@verdaccio/auth 9.0.0-next-9.6 → 9.0.0-next-9.8

package/build/auth.js

@@ -2,8 +2,7 @@ const require_runtime = require("./_virtual/_rolldown/runtime.js");
 const require_utils = require("./utils.js");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug);
-let lodash = require("lodash");
-lodash = require_runtime.__toESM(lodash);
+let lodash_es = require("lodash-es");
 let verdaccio_htpasswd = require("verdaccio-htpasswd");
 let _verdaccio_config = require("@verdaccio/config");
 let _verdaccio_core = require("@verdaccio/core");
@@ -61,9 +60,9 @@ var Auth = class {
 		this.plugins.push(require_utils.getDefaultPluginMethods(this.logger));
 	}
 	changePassword(username, password, newPassword, cb) {
-		const validPlugins = lodash.default.filter(this.plugins, (plugin) => lodash.default.isFunction(plugin.changePassword));
-		if (lodash.default.isEmpty(validPlugins)) return cb(_verdaccio_core.errorUtils.getInternalError(_verdaccio_core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
-		for (const plugin of validPlugins) if (lodash.default.isNil(plugin) || lodash.default.isFunction(plugin.changePassword) === false) {
+		const validPlugins = (0, lodash_es.filter)(this.plugins, (plugin) => typeof plugin.changePassword === "function");
+		if ((0, lodash_es.isEmpty)(validPlugins)) return cb(_verdaccio_core.errorUtils.getInternalError(_verdaccio_core.SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+		for (const plugin of validPlugins) if ((0, lodash_es.isNil)(plugin) || typeof plugin.changePassword !== "function") {
 			debug$1("auth plugin does not implement changePassword, trying next one");
 			continue;
 		} else {
@@ -98,8 +97,8 @@ var Auth = class {
 					return cb(err);
 				}
 				if (!!groups && groups.length !== 0) {
-					if (lodash.default.isString(groups)) throw new TypeError("plugin group error: invalid type for function");
-					if (!lodash.default.isArray(groups)) throw new TypeError(_verdaccio_core.API_ERROR.BAD_FORMAT_USER_GROUP);
+					if (typeof groups === "string") throw new TypeError("plugin group error: invalid type for function");
+					if (!Array.isArray(groups)) throw new TypeError(_verdaccio_core.API_ERROR.BAD_FORMAT_USER_GROUP);
 					debug$1("authentication for user %o was successfully. Groups: %o", username, groups);
 					return cb(err, (0, _verdaccio_config.createRemoteUser)(username, groups));
 				}
@@ -190,7 +189,7 @@ var Auth = class {
 					debug$1("forbidden unpublish. Error: %o", err);
 					return callback(err);
 				}
-				if (lodash.default.isNil(ok) === true) {
+				if ((0, lodash_es.isNil)(ok) === true) {
 					debug$1("bypass unpublish for %o, publish will handle the access", packageName);
 					this.logger.trace({
 						user: user.name,
@@ -277,7 +276,7 @@ var Auth = class {
 			req.remote_user = remoteUser;
 			res.locals.remote_user = remoteUser;
 			const { authorization } = req.headers;
-			if (lodash.default.isNil(authorization)) {
+			if ((0, lodash_es.isNil)(authorization)) {
 				debug$1("jwt, authentication header is missing");
 				return next();
 			}
@@ -358,7 +357,7 @@ var Auth = class {
 		}
 	}
 	_isRemoteUserValid(remote_user) {
-		return lodash.default.isUndefined(remote_user) === false && lodash.default.isUndefined(remote_user?.name) === false;
+		return (0, lodash_es.isUndefined)(remote_user) === false && (0, lodash_es.isUndefined)(remote_user?.name) === false;
 	}
 	/**
 	* JWT middleware for WebUI
@@ -376,7 +375,7 @@ var Auth = class {
 				return _next();
 			};
 			const { authorization } = req.headers;
-			if (lodash.default.isNil(authorization)) return next();
+			if ((0, lodash_es.isNil)(authorization)) return next();
 			if (!require_utils.isAuthHeaderValid(authorization)) return next(_verdaccio_core.errorUtils.getBadRequest(_verdaccio_core.API_ERROR.BAD_AUTH_HEADER));
 			const token = (authorization || "").replace(`${_verdaccio_core.TOKEN_BEARER} `, "");
 			if (!token) return next();
@@ -394,24 +393,19 @@ var Auth = class {
 	async jwtEncrypt(user, signOptions) {
 		const { real_groups, name, groups } = user;
 		debug$1("jwt encrypt %o", name);
-		const realGroupsValidated = lodash.default.isNil(real_groups) ? [] : real_groups;
+		const realGroupsValidated = (0, lodash_es.isNil)(real_groups) ? [] : real_groups;
 		return await (0, _verdaccio_signature.signPayload)({
 			real_groups: realGroupsValidated,
 			name,
-			groups: lodash.default.isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
+			groups: (0, lodash_es.isNil)(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
 		}, this.secret, signOptions);
 	}
 	/**
 	* Encrypt a string.
 	*/
 	aesEncrypt(value) {
-		if (this.secret.length === _verdaccio_config.TOKEN_VALID_LENGTH) {
-			debug$1("signing with enhanced aes legacy");
-			return (0, _verdaccio_signature.aesEncrypt)(value, this.secret);
-		} else {
-			debug$1("signing with enhanced aes deprecated legacy");
-			return (0, _verdaccio_signature.aesEncryptDeprecated)(Buffer.from(value), this.secret).toString("base64");
-		}
+		debug$1("signing with aes encryption");
+		return (0, _verdaccio_signature.aesEncrypt)(value, this.secret);
 	}
 };
 //#endregion

package/build/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n} from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (_.isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    if (this.secret.length === TOKEN_VALID_LENGTH) {\n      debug('signing with enhanced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhanced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;;;;AAsDA,IAAM,WAAA,GAAA,MAAA,SAAmB,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,UAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,UAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,mBAAA,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAA,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,WAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,UAAA,GAAA,mBAAA,iBACE,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,EACD,gBAAA,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,gBAAA,eACrC,gBAAA,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,cAAA,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,OAAA,QAAE,OAAO,KAAK,UAAU,WAAW,OAAA,QAAE,WAAW,OAAO,eAAe,CAAC;AAE5F,MAAI,OAAA,QAAE,QAAQ,aAAa,CACzB,QAAO,GAAG,gBAAA,WAAW,iBAAiB,gBAAA,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,KAAI,OAAA,QAAE,MAAM,OAAO,IAAI,OAAA,QAAE,WAAW,OAAO,eAAe,KAAK,OAAO;AACpE,WAAM,iEAAiE;AACvE;SACK;AACL,WAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,YAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,WAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,aAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,OAAA,QAAE,SAAS,OAAO,CACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,OAAA,QAAE,QAAQ,OAAO,CAE7C,OAAM,IAAI,UAAU,gBAAA,UAAU,sBAAsB;AAGtD,aAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,MAAA,GAAA,kBAAA,kBAAsB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,UAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,oBAAA,aAAa,KAAK,gBAAA,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,aAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,aAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,YAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,YAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,aAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,aAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,YAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,aAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,QAAI,OAAA,QAAE,MAAM,GAAG,KAAK,MAAM;AACxB,aAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,aAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,YAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,aAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,aAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,UAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE,2BAAA,kBAAA;GAA2B,kBAAA,kBAAA;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,cAAA,GAAA,kBAAA,4BAAwC;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,OAAA,QAAE,MAAM,cAAc,EAAE;AAC1B,YAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,cAAA,kBAAkB,cAAc,EAAE;AACrC,YAAM,mDAAmD;AACzD,WAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,cAAA,YAAY,SAAS,EAAE;AACzB,YAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,YAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,UAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,cAAA,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,gBAAA,YAAY,aAAa,EAAE;AACtD,WAAM,qBAAqB;GAG3B,MAAM,qBAAA,GAAA,qBAAA,mBADc,cAAA,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,YAAM,6DAA6D;AACnE,SAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,WAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,aAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,aAAM,4BAA4B;AAClC,SAAI,eAAA,GAAA,kBAAA,4BAAyC;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,WAAM,mBAAmB;GACzB,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,YAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,YAAM,oBAAoB;AAC1B,SAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,UAAM,+BAA+B;AACrC,UAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,UAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,cAAc;AAClF,UAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,WAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,aAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,eAAA,GAAA,kBAAA,4BAAyC;AAC7C,aAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,WAAM,wBAAwB;AAC9B,UAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,SAAO,OAAA,QAAE,YAAY,YAAY,KAAK,SAAS,OAAA,QAAE,YAAY,aAAa,KAAK,KAAK;;;;;CAMtF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,OAAA,QAAE,MAAM,cAAc,CACxB,QAAO,MAAM;AAGf,OAAI,CAAC,cAAA,kBAAkB,cAAc,CACnC,QAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,gBAAA,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,cAAA,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,eAAA,GAAA,kBAAA,kBAA+B,MAAgB,OAAO;SAE1D,KAAI,eAAA,GAAA,kBAAA,4BAAyC;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,UAAM,kBAAkB,KAAK;EAC7B,MAAM,sBAAsB,OAAA,QAAE,MAAM,YAAY,GAAG,EAAE,GAAG;AAexD,SANsB,OAAA,GAAA,qBAAA,aALM;GAC1B,aAAa;GACb;GACA,QANoB,OAAA,QAAE,MAAM,OAAO,GACjC,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,MAAI,KAAK,OAAO,WAAW,kBAAA,oBAAoB;AAC7C,WAAM,mCAAmC;AAEzC,WAAA,GAAA,qBAAA,YADyB,OAAO,KAAK,OAAO;SAEvC;AACL,WAAM,8CAA8C;AAGpD,WAAA,GAAA,qBAAA,sBADmC,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,SAAS"}
+{"version":3,"file":"auth.js","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { filter, isEmpty, isNil, isUndefined } from 'lodash-es';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = filter(\n      this.plugins,\n      (plugin) => typeof plugin.changePassword === 'function'\n    );\n\n    if (isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || typeof plugin.changePassword !== 'function') {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (typeof groups === 'string') {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = Array.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;;;AAiDA,IAAM,WAAA,GAAA,MAAA,SAAmB,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,UAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,UAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,mBAAA,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAA,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,WAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,UAAA,GAAA,mBAAA,iBACE,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,EACD,gBAAA,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,gBAAA,eACrC,gBAAA,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,cAAA,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,gBAAA,GAAA,UAAA,QACJ,KAAK,UACJ,WAAW,OAAO,OAAO,mBAAmB,WAC9C;AAED,OAAA,GAAA,UAAA,SAAY,aAAa,CACvB,QAAO,GAAG,gBAAA,WAAW,iBAAiB,gBAAA,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,MAAA,GAAA,UAAA,OAAU,OAAO,IAAI,OAAO,OAAO,mBAAmB,YAAY;AAChE,WAAM,iEAAiE;AACvE;SACK;AACL,WAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,YAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,WAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,aAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,OAAO,WAAW,SACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,MAAM,QAAQ,OAAO,CAEjD,OAAM,IAAI,UAAU,gBAAA,UAAU,sBAAsB;AAGtD,aAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,MAAA,GAAA,kBAAA,kBAAsB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,UAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,oBAAA,aAAa,KAAK,gBAAA,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,aAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,aAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,YAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,YAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,aAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,aAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,YAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,aAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,SAAA,GAAA,UAAA,OAAU,GAAG,KAAK,MAAM;AACtB,aAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,aAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,gBAAA,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,UAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,YAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,aAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,aAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,YAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,UAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE,2BAAA,kBAAA;GAA2B,kBAAA,kBAAA;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,cAAA,GAAA,kBAAA,4BAAwC;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,QAAA,GAAA,UAAA,OAAU,cAAc,EAAE;AACxB,YAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,cAAA,kBAAkB,cAAc,EAAE;AACrC,YAAM,mDAAmD;AACzD,WAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,cAAA,YAAY,SAAS,EAAE;AACzB,YAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,YAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,UAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,cAAA,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,gBAAA,YAAY,aAAa,EAAE;AACtD,WAAM,qBAAqB;GAG3B,MAAM,qBAAA,GAAA,qBAAA,mBADc,cAAA,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,YAAM,6DAA6D;AACnE,SAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,WAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,aAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,aAAM,4BAA4B;AAClC,SAAI,eAAA,GAAA,kBAAA,4BAAyC;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,WAAM,mBAAmB;GACzB,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,YAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,YAAM,oBAAoB;AAC1B,SAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,UAAM,+BAA+B;AACrC,UAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,UAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,cAAA,yBAAyB,UAAU,QAAQ,cAAc;AAClF,UAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,WAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,aAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,eAAA,GAAA,kBAAA,4BAAyC;AAC7C,aAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,WAAM,wBAAwB;AAC9B,UAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,UAAA,GAAA,UAAA,aAAmB,YAAY,KAAK,UAAA,GAAA,UAAA,aAAqB,aAAa,KAAK,KAAK;;;;;CAMlF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,QAAA,GAAA,UAAA,OAAU,cAAc,CACtB,QAAO,MAAM;AAGf,OAAI,CAAC,cAAA,kBAAkB,cAAc,CACnC,QAAO,KAAK,gBAAA,WAAW,cAAc,gBAAA,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,gBAAA,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,cAAA,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,eAAA,GAAA,kBAAA,kBAA+B,MAAgB,OAAO;SAE1D,KAAI,eAAA,GAAA,kBAAA,4BAAyC;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,UAAM,kBAAkB,KAAK;EAC7B,MAAM,uBAAA,GAAA,UAAA,OAA4B,YAAY,GAAG,EAAE,GAAG;AAetD,SANsB,OAAA,GAAA,qBAAA,aALM;GAC1B,aAAa;GACb;GACA,SAAA,GAAA,UAAA,OAN0B,OAAO,GAC/B,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,UAAM,8BAA8B;AAEpC,UAAA,GAAA,qBAAA,YADyB,OAAO,KAAK,OAAO"}

package/build/auth.mjs

@@ -1,11 +1,11 @@
 import { convertPayloadToBase64, getDefaultPluginMethods, getMiddlewareCredentials, isAESLegacy, isAuthHeaderValid, parseAuthTokenHeader, verifyJWTPayload } from "./utils.mjs";
 import buildDebug from "debug";
-import _ from "lodash";
+import { filter, isEmpty, isNil, isUndefined } from "lodash-es";
 import { HTPasswd } from "verdaccio-htpasswd";
-import { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from "@verdaccio/config";
+import { createAnonymousRemoteUser, createRemoteUser } from "@verdaccio/config";
 import { API_ERROR, PLUGIN_CATEGORY, PLUGIN_PREFIX, SUPPORT_ERRORS, TOKEN_BASIC, TOKEN_BEARER, authUtils, errorUtils, pluginUtils, warningUtils } from "@verdaccio/core";
 import { asyncLoadPlugin } from "@verdaccio/loaders";
-import { aesEncrypt, aesEncryptDeprecated, parseBasicPayload, signPayload } from "@verdaccio/signature";
+import { aesEncrypt, parseBasicPayload, signPayload } from "@verdaccio/signature";
 //#region src/auth.ts
 var debug = buildDebug("verdaccio:auth");
 var Auth = class {
@@ -58,9 +58,9 @@ var Auth = class {
 		this.plugins.push(getDefaultPluginMethods(this.logger));
 	}
 	changePassword(username, password, newPassword, cb) {
-		const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));
-		if (_.isEmpty(validPlugins)) return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
-		for (const plugin of validPlugins) if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {
+		const validPlugins = filter(this.plugins, (plugin) => typeof plugin.changePassword === "function");
+		if (isEmpty(validPlugins)) return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));
+		for (const plugin of validPlugins) if (isNil(plugin) || typeof plugin.changePassword !== "function") {
 			debug("auth plugin does not implement changePassword, trying next one");
 			continue;
 		} else {
@@ -95,8 +95,8 @@ var Auth = class {
 					return cb(err);
 				}
 				if (!!groups && groups.length !== 0) {
-					if (_.isString(groups)) throw new TypeError("plugin group error: invalid type for function");
-					if (!_.isArray(groups)) throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);
+					if (typeof groups === "string") throw new TypeError("plugin group error: invalid type for function");
+					if (!Array.isArray(groups)) throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);
 					debug("authentication for user %o was successfully. Groups: %o", username, groups);
 					return cb(err, createRemoteUser(username, groups));
 				}
@@ -187,7 +187,7 @@ var Auth = class {
 					debug("forbidden unpublish. Error: %o", err);
 					return callback(err);
 				}
-				if (_.isNil(ok) === true) {
+				if (isNil(ok) === true) {
 					debug("bypass unpublish for %o, publish will handle the access", packageName);
 					this.logger.trace({
 						user: user.name,
@@ -274,7 +274,7 @@ var Auth = class {
 			req.remote_user = remoteUser;
 			res.locals.remote_user = remoteUser;
 			const { authorization } = req.headers;
-			if (_.isNil(authorization)) {
+			if (isNil(authorization)) {
 				debug("jwt, authentication header is missing");
 				return next();
 			}
@@ -355,7 +355,7 @@ var Auth = class {
 		}
 	}
 	_isRemoteUserValid(remote_user) {
-		return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;
+		return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;
 	}
 	/**
 	* JWT middleware for WebUI
@@ -373,7 +373,7 @@ var Auth = class {
 				return _next();
 			};
 			const { authorization } = req.headers;
-			if (_.isNil(authorization)) return next();
+			if (isNil(authorization)) return next();
 			if (!isAuthHeaderValid(authorization)) return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));
 			const token = (authorization || "").replace(`${TOKEN_BEARER} `, "");
 			if (!token) return next();
@@ -391,24 +391,19 @@ var Auth = class {
 	async jwtEncrypt(user, signOptions) {
 		const { real_groups, name, groups } = user;
 		debug("jwt encrypt %o", name);
-		const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;
+		const realGroupsValidated = isNil(real_groups) ? [] : real_groups;
 		return await signPayload({
 			real_groups: realGroupsValidated,
 			name,
-			groups: _.isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
+			groups: isNil(groups) ? real_groups : Array.from(new Set([...groups.concat(realGroupsValidated)]))
 		}, this.secret, signOptions);
 	}
 	/**
 	* Encrypt a string.
 	*/
 	aesEncrypt(value) {
-		if (this.secret.length === TOKEN_VALID_LENGTH) {
-			debug("signing with enhanced aes legacy");
-			return aesEncrypt(value, this.secret);
-		} else {
-			debug("signing with enhanced aes deprecated legacy");
-			return aesEncryptDeprecated(Buffer.from(value), this.secret).toString("base64");
-		}
+		debug("signing with aes encryption");
+		return aesEncrypt(value, this.secret);
 	}
 };
 //#endregion

package/build/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { TOKEN_VALID_LENGTH, createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport {\n  aesEncrypt,\n  aesEncryptDeprecated,\n  parseBasicPayload,\n  signPayload,\n} from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = _.filter(this.plugins, (plugin) => _.isFunction(plugin.changePassword));\n\n    if (_.isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (_.isNil(plugin) || _.isFunction(plugin.changePassword) === false) {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (_.isString(groups)) {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = _.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (_.isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return _.isUndefined(remote_user) === false && _.isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (_.isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = _.isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = _.isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    if (this.secret.length === TOKEN_VALID_LENGTH) {\n      debug('signing with enhanced aes legacy');\n      const token = aesEncrypt(value, this.secret);\n      return token;\n    } else {\n      debug('signing with enhanced aes deprecated legacy');\n      // deprecated aes (legacy) signature, only must be used for legacy version\n      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');\n      return token;\n    }\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;AAsDA,IAAM,QAAQ,WAAW,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,QAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,QAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,SAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,SAAO,gBACL,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,EACD,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,eACrC,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,EAAE,OAAO,KAAK,UAAU,WAAW,EAAE,WAAW,OAAO,eAAe,CAAC;AAE5F,MAAI,EAAE,QAAQ,aAAa,CACzB,QAAO,GAAG,WAAW,iBAAiB,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,KAAI,EAAE,MAAM,OAAO,IAAI,EAAE,WAAW,OAAO,eAAe,KAAK,OAAO;AACpE,SAAM,iEAAiE;AACvE;SACK;AACL,SAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,UAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,SAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,WAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,EAAE,SAAS,OAAO,CACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,EAAE,QAAQ,OAAO,CAE7C,OAAM,IAAI,UAAU,UAAU,sBAAsB;AAGtD,WAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,KAAK,iBAAiB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,QAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,iBAAa,KAAK,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,WAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,WAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,UAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,UAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,WAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,UAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,WAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,QAAI,EAAE,MAAM,GAAG,KAAK,MAAM;AACxB,WAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,WAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,UAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,WAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,QAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE;GAA2B;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,aAAa,2BAA2B;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,EAAE,MAAM,cAAc,EAAE;AAC1B,UAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,kBAAkB,cAAc,EAAE;AACrC,UAAM,mDAAmD;AACzD,WAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,YAAY,SAAS,EAAE;AACzB,UAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,UAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,SAAM,qBAAqB;GAG3B,MAAM,oBAAoB,kBADN,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,UAAM,6DAA6D;AACnE,SAAK,WAAW,cAAc,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,WAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,WAAM,4BAA4B;AAClC,SAAI,cAAc,2BAA2B;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,SAAM,mBAAmB;GACzB,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,UAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,UAAM,oBAAoB;AAC1B,SAAK,WAAW,aAAa,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,+BAA+B;AACrC,QAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,QAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,QAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,WAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,cAAc,2BAA2B;AAC7C,WAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,SAAM,wBAAwB;AAC9B,UAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,SAAO,EAAE,YAAY,YAAY,KAAK,SAAS,EAAE,YAAY,aAAa,KAAK,KAAK;;;;;CAMtF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,EAAE,MAAM,cAAc,CACxB,QAAO,MAAM;AAGf,OAAI,CAAC,kBAAkB,cAAc,CACnC,QAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,cAAc,iBAAiB,MAAgB,OAAO;SAE1D,KAAI,cAAc,2BAA2B;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,QAAM,kBAAkB,KAAK;EAC7B,MAAM,sBAAsB,EAAE,MAAM,YAAY,GAAG,EAAE,GAAG;AAexD,SANsB,MAAM,YALA;GAC1B,aAAa;GACb;GACA,QANoB,EAAE,MAAM,OAAO,GACjC,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,MAAI,KAAK,OAAO,WAAW,oBAAoB;AAC7C,SAAM,mCAAmC;AAEzC,UADc,WAAW,OAAO,KAAK,OAAO;SAEvC;AACL,SAAM,8CAA8C;AAGpD,UADc,qBAAqB,OAAO,KAAK,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,SAAS"}
+{"version":3,"file":"auth.mjs","names":[],"sources":["../src/auth.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { filter, isEmpty, isNil, isUndefined } from 'lodash-es';\nimport { HTPasswd } from 'verdaccio-htpasswd';\n\nimport { createAnonymousRemoteUser, createRemoteUser } from '@verdaccio/config';\nimport type { VerdaccioError, pluginUtils } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  PLUGIN_CATEGORY,\n  PLUGIN_PREFIX,\n  SUPPORT_ERRORS,\n  TOKEN_BASIC,\n  TOKEN_BEARER,\n  authUtils,\n  errorUtils,\n  pluginUtils as pluginSanity,\n  warningUtils,\n} from '@verdaccio/core';\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';\nimport type {\n  AllowAccess,\n  Callback,\n  Config,\n  JWTSignOptions,\n  Logger,\n  PackageAccess,\n  RemoteUser,\n  Security,\n} from '@verdaccio/types';\n\nimport type {\n  $RequestExtend,\n  $ResponseExtend,\n  AESPayload,\n  IAuthMiddleware,\n  NextFunction,\n  TokenEncryption,\n} from './types';\nimport {\n  convertPayloadToBase64,\n  getDefaultPluginMethods,\n  getMiddlewareCredentials,\n  isAESLegacy,\n  isAuthHeaderValid,\n  parseAuthTokenHeader,\n  verifyJWTPayload,\n} from './utils';\n\nconst debug = buildDebug('verdaccio:auth');\n\nclass Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {\n  public config: Config;\n  public secret: string;\n  public logger: Logger;\n  public plugins: pluginUtils.Auth<Config>[];\n  public options: { legacyMergeConfigs: boolean };\n\n  public constructor(config: Config, logger: Logger, options = { legacyMergeConfigs: false }) {\n    this.config = config;\n    this.secret = config.secret;\n    this.logger = logger;\n    this.plugins = [];\n    this.options = options;\n    if (!this.secret) {\n      throw new TypeError('secret it is required value on initialize the auth class');\n    }\n  }\n\n  public async init() {\n    let plugins = await this.loadPlugin();\n\n    debug('auth plugins found %s', plugins.length);\n    // Missing auth config or no loaded plugins -> load default htpasswd plugin\n    // Empty auth config (null) -> just use fallback methods\n    if (this.config.auth !== null && (!plugins || plugins.length === 0)) {\n      plugins = this.loadDefaultPlugin();\n    }\n    this.plugins = plugins;\n\n    this.applyFallbackPluginMethods();\n  }\n\n  private loadDefaultPlugin() {\n    debug('load default auth plugin');\n    let authPlugin;\n    try {\n      authPlugin = new HTPasswd(\n        { file: './htpasswd' },\n        {\n          config: this.config,\n          logger: this.logger,\n        }\n      );\n      this.logger.info(\n        { name: 'verdaccio-htpasswd', pluginCategory: PLUGIN_CATEGORY.AUTHENTICATION },\n        'plugin @{name} successfully loaded (@{pluginCategory})'\n      );\n    } catch (error: any) {\n      debug('error on loading auth htpasswd plugin stack: %o', error);\n      this.logger.info({}, 'no auth plugin has been found');\n      return [];\n    }\n\n    return [authPlugin];\n  }\n\n  private async loadPlugin() {\n    return asyncLoadPlugin<pluginUtils.Auth<Config>>(\n      this.config.auth,\n      {\n        config: this.config,\n        logger: this.logger,\n      },\n      pluginSanity.authSanityCheck,\n      this.options.legacyMergeConfigs,\n      this.config?.server?.pluginPrefix ?? PLUGIN_PREFIX,\n      PLUGIN_CATEGORY.AUTHENTICATION\n    );\n  }\n\n  private applyFallbackPluginMethods(): void {\n    this.plugins.push(getDefaultPluginMethods(this.logger));\n  }\n\n  public changePassword(\n    username: string,\n    password: string,\n    newPassword: string,\n    cb: Callback\n  ): void {\n    const validPlugins = filter(\n      this.plugins,\n      (plugin) => typeof plugin.changePassword === 'function'\n    );\n\n    if (isEmpty(validPlugins)) {\n      return cb(errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE));\n    }\n\n    for (const plugin of validPlugins) {\n      if (isNil(plugin) || typeof plugin.changePassword !== 'function') {\n        debug('auth plugin does not implement changePassword, trying next one');\n        continue;\n      } else {\n        debug('updating password for %o', username);\n        plugin.changePassword!(username, password, newPassword, (err, profile): void => {\n          if (err) {\n            this.logger.error(\n              { username, err },\n              `An error has been produced\n            updating the password for @{username}. Error: @{err.message}`\n            );\n            return cb(err);\n          }\n\n          debug('updated password for %o was successful', username);\n          return cb(null, profile);\n        });\n      }\n    }\n  }\n\n  public async invalidateToken(token: string) {\n    // eslint-disable-next-line no-console\n    console.log('invalidate token pending to implement', token);\n    return Promise.resolve();\n  }\n\n  public authenticate(\n    username: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const plugins = this.plugins.slice(0);\n    (function next(): void {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.authenticate !== 'function') {\n        return next();\n      }\n\n      debug('authenticating %o', username);\n      plugin.authenticate(username, password, function (err: VerdaccioError | null, groups): void {\n        if (err) {\n          debug('authenticating for user %o failed. Error: %o', username, err?.message);\n          return cb(err);\n        }\n\n        // Expect: SKIP if groups is falsey and not an array\n        //         with at least one item (truthy length)\n        // Expect: CONTINUE otherwise (will error if groups is not\n        //         an array, but this is current behavior)\n        // Caveat: STRING (if valid) will pass successfully\n        //         bug give unexpected results\n        // Info: Cannot use `== false to check falsey values`\n        if (!!groups && groups.length !== 0) {\n          // TODO: create a better understanding of expectations\n          if (typeof groups === 'string') {\n            throw new TypeError('plugin group error: invalid type for function');\n          }\n          const isGroupValid: boolean = Array.isArray(groups);\n          if (!isGroupValid) {\n            throw new TypeError(API_ERROR.BAD_FORMAT_USER_GROUP);\n          }\n\n          debug('authentication for user %o was successfully. Groups: %o', username, groups);\n          return cb(err, createRemoteUser(username, groups));\n        }\n        next();\n      });\n    })();\n  }\n\n  public add_user(\n    user: string,\n    password: string,\n    cb: (error: VerdaccioError | null, user?: RemoteUser) => void\n  ): void {\n    const self = this;\n    const plugins = this.plugins.slice(0);\n    debug('add user %o', user);\n\n    (function next(): void {\n      let method = 'adduser';\n      const plugin = plugins.shift();\n      // @ts-expect-error future major (7.x) should remove this section\n      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {\n        method = 'add_user';\n        warningUtils.emit(warningUtils.Codes.VERWAR006);\n      }\n      // @ts-ignore\n      if (typeof plugin[method] !== 'function') {\n        next();\n      } else {\n        // TODO: replace by adduser whenever add_user deprecation method has been removed\n        // @ts-ignore\n        plugin[method](\n          user,\n          password,\n          function (err: VerdaccioError | null, ok?: boolean | string): void {\n            if (err) {\n              debug('the user %o could not be added. Error: %o', user, err?.message);\n              return cb(err);\n            }\n            if (ok) {\n              debug('the user %o has been added', user);\n              return self.authenticate(user, password, cb);\n            }\n            debug('user could not be added, skip to next auth plugin');\n            next();\n          }\n        );\n      }\n    })();\n  }\n\n  /**\n   * Allow user to access a package.\n   */\n  public allow_access(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: pluginUtils.AccessCallback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    ) as AllowAccess & PackageAccess;\n\n    debug('check access permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_access !== 'function') {\n        debug('plugin does not implement allow_access');\n        return next();\n      }\n\n      plugin.allow_access(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden access. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('access was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `access was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('access was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate access denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public allow_unpublish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check unpublish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_unpublish !== 'function') {\n        debug('plugin does not implement allow_unpublish');\n        return next();\n      }\n\n      plugin.allow_unpublish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden unpublish. Error: %o', err);\n          return callback(err);\n        }\n\n        // The following is different from the allow_access and allow_publish implementations:\n        // If the packages config is missing an entry for \"unpublish\", the built-in default method\n        // (or a plugin) will return undefined, which will trigger the allow_publish fallback.\n        // (see utils.ts, handleSpecialUnpublish, callback(null, undefined))\n        if (isNil(ok) === true) {\n          debug('bypass unpublish for %o, publish will handle the access', packageName);\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `bypass unpublish for @{name} by @{user}, publish will handle the access`\n          );\n          return this.allow_publish({ packageName, packageVersion }, user, callback);\n        }\n\n        if (ok) {\n          debug('unpublish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `unpublish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('unpublish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate unpublish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  /**\n   * Allow user to publish a package.\n   */\n  public allow_publish(\n    { packageName, packageVersion }: pluginUtils.AuthPluginPackage,\n    user: RemoteUser,\n    callback: Callback\n  ): void {\n    const plugins = this.plugins.slice(0);\n    const pkg = Object.assign(\n      { name: packageName, version: packageVersion },\n      authUtils.getMatchedPackagesSpec(packageName, this.config.packages)\n    );\n\n    debug('check publish permissions for user %o to package %o', user.name, packageName);\n\n    // Use const instead of function declaration so we can use this.logger\n    const next = (): void => {\n      const plugin = plugins.shift();\n\n      if (typeof plugin?.allow_publish !== 'function') {\n        debug('plugin does not implement allow_publish');\n        return next();\n      }\n\n      plugin.allow_publish(user, pkg, (err: VerdaccioError | null, ok?: boolean): void => {\n        if (err) {\n          debug('forbidden publish. Error: %o', err);\n          return callback(err);\n        }\n\n        if (ok) {\n          debug('publish was granted');\n          this.logger.trace(\n            { user: user.name, name: pkg.name },\n            `publish was granted for @{name} by @{user}`\n          );\n          return callback(null, ok);\n        }\n\n        // cb(null, false) causes next plugin to roll\n        debug('publish was denied. Rolling to next plugin');\n        this.logger.trace(\n          { user: user.name, name: pkg.name },\n          `intermediate publish denial for @{name} by @{user}, rolling to next plugin`\n        );\n        return next();\n      });\n    };\n\n    return next();\n  }\n\n  public apiJWTmiddleware(): any {\n    debug('jwt middleware');\n    const plugins = this.plugins.slice(0);\n    const helpers = { createAnonymousRemoteUser, createRemoteUser };\n    for (const plugin of plugins) {\n      if (plugin.apiJWTmiddleware) {\n        return plugin.apiJWTmiddleware(helpers);\n      }\n    }\n\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {\n      req.pause();\n      const next = function (err?: VerdaccioError): NextFunction {\n        req.resume();\n        // uncomment this to reject users with bad auth headers\n        // return _next.apply(null, arguments)\n        // swallow error, user remains unauthorized\n        // set remoteUserError to indicate that user was attempting authentication\n        if (err) {\n          req.remote_user.error = err.message;\n        }\n\n        return _next() as unknown as NextFunction;\n      };\n\n      // FUTURE: disabled, not removed yet but seems unreacable code\n      // if (this._isRemoteUserValid(req.remote_user)) {\n      //   debug('jwt has a valid authentication header');\n      //   return next();\n      // }\n\n      // in case auth header does not exist we return anonymous function\n      const remoteUser = createAnonymousRemoteUser();\n      req.remote_user = remoteUser;\n      res.locals.remote_user = remoteUser;\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        debug('jwt, authentication header is missing');\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        debug('api middleware authentication heather is invalid');\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n      const { secret, security } = this.config;\n\n      if (isAESLegacy(security)) {\n        debug('api middleware using legacy auth token');\n        this.handleAESMiddleware(req, security, secret, authorization, next);\n      } else {\n        debug('api middleware using JWT auth token');\n        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);\n      }\n    };\n  }\n\n  private handleJWTAPIMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: any\n  ): void {\n    debug('handle JWT api middleware');\n    const { scheme, token } = parseAuthTokenHeader(authorization);\n    if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n      debug('handle basic token');\n      // this should happen when client tries to login with an existing user\n      const credentials = convertPayloadToBase64(token).toString();\n      const parsedCredentials = parseBasicPayload(credentials);\n      if (!parsedCredentials) {\n        debug('invalid basic credentials format (missing colon separator)');\n        next(errorUtils.getBadRequest(API_ERROR.BAD_USERNAME_PASSWORD));\n        return;\n      }\n      const { user, password } = parsedCredentials as AESPayload;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err: VerdaccioError | null, user): void => {\n        if (!err) {\n          debug('generating a remote user');\n          req.remote_user = user;\n          next();\n        } else {\n          debug('generating anonymous user');\n          req.remote_user = createAnonymousRemoteUser();\n          next(err);\n        }\n      });\n    } else {\n      debug('handle jwt token');\n      const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n      if (credentials) {\n        // if the signature is valid we rely on it\n        req.remote_user = credentials;\n        debug('generating a remote user');\n        next();\n      } else {\n        // with JWT throw 401\n        debug('jwt invalid token');\n        next(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n      }\n    }\n  }\n\n  private handleAESMiddleware(\n    req: $RequestExtend,\n    security: Security,\n    secret: string,\n    authorization: string,\n    next: Function\n  ): void {\n    debug('handle legacy api middleware');\n    debug('api middleware has a secret? %o', typeof secret === 'string');\n    debug('api middleware authorization %o', typeof authorization === 'string');\n    const credentials: any = getMiddlewareCredentials(security, secret, authorization);\n    debug('api middleware credentials %o', credentials?.name);\n    if (credentials) {\n      const { user, password } = credentials;\n      debug('authenticating %o', user);\n      this.authenticate(user, password, (err, user): void => {\n        if (!err) {\n          req.remote_user = user;\n          debug('generating a remote user');\n          next();\n        } else {\n          req.remote_user = createAnonymousRemoteUser();\n          debug('generating anonymous user');\n          next(err);\n        }\n      });\n    } else {\n      // we force npm client to ask again with basic authentication\n      debug('legacy invalid header');\n      return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n    }\n  }\n\n  private _isRemoteUserValid(remote_user?: RemoteUser): boolean {\n    return isUndefined(remote_user) === false && isUndefined(remote_user?.name) === false;\n  }\n\n  /**\n   * JWT middleware for WebUI\n   */\n  public webUIJWTmiddleware() {\n    return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {\n      if (this._isRemoteUserValid(req.remote_user)) {\n        return _next();\n      }\n\n      req.pause();\n      const next = (err: VerdaccioError | void): void => {\n        req.resume();\n        if (err) {\n          req.remote_user.error = err.message;\n          res.status(err.statusCode).send(err.message);\n        }\n\n        return _next();\n      };\n\n      const { authorization } = req.headers;\n      if (isNil(authorization)) {\n        return next();\n      }\n\n      if (!isAuthHeaderValid(authorization)) {\n        return next(errorUtils.getBadRequest(API_ERROR.BAD_AUTH_HEADER));\n      }\n\n      const token = (authorization || '').replace(`${TOKEN_BEARER} `, '');\n      if (!token) {\n        return next();\n      }\n\n      let credentials: RemoteUser | undefined;\n      try {\n        credentials = verifyJWTPayload(token, this.config.secret, this.config.security);\n      } catch {\n        // FIXME: intended behaviour, do we want it?\n      }\n\n      if (this._isRemoteUserValid(credentials)) {\n        const { name, groups } = credentials as RemoteUser;\n        req.remote_user = createRemoteUser(name as string, groups);\n      } else {\n        req.remote_user = createAnonymousRemoteUser();\n      }\n\n      next();\n    };\n  }\n\n  public async jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string> {\n    const { real_groups, name, groups } = user;\n    debug('jwt encrypt %o', name);\n    const realGroupsValidated = isNil(real_groups) ? [] : real_groups;\n    const groupedGroups = isNil(groups)\n      ? real_groups\n      : Array.from(new Set([...groups.concat(realGroupsValidated)]));\n    const payload: RemoteUser = {\n      real_groups: realGroupsValidated,\n      name,\n      groups: groupedGroups,\n    };\n    const token: string = await signPayload(\n      payload,\n      this.secret,\n      signOptions as Parameters<typeof signPayload>[2]\n    );\n\n    return token;\n  }\n\n  /**\n   * Encrypt a string.\n   */\n  public aesEncrypt(value: string): string | void {\n    debug('signing with aes encryption');\n    const token = aesEncrypt(value, this.secret);\n    return token;\n  }\n}\n\nexport { Auth };\n"],"mappings":";;;;;;;;;AAiDA,IAAM,QAAQ,WAAW,iBAAiB;AAE1C,IAAM,OAAN,MAA+E;CAC7E;CACA;CACA;CACA;CACA;CAEA,YAAmB,QAAgB,QAAgB,UAAU,EAAE,oBAAoB,OAAO,EAAE;AAC1F,OAAK,SAAS;AACd,OAAK,SAAS,OAAO;AACrB,OAAK,SAAS;AACd,OAAK,UAAU,EAAE;AACjB,OAAK,UAAU;AACf,MAAI,CAAC,KAAK,OACR,OAAM,IAAI,UAAU,2DAA2D;;CAInF,MAAa,OAAO;EAClB,IAAI,UAAU,MAAM,KAAK,YAAY;AAErC,QAAM,yBAAyB,QAAQ,OAAO;AAG9C,MAAI,KAAK,OAAO,SAAS,SAAS,CAAC,WAAW,QAAQ,WAAW,GAC/D,WAAU,KAAK,mBAAmB;AAEpC,OAAK,UAAU;AAEf,OAAK,4BAA4B;;CAGnC,oBAA4B;AAC1B,QAAM,2BAA2B;EACjC,IAAI;AACJ,MAAI;AACF,gBAAa,IAAI,SACf,EAAE,MAAM,cAAc,EACtB;IACE,QAAQ,KAAK;IACb,QAAQ,KAAK;IACd,CACF;AACD,QAAK,OAAO,KACV;IAAE,MAAM;IAAsB,gBAAgB,gBAAgB;IAAgB,EAC9E,yDACD;WACM,OAAY;AACnB,SAAM,mDAAmD,MAAM;AAC/D,QAAK,OAAO,KAAK,EAAE,EAAE,gCAAgC;AACrD,UAAO,EAAE;;AAGX,SAAO,CAAC,WAAW;;CAGrB,MAAc,aAAa;AACzB,SAAO,gBACL,KAAK,OAAO,MACZ;GACE,QAAQ,KAAK;GACb,QAAQ,KAAK;GACd,EACD,YAAa,iBACb,KAAK,QAAQ,oBACb,KAAK,QAAQ,QAAQ,gBAAgB,eACrC,gBAAgB,eACjB;;CAGH,6BAA2C;AACzC,OAAK,QAAQ,KAAK,wBAAwB,KAAK,OAAO,CAAC;;CAGzD,eACE,UACA,UACA,aACA,IACM;EACN,MAAM,eAAe,OACnB,KAAK,UACJ,WAAW,OAAO,OAAO,mBAAmB,WAC9C;AAED,MAAI,QAAQ,aAAa,CACvB,QAAO,GAAG,WAAW,iBAAiB,eAAe,yBAAyB,CAAC;AAGjF,OAAK,MAAM,UAAU,aACnB,KAAI,MAAM,OAAO,IAAI,OAAO,OAAO,mBAAmB,YAAY;AAChE,SAAM,iEAAiE;AACvE;SACK;AACL,SAAM,4BAA4B,SAAS;AAC3C,UAAO,eAAgB,UAAU,UAAU,cAAc,KAAK,YAAkB;AAC9E,QAAI,KAAK;AACP,UAAK,OAAO,MACV;MAAE;MAAU;MAAK,EACjB;0EAED;AACD,YAAO,GAAG,IAAI;;AAGhB,UAAM,0CAA0C,SAAS;AACzD,WAAO,GAAG,MAAM,QAAQ;KACxB;;;CAKR,MAAa,gBAAgB,OAAe;AAE1C,UAAQ,IAAI,yCAAyC,MAAM;AAC3D,SAAO,QAAQ,SAAS;;CAG1B,aACE,UACA,UACA,IACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,GAAC,SAAS,OAAa;GACrB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,WAClC,QAAO,MAAM;AAGf,SAAM,qBAAqB,SAAS;AACpC,UAAO,aAAa,UAAU,UAAU,SAAU,KAA4B,QAAc;AAC1F,QAAI,KAAK;AACP,WAAM,gDAAgD,UAAU,KAAK,QAAQ;AAC7E,YAAO,GAAG,IAAI;;AAUhB,QAAI,CAAC,CAAC,UAAU,OAAO,WAAW,GAAG;AAEnC,SAAI,OAAO,WAAW,SACpB,OAAM,IAAI,UAAU,gDAAgD;AAGtE,SAAI,CAD0B,MAAM,QAAQ,OAAO,CAEjD,OAAM,IAAI,UAAU,UAAU,sBAAsB;AAGtD,WAAM,2DAA2D,UAAU,OAAO;AAClF,YAAO,GAAG,KAAK,iBAAiB,UAAU,OAAO,CAAC;;AAEpD,UAAM;KACN;MACA;;CAGN,SACE,MACA,UACA,IACM;EACN,MAAM,OAAO;EACb,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;AACrC,QAAM,eAAe,KAAK;AAE1B,GAAC,SAAS,OAAa;GACrB,IAAI,SAAS;GACb,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,OAAO,YAAY,eAAe,OAAO,OAAO,aAAa,YAAY;AAClF,aAAS;AACT,iBAAa,KAAK,aAAa,MAAM,UAAU;;AAGjD,OAAI,OAAO,OAAO,YAAY,WAC5B,OAAM;OAIN,QAAO,QACL,MACA,UACA,SAAU,KAA4B,IAA6B;AACjE,QAAI,KAAK;AACP,WAAM,6CAA6C,MAAM,KAAK,QAAQ;AACtE,YAAO,GAAG,IAAI;;AAEhB,QAAI,IAAI;AACN,WAAM,8BAA8B,KAAK;AACzC,YAAO,KAAK,aAAa,MAAM,UAAU,GAAG;;AAE9C,UAAM,oDAAoD;AAC1D,UAAM;KAET;MAED;;;;;CAMN,aACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,sDAAsD,KAAK,MAAM,YAAY;EAGnF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,UAAM,yCAAyC;AAC/C,WAAO,MAAM;;AAGf,UAAO,aAAa,MAAM,MAAM,KAA4B,OAAuB;AACjF,QAAI,KAAK;AACP,WAAM,+BAA+B,IAAI;AACzC,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,qBAAqB;AAC3B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,4CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,4CAA4C;AAClD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,4EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,gBACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,yDAAyD,KAAK,MAAM,YAAY;EAGtF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,UAAM,4CAA4C;AAClD,WAAO,MAAM;;AAGf,UAAO,gBAAgB,MAAM,MAAM,KAA4B,OAAuB;AACpF,QAAI,KAAK;AACP,WAAM,kCAAkC,IAAI;AAC5C,YAAO,SAAS,IAAI;;AAOtB,QAAI,MAAM,GAAG,KAAK,MAAM;AACtB,WAAM,2DAA2D,YAAY;AAC7E,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,0EACD;AACD,YAAO,KAAK,cAAc;MAAE;MAAa;MAAgB,EAAE,MAAM,SAAS;;AAG5E,QAAI,IAAI;AACN,WAAM,wBAAwB;AAC9B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,+CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,+CAA+C;AACrD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,+EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;;;;CAMf,cACE,EAAE,aAAa,kBACf,MACA,UACM;EACN,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,MAAM,OAAO,OACjB;GAAE,MAAM;GAAa,SAAS;GAAgB,EAC9C,UAAU,uBAAuB,aAAa,KAAK,OAAO,SAAS,CACpE;AAED,QAAM,uDAAuD,KAAK,MAAM,YAAY;EAGpF,MAAM,aAAmB;GACvB,MAAM,SAAS,QAAQ,OAAO;AAE9B,OAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,UAAM,0CAA0C;AAChD,WAAO,MAAM;;AAGf,UAAO,cAAc,MAAM,MAAM,KAA4B,OAAuB;AAClF,QAAI,KAAK;AACP,WAAM,gCAAgC,IAAI;AAC1C,YAAO,SAAS,IAAI;;AAGtB,QAAI,IAAI;AACN,WAAM,sBAAsB;AAC5B,UAAK,OAAO,MACV;MAAE,MAAM,KAAK;MAAM,MAAM,IAAI;MAAM,EACnC,6CACD;AACD,YAAO,SAAS,MAAM,GAAG;;AAI3B,UAAM,6CAA6C;AACnD,SAAK,OAAO,MACV;KAAE,MAAM,KAAK;KAAM,MAAM,IAAI;KAAM,EACnC,6EACD;AACD,WAAO,MAAM;KACb;;AAGJ,SAAO,MAAM;;CAGf,mBAA+B;AAC7B,QAAM,iBAAiB;EACvB,MAAM,UAAU,KAAK,QAAQ,MAAM,EAAE;EACrC,MAAM,UAAU;GAAE;GAA2B;GAAkB;AAC/D,OAAK,MAAM,UAAU,QACnB,KAAI,OAAO,iBACT,QAAO,OAAO,iBAAiB,QAAQ;AAI3C,UAAQ,KAAqB,KAAsB,UAAwB;AACzE,OAAI,OAAO;GACX,MAAM,OAAO,SAAU,KAAoC;AACzD,QAAI,QAAQ;AAKZ,QAAI,IACF,KAAI,YAAY,QAAQ,IAAI;AAG9B,WAAO,OAAO;;GAUhB,MAAM,aAAa,2BAA2B;AAC9C,OAAI,cAAc;AAClB,OAAI,OAAO,cAAc;GAEzB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,MAAM,cAAc,EAAE;AACxB,UAAM,wCAAwC;AAC9C,WAAO,MAAM;;AAGf,OAAI,CAAC,kBAAkB,cAAc,EAAE;AACrC,UAAM,mDAAmD;AACzD,WAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;GAElE,MAAM,EAAE,QAAQ,aAAa,KAAK;AAElC,OAAI,YAAY,SAAS,EAAE;AACzB,UAAM,yCAAyC;AAC/C,SAAK,oBAAoB,KAAK,UAAU,QAAQ,eAAe,KAAK;UAC/D;AACL,UAAM,sCAAsC;AAC5C,SAAK,uBAAuB,KAAK,UAAU,QAAQ,eAAe,KAAK;;;;CAK7E,uBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,4BAA4B;EAClC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,cAAc;AAC7D,MAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,SAAM,qBAAqB;GAG3B,MAAM,oBAAoB,kBADN,uBAAuB,MAAM,CAAC,UAAU,CACJ;AACxD,OAAI,CAAC,mBAAmB;AACtB,UAAM,6DAA6D;AACnE,SAAK,WAAW,cAAc,UAAU,sBAAsB,CAAC;AAC/D;;GAEF,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAA4B,SAAe;AAC5E,QAAI,CAAC,KAAK;AACR,WAAM,2BAA2B;AACjC,SAAI,cAAc;AAClB,WAAM;WACD;AACL,WAAM,4BAA4B;AAClC,SAAI,cAAc,2BAA2B;AAC7C,UAAK,IAAI;;KAEX;SACG;AACL,SAAM,mBAAmB;GACzB,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,OAAI,aAAa;AAEf,QAAI,cAAc;AAClB,UAAM,2BAA2B;AACjC,UAAM;UACD;AAEL,UAAM,oBAAoB;AAC1B,SAAK,WAAW,aAAa,UAAU,sBAAsB,CAAC;;;;CAKpE,oBACE,KACA,UACA,QACA,eACA,MACM;AACN,QAAM,+BAA+B;AACrC,QAAM,mCAAmC,OAAO,WAAW,SAAS;AACpE,QAAM,mCAAmC,OAAO,kBAAkB,SAAS;EAC3E,MAAM,cAAmB,yBAAyB,UAAU,QAAQ,cAAc;AAClF,QAAM,iCAAiC,aAAa,KAAK;AACzD,MAAI,aAAa;GACf,MAAM,EAAE,MAAM,aAAa;AAC3B,SAAM,qBAAqB,KAAK;AAChC,QAAK,aAAa,MAAM,WAAW,KAAK,SAAe;AACrD,QAAI,CAAC,KAAK;AACR,SAAI,cAAc;AAClB,WAAM,2BAA2B;AACjC,WAAM;WACD;AACL,SAAI,cAAc,2BAA2B;AAC7C,WAAM,4BAA4B;AAClC,UAAK,IAAI;;KAEX;SACG;AAEL,SAAM,wBAAwB;AAC9B,UAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;;;CAIpE,mBAA2B,aAAmC;AAC5D,SAAO,YAAY,YAAY,KAAK,SAAS,YAAY,aAAa,KAAK,KAAK;;;;;CAMlF,qBAA4B;AAC1B,UAAQ,KAAqB,KAAsB,UAA8B;AAC/E,OAAI,KAAK,mBAAmB,IAAI,YAAY,CAC1C,QAAO,OAAO;AAGhB,OAAI,OAAO;GACX,MAAM,QAAQ,QAAqC;AACjD,QAAI,QAAQ;AACZ,QAAI,KAAK;AACP,SAAI,YAAY,QAAQ,IAAI;AAC5B,SAAI,OAAO,IAAI,WAAW,CAAC,KAAK,IAAI,QAAQ;;AAG9C,WAAO,OAAO;;GAGhB,MAAM,EAAE,kBAAkB,IAAI;AAC9B,OAAI,MAAM,cAAc,CACtB,QAAO,MAAM;AAGf,OAAI,CAAC,kBAAkB,cAAc,CACnC,QAAO,KAAK,WAAW,cAAc,UAAU,gBAAgB,CAAC;GAGlE,MAAM,SAAS,iBAAiB,IAAI,QAAQ,GAAG,aAAa,IAAI,GAAG;AACnE,OAAI,CAAC,MACH,QAAO,MAAM;GAGf,IAAI;AACJ,OAAI;AACF,kBAAc,iBAAiB,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,SAAS;WACzE;AAIR,OAAI,KAAK,mBAAmB,YAAY,EAAE;IACxC,MAAM,EAAE,MAAM,WAAW;AACzB,QAAI,cAAc,iBAAiB,MAAgB,OAAO;SAE1D,KAAI,cAAc,2BAA2B;AAG/C,SAAM;;;CAIV,MAAa,WAAW,MAAkB,aAA8C;EACtF,MAAM,EAAE,aAAa,MAAM,WAAW;AACtC,QAAM,kBAAkB,KAAK;EAC7B,MAAM,sBAAsB,MAAM,YAAY,GAAG,EAAE,GAAG;AAetD,SANsB,MAAM,YALA;GAC1B,aAAa;GACb;GACA,QANoB,MAAM,OAAO,GAC/B,cACA,MAAM,KAAK,IAAI,IAAI,CAAC,GAAG,OAAO,OAAO,oBAAoB,CAAC,CAAC,CAAC;GAK/D,EAGC,KAAK,QACL,YACD;;;;;CAQH,WAAkB,OAA8B;AAC9C,QAAM,8BAA8B;AAEpC,SADc,WAAW,OAAO,KAAK,OAAO"}

package/build/utils.js

@@ -1,8 +1,7 @@
 const require_runtime = require("./_virtual/_rolldown/runtime.js");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug);
-let lodash = require("lodash");
-lodash = require_runtime.__toESM(lodash);
+let lodash_es = require("lodash-es");
 let _verdaccio_config = require("@verdaccio/config");
 let _verdaccio_core = require("@verdaccio/core");
 let _verdaccio_signature = require("@verdaccio/signature");
@@ -27,16 +26,7 @@ function parseAESCredentials(authorizationHeader, secret) {
 		return convertPayloadToBase64(token).toString();
 	} else if (scheme.toUpperCase() === _verdaccio_core.TOKEN_BEARER.toUpperCase()) {
 		debug$1("legacy header bearer");
-		debug$1("secret length %o", secret.length);
-		const isLegacyUnsecure = secret.length > 32;
-		debug$1("is legacy unsecure %o", isLegacyUnsecure);
-		if (isLegacyUnsecure) {
-			debug$1("legacy unsecure enabled");
-			return (0, _verdaccio_signature.aesDecryptDeprecated)(convertPayloadToBase64(token), secret).toString("utf-8");
-		} else {
-			debug$1("legacy secure enabled");
-			return (0, _verdaccio_signature.aesDecrypt)(token.toString(), secret);
-		}
+		return (0, _verdaccio_signature.aesDecrypt)(token.toString(), secret);
 	}
 }
 function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
@@ -57,11 +47,11 @@ function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
 	}
 	const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
 	debug$1("is jwt");
-	if (lodash.default.isString(token) && scheme.toUpperCase() === _verdaccio_core.TOKEN_BEARER.toUpperCase()) return verifyJWTPayload(token, secretKey, security);
+	if (typeof token === "string" && scheme.toUpperCase() === _verdaccio_core.TOKEN_BEARER.toUpperCase()) return verifyJWTPayload(token, secretKey, security);
 }
 function isAESLegacy(security) {
 	const { legacy, jwt } = security.api;
-	return lodash.default.isNil(legacy) === false && lodash.default.isNil(jwt) && legacy === true;
+	return (0, lodash_es.isNil)(legacy) === false && (0, lodash_es.isNil)(jwt) && legacy === true;
 }
 async function getApiToken(auth, config, remoteUser, aesPassword) {
 	debug$1("get api token");

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport {\n  aesDecrypt,\n  aesDecryptDeprecated,\n  parseBasicPayload,\n  verifyPayload,\n} from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    debug('secret length %o', secret.length);\n    const isLegacyUnsecure = secret.length > 32;\n    debug('is legacy unsecure %o', isLegacyUnsecure);\n    if (isLegacyUnsecure) {\n      debug('legacy unsecure enabled');\n      return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');\n    } else {\n      debug('legacy secure enabled');\n      return aesDecrypt(token.toString(), secret);\n    }\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;;AAuBA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;;;;;AAMhD,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,IAAI;AAG5C,QAAO;EAAE;EAAQ;EAAO;;AAG1B,SAAgB,oBAAoB,qBAA6B,QAAgB;AAC/E,SAAM,2BAA2B;CACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAInE,KAAI,OAAO,aAAa,KAAK,gBAAA,YAAY,aAAa,EAAE;AACtD,UAAM,sBAAsB;AAG5B,SAFoB,uBAAuB,MAAM,CAAC,UAAU;YAGnD,OAAO,aAAa,KAAK,gBAAA,aAAa,aAAa,EAAE;AAC9D,UAAM,uBAAuB;AAC7B,UAAM,oBAAoB,OAAO,OAAO;EACxC,MAAM,mBAAmB,OAAO,SAAS;AACzC,UAAM,yBAAyB,iBAAiB;AAChD,MAAI,kBAAkB;AACpB,WAAM,0BAA0B;AAChC,WAAA,GAAA,qBAAA,sBAA4B,uBAAuB,MAAM,EAAE,OAAO,CAAC,SAAS,QAAQ;SAC/E;AACL,WAAM,wBAAwB;AAC9B,WAAA,GAAA,qBAAA,YAAkB,MAAM,UAAU,EAAE,OAAO;;;;AAKjD,SAAgB,yBACd,UACA,WACA,qBACuB;AACvB,SAAM,gCAAgC;AAEtC,KAAI,YAAY,SAAS,EAAE;AACzB,UAAM,YAAY;EAClB,MAAM,cAAc,oBAAoB,qBAAqB,UAAU;AACvE,MAAI,CAAC,aAAa;AAChB,WAAM,kCAAkC;AACxC;;EAGF,MAAM,qBAAA,GAAA,qBAAA,mBAAsC,YAAY;AACxD,MAAI,CAAC,mBAAmB;AACtB,WAAM,gDAAgD;AACtD;;AAGF,SAAO;;CAET,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAEnE,SAAM,SAAS;AACf,KAAI,OAAA,QAAE,SAAS,MAAM,IAAI,OAAO,aAAa,KAAK,gBAAA,aAAa,aAAa,CAC1E,QAAO,iBAAiB,OAAO,WAAW,SAAS;;AAIvD,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;AAEjC,QAAO,OAAA,QAAE,MAAM,OAAO,KAAK,SAAS,OAAA,QAAE,MAAM,IAAI,IAAI,WAAW;;AAGjE,eAAsB,YACpB,MACA,QACA,YACA,aACwB;AACxB,SAAM,gBAAgB;CACtB,MAAM,EAAE,aAAa;AAErB,KAAI,YAAY,SAAS,EAAE;AACzB,UAAM,0BAA0B;AAEhC,SAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,WAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;IAC3E;;CAEJ,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,KAAK,KACP,QAAO,MAAM,KAAK,WAAW,YAAY,IAAI,KAAK;AAEpD,QAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,UAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;GAC3E;;AAGJ,IAAa,gBAA0B,CAAC,qBAAqB,oBAAoB;AAEjF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;AAC9F,KAAI;AAOF,UAAA,GAAA,qBAAA,eALE,OACA,QACA,UAAU,KAAK,KAAK,OACrB;UAGM,OAAY;AAEnB,MAAI,cAAc,SAAS,MAAM,KAAK,CAIpC,SAAA,GAAA,kBAAA,4BAAkC;AAEpC,QAAM,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,MAAM,QAAQ;;;AAIrE,SAAgB,kBAAkB,eAAgC;AAChE,QAAO,cAAc,MAAM,IAAI,CAAC,WAAW;;;;;;;AAQ7C,SAAgB,wBAAwB,QAA0C;AAChF,QAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;AACjF,WAAM,wCAAwC;AAC9C,MAAG,gBAAA,WAAW,aAAa,gBAAA,UAAU,sBAAsB,CAAC;;EAG9D,QAAQ,OAAe,WAAmB,IAAwC;AAChF,WAAM,mCAAmC;AAGzC,MAAG,MAAM,KAAK;;EAIhB,cAAc,aAAa,UAAU,OAAO;EAE5C,eAAe,aAAa,WAAW,OAAO;EAC9C,iBAAiB,uBAAuB,OAAO;EAChD;;AAGH,SAAgB,aAAa,QAAwB,QAA6B;AAChF,QAAO,SAAS,oBACd,MACA,KACA,UACM;AACN,SAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,uCAAuC;EAC3E,MAAM,EAAE,MAAM,WAAW;AACzB,UAAM,kCAAgC,QAAQ,OAAO;EACrD,MAAM,cAAc,IAAI;AACxB,UAAM,uCAAqC,QAAQ,YAAY;EAC/D,MAAM,gBAAgB,YAAY,MAAM,UAAU;AAChD,UAAO,SAAS,SAAS,OAAO,SAAS,MAAM;IAC/C;AACF,UAAM,wCAAoC,MAAM,cAAc;AAC9D,SAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;GAAa,EACpE,gGACD;AAED,MAAI,eAAe;AACjB,UAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,kDAAkD;AACtF,UAAO,SAAS,MAAM,KAAK;;AAG7B,MAAI,KACF,UACE,gBAAA,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,OAAO,CACxF;MAED,UACE,gBAAA,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,OAAO,CACtF;;;;;;AAQP,SAAgB,uBAAuB,QAAqB;AAC1D,QAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;AACzC,UAAM,oCAAoC,mBAAmB;EAC7D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;AAC3F,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAW,EAC9C,sEACD;AAED,MAAI,sBAAsB,cAAc,MACtC,QAAO,SAAS,MAAM,KAAA,EAAU;AAGlC,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;GAAW,EACtD,8EACD;AACD,SAAO,aAAa,QAAQ,OAAO,CAAC,MAAM,KAAK,SAAS;;;AAI5D,SAAgB,UAAU,MAAc,UAA0B;AAChE,QAAO,OAAO,GAAG,KAAK,GAAG,WAAW;;AAGtC,SAAgB,uBAAuB,SAAyB;AAC9D,QAAO,OAAO,KAAK,SAAS,SAAS"}
+{"version":3,"file":"utils.js","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (typeof token === 'string' && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return isNil(legacy) === false && isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;;;AAkBA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;;;;;AAMhD,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,IAAI;AAG5C,QAAO;EAAE;EAAQ;EAAO;;AAG1B,SAAgB,oBAAoB,qBAA6B,QAAgB;AAC/E,SAAM,2BAA2B;CACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAInE,KAAI,OAAO,aAAa,KAAK,gBAAA,YAAY,aAAa,EAAE;AACtD,UAAM,sBAAsB;AAG5B,SAFoB,uBAAuB,MAAM,CAAC,UAAU;YAGnD,OAAO,aAAa,KAAK,gBAAA,aAAa,aAAa,EAAE;AAC9D,UAAM,uBAAuB;AAC7B,UAAA,GAAA,qBAAA,YAAkB,MAAM,UAAU,EAAE,OAAO;;;AAI/C,SAAgB,yBACd,UACA,WACA,qBACuB;AACvB,SAAM,gCAAgC;AAEtC,KAAI,YAAY,SAAS,EAAE;AACzB,UAAM,YAAY;EAClB,MAAM,cAAc,oBAAoB,qBAAqB,UAAU;AACvE,MAAI,CAAC,aAAa;AAChB,WAAM,kCAAkC;AACxC;;EAGF,MAAM,qBAAA,GAAA,qBAAA,mBAAsC,YAAY;AACxD,MAAI,CAAC,mBAAmB;AACtB,WAAM,gDAAgD;AACtD;;AAGF,SAAO;;CAET,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAEnE,SAAM,SAAS;AACf,KAAI,OAAO,UAAU,YAAY,OAAO,aAAa,KAAK,gBAAA,aAAa,aAAa,CAClF,QAAO,iBAAiB,OAAO,WAAW,SAAS;;AAIvD,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;AAEjC,SAAA,GAAA,UAAA,OAAa,OAAO,KAAK,UAAA,GAAA,UAAA,OAAe,IAAI,IAAI,WAAW;;AAG7D,eAAsB,YACpB,MACA,QACA,YACA,aACwB;AACxB,SAAM,gBAAgB;CACtB,MAAM,EAAE,aAAa;AAErB,KAAI,YAAY,SAAS,EAAE;AACzB,UAAM,0BAA0B;AAEhC,SAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,WAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;IAC3E;;CAEJ,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,KAAK,KACP,QAAO,MAAM,KAAK,WAAW,YAAY,IAAI,KAAK;AAEpD,QAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,UAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;GAC3E;;AAGJ,IAAa,gBAA0B,CAAC,qBAAqB,oBAAoB;AAEjF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;AAC9F,KAAI;AAOF,UAAA,GAAA,qBAAA,eALE,OACA,QACA,UAAU,KAAK,KAAK,OACrB;UAGM,OAAY;AAEnB,MAAI,cAAc,SAAS,MAAM,KAAK,CAIpC,SAAA,GAAA,kBAAA,4BAAkC;AAEpC,QAAM,gBAAA,WAAW,QAAQ,gBAAA,YAAY,cAAc,MAAM,QAAQ;;;AAIrE,SAAgB,kBAAkB,eAAgC;AAChE,QAAO,cAAc,MAAM,IAAI,CAAC,WAAW;;;;;;;AAQ7C,SAAgB,wBAAwB,QAA0C;AAChF,QAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;AACjF,WAAM,wCAAwC;AAC9C,MAAG,gBAAA,WAAW,aAAa,gBAAA,UAAU,sBAAsB,CAAC;;EAG9D,QAAQ,OAAe,WAAmB,IAAwC;AAChF,WAAM,mCAAmC;AAGzC,MAAG,MAAM,KAAK;;EAIhB,cAAc,aAAa,UAAU,OAAO;EAE5C,eAAe,aAAa,WAAW,OAAO;EAC9C,iBAAiB,uBAAuB,OAAO;EAChD;;AAGH,SAAgB,aAAa,QAAwB,QAA6B;AAChF,QAAO,SAAS,oBACd,MACA,KACA,UACM;AACN,SAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,uCAAuC;EAC3E,MAAM,EAAE,MAAM,WAAW;AACzB,UAAM,kCAAgC,QAAQ,OAAO;EACrD,MAAM,cAAc,IAAI;AACxB,UAAM,uCAAqC,QAAQ,YAAY;EAC/D,MAAM,gBAAgB,YAAY,MAAM,UAAU;AAChD,UAAO,SAAS,SAAS,OAAO,SAAS,MAAM;IAC/C;AACF,UAAM,wCAAoC,MAAM,cAAc;AAC9D,SAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;GAAa,EACpE,gGACD;AAED,MAAI,eAAe;AACjB,UAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,kDAAkD;AACtF,UAAO,SAAS,MAAM,KAAK;;AAG7B,MAAI,KACF,UACE,gBAAA,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,OAAO,CACxF;MAED,UACE,gBAAA,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,OAAO,CACtF;;;;;;AAQP,SAAgB,uBAAuB,QAAqB;AAC1D,QAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;AACzC,UAAM,oCAAoC,mBAAmB;EAC7D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;AAC3F,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAW,EAC9C,sEACD;AAED,MAAI,sBAAsB,cAAc,MACtC,QAAO,SAAS,MAAM,KAAA,EAAU;AAGlC,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;GAAW,EACtD,8EACD;AACD,SAAO,aAAa,QAAQ,OAAO,CAAC,MAAM,KAAK,SAAS;;;AAI5D,SAAgB,UAAU,MAAc,UAA0B;AAChE,QAAO,OAAO,GAAG,KAAK,GAAG,WAAW;;AAGtC,SAAgB,uBAAuB,SAAyB;AAC9D,QAAO,OAAO,KAAK,SAAS,SAAS"}

package/build/utils.mjs

@@ -1,8 +1,8 @@
 import buildDebug from "debug";
-import _ from "lodash";
+import { isNil } from "lodash-es";
 import { createAnonymousRemoteUser } from "@verdaccio/config";
 import { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from "@verdaccio/core";
-import { aesDecrypt, aesDecryptDeprecated, parseBasicPayload, verifyPayload } from "@verdaccio/signature";
+import { aesDecrypt, parseBasicPayload, verifyPayload } from "@verdaccio/signature";
 //#region src/utils.ts
 var debug = buildDebug("verdaccio:auth:utils");
 /**
@@ -24,16 +24,7 @@ function parseAESCredentials(authorizationHeader, secret) {
 		return convertPayloadToBase64(token).toString();
 	} else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
 		debug("legacy header bearer");
-		debug("secret length %o", secret.length);
-		const isLegacyUnsecure = secret.length > 32;
-		debug("is legacy unsecure %o", isLegacyUnsecure);
-		if (isLegacyUnsecure) {
-			debug("legacy unsecure enabled");
-			return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString("utf-8");
-		} else {
-			debug("legacy secure enabled");
-			return aesDecrypt(token.toString(), secret);
-		}
+		return aesDecrypt(token.toString(), secret);
 	}
 }
 function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
@@ -54,11 +45,11 @@ function getMiddlewareCredentials(security, secretKey, authorizationHeader) {
 	}
 	const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
 	debug("is jwt");
-	if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) return verifyJWTPayload(token, secretKey, security);
+	if (typeof token === "string" && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) return verifyJWTPayload(token, secretKey, security);
 }
 function isAESLegacy(security) {
 	const { legacy, jwt } = security.api;
-	return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;
+	return isNil(legacy) === false && isNil(jwt) && legacy === true;
 }
 async function getApiToken(auth, config, remoteUser, aesPassword) {
 	debug("get api token");

package/build/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport {\n  aesDecrypt,\n  aesDecryptDeprecated,\n  parseBasicPayload,\n  verifyPayload,\n} from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    debug('secret length %o', secret.length);\n    const isLegacyUnsecure = secret.length > 32;\n    debug('is legacy unsecure %o', isLegacyUnsecure);\n    if (isLegacyUnsecure) {\n      debug('legacy unsecure enabled');\n      return aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');\n    } else {\n      debug('legacy secure enabled');\n      return aesDecrypt(token.toString(), secret);\n    }\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return _.isNil(legacy) === false && _.isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;AAuBA,IAAM,QAAQ,WAAW,uBAAuB;;;;;AAMhD,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,IAAI;AAG5C,QAAO;EAAE;EAAQ;EAAO;;AAG1B,SAAgB,oBAAoB,qBAA6B,QAAgB;AAC/E,OAAM,2BAA2B;CACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAInE,KAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,QAAM,sBAAsB;AAG5B,SAFoB,uBAAuB,MAAM,CAAC,UAAU;YAGnD,OAAO,aAAa,KAAK,aAAa,aAAa,EAAE;AAC9D,QAAM,uBAAuB;AAC7B,QAAM,oBAAoB,OAAO,OAAO;EACxC,MAAM,mBAAmB,OAAO,SAAS;AACzC,QAAM,yBAAyB,iBAAiB;AAChD,MAAI,kBAAkB;AACpB,SAAM,0BAA0B;AAChC,UAAO,qBAAqB,uBAAuB,MAAM,EAAE,OAAO,CAAC,SAAS,QAAQ;SAC/E;AACL,SAAM,wBAAwB;AAC9B,UAAO,WAAW,MAAM,UAAU,EAAE,OAAO;;;;AAKjD,SAAgB,yBACd,UACA,WACA,qBACuB;AACvB,OAAM,gCAAgC;AAEtC,KAAI,YAAY,SAAS,EAAE;AACzB,QAAM,YAAY;EAClB,MAAM,cAAc,oBAAoB,qBAAqB,UAAU;AACvE,MAAI,CAAC,aAAa;AAChB,SAAM,kCAAkC;AACxC;;EAGF,MAAM,oBAAoB,kBAAkB,YAAY;AACxD,MAAI,CAAC,mBAAmB;AACtB,SAAM,gDAAgD;AACtD;;AAGF,SAAO;;CAET,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAEnE,OAAM,SAAS;AACf,KAAI,EAAE,SAAS,MAAM,IAAI,OAAO,aAAa,KAAK,aAAa,aAAa,CAC1E,QAAO,iBAAiB,OAAO,WAAW,SAAS;;AAIvD,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;AAEjC,QAAO,EAAE,MAAM,OAAO,KAAK,SAAS,EAAE,MAAM,IAAI,IAAI,WAAW;;AAGjE,eAAsB,YACpB,MACA,QACA,YACA,aACwB;AACxB,OAAM,gBAAgB;CACtB,MAAM,EAAE,aAAa;AAErB,KAAI,YAAY,SAAS,EAAE;AACzB,QAAM,0BAA0B;AAEhC,SAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,WAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;IAC3E;;CAEJ,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,KAAK,KACP,QAAO,MAAM,KAAK,WAAW,YAAY,IAAI,KAAK;AAEpD,QAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,UAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;GAC3E;;AAGJ,IAAa,gBAA0B,CAAC,qBAAqB,oBAAoB;AAEjF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;AAC9F,KAAI;AAOF,SAN4B,cAC1B,OACA,QACA,UAAU,KAAK,KAAK,OACrB;UAGM,OAAY;AAEnB,MAAI,cAAc,SAAS,MAAM,KAAK,CAIpC,QAAO,2BAA2B;AAEpC,QAAM,WAAW,QAAQ,YAAY,cAAc,MAAM,QAAQ;;;AAIrE,SAAgB,kBAAkB,eAAgC;AAChE,QAAO,cAAc,MAAM,IAAI,CAAC,WAAW;;;;;;;AAQ7C,SAAgB,wBAAwB,QAA0C;AAChF,QAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;AACjF,SAAM,wCAAwC;AAC9C,MAAG,WAAW,aAAa,UAAU,sBAAsB,CAAC;;EAG9D,QAAQ,OAAe,WAAmB,IAAwC;AAChF,SAAM,mCAAmC;AAGzC,MAAG,MAAM,KAAK;;EAIhB,cAAc,aAAa,UAAU,OAAO;EAE5C,eAAe,aAAa,WAAW,OAAO;EAC9C,iBAAiB,uBAAuB,OAAO;EAChD;;AAGH,SAAgB,aAAa,QAAwB,QAA6B;AAChF,QAAO,SAAS,oBACd,MACA,KACA,UACM;AACN,SAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,uCAAuC;EAC3E,MAAM,EAAE,MAAM,WAAW;AACzB,QAAM,kCAAgC,QAAQ,OAAO;EACrD,MAAM,cAAc,IAAI;AACxB,QAAM,uCAAqC,QAAQ,YAAY;EAC/D,MAAM,gBAAgB,YAAY,MAAM,UAAU;AAChD,UAAO,SAAS,SAAS,OAAO,SAAS,MAAM;IAC/C;AACF,QAAM,wCAAoC,MAAM,cAAc;AAC9D,SAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;GAAa,EACpE,gGACD;AAED,MAAI,eAAe;AACjB,UAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,kDAAkD;AACtF,UAAO,SAAS,MAAM,KAAK;;AAG7B,MAAI,KACF,UACE,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,OAAO,CACxF;MAED,UACE,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,OAAO,CACtF;;;;;;AAQP,SAAgB,uBAAuB,QAAqB;AAC1D,QAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;AACzC,QAAM,oCAAoC,mBAAmB;EAC7D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;AAC3F,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAW,EAC9C,sEACD;AAED,MAAI,sBAAsB,cAAc,MACtC,QAAO,SAAS,MAAM,KAAA,EAAU;AAGlC,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;GAAW,EACtD,8EACD;AACD,SAAO,aAAa,QAAQ,OAAO,CAAC,MAAM,KAAK,SAAS;;;AAI5D,SAAgB,UAAU,MAAc,UAA0B;AAChE,QAAO,OAAO,GAAG,KAAK,GAAG,WAAW;;AAGtC,SAAgB,uBAAuB,SAAyB;AAC9D,QAAO,OAAO,KAAK,SAAS,SAAS"}
+{"version":3,"file":"utils.mjs","names":[],"sources":["../src/utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport type { pluginUtils } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, errorUtils } from '@verdaccio/core';\nimport { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';\nimport type { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';\n\nimport type {\n  ActionsAllowed,\n  AllowAction,\n  AllowActionCallback,\n  AuthMiddlewarePayload,\n  AuthTokenHeader,\n  TokenEncryption,\n} from './types';\n\nconst debug = buildDebug('verdaccio:auth:utils');\n\n/**\n * Split authentication header eg: Bearer [secret_token]\n * @param authorizationHeader auth token\n */\nexport function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHeader {\n  const parts = authorizationHeader.split(' ');\n  const [scheme, token] = parts;\n\n  return { scheme, token };\n}\n\nexport function parseAESCredentials(authorizationHeader: string, secret: string) {\n  debug('parseAESCredentials init');\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  // basic is deprecated and should not be enforced\n  // basic is currently being used for functional test\n  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {\n    debug('legacy header basic');\n    const credentials = convertPayloadToBase64(token).toString();\n\n    return credentials;\n  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    debug('legacy header bearer');\n    return aesDecrypt(token.toString(), secret);\n  }\n}\n\nexport function getMiddlewareCredentials(\n  security: Security,\n  secretKey: string,\n  authorizationHeader: string\n): AuthMiddlewarePayload {\n  debug('getMiddlewareCredentials init');\n  // comment out for debugging purposes\n  if (isAESLegacy(security)) {\n    debug('is legacy');\n    const credentials = parseAESCredentials(authorizationHeader, secretKey);\n    if (!credentials) {\n      debug('parse legacy credentials failed');\n      return;\n    }\n\n    const parsedCredentials = parseBasicPayload(credentials);\n    if (!parsedCredentials) {\n      debug('parse legacy basic payload credentials failed');\n      return;\n    }\n\n    return parsedCredentials;\n  }\n  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);\n\n  debug('is jwt');\n  if (typeof token === 'string' && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {\n    return verifyJWTPayload(token, secretKey, security);\n  }\n}\n\nexport function isAESLegacy(security: Security): boolean {\n  const { legacy, jwt } = security.api;\n\n  return isNil(legacy) === false && isNil(jwt) && legacy === true;\n}\n\nexport async function getApiToken(\n  auth: TokenEncryption,\n  config: Config,\n  remoteUser: RemoteUser,\n  aesPassword: string\n): Promise<string | void> {\n  debug('get api token');\n  const { security } = config;\n\n  if (isAESLegacy(security)) {\n    debug('security legacy enabled');\n    // fallback all goes to AES encryption\n    return await new Promise((resolve): void => {\n      resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n    });\n  }\n  const { jwt } = security.api;\n\n  if (jwt?.sign) {\n    return await auth.jwtEncrypt(remoteUser, jwt.sign);\n  }\n  return await new Promise((resolve): void => {\n    resolve(auth.aesEncrypt(buildUser(remoteUser.name as string, aesPassword)));\n  });\n}\n\nexport const expireReasons: string[] = ['JsonWebTokenError', 'TokenExpiredError'];\n\nexport function verifyJWTPayload(token: string, secret: string, security: Security): RemoteUser {\n  try {\n    const payload: RemoteUser = verifyPayload(\n      token,\n      secret,\n      security?.api?.jwt?.verify as Parameters<typeof verifyPayload>[2]\n    );\n\n    return payload;\n  } catch (error: any) {\n    // #168 this check should be removed as soon AES encrypt is removed.\n    if (expireReasons.includes(error.name)) {\n      // it might be possible the jwt configuration is enabled and\n      // old tokens fails still remains in usage, thus\n      // we return an anonymous user to force log in.\n      return createAnonymousRemoteUser();\n    }\n    throw errorUtils.getCode(HTTP_STATUS.UNAUTHORIZED, error.message);\n  }\n}\n\nexport function isAuthHeaderValid(authorization: string): boolean {\n  return authorization.split(' ').length === 2;\n}\n\n/**\n * Return a default configuration for authentication if none is provided.\n * @param logger {Logger}\n * @returns object of default implementations.\n */\nexport function getDefaultPluginMethods(logger: Logger): pluginUtils.Auth<Config> {\n  return {\n    authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {\n      debug('triggered default authenticate method');\n      cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));\n    },\n\n    adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {\n      debug('triggered default adduser method');\n      // since adduser is not implemented but optional, continue without error\n      // this assumes that the user is added by an external system\n      cb(null, true);\n    },\n\n    // @ts-ignore\n    allow_access: allow_action('access', logger),\n    // @ts-ignore\n    allow_publish: allow_action('publish', logger),\n    allow_unpublish: handleSpecialUnpublish(logger),\n  };\n}\n\nexport function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {\n  return function allowActionCallback(\n    user: RemoteUser,\n    pkg: AuthPackageAllow,\n    callback: AllowActionCallback\n  ): void {\n    logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);\n    const { name, groups } = user;\n    debug('allow_action \"%s\": groups %s', action, groups);\n    const groupAccess = pkg[action] as string[];\n    debug('allow_action \"%s\": groupAccess %s', action, groupAccess);\n    const hasPermission = groupAccess.some((group) => {\n      return name === group || groups.includes(group);\n    });\n    debug('package \"%s\" has permission \"%s\"', name, hasPermission);\n    logger.trace(\n      { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },\n      `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`\n    );\n\n    if (hasPermission) {\n      logger.trace({ remote: user.name }, `auth/allow_action: access granted to: @{remote}`);\n      return callback(null, true);\n    }\n\n    if (name) {\n      callback(\n        errorUtils.getForbidden(`user ${name} is not allowed to ${action} package ${pkg.name}`)\n      );\n    } else {\n      callback(\n        errorUtils.getUnauthorized(`authorization required to ${action} package ${pkg.name}`)\n      );\n    }\n  };\n}\n\n/**\n *\n */\nexport function handleSpecialUnpublish(logger: Logger): any {\n  return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {\n    const action = 'unpublish';\n    // verify whether the unpublish prop has been defined\n    const isUnpublishMissing: boolean = !pkg[action];\n    debug('is unpublish method missing ? %s', isUnpublishMissing);\n    const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;\n    logger.trace(\n      { user: user.name, name: pkg.name, hasGroups },\n      `fallback unpublish for @{name} has groups: @{hasGroups} for @{user}`\n    );\n\n    if (isUnpublishMissing || hasGroups === false) {\n      return callback(null, undefined);\n    }\n\n    logger.trace(\n      { user: user.name, name: pkg.name, action, hasGroups },\n      `allow_action for @{action} for @{name} has groups: @{hasGroups} for @{user}`\n    );\n    return allow_action(action, logger)(user, pkg, callback);\n  };\n}\n\nexport function buildUser(name: string, password: string): string {\n  return String(`${name}:${password}`);\n}\n\nexport function convertPayloadToBase64(payload: string): Buffer {\n  return Buffer.from(payload, 'base64');\n}\n"],"mappings":";;;;;;AAkBA,IAAM,QAAQ,WAAW,uBAAuB;;;;;AAMhD,SAAgB,qBAAqB,qBAA8C;CAEjF,MAAM,CAAC,QAAQ,SADD,oBAAoB,MAAM,IAAI;AAG5C,QAAO;EAAE;EAAQ;EAAO;;AAG1B,SAAgB,oBAAoB,qBAA6B,QAAgB;AAC/E,OAAM,2BAA2B;CACjC,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAInE,KAAI,OAAO,aAAa,KAAK,YAAY,aAAa,EAAE;AACtD,QAAM,sBAAsB;AAG5B,SAFoB,uBAAuB,MAAM,CAAC,UAAU;YAGnD,OAAO,aAAa,KAAK,aAAa,aAAa,EAAE;AAC9D,QAAM,uBAAuB;AAC7B,SAAO,WAAW,MAAM,UAAU,EAAE,OAAO;;;AAI/C,SAAgB,yBACd,UACA,WACA,qBACuB;AACvB,OAAM,gCAAgC;AAEtC,KAAI,YAAY,SAAS,EAAE;AACzB,QAAM,YAAY;EAClB,MAAM,cAAc,oBAAoB,qBAAqB,UAAU;AACvE,MAAI,CAAC,aAAa;AAChB,SAAM,kCAAkC;AACxC;;EAGF,MAAM,oBAAoB,kBAAkB,YAAY;AACxD,MAAI,CAAC,mBAAmB;AACtB,SAAM,gDAAgD;AACtD;;AAGF,SAAO;;CAET,MAAM,EAAE,QAAQ,UAAU,qBAAqB,oBAAoB;AAEnE,OAAM,SAAS;AACf,KAAI,OAAO,UAAU,YAAY,OAAO,aAAa,KAAK,aAAa,aAAa,CAClF,QAAO,iBAAiB,OAAO,WAAW,SAAS;;AAIvD,SAAgB,YAAY,UAA6B;CACvD,MAAM,EAAE,QAAQ,QAAQ,SAAS;AAEjC,QAAO,MAAM,OAAO,KAAK,SAAS,MAAM,IAAI,IAAI,WAAW;;AAG7D,eAAsB,YACpB,MACA,QACA,YACA,aACwB;AACxB,OAAM,gBAAgB;CACtB,MAAM,EAAE,aAAa;AAErB,KAAI,YAAY,SAAS,EAAE;AACzB,QAAM,0BAA0B;AAEhC,SAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,WAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;IAC3E;;CAEJ,MAAM,EAAE,QAAQ,SAAS;AAEzB,KAAI,KAAK,KACP,QAAO,MAAM,KAAK,WAAW,YAAY,IAAI,KAAK;AAEpD,QAAO,MAAM,IAAI,SAAS,YAAkB;AAC1C,UAAQ,KAAK,WAAW,UAAU,WAAW,MAAgB,YAAY,CAAC,CAAC;GAC3E;;AAGJ,IAAa,gBAA0B,CAAC,qBAAqB,oBAAoB;AAEjF,SAAgB,iBAAiB,OAAe,QAAgB,UAAgC;AAC9F,KAAI;AAOF,SAN4B,cAC1B,OACA,QACA,UAAU,KAAK,KAAK,OACrB;UAGM,OAAY;AAEnB,MAAI,cAAc,SAAS,MAAM,KAAK,CAIpC,QAAO,2BAA2B;AAEpC,QAAM,WAAW,QAAQ,YAAY,cAAc,MAAM,QAAQ;;;AAIrE,SAAgB,kBAAkB,eAAgC;AAChE,QAAO,cAAc,MAAM,IAAI,CAAC,WAAW;;;;;;;AAQ7C,SAAgB,wBAAwB,QAA0C;AAChF,QAAO;EACL,aAAa,OAAe,WAAmB,IAAoC;AACjF,SAAM,wCAAwC;AAC9C,MAAG,WAAW,aAAa,UAAU,sBAAsB,CAAC;;EAG9D,QAAQ,OAAe,WAAmB,IAAwC;AAChF,SAAM,mCAAmC;AAGzC,MAAG,MAAM,KAAK;;EAIhB,cAAc,aAAa,UAAU,OAAO;EAE5C,eAAe,aAAa,WAAW,OAAO;EAC9C,iBAAiB,uBAAuB,OAAO;EAChD;;AAGH,SAAgB,aAAa,QAAwB,QAA6B;AAChF,QAAO,SAAS,oBACd,MACA,KACA,UACM;AACN,SAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,uCAAuC;EAC3E,MAAM,EAAE,MAAM,WAAW;AACzB,QAAM,kCAAgC,QAAQ,OAAO;EACrD,MAAM,cAAc,IAAI;AACxB,QAAM,uCAAqC,QAAQ,YAAY;EAC/D,MAAM,gBAAgB,YAAY,MAAM,UAAU;AAChD,UAAO,SAAS,SAAS,OAAO,SAAS,MAAM;IAC/C;AACF,QAAM,wCAAoC,MAAM,cAAc;AAC9D,SAAO,MACL;GAAE,SAAS,IAAI;GAAM;GAAe,QAAQ,KAAK;GAAM;GAAa,EACpE,gGACD;AAED,MAAI,eAAe;AACjB,UAAO,MAAM,EAAE,QAAQ,KAAK,MAAM,EAAE,kDAAkD;AACtF,UAAO,SAAS,MAAM,KAAK;;AAG7B,MAAI,KACF,UACE,WAAW,aAAa,QAAQ,KAAK,qBAAqB,OAAO,WAAW,IAAI,OAAO,CACxF;MAED,UACE,WAAW,gBAAgB,6BAA6B,OAAO,WAAW,IAAI,OAAO,CACtF;;;;;;AAQP,SAAgB,uBAAuB,QAAqB;AAC1D,QAAO,SAAU,MAAkB,KAAuB,UAAqC;EAC7F,MAAM,SAAS;EAEf,MAAM,qBAA8B,CAAC,IAAI;AACzC,QAAM,oCAAoC,mBAAmB;EAC7D,MAAM,YAAqB,qBAAqB,QAAS,IAAI,QAAqB,SAAS;AAC3F,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAW,EAC9C,sEACD;AAED,MAAI,sBAAsB,cAAc,MACtC,QAAO,SAAS,MAAM,KAAA,EAAU;AAGlC,SAAO,MACL;GAAE,MAAM,KAAK;GAAM,MAAM,IAAI;GAAM;GAAQ;GAAW,EACtD,8EACD;AACD,SAAO,aAAa,QAAQ,OAAO,CAAC,MAAM,KAAK,SAAS;;;AAI5D,SAAgB,UAAU,MAAc,UAA0B;AAChE,QAAO,OAAO,GAAG,KAAK,GAAG,WAAW;;AAGtC,SAAgB,uBAAuB,SAAyB;AAC9D,QAAO,OAAO,KAAK,SAAS,SAAS"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "9.0.0-next-9.6",
+  "version": "9.0.0-next-9.8",
   "description": "Verdaccio Authentication",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -33,18 +33,20 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/config": "9.0.0-next-9.6",
-    "@verdaccio/core": "9.0.0-next-9.6",
-    "@verdaccio/loaders": "9.0.0-next-9.6",
-    "@verdaccio/signature": "9.0.0-next-9.6",
+    "@verdaccio/config": "9.0.0-next-9.8",
+    "@verdaccio/core": "9.0.0-next-9.8",
+    "@verdaccio/loaders": "9.0.0-next-9.8",
+    "@verdaccio/signature": "9.0.0-next-9.8",
     "debug": "4.4.3",
-    "lodash": "4.17.23",
-    "verdaccio-htpasswd": "14.0.0-next-9.6"
+    "lodash-es": "4.17.23",
+    "verdaccio-htpasswd": "14.0.0-next-9.8"
   },
   "devDependencies": {
-    "@verdaccio/middleware": "9.0.0-next-9.6",
-    "@verdaccio/types": "14.0.0-next-9.3",
-    "@verdaccio/logger": "9.0.0-next-9.6",
+    "@verdaccio/middleware": "9.0.0-next-9.8",
+    "@verdaccio/types": "14.0.0-next-9.4",
+    "@verdaccio/logger": "9.0.0-next-9.8",
+    "verdaccio-htpasswd": "14.0.0-next-9.8",
+    "@types/lodash-es": "4.17.12",
     "express": "5.2.1",
     "supertest": "7.1.4",
     "vitest": "4.1.0"