@verdaccio/auth 8.0.6 → 8.1.0

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["_debug","_interopRequireDefault","require","_lodash","_config","_core","_signature","e","__esModule","_regenerator","t","r","Symbol","n","iterator","o","toStringTag","i","c","prototype","Generator","u","Object","create","_regeneratorDefine2","f","p","y","G","v","a","d","bind","length","l","TypeError","call","done","value","GeneratorFunction","GeneratorFunctionPrototype","getPrototypeOf","setPrototypeOf","__proto__","displayName","w","m","defineProperty","_regeneratorDefine","_invoke","enumerable","configurable","writable","ownKeys","keys","getOwnPropertySymbols","filter","getOwnPropertyDescriptor","push","apply","_objectSpread","arguments","forEach","_defineProperty","getOwnPropertyDescriptors","defineProperties","_toPropertyKey","_toPrimitive","_typeof","toPrimitive","String","Number","asyncGeneratorStep","Promise","resolve","then","_asyncToGenerator","_next","_throw","_slicedToArray","_arrayWithHoles","_iterableToArrayLimit","_unsupportedIterableToArray","_nonIterableRest","_arrayLikeToArray","toString","slice","constructor","name","Array","from","test","next","isArray","debug","buildDebug","parseAuthTokenHeader","authorizationHeader","parts","split","_parts","scheme","token","parseAESCredentials","secret","_parseAuthTokenHeader","toUpperCase","TOKEN_BASIC","credentials","convertPayloadToBase64","TOKEN_BEARER","isLegacyUnsecure","aesDecryptDeprecated","aesDecrypt","getMiddlewareCredentials","security","secretKey","isAESLegacy","parsedCredentials","parseBasicPayload","_parseAuthTokenHeader2","_","isString","verifyJWTPayload","_security$api","api","legacy","jwt","isNil","getApiToken","_x","_x2","_x3","_x4","_getApiToken","_callee","auth","config","remoteUser","aesPassword","options","tokenUser","_args","_context","undefined","tokenKey","key","aesEncrypt","buildUser","sign","jwtEncrypt","expireReasons","exports","_security$api2","payload","verifyPayload","verify","error","includes","createAnonymousRemoteUser","errorUtils","getCode","HTTP_STATUS","UNAUTHORIZED","message","isAuthHeaderValid","authorization","getDefaultPluginMethods","logger","authenticate","_user","_password","cb","getForbidden","API_ERROR","BAD_USERNAME_PASSWORD","adduser","allow_access","allow_action","allow_publish","allow_unpublish","handleSpecialUnpublish","action","allowActionCallback","user","pkg","callback","trace","remote","groups","groupAccess","hasPermission","some","group","pkgName","concat","getUnauthorized","isUnpublishMissing","hasGroups","password","JSON","stringify","Buffer"],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport {\n  aesDecrypt,\n  aesDecryptDeprecated,\n  parseBasicPayload,\n  verifyPayload,\n} from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    debug('secret length %o', secret.length);\n    const isLegacyUnsecure = secret.length > 32;\n    debug('is legacy unsecure %o', isLegacyUnsecure);\n    if (isLegacyUnsecure) {\n      debug('legacy unsecure enabled');\n      return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');\n    } else {\n      debug('legacy secure enabled');\n      return aesDecrypt(token.toString(), secret);\n    }\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string,\n  options: { tokenKey?: string } = {}\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n  const tokenUser: RemoteUser = options.tokenKey\n    ? { ...remoteUser, token: { key: options.tokenKey } }\n    : remoteUser;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(tokenUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret, security?.api?.jwt?.verify);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string, tokenKey?: string): string {\n  if (tokenKey) {\n    return JSON.stringify({ user: name, password, tokenKey });\n  }\n\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,OAAA,GAAAF,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AAK8B,SAAAD,uBAAAM,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,gBAAAA,CAAA;AAAA,SAAAE,aAAA,IAV9B,uKAAAF,CAAA,EAAAG,CAAA,EAAAC,CAAA,wBAAAC,MAAA,GAAAA,MAAA,OAAAC,CAAA,GAAAF,CAAA,CAAAG,QAAA,kBAAAC,CAAA,GAAAJ,CAAA,CAAAK,WAAA,8BAAAC,EAAAN,CAAA,EAAAE,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAC,CAAA,GAAAL,CAAA,IAAAA,CAAA,CAAAM,SAAA,YAAAC,SAAA,GAAAP,CAAA,GAAAO,SAAA,EAAAC,CAAA,GAAAC,MAAA,CAAAC,MAAA,CAAAL,CAAA,CAAAC,SAAA,UAAAK,mBAAA,CAAAH,CAAA,uBAAAV,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAE,CAAA,EAAAC,CAAA,EAAAG,CAAA,EAAAI,CAAA,MAAAC,CAAA,GAAAX,CAAA,QAAAY,CAAA,OAAAC,CAAA,KAAAF,CAAA,KAAAb,CAAA,KAAAgB,CAAA,EAAAtB,CAAA,EAAAuB,CAAA,EAAAC,CAAA,EAAAN,CAAA,EAAAM,CAAA,CAAAC,IAAA,CAAAzB,CAAA,MAAAwB,CAAA,WAAAA,EAAArB,CAAA,EAAAC,CAAA,WAAAM,CAAA,GAAAP,CAAA,EAAAQ,CAAA,MAAAG,CAAA,GAAAd,CAAA,EAAAqB,CAAA,CAAAf,CAAA,GAAAF,CAAA,EAAAmB,CAAA,gBAAAC,EAAApB,CAAA,EAAAE,CAAA,SAAAK,CAAA,GAAAP,CAAA,EAAAU,CAAA,GAAAR,CAAA,EAAAH,CAAA,OAAAiB,CAAA,IAAAF,CAAA,KAAAV,CAAA,IAAAL,CAAA,GAAAgB,CAAA,CAAAO,MAAA,EAAAvB,CAAA,UAAAK,CAAA,EAAAE,CAAA,GAAAS,CAAA,CAAAhB,CAAA,GAAAqB,CAAA,GAAAH,CAAA,CAAAF,CAAA,EAAAQ,CAAA,GAAAjB,CAAA,KAAAN,CAAA,QAAAI,CAAA,GAAAmB,CAAA,KAAArB,CAAA,MAAAQ,CAAA,GAAAJ,CAAA,EAAAC,CAAA,GAAAD,CAAA,YAAAC,CAAA,WAAAD,CAAA,MAAAA,CAAA,MAAAV,CAAA,IAAAU,CAAA,OAAAc,CAAA,MAAAhB,CAAA,GAAAJ,CAAA,QAAAoB,CAAA,GAAAd,CAAA,QAAAC,CAAA,MAAAU,CAAA,CAAAC,CAAA,GAAAhB,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAI,CAAA,OAAAc,CAAA,GAAAG,CAAA,KAAAnB,CAAA,GAAAJ,CAAA,QAAAM,CAAA,MAAAJ,CAAA,IAAAA,CAAA,GAAAqB,CAAA,MAAAjB,CAAA,MAAAN,CAAA,EAAAM,CAAA,MAAAJ,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAqB,CAAA,EAAAhB,CAAA,cAAAH,CAAA,IAAAJ,CAAA,aAAAmB,CAAA,QAAAH,CAAA,OAAAd,CAAA,qBAAAE,CAAA,EAAAW,CAAA,EAAAQ,CAAA,QAAAT,CAAA,YAAAU,SAAA,uCAAAR,CAAA,UAAAD,CAAA,IAAAK,CAAA,CAAAL,CAAA,EAAAQ,CAAA,GAAAhB,CAAA,GAAAQ,CAAA,EAAAL,CAAA,GAAAa,CAAA,GAAAxB,CAAA,GAAAQ,CAAA,OAAAX,CAAA,GAAAc,CAAA,MAAAM,CAAA,KAAAV,CAAA,KAAAC,CAAA,GAAAA,CAAA,QAAAA,CAAA,SAAAU,CAAA,CAAAf,CAAA,QAAAkB,CAAA,CAAAb,CAAA,EAAAG,CAAA,KAAAO,CAAA,CAAAf,CAAA,GAAAQ,CAAA,GAAAO,CAAA,CAAAC,CAAA,GAAAR,CAAA,aAAAI,CAAA,MAAAR,CAAA,QAAAC,CAAA,KAAAH,CAAA,YAAAL,CAAA,GAAAO,CAAA,CAAAF,CAAA,WAAAL,CAAA,GAAAA,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,EAAAI,CAAA,UAAAc,SAAA,2CAAAzB,CAAA,CAAA2B,IAAA,SAAA3B,CAAA,EAAAW,CAAA,GAAAX,CAAA,CAAA4B,KAAA,EAAApB,CAAA,SAAAA,CAAA,oBAAAA,CAAA,KAAAR,CAAA,GAAAO,CAAA,eAAAP,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,GAAAC,CAAA,SAAAG,CAAA,GAAAc,SAAA,uCAAApB,CAAA,gBAAAG,CAAA,OAAAD,CAAA,GAAAV,CAAA,cAAAG,CAAA,IAAAiB,CAAA,GAAAC,CAAA,CAAAf,CAAA,QAAAQ,CAAA,GAAAV,CAAA,CAAAyB,IAAA,CAAAvB,CAAA,EAAAe,CAAA,OAAAE,CAAA,kBAAApB,CAAA,IAAAO,CAAA,GAAAV,CAAA,EAAAW,CAAA,MAAAG,CAAA,GAAAX,CAAA,cAAAe,CAAA,mBAAAa,KAAA,EAAA5B,CAAA,EAAA2B,IAAA,EAAAV,CAAA,SAAAhB,CAAA,EAAAI,CAAA,EAAAE,CAAA,QAAAI,CAAA,QAAAS,CAAA,gBAAAV,UAAA,cAAAmB,kBAAA,cAAAC,2BAAA,KAAA9B,CAAA,GAAAY,MAAA,CAAAmB,cAAA,MAAAvB,CAAA,MAAAL,CAAA,IAAAH,CAAA,CAAAA,CAAA,IAAAG,CAAA,SAAAW,mBAAA,CAAAd,CAAA,OAAAG,CAAA,iCAAAH,CAAA,GAAAW,CAAA,GAAAmB,0BAAA,CAAArB,SAAA,GAAAC,SAAA,CAAAD,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAL,CAAA,YAAAO,EAAAlB,CAAA,WAAAe,MAAA,CAAAoB,cAAA,GAAApB,MAAA,CAAAoB,cAAA,CAAAnC,CAAA,EAAAiC,0BAAA,KAAAjC,CAAA,CAAAoC,SAAA,GAAAH,0BAAA,EAAAhB,mBAAA,CAAAjB,CAAA,EAAAQ,CAAA,yBAAAR,CAAA,CAAAY,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAF,CAAA,GAAAd,CAAA,WAAAgC,iBAAA,CAAApB,SAAA,GAAAqB,0BAAA,EAAAhB,mBAAA,CAAAH,CAAA,iBAAAmB,0BAAA,GAAAhB,mBAAA,CAAAgB,0BAAA,iBAAAD,iBAAA,GAAAA,iBAAA,CAAAK,WAAA,wBAAApB,mBAAA,CAAAgB,0BAAA,EAAAzB,CAAA,wBAAAS,mBAAA,CAAAH,CAAA,GAAAG,mBAAA,CAAAH,CAAA,EAAAN,CAAA,gBAAAS,mBAAA,CAAAH,CAAA,EAAAR,CAAA,iCAAAW,mBAAA,CAAAH,CAAA,8DAAAZ,YAAA,YAAAA,aAAA,aAAAoC,CAAA,EAAA5B,CAAA,EAAA6B,CAAA,EAAArB,CAAA;AAAA,SAAAD,oBAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,QAAAO,CAAA,GAAAK,MAAA,CAAAyB,cAAA,QAAA9B,CAAA,uBAAAV,CAAA,IAAAU,CAAA,QAAAO,mBAAA,YAAAwB,mBAAAzC,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,aAAAK,EAAAJ,CAAA,EAAAE,CAAA,IAAAW,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,YAAAJ,CAAA,gBAAA0C,OAAA,CAAAtC,CAAA,EAAAE,CAAA,EAAAN,CAAA,SAAAI,CAAA,GAAAM,CAAA,GAAAA,CAAA,CAAAV,CAAA,EAAAI,CAAA,IAAA2B,KAAA,EAAAzB,CAAA,EAAAqC,UAAA,GAAAxC,CAAA,EAAAyC,YAAA,GAAAzC,CAAA,EAAA0C,QAAA,GAAA1C,CAAA,MAAAH,CAAA,CAAAI,CAAA,IAAAE,CAAA,IAAAE,CAAA,aAAAA,CAAA,cAAAA,CAAA,mBAAAS,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA;AAAA,SAAA2C,QAAA9C,CAAA,EAAAI,CAAA,QAAAD,CAAA,GAAAY,MAAA,CAAAgC,IAAA,CAAA/C,CAAA,OAAAe,MAAA,CAAAiC,qBAAA,QAAAxC,CAAA,GAAAO,MAAA,CAAAiC,qBAAA,CAAAhD,CAAA,GAAAI,CAAA,KAAAI,CAAA,GAAAA,CAAA,CAAAyC,MAAA,WAAA7C,CAAA,WAAAW,MAAA,CAAAmC,wBAAA,CAAAlD,CAAA,EAAAI,CAAA,EAAAuC,UAAA,OAAAxC,CAAA,CAAAgD,IAAA,CAAAC,KAAA,CAAAjD,CAAA,EAAAK,CAAA,YAAAL,CAAA;AAAA,SAAAkD,cAAArD,CAAA,aAAAI,CAAA,MAAAA,CAAA,GAAAkD,SAAA,CAAA5B,MAAA,EAAAtB,CAAA,UAAAD,CAAA,WAAAmD,SAAA,CAAAlD,CAAA,IAAAkD,SAAA,CAAAlD,CAAA,QAAAA,CAAA,OAAA0C,OAAA,CAAA/B,MAAA,CAAAZ,CAAA,OAAAoD,OAAA,WAAAnD,CAAA,IAAAoD,eAAA,CAAAxD,CAAA,EAAAI,CAAA,EAAAD,CAAA,CAAAC,CAAA,SAAAW,MAAA,CAAA0C,yBAAA,GAAA1C,MAAA,CAAA2C,gBAAA,CAAA1D,CAAA,EAAAe,MAAA,CAAA0C,yBAAA,CAAAtD,CAAA,KAAA2C,OAAA,CAAA/B,MAAA,CAAAZ,CAAA,GAAAoD,OAAA,WAAAnD,CAAA,IAAAW,MAAA,CAAAyB,cAAA,CAAAxC,CAAA,EAAAI,CAAA,EAAAW,MAAA,CAAAmC,wBAAA,CAAA/C,CAAA,EAAAC,CAAA,iBAAAJ,CAAA;AAAA,SAAAwD,gBAAAxD,CAAA,EAAAI,CAAA,EAAAD,CAAA,YAAAC,CAAA,GAAAuD,cAAA,CAAAvD,CAAA,MAAAJ,CAAA,GAAAe,MAAA,CAAAyB,cAAA,CAAAxC,CAAA,EAAAI,CAAA,IAAA2B,KAAA,EAAA5B,CAAA,EAAAwC,UAAA,MAAAC,YAAA,MAAAC,QAAA,UAAA7C,CAAA,CAAAI,CAAA,IAAAD,CAAA,EAAAH,CAAA;AAAA,SAAA2D,eAAAxD,CAAA,QAAAO,CAAA,GAAAkD,YAAA,CAAAzD,CAAA,gCAAA0D,OAAA,CAAAnD,CAAA,IAAAA,CAAA,GAAAA,CAAA;AAAA,SAAAkD,aAAAzD,CAAA,EAAAC,CAAA,oBAAAyD,OAAA,CAAA1D,CAAA,MAAAA,CAAA,SAAAA,CAAA,MAAAH,CAAA,GAAAG,CAAA,CAAAE,MAAA,CAAAyD,WAAA,kBAAA9D,CAAA,QAAAU,CAAA,GAAAV,CAAA,CAAA6B,IAAA,CAAA1B,CAAA,EAAAC,CAAA,gCAAAyD,OAAA,CAAAnD,CAAA,UAAAA,CAAA,YAAAkB,SAAA,yEAAAxB,CAAA,GAAA2D,MAAA,GAAAC,MAAA,EAAA7D,CAAA;AAAA,SAAA8D,mBAAA3D,CAAA,EAAAH,CAAA,EAAAH,CAAA,EAAAI,CAAA,EAAAI,CAAA,EAAAe,CAAA,EAAAZ,CAAA,cAAAD,CAAA,GAAAJ,CAAA,CAAAiB,CAAA,EAAAZ,CAAA,GAAAG,CAAA,GAAAJ,CAAA,CAAAqB,KAAA,WAAAzB,CAAA,gBAAAN,CAAA,CAAAM,CAAA,KAAAI,CAAA,CAAAoB,IAAA,GAAA3B,CAAA,CAAAW,CAAA,IAAAoD,OAAA,CAAAC,OAAA,CAAArD,CAAA,EAAAsD,IAAA,CAAAhE,CAAA,EAAAI,CAAA;AAAA,SAAA6D,kBAAA/D,CAAA,6BAAAH,CAAA,SAAAH,CAAA,GAAAsD,SAAA,aAAAY,OAAA,WAAA9D,CAAA,EAAAI,CAAA,QAAAe,CAAA,GAAAjB,CAAA,CAAA8C,KAAA,CAAAjD,CAAA,EAAAH,CAAA,YAAAsE,MAAAhE,CAAA,IAAA2D,kBAAA,CAAA1C,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA8D,KAAA,EAAAC,MAAA,UAAAjE,CAAA,cAAAiE,OAAAjE,CAAA,IAAA2D,kBAAA,CAAA1C,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA8D,KAAA,EAAAC,MAAA,WAAAjE,CAAA,KAAAgE,KAAA;AAAA,SAAAE,eAAApE,CAAA,EAAAJ,CAAA,WAAAyE,eAAA,CAAArE,CAAA,KAAAsE,qBAAA,CAAAtE,CAAA,EAAAJ,CAAA,KAAA2E,2BAAA,CAAAvE,CAAA,EAAAJ,CAAA,KAAA4E,gBAAA;AAAA,SAAAA,iBAAA,cAAAhD,SAAA;AAAA,SAAA+C,4BAAAvE,CAAA,EAAAmB,CAAA,QAAAnB,CAAA,2BAAAA,CAAA,SAAAyE,iBAAA,CAAAzE,CAAA,EAAAmB,CAAA,OAAApB,CAAA,MAAA2E,QAAA,CAAAjD,IAAA,CAAAzB,CAAA,EAAA2E,KAAA,6BAAA5E,CAAA,IAAAC,CAAA,CAAA4E,WAAA,KAAA7E,CAAA,GAAAC,CAAA,CAAA4E,WAAA,CAAAC,IAAA,aAAA9E,CAAA,cAAAA,CAAA,GAAA+E,KAAA,CAAAC,IAAA,CAAA/E,CAAA,oBAAAD,CAAA,+CAAAiF,IAAA,CAAAjF,CAAA,IAAA0E,iBAAA,CAAAzE,CAAA,EAAAmB,CAAA;AAAA,SAAAsD,kBAAAzE,CAAA,EAAAmB,CAAA,aAAAA,CAAA,IAAAA,CAAA,GAAAnB,CAAA,CAAAsB,MAAA,MAAAH,CAAA,GAAAnB,CAAA,CAAAsB,MAAA,YAAA1B,CAAA,MAAAM,CAAA,GAAA4E,KAAA,CAAA3D,CAAA,GAAAvB,CAAA,GAAAuB,CAAA,EAAAvB,CAAA,IAAAM,CAAA,CAAAN,CAAA,IAAAI,CAAA,CAAAJ,CAAA,UAAAM,CAAA;AAAA,SAAAoE,sBAAAtE,CAAA,EAAAuB,CAAA,QAAAxB,CAAA,WAAAC,CAAA,gCAAAC,MAAA,IAAAD,CAAA,CAAAC,MAAA,CAAAE,QAAA,KAAAH,CAAA,4BAAAD,CAAA,QAAAH,CAAA,EAAAM,CAAA,EAAAI,CAAA,EAAAI,CAAA,EAAAS,CAAA,OAAAL,CAAA,OAAAV,CAAA,iBAAAE,CAAA,IAAAP,CAAA,GAAAA,CAAA,CAAA0B,IAAA,CAAAzB,CAAA,GAAAiF,IAAA,QAAA1D,CAAA,QAAAZ,MAAA,CAAAZ,CAAA,MAAAA,CAAA,UAAAe,CAAA,uBAAAA,CAAA,IAAAlB,CAAA,GAAAU,CAAA,CAAAmB,IAAA,CAAA1B,CAAA,GAAA2B,IAAA,MAAAP,CAAA,CAAA4B,IAAA,CAAAnD,CAAA,CAAA+B,KAAA,GAAAR,CAAA,CAAAG,MAAA,KAAAC,CAAA,GAAAT,CAAA,iBAAAd,CAAA,IAAAI,CAAA,OAAAF,CAAA,GAAAF,CAAA,yBAAAc,CAAA,YAAAf,CAAA,eAAAW,CAAA,GAAAX,CAAA,cAAAY,MAAA,CAAAD,CAAA,MAAAA,CAAA,2BAAAN,CAAA,QAAAF,CAAA,aAAAiB,CAAA;AAAA,SAAAkD,gBAAArE,CAAA,QAAA8E,KAAA,CAAAI,OAAA,CAAAlF,CAAA,UAAAA,CAAA;AAsBA,IAAMmF,KAAK,GAAG,IAAAC,iBAAU,EAAC,sBAAsB,CAAC;;AAEhD;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,mBAA2B,EAAmB;EACjF,IAAMC,KAAK,GAAGD,mBAAmB,CAACE,KAAK,CAAC,GAAG,CAAC;EAC5C,IAAAC,MAAA,GAAArB,cAAA,CAAwBmB,KAAK;IAAtBG,MAAM,GAAAD,MAAA;IAAEE,KAAK,GAAAF,MAAA;EAEpB,OAAO;IAAEC,MAAM,EAANA,MAAM;IAAEC,KAAK,EAALA;EAAM,CAAC;AAC1B;AAEO,SAASC,mBAAmBA,CAACN,mBAA2B,EAAEO,MAAc,EAAE;EAC/EV,KAAK,CAAC,0BAA0B,CAAC;EACjC,IAAAW,qBAAA,GAA0BT,oBAAoB,CAACC,mBAAmB,CAAC;IAA3DI,MAAM,GAAAI,qBAAA,CAANJ,MAAM;IAAEC,KAAK,GAAAG,qBAAA,CAALH,KAAK;;EAErB;EACA;EACA,IAAID,MAAM,CAACK,WAAW,CAAC,CAAC,KAAKC,iBAAW,CAACD,WAAW,CAAC,CAAC,EAAE;IACtDZ,KAAK,CAAC,qBAAqB,CAAC;IAC5B,IAAMc,WAAW,GAAGC,sBAAsB,CAACP,KAAK,CAAC,CAACjB,QAAQ,CAAC,CAAC;IAE5D,OAAOuB,WAAW;EACpB,CAAC,MAAM,IAAIP,MAAM,CAACK,WAAW,CAAC,CAAC,KAAKI,kBAAY,CAACJ,WAAW,CAAC,CAAC,EAAE;IAC9DZ,KAAK,CAAC,sBAAsB,CAAC;IAC7BA,KAAK,CAAC,kBAAkB,EAAEU,MAAM,CAACvE,MAAM,CAAC;IACxC,IAAM8E,gBAAgB,GAAGP,MAAM,CAACvE,MAAM,GAAG,EAAE;IAC3C6D,KAAK,CAAC,uBAAuB,EAAEiB,gBAAgB,CAAC;IAChD,IAAIA,gBAAgB,EAAE;MACpBjB,KAAK,CAAC,yBAAyB,CAAC;MAChC,OAAO,IAAAkB,+BAAoB,EAACH,sBAAsB,CAACP,KAAK,CAAC,EAAEE,MAAM,CAAC,CAACnB,QAAQ,CAAC,OAAO,CAAC;IACtF,CAAC,MAAM;MACLS,KAAK,CAAC,uBAAuB,CAAC;MAC9B,OAAO,IAAAmB,qBAAU,EAACX,KAAK,CAACjB,QAAQ,CAAC,CAAC,EAAEmB,MAAM,CAAC;IAC7C;EACF;AACF;AAEO,SAASU,wBAAwBA,CACtCC,QAAkB,EAClBC,SAAiB,EACjBnB,mBAA2B,EACJ;EACvBH,KAAK,CAAC,+BAA+B,CAAC;EACtC;EACA,IAAIuB,WAAW,CAACF,QAAQ,CAAC,EAAE;IACzBrB,KAAK,CAAC,WAAW,CAAC;IAClB,IAAMc,WAAW,GAAGL,mBAAmB,CAACN,mBAAmB,EAAEmB,SAAS,CAAC;IACvE,IAAI,CAACR,WAAW,EAAE;MAChBd,KAAK,CAAC,iCAAiC,CAAC;MACxC;IACF;IAEA,IAAMwB,iBAAiB,GAAG,IAAAC,4BAAiB,EAACX,WAAW,CAAC;IACxD,IAAI,CAACU,iBAAiB,EAAE;MACtBxB,KAAK,CAAC,+CAA+C,CAAC;MACtD;IACF;IAEA,OAAOwB,iBAAiB;EAC1B;EACA,IAAAE,sBAAA,GAA0BxB,oBAAoB,CAACC,mBAAmB,CAAC;IAA3DI,MAAM,GAAAmB,sBAAA,CAANnB,MAAM;IAAEC,KAAK,GAAAkB,sBAAA,CAALlB,KAAK;EAErBR,KAAK,CAAC,QAAQ,CAAC;EACf,IAAI2B,kBAAC,CAACC,QAAQ,CAACpB,KAAK,CAAC,IAAID,MAAM,CAACK,WAAW,CAAC,CAAC,KAAKI,kBAAY,CAACJ,WAAW,CAAC,CAAC,EAAE;IAC5E,OAAOiB,gBAAgB,CAACrB,KAAK,EAAEc,SAAS,EAAED,QAAQ,CAAC;EACrD;AACF;AAEO,SAASE,WAAWA,CAACF,QAAkB,EAAW;EACvD,IAAAS,aAAA,GAAwBT,QAAQ,CAACU,GAAG;IAA5BC,MAAM,GAAAF,aAAA,CAANE,MAAM;IAAEC,GAAG,GAAAH,aAAA,CAAHG,GAAG;EAEnB,OAAON,kBAAC,CAACO,KAAK,CAACF,MAAM,CAAC,KAAK,KAAK,IAAIL,kBAAC,CAACO,KAAK,CAACD,GAAG,CAAC,IAAID,MAAM,KAAK,IAAI;AACrE;AAAC,SAEqBG,WAAWA,CAAAC,EAAA,EAAAC,GAAA,EAAAC,GAAA,EAAAC,GAAA;EAAA,OAAAC,YAAA,CAAA3E,KAAA,OAAAE,SAAA;AAAA;AAAA,SAAAyE,aAAA;EAAAA,YAAA,GAAA1D,iBAAA,cAAAnE,YAAA,GAAAqC,CAAA,CAA1B,SAAAyF,QACLC,IAAqB,EACrBC,MAAc,EACdC,UAAsB,EACtBC,WAAmB;IAAA,IAAAC,OAAA;MAAAzB,QAAA;MAAA0B,SAAA;MAAAd,GAAA;MAAAe,KAAA,GAAAjF,SAAA;IAAA,OAAApD,YAAA,GAAAoC,CAAA,WAAAkG,QAAA;MAAA,kBAAAA,QAAA,CAAAlI,CAAA;QAAA;UACnB+H,OAA8B,GAAAE,KAAA,CAAA7G,MAAA,QAAA6G,KAAA,QAAAE,SAAA,GAAAF,KAAA,MAAG,CAAC,CAAC;UAEnChD,KAAK,CAAC,eAAe,CAAC;UACdqB,QAAQ,GAAKsB,MAAM,CAAnBtB,QAAQ;UACV0B,SAAqB,GAAGD,OAAO,CAACK,QAAQ,GAAArF,aAAA,CAAAA,aAAA,KACrC8E,UAAU;YAAEpC,KAAK,EAAE;cAAE4C,GAAG,EAAEN,OAAO,CAACK;YAAS;UAAC,KACjDP,UAAU;UAAA,KAEVrB,WAAW,CAACF,QAAQ,CAAC;YAAA4B,QAAA,CAAAlI,CAAA;YAAA;UAAA;UACvBiF,KAAK,CAAC,yBAAyB,CAAC;UAChC;UAAAiD,QAAA,CAAAlI,CAAA;UAAA,OACa,IAAI4D,OAAO,CAAC,UAACC,OAAO,EAAW;YAC1CA,OAAO,CAAC8D,IAAI,CAACW,UAAU,CAACC,SAAS,CAACV,UAAU,CAAClD,IAAI,EAAYmD,WAAW,EAAEC,OAAO,CAACK,QAAQ,CAAC,CAAC,CAAC;UAC/F,CAAC,CAAC;QAAA;UAAA,OAAAF,QAAA,CAAAjH,CAAA,IAAAiH,QAAA,CAAAlH,CAAA;QAAA;UAEIkG,GAAG,GAAKZ,QAAQ,CAACU,GAAG,CAApBE,GAAG;UAAA,MAEPA,GAAG,aAAHA,GAAG,eAAHA,GAAG,CAAEsB,IAAI;YAAAN,QAAA,CAAAlI,CAAA;YAAA;UAAA;UAAAkI,QAAA,CAAAlI,CAAA;UAAA,OACE2H,IAAI,CAACc,UAAU,CAACT,SAAS,EAAEd,GAAG,CAACsB,IAAI,CAAC;QAAA;UAAA,OAAAN,QAAA,CAAAjH,CAAA,IAAAiH,QAAA,CAAAlH,CAAA;QAAA;UAAAkH,QAAA,CAAAlI,CAAA;UAAA,OAEtC,IAAI4D,OAAO,CAAC,UAACC,OAAO,EAAW;YAC1CA,OAAO,CAAC8D,IAAI,CAACW,UAAU,CAACC,SAAS,CAACV,UAAU,CAAClD,IAAI,EAAYmD,WAAW,EAAEC,OAAO,CAACK,QAAQ,CAAC,CAAC,CAAC;UAC/F,CAAC,CAAC;QAAA;UAAA,OAAAF,QAAA,CAAAjH,CAAA,IAAAiH,QAAA,CAAAlH,CAAA;MAAA;IAAA,GAAA0G,OAAA;EAAA,CACH;EAAA,OAAAD,YAAA,CAAA3E,KAAA,OAAAE,SAAA;AAAA;AAEM,IAAM0F,aAAuB,GAAAC,OAAA,CAAAD,aAAA,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;AAE1E,SAAS5B,gBAAgBA,CAACrB,KAAa,EAAEE,MAAc,EAAEW,QAAkB,EAAc;EAC9F,IAAI;IAAA,IAAAsC,cAAA;IACF,IAAMC,OAAmB,GAAG,IAAAC,wBAAa,EAACrD,KAAK,EAAEE,MAAM,EAAEW,QAAQ,aAARA,QAAQ,gBAAAsC,cAAA,GAARtC,QAAQ,CAAEU,GAAG,cAAA4B,cAAA,gBAAAA,cAAA,GAAbA,cAAA,CAAe1B,GAAG,cAAA0B,cAAA,uBAAlBA,cAAA,CAAoBG,MAAM,CAAC;IAEpF,OAAOF,OAAO;EAChB,CAAC,CAAC,OAAOG,KAAU,EAAE;IACnB;IACA,IAAIN,aAAa,CAACO,QAAQ,CAACD,KAAK,CAACrE,IAAI,CAAC,EAAE;MACtC;MACA;MACA;MACA,OAAO,IAAAuE,iCAAyB,EAAC,CAAC;IACpC;IACA,MAAMC,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,YAAY,EAAEN,KAAK,CAACO,OAAO,CAAC;EACnE;AACF;AAEO,SAASC,iBAAiBA,CAACC,aAAqB,EAAW;EAChE,OAAOA,aAAa,CAACnE,KAAK,CAAC,GAAG,CAAC,CAAClE,MAAM,KAAK,CAAC;AAC9C;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASsI,uBAAuBA,CAACC,MAAc,EAA4B;EAChF,OAAO;IACLC,YAAY,WAAZA,YAAYA,CAACC,KAAa,EAAEC,SAAiB,EAAEC,EAA4B,EAAQ;MACjF9E,KAAK,CAAC,uCAAuC,CAAC;MAC9C8E,EAAE,CAACZ,gBAAU,CAACa,YAAY,CAACC,eAAS,CAACC,qBAAqB,CAAC,CAAC;IAC9D,CAAC;IAEDC,OAAO,WAAPA,OAAOA,CAACN,KAAa,EAAEC,SAAiB,EAAEC,EAAgC,EAAQ;MAChF9E,KAAK,CAAC,kCAAkC,CAAC;MACzC;MACA;MACA8E,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;IAChB,CAAC;IAED;IACAK,YAAY,EAAEC,YAAY,CAAC,QAAQ,EAAEV,MAAM,CAAC;IAC5C;IACAW,aAAa,EAAED,YAAY,CAAC,SAAS,EAAEV,MAAM,CAAC;IAC9CY,eAAe,EAAEC,sBAAsB,CAACb,MAAM;EAChD,CAAC;AACH;AAEO,SAASU,YAAYA,CAACI,MAAsB,EAAEd,MAAc,EAAe;EAChF,OAAO,SAASe,mBAAmBA,CACjCC,IAAgB,EAChBC,GAAqB,EACrBC,QAA6B,EACvB;IACNlB,MAAM,CAACmB,KAAK,CAAC;MAAEC,MAAM,EAAEJ,IAAI,CAAChG;IAAK,CAAC,wCAAwC,CAAC;IAC3E,IAAQA,IAAI,GAAagG,IAAI,CAArBhG,IAAI;MAAEqG,MAAM,GAAKL,IAAI,CAAfK,MAAM;IACpB/F,KAAK,CAAC,8BAA8B,EAAEwF,MAAM,EAAEO,MAAM,CAAC;IACrD,IAAMC,WAAW,GAAGL,GAAG,CAACH,MAAM,CAAa;IAC3CxF,KAAK,CAAC,mCAAmC,EAAEwF,MAAM,EAAEQ,WAAW,CAAC;IAC/D,IAAMC,aAAa,GAAGD,WAAW,CAACE,IAAI,CAAC,UAACC,KAAK,EAAK;MAChD,OAAOzG,IAAI,KAAKyG,KAAK,IAAIJ,MAAM,CAAC/B,QAAQ,CAACmC,KAAK,CAAC;IACjD,CAAC,CAAC;IACFnG,KAAK,CAAC,kCAAkC,EAAEN,IAAI,EAAEuG,aAAa,CAAC;IAC9DvB,MAAM,CAACmB,KAAK,CACV;MAAEO,OAAO,EAAET,GAAG,CAACjG,IAAI;MAAEuG,aAAa,EAAbA,aAAa;MAAEH,MAAM,EAAEJ,IAAI,CAAChG,IAAI;MAAEsG,WAAW,EAAXA;IAAY,CAAC,iGAEtE,CAAC;IAED,IAAIC,aAAa,EAAE;MACjBvB,MAAM,CAACmB,KAAK,CAAC;QAAEC,MAAM,EAAEJ,IAAI,CAAChG;MAAK,CAAC,mDAAmD,CAAC;MACtF,OAAOkG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAC7B;IAEA,IAAIlG,IAAI,EAAE;MACRkG,QAAQ,CACN1B,gBAAU,CAACa,YAAY,SAAAsB,MAAA,CAAS3G,IAAI,yBAAA2G,MAAA,CAAsBb,MAAM,eAAAa,MAAA,CAAYV,GAAG,CAACjG,IAAI,CAAE,CACxF,CAAC;IACH,CAAC,MAAM;MACLkG,QAAQ,CACN1B,gBAAU,CAACoC,eAAe,8BAAAD,MAAA,CAA8Bb,MAAM,eAAAa,MAAA,CAAYV,GAAG,CAACjG,IAAI,CAAE,CACtF,CAAC;IACH;EACF,CAAC;AACH;;AAEA;AACA;AACA;AACO,SAAS6F,sBAAsBA,CAACb,MAAc,EAAO;EAC1D,OAAO,UAAUgB,IAAgB,EAAEC,GAAqB,EAAEC,QAA6B,EAAQ;IAC7F,IAAMJ,MAAM,GAAG,WAAW;IAC1B;IACA,IAAMe,kBAA2B,GAAG,CAACZ,GAAG,CAACH,MAAM,CAAC;IAChDxF,KAAK,CAAC,kCAAkC,EAAEuG,kBAAkB,CAAC;IAC7D,IAAMC,SAAkB,GAAGD,kBAAkB,GAAG,KAAK,GAAIZ,GAAG,CAACH,MAAM,CAAC,CAAcrJ,MAAM,GAAG,CAAC;IAC5FuI,MAAM,CAACmB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAAChG,IAAI;MAAEA,IAAI,EAAEiG,GAAG,CAACjG,IAAI;MAAE8G,SAAS,EAATA;IAAU,CAAC,uEAEhD,CAAC;IAED,IAAID,kBAAkB,IAAIC,SAAS,KAAK,KAAK,EAAE;MAC7C,OAAOZ,QAAQ,CAAC,IAAI,EAAE1C,SAAS,CAAC;IAClC;IAEAwB,MAAM,CAACmB,KAAK,CACV;MAAEH,IAAI,EAAEA,IAAI,CAAChG,IAAI;MAAEA,IAAI,EAAEiG,GAAG,CAACjG,IAAI;MAAE8F,MAAM,EAANA,MAAM;MAAEgB,SAAS,EAATA;IAAU,CAAC,+EAExD,CAAC;IACD,OAAOpB,YAAY,CAACI,MAAM,EAAEd,MAAM,CAAC,CAACgB,IAAI,EAAEC,GAAG,EAAEC,QAAQ,CAAC;EAC1D,CAAC;AACH;AAEO,SAAStC,SAASA,CAAC5D,IAAY,EAAE+G,QAAgB,EAAEtD,QAAiB,EAAU;EACnF,IAAIA,QAAQ,EAAE;IACZ,OAAOuD,IAAI,CAACC,SAAS,CAAC;MAAEjB,IAAI,EAAEhG,IAAI;MAAE+G,QAAQ,EAARA,QAAQ;MAAEtD,QAAQ,EAARA;IAAS,CAAC,CAAC;EAC3D;EAEA,OAAO3E,MAAM,IAAA6H,MAAA,CAAI3G,IAAI,OAAA2G,MAAA,CAAII,QAAQ,CAAE,CAAC;AACtC;AAEO,SAAS1F,sBAAsBA,CAAC6C,OAAe,EAAU;EAC9D,OAAOgD,MAAM,CAAChH,IAAI,CAACgE,OAAO,EAAE,QAAQ,CAAC;AACvC","ignoreList":[]}
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string,\n  options: { tokenKey?: string } = {}\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n  const tokenUser: RemoteUser = options.tokenKey\n    ? { ...remoteUser, token: { key: options.tokenKey } }\n    : remoteUser;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(tokenUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret, security?.api?.jwt?.verify);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string, tokenKey?: string): string {\n  if (tokenKey) {\n    return JSON.stringify({ user: name, password, tokenKey });\n  }\n\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;;;;;AAM/C,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,GAChB;CAExB,OAAO;EAAE;EAAQ;CAAM;AACzB;AAEA,SAAgB,oBAAoB,qBAA6B,QAAgB;CAC/E,QAAM,0BAA0B;CAChC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAIlE,IAAI,OAAO,YAAY,MAAM,gBAAA,YAAY,YAAY,GAAG;EACtD,QAAM,qBAAqB;EAG3B,OAFoB,uBAAuB,KAAK,EAAE,SAE3C;CACT,OAAO,IAAI,OAAO,YAAY,MAAM,gBAAA,aAAa,YAAY,GAAG;EAC9D,QAAM,sBAAsB;EAC5B,QAAA,GAAA,qBAAA,YAAkB,MAAM,SAAS,GAAG,MAAM;CAC5C;AACF;AAEA,SAAgB,yBACd,UACA,WACA,qBACuB;CACvB,QAAM,+BAA+B;CAErC,IAAI,YAAY,QAAQ,GAAG;EACzB,QAAM,WAAW;EACjB,MAAM,cAAc,oBAAoB,qBAAqB,SAAS;EACtE,IAAI,CAAC,aAAa;GAChB,QAAM,iCAAiC;GACvC;EACF;EAEA,MAAM,qBAAA,GAAA,qBAAA,mBAAsC,WAAW;EACvD,IAAI,CAAC,mBAAmB;GACtB,QAAM,+CAA+C;GACrD;EACF;EAEA,OAAO;CACT;CACA,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAElE,QAAM,QAAQ;CACd,IAAI,OAAA,QAAE,SAAS,KAAK,KAAK,OAAO,YAAY,MAAM,gBAAA,aAAa,YAAY,GACzE,OAAO,iBAAiB,OAAO,WAAW,QAAQ;AAEtD;AAEA,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;CAEjC,OAAO,OAAA,QAAE,MAAM,MAAM,MAAM,SAAS,OAAA,QAAE,MAAM,GAAG,KAAK,WAAW;AACjE;AAEA,eAAsB,YACpB,MACA,QACA,YACA,aACA,UAAiC,CAAC,GACV;CACxB,QAAM,eAAe;CACrB,MAAM,EAAE,aAAa;CACrB,MAAM,YAAwB,QAAQ,WAClC;EAAE,GAAG;EAAY,OAAO,EAAE,KAAK,QAAQ,SAAS;CAAE,IAClD;CAEJ,IAAI,YAAY,QAAQ,GAAG;EACzB,QAAM,yBAAyB;EAE/B,OAAO,MAAM,IAAI,SAAS,YAAkB;GAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;EAC9F,CAAC;CACH;CACA,MAAM,EAAE,QAAQ,SAAS;CAEzB,IAAI,KAAK,MACP,OAAO,MAAM,KAAK,WAAW,WAAW,IAAI,IAAI;CAElD,OAAO,MAAM,IAAI,SAAS,YAAkB;EAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;CAC9F,CAAC;AACH;AAEA,IAAa,gBAA0B,CAAC,qBAAqB,mBAAmB;AAEhF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;CAC9F,IAAI;EAGF,QAAA,GAAA,qBAAA,eAF0C,OAAO,QAAQ,UAAU,KAAK,KAAK,MAEtE;CACT,SAAS,OAAY;EAEnB,IAAI,cAAc,SAAS,MAAM,IAAI,GAInC,QAAA,GAAA,kBAAA,2BAAiC;EAEnC,MAAM,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,MAAM,OAAO;CAClE;AACF;AAEA,SAAgB,kBAAkB,eAAgC;CAChE,OAAO,cAAc,MAAM,GAAG,EAAE,WAAW;AAC7C;;;;;;AAOA,SAAgB,wBAAwB,QAA0C;CAChF,OAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;GACjF,QAAM,uCAAuC;GAC7C,GAAG,gBAAA,WAAW,aAAa,gBAAA,UAAU,qBAAqB,CAAC;EAC7D;EAEA,QAAQ,OAAe,WAAmB,IAAwC;GAChF,QAAM,kCAAkC;GAGxC,GAAG,MAAM,IAAI;EACf;EAGA,cAAc,aAAa,UAAU,MAAM;EAE3C,eAAe,aAAa,WAAW,MAAM;EAC7C,iBAAiB,uBAAuB,MAAM;CAChD;AACF;AAEA,SAAgB,aAAa,QAAwB,QAA6B;CAChF,OAAO,SAAS,oBACd,MACA,KACA,UACM;EACN,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,sCAAsC;EAC1E,MAAM,EAAE,MAAM,WAAW;EACzB,QAAM,kCAAgC,QAAQ,MAAM;EACpD,MAAM,cAAc,IAAI;EACxB,QAAM,uCAAqC,QAAQ,WAAW;EAC9D,MAAM,gBAAgB,YAAY,MAAM,UAAU;GAChD,OAAO,SAAS,SAAS,OAAO,SAAS,KAAK;EAChD,CAAC;EACD,QAAM,wCAAoC,MAAM,aAAa;EAC7D,OAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;EAAY,GACnE,+FACF;EAEA,IAAI,eAAe;GACjB,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,iDAAiD;GACrF,OAAO,SAAS,MAAM,IAAI;EAC5B;EAEA,IAAI,MACF,SACE,gBAAA,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,MAAM,CACxF;OAEA,SACE,gBAAA,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,MAAM,CACtF;CAEJ;AACF;;;;AAKA,SAAgB,uBAAuB,QAAqB;CAC1D,OAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;EACzC,QAAM,oCAAoC,kBAAkB;EAC5D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;EAC3F,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;EAAU,GAC7C,qEACF;EAEA,IAAI,sBAAsB,cAAc,OACtC,OAAO,SAAS,MAAM,KAAA,CAAS;EAGjC,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;EAAU,GACrD,6EACF;EACA,OAAO,aAAa,QAAQ,MAAM,EAAE,MAAM,KAAK,QAAQ;CACzD;AACF;AAEA,SAAgB,UAAU,MAAc,UAAkB,UAA2B;CACnF,IAAI,UACF,OAAO,KAAK,UAAU;EAAE,MAAM;EAAM;EAAU;CAAS,CAAC;CAG1D,OAAO,OAAO,GAAG,KAAK,GAAG,UAAU;AACrC;AAEA,SAAgB,uBAAuB,SAAyB;CAC9D,OAAO,OAAO,KAAK,SAAS,QAAQ;AACtC"}

package/build/utils.mjs

@@ -0,0 +1,168 @@
+import buildDebug from "debug";
+import _ from "lodash";
+import { createAnonymousRemoteUser } from "@verdaccio/config";
+import { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from "@verdaccio/core";
+import { aesDecrypt, parseBasicPayload, verifyPayload } from "@verdaccio/signature";
+//#region src/utils.ts
+var debug = buildDebug("verdaccio:auth:utils");
+/**
+* Split authentication header eg: Bearer [secret_token]
+* @param authorizationHeader auth token
+*/
+function parseAuthTokenHeader(authorizationHeader) {
+	const [scheme, token] = authorizationHeader.split(" ");
+	return {
+		scheme,
+		token
+	};
+}
+function parseAESCredentials(authorizationHeader, secret) {
+	debug("parseAESCredentials init");
+	const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+	if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
+		debug("legacy header basic");
+		return convertPayloadToBase64(token).toString();
+	} else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+		debug("legacy header bearer");
+		return aesDecrypt(token.toString(), secret);
+	}
+}
+function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
+	debug("getMiddlewareCredentials init");
+	if (isAESLegacy(security)) {
+		debug("is legacy");
+		const credentials = parseAESCredentials(authorizationHeader, secretKey);
+		if (!credentials) {
+			debug("parse legacy credentials failed");
+			return;
+		}
+		const parsedCredentials = parseBasicPayload(credentials);
+		if (!parsedCredentials) {
+			debug("parse legacy basic payload credentials failed");
+			return;
+		}
+		return parsedCredentials;
+	}
+	const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+	debug("is jwt");
+	if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) return verifyJWTPayload(token, secretKey, security);
+}
+function isAESLegacy(security) {
+	const { legacy, jwt } = security.api;
+	return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;
+}
+async function getApiToken(auth, config, remoteUser, aesPassword, options = {}) {
+	debug("get api token");
+	const { security } = config;
+	const tokenUser = options.tokenKey ? {
+		...remoteUser,
+		token: { key: options.tokenKey }
+	} : remoteUser;
+	if (isAESLegacy(security)) {
+		debug("security legacy enabled");
+		return await new Promise((resolve) => {
+			resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword, options.tokenKey)));
+		});
+	}
+	const { jwt } = security.api;
+	if (jwt?.sign) return await auth.jwtEncrypt(tokenUser, jwt.sign);
+	return await new Promise((resolve) => {
+		resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword, options.tokenKey)));
+	});
+}
+var expireReasons = ["JsonWebTokenError", "TokenExpiredError"];
+function verifyJWTPayload(token, secret, security) {
+	try {
+		return verifyPayload(token, secret, security?.api?.jwt?.verify);
+	} catch (error) {
+		if (expireReasons.includes(error.name)) return createAnonymousRemoteUser();
+		throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);
+	}
+}
+function isAuthHeaderValid(authorization) {
+	return authorization.split(" ").length === 2;
+}
+/**
+* Return a default configuration for authentication if none is provided.
+* @param logger {Logger}
+* @returns object of default implementations.
+*/
+function getDefaultPluginMethods(logger) {
+	return {
+		authenticate(_user, _password, cb) {
+			debug("triggered default authenticate method");
+			cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));
+		},
+		adduser(_user, _password, cb) {
+			debug("triggered default adduser method");
+			cb(null, true);
+		},
+		allow_access: allow_action("access", logger),
+		allow_publish: allow_action("publish", logger),
+		allow_unpublish: handleSpecialUnpublish(logger)
+	};
+}
+function allow_action(action, logger) {
+	return function allowActionCallback(user, pkg, callback) {
+		logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);
+		const { name, groups } = user;
+		debug("allow_action \"%s\": groups %s", action, groups);
+		const groupAccess = pkg[action];
+		debug("allow_action \"%s\": groupAccess %s", action, groupAccess);
+		const hasPermission = groupAccess.some((group) => {
+			return name === group || groups.includes(group);
+		});
+		debug("package \"%s\" has permission \"%s\"", name, hasPermission);
+		logger.trace({
+			pkgName: pkg.name,
+			hasPermission,
+			remote: user.name,
+			groupAccess
+		}, `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`);
+		if (hasPermission) {
+			logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);
+			return callback(null, true);
+		}
+		if (name) callback(errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`));
+		else callback(errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`));
+	};
+}
+/**
+*
+*/
+function handleSpecialUnpublish(logger) {
+	return function(user, pkg, callback) {
+		const action = "unpublish";
+		const isUnpublishMissing = !pkg[action];
+		debug("is unpublish method missing ? %s", isUnpublishMissing);
+		const hasGroups = isUnpublishMissing ? false : pkg[action].length > 0;
+		logger.trace({
+			user: user.name,
+			name: pkg.name,
+			hasGroups
+		}, `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`);
+		if (isUnpublishMissing || hasGroups === false) return callback(null, void 0);
+		logger.trace({
+			user: user.name,
+			name: pkg.name,
+			action,
+			hasGroups
+		}, `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`);
+		return allow_action(action, logger)(user, pkg, callback);
+	};
+}
+function buildUser(name, password, tokenKey) {
+	if (tokenKey) return JSON.stringify({
+		user: name,
+		password,
+		tokenKey
+	});
+	return String(`${name}:${password}`);
+}
+function convertPayloadToBase64(payload) {
+	return Buffer.from(payload, "base64");
+}
+//#endregion
+export { allow_action, buildUser, convertPayloadToBase64, expireReasons, getApiToken, getDefaultPluginMethods, getMiddlewareCredentials, handleSpecialUnpublish, isAESLegacy, isAuthHeaderValid, parseAESCredentials, parseAuthTokenHeader, verifyJWTPayload };
+
+//# sourceMappingURL=utils.mjs.map

package/build/utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.mjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string,\n  options: { tokenKey?: string } = {}\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n  const tokenUser: RemoteUser = options.tokenKey\n    ? { ...remoteUser, token: { key: options.tokenKey } }\n    : remoteUser;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(tokenUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(token, secret, security?.api?.jwt?.verify);\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string, tokenKey?: string): string {\n  if (tokenKey) {\n    return JSON.stringify({ user: name, password, tokenKey });\n  }\n\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;AAkBA,IAAM,QAAQ,WAAW,sBAAsB;;;;;AAM/C,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,GAChB;CAExB,OAAO;EAAE;EAAQ;CAAM;AACzB;AAEA,SAAgB,oBAAoB,qBAA6B,QAAgB;CAC/E,MAAM,0BAA0B;CAChC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAIlE,IAAI,OAAO,YAAY,MAAM,YAAY,YAAY,GAAG;EACtD,MAAM,qBAAqB;EAG3B,OAFoB,uBAAuB,KAAK,EAAE,SAE3C;CACT,OAAO,IAAI,OAAO,YAAY,MAAM,aAAa,YAAY,GAAG;EAC9D,MAAM,sBAAsB;EAC5B,OAAO,WAAW,MAAM,SAAS,GAAG,MAAM;CAC5C;AACF;AAEA,SAAgB,yBACd,UACA,WACA,qBACuB;CACvB,MAAM,+BAA+B;CAErC,IAAI,YAAY,QAAQ,GAAG;EACzB,MAAM,WAAW;EACjB,MAAM,cAAc,oBAAoB,qBAAqB,SAAS;EACtE,IAAI,CAAC,aAAa;GAChB,MAAM,iCAAiC;GACvC;EACF;EAEA,MAAM,oBAAoB,kBAAkB,WAAW;EACvD,IAAI,CAAC,mBAAmB;GACtB,MAAM,+CAA+C;GACrD;EACF;EAEA,OAAO;CACT;CACA,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAElE,MAAM,QAAQ;CACd,IAAI,EAAE,SAAS,KAAK,KAAK,OAAO,YAAY,MAAM,aAAa,YAAY,GACzE,OAAO,iBAAiB,OAAO,WAAW,QAAQ;AAEtD;AAEA,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;CAEjC,OAAO,EAAE,MAAM,MAAM,MAAM,SAAS,EAAE,MAAM,GAAG,KAAK,WAAW;AACjE;AAEA,eAAsB,YACpB,MACA,QACA,YACA,aACA,UAAiC,CAAC,GACV;CACxB,MAAM,eAAe;CACrB,MAAM,EAAE,aAAa;CACrB,MAAM,YAAwB,QAAQ,WAClC;EAAE,GAAG;EAAY,OAAO,EAAE,KAAK,QAAQ,SAAS;CAAE,IAClD;CAEJ,IAAI,YAAY,QAAQ,GAAG;EACzB,MAAM,yBAAyB;EAE/B,OAAO,MAAM,IAAI,SAAS,YAAkB;GAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;EAC9F,CAAC;CACH;CACA,MAAM,EAAE,QAAQ,SAAS;CAEzB,IAAI,KAAK,MACP,OAAO,MAAM,KAAK,WAAW,WAAW,IAAI,IAAI;CAElD,OAAO,MAAM,IAAI,SAAS,YAAkB;EAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;CAC9F,CAAC;AACH;AAEA,IAAa,gBAA0B,CAAC,qBAAqB,mBAAmB;AAEhF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;CAC9F,IAAI;EAGF,OAF4B,cAAc,OAAO,QAAQ,UAAU,KAAK,KAAK,MAEtE;CACT,SAAS,OAAY;EAEnB,IAAI,cAAc,SAAS,MAAM,IAAI,GAInC,OAAO,0BAA0B;EAEnC,MAAM,WAAW,QAAQ,YAAY,cAAc,MAAM,OAAO;CAClE;AACF;AAEA,SAAgB,kBAAkB,eAAgC;CAChE,OAAO,cAAc,MAAM,GAAG,EAAE,WAAW;AAC7C;;;;;;AAOA,SAAgB,wBAAwB,QAA0C;CAChF,OAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;GACjF,MAAM,uCAAuC;GAC7C,GAAG,WAAW,aAAa,UAAU,qBAAqB,CAAC;EAC7D;EAEA,QAAQ,OAAe,WAAmB,IAAwC;GAChF,MAAM,kCAAkC;GAGxC,GAAG,MAAM,IAAI;EACf;EAGA,cAAc,aAAa,UAAU,MAAM;EAE3C,eAAe,aAAa,WAAW,MAAM;EAC7C,iBAAiB,uBAAuB,MAAM;CAChD;AACF;AAEA,SAAgB,aAAa,QAAwB,QAA6B;CAChF,OAAO,SAAS,oBACd,MACA,KACA,UACM;EACN,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,sCAAsC;EAC1E,MAAM,EAAE,MAAM,WAAW;EACzB,MAAM,kCAAgC,QAAQ,MAAM;EACpD,MAAM,cAAc,IAAI;EACxB,MAAM,uCAAqC,QAAQ,WAAW;EAC9D,MAAM,gBAAgB,YAAY,MAAM,UAAU;GAChD,OAAO,SAAS,SAAS,OAAO,SAAS,KAAK;EAChD,CAAC;EACD,MAAM,wCAAoC,MAAM,aAAa;EAC7D,OAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;EAAY,GACnE,+FACF;EAEA,IAAI,eAAe;GACjB,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,iDAAiD;GACrF,OAAO,SAAS,MAAM,IAAI;EAC5B;EAEA,IAAI,MACF,SACE,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,MAAM,CACxF;OAEA,SACE,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,MAAM,CACtF;CAEJ;AACF;;;;AAKA,SAAgB,uBAAuB,QAAqB;CAC1D,OAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;EACzC,MAAM,oCAAoC,kBAAkB;EAC5D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;EAC3F,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;EAAU,GAC7C,qEACF;EAEA,IAAI,sBAAsB,cAAc,OACtC,OAAO,SAAS,MAAM,KAAA,CAAS;EAGjC,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;EAAU,GACrD,6EACF;EACA,OAAO,aAAa,QAAQ,MAAM,EAAE,MAAM,KAAK,QAAQ;CACzD;AACF;AAEA,SAAgB,UAAU,MAAc,UAAkB,UAA2B;CACnF,IAAI,UACF,OAAO,KAAK,UAAU;EAAE,MAAM;EAAM;EAAU;CAAS,CAAC;CAG1D,OAAO,OAAO,GAAG,KAAK,GAAG,UAAU;AACrC;AAEA,SAAgB,uBAAuB,SAAyB;CAC9D,OAAO,OAAO,KAAK,SAAS,QAAQ;AACtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "8.0.6",
+  "version": "8.1.0",
   "description": "Verdaccio Authentication",
   "keywords": [
     "enterprise",
@@ -32,34 +32,47 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "main": "./build/index.js",
+  "module": "./build/index.mjs",
   "types": "./build/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.mjs"
+      },
+      "require": {
+        "types": "./build/index.d.ts",
+        "default": "./build/index.js"
+      }
+    },
+    "./build/*": "./build/*"
+  },
   "dependencies": {
-    "@verdaccio/config": "8.1.4",
-    "@verdaccio/core": "8.1.4",
-    "@verdaccio/loaders": "8.0.5",
-    "@verdaccio/signature": "8.0.5",
+    "@verdaccio/config": "8.2.0",
+    "@verdaccio/core": "8.2.0",
+    "@verdaccio/loaders": "8.1.0",
+    "@verdaccio/signature": "8.1.0",
     "debug": "4.4.3",
     "lodash": "4.18.1",
-    "verdaccio-htpasswd": "13.0.5"
+    "verdaccio-htpasswd": "13.1.0"
   },
   "devDependencies": {
-    "@verdaccio/logger": "8.0.5",
-    "@verdaccio/middleware": "8.0.7",
+    "@verdaccio/logger": "8.1.0",
+    "@verdaccio/middleware": "8.1.0",
     "@verdaccio/types": "13.0.5",
     "express": "4.22.1",
     "supertest": "7.1.4",
+    "vite": "8.0.16",
     "vitest": "4.1.2"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "scripts": {
     "clean": "rimraf ./build",
     "test": "vitest run",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
-    "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
-    "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
-    "watch": "pnpm build:js -- --watch",
-    "build": "pnpm run build:js && pnpm run build:types"
+    "watch": "vite build --watch",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.build.json"
   }
 }

package/build/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","names":["_auth","require","_utils","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_types"],"sources":["../src/index.ts"],"sourcesContent":["export { Auth } from './auth';\nexport * from './utils';\nexport * from './types';\n"],"mappings":";;;;;;;;;;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,IAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AACA,IAAAS,MAAA,GAAAd,OAAA;AAAAE,MAAA,CAAAC,IAAA,CAAAW,MAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,MAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,IAAA;MAAA,OAAAC,MAAA,CAAAT,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}

package/build/types.js

@@ -1,6 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport type { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';\n\nexport interface AESPayload {\n  user: string;\n  password: string;\n  tokenKey?: string;\n}\n\nexport type BasicPayload = AESPayload | void;\nexport type AuthMiddlewarePayload = RemoteUser | BasicPayload;\n\nexport interface AuthTokenHeader {\n  scheme: string;\n  token: string;\n}\nexport type AllowActionCallbackResponse = boolean | undefined;\nexport type AllowActionCallback = (\n  error: VerdaccioError | null,\n  allowed?: AllowActionCallbackResponse\n) => void;\n\nexport type AllowAction = (\n  user: RemoteUser,\n  pkg: AuthPackageAllow,\n  callback: AllowActionCallback\n) => void;\n\nexport interface TokenEncryption {\n  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;\n  aesEncrypt(buf: string): string | void;\n}\n\nexport type ActionsAllowed = 'publish' | 'unpublish' | 'access';\n\n// remove\nexport interface IAuthMiddleware {\n  apiJWTmiddleware(): $NextFunctionVer;\n  webUIJWTmiddleware(): $NextFunctionVer;\n}\n\nexport type $RequestExtend = Request & { remote_user?: any; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\nexport { NextFunction };\n"],"mappings":"","ignoreList":[]}