@verdaccio/config 7.0.0-next.5 → 8.0.0-next-8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "7.0.0-next.5",
+  "version": "8.0.0-next-8.0",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -26,20 +26,18 @@
     "verdaccio"
   ],
   "engines": {
-    "node": ">=12"
+    "node": ">=14"
   },
   "dependencies": {
-    "@verdaccio/core": "7.0.0-next.5",
-    "@verdaccio/utils": "7.0.0-next.5",
-    "debug": "4.3.4",
+    "@verdaccio/core": "8.0.0-next-8.0",
+    "@verdaccio/utils": "7.0.1-next-8.0",
+    "debug": "4.3.7",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "minimatch": "7.4.6",
-    "yup": "0.32.11"
+    "minimatch": "7.4.6"
   },
   "devDependencies": {
-    "@types/minimatch": "5.1.2",
-    "@types/yup": "0.32.0"
+    "@types/minimatch": "5.1.2"
   },
   "funding": {
     "type": "opencollective",
@@ -47,7 +45,7 @@
   },
   "scripts": {
     "clean": "rimraf ./build",
-    "test": "jest",
+    "test": "vitest run",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",

package/src/builder.ts

@@ -19,8 +19,7 @@ export default class ConfigBuilder {
   private config: ConfigYaml;
 
   public constructor(config?: Partial<ConfigYaml>) {
-    // @ts-ignore
-    this.config = config ?? { uplinks: {}, packages: {}, security: {} };
+    this.config = merge(config, { uplinks: {}, packages: {}, security: {} });
   }
 
   public static build(config?: Partial<ConfigYaml>): ConfigBuilder {

package/src/conf/default.yaml

@@ -18,6 +18,12 @@ storage: ./storage
 # https://verdaccio.org/docs/webui
 web:
   title: Verdaccio
+  # custom colors for header background and font
+  # primaryColor: "#4b5e40"
+  # custom logos and favicon
+  # logo: ./path/to/logo.png
+  # logoDark: ./path/to/logoDark.png
+  # favicon: ./path/to/favicon.ico
   # comment out to disable gravatar support
   # gravatar: false
   # by default packages are ordercer ascendant (asc|desc)
@@ -35,6 +41,7 @@ web:
   # showSearch: true
   # showRaw: true
   # showDownloadTarball: true
+  # showUplinks: true
   #  HTML tags injected after manifest <scripts/>
   # scriptsBodyAfter:
   #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
@@ -82,7 +89,7 @@ packages:
     # and three keywords: "$all", "$anonymous", "$authenticated"
     access: $all
 
-    # allow all known users to publish/publish packages
+    # allow all known users to publish/unpublish packages
     # (anyone can register by default, remember?)
     publish: $authenticated
     unpublish: $authenticated
@@ -113,6 +120,7 @@ server:
 # https://verdaccio.org/docs/configuration#offline-publish
 # publish:
 #   allow_offline: false
+#   check_owners: false
 
 # https://verdaccio.org/docs/configuration#url-prefix
 # url_prefix: /verdaccio/
@@ -179,6 +187,7 @@ server:
 middlewares:
   audit:
     enabled: true
+    # timeout: 10000
 
 # https://verdaccio.org/docs/logger
 # log settings

package/src/conf/docker.yaml

@@ -21,6 +21,12 @@ plugins: /verdaccio/plugins
 # https://verdaccio.org/docs/webui
 web:
   title: Verdaccio
+  # custom colors for header background and font
+  # primaryColor: "#4b5e40"
+  # custom logos and favicon
+  # logo: ./path/to/logo.png
+  # logoDark: ./path/to/logoDark.png
+  # favicon: ./path/to/favicon.ico
   # Comment out to disable gravatar support
   # gravatar: false
   # By default packages are ordered ascendant (asc|desc)
@@ -38,6 +44,7 @@ web:
   # showSearch: true
   # showRaw: true
   # showDownloadTarball: true
+  # showUplinks: true
   #  HTML tags injected after manifest <scripts/>
   # scriptsBodyAfter:
   #    - '<script type="text/javascript" src="https://my.company.com/customJS.min.js"></script>'
@@ -86,7 +93,7 @@ packages:
     # and three keywords: "$all", "$anonymous", "$authenticated"
     access: $all
 
-    # Allow all known users to publish/publish packages
+    # Allow all known users to publish/unpublish packages
     # (anyone can register by default, remember?)
     publish: $authenticated
     unpublish: $authenticated
@@ -119,6 +126,7 @@ server:
 # https://verdaccio.org/docs/configuration#offline-publish
 # publish:
 #   allow_offline: false
+#   check_owners: false
 
 # https://verdaccio.org/docs/configuration#url-prefix
 # url_prefix: /verdaccio/
@@ -185,6 +193,7 @@ server:
 middlewares:
   audit:
     enabled: true
+    # timeout: 10000
 
 # https://verdaccio.org/docs/logger
 # log settings

package/src/config-path.ts

@@ -1,16 +1,13 @@
 import buildDebug from 'debug';
 import fs from 'fs';
 import _ from 'lodash';
+import os from 'os';
 import path from 'path';
 
-import { CHARACTER_ENCODING } from '@verdaccio/core';
-
 import { fileExists, folderExists } from './config-utils';
 
 const CONFIG_FILE = 'config.yaml';
 const XDG = 'xdg';
-const WIN = 'win';
-const WIN32 = 'win32';
 // eslint-disable-next-line
 const pkgJSON = {
   name: 'verdaccio',
@@ -18,23 +15,27 @@ const pkgJSON = {
 
 export type SetupDirectory = {
   path: string;
-  type: string;
+  type: 'xdg' | 'win' | 'win32' | 'def' | 'old';
 };
 
-const debug = buildDebug('verdaccio:config');
+const debug = buildDebug('verdaccio:config:config-path');
 
 /**
  * Find and get the first config file that match.
  * @return {String} the config file path
  */
 function findConfigFile(configPath?: string): string {
+  debug('searching for config file %o', configPath);
   if (typeof configPath !== 'undefined') {
-    return path.resolve(configPath);
+    const configLocation = path.resolve(configPath);
+    debug('custom location %s', configLocation);
+    return configLocation;
   }
 
   const configPaths: SetupDirectory[] = getConfigPaths();
   debug('%o posible locations found', configPaths.length);
-  if (_.isEmpty(configPaths)) {
+  if (configPaths.length === 0) {
+    debug('no configuration files can be processed');
     // this should never happens
     throw new Error('no configuration files can be processed');
   }
@@ -45,12 +46,12 @@ function findConfigFile(configPath?: string): string {
   );
 
   if (typeof primaryConf !== 'undefined') {
-    debug('previous location exist already %s', primaryConf?.path);
+    debug('at least one primary location detected at %s', primaryConf?.path);
     return primaryConf.path;
   }
-
-  // @ts-ignore
-  return createConfigFile(_.head(configPaths)).path;
+  debug('no previous location found, creating a new one');
+  debug('generating the first match path location  %s', configPaths[0].path);
+  return createConfigFile(configPaths[0]).path;
 }
 
 function createConfigFile(configLocation: SetupDirectory): SetupDirectory {
@@ -63,25 +64,37 @@ function createConfigFile(configLocation: SetupDirectory): SetupDirectory {
   return configLocation;
 }
 
-export function readDefaultConfig(): Buffer {
+export function readDefaultConfig(): string {
   const pathDefaultConf: string = path.resolve(__dirname, 'conf/default.yaml');
   try {
-    debug('default configuration file %s', pathDefaultConf);
+    debug('the path of default config used from %s', pathDefaultConf);
     fs.accessSync(pathDefaultConf, fs.constants.R_OK);
+    debug('configuration file has enough permissions for reading');
   } catch {
+    debug('configuration file does not have enough permissions for reading');
     throw new TypeError('configuration file does not have enough permissions for reading');
   }
-  // @ts-ignore
-  return fs.readFileSync(pathDefaultConf, CHARACTER_ENCODING.UTF8);
+
+  return fs.readFileSync(pathDefaultConf, 'utf8');
 }
 
 function createConfigFolder(configLocation): void {
-  fs.mkdirSync(path.dirname(configLocation.path), { recursive: true });
-  debug(`Creating default config file in %o`, configLocation?.path);
+  const folder = path.dirname(configLocation.path);
+  debug(`creating default config file folder at %o`, folder);
+  fs.mkdirSync(folder, { recursive: true });
+  debug(`folder %o created`, folder);
 }
 
-function updateStorageLinks(configLocation, defaultConfig): string {
+/**
+ * Update the storage links to the new location if it is necessary.
+ * @param configLocation
+ * @param defaultConfig
+ * @returns
+ */
+function updateStorageLinks(configLocation: SetupDirectory, defaultConfig: string): string {
+  debug('checking storage links for %s and type %s', configLocation.path, configLocation.type);
   if (configLocation.type !== XDG) {
+    debug(`skip storage override for %s`, configLocation.type);
     return defaultConfig;
   }
 
@@ -114,7 +127,11 @@ function getConfigPaths(): SetupDirectory[] {
 
   return listPaths.reduce(function (acc, currentValue: SetupDirectory | void): SetupDirectory[] {
     if (typeof currentValue !== 'undefined') {
-      debug('directory detected path %s for type %s', currentValue?.path, currentValue.type);
+      debug(
+        'posible directory path generated %s for type %s',
+        currentValue?.path,
+        currentValue.type
+      );
       acc.push(currentValue);
     }
     return acc;
@@ -123,11 +140,22 @@ function getConfigPaths(): SetupDirectory[] {
 
 /**
  * Get XDG_CONFIG_HOME or HOME location (usually unix)
+ *
+ * The XDG_CONFIG_HOME environment variable is also part of the XDG Base Directory Specification,
+ * which aims to standardize the locations where applications store configuration files and other
+ * user-specific data on Unix-like operating systems.
+ *
+ *
+ *
+ * https://specifications.freedesktop.org/basedir-spec/latest/
+ *
+ *
  * @returns
  */
 const getXDGDirectory = (): SetupDirectory | void => {
   const xDGConfigPath =
     process.env.XDG_CONFIG_HOME || (process.env.HOME && path.join(process.env.HOME, '.config'));
+  debug('XDGConfig folder path %s', xDGConfigPath);
   if (xDGConfigPath && folderExists(xDGConfigPath)) {
     debug('XDGConfig folder path %s', xDGConfigPath);
     return {
@@ -143,11 +171,11 @@ const getXDGDirectory = (): SetupDirectory | void => {
  * @returns
  */
 const getWindowsDirectory = (): SetupDirectory | void => {
-  if (process.platform === WIN32 && process.env.APPDATA && folderExists(process.env.APPDATA)) {
-    debug('is windows appdata: %s', process.env.APPDATA);
+  if (os.platform() === 'win32' && process.env.APPDATA && folderExists(process.env.APPDATA)) {
+    debug('windows appdata folder path %s', process.env.APPDATA);
     return {
       path: path.resolve(path.join(process.env.APPDATA, pkgJSON.name, CONFIG_FILE)),
-      type: WIN,
+      type: 'win',
     };
   }
 };
@@ -158,8 +186,10 @@ const getWindowsDirectory = (): SetupDirectory | void => {
  * @returns
  */
 const getRelativeDefaultDirectory = (): SetupDirectory => {
+  const relativePath = path.resolve(path.join('.', pkgJSON.name, CONFIG_FILE));
+  debug('relative folder path %s', relativePath);
   return {
-    path: path.resolve(path.join('.', pkgJSON.name, CONFIG_FILE)),
+    path: relativePath,
     type: 'def',
   };
 };
@@ -169,8 +199,10 @@ const getRelativeDefaultDirectory = (): SetupDirectory => {
  * @returns
  */
 const getOldDirectory = (): SetupDirectory => {
+  const oldPath = path.resolve(path.join('.', CONFIG_FILE));
+  debug('old folder path %s', oldPath);
   return {
-    path: path.resolve(path.join('.', CONFIG_FILE)),
+    path: oldPath,
     type: 'old',
   };
 };

package/src/config-utils.ts

@@ -1,5 +1,8 @@
+import buildDebug from 'debug';
 import fs from 'fs';
 
+const debug = buildDebug('verdaccio:config:config-utils');
+
 /**
  * Check whether the path already exist.
  * @param {String} path
@@ -7,9 +10,13 @@ import fs from 'fs';
  */
 export function folderExists(path: string): boolean {
   try {
+    debug('check folder exist', path);
     const stat = fs.statSync(path);
-    return stat.isDirectory();
+    const isDirectory = stat.isDirectory();
+    debug('folder exist', isDirectory);
+    return isDirectory;
   } catch (_: any) {
+    debug('folder %s does not exist', path);
     return false;
   }
 }
@@ -21,9 +28,13 @@ export function folderExists(path: string): boolean {
  */
 export function fileExists(path: string): boolean {
   try {
+    debug('check file exist', path);
     const stat = fs.statSync(path);
-    return stat.isFile();
+    const isFile = stat.isFile();
+    debug('file exist', isFile);
+    return isFile;
   } catch (_: any) {
+    debug('file %s does not exist', path);
     return false;
   }
 }

package/src/config.ts

@@ -36,6 +36,13 @@ export const defaultUserRateLimiting = {
   max: 1000,
 };
 
+export function isNodeVersionGreaterThan21() {
+  const [major, minor] = process.versions.node.split('.').map(Number);
+  return major > 21 || (major === 21 && minor >= 0);
+}
+
+const TOKEN_VALID_LENGTH = 32;
+
 /**
  * Coordinates the application configuration
  */
@@ -56,21 +63,20 @@ class Config implements AppConfig {
   public plugins: string | void | null;
   public security: Security;
   public serverSettings: ServerSettingsConf;
+  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };
   // @ts-ignore
   public secret: string;
   public flags: FlagsConfig;
   public userRateLimit: RateLimit;
-  private configOptions: { forceEnhancedLegacySignature: boolean };
   public constructor(
     config: ConfigYaml & { config_path: string },
     // forceEnhancedLegacySignature is a property that
     // allows switch a new legacy aes signature token signature
     // for older versions do not want to have this new signature model
     // this property must be false
-    configOptions = { forceEnhancedLegacySignature: true }
+    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }
   ) {
     const self = this;
-    this.configOptions = configOptions;
     this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
     if (!config.configPath) {
       // backport self_path for previous to version 6
@@ -80,11 +86,21 @@ class Config implements AppConfig {
         throw new Error('configPath property is required');
       }
     }
+    this.configOverrideOptions = configOverrideOptions;
     this.configPath = config.configPath;
     this.self_path = this.configPath;
     debug('config path: %s', this.configPath);
     this.plugins = config.plugins;
-    this.security = _.merge(defaultSecurity, config.security);
+    this.security = _.merge(
+      // override the default security configuration via constructor
+      _.merge(defaultSecurity, {
+        api: {
+          migrateToSecureLegacySignature:
+            this.configOverrideOptions.forceMigrateToSecureLegacySignature,
+        },
+      }),
+      config.security
+    );
     this.serverSettings = serverSettings;
     this.flags = {
       searchRemote: config.flags?.searchRemote ?? true,
@@ -135,14 +151,8 @@ class Config implements AppConfig {
     }
   }
 
-  public getEnhancedLegacySignature() {
-    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {
-      if (this.security.enhancedLegacySignature === true) {
-        return true;
-      }
-      return false;
-    }
-    return this.configOptions.forceEnhancedLegacySignature;
+  public getMigrateToSecureLegacySignature() {
+    return this.security.api.migrateToSecureLegacySignature;
   }
 
   public getConfigPath() {
@@ -158,36 +168,70 @@ class Config implements AppConfig {
   }
 
   /**
-   * Store or create whether receive a secret key
+   * Verify if the secret complies with the required structure
+   *  - If the secret is not provided, it will generate a new one
+   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
+   *  - If the secret is provided:
+   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
+   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
+   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
+   *      generated with the new signature model
    * @secret external secret key
    */
   public checkSecretKey(secret?: string): string {
-    debug('check secret key');
+    debug('checking secret key init');
     if (typeof secret === 'string' && _.isEmpty(secret) === false) {
+      debug('checking secret key length %s', secret.length);
+      if (secret.length > TOKEN_VALID_LENGTH) {
+        if (isNodeVersionGreaterThan21()) {
+          debug('is node version greater than 21');
+          if (this.getMigrateToSecureLegacySignature() === true) {
+            this.secret = generateRandomSecretKey();
+            debug('rewriting secret key with length %s', this.secret.length);
+            return this.secret;
+          }
+          // oops, user needs to generate a new secret key
+          debug(
+            'secret does not comply with the required length, current length  %d, application will fail on startup',
+            secret.length
+          );
+          throw new Error(
+            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
+            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
+            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`
+          );
+        } else {
+          debug('is node version lower than 22');
+          if (this.getMigrateToSecureLegacySignature() === true) {
+            this.secret = generateRandomSecretKey();
+            debug('rewriting secret key with length %s', this.secret.length);
+            return this.secret;
+          }
+          debug('triggering deprecation warning for secret key length %s', secret.length);
+          // still using Node.js versions previous to 22, but we need to emit a deprecation warning
+          // deprecation warning, secret key is too long and must be 32
+          // this will be removed in the next major release and will produce an error
+          warningUtils.emit(Codes.VERWAR007);
+          this.secret = secret;
+          return this.secret;
+        }
+      } else if (secret.length === TOKEN_VALID_LENGTH) {
+        debug('detected valid secret key length %s', secret.length);
+        this.secret = secret;
+        return this.secret;
+      }
+      debug('reusing previous key with length %s', secret.length);
       this.secret = secret;
-      debug('reusing previous key');
-      return secret;
-    }
-    // generate a new a secret key
-    // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generating a new secret key');
-
-    if (this.getEnhancedLegacySignature()) {
-      debug('key generated with "enhanced" legacy signature user config');
-      this.secret = generateRandomSecretKey();
+      return this.secret;
     } else {
-      debug('key generated with legacy signature user config');
-      this.secret = generateRandomHexString(32);
-    }
-    // set this to false allow use old token signature and is not recommended
-    // only use for migration reasons, major release will remove this property and
-    // set it by default
-    if (this.security?.enhancedLegacySignature === false) {
-      warningUtils.emit(Codes.VERWAR005);
-    }
+      // generate a new a secret key
+      // FUTURE: this might be an external secret key, perhaps within config file?
+      debug('generating a new secret key');
+      this.secret = generateRandomSecretKey();
+      debug('generated a new secret key length %s', this.secret?.length);
 
-    debug('generated a new secret key length %s', this.secret?.length);
-    return this.secret;
+      return this.secret;
+    }
   }
 }
 

package/src/package-access.ts

@@ -1,9 +1,12 @@
 import assert from 'assert';
+import buildDebug from 'debug';
 import _ from 'lodash';
 
 import { errorUtils } from '@verdaccio/core';
 import { PackageAccess } from '@verdaccio/types';
 
+const debug = buildDebug('verdaccio:config:utils');
+
 export interface LegacyPackageList {
   [key: string]: PackageAccess;
 }
@@ -27,7 +30,7 @@ export const PACKAGE_ACCESS = {
 
 export function normalizeUserList(groupsList: any): any {
   const result: any[] = [];
-  if (_.isNil(groupsList)) {
+  if (_.isNil(groupsList) || _.isEmpty(groupsList)) {
     return result;
   }
 
@@ -61,6 +64,7 @@ export function normalisePackageAccess(packages: LegacyPackageList): LegacyPacka
   for (const pkg in packages) {
     if (Object.prototype.hasOwnProperty.call(packages, pkg)) {
       const packageAccess = packages[pkg];
+      debug('package access %s for %s ', packageAccess, pkg);
       const isInvalid = _.isObject(packageAccess) && _.isArray(packageAccess) === false;
       assert(isInvalid, `CONFIG: bad "'${pkg}'" package description (object expected)`);
 

package/src/security.ts

@@ -13,6 +13,7 @@ const defaultWebTokenOptions: JWTOptions = {
 
 const defaultApiTokenConf: APITokenOptions = {
   legacy: true,
+  migrateToSecureLegacySignature: true,
 };
 
 export const defaultSecurity: Security = {

package/src/token.ts

@@ -1,9 +1,11 @@
 import { randomBytes } from 'crypto';
 
+// TODO: code duplicated at @verdaccio/signature
 export const TOKEN_VALID_LENGTH = 32;
 
 /**
  * Secret key must have 32 characters.
+ * // TODO: code duplicated at @verdaccio/signature
  */
 export function generateRandomSecretKey(): string {
   return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);

package/test/__snapshots__/builder.spec.ts.snap

@@ -1,6 +1,6 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`Config builder should create a configuration file as yaml 1`] = `
+exports[`Config builder > should create a configuration file as yaml 1`] = `
 "uplinks:
   upstream:
     url: https://registry.verdaccio.org

package/test/__snapshots__/config-parsing.spec.ts.snap

@@ -1,6 +1,6 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`parse fromJStoYAML basic conversion roundtrip 1`] = `
+exports[`parse > fromJStoYAML > basic conversion roundtrip 1`] = `
 "storage: ./storage_default_storage
 uplinks:
   npmjs:

package/test/agent.spec.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from 'vitest';
+
+import { getUserAgent } from '../src';
+
+describe('getUserAgent', () => {
+  test('should return custom user agent when customUserAgent is true', () => {
+    const customUserAgent = true;
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(customUserAgent, version, name);
+
+    expect(result).toBe('MyAgent/1.0.0');
+  });
+
+  test('should return custom user agent when customUserAgent is a non-empty string', () => {
+    const customUserAgent = 'CustomAgent/1.0.0';
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(customUserAgent, version, name);
+
+    expect(result).toBe('CustomAgent/1.0.0');
+  });
+
+  test('should return "hidden" when customUserAgent is false', () => {
+    const customUserAgent = false;
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(customUserAgent, version, name);
+
+    expect(result).toBe('hidden');
+  });
+
+  test('should return default user agent when customUserAgent is undefined', () => {
+    const version = '1.0.0';
+    const name = 'MyAgent';
+
+    const result = getUserAgent(undefined, version, name);
+
+    expect(result).toBe('MyAgent/1.0.0');
+  });
+});