@verdaccio/middleware 6.0.0-6-next.13 → 6.0.0-6-next.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/CHANGELOG.md +44 -0
  2. package/build/middleware.d.ts +2 -2
  3. package/build/middleware.js +14 -14
  4. package/build/middleware.js.map +1 -1
  5. package/package.json +7 -6
  6. package/src/middleware.ts +13 -14
  7. package/types/custom.d.ts +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,49 @@
1
1
  # @verdaccio/middleware
2
2
 
3
+ ## 6.0.0-6-next.17
4
+
5
+ ### Patch Changes
6
+
7
+ - Updated dependencies [730b5d8c]
8
+ - @verdaccio/logger@6.0.0-6-next.9
9
+ - @verdaccio/auth@6.0.0-6-next.17
10
+
11
+ ## 6.0.0-6-next.16
12
+
13
+ ### Minor Changes
14
+
15
+ - 24b9be02: refactor: improve docker image build with strict dependencies and prod build
16
+
17
+ ### Patch Changes
18
+
19
+ - Updated dependencies [a828271d]
20
+ - Updated dependencies [24b9be02]
21
+ - Updated dependencies [e75c0a3b]
22
+ - Updated dependencies [b13a3fef]
23
+ - @verdaccio/utils@6.0.0-6-next.10
24
+ - @verdaccio/core@6.0.0-6-next.4
25
+ - @verdaccio/logger@6.0.0-6-next.8
26
+ - @verdaccio/auth@6.0.0-6-next.16
27
+
28
+ ## 6.0.0-6-next.15
29
+
30
+ ### Patch Changes
31
+
32
+ - Updated dependencies [f86c31ed]
33
+ - Updated dependencies [20c9e43e]
34
+ - @verdaccio/utils@6.0.0-6-next.9
35
+ - @verdaccio/auth@6.0.0-6-next.15
36
+
37
+ ## 6.0.0-6-next.14
38
+
39
+ ### Patch Changes
40
+
41
+ - Updated dependencies [6c1eb021]
42
+ - @verdaccio/core@6.0.0-6-next.3
43
+ - @verdaccio/logger@6.0.0-6-next.7
44
+ - @verdaccio/auth@6.0.0-6-next.14
45
+ - @verdaccio/utils@6.0.0-6-next.8
46
+
3
47
  ## 6.0.0-6-next.13
4
48
 
5
49
  ### Major Changes
package/build/middleware.d.ts CHANGED
@@ -1,7 +1,7 @@
1
1
  import { NextFunction, Request, Response } from 'express';
2
- import { Config, Package, RemoteUser, Logger } from '@verdaccio/types';
3
- import { IAuth } from '@verdaccio/auth';
4
2
  import { HttpError } from 'http-errors';
3
+ import { IAuth } from '@verdaccio/auth';
4
+ import { Config, Logger, Package, RemoteUser } from '@verdaccio/types';
5
5
  export declare type $RequestExtend = Request & {
6
6
  remote_user?: RemoteUser;
7
7
  log: Logger;
package/build/middleware.js CHANGED
@@ -3,30 +3,30 @@
3
3
  Object.defineProperty(exports, "__esModule", {
4
4
  value: true
5
5
  });
6
- exports.match = match;
7
- exports.setSecurityWebHeaders = setSecurityWebHeaders;
8
- exports.validateName = validateName;
9
- exports.validatePackage = validatePackage;
10
- exports.media = media;
6
+ exports.LOG_VERDACCIO_ERROR = exports.LOG_VERDACCIO_BYTES = exports.LOG_STATUS_MESSAGE = void 0;
7
+ exports.allow = allow;
8
+ exports.antiLoop = antiLoop;
11
9
  exports.encodeScopePackage = encodeScopePackage;
10
+ exports.errorReportingMiddleware = errorReportingMiddleware;
12
11
  exports.expectJson = expectJson;
13
- exports.antiLoop = antiLoop;
14
- exports.allow = allow;
15
12
  exports.final = final;
16
- exports.log = log;
17
13
  exports.handleError = handleError;
18
- exports.errorReportingMiddleware = errorReportingMiddleware;
19
- exports.LOG_VERDACCIO_BYTES = exports.LOG_VERDACCIO_ERROR = exports.LOG_STATUS_MESSAGE = void 0;
20
-
21
- var _lodash = _interopRequireDefault(require("lodash"));
14
+ exports.log = log;
15
+ exports.match = match;
16
+ exports.media = media;
17
+ exports.setSecurityWebHeaders = setSecurityWebHeaders;
18
+ exports.validateName = validateName;
19
+ exports.validatePackage = validatePackage;
22
20
 
23
21
  var _debug = _interopRequireDefault(require("debug"));
24
22
 
25
- var _utils = require("@verdaccio/utils");
23
+ var _lodash = _interopRequireDefault(require("lodash"));
24
+
25
+ var _core = require("@verdaccio/core");
26
26
 
27
27
  var _logger = require("@verdaccio/logger");
28
28
 
29
- var _core = require("@verdaccio/core");
29
+ var _utils = require("@verdaccio/utils");
30
30
 
31
31
  var _middlewareUtils = require("./middleware-utils");
32
32
 
package/build/middleware.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../src/middleware.ts"],"names":["debug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","errorUtils","getForbidden","validatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","isObject","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AACA;;AAEA;;AAUA;;AAEA;;AAWA;;;;AAMA,MAAMA,KAAK,GAAG,oBAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;AACzC,SAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;AACN,QAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;AACtBD,MAAAA,IAAI;AACL,KAFD,MAEO;AACLA,MAAAA,IAAI,CAAC,OAAD,CAAJ;AACD;AACF,GAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN;AACAD,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;AACAP,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;AACAR,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;AACAT,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQI,GAAnB,EAAwB,eAAxB;AACAT,EAAAA,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,yBAAiBC,KAAjB,CAAJ,EAA6B;AAClCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAWC,YAAX,CAAwB,aAAaF,IAArC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASG,eAAT,CACLhB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,4BAAoBC,KAApB,CAAJ,EAAgC;AACrCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAWC,YAAX,CAAwB,aAAaF,IAArC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASI,KAAT,CAAeC,MAAf,EAA2C;AAChD,SAAO,UAAUlB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYC,kBAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;AACpDhB,MAAAA,IAAI,CACFY,iBAAWQ,OAAX,CACEC,kBAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGElB,GAAG,CAACmB,OAAJ,CAAYC,kBAAYC,YAAxB,CALJ,CADE,CAAJ;AASD,KAVD,MAUO;AACLnB,MAAAA,IAAI;AACL;AACF,GAdD;AAeD;;AAEM,SAASuB,kBAAT,CACLzB,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAIF,GAAG,CAAC0B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;AAC/B;AACA3B,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAAC0B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;AACD;;AACD1B,EAAAA,IAAI;AACL;;AAEM,SAAS2B,UAAT,CACL7B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAI,CAAC,qBAASF,GAAG,CAAC8B,IAAb,CAAL,EAAyB;AACvB,WAAO5B,IAAI,CAACY,iBAAWiB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;AACD;;AACD7B,EAAAA,IAAI;AACL;;AAEM,SAAS8B,QAAT,CAAkBC,MAAlB,EAA4C;AACjD,SAAO,UAAUjC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,IAAmB,IAAvB,EAA6B;AAC3B,YAAMC,GAAG,GAAGnC,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;AAEA,WAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;AACnC,cAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAOvC,KAAP,CAAa,kBAAb,CAAV;;AACA,YAAIyC,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;AAClC,iBAAOtC,IAAI,CAACY,iBAAWQ,OAAX,CAAmBC,kBAAYkB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;AACD;AACF;AACF;;AACDvC,IAAAA,IAAI;AACL,GAZD;AAaD;;AAEM,SAASwC,KAAT,CAAeC,IAAf,EAAsC;AAC3C,SAAO,UAAUC,MAAV,EAAoC;AACzC,WAAO,UAAU5C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxFF,MAAAA,GAAG,CAAC6C,KAAJ;AACA,YAAMC,WAAW,GAAG9C,GAAG,CAAC+C,MAAJ,CAAWC,KAAX,GACf,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWC,KAAM,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBjD,GAAG,CAAC+C,MAAJ,CAAWE,OAFf;AAGA,YAAMC,cAAc,GAAGlD,GAAG,CAAC+C,MAAJ,CAAWI,QAAX,GACnB,4CAAsBnD,GAAG,CAAC+C,MAAJ,CAAWI,QAAjC,CADmB,GAEnBC,SAFJ;AAGA,YAAMC,MAAM,GAAGrD,GAAG,CAACsD,WAAnB;;AACAC,qBAAOC,KAAP,CACE;AAAEZ,QAAAA,MAAF;AAAUa,QAAAA,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAExC;AAAxB,OADF,EAEG,iDAFH;;AAIA8B,MAAAA,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;AAAEE,QAAAA,WAAF;AAAeI,QAAAA;AAAf,OADF,EAEEG,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;AAC9B3D,QAAAA,GAAG,CAAC4D,MAAJ;;AACA,YAAIF,KAAJ,EAAW;AACTxD,UAAAA,IAAI,CAACwD,KAAD,CAAJ;AACD,SAFD,MAEO,IAAIC,OAAJ,EAAa;AAClBzD,UAAAA,IAAI;AACL,SAFM,MAEA;AACL;AACA;AACA,gBAAMY,iBAAW+C,gBAAX,CAA4BC,gBAAUC,YAAtC,CAAN;AACD;AACF,OAdH;AAgBD,KA7BD;AA8BD,GA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLlC,IADK,EAEL9B,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;AACN,MAAID,GAAG,CAACgE,UAAJ,KAAmB1C,kBAAY2C,YAA/B,IAA+C,CAACjE,GAAG,CAACkE,SAAJ,CAAc5D,cAAQ6D,QAAtB,CAApD,EAAqF;AACnF;AACAnE,IAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQ6D,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;AACD;;AAED,MAAI;AACF,QAAIC,gBAAEC,QAAF,CAAW1C,IAAX,KAAoByC,gBAAEE,QAAF,CAAW3C,IAAX,CAAxB,EAA0C;AACxC,UAAI,CAAC7B,GAAG,CAACkE,SAAJ,CAAc5D,cAAQc,YAAtB,CAAL,EAA0C;AACxCpB,QAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQc,YAAnB,EAAiCd,cAAQmE,IAAzC;AACD;;AAED,UAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4ByC,gBAAEI,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;AACvD,YAAI,OAAQA,IAAD,CAA0B4B,KAAjC,KAA2C,QAA/C,EAAyD;AACvDzD,UAAAA,GAAG,CAAC2E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B4B,KAAxD,CADuD,CAEvD;AACD;;AACD5B,QAAAA,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBsB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;AACD,OAXuC,CAaxC;;;AACA,UACE,CAACnD,GAAG,CAACgE,UAAL,IACChE,GAAG,CAACgE,UAAJ,IAAkB1C,kBAAYwD,EAA9B,IAAoC9E,GAAG,CAACgE,UAAJ,GAAiB1C,kBAAYyD,gBAFpE,EAGE;AACA/E,QAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQ0E,IAAnB,EAAyB,MAAM,wBAAYnD,IAAZ,CAAN,GAAoC,GAA7D;AACD;AACF,KApBD,MAoBO,CACL;AACD;AACF,GAxBD,CAwBE,OAAOoD,GAAP,EAAiB;AACjB;AACA;AACA;AACA,QAAIA,GAAG,CAACC,OAAJ,CAAYrF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;AACxD,UAAIyE,gBAAEI,KAAF,CAAQ1E,GAAG,CAACmF,MAAZ,MAAwB,KAA5B,EAAmC;AAAA;;AACjC,uBAAAnF,GAAG,CAACmF,MAAJ,4DAAYC,OAAZ;AACD;;AACD;AACD;;AACD,UAAMH,GAAN;AACD;;AAEDjF,EAAAA,GAAG,CAACqF,IAAJ,CAASxD,IAAT;AACD,C,CAED;;;AACO,MAAMyD,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa1F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;AAC3F;AACAF,EAAAA,GAAG,CAAC0F,GAAJ,GAAUnC,eAAOoC,KAAP,CAAa;AAAEC,IAAAA,GAAG,EAAE;AAAP,GAAb,CAAV;AAEA,QAAMC,KAAK,GAAG7F,GAAG,CAACmB,OAAJ,CAAY2E,aAA1B;;AACA,MAAIvB,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4B,cAA5B;AACD;;AAED,QAAMC,OAAO,GAAG/F,GAAG,CAACmB,OAAJ,CAAY6E,MAA5B;;AACA,MAAIzB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqB,cAArB;AACD;;AAEDhG,EAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,EAAAA,GAAG,CAAC0F,GAAJ,CAAQQ,IAAR,CAAa;AAAElG,IAAAA,GAAG,EAAEA,GAAP;AAAYmG,IAAAA,EAAE,EAAEnG,GAAG,CAACmG;AAApB,GAAb,EAAuC,4CAAvC;AACAnG,EAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;;AAEA,MAAI6C,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4BD,KAA5B;AACD;;AAED,MAAItB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqBD,OAArB;AACD;;AAED,MAAIK,OAAO,GAAG,CAAd;AACApG,EAAAA,GAAG,CAACqG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;AACpCF,IAAAA,OAAO,IAAIE,KAAK,CAAChE,MAAjB;AACD,GAFD;AAIA,MAAIiE,QAAQ,GAAG,CAAf;AACA,QAAMC,MAAM,GAAGvG,GAAG,CAACwG,KAAnB,CAhC2F,CAiC3F;AACA;;AACAxG,EAAAA,GAAG,CAACwG,KAAJ,GAAY,UAAUC,GAAV,EAAwB;AAClCH,IAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACA;AACA;;AACAkE,IAAAA,MAAM,CAACG,KAAP,CAAa1G,GAAb,EAAkB2G,SAAlB;AACD,GALD;;AAOA,QAAMlB,GAAG,GAAG,YAAkB;AAC5B,UAAMmB,YAAY,GAAG7G,GAAG,CAACmB,OAAJ,CAAY,iBAAZ,CAArB;AACA,UAAM2F,aAAa,GAAG9G,GAAG,CAAC+G,UAAJ,CAAeD,aAArC;AACA,UAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;AACA,QAAI3B,OAAJ;;AACA,QAAIlF,GAAG,CAAC2E,MAAJ,CAAWC,gBAAf,EAAiC;AAC/BM,MAAAA,OAAO,GAAGK,mBAAV;AACD,KAFD,MAEO;AACLL,MAAAA,OAAO,GAAGM,mBAAV;AACD;;AAEDzF,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,IAAAA,GAAG,CAAC0F,GAAJ,CAAQuB,IAAR,CACE;AACEC,MAAAA,OAAO,EAAE;AACPC,QAAAA,MAAM,EAAEnH,GAAG,CAACmH,MADL;AAEPzF,QAAAA,GAAG,EAAE1B,GAAG,CAAC0B;AAFF,OADX;AAKE+B,MAAAA,IAAI,EAAGzD,GAAG,CAACsD,WAAJ,IAAmBtD,GAAG,CAACsD,WAAJ,CAAgBzC,IAApC,IAA6C,IALrD;AAMEmG,MAAAA,QANF;AAOEI,MAAAA,MAAM,EAAEnH,GAAG,CAACgE,UAPd;AAQEP,MAAAA,KAAK,EAAEzD,GAAG,CAAC2E,MAAJ,CAAWC,gBARpB;AASEwC,MAAAA,KAAK,EAAE;AACLC,QAAAA,EAAE,EAAElB,OADC;AAELmB,QAAAA,GAAG,EAAEhB;AAFA;AATT,KADF,EAeEpB,OAfF;AAiBAnF,IAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;AACD,GA9BD;;AAgCA1B,EAAAA,GAAG,CAACqG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;AAChCX,IAAAA,GAAG;AACJ,GAFD;AAIA,QAAM8B,IAAI,GAAGvH,GAAG,CAACwH,GAAjB;;AACAxH,EAAAA,GAAG,CAACwH,GAAJ,GAAU,UAAUf,GAAV,EAAqB;AAC7B,QAAIA,GAAJ,EAAS;AACPH,MAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACD;AACD;AACA;;;AACAkF,IAAAA,IAAI,CAACb,KAAL,CAAW1G,GAAX,EAAgB2G,SAAhB;;AACAlB,IAAAA,GAAG;AACJ,GARD;;AASAxF,EAAAA,IAAI;AACL;;AAEM,SAASwH,WAAT,CACLxC,GADK,EAELlF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;AACAL,EAAAA,KAAK,CAAC,oBAAD,CAAL;;AACA,MAAI0E,gBAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;AAClBrF,IAAAA,KAAK,CAAC,iBAAD,CAAL;;AACA,QAAIqF,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B3H,GAAG,CAACgE,UAAJ,KAAmB1C,kBAAYsG,YAAhE,EAA8E;AAC5E,aAAO3H,IAAI,EAAX;AACD;;AACD,QAAIqE,gBAAEuD,UAAF,CAAa7H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAxB,MAA0C,KAA9C,EAAqD;AACnDlI,MAAAA,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;AACA;;AACAmI,MAAAA,wBAAwB,CAAChI,GAAD,EAAMC,GAAN,EAAWsE,gBAAE0D,IAAb,CAAxB;AACD;;AACDpI,IAAAA,KAAK,CAAC,6BAAD,CAAL;AACAI,IAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,CAAwB7C,GAAxB;AACD,GAbD,MAaO;AACL;AACArF,IAAAA,KAAK,CAAC,qCAAD,CAAL;AACA,WAAOK,IAAI,CAACgF,GAAD,CAAX;AACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLhI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACNL,EAAAA,KAAK,CAAC,yBAAD,CAAL;;AACAI,EAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,GACE9H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,IACA,UAAU7C,GAAV,EAAqC;AACnC,QAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc7F,kBAAY2G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;AAC3EvH,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA,UAAI7C,gBAAEI,KAAF,CAAQ1E,GAAG,CAACkI,WAAZ,MAA6B,KAAjC,EAAwC;AACtCtI,QAAAA,KAAK,CAAC,gBAAD,EAAmBqF,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;AACAnH,QAAAA,GAAG,CAACmH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;AACAvH,QAAAA,KAAK,CAAC,eAAD,EAAkBqF,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;AACAjF,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,gBAAUsE;AAAlC,SAAD,CAAJ;AACD;AACF,KARD,MAQO;AACLvI,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA7D,qBAAOG,KAAP,CAAa;AAAEwB,QAAAA,GAAG,EAAEA;AAAP,OAAb,EAA2B,iDAA3B;;AACA,UAAI,CAACjF,GAAG,CAACmH,MAAL,IAAe,CAACnH,GAAG,CAACqF,IAAxB,EAA8B;AAC5B;AACA/B,uBAAOG,KAAP,CAAa,oDAAb;;AACA7D,QAAAA,KAAK,CAAC,yEAAD,EAA4EqF,GAA5E,CAAL;AACAjF,QAAAA,GAAG,CAACoF,OAAJ;AACD,OALD,MAKO,IAAI,CAACpF,GAAG,CAACkI,WAAT,EAAsB;AAC3BtI,QAAAA,KAAK,CAAC,0BAAD,EAA6BqF,GAA7B,CAAL;AACAjF,QAAAA,GAAG,CAACmH,MAAJ,CAAW7F,kBAAY8G,cAAvB;AACAnI,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEI,gBAAUwE;AAAnB,SAAD,CAAJ;AACD,OAJM,MAIA;AACL;AACAzI,QAAAA,KAAK,CAAC,6CAAD,EAAgDqF,GAAhD,CAAL;AACD;AACF;AACF,GA5BH;;AA8BArF,EAAAA,KAAK,CAAC,gCAAD,CAAL;AACAK,EAAAA,IAAI;AACL","sourcesContent":["import _ from 'lodash';\nimport buildDebug from 'debug';\n\nimport {\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n isObject,\n stringToMD5,\n} from '@verdaccio/utils';\n\nimport { NextFunction, Request, Response } from 'express';\n\nimport { Config, Package, RemoteUser, Logger } from '@verdaccio/types';\nimport { logger } from '@verdaccio/logger';\nimport { IAuth } from '@verdaccio/auth';\nimport {\n errorUtils,\n API_ERROR,\n HEADER_TYPE,\n HEADERS,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n} from '@verdaccio/core';\nimport { HttpError } from 'http-errors';\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: IAuth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"file":"middleware.js"}
1
+ {"version":3,"sources":["../src/middleware.ts"],"names":["debug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","errorUtils","getForbidden","validatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","isObject","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,oBAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;AACzC,SAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;AACN,QAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;AACtBD,MAAAA,IAAI;AACL,KAFD,MAEO;AACLA,MAAAA,IAAI,CAAC,OAAD,CAAJ;AACD;AACF,GAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN;AACAD,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;AACAP,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;AACAR,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;AACAT,EAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQI,GAAnB,EAAwB,eAAxB;AACAT,EAAAA,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,yBAAiBC,KAAjB,CAAJ,EAA6B;AAClCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAWC,YAAX,CAAwB,aAAaF,IAArC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASG,eAAT,CACLhB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;AACN,MAAIV,KAAK,KAAK,GAAd,EAAmB;AACjB;AACAD,IAAAA,IAAI,CAAC,OAAD,CAAJ;AACD,GAHD,MAGO,IAAI,4BAAoBC,KAApB,CAAJ,EAAgC;AACrCD,IAAAA,IAAI;AACL,GAFM,MAEA;AACLA,IAAAA,IAAI,CAACY,iBAAWC,YAAX,CAAwB,aAAaF,IAArC,CAAD,CAAJ;AACD;AACF;;AAEM,SAASI,KAAT,CAAeC,MAAf,EAA2C;AAChD,SAAO,UAAUlB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYC,kBAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;AACpDhB,MAAAA,IAAI,CACFY,iBAAWQ,OAAX,CACEC,kBAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGElB,GAAG,CAACmB,OAAJ,CAAYC,kBAAYC,YAAxB,CALJ,CADE,CAAJ;AASD,KAVD,MAUO;AACLnB,MAAAA,IAAI;AACL;AACF,GAdD;AAeD;;AAEM,SAASuB,kBAAT,CACLzB,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAIF,GAAG,CAAC0B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;AAC/B;AACA3B,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAAC0B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;AACD;;AACD1B,EAAAA,IAAI;AACL;;AAEM,SAAS2B,UAAT,CACL7B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACN,MAAI,CAAC,qBAASF,GAAG,CAAC8B,IAAb,CAAL,EAAyB;AACvB,WAAO5B,IAAI,CAACY,iBAAWiB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;AACD;;AACD7B,EAAAA,IAAI;AACL;;AAEM,SAAS8B,QAAT,CAAkBC,MAAlB,EAA4C;AACjD,SAAO,UAAUjC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxF,QAAIF,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,IAAmB,IAAvB,EAA6B;AAC3B,YAAMC,GAAG,GAAGnC,GAAG,CAACmB,OAAJ,CAAYe,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;AAEA,WAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;AACnC,cAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAOvC,KAAP,CAAa,kBAAb,CAAV;;AACA,YAAIyC,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;AAClC,iBAAOtC,IAAI,CAACY,iBAAWQ,OAAX,CAAmBC,kBAAYkB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;AACD;AACF;AACF;;AACDvC,IAAAA,IAAI;AACL,GAZD;AAaD;;AAEM,SAASwC,KAAT,CAAeC,IAAf,EAAsC;AAC3C,SAAO,UAAUC,MAAV,EAAoC;AACzC,WAAO,UAAU5C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;AACxFF,MAAAA,GAAG,CAAC6C,KAAJ;AACA,YAAMC,WAAW,GAAG9C,GAAG,CAAC+C,MAAJ,CAAWC,KAAX,GACf,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWC,KAAM,IAAGhD,GAAG,CAAC+C,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBjD,GAAG,CAAC+C,MAAJ,CAAWE,OAFf;AAGA,YAAMC,cAAc,GAAGlD,GAAG,CAAC+C,MAAJ,CAAWI,QAAX,GACnB,4CAAsBnD,GAAG,CAAC+C,MAAJ,CAAWI,QAAjC,CADmB,GAEnBC,SAFJ;AAGA,YAAMC,MAAM,GAAGrD,GAAG,CAACsD,WAAnB;;AACAC,qBAAOC,KAAP,CACE;AAAEZ,QAAAA,MAAF;AAAUa,QAAAA,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAExC;AAAxB,OADF,EAEG,iDAFH;;AAIA8B,MAAAA,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;AAAEE,QAAAA,WAAF;AAAeI,QAAAA;AAAf,OADF,EAEEG,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;AAC9B3D,QAAAA,GAAG,CAAC4D,MAAJ;;AACA,YAAIF,KAAJ,EAAW;AACTxD,UAAAA,IAAI,CAACwD,KAAD,CAAJ;AACD,SAFD,MAEO,IAAIC,OAAJ,EAAa;AAClBzD,UAAAA,IAAI;AACL,SAFM,MAEA;AACL;AACA;AACA,gBAAMY,iBAAW+C,gBAAX,CAA4BC,gBAAUC,YAAtC,CAAN;AACD;AACF,OAdH;AAgBD,KA7BD;AA8BD,GA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLlC,IADK,EAEL9B,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;AACN,MAAID,GAAG,CAACgE,UAAJ,KAAmB1C,kBAAY2C,YAA/B,IAA+C,CAACjE,GAAG,CAACkE,SAAJ,CAAc5D,cAAQ6D,QAAtB,CAApD,EAAqF;AACnF;AACAnE,IAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQ6D,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;AACD;;AAED,MAAI;AACF,QAAIC,gBAAEC,QAAF,CAAW1C,IAAX,KAAoByC,gBAAEE,QAAF,CAAW3C,IAAX,CAAxB,EAA0C;AACxC,UAAI,CAAC7B,GAAG,CAACkE,SAAJ,CAAc5D,cAAQc,YAAtB,CAAL,EAA0C;AACxCpB,QAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQc,YAAnB,EAAiCd,cAAQmE,IAAzC;AACD;;AAED,UAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4ByC,gBAAEI,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;AACvD,YAAI,OAAQA,IAAD,CAA0B4B,KAAjC,KAA2C,QAA/C,EAAyD;AACvDzD,UAAAA,GAAG,CAAC2E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B4B,KAAxD,CADuD,CAEvD;AACD;;AACD5B,QAAAA,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBsB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;AACD,OAXuC,CAaxC;;;AACA,UACE,CAACnD,GAAG,CAACgE,UAAL,IACChE,GAAG,CAACgE,UAAJ,IAAkB1C,kBAAYwD,EAA9B,IAAoC9E,GAAG,CAACgE,UAAJ,GAAiB1C,kBAAYyD,gBAFpE,EAGE;AACA/E,QAAAA,GAAG,CAACK,MAAJ,CAAWC,cAAQ0E,IAAnB,EAAyB,MAAM,wBAAYnD,IAAZ,CAAN,GAAoC,GAA7D;AACD;AACF,KApBD,MAoBO,CACL;AACD;AACF,GAxBD,CAwBE,OAAOoD,GAAP,EAAiB;AACjB;AACA;AACA;AACA,QAAIA,GAAG,CAACC,OAAJ,CAAYrF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;AACxD,UAAIyE,gBAAEI,KAAF,CAAQ1E,GAAG,CAACmF,MAAZ,MAAwB,KAA5B,EAAmC;AAAA;;AACjC,uBAAAnF,GAAG,CAACmF,MAAJ,4DAAYC,OAAZ;AACD;;AACD;AACD;;AACD,UAAMH,GAAN;AACD;;AAEDjF,EAAAA,GAAG,CAACqF,IAAJ,CAASxD,IAAT;AACD,C,CAED;;;AACO,MAAMyD,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa1F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;AAC3F;AACAF,EAAAA,GAAG,CAAC0F,GAAJ,GAAUnC,eAAOoC,KAAP,CAAa;AAAEC,IAAAA,GAAG,EAAE;AAAP,GAAb,CAAV;AAEA,QAAMC,KAAK,GAAG7F,GAAG,CAACmB,OAAJ,CAAY2E,aAA1B;;AACA,MAAIvB,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4B,cAA5B;AACD;;AAED,QAAMC,OAAO,GAAG/F,GAAG,CAACmB,OAAJ,CAAY6E,MAA5B;;AACA,MAAIzB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqB,cAArB;AACD;;AAEDhG,EAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,EAAAA,GAAG,CAAC0F,GAAJ,CAAQQ,IAAR,CAAa;AAAElG,IAAAA,GAAG,EAAEA,GAAP;AAAYmG,IAAAA,EAAE,EAAEnG,GAAG,CAACmG;AAApB,GAAb,EAAuC,4CAAvC;AACAnG,EAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;;AAEA,MAAI6C,gBAAEI,KAAF,CAAQkB,KAAR,MAAmB,KAAvB,EAA8B;AAC5B7F,IAAAA,GAAG,CAACmB,OAAJ,CAAY2E,aAAZ,GAA4BD,KAA5B;AACD;;AAED,MAAItB,gBAAEI,KAAF,CAAQoB,OAAR,MAAqB,KAAzB,EAAgC;AAC9B/F,IAAAA,GAAG,CAACmB,OAAJ,CAAY6E,MAAZ,GAAqBD,OAArB;AACD;;AAED,MAAIK,OAAO,GAAG,CAAd;AACApG,EAAAA,GAAG,CAACqG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;AACpCF,IAAAA,OAAO,IAAIE,KAAK,CAAChE,MAAjB;AACD,GAFD;AAIA,MAAIiE,QAAQ,GAAG,CAAf;AACA,QAAMC,MAAM,GAAGvG,GAAG,CAACwG,KAAnB,CAhC2F,CAiC3F;AACA;;AACAxG,EAAAA,GAAG,CAACwG,KAAJ,GAAY,UAAUC,GAAV,EAAwB;AAClCH,IAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACA;AACA;;AACAkE,IAAAA,MAAM,CAACG,KAAP,CAAa1G,GAAb,EAAkB2G,SAAlB;AACD,GALD;;AAOA,QAAMlB,GAAG,GAAG,YAAkB;AAC5B,UAAMmB,YAAY,GAAG7G,GAAG,CAACmB,OAAJ,CAAY,iBAAZ,CAArB;AACA,UAAM2F,aAAa,GAAG9G,GAAG,CAAC+G,UAAJ,CAAeD,aAArC;AACA,UAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;AACA,QAAI3B,OAAJ;;AACA,QAAIlF,GAAG,CAAC2E,MAAJ,CAAWC,gBAAf,EAAiC;AAC/BM,MAAAA,OAAO,GAAGK,mBAAV;AACD,KAFD,MAEO;AACLL,MAAAA,OAAO,GAAGM,mBAAV;AACD;;AAEDzF,IAAAA,GAAG,CAAC0B,GAAJ,GAAU1B,GAAG,CAACiG,WAAd;AACAjG,IAAAA,GAAG,CAAC0F,GAAJ,CAAQuB,IAAR,CACE;AACEC,MAAAA,OAAO,EAAE;AACPC,QAAAA,MAAM,EAAEnH,GAAG,CAACmH,MADL;AAEPzF,QAAAA,GAAG,EAAE1B,GAAG,CAAC0B;AAFF,OADX;AAKE+B,MAAAA,IAAI,EAAGzD,GAAG,CAACsD,WAAJ,IAAmBtD,GAAG,CAACsD,WAAJ,CAAgBzC,IAApC,IAA6C,IALrD;AAMEmG,MAAAA,QANF;AAOEI,MAAAA,MAAM,EAAEnH,GAAG,CAACgE,UAPd;AAQEP,MAAAA,KAAK,EAAEzD,GAAG,CAAC2E,MAAJ,CAAWC,gBARpB;AASEwC,MAAAA,KAAK,EAAE;AACLC,QAAAA,EAAE,EAAElB,OADC;AAELmB,QAAAA,GAAG,EAAEhB;AAFA;AATT,KADF,EAeEpB,OAfF;AAiBAnF,IAAAA,GAAG,CAACiG,WAAJ,GAAkBjG,GAAG,CAAC0B,GAAtB;AACD,GA9BD;;AAgCA1B,EAAAA,GAAG,CAACqG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;AAChCX,IAAAA,GAAG;AACJ,GAFD;AAIA,QAAM8B,IAAI,GAAGvH,GAAG,CAACwH,GAAjB;;AACAxH,EAAAA,GAAG,CAACwH,GAAJ,GAAU,UAAUf,GAAV,EAAqB;AAC7B,QAAIA,GAAJ,EAAS;AACPH,MAAAA,QAAQ,IAAIG,GAAG,CAACpE,MAAhB;AACD;AACD;AACA;;;AACAkF,IAAAA,IAAI,CAACb,KAAL,CAAW1G,GAAX,EAAgB2G,SAAhB;;AACAlB,IAAAA,GAAG;AACJ,GARD;;AASAxF,EAAAA,IAAI;AACL;;AAEM,SAASwH,WAAT,CACLxC,GADK,EAELlF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;AACAL,EAAAA,KAAK,CAAC,oBAAD,CAAL;;AACA,MAAI0E,gBAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;AAClBrF,IAAAA,KAAK,CAAC,iBAAD,CAAL;;AACA,QAAIqF,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B3H,GAAG,CAACgE,UAAJ,KAAmB1C,kBAAYsG,YAAhE,EAA8E;AAC5E,aAAO3H,IAAI,EAAX;AACD;;AACD,QAAIqE,gBAAEuD,UAAF,CAAa7H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAxB,MAA0C,KAA9C,EAAqD;AACnDlI,MAAAA,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;AACA;;AACAmI,MAAAA,wBAAwB,CAAChI,GAAD,EAAMC,GAAN,EAAWsE,gBAAE0D,IAAb,CAAxB;AACD;;AACDpI,IAAAA,KAAK,CAAC,6BAAD,CAAL;AACAI,IAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,CAAwB7C,GAAxB;AACD,GAbD,MAaO;AACL;AACArF,IAAAA,KAAK,CAAC,qCAAD,CAAL;AACA,WAAOK,IAAI,CAACgF,GAAD,CAAX;AACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLhI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;AACNL,EAAAA,KAAK,CAAC,yBAAD,CAAL;;AACAI,EAAAA,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,GACE9H,GAAG,CAAC2E,MAAJ,CAAWmD,YAAX,IACA,UAAU7C,GAAV,EAAqC;AACnC,QAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc7F,kBAAY2G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;AAC3EvH,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA,UAAI7C,gBAAEI,KAAF,CAAQ1E,GAAG,CAACkI,WAAZ,MAA6B,KAAjC,EAAwC;AACtCtI,QAAAA,KAAK,CAAC,gBAAD,EAAmBqF,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;AACAnH,QAAAA,GAAG,CAACmH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;AACAvH,QAAAA,KAAK,CAAC,eAAD,EAAkBqF,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;AACAjF,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,gBAAUsE;AAAlC,SAAD,CAAJ;AACD;AACF,KARD,MAQO;AACLvI,MAAAA,KAAK,CAAC,mBAAD,EAAsBqF,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;AACA7D,qBAAOG,KAAP,CAAa;AAAEwB,QAAAA,GAAG,EAAEA;AAAP,OAAb,EAA2B,iDAA3B;;AACA,UAAI,CAACjF,GAAG,CAACmH,MAAL,IAAe,CAACnH,GAAG,CAACqF,IAAxB,EAA8B;AAC5B;AACA/B,uBAAOG,KAAP,CAAa,oDAAb;;AACA7D,QAAAA,KAAK,CAAC,yEAAD,EAA4EqF,GAA5E,CAAL;AACAjF,QAAAA,GAAG,CAACoF,OAAJ;AACD,OALD,MAKO,IAAI,CAACpF,GAAG,CAACkI,WAAT,EAAsB;AAC3BtI,QAAAA,KAAK,CAAC,0BAAD,EAA6BqF,GAA7B,CAAL;AACAjF,QAAAA,GAAG,CAACmH,MAAJ,CAAW7F,kBAAY8G,cAAvB;AACAnI,QAAAA,IAAI,CAAC;AAAEwD,UAAAA,KAAK,EAAEI,gBAAUwE;AAAnB,SAAD,CAAJ;AACD,OAJM,MAIA;AACL;AACAzI,QAAAA,KAAK,CAAC,6CAAD,EAAgDqF,GAAhD,CAAL;AACD;AACF;AACF,GA5BH;;AA8BArF,EAAAA,KAAK,CAAC,gCAAD,CAAL;AACAK,EAAAA,IAAI;AACL","sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { IAuth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: IAuth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"file":"middleware.js"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@verdaccio/middleware",
3
- "version": "6.0.0-6-next.13",
3
+ "version": "6.0.0-6-next.17",
4
4
  "description": "loaders logic",
5
5
  "main": "./build/index.js",
6
6
  "types": "build/index.d.ts",
@@ -30,11 +30,12 @@
30
30
  "npm": ">=6"
31
31
  },
32
32
  "dependencies": {
33
- "debug": "4.3.2",
34
- "@verdaccio/auth": "6.0.0-6-next.13",
35
- "@verdaccio/core": "6.0.0-6-next.2",
36
- "@verdaccio/logger": "6.0.0-6-next.6",
37
- "@verdaccio/utils": "6.0.0-6-next.7",
33
+ "debug": "4.3.3",
34
+ "body-parser": "1.19.1",
35
+ "@verdaccio/auth": "6.0.0-6-next.17",
36
+ "@verdaccio/core": "6.0.0-6-next.4",
37
+ "@verdaccio/logger": "6.0.0-6-next.9",
38
+ "@verdaccio/utils": "6.0.0-6-next.10",
38
39
  "lodash": "4.17.21"
39
40
  },
40
41
  "funding": {
package/src/middleware.ts CHANGED
@@ -1,29 +1,28 @@
1
- import _ from 'lodash';
2
1
  import buildDebug from 'debug';
3
-
4
- import {
5
- validateName as utilValidateName,
6
- validatePackage as utilValidatePackage,
7
- isObject,
8
- stringToMD5,
9
- } from '@verdaccio/utils';
10
-
11
2
  import { NextFunction, Request, Response } from 'express';
3
+ import { HttpError } from 'http-errors';
4
+ import _ from 'lodash';
12
5
 
13
- import { Config, Package, RemoteUser, Logger } from '@verdaccio/types';
14
- import { logger } from '@verdaccio/logger';
15
6
  import { IAuth } from '@verdaccio/auth';
16
7
  import {
17
- errorUtils,
18
8
  API_ERROR,
19
- HEADER_TYPE,
20
9
  HEADERS,
10
+ HEADER_TYPE,
21
11
  HTTP_STATUS,
22
12
  TOKEN_BASIC,
23
13
  TOKEN_BEARER,
24
14
  VerdaccioError,
15
+ errorUtils,
25
16
  } from '@verdaccio/core';
26
- import { HttpError } from 'http-errors';
17
+ import { logger } from '@verdaccio/logger';
18
+ import { Config, Logger, Package, RemoteUser } from '@verdaccio/types';
19
+ import {
20
+ isObject,
21
+ stringToMD5,
22
+ validateName as utilValidateName,
23
+ validatePackage as utilValidatePackage,
24
+ } from '@verdaccio/utils';
25
+
27
26
  import { getVersionFromTarball } from './middleware-utils';
28
27
 
29
28
  export type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };
package/types/custom.d.ts CHANGED
@@ -1,6 +1,6 @@
1
1
  // <reference types="node" />
2
-
3
2
  import * as http from 'http';
3
+
4
4
  import { Logger, RemoteUser } from '@verdaccio/types';
5
5
 
6
6
  declare global {