@verdaccio/config 7.0.0-next-7.13 → 7.0.0-next-7.15

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @verdaccio/config
 
+## 7.0.0-next-7.15
+
+### Minor Changes
+
+- bd8703e: feat: add migrateToSecureLegacySignature and remove enhancedLegacySignature property
+
+### Patch Changes
+
+- Updated dependencies [bd8703e]
+  - @verdaccio/core@7.0.0-next-7.15
+  - @verdaccio/utils@7.0.0-next-7.15
+
+## 7.0.0-next-7.14
+
+### Patch Changes
+
+- @verdaccio/core@7.0.0-next-7.14
+- @verdaccio/utils@7.0.0-next-7.14
+
 ## 7.0.0-next-7.13
 
 ### Patch Changes

package/build/config.d.ts

@@ -4,6 +4,7 @@ export declare const defaultUserRateLimiting: {
     windowMs: number;
     max: number;
 };
+export declare function isNodeVersionGreaterThan21(): boolean;
 /**
  * Coordinates the application configuration
  */
@@ -23,23 +24,30 @@ declare class Config implements AppConfig {
     plugins: string | void | null;
     security: Security;
     serverSettings: ServerSettingsConf;
+    private configOverrideOptions;
     secret: string;
     flags: FlagsConfig;
     userRateLimit: RateLimit;
-    private configOptions;
     constructor(config: ConfigYaml & {
         config_path: string;
-    }, configOptions?: {
-        forceEnhancedLegacySignature: boolean;
+    }, configOverrideOptions?: {
+        forceMigrateToSecureLegacySignature: boolean;
     });
-    getEnhancedLegacySignature(): boolean;
+    getMigrateToSecureLegacySignature(): boolean;
     getConfigPath(): string;
     /**
      * Check for package spec
      */
     getMatchedPackagesSpec(pkgName: string): PackageAccess | void;
     /**
-     * Store or create whether receive a secret key
+     * Verify if the secret complies with the required structure
+     *  - If the secret is not provided, it will generate a new one
+     *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
+     *  - If the secret is provided:
+     *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
+     *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
+     *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
+     *      generated with the new signature model
      * @secret external secret key
      */
     checkSecretKey(secret?: string): string;

package/build/config.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.defaultUserRateLimiting = exports.WEB_TITLE = exports.Config = void 0;
+exports.isNodeVersionGreaterThan21 = isNodeVersionGreaterThan21;
 var _assert = _interopRequireDefault(require("assert"));
 var _debug = _interopRequireDefault(require("debug"));
 var _lodash = _interopRequireDefault(require("lodash"));
@@ -28,6 +29,11 @@ const defaultUserRateLimiting = exports.defaultUserRateLimiting = {
   // 15 minutes
   max: 1000
 };
+function isNodeVersionGreaterThan21() {
+  const [major, minor] = process.versions.node.split('.').map(Number);
+  return major > 21 || major === 21 && minor >= 0;
+}
+const TOKEN_VALID_LENGTH = 32;
 
 /**
  * Coordinates the application configuration
@@ -44,12 +50,11 @@ class Config {
   // allows switch a new legacy aes signature token signature
   // for older versions do not want to have this new signature model
   // this property must be false
-  configOptions = {
-    forceEnhancedLegacySignature: true
+  configOverrideOptions = {
+    forceMigrateToSecureLegacySignature: true
   }) {
     var _config$flags$searchR, _config$flags, _config$flags$changeP, _config$flags2;
     const self = this;
-    this.configOptions = configOptions;
     this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
     if (!config.configPath) {
       var _config$config_path;
@@ -60,11 +65,18 @@ class Config {
         throw new Error('configPath property is required');
       }
     }
+    this.configOverrideOptions = configOverrideOptions;
     this.configPath = config.configPath;
     this.self_path = this.configPath;
     debug('config path: %s', this.configPath);
     this.plugins = config.plugins;
-    this.security = _lodash.default.merge(_security.defaultSecurity, config.security);
+    this.security = _lodash.default.merge(
+    // override the default security configuration via constructor
+    _lodash.default.merge(_security.defaultSecurity, {
+      api: {
+        migrateToSecureLegacySignature: this.configOverrideOptions.forceMigrateToSecureLegacySignature
+      }
+    }), config.security);
     this.serverSettings = _serverSettings.default;
     this.flags = {
       searchRemote: (_config$flags$searchR = (_config$flags = config.flags) === null || _config$flags === void 0 ? void 0 : _config$flags.searchRemote) !== null && _config$flags$searchR !== void 0 ? _config$flags$searchR : true,
@@ -112,14 +124,8 @@ class Config {
       this.server_id = (0, _utils.generateRandomHexString)(6);
     }
   }
-  getEnhancedLegacySignature() {
-    if (typeof (this === null || this === void 0 ? void 0 : this.security.enhancedLegacySignature) !== 'undefined') {
-      if (this.security.enhancedLegacySignature === true) {
-        return true;
-      }
-      return false;
-    }
-    return this.configOptions.forceEnhancedLegacySignature;
+  getMigrateToSecureLegacySignature() {
+    return this.security.api.migrateToSecureLegacySignature;
   }
   getConfigPath() {
     return this.configPath;
@@ -134,35 +140,65 @@ class Config {
   }
 
   /**
-   * Store or create whether receive a secret key
+   * Verify if the secret complies with the required structure
+   *  - If the secret is not provided, it will generate a new one
+   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
+   *  - If the secret is provided:
+   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
+   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
+   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
+   *      generated with the new signature model
    * @secret external secret key
    */
   checkSecretKey(secret) {
-    var _this$security, _this$secret;
-    debug('check secret key');
+    debug('checking secret key init');
     if (typeof secret === 'string' && _lodash.default.isEmpty(secret) === false) {
+      debug('checking secret key length %s', secret.length);
+      if (secret.length > TOKEN_VALID_LENGTH) {
+        if (isNodeVersionGreaterThan21()) {
+          debug('is node version greater than 21');
+          if (this.getMigrateToSecureLegacySignature() === true) {
+            this.secret = (0, _token.generateRandomSecretKey)();
+            debug('rewriting secret key with length %s', this.secret.length);
+            return this.secret;
+          }
+          // oops, user needs to generate a new secret key
+          debug('secret does not comply with the required length, current length  %d, application will fail on startup', secret.length);
+          throw new Error(`Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
+            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
+            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
+        } else {
+          debug('is node version lower than 22');
+          if (this.getMigrateToSecureLegacySignature() === true) {
+            this.secret = (0, _token.generateRandomSecretKey)();
+            debug('rewriting secret key with length %s', this.secret.length);
+            return this.secret;
+          }
+          debug('triggering deprecation warning for secret key length %s', secret.length);
+          // still using Node.js versions previous to 22, but we need to emit a deprecation warning
+          // deprecation warning, secret key is too long and must be 32
+          // this will be removed in the next major release and will produce an error
+          _core.warningUtils.emit(_warningUtils.Codes.VERWAR007);
+          this.secret = secret;
+          return this.secret;
+        }
+      } else if (secret.length === TOKEN_VALID_LENGTH) {
+        debug('detected valid secret key length %s', secret.length);
+        this.secret = secret;
+        return this.secret;
+      }
+      debug('reusing previous key with length %s', secret.length);
       this.secret = secret;
-      debug('reusing previous key');
-      return secret;
-    }
-    // generate a new a secret key
-    // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generating a new secret key');
-    if (this.getEnhancedLegacySignature()) {
-      debug('key generated with "enhanced" legacy signature user config');
-      this.secret = (0, _token.generateRandomSecretKey)();
+      return this.secret;
     } else {
-      debug('key generated with legacy signature user config');
-      this.secret = (0, _utils.generateRandomHexString)(32);
-    }
-    // set this to false allow use old token signature and is not recommended
-    // only use for migration reasons, major release will remove this property and
-    // set it by default
-    if (((_this$security = this.security) === null || _this$security === void 0 ? void 0 : _this$security.enhancedLegacySignature) === false) {
-      _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
+      var _this$secret;
+      // generate a new a secret key
+      // FUTURE: this might be an external secret key, perhaps within config file?
+      debug('generating a new secret key');
+      this.secret = (0, _token.generateRandomSecretKey)();
+      debug('generated a new secret key length %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
+      return this.secret;
     }
-    debug('generated a new secret key length %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
-    return this.secret;
   }
 }
 exports.Config = Config;

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getEnhancedLegacySignature","enhancedLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$security","_this$secret","isEmpty","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getEnhancedLegacySignature() {\n    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {\n      if (this.security.enhancedLegacySignature === true) {\n        return true;\n      }\n      return false;\n    }\n    return this.configOptions.forceEnhancedLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generating a new secret key');\n\n    if (this.getEnhancedLegacySignature()) {\n      debug('key generated with \"enhanced\" legacy signature user config');\n      this.secret = generateRandomSecretKey();\n    } else {\n      debug('key generated with legacy signature user config');\n      this.secret = generateRandomHexString(32);\n    }\n    // set this to false allow use old token signature and is not recommended\n    // only use for migration reasons, major release will remove this property and\n    // set it by default\n    if (this.security?.enhancedLegacySignature === false) {\n      warningUtils.emit(Codes.VERWAR005);\n    }\n\n    debug('generated a new secret key length %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,0BAA0BA,CAAA,EAAG;IAClC,IAAI,QAAO,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE3B,QAAQ,CAAC4B,uBAAuB,MAAK,WAAW,EAAE;MACjE,IAAI,IAAI,CAAC5B,QAAQ,CAAC4B,uBAAuB,KAAK,IAAI,EAAE;QAClD,OAAO,IAAI;MACb;MACA,OAAO,KAAK;IACd;IACA,OAAO,IAAI,CAAC7C,aAAa,CAACC,4BAA4B;EACxD;EAEO6C,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACnC,UAAU;EACxB;;EAEA;AACF;AACA;EACSoC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACV,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSW,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,cAAA,EAAAC,YAAA;IAC7C9D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO4D,MAAM,KAAK,QAAQ,IAAIhC,eAAC,CAACmC,OAAO,CAACH,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB5D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO4D,MAAM;IACf;IACA;IACA;IACA5D,KAAK,CAAC,6BAA6B,CAAC;IAEpC,IAAI,IAAI,CAACsD,0BAA0B,CAAC,CAAC,EAAE;MACrCtD,KAAK,CAAC,4DAA4D,CAAC;MACnE,IAAI,CAAC4D,MAAM,GAAG,IAAAI,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACLhE,KAAK,CAAC,iDAAiD,CAAC;MACxD,IAAI,CAAC4D,MAAM,GAAG,IAAAP,8BAAuB,EAAC,EAAE,CAAC;IAC3C;IACA;IACA;IACA;IACA,IAAI,EAAAQ,cAAA,OAAI,CAAClC,QAAQ,cAAAkC,cAAA,uBAAbA,cAAA,CAAeN,uBAAuB,MAAK,KAAK,EAAE;MACpDU,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;IACpC;IAEApE,KAAK,CAAC,sCAAsC,GAAA8D,YAAA,GAAE,IAAI,CAACF,MAAM,cAAAE,YAAA,uBAAXA,YAAA,CAAaO,MAAM,CAAC;IAClE,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACzD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}
+{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","isNodeVersionGreaterThan21","major","minor","process","versions","node","split","map","Number","TOKEN_VALID_LENGTH","Config","constructor","config","configOverrideOptions","forceMigrateToSecureLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","api","migrateToSecureLegacySignature","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getMigrateToSecureLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","isEmpty","length","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR007","_this$secret"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length > TOKEN_VALID_LENGTH) {\n        if (isNodeVersionGreaterThan21()) {\n          debug('is node version greater than 21');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          // oops, user needs to generate a new secret key\n          debug(\n            'secret does not comply with the required length, current length  %d, application will fail on startup',\n            secret.length\n          );\n          throw new Error(\n            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n          );\n        } else {\n          debug('is node version lower than 22');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          debug('triggering deprecation warning for secret key length %s', secret.length);\n          // still using Node.js versions previous to 22, but we need to emit a deprecation warning\n          // deprecation warning, secret key is too long and must be 32\n          // this will be removed in the next major release and will produce an error\n          warningUtils.emit(Codes.VERWAR007);\n          this.secret = secret;\n          return this.secret;\n        }\n      } else if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      debug('reusing previous key with length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;AAEM,SAASC,0BAA0BA,CAAA,EAAG;EAC3C,MAAM,CAACC,KAAK,EAAEC,KAAK,CAAC,GAAGC,OAAO,CAACC,QAAQ,CAACC,IAAI,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,GAAG,CAACC,MAAM,CAAC;EACnE,OAAOP,KAAK,GAAG,EAAE,IAAKA,KAAK,KAAK,EAAE,IAAIC,KAAK,IAAI,CAAE;AACnD;AAEA,MAAMO,kBAAkB,GAAG,EAAE;;AAE7B;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAQE;;EAIOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,qBAAqB,GAAG;IAAEC,mCAAmC,EAAE;EAAK,CAAC,EACrE;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACC,OAAO,GAAGjB,OAAO,CAACkB,GAAG,CAACC,sBAAsB,IAAIV,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACW,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAZ,MAAM,CAACW,UAAU,IAAAC,mBAAA,GAAGZ,MAAM,CAACa,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIZ,MAAM,CAACc,SAAS;MAC1D,IAAI,CAACd,MAAM,CAACW,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACd,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACU,UAAU,GAAGX,MAAM,CAACW,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChC9B,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC8B,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGhB,MAAM,CAACgB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK;IACrB;IACAD,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAE;MACvBC,GAAG,EAAE;QACHC,8BAA8B,EAC5B,IAAI,CAACrB,qBAAqB,CAACC;MAC/B;IACF,CAAC,CAAC,EACFF,MAAM,CAACiB,QACT,CAAC;IACD,IAAI,CAACM,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAAtB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACwB,KAAK,cAAApB,aAAA,uBAAZA,aAAA,CAAcqB,YAAY,cAAAtB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDuB,cAAc,GAAArB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACwB,KAAK,cAAAlB,cAAA,uBAAZA,cAAA,CAAcoB,cAAc,cAAArB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACsB,UAAU,GAAG3B,MAAM,CAAC2B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI5B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACqB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BrB,IAAI,CAACqB,UAAU,CAAC,GAAG5B,MAAM,CAAC4B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACA9C,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAAC8C,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAG7C,uBAAuB;MAAE,IAAGe,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE8B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACb,eAAC,CAACc,QAAQ,CAAChC,MAAM,CAAC,EAAEiC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACAvD,oBAAoB,CAACwD,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI7B,IAAI,CAAC6B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB7B,IAAI,CAAC6B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACzB,IAAI,CAAC6B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAAClC,IAAI,CAACiC,QAAQ,CAAC;;IAErD;IACA5D,gBAAgB,CAACuD,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAInC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACmC,OAAO,CAAC,GAAGnD,OAAO,CAACkB,GAAG,CAACiC,OAAO,CAAC,IAAInD,OAAO,CAACkB,GAAG,CAACiC,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,iCAAiCA,CAAA,EAAG;IACzC,OAAO,IAAI,CAAC7B,QAAQ,CAACI,GAAG,CAACC,8BAA8B;EACzD;EAEOyB,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACpC,UAAU;EACxB;;EAEA;AACF;AACA;EACSqC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACT,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACSU,cAAcA,CAACC,MAAe,EAAU;IAC7CtE,KAAK,CAAC,0BAA0B,CAAC;IACjC,IAAI,OAAOsE,MAAM,KAAK,QAAQ,IAAIjC,eAAC,CAACkC,OAAO,CAACD,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7DtE,KAAK,CAAC,+BAA+B,EAAEsE,MAAM,CAACE,MAAM,CAAC;MACrD,IAAIF,MAAM,CAACE,MAAM,GAAGxD,kBAAkB,EAAE;QACtC,IAAIT,0BAA0B,CAAC,CAAC,EAAE;UAChCP,KAAK,CAAC,iCAAiC,CAAC;UACxC,IAAI,IAAI,CAACiE,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACK,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvCzE,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACsE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACA;UACAtE,KAAK,CACH,uGAAuG,EACvGsE,MAAM,CAACE,MACT,CAAC;UACD,MAAM,IAAItC,KAAK,CACZ,wEAAuEoC,MAAM,CAACE,MAAO;AAClG;AACA,kFACU,CAAC;QACH,CAAC,MAAM;UACLxE,KAAK,CAAC,+BAA+B,CAAC;UACtC,IAAI,IAAI,CAACiE,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACK,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvCzE,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACsE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACAtE,KAAK,CAAC,yDAAyD,EAAEsE,MAAM,CAACE,MAAM,CAAC;UAC/E;UACA;UACA;UACAE,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;UAClC,IAAI,CAACP,MAAM,GAAGA,MAAM;UACpB,OAAO,IAAI,CAACA,MAAM;QACpB;MACF,CAAC,MAAM,IAAIA,MAAM,CAACE,MAAM,KAAKxD,kBAAkB,EAAE;QAC/ChB,KAAK,CAAC,qCAAqC,EAAEsE,MAAM,CAACE,MAAM,CAAC;QAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;QACpB,OAAO,IAAI,CAACA,MAAM;MACpB;MACAtE,KAAK,CAAC,qCAAqC,EAAEsE,MAAM,CAACE,MAAM,CAAC;MAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;MACpB,OAAO,IAAI,CAACA,MAAM;IACpB,CAAC,MAAM;MAAA,IAAAQ,YAAA;MACL;MACA;MACA9E,KAAK,CAAC,6BAA6B,CAAC;MACpC,IAAI,CAACsE,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;MACvCzE,KAAK,CAAC,sCAAsC,GAAA8E,YAAA,GAAE,IAAI,CAACR,MAAM,cAAAQ,YAAA,uBAAXA,YAAA,CAAaN,MAAM,CAAC;MAElE,OAAO,IAAI,CAACF,MAAM;IACpB;EACF;AACF;AAACnE,OAAA,CAAAc,MAAA,GAAAA,MAAA"}

package/build/security.js

@@ -14,7 +14,8 @@ const defaultWebTokenOptions = {
   verify: {}
 };
 const defaultApiTokenConf = {
-  legacy: true
+  legacy: true,
+  migrateToSecureLegacySignature: true
 };
 const defaultSecurity = exports.defaultSecurity = {
   web: defaultWebTokenOptions,

package/build/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","names":["TIME_EXPIRATION_1H","exports","defaultWebTokenOptions","sign","expiresIn","verify","defaultApiTokenConf","legacy","defaultSecurity","web","api"],"sources":["../src/security.ts"],"sourcesContent":["import { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";;;;;;AAEA;AACO,MAAMA,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,IAAI;AAEtC,MAAME,sBAAkC,GAAG;EACzCC,IAAI,EAAE;IACJ;IACAC,SAAS,EAAEJ;EACb,CAAC;EACDK,MAAM,EAAE,CAAC;AACX,CAAC;AAED,MAAMC,mBAAoC,GAAG;EAC3CC,MAAM,EAAE;AACV,CAAC;AAEM,MAAMC,eAAyB,GAAAP,OAAA,CAAAO,eAAA,GAAG;EACvCC,GAAG,EAAEP,sBAAsB;EAC3BQ,GAAG,EAAEJ;AACP,CAAC"}
+{"version":3,"file":"security.js","names":["TIME_EXPIRATION_1H","exports","defaultWebTokenOptions","sign","expiresIn","verify","defaultApiTokenConf","legacy","migrateToSecureLegacySignature","defaultSecurity","web","api"],"sources":["../src/security.ts"],"sourcesContent":["import { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n  migrateToSecureLegacySignature: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";;;;;;AAEA;AACO,MAAMA,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,IAAI;AAEtC,MAAME,sBAAkC,GAAG;EACzCC,IAAI,EAAE;IACJ;IACAC,SAAS,EAAEJ;EACb,CAAC;EACDK,MAAM,EAAE,CAAC;AACX,CAAC;AAED,MAAMC,mBAAoC,GAAG;EAC3CC,MAAM,EAAE,IAAI;EACZC,8BAA8B,EAAE;AAClC,CAAC;AAEM,MAAMC,eAAyB,GAAAR,OAAA,CAAAQ,eAAA,GAAG;EACvCC,GAAG,EAAER,sBAAsB;EAC3BS,GAAG,EAAEL;AACP,CAAC"}

package/build/token.d.ts

@@ -1,5 +1,6 @@
 export declare const TOKEN_VALID_LENGTH = 32;
 /**
  * Secret key must have 32 characters.
+ * // TODO: code duplicated at @verdaccio/signature
  */
 export declare function generateRandomSecretKey(): string;

package/build/token.js

@@ -6,10 +6,12 @@ Object.defineProperty(exports, "__esModule", {
 exports.TOKEN_VALID_LENGTH = void 0;
 exports.generateRandomSecretKey = generateRandomSecretKey;
 var _crypto = require("crypto");
+// TODO: code duplicated at @verdaccio/signature
 const TOKEN_VALID_LENGTH = exports.TOKEN_VALID_LENGTH = 32;
 
 /**
  * Secret key must have 32 characters.
+ * // TODO: code duplicated at @verdaccio/signature
  */
 function generateRandomSecretKey() {
   return (0, _crypto.randomBytes)(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);

package/build/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["_crypto","require","TOKEN_VALID_LENGTH","exports","generateRandomSecretKey","randomBytes","toString","substring"],"sources":["../src/token.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Secret key must have 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACO,SAASE,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACH,kBAAkB,CAAC,CAACI,QAAQ,CAAC,QAAQ,CAAC,CAACC,SAAS,CAAC,CAAC,EAAEL,kBAAkB,CAAC;AAC5F"}
+{"version":3,"file":"token.js","names":["_crypto","require","TOKEN_VALID_LENGTH","exports","generateRandomSecretKey","randomBytes","toString","substring"],"sources":["../src/token.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\n\n// TODO: code duplicated at @verdaccio/signature\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Secret key must have 32 characters.\n * // TODO: code duplicated at @verdaccio/signature\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEA;AACO,MAAMC,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACA;AACO,SAASE,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACH,kBAAkB,CAAC,CAACI,QAAQ,CAAC,QAAQ,CAAC,CAACC,SAAS,CAAC,CAAC,EAAEL,kBAAkB,CAAC;AAC5F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "7.0.0-next-7.13",
+  "version": "7.0.0-next-7.15",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,8 +29,8 @@
     "node": ">=12"
   },
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next-7.13",
-    "@verdaccio/utils": "7.0.0-next-7.13",
+    "@verdaccio/core": "7.0.0-next-7.15",
+    "@verdaccio/utils": "7.0.0-next-7.15",
     "debug": "4.3.4",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",

package/src/config.ts

@@ -36,6 +36,13 @@ export const defaultUserRateLimiting = {
   max: 1000,
 };
 
+export function isNodeVersionGreaterThan21() {
+  const [major, minor] = process.versions.node.split('.').map(Number);
+  return major > 21 || (major === 21 && minor >= 0);
+}
+
+const TOKEN_VALID_LENGTH = 32;
+
 /**
  * Coordinates the application configuration
  */
@@ -56,21 +63,20 @@ class Config implements AppConfig {
   public plugins: string | void | null;
   public security: Security;
   public serverSettings: ServerSettingsConf;
+  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };
   // @ts-ignore
   public secret: string;
   public flags: FlagsConfig;
   public userRateLimit: RateLimit;
-  private configOptions: { forceEnhancedLegacySignature: boolean };
   public constructor(
     config: ConfigYaml & { config_path: string },
     // forceEnhancedLegacySignature is a property that
     // allows switch a new legacy aes signature token signature
     // for older versions do not want to have this new signature model
     // this property must be false
-    configOptions = { forceEnhancedLegacySignature: true }
+    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }
   ) {
     const self = this;
-    this.configOptions = configOptions;
     this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
     if (!config.configPath) {
       // backport self_path for previous to version 6
@@ -80,11 +86,21 @@ class Config implements AppConfig {
         throw new Error('configPath property is required');
       }
     }
+    this.configOverrideOptions = configOverrideOptions;
     this.configPath = config.configPath;
     this.self_path = this.configPath;
     debug('config path: %s', this.configPath);
     this.plugins = config.plugins;
-    this.security = _.merge(defaultSecurity, config.security);
+    this.security = _.merge(
+      // override the default security configuration via constructor
+      _.merge(defaultSecurity, {
+        api: {
+          migrateToSecureLegacySignature:
+            this.configOverrideOptions.forceMigrateToSecureLegacySignature,
+        },
+      }),
+      config.security
+    );
     this.serverSettings = serverSettings;
     this.flags = {
       searchRemote: config.flags?.searchRemote ?? true,
@@ -135,14 +151,8 @@ class Config implements AppConfig {
     }
   }
 
-  public getEnhancedLegacySignature() {
-    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {
-      if (this.security.enhancedLegacySignature === true) {
-        return true;
-      }
-      return false;
-    }
-    return this.configOptions.forceEnhancedLegacySignature;
+  public getMigrateToSecureLegacySignature() {
+    return this.security.api.migrateToSecureLegacySignature;
   }
 
   public getConfigPath() {
@@ -158,36 +168,70 @@ class Config implements AppConfig {
   }
 
   /**
-   * Store or create whether receive a secret key
+   * Verify if the secret complies with the required structure
+   *  - If the secret is not provided, it will generate a new one
+   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
+   *  - If the secret is provided:
+   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
+   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
+   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
+   *      generated with the new signature model
    * @secret external secret key
    */
   public checkSecretKey(secret?: string): string {
-    debug('check secret key');
+    debug('checking secret key init');
     if (typeof secret === 'string' && _.isEmpty(secret) === false) {
+      debug('checking secret key length %s', secret.length);
+      if (secret.length > TOKEN_VALID_LENGTH) {
+        if (isNodeVersionGreaterThan21()) {
+          debug('is node version greater than 21');
+          if (this.getMigrateToSecureLegacySignature() === true) {
+            this.secret = generateRandomSecretKey();
+            debug('rewriting secret key with length %s', this.secret.length);
+            return this.secret;
+          }
+          // oops, user needs to generate a new secret key
+          debug(
+            'secret does not comply with the required length, current length  %d, application will fail on startup',
+            secret.length
+          );
+          throw new Error(
+            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
+            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
+            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`
+          );
+        } else {
+          debug('is node version lower than 22');
+          if (this.getMigrateToSecureLegacySignature() === true) {
+            this.secret = generateRandomSecretKey();
+            debug('rewriting secret key with length %s', this.secret.length);
+            return this.secret;
+          }
+          debug('triggering deprecation warning for secret key length %s', secret.length);
+          // still using Node.js versions previous to 22, but we need to emit a deprecation warning
+          // deprecation warning, secret key is too long and must be 32
+          // this will be removed in the next major release and will produce an error
+          warningUtils.emit(Codes.VERWAR007);
+          this.secret = secret;
+          return this.secret;
+        }
+      } else if (secret.length === TOKEN_VALID_LENGTH) {
+        debug('detected valid secret key length %s', secret.length);
+        this.secret = secret;
+        return this.secret;
+      }
+      debug('reusing previous key with length %s', secret.length);
       this.secret = secret;
-      debug('reusing previous key');
-      return secret;
-    }
-    // generate a new a secret key
-    // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generating a new secret key');
-
-    if (this.getEnhancedLegacySignature()) {
-      debug('key generated with "enhanced" legacy signature user config');
-      this.secret = generateRandomSecretKey();
+      return this.secret;
     } else {
-      debug('key generated with legacy signature user config');
-      this.secret = generateRandomHexString(32);
-    }
-    // set this to false allow use old token signature and is not recommended
-    // only use for migration reasons, major release will remove this property and
-    // set it by default
-    if (this.security?.enhancedLegacySignature === false) {
-      warningUtils.emit(Codes.VERWAR005);
-    }
+      // generate a new a secret key
+      // FUTURE: this might be an external secret key, perhaps within config file?
+      debug('generating a new secret key');
+      this.secret = generateRandomSecretKey();
+      debug('generated a new secret key length %s', this.secret?.length);
 
-    debug('generated a new secret key length %s', this.secret?.length);
-    return this.secret;
+      return this.secret;
+    }
   }
 }
 

package/src/security.ts

@@ -13,6 +13,7 @@ const defaultWebTokenOptions: JWTOptions = {
 
 const defaultApiTokenConf: APITokenOptions = {
   legacy: true,
+  migrateToSecureLegacySignature: true,
 };
 
 export const defaultSecurity: Security = {

package/src/token.ts

@@ -1,9 +1,11 @@
 import { randomBytes } from 'crypto';
 
+// TODO: code duplicated at @verdaccio/signature
 export const TOKEN_VALID_LENGTH = 32;
 
 /**
  * Secret key must have 32 characters.
+ * // TODO: code duplicated at @verdaccio/signature
  */
 export function generateRandomSecretKey(): string {
   return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);

package/test/config.spec.ts

@@ -6,9 +6,12 @@ import {
   DEFAULT_REGISTRY,
   DEFAULT_UPLINK,
   ROLES,
+  TOKEN_VALID_LENGTH,
   WEB_TITLE,
   defaultSecurity,
+  generateRandomSecretKey,
   getDefaultConfig,
+  isNodeVersionGreaterThan21,
   parseConfigFile,
 } from '../src';
 import { parseConfigurationFile } from './utils';
@@ -19,6 +22,8 @@ const resolveConf = (conf) => {
   return path.join(__dirname, `../src/conf/${name}${ext.startsWith('.') ? ext : '.yaml'}`);
 };
 
+const itif = (condition) => (condition ? it : it.skip);
+
 const checkDefaultUplink = (config) => {
   expect(_.isObject(config.uplinks[DEFAULT_UPLINK])).toBeTruthy();
   expect(config.uplinks[DEFAULT_UPLINK].url).toMatch(DEFAULT_REGISTRY);
@@ -94,32 +99,85 @@ describe('check basic content parsed file', () => {
 describe('checkSecretKey', () => {
   test('with default.yaml and pre selected secret', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    expect(config.checkSecretKey('12345')).toEqual('12345');
+    expect(config.checkSecretKey(generateRandomSecretKey())).toHaveLength(TOKEN_VALID_LENGTH);
   });
 
   test('with default.yaml and void secret', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    expect(typeof config.checkSecretKey() === 'string').toBeTruthy();
+    const secret = config.checkSecretKey();
+    expect(typeof secret === 'string').toBeTruthy();
+    expect(secret).toHaveLength(TOKEN_VALID_LENGTH);
   });
 
-  test('with default.yaml and emtpy string secret', () => {
+  test('with default.yaml and empty string secret', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    expect(typeof config.checkSecretKey('') === 'string').toBeTruthy();
+    const secret = config.checkSecretKey('');
+    expect(typeof secret === 'string').toBeTruthy();
+    expect(secret).toHaveLength(TOKEN_VALID_LENGTH);
   });
 
-  test('with enhanced legacy signature', () => {
+  test('with default.yaml and valid string secret length', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    config.security.enhancedLegacySignature = true;
-    expect(typeof config.checkSecretKey() === 'string').toBeTruthy();
-    expect(config.secret.length).toBe(32);
+    expect(typeof config.checkSecretKey(generateRandomSecretKey()) === 'string').toBeTruthy();
+  });
+
+  test('with default.yaml migrate a valid string secret length', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')), {
+      forceMigrateToSecureLegacySignature: true,
+    });
+    expect(
+      // 64 characters secret long
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toHaveLength(TOKEN_VALID_LENGTH);
   });
 
-  test('without enhanced legacy signature', () => {
+  // only runs on Node.js 22 or higher
+  itif(isNodeVersionGreaterThan21())('with enhanced legacy signature Node 22 or higher', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')), {
+      forceMigrateToSecureLegacySignature: false,
+    });
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(() =>
+      // 64 characters secret long
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toThrow();
+  });
+
+  itif(isNodeVersionGreaterThan21())('with enhanced legacy signature Node 22 or higher', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')), {
+      forceMigrateToSecureLegacySignature: false,
+    });
+    config.security.api.migrateToSecureLegacySignature = true;
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toHaveLength(TOKEN_VALID_LENGTH);
+  });
+
+  itif(isNodeVersionGreaterThan21() === false)(
+    'with old unsecure legacy signature Node 21 or lower',
+    () => {
+      const config = new Config(parseConfigFile(resolveConf('default')));
+      config.security.api.migrateToSecureLegacySignature = false;
+      // 64 characters secret long
+      // eslint-disable-next-line jest/no-standalone-expect
+      expect(
+        config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+      ).toHaveLength(64);
+    }
+  );
+
+  test('with migration to new legacy signature Node 21 or lower', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    config.security.enhancedLegacySignature = false;
-    expect(typeof config.checkSecretKey() === 'string').toBeTruthy();
-    expect(config.secret.length).toBe(64);
+    config.security.api.migrateToSecureLegacySignature = true;
+    // 64 characters secret long
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toHaveLength(TOKEN_VALID_LENGTH);
   });
+
+  test.todo('test emit warning with secret key');
 });
 
 describe('getMatchedPackagesSpec', () => {