@verdaccio/core 6.0.0-6-next.47 → 6.0.0-6-next.49

package/build/string-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"string-utils.js","names":["getByQualityPriorityValue","headerValue","split","length","qList","header","reduce","acc","item","accept","q","query","push","trim","sort","a","b"],"sources":["../src/string-utils.ts"],"sourcesContent":["/**\n * Quality values, or q-values and q-factors, are used to describe the order\n * of priority of values in a comma-separated list.\n * It is a special syntax allowed in some HTTP headers and in HTML.\n * https://developer.mozilla.org/en-US/docs/Glossary/Quality_values\n * @param headerValue\n */\nexport function getByQualityPriorityValue(headerValue: string | undefined | null): string {\n  if (typeof headerValue !== 'string') {\n    return '';\n  }\n\n  const split = headerValue.split(',');\n\n  if (split.length <= 1) {\n    const qList = split[0].split(';');\n    return qList[0];\n  }\n\n  let [header] = split\n    .reduce((acc, item: string) => {\n      const qList = item.split(';');\n      if (qList.length > 1) {\n        const [accept, q] = qList;\n        const [, query] = q.split('=');\n        acc.push([accept.trim(), query ? query : 0]);\n      } else {\n        acc.push([qList[0], 0]);\n      }\n      return acc;\n    }, [] as any)\n    .sort(function (a: number[], b: number[]) {\n      return b[1] - a[1];\n    });\n  return header[0];\n}\n"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,yBAAT,CAAmCC,WAAnC,EAAmF;EACxF,IAAI,OAAOA,WAAP,KAAuB,QAA3B,EAAqC;IACnC,OAAO,EAAP;EACD;;EAED,MAAMC,KAAK,GAAGD,WAAW,CAACC,KAAZ,CAAkB,GAAlB,CAAd;;EAEA,IAAIA,KAAK,CAACC,MAAN,IAAgB,CAApB,EAAuB;IACrB,MAAMC,KAAK,GAAGF,KAAK,CAAC,CAAD,CAAL,CAASA,KAAT,CAAe,GAAf,CAAd;IACA,OAAOE,KAAK,CAAC,CAAD,CAAZ;EACD;;EAED,IAAI,CAACC,MAAD,IAAWH,KAAK,CACjBI,MADY,CACL,CAACC,GAAD,EAAMC,IAAN,KAAuB;IAC7B,MAAMJ,KAAK,GAAGI,IAAI,CAACN,KAAL,CAAW,GAAX,CAAd;;IACA,IAAIE,KAAK,CAACD,MAAN,GAAe,CAAnB,EAAsB;MACpB,MAAM,CAACM,MAAD,EAASC,CAAT,IAAcN,KAApB;MACA,MAAM,GAAGO,KAAH,IAAYD,CAAC,CAACR,KAAF,CAAQ,GAAR,CAAlB;MACAK,GAAG,CAACK,IAAJ,CAAS,CAACH,MAAM,CAACI,IAAP,EAAD,EAAgBF,KAAK,GAAGA,KAAH,GAAW,CAAhC,CAAT;IACD,CAJD,MAIO;MACLJ,GAAG,CAACK,IAAJ,CAAS,CAACR,KAAK,CAAC,CAAD,CAAN,EAAW,CAAX,CAAT;IACD;;IACD,OAAOG,GAAP;EACD,CAXY,EAWV,EAXU,EAYZO,IAZY,CAYP,UAAUC,CAAV,EAAuBC,CAAvB,EAAoC;IACxC,OAAOA,CAAC,CAAC,CAAD,CAAD,GAAOD,CAAC,CAAC,CAAD,CAAf;EACD,CAdY,CAAf;EAeA,OAAOV,MAAM,CAAC,CAAD,CAAb;AACD"}

package/build/validation-utils.d.ts

@@ -27,3 +27,4 @@ export declare function normalizeMetadata(manifest: Manifest, name: string): Man
  * @return {Boolean}
  */
 export declare function isObject(obj: any): boolean;
+export declare function validatePassword(password: string, validation?: RegExp): boolean;

package/build/validation-utils.js

@@ -8,6 +8,7 @@ exports.isPackageNameScoped = isPackageNameScoped;
 exports.normalizeMetadata = normalizeMetadata;
 exports.validateName = validateName;
 exports.validatePackage = validatePackage;
+exports.validatePassword = validatePassword;
 Object.defineProperty(exports, "validatePublishSingleVersion", {
   enumerable: true,
   get: function () {
@@ -123,4 +124,8 @@ function isObject(obj) {
 
   return (typeof obj === 'object' || typeof obj.prototype === 'undefined') && Array.isArray(obj) === false;
 }
+
+function validatePassword(password, validation = _constants.DEFAULT_PASSWORD_VALIDATION) {
+  return typeof password === 'string' && validation instanceof RegExp ? password.match(validation) !== null : false;
+}
 //# sourceMappingURL=validation-utils.js.map

package/build/validation-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation-utils.js","names":["isPackageNameScoped","name","startsWith","validateName","normalizedName","toLowerCase","isScoped","scopedName","split","match","includes","validatePackage","nameList","length","slice","normalizeMetadata","manifest","assert","strictEqual","_manifest","isObject","DIST_TAGS","obj","prototype","Array","isArray"],"sources":["../src/validation-utils.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { Manifest } from '@verdaccio/types';\n\nimport { DIST_TAGS } from './constants';\n\nexport { validatePublishSingleVersion } from './schemes/publish-manifest';\n\nexport function isPackageNameScoped(name: string): boolean {\n  return name.startsWith('@');\n}\n\n/**\n * From normalize-package-data/lib/fixer.js\n * @param {*} name  the package name\n * @return {Boolean} whether is valid or not\n */\nexport function validateName(name: string): boolean {\n  if (typeof name !== 'string') {\n    return false;\n  }\n\n  let normalizedName: string = name.toLowerCase();\n\n  const isScoped: boolean = isPackageNameScoped(name);\n  const scopedName = name.split('/', 2)[1];\n\n  if (isScoped && typeof scopedName !== 'undefined') {\n    normalizedName = scopedName.toLowerCase();\n  }\n\n  /**\n   * Some context about the first regex\n   * - npm used to have a different tarball naming system.\n   * eg: http://registry.npmjs.com/thirty-two\n   * https://registry.npmjs.org/thirty-two/-/thirty-two@0.0.1.tgz\n   * The file name thirty-two@0.0.1.tgz, the version and the pkg name was separated by an at (@)\n   * while nowadays the naming system is based in dashes\n   * https://registry.npmjs.org/verdaccio/-/verdaccio-1.4.0.tgz\n   *\n   * more info here: https://github.com/rlidwka/sinopia/issues/75\n   */\n  return !(\n    !normalizedName.match(/^[-a-zA-Z0-9_.!~*'()@]+$/) ||\n    normalizedName.startsWith('.') || // \".bin\", etc.\n    ['node_modules', '__proto__', 'favicon.ico'].includes(normalizedName)\n  );\n}\n\n/**\n * Validate a package.\n * @return {Boolean} whether the package is valid or not\n */\nexport function validatePackage(name: string): boolean {\n  const nameList = name.split('/', 2);\n  if (nameList.length === 1) {\n    // normal package\n    return validateName(nameList[0]);\n  }\n  // scoped package\n  return nameList[0][0] === '@' && validateName(nameList[0].slice(1)) && validateName(nameList[1]);\n}\n\n/**\n * Validate the package metadata, add additional properties whether are missing within\n * the metadata properties.\n * @param {*} manifest\n * @param {*} name\n * @return {Object} the object with additional properties as dist-tags ad versions\n * FUTURE: rename to normalizeMetadata\n */\nexport function normalizeMetadata(manifest: Manifest, name: string): Manifest {\n  assert.strictEqual(manifest.name, name);\n  const _manifest = { ...manifest };\n\n  if (!isObject(manifest[DIST_TAGS])) {\n    _manifest[DIST_TAGS] = {};\n  }\n\n  // This may not be nee dit\n  if (!isObject(manifest['versions'])) {\n    _manifest['versions'] = {};\n  }\n\n  if (!isObject(manifest['time'])) {\n    _manifest['time'] = {};\n  }\n\n  return _manifest;\n}\n\n/**\n * Check whether an element is an Object\n * @param {*} obj the element\n * @return {Boolean}\n */\nexport function isObject(obj: any): boolean {\n  if (obj === null || typeof obj === 'undefined' || typeof obj === 'string') {\n    return false;\n  }\n\n  return (\n    (typeof obj === 'object' || typeof obj.prototype === 'undefined') &&\n    Array.isArray(obj) === false\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA;;AAIA;;AAEA;;;;AAEO,SAASA,mBAAT,CAA6BC,IAA7B,EAAoD;EACzD,OAAOA,IAAI,CAACC,UAAL,CAAgB,GAAhB,CAAP;AACD;AAED;AACA;AACA;AACA;AACA;;;AACO,SAASC,YAAT,CAAsBF,IAAtB,EAA6C;EAClD,IAAI,OAAOA,IAAP,KAAgB,QAApB,EAA8B;IAC5B,OAAO,KAAP;EACD;;EAED,IAAIG,cAAsB,GAAGH,IAAI,CAACI,WAAL,EAA7B;EAEA,MAAMC,QAAiB,GAAGN,mBAAmB,CAACC,IAAD,CAA7C;EACA,MAAMM,UAAU,GAAGN,IAAI,CAACO,KAAL,CAAW,GAAX,EAAgB,CAAhB,EAAmB,CAAnB,CAAnB;;EAEA,IAAIF,QAAQ,IAAI,OAAOC,UAAP,KAAsB,WAAtC,EAAmD;IACjDH,cAAc,GAAGG,UAAU,CAACF,WAAX,EAAjB;EACD;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;EACE,OAAO,EACL,CAACD,cAAc,CAACK,KAAf,CAAqB,0BAArB,CAAD,IACAL,cAAc,CAACF,UAAf,CAA0B,GAA1B,CADA,IACkC;EAClC,CAAC,cAAD,EAAiB,WAAjB,EAA8B,aAA9B,EAA6CQ,QAA7C,CAAsDN,cAAtD,CAHK,CAAP;AAKD;AAED;AACA;AACA;AACA;;;AACO,SAASO,eAAT,CAAyBV,IAAzB,EAAgD;EACrD,MAAMW,QAAQ,GAAGX,IAAI,CAACO,KAAL,CAAW,GAAX,EAAgB,CAAhB,CAAjB;;EACA,IAAII,QAAQ,CAACC,MAAT,KAAoB,CAAxB,EAA2B;IACzB;IACA,OAAOV,YAAY,CAACS,QAAQ,CAAC,CAAD,CAAT,CAAnB;EACD,CALoD,CAMrD;;;EACA,OAAOA,QAAQ,CAAC,CAAD,CAAR,CAAY,CAAZ,MAAmB,GAAnB,IAA0BT,YAAY,CAACS,QAAQ,CAAC,CAAD,CAAR,CAAYE,KAAZ,CAAkB,CAAlB,CAAD,CAAtC,IAAgEX,YAAY,CAACS,QAAQ,CAAC,CAAD,CAAT,CAAnF;AACD;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AACO,SAASG,iBAAT,CAA2BC,QAA3B,EAA+Cf,IAA/C,EAAuE;EAC5EgB,eAAA,CAAOC,WAAP,CAAmBF,QAAQ,CAACf,IAA5B,EAAkCA,IAAlC;;EACA,MAAMkB,SAAS,GAAG,EAAE,GAAGH;EAAL,CAAlB;;EAEA,IAAI,CAACI,QAAQ,CAACJ,QAAQ,CAACK,oBAAD,CAAT,CAAb,EAAoC;IAClCF,SAAS,CAACE,oBAAD,CAAT,GAAuB,EAAvB;EACD,CAN2E,CAQ5E;;;EACA,IAAI,CAACD,QAAQ,CAACJ,QAAQ,CAAC,UAAD,CAAT,CAAb,EAAqC;IACnCG,SAAS,CAAC,UAAD,CAAT,GAAwB,EAAxB;EACD;;EAED,IAAI,CAACC,QAAQ,CAACJ,QAAQ,CAAC,MAAD,CAAT,CAAb,EAAiC;IAC/BG,SAAS,CAAC,MAAD,CAAT,GAAoB,EAApB;EACD;;EAED,OAAOA,SAAP;AACD;AAED;AACA;AACA;AACA;AACA;;;AACO,SAASC,QAAT,CAAkBE,GAAlB,EAAqC;EAC1C,IAAIA,GAAG,KAAK,IAAR,IAAgB,OAAOA,GAAP,KAAe,WAA/B,IAA8C,OAAOA,GAAP,KAAe,QAAjE,EAA2E;IACzE,OAAO,KAAP;EACD;;EAED,OACE,CAAC,OAAOA,GAAP,KAAe,QAAf,IAA2B,OAAOA,GAAG,CAACC,SAAX,KAAyB,WAArD,KACAC,KAAK,CAACC,OAAN,CAAcH,GAAd,MAAuB,KAFzB;AAID"}
+{"version":3,"file":"validation-utils.js","names":["isPackageNameScoped","name","startsWith","validateName","normalizedName","toLowerCase","isScoped","scopedName","split","match","includes","validatePackage","nameList","length","slice","normalizeMetadata","manifest","assert","strictEqual","_manifest","isObject","DIST_TAGS","obj","prototype","Array","isArray","validatePassword","password","validation","DEFAULT_PASSWORD_VALIDATION","RegExp"],"sources":["../src/validation-utils.ts"],"sourcesContent":["import assert from 'assert';\n\nimport { Manifest } from '@verdaccio/types';\n\nimport { DEFAULT_PASSWORD_VALIDATION, DIST_TAGS } from './constants';\n\nexport { validatePublishSingleVersion } from './schemes/publish-manifest';\n\nexport function isPackageNameScoped(name: string): boolean {\n  return name.startsWith('@');\n}\n\n/**\n * From normalize-package-data/lib/fixer.js\n * @param {*} name  the package name\n * @return {Boolean} whether is valid or not\n */\nexport function validateName(name: string): boolean {\n  if (typeof name !== 'string') {\n    return false;\n  }\n\n  let normalizedName: string = name.toLowerCase();\n\n  const isScoped: boolean = isPackageNameScoped(name);\n  const scopedName = name.split('/', 2)[1];\n\n  if (isScoped && typeof scopedName !== 'undefined') {\n    normalizedName = scopedName.toLowerCase();\n  }\n\n  /**\n   * Some context about the first regex\n   * - npm used to have a different tarball naming system.\n   * eg: http://registry.npmjs.com/thirty-two\n   * https://registry.npmjs.org/thirty-two/-/thirty-two@0.0.1.tgz\n   * The file name thirty-two@0.0.1.tgz, the version and the pkg name was separated by an at (@)\n   * while nowadays the naming system is based in dashes\n   * https://registry.npmjs.org/verdaccio/-/verdaccio-1.4.0.tgz\n   *\n   * more info here: https://github.com/rlidwka/sinopia/issues/75\n   */\n  return !(\n    !normalizedName.match(/^[-a-zA-Z0-9_.!~*'()@]+$/) ||\n    normalizedName.startsWith('.') || // \".bin\", etc.\n    ['node_modules', '__proto__', 'favicon.ico'].includes(normalizedName)\n  );\n}\n\n/**\n * Validate a package.\n * @return {Boolean} whether the package is valid or not\n */\nexport function validatePackage(name: string): boolean {\n  const nameList = name.split('/', 2);\n  if (nameList.length === 1) {\n    // normal package\n    return validateName(nameList[0]);\n  }\n  // scoped package\n  return nameList[0][0] === '@' && validateName(nameList[0].slice(1)) && validateName(nameList[1]);\n}\n\n/**\n * Validate the package metadata, add additional properties whether are missing within\n * the metadata properties.\n * @param {*} manifest\n * @param {*} name\n * @return {Object} the object with additional properties as dist-tags ad versions\n * FUTURE: rename to normalizeMetadata\n */\nexport function normalizeMetadata(manifest: Manifest, name: string): Manifest {\n  assert.strictEqual(manifest.name, name);\n  const _manifest = { ...manifest };\n\n  if (!isObject(manifest[DIST_TAGS])) {\n    _manifest[DIST_TAGS] = {};\n  }\n\n  // This may not be nee dit\n  if (!isObject(manifest['versions'])) {\n    _manifest['versions'] = {};\n  }\n\n  if (!isObject(manifest['time'])) {\n    _manifest['time'] = {};\n  }\n\n  return _manifest;\n}\n\n/**\n * Check whether an element is an Object\n * @param {*} obj the element\n * @return {Boolean}\n */\nexport function isObject(obj: any): boolean {\n  if (obj === null || typeof obj === 'undefined' || typeof obj === 'string') {\n    return false;\n  }\n\n  return (\n    (typeof obj === 'object' || typeof obj.prototype === 'undefined') &&\n    Array.isArray(obj) === false\n  );\n}\n\nexport function validatePassword(\n  password: string,\n  validation: RegExp = DEFAULT_PASSWORD_VALIDATION\n): boolean {\n  return typeof password === 'string' && validation instanceof RegExp\n    ? password.match(validation) !== null\n    : false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAAA;;AAIA;;AAEA;;;;AAEO,SAASA,mBAAT,CAA6BC,IAA7B,EAAoD;EACzD,OAAOA,IAAI,CAACC,UAAL,CAAgB,GAAhB,CAAP;AACD;AAED;AACA;AACA;AACA;AACA;;;AACO,SAASC,YAAT,CAAsBF,IAAtB,EAA6C;EAClD,IAAI,OAAOA,IAAP,KAAgB,QAApB,EAA8B;IAC5B,OAAO,KAAP;EACD;;EAED,IAAIG,cAAsB,GAAGH,IAAI,CAACI,WAAL,EAA7B;EAEA,MAAMC,QAAiB,GAAGN,mBAAmB,CAACC,IAAD,CAA7C;EACA,MAAMM,UAAU,GAAGN,IAAI,CAACO,KAAL,CAAW,GAAX,EAAgB,CAAhB,EAAmB,CAAnB,CAAnB;;EAEA,IAAIF,QAAQ,IAAI,OAAOC,UAAP,KAAsB,WAAtC,EAAmD;IACjDH,cAAc,GAAGG,UAAU,CAACF,WAAX,EAAjB;EACD;EAED;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;EACE,OAAO,EACL,CAACD,cAAc,CAACK,KAAf,CAAqB,0BAArB,CAAD,IACAL,cAAc,CAACF,UAAf,CAA0B,GAA1B,CADA,IACkC;EAClC,CAAC,cAAD,EAAiB,WAAjB,EAA8B,aAA9B,EAA6CQ,QAA7C,CAAsDN,cAAtD,CAHK,CAAP;AAKD;AAED;AACA;AACA;AACA;;;AACO,SAASO,eAAT,CAAyBV,IAAzB,EAAgD;EACrD,MAAMW,QAAQ,GAAGX,IAAI,CAACO,KAAL,CAAW,GAAX,EAAgB,CAAhB,CAAjB;;EACA,IAAII,QAAQ,CAACC,MAAT,KAAoB,CAAxB,EAA2B;IACzB;IACA,OAAOV,YAAY,CAACS,QAAQ,CAAC,CAAD,CAAT,CAAnB;EACD,CALoD,CAMrD;;;EACA,OAAOA,QAAQ,CAAC,CAAD,CAAR,CAAY,CAAZ,MAAmB,GAAnB,IAA0BT,YAAY,CAACS,QAAQ,CAAC,CAAD,CAAR,CAAYE,KAAZ,CAAkB,CAAlB,CAAD,CAAtC,IAAgEX,YAAY,CAACS,QAAQ,CAAC,CAAD,CAAT,CAAnF;AACD;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;;AACO,SAASG,iBAAT,CAA2BC,QAA3B,EAA+Cf,IAA/C,EAAuE;EAC5EgB,eAAA,CAAOC,WAAP,CAAmBF,QAAQ,CAACf,IAA5B,EAAkCA,IAAlC;;EACA,MAAMkB,SAAS,GAAG,EAAE,GAAGH;EAAL,CAAlB;;EAEA,IAAI,CAACI,QAAQ,CAACJ,QAAQ,CAACK,oBAAD,CAAT,CAAb,EAAoC;IAClCF,SAAS,CAACE,oBAAD,CAAT,GAAuB,EAAvB;EACD,CAN2E,CAQ5E;;;EACA,IAAI,CAACD,QAAQ,CAACJ,QAAQ,CAAC,UAAD,CAAT,CAAb,EAAqC;IACnCG,SAAS,CAAC,UAAD,CAAT,GAAwB,EAAxB;EACD;;EAED,IAAI,CAACC,QAAQ,CAACJ,QAAQ,CAAC,MAAD,CAAT,CAAb,EAAiC;IAC/BG,SAAS,CAAC,MAAD,CAAT,GAAoB,EAApB;EACD;;EAED,OAAOA,SAAP;AACD;AAED;AACA;AACA;AACA;AACA;;;AACO,SAASC,QAAT,CAAkBE,GAAlB,EAAqC;EAC1C,IAAIA,GAAG,KAAK,IAAR,IAAgB,OAAOA,GAAP,KAAe,WAA/B,IAA8C,OAAOA,GAAP,KAAe,QAAjE,EAA2E;IACzE,OAAO,KAAP;EACD;;EAED,OACE,CAAC,OAAOA,GAAP,KAAe,QAAf,IAA2B,OAAOA,GAAG,CAACC,SAAX,KAAyB,WAArD,KACAC,KAAK,CAACC,OAAN,CAAcH,GAAd,MAAuB,KAFzB;AAID;;AAEM,SAASI,gBAAT,CACLC,QADK,EAELC,UAAkB,GAAGC,sCAFhB,EAGI;EACT,OAAO,OAAOF,QAAP,KAAoB,QAApB,IAAgCC,UAAU,YAAYE,MAAtD,GACHH,QAAQ,CAAClB,KAAT,CAAemB,UAAf,MAA+B,IAD5B,GAEH,KAFJ;AAGD"}

package/build/warning-utils.d.ts

@@ -5,4 +5,4 @@ export declare enum Codes {
     VERWAR004 = "VERWAR004",
     VERDEP003 = "VERDEP003"
 }
-export declare function emit(code: any, a?: string, b?: string, c?: string): void;
+export declare function emit(code: string, a?: string, b?: string, c?: string): void;

package/build/warning-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"warning-utils.js","names":["warningInstance","warning","verdaccioWarning","verdaccioDeprecation","Codes","create","VERWAR002","VERWAR001","VERWAR003","VERWAR004","VERDEP003","emit","code","a","b","c"],"sources":["../src/warning-utils.ts"],"sourcesContent":["import warning from 'process-warning';\n\nconst warningInstance = warning();\nconst verdaccioWarning = 'VerdaccioWarning';\nconst verdaccioDeprecation = 'VerdaccioDeprecation';\n\nexport enum Codes {\n  VERWAR001 = 'VERWAR001',\n  VERWAR002 = 'VERWAR002',\n  VERWAR003 = 'VERWAR003',\n  VERWAR004 = 'VERWAR004',\n  // deprecation warnings\n  VERDEP003 = 'VERDEP003',\n}\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR002,\n  `The property config \"logs\" property is longer supported, rename to \"log\" and use object instead`\n);\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR001,\n  `Verdaccio doesn't need superuser privileges. don't run it under root`\n);\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR003,\n  'rotating-file type is not longer supported, consider use [logrotate] instead'\n);\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR004,\n  `invalid address - %s, we expect a port (e.g. \"4873\"), \nhost:port (e.g. \"localhost:4873\") or full url '(e.g. \"http://localhost:4873/\")\nhttps://verdaccio.org/docs/en/configuration#listen-port`\n);\n\nwarningInstance.create(\n  verdaccioDeprecation,\n  Codes.VERDEP003,\n  'multiple addresses will be deprecated in the next major, only use one'\n);\n\nexport function emit(code, a?: string, b?: string, c?: string) {\n  warningInstance.emit(code, a, b, c);\n}\n"],"mappings":";;;;;;;;AAAA;;;;AAEA,MAAMA,eAAe,GAAG,IAAAC,uBAAA,GAAxB;AACA,MAAMC,gBAAgB,GAAG,kBAAzB;AACA,MAAMC,oBAAoB,GAAG,sBAA7B;IAEYC,K;;;WAAAA,K;EAAAA,K;EAAAA,K;EAAAA,K;EAAAA,K;EAAAA,K;GAAAA,K,qBAAAA,K;;AASZJ,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACE,SAFR,EAGG,iGAHH;AAMAN,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACG,SAFR,EAGG,sEAHH;AAMAP,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACI,SAFR,EAGE,8EAHF;AAMAR,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACK,SAFR,EAGG;AACH;AACA,wDALA;AAQAT,eAAe,CAACK,MAAhB,CACEF,oBADF,EAEEC,KAAK,CAACM,SAFR,EAGE,uEAHF;;AAMO,SAASC,IAAT,CAAcC,IAAd,EAAoBC,CAApB,EAAgCC,CAAhC,EAA4CC,CAA5C,EAAwD;EAC7Df,eAAe,CAACW,IAAhB,CAAqBC,IAArB,EAA2BC,CAA3B,EAA8BC,CAA9B,EAAiCC,CAAjC;AACD"}
+{"version":3,"file":"warning-utils.js","names":["warningInstance","warning","verdaccioWarning","verdaccioDeprecation","Codes","create","VERWAR002","VERWAR001","VERWAR003","VERWAR004","VERDEP003","emit","code","a","b","c"],"sources":["../src/warning-utils.ts"],"sourcesContent":["import warning from 'process-warning';\n\nconst warningInstance = warning();\nconst verdaccioWarning = 'VerdaccioWarning';\nconst verdaccioDeprecation = 'VerdaccioDeprecation';\n\nexport enum Codes {\n  VERWAR001 = 'VERWAR001',\n  VERWAR002 = 'VERWAR002',\n  VERWAR003 = 'VERWAR003',\n  VERWAR004 = 'VERWAR004',\n  // deprecation warnings\n  VERDEP003 = 'VERDEP003',\n}\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR002,\n  `The property config \"logs\" property is longer supported, rename to \"log\" and use object instead`\n);\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR001,\n  `Verdaccio doesn't need superuser privileges. don't run it under root`\n);\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR003,\n  'rotating-file type is not longer supported, consider use [logrotate] instead'\n);\n\nwarningInstance.create(\n  verdaccioWarning,\n  Codes.VERWAR004,\n  `invalid address - %s, we expect a port (e.g. \"4873\"), \nhost:port (e.g. \"localhost:4873\") or full url '(e.g. \"http://localhost:4873/\")\nhttps://verdaccio.org/docs/en/configuration#listen-port`\n);\n\nwarningInstance.create(\n  verdaccioDeprecation,\n  Codes.VERDEP003,\n  'multiple addresses will be deprecated in the next major, only use one'\n);\n\nexport function emit(code: string, a?: string, b?: string, c?: string) {\n  warningInstance.emit(code, a, b, c);\n}\n"],"mappings":";;;;;;;;AAAA;;;;AAEA,MAAMA,eAAe,GAAG,IAAAC,uBAAA,GAAxB;AACA,MAAMC,gBAAgB,GAAG,kBAAzB;AACA,MAAMC,oBAAoB,GAAG,sBAA7B;IAEYC,K;;;WAAAA,K;EAAAA,K;EAAAA,K;EAAAA,K;EAAAA,K;EAAAA,K;GAAAA,K,qBAAAA,K;;AASZJ,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACE,SAFR,EAGG,iGAHH;AAMAN,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACG,SAFR,EAGG,sEAHH;AAMAP,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACI,SAFR,EAGE,8EAHF;AAMAR,eAAe,CAACK,MAAhB,CACEH,gBADF,EAEEE,KAAK,CAACK,SAFR,EAGG;AACH;AACA,wDALA;AAQAT,eAAe,CAACK,MAAhB,CACEF,oBADF,EAEEC,KAAK,CAACM,SAFR,EAGE,uEAHF;;AAMO,SAASC,IAAT,CAAcC,IAAd,EAA4BC,CAA5B,EAAwCC,CAAxC,EAAoDC,CAApD,EAAgE;EACrEf,eAAe,CAACW,IAAhB,CAAqBC,IAArB,EAA2BC,CAA3B,EAA8BC,CAA9B,EAAiCC,CAAjC;AACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/core",
-  "version": "6.0.0-6-next.47",
+  "version": "6.0.0-6-next.49",
   "description": "core utilities",
   "keywords": [
     "private",
@@ -39,11 +39,13 @@
     "semver": "7.3.7",
     "ajv": "8.11.0",
     "process-warning": "1.0.0",
-    "core-js": "3.25.0"
+    "core-js": "3.25.3"
   },
   "devDependencies": {
     "lodash": "4.17.21",
-    "@verdaccio/types": "11.0.0-6-next.16"
+    "typedoc": "0.23.15",
+    "typedoc-plugin-missing-exports": "latest",
+    "@verdaccio/types": "11.0.0-6-next.17"
   },
   "funding": {
     "type": "opencollective",
@@ -53,6 +55,7 @@
     "clean": "rimraf ./build",
     "test": "jest",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
+    "build:docs": "typedoc --options ./typedoc.json --tsconfig tsconfig.build.json",
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
     "watch": "pnpm build:js -- --watch",

package/src/constants.ts

@@ -1,6 +1,6 @@
 import httpCodes from 'http-status-codes';
 
-export const DEFAULT_MIN_LIMIT_PASSWORD = 3;
+export const DEFAULT_PASSWORD_VALIDATION = /.{3}$/;
 export const TIME_EXPIRATION_24H = '24h';
 export const TIME_EXPIRATION_7D = '7d';
 export const DIST_TAGS = 'dist-tags';
@@ -46,6 +46,7 @@ export const HEADERS = {
   NONE_MATCH: 'If-None-Match',
   ETAG: 'ETag',
   JSON_CHARSET: 'application/json; charset=utf-8',
+  JSON_INSTALL_CHARSET: 'application/vnd.npm.install-v1+json; charset=utf-8',
   OCTET_STREAM: 'application/octet-stream; charset=utf-8',
   TEXT_CHARSET: 'text/plain; charset=utf-8',
   WWW_AUTH: 'WWW-Authenticate',

package/src/error-utils.ts

@@ -1,11 +1,9 @@
 import createError, { HttpError } from 'http-errors';
 
-import { DEFAULT_MIN_LIMIT_PASSWORD, HTTP_STATUS } from './constants';
+import { HTTP_STATUS } from './constants';
 
 export const API_ERROR = {
-  PASSWORD_SHORT: (passLength = DEFAULT_MIN_LIMIT_PASSWORD): string =>
-    `The provided password is too short. Please pick a password longer than ` +
-    `${passLength} characters.`,
+  PASSWORD_SHORT: `The provided password does not pass the validation`,
   MUST_BE_LOGGED: 'You must be logged in to publish packages.',
   PLUGIN_ERROR: 'bug in the auth plugin system',
   CONFIG_BAD_FORMAT: 'config file must be an object',

package/src/index.ts

@@ -5,6 +5,7 @@ import * as pkgUtils from './pkg-utils';
 import * as pluginUtils from './plugin-utils';
 import * as searchUtils from './search-utils';
 import * as streamUtils from './stream-utils';
+import * as stringUtils from './string-utils';
 import * as validatioUtils from './validation-utils';
 import * as warningUtils from './warning-utils';
 
@@ -19,7 +20,7 @@ export {
   CHARACTER_ENCODING,
   HEADER_TYPE,
   LATEST,
-  DEFAULT_MIN_LIMIT_PASSWORD,
+  DEFAULT_PASSWORD_VALIDATION,
   DEFAULT_USER,
   USERS,
 } from './constants';
@@ -33,6 +34,7 @@ export {
   // TODO: remove this typo
   validatioUtils,
   validationUtils,
+  stringUtils,
   constants,
   pluginUtils,
   warningUtils,

package/src/plugin-utils.ts

@@ -1,24 +1,174 @@
-import { Config, IPackageStorage, Token, TokenFilter } from '@verdaccio/types';
+import { Express, RequestHandler } from 'express';
+import { Readable, Writable } from 'stream';
 
-import { searchUtils } from '.';
+import {
+  AllowAccess,
+  Callback,
+  Config,
+  Logger,
+  Manifest,
+  PackageAccess,
+  RemoteUser,
+  Token,
+  TokenFilter,
+} from '@verdaccio/types';
 
-interface IPlugin {
-  version?: string;
-  // In case a plugin needs to be cleaned up/removed
-  close?(): void;
+import { VerdaccioError, searchUtils } from '.';
+
+export interface AuthPluginPackage {
+  packageName: string;
+  packageVersion?: string;
+  tag?: string;
+}
+export interface PluginOptions {
+  config: Config;
+  logger: Logger;
+}
+
+/**
+ * The base plugin class, set of utilities for developing
+ * plugins.
+ * @alpha
+ * */
+export class Plugin<PluginConfig> {
+  static version = 1;
+  public readonly version: number;
+  public readonly config: PluginConfig | unknown;
+  public readonly options: PluginOptions;
+  public constructor(config: PluginConfig, options: PluginOptions) {
+    this.version = Plugin.version;
+    this.config = config;
+    this.options = options;
+  }
+
+  public getVersion() {
+    return this.version;
+  }
+}
+export interface StorageHandler {
+  logger: Logger;
+  deletePackage(fileName: string): Promise<void>;
+  removePackage(): Promise<void>;
+  //  next packages migration (this list is meant to replace the callback parent functions)
+  updatePackage(
+    packageName: string,
+    handleUpdate: (manifest: Manifest) => Promise<Manifest>
+  ): Promise<Manifest>;
+  readPackage(name: string): Promise<Manifest>;
+  savePackage(pkgName: string, value: Manifest): Promise<void>;
+  readTarball(pkgName: string, { signal }: { signal: AbortSignal }): Promise<Readable>;
+  createPackage(name: string, manifest: Manifest): Promise<void>;
+  writeTarball(tarballName: string, { signal }: { signal: AbortSignal }): Promise<Writable>;
+  // verify if tarball exist in the storage
+  hasTarball(fileName: string): Promise<boolean>;
+  // verify if package exist in the storage
+  hasPackage(): Promise<boolean>;
 }
 
-export interface IPluginStorage<T> extends IPlugin {
-  config: T & Config;
+export interface Storage<PluginConfig> extends Plugin<PluginConfig> {
   add(name: string): Promise<void>;
   remove(name: string): Promise<void>;
   get(): Promise<any>;
   init(): Promise<void>;
   getSecret(): Promise<string>;
   setSecret(secret: string): Promise<any>;
-  getPackageStorage(packageInfo: string): IPackageStorage;
+  getPackageStorage(packageInfo: string): StorageHandler;
   search(query: searchUtils.SearchQuery): Promise<searchUtils.SearchItem[]>;
   saveToken(token: Token): Promise<any>;
   deleteToken(user: string, tokenKey: string): Promise<any>;
   readTokens(filter: TokenFilter): Promise<Token[]>;
 }
+
+/**
+ * This function allow add additional middleware to the application.
+ *
+ *  ```ts
+ *  import express, { Request, Response } from 'express';
+ * 
+ *  class Middleware extends Plugin {
+ *    // instances of auth and storage are injected
+ *    register_middlewares(app, auth, storage) {
+ *      const router = express.Router();
+ *      router.post('/my-endpoint', (req: Request, res: Response): void => {
+        res.status(200).end();
+      });
+ *    }
+ *  }
+ * 
+ *  
+ *  const [plugin] = await asyncLoadPlugin(...);
+ *  plugin.register_middlewares(app, auth, storage);
+ *  ```
+ */
+export interface ExpressMiddleware<PluginConfig, Storage, Auth> extends Plugin<PluginConfig> {
+  register_middlewares(app: Express, auth: Auth, storage: Storage): void;
+}
+
+/**
+ * dasdsa
+ */
+export type AuthCallback = (error: VerdaccioError | null, groups?: string[] | false) => void;
+
+export type AuthAccessCallback = (error: VerdaccioError | null, access?: boolean) => void;
+export type AuthUserCallback = (error: VerdaccioError | null, access?: boolean | string) => void;
+export type AuthChangePasswordCallback = (error: VerdaccioError | null, access?: boolean) => void;
+export type AccessCallback = (error: VerdaccioError | null, ok?: boolean) => void;
+export interface Auth<T> extends Plugin<T> {
+  /**
+   * Handles the authenticated method.
+   * ```ts
+   *  class Auth {
+      public authenticate(user: string, password: string, done: AuthCallback): void {
+        if (!password) {
+          return done(errorUtils.getUnauthorized(API_ERROR.BAD_USERNAME_PASSWORD));
+        }
+        // always return an array of users
+        return done(null, [user]);      
+   *  }
+   * ```
+   */
+  authenticate(user: string, password: string, cb: AuthCallback): void;
+  /**
+   * Handles the authenticated method.
+   * ```ts
+   *  class Auth {
+      public adduser(user: string, password: string, done: AuthCallback): void {
+        if (!password) {
+          return done(errorUtils.getUnauthorized(API_ERROR.BAD_USERNAME_PASSWORD));
+        }
+        // return boolean
+        return done(null, true);      
+   *  }
+   * ```
+   */
+  adduser?(user: string, password: string, cb: AuthUserCallback): void;
+  changePassword?(
+    user: string,
+    password: string,
+    newPassword: string,
+    cb: AuthChangePasswordCallback
+  ): void;
+  allow_publish?(user: RemoteUser, pkg: T & PackageAccess, cb: AuthAccessCallback): void;
+  allow_publish?(user: RemoteUser, pkg: AllowAccess & PackageAccess, cb: AuthAccessCallback): void;
+  allow_access?(user: RemoteUser, pkg: T & PackageAccess, cb: AccessCallback): void;
+  allow_access?(user: RemoteUser, pkg: AllowAccess & PackageAccess, cb: AccessCallback): void;
+  allow_unpublish?(user: RemoteUser, pkg: T & PackageAccess, cb: AuthAccessCallback): void;
+  allow_unpublish?(
+    user: RemoteUser,
+    pkg: AllowAccess & PackageAccess,
+    cb: AuthAccessCallback
+  ): void;
+  apiJWTmiddleware?(helpers: any): RequestHandler;
+}
+
+export interface IBasicAuth {
+  authenticate(user: string, password: string, cb: Callback): void;
+  invalidateToken?(token: string): Promise<void>;
+  changePassword(user: string, password: string, newPassword: string, cb: Callback): void;
+  allow_access(pkg: AuthPluginPackage, user: RemoteUser, callback: Callback): void;
+  add_user(user: string, password: string, cb: Callback): any;
+}
+
+export interface ManifestFilter<T> extends Plugin<T> {
+  filterMetadata(packageInfo: Manifest): Promise<Manifest>;
+}

package/src/stream-utils.ts

@@ -1,90 +1,9 @@
-import { PassThrough, Transform, TransformOptions } from 'stream';
-
-export interface IReadTarball {
-  abort?: () => void;
-}
-
-export interface IUploadTarball {
-  done?: () => void;
-  abort?: () => void;
-}
-
-/**
- * This stream is used to read tarballs from repository.
- * @param {*} options
- * @return {Stream}
- */
-class ReadTarball extends PassThrough implements IReadTarball {
-  /**
-   *
-   * @param {Object} options
-   */
-  public constructor(options: TransformOptions) {
-    super(options);
-    // called when data is not needed anymore
-    addAbstractMethods(this, 'abort');
-  }
-
-  public abort(): void {}
-}
-
-/**
- * This stream is used to upload tarballs to a repository.
- * @param {*} options
- * @return {Stream}
- */
-class UploadTarball extends PassThrough implements IUploadTarball {
-  /**
-   *
-   * @param {Object} options
-   */
-  public constructor(options: any) {
-    super(options);
-    // called when user closes connection before upload finishes
-    addAbstractMethods(this, 'abort');
-
-    // called when upload finishes successfully
-    addAbstractMethods(this, 'done');
-  }
-
-  public abort(): void {}
-  public done(): void {}
-}
-
-/**
- * This function intercepts abstract calls and replays them allowing.
- * us to attach those functions after we are ready to do so
- * @param {*} self
- * @param {*} name
- */
-// Perhaps someone knows a better way to write this
-function addAbstractMethods(self: any, name: any): void {
-  self._called_methods = self._called_methods || {};
-
-  self.__defineGetter__(name, function () {
-    return function (): void {
-      self._called_methods[name] = true;
-    };
-  });
-
-  self.__defineSetter__(name, function (fn: any) {
-    delete self[name];
-
-    self[name] = fn;
-
-    // eslint-disable-next-line @typescript-eslint/prefer-optional-chain
-    if (self._called_methods && self._called_methods[name]) {
-      delete self._called_methods[name];
-
-      self[name]();
-    }
-  });
-}
+import { Readable, Transform } from 'stream';
 
 /**
  * Converts a buffer stream to a string.
  */
-const readableToString = async (stream) => {
+const readableToString = async (stream: Readable) => {
   const chunks: Buffer[] = [];
   for await (let chunk of stream) {
     chunks.push(Buffer.from(chunk));
@@ -106,4 +25,4 @@ const transformObjectToString = () => {
   });
 };
 
-export { ReadTarball, UploadTarball, readableToString, transformObjectToString };
+export { readableToString, transformObjectToString };

package/src/string-utils.ts

@@ -0,0 +1,36 @@
+/**
+ * Quality values, or q-values and q-factors, are used to describe the order
+ * of priority of values in a comma-separated list.
+ * It is a special syntax allowed in some HTTP headers and in HTML.
+ * https://developer.mozilla.org/en-US/docs/Glossary/Quality_values
+ * @param headerValue
+ */
+export function getByQualityPriorityValue(headerValue: string | undefined | null): string {
+  if (typeof headerValue !== 'string') {
+    return '';
+  }
+
+  const split = headerValue.split(',');
+
+  if (split.length <= 1) {
+    const qList = split[0].split(';');
+    return qList[0];
+  }
+
+  let [header] = split
+    .reduce((acc, item: string) => {
+      const qList = item.split(';');
+      if (qList.length > 1) {
+        const [accept, q] = qList;
+        const [, query] = q.split('=');
+        acc.push([accept.trim(), query ? query : 0]);
+      } else {
+        acc.push([qList[0], 0]);
+      }
+      return acc;
+    }, [] as any)
+    .sort(function (a: number[], b: number[]) {
+      return b[1] - a[1];
+    });
+  return header[0];
+}

package/src/validation-utils.ts

@@ -2,7 +2,7 @@ import assert from 'assert';
 
 import { Manifest } from '@verdaccio/types';
 
-import { DIST_TAGS } from './constants';
+import { DEFAULT_PASSWORD_VALIDATION, DIST_TAGS } from './constants';
 
 export { validatePublishSingleVersion } from './schemes/publish-manifest';
 
@@ -104,3 +104,12 @@ export function isObject(obj: any): boolean {
     Array.isArray(obj) === false
   );
 }
+
+export function validatePassword(
+  password: string,
+  validation: RegExp = DEFAULT_PASSWORD_VALIDATION
+): boolean {
+  return typeof password === 'string' && validation instanceof RegExp
+    ? password.match(validation) !== null
+    : false;
+}

package/src/warning-utils.ts

@@ -45,6 +45,6 @@ warningInstance.create(
   'multiple addresses will be deprecated in the next major, only use one'
 );
 
-export function emit(code, a?: string, b?: string, c?: string) {
+export function emit(code: string, a?: string, b?: string, c?: string) {
   warningInstance.emit(code, a, b, c);
 }

package/test/mystreams.spec.ts

@@ -1,34 +1,8 @@
 import { Stream } from 'stream';
 
-import { ReadTarball, UploadTarball, readableToString } from '../src/stream-utils';
+import { readableToString } from '../src/stream-utils';
 
 describe('mystreams', () => {
-  test('should delay events on ReadTarball abort', (cb) => {
-    const readTballStream = new ReadTarball({});
-    readTballStream.abort();
-    setTimeout(function () {
-      readTballStream.abort = function (): void {
-        cb();
-      };
-      readTballStream.abort = function (): never {
-        throw Error('fail');
-      };
-    }, 10);
-  });
-
-  test('should delay events on UploadTarball abort', (cb) => {
-    const uploadTballStream = new UploadTarball({});
-    uploadTballStream.abort();
-    setTimeout(function () {
-      uploadTballStream.abort = function (): void {
-        cb();
-      };
-      uploadTballStream.abort = function (): never {
-        throw Error('fail');
-      };
-    }, 10);
-  });
-
   test('readableToString single string', async () => {
     expect(await readableToString(Stream.Readable.from('foo'))).toEqual('foo');
   });

package/test/string-utils.spec.ts

@@ -0,0 +1,40 @@
+import { stringUtils } from '../src';
+
+describe('string-utils', () => {
+  test('getByQualityPriorityValue', () => {
+    expect(stringUtils.getByQualityPriorityValue('')).toEqual('');
+    expect(stringUtils.getByQualityPriorityValue(null)).toEqual('');
+    expect(stringUtils.getByQualityPriorityValue(undefined)).toEqual('');
+    expect(stringUtils.getByQualityPriorityValue('something')).toEqual('something');
+    expect(stringUtils.getByQualityPriorityValue('something,')).toEqual('something');
+    expect(stringUtils.getByQualityPriorityValue('0,')).toEqual('0');
+    expect(stringUtils.getByQualityPriorityValue('application/json')).toEqual('application/json');
+    expect(stringUtils.getByQualityPriorityValue('application/json; q=1')).toEqual(
+      'application/json'
+    );
+    expect(stringUtils.getByQualityPriorityValue('application/json; q=')).toEqual(
+      'application/json'
+    );
+    expect(stringUtils.getByQualityPriorityValue('application/json;')).toEqual('application/json');
+    expect(
+      stringUtils.getByQualityPriorityValue(
+        'application/json; q=1.0, application/vnd.npm.install-v1+json; q=0.9, */*'
+      )
+    ).toEqual('application/json');
+    expect(
+      stringUtils.getByQualityPriorityValue(
+        'application/json; q=1.0, application/vnd.npm.install-v1+json; q=, */*'
+      )
+    ).toEqual('application/json');
+    expect(
+      stringUtils.getByQualityPriorityValue(
+        'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.9, */*'
+      )
+    ).toEqual('application/vnd.npm.install-v1+json');
+    expect(
+      stringUtils.getByQualityPriorityValue(
+        'application/vnd.npm.install-v1+json; q=, application/json; q=0.9, */*'
+      )
+    ).toEqual('application/json');
+  });
+});