@verdaccio/config 7.0.0-next.5 → 8.0.0-next-8.0

package/test/builder.spec.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { ConfigBuilder } from '../src';
 
 describe('Config builder', () => {
@@ -13,6 +15,7 @@ describe('Config builder', () => {
         proxy: 'some',
       })
       .addLogger({ level: 'info', type: 'stdout', format: 'json' })
+      .addAuth({ htpasswd: { file: '.htpasswd' } })
       .addStorage('/tmp/verdaccio')
       .addSecurity({ api: { legacy: true } });
     expect(config.getConfig()).toEqual({
@@ -21,6 +24,11 @@ describe('Config builder', () => {
           legacy: true,
         },
       },
+      auth: {
+        htpasswd: {
+          file: '.htpasswd',
+        },
+      },
       storage: '/tmp/verdaccio',
       packages: {
         'upstream/*': {
@@ -61,5 +69,58 @@ describe('Config builder', () => {
       .addStorage('/tmp/verdaccio')
       .addSecurity({ api: { legacy: true } });
     expect(config.getAsYaml()).toMatchSnapshot();
+
+    expect(config.getConfig()).toEqual({
+      uplinks: {
+        upstream: {
+          url: 'https://registry.verdaccio.org',
+        },
+        upstream2: {
+          url: 'https://registry.verdaccio.org',
+        },
+      },
+      packages: {
+        'upstream/*': {
+          access: 'public',
+          publish: 'foo, bar',
+          unpublish: 'foo, bar',
+          proxy: 'some',
+        },
+      },
+      security: {
+        api: {
+          legacy: true,
+        },
+      },
+      log: {
+        level: 'info',
+        type: 'stdout',
+        format: 'json',
+      },
+      storage: '/tmp/verdaccio',
+    });
+  });
+
+  test('should merge configurations', () => {
+    // @ts-expect-error
+    const config = ConfigBuilder.build({ security: { api: { legacy: false } } });
+    config.addSecurity({ web: { verify: {}, sign: { algorithm: 'ES256' } } });
+    config.addStorage('/tmp/verdaccio');
+    expect(config.getConfig()).toEqual({
+      security: {
+        api: {
+          legacy: false,
+        },
+        web: {
+          verify: {},
+          sign: {
+            algorithm: 'ES256',
+          },
+        },
+      },
+      uplinks: {},
+      packages: {},
+      storage: '/tmp/verdaccio',
+    });
   });
 });

package/test/config-parsing.spec.ts

@@ -1,5 +1,6 @@
 import fs from 'fs';
 import path from 'path';
+import { describe, expect, test } from 'vitest';
 
 import { fileUtils } from '@verdaccio/core';
 

package/test/config-utils.spec.ts

@@ -1,4 +1,5 @@
 import path from 'path';
+import { describe, expect, test } from 'vitest';
 
 import { fileExists, folderExists } from '../src/config-utils';
 

package/test/config.path.spec.ts

@@ -1,76 +1,105 @@
+import fs from 'fs';
 import os from 'os';
+import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 
 import { findConfigFile } from '../src/config-path';
 
-const mockmkDir = jest.fn();
-const mockaccessSync = jest.fn();
-const mockwriteFile = jest.fn();
-
-jest.mock('fs', () => {
-  const fsOri = jest.requireActual('fs');
-  return {
-    ...fsOri,
-    statSync: (path) => ({
-      isDirectory: () => {
-        if (path.match(/fail/)) {
-          throw Error('file does not exist');
-        }
-        return true;
-      },
-    }),
-    accessSync: (a) => mockaccessSync(a),
-    mkdirSync: (a) => mockmkDir(a),
-    writeFileSync: (a) => mockwriteFile(a),
+describe('config-path', () => {
+  let statSyncMock;
+  let mkdirSyncMock;
+  let writeFileSyncMock;
+  let accessSyncMock;
+  let fakeStats = {
+    isDirectory: vi.fn().mockReturnValue(true),
   };
-});
-
-jest.mock('fs');
 
-describe('config-path', () => {
   beforeEach(() => {
-    jest.clearAllMocks();
-    jest.resetAllMocks();
+    // Mock only statSync method
+    statSyncMock = vi.spyOn(fs, 'statSync');
+    mkdirSyncMock = vi.spyOn(fs, 'mkdirSync');
+    writeFileSyncMock = vi.spyOn(fs, 'writeFileSync');
+    accessSyncMock = vi.spyOn(fs, 'accessSync');
+  });
+
+  afterEach(() => {
+    // Restore the original implementation after each test
+    statSyncMock.mockRestore();
+    vi.unstubAllEnvs();
   });
 
+  function platformPath(path: string): string {
+    return path.replace(/\//g, os.platform() === 'win32' ? '\\' : '/');
+  }
+
   describe('findConfigFile', () => {
-    if (os.platform() !== 'win32') {
-      describe('using defiled location from arguments', () => {
-        test('with custom location', () => {
-          expect(findConfigFile('/home/user/custom/location/config.yaml')).toEqual(
-            '/home/user/custom/location/config.yaml'
-          );
-          expect(mockwriteFile).not.toHaveBeenCalled();
-          expect(mockmkDir).not.toHaveBeenCalled();
-        });
+    describe('using file location from arguments', () => {
+      test('with custom location', () => {
+        // mock
+        statSyncMock.mockReturnValue(fakeStats);
+        mkdirSyncMock.mockReturnValue(true);
+        writeFileSyncMock.mockReturnValue(undefined);
+        // Note: on Windows, path contains drive letter
+        expect(findConfigFile('/home/user/custom/location/config.yaml')).toMatch(
+          platformPath('/home/user/custom/location/config.yaml')
+        );
+        expect(writeFileSyncMock).not.toHaveBeenCalled();
+        expect(mkdirSyncMock).not.toHaveBeenCalled();
       });
+    });
 
-      describe('whith env variables', () => {
-        test('with XDG_CONFIG_HOME if directory exist but config file is missing', () => {
-          process.env.XDG_CONFIG_HOME = '/home/user';
-          expect(findConfigFile()).toEqual('/home/user/verdaccio/config.yaml');
-          expect(mockwriteFile).toHaveBeenCalledWith('/home/user/verdaccio/config.yaml');
-          expect(mockmkDir).toHaveBeenCalledWith('/home/user/verdaccio');
-        });
+    describe('with env variables', () => {
+      test('the env XDG_CONFIG_HOME is defined and the directory exist but config file is missing', async () => {
+        // mock
+        statSyncMock.mockReturnValue(fakeStats);
+        mkdirSyncMock.mockReturnValue(true);
+        writeFileSyncMock.mockReturnValue(undefined);
+        // node env variable
+        vi.stubEnv('XDG_CONFIG_HOME', '/home/user');
 
-        test('with HOME if directory exist but config file is missing', () => {
-          delete process.env.XDG_CONFIG_HOME;
-          process.env.HOME = '/home/user';
-          expect(findConfigFile()).toEqual('/home/user/.config/verdaccio/config.yaml');
-          expect(mockwriteFile).toHaveBeenCalledWith('/home/user/.config/verdaccio/config.yaml');
-          expect(mockmkDir).toHaveBeenCalledWith('/home/user/.config/verdaccio');
-        });
+        expect(findConfigFile()).toEqual(platformPath('/home/user/verdaccio/config.yaml'));
+        expect(writeFileSyncMock).toHaveBeenCalledWith(
+          platformPath('/home/user/verdaccio/config.yaml'),
+          expect.stringContaining('packages')
+        );
+      });
+
+      test('with HOME if directory exist but config file is missing', () => {
+        // mock
+        statSyncMock.mockReturnValue(fakeStats);
+        mkdirSyncMock.mockReturnValue(true);
+        writeFileSyncMock.mockReturnValue(undefined);
+        vi.stubEnv('XDG_CONFIG_HOME', '');
+        vi.stubEnv('HOME', '/home/user');
+        expect(findConfigFile()).toEqual(platformPath('/home/user/.config/verdaccio/config.yaml'));
+        expect(writeFileSyncMock).toHaveBeenCalledWith(
+          platformPath('/home/user/.config/verdaccio/config.yaml'),
+          expect.stringContaining('packages')
+        );
+        expect(mkdirSyncMock).toHaveBeenCalledWith(
+          platformPath('/home/user/.config/verdaccio'),
+          expect.anything()
+        );
+      });
 
-        describe('error handling', () => {
-          test('XDG_CONFIG_HOME is not directory fallback to default', () => {
-            process.env.XDG_CONFIG_HOME = '/home/user/fail';
-            mockaccessSync.mockImplementation(() => {});
-            mockwriteFile.mockImplementation(() => {});
-            expect(findConfigFile()).toMatch('packages/config/verdaccio/config.yaml');
+      describe('error handling', () => {
+        test('XDG_CONFIG_HOME is not directory fallback to default', () => {
+          // mock
+          statSyncMock.mockReturnValue({
+            isDirectory: vi.fn().mockReturnValue(false),
           });
+          mkdirSyncMock.mockReturnValue(true);
+          writeFileSyncMock.mockReturnValue(undefined);
+          // node env variable
+          vi.stubEnv('XDG_CONFIG_HOME', '/home/user/fail');
 
+          expect(findConfigFile()).toMatch(platformPath('packages/config/verdaccio/config.yaml'));
+        });
+
+        // Does not work on Windows
+        if (os.platform() !== 'win32') {
           test('no permissions on read default config file', () => {
-            process.env.XDG_CONFIG_HOME = '/home/user';
-            mockaccessSync.mockImplementation(() => {
+            vi.stubEnv('XDG_CONFIG_HOME', '/home/user');
+            accessSyncMock.mockImplementation(() => {
               throw new Error('error on write file');
             });
 
@@ -78,29 +107,28 @@ describe('config-path', () => {
               findConfigFile();
             }).toThrow(/configuration file does not have enough permissions for reading/);
           });
-        });
+        }
       });
+    });
 
-      describe('with no env variables', () => {
+    // Note: Trying to mock Windows platform leads to different results (incorrect slashes)
+    if (os.platform() === 'win32') {
+      describe('with Windows env variables', () => {
         test('with relative location', () => {
-          mockaccessSync.mockImplementation(() => {});
-          delete process.env.XDG_CONFIG_HOME;
-          delete process.env.HOME;
-          process.env.APPDATA = '/app/data/';
-          expect(findConfigFile()).toMatch('packages/config/verdaccio/config.yaml');
-          expect(mockwriteFile).toHaveBeenCalled();
-          expect(mockmkDir).toHaveBeenCalled();
+          // mock
+          statSyncMock.mockReturnValue(fakeStats);
+          mkdirSyncMock.mockReturnValue(true);
+          writeFileSyncMock.mockReturnValue(undefined);
+          accessSyncMock.mockImplementation(() => {});
+          // delete process.env.XDG_CONFIG_HOME;
+          vi.stubEnv('XDG_CONFIG_HOME', '');
+          vi.stubEnv('HOME', '');
+          vi.stubEnv('APPDATA', 'C:\\Users\\Tester\\AppData\\');
+          expect(findConfigFile()).toEqual('C:\\Users\\Tester\\AppData\\verdaccio\\config.yaml');
+          expect(writeFileSyncMock).toHaveBeenCalled();
+          expect(mkdirSyncMock).toHaveBeenCalled();
         });
       });
-    } else {
-      test('with windows as directory exist but config file is missing', () => {
-        delete process.env.XDG_CONFIG_HOME;
-        delete process.env.HOME;
-        process.env.APPDATA = '/app/data/';
-        expect(findConfigFile()).toMatch('\\app\\data\\verdaccio\\config.yaml');
-        expect(mockwriteFile).toHaveBeenCalled();
-        expect(mockmkDir).toHaveBeenCalled();
-      });
     }
   });
 });

package/test/config.spec.ts

@@ -1,14 +1,18 @@
 import _ from 'lodash';
 import path from 'path';
+import { describe, expect, test } from 'vitest';
 
 import {
   Config,
   DEFAULT_REGISTRY,
   DEFAULT_UPLINK,
   ROLES,
+  TOKEN_VALID_LENGTH,
   WEB_TITLE,
   defaultSecurity,
+  generateRandomSecretKey,
   getDefaultConfig,
+  isNodeVersionGreaterThan21,
   parseConfigFile,
 } from '../src';
 import { parseConfigurationFile } from './utils';
@@ -19,6 +23,8 @@ const resolveConf = (conf) => {
   return path.join(__dirname, `../src/conf/${name}${ext.startsWith('.') ? ext : '.yaml'}`);
 };
 
+const itif = (condition) => (condition ? test : test.skip);
+
 const checkDefaultUplink = (config) => {
   expect(_.isObject(config.uplinks[DEFAULT_UPLINK])).toBeTruthy();
   expect(config.uplinks[DEFAULT_UPLINK].url).toMatch(DEFAULT_REGISTRY);
@@ -94,18 +100,85 @@ describe('check basic content parsed file', () => {
 describe('checkSecretKey', () => {
   test('with default.yaml and pre selected secret', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    expect(config.checkSecretKey('12345')).toEqual('12345');
+    expect(config.checkSecretKey(generateRandomSecretKey())).toHaveLength(TOKEN_VALID_LENGTH);
   });
 
   test('with default.yaml and void secret', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    expect(typeof config.checkSecretKey() === 'string').toBeTruthy();
+    const secret = config.checkSecretKey();
+    expect(typeof secret === 'string').toBeTruthy();
+    expect(secret).toHaveLength(TOKEN_VALID_LENGTH);
+  });
+
+  test('with default.yaml and empty string secret', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')));
+    const secret = config.checkSecretKey('');
+    expect(typeof secret === 'string').toBeTruthy();
+    expect(secret).toHaveLength(TOKEN_VALID_LENGTH);
   });
 
-  test('with default.yaml and emtpy string secret', () => {
+  test('with default.yaml and valid string secret length', () => {
     const config = new Config(parseConfigFile(resolveConf('default')));
-    expect(typeof config.checkSecretKey('') === 'string').toBeTruthy();
+    expect(typeof config.checkSecretKey(generateRandomSecretKey()) === 'string').toBeTruthy();
+  });
+
+  test('with default.yaml migrate a valid string secret length', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')), {
+      forceMigrateToSecureLegacySignature: true,
+    });
+    expect(
+      // 64 characters secret long
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toHaveLength(TOKEN_VALID_LENGTH);
+  });
+
+  // only runs on Node.js 22 or higher
+  itif(isNodeVersionGreaterThan21())('with enhanced legacy signature Node 22 or higher', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')), {
+      forceMigrateToSecureLegacySignature: false,
+    });
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(() =>
+      // 64 characters secret long
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toThrow();
+  });
+
+  itif(isNodeVersionGreaterThan21())('with enhanced legacy signature Node 22 or higher', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')), {
+      forceMigrateToSecureLegacySignature: false,
+    });
+    config.security.api.migrateToSecureLegacySignature = true;
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toHaveLength(TOKEN_VALID_LENGTH);
   });
+
+  itif(isNodeVersionGreaterThan21() === false)(
+    'with old unsecure legacy signature Node 21 or lower',
+    () => {
+      const config = new Config(parseConfigFile(resolveConf('default')));
+      config.security.api.migrateToSecureLegacySignature = false;
+      // 64 characters secret long
+      // eslint-disable-next-line jest/no-standalone-expect
+      expect(
+        config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+      ).toHaveLength(64);
+    }
+  );
+
+  test('with migration to new legacy signature Node 21 or lower', () => {
+    const config = new Config(parseConfigFile(resolveConf('default')));
+    config.security.api.migrateToSecureLegacySignature = true;
+    // 64 characters secret long
+    // eslint-disable-next-line jest/no-standalone-expect
+    expect(
+      config.checkSecretKey('b4982dbb0108531fafb552374d7e83724b6458a2b3ffa97ad0edb899bdaefc4a')
+    ).toHaveLength(TOKEN_VALID_LENGTH);
+  });
+
+  test.todo('test emit warning with secret key');
 });
 
 describe('getMatchedPackagesSpec', () => {
@@ -159,3 +232,18 @@ describe('VERDACCIO_STORAGE_PATH', () => {
     delete process.env.VERDACCIO_STORAGE_PATH;
   });
 });
+
+describe('configPath', () => {
+  test('should set configPath in config', () => {
+    const defaultConfig = parseConfigFile(resolveConf('default'));
+    const config = new Config(defaultConfig);
+    expect(config.getConfigPath()).toBe(path.join(__dirname, '../src/conf/default.yaml'));
+  });
+
+  test('should throw an error if configPath is not provided', () => {
+    const defaultConfig = parseConfigFile(resolveConf('default'));
+    defaultConfig.configPath = '';
+    defaultConfig.config_path = '';
+    expect(() => new Config(defaultConfig)).toThrow('configPath property is required');
+  });
+});

package/test/package-access.spec.ts

@@ -1,7 +1,8 @@
 import _ from 'lodash';
+import { describe, expect, test } from 'vitest';
 
 import { parseConfigFile } from '../src';
-import { PACKAGE_ACCESS, normalisePackageAccess } from '../src/package-access';
+import { PACKAGE_ACCESS, normalisePackageAccess, normalizeUserList } from '../src/package-access';
 import { parseConfigurationFile } from './utils';
 
 describe('Package access utilities', () => {
@@ -123,4 +124,30 @@ describe('Package access utilities', () => {
       expect(_.isArray(all.publish)).toBeTruthy();
     });
   });
+  describe('normaliseUserList', () => {
+    test('should normalize user list', () => {
+      const groupsList = 'admin superadmin';
+      const result = normalizeUserList(groupsList);
+      expect(result).toEqual(['admin', 'superadmin']);
+    });
+
+    test('should normalize empty user list', () => {
+      const groupsList = '';
+      const result = normalizeUserList(groupsList);
+      expect(result).toEqual([]);
+    });
+
+    test('should normalize user list array', () => {
+      const groupsList = ['admin', 'superadmin'];
+      const result = normalizeUserList(groupsList);
+      expect(result).toEqual(['admin', 'superadmin']);
+    });
+
+    test('should throw error for invalid user list', () => {
+      const groupsList = { group: 'admin' };
+      expect(() => {
+        normalizeUserList(groupsList);
+      }).toThrow('CONFIG: bad package acl (array or string expected): {"group":"admin"}');
+    });
+  });
 });

package/test/token.spec.ts

@@ -1,3 +1,5 @@
+import { expect, test } from 'vitest';
+
 import { TOKEN_VALID_LENGTH, generateRandomSecretKey } from '../src/token';
 
 test('token test valid length', () => {

package/test/uplinks.spec.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { normalisePackageAccess, parseConfigFile } from '../src';
 import { hasProxyTo, sanityCheckUplinksProps, uplinkSanityCheck } from '../src/uplinks';
 import { parseConfigurationFile } from './utils';

package/test/utils.spec.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { ROLES, createAnonymousRemoteUser, createRemoteUser } from '../src';
 
 describe('createRemoteUser and createAnonymousRemoteUser', () => {

package/jest.config.js

@@ -1,10 +0,0 @@
-const config = require('../../jest/config');
-
-module.exports = Object.assign({}, config, {
-  coverageThreshold: {
-    global: {
-      // FIXME: increase to 90
-      lines: 85,
-    },
-  },
-});