@verdaccio/middleware 6.0.0-6-next.29 → 6.0.0-6-next.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +23 -0
  2. package/build/middleware.js +6 -4
  3. package/build/middleware.js.map +1 -1
  4. package/package.json +5 -5
  5. package/src/middleware.ts +4 -7
package/CHANGELOG.md CHANGED
@@ -1,5 +1,28 @@
1
1
  # @verdaccio/middleware
2
2
 
3
+ ## 6.0.0-6-next.30
4
+
5
+ ### Minor Changes
6
+
7
+ - 4b29d715: chore: move improvements from v5 to v6
8
+
9
+ Migrate improvements form v5 to v6:
10
+
11
+ - https://github.com/verdaccio/verdaccio/pull/3158
12
+ - https://github.com/verdaccio/verdaccio/pull/3151
13
+ - https://github.com/verdaccio/verdaccio/pull/2271
14
+ - https://github.com/verdaccio/verdaccio/pull/2787
15
+ - https://github.com/verdaccio/verdaccio/pull/2791
16
+ - https://github.com/verdaccio/verdaccio/pull/2205
17
+
18
+ ### Patch Changes
19
+
20
+ - Updated dependencies [4b29d715]
21
+ - @verdaccio/auth@6.0.0-6-next.30
22
+ - @verdaccio/core@6.0.0-6-next.51
23
+ - @verdaccio/logger@6.0.0-6-next.19
24
+ - @verdaccio/utils@6.0.0-6-next.19
25
+
3
26
  ## 6.0.0-6-next.29
4
27
 
5
28
  ### Patch Changes
package/build/middleware.js CHANGED
@@ -83,7 +83,7 @@ function validatePackage(req, res, next, value, name) {
83
83
  function media(expect) {
84
84
  return function (req, res, next) {
85
85
  if (req.headers[_core.HEADER_TYPE.CONTENT_TYPE] !== expect) {
86
- next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.headers[_core.HEADER_TYPE.CONTENT_TYPE]));
86
+ next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.get[_core.HEADER_TYPE.CONTENT_TYPE]));
87
87
  } else {
88
88
  next();
89
89
  }
@@ -109,7 +109,9 @@ function expectJson(req, res, next) {
109
109
 
110
110
  function antiLoop(config) {
111
111
  return function (req, res, next) {
112
- if (req.headers.via != null) {
112
+ var _req$headers;
113
+
114
+ if ((req === null || req === void 0 ? void 0 : (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.via) != null) {
113
115
  const arr = req.headers.via.split(',');
114
116
 
115
117
  for (let i = 0; i < arr.length; i++) {
@@ -225,7 +227,7 @@ function log(req, res, next) {
225
227
  req.headers.authorization = '<Classified>';
226
228
  }
227
229
 
228
- const _cookie = req.headers.cookie;
230
+ const _cookie = req.get('cookie');
229
231
 
230
232
  if (_lodash.default.isNil(_cookie) === false) {
231
233
  req.headers.cookie = '<Classified>';
@@ -263,7 +265,7 @@ function log(req, res, next) {
263
265
  };
264
266
 
265
267
  const log = function () {
266
- const forwardedFor = req.headers['x-forwarded-for'];
268
+ const forwardedFor = req.get('x-forwarded-for');
267
269
  const remoteAddress = req.connection.remoteAddress;
268
270
  const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
269
271
  let message;
package/build/middleware.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;EACzC,OAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;IACN,IAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;MACtBD,IAAI;IACL,CAFD,MAEO;MACLA,IAAI,CAAC,OAAD,CAAJ;IACD;EACF,CAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN;EACAD,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;EACAP,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;EACAR,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;EACAT,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQI,GAAnB,EAAwB,eAAxB;EACAT,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAY,mBAAA,EAAiBX,KAAjB,CAAJ,EAA6B;IAClCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASI,eAAT,CACLjB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAgB,sBAAA,EAAoBf,KAApB,CAAJ,EAAgC;IACrCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASM,KAAT,CAAeC,MAAf,EAA2C;EAChD,OAAO,UAAUpB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;MACpDlB,IAAI,CACFa,gBAAA,CAAWS,OAAX,CACEC,iBAAA,CAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGEpB,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,CALJ,CADE,CAAJ;IASD,CAVD,MAUO;MACLrB,IAAI;IACL;EACF,CAdD;AAeD;;AAEM,SAASyB,kBAAT,CACL3B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAIF,GAAG,CAAC4B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;IAC/B;IACA7B,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAAC4B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;EACD;;EACD5B,IAAI;AACL;;AAEM,SAAS6B,UAAT,CACL/B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAI,CAAC,IAAA8B,eAAA,EAAShC,GAAG,CAACiC,IAAb,CAAL,EAAyB;IACvB,OAAO/B,IAAI,CAACa,gBAAA,CAAWmB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;EACD;;EACDhC,IAAI;AACL;;AAEM,SAASiC,QAAT,CAAkBC,MAAlB,EAA4C;EACjD,OAAO,UAAUpC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYgB,GAAZ,IAAmB,IAAvB,EAA6B;MAC3B,MAAMC,GAAG,GAAGtC,GAAG,CAACqB,OAAJ,CAAYgB,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;MAEA,KAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAO1C,KAAP,CAAa,kBAAb,CAAV;;QACA,IAAI4C,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;UAClC,OAAOzC,IAAI,CAACa,gBAAA,CAAWS,OAAX,CAAmBC,iBAAA,CAAYmB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;QACD;MACF;IACF;;IACD1C,IAAI;EACL,CAZD;AAaD;;AAEM,SAAS2C,KAAT,CAAeC,IAAf,EAAqC;EAC1C,OAAO,UAAUC,MAAV,EAAoC;IACzC,OAAO,UAAU/C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;MACxFF,GAAG,CAACgD,KAAJ;MACA,MAAMC,WAAW,GAAGjD,GAAG,CAACkD,MAAJ,CAAWC,KAAX,GACf,IAAGnD,GAAG,CAACkD,MAAJ,CAAWC,KAAM,IAAGnD,GAAG,CAACkD,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBpD,GAAG,CAACkD,MAAJ,CAAWE,OAFf;MAGA,MAAMC,cAAc,GAAGrD,GAAG,CAACkD,MAAJ,CAAWI,QAAX,GACnB,IAAAC,sCAAA,EAAsBvD,GAAG,CAACkD,MAAJ,CAAWI,QAAjC,CADmB,GAEnBE,SAFJ;MAGA,MAAMC,MAAM,GAAGzD,GAAG,CAAC0D,WAAnB;;MACAC,cAAA,CAAOC,KAAP,CACE;QAAEb,MAAF;QAAUc,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAE5C;MAAxB,CADF,EAEG,iDAFH;;MAIAiC,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;QAAEE,WAAF;QAAeI;MAAf,CADF,EAEEI,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;QAC9B/D,GAAG,CAACgE,MAAJ;;QACA,IAAIF,KAAJ,EAAW;UACT5D,IAAI,CAAC4D,KAAD,CAAJ;QACD,CAFD,MAEO,IAAIC,OAAJ,EAAa;UAClB7D,IAAI;QACL,CAFM,MAEA;UACL;UACA;UACA,MAAMa,gBAAA,CAAWkD,gBAAX,CAA4BC,eAAA,CAAUC,YAAtC,CAAN;QACD;MACF,CAdH;IAgBD,CA7BD;EA8BD,CA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLnC,IADK,EAELjC,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;EACN,IAAID,GAAG,CAACoE,UAAJ,KAAmB5C,iBAAA,CAAY6C,YAA/B,IAA+C,CAACrE,GAAG,CAACsE,SAAJ,CAAchE,aAAA,CAAQiE,QAAtB,CAApD,EAAqF;IACnF;IACAvE,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQiE,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;EACD;;EAED,IAAI;IACF,IAAIC,eAAA,CAAEC,QAAF,CAAW3C,IAAX,KAAoB0C,eAAA,CAAE3C,QAAF,CAAWC,IAAX,CAAxB,EAA0C;MACxC,IAAI,CAAChC,GAAG,CAACsE,SAAJ,CAAchE,aAAA,CAAQgB,YAAtB,CAAL,EAA0C;QACxCtB,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQgB,YAAnB,EAAiChB,aAAA,CAAQsE,IAAzC;MACD;;MAED,IAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4B0C,eAAA,CAAEG,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;QACvD,IAAI,OAAQA,IAAD,CAA0B6B,KAAjC,KAA2C,QAA/C,EAAyD;UACvD7D,GAAG,CAAC8E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B6B,KAAxD,CADuD,CAEvD;QACD;;QACD7B,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBuB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;MACD,CAXuC,CAaxC;;;MACA,IACE,CAACvD,GAAG,CAACoE,UAAL,IACCpE,GAAG,CAACoE,UAAJ,IAAkB5C,iBAAA,CAAYyD,EAA9B,IAAoCjF,GAAG,CAACoE,UAAJ,GAAiB5C,iBAAA,CAAY0D,gBAFpE,EAGE;QACAlF,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQ6E,IAAnB,EAAyB,MAAM,IAAAC,kBAAA,EAAYpD,IAAZ,CAAN,GAAoC,GAA7D;MACD;IACF,CApBD,MAoBO,CACL;IACD;EACF,CAxBD,CAwBE,OAAOqD,GAAP,EAAiB;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAJ,CAAYzF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;MACxD,IAAI6E,eAAA,CAAEG,KAAF,CAAQ7E,GAAG,CAACuF,MAAZ,MAAwB,KAA5B,EAAmC;QAAA;;QACjC,eAAAvF,GAAG,CAACuF,MAAJ,4DAAYC,OAAZ;MACD;;MACD;IACD;;IACD,MAAMH,GAAN;EACD;;EAEDrF,GAAG,CAACyF,IAAJ,CAASzD,IAAT;AACD,C,CAED;;;AACO,MAAM0D,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa9F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;EAC3F;EACAF,GAAG,CAAC8F,GAAJ,GAAUnC,cAAA,CAAOoC,KAAP,CAAa;IAAEC,GAAG,EAAE;EAAP,CAAb,CAAV;EAEA,MAAMC,KAAK,GAAGjG,GAAG,CAACqB,OAAJ,CAAY6E,aAA1B;;EACA,IAAIvB,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BjG,GAAG,CAACqB,OAAJ,CAAY6E,aAAZ,GAA4B,cAA5B;EACD;;EAED,MAAMC,OAAO,GAAGnG,GAAG,CAACqB,OAAJ,CAAY+E,MAA5B;;EACA,IAAIzB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BnG,GAAG,CAACqB,OAAJ,CAAY+E,MAAZ,GAAqB,cAArB;EACD;;EAEDpG,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAACqG,WAAd;EACArG,GAAG,CAAC8F,GAAJ,CAAQQ,IAAR,CAAa;IAAEtG,GAAG,EAAEA,GAAP;IAAYuG,EAAE,EAAEvG,GAAG,CAACuG;EAApB,CAAb,EAAuC,4CAAvC;EACAvG,GAAG,CAACqG,WAAJ,GAAkBrG,GAAG,CAAC4B,GAAtB;;EAEA,IAAI+C,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BjG,GAAG,CAACqB,OAAJ,CAAY6E,aAAZ,GAA4BD,KAA5B;EACD;;EAED,IAAItB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BnG,GAAG,CAACqB,OAAJ,CAAY+E,MAAZ,GAAqBD,OAArB;EACD;;EAED,IAAIK,OAAO,GAAG,CAAd;EACAxG,GAAG,CAACyG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAjB;EACD,CAFD;EAIA,IAAIkE,QAAQ,GAAG,CAAf;EACA,MAAMC,MAAM,GAAG3G,GAAG,CAAC4G,KAAnB,CAhC2F,CAiC3F;EACA;;EACA5G,GAAG,CAAC4G,KAAJ,GAAY,UAAUC,GAAV,EAAwB;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACA;IACA;;IACAmE,MAAM,CAACG,KAAP,CAAa9G,GAAb,EAAkB+G,SAAlB;EACD,CALD;;EAOA,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGjH,GAAG,CAACqB,OAAJ,CAAY,iBAAZ,CAArB;IACA,MAAM6F,aAAa,GAAGlH,GAAG,CAACmH,UAAJ,CAAeD,aAArC;IACA,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;IACA,IAAI3B,OAAJ;;IACA,IAAItF,GAAG,CAAC8E,MAAJ,CAAWC,gBAAf,EAAiC;MAC/BO,OAAO,GAAGK,mBAAV;IACD,CAFD,MAEO;MACLL,OAAO,GAAGM,mBAAV;IACD;;IAED7F,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAACqG,WAAd;IACArG,GAAG,CAAC8F,GAAJ,CAAQuB,IAAR,CACE;MACEC,OAAO,EAAE;QACPC,MAAM,EAAEvH,GAAG,CAACuH,MADL;QAEP3F,GAAG,EAAE5B,GAAG,CAAC4B;MAFF,CADX;MAKEiC,IAAI,EAAG7D,GAAG,CAAC0D,WAAJ,IAAmB1D,GAAG,CAAC0D,WAAJ,CAAgB7C,IAApC,IAA6C,IALrD;MAMEuG,QANF;MAOEI,MAAM,EAAEvH,GAAG,CAACoE,UAPd;MAQEP,KAAK,EAAE7D,GAAG,CAAC8E,MAAJ,CAAWC,gBARpB;MASEyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OADC;QAELmB,GAAG,EAAEhB;MAFA;IATT,CADF,EAeEpB,OAfF;IAiBAvF,GAAG,CAACqG,WAAJ,GAAkBrG,GAAG,CAAC4B,GAAtB;EACD,CA9BD;;EAgCA5B,GAAG,CAACyG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;IAChCX,GAAG;EACJ,CAFD;EAIA,MAAM8B,IAAI,GAAG3H,GAAG,CAAC4H,GAAjB,CA9E2F,CA+E3F;;EACA5H,GAAG,CAAC4H,GAAJ,GAAU,UAAUf,GAAV,EAAqB;IAC7B,IAAIA,GAAJ,EAAS;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACD;IACD;IACA;;;IACAmF,IAAI,CAACb,KAAL,CAAW9G,GAAX,EAAgB+G,SAAhB;;IACAlB,GAAG;EACJ,CARD;;EASA5F,IAAI;AACL;;AAEM,SAAS4H,WAAT,CACLxC,GADK,EAELtF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;EACAN,KAAK,CAAC,oBAAD,CAAL;;EACA,IAAI+E,eAAA,CAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;IAClB1F,KAAK,CAAC,iBAAD,CAAL;;IACA,IAAI0F,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B/H,GAAG,CAACoE,UAAJ,KAAmB5C,iBAAA,CAAYwG,YAAhE,EAA8E;MAC5E,OAAO/H,IAAI,EAAX;IACD;;IACD,IAAIyE,eAAA,CAAEuD,UAAF,CAAajI,GAAG,CAAC8E,MAAJ,CAAWoD,YAAxB,MAA0C,KAA9C,EAAqD;MACnDvI,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;MACA;;MACAwI,wBAAwB,CAACpI,GAAD,EAAMC,GAAN,EAAW0E,eAAA,CAAE0D,IAAb,CAAxB;IACD;;IACDzI,KAAK,CAAC,6BAAD,CAAL;IACAK,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,CAAwB7C,GAAxB;EACD,CAbD,MAaO;IACL;IACA1F,KAAK,CAAC,qCAAD,CAAL;IACA,OAAOM,IAAI,CAACoF,GAAD,CAAX;EACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLpI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACNN,KAAK,CAAC,yBAAD,CAAL;;EACAK,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,GACElI,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,IACA,UAAU7C,GAAV,EAAqC;IACnC,IAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc/F,iBAAA,CAAY6G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;MAC3E5H,KAAK,CAAC,mBAAD,EAAsB0F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA,IAAI7C,eAAA,CAAEG,KAAF,CAAQ7E,GAAG,CAACsI,WAAZ,MAA6B,KAAjC,EAAwC;QACtC3I,KAAK,CAAC,gBAAD,EAAmB0F,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;QACAvH,GAAG,CAACuH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;QACA5H,KAAK,CAAC,eAAD,EAAkB0F,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;QACArF,IAAI,CAAC;UAAE4D,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,eAAA,CAAUsE;QAAlC,CAAD,CAAJ;MACD;IACF,CARD,MAQO;MACL5I,KAAK,CAAC,mBAAD,EAAsB0F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA7D,cAAA,CAAOG,KAAP,CAAa;QAAEwB,GAAG,EAAEA;MAAP,CAAb,EAA2B,iDAA3B;;MACA,IAAI,CAACrF,GAAG,CAACuH,MAAL,IAAe,CAACvH,GAAG,CAACyF,IAAxB,EAA8B;QAC5B;QACA/B,cAAA,CAAOG,KAAP,CAAa,oDAAb;;QACAlE,KAAK,CAAC,yEAAD,EAA4E0F,GAA5E,CAAL;QACArF,GAAG,CAACwF,OAAJ;MACD,CALD,MAKO,IAAI,CAACxF,GAAG,CAACsI,WAAT,EAAsB;QAC3B3I,KAAK,CAAC,0BAAD,EAA6B0F,GAA7B,CAAL;QACArF,GAAG,CAACuH,MAAJ,CAAW/F,iBAAA,CAAYgH,cAAvB;QACAvI,IAAI,CAAC;UAAE4D,KAAK,EAAEI,eAAA,CAAUwE;QAAnB,CAAD,CAAJ;MACD,CAJM,MAIA;QACL;QACA9I,KAAK,CAAC,6CAAD,EAAgD0F,GAAhD,CAAL;MACD;IACF;EACF,CA5BH;;EA8BA1F,KAAK,CAAC,gCAAD,CAAL;EACAM,IAAI;AACL"}
1
+ {"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","get","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.get('x-forwarded-for');\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;EACzC,OAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;IACN,IAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;MACtBD,IAAI;IACL,CAFD,MAEO;MACLA,IAAI,CAAC,OAAD,CAAJ;IACD;EACF,CAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN;EACAD,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;EACAP,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;EACAR,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;EACAT,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQI,GAAnB,EAAwB,eAAxB;EACAT,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAY,mBAAA,EAAiBX,KAAjB,CAAJ,EAA6B;IAClCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASI,eAAT,CACLjB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAgB,sBAAA,EAAoBf,KAApB,CAAJ,EAAgC;IACrCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASM,KAAT,CAAeC,MAAf,EAA2C;EAChD,OAAO,UAAUpB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;MACpDlB,IAAI,CACFa,gBAAA,CAAWS,OAAX,CACEC,iBAAA,CAAYC,iBADd,EAEE,iCAAiCN,MAAjC,GAA0C,SAA1C,GAAsDpB,GAAG,CAAC2B,GAAJ,CAAQL,iBAAA,CAAYC,YAApB,CAFxD,CADE,CAAJ;IAMD,CAPD,MAOO;MACLrB,IAAI;IACL;EACF,CAXD;AAYD;;AAEM,SAAS0B,kBAAT,CACL5B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAIF,GAAG,CAAC6B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;IAC/B;IACA9B,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAAC6B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;EACD;;EACD7B,IAAI;AACL;;AAEM,SAAS8B,UAAT,CACLhC,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAI,CAAC,IAAA+B,eAAA,EAASjC,GAAG,CAACkC,IAAb,CAAL,EAAyB;IACvB,OAAOhC,IAAI,CAACa,gBAAA,CAAWoB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;EACD;;EACDjC,IAAI;AACL;;AAEM,SAASkC,QAAT,CAAkBC,MAAlB,EAA4C;EACjD,OAAO,UAAUrC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IAAA;;IACxF,IAAI,CAAAF,GAAG,SAAH,IAAAA,GAAG,WAAH,4BAAAA,GAAG,CAAEqB,OAAL,8DAAciB,GAAd,KAAqB,IAAzB,EAA+B;MAC7B,MAAMC,GAAG,GAAGvC,GAAG,CAACqB,OAAJ,CAAYiB,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;MAEA,KAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAO3C,KAAP,CAAa,kBAAb,CAAV;;QACA,IAAI6C,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;UAClC,OAAO1C,IAAI,CAACa,gBAAA,CAAWS,OAAX,CAAmBC,iBAAA,CAAYoB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;QACD;MACF;IACF;;IACD3C,IAAI;EACL,CAZD;AAaD;;AAEM,SAAS4C,KAAT,CAAeC,IAAf,EAAqC;EAC1C,OAAO,UAAUC,MAAV,EAAoC;IACzC,OAAO,UAAUhD,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;MACxFF,GAAG,CAACiD,KAAJ;MACA,MAAMC,WAAW,GAAGlD,GAAG,CAACmD,MAAJ,CAAWC,KAAX,GACf,IAAGpD,GAAG,CAACmD,MAAJ,CAAWC,KAAM,IAAGpD,GAAG,CAACmD,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBrD,GAAG,CAACmD,MAAJ,CAAWE,OAFf;MAGA,MAAMC,cAAc,GAAGtD,GAAG,CAACmD,MAAJ,CAAWI,QAAX,GACnB,IAAAC,sCAAA,EAAsBxD,GAAG,CAACmD,MAAJ,CAAWI,QAAjC,CADmB,GAEnBE,SAFJ;MAGA,MAAMC,MAAM,GAAG1D,GAAG,CAAC2D,WAAnB;;MACAC,cAAA,CAAOC,KAAP,CACE;QAAEb,MAAF;QAAUc,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAE7C;MAAxB,CADF,EAEG,iDAFH;;MAIAkC,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;QAAEE,WAAF;QAAeI;MAAf,CADF,EAEEI,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;QAC9BhE,GAAG,CAACiE,MAAJ;;QACA,IAAIF,KAAJ,EAAW;UACT7D,IAAI,CAAC6D,KAAD,CAAJ;QACD,CAFD,MAEO,IAAIC,OAAJ,EAAa;UAClB9D,IAAI;QACL,CAFM,MAEA;UACL;UACA;UACA,MAAMa,gBAAA,CAAWmD,gBAAX,CAA4BC,eAAA,CAAUC,YAAtC,CAAN;QACD;MACF,CAdH;IAgBD,CA7BD;EA8BD,CA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLnC,IADK,EAELlC,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;EACN,IAAID,GAAG,CAACqE,UAAJ,KAAmB7C,iBAAA,CAAY8C,YAA/B,IAA+C,CAACtE,GAAG,CAACuE,SAAJ,CAAcjE,aAAA,CAAQkE,QAAtB,CAApD,EAAqF;IACnF;IACAxE,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQkE,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;EACD;;EAED,IAAI;IACF,IAAIC,eAAA,CAAEC,QAAF,CAAW3C,IAAX,KAAoB0C,eAAA,CAAE3C,QAAF,CAAWC,IAAX,CAAxB,EAA0C;MACxC,IAAI,CAACjC,GAAG,CAACuE,SAAJ,CAAcjE,aAAA,CAAQgB,YAAtB,CAAL,EAA0C;QACxCtB,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQgB,YAAnB,EAAiChB,aAAA,CAAQuE,IAAzC;MACD;;MAED,IAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4B0C,eAAA,CAAEG,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;QACvD,IAAI,OAAQA,IAAD,CAA0B6B,KAAjC,KAA2C,QAA/C,EAAyD;UACvD9D,GAAG,CAAC+E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B6B,KAAxD,CADuD,CAEvD;QACD;;QACD7B,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBuB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;MACD,CAXuC,CAaxC;;;MACA,IACE,CAACxD,GAAG,CAACqE,UAAL,IACCrE,GAAG,CAACqE,UAAJ,IAAkB7C,iBAAA,CAAY0D,EAA9B,IAAoClF,GAAG,CAACqE,UAAJ,GAAiB7C,iBAAA,CAAY2D,gBAFpE,EAGE;QACAnF,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQ8E,IAAnB,EAAyB,MAAM,IAAAC,kBAAA,EAAYpD,IAAZ,CAAN,GAAoC,GAA7D;MACD;IACF,CApBD,MAoBO,CACL;IACD;EACF,CAxBD,CAwBE,OAAOqD,GAAP,EAAiB;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAJ,CAAY1F,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;MACxD,IAAI8E,eAAA,CAAEG,KAAF,CAAQ9E,GAAG,CAACwF,MAAZ,MAAwB,KAA5B,EAAmC;QAAA;;QACjC,eAAAxF,GAAG,CAACwF,MAAJ,4DAAYC,OAAZ;MACD;;MACD;IACD;;IACD,MAAMH,GAAN;EACD;;EAEDtF,GAAG,CAAC0F,IAAJ,CAASzD,IAAT;AACD,C,CAED;;;AACO,MAAM0D,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa/F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;EAC3F;EACAF,GAAG,CAAC+F,GAAJ,GAAUnC,cAAA,CAAOoC,KAAP,CAAa;IAAEC,GAAG,EAAE;EAAP,CAAb,CAAV;EAEA,MAAMC,KAAK,GAAGlG,GAAG,CAACqB,OAAJ,CAAY8E,aAA1B;;EACA,IAAIvB,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BlG,GAAG,CAACqB,OAAJ,CAAY8E,aAAZ,GAA4B,cAA5B;EACD;;EAED,MAAMC,OAAO,GAAGpG,GAAG,CAAC2B,GAAJ,CAAQ,QAAR,CAAhB;;EACA,IAAIiD,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BpG,GAAG,CAACqB,OAAJ,CAAYgF,MAAZ,GAAqB,cAArB;EACD;;EAEDrG,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAACsG,WAAd;EACAtG,GAAG,CAAC+F,GAAJ,CAAQQ,IAAR,CAAa;IAAEvG,GAAG,EAAEA,GAAP;IAAYwG,EAAE,EAAExG,GAAG,CAACwG;EAApB,CAAb,EAAuC,4CAAvC;EACAxG,GAAG,CAACsG,WAAJ,GAAkBtG,GAAG,CAAC6B,GAAtB;;EAEA,IAAI+C,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BlG,GAAG,CAACqB,OAAJ,CAAY8E,aAAZ,GAA4BD,KAA5B;EACD;;EAED,IAAItB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BpG,GAAG,CAACqB,OAAJ,CAAYgF,MAAZ,GAAqBD,OAArB;EACD;;EAED,IAAIK,OAAO,GAAG,CAAd;EACAzG,GAAG,CAAC0G,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAjB;EACD,CAFD;EAIA,IAAIkE,QAAQ,GAAG,CAAf;EACA,MAAMC,MAAM,GAAG5G,GAAG,CAAC6G,KAAnB,CAhC2F,CAiC3F;EACA;;EACA7G,GAAG,CAAC6G,KAAJ,GAAY,UAAUC,GAAV,EAAwB;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACA;IACA;;IACAmE,MAAM,CAACG,KAAP,CAAa/G,GAAb,EAAkBgH,SAAlB;EACD,CALD;;EAOA,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGlH,GAAG,CAAC2B,GAAJ,CAAQ,iBAAR,CAArB;IACA,MAAMwF,aAAa,GAAGnH,GAAG,CAACoH,UAAJ,CAAeD,aAArC;IACA,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;IACA,IAAI3B,OAAJ;;IACA,IAAIvF,GAAG,CAAC+E,MAAJ,CAAWC,gBAAf,EAAiC;MAC/BO,OAAO,GAAGK,mBAAV;IACD,CAFD,MAEO;MACLL,OAAO,GAAGM,mBAAV;IACD;;IAED9F,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAACsG,WAAd;IACAtG,GAAG,CAAC+F,GAAJ,CAAQuB,IAAR,CACE;MACEC,OAAO,EAAE;QACPC,MAAM,EAAExH,GAAG,CAACwH,MADL;QAEP3F,GAAG,EAAE7B,GAAG,CAAC6B;MAFF,CADX;MAKEiC,IAAI,EAAG9D,GAAG,CAAC2D,WAAJ,IAAmB3D,GAAG,CAAC2D,WAAJ,CAAgB9C,IAApC,IAA6C,IALrD;MAMEwG,QANF;MAOEI,MAAM,EAAExH,GAAG,CAACqE,UAPd;MAQEP,KAAK,EAAE9D,GAAG,CAAC+E,MAAJ,CAAWC,gBARpB;MASEyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OADC;QAELmB,GAAG,EAAEhB;MAFA;IATT,CADF,EAeEpB,OAfF;IAiBAxF,GAAG,CAACsG,WAAJ,GAAkBtG,GAAG,CAAC6B,GAAtB;EACD,CA9BD;;EAgCA7B,GAAG,CAAC0G,EAAJ,CAAO,OAAP,EAAgB,YAAkB;IAChCX,GAAG;EACJ,CAFD;EAIA,MAAM8B,IAAI,GAAG5H,GAAG,CAAC6H,GAAjB,CA9E2F,CA+E3F;;EACA7H,GAAG,CAAC6H,GAAJ,GAAU,UAAUf,GAAV,EAAqB;IAC7B,IAAIA,GAAJ,EAAS;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACD;IACD;IACA;;;IACAmF,IAAI,CAACb,KAAL,CAAW/G,GAAX,EAAgBgH,SAAhB;;IACAlB,GAAG;EACJ,CARD;;EASA7F,IAAI;AACL;;AAEM,SAAS6H,WAAT,CACLxC,GADK,EAELvF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;EACAN,KAAK,CAAC,oBAAD,CAAL;;EACA,IAAIgF,eAAA,CAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;IAClB3F,KAAK,CAAC,iBAAD,CAAL;;IACA,IAAI2F,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6BhI,GAAG,CAACqE,UAAJ,KAAmB7C,iBAAA,CAAYyG,YAAhE,EAA8E;MAC5E,OAAOhI,IAAI,EAAX;IACD;;IACD,IAAI0E,eAAA,CAAEuD,UAAF,CAAalI,GAAG,CAAC+E,MAAJ,CAAWoD,YAAxB,MAA0C,KAA9C,EAAqD;MACnDxI,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;MACA;;MACAyI,wBAAwB,CAACrI,GAAD,EAAMC,GAAN,EAAW2E,eAAA,CAAE0D,IAAb,CAAxB;IACD;;IACD1I,KAAK,CAAC,6BAAD,CAAL;IACAK,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,CAAwB7C,GAAxB;EACD,CAbD,MAaO;IACL;IACA3F,KAAK,CAAC,qCAAD,CAAL;IACA,OAAOM,IAAI,CAACqF,GAAD,CAAX;EACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLrI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACNN,KAAK,CAAC,yBAAD,CAAL;;EACAK,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,GACEnI,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,IACA,UAAU7C,GAAV,EAAqC;IACnC,IAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAchG,iBAAA,CAAY8G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;MAC3E7H,KAAK,CAAC,mBAAD,EAAsB2F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA,IAAI7C,eAAA,CAAEG,KAAF,CAAQ9E,GAAG,CAACuI,WAAZ,MAA6B,KAAjC,EAAwC;QACtC5I,KAAK,CAAC,gBAAD,EAAmB2F,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;QACAxH,GAAG,CAACwH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;QACA7H,KAAK,CAAC,eAAD,EAAkB2F,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;QACAtF,IAAI,CAAC;UAAE6D,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,eAAA,CAAUsE;QAAlC,CAAD,CAAJ;MACD;IACF,CARD,MAQO;MACL7I,KAAK,CAAC,mBAAD,EAAsB2F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA7D,cAAA,CAAOG,KAAP,CAAa;QAAEwB,GAAG,EAAEA;MAAP,CAAb,EAA2B,iDAA3B;;MACA,IAAI,CAACtF,GAAG,CAACwH,MAAL,IAAe,CAACxH,GAAG,CAAC0F,IAAxB,EAA8B;QAC5B;QACA/B,cAAA,CAAOG,KAAP,CAAa,oDAAb;;QACAnE,KAAK,CAAC,yEAAD,EAA4E2F,GAA5E,CAAL;QACAtF,GAAG,CAACyF,OAAJ;MACD,CALD,MAKO,IAAI,CAACzF,GAAG,CAACuI,WAAT,EAAsB;QAC3B5I,KAAK,CAAC,0BAAD,EAA6B2F,GAA7B,CAAL;QACAtF,GAAG,CAACwH,MAAJ,CAAWhG,iBAAA,CAAYiH,cAAvB;QACAxI,IAAI,CAAC;UAAE6D,KAAK,EAAEI,eAAA,CAAUwE;QAAnB,CAAD,CAAJ;MACD,CAJM,MAIA;QACL;QACA/I,KAAK,CAAC,6CAAD,EAAgD2F,GAAhD,CAAL;MACD;IACF;EACF,CA5BH;;EA8BA3F,KAAK,CAAC,gCAAD,CAAL;EACAM,IAAI;AACL"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@verdaccio/middleware",
3
- "version": "6.0.0-6-next.29",
3
+ "version": "6.0.0-6-next.30",
4
4
  "description": "loaders logic",
5
5
  "main": "./build/index.js",
6
6
  "types": "build/index.d.ts",
@@ -32,10 +32,10 @@
32
32
  "dependencies": {
33
33
  "debug": "4.3.4",
34
34
  "body-parser": "1.20.1",
35
- "@verdaccio/auth": "6.0.0-6-next.29",
36
- "@verdaccio/core": "6.0.0-6-next.50",
37
- "@verdaccio/logger": "6.0.0-6-next.18",
38
- "@verdaccio/utils": "6.0.0-6-next.18",
35
+ "@verdaccio/auth": "6.0.0-6-next.30",
36
+ "@verdaccio/core": "6.0.0-6-next.51",
37
+ "@verdaccio/logger": "6.0.0-6-next.19",
38
+ "@verdaccio/utils": "6.0.0-6-next.19",
39
39
  "lodash": "4.17.21"
40
40
  },
41
41
  "funding": {
package/src/middleware.ts CHANGED
@@ -104,10 +104,7 @@ export function media(expect: string | null): any {
104
104
  next(
105
105
  errorUtils.getCode(
106
106
  HTTP_STATUS.UNSUPPORTED_MEDIA,
107
- 'wrong content-type, expect: ' +
108
- expect +
109
- ', got: ' +
110
- req.headers[HEADER_TYPE.CONTENT_TYPE]
107
+ 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]
111
108
  )
112
109
  );
113
110
  } else {
@@ -141,7 +138,7 @@ export function expectJson(
141
138
 
142
139
  export function antiLoop(config: Config): Function {
143
140
  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
144
- if (req.headers.via != null) {
141
+ if (req?.headers?.via != null) {
145
142
  const arr = req.headers.via.split(',');
146
143
 
147
144
  for (let i = 0; i < arr.length; i++) {
@@ -264,7 +261,7 @@ export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFuncti
264
261
  req.headers.authorization = '<Classified>';
265
262
  }
266
263
 
267
- const _cookie = req.headers.cookie;
264
+ const _cookie = req.get('cookie');
268
265
  if (_.isNil(_cookie) === false) {
269
266
  req.headers.cookie = '<Classified>';
270
267
  }
@@ -298,7 +295,7 @@ export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFuncti
298
295
  };
299
296
 
300
297
  const log = function (): void {
301
- const forwardedFor = req.headers['x-forwarded-for'];
298
+ const forwardedFor = req.get('x-forwarded-for');
302
299
  const remoteAddress = req.connection.remoteAddress;
303
300
  const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
304
301
  let message;