@verdaccio/config 9.0.0-next-9.5 → 9.0.0-next-9.7

package/README.md

@@ -98,16 +98,16 @@ If you want to report a security vulnerability, please follow the steps which we
 
 Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/verdaccio/contribute)]
 
-[![sponsor](https://opencollective.com/verdaccio/sponsor/0/avatar.svg)](https://opencollective.com/verdaccio/sponsor/0/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/1/avatar.svg)](https://opencollective.com/verdaccio/sponsor/1/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/2/avatar.svg)](https://opencollective.com/verdaccio/sponsor/2/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/3/avatar.svg)](https://opencollective.com/verdaccio/sponsor/3/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/4/avatar.svg)](https://opencollective.com/verdaccio/sponsor/4/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/5/avatar.svg)](https://opencollective.com/verdaccio/sponsor/5/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/6/avatar.svg)](https://opencollective.com/verdaccio/sponsor/6/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/7/avatar.svg)](https://opencollective.com/verdaccio/sponsor/7/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/8/avatar.svg)](https://opencollective.com/verdaccio/sponsor/8/website)
-[![sponsor](https://opencollective.com/verdaccio/sponsor/9/avatar.svg)](https://opencollective.com/verdaccio/sponsor/9/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/0/avatar.png)](https://opencollective.com/verdaccio/sponsor/0/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/1/avatar.png)](https://opencollective.com/verdaccio/sponsor/1/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/2/avatar.png)](https://opencollective.com/verdaccio/sponsor/2/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/3/avatar.png)](https://opencollective.com/verdaccio/sponsor/3/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/4/avatar.png)](https://opencollective.com/verdaccio/sponsor/4/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/5/avatar.png)](https://opencollective.com/verdaccio/sponsor/5/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/6/avatar.png)](https://opencollective.com/verdaccio/sponsor/6/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/7/avatar.png)](https://opencollective.com/verdaccio/sponsor/7/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/8/avatar.png)](https://opencollective.com/verdaccio/sponsor/8/website)
+[![sponsor](https://opencollective.com/verdaccio/sponsor/9/avatar.png)](https://opencollective.com/verdaccio/sponsor/9/website)
 
 ## Open Collective Backers
 

package/build/conf/default.yaml

@@ -218,6 +218,26 @@ middlewares:
     enabled: true
     # timeout: 10000
 
+# Settings for filter plugins
+# https://verdaccio.org/docs/configuration#filters
+filters:
+  '@verdaccio/package-filter':
+    # Block versions younger than N days
+    # minAgeDays: 30
+    # Block versions published after a specific date
+    # dateThreshold: '2024-01-01'
+    # Block specific packages, scopes, or version ranges
+    # block:
+    #   - scope: '@evilscope'
+    #   - package: 'malicious-pkg'
+    #   - package: 'some-pkg'
+    #     versions: '>=2.0.0'
+    # Allow exceptions to block rules
+    # allow:
+    #   - scope: '@trusted'
+    #   - package: 'some-pkg'
+    #     versions: '2.1.0'
+
 # Log settings
 # https://verdaccio.org/docs/logger
 # Redaction: https://getpino.io/#/docs/redaction

package/build/conf/docker.yaml

@@ -214,6 +214,26 @@ middlewares:
     enabled: true
     # timeout: 10000
 
+# Settings for filter plugins
+# https://verdaccio.org/docs/configuration#filters
+filters:
+  '@verdaccio/package-filter':
+    # Block versions younger than N days
+    # minAgeDays: 30
+    # Block versions published after a specific date
+    # dateThreshold: '2024-01-01'
+    # Block specific packages, scopes, or version ranges
+    # block:
+    #   - scope: '@evilscope'
+    #   - package: 'malicious-pkg'
+    #   - package: 'some-pkg'
+    #     versions: '>=2.0.0'
+    # Allow exceptions to block rules
+    # allow:
+    #   - scope: '@trusted'
+    #   - package: 'some-pkg'
+    #     versions: '2.1.0'
+
 # Log settings
 # https://verdaccio.org/docs/logger
 # Redaction: https://getpino.io/#/docs/redaction

package/build/config.d.ts

@@ -4,7 +4,6 @@ export declare const defaultUserRateLimiting: {
     windowMs: number;
     max: number;
 };
-export declare function isNodeVersionGreaterThan21(): boolean;
 /**
  * Coordinates the application configuration
  */
@@ -25,16 +24,12 @@ declare class Config implements AppConfig {
     plugins: string | void | null;
     security: Security;
     server: ServerSettingsConf;
-    private configOverrideOptions;
     secret: string;
     flags: FlagsConfig;
     userRateLimit: RateLimit;
     constructor(config: ConfigYaml & {
         config_path: string;
-    }, configOverrideOptions?: {
-        forceMigrateToSecureLegacySignature: boolean;
     });
-    getMigrateToSecureLegacySignature(): boolean;
     getConfigPath(): string;
     /**
      * Check for package spec
@@ -44,14 +39,9 @@ declare class Config implements AppConfig {
      */
     getMatchedPackagesSpec(pkgName: string): PackageAccess | void;
     /**
-     * Verify if the secret complies with the required structure
-     *  - If the secret is not provided, it will generate a new one
-     *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
-     *  - If the secret is provided:
-     *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
-     *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
-     *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
-     *      generated with the new signature model
+     * Verify if the secret complies with the required structure.
+     * The secret must be exactly 32 characters long for aes-256-ctr encryption.
+     * If no secret is provided, a new one will be generated.
      * @secret external secret key
      */
     checkSecretKey(secret?: string): string;

package/build/config.js

@@ -13,7 +13,6 @@ let node_assert = require("node:assert");
 node_assert = require_runtime.__toESM(node_assert);
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/config.ts
-var { Codes } = _verdaccio_core.warningUtils;
 var strategicConfigProps = ["uplinks", "packages"];
 var allowedEnvConfig = [
 	"http_proxy",
@@ -26,10 +25,6 @@ var defaultUserRateLimiting = {
 	windowMs: 900 * 1e3,
 	max: 1e3
 };
-function isNodeVersionGreaterThan21() {
-	const [major, minor] = process.versions.node.split(".").map(Number);
-	return major > 21 || major === 21 && minor >= 0;
-}
 var TOKEN_VALID_LENGTH = 32;
 /**
 * Coordinates the application configuration
@@ -51,23 +46,21 @@ var Config = class {
 	plugins;
 	security;
 	server;
-	configOverrideOptions;
 	secret;
 	flags;
 	userRateLimit;
-	constructor(config, configOverrideOptions = { forceMigrateToSecureLegacySignature: true }) {
+	constructor(config) {
 		const self = this;
 		this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
 		if (!config.configPath) {
 			config.configPath = config.config_path ?? config.self_path;
 			if (!config.configPath) throw new Error("configPath property is required");
 		}
-		this.configOverrideOptions = configOverrideOptions;
 		this.configPath = config.configPath;
 		this.self_path = this.configPath;
 		debug$1("config path: %s", this.configPath);
 		this.plugins = config.plugins;
-		this.security = lodash.default.merge(lodash.default.merge(require_security.defaultSecurity, { api: { migrateToSecureLegacySignature: this.configOverrideOptions.forceMigrateToSecureLegacySignature } }), config.security);
+		this.security = lodash.default.merge(require_security.defaultSecurity, config.security);
 		this.server = {
 			...require_serverSettings.default,
 			...config.server
@@ -100,9 +93,6 @@ var Config = class {
 		});
 		if (!this.server_id) this.server_id = _verdaccio_core.cryptoUtils.generateRandomHexString(6);
 	}
-	getMigrateToSecureLegacySignature() {
-		return this.security.api.migrateToSecureLegacySignature;
-	}
 	getConfigPath() {
 		return this.configPath;
 	}
@@ -116,49 +106,17 @@ var Config = class {
 		return _verdaccio_core.authUtils.getMatchedPackagesSpec(pkgName, this.packages);
 	}
 	/**
-	* Verify if the secret complies with the required structure
-	*  - If the secret is not provided, it will generate a new one
-	*    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
-	*  - If the secret is provided:
-	*    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
-	*    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
-	*    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
-	*      generated with the new signature model
+	* Verify if the secret complies with the required structure.
+	* The secret must be exactly 32 characters long for aes-256-ctr encryption.
+	* If no secret is provided, a new one will be generated.
 	* @secret external secret key
 	*/
 	checkSecretKey(secret) {
 		debug$1("checking secret key init");
 		if (typeof secret === "string" && lodash.default.isEmpty(secret) === false) {
 			debug$1("checking secret key length %s", secret.length);
-			if (secret.length > TOKEN_VALID_LENGTH) if (isNodeVersionGreaterThan21()) {
-				debug$1("is node version greater than 21");
-				if (this.getMigrateToSecureLegacySignature() === true) {
-					this.secret = require_token.generateRandomSecretKey();
-					debug$1("rewriting secret key with length %s", this.secret.length);
-					return this.secret;
-				}
-				debug$1("secret does not comply with the required length, current length  %d, application will fail on startup", secret.length);
-				throw new Error(`Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
-            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
-            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
-			} else {
-				debug$1("is node version lower than 22");
-				if (this.getMigrateToSecureLegacySignature() === true) {
-					this.secret = require_token.generateRandomSecretKey();
-					debug$1("rewriting secret key with length %s", this.secret.length);
-					return this.secret;
-				}
-				debug$1("triggering deprecation warning for secret key length %s", secret.length);
-				_verdaccio_core.warningUtils.emit(Codes.VERWAR007);
-				this.secret = secret;
-				return this.secret;
-			}
-			else if (secret.length === TOKEN_VALID_LENGTH) {
-				debug$1("detected valid secret key length %s", secret.length);
-				this.secret = secret;
-				return this.secret;
-			}
-			debug$1("reusing previous key with length %s", secret.length);
+			if (secret.length !== TOKEN_VALID_LENGTH) throw new Error(`Invalid storage secret key length, must be ${TOKEN_VALID_LENGTH} characters long but is ${secret.length}. Please generate a new one. Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
+			debug$1("detected valid secret key length %s", secret.length);
 			this.secret = secret;
 			return this.secret;
 		} else {
@@ -173,6 +131,5 @@ var Config = class {
 exports.Config = Config;
 exports.WEB_TITLE = WEB_TITLE;
 exports.defaultUserRateLimiting = defaultUserRateLimiting;
-exports.isNodeVersionGreaterThan21 = isNodeVersionGreaterThan21;
 
 //# sourceMappingURL=config.js.map

package/build/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","names":[],"sources":["../src/config.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport assert from 'node:assert';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils, warningUtils } from '@verdaccio/core';\nimport type {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst { Codes } = warningUtils;\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n      createUser: config.flags?.createUser ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length > TOKEN_VALID_LENGTH) {\n        if (isNodeVersionGreaterThan21()) {\n          debug('is node version greater than 21');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          // oops, user needs to generate a new secret key\n          debug(\n            'secret does not comply with the required length, current length  %d, application will fail on startup',\n            secret.length\n          );\n          throw new Error(\n            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n          );\n        } else {\n          debug('is node version lower than 22');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          debug('triggering deprecation warning for secret key length %s', secret.length);\n          // still using Node.js versions previous to 22, but we need to emit a deprecation warning\n          // deprecation warning, secret key is too long and must be 32\n          // this will be removed in the next major release and will produce an error\n          warningUtils.emit(Codes.VERWAR007);\n          this.secret = secret;\n          return this.secret;\n        }\n      } else if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      debug('reusing previous key with length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,IAAM,EAAE,UAAU,gBAAA;AAElB,IAAM,uBAAuB,CAAC,WAAW,WAAW;AACpD,IAAM,mBAAmB;CAAC;CAAc;CAAe;CAAW;AAClE,IAAM,WAAA,GAAA,MAAA,SAAmB,mBAAmB;AAE5C,IAAa,YAAY;AAGzB,IAAa,0BAA0B;CACrC,UAAU,MAAU;CACpB,KAAK;CACN;AAED,SAAgB,6BAA6B;CAC3C,MAAM,CAAC,OAAO,SAAS,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAC,IAAI,OAAO;AACnE,QAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;;AAGjD,IAAM,qBAAqB;;;;AAK3B,IAAM,SAAN,MAAkC;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;CAIA;CACA;CAEA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,YACE,QAKA,wBAAwB,EAAE,qCAAqC,MAAM,EACrE;EACA,MAAM,OAAO;AACb,OAAK,UAAU,QAAQ,IAAI,0BAA0B,OAAO;AAC5D,MAAI,CAAC,OAAO,YAAY;AAGtB,UAAO,aAAa,OAAO,eAAe,OAAO;AACjD,OAAI,CAAC,OAAO,WACV,OAAM,IAAI,MAAM,kCAAkC;;AAGtD,OAAK,wBAAwB;AAC7B,OAAK,aAAa,OAAO;AACzB,OAAK,YAAY,KAAK;AACtB,UAAM,mBAAmB,KAAK,WAAW;AACzC,OAAK,UAAU,OAAO;AACtB,OAAK,WAAW,OAAA,QAAE,MAEhB,OAAA,QAAE,MAAM,iBAAA,iBAAiB,EACvB,KAAK,EACH,gCACE,KAAK,sBAAsB,qCAC9B,EACF,CAAC,EACF,OAAO,SACR;AACD,OAAK,SAAS;GAAE,GAAG,uBAAA;GAAuB,GAAG,OAAO;GAAQ;AAC5D,OAAK,QAAQ;GACX,cAAc,OAAO,OAAO,gBAAgB;GAC5C,gBAAgB,OAAO,OAAO,kBAAkB;GAChD,UAAU,OAAO,OAAO,YAAY;GACpC,YAAY,OAAO,OAAO,cAAc;GACzC;AACD,OAAK,aAAa,OAAO;AAEzB,OAAK,MAAM,cAAc,OACvB,KAAI,KAAK,eAAe,KACtB,MAAK,cAAc,OAAO;AAI9B,MAAI,OAAO,KAAK,eAAe,aAAa;AAE1C,WAAM,yBAAyB;AAC/B,QAAK,aAAa,cAAA,aAAa,MAAM;;AAGvC,OAAK,gBAAgB;GAAE,GAAG;GAAyB,GAAG,QAAQ;GAAe;AAG7E,GAAA,GAAA,YAAA,SAAO,gBAAA,gBAAgB,SAAS,OAAO,EAAE,gBAAA,UAAU,iBAAiB;AAGpE,uBAAqB,QAAQ,SAAU,GAAS;AAC9C,OAAI,KAAK,MAAM,KACb,MAAK,KAAK,EAAE;AAGd,IAAA,GAAA,YAAA,SAAO,gBAAA,gBAAgB,SAAS,KAAK,GAAG,EAAE,gBAAgB,EAAE,2BAA2B;IACvF;AAEF,OAAK,UAAU,gBAAA,wBAAwB,gBAAA,kBAAkB,KAAK,QAAQ,CAAC;AACvE,OAAK,WAAW,uBAAA,uBAAuB,KAAK,SAAS;AAGrD,mBAAiB,SAAS,YAAkB;AAC1C,OAAI,EAAE,WAAW,MACf,MAAK,WAAW,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,aAAa;IAE3E;AAIF,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,gBAAA,YAAY,wBAAwB,EAAE;;CAI3D,oCAA2C;AACzC,SAAO,KAAK,SAAS,IAAI;;CAG3B,gBAAuB;AACrB,SAAO,KAAK;;;;;;;;CASd,uBAA8B,SAAuC;AAEnE,SAAO,gBAAA,UAAU,uBAAuB,SAAS,KAAK,SAAS;;;;;;;;;;;;;CAcjE,eAAsB,QAAyB;AAC7C,UAAM,2BAA2B;AACjC,MAAI,OAAO,WAAW,YAAY,OAAA,QAAE,QAAQ,OAAO,KAAK,OAAO;AAC7D,WAAM,iCAAiC,OAAO,OAAO;AACrD,OAAI,OAAO,SAAS,mBAClB,KAAI,4BAA4B,EAAE;AAChC,YAAM,kCAAkC;AACxC,QAAI,KAAK,mCAAmC,KAAK,MAAM;AACrD,UAAK,SAAS,cAAA,yBAAyB;AACvC,aAAM,uCAAuC,KAAK,OAAO,OAAO;AAChE,YAAO,KAAK;;AAGd,YACE,yGACA,OAAO,OACR;AACD,UAAM,IAAI,MACR,wEAAwE,OAAO,OAAO;;mFAGvF;UACI;AACL,YAAM,gCAAgC;AACtC,QAAI,KAAK,mCAAmC,KAAK,MAAM;AACrD,UAAK,SAAS,cAAA,yBAAyB;AACvC,aAAM,uCAAuC,KAAK,OAAO,OAAO;AAChE,YAAO,KAAK;;AAEd,YAAM,2DAA2D,OAAO,OAAO;AAI/E,oBAAA,aAAa,KAAK,MAAM,UAAU;AAClC,SAAK,SAAS;AACd,WAAO,KAAK;;YAEL,OAAO,WAAW,oBAAoB;AAC/C,YAAM,uCAAuC,OAAO,OAAO;AAC3D,SAAK,SAAS;AACd,WAAO,KAAK;;AAEd,WAAM,uCAAuC,OAAO,OAAO;AAC3D,QAAK,SAAS;AACd,UAAO,KAAK;SACP;AAGL,WAAM,8BAA8B;AACpC,QAAK,SAAS,cAAA,yBAAyB;AACvC,WAAM,wCAAwC,KAAK,QAAQ,OAAO;AAElE,UAAO,KAAK"}
+{"version":3,"file":"config.js","names":[],"sources":["../src/config.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport assert from 'node:assert';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils } from '@verdaccio/core';\nimport type {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(config: ConfigYaml & { config_path: string }) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n      createUser: config.flags?.createUser ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure.\n   * The secret must be exactly 32 characters long for aes-256-ctr encryption.\n   * If no secret is provided, a new one will be generated.\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length !== TOKEN_VALID_LENGTH) {\n        throw new Error(\n          `Invalid storage secret key length, must be ${TOKEN_VALID_LENGTH} characters long but is ${secret.length}. ` +\n            `Please generate a new one. Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n        );\n      }\n      debug('detected valid secret key length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,IAAM,uBAAuB,CAAC,WAAW,WAAW;AACpD,IAAM,mBAAmB;CAAC;CAAc;CAAe;CAAW;AAClE,IAAM,WAAA,GAAA,MAAA,SAAmB,mBAAmB;AAE5C,IAAa,YAAY;AAGzB,IAAa,0BAA0B;CACrC,UAAU,MAAU;CACpB,KAAK;CACN;AAED,IAAM,qBAAqB;;;;AAK3B,IAAM,SAAN,MAAkC;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;CAIA;CACA;CAEA;CACA;CACA;CAEA;CACA;CACA;CACA,YAAmB,QAA8C;EAC/D,MAAM,OAAO;AACb,OAAK,UAAU,QAAQ,IAAI,0BAA0B,OAAO;AAC5D,MAAI,CAAC,OAAO,YAAY;AAGtB,UAAO,aAAa,OAAO,eAAe,OAAO;AACjD,OAAI,CAAC,OAAO,WACV,OAAM,IAAI,MAAM,kCAAkC;;AAGtD,OAAK,aAAa,OAAO;AACzB,OAAK,YAAY,KAAK;AACtB,UAAM,mBAAmB,KAAK,WAAW;AACzC,OAAK,UAAU,OAAO;AACtB,OAAK,WAAW,OAAA,QAAE,MAAM,iBAAA,iBAAiB,OAAO,SAAS;AACzD,OAAK,SAAS;GAAE,GAAG,uBAAA;GAAuB,GAAG,OAAO;GAAQ;AAC5D,OAAK,QAAQ;GACX,cAAc,OAAO,OAAO,gBAAgB;GAC5C,gBAAgB,OAAO,OAAO,kBAAkB;GAChD,UAAU,OAAO,OAAO,YAAY;GACpC,YAAY,OAAO,OAAO,cAAc;GACzC;AACD,OAAK,aAAa,OAAO;AAEzB,OAAK,MAAM,cAAc,OACvB,KAAI,KAAK,eAAe,KACtB,MAAK,cAAc,OAAO;AAI9B,MAAI,OAAO,KAAK,eAAe,aAAa;AAE1C,WAAM,yBAAyB;AAC/B,QAAK,aAAa,cAAA,aAAa,MAAM;;AAGvC,OAAK,gBAAgB;GAAE,GAAG;GAAyB,GAAG,QAAQ;GAAe;AAG7E,GAAA,GAAA,YAAA,SAAO,gBAAA,gBAAgB,SAAS,OAAO,EAAE,gBAAA,UAAU,iBAAiB;AAGpE,uBAAqB,QAAQ,SAAU,GAAS;AAC9C,OAAI,KAAK,MAAM,KACb,MAAK,KAAK,EAAE;AAGd,IAAA,GAAA,YAAA,SAAO,gBAAA,gBAAgB,SAAS,KAAK,GAAG,EAAE,gBAAgB,EAAE,2BAA2B;IACvF;AAEF,OAAK,UAAU,gBAAA,wBAAwB,gBAAA,kBAAkB,KAAK,QAAQ,CAAC;AACvE,OAAK,WAAW,uBAAA,uBAAuB,KAAK,SAAS;AAGrD,mBAAiB,SAAS,YAAkB;AAC1C,OAAI,EAAE,WAAW,MACf,MAAK,WAAW,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,aAAa;IAE3E;AAIF,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,gBAAA,YAAY,wBAAwB,EAAE;;CAI3D,gBAAuB;AACrB,SAAO,KAAK;;;;;;;;CASd,uBAA8B,SAAuC;AAEnE,SAAO,gBAAA,UAAU,uBAAuB,SAAS,KAAK,SAAS;;;;;;;;CASjE,eAAsB,QAAyB;AAC7C,UAAM,2BAA2B;AACjC,MAAI,OAAO,WAAW,YAAY,OAAA,QAAE,QAAQ,OAAO,KAAK,OAAO;AAC7D,WAAM,iCAAiC,OAAO,OAAO;AACrD,OAAI,OAAO,WAAW,mBACpB,OAAM,IAAI,MACR,8CAA8C,mBAAmB,0BAA0B,OAAO,OAAO,oGAE1G;AAEH,WAAM,uCAAuC,OAAO,OAAO;AAC3D,QAAK,SAAS;AACd,UAAO,KAAK;SACP;AACL,WAAM,8BAA8B;AACpC,QAAK,SAAS,cAAA,yBAAyB;AACvC,WAAM,wCAAwC,KAAK,QAAQ,OAAO;AAClE,UAAO,KAAK"}

package/build/config.mjs

@@ -7,9 +7,8 @@ import { sanityCheckUplinksProps, uplinkSanityCheck } from "./uplinks.mjs";
 import buildDebug from "debug";
 import _ from "lodash";
 import assert from "node:assert";
-import { APP_ERROR, authUtils, cryptoUtils, validationUtils, warningUtils } from "@verdaccio/core";
+import { APP_ERROR, authUtils, cryptoUtils, validationUtils } from "@verdaccio/core";
 //#region src/config.ts
-var { Codes } = warningUtils;
 var strategicConfigProps = ["uplinks", "packages"];
 var allowedEnvConfig = [
 	"http_proxy",
@@ -22,10 +21,6 @@ var defaultUserRateLimiting = {
 	windowMs: 900 * 1e3,
 	max: 1e3
 };
-function isNodeVersionGreaterThan21() {
-	const [major, minor] = process.versions.node.split(".").map(Number);
-	return major > 21 || major === 21 && minor >= 0;
-}
 var TOKEN_VALID_LENGTH = 32;
 /**
 * Coordinates the application configuration
@@ -47,23 +42,21 @@ var Config = class {
 	plugins;
 	security;
 	server;
-	configOverrideOptions;
 	secret;
 	flags;
 	userRateLimit;
-	constructor(config, configOverrideOptions = { forceMigrateToSecureLegacySignature: true }) {
+	constructor(config) {
 		const self = this;
 		this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;
 		if (!config.configPath) {
 			config.configPath = config.config_path ?? config.self_path;
 			if (!config.configPath) throw new Error("configPath property is required");
 		}
-		this.configOverrideOptions = configOverrideOptions;
 		this.configPath = config.configPath;
 		this.self_path = this.configPath;
 		debug("config path: %s", this.configPath);
 		this.plugins = config.plugins;
-		this.security = _.merge(_.merge(defaultSecurity, { api: { migrateToSecureLegacySignature: this.configOverrideOptions.forceMigrateToSecureLegacySignature } }), config.security);
+		this.security = _.merge(defaultSecurity, config.security);
 		this.server = {
 			...serverSettings_default,
 			...config.server
@@ -96,9 +89,6 @@ var Config = class {
 		});
 		if (!this.server_id) this.server_id = cryptoUtils.generateRandomHexString(6);
 	}
-	getMigrateToSecureLegacySignature() {
-		return this.security.api.migrateToSecureLegacySignature;
-	}
 	getConfigPath() {
 		return this.configPath;
 	}
@@ -112,49 +102,17 @@ var Config = class {
 		return authUtils.getMatchedPackagesSpec(pkgName, this.packages);
 	}
 	/**
-	* Verify if the secret complies with the required structure
-	*  - If the secret is not provided, it will generate a new one
-	*    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)
-	*  - If the secret is provided:
-	*    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup
-	*    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning
-	*    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be
-	*      generated with the new signature model
+	* Verify if the secret complies with the required structure.
+	* The secret must be exactly 32 characters long for aes-256-ctr encryption.
+	* If no secret is provided, a new one will be generated.
 	* @secret external secret key
 	*/
 	checkSecretKey(secret) {
 		debug("checking secret key init");
 		if (typeof secret === "string" && _.isEmpty(secret) === false) {
 			debug("checking secret key length %s", secret.length);
-			if (secret.length > TOKEN_VALID_LENGTH) if (isNodeVersionGreaterThan21()) {
-				debug("is node version greater than 21");
-				if (this.getMigrateToSecureLegacySignature() === true) {
-					this.secret = generateRandomSecretKey();
-					debug("rewriting secret key with length %s", this.secret.length);
-					return this.secret;
-				}
-				debug("secret does not comply with the required length, current length  %d, application will fail on startup", secret.length);
-				throw new Error(`Invalid storage secret key length, must be 32 characters long but is ${secret.length}. 
-            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. 
-            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
-			} else {
-				debug("is node version lower than 22");
-				if (this.getMigrateToSecureLegacySignature() === true) {
-					this.secret = generateRandomSecretKey();
-					debug("rewriting secret key with length %s", this.secret.length);
-					return this.secret;
-				}
-				debug("triggering deprecation warning for secret key length %s", secret.length);
-				warningUtils.emit(Codes.VERWAR007);
-				this.secret = secret;
-				return this.secret;
-			}
-			else if (secret.length === TOKEN_VALID_LENGTH) {
-				debug("detected valid secret key length %s", secret.length);
-				this.secret = secret;
-				return this.secret;
-			}
-			debug("reusing previous key with length %s", secret.length);
+			if (secret.length !== TOKEN_VALID_LENGTH) throw new Error(`Invalid storage secret key length, must be ${TOKEN_VALID_LENGTH} characters long but is ${secret.length}. Please generate a new one. Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`);
+			debug("detected valid secret key length %s", secret.length);
 			this.secret = secret;
 			return this.secret;
 		} else {
@@ -166,6 +124,6 @@ var Config = class {
 	}
 };
 //#endregion
-export { Config, WEB_TITLE, defaultUserRateLimiting, isNodeVersionGreaterThan21 };
+export { Config, WEB_TITLE, defaultUserRateLimiting };
 
 //# sourceMappingURL=config.mjs.map

package/build/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport assert from 'node:assert';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils, warningUtils } from '@verdaccio/core';\nimport type {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst { Codes } = warningUtils;\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nexport function isNodeVersionGreaterThan21() {\n  const [major, minor] = process.versions.node.split('.').map(Number);\n  return major > 21 || (major === 21 && minor >= 0);\n}\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  private configOverrideOptions: { forceMigrateToSecureLegacySignature: boolean };\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(\n    config: ConfigYaml & { config_path: string },\n    // forceEnhancedLegacySignature is a property that\n    // allows switch a new legacy aes signature token signature\n    // for older versions do not want to have this new signature model\n    // this property must be false\n    configOverrideOptions = { forceMigrateToSecureLegacySignature: true }\n  ) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configOverrideOptions = configOverrideOptions;\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(\n      // override the default security configuration via constructor\n      _.merge(defaultSecurity, {\n        api: {\n          migrateToSecureLegacySignature:\n            this.configOverrideOptions.forceMigrateToSecureLegacySignature,\n        },\n      }),\n      config.security\n    );\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n      createUser: config.flags?.createUser ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getMigrateToSecureLegacySignature() {\n    return this.security.api.migrateToSecureLegacySignature;\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure\n   *  - If the secret is not provided, it will generate a new one\n   *    - For any Node.js version the new secret will be 32 characters long (to allow compatibility with modern Node.js versions)\n   *  - If the secret is provided:\n   *    - If Node.js 22 or higher, the secret must be 32 characters long thus the application will fail on startup\n   *    - If Node.js 21 or lower, the secret will be used as is but will display a deprecation warning\n   *    - If the property `security.api.migrateToSecureLegacySignature` is provided and set to true, the secret will be\n   *      generated with the new signature model\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length > TOKEN_VALID_LENGTH) {\n        if (isNodeVersionGreaterThan21()) {\n          debug('is node version greater than 21');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          // oops, user needs to generate a new secret key\n          debug(\n            'secret does not comply with the required length, current length  %d, application will fail on startup',\n            secret.length\n          );\n          throw new Error(\n            `Invalid storage secret key length, must be 32 characters long but is ${secret.length}. \n            The secret length in Node.js 22 or higher must be 32 characters long. Please consider generate a new one. \n            Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n          );\n        } else {\n          debug('is node version lower than 22');\n          if (this.getMigrateToSecureLegacySignature() === true) {\n            this.secret = generateRandomSecretKey();\n            debug('rewriting secret key with length %s', this.secret.length);\n            return this.secret;\n          }\n          debug('triggering deprecation warning for secret key length %s', secret.length);\n          // still using Node.js versions previous to 22, but we need to emit a deprecation warning\n          // deprecation warning, secret key is too long and must be 32\n          // this will be removed in the next major release and will produce an error\n          warningUtils.emit(Codes.VERWAR007);\n          this.secret = secret;\n          return this.secret;\n        }\n      } else if (secret.length === TOKEN_VALID_LENGTH) {\n        debug('detected valid secret key length %s', secret.length);\n        this.secret = secret;\n        return this.secret;\n      }\n      debug('reusing previous key with length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      // generate a new a secret key\n      // FUTURE: this might be an external secret key, perhaps within config file?\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;;;;;AAwBA,IAAM,EAAE,UAAU;AAElB,IAAM,uBAAuB,CAAC,WAAW,WAAW;AACpD,IAAM,mBAAmB;CAAC;CAAc;CAAe;CAAW;AAClE,IAAM,QAAQ,WAAW,mBAAmB;AAE5C,IAAa,YAAY;AAGzB,IAAa,0BAA0B;CACrC,UAAU,MAAU;CACpB,KAAK;CACN;AAED,SAAgB,6BAA6B;CAC3C,MAAM,CAAC,OAAO,SAAS,QAAQ,SAAS,KAAK,MAAM,IAAI,CAAC,IAAI,OAAO;AACnE,QAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;;AAGjD,IAAM,qBAAqB;;;;AAK3B,IAAM,SAAN,MAAkC;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;CAIA;CACA;CAEA;CACA;CACA;CACA;CAEA;CACA;CACA;CACA,YACE,QAKA,wBAAwB,EAAE,qCAAqC,MAAM,EACrE;EACA,MAAM,OAAO;AACb,OAAK,UAAU,QAAQ,IAAI,0BAA0B,OAAO;AAC5D,MAAI,CAAC,OAAO,YAAY;AAGtB,UAAO,aAAa,OAAO,eAAe,OAAO;AACjD,OAAI,CAAC,OAAO,WACV,OAAM,IAAI,MAAM,kCAAkC;;AAGtD,OAAK,wBAAwB;AAC7B,OAAK,aAAa,OAAO;AACzB,OAAK,YAAY,KAAK;AACtB,QAAM,mBAAmB,KAAK,WAAW;AACzC,OAAK,UAAU,OAAO;AACtB,OAAK,WAAW,EAAE,MAEhB,EAAE,MAAM,iBAAiB,EACvB,KAAK,EACH,gCACE,KAAK,sBAAsB,qCAC9B,EACF,CAAC,EACF,OAAO,SACR;AACD,OAAK,SAAS;GAAE,GAAG;GAAuB,GAAG,OAAO;GAAQ;AAC5D,OAAK,QAAQ;GACX,cAAc,OAAO,OAAO,gBAAgB;GAC5C,gBAAgB,OAAO,OAAO,kBAAkB;GAChD,UAAU,OAAO,OAAO,YAAY;GACpC,YAAY,OAAO,OAAO,cAAc;GACzC;AACD,OAAK,aAAa,OAAO;AAEzB,OAAK,MAAM,cAAc,OACvB,KAAI,KAAK,eAAe,KACtB,MAAK,cAAc,OAAO;AAI9B,MAAI,OAAO,KAAK,eAAe,aAAa;AAE1C,SAAM,yBAAyB;AAC/B,QAAK,aAAa,aAAa,MAAM;;AAGvC,OAAK,gBAAgB;GAAE,GAAG;GAAyB,GAAG,QAAQ;GAAe;AAG7E,SAAO,gBAAgB,SAAS,OAAO,EAAE,UAAU,iBAAiB;AAGpE,uBAAqB,QAAQ,SAAU,GAAS;AAC9C,OAAI,KAAK,MAAM,KACb,MAAK,KAAK,EAAE;AAGd,UAAO,gBAAgB,SAAS,KAAK,GAAG,EAAE,gBAAgB,EAAE,2BAA2B;IACvF;AAEF,OAAK,UAAU,wBAAwB,kBAAkB,KAAK,QAAQ,CAAC;AACvE,OAAK,WAAW,uBAAuB,KAAK,SAAS;AAGrD,mBAAiB,SAAS,YAAkB;AAC1C,OAAI,EAAE,WAAW,MACf,MAAK,WAAW,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,aAAa;IAE3E;AAIF,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,YAAY,wBAAwB,EAAE;;CAI3D,oCAA2C;AACzC,SAAO,KAAK,SAAS,IAAI;;CAG3B,gBAAuB;AACrB,SAAO,KAAK;;;;;;;;CASd,uBAA8B,SAAuC;AAEnE,SAAO,UAAU,uBAAuB,SAAS,KAAK,SAAS;;;;;;;;;;;;;CAcjE,eAAsB,QAAyB;AAC7C,QAAM,2BAA2B;AACjC,MAAI,OAAO,WAAW,YAAY,EAAE,QAAQ,OAAO,KAAK,OAAO;AAC7D,SAAM,iCAAiC,OAAO,OAAO;AACrD,OAAI,OAAO,SAAS,mBAClB,KAAI,4BAA4B,EAAE;AAChC,UAAM,kCAAkC;AACxC,QAAI,KAAK,mCAAmC,KAAK,MAAM;AACrD,UAAK,SAAS,yBAAyB;AACvC,WAAM,uCAAuC,KAAK,OAAO,OAAO;AAChE,YAAO,KAAK;;AAGd,UACE,yGACA,OAAO,OACR;AACD,UAAM,IAAI,MACR,wEAAwE,OAAO,OAAO;;mFAGvF;UACI;AACL,UAAM,gCAAgC;AACtC,QAAI,KAAK,mCAAmC,KAAK,MAAM;AACrD,UAAK,SAAS,yBAAyB;AACvC,WAAM,uCAAuC,KAAK,OAAO,OAAO;AAChE,YAAO,KAAK;;AAEd,UAAM,2DAA2D,OAAO,OAAO;AAI/E,iBAAa,KAAK,MAAM,UAAU;AAClC,SAAK,SAAS;AACd,WAAO,KAAK;;YAEL,OAAO,WAAW,oBAAoB;AAC/C,UAAM,uCAAuC,OAAO,OAAO;AAC3D,SAAK,SAAS;AACd,WAAO,KAAK;;AAEd,SAAM,uCAAuC,OAAO,OAAO;AAC3D,QAAK,SAAS;AACd,UAAO,KAAK;SACP;AAGL,SAAM,8BAA8B;AACpC,QAAK,SAAS,yBAAyB;AACvC,SAAM,wCAAwC,KAAK,QAAQ,OAAO;AAElE,UAAO,KAAK"}
+{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport _ from 'lodash';\nimport assert from 'node:assert';\n\nimport { APP_ERROR, authUtils, cryptoUtils, validationUtils } from '@verdaccio/core';\nimport type {\n  Config as AppConfig,\n  AuthConf,\n  ConfigYaml,\n  FlagsConfig,\n  PackageAccess,\n  PackageList,\n  RateLimit,\n  Security,\n  ServerSettingsConf,\n} from '@verdaccio/types';\n\nimport { getUserAgent } from './agent';\nimport { normalisePackageAccess } from './package-access';\nimport { defaultSecurity } from './security';\nimport defaultServerSettings from './serverSettings';\nimport { generateRandomSecretKey } from './token';\nimport { sanityCheckUplinksProps, uplinkSanityCheck } from './uplinks';\n\nconst strategicConfigProps = ['uplinks', 'packages'];\nconst allowedEnvConfig = ['http_proxy', 'https_proxy', 'no_proxy'];\nconst debug = buildDebug('verdaccio:config');\n\nexport const WEB_TITLE = 'Verdaccio';\n\n// we limit max 1000 request per 15 minutes on user endpoints\nexport const defaultUserRateLimiting = {\n  windowMs: 15 * 60 * 1000, // 15 minutes\n  max: 1000,\n};\n\nconst TOKEN_VALID_LENGTH = 32;\n\n/**\n * Coordinates the application configuration\n */\nclass Config implements AppConfig {\n  public user_agent: string | undefined;\n  public uplinks: any;\n  public packages: PackageList;\n  public users: any;\n  public auth: AuthConf;\n  public store: any;\n  public server_id: string;\n  public configPath: string;\n  /**\n   * @deprecated use configPath or config.getConfigPath();\n   */\n  public self_path: string;\n  public storage: string | void;\n\n  public plugins: string | void | null;\n  public security: Security;\n  public server: ServerSettingsConf;\n  // @ts-ignore\n  public secret: string;\n  public flags: FlagsConfig;\n  public userRateLimit: RateLimit;\n  public constructor(config: ConfigYaml & { config_path: string }) {\n    const self = this;\n    this.storage = process.env.VERDACCIO_STORAGE_PATH || config.storage;\n    if (!config.configPath) {\n      // backport self_path for previous to version 6\n      // @ts-expect-error\n      config.configPath = config.config_path ?? config.self_path;\n      if (!config.configPath) {\n        throw new Error('configPath property is required');\n      }\n    }\n    this.configPath = config.configPath;\n    this.self_path = this.configPath;\n    debug('config path: %s', this.configPath);\n    this.plugins = config.plugins;\n    this.security = _.merge(defaultSecurity, config.security);\n    this.server = { ...defaultServerSettings, ...config.server };\n    this.flags = {\n      searchRemote: config.flags?.searchRemote ?? true,\n      changePassword: config.flags?.changePassword ?? false,\n      webLogin: config.flags?.webLogin ?? false,\n      createUser: config.flags?.createUser ?? false,\n    };\n    this.user_agent = config.user_agent;\n\n    for (const configProp in config) {\n      if (self[configProp] == null) {\n        self[configProp] = config[configProp];\n      }\n    }\n\n    if (typeof this.user_agent === 'undefined') {\n      // by default user agent is hidden\n      debug('set default user agent');\n      this.user_agent = getUserAgent(false);\n    }\n\n    this.userRateLimit = { ...defaultUserRateLimiting, ...config?.userRateLimit };\n\n    // some weird shell scripts are valid yaml files parsed as string\n    assert(validationUtils.isObject(config), APP_ERROR.CONFIG_NOT_VALID);\n\n    // sanity check for strategic config properties\n    strategicConfigProps.forEach(function (x): void {\n      if (self[x] == null) {\n        self[x] = {};\n      }\n\n      assert(validationUtils.isObject(self[x]), `CONFIG: bad \"${x}\" value (object expected)`);\n    });\n\n    this.uplinks = sanityCheckUplinksProps(uplinkSanityCheck(this.uplinks));\n    this.packages = normalisePackageAccess(self.packages);\n\n    // loading these from ENV if aren't in config\n    allowedEnvConfig.forEach((envConf): void => {\n      if (!(envConf in self)) {\n        self[envConf] = process.env[envConf] || process.env[envConf.toUpperCase()];\n      }\n    });\n\n    // unique identifier of self server (or a cluster), used to avoid loops\n    // @ts-ignore\n    if (!this.server_id) {\n      this.server_id = cryptoUtils.generateRandomHexString(6);\n    }\n  }\n\n  public getConfigPath() {\n    return this.configPath;\n  }\n\n  /**\n   * Check for package spec\n   * @param pkgName - package name\n   * @returns package access\n   * @deprecated use core.authUtils instead\n   */\n  public getMatchedPackagesSpec(pkgName: string): PackageAccess | void {\n    // TODO: remove this method and replace by library utils\n    return authUtils.getMatchedPackagesSpec(pkgName, this.packages);\n  }\n\n  /**\n   * Verify if the secret complies with the required structure.\n   * The secret must be exactly 32 characters long for aes-256-ctr encryption.\n   * If no secret is provided, a new one will be generated.\n   * @secret external secret key\n   */\n  public checkSecretKey(secret?: string): string {\n    debug('checking secret key init');\n    if (typeof secret === 'string' && _.isEmpty(secret) === false) {\n      debug('checking secret key length %s', secret.length);\n      if (secret.length !== TOKEN_VALID_LENGTH) {\n        throw new Error(\n          `Invalid storage secret key length, must be ${TOKEN_VALID_LENGTH} characters long but is ${secret.length}. ` +\n            `Please generate a new one. Learn more at https://verdaccio.org/docs/configuration/#.verdaccio-db`\n        );\n      }\n      debug('detected valid secret key length %s', secret.length);\n      this.secret = secret;\n      return this.secret;\n    } else {\n      debug('generating a new secret key');\n      this.secret = generateRandomSecretKey();\n      debug('generated a new secret key length %s', this.secret?.length);\n      return this.secret;\n    }\n  }\n}\n\nexport { Config };\n"],"mappings":";;;;;;;;;;;AAwBA,IAAM,uBAAuB,CAAC,WAAW,WAAW;AACpD,IAAM,mBAAmB;CAAC;CAAc;CAAe;CAAW;AAClE,IAAM,QAAQ,WAAW,mBAAmB;AAE5C,IAAa,YAAY;AAGzB,IAAa,0BAA0B;CACrC,UAAU,MAAU;CACpB,KAAK;CACN;AAED,IAAM,qBAAqB;;;;AAK3B,IAAM,SAAN,MAAkC;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;;;;CAIA;CACA;CAEA;CACA;CACA;CAEA;CACA;CACA;CACA,YAAmB,QAA8C;EAC/D,MAAM,OAAO;AACb,OAAK,UAAU,QAAQ,IAAI,0BAA0B,OAAO;AAC5D,MAAI,CAAC,OAAO,YAAY;AAGtB,UAAO,aAAa,OAAO,eAAe,OAAO;AACjD,OAAI,CAAC,OAAO,WACV,OAAM,IAAI,MAAM,kCAAkC;;AAGtD,OAAK,aAAa,OAAO;AACzB,OAAK,YAAY,KAAK;AACtB,QAAM,mBAAmB,KAAK,WAAW;AACzC,OAAK,UAAU,OAAO;AACtB,OAAK,WAAW,EAAE,MAAM,iBAAiB,OAAO,SAAS;AACzD,OAAK,SAAS;GAAE,GAAG;GAAuB,GAAG,OAAO;GAAQ;AAC5D,OAAK,QAAQ;GACX,cAAc,OAAO,OAAO,gBAAgB;GAC5C,gBAAgB,OAAO,OAAO,kBAAkB;GAChD,UAAU,OAAO,OAAO,YAAY;GACpC,YAAY,OAAO,OAAO,cAAc;GACzC;AACD,OAAK,aAAa,OAAO;AAEzB,OAAK,MAAM,cAAc,OACvB,KAAI,KAAK,eAAe,KACtB,MAAK,cAAc,OAAO;AAI9B,MAAI,OAAO,KAAK,eAAe,aAAa;AAE1C,SAAM,yBAAyB;AAC/B,QAAK,aAAa,aAAa,MAAM;;AAGvC,OAAK,gBAAgB;GAAE,GAAG;GAAyB,GAAG,QAAQ;GAAe;AAG7E,SAAO,gBAAgB,SAAS,OAAO,EAAE,UAAU,iBAAiB;AAGpE,uBAAqB,QAAQ,SAAU,GAAS;AAC9C,OAAI,KAAK,MAAM,KACb,MAAK,KAAK,EAAE;AAGd,UAAO,gBAAgB,SAAS,KAAK,GAAG,EAAE,gBAAgB,EAAE,2BAA2B;IACvF;AAEF,OAAK,UAAU,wBAAwB,kBAAkB,KAAK,QAAQ,CAAC;AACvE,OAAK,WAAW,uBAAuB,KAAK,SAAS;AAGrD,mBAAiB,SAAS,YAAkB;AAC1C,OAAI,EAAE,WAAW,MACf,MAAK,WAAW,QAAQ,IAAI,YAAY,QAAQ,IAAI,QAAQ,aAAa;IAE3E;AAIF,MAAI,CAAC,KAAK,UACR,MAAK,YAAY,YAAY,wBAAwB,EAAE;;CAI3D,gBAAuB;AACrB,SAAO,KAAK;;;;;;;;CASd,uBAA8B,SAAuC;AAEnE,SAAO,UAAU,uBAAuB,SAAS,KAAK,SAAS;;;;;;;;CASjE,eAAsB,QAAyB;AAC7C,QAAM,2BAA2B;AACjC,MAAI,OAAO,WAAW,YAAY,EAAE,QAAQ,OAAO,KAAK,OAAO;AAC7D,SAAM,iCAAiC,OAAO,OAAO;AACrD,OAAI,OAAO,WAAW,mBACpB,OAAM,IAAI,MACR,8CAA8C,mBAAmB,0BAA0B,OAAO,OAAO,oGAE1G;AAEH,SAAM,uCAAuC,OAAO,OAAO;AAC3D,QAAK,SAAS;AACd,UAAO,KAAK;SACP;AACL,SAAM,8BAA8B;AACpC,QAAK,SAAS,yBAAyB;AACvC,SAAM,wCAAwC,KAAK,QAAQ,OAAO;AAClE,UAAO,KAAK"}

package/build/index.js

@@ -41,7 +41,6 @@ exports.getListenAddress = require_address.getListenAddress;
 exports.getProxiesForPackage = require_uplinks.getProxiesForPackage;
 exports.getUserAgent = require_agent.getUserAgent;
 exports.hasProxyTo = require_uplinks.hasProxyTo;
-exports.isNodeVersionGreaterThan21 = require_config.isNodeVersionGreaterThan21;
 exports.normalisePackageAccess = require_package_access.normalisePackageAccess;
 exports.normalizeUserList = require_package_access.normalizeUserList;
 exports.parseAddress = require_address.parseAddress;

package/build/index.mjs

@@ -3,7 +3,7 @@ import { PACKAGE_ACCESS, ROLES, normalisePackageAccess, normalizeUserList } from
 import { TIME_EXPIRATION_1H, defaultSecurity } from "./security.mjs";
 import { TOKEN_VALID_LENGTH, generateRandomSecretKey } from "./token.mjs";
 import { DEFAULT_REGISTRY, DEFAULT_UPLINK, getProxiesForPackage, hasProxyTo, sanityCheckNames, sanityCheckUplinksProps, uplinkSanityCheck } from "./uplinks.mjs";
-import { Config, WEB_TITLE, defaultUserRateLimiting, isNodeVersionGreaterThan21 } from "./config.mjs";
+import { Config, WEB_TITLE, defaultUserRateLimiting } from "./config.mjs";
 import { fileExists, folderExists } from "./config-utils.mjs";
 import { findConfigFile, readDefaultConfig } from "./config-path.mjs";
 import { fromJStoYAML, getConfigParsed, parseConfigFile } from "./parse.mjs";
@@ -11,4 +11,4 @@ import { createAnonymousRemoteUser, createRemoteUser, defaultLoggedUserRoles, de
 import ConfigBuilder from "./builder.mjs";
 import { getDefaultConfig } from "./conf/index.mjs";
 import { getListenAddress, parseAddress } from "./address.mjs";
-export { Config, ConfigBuilder, DEFAULT_REGISTRY, DEFAULT_UPLINK, PACKAGE_ACCESS, ROLES, TIME_EXPIRATION_1H, TOKEN_VALID_LENGTH, WEB_TITLE, createAnonymousRemoteUser, createRemoteUser, defaultLoggedUserRoles, defaultNonLoggedUserRoles, defaultSecurity, defaultUserRateLimiting, fileExists, findConfigFile, folderExists, fromJStoYAML, generateRandomSecretKey, getConfigParsed, getDefaultConfig, getListenAddress, getProxiesForPackage, getUserAgent, hasProxyTo, isNodeVersionGreaterThan21, normalisePackageAccess, normalizeUserList, parseAddress, parseConfigFile, readDefaultConfig, sanityCheckNames, sanityCheckUplinksProps, uplinkSanityCheck };
+export { Config, ConfigBuilder, DEFAULT_REGISTRY, DEFAULT_UPLINK, PACKAGE_ACCESS, ROLES, TIME_EXPIRATION_1H, TOKEN_VALID_LENGTH, WEB_TITLE, createAnonymousRemoteUser, createRemoteUser, defaultLoggedUserRoles, defaultNonLoggedUserRoles, defaultSecurity, defaultUserRateLimiting, fileExists, findConfigFile, folderExists, fromJStoYAML, generateRandomSecretKey, getConfigParsed, getDefaultConfig, getListenAddress, getProxiesForPackage, getUserAgent, hasProxyTo, normalisePackageAccess, normalizeUserList, parseAddress, parseConfigFile, readDefaultConfig, sanityCheckNames, sanityCheckUplinksProps, uplinkSanityCheck };

package/build/security.js

@@ -5,10 +5,7 @@ var defaultSecurity = {
 		sign: { expiresIn: "1h" },
 		verify: {}
 	},
-	api: {
-		legacy: true,
-		migrateToSecureLegacySignature: true
-	}
+	api: { legacy: true }
 };
 //#endregion
 exports.TIME_EXPIRATION_1H = TIME_EXPIRATION_1H;

package/build/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","names":[],"sources":["../src/security.ts"],"sourcesContent":["import type { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n  migrateToSecureLegacySignature: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";AAGA,IAAa,qBAAqB;AAelC,IAAa,kBAA4B;CACvC,KAdyC;EACzC,MAAM,EAEJ,WAAA,MACD;EACD,QAAQ,EAAE;EACX;CASC,KAP2C;EAC3C,QAAQ;EACR,gCAAgC;EACjC;CAKA"}
+{"version":3,"file":"security.js","names":[],"sources":["../src/security.ts"],"sourcesContent":["import type { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";AAGA,IAAa,qBAAqB;AAclC,IAAa,kBAA4B;CACvC,KAbyC;EACzC,MAAM,EAEJ,WAAA,MACD;EACD,QAAQ,EAAE;EACX;CAQC,KAN2C,EAC3C,QAAQ,MACT;CAKA"}

package/build/security.mjs

@@ -5,10 +5,7 @@ var defaultSecurity = {
 		sign: { expiresIn: "1h" },
 		verify: {}
 	},
-	api: {
-		legacy: true,
-		migrateToSecureLegacySignature: true
-	}
+	api: { legacy: true }
 };
 //#endregion
 export { TIME_EXPIRATION_1H, defaultSecurity };

package/build/security.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"security.mjs","names":[],"sources":["../src/security.ts"],"sourcesContent":["import type { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n  migrateToSecureLegacySignature: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";AAGA,IAAa,qBAAqB;AAelC,IAAa,kBAA4B;CACvC,KAdyC;EACzC,MAAM,EAEJ,WAAA,MACD;EACD,QAAQ,EAAE;EACX;CASC,KAP2C;EAC3C,QAAQ;EACR,gCAAgC;EACjC;CAKA"}
+{"version":3,"file":"security.mjs","names":[],"sources":["../src/security.ts"],"sourcesContent":["import type { APITokenOptions, JWTOptions, Security } from '@verdaccio/types';\n\n// TODO: get this from core package\nexport const TIME_EXPIRATION_1H = '1h';\n\nconst defaultWebTokenOptions: JWTOptions = {\n  sign: {\n    // The expiration token for the website is 7 days\n    expiresIn: TIME_EXPIRATION_1H,\n  },\n  verify: {},\n};\n\nconst defaultApiTokenConf: APITokenOptions = {\n  legacy: true,\n};\n\nexport const defaultSecurity: Security = {\n  web: defaultWebTokenOptions,\n  api: defaultApiTokenConf,\n};\n"],"mappings":";AAGA,IAAa,qBAAqB;AAclC,IAAa,kBAA4B;CACvC,KAbyC;EACzC,MAAM,EAEJ,WAAA,MACD;EACD,QAAQ,EAAE;EACX;CAQC,KAN2C,EAC3C,QAAQ,MACT;CAKA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "9.0.0-next-9.5",
+  "version": "9.0.0-next-9.7",
   "description": "Verdaccio Configuration",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,13 +33,13 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@verdaccio/core": "9.0.0-next-9.5",
+    "@verdaccio/core": "9.0.0-next-9.7",
     "debug": "4.4.3",
     "js-yaml": "4.1.1",
     "lodash": "4.17.23"
   },
   "devDependencies": {
-    "@verdaccio/types": "14.0.0-next-9.2",
+    "@verdaccio/types": "14.0.0-next-9.4",
     "vitest": "4.1.0"
   },
   "funding": {