@verdaccio/config 7.0.0-next.4 → 7.0.0-next.5

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @verdaccio/config
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes
@@ -225,12 +237,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -1000,14 +1012,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

package/build/config.d.ts

@@ -32,6 +32,7 @@ declare class Config implements AppConfig {
     }, configOptions?: {
         forceEnhancedLegacySignature: boolean;
     });
+    getEnhancedLegacySignature(): boolean;
     getConfigPath(): string;
     /**
      * Check for package spec

package/build/config.js

@@ -39,7 +39,12 @@ class Config {
 
   // @ts-ignore
 
-  constructor(config, configOptions = {
+  constructor(config,
+  // forceEnhancedLegacySignature is a property that
+  // allows switch a new legacy aes signature token signature
+  // for older versions do not want to have this new signature model
+  // this property must be false
+  configOptions = {
     forceEnhancedLegacySignature: true
   }) {
     var _config$flags$searchR, _config$flags, _config$flags$changeP, _config$flags2;
@@ -107,6 +112,15 @@ class Config {
       this.server_id = (0, _utils.generateRandomHexString)(6);
     }
   }
+  getEnhancedLegacySignature() {
+    if (typeof (this === null || this === void 0 ? void 0 : this.security.enhancedLegacySignature) !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
   getConfigPath() {
     return this.configPath;
   }
@@ -124,7 +138,7 @@ class Config {
    * @secret external secret key
    */
   checkSecretKey(secret) {
-    var _this$secret;
+    var _this$security, _this$secret;
     debug('check secret key');
     if (typeof secret === 'string' && _lodash.default.isEmpty(secret) === false) {
       this.secret = secret;
@@ -133,20 +147,21 @@ class Config {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
-    //
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    debug('generating a new secret key');
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = (0, _token.generateRandomSecretKey)();
     } else {
-      this.secret = this.security.enhancedLegacySignature === true ? (0, _token.generateRandomSecretKey)() : (0, _utils.generateRandomHexString)(32);
-      // set this to false allow use old token signature and is not recommended
-      // only use for migration reasons, major release will remove this property and
-      // set it by default
-      if (this.security.enhancedLegacySignature === false) {
-        _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
-      }
+      debug('key generated with legacy signature user config');
+      this.secret = (0, _utils.generateRandomHexString)(32);
+    }
+    // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
+    // set it by default
+    if (((_this$security = this.security) === null || _this$security === void 0 ? void 0 : _this$security.enhancedLegacySignature) === false) {
+      _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
     }
-    debug('generated a new secret key %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
+    debug('generated a new secret key length %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
     return this.secret;
   }
 }

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$secret","isEmpty","generateRandomSecretKey","enhancedLegacySignature","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generate a new key');\n    //\n    if (this.configOptions.forceEnhancedLegacySignature) {\n      this.secret = generateRandomSecretKey();\n    } else {\n      this.secret =\n        this.security.enhancedLegacySignature === true\n          ? generateRandomSecretKey()\n          : generateRandomHexString(32);\n      // set this to false allow use old token signature and is not recommended\n      // only use for migration reasons, major release will remove this property and\n      // set it by default\n      if (this.security.enhancedLegacySignature === false) {\n        warningUtils.emit(Codes.VERWAR005);\n      }\n    }\n\n    debug('generated a new secret key %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C,EAC5CC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACjC,UAAU;EACxB;;EAEA;AACF;AACA;EACSkC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACR,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSS,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,YAAA;IAC7C3D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO0D,MAAM,KAAK,QAAQ,IAAI9B,eAAC,CAACgC,OAAO,CAACF,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB1D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO0D,MAAM;IACf;IACA;IACA;IACA1D,KAAK,CAAC,oBAAoB,CAAC;IAC3B;IACA,IAAI,IAAI,CAACU,aAAa,CAACC,4BAA4B,EAAE;MACnD,IAAI,CAAC+C,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACL,IAAI,CAACH,MAAM,GACT,IAAI,CAAC/B,QAAQ,CAACmC,uBAAuB,KAAK,IAAI,GAC1C,IAAAD,8BAAuB,EAAC,CAAC,GACzB,IAAAR,8BAAuB,EAAC,EAAE,CAAC;MACjC;MACA;MACA;MACA,IAAI,IAAI,CAAC1B,QAAQ,CAACmC,uBAAuB,KAAK,KAAK,EAAE;QACnDC,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;MACpC;IACF;IAEAlE,KAAK,CAAC,+BAA+B,GAAA2D,YAAA,GAAE,IAAI,CAACD,MAAM,cAAAC,YAAA,uBAAXA,YAAA,CAAaQ,MAAM,CAAC;IAC3D,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACvD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}
+{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getEnhancedLegacySignature","enhancedLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$security","_this$secret","isEmpty","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getEnhancedLegacySignature() {\n    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {\n      if (this.security.enhancedLegacySignature === true) {\n        return true;\n      }\n      return false;\n    }\n    return this.configOptions.forceEnhancedLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generating a new secret key');\n\n    if (this.getEnhancedLegacySignature()) {\n      debug('key generated with \"enhanced\" legacy signature user config');\n      this.secret = generateRandomSecretKey();\n    } else {\n      debug('key generated with legacy signature user config');\n      this.secret = generateRandomHexString(32);\n    }\n    // set this to false allow use old token signature and is not recommended\n    // only use for migration reasons, major release will remove this property and\n    // set it by default\n    if (this.security?.enhancedLegacySignature === false) {\n      warningUtils.emit(Codes.VERWAR005);\n    }\n\n    debug('generated a new secret key length %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,0BAA0BA,CAAA,EAAG;IAClC,IAAI,QAAO,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE3B,QAAQ,CAAC4B,uBAAuB,MAAK,WAAW,EAAE;MACjE,IAAI,IAAI,CAAC5B,QAAQ,CAAC4B,uBAAuB,KAAK,IAAI,EAAE;QAClD,OAAO,IAAI;MACb;MACA,OAAO,KAAK;IACd;IACA,OAAO,IAAI,CAAC7C,aAAa,CAACC,4BAA4B;EACxD;EAEO6C,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACnC,UAAU;EACxB;;EAEA;AACF;AACA;EACSoC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACV,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSW,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,cAAA,EAAAC,YAAA;IAC7C9D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO4D,MAAM,KAAK,QAAQ,IAAIhC,eAAC,CAACmC,OAAO,CAACH,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB5D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO4D,MAAM;IACf;IACA;IACA;IACA5D,KAAK,CAAC,6BAA6B,CAAC;IAEpC,IAAI,IAAI,CAACsD,0BAA0B,CAAC,CAAC,EAAE;MACrCtD,KAAK,CAAC,4DAA4D,CAAC;MACnE,IAAI,CAAC4D,MAAM,GAAG,IAAAI,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACLhE,KAAK,CAAC,iDAAiD,CAAC;MACxD,IAAI,CAAC4D,MAAM,GAAG,IAAAP,8BAAuB,EAAC,EAAE,CAAC;IAC3C;IACA;IACA;IACA;IACA,IAAI,EAAAQ,cAAA,OAAI,CAAClC,QAAQ,cAAAkC,cAAA,uBAAbA,cAAA,CAAeN,uBAAuB,MAAK,KAAK,EAAE;MACpDU,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;IACpC;IAEApE,KAAK,CAAC,sCAAsC,GAAA8D,YAAA,GAAE,IAAI,CAACF,MAAM,cAAAE,YAAA,uBAAXA,YAAA,CAAaO,MAAM,CAAC;IAClE,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACzD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,8 +29,8 @@
     "node": ">=12"
   },
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next.4",
-    "@verdaccio/utils": "7.0.0-next.4",
+    "@verdaccio/core": "7.0.0-next.5",
+    "@verdaccio/utils": "7.0.0-next.5",
     "debug": "4.3.4",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@types/minimatch": "5.1.2",
-    "@types/yup": "0.29.14"
+    "@types/yup": "0.32.0"
   },
   "funding": {
     "type": "opencollective",

package/src/config.ts

@@ -63,6 +63,10 @@ class Config implements AppConfig {
   private configOptions: { forceEnhancedLegacySignature: boolean };
   public constructor(
     config: ConfigYaml & { config_path: string },
+    // forceEnhancedLegacySignature is a property that
+    // allows switch a new legacy aes signature token signature
+    // for older versions do not want to have this new signature model
+    // this property must be false
     configOptions = { forceEnhancedLegacySignature: true }
   ) {
     const self = this;
@@ -131,6 +135,16 @@ class Config implements AppConfig {
     }
   }
 
+  public getEnhancedLegacySignature() {
+    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
+
   public getConfigPath() {
     return this.configPath;
   }
@@ -156,24 +170,23 @@ class Config implements AppConfig {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
-    //
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    debug('generating a new secret key');
+
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = generateRandomSecretKey();
     } else {
-      this.secret =
-        this.security.enhancedLegacySignature === true
-          ? generateRandomSecretKey()
-          : generateRandomHexString(32);
-      // set this to false allow use old token signature and is not recommended
-      // only use for migration reasons, major release will remove this property and
-      // set it by default
-      if (this.security.enhancedLegacySignature === false) {
-        warningUtils.emit(Codes.VERWAR005);
-      }
+      debug('key generated with legacy signature user config');
+      this.secret = generateRandomHexString(32);
+    }
+    // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
+    // set it by default
+    if (this.security?.enhancedLegacySignature === false) {
+      warningUtils.emit(Codes.VERWAR005);
     }
 
-    debug('generated a new secret key %s', this.secret?.length);
+    debug('generated a new secret key length %s', this.secret?.length);
     return this.secret;
   }
 }