@verdaccio/config 7.0.0-next.4 → 7.0.0-next.6

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @verdaccio/config
 
+## 7.0.0-next.6
+
+### Patch Changes
+
+- 4d96324: chore(config): increase test coverage
+  - @verdaccio/core@7.0.0-next.6
+  - @verdaccio/utils@7.0.0-next.6
+
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes
@@ -225,12 +245,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -1000,14 +1020,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Verdaccio contributors
+Copyright (c) 2024 Verdaccio contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/build/config.d.ts

@@ -32,6 +32,7 @@ declare class Config implements AppConfig {
     }, configOptions?: {
         forceEnhancedLegacySignature: boolean;
     });
+    getEnhancedLegacySignature(): boolean;
     getConfigPath(): string;
     /**
      * Check for package spec

package/build/config.js

@@ -39,7 +39,12 @@ class Config {
 
   // @ts-ignore
 
-  constructor(config, configOptions = {
+  constructor(config,
+  // forceEnhancedLegacySignature is a property that
+  // allows switch a new legacy aes signature token signature
+  // for older versions do not want to have this new signature model
+  // this property must be false
+  configOptions = {
     forceEnhancedLegacySignature: true
   }) {
     var _config$flags$searchR, _config$flags, _config$flags$changeP, _config$flags2;
@@ -107,6 +112,15 @@ class Config {
       this.server_id = (0, _utils.generateRandomHexString)(6);
     }
   }
+  getEnhancedLegacySignature() {
+    if (typeof (this === null || this === void 0 ? void 0 : this.security.enhancedLegacySignature) !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
   getConfigPath() {
     return this.configPath;
   }
@@ -124,7 +138,7 @@ class Config {
    * @secret external secret key
    */
   checkSecretKey(secret) {
-    var _this$secret;
+    var _this$security, _this$secret;
     debug('check secret key');
     if (typeof secret === 'string' && _lodash.default.isEmpty(secret) === false) {
       this.secret = secret;
@@ -133,20 +147,21 @@ class Config {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
-    //
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    debug('generating a new secret key');
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = (0, _token.generateRandomSecretKey)();
     } else {
-      this.secret = this.security.enhancedLegacySignature === true ? (0, _token.generateRandomSecretKey)() : (0, _utils.generateRandomHexString)(32);
-      // set this to false allow use old token signature and is not recommended
-      // only use for migration reasons, major release will remove this property and
-      // set it by default
-      if (this.security.enhancedLegacySignature === false) {
-        _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
-      }
+      debug('key generated with legacy signature user config');
+      this.secret = (0, _utils.generateRandomHexString)(32);
+    }
+    // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
+    // set it by default
+    if (((_this$security = this.security) === null || _this$security === void 0 ? void 0 : _this$security.enhancedLegacySignature) === false) {
+      _core.warningUtils.emit(_warningUtils.Codes.VERWAR005);
     }
-    debug('generated a new secret key %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
+    debug('generated a new secret key length %s', (_this$secret = this.secret) === null || _this$secret === void 0 ? void 0 : _this$secret.length);
     return this.secret;
   }
 }

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$secret","isEmpty","generateRandomSecretKey","enhancedLegacySignature","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generate a new key');\n    //\n    if (this.configOptions.forceEnhancedLegacySignature) {\n      this.secret = generateRandomSecretKey();\n    } else {\n      this.secret =\n        this.security.enhancedLegacySignature === true\n          ? generateRandomSecretKey()\n          : generateRandomHexString(32);\n      // set this to false allow use old token signature and is not recommended\n      // only use for migration reasons, major release will remove this property and\n      // set it by default\n      if (this.security.enhancedLegacySignature === false) {\n        warningUtils.emit(Codes.VERWAR005);\n      }\n    }\n\n    debug('generated a new secret key %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C,EAC5CC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACjC,UAAU;EACxB;;EAEA;AACF;AACA;EACSkC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACR,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSS,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,YAAA;IAC7C3D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO0D,MAAM,KAAK,QAAQ,IAAI9B,eAAC,CAACgC,OAAO,CAACF,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB1D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO0D,MAAM;IACf;IACA;IACA;IACA1D,KAAK,CAAC,oBAAoB,CAAC;IAC3B;IACA,IAAI,IAAI,CAACU,aAAa,CAACC,4BAA4B,EAAE;MACnD,IAAI,CAAC+C,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACL,IAAI,CAACH,MAAM,GACT,IAAI,CAAC/B,QAAQ,CAACmC,uBAAuB,KAAK,IAAI,GAC1C,IAAAD,8BAAuB,EAAC,CAAC,GACzB,IAAAR,8BAAuB,EAAC,EAAE,CAAC;MACjC;MACA;MACA;MACA,IAAI,IAAI,CAAC1B,QAAQ,CAACmC,uBAAuB,KAAK,KAAK,EAAE;QACnDC,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;MACpC;IACF;IAEAlE,KAAK,CAAC,+BAA+B,GAAA2D,YAAA,GAAE,IAAI,CAACD,MAAM,cAAAC,YAAA,uBAAXA,YAAA,CAAaQ,MAAM,CAAC;IAC3D,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACvD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}
+{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","obj","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","Config","constructor","config","configOptions","forceEnhancedLegacySignature","_config$flags$searchR","_config$flags","_config$flags$changeP","_config$flags2","self","storage","process","env","VERDACCIO_STORAGE_PATH","configPath","_config$config_path","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getEnhancedLegacySignature","enhancedLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","_this$security","_this$secret","isEmpty","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR005","length"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec, isObject } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  private configOptions: { forceEnhancedLegacySignature: boolean };\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOptions = { forceEnhancedLegacySignature: true }\n  ) {\n    const self = this;\n    this.configOptions = configOptions;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(_.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getEnhancedLegacySignature() {\n    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {\n      if (this.security.enhancedLegacySignature === true) {\n        return true;\n      }\n      return false;\n    }\n    return this.configOptions.forceEnhancedLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Store or create whether receive a secret key\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('check secret key');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      this.secret = secret;\n      debug('reusing previous key');\n      return secret;\n    }\n    // generate a new a secret key\n    // FUTURE: this might be an external secret key, perhaps within config file?\n    debug('generating a new secret key');\n\n    if (this.getEnhancedLegacySignature()) {\n      debug('key generated with \"enhanced\" legacy signature user config');\n      this.secret = generateRandomSecretKey();\n    } else {\n      debug('key generated with legacy signature user config');\n      this.secret = generateRandomHexString(32);\n    }\n    // set this to false allow use old token signature and is not recommended\n    // only use for migration reasons, major release will remove this property and\n    // set it by default\n    if (this.security?.enhancedLegacySignature === false) {\n      warningUtils.emit(Codes.VERWAR005);\n    }\n\n    debug('generated a new secret key length %s', this.secret?.length);\n    return this.secret;\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;;AAED;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAQhC;AACF;AACA;;EAOE;;EAKOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,aAAa,GAAG;IAAEC,4BAA4B,EAAE;EAAK,CAAC,EACtD;IAAA,IAAAC,qBAAA,EAAAC,aAAA,EAAAC,qBAAA,EAAAC,cAAA;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACN,aAAa,GAAGA,aAAa;IAClC,IAAI,CAACO,OAAO,GAAGC,OAAO,CAACC,GAAG,CAACC,sBAAsB,IAAIX,MAAM,CAACQ,OAAO;IACnE,IAAI,CAACR,MAAM,CAACY,UAAU,EAAE;MAAA,IAAAC,mBAAA;MACtB;MACA;MACAb,MAAM,CAACY,UAAU,IAAAC,mBAAA,GAAGb,MAAM,CAACc,WAAW,cAAAD,mBAAA,cAAAA,mBAAA,GAAIb,MAAM,CAACe,SAAS;MAC1D,IAAI,CAACf,MAAM,CAACY,UAAU,EAAE;QACtB,MAAM,IAAII,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACJ,UAAU,GAAGZ,MAAM,CAACY,UAAU;IACnC,IAAI,CAACG,SAAS,GAAG,IAAI,CAACH,UAAU;IAChCrB,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAACqB,UAAU,CAAC;IACzC,IAAI,CAACK,OAAO,GAAGjB,MAAM,CAACiB,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAErB,MAAM,CAACkB,QAAQ,CAAC;IACzD,IAAI,CAACI,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,GAAArB,qBAAA,IAAAC,aAAA,GAAEJ,MAAM,CAACuB,KAAK,cAAAnB,aAAA,uBAAZA,aAAA,CAAcoB,YAAY,cAAArB,qBAAA,cAAAA,qBAAA,GAAI,IAAI;MAChDsB,cAAc,GAAApB,qBAAA,IAAAC,cAAA,GAAEN,MAAM,CAACuB,KAAK,cAAAjB,cAAA,uBAAZA,cAAA,CAAcmB,cAAc,cAAApB,qBAAA,cAAAA,qBAAA,GAAI;IAClD,CAAC;IACD,IAAI,CAACqB,UAAU,GAAG1B,MAAM,CAAC0B,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI3B,MAAM,EAAE;MAC/B,IAAIO,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAG3B,MAAM,CAAC2B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAnC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACmC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGlC,uBAAuB;MAAE,IAAGK,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6B,aAAa;IAAC,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACX,eAAC,CAACY,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEtD;IACA5C,oBAAoB,CAAC6C,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI5B,IAAI,CAAC4B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB5B,IAAI,CAAC4B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAL,eAAM,EAAC,IAAAC,eAAQ,EAACxB,IAAI,CAAC4B,CAAC,CAAC,CAAC,EAAG,gBAAeA,CAAE,2BAA0B,CAAC;IACzE,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACjC,IAAI,CAACgC,QAAQ,CAAC;;IAErD;IACAjD,gBAAgB,CAAC4C,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIlC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACkC,OAAO,CAAC,GAAGhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAAC,IAAIhC,OAAO,CAACC,GAAG,CAAC+B,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,0BAA0BA,CAAA,EAAG;IAClC,IAAI,QAAO,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE3B,QAAQ,CAAC4B,uBAAuB,MAAK,WAAW,EAAE;MACjE,IAAI,IAAI,CAAC5B,QAAQ,CAAC4B,uBAAuB,KAAK,IAAI,EAAE;QAClD,OAAO,IAAI;MACb;MACA,OAAO,KAAK;IACd;IACA,OAAO,IAAI,CAAC7C,aAAa,CAACC,4BAA4B;EACxD;EAEO6C,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACnC,UAAU;EACxB;;EAEA;AACF;AACA;EACSoC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACV,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;EACSW,cAAcA,CAACC,MAAe,EAAU;IAAA,IAAAC,cAAA,EAAAC,YAAA;IAC7C9D,KAAK,CAAC,kBAAkB,CAAC;IACzB,IAAI,OAAO4D,MAAM,KAAK,QAAQ,IAAIhC,eAAC,CAACmC,OAAO,CAACH,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7D,IAAI,CAACA,MAAM,GAAGA,MAAM;MACpB5D,KAAK,CAAC,sBAAsB,CAAC;MAC7B,OAAO4D,MAAM;IACf;IACA;IACA;IACA5D,KAAK,CAAC,6BAA6B,CAAC;IAEpC,IAAI,IAAI,CAACsD,0BAA0B,CAAC,CAAC,EAAE;MACrCtD,KAAK,CAAC,4DAA4D,CAAC;MACnE,IAAI,CAAC4D,MAAM,GAAG,IAAAI,8BAAuB,EAAC,CAAC;IACzC,CAAC,MAAM;MACLhE,KAAK,CAAC,iDAAiD,CAAC;MACxD,IAAI,CAAC4D,MAAM,GAAG,IAAAP,8BAAuB,EAAC,EAAE,CAAC;IAC3C;IACA;IACA;IACA;IACA,IAAI,EAAAQ,cAAA,OAAI,CAAClC,QAAQ,cAAAkC,cAAA,uBAAbA,cAAA,CAAeN,uBAAuB,MAAK,KAAK,EAAE;MACpDU,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;IACpC;IAEApE,KAAK,CAAC,sCAAsC,GAAA8D,YAAA,GAAE,IAAI,CAACF,MAAM,cAAAE,YAAA,uBAAXA,YAAA,CAAaO,MAAM,CAAC;IAClE,OAAO,IAAI,CAACT,MAAM;EACpB;AACF;AAACzD,OAAA,CAAAI,MAAA,GAAAA,MAAA"}

package/build/package-access.js

@@ -28,7 +28,7 @@ const PACKAGE_ACCESS = exports.PACKAGE_ACCESS = {
 };
 function normalizeUserList(groupsList) {
   const result = [];
-  if (_lodash.default.isNil(groupsList)) {
+  if (_lodash.default.isNil(groupsList) || _lodash.default.isEmpty(groupsList)) {
     return result;
   }
 

package/build/package-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"package-access.js","names":["_assert","_interopRequireDefault","require","_lodash","_core","obj","__esModule","default","ROLES","exports","$ALL","ALL","$AUTH","$ANONYMOUS","DEPRECATED_ALL","DEPRECATED_AUTH","DEPRECATED_ANONYMOUS","PACKAGE_ACCESS","SCOPE","normalizeUserList","groupsList","result","_","isNil","isString","groupsArray","split","push","Array","isArray","errorUtils","getInternalError","JSON","stringify","flatten","normalisePackageAccess","packages","normalizedPkgs","access","publish","unpublish","proxy","pkg","Object","prototype","hasOwnProperty","call","packageAccess","isInvalid","isObject","assert","isUndefined"],"sources":["../src/package-access.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { PackageAccess } from '@verdaccio/types';\n\nexport interface LegacyPackageList {\n  [key: string]: PackageAccess;\n}\n\n// @deprecated use @verdaccio/core:authUtils\nexport const ROLES = {\n  $ALL: '$all',\n  ALL: 'all',\n  $AUTH: '$authenticated',\n  $ANONYMOUS: '$anonymous',\n  DEPRECATED_ALL: '@all',\n  DEPRECATED_AUTH: '@authenticated',\n  DEPRECATED_ANONYMOUS: '@anonymous',\n};\n\n// @deprecated use @verdaccio/core:authUtils\nexport const PACKAGE_ACCESS = {\n  SCOPE: '@*/*',\n  ALL: '**',\n};\n\nexport function normalizeUserList(groupsList: any): any {\n  const result: any[] = [];\n  if (_.isNil(groupsList)) {\n    return result;\n  }\n\n  // if it's a string, split it to array\n  if (_.isString(groupsList)) {\n    const groupsArray = groupsList.split(/\\s+/);\n\n    result.push(groupsArray);\n  } else if (Array.isArray(groupsList)) {\n    result.push(groupsList);\n  } else {\n    throw errorUtils.getInternalError(\n      'CONFIG: bad package acl (array or string expected): ' + JSON.stringify(groupsList)\n    );\n  }\n\n  return _.flatten(result);\n}\n\nexport function normalisePackageAccess(packages: LegacyPackageList): LegacyPackageList {\n  const normalizedPkgs: LegacyPackageList = { ...packages };\n  if (_.isNil(normalizedPkgs['**'])) {\n    normalizedPkgs['**'] = {\n      access: [],\n      publish: [],\n      unpublish: [],\n      proxy: [],\n    };\n  }\n\n  for (const pkg in packages) {\n    if (Object.prototype.hasOwnProperty.call(packages, pkg)) {\n      const packageAccess = packages[pkg];\n      const isInvalid = _.isObject(packageAccess) && _.isArray(packageAccess) === false;\n      assert(isInvalid, `CONFIG: bad \"'${pkg}'\" package description (object expected)`);\n\n      normalizedPkgs[pkg].access = normalizeUserList(packageAccess.access);\n      normalizedPkgs[pkg].publish = normalizeUserList(packageAccess.publish);\n      normalizedPkgs[pkg].proxy = normalizeUserList(packageAccess.proxy);\n      // if unpublish is not defined, we set to false to fallback in publish access\n      normalizedPkgs[pkg].unpublish = _.isUndefined(packageAccess.unpublish)\n        ? false\n        : normalizeUserList(packageAccess.unpublish);\n    }\n  }\n\n  return normalizedPkgs;\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAO7C;AACO,MAAMG,KAAK,GAAAC,OAAA,CAAAD,KAAA,GAAG;EACnBE,IAAI,EAAE,MAAM;EACZC,GAAG,EAAE,KAAK;EACVC,KAAK,EAAE,gBAAgB;EACvBC,UAAU,EAAE,YAAY;EACxBC,cAAc,EAAE,MAAM;EACtBC,eAAe,EAAE,gBAAgB;EACjCC,oBAAoB,EAAE;AACxB,CAAC;;AAED;AACO,MAAMC,cAAc,GAAAR,OAAA,CAAAQ,cAAA,GAAG;EAC5BC,KAAK,EAAE,MAAM;EACbP,GAAG,EAAE;AACP,CAAC;AAEM,SAASQ,iBAAiBA,CAACC,UAAe,EAAO;EACtD,MAAMC,MAAa,GAAG,EAAE;EACxB,IAAIC,eAAC,CAACC,KAAK,CAACH,UAAU,CAAC,EAAE;IACvB,OAAOC,MAAM;EACf;;EAEA;EACA,IAAIC,eAAC,CAACE,QAAQ,CAACJ,UAAU,CAAC,EAAE;IAC1B,MAAMK,WAAW,GAAGL,UAAU,CAACM,KAAK,CAAC,KAAK,CAAC;IAE3CL,MAAM,CAACM,IAAI,CAACF,WAAW,CAAC;EAC1B,CAAC,MAAM,IAAIG,KAAK,CAACC,OAAO,CAACT,UAAU,CAAC,EAAE;IACpCC,MAAM,CAACM,IAAI,CAACP,UAAU,CAAC;EACzB,CAAC,MAAM;IACL,MAAMU,gBAAU,CAACC,gBAAgB,CAC/B,sDAAsD,GAAGC,IAAI,CAACC,SAAS,CAACb,UAAU,CACpF,CAAC;EACH;EAEA,OAAOE,eAAC,CAACY,OAAO,CAACb,MAAM,CAAC;AAC1B;AAEO,SAASc,sBAAsBA,CAACC,QAA2B,EAAqB;EACrF,MAAMC,cAAiC,GAAG;IAAE,GAAGD;EAAS,CAAC;EACzD,IAAId,eAAC,CAACC,KAAK,CAACc,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;IACjCA,cAAc,CAAC,IAAI,CAAC,GAAG;MACrBC,MAAM,EAAE,EAAE;MACVC,OAAO,EAAE,EAAE;MACXC,SAAS,EAAE,EAAE;MACbC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,KAAK,MAAMC,GAAG,IAAIN,QAAQ,EAAE;IAC1B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,QAAQ,EAAEM,GAAG,CAAC,EAAE;MACvD,MAAMK,aAAa,GAAGX,QAAQ,CAACM,GAAG,CAAC;MACnC,MAAMM,SAAS,GAAG1B,eAAC,CAAC2B,QAAQ,CAACF,aAAa,CAAC,IAAIzB,eAAC,CAACO,OAAO,CAACkB,aAAa,CAAC,KAAK,KAAK;MACjF,IAAAG,eAAM,EAACF,SAAS,EAAG,iBAAgBN,GAAI,0CAAyC,CAAC;MAEjFL,cAAc,CAACK,GAAG,CAAC,CAACJ,MAAM,GAAGnB,iBAAiB,CAAC4B,aAAa,CAACT,MAAM,CAAC;MACpED,cAAc,CAACK,GAAG,CAAC,CAACH,OAAO,GAAGpB,iBAAiB,CAAC4B,aAAa,CAACR,OAAO,CAAC;MACtEF,cAAc,CAACK,GAAG,CAAC,CAACD,KAAK,GAAGtB,iBAAiB,CAAC4B,aAAa,CAACN,KAAK,CAAC;MAClE;MACAJ,cAAc,CAACK,GAAG,CAAC,CAACF,SAAS,GAAGlB,eAAC,CAAC6B,WAAW,CAACJ,aAAa,CAACP,SAAS,CAAC,GAClE,KAAK,GACLrB,iBAAiB,CAAC4B,aAAa,CAACP,SAAS,CAAC;IAChD;EACF;EAEA,OAAOH,cAAc;AACvB"}
+{"version":3,"file":"package-access.js","names":["_assert","_interopRequireDefault","require","_lodash","_core","obj","__esModule","default","ROLES","exports","$ALL","ALL","$AUTH","$ANONYMOUS","DEPRECATED_ALL","DEPRECATED_AUTH","DEPRECATED_ANONYMOUS","PACKAGE_ACCESS","SCOPE","normalizeUserList","groupsList","result","_","isNil","isEmpty","isString","groupsArray","split","push","Array","isArray","errorUtils","getInternalError","JSON","stringify","flatten","normalisePackageAccess","packages","normalizedPkgs","access","publish","unpublish","proxy","pkg","Object","prototype","hasOwnProperty","call","packageAccess","isInvalid","isObject","assert","isUndefined"],"sources":["../src/package-access.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { errorUtils } from '@verdaccio/core';\nimport { PackageAccess } from '@verdaccio/types';\n\nexport interface LegacyPackageList {\n  [key: string]: PackageAccess;\n}\n\n// @deprecated use @verdaccio/core:authUtils\nexport const ROLES = {\n  $ALL: '$all',\n  ALL: 'all',\n  $AUTH: '$authenticated',\n  $ANONYMOUS: '$anonymous',\n  DEPRECATED_ALL: '@all',\n  DEPRECATED_AUTH: '@authenticated',\n  DEPRECATED_ANONYMOUS: '@anonymous',\n};\n\n// @deprecated use @verdaccio/core:authUtils\nexport const PACKAGE_ACCESS = {\n  SCOPE: '@*/*',\n  ALL: '**',\n};\n\nexport function normalizeUserList(groupsList: any): any {\n  const result: any[] = [];\n  if (_.isNil(groupsList) || _.isEmpty(groupsList)) {\n    return result;\n  }\n\n  // if it's a string, split it to array\n  if (_.isString(groupsList)) {\n    const groupsArray = groupsList.split(/\\s+/);\n\n    result.push(groupsArray);\n  } else if (Array.isArray(groupsList)) {\n    result.push(groupsList);\n  } else {\n    throw errorUtils.getInternalError(\n      'CONFIG: bad package acl (array or string expected): ' + JSON.stringify(groupsList)\n    );\n  }\n\n  return _.flatten(result);\n}\n\nexport function normalisePackageAccess(packages: LegacyPackageList): LegacyPackageList {\n  const normalizedPkgs: LegacyPackageList = { ...packages };\n  if (_.isNil(normalizedPkgs['**'])) {\n    normalizedPkgs['**'] = {\n      access: [],\n      publish: [],\n      unpublish: [],\n      proxy: [],\n    };\n  }\n\n  for (const pkg in packages) {\n    if (Object.prototype.hasOwnProperty.call(packages, pkg)) {\n      const packageAccess = packages[pkg];\n      const isInvalid = _.isObject(packageAccess) && _.isArray(packageAccess) === false;\n      assert(isInvalid, `CONFIG: bad \"'${pkg}'\" package description (object expected)`);\n\n      normalizedPkgs[pkg].access = normalizeUserList(packageAccess.access);\n      normalizedPkgs[pkg].publish = normalizeUserList(packageAccess.publish);\n      normalizedPkgs[pkg].proxy = normalizeUserList(packageAccess.proxy);\n      // if unpublish is not defined, we set to false to fallback in publish access\n      normalizedPkgs[pkg].unpublish = _.isUndefined(packageAccess.unpublish)\n        ? false\n        : normalizeUserList(packageAccess.unpublish);\n    }\n  }\n\n  return normalizedPkgs;\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAO7C;AACO,MAAMG,KAAK,GAAAC,OAAA,CAAAD,KAAA,GAAG;EACnBE,IAAI,EAAE,MAAM;EACZC,GAAG,EAAE,KAAK;EACVC,KAAK,EAAE,gBAAgB;EACvBC,UAAU,EAAE,YAAY;EACxBC,cAAc,EAAE,MAAM;EACtBC,eAAe,EAAE,gBAAgB;EACjCC,oBAAoB,EAAE;AACxB,CAAC;;AAED;AACO,MAAMC,cAAc,GAAAR,OAAA,CAAAQ,cAAA,GAAG;EAC5BC,KAAK,EAAE,MAAM;EACbP,GAAG,EAAE;AACP,CAAC;AAEM,SAASQ,iBAAiBA,CAACC,UAAe,EAAO;EACtD,MAAMC,MAAa,GAAG,EAAE;EACxB,IAAIC,eAAC,CAACC,KAAK,CAACH,UAAU,CAAC,IAAIE,eAAC,CAACE,OAAO,CAACJ,UAAU,CAAC,EAAE;IAChD,OAAOC,MAAM;EACf;;EAEA;EACA,IAAIC,eAAC,CAACG,QAAQ,CAACL,UAAU,CAAC,EAAE;IAC1B,MAAMM,WAAW,GAAGN,UAAU,CAACO,KAAK,CAAC,KAAK,CAAC;IAE3CN,MAAM,CAACO,IAAI,CAACF,WAAW,CAAC;EAC1B,CAAC,MAAM,IAAIG,KAAK,CAACC,OAAO,CAACV,UAAU,CAAC,EAAE;IACpCC,MAAM,CAACO,IAAI,CAACR,UAAU,CAAC;EACzB,CAAC,MAAM;IACL,MAAMW,gBAAU,CAACC,gBAAgB,CAC/B,sDAAsD,GAAGC,IAAI,CAACC,SAAS,CAACd,UAAU,CACpF,CAAC;EACH;EAEA,OAAOE,eAAC,CAACa,OAAO,CAACd,MAAM,CAAC;AAC1B;AAEO,SAASe,sBAAsBA,CAACC,QAA2B,EAAqB;EACrF,MAAMC,cAAiC,GAAG;IAAE,GAAGD;EAAS,CAAC;EACzD,IAAIf,eAAC,CAACC,KAAK,CAACe,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE;IACjCA,cAAc,CAAC,IAAI,CAAC,GAAG;MACrBC,MAAM,EAAE,EAAE;MACVC,OAAO,EAAE,EAAE;MACXC,SAAS,EAAE,EAAE;MACbC,KAAK,EAAE;IACT,CAAC;EACH;EAEA,KAAK,MAAMC,GAAG,IAAIN,QAAQ,EAAE;IAC1B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,QAAQ,EAAEM,GAAG,CAAC,EAAE;MACvD,MAAMK,aAAa,GAAGX,QAAQ,CAACM,GAAG,CAAC;MACnC,MAAMM,SAAS,GAAG3B,eAAC,CAAC4B,QAAQ,CAACF,aAAa,CAAC,IAAI1B,eAAC,CAACQ,OAAO,CAACkB,aAAa,CAAC,KAAK,KAAK;MACjF,IAAAG,eAAM,EAACF,SAAS,EAAG,iBAAgBN,GAAI,0CAAyC,CAAC;MAEjFL,cAAc,CAACK,GAAG,CAAC,CAACJ,MAAM,GAAGpB,iBAAiB,CAAC6B,aAAa,CAACT,MAAM,CAAC;MACpED,cAAc,CAACK,GAAG,CAAC,CAACH,OAAO,GAAGrB,iBAAiB,CAAC6B,aAAa,CAACR,OAAO,CAAC;MACtEF,cAAc,CAACK,GAAG,CAAC,CAACD,KAAK,GAAGvB,iBAAiB,CAAC6B,aAAa,CAACN,KAAK,CAAC;MAClE;MACAJ,cAAc,CAACK,GAAG,CAAC,CAACF,SAAS,GAAGnB,eAAC,CAAC8B,WAAW,CAACJ,aAAa,CAACP,SAAS,CAAC,GAClE,KAAK,GACLtB,iBAAiB,CAAC6B,aAAa,CAACP,SAAS,CAAC;IAChD;EACF;EAEA,OAAOH,cAAc;AACvB"}

package/jest.config.js

@@ -3,8 +3,7 @@ const config = require('../../jest/config');
 module.exports = Object.assign({}, config, {
   coverageThreshold: {
     global: {
-      // FIXME: increase to 90
-      lines: 85,
+      lines: 90,
     },
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.6",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,8 +29,8 @@
     "node": ">=12"
   },
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next.4",
-    "@verdaccio/utils": "7.0.0-next.4",
+    "@verdaccio/core": "7.0.0-next.6",
+    "@verdaccio/utils": "7.0.0-next.6",
     "debug": "4.3.4",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
@@ -39,7 +39,7 @@
   },
   "devDependencies": {
     "@types/minimatch": "5.1.2",
-    "@types/yup": "0.29.14"
+    "@types/yup": "0.32.0"
   },
   "funding": {
     "type": "opencollective",

package/src/config.ts

@@ -63,6 +63,10 @@ class Config implements AppConfig {
   private configOptions: { forceEnhancedLegacySignature: boolean };
   public constructor(
     config: ConfigYaml & { config_path: string },
+    // forceEnhancedLegacySignature is a property that
+    // allows switch a new legacy aes signature token signature
+    // for older versions do not want to have this new signature model
+    // this property must be false
     configOptions = { forceEnhancedLegacySignature: true }
   ) {
     const self = this;
@@ -131,6 +135,16 @@ class Config implements AppConfig {
     }
   }
 
+  public getEnhancedLegacySignature() {
+    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
+
   public getConfigPath() {
     return this.configPath;
   }
@@ -156,24 +170,23 @@ class Config implements AppConfig {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
-    //
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    debug('generating a new secret key');
+
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = generateRandomSecretKey();
     } else {
-      this.secret =
-        this.security.enhancedLegacySignature === true
-          ? generateRandomSecretKey()
-          : generateRandomHexString(32);
-      // set this to false allow use old token signature and is not recommended
-      // only use for migration reasons, major release will remove this property and
-      // set it by default
-      if (this.security.enhancedLegacySignature === false) {
-        warningUtils.emit(Codes.VERWAR005);
-      }
+      debug('key generated with legacy signature user config');
+      this.secret = generateRandomHexString(32);
+    }
+    // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
+    // set it by default
+    if (this.security?.enhancedLegacySignature === false) {
+      warningUtils.emit(Codes.VERWAR005);
     }
 
-    debug('generated a new secret key %s', this.secret?.length);
+    debug('generated a new secret key length %s', this.secret?.length);
     return this.secret;
   }
 }

package/src/package-access.ts

@@ -27,7 +27,7 @@ export const PACKAGE_ACCESS = {
 
 export function normalizeUserList(groupsList: any): any {
   const result: any[] = [];
-  if (_.isNil(groupsList)) {
+  if (_.isNil(groupsList) || _.isEmpty(groupsList)) {
     return result;
   }
 

package/test/agent.spec.ts

@@ -0,0 +1,42 @@
+import { getUserAgent } from '../src';
+
+describe('getUserAgent', () => {
+  test('should return custom user agent when customUserAgent is true', () => {
+    const customUserAgent = true;
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(customUserAgent, version, name);
+
+    expect(result).toBe('MyAgent/1.0.0');
+  });
+
+  test('should return custom user agent when customUserAgent is a non-empty string', () => {
+    const customUserAgent = 'CustomAgent/1.0.0';
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(customUserAgent, version, name);
+
+    expect(result).toBe('CustomAgent/1.0.0');
+  });
+
+  test('should return "hidden" when customUserAgent is false', () => {
+    const customUserAgent = false;
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(customUserAgent, version, name);
+
+    expect(result).toBe('hidden');
+  });
+
+  test('should return default user agent when customUserAgent is undefined', () => {
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(undefined, version, name);
+
+    expect(result).toBe('MyAgent/1.0.0');
+  });
+});

package/test/builder.spec.ts

@@ -13,6 +13,7 @@ describe('Config builder', () => {
         proxy: 'some',
       })
       .addLogger({ level: 'info', type: 'stdout', format: 'json' })
+      .addAuth({ htpasswd: { file: '.htpasswd' } })
       .addStorage('/tmp/verdaccio')
       .addSecurity({ api: { legacy: true } });
     expect(config.getConfig()).toEqual({
@@ -21,6 +22,11 @@ describe('Config builder', () => {
           legacy: true,
         },
       },
+      auth: {
+        htpasswd: {
+          file: '.htpasswd',
+        },
+      },
       storage: '/tmp/verdaccio',
       packages: {
         'upstream/*': {

package/test/config.spec.ts

@@ -106,6 +106,20 @@ describe('checkSecretKey', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
     expect(typeof config.checkSecretKey('') === 'string').toBeTruthy();
   });
+
+  test('with enhanced legacy signature', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')));
+    config.security.enhancedLegacySignature = true;
+    expect(typeof config.checkSecretKey() === 'string').toBeTruthy();
+    expect(config.secret.length).toBe(32);
+  });
+
+  test('without enhanced legacy signature', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')));
+    config.security.enhancedLegacySignature = false;
+    expect(typeof config.checkSecretKey() === 'string').toBeTruthy();
+    expect(config.secret.length).toBe(64);
+  });
 });
 
 describe('getMatchedPackagesSpec', () => {
@@ -159,3 +173,18 @@ describe('VERDACCIO_STORAGE_PATH', () => {
     delete process.env.VERDACCIO_STORAGE_PATH;
   });
 });
+
+describe('configPath', () => {
+  test('should set configPath in config', () => {
+    const defaultConfig = parseConfigFile(resolveConf('default'));
+    const config = new Config(defaultConfig);
+    expect(config.getConfigPath()).toBe(path.join(__dirname, '../src/conf/default.yaml'));
+  });
+
+  test('should throw an error if configPath is not provided', () => {
+    const defaultConfig = parseConfigFile(resolveConf('default'));
+    defaultConfig.configPath = '';
+    defaultConfig.config_path = '';
+    expect(() => new Config(defaultConfig)).toThrow('configPath property is required');
+  });
+});

package/test/package-access.spec.ts

@@ -1,7 +1,7 @@
 import _ from 'lodash';
 
 import { parseConfigFile } from '../src';
-import { PACKAGE_ACCESS, normalisePackageAccess } from '../src/package-access';
+import { PACKAGE_ACCESS, normalisePackageAccess, normalizeUserList } from '../src/package-access';
 import { parseConfigurationFile } from './utils';
 
 describe('Package access utilities', () => {
@@ -123,4 +123,30 @@ describe('Package access utilities', () => {
       expect(_.isArray(all.publish)).toBeTruthy();
     });
   });
+  describe('normaliseUserList', () => {
+    test('should normalize user list', () => {
+      const groupsList = 'admin superadmin';
+      const result = normalizeUserList(groupsList);
+      expect(result).toEqual(['admin', 'superadmin']);
+    });
+
+    test('should normalize empty user list', () => {
+      const groupsList = '';
+      const result = normalizeUserList(groupsList);
+      expect(result).toEqual([]);
+    });
+
+    test('should normalize user list array', () => {
+      const groupsList = ['admin', 'superadmin'];
+      const result = normalizeUserList(groupsList);
+      expect(result).toEqual(['admin', 'superadmin']);
+    });
+
+    test('should throw error for invalid user list', () => {
+      const groupsList = { group: 'admin' };
+      expect(() => {
+        normalizeUserList(groupsList);
+      }).toThrow('CONFIG: bad package acl (array or string expected): {"group":"admin"}');
+    });
+  });
 });