@verdaccio/auth 9.0.0-next-9.3 → 9.0.0-next-9.4

package/build/auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n} from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      (plugin): boolean => {\n        const { authenticate, allow_access, allow_publish } = plugin;\n\n        return (\n          typeof authenticate !== 'undefined' ||\n          typeof allow_access !== 'undefined' ||\n          typeof allow_publish !== 'undefined'\n        );\n      },\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (_.isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    if (this.secret.length === TOKEN_VALID_LENGTH) {\n      debug('signing with enhanced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhanced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;AAqDA,IAAM,QAAQ,WAAW,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,QAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,QAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,SAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,SAAO,gBACL,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,GACA,WAAoB;GACnB,MAAM,EAAE,cAAc,cAAc,kBAAkB;AAEtD,UACE,OAAO,iBAAiB,eACxB,OAAO,iBAAiB,eACxB,OAAO,kBAAkB;KAG7B,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,eACrC,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,EAAE,OAAO,KAAK,UAAU,WAAW,EAAE,WAAW,OAAO,eAAe,CAAC;AAE5F,MAAI,EAAE,QAAQ,aAAa,CACzB,QAAO,GAAG,WAAW,iBAAiB,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,KAAI,EAAE,MAAM,OAAO,IAAI,EAAE,WAAW,OAAO,eAAe,KAAK,OAAO;AACpE,SAAM,iEAAiE;AACvE;SACK;AACL,SAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,UAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,SAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,WAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,EAAE,SAAS,OAAO,CACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,EAAE,QAAQ,OAAO,CAE7C,OAAM,IAAI,UAAU,UAAU,sBAAsB;AAGtD,WAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,KAAK,iBAAiB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,QAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,iBAAa,KAAK,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,WAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,WAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,UAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,UAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,WAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,UAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,WAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,QAAI,EAAE,MAAM,GAAG,KAAK,MAAM;AACxB,WAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,WAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,UAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,WAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,QAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE;GAA2B;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,aAAa,2BAA2B;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,EAAE,MAAM,cAAc,EAAE;AAC1B,UAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,kBAAkB,cAAc,EAAE;AACrC,UAAM,mDAAmD;AACzD,WAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,YAAY,SAAS,EAAE;AACzB,UAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,UAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,SAAM,qBAAqB;GAG3B,MAAM,oBAAoB,kBADN,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,UAAM,6DAA6D;AACnE,SAAK,WAAW,cAAc,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,WAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,WAAM,4BAA4B;AAClC,SAAI,cAAc,2BAA2B;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,SAAM,mBAAmB;GACzB,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,UAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,UAAM,oBAAoB;AAC1B,SAAK,WAAW,aAAa,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,+BAA+B;AACrC,QAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,QAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,QAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,WAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,cAAc,2BAA2B;AAC7C,WAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,SAAM,wBAAwB;AAC9B,UAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,SAAO,EAAE,YAAY,YAAY,KAAK,SAAS,EAAE,YAAY,aAAa,KAAK,KAAK;;;;;CAMtF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,EAAE,MAAM,cAAc,CACxB,QAAO,MAAM;AAGf,OAAI,CAAC,kBAAkB,cAAc,CACnC,QAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,cAAc,iBAAiB,MAAgB,OAAO;SAE1D,KAAI,cAAc,2BAA2B;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,QAAM,kBAAkB,KAAK;EAC7B,MAAM,sBAAsB,EAAE,MAAM,YAAY,GAAG,EAAE,GAAG;AAexD,SANsB,MAAM,YALA;GAC1B,aAAa;GACb;GACA,QANoB,EAAE,MAAM,OAAO,GACjC,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,MAAI,KAAK,OAAO,WAAW,oBAAoB;AAC7C,SAAM,mCAAmC;AAEzC,UADc,WAAW,OAAO,KAAK,OAAO;SAEvC;AACL,SAAM,8CAA8C;AAGpD,UADc,qBAAqB,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,SAAS"}

package/build/index.js

@@ -1,40 +1,20 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
 });
-var _exportNames = {
-  Auth: true
-};
-Object.defineProperty(exports, "Auth", {
-  enumerable: true,
-  get: function get() {
-    return _auth.Auth;
-  }
-});
-var _auth = require("./auth");
-var _utils = require("./utils");
-Object.keys(_utils).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _utils[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function get() {
-      return _utils[key];
-    }
-  });
-});
-var _types = require("./types");
-Object.keys(_types).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _types[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function get() {
-      return _types[key];
-    }
-  });
-});
-//# sourceMappingURL=index.js.map
+const require_utils = require("./utils.js");
+const require_auth = require("./auth.js");
+exports.Auth = require_auth.Auth;
+exports.allow_action = require_utils.allow_action;
+exports.buildUser = require_utils.buildUser;
+exports.convertPayloadToBase64 = require_utils.convertPayloadToBase64;
+exports.expireReasons = require_utils.expireReasons;
+exports.getApiToken = require_utils.getApiToken;
+exports.getDefaultPluginMethods = require_utils.getDefaultPluginMethods;
+exports.getMiddlewareCredentials = require_utils.getMiddlewareCredentials;
+exports.handleSpecialUnpublish = require_utils.handleSpecialUnpublish;
+exports.isAESLegacy = require_utils.isAESLegacy;
+exports.isAuthHeaderValid = require_utils.isAuthHeaderValid;
+exports.parseAESCredentials = require_utils.parseAESCredentials;
+exports.parseAuthTokenHeader = require_utils.parseAuthTokenHeader;
+exports.verifyJWTPayload = require_utils.verifyJWTPayload;

package/build/index.mjs

@@ -0,0 +1,3 @@
+import { allow_action, buildUser, convertPayloadToBase64, expireReasons, getApiToken, getDefaultPluginMethods, getMiddlewareCredentials, handleSpecialUnpublish, isAESLegacy, isAuthHeaderValid, parseAESCredentials, parseAuthTokenHeader, verifyJWTPayload } from "./utils.mjs";
+import { Auth } from "./auth.mjs";
+export { Auth, allow_action, buildUser, convertPayloadToBase64, expireReasons, getApiToken, getDefaultPluginMethods, getMiddlewareCredentials, handleSpecialUnpublish, isAESLegacy, isAuthHeaderValid, parseAESCredentials, parseAuthTokenHeader, verifyJWTPayload };

package/build/types.d.ts

@@ -1,6 +1,6 @@
-import type { NextFunction, Request, Response } from 'express';
-import type { VerdaccioError } from '@verdaccio/core';
-import type { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
+import { NextFunction, Request, Response } from 'express';
+import { VerdaccioError } from '@verdaccio/core';
+import { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
 export interface AESPayload {
     user: string;
     password: string;
@@ -31,4 +31,4 @@ export type $ResponseExtend = Response & {
     cookies?: any;
 };
 export type $NextFunctionVer = NextFunction & any;
-export { NextFunction };
+export type { NextFunction };

package/build/utils.d.ts

@@ -1,6 +1,6 @@
-import type { pluginUtils } from '@verdaccio/core';
-import type { Config, Logger, RemoteUser, Security } from '@verdaccio/types';
-import type { ActionsAllowed, AllowAction, AuthMiddlewarePayload, AuthTokenHeader, TokenEncryption } from './types';
+import { pluginUtils } from '@verdaccio/core';
+import { Config, Logger, RemoteUser, Security } from '@verdaccio/types';
+import { ActionsAllowed, AllowAction, AuthMiddlewarePayload, AuthTokenHeader, TokenEncryption } from './types';
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token

package/build/utils.js

@@ -1,265 +1,183 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.allow_action = allow_action;
-exports.buildUser = buildUser;
-exports.convertPayloadToBase64 = convertPayloadToBase64;
-exports.expireReasons = void 0;
-exports.getApiToken = getApiToken;
-exports.getDefaultPluginMethods = getDefaultPluginMethods;
-exports.getMiddlewareCredentials = getMiddlewareCredentials;
-exports.handleSpecialUnpublish = handleSpecialUnpublish;
-exports.isAESLegacy = isAESLegacy;
-exports.isAuthHeaderValid = isAuthHeaderValid;
-exports.parseAESCredentials = parseAESCredentials;
-exports.parseAuthTokenHeader = parseAuthTokenHeader;
-exports.verifyJWTPayload = verifyJWTPayload;
-var _debug = _interopRequireDefault(require("debug"));
-var _lodash = _interopRequireDefault(require("lodash"));
-var _config = require("@verdaccio/config");
-var _core = require("@verdaccio/core");
-var _signature = require("@verdaccio/signature");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
-function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
-function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
-function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
-function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
-function _slicedToArray(r, e) { return _arrayWithHoles(r) || _iterableToArrayLimit(r, e) || _unsupportedIterableToArray(r, e) || _nonIterableRest(); }
-function _nonIterableRest() { throw new TypeError("Invalid attempt to destructure non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); }
-function _unsupportedIterableToArray(r, a) { if (r) { if ("string" == typeof r) return _arrayLikeToArray(r, a); var t = {}.toString.call(r).slice(8, -1); return "Object" === t && r.constructor && (t = r.constructor.name), "Map" === t || "Set" === t ? Array.from(r) : "Arguments" === t || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(t) ? _arrayLikeToArray(r, a) : void 0; } }
-function _arrayLikeToArray(r, a) { (null == a || a > r.length) && (a = r.length); for (var e = 0, n = Array(a); e < a; e++) n[e] = r[e]; return n; }
-function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (null != t) { var e, n, i, u, a = [], f = !0, o = !1; try { if (i = (t = t.call(r)).next, 0 === l) { if (Object(t) !== t) return; f = !1; } else for (; !(f = (e = i.call(t)).done) && (a.push(e.value), a.length !== l); f = !0); } catch (r) { o = !0, n = r; } finally { try { if (!f && null != t["return"] && (u = t["return"](), Object(u) !== u)) return; } finally { if (o) throw n; } } return a; } }
-function _arrayWithHoles(r) { if (Array.isArray(r)) return r; }
-var debug = (0, _debug["default"])('verdaccio:auth:utils');
-
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let lodash = require("lodash");
+lodash = require_runtime.__toESM(lodash);
+let _verdaccio_config = require("@verdaccio/config");
+let _verdaccio_core = require("@verdaccio/core");
+let _verdaccio_signature = require("@verdaccio/signature");
+//#region src/utils.ts
+var debug$1 = (0, debug.default)("verdaccio:auth:utils");
 /**
- * Split authentication header eg: Bearer [secret_token]
- * @param authorizationHeader auth token
- */
+* Split authentication header eg: Bearer [secret_token]
+* @param authorizationHeader auth token
+*/
 function parseAuthTokenHeader(authorizationHeader) {
-  var parts = authorizationHeader.split(' ');
-  var _parts = _slicedToArray(parts, 2),
-    scheme = _parts[0],
-    token = _parts[1];
-  return {
-    scheme: scheme,
-    token: token
-  };
+	const [scheme, token] = authorizationHeader.split(" ");
+	return {
+		scheme,
+		token
+	};
 }
 function parseAESCredentials(authorizationHeader, secret) {
-  debug('parseAESCredentials init');
-  var _parseAuthTokenHeader = parseAuthTokenHeader(authorizationHeader),
-    scheme = _parseAuthTokenHeader.scheme,
-    token = _parseAuthTokenHeader.token;
-
-  // basic is deprecated and should not be enforced
-  // basic is currently being used for functional test
-  if (scheme.toUpperCase() === _core.TOKEN_BASIC.toUpperCase()) {
-    debug('legacy header basic');
-    var credentials = convertPayloadToBase64(token).toString();
-    return credentials;
-  } else if (scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
-    debug('legacy header bearer');
-    debug('secret length %o', secret.length);
-    var isLegacyUnsecure = secret.length > 32;
-    debug('is legacy unsecure %o', isLegacyUnsecure);
-    if (isLegacyUnsecure) {
-      debug('legacy unsecure enabled');
-      return (0, _signature.aesDecryptDeprecated)(convertPayloadToBase64(token), secret).toString('utf-8');
-    } else {
-      debug('legacy secure enabled');
-      return (0, _signature.aesDecrypt)(token.toString(), secret);
-    }
-  }
+	debug$1("parseAESCredentials init");
+	const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+	if (scheme.toUpperCase() === _verdaccio_core.TOKEN_BASIC.toUpperCase()) {
+		debug$1("legacy header basic");
+		return convertPayloadToBase64(token).toString();
+	} else if (scheme.toUpperCase() === _verdaccio_core.TOKEN_BEARER.toUpperCase()) {
+		debug$1("legacy header bearer");
+		debug$1("secret length %o", secret.length);
+		const isLegacyUnsecure = secret.length > 32;
+		debug$1("is legacy unsecure %o", isLegacyUnsecure);
+		if (isLegacyUnsecure) {
+			debug$1("legacy unsecure enabled");
+			return (0, _verdaccio_signature.aesDecryptDeprecated)(convertPayloadToBase64(token), secret).toString("utf-8");
+		} else {
+			debug$1("legacy secure enabled");
+			return (0, _verdaccio_signature.aesDecrypt)(token.toString(), secret);
+		}
+	}
 }
 function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
-  debug('getMiddlewareCredentials init');
-  // comment out for debugging purposes
-  if (isAESLegacy(security)) {
-    debug('is legacy');
-    var credentials = parseAESCredentials(authorizationHeader, secretKey);
-    if (!credentials) {
-      debug('parse legacy credentials failed');
-      return;
-    }
-    var parsedCredentials = (0, _signature.parseBasicPayload)(credentials);
-    if (!parsedCredentials) {
-      debug('parse legacy basic payload credentials failed');
-      return;
-    }
-    return parsedCredentials;
-  }
-  var _parseAuthTokenHeader2 = parseAuthTokenHeader(authorizationHeader),
-    scheme = _parseAuthTokenHeader2.scheme,
-    token = _parseAuthTokenHeader2.token;
-  debug('is jwt');
-  if (_lodash["default"].isString(token) && scheme.toUpperCase() === _core.TOKEN_BEARER.toUpperCase()) {
-    return verifyJWTPayload(token, secretKey, security);
-  }
+	debug$1("getMiddlewareCredentials init");
+	if (isAESLegacy(security)) {
+		debug$1("is legacy");
+		const credentials = parseAESCredentials(authorizationHeader, secretKey);
+		if (!credentials) {
+			debug$1("parse legacy credentials failed");
+			return;
+		}
+		const parsedCredentials = (0, _verdaccio_signature.parseBasicPayload)(credentials);
+		if (!parsedCredentials) {
+			debug$1("parse legacy basic payload credentials failed");
+			return;
+		}
+		return parsedCredentials;
+	}
+	const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+	debug$1("is jwt");
+	if (lodash.default.isString(token) && scheme.toUpperCase() === _verdaccio_core.TOKEN_BEARER.toUpperCase()) return verifyJWTPayload(token, secretKey, security);
 }
 function isAESLegacy(security) {
-  var _security$api = security.api,
-    legacy = _security$api.legacy,
-    jwt = _security$api.jwt;
-  return _lodash["default"].isNil(legacy) === false && _lodash["default"].isNil(jwt) && legacy === true;
-}
-function getApiToken(_x, _x2, _x3, _x4) {
-  return _getApiToken.apply(this, arguments);
+	const { legacy, jwt } = security.api;
+	return lodash.default.isNil(legacy) === false && lodash.default.isNil(jwt) && legacy === true;
 }
-function _getApiToken() {
-  _getApiToken = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(auth, config, remoteUser, aesPassword) {
-    var security, jwt;
-    return _regenerator().w(function (_context) {
-      while (1) switch (_context.n) {
-        case 0:
-          debug('get api token');
-          security = config.security;
-          if (!isAESLegacy(security)) {
-            _context.n = 2;
-            break;
-          }
-          debug('security legacy enabled');
-          // fallback all goes to AES encryption
-          _context.n = 1;
-          return new Promise(function (resolve) {
-            resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
-          });
-        case 1:
-          return _context.a(2, _context.v);
-        case 2:
-          jwt = security.api.jwt;
-          if (!(jwt !== null && jwt !== void 0 && jwt.sign)) {
-            _context.n = 4;
-            break;
-          }
-          _context.n = 3;
-          return auth.jwtEncrypt(remoteUser, jwt.sign);
-        case 3:
-          return _context.a(2, _context.v);
-        case 4:
-          _context.n = 5;
-          return new Promise(function (resolve) {
-            resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
-          });
-        case 5:
-          return _context.a(2, _context.v);
-      }
-    }, _callee);
-  }));
-  return _getApiToken.apply(this, arguments);
+async function getApiToken(auth, config, remoteUser, aesPassword) {
+	debug$1("get api token");
+	const { security } = config;
+	if (isAESLegacy(security)) {
+		debug$1("security legacy enabled");
+		return await new Promise((resolve) => {
+			resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
+		});
+	}
+	const { jwt } = security.api;
+	if (jwt?.sign) return await auth.jwtEncrypt(remoteUser, jwt.sign);
+	return await new Promise((resolve) => {
+		resolve(auth.aesEncrypt(buildUser(remoteUser.name, aesPassword)));
+	});
 }
-var expireReasons = exports.expireReasons = ['JsonWebTokenError', 'TokenExpiredError'];
+var expireReasons = ["JsonWebTokenError", "TokenExpiredError"];
 function verifyJWTPayload(token, secret, security) {
-  try {
-    var _security$api2;
-    var payload = (0, _signature.verifyPayload)(token, secret, security === null || security === void 0 || (_security$api2 = security.api) === null || _security$api2 === void 0 || (_security$api2 = _security$api2.jwt) === null || _security$api2 === void 0 ? void 0 : _security$api2.verify);
-    return payload;
-  } catch (error) {
-    // #168 this check should be removed as soon AES encrypt is removed.
-    if (expireReasons.includes(error.name)) {
-      // it might be possible the jwt configuration is enabled and
-      // old tokens fails still remains in usage, thus
-      // we return an anonymous user to force log in.
-      return (0, _config.createAnonymousRemoteUser)();
-    }
-    throw _core.errorUtils.getCode(_core.HTTP_STATUS.UNAUTHORIZED, error.message);
-  }
+	try {
+		return (0, _verdaccio_signature.verifyPayload)(token, secret, security?.api?.jwt?.verify);
+	} catch (error) {
+		if (expireReasons.includes(error.name)) return (0, _verdaccio_config.createAnonymousRemoteUser)();
+		throw _verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.UNAUTHORIZED, error.message);
+	}
 }
 function isAuthHeaderValid(authorization) {
-  return authorization.split(' ').length === 2;
+	return authorization.split(" ").length === 2;
 }
-
 /**
- * Return a default configuration for authentication if none is provided.
- * @param logger {Logger}
- * @returns object of default implementations.
- */
+* Return a default configuration for authentication if none is provided.
+* @param logger {Logger}
+* @returns object of default implementations.
+*/
 function getDefaultPluginMethods(logger) {
-  return {
-    authenticate: function authenticate(_user, _password, cb) {
-      debug('triggered default authenticate method');
-      cb(_core.errorUtils.getForbidden(_core.API_ERROR.BAD_USERNAME_PASSWORD));
-    },
-    adduser: function adduser(_user, _password, cb) {
-      debug('triggered default adduser method');
-      // since adduser is not implemented but optional, continue without error
-      // this assumes that the user is added by an external system
-      cb(null, true);
-    },
-    // @ts-ignore
-    allow_access: allow_action('access', logger),
-    // @ts-ignore
-    allow_publish: allow_action('publish', logger),
-    allow_unpublish: handleSpecialUnpublish(logger)
-  };
+	return {
+		authenticate(_user, _password, cb) {
+			debug$1("triggered default authenticate method");
+			cb(_verdaccio_core.errorUtils.getForbidden(_verdaccio_core.API_ERROR.BAD_USERNAME_PASSWORD));
+		},
+		adduser(_user, _password, cb) {
+			debug$1("triggered default adduser method");
+			cb(null, true);
+		},
+		allow_access: allow_action("access", logger),
+		allow_publish: allow_action("publish", logger),
+		allow_unpublish: handleSpecialUnpublish(logger)
+	};
 }
 function allow_action(action, logger) {
-  return function allowActionCallback(user, pkg, callback) {
-    logger.trace({
-      remote: user.name
-    }, "[auth/allow_action]: user: @{remote}");
-    var name = user.name,
-      groups = user.groups;
-    debug('allow_action "%s": groups %s', action, groups);
-    var groupAccess = pkg[action];
-    debug('allow_action "%s": groupAccess %s', action, groupAccess);
-    var hasPermission = groupAccess.some(function (group) {
-      return name === group || groups.includes(group);
-    });
-    debug('package "%s" has permission "%s"', name, hasPermission);
-    logger.trace({
-      pkgName: pkg.name,
-      hasPermission: hasPermission,
-      remote: user.name,
-      groupAccess: groupAccess
-    }, "[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}");
-    if (hasPermission) {
-      logger.trace({
-        remote: user.name
-      }, "auth/allow_action: access granted to: @{remote}");
-      return callback(null, true);
-    }
-    if (name) {
-      callback(_core.errorUtils.getForbidden("user ".concat(name, " is not allowed to ").concat(action, " package ").concat(pkg.name)));
-    } else {
-      callback(_core.errorUtils.getUnauthorized("authorization required to ".concat(action, " package ").concat(pkg.name)));
-    }
-  };
+	return function allowActionCallback(user, pkg, callback) {
+		logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);
+		const { name, groups } = user;
+		debug$1("allow_action \"%s\": groups %s", action, groups);
+		const groupAccess = pkg[action];
+		debug$1("allow_action \"%s\": groupAccess %s", action, groupAccess);
+		const hasPermission = groupAccess.some((group) => {
+			return name === group || groups.includes(group);
+		});
+		debug$1("package \"%s\" has permission \"%s\"", name, hasPermission);
+		logger.trace({
+			pkgName: pkg.name,
+			hasPermission,
+			remote: user.name,
+			groupAccess
+		}, `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`);
+		if (hasPermission) {
+			logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);
+			return callback(null, true);
+		}
+		if (name) callback(_verdaccio_core.errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`));
+		else callback(_verdaccio_core.errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`));
+	};
 }
-
 /**
- *
- */
+*
+*/
 function handleSpecialUnpublish(logger) {
-  return function (user, pkg, callback) {
-    var action = 'unpublish';
-    // verify whether the unpublish prop has been defined
-    var isUnpublishMissing = !pkg[action];
-    debug('is unpublish method missing ? %s', isUnpublishMissing);
-    var hasGroups = isUnpublishMissing ? false : pkg[action].length > 0;
-    logger.trace({
-      user: user.name,
-      name: pkg.name,
-      hasGroups: hasGroups
-    }, "fallback unpublish for @{name} has groups: @{hasGroups} for @{user}");
-    if (isUnpublishMissing || hasGroups === false) {
-      return callback(null, undefined);
-    }
-    logger.trace({
-      user: user.name,
-      name: pkg.name,
-      action: action,
-      hasGroups: hasGroups
-    }, "allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}");
-    return allow_action(action, logger)(user, pkg, callback);
-  };
+	return function(user, pkg, callback) {
+		const action = "unpublish";
+		const isUnpublishMissing = !pkg[action];
+		debug$1("is unpublish method missing ? %s", isUnpublishMissing);
+		const hasGroups = isUnpublishMissing ? false : pkg[action].length > 0;
+		logger.trace({
+			user: user.name,
+			name: pkg.name,
+			hasGroups
+		}, `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`);
+		if (isUnpublishMissing || hasGroups === false) return callback(null, void 0);
+		logger.trace({
+			user: user.name,
+			name: pkg.name,
+			action,
+			hasGroups
+		}, `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`);
+		return allow_action(action, logger)(user, pkg, callback);
+	};
 }
 function buildUser(name, password) {
-  return String("".concat(name, ":").concat(password));
+	return String(`${name}:${password}`);
 }
 function convertPayloadToBase64(payload) {
-  return Buffer.from(payload, 'base64');
+	return Buffer.from(payload, "base64");
 }
+//#endregion
+exports.allow_action = allow_action;
+exports.buildUser = buildUser;
+exports.convertPayloadToBase64 = convertPayloadToBase64;
+exports.expireReasons = expireReasons;
+exports.getApiToken = getApiToken;
+exports.getDefaultPluginMethods = getDefaultPluginMethods;
+exports.getMiddlewareCredentials = getMiddlewareCredentials;
+exports.handleSpecialUnpublish = handleSpecialUnpublish;
+exports.isAESLegacy = isAESLegacy;
+exports.isAuthHeaderValid = isAuthHeaderValid;
+exports.parseAESCredentials = parseAESCredentials;
+exports.parseAuthTokenHeader = parseAuthTokenHeader;
+exports.verifyJWTPayload = verifyJWTPayload;
+
 //# sourceMappingURL=utils.js.map