@verdaccio/config 8.1.2 → 8.2.0

package/build/config-utils.js

@@ -1,48 +1,44 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.fileExists = fileExists;
-exports.folderExists = folderExists;
-var _debug = _interopRequireDefault(require("debug"));
-var _nodeFs = _interopRequireDefault(require("node:fs"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:config:config-utils');
-
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs);
+//#region src/config-utils.ts
+var debug$1 = (0, debug.default)("verdaccio:config:config-utils");
 /**
- * Check whether the path already exist.
- * @param {String} path
- * @return {Boolean}
- */
+* Check whether the path already exist.
+* @param {String} path
+* @return {Boolean}
+*/
 function folderExists(path) {
-  try {
-    debug('check folder exist', path);
-    const stat = _nodeFs.default.statSync(path);
-    const isDirectory = stat.isDirectory();
-    debug('folder exist', isDirectory);
-    return isDirectory;
-  } catch {
-    debug('folder %s does not exist', path);
-    return false;
-  }
+	try {
+		debug$1("check folder exist", path);
+		const isDirectory = node_fs.default.statSync(path).isDirectory();
+		debug$1("folder exist", isDirectory);
+		return isDirectory;
+	} catch {
+		debug$1("folder %s does not exist", path);
+		return false;
+	}
 }
-
 /**
- * Check whether the file already exist.
- * @param {String} path
- * @return {Boolean}
- */
+* Check whether the file already exist.
+* @param {String} path
+* @return {Boolean}
+*/
 function fileExists(path) {
-  try {
-    debug('check file exist', path);
-    const stat = _nodeFs.default.statSync(path);
-    const isFile = stat.isFile();
-    debug('file exist', isFile);
-    return isFile;
-  } catch {
-    debug('file %s does not exist', path);
-    return false;
-  }
+	try {
+		debug$1("check file exist", path);
+		const isFile = node_fs.default.statSync(path).isFile();
+		debug$1("file exist", isFile);
+		return isFile;
+	} catch {
+		debug$1("file %s does not exist", path);
+		return false;
+	}
 }
+//#endregion
+exports.fileExists = fileExists;
+exports.folderExists = folderExists;
+
 //# sourceMappingURL=config-utils.js.map

package/build/config-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-utils.js","names":["_debug","_interopRequireDefault","require","_nodeFs","e","__esModule","default","debug","buildDebug","folderExists","path","stat","fs","statSync","isDirectory","fileExists","isFile"],"sources":["../src/config-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport fs from 'node:fs';\n\nconst debug = buildDebug('verdaccio:config:config-utils');\n\n/**\n * Check whether the path already exist.\n * @param {String} path\n * @return {Boolean}\n */\nexport function folderExists(path: string): boolean {\n  try {\n    debug('check folder exist', path);\n    const stat = fs.statSync(path);\n    const isDirectory = stat.isDirectory();\n    debug('folder exist', isDirectory);\n    return isDirectory;\n  } catch {\n    debug('folder %s does not exist', path);\n    return false;\n  }\n}\n\n/**\n * Check whether the file already exist.\n * @param {String} path\n * @return {Boolean}\n */\nexport function fileExists(path: string): boolean {\n  try {\n    debug('check file exist', path);\n    const stat = fs.statSync(path);\n    const isFile = stat.isFile();\n    debug('file exist', isFile);\n    return isFile;\n  } catch {\n    debug('file %s does not exist', path);\n    return false;\n  }\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AAAyB,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEzB,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,+BAA+B,CAAC;;AAEzD;AACA;AACA;AACA;AACA;AACO,SAASC,YAAYA,CAACC,IAAY,EAAW;EAClD,IAAI;IACFH,KAAK,CAAC,oBAAoB,EAAEG,IAAI,CAAC;IACjC,MAAMC,IAAI,GAAGC,eAAE,CAACC,QAAQ,CAACH,IAAI,CAAC;IAC9B,MAAMI,WAAW,GAAGH,IAAI,CAACG,WAAW,CAAC,CAAC;IACtCP,KAAK,CAAC,cAAc,EAAEO,WAAW,CAAC;IAClC,OAAOA,WAAW;EACpB,CAAC,CAAC,MAAM;IACNP,KAAK,CAAC,0BAA0B,EAAEG,IAAI,CAAC;IACvC,OAAO,KAAK;EACd;AACF;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASK,UAAUA,CAACL,IAAY,EAAW;EAChD,IAAI;IACFH,KAAK,CAAC,kBAAkB,EAAEG,IAAI,CAAC;IAC/B,MAAMC,IAAI,GAAGC,eAAE,CAACC,QAAQ,CAACH,IAAI,CAAC;IAC9B,MAAMM,MAAM,GAAGL,IAAI,CAACK,MAAM,CAAC,CAAC;IAC5BT,KAAK,CAAC,YAAY,EAAES,MAAM,CAAC;IAC3B,OAAOA,MAAM;EACf,CAAC,CAAC,MAAM;IACNT,KAAK,CAAC,wBAAwB,EAAEG,IAAI,CAAC;IACrC,OAAO,KAAK;EACd;AACF","ignoreList":[]}
+{"version":3,"file":"config-utils.js","names":[],"sources":["../src/config-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport fs from 'node:fs';\n\nconst debug = buildDebug('verdaccio:config:config-utils');\n\n/**\n * Check whether the path already exist.\n * @param {String} path\n * @return {Boolean}\n */\nexport function folderExists(path: string): boolean {\n  try {\n    debug('check folder exist', path);\n    const stat = fs.statSync(path);\n    const isDirectory = stat.isDirectory();\n    debug('folder exist', isDirectory);\n    return isDirectory;\n  } catch {\n    debug('folder %s does not exist', path);\n    return false;\n  }\n}\n\n/**\n * Check whether the file already exist.\n * @param {String} path\n * @return {Boolean}\n */\nexport function fileExists(path: string): boolean {\n  try {\n    debug('check file exist', path);\n    const stat = fs.statSync(path);\n    const isFile = stat.isFile();\n    debug('file exist', isFile);\n    return isFile;\n  } catch {\n    debug('file %s does not exist', path);\n    return false;\n  }\n}\n"],"mappings":";;;;;;AAGA,IAAM,WAAA,GAAA,MAAA,SAAmB,+BAA+B;;;;;;AAOxD,SAAgB,aAAa,MAAuB;CAClD,IAAI;EACF,QAAM,sBAAsB,IAAI;EAEhC,MAAM,cADO,QAAA,QAAG,SAAS,IACL,EAAK,YAAY;EACrC,QAAM,gBAAgB,WAAW;EACjC,OAAO;CACT,QAAQ;EACN,QAAM,4BAA4B,IAAI;EACtC,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,WAAW,MAAuB;CAChD,IAAI;EACF,QAAM,oBAAoB,IAAI;EAE9B,MAAM,SADO,QAAA,QAAG,SAAS,IACV,EAAK,OAAO;EAC3B,QAAM,cAAc,MAAM;EAC1B,OAAO;CACT,QAAQ;EACN,QAAM,0BAA0B,IAAI;EACpC,OAAO;CACT;AACF"}

package/build/config-utils.mjs

@@ -0,0 +1,40 @@
+import buildDebug from "debug";
+import fs from "node:fs";
+//#region src/config-utils.ts
+var debug = buildDebug("verdaccio:config:config-utils");
+/**
+* Check whether the path already exist.
+* @param {String} path
+* @return {Boolean}
+*/
+function folderExists(path) {
+	try {
+		debug("check folder exist", path);
+		const isDirectory = fs.statSync(path).isDirectory();
+		debug("folder exist", isDirectory);
+		return isDirectory;
+	} catch {
+		debug("folder %s does not exist", path);
+		return false;
+	}
+}
+/**
+* Check whether the file already exist.
+* @param {String} path
+* @return {Boolean}
+*/
+function fileExists(path) {
+	try {
+		debug("check file exist", path);
+		const isFile = fs.statSync(path).isFile();
+		debug("file exist", isFile);
+		return isFile;
+	} catch {
+		debug("file %s does not exist", path);
+		return false;
+	}
+}
+//#endregion
+export { fileExists, folderExists };
+
+//# sourceMappingURL=config-utils.mjs.map

package/build/config-utils.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-utils.mjs","names":[],"sources":["../src/config-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport fs from 'node:fs';\n\nconst debug = buildDebug('verdaccio:config:config-utils');\n\n/**\n * Check whether the path already exist.\n * @param {String} path\n * @return {Boolean}\n */\nexport function folderExists(path: string): boolean {\n  try {\n    debug('check folder exist', path);\n    const stat = fs.statSync(path);\n    const isDirectory = stat.isDirectory();\n    debug('folder exist', isDirectory);\n    return isDirectory;\n  } catch {\n    debug('folder %s does not exist', path);\n    return false;\n  }\n}\n\n/**\n * Check whether the file already exist.\n * @param {String} path\n * @return {Boolean}\n */\nexport function fileExists(path: string): boolean {\n  try {\n    debug('check file exist', path);\n    const stat = fs.statSync(path);\n    const isFile = stat.isFile();\n    debug('file exist', isFile);\n    return isFile;\n  } catch {\n    debug('file %s does not exist', path);\n    return false;\n  }\n}\n"],"mappings":";;;AAGA,IAAM,QAAQ,WAAW,+BAA+B;;;;;;AAOxD,SAAgB,aAAa,MAAuB;CAClD,IAAI;EACF,MAAM,sBAAsB,IAAI;EAEhC,MAAM,cADO,GAAG,SAAS,IACL,EAAK,YAAY;EACrC,MAAM,gBAAgB,WAAW;EACjC,OAAO;CACT,QAAQ;EACN,MAAM,4BAA4B,IAAI;EACtC,OAAO;CACT;AACF;;;;;;AAOA,SAAgB,WAAW,MAAuB;CAChD,IAAI;EACF,MAAM,oBAAoB,IAAI;EAE9B,MAAM,SADO,GAAG,SAAS,IACV,EAAK,OAAO;EAC3B,MAAM,cAAc,MAAM;EAC1B,OAAO;CACT,QAAQ;EACN,MAAM,0BAA0B,IAAI;EACpC,OAAO;CACT;AACF"}

package/build/config.js

@@ -1,209 +1,160 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.defaultUserRateLimiting = exports.WEB_TITLE = exports.Config = void 0;
-exports.isNodeVersionGreaterThan21 = isNodeVersionGreaterThan21;
-var _debug = _interopRequireDefault(require("debug"));
-var _lodash = _interopRequireDefault(require("lodash"));
-var _nodeAssert = _interopRequireDefault(require("node:assert"));
-var _core = require("@verdaccio/core");
-var _warningUtils = require("@verdaccio/core/build/warning-utils");
-var _agent = require("./agent");
-var _packageAccess = require("./package-access");
-var _security = require("./security");
-var _serverSettings = _interopRequireDefault(require("./serverSettings"));
-var _token = require("./token");
-var _uplinks = require("./uplinks");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const strategicConfigProps = ['uplinks', 'packages'];
-const allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];
-const debug = (0, _debug.default)('verdaccio:config');
-const WEB_TITLE = exports.WEB_TITLE = 'Verdaccio';
-
-// we limit max 1000 request per 15 minutes on user endpoints
-const defaultUserRateLimiting = exports.defaultUserRateLimiting = {
-  windowMs: 15 * 60 * 1000,
-  // 15 minutes
-  max: 1000
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+const require_agent = require("./agent.js");
+const require_package_access = require("./package-access.js");
+const require_security = require("./security.js");
+const require_serverSettings = require("./serverSettings.js");
+const require_token = require("./token.js");
+const require_uplinks = require("./uplinks.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let lodash = require("lodash");
+lodash = require_runtime.__toESM(lodash);
+let node_assert = require("node:assert");
+node_assert = require_runtime.__toESM(node_assert);
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/config.ts
+var strategicConfigProps = ["uplinks", "packages"];
+var allowedEnvConfig = [
+	"http_proxy",
+	"https_proxy",
+	"no_proxy"
+];
+var debug$1 = (0, debug.default)("verdaccio:config");
+var WEB_TITLE = "Verdaccio";
+var defaultUserRateLimiting = {
+	windowMs: 900 * 1e3,
+	max: 1e3
 };
 function isNodeVersionGreaterThan21() {
-  const [major, minor] = process.versions.node.split('.').map(Number);
-  return major > 21 || major === 21 && minor >= 0;
+	const [major, minor] = process.versions.node.split(".").map(Number);
+	return major > 21 || major === 21 && minor >= 0;
 }
-const TOKEN_VALID_LENGTH = 32;
-
+var TOKEN_VALID_LENGTH = 32;
 /**
- * Coordinates the application configuration
- */
-class Config {
-  /**
-   * @deprecated use configPath or config.getConfigPath();
-   */
-
-  // @ts-ignore
-
-  constructor(config,
-  // forceEnhancedLegacySignature is a property that
-  // allows switch a new legacy aes signature token signature
-  // for older versions do not want to have this new signature model
-  // this property must be false
-  configOverrideOptions = {
-    forceMigrateToSecureLegacySignature: true
-  }) {
-    const self = this;
-    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
-    if (!config.configPath) {
-      // backport self_path for previous to version 6
-      // @ts-expect-error
-      config.configPath = config.config_path ?? config.self_path;
-      if (!config.configPath) {
-        throw new Error('configPath property is required');
-      }
-    }
-    this.configOverrideOptions = configOverrideOptions;
-    this.configPath = config.configPath;
-    this.self_path = this.configPath;
-    debug('config path: %s', this.configPath);
-    this.plugins = config.plugins;
-    this.security = _lodash.default.merge(
-    // override the default security configuration via constructor
-    _lodash.default.merge(_security.defaultSecurity, {
-      api: {
-        migrateToSecureLegacySignature: this.configOverrideOptions.forceMigrateToSecureLegacySignature
-      }
-    }), config.security);
-    this.server = {
-      ..._serverSettings.default,
-      ...config.server
-    };
-    this.flags = {
-      searchRemote: config.flags?.searchRemote ?? true,
-      changePassword: config.flags?.changePassword ?? false,
-      webLogin: config.flags?.webLogin ?? false,
-      createUser: config.flags?.createUser ?? false
-    };
-    this.user_agent = config.user_agent;
-    for (const configProp in config) {
-      if (self[configProp] == null) {
-        self[configProp] = config[configProp];
-      }
-    }
-    if (typeof this.user_agent === 'undefined') {
-      // by default user agent is hidden
-      debug('set default user agent');
-      this.user_agent = (0, _agent.getUserAgent)(false);
-    }
-    this.userRateLimit = {
-      ...defaultUserRateLimiting,
-      ...config?.userRateLimit
-    };
-
-    // some weird shell scripts are valid yaml files parsed as string
-    (0, _nodeAssert.default)(_core.validationUtils.isObject(config), _core.APP_ERROR.CONFIG_NOT_VALID);
-
-    // sanity check for strategic config properties
-    strategicConfigProps.forEach(function (x) {
-      if (self[x] == null) {
-        self[x] = {};
-      }
-      (0, _nodeAssert.default)(_core.validationUtils.isObject(self[x]), `CONFIG: bad "${x}" value (object expected)`);
-    });
-    this.uplinks = (0, _uplinks.sanityCheckUplinksProps)((0, _uplinks.uplinkSanityCheck)(this.uplinks));
-    this.packages = (0, _packageAccess.normalisePackageAccess)(self.packages);
-
-    // loading these from ENV if aren't in config
-    allowedEnvConfig.forEach(envConf => {
-      if (!(envConf in self)) {
-        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];
-      }
-    });
-
-    // unique identifier of self server (or a cluster), used to avoid loops
-    // @ts-ignore
-    if (!this.server_id) {
-      this.server_id = _core.cryptoUtils.generateRandomHexString(6);
-    }
-  }
-  getMigrateToSecureLegacySignature() {
-    return this.security.api.migrateToSecureLegacySignature;
-  }
-  getConfigPath() {
-    return this.configPath;
-  }
-
-  /**
-   * Check for package spec
-   * @param pkgName - package name
-   * @returns package access
-   * @deprecated use core.authUtils instead
-   */
-  getMatchedPackagesSpec(pkgName) {
-    // TODO: remove this method and replace by library utils
-    return _core.authUtils.getMatchedPackagesSpec(pkgName, this.packages);
-  }
-
-  /**
-   * Verify if the secret complies with the required structure
-   *  - If the secret is not provided, it will generate a new one
-   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
-   *  - If the secret is provided:
-   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
-   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
-   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
-   *      generated with the new signature model
-   * @secret external secret key
-   */
-  checkSecretKey(secret) {
-    debug('checking secret key init');
-    if (typeof secret === 'string' && _lodash.default.isEmpty(secret) === false) {
-      debug('checking secret key length %s', secret.length);
-      if (secret.length > TOKEN_VALID_LENGTH) {
-        if (isNodeVersionGreaterThan21()) {
-          debug('is node version greater than 21');
-          if (this.getMigrateToSecureLegacySignature() === true) {
-            this.secret = (0, _token.generateRandomSecretKey)();
-            debug('rewriting secret key with length %s', this.secret.length);
-            return this.secret;
-          }
-          // oops, user needs to generate a new secret key
-          debug('secret does not comply with the required length, current length  %d, application will fail on startup', secret.length);
-          throw new Error(`Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
-            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
-            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
-        } else {
-          debug('is node version lower than 22');
-          if (this.getMigrateToSecureLegacySignature() === true) {
-            this.secret = (0, _token.generateRandomSecretKey)();
-            debug('rewriting secret key with length %s', this.secret.length);
-            return this.secret;
-          }
-          debug('triggering deprecation warning for secret key length %s', secret.length);
-          // still using Node.js versions previous to 22, but we need to emit a deprecation warning
-          // deprecation warning, secret key is too long and must be 32
-          // this will be removed in the next major release and will produce an error
-          _core.warningUtils.emit(_warningUtils.Codes.VERWAR007);
-          this.secret = secret;
-          return this.secret;
-        }
-      } else if (secret.length === TOKEN_VALID_LENGTH) {
-        debug('detected valid secret key length %s', secret.length);
-        this.secret = secret;
-        return this.secret;
-      }
-      debug('reusing previous key with length %s', secret.length);
-      this.secret = secret;
-      return this.secret;
-    } else {
-      // generate a new a secret key
-      // FUTURE: this might be an external secret key, perhaps within config file?
-      debug('generating a new secret key');
-      this.secret = (0, _token.generateRandomSecretKey)();
-      debug('generated a new secret key length %s', this.secret?.length);
-      return this.secret;
-    }
-  }
-}
+* Coordinates the application configuration
+*/
+var Config = class {
+	user_agent;
+	uplinks;
+	packages;
+	users;
+	auth;
+	store;
+	server_id;
+	configPath;
+	/**
+	* @deprecated use configPath or config.getConfigPath();
+	*/
+	self_path;
+	storage;
+	plugins;
+	security;
+	server;
+	configOverrideOptions;
+	secret;
+	flags;
+	userRateLimit;
+	constructor(config, configOverrideOptions = { forceMigrateToSecureLegacySignature: true }) {
+		const self = this;
+		this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
+		if (!config.configPath) {
+			config.configPath = config.config_path ?? config.self_path;
+			if (!config.configPath) throw new Error("configPath property is required");
+		}
+		this.configOverrideOptions = configOverrideOptions;
+		this.configPath = config.configPath;
+		this.self_path = this.configPath;
+		debug$1("config path: %s", this.configPath);
+		this.plugins = config.plugins;
+		this.security = lodash.default.merge(lodash.default.merge(require_security.defaultSecurity, { api: { migrateToSecureLegacySignature: this.configOverrideOptions.forceMigrateToSecureLegacySignature } }), config.security);
+		this.server = {
+			...require_serverSettings.default,
+			...config.server
+		};
+		this.flags = {
+			searchRemote: config.flags?.searchRemote ?? true,
+			changePassword: config.flags?.changePassword ?? false,
+			webLogin: config.flags?.webLogin ?? false,
+			createUser: config.flags?.createUser ?? false
+		};
+		this.user_agent = config.user_agent;
+		for (const configProp in config) if (self[configProp] == null) self[configProp] = config[configProp];
+		if (typeof this.user_agent === "undefined") {
+			debug$1("set default user agent");
+			this.user_agent = require_agent.getUserAgent(false);
+		}
+		this.userRateLimit = {
+			...defaultUserRateLimiting,
+			...config?.userRateLimit
+		};
+		(0, node_assert.default)(_verdaccio_core.validationUtils.isObject(config), _verdaccio_core.APP_ERROR.CONFIG_NOT_VALID);
+		strategicConfigProps.forEach(function(x) {
+			if (self[x] == null) self[x] = {};
+			(0, node_assert.default)(_verdaccio_core.validationUtils.isObject(self[x]), `CONFIG: bad "${x}" value (object expected)`);
+		});
+		this.uplinks = require_uplinks.sanityCheckUplinksProps(require_uplinks.uplinkSanityCheck(this.uplinks));
+		this.packages = require_package_access.normalisePackageAccess(self.packages);
+		allowedEnvConfig.forEach((envConf) => {
+			if (!(envConf in self)) self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];
+		});
+		if (!this.server_id) this.server_id = _verdaccio_core.cryptoUtils.generateRandomHexString(6);
+	}
+	getMigrateToSecureLegacySignature() {
+		return this.security.api.migrateToSecureLegacySignature;
+	}
+	getConfigPath() {
+		return this.configPath;
+	}
+	/**
+	* Check for package spec
+	* @param pkgName - package name
+	* @returns package access
+	* @deprecated use core.authUtils instead
+	*/
+	getMatchedPackagesSpec(pkgName) {
+		return _verdaccio_core.authUtils.getMatchedPackagesSpec(pkgName, this.packages);
+	}
+	/**
+	* Verify if the secret complies with the required structure
+	*  - If the secret is not provided, it will generate a new one
+	*    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
+	*  - If the secret is provided:
+	*    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
+	*    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
+	*    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
+	*      generated with the new signature model
+	* @secret external secret key
+	*/
+	checkSecretKey(secret) {
+		debug$1("checking secret key init");
+		if (typeof secret === "string" && lodash.default.isEmpty(secret) === false) {
+			debug$1("checking secret key length %s", secret.length);
+			if (secret.length === TOKEN_VALID_LENGTH) {
+				debug$1("detected valid secret key length %s", secret.length);
+				this.secret = secret;
+				return this.secret;
+			}
+			if (this.getMigrateToSecureLegacySignature() === true) {
+				this.secret = require_token.generateRandomSecretKey();
+				debug$1("rewriting secret key with length %s", this.secret.length);
+				return this.secret;
+			}
+			debug$1("secret does not comply with the required length, current length %d", secret.length);
+			throw new Error(`Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
+        The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
+        Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
+		} else {
+			debug$1("generating a new secret key");
+			this.secret = require_token.generateRandomSecretKey();
+			debug$1("generated a new secret key length %s", this.secret?.length);
+			return this.secret;
+		}
+	}
+};
+//#endregion
 exports.Config = Config;
+exports.WEB_TITLE = WEB_TITLE;
+exports.defaultUserRateLimiting = defaultUserRateLimiting;
+exports.isNodeVersionGreaterThan21 = isNodeVersionGreaterThan21;
+
 //# sourceMappingURL=config.js.map

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":["_debug","_interopRequireDefault","require","_lodash","_nodeAssert","_core","_warningUtils","_agent","_packageAccess","_security","_serverSettings","_token","_uplinks","e","__esModule","default","strategicConfigProps","allowedEnvConfig","debug","buildDebug","WEB_TITLE","exports","defaultUserRateLimiting","windowMs","max","isNodeVersionGreaterThan21","major","minor","process","versions","node","split","map","Number","TOKEN_VALID_LENGTH","Config","constructor","config","configOverrideOptions","forceMigrateToSecureLegacySignature","self","storage","env","VERDACCIO_STORAGE_PATH","configPath","config_path","self_path","Error","plugins","security","_","merge","defaultSecurity","api","migrateToSecureLegacySignature","server","defaultServerSettings","flags","searchRemote","changePassword","webLogin","createUser","user_agent","configProp","getUserAgent","userRateLimit","assert","validationUtils","isObject","APP_ERROR","CONFIG_NOT_VALID","forEach","x","uplinks","sanityCheckUplinksProps","uplinkSanityCheck","packages","normalisePackageAccess","envConf","toUpperCase","server_id","cryptoUtils","generateRandomHexString","getMigrateToSecureLegacySignature","getConfigPath","getMatchedPackagesSpec","pkgName","authUtils","checkSecretKey","secret","isEmpty","length","generateRandomSecretKey","warningUtils","emit","Codes","VERWAR007"],"sources":["../src/config.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport assert from 'node:assert';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils, warningUtils } from '@verdaccio/core';\nimport { Codes } from '@verdaccio/core/build/warning-utils';\nimport type {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n      createUser: config.flags?.createUser ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length > TOKEN_VALID_LENGTH) {\n        if (isNodeVersionGreaterThan21()) {\n          debug('is node version greater than 21');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          // oops, user needs to generate a new secret key\n          debug(\n            'secret does not comply with the required length, current length  %d, application will fail on startup',\n            secret.length\n          );\n          throw new Error(\n            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n          );\n        } else {\n          debug('is node version lower than 22');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          debug('triggering deprecation warning for secret key length %s', secret.length);\n          // still using Node.js versions previous to 22, but we need to emit a deprecation warning\n          // deprecation warning, secret key is too long and must be 32\n          // this will be removed in the next major release and will produce an error\n          warningUtils.emit(Codes.VERWAR007);\n          this.secret = secret;\n          return this.secret;\n        }\n      } else if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      debug('reusing previous key with length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,WAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AACA,IAAAI,aAAA,GAAAJ,OAAA;AAaA,IAAAK,MAAA,GAAAL,OAAA;AACA,IAAAM,cAAA,GAAAN,OAAA;AACA,IAAAO,SAAA,GAAAP,OAAA;AACA,IAAAQ,eAAA,GAAAT,sBAAA,CAAAC,OAAA;AACA,IAAAS,MAAA,GAAAT,OAAA;AACA,IAAAU,QAAA,GAAAV,OAAA;AAAuE,SAAAD,uBAAAY,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEvE,MAAMG,oBAAoB,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC;AACpD,MAAMC,gBAAgB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,UAAU,CAAC;AAClE,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,kBAAkB,CAAC;AAErC,MAAMC,SAAS,GAAAC,OAAA,CAAAD,SAAA,GAAG,WAAW;;AAEpC;AACO,MAAME,uBAAuB,GAAAD,OAAA,CAAAC,uBAAA,GAAG;EACrCC,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI;EAAE;EAC1BC,GAAG,EAAE;AACP,CAAC;AAEM,SAASC,0BAA0BA,CAAA,EAAG;EAC3C,MAAM,CAACC,KAAK,EAAEC,KAAK,CAAC,GAAGC,OAAO,CAACC,QAAQ,CAACC,IAAI,CAACC,KAAK,CAAC,GAAG,CAAC,CAACC,GAAG,CAACC,MAAM,CAAC;EACnE,OAAOP,KAAK,GAAG,EAAE,IAAKA,KAAK,KAAK,EAAE,IAAIC,KAAK,IAAI,CAAE;AACnD;AAEA,MAAMO,kBAAkB,GAAG,EAAE;;AAE7B;AACA;AACA;AACA,MAAMC,MAAM,CAAsB;EAShC;AACF;AACA;;EAQE;;EAIOC,WAAWA,CAChBC,MAA4C;EAC5C;EACA;EACA;EACA;EACAC,qBAAqB,GAAG;IAAEC,mCAAmC,EAAE;EAAK,CAAC,EACrE;IACA,MAAMC,IAAI,GAAG,IAAI;IACjB,IAAI,CAACC,OAAO,GAAGb,OAAO,CAACc,GAAG,CAACC,sBAAsB,IAAIN,MAAM,CAACI,OAAO;IACnE,IAAI,CAACJ,MAAM,CAACO,UAAU,EAAE;MACtB;MACA;MACAP,MAAM,CAACO,UAAU,GAAGP,MAAM,CAACQ,WAAW,IAAIR,MAAM,CAACS,SAAS;MAC1D,IAAI,CAACT,MAAM,CAACO,UAAU,EAAE;QACtB,MAAM,IAAIG,KAAK,CAAC,iCAAiC,CAAC;MACpD;IACF;IACA,IAAI,CAACT,qBAAqB,GAAGA,qBAAqB;IAClD,IAAI,CAACM,UAAU,GAAGP,MAAM,CAACO,UAAU;IACnC,IAAI,CAACE,SAAS,GAAG,IAAI,CAACF,UAAU;IAChC1B,KAAK,CAAC,iBAAiB,EAAE,IAAI,CAAC0B,UAAU,CAAC;IACzC,IAAI,CAACI,OAAO,GAAGX,MAAM,CAACW,OAAO;IAC7B,IAAI,CAACC,QAAQ,GAAGC,eAAC,CAACC,KAAK;IACrB;IACAD,eAAC,CAACC,KAAK,CAACC,yBAAe,EAAE;MACvBC,GAAG,EAAE;QACHC,8BAA8B,EAC5B,IAAI,CAAChB,qBAAqB,CAACC;MAC/B;IACF,CAAC,CAAC,EACFF,MAAM,CAACY,QACT,CAAC;IACD,IAAI,CAACM,MAAM,GAAG;MAAE,GAAGC,uBAAqB;MAAE,GAAGnB,MAAM,CAACkB;IAAO,CAAC;IAC5D,IAAI,CAACE,KAAK,GAAG;MACXC,YAAY,EAAErB,MAAM,CAACoB,KAAK,EAAEC,YAAY,IAAI,IAAI;MAChDC,cAAc,EAAEtB,MAAM,CAACoB,KAAK,EAAEE,cAAc,IAAI,KAAK;MACrDC,QAAQ,EAAEvB,MAAM,CAACoB,KAAK,EAAEG,QAAQ,IAAI,KAAK;MACzCC,UAAU,EAAExB,MAAM,CAACoB,KAAK,EAAEI,UAAU,IAAI;IAC1C,CAAC;IACD,IAAI,CAACC,UAAU,GAAGzB,MAAM,CAACyB,UAAU;IAEnC,KAAK,MAAMC,UAAU,IAAI1B,MAAM,EAAE;MAC/B,IAAIG,IAAI,CAACuB,UAAU,CAAC,IAAI,IAAI,EAAE;QAC5BvB,IAAI,CAACuB,UAAU,CAAC,GAAG1B,MAAM,CAAC0B,UAAU,CAAC;MACvC;IACF;IAEA,IAAI,OAAO,IAAI,CAACD,UAAU,KAAK,WAAW,EAAE;MAC1C;MACA5C,KAAK,CAAC,wBAAwB,CAAC;MAC/B,IAAI,CAAC4C,UAAU,GAAG,IAAAE,mBAAY,EAAC,KAAK,CAAC;IACvC;IAEA,IAAI,CAACC,aAAa,GAAG;MAAE,GAAG3C,uBAAuB;MAAE,GAAGe,MAAM,EAAE4B;IAAc,CAAC;;IAE7E;IACA,IAAAC,mBAAM,EAACC,qBAAe,CAACC,QAAQ,CAAC/B,MAAM,CAAC,EAAEgC,eAAS,CAACC,gBAAgB,CAAC;;IAEpE;IACAtD,oBAAoB,CAACuD,OAAO,CAAC,UAAUC,CAAC,EAAQ;MAC9C,IAAIhC,IAAI,CAACgC,CAAC,CAAC,IAAI,IAAI,EAAE;QACnBhC,IAAI,CAACgC,CAAC,CAAC,GAAG,CAAC,CAAC;MACd;MAEA,IAAAN,mBAAM,EAACC,qBAAe,CAACC,QAAQ,CAAC5B,IAAI,CAACgC,CAAC,CAAC,CAAC,EAAE,gBAAgBA,CAAC,2BAA2B,CAAC;IACzF,CAAC,CAAC;IAEF,IAAI,CAACC,OAAO,GAAG,IAAAC,gCAAuB,EAAC,IAAAC,0BAAiB,EAAC,IAAI,CAACF,OAAO,CAAC,CAAC;IACvE,IAAI,CAACG,QAAQ,GAAG,IAAAC,qCAAsB,EAACrC,IAAI,CAACoC,QAAQ,CAAC;;IAErD;IACA3D,gBAAgB,CAACsD,OAAO,CAAEO,OAAO,IAAW;MAC1C,IAAI,EAAEA,OAAO,IAAItC,IAAI,CAAC,EAAE;QACtBA,IAAI,CAACsC,OAAO,CAAC,GAAGlD,OAAO,CAACc,GAAG,CAACoC,OAAO,CAAC,IAAIlD,OAAO,CAACc,GAAG,CAACoC,OAAO,CAACC,WAAW,CAAC,CAAC,CAAC;MAC5E;IACF,CAAC,CAAC;;IAEF;IACA;IACA,IAAI,CAAC,IAAI,CAACC,SAAS,EAAE;MACnB,IAAI,CAACA,SAAS,GAAGC,iBAAW,CAACC,uBAAuB,CAAC,CAAC,CAAC;IACzD;EACF;EAEOC,iCAAiCA,CAAA,EAAG;IACzC,OAAO,IAAI,CAAClC,QAAQ,CAACI,GAAG,CAACC,8BAA8B;EACzD;EAEO8B,aAAaA,CAAA,EAAG;IACrB,OAAO,IAAI,CAACxC,UAAU;EACxB;;EAEA;AACF;AACA;AACA;AACA;AACA;EACSyC,sBAAsBA,CAACC,OAAe,EAAwB;IACnE;IACA,OAAOC,eAAS,CAACF,sBAAsB,CAACC,OAAO,EAAE,IAAI,CAACV,QAAQ,CAAC;EACjE;;EAEA;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;EACSY,cAAcA,CAACC,MAAe,EAAU;IAC7CvE,KAAK,CAAC,0BAA0B,CAAC;IACjC,IAAI,OAAOuE,MAAM,KAAK,QAAQ,IAAIvC,eAAC,CAACwC,OAAO,CAACD,MAAM,CAAC,KAAK,KAAK,EAAE;MAC7DvE,KAAK,CAAC,+BAA+B,EAAEuE,MAAM,CAACE,MAAM,CAAC;MACrD,IAAIF,MAAM,CAACE,MAAM,GAAGzD,kBAAkB,EAAE;QACtC,IAAIT,0BAA0B,CAAC,CAAC,EAAE;UAChCP,KAAK,CAAC,iCAAiC,CAAC;UACxC,IAAI,IAAI,CAACiE,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACM,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvC1E,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACuE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACA;UACAvE,KAAK,CACH,uGAAuG,EACvGuE,MAAM,CAACE,MACT,CAAC;UACD,MAAM,IAAI5C,KAAK,CACb,wEAAwE0C,MAAM,CAACE,MAAM;AACjG;AACA,kFACU,CAAC;QACH,CAAC,MAAM;UACLzE,KAAK,CAAC,+BAA+B,CAAC;UACtC,IAAI,IAAI,CAACiE,iCAAiC,CAAC,CAAC,KAAK,IAAI,EAAE;YACrD,IAAI,CAACM,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;YACvC1E,KAAK,CAAC,qCAAqC,EAAE,IAAI,CAACuE,MAAM,CAACE,MAAM,CAAC;YAChE,OAAO,IAAI,CAACF,MAAM;UACpB;UACAvE,KAAK,CAAC,yDAAyD,EAAEuE,MAAM,CAACE,MAAM,CAAC;UAC/E;UACA;UACA;UACAE,kBAAY,CAACC,IAAI,CAACC,mBAAK,CAACC,SAAS,CAAC;UAClC,IAAI,CAACP,MAAM,GAAGA,MAAM;UACpB,OAAO,IAAI,CAACA,MAAM;QACpB;MACF,CAAC,MAAM,IAAIA,MAAM,CAACE,MAAM,KAAKzD,kBAAkB,EAAE;QAC/ChB,KAAK,CAAC,qCAAqC,EAAEuE,MAAM,CAACE,MAAM,CAAC;QAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;QACpB,OAAO,IAAI,CAACA,MAAM;MACpB;MACAvE,KAAK,CAAC,qCAAqC,EAAEuE,MAAM,CAACE,MAAM,CAAC;MAC3D,IAAI,CAACF,MAAM,GAAGA,MAAM;MACpB,OAAO,IAAI,CAACA,MAAM;IACpB,CAAC,MAAM;MACL;MACA;MACAvE,KAAK,CAAC,6BAA6B,CAAC;MACpC,IAAI,CAACuE,MAAM,GAAG,IAAAG,8BAAuB,EAAC,CAAC;MACvC1E,KAAK,CAAC,sCAAsC,EAAE,IAAI,CAACuE,MAAM,EAAEE,MAAM,CAAC;MAElE,OAAO,IAAI,CAACF,MAAM;IACpB;EACF;AACF;AAACpE,OAAA,CAAAc,MAAA,GAAAA,MAAA","ignoreList":[]}
+{"version":3,"file":"config.js","names":[],"sources":["../src/config.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport assert from 'node:assert';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils } from '@verdaccio/core';\nimport type {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n      createUser: config.flags?.createUser ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      // Node.js 22+ removed the legacy AES APIs, so token signing only works\n      // with a secret of exactly 32 characters: migrate legacy (64 characters)\n      // or manually edited secrets, otherwise fail fast at startup instead of\n      // failing later on the first signed token\n      if (this.getMigrateToSecureLegacySignature() === true) {\n        this.secret = generateRandomSecretKey();\n        debug('rewriting secret key with length %s', this.secret.length);\n        return this.secret;\n      }\n      debug('secret does not comply with the required length, current length %d', secret.length);\n      throw new Error(\n        `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n        The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n        Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n      );\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,IAAM,uBAAuB,CAAC,WAAW,UAAU;AACnD,IAAM,mBAAmB;CAAC;CAAc;CAAe;AAAU;AACjE,IAAM,WAAA,GAAA,MAAA,SAAmB,kBAAkB;AAE3C,IAAa,YAAY;AAGzB,IAAa,0BAA0B;CACrC,UAAU,MAAU;CACpB,KAAK;AACP;AAEA,SAAgB,6BAA6B;CAC3C,MAAM,CAAC,OAAO,SAAS,QAAQ,SAAS,KAAK,MAAM,GAAG,EAAE,IAAI,MAAM;CAClE,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;AACjD;AAEA,IAAM,qBAAqB;;;;AAK3B,IAAM,SAAN,MAAkC;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;CAIA;CACA;CAEA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,YACE,QAKA,wBAAwB,EAAE,qCAAqC,KAAK,GACpE;EACA,MAAM,OAAO;EACb,KAAK,UAAU,QAAQ,IAAI,0BAA0B,OAAO;EAC5D,IAAI,CAAC,OAAO,YAAY;GAGtB,OAAO,aAAa,OAAO,eAAe,OAAO;GACjD,IAAI,CAAC,OAAO,YACV,MAAM,IAAI,MAAM,iCAAiC;EAErD;EACA,KAAK,wBAAwB;EAC7B,KAAK,aAAa,OAAO;EACzB,KAAK,YAAY,KAAK;EACtB,QAAM,mBAAmB,KAAK,UAAU;EACxC,KAAK,UAAU,OAAO;EACtB,KAAK,WAAW,OAAA,QAAE,MAEhB,OAAA,QAAE,MAAM,iBAAA,iBAAiB,EACvB,KAAK,EACH,gCACE,KAAK,sBAAsB,oCAC/B,EACF,CAAC,GACD,OAAO,QACT;EACA,KAAK,SAAS;GAAE,GAAG,uBAAA;GAAuB,GAAG,OAAO;EAAO;EAC3D,KAAK,QAAQ;GACX,cAAc,OAAO,OAAO,gBAAgB;GAC5C,gBAAgB,OAAO,OAAO,kBAAkB;GAChD,UAAU,OAAO,OAAO,YAAY;GACpC,YAAY,OAAO,OAAO,cAAc;EAC1C;EACA,KAAK,aAAa,OAAO;EAEzB,KAAK,MAAM,cAAc,QACvB,IAAI,KAAK,eAAe,MACtB,KAAK,cAAc,OAAO;EAI9B,IAAI,OAAO,KAAK,eAAe,aAAa;GAE1C,QAAM,wBAAwB;GAC9B,KAAK,aAAa,cAAA,aAAa,KAAK;EACtC;EAEA,KAAK,gBAAgB;GAAE,GAAG;GAAyB,GAAG,QAAQ;EAAc;EAG5E,CAAA,GAAA,YAAA,SAAO,gBAAA,gBAAgB,SAAS,MAAM,GAAG,gBAAA,UAAU,gBAAgB;EAGnE,qBAAqB,QAAQ,SAAU,GAAS;GAC9C,IAAI,KAAK,MAAM,MACb,KAAK,KAAK,CAAC;GAGb,CAAA,GAAA,YAAA,SAAO,gBAAA,gBAAgB,SAAS,KAAK,EAAE,GAAG,gBAAgB,EAAE,0BAA0B;EACxF,CAAC;EAED,KAAK,UAAU,gBAAA,wBAAwB,gBAAA,kBAAkB,KAAK,OAAO,CAAC;EACtE,KAAK,WAAW,uBAAA,uBAAuB,KAAK,QAAQ;EAGpD,iBAAiB,SAAS,YAAkB;GAC1C,IAAI,EAAE,WAAW,OACf,KAAK,WAAW,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,YAAY;EAE5E,CAAC;EAID,IAAI,CAAC,KAAK,WACR,KAAK,YAAY,gBAAA,YAAY,wBAAwB,CAAC;CAE1D;CAEA,oCAA2C;EACzC,OAAO,KAAK,SAAS,IAAI;CAC3B;CAEA,gBAAuB;EACrB,OAAO,KAAK;CACd;;;;;;;CAQA,uBAA8B,SAAuC;EAEnE,OAAO,gBAAA,UAAU,uBAAuB,SAAS,KAAK,QAAQ;CAChE;;;;;;;;;;;;CAaA,eAAsB,QAAyB;EAC7C,QAAM,0BAA0B;EAChC,IAAI,OAAO,WAAW,YAAY,OAAA,QAAE,QAAQ,MAAM,MAAM,OAAO;GAC7D,QAAM,iCAAiC,OAAO,MAAM;GACpD,IAAI,OAAO,WAAW,oBAAoB;IACxC,QAAM,uCAAuC,OAAO,MAAM;IAC1D,KAAK,SAAS;IACd,OAAO,KAAK;GACd;GAKA,IAAI,KAAK,kCAAkC,MAAM,MAAM;IACrD,KAAK,SAAS,cAAA,wBAAwB;IACtC,QAAM,uCAAuC,KAAK,OAAO,MAAM;IAC/D,OAAO,KAAK;GACd;GACA,QAAM,sEAAsE,OAAO,MAAM;GACzF,MAAM,IAAI,MACR,wEAAwE,OAAO,OAAO;;8EAGxF;EACF,OAAO;GAGL,QAAM,6BAA6B;GACnC,KAAK,SAAS,cAAA,wBAAwB;GACtC,QAAM,wCAAwC,KAAK,QAAQ,MAAM;GAEjE,OAAO,KAAK;EACd;CACF;AACF"}