@verdaccio/middleware 6.0.0-6-next.12 → 6.0.0-6-next.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/CHANGELOG.md +57 -0
  2. package/build/middleware-utils.js +2 -3
  3. package/build/middleware-utils.js.map +1 -1
  4. package/build/middleware.d.ts +2 -2
  5. package/build/middleware.js +36 -36
  6. package/build/middleware.js.map +1 -1
  7. package/package.json +8 -7
  8. package/src/middleware-utils.ts +3 -3
  9. package/src/middleware.ts +20 -21
  10. package/types/custom.d.ts +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,62 @@
1
1
  # @verdaccio/middleware
2
2
 
3
+ ## 6.0.0-6-next.16
4
+
5
+ ### Minor Changes
6
+
7
+ - 24b9be02: refactor: improve docker image build with strict dependencies and prod build
8
+
9
+ ### Patch Changes
10
+
11
+ - Updated dependencies [a828271d]
12
+ - Updated dependencies [24b9be02]
13
+ - Updated dependencies [e75c0a3b]
14
+ - Updated dependencies [b13a3fef]
15
+ - @verdaccio/utils@6.0.0-6-next.10
16
+ - @verdaccio/core@6.0.0-6-next.4
17
+ - @verdaccio/logger@6.0.0-6-next.8
18
+ - @verdaccio/auth@6.0.0-6-next.16
19
+
20
+ ## 6.0.0-6-next.15
21
+
22
+ ### Patch Changes
23
+
24
+ - Updated dependencies [f86c31ed]
25
+ - Updated dependencies [20c9e43e]
26
+ - @verdaccio/utils@6.0.0-6-next.9
27
+ - @verdaccio/auth@6.0.0-6-next.15
28
+
29
+ ## 6.0.0-6-next.14
30
+
31
+ ### Patch Changes
32
+
33
+ - Updated dependencies [6c1eb021]
34
+ - @verdaccio/core@6.0.0-6-next.3
35
+ - @verdaccio/logger@6.0.0-6-next.7
36
+ - @verdaccio/auth@6.0.0-6-next.14
37
+ - @verdaccio/utils@6.0.0-6-next.8
38
+
39
+ ## 6.0.0-6-next.13
40
+
41
+ ### Major Changes
42
+
43
+ - 794af76c: Remove Node 12 support
44
+
45
+ - We need move to the new `undici` and does not support Node.js 12
46
+
47
+ ### Minor Changes
48
+
49
+ - 154b2ecd: refactor: remove @verdaccio/commons-api in favor @verdaccio/core and remove duplications
50
+
51
+ ### Patch Changes
52
+
53
+ - Updated dependencies [794af76c]
54
+ - Updated dependencies [154b2ecd]
55
+ - @verdaccio/auth@6.0.0-6-next.13
56
+ - @verdaccio/core@6.0.0-6-next.2
57
+ - @verdaccio/logger@6.0.0-6-next.6
58
+ - @verdaccio/utils@6.0.0-6-next.7
59
+
3
60
  ## 6.0.0-6-next.12
4
61
 
5
62
  ### Patch Changes
package/build/middleware-utils.js CHANGED
@@ -11,8 +11,7 @@ exports.getVersionFromTarball = getVersionFromTarball;
11
11
  * @returns {String}
12
12
  */
13
13
  function getVersionFromTarball(name) {
14
- // FIXME: we know the regex is valid, but we should improve this part as ts suggest
15
- // @ts-ignore
16
- return /.+-(\d.+)\.tgz/.test(name) ? name.match(/.+-(\d.+)\.tgz/)[1] : undefined;
14
+ const groups = name.match(/.+-(\d.+)\.tgz/);
15
+ return groups !== null ? groups[1] : undefined;
17
16
  }
18
17
  //# sourceMappingURL=middleware-utils.js.map
package/build/middleware-utils.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/middleware-utils.ts"],"names":["getVersionFromTarball","name","test","match","undefined"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACO,SAASA,qBAAT,CAA+BC,IAA/B,EAA4D;AACjE;AACA;AACA,SAAO,iBAAiBC,IAAjB,CAAsBD,IAAtB,IAA8BA,IAAI,CAACE,KAAL,CAAW,gBAAX,EAA6B,CAA7B,CAA9B,GAAgEC,SAAvE;AACD","sourcesContent":["/**\n * return package version from tarball name\n * @param {String} name\n * @returns {String}\n */\nexport function getVersionFromTarball(name: string): string | void {\n // FIXME: we know the regex is valid, but we should improve this part as ts suggest\n // @ts-ignore\n return /.+-(\\d.+)\\.tgz/.test(name) ? name.match(/.+-(\\d.+)\\.tgz/)[1] : undefined;\n}\n"],"file":"middleware-utils.js"}
1
+ {"version":3,"sources":["../src/middleware-utils.ts"],"names":["getVersionFromTarball","name","groups","match","undefined"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACO,SAASA,qBAAT,CAA+BC,IAA/B,EAA4D;AACjE,QAAMC,MAAM,GAAGD,IAAI,CAACE,KAAL,CAAW,gBAAX,CAAf;AAEA,SAAOD,MAAM,KAAK,IAAX,GAAkBA,MAAM,CAAC,CAAD,CAAxB,GAA8BE,SAArC;AACD","sourcesContent":["/**\n * return package version from tarball name\n * @param {String} name\n * @returns {String}\n */\nexport function getVersionFromTarball(name: string): string | void {\n const groups = name.match(/.+-(\\d.+)\\.tgz/);\n\n return groups !== null ? groups[1] : undefined;\n}\n"],"file":"middleware-utils.js"}
package/build/middleware.d.ts CHANGED
@@ -1,7 +1,7 @@
1
1
  import { NextFunction, Request, Response } from 'express';
2
- import { Config, Package, RemoteUser, Logger } from '@verdaccio/types';
3
- import { IAuth } from '@verdaccio/auth';
4
2
  import { HttpError } from 'http-errors';
3
+ import { IAuth } from '@verdaccio/auth';
4
+ import { Config, Logger, Package, RemoteUser } from '@verdaccio/types';
5
5
  export declare type $RequestExtend = Request & {
6
6
  remote_user?: RemoteUser;
7
7
  log: Logger;
package/build/middleware.js CHANGED
@@ -3,30 +3,30 @@
3
3
  Object.defineProperty(exports, "__esModule", {
4
4
  value: true
5
5
  });
6
- exports.match = match;
7
- exports.setSecurityWebHeaders = setSecurityWebHeaders;
8
- exports.validateName = validateName;
9
- exports.validatePackage = validatePackage;
10
- exports.media = media;
6
+ exports.LOG_VERDACCIO_ERROR = exports.LOG_VERDACCIO_BYTES = exports.LOG_STATUS_MESSAGE = void 0;
7
+ exports.allow = allow;
8
+ exports.antiLoop = antiLoop;
11
9
  exports.encodeScopePackage = encodeScopePackage;
10
+ exports.errorReportingMiddleware = errorReportingMiddleware;
12
11
  exports.expectJson = expectJson;
13
- exports.antiLoop = antiLoop;
14
- exports.allow = allow;
15
12
  exports.final = final;
16
- exports.log = log;
17
13
  exports.handleError = handleError;
18
- exports.errorReportingMiddleware = errorReportingMiddleware;
19
- exports.LOG_VERDACCIO_BYTES = exports.LOG_VERDACCIO_ERROR = exports.LOG_STATUS_MESSAGE = void 0;
20
-
21
- var _lodash = _interopRequireDefault(require("lodash"));
14
+ exports.log = log;
15
+ exports.match = match;
16
+ exports.media = media;
17
+ exports.setSecurityWebHeaders = setSecurityWebHeaders;
18
+ exports.validateName = validateName;
19
+ exports.validatePackage = validatePackage;
22
20
 
23
21
  var _debug = _interopRequireDefault(require("debug"));
24
22
 
25
- var _utils = require("@verdaccio/utils");
23
+ var _lodash = _interopRequireDefault(require("lodash"));
24
+
25
+ var _core = require("@verdaccio/core");
26
26
 
27
27
  var _logger = require("@verdaccio/logger");
28
28
 
29
- var _commonsApi = require("@verdaccio/commons-api");
29
+ var _utils = require("@verdaccio/utils");
30
30
 
31
31
  var _middlewareUtils = require("./middleware-utils");
32
32
 
@@ -48,13 +48,13 @@ function match(regexp) {
48
48
 
49
49
  function setSecurityWebHeaders(req, res, next) {
50
50
  // disable loading in frames (clickjacking, etc.)
51
- res.header(_commonsApi.HEADERS.FRAMES_OPTIONS, 'deny'); // avoid stablish connections outside of domain
51
+ res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny'); // avoid stablish connections outside of domain
52
52
 
53
- res.header(_commonsApi.HEADERS.CSP, "connect-src 'self'"); // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
53
+ res.header(_core.HEADERS.CSP, "connect-src 'self'"); // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
54
54
 
55
- res.header(_commonsApi.HEADERS.CTO, 'nosniff'); // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
55
+ res.header(_core.HEADERS.CTO, 'nosniff'); // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
56
56
 
57
- res.header(_commonsApi.HEADERS.XSS, '1; mode=block');
57
+ res.header(_core.HEADERS.XSS, '1; mode=block');
58
58
  next();
59
59
  }
60
60
 
@@ -65,7 +65,7 @@ function validateName(req, res, next, value, name) {
65
65
  } else if ((0, _utils.validateName)(value)) {
66
66
  next();
67
67
  } else {
68
- next(_utils.ErrorCode.getForbidden('invalid ' + name));
68
+ next(_core.errorUtils.getForbidden('invalid ' + name));
69
69
  }
70
70
  }
71
71
 
@@ -76,14 +76,14 @@ function validatePackage(req, res, next, value, name) {
76
76
  } else if ((0, _utils.validatePackage)(value)) {
77
77
  next();
78
78
  } else {
79
- next(_utils.ErrorCode.getForbidden('invalid ' + name));
79
+ next(_core.errorUtils.getForbidden('invalid ' + name));
80
80
  }
81
81
  }
82
82
 
83
83
  function media(expect) {
84
84
  return function (req, res, next) {
85
- if (req.headers[_commonsApi.HEADER_TYPE.CONTENT_TYPE] !== expect) {
86
- next(_utils.ErrorCode.getCode(_commonsApi.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.headers[_commonsApi.HEADER_TYPE.CONTENT_TYPE]));
85
+ if (req.headers[_core.HEADER_TYPE.CONTENT_TYPE] !== expect) {
86
+ next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.headers[_core.HEADER_TYPE.CONTENT_TYPE]));
87
87
  } else {
88
88
  next();
89
89
  }
@@ -101,7 +101,7 @@ function encodeScopePackage(req, res, next) {
101
101
 
102
102
  function expectJson(req, res, next) {
103
103
  if (!(0, _utils.isObject)(req.body)) {
104
- return next(_utils.ErrorCode.getBadRequest("can't parse incoming json"));
104
+ return next(_core.errorUtils.getBadRequest("can't parse incoming json"));
105
105
  }
106
106
 
107
107
  next();
@@ -116,7 +116,7 @@ function antiLoop(config) {
116
116
  const m = arr[i].match(/\s*(\S+)\s+(\S+)/);
117
117
 
118
118
  if (m && m[2] === config.server_id) {
119
- return next(_utils.ErrorCode.getCode(_commonsApi.HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
119
+ return next(_core.errorUtils.getCode(_core.HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
120
120
  }
121
121
  }
122
122
  }
@@ -151,7 +151,7 @@ function allow(auth) {
151
151
  } else {
152
152
  // last plugin (that's our built-in one) returns either
153
153
  // cb(err) or cb(null, true), so this should never happen
154
- throw _utils.ErrorCode.getInternalError(_commonsApi.API_ERROR.PLUGIN_ERROR);
154
+ throw _core.errorUtils.getInternalError(_core.API_ERROR.PLUGIN_ERROR);
155
155
  }
156
156
  });
157
157
  };
@@ -161,15 +161,15 @@ function allow(auth) {
161
161
  function final(body, req, res, // if we remove `next` breaks test
162
162
  // eslint-disable-next-line @typescript-eslint/no-unused-vars
163
163
  next) {
164
- if (res.statusCode === _commonsApi.HTTP_STATUS.UNAUTHORIZED && !res.getHeader(_commonsApi.HEADERS.WWW_AUTH)) {
164
+ if (res.statusCode === _core.HTTP_STATUS.UNAUTHORIZED && !res.getHeader(_core.HEADERS.WWW_AUTH)) {
165
165
  // they say it's required for 401, so...
166
- res.header(_commonsApi.HEADERS.WWW_AUTH, `${_commonsApi.TOKEN_BASIC}, ${_commonsApi.TOKEN_BEARER}`);
166
+ res.header(_core.HEADERS.WWW_AUTH, `${_core.TOKEN_BASIC}, ${_core.TOKEN_BEARER}`);
167
167
  }
168
168
 
169
169
  try {
170
170
  if (_lodash.default.isString(body) || _lodash.default.isObject(body)) {
171
- if (!res.getHeader(_commonsApi.HEADERS.CONTENT_TYPE)) {
172
- res.header(_commonsApi.HEADERS.CONTENT_TYPE, _commonsApi.HEADERS.JSON);
171
+ if (!res.getHeader(_core.HEADERS.CONTENT_TYPE)) {
172
+ res.header(_core.HEADERS.CONTENT_TYPE, _core.HEADERS.JSON);
173
173
  }
174
174
 
175
175
  if (typeof body === 'object' && _lodash.default.isNil(body) === false) {
@@ -181,8 +181,8 @@ next) {
181
181
  } // don't send etags with errors
182
182
 
183
183
 
184
- if (!res.statusCode || res.statusCode >= _commonsApi.HTTP_STATUS.OK && res.statusCode < _commonsApi.HTTP_STATUS.MULTIPLE_CHOICES) {
185
- res.header(_commonsApi.HEADERS.ETAG, '"' + (0, _utils.stringToMD5)(body) + '"');
184
+ if (!res.statusCode || res.statusCode >= _core.HTTP_STATUS.OK && res.statusCode < _core.HTTP_STATUS.MULTIPLE_CHOICES) {
185
+ res.header(_core.HEADERS.ETAG, '"' + (0, _utils.stringToMD5)(body) + '"');
186
186
  }
187
187
  } else {// send(null), send(204), etc.
188
188
  }
@@ -319,7 +319,7 @@ function handleError(err, req, res, next) {
319
319
  if (_lodash.default.isError(err)) {
320
320
  debug('is native error');
321
321
 
322
- if (err.code === 'ECONNABORT' && res.statusCode === _commonsApi.HTTP_STATUS.NOT_MODIFIED) {
322
+ if (err.code === 'ECONNABORT' && res.statusCode === _core.HTTP_STATUS.NOT_MODIFIED) {
323
323
  return next();
324
324
  }
325
325
 
@@ -344,7 +344,7 @@ function errorReportingMiddleware(req, res, next) {
344
344
  debug('error report middleware');
345
345
 
346
346
  res.locals.report_error = res.locals.report_error || function (err) {
347
- if (err.status && err.status >= _commonsApi.HTTP_STATUS.BAD_REQUEST && err.status < 600) {
347
+ if (err.status && err.status >= _core.HTTP_STATUS.BAD_REQUEST && err.status < 600) {
348
348
  debug('is error > 409 %o', err === null || err === void 0 ? void 0 : err.status);
349
349
 
350
350
  if (_lodash.default.isNil(res.headersSent) === false) {
@@ -352,7 +352,7 @@ function errorReportingMiddleware(req, res, next) {
352
352
  res.status(err.status);
353
353
  debug('next layer %o', err === null || err === void 0 ? void 0 : err.message);
354
354
  next({
355
- error: err.message || _commonsApi.API_ERROR.UNKNOWN_ERROR
355
+ error: err.message || _core.API_ERROR.UNKNOWN_ERROR
356
356
  });
357
357
  }
358
358
  } else {
@@ -370,9 +370,9 @@ function errorReportingMiddleware(req, res, next) {
370
370
  res.destroy();
371
371
  } else if (!res.headersSent) {
372
372
  debug('report internal error %o', err);
373
- res.status(_commonsApi.HTTP_STATUS.INTERNAL_ERROR);
373
+ res.status(_core.HTTP_STATUS.INTERNAL_ERROR);
374
374
  next({
375
- error: _commonsApi.API_ERROR.INTERNAL_SERVER_ERROR
375
+ error: _core.API_ERROR.INTERNAL_SERVER_ERROR
376
376
  });
377
377
  } else {
378
378
  // socket should be already closed
package/build/middleware.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/middleware.ts"],"names":["debug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","ErrorCode","getForbidden","validatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","isObject","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AAWA;;AAEA;;AAUA;;;;AAMA,MAAMA,KAAK,GAAG,oBAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;AACzC,SAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;AACN,QAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;AACtBD,MAAAA,IAAI;AACL,KAFD,MAEO;AACLA,MAAAA,IAAI,CAAC,OAAD,CAAJ;AACD;AACF,GAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN;AACAD,EAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;AACAP,EAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;AACAR,EAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;AACAT,EAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQI,GAAnB,EAAwB,eAAxB;AACAT,EAAAA,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,yBAAiBC,KAAjB,CAAJ,EAA6B;AAClCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAUC,YAAV,CAAuB,aAAaF,IAApC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASG,eAAT,CACLhB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,4BAAoBC,KAApB,CAAJ,EAAgC;AACrCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAUC,YAAV,CAAuB,aAAaF,IAApC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASI,KAAT,CAAeC,MAAf,EAA2C;AAChD,SAAO,UAAUlB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYC,wBAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;AACpDhB,MAAAA,IAAI,CACFY,iBAAUQ,OAAV,CACEC,wBAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGElB,GAAG,CAACmB,OAAJ,CAAYC,wBAAYC,YAAxB,CALJ,CADE,CAAJ;AASD,KAVD,MAUO;AACLnB,MAAAA,IAAI;AACL;AACF,GAdD;AAeD;;AAEM,SAASuB,kBAAT,CACLzB,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAIF,GAAG,CAAC0B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;AAC/B;AACA3B,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAAC0B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;AACD;;AACD1B,EAAAA,IAAI;AACL;;AAEM,SAAS2B,UAAT,CACL7B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAI,CAAC,qBAASF,GAAG,CAAC8B,IAAb,CAAL,EAAyB;AACvB,WAAO5B,IAAI,CAACY,iBAAUiB,aAAV,CAAwB,2BAAxB,CAAD,CAAX;AACD;;AACD7B,EAAAA,IAAI;AACL;;AAEM,SAAS8B,QAAT,CAAkBC,MAAlB,EAA4C;AACjD,SAAO,UAAUjC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,IAAmB,IAAvB,EAA6B;AAC3B,YAAMC,GAAG,GAAGnC,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;AAEA,WAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;AACnC,cAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAOvC,KAAP,CAAa,kBAAb,CAAV;;AACA,YAAIyC,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;AAClC,iBAAOtC,IAAI,CAACY,iBAAUQ,OAAV,CAAkBC,wBAAYkB,aAA9B,EAA6C,eAA7C,CAAD,CAAX;AACD;AACF;AACF;;AACDvC,IAAAA,IAAI;AACL,GAZD;AAaD;;AAEM,SAASwC,KAAT,CAAeC,IAAf,EAAsC;AAC3C,SAAO,UAAUC,MAAV,EAAoC;AACzC,WAAO,UAAU5C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxFF,MAAAA,GAAG,CAAC6C,KAAJ;AACA,YAAMC,WAAW,GAAG9C,GAAG,CAAC+C,MAAJ,CAAWC,KAAX,GACf,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWC,KAAM,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBjD,GAAG,CAAC+C,MAAJ,CAAWE,OAFf;AAGA,YAAMC,cAAc,GAAGlD,GAAG,CAAC+C,MAAJ,CAAWI,QAAX,GACnB,4CAAsBnD,GAAG,CAAC+C,MAAJ,CAAWI,QAAjC,CADmB,GAEnBC,SAFJ;AAGA,YAAMC,MAAM,GAAGrD,GAAG,CAACsD,WAAnB;;AACAC,qBAAOC,KAAP,CACE;AAAEZ,QAAAA,MAAF;AAAUa,QAAAA,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAExC;AAAxB,OADF,EAEG,iDAFH;;AAIA8B,MAAAA,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;AAAEE,QAAAA,WAAF;AAAeI,QAAAA;AAAf,OADF,EAEEG,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;AAC9B3D,QAAAA,GAAG,CAAC4D,MAAJ;;AACA,YAAIF,KAAJ,EAAW;AACTxD,UAAAA,IAAI,CAACwD,KAAD,CAAJ;AACD,SAFD,MAEO,IAAIC,OAAJ,EAAa;AAClBzD,UAAAA,IAAI;AACL,SAFM,MAEA;AACL;AACA;AACA,gBAAMY,iBAAU+C,gBAAV,CAA2BC,sBAAUC,YAArC,CAAN;AACD;AACF,OAdH;AAgBD,KA7BD;AA8BD,GA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLlC,IADK,EAEL9B,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;AACN,MAAID,GAAG,CAACgE,UAAJ,KAAmB1C,wBAAY2C,YAA/B,IAA+C,CAACjE,GAAG,CAACkE,SAAJ,CAAc5D,oBAAQ6D,QAAtB,CAApD,EAAqF;AACnF;AACAnE,IAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQ6D,QAAnB,EAA8B,GAAEC,uBAAY,KAAIC,wBAAa,EAA7D;AACD;;AAED,MAAI;AACF,QAAIC,gBAAEC,QAAF,CAAW1C,IAAX,KAAoByC,gBAAEE,QAAF,CAAW3C,IAAX,CAAxB,EAA0C;AACxC,UAAI,CAAC7B,GAAG,CAACkE,SAAJ,CAAc5D,oBAAQc,YAAtB,CAAL,EAA0C;AACxCpB,QAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQc,YAAnB,EAAiCd,oBAAQmE,IAAzC;AACD;;AAED,UAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4ByC,gBAAEI,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;AACvD,YAAI,OAAQA,IAAD,CAA0B4B,KAAjC,KAA2C,QAA/C,EAAyD;AACvDzD,UAAAA,GAAG,CAAC2E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B4B,KAAxD,CADuD,CAEvD;AACD;;AACD5B,QAAAA,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBsB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;AACD,OAXuC,CAaxC;;;AACA,UACE,CAACnD,GAAG,CAACgE,UAAL,IACChE,GAAG,CAACgE,UAAJ,IAAkB1C,wBAAYwD,EAA9B,IAAoC9E,GAAG,CAACgE,UAAJ,GAAiB1C,wBAAYyD,gBAFpE,EAGE;AACA/E,QAAAA,GAAG,CAACK,MAAJ,CAAWC,oBAAQ0E,IAAnB,EAAyB,MAAM,wBAAYnD,IAAZ,CAAN,GAAoC,GAA7D;AACD;AACF,KApBD,MAoBO,CACL;AACD;AACF,GAxBD,CAwBE,OAAOoD,GAAP,EAAiB;AACjB;AACA;AACA;AACA,QAAIA,GAAG,CAACC,OAAJ,CAAYrF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;AACxD,UAAIyE,gBAAEI,KAAF,CAAQ1E,GAAG,CAACmF,MAAZ,MAAwB,KAA5B,EAAmC;AAAA;;AACjC,uBAAAnF,GAAG,CAACmF,MAAJ,4DAAYC,OAAZ;AACD;;AACD;AACD;;AACD,UAAMH,GAAN;AACD;;AAEDjF,EAAAA,GAAG,CAACqF,IAAJ,CAASxD,IAAT;AACD,C,CAED;;;AACO,MAAMyD,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa1F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;AAC3F;AACAF,EAAAA,GAAG,CAAC0F,GAAJ,GAAUnC,eAAOoC,KAAP,CAAa;AAAEC,IAAAA,GAAG,EAAE;AAAP,GAAb,CAAV;AAEA,QAAMC,KAAK,GAAG7F,GAAG,CAACmB,OAAJ,CAAY2E,aAA1B;;AACA,MAAIvB,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4B,cAA5B;AACD;;AAED,QAAMC,OAAO,GAAG/F,GAAG,CAACmB,OAAJ,CAAY6E,MAA5B;;AACA,MAAIzB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqB,cAArB;AACD;;AAEDhG,EAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,EAAAA,GAAG,CAAC0F,GAAJ,CAAQQ,IAAR,CAAa;AAAElG,IAAAA,GAAG,EAAEA,GAAP;AAAYmG,IAAAA,EAAE,EAAEnG,GAAG,CAACmG;AAApB,GAAb,EAAuC,4CAAvC;AACAnG,EAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;;AAEA,MAAI6C,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4BD,KAA5B;AACD;;AAED,MAAItB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqBD,OAArB;AACD;;AAED,MAAIK,OAAO,GAAG,CAAd;AACApG,EAAAA,GAAG,CAACqG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;AACpCF,IAAAA,OAAO,IAAIE,KAAK,CAAChE,MAAjB;AACD,GAFD;AAIA,MAAIiE,QAAQ,GAAG,CAAf;AACA,QAAMC,MAAM,GAAGvG,GAAG,CAACwG,KAAnB,CAhC2F,CAiC3F;AACA;;AACAxG,EAAAA,GAAG,CAACwG,KAAJ,GAAY,UAAUC,GAAV,EAAwB;AAClCH,IAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACA;AACA;;AACAkE,IAAAA,MAAM,CAACG,KAAP,CAAa1G,GAAb,EAAkB2G,SAAlB;AACD,GALD;;AAOA,QAAMlB,GAAG,GAAG,YAAkB;AAC5B,UAAMmB,YAAY,GAAG7G,GAAG,CAACmB,OAAJ,CAAY,iBAAZ,CAArB;AACA,UAAM2F,aAAa,GAAG9G,GAAG,CAAC+G,UAAJ,CAAeD,aAArC;AACA,UAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;AACA,QAAI3B,OAAJ;;AACA,QAAIlF,GAAG,CAAC2E,MAAJ,CAAWC,gBAAf,EAAiC;AAC/BM,MAAAA,OAAO,GAAGK,mBAAV;AACD,KAFD,MAEO;AACLL,MAAAA,OAAO,GAAGM,mBAAV;AACD;;AAEDzF,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,IAAAA,GAAG,CAAC0F,GAAJ,CAAQuB,IAAR,CACE;AACEC,MAAAA,OAAO,EAAE;AACPC,QAAAA,MAAM,EAAEnH,GAAG,CAACmH,MADL;AAEPzF,QAAAA,GAAG,EAAE1B,GAAG,CAAC0B;AAFF,OADX;AAKE+B,MAAAA,IAAI,EAAGzD,GAAG,CAACsD,WAAJ,IAAmBtD,GAAG,CAACsD,WAAJ,CAAgBzC,IAApC,IAA6C,IALrD;AAMEmG,MAAAA,QANF;AAOEI,MAAAA,MAAM,EAAEnH,GAAG,CAACgE,UAPd;AAQEP,MAAAA,KAAK,EAAEzD,GAAG,CAAC2E,MAAJ,CAAWC,gBARpB;AASEwC,MAAAA,KAAK,EAAE;AACLC,QAAAA,EAAE,EAAElB,OADC;AAELmB,QAAAA,GAAG,EAAEhB;AAFA;AATT,KADF,EAeEpB,OAfF;AAiBAnF,IAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;AACD,GA9BD;;AAgCA1B,EAAAA,GAAG,CAACqG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;AAChCX,IAAAA,GAAG;AACJ,GAFD;AAIA,QAAM8B,IAAI,GAAGvH,GAAG,CAACwH,GAAjB;;AACAxH,EAAAA,GAAG,CAACwH,GAAJ,GAAU,UAAUf,GAAV,EAAqB;AAC7B,QAAIA,GAAJ,EAAS;AACPH,MAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACD;AACD;AACA;;;AACAkF,IAAAA,IAAI,CAACb,KAAL,CAAW1G,GAAX,EAAgB2G,SAAhB;;AACAlB,IAAAA,GAAG;AACJ,GARD;;AASAxF,EAAAA,IAAI;AACL;;AAEM,SAASwH,WAAT,CACLxC,GADK,EAELlF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;AACAL,EAAAA,KAAK,CAAC,oBAAD,CAAL;;AACA,MAAI0E,gBAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;AAClBrF,IAAAA,KAAK,CAAC,iBAAD,CAAL;;AACA,QAAIqF,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B3H,GAAG,CAACgE,UAAJ,KAAmB1C,wBAAYsG,YAAhE,EAA8E;AAC5E,aAAO3H,IAAI,EAAX;AACD;;AACD,QAAIqE,gBAAEuD,UAAF,CAAa7H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAxB,MAA0C,KAA9C,EAAqD;AACnDlI,MAAAA,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;AACA;;AACAmI,MAAAA,wBAAwB,CAAChI,GAAD,EAAMC,GAAN,EAAWsE,gBAAE0D,IAAb,CAAxB;AACD;;AACDpI,IAAAA,KAAK,CAAC,6BAAD,CAAL;AACAI,IAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,CAAwB7C,GAAxB;AACD,GAbD,MAaO;AACL;AACArF,IAAAA,KAAK,CAAC,qCAAD,CAAL;AACA,WAAOK,IAAI,CAACgF,GAAD,CAAX;AACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLhI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACNL,EAAAA,KAAK,CAAC,yBAAD,CAAL;;AACAI,EAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,GACE9H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,IACA,UAAU7C,GAAV,EAAqC;AACnC,QAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc7F,wBAAY2G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;AAC3EvH,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA,UAAI7C,gBAAEI,KAAF,CAAQ1E,GAAG,CAACkI,WAAZ,MAA6B,KAAjC,EAAwC;AACtCtI,QAAAA,KAAK,CAAC,gBAAD,EAAmBqF,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;AACAnH,QAAAA,GAAG,CAACmH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;AACAvH,QAAAA,KAAK,CAAC,eAAD,EAAkBqF,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;AACAjF,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,sBAAUsE;AAAlC,SAAD,CAAJ;AACD;AACF,KARD,MAQO;AACLvI,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA7D,qBAAOG,KAAP,CAAa;AAAEwB,QAAAA,GAAG,EAAEA;AAAP,OAAb,EAA2B,iDAA3B;;AACA,UAAI,CAACjF,GAAG,CAACmH,MAAL,IAAe,CAACnH,GAAG,CAACqF,IAAxB,EAA8B;AAC5B;AACA/B,uBAAOG,KAAP,CAAa,oDAAb;;AACA7D,QAAAA,KAAK,CAAC,yEAAD,EAA4EqF,GAA5E,CAAL;AACAjF,QAAAA,GAAG,CAACoF,OAAJ;AACD,OALD,MAKO,IAAI,CAACpF,GAAG,CAACkI,WAAT,EAAsB;AAC3BtI,QAAAA,KAAK,CAAC,0BAAD,EAA6BqF,GAA7B,CAAL;AACAjF,QAAAA,GAAG,CAACmH,MAAJ,CAAW7F,wBAAY8G,cAAvB;AACAnI,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEI,sBAAUwE;AAAnB,SAAD,CAAJ;AACD,OAJM,MAIA;AACL;AACAzI,QAAAA,KAAK,CAAC,6CAAD,EAAgDqF,GAAhD,CAAL;AACD;AACF;AACF,GA5BH;;AA8BArF,EAAAA,KAAK,CAAC,gCAAD,CAAL;AACAK,EAAAA,IAAI;AACL","sourcesContent":["import _ from 'lodash';\nimport buildDebug from 'debug';\n\nimport {\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n isObject,\n stringToMD5,\n ErrorCode,\n} from '@verdaccio/utils';\n\nimport { NextFunction, Request, Response } from 'express';\n\nimport { Config, Package, RemoteUser, Logger } from '@verdaccio/types';\nimport { logger } from '@verdaccio/logger';\nimport { IAuth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADER_TYPE,\n HEADERS,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n} from '@verdaccio/commons-api';\nimport { HttpError } from 'http-errors';\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(ErrorCode.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(ErrorCode.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n ErrorCode.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(ErrorCode.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(ErrorCode.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: IAuth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw ErrorCode.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"file":"middleware.js"}
1
+ {"version":3,"sources":["../src/middleware.ts"],"names":["debug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","errorUtils","getForbidden","validatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","isObject","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,oBAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;AACzC,SAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;AACN,QAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;AACtBD,MAAAA,IAAI;AACL,KAFD,MAEO;AACLA,MAAAA,IAAI,CAAC,OAAD,CAAJ;AACD;AACF,GAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN;AACAD,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;AACAP,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;AACAR,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;AACAT,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQI,GAAnB,EAAwB,eAAxB;AACAT,EAAAA,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,yBAAiBC,KAAjB,CAAJ,EAA6B;AAClCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAWC,YAAX,CAAwB,aAAaF,IAArC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASG,eAAT,CACLhB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,4BAAoBC,KAApB,CAAJ,EAAgC;AACrCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAWC,YAAX,CAAwB,aAAaF,IAArC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASI,KAAT,CAAeC,MAAf,EAA2C;AAChD,SAAO,UAAUlB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYC,kBAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;AACpDhB,MAAAA,IAAI,CACFY,iBAAWQ,OAAX,CACEC,kBAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGElB,GAAG,CAACmB,OAAJ,CAAYC,kBAAYC,YAAxB,CALJ,CADE,CAAJ;AASD,KAVD,MAUO;AACLnB,MAAAA,IAAI;AACL;AACF,GAdD;AAeD;;AAEM,SAASuB,kBAAT,CACLzB,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAIF,GAAG,CAAC0B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;AAC/B;AACA3B,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAAC0B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;AACD;;AACD1B,EAAAA,IAAI;AACL;;AAEM,SAAS2B,UAAT,CACL7B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAI,CAAC,qBAASF,GAAG,CAAC8B,IAAb,CAAL,EAAyB;AACvB,WAAO5B,IAAI,CAACY,iBAAWiB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;AACD;;AACD7B,EAAAA,IAAI;AACL;;AAEM,SAAS8B,QAAT,CAAkBC,MAAlB,EAA4C;AACjD,SAAO,UAAUjC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,IAAmB,IAAvB,EAA6B;AAC3B,YAAMC,GAAG,GAAGnC,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;AAEA,WAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;AACnC,cAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAOvC,KAAP,CAAa,kBAAb,CAAV;;AACA,YAAIyC,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;AAClC,iBAAOtC,IAAI,CAACY,iBAAWQ,OAAX,CAAmBC,kBAAYkB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;AACD;AACF;AACF;;AACDvC,IAAAA,IAAI;AACL,GAZD;AAaD;;AAEM,SAASwC,KAAT,CAAeC,IAAf,EAAsC;AAC3C,SAAO,UAAUC,MAAV,EAAoC;AACzC,WAAO,UAAU5C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxFF,MAAAA,GAAG,CAAC6C,KAAJ;AACA,YAAMC,WAAW,GAAG9C,GAAG,CAAC+C,MAAJ,CAAWC,KAAX,GACf,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWC,KAAM,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBjD,GAAG,CAAC+C,MAAJ,CAAWE,OAFf;AAGA,YAAMC,cAAc,GAAGlD,GAAG,CAAC+C,MAAJ,CAAWI,QAAX,GACnB,4CAAsBnD,GAAG,CAAC+C,MAAJ,CAAWI,QAAjC,CADmB,GAEnBC,SAFJ;AAGA,YAAMC,MAAM,GAAGrD,GAAG,CAACsD,WAAnB;;AACAC,qBAAOC,KAAP,CACE;AAAEZ,QAAAA,MAAF;AAAUa,QAAAA,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAExC;AAAxB,OADF,EAEG,iDAFH;;AAIA8B,MAAAA,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;AAAEE,QAAAA,WAAF;AAAeI,QAAAA;AAAf,OADF,EAEEG,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;AAC9B3D,QAAAA,GAAG,CAAC4D,MAAJ;;AACA,YAAIF,KAAJ,EAAW;AACTxD,UAAAA,IAAI,CAACwD,KAAD,CAAJ;AACD,SAFD,MAEO,IAAIC,OAAJ,EAAa;AAClBzD,UAAAA,IAAI;AACL,SAFM,MAEA;AACL;AACA;AACA,gBAAMY,iBAAW+C,gBAAX,CAA4BC,gBAAUC,YAAtC,CAAN;AACD;AACF,OAdH;AAgBD,KA7BD;AA8BD,GA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLlC,IADK,EAEL9B,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;AACN,MAAID,GAAG,CAACgE,UAAJ,KAAmB1C,kBAAY2C,YAA/B,IAA+C,CAACjE,GAAG,CAACkE,SAAJ,CAAc5D,cAAQ6D,QAAtB,CAApD,EAAqF;AACnF;AACAnE,IAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQ6D,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;AACD;;AAED,MAAI;AACF,QAAIC,gBAAEC,QAAF,CAAW1C,IAAX,KAAoByC,gBAAEE,QAAF,CAAW3C,IAAX,CAAxB,EAA0C;AACxC,UAAI,CAAC7B,GAAG,CAACkE,SAAJ,CAAc5D,cAAQc,YAAtB,CAAL,EAA0C;AACxCpB,QAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQc,YAAnB,EAAiCd,cAAQmE,IAAzC;AACD;;AAED,UAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4ByC,gBAAEI,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;AACvD,YAAI,OAAQA,IAAD,CAA0B4B,KAAjC,KAA2C,QAA/C,EAAyD;AACvDzD,UAAAA,GAAG,CAAC2E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B4B,KAAxD,CADuD,CAEvD;AACD;;AACD5B,QAAAA,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBsB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;AACD,OAXuC,CAaxC;;;AACA,UACE,CAACnD,GAAG,CAACgE,UAAL,IACChE,GAAG,CAACgE,UAAJ,IAAkB1C,kBAAYwD,EAA9B,IAAoC9E,GAAG,CAACgE,UAAJ,GAAiB1C,kBAAYyD,gBAFpE,EAGE;AACA/E,QAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQ0E,IAAnB,EAAyB,MAAM,wBAAYnD,IAAZ,CAAN,GAAoC,GAA7D;AACD;AACF,KApBD,MAoBO,CACL;AACD;AACF,GAxBD,CAwBE,OAAOoD,GAAP,EAAiB;AACjB;AACA;AACA;AACA,QAAIA,GAAG,CAACC,OAAJ,CAAYrF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;AACxD,UAAIyE,gBAAEI,KAAF,CAAQ1E,GAAG,CAACmF,MAAZ,MAAwB,KAA5B,EAAmC;AAAA;;AACjC,uBAAAnF,GAAG,CAACmF,MAAJ,4DAAYC,OAAZ;AACD;;AACD;AACD;;AACD,UAAMH,GAAN;AACD;;AAEDjF,EAAAA,GAAG,CAACqF,IAAJ,CAASxD,IAAT;AACD,C,CAED;;;AACO,MAAMyD,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa1F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;AAC3F;AACAF,EAAAA,GAAG,CAAC0F,GAAJ,GAAUnC,eAAOoC,KAAP,CAAa;AAAEC,IAAAA,GAAG,EAAE;AAAP,GAAb,CAAV;AAEA,QAAMC,KAAK,GAAG7F,GAAG,CAACmB,OAAJ,CAAY2E,aAA1B;;AACA,MAAIvB,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4B,cAA5B;AACD;;AAED,QAAMC,OAAO,GAAG/F,GAAG,CAACmB,OAAJ,CAAY6E,MAA5B;;AACA,MAAIzB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqB,cAArB;AACD;;AAEDhG,EAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,EAAAA,GAAG,CAAC0F,GAAJ,CAAQQ,IAAR,CAAa;AAAElG,IAAAA,GAAG,EAAEA,GAAP;AAAYmG,IAAAA,EAAE,EAAEnG,GAAG,CAACmG;AAApB,GAAb,EAAuC,4CAAvC;AACAnG,EAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;;AAEA,MAAI6C,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4BD,KAA5B;AACD;;AAED,MAAItB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqBD,OAArB;AACD;;AAED,MAAIK,OAAO,GAAG,CAAd;AACApG,EAAAA,GAAG,CAACqG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;AACpCF,IAAAA,OAAO,IAAIE,KAAK,CAAChE,MAAjB;AACD,GAFD;AAIA,MAAIiE,QAAQ,GAAG,CAAf;AACA,QAAMC,MAAM,GAAGvG,GAAG,CAACwG,KAAnB,CAhC2F,CAiC3F;AACA;;AACAxG,EAAAA,GAAG,CAACwG,KAAJ,GAAY,UAAUC,GAAV,EAAwB;AAClCH,IAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACA;AACA;;AACAkE,IAAAA,MAAM,CAACG,KAAP,CAAa1G,GAAb,EAAkB2G,SAAlB;AACD,GALD;;AAOA,QAAMlB,GAAG,GAAG,YAAkB;AAC5B,UAAMmB,YAAY,GAAG7G,GAAG,CAACmB,OAAJ,CAAY,iBAAZ,CAArB;AACA,UAAM2F,aAAa,GAAG9G,GAAG,CAAC+G,UAAJ,CAAeD,aAArC;AACA,UAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;AACA,QAAI3B,OAAJ;;AACA,QAAIlF,GAAG,CAAC2E,MAAJ,CAAWC,gBAAf,EAAiC;AAC/BM,MAAAA,OAAO,GAAGK,mBAAV;AACD,KAFD,MAEO;AACLL,MAAAA,OAAO,GAAGM,mBAAV;AACD;;AAEDzF,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,IAAAA,GAAG,CAAC0F,GAAJ,CAAQuB,IAAR,CACE;AACEC,MAAAA,OAAO,EAAE;AACPC,QAAAA,MAAM,EAAEnH,GAAG,CAACmH,MADL;AAEPzF,QAAAA,GAAG,EAAE1B,GAAG,CAAC0B;AAFF,OADX;AAKE+B,MAAAA,IAAI,EAAGzD,GAAG,CAACsD,WAAJ,IAAmBtD,GAAG,CAACsD,WAAJ,CAAgBzC,IAApC,IAA6C,IALrD;AAMEmG,MAAAA,QANF;AAOEI,MAAAA,MAAM,EAAEnH,GAAG,CAACgE,UAPd;AAQEP,MAAAA,KAAK,EAAEzD,GAAG,CAAC2E,MAAJ,CAAWC,gBARpB;AASEwC,MAAAA,KAAK,EAAE;AACLC,QAAAA,EAAE,EAAElB,OADC;AAELmB,QAAAA,GAAG,EAAEhB;AAFA;AATT,KADF,EAeEpB,OAfF;AAiBAnF,IAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;AACD,GA9BD;;AAgCA1B,EAAAA,GAAG,CAACqG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;AAChCX,IAAAA,GAAG;AACJ,GAFD;AAIA,QAAM8B,IAAI,GAAGvH,GAAG,CAACwH,GAAjB;;AACAxH,EAAAA,GAAG,CAACwH,GAAJ,GAAU,UAAUf,GAAV,EAAqB;AAC7B,QAAIA,GAAJ,EAAS;AACPH,MAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACD;AACD;AACA;;;AACAkF,IAAAA,IAAI,CAACb,KAAL,CAAW1G,GAAX,EAAgB2G,SAAhB;;AACAlB,IAAAA,GAAG;AACJ,GARD;;AASAxF,EAAAA,IAAI;AACL;;AAEM,SAASwH,WAAT,CACLxC,GADK,EAELlF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;AACAL,EAAAA,KAAK,CAAC,oBAAD,CAAL;;AACA,MAAI0E,gBAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;AAClBrF,IAAAA,KAAK,CAAC,iBAAD,CAAL;;AACA,QAAIqF,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B3H,GAAG,CAACgE,UAAJ,KAAmB1C,kBAAYsG,YAAhE,EAA8E;AAC5E,aAAO3H,IAAI,EAAX;AACD;;AACD,QAAIqE,gBAAEuD,UAAF,CAAa7H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAxB,MAA0C,KAA9C,EAAqD;AACnDlI,MAAAA,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;AACA;;AACAmI,MAAAA,wBAAwB,CAAChI,GAAD,EAAMC,GAAN,EAAWsE,gBAAE0D,IAAb,CAAxB;AACD;;AACDpI,IAAAA,KAAK,CAAC,6BAAD,CAAL;AACAI,IAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,CAAwB7C,GAAxB;AACD,GAbD,MAaO;AACL;AACArF,IAAAA,KAAK,CAAC,qCAAD,CAAL;AACA,WAAOK,IAAI,CAACgF,GAAD,CAAX;AACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLhI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACNL,EAAAA,KAAK,CAAC,yBAAD,CAAL;;AACAI,EAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,GACE9H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,IACA,UAAU7C,GAAV,EAAqC;AACnC,QAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc7F,kBAAY2G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;AAC3EvH,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA,UAAI7C,gBAAEI,KAAF,CAAQ1E,GAAG,CAACkI,WAAZ,MAA6B,KAAjC,EAAwC;AACtCtI,QAAAA,KAAK,CAAC,gBAAD,EAAmBqF,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;AACAnH,QAAAA,GAAG,CAACmH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;AACAvH,QAAAA,KAAK,CAAC,eAAD,EAAkBqF,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;AACAjF,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,gBAAUsE;AAAlC,SAAD,CAAJ;AACD;AACF,KARD,MAQO;AACLvI,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA7D,qBAAOG,KAAP,CAAa;AAAEwB,QAAAA,GAAG,EAAEA;AAAP,OAAb,EAA2B,iDAA3B;;AACA,UAAI,CAACjF,GAAG,CAACmH,MAAL,IAAe,CAACnH,GAAG,CAACqF,IAAxB,EAA8B;AAC5B;AACA/B,uBAAOG,KAAP,CAAa,oDAAb;;AACA7D,QAAAA,KAAK,CAAC,yEAAD,EAA4EqF,GAA5E,CAAL;AACAjF,QAAAA,GAAG,CAACoF,OAAJ;AACD,OALD,MAKO,IAAI,CAACpF,GAAG,CAACkI,WAAT,EAAsB;AAC3BtI,QAAAA,KAAK,CAAC,0BAAD,EAA6BqF,GAA7B,CAAL;AACAjF,QAAAA,GAAG,CAACmH,MAAJ,CAAW7F,kBAAY8G,cAAvB;AACAnI,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEI,gBAAUwE;AAAnB,SAAD,CAAJ;AACD,OAJM,MAIA;AACL;AACAzI,QAAAA,KAAK,CAAC,6CAAD,EAAgDqF,GAAhD,CAAL;AACD;AACF;AACF,GA5BH;;AA8BArF,EAAAA,KAAK,CAAC,gCAAD,CAAL;AACAK,EAAAA,IAAI;AACL","sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { IAuth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: IAuth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"file":"middleware.js"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@verdaccio/middleware",
3
- "version": "6.0.0-6-next.12",
3
+ "version": "6.0.0-6-next.16",
4
4
  "description": "loaders logic",
5
5
  "main": "./build/index.js",
6
6
  "types": "build/index.d.ts",
@@ -26,15 +26,16 @@
26
26
  "verdaccio"
27
27
  ],
28
28
  "engines": {
29
- "node": ">=10",
29
+ "node": ">=14",
30
30
  "npm": ">=6"
31
31
  },
32
32
  "dependencies": {
33
- "debug": "4.3.2",
34
- "@verdaccio/auth": "6.0.0-6-next.12",
35
- "@verdaccio/commons-api": "11.0.0-6-next.4",
36
- "@verdaccio/logger": "6.0.0-6-next.5",
37
- "@verdaccio/utils": "6.0.0-6-next.6",
33
+ "debug": "4.3.3",
34
+ "body-parser": "1.19.1",
35
+ "@verdaccio/auth": "6.0.0-6-next.16",
36
+ "@verdaccio/core": "6.0.0-6-next.4",
37
+ "@verdaccio/logger": "6.0.0-6-next.8",
38
+ "@verdaccio/utils": "6.0.0-6-next.10",
38
39
  "lodash": "4.17.21"
39
40
  },
40
41
  "funding": {
package/src/middleware-utils.ts CHANGED
@@ -4,7 +4,7 @@
4
4
  * @returns {String}
5
5
  */
6
6
  export function getVersionFromTarball(name: string): string | void {
7
- // FIXME: we know the regex is valid, but we should improve this part as ts suggest
8
- // @ts-ignore
9
- return /.+-(\d.+)\.tgz/.test(name) ? name.match(/.+-(\d.+)\.tgz/)[1] : undefined;
7
+ const groups = name.match(/.+-(\d.+)\.tgz/);
8
+
9
+ return groups !== null ? groups[1] : undefined;
10
10
  }
package/src/middleware.ts CHANGED
@@ -1,29 +1,28 @@
1
- import _ from 'lodash';
2
1
  import buildDebug from 'debug';
3
-
4
- import {
5
- validateName as utilValidateName,
6
- validatePackage as utilValidatePackage,
7
- isObject,
8
- stringToMD5,
9
- ErrorCode,
10
- } from '@verdaccio/utils';
11
-
12
2
  import { NextFunction, Request, Response } from 'express';
3
+ import { HttpError } from 'http-errors';
4
+ import _ from 'lodash';
13
5
 
14
- import { Config, Package, RemoteUser, Logger } from '@verdaccio/types';
15
- import { logger } from '@verdaccio/logger';
16
6
  import { IAuth } from '@verdaccio/auth';
17
7
  import {
18
8
  API_ERROR,
19
- HEADER_TYPE,
20
9
  HEADERS,
10
+ HEADER_TYPE,
21
11
  HTTP_STATUS,
22
12
  TOKEN_BASIC,
23
13
  TOKEN_BEARER,
24
14
  VerdaccioError,
25
- } from '@verdaccio/commons-api';
26
- import { HttpError } from 'http-errors';
15
+ errorUtils,
16
+ } from '@verdaccio/core';
17
+ import { logger } from '@verdaccio/logger';
18
+ import { Config, Logger, Package, RemoteUser } from '@verdaccio/types';
19
+ import {
20
+ isObject,
21
+ stringToMD5,
22
+ validateName as utilValidateName,
23
+ validatePackage as utilValidatePackage,
24
+ } from '@verdaccio/utils';
25
+
27
26
  import { getVersionFromTarball } from './middleware-utils';
28
27
 
29
28
  export type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };
@@ -78,7 +77,7 @@ export function validateName(
78
77
  } else if (utilValidateName(value)) {
79
78
  next();
80
79
  } else {
81
- next(ErrorCode.getForbidden('invalid ' + name));
80
+ next(errorUtils.getForbidden('invalid ' + name));
82
81
  }
83
82
  }
84
83
 
@@ -95,7 +94,7 @@ export function validatePackage(
95
94
  } else if (utilValidatePackage(value)) {
96
95
  next();
97
96
  } else {
98
- next(ErrorCode.getForbidden('invalid ' + name));
97
+ next(errorUtils.getForbidden('invalid ' + name));
99
98
  }
100
99
  }
101
100
 
@@ -103,7 +102,7 @@ export function media(expect: string | null): any {
103
102
  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
104
103
  if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {
105
104
  next(
106
- ErrorCode.getCode(
105
+ errorUtils.getCode(
107
106
  HTTP_STATUS.UNSUPPORTED_MEDIA,
108
107
  'wrong content-type, expect: ' +
109
108
  expect +
@@ -135,7 +134,7 @@ export function expectJson(
135
134
  next: $NextFunctionVer
136
135
  ): void {
137
136
  if (!isObject(req.body)) {
138
- return next(ErrorCode.getBadRequest("can't parse incoming json"));
137
+ return next(errorUtils.getBadRequest("can't parse incoming json"));
139
138
  }
140
139
  next();
141
140
  }
@@ -148,7 +147,7 @@ export function antiLoop(config: Config): Function {
148
147
  for (let i = 0; i < arr.length; i++) {
149
148
  const m = arr[i].match(/\s*(\S+)\s+(\S+)/);
150
149
  if (m && m[2] === config.server_id) {
151
- return next(ErrorCode.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
150
+ return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
152
151
  }
153
152
  }
154
153
  }
@@ -183,7 +182,7 @@ export function allow(auth: IAuth): Function {
183
182
  } else {
184
183
  // last plugin (that's our built-in one) returns either
185
184
  // cb(err) or cb(null, true), so this should never happen
186
- throw ErrorCode.getInternalError(API_ERROR.PLUGIN_ERROR);
185
+ throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);
187
186
  }
188
187
  }
189
188
  );
package/types/custom.d.ts CHANGED
@@ -1,6 +1,6 @@
1
1
  // <reference types="node" />
2
-
3
2
  import * as http from 'http';
3
+
4
4
  import { Logger, RemoteUser } from '@verdaccio/types';
5
5
 
6
6
  declare global {