@verdaccio/config 8.0.0-next-8.14 → 8.0.0-next-8.16

package/build/config.d.ts

@@ -24,7 +24,7 @@ declare class Config implements AppConfig {
     storage: string | void;
     plugins: string | void | null;
     security: Security;
-    serverSettings: ServerSettingsConf;
+    server: ServerSettingsConf;
     private configOverrideOptions;
     secret: string;
     flags: FlagsConfig;
@@ -38,6 +38,9 @@ declare class Config implements AppConfig {
     getConfigPath(): string;
     /**
      * Check for package spec
+     * @param pkgName - package name
+     * @returns package access
+     * @deprecated use core.authUtils instead
      */
     getMatchedPackagesSpec(pkgName: string): PackageAccess | void;
     /**

package/build/config.js

@@ -10,7 +10,6 @@ var _debug = _interopRequireDefault(require("debug"));
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
 var _warningUtils = require("@verdaccio/core/build/warning-utils");
-var _utils = require("@verdaccio/utils");
 var _agent = require("./agent");
 var _packageAccess = require("./package-access");
 var _security = require("./security");
@@ -75,10 +74,14 @@ class Config {
         migrateToSecureLegacySignature: this.configOverrideOptions.forceMigrateToSecureLegacySignature
       }
     }), config.security);
-    this.serverSettings = _serverSettings.default;
+    this.server = {
+      ..._serverSettings.default,
+      ...config.server
+    };
     this.flags = {
       searchRemote: config.flags?.searchRemote ?? true,
-      changePassword: config.flags?.changePassword ?? false
+      changePassword: config.flags?.changePassword ?? false,
+      webLogin: config.flags?.webLogin ?? false
     };
     this.user_agent = config.user_agent;
     for (const configProp in config) {
@@ -119,7 +122,7 @@ class Config {
     // unique identifier of self server (or a cluster), used to avoid loops
     // @ts-ignore
     if (!this.server_id) {
-      this.server_id = (0, _utils.generateRandomHexString)(6);
+      this.server_id = _core.cryptoUtils.generateRandomHexString(6);
     }
   }
   getMigrateToSecureLegacySignature() {
@@ -131,10 +134,13 @@ class Config {
 
   /**
    * Check for package spec
+   * @param pkgName - package name
+   * @returns package access
+   * @deprecated use core.authUtils instead
    */
   getMatchedPackagesSpec(pkgName) {
     // TODO: remove this method and replace by library utils
-    return (0, _utils.getMatchedPackagesSpec)(pkgName, this.packages);
+    return _core.authUtils.getMatchedPackagesSpec(pkgName, this.packages);
   }
 
   /**

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_utils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","e","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","isNodeVersionGreaterThan21","major","minor","process","versions","node","split","map","Number","TOKEN_VALID_LENGTH","Config","constructor","config","configOverrideOptions","forceMigrateToSecureLegacySignature","self","storage","env","VERDACCIO_STORAGE_PATH","configPath","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","api","migrateToSecureLegacySignature","serverSettings","flags","searchRemote","changePassword","user_agent","configProp","getUserAgent","userRateLimit","assert","validationUtils","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","generateRandomHexString","getMigrateToSecureLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","checkSecretKey","secret","isEmpty","length","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR007"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, validationUtils, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\nimport { generateRandomHexString, getMatchedPackagesSpec } from '@verdaccio/utils';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport serverSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public serverSettings: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.serverSettings = serverSettings;\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length > TOKEN_VALID_LENGTH) {\n        if (isNodeVersionGreaterThan21()) {\n          debug('is node version greater than 21');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          // oops, user needs to generate a new secret key\n          debug(\n            'secret does not comply with the required length, current length  %d, application will fail on startup',\n            secret.length\n          );\n          throw new Error(\n            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n          );\n        } else {\n          debug('is node version lower than 22');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          debug('triggering deprecation warning for secret key length %s', secret.length);\n          // still using Node.js versions previous to 22, but we need to emit a deprecation warning\n          // deprecation warning, secret key is too long and must be 32\n          // this will be removed in the next major release and will produce an error\n          warningUtils.emit(Codes.VERWAR007);\n          this.secret = secret;\n          return this.secret;\n        }\n      } else if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      debug('reusing previous key with length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAYA,IAAAK,MAAA,GAAAL,OAAA;AAEA,IAAAM,MAAA,GAAAN,OAAA;AACA,IAAAO,cAAA,GAAAP,OAAA;AACA,IAAAQ,SAAA,GAAAR,OAAA;AACA,IAAAS,eAAA,GAAAV,sBAAA,CAAAC,OAAA;AACA,IAAAU,MAAA,GAAAV,OAAA;AACA,IAAAW,QAAA,GAAAX,OAAA;AAAuE,SAAAD,uBAAAa,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;AAEM,SAASC,0BAA0BA,CAAA,EAAG;EAC3C,MAAM,CAACC,KAAK,EAAEC,KAAK,CAAC,GAAGC,OAAO,CAACC,QAAQ,CAACC,IAAI,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,GAAG,CAACC,MAAM,CAAC;EACnE,OAAOP,KAAK,GAAG,EAAE,IAAKA,KAAK,KAAK,EAAE,IAAIC,KAAK,IAAI,CAAE;AACnD;AAEA,MAAMO,kBAAkB,GAAG,EAAE;;AAE7B;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAShC;AACF;AACA;;EAQE;;EAIOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,qBAAqB,GAAG;IAAEC,mCAAmC,EAAE;EAAK,CAAC,EACrE;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACC,OAAO,GAAGb,OAAO,CAACc,GAAG,CAACC,sBAAsB,IAAIN,MAAM,CAACI,OAAO;IACnE,IAAI,CAACJ,MAAM,CAACO,UAAU,EAAE;MACtB;MACA;MACAP,MAAM,CAACO,UAAU,GAAGP,MAAM,CAACQ,WAAW,IAAIR,MAAM,CAACS,SAAS;MAC1D,IAAI,CAACT,MAAM,CAACO,UAAU,EAAE;QACtB,MAAM,IAAIG,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACT,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACM,UAAU,GAAGP,MAAM,CAACO,UAAU;IACnC,IAAI,CAACE,SAAS,GAAG,IAAI,CAACF,UAAU;IAChC1B,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC0B,UAAU,CAAC;IACzC,IAAI,CAACI,OAAO,GAAGX,MAAM,CAACW,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK;IACrB;IACAD,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAE;MACvBC,GAAG,EAAE;QACHC,8BAA8B,EAC5B,IAAI,CAAChB,qBAAqB,CAACC;MAC/B;IACF,CAAC,CAAC,EACFF,MAAM,CAACY,QACT,CAAC;IACD,IAAI,CAACM,cAAc,GAAGA,uBAAc;IACpC,IAAI,CAACC,KAAK,GAAG;MACXC,YAAY,EAAEpB,MAAM,CAACmB,KAAK,EAAEC,YAAY,IAAI,IAAI;MAChDC,cAAc,EAAErB,MAAM,CAACmB,KAAK,EAAEE,cAAc,IAAI;IAClD,CAAC;IACD,IAAI,CAACC,UAAU,GAAGtB,MAAM,CAACsB,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAIvB,MAAM,EAAE;MAC/B,IAAIG,IAAI,CAACoB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BpB,IAAI,CAACoB,UAAU,CAAC,GAAGvB,MAAM,CAACuB,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACAzC,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAACyC,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAGxC,uBAAuB;MAAE,GAAGe,MAAM,EAAEyB;IAAc,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACC,qBAAe,CAACC,QAAQ,CAAC5B,MAAM,CAAC,EAAE6B,eAAS,CAACC,gBAAgB,CAAC;;IAEpE;IACAnD,oBAAoB,CAACoD,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI7B,IAAI,CAAC6B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB7B,IAAI,CAAC6B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAN,eAAM,EAACC,qBAAe,CAACC,QAAQ,CAACzB,IAAI,CAAC6B,CAAC,CAAC,CAAC,EAAE,gBAAgBA,CAAC,2BAA2B,CAAC;IACzF,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAAClC,IAAI,CAACiC,QAAQ,CAAC;;IAErD;IACAxD,gBAAgB,CAACmD,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAInC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACmC,OAAO,CAAC,GAAG/C,OAAO,CAACc,GAAG,CAACiC,OAAO,CAAC,IAAI/C,OAAO,CAACc,GAAG,CAACiC,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAG,IAAAC,8BAAuB,EAAC,CAAC,CAAC;IAC7C;EACF;EAEOC,iCAAiCA,CAAA,EAAG;IACzC,OAAO,IAAI,CAAC9B,QAAQ,CAACI,GAAG,CAACC,8BAA8B;EACzD;EAEO0B,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACpC,UAAU;EACxB;;EAEA;AACF;AACA;EACSqC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAO,IAAAD,6BAAsB,EAACC,OAAO,EAAE,IAAI,CAACT,QAAQ,CAAC;EACvD;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACSU,cAAcA,CAACC,MAAe,EAAU;IAC7ClE,KAAK,CAAC,0BAA0B,CAAC;IACjC,IAAI,OAAOkE,MAAM,KAAK,QAAQ,IAAIlC,eAAC,CAACmC,OAAO,CAACD,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7DlE,KAAK,CAAC,+BAA+B,EAAEkE,MAAM,CAACE,MAAM,CAAC;MACrD,IAAIF,MAAM,CAACE,MAAM,GAAGpD,kBAAkB,EAAE;QACtC,IAAIT,0BAA0B,CAAC,CAAC,EAAE;UAChCP,KAAK,CAAC,iCAAiC,CAAC;UACxC,IAAI,IAAI,CAAC6D,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACK,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvCrE,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACkE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACA;UACAlE,KAAK,CACH,uGAAuG,EACvGkE,MAAM,CAACE,MACT,CAAC;UACD,MAAM,IAAIvC,KAAK,CACb,wEAAwEqC,MAAM,CAACE,MAAM;AACjG;AACA,kFACU,CAAC;QACH,CAAC,MAAM;UACLpE,KAAK,CAAC,+BAA+B,CAAC;UACtC,IAAI,IAAI,CAAC6D,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACK,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvCrE,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACkE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACAlE,KAAK,CAAC,yDAAyD,EAAEkE,MAAM,CAACE,MAAM,CAAC;UAC/E;UACA;UACA;UACAE,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;UAClC,IAAI,CAACP,MAAM,GAAGA,MAAM;UACpB,OAAO,IAAI,CAACA,MAAM;QACpB;MACF,CAAC,MAAM,IAAIA,MAAM,CAACE,MAAM,KAAKpD,kBAAkB,EAAE;QAC/ChB,KAAK,CAAC,qCAAqC,EAAEkE,MAAM,CAACE,MAAM,CAAC;QAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;QACpB,OAAO,IAAI,CAACA,MAAM;MACpB;MACAlE,KAAK,CAAC,qCAAqC,EAAEkE,MAAM,CAACE,MAAM,CAAC;MAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;MACpB,OAAO,IAAI,CAACA,MAAM;IACpB,CAAC,MAAM;MACL;MACA;MACAlE,KAAK,CAAC,6BAA6B,CAAC;MACpC,IAAI,CAACkE,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;MACvCrE,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAACkE,MAAM,EAAEE,MAAM,CAAC;MAElE,OAAO,IAAI,CAACF,MAAM;IACpB;EACF;AACF;AAAC/D,OAAA,CAAAc,MAAA,GAAAA,MAAA","ignoreList":[]}
+{"version":3,"file":"config.js","names":["_assert","_interopRequireDefault","require","_debug","_lodash","_core","_warningUtils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","e","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","isNodeVersionGreaterThan21","major","minor","process","versions","node","split","map","Number","TOKEN_VALID_LENGTH","Config","constructor","config","configOverrideOptions","forceMigrateToSecureLegacySignature","self","storage","env","VERDACCIO_STORAGE_PATH","configPath","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","api","migrateToSecureLegacySignature","server","defaultServerSettings","flags","searchRemote","changePassword","webLogin","user_agent","configProp","getUserAgent","userRateLimit","assert","validationUtils","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","cryptoUtils","generateRandomHexString","getMigrateToSecureLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","authUtils","checkSecretKey","secret","isEmpty","length","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR007"],"sources":["../src/config.ts"],"sourcesContent":["import assert from 'assert';\nimport buildDebug from 'debug';\nimport _ from 'lodash';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length > TOKEN_VALID_LENGTH) {\n        if (isNodeVersionGreaterThan21()) {\n          debug('is node version greater than 21');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          // oops, user needs to generate a new secret key\n          debug(\n            'secret does not comply with the required length, current length  %d, application will fail on startup',\n            secret.length\n          );\n          throw new Error(\n            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n          );\n        } else {\n          debug('is node version lower than 22');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          debug('triggering deprecation warning for secret key length %s', secret.length);\n          // still using Node.js versions previous to 22, but we need to emit a deprecation warning\n          // deprecation warning, secret key is too long and must be 32\n          // this will be removed in the next major release and will produce an error\n          warningUtils.emit(Codes.VERWAR007);\n          this.secret = secret;\n          return this.secret;\n        }\n      } else if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      debug('reusing previous key with length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,MAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAaA,IAAAK,MAAA,GAAAL,OAAA;AACA,IAAAM,cAAA,GAAAN,OAAA;AACA,IAAAO,SAAA,GAAAP,OAAA;AACA,IAAAQ,eAAA,GAAAT,sBAAA,CAAAC,OAAA;AACA,IAAAS,MAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AAAuE,SAAAD,uBAAAY,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;AAEM,SAASC,0BAA0BA,CAAA,EAAG;EAC3C,MAAM,CAACC,KAAK,EAAEC,KAAK,CAAC,GAAGC,OAAO,CAACC,QAAQ,CAACC,IAAI,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,GAAG,CAACC,MAAM,CAAC;EACnE,OAAOP,KAAK,GAAG,EAAE,IAAKA,KAAK,KAAK,EAAE,IAAIC,KAAK,IAAI,CAAE;AACnD;AAEA,MAAMO,kBAAkB,GAAG,EAAE;;AAE7B;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAShC;AACF;AACA;;EAQE;;EAIOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,qBAAqB,GAAG;IAAEC,mCAAmC,EAAE;EAAK,CAAC,EACrE;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACC,OAAO,GAAGb,OAAO,CAACc,GAAG,CAACC,sBAAsB,IAAIN,MAAM,CAACI,OAAO;IACnE,IAAI,CAACJ,MAAM,CAACO,UAAU,EAAE;MACtB;MACA;MACAP,MAAM,CAACO,UAAU,GAAGP,MAAM,CAACQ,WAAW,IAAIR,MAAM,CAACS,SAAS;MAC1D,IAAI,CAACT,MAAM,CAACO,UAAU,EAAE;QACtB,MAAM,IAAIG,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACT,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACM,UAAU,GAAGP,MAAM,CAACO,UAAU;IACnC,IAAI,CAACE,SAAS,GAAG,IAAI,CAACF,UAAU;IAChC1B,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC0B,UAAU,CAAC;IACzC,IAAI,CAACI,OAAO,GAAGX,MAAM,CAACW,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK;IACrB;IACAD,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAE;MACvBC,GAAG,EAAE;QACHC,8BAA8B,EAC5B,IAAI,CAAChB,qBAAqB,CAACC;MAC/B;IACF,CAAC,CAAC,EACFF,MAAM,CAACY,QACT,CAAC;IACD,IAAI,CAACM,MAAM,GAAG;MAAE,GAAGC,uBAAqB;MAAE,GAAGnB,MAAM,CAACkB;IAAO,CAAC;IAC5D,IAAI,CAACE,KAAK,GAAG;MACXC,YAAY,EAAErB,MAAM,CAACoB,KAAK,EAAEC,YAAY,IAAI,IAAI;MAChDC,cAAc,EAAEtB,MAAM,CAACoB,KAAK,EAAEE,cAAc,IAAI,KAAK;MACrDC,QAAQ,EAAEvB,MAAM,CAACoB,KAAK,EAAEG,QAAQ,IAAI;IACtC,CAAC;IACD,IAAI,CAACC,UAAU,GAAGxB,MAAM,CAACwB,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAIzB,MAAM,EAAE;MAC/B,IAAIG,IAAI,CAACsB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BtB,IAAI,CAACsB,UAAU,CAAC,GAAGzB,MAAM,CAACyB,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACA3C,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAAC2C,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAG1C,uBAAuB;MAAE,GAAGe,MAAM,EAAE2B;IAAc,CAAC;;IAE7E;IACA,IAAAC,eAAM,EAACC,qBAAe,CAACC,QAAQ,CAAC9B,MAAM,CAAC,EAAE+B,eAAS,CAACC,gBAAgB,CAAC;;IAEpE;IACArD,oBAAoB,CAACsD,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAI/B,IAAI,CAAC+B,CAAC,CAAC,IAAI,IAAI,EAAE;QACnB/B,IAAI,CAAC+B,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAN,eAAM,EAACC,qBAAe,CAACC,QAAQ,CAAC3B,IAAI,CAAC+B,CAAC,CAAC,CAAC,EAAE,gBAAgBA,CAAC,2BAA2B,CAAC;IACzF,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACpC,IAAI,CAACmC,QAAQ,CAAC;;IAErD;IACA1D,gBAAgB,CAACqD,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAIrC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACqC,OAAO,CAAC,GAAGjD,OAAO,CAACc,GAAG,CAACmC,OAAO,CAAC,IAAIjD,OAAO,CAACc,GAAG,CAACmC,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAGC,iBAAW,CAACC,uBAAuB,CAAC,CAAC,CAAC;IACzD;EACF;EAEOC,iCAAiCA,CAAA,EAAG;IACzC,OAAO,IAAI,CAACjC,QAAQ,CAACI,GAAG,CAACC,8BAA8B;EACzD;EAEO6B,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACvC,UAAU;EACxB;;EAEA;AACF;AACA;AACA;AACA;AACA;EACSwC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAOC,eAAS,CAACF,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACV,QAAQ,CAAC;EACjE;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACSY,cAAcA,CAACC,MAAe,EAAU;IAC7CtE,KAAK,CAAC,0BAA0B,CAAC;IACjC,IAAI,OAAOsE,MAAM,KAAK,QAAQ,IAAItC,eAAC,CAACuC,OAAO,CAACD,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7DtE,KAAK,CAAC,+BAA+B,EAAEsE,MAAM,CAACE,MAAM,CAAC;MACrD,IAAIF,MAAM,CAACE,MAAM,GAAGxD,kBAAkB,EAAE;QACtC,IAAIT,0BAA0B,CAAC,CAAC,EAAE;UAChCP,KAAK,CAAC,iCAAiC,CAAC;UACxC,IAAI,IAAI,CAACgE,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACM,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvCzE,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACsE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACA;UACAtE,KAAK,CACH,uGAAuG,EACvGsE,MAAM,CAACE,MACT,CAAC;UACD,MAAM,IAAI3C,KAAK,CACb,wEAAwEyC,MAAM,CAACE,MAAM;AACjG;AACA,kFACU,CAAC;QACH,CAAC,MAAM;UACLxE,KAAK,CAAC,+BAA+B,CAAC;UACtC,IAAI,IAAI,CAACgE,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACM,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvCzE,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACsE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACAtE,KAAK,CAAC,yDAAyD,EAAEsE,MAAM,CAACE,MAAM,CAAC;UAC/E;UACA;UACA;UACAE,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;UAClC,IAAI,CAACP,MAAM,GAAGA,MAAM;UACpB,OAAO,IAAI,CAACA,MAAM;QACpB;MACF,CAAC,MAAM,IAAIA,MAAM,CAACE,MAAM,KAAKxD,kBAAkB,EAAE;QAC/ChB,KAAK,CAAC,qCAAqC,EAAEsE,MAAM,CAACE,MAAM,CAAC;QAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;QACpB,OAAO,IAAI,CAACA,MAAM;MACpB;MACAtE,KAAK,CAAC,qCAAqC,EAAEsE,MAAM,CAACE,MAAM,CAAC;MAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;MACpB,OAAO,IAAI,CAACA,MAAM;IACpB,CAAC,MAAM;MACL;MACA;MACAtE,KAAK,CAAC,6BAA6B,CAAC;MACpC,IAAI,CAACsE,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;MACvCzE,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAACsE,MAAM,EAAEE,MAAM,CAAC;MAElE,OAAO,IAAI,CAACF,MAAM;IACpB;EACF;AACF;AAACnE,OAAA,CAAAc,MAAA,GAAAA,MAAA","ignoreList":[]}

package/build/token.d.ts

@@ -1,6 +1,5 @@
 export declare const TOKEN_VALID_LENGTH = 32;
 /**
  * Secret key must have 32 characters.
- * // TODO: code duplicated at @verdaccio/signature
  */
 export declare function generateRandomSecretKey(): string;

package/build/token.js

@@ -6,12 +6,10 @@ Object.defineProperty(exports, "__esModule", {
 exports.TOKEN_VALID_LENGTH = void 0;
 exports.generateRandomSecretKey = generateRandomSecretKey;
 var _crypto = require("crypto");
-// TODO: code duplicated at @verdaccio/signature
 const TOKEN_VALID_LENGTH = exports.TOKEN_VALID_LENGTH = 32;
 
 /**
  * Secret key must have 32 characters.
- * // TODO: code duplicated at @verdaccio/signature
  */
 function generateRandomSecretKey() {
   return (0, _crypto.randomBytes)(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);

package/build/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["_crypto","require","TOKEN_VALID_LENGTH","exports","generateRandomSecretKey","randomBytes","toString","substring"],"sources":["../src/token.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\n\n// TODO: code duplicated at @verdaccio/signature\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Secret key must have 32 characters.\n * // TODO: code duplicated at @verdaccio/signature\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEA;AACO,MAAMC,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACA;AACO,SAASE,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACH,kBAAkB,CAAC,CAACI,QAAQ,CAAC,QAAQ,CAAC,CAACC,SAAS,CAAC,CAAC,EAAEL,kBAAkB,CAAC;AAC5F","ignoreList":[]}
+{"version":3,"file":"token.js","names":["_crypto","require","TOKEN_VALID_LENGTH","exports","generateRandomSecretKey","randomBytes","toString","substring"],"sources":["../src/token.ts"],"sourcesContent":["import { randomBytes } from 'crypto';\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Secret key must have 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACO,SAASE,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACH,kBAAkB,CAAC,CAACI,QAAQ,CAAC,QAAQ,CAAC,CAACC,SAAS,CAAC,CAAC,EAAEL,kBAAkB,CAAC;AAC5F","ignoreList":[]}

package/build/uplinks.js

@@ -11,7 +11,7 @@ exports.sanityCheckUplinksProps = sanityCheckUplinksProps;
 exports.uplinkSanityCheck = uplinkSanityCheck;
 var _assert = _interopRequireDefault(require("assert"));
 var _lodash = _interopRequireDefault(require("lodash"));
-var _utils = require("@verdaccio/utils");
+var _core = require("@verdaccio/core");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const DEFAULT_REGISTRY = exports.DEFAULT_REGISTRY = 'https://registry.npmjs.org';
 const DEFAULT_UPLINK = exports.DEFAULT_UPLINK = 'npmjs';
@@ -47,7 +47,7 @@ function sanityCheckUplinksProps(configUpLinks) {
   return uplinks;
 }
 function getProxiesForPackage(pkg, packages) {
-  const matchedPkg = (0, _utils.getMatchedPackagesSpec)(pkg, packages);
+  const matchedPkg = _core.authUtils.getMatchedPackagesSpec(pkg, packages);
   return matchedPkg?.proxy || [];
 }
 function hasProxyTo(pkg, upLink, packages) {

package/build/uplinks.js.map

@@ -1 +1 @@
-{"version":3,"file":"uplinks.js","names":["_assert","_interopRequireDefault","require","_lodash","_utils","e","__esModule","default","DEFAULT_REGISTRY","exports","DEFAULT_UPLINK","BLACKLIST","all","anonymous","undefined","owner","none","uplinkSanityCheck","uplinks","users","newUplinks","_","clone","newUsers","uplink","Object","prototype","hasOwnProperty","call","cache","sanityCheckNames","sanityCheckUplinksProps","configUpLinks","assert","url","isString","replace","getProxiesForPackage","pkg","packages","matchedPkg","getMatchedPackagesSpec","proxy","hasProxyTo","upLink","proxyList","some","curr","item","match","isNil"],"sources":["../src/uplinks.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { PackageList, UpLinksConfList } from '@verdaccio/types';\nimport { getMatchedPackagesSpec } from '@verdaccio/utils';\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org';\nexport const DEFAULT_UPLINK = 'npmjs';\n\nconst BLACKLIST = {\n  all: true,\n  anonymous: true,\n  undefined: true,\n  owner: true,\n  none: true,\n};\n\nexport function uplinkSanityCheck(\n  uplinks: UpLinksConfList,\n  users: any = BLACKLIST\n): UpLinksConfList {\n  const newUplinks = _.clone(uplinks);\n  let newUsers = _.clone(users);\n\n  for (const uplink in newUplinks) {\n    if (Object.prototype.hasOwnProperty.call(newUplinks, uplink)) {\n      if (typeof newUplinks[uplink].cache === 'undefined') {\n        newUplinks[uplink].cache = true;\n      }\n      newUsers = sanityCheckNames(uplink, newUsers);\n    }\n  }\n\n  return newUplinks;\n}\n\nexport function sanityCheckUplinksProps(configUpLinks: UpLinksConfList): UpLinksConfList {\n  const uplinks = _.clone(configUpLinks);\n\n  for (const uplink in uplinks) {\n    if (Object.prototype.hasOwnProperty.call(uplinks, uplink)) {\n      assert(uplinks[uplink].url, 'CONFIG: no url for uplink: ' + uplink);\n      assert(_.isString(uplinks[uplink].url), 'CONFIG: wrong url format for uplink: ' + uplink);\n      uplinks[uplink].url = uplinks[uplink].url.replace(/\\/$/, '');\n    }\n  }\n\n  return uplinks;\n}\n\nexport function getProxiesForPackage(pkg: string, packages: PackageList): string[] {\n  const matchedPkg = getMatchedPackagesSpec(pkg, packages);\n  return matchedPkg?.proxy || [];\n}\n\nexport function hasProxyTo(pkg: string, upLink: string, packages: PackageList): boolean {\n  const proxyList = getProxiesForPackage(pkg, packages);\n  if (proxyList) {\n    return proxyList.some((curr) => upLink === curr);\n  }\n\n  return false;\n}\n\nexport function sanityCheckNames(item: string, users: any): any {\n  assert(\n    item !== 'all' &&\n      item !== 'owner' &&\n      item !== 'anonymous' &&\n      item !== 'undefined' &&\n      item !== 'none',\n    'CONFIG: reserved uplink name: ' + item\n  );\n  assert(!item.match(/\\s/), 'CONFIG: invalid uplink name: ' + item);\n  assert(_.isNil(users[item]), 'CONFIG: duplicate uplink name: ' + item);\n  users[item] = true;\n\n  return users;\n}\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAGA,IAAAE,MAAA,GAAAF,OAAA;AAA0D,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEnD,MAAMG,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,4BAA4B;AACrD,MAAME,cAAc,GAAAD,OAAA,CAAAC,cAAA,GAAG,OAAO;AAErC,MAAMC,SAAS,GAAG;EAChBC,GAAG,EAAE,IAAI;EACTC,SAAS,EAAE,IAAI;EACfC,SAAS,EAAE,IAAI;EACfC,KAAK,EAAE,IAAI;EACXC,IAAI,EAAE;AACR,CAAC;AAEM,SAASC,iBAAiBA,CAC/BC,OAAwB,EACxBC,KAAU,GAAGR,SAAS,EACL;EACjB,MAAMS,UAAU,GAAGC,eAAC,CAACC,KAAK,CAACJ,OAAO,CAAC;EACnC,IAAIK,QAAQ,GAAGF,eAAC,CAACC,KAAK,CAACH,KAAK,CAAC;EAE7B,KAAK,MAAMK,MAAM,IAAIJ,UAAU,EAAE;IAC/B,IAAIK,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,UAAU,EAAEI,MAAM,CAAC,EAAE;MAC5D,IAAI,OAAOJ,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,KAAK,WAAW,EAAE;QACnDT,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,GAAG,IAAI;MACjC;MACAN,QAAQ,GAAGO,gBAAgB,CAACN,MAAM,EAAED,QAAQ,CAAC;IAC/C;EACF;EAEA,OAAOH,UAAU;AACnB;AAEO,SAASW,uBAAuBA,CAACC,aAA8B,EAAmB;EACvF,MAAMd,OAAO,GAAGG,eAAC,CAACC,KAAK,CAACU,aAAa,CAAC;EAEtC,KAAK,MAAMR,MAAM,IAAIN,OAAO,EAAE;IAC5B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,OAAO,EAAEM,MAAM,CAAC,EAAE;MACzD,IAAAS,eAAM,EAACf,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,EAAE,6BAA6B,GAAGV,MAAM,CAAC;MACnE,IAAAS,eAAM,EAACZ,eAAC,CAACc,QAAQ,CAACjB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAAC,EAAE,uCAAuC,GAAGV,MAAM,CAAC;MACzFN,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,GAAGhB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAACE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9D;EACF;EAEA,OAAOlB,OAAO;AAChB;AAEO,SAASmB,oBAAoBA,CAACC,GAAW,EAAEC,QAAqB,EAAY;EACjF,MAAMC,UAAU,GAAG,IAAAC,6BAAsB,EAACH,GAAG,EAAEC,QAAQ,CAAC;EACxD,OAAOC,UAAU,EAAEE,KAAK,IAAI,EAAE;AAChC;AAEO,SAASC,UAAUA,CAACL,GAAW,EAAEM,MAAc,EAAEL,QAAqB,EAAW;EACtF,MAAMM,SAAS,GAAGR,oBAAoB,CAACC,GAAG,EAAEC,QAAQ,CAAC;EACrD,IAAIM,SAAS,EAAE;IACb,OAAOA,SAAS,CAACC,IAAI,CAAEC,IAAI,IAAKH,MAAM,KAAKG,IAAI,CAAC;EAClD;EAEA,OAAO,KAAK;AACd;AAEO,SAASjB,gBAAgBA,CAACkB,IAAY,EAAE7B,KAAU,EAAO;EAC9D,IAAAc,eAAM,EACJe,IAAI,KAAK,KAAK,IACZA,IAAI,KAAK,OAAO,IAChBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,MAAM,EACjB,gCAAgC,GAAGA,IACrC,CAAC;EACD,IAAAf,eAAM,EAAC,CAACe,IAAI,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,+BAA+B,GAAGD,IAAI,CAAC;EACjE,IAAAf,eAAM,EAACZ,eAAC,CAAC6B,KAAK,CAAC/B,KAAK,CAAC6B,IAAI,CAAC,CAAC,EAAE,iCAAiC,GAAGA,IAAI,CAAC;EACtE7B,KAAK,CAAC6B,IAAI,CAAC,GAAG,IAAI;EAElB,OAAO7B,KAAK;AACd","ignoreList":[]}
+{"version":3,"file":"uplinks.js","names":["_assert","_interopRequireDefault","require","_lodash","_core","e","__esModule","default","DEFAULT_REGISTRY","exports","DEFAULT_UPLINK","BLACKLIST","all","anonymous","undefined","owner","none","uplinkSanityCheck","uplinks","users","newUplinks","_","clone","newUsers","uplink","Object","prototype","hasOwnProperty","call","cache","sanityCheckNames","sanityCheckUplinksProps","configUpLinks","assert","url","isString","replace","getProxiesForPackage","pkg","packages","matchedPkg","authUtils","getMatchedPackagesSpec","proxy","hasProxyTo","upLink","proxyList","some","curr","item","match","isNil"],"sources":["../src/uplinks.ts"],"sourcesContent":["import assert from 'assert';\nimport _ from 'lodash';\n\nimport { authUtils } from '@verdaccio/core';\nimport { PackageList, UpLinksConfList } from '@verdaccio/types';\n\nexport const DEFAULT_REGISTRY = 'https://registry.npmjs.org';\nexport const DEFAULT_UPLINK = 'npmjs';\n\nconst BLACKLIST = {\n  all: true,\n  anonymous: true,\n  undefined: true,\n  owner: true,\n  none: true,\n};\n\nexport function uplinkSanityCheck(\n  uplinks: UpLinksConfList,\n  users: any = BLACKLIST\n): UpLinksConfList {\n  const newUplinks = _.clone(uplinks);\n  let newUsers = _.clone(users);\n\n  for (const uplink in newUplinks) {\n    if (Object.prototype.hasOwnProperty.call(newUplinks, uplink)) {\n      if (typeof newUplinks[uplink].cache === 'undefined') {\n        newUplinks[uplink].cache = true;\n      }\n      newUsers = sanityCheckNames(uplink, newUsers);\n    }\n  }\n\n  return newUplinks;\n}\n\nexport function sanityCheckUplinksProps(configUpLinks: UpLinksConfList): UpLinksConfList {\n  const uplinks = _.clone(configUpLinks);\n\n  for (const uplink in uplinks) {\n    if (Object.prototype.hasOwnProperty.call(uplinks, uplink)) {\n      assert(uplinks[uplink].url, 'CONFIG: no url for uplink: ' + uplink);\n      assert(_.isString(uplinks[uplink].url), 'CONFIG: wrong url format for uplink: ' + uplink);\n      uplinks[uplink].url = uplinks[uplink].url.replace(/\\/$/, '');\n    }\n  }\n\n  return uplinks;\n}\n\nexport function getProxiesForPackage(pkg: string, packages: PackageList): string[] {\n  const matchedPkg = authUtils.getMatchedPackagesSpec(pkg, packages);\n  return matchedPkg?.proxy || [];\n}\n\nexport function hasProxyTo(pkg: string, upLink: string, packages: PackageList): boolean {\n  const proxyList = getProxiesForPackage(pkg, packages);\n  if (proxyList) {\n    return proxyList.some((curr) => upLink === curr);\n  }\n\n  return false;\n}\n\nexport function sanityCheckNames(item: string, users: any): any {\n  assert(\n    item !== 'all' &&\n      item !== 'owner' &&\n      item !== 'anonymous' &&\n      item !== 'undefined' &&\n      item !== 'none',\n    'CONFIG: reserved uplink name: ' + item\n  );\n  assert(!item.match(/\\s/), 'CONFIG: invalid uplink name: ' + item);\n  assert(_.isNil(users[item]), 'CONFIG: duplicate uplink name: ' + item);\n  users[item] = true;\n\n  return users;\n}\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA4C,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAGrC,MAAMG,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,4BAA4B;AACrD,MAAME,cAAc,GAAAD,OAAA,CAAAC,cAAA,GAAG,OAAO;AAErC,MAAMC,SAAS,GAAG;EAChBC,GAAG,EAAE,IAAI;EACTC,SAAS,EAAE,IAAI;EACfC,SAAS,EAAE,IAAI;EACfC,KAAK,EAAE,IAAI;EACXC,IAAI,EAAE;AACR,CAAC;AAEM,SAASC,iBAAiBA,CAC/BC,OAAwB,EACxBC,KAAU,GAAGR,SAAS,EACL;EACjB,MAAMS,UAAU,GAAGC,eAAC,CAACC,KAAK,CAACJ,OAAO,CAAC;EACnC,IAAIK,QAAQ,GAAGF,eAAC,CAACC,KAAK,CAACH,KAAK,CAAC;EAE7B,KAAK,MAAMK,MAAM,IAAIJ,UAAU,EAAE;IAC/B,IAAIK,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACR,UAAU,EAAEI,MAAM,CAAC,EAAE;MAC5D,IAAI,OAAOJ,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,KAAK,WAAW,EAAE;QACnDT,UAAU,CAACI,MAAM,CAAC,CAACK,KAAK,GAAG,IAAI;MACjC;MACAN,QAAQ,GAAGO,gBAAgB,CAACN,MAAM,EAAED,QAAQ,CAAC;IAC/C;EACF;EAEA,OAAOH,UAAU;AACnB;AAEO,SAASW,uBAAuBA,CAACC,aAA8B,EAAmB;EACvF,MAAMd,OAAO,GAAGG,eAAC,CAACC,KAAK,CAACU,aAAa,CAAC;EAEtC,KAAK,MAAMR,MAAM,IAAIN,OAAO,EAAE;IAC5B,IAAIO,MAAM,CAACC,SAAS,CAACC,cAAc,CAACC,IAAI,CAACV,OAAO,EAAEM,MAAM,CAAC,EAAE;MACzD,IAAAS,eAAM,EAACf,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,EAAE,6BAA6B,GAAGV,MAAM,CAAC;MACnE,IAAAS,eAAM,EAACZ,eAAC,CAACc,QAAQ,CAACjB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAAC,EAAE,uCAAuC,GAAGV,MAAM,CAAC;MACzFN,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,GAAGhB,OAAO,CAACM,MAAM,CAAC,CAACU,GAAG,CAACE,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC9D;EACF;EAEA,OAAOlB,OAAO;AAChB;AAEO,SAASmB,oBAAoBA,CAACC,GAAW,EAAEC,QAAqB,EAAY;EACjF,MAAMC,UAAU,GAAGC,eAAS,CAACC,sBAAsB,CAACJ,GAAG,EAAEC,QAAQ,CAAC;EAClE,OAAOC,UAAU,EAAEG,KAAK,IAAI,EAAE;AAChC;AAEO,SAASC,UAAUA,CAACN,GAAW,EAAEO,MAAc,EAAEN,QAAqB,EAAW;EACtF,MAAMO,SAAS,GAAGT,oBAAoB,CAACC,GAAG,EAAEC,QAAQ,CAAC;EACrD,IAAIO,SAAS,EAAE;IACb,OAAOA,SAAS,CAACC,IAAI,CAAEC,IAAI,IAAKH,MAAM,KAAKG,IAAI,CAAC;EAClD;EAEA,OAAO,KAAK;AACd;AAEO,SAASlB,gBAAgBA,CAACmB,IAAY,EAAE9B,KAAU,EAAO;EAC9D,IAAAc,eAAM,EACJgB,IAAI,KAAK,KAAK,IACZA,IAAI,KAAK,OAAO,IAChBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,MAAM,EACjB,gCAAgC,GAAGA,IACrC,CAAC;EACD,IAAAhB,eAAM,EAAC,CAACgB,IAAI,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,+BAA+B,GAAGD,IAAI,CAAC;EACjE,IAAAhB,eAAM,EAACZ,eAAC,CAAC8B,KAAK,CAAChC,KAAK,CAAC8B,IAAI,CAAC,CAAC,EAAE,iCAAiC,GAAGA,IAAI,CAAC;EACtE9B,KAAK,CAAC8B,IAAI,CAAC,GAAG,IAAI;EAElB,OAAO9B,KAAK;AACd","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "8.0.0-next-8.14",
+  "version": "8.0.0-next-8.16",
   "description": "Verdaccio Configuration",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,8 +33,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "8.0.0-next-8.14",
-    "@verdaccio/utils": "8.1.0-next-8.14",
+    "@verdaccio/core": "8.0.0-next-8.16",
     "debug": "4.4.0",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",