@verdaccio/auth 9.0.0-next-9.17 → 9.0.0-next-9.18

package/build/auth.js

@@ -342,7 +342,10 @@ var Auth = class {
 			debug$1("authenticating %o", user);
 			this.authenticate(user, password, (err, user) => {
 				if (!err) {
-					req.remote_user = user;
+					req.remote_user = credentials.tokenKey ? {
+						...user,
+						token: { key: credentials.tokenKey }
+					} : user;
 					debug$1("generating a remote user");
 					next();
 				} else {
@@ -391,14 +394,16 @@ var Auth = class {
 		};
 	}
 	async jwtEncrypt(user, signOptions) {
-		const { real_groups, name, groups } = user;
+		const { real_groups, name, groups, token: tokenMetadata } = user;
 		debug$1("jwt encrypt %o", name);
 		const realGroupsValidated = (0, lodash_es.isNil)(real_groups) ? [] : real_groups;
-		return await (0, _verdaccio_signature.signPayload)({
+		const payload = {
 			real_groups: realGroupsValidated,
 			name,
 			groups: (0, lodash_es.isNil)(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
-		}, this.secret, signOptions);
+		};
+		if (tokenMetadata?.key) payload.token = { key: tokenMetadata.key };
+		return await (0, _verdaccio_signature.signPayload)(payload, this.secret, signOptions);
 	}
 	/**
 	* Encrypt a string.

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { filter, isEmpty, isNil, isUndefined } from 'lodash-es';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = filter(\n      this.plugins,\n      (plugin) => typeof plugin.changePassword === 'function'\n    );\n\n    if (isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || typeof plugin.changePassword !== 'function') {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (typeof groups === 'string') {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = Array.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;;;AAiDA,IAAM,WAAA,GAAA,MAAA,SAAmB,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,UAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,UAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,mBAAA,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAA,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,WAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,UAAA,GAAA,mBAAA,iBACE,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,EACD,gBAAA,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,gBAAA,eACrC,gBAAA,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,cAAA,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,gBAAA,GAAA,UAAA,QACJ,KAAK,UACJ,WAAW,OAAO,OAAO,mBAAmB,WAC9C;AAED,OAAA,GAAA,UAAA,SAAY,aAAa,CACvB,QAAO,GAAG,gBAAA,WAAW,iBAAiB,gBAAA,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,MAAA,GAAA,UAAA,OAAU,OAAO,IAAI,OAAO,OAAO,mBAAmB,YAAY;AAChE,WAAM,iEAAiE;AACvE;SACK;AACL,WAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,YAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,WAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,aAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,OAAO,WAAW,SACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,MAAM,QAAQ,OAAO,CAEjD,OAAM,IAAI,UAAU,gBAAA,UAAU,sBAAsB;AAGtD,aAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,MAAA,GAAA,kBAAA,kBAAsB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,UAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,oBAAA,aAAa,KAAK,gBAAA,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,aAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,aAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,YAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,YAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,aAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,aAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,YAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,aAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,SAAA,GAAA,UAAA,OAAU,GAAG,KAAK,MAAM;AACtB,aAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,aAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,YAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,aAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,aAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,UAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE,2BAAA,kBAAA;GAA2B,kBAAA,kBAAA;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,cAAA,GAAA,kBAAA,4BAAwC;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,QAAA,GAAA,UAAA,OAAU,cAAc,EAAE;AACxB,YAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,cAAA,kBAAkB,cAAc,EAAE;AACrC,YAAM,mDAAmD;AACzD,WAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,cAAA,YAAY,SAAS,EAAE;AACzB,YAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,YAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,UAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,cAAA,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,gBAAA,YAAY,aAAa,EAAE;AACtD,WAAM,qBAAqB;GAG3B,MAAM,qBAAA,GAAA,qBAAA,mBADc,cAAA,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,YAAM,6DAA6D;AACnE,SAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,WAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,aAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,aAAM,4BAA4B;AAClC,SAAI,eAAA,GAAA,kBAAA,4BAAyC;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,WAAM,mBAAmB;GACzB,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,YAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,YAAM,oBAAoB;AAC1B,SAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,UAAM,+BAA+B;AACrC,UAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,UAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,cAAc;AAClF,UAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,WAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,aAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,eAAA,GAAA,kBAAA,4BAAyC;AAC7C,aAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,WAAM,wBAAwB;AAC9B,UAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,UAAA,GAAA,UAAA,aAAmB,YAAY,KAAK,UAAA,GAAA,UAAA,aAAqB,aAAa,KAAK,KAAK;;;;;CAMlF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,QAAA,GAAA,UAAA,OAAU,cAAc,CACtB,QAAO,MAAM;AAGf,OAAI,CAAC,cAAA,kBAAkB,cAAc,CACnC,QAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,gBAAA,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,cAAA,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,eAAA,GAAA,kBAAA,kBAA+B,MAAgB,OAAO;SAE1D,KAAI,eAAA,GAAA,kBAAA,4BAAyC;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,UAAM,kBAAkB,KAAK;EAC7B,MAAM,uBAAA,GAAA,UAAA,OAA4B,YAAY,GAAG,EAAE,GAAG;AAetD,SANsB,OAAA,GAAA,qBAAA,aALM;GAC1B,aAAa;GACb;GACA,SAAA,GAAA,UAAA,OAN0B,OAAO,GAC/B,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,UAAM,8BAA8B;AAEpC,UAAA,GAAA,qBAAA,YADyB,OAAO,KAAK,OAAO"}
+{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { filter, isEmpty, isNil, isUndefined } from 'lodash-es';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = filter(\n      this.plugins,\n      (plugin) => typeof plugin.changePassword === 'function'\n    );\n\n    if (isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || typeof plugin.changePassword !== 'function') {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (typeof groups === 'string') {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = Array.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = credentials.tokenKey\n            ? { ...user, token: { key: credentials.tokenKey } }\n            : user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups, token: tokenMetadata } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    if (tokenMetadata?.key) {\n      payload.token = { key: tokenMetadata.key };\n    }\n    const signedToken: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return signedToken;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;;;AAiDA,IAAM,WAAA,GAAA,MAAA,SAAmB,gBAAgB;AAEzC,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,MAAM,GAAG;EAC1F,KAAK,SAAS;EACd,KAAK,SAAS,OAAO;EACrB,KAAK,SAAS;EACd,KAAK,UAAU,CAAC;EAChB,KAAK,UAAU;EACf,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,UAAU,0DAA0D;CAElF;CAEA,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,WAAW;EAEpC,QAAM,yBAAyB,QAAQ,MAAM;EAG7C,IAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,IAC/D,UAAU,KAAK,kBAAkB;EAEnC,KAAK,UAAU;EAEf,KAAK,2BAA2B;CAClC;CAEA,oBAA4B;EAC1B,QAAM,0BAA0B;EAChC,IAAI;EACJ,IAAI;GACF,aAAa,IAAI,mBAAA,SACf,EAAE,MAAM,aAAa,GACrB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;GACf,CACF;GACA,KAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAA,gBAAgB;GAAe,GAC7E,wDACF;EACF,SAAS,OAAY;GACnB,QAAM,mDAAmD,KAAK;GAC9D,KAAK,OAAO,KAAK,CAAC,GAAG,+BAA+B;GACpD,OAAO,CAAC;EACV;EAEA,OAAO,CAAC,UAAU;CACpB;CAEA,MAAc,aAAa;EACzB,QAAA,GAAA,mBAAA,iBACE,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;EACf,GACA,gBAAA,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,gBAAA,eACrC,gBAAA,gBAAgB,cAClB;CACF;CAEA,6BAA2C;EACzC,KAAK,QAAQ,KAAK,cAAA,wBAAwB,KAAK,MAAM,CAAC;CACxD;CAEA,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,gBAAA,GAAA,UAAA,QACJ,KAAK,UACJ,WAAW,OAAO,OAAO,mBAAmB,UAC/C;EAEA,KAAA,GAAA,UAAA,SAAY,YAAY,GACtB,OAAO,GAAG,gBAAA,WAAW,iBAAiB,gBAAA,eAAe,wBAAwB,CAAC;EAGhF,KAAK,MAAM,UAAU,cACnB,KAAA,GAAA,UAAA,OAAU,MAAM,KAAK,OAAO,OAAO,mBAAmB,YAAY;GAChE,QAAM,gEAAgE;GACtE;EACF,OAAO;GACL,QAAM,4BAA4B,QAAQ;GAC1C,OAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;IAC9E,IAAI,KAAK;KACP,KAAK,OAAO,MACV;MAAE;MAAU;KAAI,GAChB;yEAEF;KACA,OAAO,GAAG,GAAG;IACf;IAEA,QAAM,0CAA0C,QAAQ;IACxD,OAAO,GAAG,MAAM,OAAO;GACzB,CAAC;EACH;CAEJ;CAEA,MAAa,gBAAgB,OAAe;EAE1C,QAAQ,IAAI,yCAAyC,KAAK;EAC1D,OAAO,QAAQ,QAAQ;CACzB;CAEA,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,CAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,iBAAiB,YAClC,OAAO,KAAK;GAGd,QAAM,qBAAqB,QAAQ;GACnC,OAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;IAC1F,IAAI,KAAK;KACP,QAAM,gDAAgD,UAAU,KAAK,OAAO;KAC5E,OAAO,GAAG,GAAG;IACf;IASA,IAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;KAEnC,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,UAAU,+CAA+C;KAGrE,IAAI,CAD0B,MAAM,QAAQ,MACvC,GACH,MAAM,IAAI,UAAU,gBAAA,UAAU,qBAAqB;KAGrD,QAAM,2DAA2D,UAAU,MAAM;KACjF,OAAO,GAAG,MAAA,GAAA,kBAAA,kBAAsB,UAAU,MAAM,CAAC;IACnD;IACA,KAAK;GACP,CAAC;EACH,GAAG;CACL;CAEA,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,QAAM,eAAe,IAAI;EAEzB,CAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;IAClF,SAAS;IACT,gBAAA,aAAa,KAAK,gBAAA,aAAa,MAAM,SAAS;GAChD;GAEA,IAAI,OAAO,OAAO,YAAY,YAC5B,KAAK;QAIL,OAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;IACjE,IAAI,KAAK;KACP,QAAM,6CAA6C,MAAM,KAAK,OAAO;KACrE,OAAO,GAAG,GAAG;IACf;IACA,IAAI,IAAI;KACN,QAAM,8BAA8B,IAAI;KACxC,OAAO,KAAK,aAAa,MAAM,UAAU,EAAE;IAC7C;IACA,QAAM,mDAAmD;IACzD,KAAK;GACP,CACF;EAEJ,GAAG;CACL;;;;CAKA,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,QAAM,sDAAsD,KAAK,MAAM,WAAW;EAGlF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,iBAAiB,YAAY;IAC9C,QAAM,wCAAwC;IAC9C,OAAO,KAAK;GACd;GAEA,OAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;IACjF,IAAI,KAAK;KACP,QAAM,+BAA+B,GAAG;KACxC,OAAO,SAAS,GAAG;IACrB;IAEA,IAAI,IAAI;KACN,QAAM,oBAAoB;KAC1B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,2CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,QAAM,2CAA2C;IACjD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,2EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,QAAM,yDAAyD,KAAK,MAAM,WAAW;EAGrF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,oBAAoB,YAAY;IACjD,QAAM,2CAA2C;IACjD,OAAO,KAAK;GACd;GAEA,OAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;IACpF,IAAI,KAAK;KACP,QAAM,kCAAkC,GAAG;KAC3C,OAAO,SAAS,GAAG;IACrB;IAMA,KAAA,GAAA,UAAA,OAAU,EAAE,MAAM,MAAM;KACtB,QAAM,2DAA2D,WAAW;KAC5E,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,yEACF;KACA,OAAO,KAAK,cAAc;MAAE;MAAa;KAAe,GAAG,MAAM,QAAQ;IAC3E;IAEA,IAAI,IAAI;KACN,QAAM,uBAAuB;KAC7B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,8CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,QAAM,8CAA8C;IACpD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,8EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;;;;CAKA,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,QAAM,uDAAuD,KAAK,MAAM,WAAW;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,kBAAkB,YAAY;IAC/C,QAAM,yCAAyC;IAC/C,OAAO,KAAK;GACd;GAEA,OAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;IAClF,IAAI,KAAK;KACP,QAAM,gCAAgC,GAAG;KACzC,OAAO,SAAS,GAAG;IACrB;IAEA,IAAI,IAAI;KACN,QAAM,qBAAqB;KAC3B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,4CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,QAAM,4CAA4C;IAClD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,4EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,mBAA+B;EAC7B,QAAM,gBAAgB;EACtB,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,UAAU;GAAE,2BAAA,kBAAA;GAA2B,kBAAA,kBAAA;EAAiB;EAC9D,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,kBACT,OAAO,OAAO,iBAAiB,OAAO;EAI1C,QAAQ,KAAqB,KAAsB,UAAwB;GACzE,IAAI,MAAM;GACV,MAAM,OAAO,SAAU,KAAoC;IACzD,IAAI,OAAO;IAKX,IAAI,KACF,IAAI,YAAY,QAAQ,IAAI;IAG9B,OAAO,MAAM;GACf;GASA,MAAM,cAAA,GAAA,kBAAA,2BAAuC;GAC7C,IAAI,cAAc;GAClB,IAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;GAC9B,KAAA,GAAA,UAAA,OAAU,aAAa,GAAG;IACxB,QAAM,uCAAuC;IAC7C,OAAO,KAAK;GACd;GAEA,IAAI,CAAC,cAAA,kBAAkB,aAAa,GAAG;IACrC,QAAM,kDAAkD;IACxD,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,eAAe,CAAC;GACjE;GACA,MAAM,EAAE,QAAQ,aAAa,KAAK;GAElC,IAAI,cAAA,YAAY,QAAQ,GAAG;IACzB,QAAM,wCAAwC;IAC9C,KAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,IAAI;GACrE,OAAO;IACL,QAAM,qCAAqC;IAC3C,KAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,IAAI;GACxE;EACF;CACF;CAEA,uBACE,KACA,UACA,QACA,eACA,MACM;EACN,QAAM,2BAA2B;EACjC,MAAM,EAAE,QAAQ,UAAU,cAAA,qBAAqB,aAAa;EAC5D,IAAI,OAAO,YAAY,MAAM,gBAAA,YAAY,YAAY,GAAG;GACtD,QAAM,oBAAoB;GAG1B,MAAM,qBAAA,GAAA,qBAAA,mBADc,cAAA,uBAAuB,KAAK,EAAE,SACN,CAAW;GACvD,IAAI,CAAC,mBAAmB;IACtB,QAAM,4DAA4D;IAClE,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,qBAAqB,CAAC;IAC9D;GACF;GACA,MAAM,EAAE,MAAM,aAAa;GAC3B,QAAM,qBAAqB,IAAI;GAC/B,KAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;IAC5E,IAAI,CAAC,KAAK;KACR,QAAM,0BAA0B;KAChC,IAAI,cAAc;KAClB,KAAK;IACP,OAAO;KACL,QAAM,2BAA2B;KACjC,IAAI,eAAA,GAAA,kBAAA,2BAAwC;KAC5C,KAAK,GAAG;IACV;GACF,CAAC;EACH,OAAO;GACL,QAAM,kBAAkB;GACxB,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,aAAa;GACjF,IAAI,aAAa;IAEf,IAAI,cAAc;IAClB,QAAM,0BAA0B;IAChC,KAAK;GACP,OAAO;IAEL,QAAM,mBAAmB;IACzB,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,qBAAqB,CAAC;GAC/D;EACF;CACF;CAEA,oBACE,KACA,UACA,QACA,eACA,MACM;EACN,QAAM,8BAA8B;EACpC,QAAM,mCAAmC,OAAO,WAAW,QAAQ;EACnE,QAAM,mCAAmC,OAAO,kBAAkB,QAAQ;EAC1E,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,aAAa;EACjF,QAAM,iCAAiC,aAAa,IAAI;EACxD,IAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;GAC3B,QAAM,qBAAqB,IAAI;GAC/B,KAAK,aAAa,MAAM,WAAW,KAAK,SAAe;IACrD,IAAI,CAAC,KAAK;KACR,IAAI,cAAc,YAAY,WAC1B;MAAE,GAAG;MAAM,OAAO,EAAE,KAAK,YAAY,SAAS;KAAE,IAChD;KACJ,QAAM,0BAA0B;KAChC,KAAK;IACP,OAAO;KACL,IAAI,eAAA,GAAA,kBAAA,2BAAwC;KAC5C,QAAM,2BAA2B;KACjC,KAAK,GAAG;IACV;GACF,CAAC;EACH,OAAO;GAEL,QAAM,uBAAuB;GAC7B,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,eAAe,CAAC;EACjE;CACF;CAEA,mBAA2B,aAAmC;EAC5D,QAAA,GAAA,UAAA,aAAmB,WAAW,MAAM,UAAA,GAAA,UAAA,aAAqB,aAAa,IAAI,MAAM;CAClF;;;;CAKA,qBAA4B;EAC1B,QAAQ,KAAqB,KAAsB,UAA8B;GAC/E,IAAI,KAAK,mBAAmB,IAAI,WAAW,GACzC,OAAO,MAAM;GAGf,IAAI,MAAM;GACV,MAAM,QAAQ,QAAqC;IACjD,IAAI,OAAO;IACX,IAAI,KAAK;KACP,IAAI,YAAY,QAAQ,IAAI;KAC5B,IAAI,OAAO,IAAI,UAAU,EAAE,KAAK,IAAI,OAAO;IAC7C;IAEA,OAAO,MAAM;GACf;GAEA,MAAM,EAAE,kBAAkB,IAAI;GAC9B,KAAA,GAAA,UAAA,OAAU,aAAa,GACrB,OAAO,KAAK;GAGd,IAAI,CAAC,cAAA,kBAAkB,aAAa,GAClC,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,eAAe,CAAC;GAGjE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,gBAAA,aAAa,IAAI,EAAE;GAClE,IAAI,CAAC,OACH,OAAO,KAAK;GAGd,IAAI;GACJ,IAAI;IACF,cAAc,cAAA,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,QAAQ;GAChF,QAAQ,CAER;GAEA,IAAI,KAAK,mBAAmB,WAAW,GAAG;IACxC,MAAM,EAAE,MAAM,WAAW;IACzB,IAAI,eAAA,GAAA,kBAAA,kBAA+B,MAAgB,MAAM;GAC3D,OACE,IAAI,eAAA,GAAA,kBAAA,2BAAwC;GAG9C,KAAK;EACP;CACF;CAEA,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,QAAQ,OAAO,kBAAkB;EAC5D,QAAM,kBAAkB,IAAI;EAC5B,MAAM,uBAAA,GAAA,UAAA,OAA4B,WAAW,IAAI,CAAC,IAAI;EAItD,MAAM,UAAsB;GAC1B,aAAa;GACb;GACA,SAAA,GAAA,UAAA,OAN0B,MAAM,IAC9B,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,mBAAmB,CAAC,CAAC,CAAC;EAK/D;EACA,IAAI,eAAe,KACjB,QAAQ,QAAQ,EAAE,KAAK,cAAc,IAAI;EAQ3C,OAAO,OAAA,GAAA,qBAAA,aALL,SACA,KAAK,QACL,WACF;CAGF;;;;CAKA,WAAkB,OAA8B;EAC9C,QAAM,6BAA6B;EAEnC,QAAA,GAAA,qBAAA,YADyB,OAAO,KAAK,MAC9B;CACT;AACF"}

package/build/auth.mjs

@@ -340,7 +340,10 @@ var Auth = class {
 			debug("authenticating %o", user);
 			this.authenticate(user, password, (err, user) => {
 				if (!err) {
-					req.remote_user = user;
+					req.remote_user = credentials.tokenKey ? {
+						...user,
+						token: { key: credentials.tokenKey }
+					} : user;
 					debug("generating a remote user");
 					next();
 				} else {
@@ -389,14 +392,16 @@ var Auth = class {
 		};
 	}
 	async jwtEncrypt(user, signOptions) {
-		const { real_groups, name, groups } = user;
+		const { real_groups, name, groups, token: tokenMetadata } = user;
 		debug("jwt encrypt %o", name);
 		const realGroupsValidated = isNil(real_groups) ? [] : real_groups;
-		return await signPayload({
+		const payload = {
 			real_groups: realGroupsValidated,
 			name,
 			groups: isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
-		}, this.secret, signOptions);
+		};
+		if (tokenMetadata?.key) payload.token = { key: tokenMetadata.key };
+		return await signPayload(payload, this.secret, signOptions);
 	}
 	/**
 	* Encrypt a string.

package/build/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { filter, isEmpty, isNil, isUndefined } from 'lodash-es';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = filter(\n      this.plugins,\n      (plugin) => typeof plugin.changePassword === 'function'\n    );\n\n    if (isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || typeof plugin.changePassword !== 'function') {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (typeof groups === 'string') {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = Array.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;AAiDA,IAAM,QAAQ,WAAW,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,QAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,QAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,SAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,SAAO,gBACL,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,EACD,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,eACrC,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,OACnB,KAAK,UACJ,WAAW,OAAO,OAAO,mBAAmB,WAC9C;AAED,MAAI,QAAQ,aAAa,CACvB,QAAO,GAAG,WAAW,iBAAiB,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,KAAI,MAAM,OAAO,IAAI,OAAO,OAAO,mBAAmB,YAAY;AAChE,SAAM,iEAAiE;AACvE;SACK;AACL,SAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,UAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,SAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,WAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,OAAO,WAAW,SACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,MAAM,QAAQ,OAAO,CAEjD,OAAM,IAAI,UAAU,UAAU,sBAAsB;AAGtD,WAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,KAAK,iBAAiB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,QAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,iBAAa,KAAK,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,WAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,WAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,UAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,UAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,WAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,UAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,WAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,QAAI,MAAM,GAAG,KAAK,MAAM;AACtB,WAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,WAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,UAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,WAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,QAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE;GAA2B;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,aAAa,2BAA2B;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,MAAM,cAAc,EAAE;AACxB,UAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,kBAAkB,cAAc,EAAE;AACrC,UAAM,mDAAmD;AACzD,WAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,YAAY,SAAS,EAAE;AACzB,UAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,UAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,SAAM,qBAAqB;GAG3B,MAAM,oBAAoB,kBADN,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,UAAM,6DAA6D;AACnE,SAAK,WAAW,cAAc,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,WAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,WAAM,4BAA4B;AAClC,SAAI,cAAc,2BAA2B;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,SAAM,mBAAmB;GACzB,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,UAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,UAAM,oBAAoB;AAC1B,SAAK,WAAW,aAAa,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,+BAA+B;AACrC,QAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,QAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,QAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,WAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,cAAc,2BAA2B;AAC7C,WAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,SAAM,wBAAwB;AAC9B,UAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,SAAO,YAAY,YAAY,KAAK,SAAS,YAAY,aAAa,KAAK,KAAK;;;;;CAMlF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,MAAM,cAAc,CACtB,QAAO,MAAM;AAGf,OAAI,CAAC,kBAAkB,cAAc,CACnC,QAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,cAAc,iBAAiB,MAAgB,OAAO;SAE1D,KAAI,cAAc,2BAA2B;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,QAAM,kBAAkB,KAAK;EAC7B,MAAM,sBAAsB,MAAM,YAAY,GAAG,EAAE,GAAG;AAetD,SANsB,MAAM,YALA;GAC1B,aAAa;GACb;GACA,QANoB,MAAM,OAAO,GAC/B,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,QAAM,8BAA8B;AAEpC,SADc,WAAW,OAAO,KAAK,OAAO"}
+{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { filter, isEmpty, isNil, isUndefined } from 'lodash-es';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = filter(\n      this.plugins,\n      (plugin) => typeof plugin.changePassword === 'function'\n    );\n\n    if (isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || typeof plugin.changePassword !== 'function') {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (typeof groups === 'string') {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = Array.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = credentials.tokenKey\n            ? { ...user, token: { key: credentials.tokenKey } }\n            : user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups, token: tokenMetadata } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    if (tokenMetadata?.key) {\n      payload.token = { key: tokenMetadata.key };\n    }\n    const signedToken: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return signedToken;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;AAiDA,IAAM,QAAQ,WAAW,gBAAgB;AAEzC,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,MAAM,GAAG;EAC1F,KAAK,SAAS;EACd,KAAK,SAAS,OAAO;EACrB,KAAK,SAAS;EACd,KAAK,UAAU,CAAC;EAChB,KAAK,UAAU;EACf,IAAI,CAAC,KAAK,QACR,MAAM,IAAI,UAAU,0DAA0D;CAElF;CAEA,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,WAAW;EAEpC,MAAM,yBAAyB,QAAQ,MAAM;EAG7C,IAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,IAC/D,UAAU,KAAK,kBAAkB;EAEnC,KAAK,UAAU;EAEf,KAAK,2BAA2B;CAClC;CAEA,oBAA4B;EAC1B,MAAM,0BAA0B;EAChC,IAAI;EACJ,IAAI;GACF,aAAa,IAAI,SACf,EAAE,MAAM,aAAa,GACrB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;GACf,CACF;GACA,KAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAgB;GAAe,GAC7E,wDACF;EACF,SAAS,OAAY;GACnB,MAAM,mDAAmD,KAAK;GAC9D,KAAK,OAAO,KAAK,CAAC,GAAG,+BAA+B;GACpD,OAAO,CAAC;EACV;EAEA,OAAO,CAAC,UAAU;CACpB;CAEA,MAAc,aAAa;EACzB,OAAO,gBACL,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;EACf,GACA,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,eACrC,gBAAgB,cAClB;CACF;CAEA,6BAA2C;EACzC,KAAK,QAAQ,KAAK,wBAAwB,KAAK,MAAM,CAAC;CACxD;CAEA,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,OACnB,KAAK,UACJ,WAAW,OAAO,OAAO,mBAAmB,UAC/C;EAEA,IAAI,QAAQ,YAAY,GACtB,OAAO,GAAG,WAAW,iBAAiB,eAAe,wBAAwB,CAAC;EAGhF,KAAK,MAAM,UAAU,cACnB,IAAI,MAAM,MAAM,KAAK,OAAO,OAAO,mBAAmB,YAAY;GAChE,MAAM,gEAAgE;GACtE;EACF,OAAO;GACL,MAAM,4BAA4B,QAAQ;GAC1C,OAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;IAC9E,IAAI,KAAK;KACP,KAAK,OAAO,MACV;MAAE;MAAU;KAAI,GAChB;yEAEF;KACA,OAAO,GAAG,GAAG;IACf;IAEA,MAAM,0CAA0C,QAAQ;IACxD,OAAO,GAAG,MAAM,OAAO;GACzB,CAAC;EACH;CAEJ;CAEA,MAAa,gBAAgB,OAAe;EAE1C,QAAQ,IAAI,yCAAyC,KAAK;EAC1D,OAAO,QAAQ,QAAQ;CACzB;CAEA,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,CAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,iBAAiB,YAClC,OAAO,KAAK;GAGd,MAAM,qBAAqB,QAAQ;GACnC,OAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;IAC1F,IAAI,KAAK;KACP,MAAM,gDAAgD,UAAU,KAAK,OAAO;KAC5E,OAAO,GAAG,GAAG;IACf;IASA,IAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;KAEnC,IAAI,OAAO,WAAW,UACpB,MAAM,IAAI,UAAU,+CAA+C;KAGrE,IAAI,CAD0B,MAAM,QAAQ,MACvC,GACH,MAAM,IAAI,UAAU,UAAU,qBAAqB;KAGrD,MAAM,2DAA2D,UAAU,MAAM;KACjF,OAAO,GAAG,KAAK,iBAAiB,UAAU,MAAM,CAAC;IACnD;IACA,KAAK;GACP,CAAC;EACH,GAAG;CACL;CAEA,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,eAAe,IAAI;EAEzB,CAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;IAClF,SAAS;IACT,aAAa,KAAK,aAAa,MAAM,SAAS;GAChD;GAEA,IAAI,OAAO,OAAO,YAAY,YAC5B,KAAK;QAIL,OAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;IACjE,IAAI,KAAK;KACP,MAAM,6CAA6C,MAAM,KAAK,OAAO;KACrE,OAAO,GAAG,GAAG;IACf;IACA,IAAI,IAAI;KACN,MAAM,8BAA8B,IAAI;KACxC,OAAO,KAAK,aAAa,MAAM,UAAU,EAAE;IAC7C;IACA,MAAM,mDAAmD;IACzD,KAAK;GACP,CACF;EAEJ,GAAG;CACL;;;;CAKA,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,MAAM,sDAAsD,KAAK,MAAM,WAAW;EAGlF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,iBAAiB,YAAY;IAC9C,MAAM,wCAAwC;IAC9C,OAAO,KAAK;GACd;GAEA,OAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;IACjF,IAAI,KAAK;KACP,MAAM,+BAA+B,GAAG;KACxC,OAAO,SAAS,GAAG;IACrB;IAEA,IAAI,IAAI;KACN,MAAM,oBAAoB;KAC1B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,2CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,MAAM,2CAA2C;IACjD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,2EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,MAAM,yDAAyD,KAAK,MAAM,WAAW;EAGrF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,oBAAoB,YAAY;IACjD,MAAM,2CAA2C;IACjD,OAAO,KAAK;GACd;GAEA,OAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;IACpF,IAAI,KAAK;KACP,MAAM,kCAAkC,GAAG;KAC3C,OAAO,SAAS,GAAG;IACrB;IAMA,IAAI,MAAM,EAAE,MAAM,MAAM;KACtB,MAAM,2DAA2D,WAAW;KAC5E,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,yEACF;KACA,OAAO,KAAK,cAAc;MAAE;MAAa;KAAe,GAAG,MAAM,QAAQ;IAC3E;IAEA,IAAI,IAAI;KACN,MAAM,uBAAuB;KAC7B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,8CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,MAAM,8CAA8C;IACpD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,8EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;;;;CAKA,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;EAAe,GAC7C,UAAU,uBAAuB,aAAa,KAAK,OAAO,QAAQ,CACpE;EAEA,MAAM,uDAAuD,KAAK,MAAM,WAAW;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,MAAM;GAE7B,IAAI,OAAO,QAAQ,kBAAkB,YAAY;IAC/C,MAAM,yCAAyC;IAC/C,OAAO,KAAK;GACd;GAEA,OAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;IAClF,IAAI,KAAK;KACP,MAAM,gCAAgC,GAAG;KACzC,OAAO,SAAS,GAAG;IACrB;IAEA,IAAI,IAAI;KACN,MAAM,qBAAqB;KAC3B,KAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;KAAK,GAClC,4CACF;KACA,OAAO,SAAS,MAAM,EAAE;IAC1B;IAGA,MAAM,4CAA4C;IAClD,KAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;IAAK,GAClC,4EACF;IACA,OAAO,KAAK;GACd,CAAC;EACH;EAEA,OAAO,KAAK;CACd;CAEA,mBAA+B;EAC7B,MAAM,gBAAgB;EACtB,MAAM,UAAU,KAAK,QAAQ,MAAM,CAAC;EACpC,MAAM,UAAU;GAAE;GAA2B;EAAiB;EAC9D,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,kBACT,OAAO,OAAO,iBAAiB,OAAO;EAI1C,QAAQ,KAAqB,KAAsB,UAAwB;GACzE,IAAI,MAAM;GACV,MAAM,OAAO,SAAU,KAAoC;IACzD,IAAI,OAAO;IAKX,IAAI,KACF,IAAI,YAAY,QAAQ,IAAI;IAG9B,OAAO,MAAM;GACf;GASA,MAAM,aAAa,0BAA0B;GAC7C,IAAI,cAAc;GAClB,IAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;GAC9B,IAAI,MAAM,aAAa,GAAG;IACxB,MAAM,uCAAuC;IAC7C,OAAO,KAAK;GACd;GAEA,IAAI,CAAC,kBAAkB,aAAa,GAAG;IACrC,MAAM,kDAAkD;IACxD,OAAO,KAAK,WAAW,cAAc,UAAU,eAAe,CAAC;GACjE;GACA,MAAM,EAAE,QAAQ,aAAa,KAAK;GAElC,IAAI,YAAY,QAAQ,GAAG;IACzB,MAAM,wCAAwC;IAC9C,KAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,IAAI;GACrE,OAAO;IACL,MAAM,qCAAqC;IAC3C,KAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,IAAI;GACxE;EACF;CACF;CAEA,uBACE,KACA,UACA,QACA,eACA,MACM;EACN,MAAM,2BAA2B;EACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,aAAa;EAC5D,IAAI,OAAO,YAAY,MAAM,YAAY,YAAY,GAAG;GACtD,MAAM,oBAAoB;GAG1B,MAAM,oBAAoB,kBADN,uBAAuB,KAAK,EAAE,SACN,CAAW;GACvD,IAAI,CAAC,mBAAmB;IACtB,MAAM,4DAA4D;IAClE,KAAK,WAAW,cAAc,UAAU,qBAAqB,CAAC;IAC9D;GACF;GACA,MAAM,EAAE,MAAM,aAAa;GAC3B,MAAM,qBAAqB,IAAI;GAC/B,KAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;IAC5E,IAAI,CAAC,KAAK;KACR,MAAM,0BAA0B;KAChC,IAAI,cAAc;KAClB,KAAK;IACP,OAAO;KACL,MAAM,2BAA2B;KACjC,IAAI,cAAc,0BAA0B;KAC5C,KAAK,GAAG;IACV;GACF,CAAC;EACH,OAAO;GACL,MAAM,kBAAkB;GACxB,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,aAAa;GACjF,IAAI,aAAa;IAEf,IAAI,cAAc;IAClB,MAAM,0BAA0B;IAChC,KAAK;GACP,OAAO;IAEL,MAAM,mBAAmB;IACzB,KAAK,WAAW,aAAa,UAAU,qBAAqB,CAAC;GAC/D;EACF;CACF;CAEA,oBACE,KACA,UACA,QACA,eACA,MACM;EACN,MAAM,8BAA8B;EACpC,MAAM,mCAAmC,OAAO,WAAW,QAAQ;EACnE,MAAM,mCAAmC,OAAO,kBAAkB,QAAQ;EAC1E,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,aAAa;EACjF,MAAM,iCAAiC,aAAa,IAAI;EACxD,IAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;GAC3B,MAAM,qBAAqB,IAAI;GAC/B,KAAK,aAAa,MAAM,WAAW,KAAK,SAAe;IACrD,IAAI,CAAC,KAAK;KACR,IAAI,cAAc,YAAY,WAC1B;MAAE,GAAG;MAAM,OAAO,EAAE,KAAK,YAAY,SAAS;KAAE,IAChD;KACJ,MAAM,0BAA0B;KAChC,KAAK;IACP,OAAO;KACL,IAAI,cAAc,0BAA0B;KAC5C,MAAM,2BAA2B;KACjC,KAAK,GAAG;IACV;GACF,CAAC;EACH,OAAO;GAEL,MAAM,uBAAuB;GAC7B,OAAO,KAAK,WAAW,cAAc,UAAU,eAAe,CAAC;EACjE;CACF;CAEA,mBAA2B,aAAmC;EAC5D,OAAO,YAAY,WAAW,MAAM,SAAS,YAAY,aAAa,IAAI,MAAM;CAClF;;;;CAKA,qBAA4B;EAC1B,QAAQ,KAAqB,KAAsB,UAA8B;GAC/E,IAAI,KAAK,mBAAmB,IAAI,WAAW,GACzC,OAAO,MAAM;GAGf,IAAI,MAAM;GACV,MAAM,QAAQ,QAAqC;IACjD,IAAI,OAAO;IACX,IAAI,KAAK;KACP,IAAI,YAAY,QAAQ,IAAI;KAC5B,IAAI,OAAO,IAAI,UAAU,EAAE,KAAK,IAAI,OAAO;IAC7C;IAEA,OAAO,MAAM;GACf;GAEA,MAAM,EAAE,kBAAkB,IAAI;GAC9B,IAAI,MAAM,aAAa,GACrB,OAAO,KAAK;GAGd,IAAI,CAAC,kBAAkB,aAAa,GAClC,OAAO,KAAK,WAAW,cAAc,UAAU,eAAe,CAAC;GAGjE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,aAAa,IAAI,EAAE;GAClE,IAAI,CAAC,OACH,OAAO,KAAK;GAGd,IAAI;GACJ,IAAI;IACF,cAAc,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,QAAQ;GAChF,QAAQ,CAER;GAEA,IAAI,KAAK,mBAAmB,WAAW,GAAG;IACxC,MAAM,EAAE,MAAM,WAAW;IACzB,IAAI,cAAc,iBAAiB,MAAgB,MAAM;GAC3D,OACE,IAAI,cAAc,0BAA0B;GAG9C,KAAK;EACP;CACF;CAEA,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,QAAQ,OAAO,kBAAkB;EAC5D,MAAM,kBAAkB,IAAI;EAC5B,MAAM,sBAAsB,MAAM,WAAW,IAAI,CAAC,IAAI;EAItD,MAAM,UAAsB;GAC1B,aAAa;GACb;GACA,QANoB,MAAM,MAAM,IAC9B,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,mBAAmB,CAAC,CAAC,CAAC;EAK/D;EACA,IAAI,eAAe,KACjB,QAAQ,QAAQ,EAAE,KAAK,cAAc,IAAI;EAQ3C,OAAO,MAN2B,YAChC,SACA,KAAK,QACL,WACF;CAGF;;;;CAKA,WAAkB,OAA8B;EAC9C,MAAM,6BAA6B;EAEnC,OADc,WAAW,OAAO,KAAK,MAC9B;CACT;AACF"}

package/build/types.d.ts

@@ -4,6 +4,7 @@ import { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio
 export interface AESPayload {
     user: string;
     password: string;
+    tokenKey?: string;
 }
 export type BasicPayload = AESPayload | void;
 export type AuthMiddlewarePayload = RemoteUser | BasicPayload;

package/build/utils.d.ts

@@ -9,7 +9,9 @@ export declare function parseAuthTokenHeader(authorizationHeader: string): AuthT
 export declare function parseAESCredentials(authorizationHeader: string, secret: string): string | void;
 export declare function getMiddlewareCredentials(security: Security, secretKey: string, authorizationHeader: string): AuthMiddlewarePayload;
 export declare function isAESLegacy(security: Security): boolean;
-export declare function getApiToken(auth: TokenEncryption, config: Config, remoteUser: RemoteUser, aesPassword: string): Promise<string | void>;
+export declare function getApiToken(auth: TokenEncryption, config: Config, remoteUser: RemoteUser, aesPassword: string, options?: {
+    tokenKey?: string;
+}): Promise<string | void>;
 export declare const expireReasons: string[];
 export declare function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser;
 export declare function isAuthHeaderValid(authorization: string): boolean;
@@ -24,5 +26,5 @@ export declare function allow_action(action: ActionsAllowed, logger: Logger): Al
  *
  */
 export declare function handleSpecialUnpublish(logger: Logger): any;
-export declare function buildUser(name: string, password: string): string;
+export declare function buildUser(name: string, password: string, tokenKey?: string): string;
 export declare function convertPayloadToBase64(payload: string): Buffer;

package/build/utils.js

@@ -53,19 +53,23 @@ function isAESLegacy(security) {
 	const { legacy, jwt } = security.api;
 	return (0, lodash_es.isNil)(legacy) === false && (0, lodash_es.isNil)(jwt) && legacy === true;
 }
-async function getApiToken(auth, config, remoteUser, aesPassword) {
+async function getApiToken(auth, config, remoteUser, aesPassword, options = {}) {
 	debug$1("get api token");
 	const { security } = config;
+	const tokenUser = options.tokenKey ? {
+		...remoteUser,
+		token: { key: options.tokenKey }
+	} : remoteUser;
 	if (isAESLegacy(security)) {
 		debug$1("security legacy enabled");
 		return await new Promise((resolve) => {
-			resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
+			resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword, options.tokenKey)));
 		});
 	}
 	const { jwt } = security.api;
-	if (jwt?.sign) return await auth.jwtEncrypt(remoteUser, jwt.sign);
+	if (jwt?.sign) return await auth.jwtEncrypt(tokenUser, jwt.sign);
 	return await new Promise((resolve) => {
-		resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
+		resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword, options.tokenKey)));
 	});
 }
 var expireReasons = ["JsonWebTokenError", "TokenExpiredError"];
@@ -149,7 +153,12 @@ function handleSpecialUnpublish(logger) {
 		return allow_action(action, logger)(user, pkg, callback);
 	};
 }
-function buildUser(name, password) {
+function buildUser(name, password, tokenKey) {
+	if (tokenKey) return JSON.stringify({
+		user: name,
+		password,
+		tokenKey
+	});
 	return String(`${name}:${password}`);
 }
 function convertPayloadToBase64(payload) {

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (typeof token === 'string' && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return isNil(legacy) === false && isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;;;;;AAMhD,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,IAAI;AAG5C,QAAO;EAAE;EAAQ;EAAO;;AAG1B,SAAgB,oBAAoB,qBAA6B,QAAgB;AAC/E,SAAM,2BAA2B;CACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAInE,KAAI,OAAO,aAAa,KAAK,gBAAA,YAAY,aAAa,EAAE;AACtD,UAAM,sBAAsB;AAG5B,SAFoB,uBAAuB,MAAM,CAAC,UAAU;YAGnD,OAAO,aAAa,KAAK,gBAAA,aAAa,aAAa,EAAE;AAC9D,UAAM,uBAAuB;AAC7B,UAAA,GAAA,qBAAA,YAAkB,MAAM,UAAU,EAAE,OAAO;;;AAI/C,SAAgB,yBACd,UACA,WACA,qBACuB;AACvB,SAAM,gCAAgC;AAEtC,KAAI,YAAY,SAAS,EAAE;AACzB,UAAM,YAAY;EAClB,MAAM,cAAc,oBAAoB,qBAAqB,UAAU;AACvE,MAAI,CAAC,aAAa;AAChB,WAAM,kCAAkC;AACxC;;EAGF,MAAM,qBAAA,GAAA,qBAAA,mBAAsC,YAAY;AACxD,MAAI,CAAC,mBAAmB;AACtB,WAAM,gDAAgD;AACtD;;AAGF,SAAO;;CAET,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAEnE,SAAM,SAAS;AACf,KAAI,OAAO,UAAU,YAAY,OAAO,aAAa,KAAK,gBAAA,aAAa,aAAa,CAClF,QAAO,iBAAiB,OAAO,WAAW,SAAS;;AAIvD,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;AAEjC,SAAA,GAAA,UAAA,OAAa,OAAO,KAAK,UAAA,GAAA,UAAA,OAAe,IAAI,IAAI,WAAW;;AAG7D,eAAsB,YACpB,MACA,QACA,YACA,aACwB;AACxB,SAAM,gBAAgB;CACtB,MAAM,EAAE,aAAa;AAErB,KAAI,YAAY,SAAS,EAAE;AACzB,UAAM,0BAA0B;AAEhC,SAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,WAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;IAC3E;;CAEJ,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,KAAK,KACP,QAAO,MAAM,KAAK,WAAW,YAAY,IAAI,KAAK;AAEpD,QAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,UAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;GAC3E;;AAGJ,IAAa,gBAA0B,CAAC,qBAAqB,oBAAoB;AAEjF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;AAC9F,KAAI;AAOF,UAAA,GAAA,qBAAA,eALE,OACA,QACA,UAAU,KAAK,KAAK,OACrB;UAGM,OAAY;AAEnB,MAAI,cAAc,SAAS,MAAM,KAAK,CAIpC,SAAA,GAAA,kBAAA,4BAAkC;AAEpC,QAAM,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,MAAM,QAAQ;;;AAIrE,SAAgB,kBAAkB,eAAgC;AAChE,QAAO,cAAc,MAAM,IAAI,CAAC,WAAW;;;;;;;AAQ7C,SAAgB,wBAAwB,QAA0C;AAChF,QAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;AACjF,WAAM,wCAAwC;AAC9C,MAAG,gBAAA,WAAW,aAAa,gBAAA,UAAU,sBAAsB,CAAC;;EAG9D,QAAQ,OAAe,WAAmB,IAAwC;AAChF,WAAM,mCAAmC;AAGzC,MAAG,MAAM,KAAK;;EAIhB,cAAc,aAAa,UAAU,OAAO;EAE5C,eAAe,aAAa,WAAW,OAAO;EAC9C,iBAAiB,uBAAuB,OAAO;EAChD;;AAGH,SAAgB,aAAa,QAAwB,QAA6B;AAChF,QAAO,SAAS,oBACd,MACA,KACA,UACM;AACN,SAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,uCAAuC;EAC3E,MAAM,EAAE,MAAM,WAAW;AACzB,UAAM,kCAAgC,QAAQ,OAAO;EACrD,MAAM,cAAc,IAAI;AACxB,UAAM,uCAAqC,QAAQ,YAAY;EAC/D,MAAM,gBAAgB,YAAY,MAAM,UAAU;AAChD,UAAO,SAAS,SAAS,OAAO,SAAS,MAAM;IAC/C;AACF,UAAM,wCAAoC,MAAM,cAAc;AAC9D,SAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;GAAa,EACpE,gGACD;AAED,MAAI,eAAe;AACjB,UAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,kDAAkD;AACtF,UAAO,SAAS,MAAM,KAAK;;AAG7B,MAAI,KACF,UACE,gBAAA,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,OAAO,CACxF;MAED,UACE,gBAAA,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,OAAO,CACtF;;;;;;AAQP,SAAgB,uBAAuB,QAAqB;AAC1D,QAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;AACzC,UAAM,oCAAoC,mBAAmB;EAC7D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;AAC3F,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAW,EAC9C,sEACD;AAED,MAAI,sBAAsB,cAAc,MACtC,QAAO,SAAS,MAAM,KAAA,EAAU;AAGlC,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;GAAW,EACtD,8EACD;AACD,SAAO,aAAa,QAAQ,OAAO,CAAC,MAAM,KAAK,SAAS;;;AAI5D,SAAgB,UAAU,MAAc,UAA0B;AAChE,QAAO,OAAO,GAAG,KAAK,GAAG,WAAW;;AAGtC,SAAgB,uBAAuB,SAAyB;AAC9D,QAAO,OAAO,KAAK,SAAS,SAAS"}
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (typeof token === 'string' && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return isNil(legacy) === false && isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string,\n  options: { tokenKey?: string } = {}\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n  const tokenUser: RemoteUser = options.tokenKey\n    ? { ...remoteUser, token: { key: options.tokenKey } }\n    : remoteUser;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(tokenUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string, tokenKey?: string): string {\n  if (tokenKey) {\n    return JSON.stringify({ user: name, password, tokenKey });\n  }\n\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,sBAAsB;;;;;AAM/C,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,GAChB;CAExB,OAAO;EAAE;EAAQ;CAAM;AACzB;AAEA,SAAgB,oBAAoB,qBAA6B,QAAgB;CAC/E,QAAM,0BAA0B;CAChC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAIlE,IAAI,OAAO,YAAY,MAAM,gBAAA,YAAY,YAAY,GAAG;EACtD,QAAM,qBAAqB;EAG3B,OAFoB,uBAAuB,KAAK,EAAE,SAE3C;CACT,OAAO,IAAI,OAAO,YAAY,MAAM,gBAAA,aAAa,YAAY,GAAG;EAC9D,QAAM,sBAAsB;EAC5B,QAAA,GAAA,qBAAA,YAAkB,MAAM,SAAS,GAAG,MAAM;CAC5C;AACF;AAEA,SAAgB,yBACd,UACA,WACA,qBACuB;CACvB,QAAM,+BAA+B;CAErC,IAAI,YAAY,QAAQ,GAAG;EACzB,QAAM,WAAW;EACjB,MAAM,cAAc,oBAAoB,qBAAqB,SAAS;EACtE,IAAI,CAAC,aAAa;GAChB,QAAM,iCAAiC;GACvC;EACF;EAEA,MAAM,qBAAA,GAAA,qBAAA,mBAAsC,WAAW;EACvD,IAAI,CAAC,mBAAmB;GACtB,QAAM,+CAA+C;GACrD;EACF;EAEA,OAAO;CACT;CACA,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAElE,QAAM,QAAQ;CACd,IAAI,OAAO,UAAU,YAAY,OAAO,YAAY,MAAM,gBAAA,aAAa,YAAY,GACjF,OAAO,iBAAiB,OAAO,WAAW,QAAQ;AAEtD;AAEA,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;CAEjC,QAAA,GAAA,UAAA,OAAa,MAAM,MAAM,UAAA,GAAA,UAAA,OAAe,GAAG,KAAK,WAAW;AAC7D;AAEA,eAAsB,YACpB,MACA,QACA,YACA,aACA,UAAiC,CAAC,GACV;CACxB,QAAM,eAAe;CACrB,MAAM,EAAE,aAAa;CACrB,MAAM,YAAwB,QAAQ,WAClC;EAAE,GAAG;EAAY,OAAO,EAAE,KAAK,QAAQ,SAAS;CAAE,IAClD;CAEJ,IAAI,YAAY,QAAQ,GAAG;EACzB,QAAM,yBAAyB;EAE/B,OAAO,MAAM,IAAI,SAAS,YAAkB;GAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;EAC9F,CAAC;CACH;CACA,MAAM,EAAE,QAAQ,SAAS;CAEzB,IAAI,KAAK,MACP,OAAO,MAAM,KAAK,WAAW,WAAW,IAAI,IAAI;CAElD,OAAO,MAAM,IAAI,SAAS,YAAkB;EAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;CAC9F,CAAC;AACH;AAEA,IAAa,gBAA0B,CAAC,qBAAqB,mBAAmB;AAEhF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;CAC9F,IAAI;EAOF,QAAA,GAAA,qBAAA,eALE,OACA,QACA,UAAU,KAAK,KAAK,MAGf;CACT,SAAS,OAAY;EAEnB,IAAI,cAAc,SAAS,MAAM,IAAI,GAInC,QAAA,GAAA,kBAAA,2BAAiC;EAEnC,MAAM,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,MAAM,OAAO;CAClE;AACF;AAEA,SAAgB,kBAAkB,eAAgC;CAChE,OAAO,cAAc,MAAM,GAAG,EAAE,WAAW;AAC7C;;;;;;AAOA,SAAgB,wBAAwB,QAA0C;CAChF,OAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;GACjF,QAAM,uCAAuC;GAC7C,GAAG,gBAAA,WAAW,aAAa,gBAAA,UAAU,qBAAqB,CAAC;EAC7D;EAEA,QAAQ,OAAe,WAAmB,IAAwC;GAChF,QAAM,kCAAkC;GAGxC,GAAG,MAAM,IAAI;EACf;EAGA,cAAc,aAAa,UAAU,MAAM;EAE3C,eAAe,aAAa,WAAW,MAAM;EAC7C,iBAAiB,uBAAuB,MAAM;CAChD;AACF;AAEA,SAAgB,aAAa,QAAwB,QAA6B;CAChF,OAAO,SAAS,oBACd,MACA,KACA,UACM;EACN,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,sCAAsC;EAC1E,MAAM,EAAE,MAAM,WAAW;EACzB,QAAM,kCAAgC,QAAQ,MAAM;EACpD,MAAM,cAAc,IAAI;EACxB,QAAM,uCAAqC,QAAQ,WAAW;EAC9D,MAAM,gBAAgB,YAAY,MAAM,UAAU;GAChD,OAAO,SAAS,SAAS,OAAO,SAAS,KAAK;EAChD,CAAC;EACD,QAAM,wCAAoC,MAAM,aAAa;EAC7D,OAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;EAAY,GACnE,+FACF;EAEA,IAAI,eAAe;GACjB,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,iDAAiD;GACrF,OAAO,SAAS,MAAM,IAAI;EAC5B;EAEA,IAAI,MACF,SACE,gBAAA,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,MAAM,CACxF;OAEA,SACE,gBAAA,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,MAAM,CACtF;CAEJ;AACF;;;;AAKA,SAAgB,uBAAuB,QAAqB;CAC1D,OAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;EACzC,QAAM,oCAAoC,kBAAkB;EAC5D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;EAC3F,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;EAAU,GAC7C,qEACF;EAEA,IAAI,sBAAsB,cAAc,OACtC,OAAO,SAAS,MAAM,KAAA,CAAS;EAGjC,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;EAAU,GACrD,6EACF;EACA,OAAO,aAAa,QAAQ,MAAM,EAAE,MAAM,KAAK,QAAQ;CACzD;AACF;AAEA,SAAgB,UAAU,MAAc,UAAkB,UAA2B;CACnF,IAAI,UACF,OAAO,KAAK,UAAU;EAAE,MAAM;EAAM;EAAU;CAAS,CAAC;CAG1D,OAAO,OAAO,GAAG,KAAK,GAAG,UAAU;AACrC;AAEA,SAAgB,uBAAuB,SAAyB;CAC9D,OAAO,OAAO,KAAK,SAAS,QAAQ;AACtC"}

package/build/utils.mjs

@@ -51,19 +51,23 @@ function isAESLegacy(security) {
 	const { legacy, jwt } = security.api;
 	return isNil(legacy) === false && isNil(jwt) && legacy === true;
 }
-async function getApiToken(auth, config, remoteUser, aesPassword) {
+async function getApiToken(auth, config, remoteUser, aesPassword, options = {}) {
 	debug("get api token");
 	const { security } = config;
+	const tokenUser = options.tokenKey ? {
+		...remoteUser,
+		token: { key: options.tokenKey }
+	} : remoteUser;
 	if (isAESLegacy(security)) {
 		debug("security legacy enabled");
 		return await new Promise((resolve) => {
-			resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
+			resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword, options.tokenKey)));
 		});
 	}
 	const { jwt } = security.api;
-	if (jwt?.sign) return await auth.jwtEncrypt(remoteUser, jwt.sign);
+	if (jwt?.sign) return await auth.jwtEncrypt(tokenUser, jwt.sign);
 	return await new Promise((resolve) => {
-		resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
+		resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword, options.tokenKey)));
 	});
 }
 var expireReasons = ["JsonWebTokenError", "TokenExpiredError"];
@@ -147,7 +151,12 @@ function handleSpecialUnpublish(logger) {
 		return allow_action(action, logger)(user, pkg, callback);
 	};
 }
-function buildUser(name, password) {
+function buildUser(name, password, tokenKey) {
+	if (tokenKey) return JSON.stringify({
+		user: name,
+		password,
+		tokenKey
+	});
 	return String(`${name}:${password}`);
 }
 function convertPayloadToBase64(payload) {

package/build/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (typeof token === 'string' && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return isNil(legacy) === false && isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;AAkBA,IAAM,QAAQ,WAAW,uBAAuB;;;;;AAMhD,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,IAAI;AAG5C,QAAO;EAAE;EAAQ;EAAO;;AAG1B,SAAgB,oBAAoB,qBAA6B,QAAgB;AAC/E,OAAM,2BAA2B;CACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAInE,KAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,QAAM,sBAAsB;AAG5B,SAFoB,uBAAuB,MAAM,CAAC,UAAU;YAGnD,OAAO,aAAa,KAAK,aAAa,aAAa,EAAE;AAC9D,QAAM,uBAAuB;AAC7B,SAAO,WAAW,MAAM,UAAU,EAAE,OAAO;;;AAI/C,SAAgB,yBACd,UACA,WACA,qBACuB;AACvB,OAAM,gCAAgC;AAEtC,KAAI,YAAY,SAAS,EAAE;AACzB,QAAM,YAAY;EAClB,MAAM,cAAc,oBAAoB,qBAAqB,UAAU;AACvE,MAAI,CAAC,aAAa;AAChB,SAAM,kCAAkC;AACxC;;EAGF,MAAM,oBAAoB,kBAAkB,YAAY;AACxD,MAAI,CAAC,mBAAmB;AACtB,SAAM,gDAAgD;AACtD;;AAGF,SAAO;;CAET,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAEnE,OAAM,SAAS;AACf,KAAI,OAAO,UAAU,YAAY,OAAO,aAAa,KAAK,aAAa,aAAa,CAClF,QAAO,iBAAiB,OAAO,WAAW,SAAS;;AAIvD,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;AAEjC,QAAO,MAAM,OAAO,KAAK,SAAS,MAAM,IAAI,IAAI,WAAW;;AAG7D,eAAsB,YACpB,MACA,QACA,YACA,aACwB;AACxB,OAAM,gBAAgB;CACtB,MAAM,EAAE,aAAa;AAErB,KAAI,YAAY,SAAS,EAAE;AACzB,QAAM,0BAA0B;AAEhC,SAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,WAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;IAC3E;;CAEJ,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,KAAK,KACP,QAAO,MAAM,KAAK,WAAW,YAAY,IAAI,KAAK;AAEpD,QAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,UAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;GAC3E;;AAGJ,IAAa,gBAA0B,CAAC,qBAAqB,oBAAoB;AAEjF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;AAC9F,KAAI;AAOF,SAN4B,cAC1B,OACA,QACA,UAAU,KAAK,KAAK,OACrB;UAGM,OAAY;AAEnB,MAAI,cAAc,SAAS,MAAM,KAAK,CAIpC,QAAO,2BAA2B;AAEpC,QAAM,WAAW,QAAQ,YAAY,cAAc,MAAM,QAAQ;;;AAIrE,SAAgB,kBAAkB,eAAgC;AAChE,QAAO,cAAc,MAAM,IAAI,CAAC,WAAW;;;;;;;AAQ7C,SAAgB,wBAAwB,QAA0C;AAChF,QAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;AACjF,SAAM,wCAAwC;AAC9C,MAAG,WAAW,aAAa,UAAU,sBAAsB,CAAC;;EAG9D,QAAQ,OAAe,WAAmB,IAAwC;AAChF,SAAM,mCAAmC;AAGzC,MAAG,MAAM,KAAK;;EAIhB,cAAc,aAAa,UAAU,OAAO;EAE5C,eAAe,aAAa,WAAW,OAAO;EAC9C,iBAAiB,uBAAuB,OAAO;EAChD;;AAGH,SAAgB,aAAa,QAAwB,QAA6B;AAChF,QAAO,SAAS,oBACd,MACA,KACA,UACM;AACN,SAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,uCAAuC;EAC3E,MAAM,EAAE,MAAM,WAAW;AACzB,QAAM,kCAAgC,QAAQ,OAAO;EACrD,MAAM,cAAc,IAAI;AACxB,QAAM,uCAAqC,QAAQ,YAAY;EAC/D,MAAM,gBAAgB,YAAY,MAAM,UAAU;AAChD,UAAO,SAAS,SAAS,OAAO,SAAS,MAAM;IAC/C;AACF,QAAM,wCAAoC,MAAM,cAAc;AAC9D,SAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;GAAa,EACpE,gGACD;AAED,MAAI,eAAe;AACjB,UAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,kDAAkD;AACtF,UAAO,SAAS,MAAM,KAAK;;AAG7B,MAAI,KACF,UACE,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,OAAO,CACxF;MAED,UACE,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,OAAO,CACtF;;;;;;AAQP,SAAgB,uBAAuB,QAAqB;AAC1D,QAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;AACzC,QAAM,oCAAoC,mBAAmB;EAC7D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;AAC3F,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAW,EAC9C,sEACD;AAED,MAAI,sBAAsB,cAAc,MACtC,QAAO,SAAS,MAAM,KAAA,EAAU;AAGlC,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;GAAW,EACtD,8EACD;AACD,SAAO,aAAa,QAAQ,OAAO,CAAC,MAAM,KAAK,SAAS;;;AAI5D,SAAgB,UAAU,MAAc,UAA0B;AAChE,QAAO,OAAO,GAAG,KAAK,GAAG,WAAW;;AAGtC,SAAgB,uBAAuB,SAAyB;AAC9D,QAAO,OAAO,KAAK,SAAS,SAAS"}
+{"version":3,"file":"utils.mjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (typeof token === 'string' && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return isNil(legacy) === false && isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string,\n  options: { tokenKey?: string } = {}\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n  const tokenUser: RemoteUser = options.tokenKey\n    ? { ...remoteUser, token: { key: options.tokenKey } }\n    : remoteUser;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(tokenUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword, options.tokenKey)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string, tokenKey?: string): string {\n  if (tokenKey) {\n    return JSON.stringify({ user: name, password, tokenKey });\n  }\n\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;AAkBA,IAAM,QAAQ,WAAW,sBAAsB;;;;;AAM/C,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,GAChB;CAExB,OAAO;EAAE;EAAQ;CAAM;AACzB;AAEA,SAAgB,oBAAoB,qBAA6B,QAAgB;CAC/E,MAAM,0BAA0B;CAChC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAIlE,IAAI,OAAO,YAAY,MAAM,YAAY,YAAY,GAAG;EACtD,MAAM,qBAAqB;EAG3B,OAFoB,uBAAuB,KAAK,EAAE,SAE3C;CACT,OAAO,IAAI,OAAO,YAAY,MAAM,aAAa,YAAY,GAAG;EAC9D,MAAM,sBAAsB;EAC5B,OAAO,WAAW,MAAM,SAAS,GAAG,MAAM;CAC5C;AACF;AAEA,SAAgB,yBACd,UACA,WACA,qBACuB;CACvB,MAAM,+BAA+B;CAErC,IAAI,YAAY,QAAQ,GAAG;EACzB,MAAM,WAAW;EACjB,MAAM,cAAc,oBAAoB,qBAAqB,SAAS;EACtE,IAAI,CAAC,aAAa;GAChB,MAAM,iCAAiC;GACvC;EACF;EAEA,MAAM,oBAAoB,kBAAkB,WAAW;EACvD,IAAI,CAAC,mBAAmB;GACtB,MAAM,+CAA+C;GACrD;EACF;EAEA,OAAO;CACT;CACA,MAAM,EAAE,QAAQ,UAAU,qBAAqB,mBAAmB;CAElE,MAAM,QAAQ;CACd,IAAI,OAAO,UAAU,YAAY,OAAO,YAAY,MAAM,aAAa,YAAY,GACjF,OAAO,iBAAiB,OAAO,WAAW,QAAQ;AAEtD;AAEA,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;CAEjC,OAAO,MAAM,MAAM,MAAM,SAAS,MAAM,GAAG,KAAK,WAAW;AAC7D;AAEA,eAAsB,YACpB,MACA,QACA,YACA,aACA,UAAiC,CAAC,GACV;CACxB,MAAM,eAAe;CACrB,MAAM,EAAE,aAAa;CACrB,MAAM,YAAwB,QAAQ,WAClC;EAAE,GAAG;EAAY,OAAO,EAAE,KAAK,QAAQ,SAAS;CAAE,IAClD;CAEJ,IAAI,YAAY,QAAQ,GAAG;EACzB,MAAM,yBAAyB;EAE/B,OAAO,MAAM,IAAI,SAAS,YAAkB;GAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;EAC9F,CAAC;CACH;CACA,MAAM,EAAE,QAAQ,SAAS;CAEzB,IAAI,KAAK,MACP,OAAO,MAAM,KAAK,WAAW,WAAW,IAAI,IAAI;CAElD,OAAO,MAAM,IAAI,SAAS,YAAkB;EAC1C,QAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,aAAa,QAAQ,QAAQ,CAAC,CAAC;CAC9F,CAAC;AACH;AAEA,IAAa,gBAA0B,CAAC,qBAAqB,mBAAmB;AAEhF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;CAC9F,IAAI;EAOF,OAN4B,cAC1B,OACA,QACA,UAAU,KAAK,KAAK,MAGf;CACT,SAAS,OAAY;EAEnB,IAAI,cAAc,SAAS,MAAM,IAAI,GAInC,OAAO,0BAA0B;EAEnC,MAAM,WAAW,QAAQ,YAAY,cAAc,MAAM,OAAO;CAClE;AACF;AAEA,SAAgB,kBAAkB,eAAgC;CAChE,OAAO,cAAc,MAAM,GAAG,EAAE,WAAW;AAC7C;;;;;;AAOA,SAAgB,wBAAwB,QAA0C;CAChF,OAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;GACjF,MAAM,uCAAuC;GAC7C,GAAG,WAAW,aAAa,UAAU,qBAAqB,CAAC;EAC7D;EAEA,QAAQ,OAAe,WAAmB,IAAwC;GAChF,MAAM,kCAAkC;GAGxC,GAAG,MAAM,IAAI;EACf;EAGA,cAAc,aAAa,UAAU,MAAM;EAE3C,eAAe,aAAa,WAAW,MAAM;EAC7C,iBAAiB,uBAAuB,MAAM;CAChD;AACF;AAEA,SAAgB,aAAa,QAAwB,QAA6B;CAChF,OAAO,SAAS,oBACd,MACA,KACA,UACM;EACN,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,sCAAsC;EAC1E,MAAM,EAAE,MAAM,WAAW;EACzB,MAAM,kCAAgC,QAAQ,MAAM;EACpD,MAAM,cAAc,IAAI;EACxB,MAAM,uCAAqC,QAAQ,WAAW;EAC9D,MAAM,gBAAgB,YAAY,MAAM,UAAU;GAChD,OAAO,SAAS,SAAS,OAAO,SAAS,KAAK;EAChD,CAAC;EACD,MAAM,wCAAoC,MAAM,aAAa;EAC7D,OAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;EAAY,GACnE,+FACF;EAEA,IAAI,eAAe;GACjB,OAAO,MAAM,EAAE,QAAQ,KAAK,KAAK,GAAG,iDAAiD;GACrF,OAAO,SAAS,MAAM,IAAI;EAC5B;EAEA,IAAI,MACF,SACE,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,MAAM,CACxF;OAEA,SACE,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,MAAM,CACtF;CAEJ;AACF;;;;AAKA,SAAgB,uBAAuB,QAAqB;CAC1D,OAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;EACzC,MAAM,oCAAoC,kBAAkB;EAC5D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;EAC3F,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;EAAU,GAC7C,qEACF;EAEA,IAAI,sBAAsB,cAAc,OACtC,OAAO,SAAS,MAAM,KAAA,CAAS;EAGjC,OAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;EAAU,GACrD,6EACF;EACA,OAAO,aAAa,QAAQ,MAAM,EAAE,MAAM,KAAK,QAAQ;CACzD;AACF;AAEA,SAAgB,UAAU,MAAc,UAAkB,UAA2B;CACnF,IAAI,UACF,OAAO,KAAK,UAAU;EAAE,MAAM;EAAM;EAAU;CAAS,CAAC;CAG1D,OAAO,OAAO,GAAG,KAAK,GAAG,UAAU;AACrC;AAEA,SAAgB,uBAAuB,SAAyB;CAC9D,OAAO,OAAO,KAAK,SAAS,QAAQ;AACtC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "9.0.0-next-9.17",
+  "version": "9.0.0-next-9.18",
   "description": "Verdaccio Authentication",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -33,23 +33,23 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/config": "9.0.0-next-9.17",
-    "@verdaccio/core": "9.0.0-next-9.17",
-    "@verdaccio/loaders": "9.0.0-next-9.17",
-    "@verdaccio/signature": "9.0.0-next-9.17",
+    "@verdaccio/config": "9.0.0-next-9.18",
+    "@verdaccio/core": "9.0.0-next-9.18",
+    "@verdaccio/loaders": "9.0.0-next-9.18",
+    "@verdaccio/signature": "9.0.0-next-9.18",
     "debug": "4.4.3",
     "lodash-es": "4.18.1",
-    "verdaccio-htpasswd": "14.0.0-next-9.17"
+    "verdaccio-htpasswd": "14.0.0-next-9.18"
   },
   "devDependencies": {
-    "@verdaccio/middleware": "9.0.0-next-9.17",
-    "@verdaccio/types": "14.0.0-next-9.8",
-    "@verdaccio/logger": "9.0.0-next-9.17",
-    "verdaccio-htpasswd": "14.0.0-next-9.17",
     "@types/lodash-es": "4.17.12",
+    "@verdaccio/logger": "9.0.0-next-9.18",
+    "@verdaccio/middleware": "9.0.0-next-9.18",
+    "@verdaccio/types": "14.0.0-next-9.9",
     "express": "5.2.1",
     "supertest": "7.1.4",
-    "vitest": "4.1.0"
+    "verdaccio-htpasswd": "14.0.0-next-9.18",
+    "vitest": "4.1.7"
   },
   "funding": {
     "type": "opencollective",