@verdaccio/middleware 6.0.0-6-next.28 → 6.0.0-6-next.30
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +32 -0
- package/build/middleware.js +6 -4
- package/build/middleware.js.map +1 -1
- package/package.json +6 -6
- package/src/middleware.ts +4 -7
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,37 @@
|
|
|
1
1
|
# @verdaccio/middleware
|
|
2
2
|
|
|
3
|
+
## 6.0.0-6-next.30
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 4b29d715: chore: move improvements from v5 to v6
|
|
8
|
+
|
|
9
|
+
Migrate improvements form v5 to v6:
|
|
10
|
+
|
|
11
|
+
- https://github.com/verdaccio/verdaccio/pull/3158
|
|
12
|
+
- https://github.com/verdaccio/verdaccio/pull/3151
|
|
13
|
+
- https://github.com/verdaccio/verdaccio/pull/2271
|
|
14
|
+
- https://github.com/verdaccio/verdaccio/pull/2787
|
|
15
|
+
- https://github.com/verdaccio/verdaccio/pull/2791
|
|
16
|
+
- https://github.com/verdaccio/verdaccio/pull/2205
|
|
17
|
+
|
|
18
|
+
### Patch Changes
|
|
19
|
+
|
|
20
|
+
- Updated dependencies [4b29d715]
|
|
21
|
+
- @verdaccio/auth@6.0.0-6-next.30
|
|
22
|
+
- @verdaccio/core@6.0.0-6-next.51
|
|
23
|
+
- @verdaccio/logger@6.0.0-6-next.19
|
|
24
|
+
- @verdaccio/utils@6.0.0-6-next.19
|
|
25
|
+
|
|
26
|
+
## 6.0.0-6-next.29
|
|
27
|
+
|
|
28
|
+
### Patch Changes
|
|
29
|
+
|
|
30
|
+
- @verdaccio/core@6.0.0-6-next.50
|
|
31
|
+
- @verdaccio/auth@6.0.0-6-next.29
|
|
32
|
+
- @verdaccio/logger@6.0.0-6-next.18
|
|
33
|
+
- @verdaccio/utils@6.0.0-6-next.18
|
|
34
|
+
|
|
3
35
|
## 6.0.0-6-next.28
|
|
4
36
|
|
|
5
37
|
### Patch Changes
|
package/build/middleware.js
CHANGED
|
@@ -83,7 +83,7 @@ function validatePackage(req, res, next, value, name) {
|
|
|
83
83
|
function media(expect) {
|
|
84
84
|
return function (req, res, next) {
|
|
85
85
|
if (req.headers[_core.HEADER_TYPE.CONTENT_TYPE] !== expect) {
|
|
86
|
-
next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.
|
|
86
|
+
next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.get[_core.HEADER_TYPE.CONTENT_TYPE]));
|
|
87
87
|
} else {
|
|
88
88
|
next();
|
|
89
89
|
}
|
|
@@ -109,7 +109,9 @@ function expectJson(req, res, next) {
|
|
|
109
109
|
|
|
110
110
|
function antiLoop(config) {
|
|
111
111
|
return function (req, res, next) {
|
|
112
|
-
|
|
112
|
+
var _req$headers;
|
|
113
|
+
|
|
114
|
+
if ((req === null || req === void 0 ? void 0 : (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.via) != null) {
|
|
113
115
|
const arr = req.headers.via.split(',');
|
|
114
116
|
|
|
115
117
|
for (let i = 0; i < arr.length; i++) {
|
|
@@ -225,7 +227,7 @@ function log(req, res, next) {
|
|
|
225
227
|
req.headers.authorization = '<Classified>';
|
|
226
228
|
}
|
|
227
229
|
|
|
228
|
-
const _cookie = req.
|
|
230
|
+
const _cookie = req.get('cookie');
|
|
229
231
|
|
|
230
232
|
if (_lodash.default.isNil(_cookie) === false) {
|
|
231
233
|
req.headers.cookie = '<Classified>';
|
|
@@ -263,7 +265,7 @@ function log(req, res, next) {
|
|
|
263
265
|
};
|
|
264
266
|
|
|
265
267
|
const log = function () {
|
|
266
|
-
const forwardedFor = req.
|
|
268
|
+
const forwardedFor = req.get('x-forwarded-for');
|
|
267
269
|
const remoteAddress = req.connection.remoteAddress;
|
|
268
270
|
const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
|
|
269
271
|
let message;
|
package/build/middleware.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;EACzC,OAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;IACN,IAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;MACtBD,IAAI;IACL,CAFD,MAEO;MACLA,IAAI,CAAC,OAAD,CAAJ;IACD;EACF,CAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN;EACAD,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;EACAP,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;EACAR,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;EACAT,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQI,GAAnB,EAAwB,eAAxB;EACAT,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAY,mBAAA,EAAiBX,KAAjB,CAAJ,EAA6B;IAClCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASI,eAAT,CACLjB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAgB,sBAAA,EAAoBf,KAApB,CAAJ,EAAgC;IACrCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASM,KAAT,CAAeC,MAAf,EAA2C;EAChD,OAAO,UAAUpB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;MACpDlB,IAAI,CACFa,gBAAA,CAAWS,OAAX,CACEC,iBAAA,CAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGEpB,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,CALJ,CADE,CAAJ;IASD,CAVD,MAUO;MACLrB,IAAI;IACL;EACF,CAdD;AAeD;;AAEM,SAASyB,kBAAT,CACL3B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAIF,GAAG,CAAC4B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;IAC/B;IACA7B,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAAC4B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;EACD;;EACD5B,IAAI;AACL;;AAEM,SAAS6B,UAAT,CACL/B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAI,CAAC,IAAA8B,eAAA,EAAShC,GAAG,CAACiC,IAAb,CAAL,EAAyB;IACvB,OAAO/B,IAAI,CAACa,gBAAA,CAAWmB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;EACD;;EACDhC,IAAI;AACL;;AAEM,SAASiC,QAAT,CAAkBC,MAAlB,EAA4C;EACjD,OAAO,UAAUpC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYgB,GAAZ,IAAmB,IAAvB,EAA6B;MAC3B,MAAMC,GAAG,GAAGtC,GAAG,CAACqB,OAAJ,CAAYgB,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;MAEA,KAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAO1C,KAAP,CAAa,kBAAb,CAAV;;QACA,IAAI4C,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;UAClC,OAAOzC,IAAI,CAACa,gBAAA,CAAWS,OAAX,CAAmBC,iBAAA,CAAYmB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;QACD;MACF;IACF;;IACD1C,IAAI;EACL,CAZD;AAaD;;AAEM,SAAS2C,KAAT,CAAeC,IAAf,EAAqC;EAC1C,OAAO,UAAUC,MAAV,EAAoC;IACzC,OAAO,UAAU/C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;MACxFF,GAAG,CAACgD,KAAJ;MACA,MAAMC,WAAW,GAAGjD,GAAG,CAACkD,MAAJ,CAAWC,KAAX,GACf,IAAGnD,GAAG,CAACkD,MAAJ,CAAWC,KAAM,IAAGnD,GAAG,CAACkD,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBpD,GAAG,CAACkD,MAAJ,CAAWE,OAFf;MAGA,MAAMC,cAAc,GAAGrD,GAAG,CAACkD,MAAJ,CAAWI,QAAX,GACnB,IAAAC,sCAAA,EAAsBvD,GAAG,CAACkD,MAAJ,CAAWI,QAAjC,CADmB,GAEnBE,SAFJ;MAGA,MAAMC,MAAM,GAAGzD,GAAG,CAAC0D,WAAnB;;MACAC,cAAA,CAAOC,KAAP,CACE;QAAEb,MAAF;QAAUc,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAE5C;MAAxB,CADF,EAEG,iDAFH;;MAIAiC,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;QAAEE,WAAF;QAAeI;MAAf,CADF,EAEEI,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;QAC9B/D,GAAG,CAACgE,MAAJ;;QACA,IAAIF,KAAJ,EAAW;UACT5D,IAAI,CAAC4D,KAAD,CAAJ;QACD,CAFD,MAEO,IAAIC,OAAJ,EAAa;UAClB7D,IAAI;QACL,CAFM,MAEA;UACL;UACA;UACA,MAAMa,gBAAA,CAAWkD,gBAAX,CAA4BC,eAAA,CAAUC,YAAtC,CAAN;QACD;MACF,CAdH;IAgBD,CA7BD;EA8BD,CA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLnC,IADK,EAELjC,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;EACN,IAAID,GAAG,CAACoE,UAAJ,KAAmB5C,iBAAA,CAAY6C,YAA/B,IAA+C,CAACrE,GAAG,CAACsE,SAAJ,CAAchE,aAAA,CAAQiE,QAAtB,CAApD,EAAqF;IACnF;IACAvE,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQiE,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;EACD;;EAED,IAAI;IACF,IAAIC,eAAA,CAAEC,QAAF,CAAW3C,IAAX,KAAoB0C,eAAA,CAAE3C,QAAF,CAAWC,IAAX,CAAxB,EAA0C;MACxC,IAAI,CAAChC,GAAG,CAACsE,SAAJ,CAAchE,aAAA,CAAQgB,YAAtB,CAAL,EAA0C;QACxCtB,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQgB,YAAnB,EAAiChB,aAAA,CAAQsE,IAAzC;MACD;;MAED,IAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4B0C,eAAA,CAAEG,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;QACvD,IAAI,OAAQA,IAAD,CAA0B6B,KAAjC,KAA2C,QAA/C,EAAyD;UACvD7D,GAAG,CAAC8E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B6B,KAAxD,CADuD,CAEvD;QACD;;QACD7B,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBuB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;MACD,CAXuC,CAaxC;;;MACA,IACE,CAACvD,GAAG,CAACoE,UAAL,IACCpE,GAAG,CAACoE,UAAJ,IAAkB5C,iBAAA,CAAYyD,EAA9B,IAAoCjF,GAAG,CAACoE,UAAJ,GAAiB5C,iBAAA,CAAY0D,gBAFpE,EAGE;QACAlF,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQ6E,IAAnB,EAAyB,MAAM,IAAAC,kBAAA,EAAYpD,IAAZ,CAAN,GAAoC,GAA7D;MACD;IACF,CApBD,MAoBO,CACL;IACD;EACF,CAxBD,CAwBE,OAAOqD,GAAP,EAAiB;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAJ,CAAYzF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;MACxD,IAAI6E,eAAA,CAAEG,KAAF,CAAQ7E,GAAG,CAACuF,MAAZ,MAAwB,KAA5B,EAAmC;QAAA;;QACjC,eAAAvF,GAAG,CAACuF,MAAJ,4DAAYC,OAAZ;MACD;;MACD;IACD;;IACD,MAAMH,GAAN;EACD;;EAEDrF,GAAG,CAACyF,IAAJ,CAASzD,IAAT;AACD,C,CAED;;;AACO,MAAM0D,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa9F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;EAC3F;EACAF,GAAG,CAAC8F,GAAJ,GAAUnC,cAAA,CAAOoC,KAAP,CAAa;IAAEC,GAAG,EAAE;EAAP,CAAb,CAAV;EAEA,MAAMC,KAAK,GAAGjG,GAAG,CAACqB,OAAJ,CAAY6E,aAA1B;;EACA,IAAIvB,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BjG,GAAG,CAACqB,OAAJ,CAAY6E,aAAZ,GAA4B,cAA5B;EACD;;EAED,MAAMC,OAAO,GAAGnG,GAAG,CAACqB,OAAJ,CAAY+E,MAA5B;;EACA,IAAIzB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BnG,GAAG,CAACqB,OAAJ,CAAY+E,MAAZ,GAAqB,cAArB;EACD;;EAEDpG,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAACqG,WAAd;EACArG,GAAG,CAAC8F,GAAJ,CAAQQ,IAAR,CAAa;IAAEtG,GAAG,EAAEA,GAAP;IAAYuG,EAAE,EAAEvG,GAAG,CAACuG;EAApB,CAAb,EAAuC,4CAAvC;EACAvG,GAAG,CAACqG,WAAJ,GAAkBrG,GAAG,CAAC4B,GAAtB;;EAEA,IAAI+C,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BjG,GAAG,CAACqB,OAAJ,CAAY6E,aAAZ,GAA4BD,KAA5B;EACD;;EAED,IAAItB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BnG,GAAG,CAACqB,OAAJ,CAAY+E,MAAZ,GAAqBD,OAArB;EACD;;EAED,IAAIK,OAAO,GAAG,CAAd;EACAxG,GAAG,CAACyG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAjB;EACD,CAFD;EAIA,IAAIkE,QAAQ,GAAG,CAAf;EACA,MAAMC,MAAM,GAAG3G,GAAG,CAAC4G,KAAnB,CAhC2F,CAiC3F;EACA;;EACA5G,GAAG,CAAC4G,KAAJ,GAAY,UAAUC,GAAV,EAAwB;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACA;IACA;;IACAmE,MAAM,CAACG,KAAP,CAAa9G,GAAb,EAAkB+G,SAAlB;EACD,CALD;;EAOA,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGjH,GAAG,CAACqB,OAAJ,CAAY,iBAAZ,CAArB;IACA,MAAM6F,aAAa,GAAGlH,GAAG,CAACmH,UAAJ,CAAeD,aAArC;IACA,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;IACA,IAAI3B,OAAJ;;IACA,IAAItF,GAAG,CAAC8E,MAAJ,CAAWC,gBAAf,EAAiC;MAC/BO,OAAO,GAAGK,mBAAV;IACD,CAFD,MAEO;MACLL,OAAO,GAAGM,mBAAV;IACD;;IAED7F,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAACqG,WAAd;IACArG,GAAG,CAAC8F,GAAJ,CAAQuB,IAAR,CACE;MACEC,OAAO,EAAE;QACPC,MAAM,EAAEvH,GAAG,CAACuH,MADL;QAEP3F,GAAG,EAAE5B,GAAG,CAAC4B;MAFF,CADX;MAKEiC,IAAI,EAAG7D,GAAG,CAAC0D,WAAJ,IAAmB1D,GAAG,CAAC0D,WAAJ,CAAgB7C,IAApC,IAA6C,IALrD;MAMEuG,QANF;MAOEI,MAAM,EAAEvH,GAAG,CAACoE,UAPd;MAQEP,KAAK,EAAE7D,GAAG,CAAC8E,MAAJ,CAAWC,gBARpB;MASEyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OADC;QAELmB,GAAG,EAAEhB;MAFA;IATT,CADF,EAeEpB,OAfF;IAiBAvF,GAAG,CAACqG,WAAJ,GAAkBrG,GAAG,CAAC4B,GAAtB;EACD,CA9BD;;EAgCA5B,GAAG,CAACyG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;IAChCX,GAAG;EACJ,CAFD;EAIA,MAAM8B,IAAI,GAAG3H,GAAG,CAAC4H,GAAjB,CA9E2F,CA+E3F;;EACA5H,GAAG,CAAC4H,GAAJ,GAAU,UAAUf,GAAV,EAAqB;IAC7B,IAAIA,GAAJ,EAAS;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACD;IACD;IACA;;;IACAmF,IAAI,CAACb,KAAL,CAAW9G,GAAX,EAAgB+G,SAAhB;;IACAlB,GAAG;EACJ,CARD;;EASA5F,IAAI;AACL;;AAEM,SAAS4H,WAAT,CACLxC,GADK,EAELtF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;EACAN,KAAK,CAAC,oBAAD,CAAL;;EACA,IAAI+E,eAAA,CAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;IAClB1F,KAAK,CAAC,iBAAD,CAAL;;IACA,IAAI0F,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B/H,GAAG,CAACoE,UAAJ,KAAmB5C,iBAAA,CAAYwG,YAAhE,EAA8E;MAC5E,OAAO/H,IAAI,EAAX;IACD;;IACD,IAAIyE,eAAA,CAAEuD,UAAF,CAAajI,GAAG,CAAC8E,MAAJ,CAAWoD,YAAxB,MAA0C,KAA9C,EAAqD;MACnDvI,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;MACA;;MACAwI,wBAAwB,CAACpI,GAAD,EAAMC,GAAN,EAAW0E,eAAA,CAAE0D,IAAb,CAAxB;IACD;;IACDzI,KAAK,CAAC,6BAAD,CAAL;IACAK,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,CAAwB7C,GAAxB;EACD,CAbD,MAaO;IACL;IACA1F,KAAK,CAAC,qCAAD,CAAL;IACA,OAAOM,IAAI,CAACoF,GAAD,CAAX;EACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLpI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACNN,KAAK,CAAC,yBAAD,CAAL;;EACAK,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,GACElI,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,IACA,UAAU7C,GAAV,EAAqC;IACnC,IAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc/F,iBAAA,CAAY6G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;MAC3E5H,KAAK,CAAC,mBAAD,EAAsB0F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA,IAAI7C,eAAA,CAAEG,KAAF,CAAQ7E,GAAG,CAACsI,WAAZ,MAA6B,KAAjC,EAAwC;QACtC3I,KAAK,CAAC,gBAAD,EAAmB0F,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;QACAvH,GAAG,CAACuH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;QACA5H,KAAK,CAAC,eAAD,EAAkB0F,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;QACArF,IAAI,CAAC;UAAE4D,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,eAAA,CAAUsE;QAAlC,CAAD,CAAJ;MACD;IACF,CARD,MAQO;MACL5I,KAAK,CAAC,mBAAD,EAAsB0F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA7D,cAAA,CAAOG,KAAP,CAAa;QAAEwB,GAAG,EAAEA;MAAP,CAAb,EAA2B,iDAA3B;;MACA,IAAI,CAACrF,GAAG,CAACuH,MAAL,IAAe,CAACvH,GAAG,CAACyF,IAAxB,EAA8B;QAC5B;QACA/B,cAAA,CAAOG,KAAP,CAAa,oDAAb;;QACAlE,KAAK,CAAC,yEAAD,EAA4E0F,GAA5E,CAAL;QACArF,GAAG,CAACwF,OAAJ;MACD,CALD,MAKO,IAAI,CAACxF,GAAG,CAACsI,WAAT,EAAsB;QAC3B3I,KAAK,CAAC,0BAAD,EAA6B0F,GAA7B,CAAL;QACArF,GAAG,CAACuH,MAAJ,CAAW/F,iBAAA,CAAYgH,cAAvB;QACAvI,IAAI,CAAC;UAAE4D,KAAK,EAAEI,eAAA,CAAUwE;QAAnB,CAAD,CAAJ;MACD,CAJM,MAIA;QACL;QACA9I,KAAK,CAAC,6CAAD,EAAgD0F,GAAhD,CAAL;MACD;IACF;EACF,CA5BH;;EA8BA1F,KAAK,CAAC,gCAAD,CAAL;EACAM,IAAI;AACL"}
|
|
1
|
+
{"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","get","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.get('x-forwarded-for');\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;EACzC,OAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;IACN,IAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;MACtBD,IAAI;IACL,CAFD,MAEO;MACLA,IAAI,CAAC,OAAD,CAAJ;IACD;EACF,CAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN;EACAD,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;EACAP,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;EACAR,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;EACAT,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQI,GAAnB,EAAwB,eAAxB;EACAT,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAY,mBAAA,EAAiBX,KAAjB,CAAJ,EAA6B;IAClCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASI,eAAT,CACLjB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAgB,sBAAA,EAAoBf,KAApB,CAAJ,EAAgC;IACrCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASM,KAAT,CAAeC,MAAf,EAA2C;EAChD,OAAO,UAAUpB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;MACpDlB,IAAI,CACFa,gBAAA,CAAWS,OAAX,CACEC,iBAAA,CAAYC,iBADd,EAEE,iCAAiCN,MAAjC,GAA0C,SAA1C,GAAsDpB,GAAG,CAAC2B,GAAJ,CAAQL,iBAAA,CAAYC,YAApB,CAFxD,CADE,CAAJ;IAMD,CAPD,MAOO;MACLrB,IAAI;IACL;EACF,CAXD;AAYD;;AAEM,SAAS0B,kBAAT,CACL5B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAIF,GAAG,CAAC6B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;IAC/B;IACA9B,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAAC6B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;EACD;;EACD7B,IAAI;AACL;;AAEM,SAAS8B,UAAT,CACLhC,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAI,CAAC,IAAA+B,eAAA,EAASjC,GAAG,CAACkC,IAAb,CAAL,EAAyB;IACvB,OAAOhC,IAAI,CAACa,gBAAA,CAAWoB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;EACD;;EACDjC,IAAI;AACL;;AAEM,SAASkC,QAAT,CAAkBC,MAAlB,EAA4C;EACjD,OAAO,UAAUrC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IAAA;;IACxF,IAAI,CAAAF,GAAG,SAAH,IAAAA,GAAG,WAAH,4BAAAA,GAAG,CAAEqB,OAAL,8DAAciB,GAAd,KAAqB,IAAzB,EAA+B;MAC7B,MAAMC,GAAG,GAAGvC,GAAG,CAACqB,OAAJ,CAAYiB,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;MAEA,KAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAO3C,KAAP,CAAa,kBAAb,CAAV;;QACA,IAAI6C,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;UAClC,OAAO1C,IAAI,CAACa,gBAAA,CAAWS,OAAX,CAAmBC,iBAAA,CAAYoB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;QACD;MACF;IACF;;IACD3C,IAAI;EACL,CAZD;AAaD;;AAEM,SAAS4C,KAAT,CAAeC,IAAf,EAAqC;EAC1C,OAAO,UAAUC,MAAV,EAAoC;IACzC,OAAO,UAAUhD,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;MACxFF,GAAG,CAACiD,KAAJ;MACA,MAAMC,WAAW,GAAGlD,GAAG,CAACmD,MAAJ,CAAWC,KAAX,GACf,IAAGpD,GAAG,CAACmD,MAAJ,CAAWC,KAAM,IAAGpD,GAAG,CAACmD,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBrD,GAAG,CAACmD,MAAJ,CAAWE,OAFf;MAGA,MAAMC,cAAc,GAAGtD,GAAG,CAACmD,MAAJ,CAAWI,QAAX,GACnB,IAAAC,sCAAA,EAAsBxD,GAAG,CAACmD,MAAJ,CAAWI,QAAjC,CADmB,GAEnBE,SAFJ;MAGA,MAAMC,MAAM,GAAG1D,GAAG,CAAC2D,WAAnB;;MACAC,cAAA,CAAOC,KAAP,CACE;QAAEb,MAAF;QAAUc,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAE7C;MAAxB,CADF,EAEG,iDAFH;;MAIAkC,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;QAAEE,WAAF;QAAeI;MAAf,CADF,EAEEI,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;QAC9BhE,GAAG,CAACiE,MAAJ;;QACA,IAAIF,KAAJ,EAAW;UACT7D,IAAI,CAAC6D,KAAD,CAAJ;QACD,CAFD,MAEO,IAAIC,OAAJ,EAAa;UAClB9D,IAAI;QACL,CAFM,MAEA;UACL;UACA;UACA,MAAMa,gBAAA,CAAWmD,gBAAX,CAA4BC,eAAA,CAAUC,YAAtC,CAAN;QACD;MACF,CAdH;IAgBD,CA7BD;EA8BD,CA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLnC,IADK,EAELlC,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;EACN,IAAID,GAAG,CAACqE,UAAJ,KAAmB7C,iBAAA,CAAY8C,YAA/B,IAA+C,CAACtE,GAAG,CAACuE,SAAJ,CAAcjE,aAAA,CAAQkE,QAAtB,CAApD,EAAqF;IACnF;IACAxE,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQkE,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;EACD;;EAED,IAAI;IACF,IAAIC,eAAA,CAAEC,QAAF,CAAW3C,IAAX,KAAoB0C,eAAA,CAAE3C,QAAF,CAAWC,IAAX,CAAxB,EAA0C;MACxC,IAAI,CAACjC,GAAG,CAACuE,SAAJ,CAAcjE,aAAA,CAAQgB,YAAtB,CAAL,EAA0C;QACxCtB,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQgB,YAAnB,EAAiChB,aAAA,CAAQuE,IAAzC;MACD;;MAED,IAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4B0C,eAAA,CAAEG,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;QACvD,IAAI,OAAQA,IAAD,CAA0B6B,KAAjC,KAA2C,QAA/C,EAAyD;UACvD9D,GAAG,CAAC+E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B6B,KAAxD,CADuD,CAEvD;QACD;;QACD7B,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBuB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;MACD,CAXuC,CAaxC;;;MACA,IACE,CAACxD,GAAG,CAACqE,UAAL,IACCrE,GAAG,CAACqE,UAAJ,IAAkB7C,iBAAA,CAAY0D,EAA9B,IAAoClF,GAAG,CAACqE,UAAJ,GAAiB7C,iBAAA,CAAY2D,gBAFpE,EAGE;QACAnF,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQ8E,IAAnB,EAAyB,MAAM,IAAAC,kBAAA,EAAYpD,IAAZ,CAAN,GAAoC,GAA7D;MACD;IACF,CApBD,MAoBO,CACL;IACD;EACF,CAxBD,CAwBE,OAAOqD,GAAP,EAAiB;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAJ,CAAY1F,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;MACxD,IAAI8E,eAAA,CAAEG,KAAF,CAAQ9E,GAAG,CAACwF,MAAZ,MAAwB,KAA5B,EAAmC;QAAA;;QACjC,eAAAxF,GAAG,CAACwF,MAAJ,4DAAYC,OAAZ;MACD;;MACD;IACD;;IACD,MAAMH,GAAN;EACD;;EAEDtF,GAAG,CAAC0F,IAAJ,CAASzD,IAAT;AACD,C,CAED;;;AACO,MAAM0D,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa/F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;EAC3F;EACAF,GAAG,CAAC+F,GAAJ,GAAUnC,cAAA,CAAOoC,KAAP,CAAa;IAAEC,GAAG,EAAE;EAAP,CAAb,CAAV;EAEA,MAAMC,KAAK,GAAGlG,GAAG,CAACqB,OAAJ,CAAY8E,aAA1B;;EACA,IAAIvB,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BlG,GAAG,CAACqB,OAAJ,CAAY8E,aAAZ,GAA4B,cAA5B;EACD;;EAED,MAAMC,OAAO,GAAGpG,GAAG,CAAC2B,GAAJ,CAAQ,QAAR,CAAhB;;EACA,IAAIiD,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BpG,GAAG,CAACqB,OAAJ,CAAYgF,MAAZ,GAAqB,cAArB;EACD;;EAEDrG,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAACsG,WAAd;EACAtG,GAAG,CAAC+F,GAAJ,CAAQQ,IAAR,CAAa;IAAEvG,GAAG,EAAEA,GAAP;IAAYwG,EAAE,EAAExG,GAAG,CAACwG;EAApB,CAAb,EAAuC,4CAAvC;EACAxG,GAAG,CAACsG,WAAJ,GAAkBtG,GAAG,CAAC6B,GAAtB;;EAEA,IAAI+C,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BlG,GAAG,CAACqB,OAAJ,CAAY8E,aAAZ,GAA4BD,KAA5B;EACD;;EAED,IAAItB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BpG,GAAG,CAACqB,OAAJ,CAAYgF,MAAZ,GAAqBD,OAArB;EACD;;EAED,IAAIK,OAAO,GAAG,CAAd;EACAzG,GAAG,CAAC0G,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAjB;EACD,CAFD;EAIA,IAAIkE,QAAQ,GAAG,CAAf;EACA,MAAMC,MAAM,GAAG5G,GAAG,CAAC6G,KAAnB,CAhC2F,CAiC3F;EACA;;EACA7G,GAAG,CAAC6G,KAAJ,GAAY,UAAUC,GAAV,EAAwB;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACA;IACA;;IACAmE,MAAM,CAACG,KAAP,CAAa/G,GAAb,EAAkBgH,SAAlB;EACD,CALD;;EAOA,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGlH,GAAG,CAAC2B,GAAJ,CAAQ,iBAAR,CAArB;IACA,MAAMwF,aAAa,GAAGnH,GAAG,CAACoH,UAAJ,CAAeD,aAArC;IACA,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;IACA,IAAI3B,OAAJ;;IACA,IAAIvF,GAAG,CAAC+E,MAAJ,CAAWC,gBAAf,EAAiC;MAC/BO,OAAO,GAAGK,mBAAV;IACD,CAFD,MAEO;MACLL,OAAO,GAAGM,mBAAV;IACD;;IAED9F,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAACsG,WAAd;IACAtG,GAAG,CAAC+F,GAAJ,CAAQuB,IAAR,CACE;MACEC,OAAO,EAAE;QACPC,MAAM,EAAExH,GAAG,CAACwH,MADL;QAEP3F,GAAG,EAAE7B,GAAG,CAAC6B;MAFF,CADX;MAKEiC,IAAI,EAAG9D,GAAG,CAAC2D,WAAJ,IAAmB3D,GAAG,CAAC2D,WAAJ,CAAgB9C,IAApC,IAA6C,IALrD;MAMEwG,QANF;MAOEI,MAAM,EAAExH,GAAG,CAACqE,UAPd;MAQEP,KAAK,EAAE9D,GAAG,CAAC+E,MAAJ,CAAWC,gBARpB;MASEyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OADC;QAELmB,GAAG,EAAEhB;MAFA;IATT,CADF,EAeEpB,OAfF;IAiBAxF,GAAG,CAACsG,WAAJ,GAAkBtG,GAAG,CAAC6B,GAAtB;EACD,CA9BD;;EAgCA7B,GAAG,CAAC0G,EAAJ,CAAO,OAAP,EAAgB,YAAkB;IAChCX,GAAG;EACJ,CAFD;EAIA,MAAM8B,IAAI,GAAG5H,GAAG,CAAC6H,GAAjB,CA9E2F,CA+E3F;;EACA7H,GAAG,CAAC6H,GAAJ,GAAU,UAAUf,GAAV,EAAqB;IAC7B,IAAIA,GAAJ,EAAS;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACD;IACD;IACA;;;IACAmF,IAAI,CAACb,KAAL,CAAW/G,GAAX,EAAgBgH,SAAhB;;IACAlB,GAAG;EACJ,CARD;;EASA7F,IAAI;AACL;;AAEM,SAAS6H,WAAT,CACLxC,GADK,EAELvF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;EACAN,KAAK,CAAC,oBAAD,CAAL;;EACA,IAAIgF,eAAA,CAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;IAClB3F,KAAK,CAAC,iBAAD,CAAL;;IACA,IAAI2F,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6BhI,GAAG,CAACqE,UAAJ,KAAmB7C,iBAAA,CAAYyG,YAAhE,EAA8E;MAC5E,OAAOhI,IAAI,EAAX;IACD;;IACD,IAAI0E,eAAA,CAAEuD,UAAF,CAAalI,GAAG,CAAC+E,MAAJ,CAAWoD,YAAxB,MAA0C,KAA9C,EAAqD;MACnDxI,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;MACA;;MACAyI,wBAAwB,CAACrI,GAAD,EAAMC,GAAN,EAAW2E,eAAA,CAAE0D,IAAb,CAAxB;IACD;;IACD1I,KAAK,CAAC,6BAAD,CAAL;IACAK,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,CAAwB7C,GAAxB;EACD,CAbD,MAaO;IACL;IACA3F,KAAK,CAAC,qCAAD,CAAL;IACA,OAAOM,IAAI,CAACqF,GAAD,CAAX;EACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLrI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACNN,KAAK,CAAC,yBAAD,CAAL;;EACAK,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,GACEnI,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,IACA,UAAU7C,GAAV,EAAqC;IACnC,IAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAchG,iBAAA,CAAY8G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;MAC3E7H,KAAK,CAAC,mBAAD,EAAsB2F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA,IAAI7C,eAAA,CAAEG,KAAF,CAAQ9E,GAAG,CAACuI,WAAZ,MAA6B,KAAjC,EAAwC;QACtC5I,KAAK,CAAC,gBAAD,EAAmB2F,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;QACAxH,GAAG,CAACwH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;QACA7H,KAAK,CAAC,eAAD,EAAkB2F,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;QACAtF,IAAI,CAAC;UAAE6D,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,eAAA,CAAUsE;QAAlC,CAAD,CAAJ;MACD;IACF,CARD,MAQO;MACL7I,KAAK,CAAC,mBAAD,EAAsB2F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA7D,cAAA,CAAOG,KAAP,CAAa;QAAEwB,GAAG,EAAEA;MAAP,CAAb,EAA2B,iDAA3B;;MACA,IAAI,CAACtF,GAAG,CAACwH,MAAL,IAAe,CAACxH,GAAG,CAAC0F,IAAxB,EAA8B;QAC5B;QACA/B,cAAA,CAAOG,KAAP,CAAa,oDAAb;;QACAnE,KAAK,CAAC,yEAAD,EAA4E2F,GAA5E,CAAL;QACAtF,GAAG,CAACyF,OAAJ;MACD,CALD,MAKO,IAAI,CAACzF,GAAG,CAACuI,WAAT,EAAsB;QAC3B5I,KAAK,CAAC,0BAAD,EAA6B2F,GAA7B,CAAL;QACAtF,GAAG,CAACwH,MAAJ,CAAWhG,iBAAA,CAAYiH,cAAvB;QACAxI,IAAI,CAAC;UAAE6D,KAAK,EAAEI,eAAA,CAAUwE;QAAnB,CAAD,CAAJ;MACD,CAJM,MAIA;QACL;QACA/I,KAAK,CAAC,6CAAD,EAAgD2F,GAAhD,CAAL;MACD;IACF;EACF,CA5BH;;EA8BA3F,KAAK,CAAC,gCAAD,CAAL;EACAM,IAAI;AACL"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/middleware",
|
|
3
|
-
"version": "6.0.0-6-next.
|
|
3
|
+
"version": "6.0.0-6-next.30",
|
|
4
4
|
"description": "loaders logic",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -31,11 +31,11 @@
|
|
|
31
31
|
},
|
|
32
32
|
"dependencies": {
|
|
33
33
|
"debug": "4.3.4",
|
|
34
|
-
"body-parser": "1.20.
|
|
35
|
-
"@verdaccio/auth": "6.0.0-6-next.
|
|
36
|
-
"@verdaccio/core": "6.0.0-6-next.
|
|
37
|
-
"@verdaccio/logger": "6.0.0-6-next.
|
|
38
|
-
"@verdaccio/utils": "6.0.0-6-next.
|
|
34
|
+
"body-parser": "1.20.1",
|
|
35
|
+
"@verdaccio/auth": "6.0.0-6-next.30",
|
|
36
|
+
"@verdaccio/core": "6.0.0-6-next.51",
|
|
37
|
+
"@verdaccio/logger": "6.0.0-6-next.19",
|
|
38
|
+
"@verdaccio/utils": "6.0.0-6-next.19",
|
|
39
39
|
"lodash": "4.17.21"
|
|
40
40
|
},
|
|
41
41
|
"funding": {
|
package/src/middleware.ts
CHANGED
|
@@ -104,10 +104,7 @@ export function media(expect: string | null): any {
|
|
|
104
104
|
next(
|
|
105
105
|
errorUtils.getCode(
|
|
106
106
|
HTTP_STATUS.UNSUPPORTED_MEDIA,
|
|
107
|
-
'wrong content-type, expect: ' +
|
|
108
|
-
expect +
|
|
109
|
-
', got: ' +
|
|
110
|
-
req.headers[HEADER_TYPE.CONTENT_TYPE]
|
|
107
|
+
'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]
|
|
111
108
|
)
|
|
112
109
|
);
|
|
113
110
|
} else {
|
|
@@ -141,7 +138,7 @@ export function expectJson(
|
|
|
141
138
|
|
|
142
139
|
export function antiLoop(config: Config): Function {
|
|
143
140
|
return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
|
|
144
|
-
if (req
|
|
141
|
+
if (req?.headers?.via != null) {
|
|
145
142
|
const arr = req.headers.via.split(',');
|
|
146
143
|
|
|
147
144
|
for (let i = 0; i < arr.length; i++) {
|
|
@@ -264,7 +261,7 @@ export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFuncti
|
|
|
264
261
|
req.headers.authorization = '<Classified>';
|
|
265
262
|
}
|
|
266
263
|
|
|
267
|
-
const _cookie = req.
|
|
264
|
+
const _cookie = req.get('cookie');
|
|
268
265
|
if (_.isNil(_cookie) === false) {
|
|
269
266
|
req.headers.cookie = '<Classified>';
|
|
270
267
|
}
|
|
@@ -298,7 +295,7 @@ export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFuncti
|
|
|
298
295
|
};
|
|
299
296
|
|
|
300
297
|
const log = function (): void {
|
|
301
|
-
const forwardedFor = req.
|
|
298
|
+
const forwardedFor = req.get('x-forwarded-for');
|
|
302
299
|
const remoteAddress = req.connection.remoteAddress;
|
|
303
300
|
const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
|
|
304
301
|
let message;
|