@verdaccio/auth 9.0.0-next-9.3 → 9.0.0-next-9.4

package/build/auth.js

@@ -1,670 +1,423 @@
-"use strict";
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+const require_utils = require("./utils.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let lodash = require("lodash");
+lodash = require_runtime.__toESM(lodash);
+let verdaccio_htpasswd = require("verdaccio-htpasswd");
+let _verdaccio_config = require("@verdaccio/config");
+let _verdaccio_core = require("@verdaccio/core");
+let _verdaccio_loaders = require("@verdaccio/loaders");
+let _verdaccio_signature = require("@verdaccio/signature");
+//#region src/auth.ts
+var debug$1 = (0, debug.default)("verdaccio:auth");
+var Auth = class {
+	config;
+	secret;
+	logger;
+	plugins;
+	options;
+	constructor(config, logger, options = { legacyMergeConfigs: false }) {
+		this.config = config;
+		this.secret = config.secret;
+		this.logger = logger;
+		this.plugins = [];
+		this.options = options;
+		if (!this.secret) throw new TypeError("secret it is required value on initialize the auth class");
+	}
+	async init() {
+		let plugins = await this.loadPlugin();
+		debug$1("auth plugins found %s", plugins.length);
+		if (this.config.auth !== null && (!plugins || plugins.length === 0)) plugins = this.loadDefaultPlugin();
+		this.plugins = plugins;
+		this.applyFallbackPluginMethods();
+	}
+	loadDefaultPlugin() {
+		debug$1("load default auth plugin");
+		let authPlugin;
+		try {
+			authPlugin = new verdaccio_htpasswd.HTPasswd({ file: "./htpasswd" }, {
+				config: this.config,
+				logger: this.logger
+			});
+			this.logger.info({
+				name: "verdaccio-htpasswd",
+				pluginCategory: _verdaccio_core.PLUGIN_CATEGORY.AUTHENTICATION
+			}, "plugin @{name} successfully loaded (@{pluginCategory})");
+		} catch (error) {
+			debug$1("error on loading auth htpasswd plugin stack: %o", error);
+			this.logger.info({}, "no auth plugin has been found");
+			return [];
+		}
+		return [authPlugin];
+	}
+	async loadPlugin() {
+		return (0, _verdaccio_loaders.asyncLoadPlugin)(this.config.auth, {
+			config: this.config,
+			logger: this.logger
+		}, (plugin) => {
+			const { authenticate, allow_access, allow_publish } = plugin;
+			return typeof authenticate !== "undefined" || typeof allow_access !== "undefined" || typeof allow_publish !== "undefined";
+		}, this.options.legacyMergeConfigs, this.config?.server?.pluginPrefix ?? _verdaccio_core.PLUGIN_PREFIX, _verdaccio_core.PLUGIN_CATEGORY.AUTHENTICATION);
+	}
+	applyFallbackPluginMethods() {
+		this.plugins.push(require_utils.getDefaultPluginMethods(this.logger));
+	}
+	changePassword(username, password, newPassword, cb) {
+		const validPlugins = lodash.default.filter(this.plugins, (plugin) => lodash.default.isFunction(plugin.changePassword));
+		if (lodash.default.isEmpty(validPlugins)) return cb(_verdaccio_core.errorUtils.getInternalError(_verdaccio_core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+		for (const plugin of validPlugins) if (lodash.default.isNil(plugin) || lodash.default.isFunction(plugin.changePassword) === false) {
+			debug$1("auth plugin does not implement changePassword, trying next one");
+			continue;
+		} else {
+			debug$1("updating password for %o", username);
+			plugin.changePassword(username, password, newPassword, (err, profile) => {
+				if (err) {
+					this.logger.error({
+						username,
+						err
+					}, `An error has been produced
+            updating the password for @{username}. Error: @{err.message}`);
+					return cb(err);
+				}
+				debug$1("updated password for %o was successful", username);
+				return cb(null, profile);
+			});
+		}
+	}
+	async invalidateToken(token) {
+		console.log("invalidate token pending to implement", token);
+		return Promise.resolve();
+	}
+	authenticate(username, password, cb) {
+		const plugins = this.plugins.slice(0);
+		(function next() {
+			const plugin = plugins.shift();
+			if (typeof plugin?.authenticate !== "function") return next();
+			debug$1("authenticating %o", username);
+			plugin.authenticate(username, password, function(err, groups) {
+				if (err) {
+					debug$1("authenticating for user %o failed. Error: %o", username, err?.message);
+					return cb(err);
+				}
+				if (!!groups && groups.length !== 0) {
+					if (lodash.default.isString(groups)) throw new TypeError("plugin group error: invalid type for function");
+					if (!lodash.default.isArray(groups)) throw new TypeError(_verdaccio_core.API_ERROR.BAD_FORMAT_USER_GROUP);
+					debug$1("authentication for user %o was successfully. Groups: %o", username, groups);
+					return cb(err, (0, _verdaccio_config.createRemoteUser)(username, groups));
+				}
+				next();
+			});
+		})();
+	}
+	add_user(user, password, cb) {
+		const self = this;
+		const plugins = this.plugins.slice(0);
+		debug$1("add user %o", user);
+		(function next() {
+			let method = "adduser";
+			const plugin = plugins.shift();
+			if (typeof plugin.adduser === "undefined" && typeof plugin.add_user === "function") {
+				method = "add_user";
+				_verdaccio_core.warningUtils.emit(_verdaccio_core.warningUtils.Codes.VERWAR006);
+			}
+			if (typeof plugin[method] !== "function") next();
+			else plugin[method](user, password, function(err, ok) {
+				if (err) {
+					debug$1("the user %o could not be added. Error: %o", user, err?.message);
+					return cb(err);
+				}
+				if (ok) {
+					debug$1("the user %o has been added", user);
+					return self.authenticate(user, password, cb);
+				}
+				debug$1("user could not be added, skip to next auth plugin");
+				next();
+			});
+		})();
+	}
+	/**
+	* Allow user to access a package.
+	*/
+	allow_access({ packageName, packageVersion }, user, callback) {
+		const plugins = this.plugins.slice(0);
+		const pkg = Object.assign({
+			name: packageName,
+			version: packageVersion
+		}, _verdaccio_core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
+		debug$1("check access permissions for user %o to package %o", user.name, packageName);
+		const next = () => {
+			const plugin = plugins.shift();
+			if (typeof plugin?.allow_access !== "function") {
+				debug$1("plugin does not implement allow_access");
+				return next();
+			}
+			plugin.allow_access(user, pkg, (err, ok) => {
+				if (err) {
+					debug$1("forbidden access. Error: %o", err);
+					return callback(err);
+				}
+				if (ok) {
+					debug$1("access was granted");
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `access was granted for @{name} by @{user}`);
+					return callback(null, ok);
+				}
+				debug$1("access was denied. Rolling to next plugin");
+				this.logger.trace({
+					user: user.name,
+					name: pkg.name
+				}, `intermediate access denial for @{name} by @{user}, rolling to next plugin`);
+				return next();
+			});
+		};
+		return next();
+	}
+	allow_unpublish({ packageName, packageVersion }, user, callback) {
+		const plugins = this.plugins.slice(0);
+		const pkg = Object.assign({
+			name: packageName,
+			version: packageVersion
+		}, _verdaccio_core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
+		debug$1("check unpublish permissions for user %o to package %o", user.name, packageName);
+		const next = () => {
+			const plugin = plugins.shift();
+			if (typeof plugin?.allow_unpublish !== "function") {
+				debug$1("plugin does not implement allow_unpublish");
+				return next();
+			}
+			plugin.allow_unpublish(user, pkg, (err, ok) => {
+				if (err) {
+					debug$1("forbidden unpublish. Error: %o", err);
+					return callback(err);
+				}
+				if (lodash.default.isNil(ok) === true) {
+					debug$1("bypass unpublish for %o, publish will handle the access", packageName);
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `bypass unpublish for @{name} by @{user}, publish will handle the access`);
+					return this.allow_publish({
+						packageName,
+						packageVersion
+					}, user, callback);
+				}
+				if (ok) {
+					debug$1("unpublish was granted");
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `unpublish was granted for @{name} by @{user}`);
+					return callback(null, ok);
+				}
+				debug$1("unpublish was denied. Rolling to next plugin");
+				this.logger.trace({
+					user: user.name,
+					name: pkg.name
+				}, `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`);
+				return next();
+			});
+		};
+		return next();
+	}
+	/**
+	* Allow user to publish a package.
+	*/
+	allow_publish({ packageName, packageVersion }, user, callback) {
+		const plugins = this.plugins.slice(0);
+		const pkg = Object.assign({
+			name: packageName,
+			version: packageVersion
+		}, _verdaccio_core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
+		debug$1("check publish permissions for user %o to package %o", user.name, packageName);
+		const next = () => {
+			const plugin = plugins.shift();
+			if (typeof plugin?.allow_publish !== "function") {
+				debug$1("plugin does not implement allow_publish");
+				return next();
+			}
+			plugin.allow_publish(user, pkg, (err, ok) => {
+				if (err) {
+					debug$1("forbidden publish. Error: %o", err);
+					return callback(err);
+				}
+				if (ok) {
+					debug$1("publish was granted");
+					this.logger.trace({
+						user: user.name,
+						name: pkg.name
+					}, `publish was granted for @{name} by @{user}`);
+					return callback(null, ok);
+				}
+				debug$1("publish was denied. Rolling to next plugin");
+				this.logger.trace({
+					user: user.name,
+					name: pkg.name
+				}, `intermediate publish denial for @{name} by @{user}, rolling to next plugin`);
+				return next();
+			});
+		};
+		return next();
+	}
+	apiJWTmiddleware() {
+		debug$1("jwt middleware");
+		const plugins = this.plugins.slice(0);
+		const helpers = {
+			createAnonymousRemoteUser: _verdaccio_config.createAnonymousRemoteUser,
+			createRemoteUser: _verdaccio_config.createRemoteUser
+		};
+		for (const plugin of plugins) if (plugin.apiJWTmiddleware) return plugin.apiJWTmiddleware(helpers);
+		return (req, res, _next) => {
+			req.pause();
+			const next = function(err) {
+				req.resume();
+				if (err) req.remote_user.error = err.message;
+				return _next();
+			};
+			const remoteUser = (0, _verdaccio_config.createAnonymousRemoteUser)();
+			req.remote_user = remoteUser;
+			res.locals.remote_user = remoteUser;
+			const { authorization } = req.headers;
+			if (lodash.default.isNil(authorization)) {
+				debug$1("jwt, authentication header is missing");
+				return next();
+			}
+			if (!require_utils.isAuthHeaderValid(authorization)) {
+				debug$1("api middleware authentication heather is invalid");
+				return next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.BAD_AUTH_HEADER));
+			}
+			const { secret, security } = this.config;
+			if (require_utils.isAESLegacy(security)) {
+				debug$1("api middleware using legacy auth token");
+				this.handleAESMiddleware(req, security, secret, authorization, next);
+			} else {
+				debug$1("api middleware using JWT auth token");
+				this.handleJWTAPIMiddleware(req, security, secret, authorization, next);
+			}
+		};
+	}
+	handleJWTAPIMiddleware(req, security, secret, authorization, next) {
+		debug$1("handle JWT api middleware");
+		const { scheme, token } = require_utils.parseAuthTokenHeader(authorization);
+		if (scheme.toUpperCase() === _verdaccio_core.TOKEN_BASIC.toUpperCase()) {
+			debug$1("handle basic token");
+			const parsedCredentials = (0, _verdaccio_signature.parseBasicPayload)(require_utils.convertPayloadToBase64(token).toString());
+			if (!parsedCredentials) {
+				debug$1("invalid basic credentials format (missing colon separator)");
+				next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.BAD_USERNAME_PASSWORD));
+				return;
+			}
+			const { user, password } = parsedCredentials;
+			debug$1("authenticating %o", user);
+			this.authenticate(user, password, (err, user) => {
+				if (!err) {
+					debug$1("generating a remote user");
+					req.remote_user = user;
+					next();
+				} else {
+					debug$1("generating anonymous user");
+					req.remote_user = (0, _verdaccio_config.createAnonymousRemoteUser)();
+					next(err);
+				}
+			});
+		} else {
+			debug$1("handle jwt token");
+			const credentials = require_utils.getMiddlewareCredentials(security, secret, authorization);
+			if (credentials) {
+				req.remote_user = credentials;
+				debug$1("generating a remote user");
+				next();
+			} else {
+				debug$1("jwt invalid token");
+				next(_verdaccio_core.errorUtils.getForbidden(_verdaccio_core.API_ERROR.BAD_USERNAME_PASSWORD));
+			}
+		}
+	}
+	handleAESMiddleware(req, security, secret, authorization, next) {
+		debug$1("handle legacy api middleware");
+		debug$1("api middleware has a secret? %o", typeof secret === "string");
+		debug$1("api middleware authorization %o", typeof authorization === "string");
+		const credentials = require_utils.getMiddlewareCredentials(security, secret, authorization);
+		debug$1("api middleware credentials %o", credentials?.name);
+		if (credentials) {
+			const { user, password } = credentials;
+			debug$1("authenticating %o", user);
+			this.authenticate(user, password, (err, user) => {
+				if (!err) {
+					req.remote_user = user;
+					debug$1("generating a remote user");
+					next();
+				} else {
+					req.remote_user = (0, _verdaccio_config.createAnonymousRemoteUser)();
+					debug$1("generating anonymous user");
+					next(err);
+				}
+			});
+		} else {
+			debug$1("legacy invalid header");
+			return next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.BAD_AUTH_HEADER));
+		}
+	}
+	_isRemoteUserValid(remote_user) {
+		return lodash.default.isUndefined(remote_user) === false && lodash.default.isUndefined(remote_user?.name) === false;
+	}
+	/**
+	* JWT middleware for WebUI
+	*/
+	webUIJWTmiddleware() {
+		return (req, res, _next) => {
+			if (this._isRemoteUserValid(req.remote_user)) return _next();
+			req.pause();
+			const next = (err) => {
+				req.resume();
+				if (err) {
+					req.remote_user.error = err.message;
+					res.status(err.statusCode).send(err.message);
+				}
+				return _next();
+			};
+			const { authorization } = req.headers;
+			if (lodash.default.isNil(authorization)) return next();
+			if (!require_utils.isAuthHeaderValid(authorization)) return next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.BAD_AUTH_HEADER));
+			const token = (authorization || "").replace(`${_verdaccio_core.TOKEN_BEARER} `, "");
+			if (!token) return next();
+			let credentials;
+			try {
+				credentials = require_utils.verifyJWTPayload(token, this.config.secret, this.config.security);
+			} catch {}
+			if (this._isRemoteUserValid(credentials)) {
+				const { name, groups } = credentials;
+				req.remote_user = (0, _verdaccio_config.createRemoteUser)(name, groups);
+			} else req.remote_user = (0, _verdaccio_config.createAnonymousRemoteUser)();
+			next();
+		};
+	}
+	async jwtEncrypt(user, signOptions) {
+		const { real_groups, name, groups } = user;
+		debug$1("jwt encrypt %o", name);
+		const realGroupsValidated = lodash.default.isNil(real_groups) ? [] : real_groups;
+		return await (0, _verdaccio_signature.signPayload)({
+			real_groups: realGroupsValidated,
+			name,
+			groups: lodash.default.isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
+		}, this.secret, signOptions);
+	}
+	/**
+	* Encrypt a string.
+	*/
+	aesEncrypt(value) {
+		if (this.secret.length === _verdaccio_config.TOKEN_VALID_LENGTH) {
+			debug$1("signing with enhanced aes legacy");
+			return (0, _verdaccio_signature.aesEncrypt)(value, this.secret);
+		} else {
+			debug$1("signing with enhanced aes deprecated legacy");
+			return (0, _verdaccio_signature.aesEncryptDeprecated)(Buffer.from(value), this.secret).toString("base64");
+		}
+	}
+};
+//#endregion
+exports.Auth = Auth;
 
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.Auth = void 0;
-var _debug = _interopRequireDefault(require("debug"));
-var _lodash = _interopRequireDefault(require("lodash"));
-var _verdaccioHtpasswd = require("verdaccio-htpasswd");
-var _config = require("@verdaccio/config");
-var _core = require("@verdaccio/core");
-var _loaders = require("@verdaccio/loaders");
-var _signature = require("@verdaccio/signature");
-var _utils = require("./utils");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
-function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
-function _toConsumableArray(r) { return _arrayWithoutHoles(r) || _iterableToArray(r) || _unsupportedIterableToArray(r) || _nonIterableSpread(); }
-function _nonIterableSpread() { throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
-function _iterableToArray(r) { if ("undefined" != typeof Symbol && null != r[Symbol.iterator] || null != r["@@iterator"]) return Array.from(r); }
-function _arrayWithoutHoles(r) { if (Array.isArray(r)) return _arrayLikeToArray(r); }
-function _createForOfIteratorHelper(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
-function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
-function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
-function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
-function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
-function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
-function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
-function _classCallCheck(a, n) { if (!(a instanceof n)) throw new TypeError("Cannot call a class as a function"); }
-function _defineProperties(e, r) { for (var t = 0; t < r.length; t++) { var o = r[t]; o.enumerable = o.enumerable || !1, o.configurable = !0, "value" in o && (o.writable = !0), Object.defineProperty(e, _toPropertyKey(o.key), o); } }
-function _createClass(e, r, t) { return r && _defineProperties(e.prototype, r), t && _defineProperties(e, t), Object.defineProperty(e, "prototype", { writable: !1 }), e; }
-function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : i + ""; }
-function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
-var debug = (0, _debug["default"])('verdaccio:auth');
-var Auth = exports.Auth = /*#__PURE__*/function () {
-  function Auth(config, logger) {
-    var options = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {
-      legacyMergeConfigs: false
-    };
-    _classCallCheck(this, Auth);
-    this.config = config;
-    this.secret = config.secret;
-    this.logger = logger;
-    this.plugins = [];
-    this.options = options;
-    if (!this.secret) {
-      throw new TypeError('secret it is required value on initialize the auth class');
-    }
-  }
-  return _createClass(Auth, [{
-    key: "init",
-    value: function () {
-      var _init = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee() {
-        var plugins;
-        return _regenerator().w(function (_context) {
-          while (1) switch (_context.n) {
-            case 0:
-              _context.n = 1;
-              return this.loadPlugin();
-            case 1:
-              plugins = _context.v;
-              debug('auth plugins found %s', plugins.length);
-              // Missing auth config or no loaded plugins -> load default htpasswd plugin
-              // Empty auth config (null) -> just use fallback methods
-              if (this.config.auth !== null && (!plugins || plugins.length === 0)) {
-                plugins = this.loadDefaultPlugin();
-              }
-              this.plugins = plugins;
-              this.applyFallbackPluginMethods();
-            case 2:
-              return _context.a(2);
-          }
-        }, _callee, this);
-      }));
-      function init() {
-        return _init.apply(this, arguments);
-      }
-      return init;
-    }()
-  }, {
-    key: "loadDefaultPlugin",
-    value: function loadDefaultPlugin() {
-      debug('load default auth plugin');
-      var authPlugin;
-      try {
-        authPlugin = new _verdaccioHtpasswd.HTPasswd({
-          file: './htpasswd'
-        }, {
-          config: this.config,
-          logger: this.logger
-        });
-        this.logger.info({
-          name: 'verdaccio-htpasswd',
-          pluginCategory: _core.PLUGIN_CATEGORY.AUTHENTICATION
-        }, 'plugin @{name} successfully loaded (@{pluginCategory})');
-      } catch (error) {
-        debug('error on loading auth htpasswd plugin stack: %o', error);
-        this.logger.info({}, 'no auth plugin has been found');
-        return [];
-      }
-      return [authPlugin];
-    }
-  }, {
-    key: "loadPlugin",
-    value: function () {
-      var _loadPlugin = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2() {
-        var _this$config$server$p, _this$config;
-        return _regenerator().w(function (_context2) {
-          while (1) switch (_context2.n) {
-            case 0:
-              return _context2.a(2, (0, _loaders.asyncLoadPlugin)(this.config.auth, {
-                config: this.config,
-                logger: this.logger
-              }, function (plugin) {
-                var authenticate = plugin.authenticate,
-                  allow_access = plugin.allow_access,
-                  allow_publish = plugin.allow_publish;
-                return typeof authenticate !== 'undefined' || typeof allow_access !== 'undefined' || typeof allow_publish !== 'undefined';
-              }, this.options.legacyMergeConfigs, (_this$config$server$p = (_this$config = this.config) === null || _this$config === void 0 || (_this$config = _this$config.server) === null || _this$config === void 0 ? void 0 : _this$config.pluginPrefix) !== null && _this$config$server$p !== void 0 ? _this$config$server$p : _core.PLUGIN_PREFIX, _core.PLUGIN_CATEGORY.AUTHENTICATION));
-          }
-        }, _callee2, this);
-      }));
-      function loadPlugin() {
-        return _loadPlugin.apply(this, arguments);
-      }
-      return loadPlugin;
-    }()
-  }, {
-    key: "applyFallbackPluginMethods",
-    value: function applyFallbackPluginMethods() {
-      this.plugins.push((0, _utils.getDefaultPluginMethods)(this.logger));
-    }
-  }, {
-    key: "changePassword",
-    value: function changePassword(username, password, newPassword, cb) {
-      var _this = this;
-      var validPlugins = _lodash["default"].filter(this.plugins, function (plugin) {
-        return _lodash["default"].isFunction(plugin.changePassword);
-      });
-      if (_lodash["default"].isEmpty(validPlugins)) {
-        return cb(_core.errorUtils.getInternalError(_core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
-      }
-      var _iterator = _createForOfIteratorHelper(validPlugins),
-        _step;
-      try {
-        for (_iterator.s(); !(_step = _iterator.n()).done;) {
-          var plugin = _step.value;
-          if (_lodash["default"].isNil(plugin) || _lodash["default"].isFunction(plugin.changePassword) === false) {
-            debug('auth plugin does not implement changePassword, trying next one');
-            continue;
-          } else {
-            debug('updating password for %o', username);
-            plugin.changePassword(username, password, newPassword, function (err, profile) {
-              if (err) {
-                _this.logger.error({
-                  username: username,
-                  err: err
-                }, "An error has been produced\n            updating the password for @{username}. Error: @{err.message}");
-                return cb(err);
-              }
-              debug('updated password for %o was successful', username);
-              return cb(null, profile);
-            });
-          }
-        }
-      } catch (err) {
-        _iterator.e(err);
-      } finally {
-        _iterator.f();
-      }
-    }
-  }, {
-    key: "invalidateToken",
-    value: function () {
-      var _invalidateToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee3(token) {
-        return _regenerator().w(function (_context3) {
-          while (1) switch (_context3.n) {
-            case 0:
-              // eslint-disable-next-line no-console
-              console.log('invalidate token pending to implement', token);
-              return _context3.a(2, Promise.resolve());
-          }
-        }, _callee3);
-      }));
-      function invalidateToken(_x) {
-        return _invalidateToken.apply(this, arguments);
-      }
-      return invalidateToken;
-    }()
-  }, {
-    key: "authenticate",
-    value: function authenticate(username, password, cb) {
-      var plugins = this.plugins.slice(0);
-      (function next() {
-        var plugin = plugins.shift();
-        if (typeof (plugin === null || plugin === void 0 ? void 0 : plugin.authenticate) !== 'function') {
-          return next();
-        }
-        debug('authenticating %o', username);
-        plugin.authenticate(username, password, function (err, groups) {
-          if (err) {
-            debug('authenticating for user %o failed. Error: %o', username, err === null || err === void 0 ? void 0 : err.message);
-            return cb(err);
-          }
-
-          // Expect: SKIP if groups is falsey and not an array
-          //         with at least one item (truthy length)
-          // Expect: CONTINUE otherwise (will error if groups is not
-          //         an array, but this is current behavior)
-          // Caveat: STRING (if valid) will pass successfully
-          //         bug give unexpected results
-          // Info: Cannot use `== false to check falsey values`
-          if (!!groups && groups.length !== 0) {
-            // TODO: create a better understanding of expectations
-            if (_lodash["default"].isString(groups)) {
-              throw new TypeError('plugin group error: invalid type for function');
-            }
-            var isGroupValid = _lodash["default"].isArray(groups);
-            if (!isGroupValid) {
-              throw new TypeError(_core.API_ERROR.BAD_FORMAT_USER_GROUP);
-            }
-            debug('authentication for user %o was successfully. Groups: %o', username, groups);
-            return cb(err, (0, _config.createRemoteUser)(username, groups));
-          }
-          next();
-        });
-      })();
-    }
-  }, {
-    key: "add_user",
-    value: function add_user(user, password, cb) {
-      var self = this;
-      var plugins = this.plugins.slice(0);
-      debug('add user %o', user);
-      (function next() {
-        var method = 'adduser';
-        var plugin = plugins.shift();
-        // @ts-expect-error future major (7.x) should remove this section
-        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
-          method = 'add_user';
-          _core.warningUtils.emit(_core.warningUtils.Codes.VERWAR006);
-        }
-        // @ts-ignore
-        if (typeof plugin[method] !== 'function') {
-          next();
-        } else {
-          // TODO: replace by adduser whenever add_user deprecation method has been removed
-          // @ts-ignore
-          plugin[method](user, password, function (err, ok) {
-            if (err) {
-              debug('the user %o could not be added. Error: %o', user, err === null || err === void 0 ? void 0 : err.message);
-              return cb(err);
-            }
-            if (ok) {
-              debug('the user %o has been added', user);
-              return self.authenticate(user, password, cb);
-            }
-            debug('user could not be added, skip to next auth plugin');
-            next();
-          });
-        }
-      })();
-    }
-
-    /**
-     * Allow user to access a package.
-     */
-  }, {
-    key: "allow_access",
-    value: function allow_access(_ref, user, callback) {
-      var _this2 = this;
-      var packageName = _ref.packageName,
-        packageVersion = _ref.packageVersion;
-      var plugins = this.plugins.slice(0);
-      var pkg = Object.assign({
-        name: packageName,
-        version: packageVersion
-      }, _core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
-      debug('check access permissions for user %o to package %o', user.name, packageName);
-
-      // Use const instead of function declaration so we can use this.logger
-      var _next2 = function next() {
-        var plugin = plugins.shift();
-        if (typeof (plugin === null || plugin === void 0 ? void 0 : plugin.allow_access) !== 'function') {
-          debug('plugin does not implement allow_access');
-          return _next2();
-        }
-        plugin.allow_access(user, pkg, function (err, ok) {
-          if (err) {
-            debug('forbidden access. Error: %o', err);
-            return callback(err);
-          }
-          if (ok) {
-            debug('access was granted');
-            _this2.logger.trace({
-              user: user.name,
-              name: pkg.name
-            }, "access was granted for @{name} by @{user}");
-            return callback(null, ok);
-          }
-
-          // cb(null, false) causes next plugin to roll
-          debug('access was denied. Rolling to next plugin');
-          _this2.logger.trace({
-            user: user.name,
-            name: pkg.name
-          }, "intermediate access denial for @{name} by @{user}, rolling to next plugin");
-          return _next2();
-        });
-      };
-      return _next2();
-    }
-  }, {
-    key: "allow_unpublish",
-    value: function allow_unpublish(_ref2, user, callback) {
-      var _this3 = this;
-      var packageName = _ref2.packageName,
-        packageVersion = _ref2.packageVersion;
-      var plugins = this.plugins.slice(0);
-      var pkg = Object.assign({
-        name: packageName,
-        version: packageVersion
-      }, _core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
-      debug('check unpublish permissions for user %o to package %o', user.name, packageName);
-
-      // Use const instead of function declaration so we can use this.logger
-      var _next3 = function next() {
-        var plugin = plugins.shift();
-        if (typeof (plugin === null || plugin === void 0 ? void 0 : plugin.allow_unpublish) !== 'function') {
-          debug('plugin does not implement allow_unpublish');
-          return _next3();
-        }
-        plugin.allow_unpublish(user, pkg, function (err, ok) {
-          if (err) {
-            debug('forbidden unpublish. Error: %o', err);
-            return callback(err);
-          }
-
-          // The following is different from the allow_access and allow_publish implementations:
-          // If the packages config is missing an entry for "unpublish", the built-in default method
-          // (or a plugin) will return undefined, which will trigger the allow_publish fallback.
-          // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))
-          if (_lodash["default"].isNil(ok) === true) {
-            debug('bypass unpublish for %o, publish will handle the access', packageName);
-            _this3.logger.trace({
-              user: user.name,
-              name: pkg.name
-            }, "bypass unpublish for @{name} by @{user}, publish will handle the access");
-            return _this3.allow_publish({
-              packageName: packageName,
-              packageVersion: packageVersion
-            }, user, callback);
-          }
-          if (ok) {
-            debug('unpublish was granted');
-            _this3.logger.trace({
-              user: user.name,
-              name: pkg.name
-            }, "unpublish was granted for @{name} by @{user}");
-            return callback(null, ok);
-          }
-
-          // cb(null, false) causes next plugin to roll
-          debug('unpublish was denied. Rolling to next plugin');
-          _this3.logger.trace({
-            user: user.name,
-            name: pkg.name
-          }, "intermediate unpublish denial for @{name} by @{user}, rolling to next plugin");
-          return _next3();
-        });
-      };
-      return _next3();
-    }
-
-    /**
-     * Allow user to publish a package.
-     */
-  }, {
-    key: "allow_publish",
-    value: function allow_publish(_ref3, user, callback) {
-      var _this4 = this;
-      var packageName = _ref3.packageName,
-        packageVersion = _ref3.packageVersion;
-      var plugins = this.plugins.slice(0);
-      var pkg = Object.assign({
-        name: packageName,
-        version: packageVersion
-      }, _core.authUtils.getMatchedPackagesSpec(packageName, this.config.packages));
-      debug('check publish permissions for user %o to package %o', user.name, packageName);
-
-      // Use const instead of function declaration so we can use this.logger
-      var _next4 = function next() {
-        var plugin = plugins.shift();
-        if (typeof (plugin === null || plugin === void 0 ? void 0 : plugin.allow_publish) !== 'function') {
-          debug('plugin does not implement allow_publish');
-          return _next4();
-        }
-        plugin.allow_publish(user, pkg, function (err, ok) {
-          if (err) {
-            debug('forbidden publish. Error: %o', err);
-            return callback(err);
-          }
-          if (ok) {
-            debug('publish was granted');
-            _this4.logger.trace({
-              user: user.name,
-              name: pkg.name
-            }, "publish was granted for @{name} by @{user}");
-            return callback(null, ok);
-          }
-
-          // cb(null, false) causes next plugin to roll
-          debug('publish was denied. Rolling to next plugin');
-          _this4.logger.trace({
-            user: user.name,
-            name: pkg.name
-          }, "intermediate publish denial for @{name} by @{user}, rolling to next plugin");
-          return _next4();
-        });
-      };
-      return _next4();
-    }
-  }, {
-    key: "apiJWTmiddleware",
-    value: function apiJWTmiddleware() {
-      var _this5 = this;
-      debug('jwt middleware');
-      var plugins = this.plugins.slice(0);
-      var helpers = {
-        createAnonymousRemoteUser: _config.createAnonymousRemoteUser,
-        createRemoteUser: _config.createRemoteUser
-      };
-      var _iterator2 = _createForOfIteratorHelper(plugins),
-        _step2;
-      try {
-        for (_iterator2.s(); !(_step2 = _iterator2.n()).done;) {
-          var plugin = _step2.value;
-          if (plugin.apiJWTmiddleware) {
-            return plugin.apiJWTmiddleware(helpers);
-          }
-        }
-      } catch (err) {
-        _iterator2.e(err);
-      } finally {
-        _iterator2.f();
-      }
-      return function (req, res, _next) {
-        req.pause();
-        var next = function next(err) {
-          req.resume();
-          // uncomment this to reject users with bad auth headers
-          // return _next.apply(null, arguments)
-          // swallow error, user remains unauthorized
-          // set remoteUserError to indicate that user was attempting authentication
-          if (err) {
-            req.remote_user.error = err.message;
-          }
-          return _next();
-        };
-
-        // FUTURE: disabled, not removed yet but seems unreacable code
-        // if (this._isRemoteUserValid(req.remote_user)) {
-        //   debug('jwt has a valid authentication header');
-        //   return next();
-        // }
-
-        // in case auth header does not exist we return anonymous function
-        var remoteUser = (0, _config.createAnonymousRemoteUser)();
-        req.remote_user = remoteUser;
-        res.locals.remote_user = remoteUser;
-        var authorization = req.headers.authorization;
-        if (_lodash["default"].isNil(authorization)) {
-          debug('jwt, authentication header is missing');
-          return next();
-        }
-        if (!(0, _utils.isAuthHeaderValid)(authorization)) {
-          debug('api middleware authentication heather is invalid');
-          return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
-        }
-        var _this5$config = _this5.config,
-          secret = _this5$config.secret,
-          security = _this5$config.security;
-        if ((0, _utils.isAESLegacy)(security)) {
-          debug('api middleware using legacy auth token');
-          _this5.handleAESMiddleware(req, security, secret, authorization, next);
-        } else {
-          debug('api middleware using JWT auth token');
-          _this5.handleJWTAPIMiddleware(req, security, secret, authorization, next);
-        }
-      };
-    }
-  }, {
-    key: "handleJWTAPIMiddleware",
-    value: function handleJWTAPIMiddleware(req, security, secret, authorization, next) {
-      debug('handle JWT api middleware');
-      var _parseAuthTokenHeader = (0, _utils.parseAuthTokenHeader)(authorization),
-        scheme = _parseAuthTokenHeader.scheme,
-        token = _parseAuthTokenHeader.token;
-      if (scheme.toUpperCase() === _core.TOKEN_BASIC.toUpperCase()) {
-        debug('handle basic token');
-        // this should happen when client tries to login with an existing user
-        var credentials = (0, _utils.convertPayloadToBase64)(token).toString();
-        var parsedCredentials = (0, _signature.parseBasicPayload)(credentials);
-        if (!parsedCredentials) {
-          debug('invalid basic credentials format (missing colon separator)');
-          next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_USERNAME_PASSWORD));
-          return;
-        }
-        var _ref4 = parsedCredentials,
-          user = _ref4.user,
-          password = _ref4.password;
-        debug('authenticating %o', user);
-        this.authenticate(user, password, function (err, user) {
-          if (!err) {
-            debug('generating a remote user');
-            req.remote_user = user;
-            next();
-          } else {
-            debug('generating anonymous user');
-            req.remote_user = (0, _config.createAnonymousRemoteUser)();
-            next(err);
-          }
-        });
-      } else {
-        debug('handle jwt token');
-        var _credentials = (0, _utils.getMiddlewareCredentials)(security, secret, authorization);
-        if (_credentials) {
-          // if the signature is valid we rely on it
-          req.remote_user = _credentials;
-          debug('generating a remote user');
-          next();
-        } else {
-          // with JWT throw 401
-          debug('jwt invalid token');
-          next(_core.errorUtils.getForbidden(_core.API_ERROR.BAD_USERNAME_PASSWORD));
-        }
-      }
-    }
-  }, {
-    key: "handleAESMiddleware",
-    value: function handleAESMiddleware(req, security, secret, authorization, next) {
-      debug('handle legacy api middleware');
-      debug('api middleware has a secret? %o', typeof secret === 'string');
-      debug('api middleware authorization %o', typeof authorization === 'string');
-      var credentials = (0, _utils.getMiddlewareCredentials)(security, secret, authorization);
-      debug('api middleware credentials %o', credentials === null || credentials === void 0 ? void 0 : credentials.name);
-      if (credentials) {
-        var user = credentials.user,
-          password = credentials.password;
-        debug('authenticating %o', user);
-        this.authenticate(user, password, function (err, user) {
-          if (!err) {
-            req.remote_user = user;
-            debug('generating a remote user');
-            next();
-          } else {
-            req.remote_user = (0, _config.createAnonymousRemoteUser)();
-            debug('generating anonymous user');
-            next(err);
-          }
-        });
-      } else {
-        // we force npm client to ask again with basic authentication
-        debug('legacy invalid header');
-        return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
-      }
-    }
-  }, {
-    key: "_isRemoteUserValid",
-    value: function _isRemoteUserValid(remote_user) {
-      return _lodash["default"].isUndefined(remote_user) === false && _lodash["default"].isUndefined(remote_user === null || remote_user === void 0 ? void 0 : remote_user.name) === false;
-    }
-
-    /**
-     * JWT middleware for WebUI
-     */
-  }, {
-    key: "webUIJWTmiddleware",
-    value: function webUIJWTmiddleware() {
-      var _this6 = this;
-      return function (req, res, _next) {
-        if (_this6._isRemoteUserValid(req.remote_user)) {
-          return _next();
-        }
-        req.pause();
-        var next = function next(err) {
-          req.resume();
-          if (err) {
-            req.remote_user.error = err.message;
-            res.status(err.statusCode).send(err.message);
-          }
-          return _next();
-        };
-        var authorization = req.headers.authorization;
-        if (_lodash["default"].isNil(authorization)) {
-          return next();
-        }
-        if (!(0, _utils.isAuthHeaderValid)(authorization)) {
-          return next(_core.errorUtils.getBadRequest(_core.API_ERROR.BAD_AUTH_HEADER));
-        }
-        var token = (authorization || '').replace("".concat(_core.TOKEN_BEARER, " "), '');
-        if (!token) {
-          return next();
-        }
-        var credentials;
-        try {
-          credentials = (0, _utils.verifyJWTPayload)(token, _this6.config.secret, _this6.config.security);
-        } catch (_unused) {
-          // FIXME: intended behaviour, do we want it?
-        }
-        if (_this6._isRemoteUserValid(credentials)) {
-          var _ref5 = credentials,
-            name = _ref5.name,
-            groups = _ref5.groups;
-          req.remote_user = (0, _config.createRemoteUser)(name, groups);
-        } else {
-          req.remote_user = (0, _config.createAnonymousRemoteUser)();
-        }
-        next();
-      };
-    }
-  }, {
-    key: "jwtEncrypt",
-    value: function () {
-      var _jwtEncrypt = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee4(user, signOptions) {
-        var real_groups, name, groups, realGroupsValidated, groupedGroups, payload, token;
-        return _regenerator().w(function (_context4) {
-          while (1) switch (_context4.n) {
-            case 0:
-              real_groups = user.real_groups, name = user.name, groups = user.groups;
-              debug('jwt encrypt %o', name);
-              realGroupsValidated = _lodash["default"].isNil(real_groups) ? [] : real_groups;
-              groupedGroups = _lodash["default"].isNil(groups) ? real_groups : Array.from(new Set(_toConsumableArray(groups.concat(realGroupsValidated))));
-              payload = {
-                real_groups: realGroupsValidated,
-                name: name,
-                groups: groupedGroups
-              };
-              _context4.n = 1;
-              return (0, _signature.signPayload)(payload, this.secret, signOptions);
-            case 1:
-              token = _context4.v;
-              return _context4.a(2, token);
-          }
-        }, _callee4, this);
-      }));
-      function jwtEncrypt(_x2, _x3) {
-        return _jwtEncrypt.apply(this, arguments);
-      }
-      return jwtEncrypt;
-    }()
-    /**
-     * Encrypt a string.
-     */
-  }, {
-    key: "aesEncrypt",
-    value: function aesEncrypt(value) {
-      if (this.secret.length === _config.TOKEN_VALID_LENGTH) {
-        debug('signing with enhanced aes legacy');
-        var token = (0, _signature.aesEncrypt)(value, this.secret);
-        return token;
-      } else {
-        debug('signing with enhanced aes deprecated legacy');
-        // deprecated aes (legacy) signature, only must be used for legacy version
-        var _token = (0, _signature.aesEncryptDeprecated)(Buffer.from(value), this.secret).toString('base64');
-        return _token;
-      }
-    }
-  }]);
-}();
 //# sourceMappingURL=auth.js.map