequireDefault","require","_lodash","_core","_signature","_utils","e","__esModule","default","debug","buildDebug","parseAESCredentials","authorizationHeader","secret","scheme","token","parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","aesDecrypt","Buffer","from","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload"],"sources":["../src/signature-legacy.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';\nimport { aesDecryptDeprecated as aesDecrypt, parseBasicPayload } from '@verdaccio/signature';\nimport { Security } from '@verdaccio/types';\n\nimport { AuthMiddlewarePayload } from './types';\nimport {\n  convertPayloadToBase64,\n  isAESLegacy,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    const credentials = aesDecrypt(Buffer.from(token), secret);\n\n    return credentials;\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (typeof credentials !== 'string') {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AACA,IAAAG,UAAA,GAAAH,OAAA;AAIA,IAAAI,MAAA,GAAAJ,OAAA;AAKiB,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEjB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEzC,SAASC,mBAAmBA,CAACC,mBAA2B,EAAEC,MAAc,EAAE;EAC/EJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,MAAM;IAAEK,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIE,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDR,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMU,WAAW,GAAG,IAAAC,6BAAsB,EAACL,KAAK,CAAC,CAACM,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIL,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DR,KAAK,CAAC,sBAAsB,CAAC;IAC7B,MAAMU,WAAW,GAAG,IAAAI,+BAAU,EAACC,MAAM,CAACC,IAAI,CAACV,KAAK,CAAC,EAAEF,MAAM,CAAC;IAE1D,OAAOM,WAAW;EACpB;AACF;AAEO,SAASO,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBhB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,0BAA0B,CAAC;EACjC;EACA,IAAI,IAAAoB,kBAAW,EAACF,QAAQ,CAAC,EAAE;IACzBlB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMU,WAAW,GAAGR,mBAAmB,CAACC,mBAAmB,EAAEgB,SAAS,CAAC;IACvE,IAAI,OAAOT,WAAW,KAAK,QAAQ,EAAE;MACnCV,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMqB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACZ,WAAW,CAAC;IACxD,IAAI,CAACW,iBAAiB,EAAE;MACtBrB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOqB,iBAAiB;EAC1B;EACA,MAAM;IAAEhB,MAAM;IAAEC;EAAM,CAAC,GAAG,IAAAC,2BAAoB,EAACJ,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAIuB,eAAC,CAACC,QAAQ,CAAClB,KAAK,CAAC,IAAID,MAAM,CAACG,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAO,IAAAiB,uBAAgB,EAACnB,KAAK,EAAEa,SAAS,EAAED,QAAQ,CAAC;EACrD;AACF","ignoreList":[]}

package/build/utils.d.ts

@@ -12,7 +12,7 @@ export declare function getMiddlewareCredentials(security: Security, secretKey:
 export declare function isAESLegacy(security: Security): boolean;
 export declare function getApiToken(auth: TokenEncryption, config: Config, remoteUser: RemoteUser, aesPassword: string): Promise<string | void>;
 export declare const expireReasons: string[];
-export declare function verifyJWTPayload(token: string, secret: string): RemoteUser;
+export declare function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser;
 export declare function isAuthHeaderValid(authorization: string): boolean;
 /**
  * Return a default configuration for authentication if none is provided.

package/build/utils.js

@@ -86,7 +86,7 @@ function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
   } = parseAuthTokenHeader(authorizationHeader);
   debug('is jwt');
   if (_lodash.default.isString(token) && scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
-    return verifyJWTPayload(token, secretKey);
+    return verifyJWTPayload(token, secretKey, security);
   }
 }
 function isAESLegacy(security) {
@@ -119,9 +119,9 @@ async function getApiToken(auth, config, remoteUser, aesPassword) {
   });
 }
 const expireReasons = exports.expireReasons = ['JsonWebTokenError', 'TokenExpiredError'];
-function verifyJWTPayload(token, secret) {
+function verifyJWTPayload(token, secret, security) {
   try {
-    const payload = (0, _signature.verifyPayload)(token, secret);
+    const payload = (0, _signature.verifyPayload)(token, secret, security?.api?.jwt?.verify);
     return payload;
   } catch (error) {
     // #168 this check should be removed as soon AES encrypt is removed.

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["_debug","_interopRequireDefault","require","_lodash","_config","_core","_signature","e","__esModule","default","debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","length","isLegacyUnsecure","aesDecryptDeprecated","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","exports","payload","verifyPayload","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport {\n  aesDecrypt,\n  aesDecryptDeprecated,\n  parseBasicPayload,\n  verifyPayload,\n} from '@verdaccio/signature';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    debug('secret length %o', secret.length);\n    const isLegacyUnsecure = secret.length > 32;\n    debug('is legacy unsecure %o', isLegacyUnsecure);\n    if (isLegacyUnsecure) {\n      debug('legacy unsecure enabled');\n      return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');\n    } else {\n      debug('legacy secure enabled');\n      return aesDecrypt(token.toString(), secret);\n    }\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,UAAA,GAAAJ,OAAA;AAK8B,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAY9B,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,mBAA2B,EAAmB;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,MAAM,CAACC,MAAM,EAAEC,KAAK,CAAC,GAAGH,KAAK;EAE7B,OAAO;IAAEE,MAAM;IAAEC;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmBA,CAACL,mBAA2B,EAAEM,MAAc,EAAE;EAC/ET,KAAK,CAAC,0BAA0B,CAAC;EACjC,MAAM;IAAEM,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIG,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDV,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAK,CAAC,CAACO,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIN,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DV,KAAK,CAAC,sBAAsB,CAAC;IAC7BA,KAAK,CAAC,kBAAkB,EAAES,MAAM,CAACO,MAAM,CAAC;IACxC,MAAMC,gBAAgB,GAAGR,MAAM,CAACO,MAAM,GAAG,EAAE;IAC3ChB,KAAK,CAAC,uBAAuB,EAAEiB,gBAAgB,CAAC;IAChD,IAAIA,gBAAgB,EAAE;MACpBjB,KAAK,CAAC,yBAAyB,CAAC;MAChC,OAAO,IAAAkB,+BAAoB,EAACL,sBAAsB,CAACN,KAAK,CAAC,EAAEE,MAAM,CAAC,CAACK,QAAQ,CAAC,OAAO,CAAC;IACtF,CAAC,MAAM;MACLd,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAO,IAAAmB,qBAAU,EAACZ,KAAK,CAACO,QAAQ,CAAC,CAAC,EAAEL,MAAM,CAAC;IAC7C;EACF;AACF;AAEO,SAASW,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBnB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,+BAA+B,CAAC;EACtC;EACA,IAAIuB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBrB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAmB,EAAEmB,SAAS,CAAC;IACvE,IAAI,CAACV,WAAW,EAAE;MAChBZ,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMwB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACb,WAAW,CAAC;IACxD,IAAI,CAACY,iBAAiB,EAAE;MACtBxB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOwB,iBAAiB;EAC1B;EACA,MAAM;IAAElB,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAI0B,eAAC,CAACC,QAAQ,CAACpB,KAAK,CAAC,IAAID,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAOkB,gBAAgB,CAACrB,KAAK,EAAEe,SAAS,CAAC;EAC3C;AACF;AAEO,SAASC,WAAWA,CAACF,QAAkB,EAAW;EACvD,MAAM;IAAEQ,MAAM;IAAEC;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAEpC,OAAOL,eAAC,CAACM,KAAK,CAACH,MAAM,CAAC,KAAK,KAAK,IAAIH,eAAC,CAACM,KAAK,CAACF,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAEO,eAAeI,WAAWA,CAC/BC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB,EACK;EACxBrC,KAAK,CAAC,eAAe,CAAC;EACtB,MAAM;IAAEqB;EAAS,CAAC,GAAGc,MAAM;EAE3B,IAAIZ,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBrB,KAAK,CAAC,yBAAyB,CAAC;IAChC;IACA,OAAO,MAAM,IAAIsC,OAAO,CAAEC,OAAO,IAAW;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;EACJ;EACA,MAAM;IAAEP;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAE5B,IAAID,GAAG,EAAEa,IAAI,EAAE;IACb,OAAO,MAAMT,IAAI,CAACU,UAAU,CAACR,UAAU,EAAEN,GAAG,CAACa,IAAI,CAAC;EACpD;EACA,OAAO,MAAM,IAAIL,OAAO,CAAEC,OAAO,IAAW;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;AACJ;AAEO,MAAMQ,aAAuB,GAAAC,OAAA,CAAAD,aAAA,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAE1E,SAASjB,gBAAgBA,CAACrB,KAAa,EAAEE,MAAc,EAAc;EAC1E,IAAI;IACF,MAAMsC,OAAmB,GAAG,IAAAC,wBAAa,EAACzC,KAAK,EAAEE,MAAM,CAAC;IAExD,OAAOsC,OAAO;EAChB,CAAC,CAAC,OAAOE,KAAU,EAAE;IACnB;IACA,IAAIJ,aAAa,CAACK,QAAQ,CAACD,KAAK,CAACP,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAS,iCAAyB,EAAC,CAAC;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiBA,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAACrD,KAAK,CAAC,GAAG,CAAC,CAACW,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAAS2C,iBAAiBA,CAACC,MAAc,EAA4B;EAC1E,OAAO;IACLC,YAAYA,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjFhE,KAAK,CAAC,uCAAuC,CAAC;MAC9CgE,EAAE,CAACZ,gBAAU,CAACa,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAOA,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChFhE,KAAK,CAAC,kCAAkC,CAAC;MACzC;MACA;MACAgE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IAChB,CAAC;IAED;IACAK,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEV,MAAM,CAAC;IAC5C;IACAW,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEV,MAAM,CAAC;IAC9CY,eAAe,EAAEC,sBAAsB,CAACb,MAAM;EAChD,CAAC;AACH;AAEO,SAASU,YAAYA,CAACI,MAAsB,EAAEd,MAAc,EAAe;EAChF,OAAO,SAASe,mBAAmBA,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNlB,MAAM,CAACmB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAAClC;IAAK,CAAC,EAAE,sCAAsC,CAAC;IAC3E,MAAM;MAAEA,IAAI;MAAEuC;IAAO,CAAC,GAAGL,IAAI;IAC7B5E,KAAK,CAAC,8BAA8B,EAAE0E,MAAM,EAAEO,MAAM,CAAC;IACrD,MAAMC,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3C1E,KAAK,CAAC,mCAAmC,EAAE0E,MAAM,EAAEQ,WAAW,CAAC;IAC/D,MAAMC,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAEC,KAAK,IAAK;MAChD,OAAO3C,IAAI,KAAK2C,KAAK,IAAIJ,MAAM,CAAC/B,QAAQ,CAACmC,KAAK,CAAC;IACjD,CAAC,CAAC;IACFrF,KAAK,CAAC,kCAAkC,EAAE0C,IAAI,EAAEyC,aAAa,CAAC;IAC9DvB,MAAM,CAACmB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACnC,IAAI;MAAEyC,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAAClC,IAAI;MAAEwC;IAAY,CAAC,EACpE,+FACF,CAAC;IAED,IAAIC,aAAa,EAAE;MACjBvB,MAAM,CAACmB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAAClC;MAAK,CAAC,EAAE,iDAAiD,CAAC;MACtF,OAAOoC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAIpC,IAAI,EAAE;MACRoC,QAAQ,CACN1B,gBAAU,CAACa,YAAY,CAAC,QAAQvB,IAAI,sBAAsBgC,MAAM,YAAYG,GAAG,CAACnC,IAAI,EAAE,CACxF,CAAC;IACH,CAAC,MAAM;MACLoC,QAAQ,CACN1B,gBAAU,CAACmC,eAAe,CAAC,6BAA6Bb,MAAM,YAAYG,GAAG,CAACnC,IAAI,EAAE,CACtF,CAAC;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAAS+B,sBAAsBA,CAACb,MAAc,EAAO;EAC1D,OAAO,UAAUgB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,MAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,MAAMc,kBAA2B,GAAG,CAACX,GAAG,CAACH,MAAM,CAAC;IAChD1E,KAAK,CAAC,kCAAkC,EAAEwF,kBAAkB,CAAC;IAC7D,MAAMC,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIX,GAAG,CAACH,MAAM,CAAC,CAAc1D,MAAM,GAAG,CAAC;IAC5F4C,MAAM,CAACmB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAAClC,IAAI;MAAEA,IAAI,EAAEmC,GAAG,CAACnC,IAAI;MAAE+C;IAAU,CAAC,EAC9C,qEACF,CAAC;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOX,QAAQ,CAAC,IAAI,EAAEY,SAAS,CAAC;IAClC;IAEA9B,MAAM,CAACmB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAAClC,IAAI;MAAEA,IAAI,EAAEmC,GAAG,CAACnC,IAAI;MAAEgC,MAAM;MAAEe;IAAU,CAAC,EACtD,6EACF,CAAC;IACD,OAAOnB,YAAY,CAACI,MAAM,EAAEd,MAAM,CAAC,CAACgB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAASrC,SAASA,CAACC,IAAY,EAAEiD,QAAgB,EAAU;EAChE,OAAOC,MAAM,CAAC,GAAGlD,IAAI,IAAIiD,QAAQ,EAAE,CAAC;AACtC;AAEO,SAAS9E,sBAAsBA,CAACkC,OAAe,EAAU;EAC9D,OAAO8C,MAAM,CAACC,IAAI,CAAC/C,OAAO,EAAE,QAAQ,CAAC;AACvC","ignoreList":[]}
+{"version":3,"file":"utils.js","names":["_debug","_interopRequireDefault","require","_lodash","_config","_core","_signature","e","__esModule","default","debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","scheme","token","parseAESCredentials","secret","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","toString","TOKEN_BEARER","length","isLegacyUnsecure","aesDecryptDeprecated","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_","isString","verifyJWTPayload","legacy","jwt","api","isNil","getApiToken","auth","config","remoteUser","aesPassword","Promise","resolve","aesEncrypt","buildUser","name","sign","jwtEncrypt","expireReasons","exports","payload","verifyPayload","verify","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","getDefaultPlugins","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","getUnauthorized","isUnpublishMissing","hasGroups","undefined","password","String","Buffer","from"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport {\n  API_ERROR,\n  HTTP_STATUS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  errorUtils,\n  pluginUtils,\n} from '@verdaccio/core';\nimport {\n  aesDecrypt,\n  aesDecryptDeprecated,\n  parseBasicPayload,\n  verifyPayload,\n} from '@verdaccio/signature';\nimport { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    debug('secret length %o', secret.length);\n    const isLegacyUnsecure = secret.length > 32;\n    debug('is legacy unsecure %o', isLegacyUnsecure);\n    if (isLegacyUnsecure) {\n      debug('legacy unsecure enabled');\n      return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');\n    } else {\n      debug('legacy secure enabled');\n      return aesDecrypt(token.toString(), secret);\n    }\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret, security?.api?.jwt?.verify);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAQA,IAAAI,UAAA,GAAAJ,OAAA;AAK8B,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAY9B,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,mBAA2B,EAAmB;EACjF,MAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,MAAM,CAACC,MAAM,EAAEC,KAAK,CAAC,GAAGH,KAAK;EAE7B,OAAO;IAAEE,MAAM;IAAEC;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmBA,CAACL,mBAA2B,EAAEM,MAAc,EAAE;EAC/ET,KAAK,CAAC,0BAA0B,CAAC;EACjC,MAAM;IAAEM,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;;EAEnE;EACA;EACA,IAAIG,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDV,KAAK,CAAC,qBAAqB,CAAC;IAC5B,MAAMY,WAAW,GAAGC,sBAAsB,CAACN,KAAK,CAAC,CAACO,QAAQ,CAAC,CAAC;IAE5D,OAAOF,WAAW;EACpB,CAAC,MAAM,IAAIN,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC9DV,KAAK,CAAC,sBAAsB,CAAC;IAC7BA,KAAK,CAAC,kBAAkB,EAAES,MAAM,CAACO,MAAM,CAAC;IACxC,MAAMC,gBAAgB,GAAGR,MAAM,CAACO,MAAM,GAAG,EAAE;IAC3ChB,KAAK,CAAC,uBAAuB,EAAEiB,gBAAgB,CAAC;IAChD,IAAIA,gBAAgB,EAAE;MACpBjB,KAAK,CAAC,yBAAyB,CAAC;MAChC,OAAO,IAAAkB,+BAAoB,EAACL,sBAAsB,CAACN,KAAK,CAAC,EAAEE,MAAM,CAAC,CAACK,QAAQ,CAAC,OAAO,CAAC;IACtF,CAAC,MAAM;MACLd,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAO,IAAAmB,qBAAU,EAACZ,KAAK,CAACO,QAAQ,CAAC,CAAC,EAAEL,MAAM,CAAC;IAC7C;EACF;AACF;AAEO,SAASW,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBnB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,+BAA+B,CAAC;EACtC;EACA,IAAIuB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBrB,KAAK,CAAC,WAAW,CAAC;IAClB,MAAMY,WAAW,GAAGJ,mBAAmB,CAACL,mBAAmB,EAAEmB,SAAS,CAAC;IACvE,IAAI,CAACV,WAAW,EAAE;MAChBZ,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,MAAMwB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACb,WAAW,CAAC;IACxD,IAAI,CAACY,iBAAiB,EAAE;MACtBxB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOwB,iBAAiB;EAC1B;EACA,MAAM;IAAElB,MAAM;IAAEC;EAAM,CAAC,GAAGL,oBAAoB,CAACC,mBAAmB,CAAC;EAEnEH,KAAK,CAAC,QAAQ,CAAC;EACf,IAAI0B,eAAC,CAACC,QAAQ,CAACpB,KAAK,CAAC,IAAID,MAAM,CAACI,WAAW,CAAC,CAAC,KAAKK,kBAAY,CAACL,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAOkB,gBAAgB,CAACrB,KAAK,EAAEe,SAAS,EAAED,QAAQ,CAAC;EACrD;AACF;AAEO,SAASE,WAAWA,CAACF,QAAkB,EAAW;EACvD,MAAM;IAAEQ,MAAM;IAAEC;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAEpC,OAAOL,eAAC,CAACM,KAAK,CAACH,MAAM,CAAC,KAAK,KAAK,IAAIH,eAAC,CAACM,KAAK,CAACF,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAEO,eAAeI,WAAWA,CAC/BC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB,EACK;EACxBrC,KAAK,CAAC,eAAe,CAAC;EACtB,MAAM;IAAEqB;EAAS,CAAC,GAAGc,MAAM;EAE3B,IAAIZ,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBrB,KAAK,CAAC,yBAAyB,CAAC;IAChC;IACA,OAAO,MAAM,IAAIsC,OAAO,CAAEC,OAAO,IAAW;MAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;EACJ;EACA,MAAM;IAAEP;EAAI,CAAC,GAAGT,QAAQ,CAACU,GAAG;EAE5B,IAAID,GAAG,EAAEa,IAAI,EAAE;IACb,OAAO,MAAMT,IAAI,CAACU,UAAU,CAACR,UAAU,EAAEN,GAAG,CAACa,IAAI,CAAC;EACpD;EACA,OAAO,MAAM,IAAIL,OAAO,CAAEC,OAAO,IAAW;IAC1CA,OAAO,CAACL,IAAI,CAACM,UAAU,CAACC,SAAS,CAACL,UAAU,CAACM,IAAI,EAAYL,WAAW,CAAC,CAAC,CAAC;EAC7E,CAAC,CAAC;AACJ;AAEO,MAAMQ,aAAuB,GAAAC,OAAA,CAAAD,aAAA,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAE1E,SAASjB,gBAAgBA,CAACrB,KAAa,EAAEE,MAAc,EAAEY,QAAkB,EAAc;EAC9F,IAAI;IACF,MAAM0B,OAAmB,GAAG,IAAAC,wBAAa,EAACzC,KAAK,EAAEE,MAAM,EAAEY,QAAQ,EAAEU,GAAG,EAAED,GAAG,EAAEmB,MAAM,CAAC;IAEpF,OAAOF,OAAO;EAChB,CAAC,CAAC,OAAOG,KAAU,EAAE;IACnB;IACA,IAAIL,aAAa,CAACM,QAAQ,CAACD,KAAK,CAACR,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAU,iCAAyB,EAAC,CAAC;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiBA,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAACtD,KAAK,CAAC,GAAG,CAAC,CAACW,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAAS4C,iBAAiBA,CAACC,MAAc,EAA4B;EAC1E,OAAO;IACLC,YAAYA,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjFjE,KAAK,CAAC,uCAAuC,CAAC;MAC9CiE,EAAE,CAACZ,gBAAU,CAACa,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAOA,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChFjE,KAAK,CAAC,kCAAkC,CAAC;MACzC;MACA;MACAiE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IAChB,CAAC;IAED;IACAK,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEV,MAAM,CAAC;IAC5C;IACAW,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEV,MAAM,CAAC;IAC9CY,eAAe,EAAEC,sBAAsB,CAACb,MAAM;EAChD,CAAC;AACH;AAEO,SAASU,YAAYA,CAACI,MAAsB,EAAEd,MAAc,EAAe;EAChF,OAAO,SAASe,mBAAmBA,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNlB,MAAM,CAACmB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAACnC;IAAK,CAAC,EAAE,sCAAsC,CAAC;IAC3E,MAAM;MAAEA,IAAI;MAAEwC;IAAO,CAAC,GAAGL,IAAI;IAC7B7E,KAAK,CAAC,8BAA8B,EAAE2E,MAAM,EAAEO,MAAM,CAAC;IACrD,MAAMC,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3C3E,KAAK,CAAC,mCAAmC,EAAE2E,MAAM,EAAEQ,WAAW,CAAC;IAC/D,MAAMC,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAEC,KAAK,IAAK;MAChD,OAAO5C,IAAI,KAAK4C,KAAK,IAAIJ,MAAM,CAAC/B,QAAQ,CAACmC,KAAK,CAAC;IACjD,CAAC,CAAC;IACFtF,KAAK,CAAC,kCAAkC,EAAE0C,IAAI,EAAE0C,aAAa,CAAC;IAC9DvB,MAAM,CAACmB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACpC,IAAI;MAAE0C,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAACnC,IAAI;MAAEyC;IAAY,CAAC,EACpE,+FACF,CAAC;IAED,IAAIC,aAAa,EAAE;MACjBvB,MAAM,CAACmB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAACnC;MAAK,CAAC,EAAE,iDAAiD,CAAC;MACtF,OAAOqC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAIrC,IAAI,EAAE;MACRqC,QAAQ,CACN1B,gBAAU,CAACa,YAAY,CAAC,QAAQxB,IAAI,sBAAsBiC,MAAM,YAAYG,GAAG,CAACpC,IAAI,EAAE,CACxF,CAAC;IACH,CAAC,MAAM;MACLqC,QAAQ,CACN1B,gBAAU,CAACmC,eAAe,CAAC,6BAA6Bb,MAAM,YAAYG,GAAG,CAACpC,IAAI,EAAE,CACtF,CAAC;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAASgC,sBAAsBA,CAACb,MAAc,EAAO;EAC1D,OAAO,UAAUgB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,MAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,MAAMc,kBAA2B,GAAG,CAACX,GAAG,CAACH,MAAM,CAAC;IAChD3E,KAAK,CAAC,kCAAkC,EAAEyF,kBAAkB,CAAC;IAC7D,MAAMC,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIX,GAAG,CAACH,MAAM,CAAC,CAAc3D,MAAM,GAAG,CAAC;IAC5F6C,MAAM,CAACmB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAI;MAAEA,IAAI,EAAEoC,GAAG,CAACpC,IAAI;MAAEgD;IAAU,CAAC,EAC9C,qEACF,CAAC;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOX,QAAQ,CAAC,IAAI,EAAEY,SAAS,CAAC;IAClC;IAEA9B,MAAM,CAACmB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAACnC,IAAI;MAAEA,IAAI,EAAEoC,GAAG,CAACpC,IAAI;MAAEiC,MAAM;MAAEe;IAAU,CAAC,EACtD,6EACF,CAAC;IACD,OAAOnB,YAAY,CAACI,MAAM,EAAEd,MAAM,CAAC,CAACgB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAAStC,SAASA,CAACC,IAAY,EAAEkD,QAAgB,EAAU;EAChE,OAAOC,MAAM,CAAC,GAAGnD,IAAI,IAAIkD,QAAQ,EAAE,CAAC;AACtC;AAEO,SAAS/E,sBAAsBA,CAACkC,OAAe,EAAU;EAC9D,OAAO+C,MAAM,CAACC,IAAI,CAAChD,OAAO,EAAE,QAAQ,CAAC;AACvC","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "8.0.0-next-8.14",
+  "version": "8.0.0-next-8.16",
   "description": "Verdaccio Authentication",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -33,19 +33,18 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/config": "8.0.0-next-8.14",
-    "@verdaccio/core": "8.0.0-next-8.14",
-    "@verdaccio/loaders": "8.0.0-next-8.6",
-    "@verdaccio/signature": "8.0.0-next-8.6",
-    "@verdaccio/utils": "8.1.0-next-8.14",
+    "@verdaccio/config": "8.0.0-next-8.16",
+    "@verdaccio/core": "8.0.0-next-8.16",
+    "@verdaccio/loaders": "8.0.0-next-8.7",
+    "@verdaccio/signature": "8.0.0-next-8.8",
     "debug": "4.4.0",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "13.0.0-next-8.14"
+    "verdaccio-htpasswd": "13.0.0-next-8.16"
   },
   "devDependencies": {
-    "@verdaccio/middleware": "8.0.0-next-8.14",
-    "@verdaccio/types": "13.0.0-next-8.5",
-    "@verdaccio/logger": "8.0.0-next-8.14",
+    "@verdaccio/middleware": "8.0.0-next-8.16",
+    "@verdaccio/types": "13.0.0-next-8.6",
+    "@verdaccio/logger": "8.0.0-next-8.16",
     "express": "4.21.2",
     "supertest": "7.0.0"
   },