@verdaccio/middleware 6.0.0-6-next.29 → 6.0.0-6-next.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/CHANGELOG.md +32 -0
  2. package/build/index.js +0 -2
  3. package/build/index.js.map +1 -1
  4. package/build/middleware-utils.js +0 -1
  5. package/build/middleware-utils.js.map +1 -1
  6. package/build/middleware.d.ts +4 -4
  7. package/build/middleware.js +32 -87
  8. package/build/middleware.js.map +1 -1
  9. package/package.json +5 -5
  10. package/src/middleware.ts +4 -7
package/CHANGELOG.md CHANGED
@@ -1,5 +1,37 @@
1
1
  # @verdaccio/middleware
2
2
 
3
+ ## 6.0.0-6-next.31
4
+
5
+ ### Patch Changes
6
+
7
+ - @verdaccio/core@6.0.0-6-next.52
8
+ - @verdaccio/auth@6.0.0-6-next.31
9
+ - @verdaccio/logger@6.0.0-6-next.20
10
+ - @verdaccio/utils@6.0.0-6-next.20
11
+
12
+ ## 6.0.0-6-next.30
13
+
14
+ ### Minor Changes
15
+
16
+ - 4b29d715: chore: move improvements from v5 to v6
17
+
18
+ Migrate improvements form v5 to v6:
19
+
20
+ - https://github.com/verdaccio/verdaccio/pull/3158
21
+ - https://github.com/verdaccio/verdaccio/pull/3151
22
+ - https://github.com/verdaccio/verdaccio/pull/2271
23
+ - https://github.com/verdaccio/verdaccio/pull/2787
24
+ - https://github.com/verdaccio/verdaccio/pull/2791
25
+ - https://github.com/verdaccio/verdaccio/pull/2205
26
+
27
+ ### Patch Changes
28
+
29
+ - Updated dependencies [4b29d715]
30
+ - @verdaccio/auth@6.0.0-6-next.30
31
+ - @verdaccio/core@6.0.0-6-next.51
32
+ - @verdaccio/logger@6.0.0-6-next.19
33
+ - @verdaccio/utils@6.0.0-6-next.19
34
+
3
35
  ## 6.0.0-6-next.29
4
36
 
5
37
  ### Patch Changes
package/build/index.js CHANGED
@@ -3,9 +3,7 @@
3
3
  Object.defineProperty(exports, "__esModule", {
4
4
  value: true
5
5
  });
6
-
7
6
  var _middleware = require("./middleware");
8
-
9
7
  Object.keys(_middleware).forEach(function (key) {
10
8
  if (key === "default" || key === "__esModule") return;
11
9
  if (key in exports && exports[key] === _middleware[key]) return;
package/build/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export * from './middleware';\n"],"mappings":";;;;;;AAAA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
1
+ {"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export * from './middleware';\n"],"mappings":";;;;;AAAA;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
package/build/middleware-utils.js CHANGED
@@ -4,7 +4,6 @@ Object.defineProperty(exports, "__esModule", {
4
4
  value: true
5
5
  });
6
6
  exports.getVersionFromTarball = getVersionFromTarball;
7
-
8
7
  /**
9
8
  * return package version from tarball name
10
9
  * @param {String} name
package/build/middleware-utils.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"middleware-utils.js","names":["getVersionFromTarball","name","groups","match","undefined"],"sources":["../src/middleware-utils.ts"],"sourcesContent":["/**\n * return package version from tarball name\n * @param {String} name\n * @returns {String}\n */\nexport function getVersionFromTarball(name: string): string | void {\n const groups = name.match(/.+-(\\d.+)\\.tgz/);\n\n return groups !== null ? groups[1] : undefined;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACO,SAASA,qBAAT,CAA+BC,IAA/B,EAA4D;EACjE,MAAMC,MAAM,GAAGD,IAAI,CAACE,KAAL,CAAW,gBAAX,CAAf;EAEA,OAAOD,MAAM,KAAK,IAAX,GAAkBA,MAAM,CAAC,CAAD,CAAxB,GAA8BE,SAArC;AACD"}
1
+ {"version":3,"file":"middleware-utils.js","names":["getVersionFromTarball","name","groups","match","undefined"],"sources":["../src/middleware-utils.ts"],"sourcesContent":["/**\n * return package version from tarball name\n * @param {String} name\n * @returns {String}\n */\nexport function getVersionFromTarball(name: string): string | void {\n const groups = name.match(/.+-(\\d.+)\\.tgz/);\n\n return groups !== null ? groups[1] : undefined;\n}\n"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACO,SAASA,qBAAqB,CAACC,IAAY,EAAiB;EACjE,MAAMC,MAAM,GAAGD,IAAI,CAACE,KAAK,CAAC,gBAAgB,CAAC;EAE3C,OAAOD,MAAM,KAAK,IAAI,GAAGA,MAAM,CAAC,CAAC,CAAC,GAAGE,SAAS;AAChD"}
package/build/middleware.d.ts CHANGED
@@ -2,14 +2,14 @@ import { NextFunction, Request, Response } from 'express';
2
2
  import { HttpError } from 'http-errors';
3
3
  import { Auth } from '@verdaccio/auth';
4
4
  import { Config, Logger, Package, RemoteUser } from '@verdaccio/types';
5
- export declare type $RequestExtend = Request & {
5
+ export type $RequestExtend = Request & {
6
6
  remote_user?: RemoteUser;
7
7
  log: Logger;
8
8
  };
9
- export declare type $ResponseExtend = Response & {
9
+ export type $ResponseExtend = Response & {
10
10
  cookies?: any;
11
11
  };
12
- export declare type $NextFunctionVer = NextFunction & any;
12
+ export type $NextFunctionVer = NextFunction & any;
13
13
  export declare function match(regexp: RegExp): any;
14
14
  export declare function setSecurityWebHeaders(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;
15
15
  export declare function validateName(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer, value: string, name: string): void;
@@ -22,7 +22,7 @@ export declare function allow(auth: Auth): Function;
22
22
  export interface MiddlewareError {
23
23
  error: string;
24
24
  }
25
- export declare type FinalBody = Package | MiddlewareError | string;
25
+ export type FinalBody = Package | MiddlewareError | string;
26
26
  export declare function final(body: FinalBody, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;
27
27
  export declare const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
28
28
  export declare const LOG_VERDACCIO_ERROR: string;
package/build/middleware.js CHANGED
@@ -17,23 +17,14 @@ exports.media = media;
17
17
  exports.setSecurityWebHeaders = setSecurityWebHeaders;
18
18
  exports.validateName = validateName;
19
19
  exports.validatePackage = validatePackage;
20
-
21
20
  var _debug = _interopRequireDefault(require("debug"));
22
-
23
21
  var _lodash = _interopRequireDefault(require("lodash"));
24
-
25
22
  var _core = require("@verdaccio/core");
26
-
27
23
  var _logger = require("@verdaccio/logger");
28
-
29
24
  var _utils = require("@verdaccio/utils");
30
-
31
25
  var _middlewareUtils = require("./middleware-utils");
32
-
33
26
  function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
34
-
35
27
  const debug = (0, _debug.default)('verdaccio:middleware');
36
-
37
28
  function match(regexp) {
38
29
  return function (req, res, next, value) {
39
30
  if (regexp.exec(value)) {
@@ -42,22 +33,21 @@ function match(regexp) {
42
33
  next('route');
43
34
  }
44
35
  };
45
- } // TODO: remove, was relocated to web package
46
- // @ts-deprecated
47
-
36
+ }
48
37
 
38
+ // TODO: remove, was relocated to web package
39
+ // @ts-deprecated
49
40
  function setSecurityWebHeaders(req, res, next) {
50
41
  // disable loading in frames (clickjacking, etc.)
51
- res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny'); // avoid stablish connections outside of domain
52
-
53
- res.header(_core.HEADERS.CSP, "connect-src 'self'"); // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
54
-
55
- res.header(_core.HEADERS.CTO, 'nosniff'); // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
56
-
42
+ res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
43
+ // avoid stablish connections outside of domain
44
+ res.header(_core.HEADERS.CSP, "connect-src 'self'");
45
+ // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
46
+ res.header(_core.HEADERS.CTO, 'nosniff');
47
+ // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
57
48
  res.header(_core.HEADERS.XSS, '1; mode=block');
58
49
  next();
59
50
  }
60
-
61
51
  function validateName(req, res, next, value, name) {
62
52
  if (value === '-') {
63
53
  // special case in couchdb usually
@@ -68,7 +58,6 @@ function validateName(req, res, next, value, name) {
68
58
  next(_core.errorUtils.getForbidden('invalid ' + name));
69
59
  }
70
60
  }
71
-
72
61
  function validatePackage(req, res, next, value, name) {
73
62
  if (value === '-') {
74
63
  // special case in couchdb usually
@@ -79,52 +68,43 @@ function validatePackage(req, res, next, value, name) {
79
68
  next(_core.errorUtils.getForbidden('invalid ' + name));
80
69
  }
81
70
  }
82
-
83
71
  function media(expect) {
84
72
  return function (req, res, next) {
85
73
  if (req.headers[_core.HEADER_TYPE.CONTENT_TYPE] !== expect) {
86
- next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.headers[_core.HEADER_TYPE.CONTENT_TYPE]));
74
+ next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.get[_core.HEADER_TYPE.CONTENT_TYPE]));
87
75
  } else {
88
76
  next();
89
77
  }
90
78
  };
91
79
  }
92
-
93
80
  function encodeScopePackage(req, res, next) {
94
81
  if (req.url.indexOf('@') !== -1) {
95
82
  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
96
83
  req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
97
84
  }
98
-
99
85
  next();
100
86
  }
101
-
102
87
  function expectJson(req, res, next) {
103
88
  if (!(0, _utils.isObject)(req.body)) {
104
89
  return next(_core.errorUtils.getBadRequest("can't parse incoming json"));
105
90
  }
106
-
107
91
  next();
108
92
  }
109
-
110
93
  function antiLoop(config) {
111
94
  return function (req, res, next) {
112
- if (req.headers.via != null) {
95
+ var _req$headers;
96
+ if ((req === null || req === void 0 ? void 0 : (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.via) != null) {
113
97
  const arr = req.headers.via.split(',');
114
-
115
98
  for (let i = 0; i < arr.length; i++) {
116
99
  const m = arr[i].match(/\s*(\S+)\s+(\S+)/);
117
-
118
100
  if (m && m[2] === config.server_id) {
119
101
  return next(_core.errorUtils.getCode(_core.HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
120
102
  }
121
103
  }
122
104
  }
123
-
124
105
  next();
125
106
  };
126
107
  }
127
-
128
108
  function allow(auth) {
129
109
  return function (action) {
130
110
  return function (req, res, next) {
@@ -132,18 +112,15 @@ function allow(auth) {
132
112
  const packageName = req.params.scope ? `@${req.params.scope}/${req.params.package}` : req.params.package;
133
113
  const packageVersion = req.params.filename ? (0, _middlewareUtils.getVersionFromTarball)(req.params.filename) : undefined;
134
114
  const remote = req.remote_user;
135
-
136
115
  _logger.logger.trace({
137
116
  action,
138
117
  user: remote === null || remote === void 0 ? void 0 : remote.name
139
118
  }, `[middleware/allow][@{action}] allow for @{user}`);
140
-
141
119
  auth['allow_' + action]({
142
120
  packageName,
143
121
  packageVersion
144
122
  }, remote, function (error, allowed) {
145
123
  req.resume();
146
-
147
124
  if (error) {
148
125
  next(error);
149
126
  } else if (allowed) {
@@ -157,34 +134,34 @@ function allow(auth) {
157
134
  };
158
135
  };
159
136
  }
160
-
161
- function final(body, req, res, // if we remove `next` breaks test
137
+ function final(body, req, res,
138
+ // if we remove `next` breaks test
162
139
  // eslint-disable-next-line @typescript-eslint/no-unused-vars
163
140
  next) {
164
141
  if (res.statusCode === _core.HTTP_STATUS.UNAUTHORIZED && !res.getHeader(_core.HEADERS.WWW_AUTH)) {
165
142
  // they say it's required for 401, so...
166
143
  res.header(_core.HEADERS.WWW_AUTH, `${_core.TOKEN_BASIC}, ${_core.TOKEN_BEARER}`);
167
144
  }
168
-
169
145
  try {
170
146
  if (_lodash.default.isString(body) || _lodash.default.isObject(body)) {
171
147
  if (!res.getHeader(_core.HEADERS.CONTENT_TYPE)) {
172
148
  res.header(_core.HEADERS.CONTENT_TYPE, _core.HEADERS.JSON);
173
149
  }
174
-
175
150
  if (typeof body === 'object' && _lodash.default.isNil(body) === false) {
176
151
  if (typeof body.error === 'string') {
177
- res.locals._verdaccio_error = body.error; // res._verdaccio_error = (body as MiddlewareError).error;
152
+ res.locals._verdaccio_error = body.error;
153
+ // res._verdaccio_error = (body as MiddlewareError).error;
178
154
  }
179
155
 
180
156
  body = JSON.stringify(body, undefined, ' ') + '\n';
181
- } // don't send etags with errors
182
-
157
+ }
183
158
 
159
+ // don't send etags with errors
184
160
  if (!res.statusCode || res.statusCode >= _core.HTTP_STATUS.OK && res.statusCode < _core.HTTP_STATUS.MULTIPLE_CHOICES) {
185
161
  res.header(_core.HEADERS.ETAG, '"' + (0, _utils.stringToMD5)(body) + '"');
186
162
  }
187
- } else {// send(null), send(204), etc.
163
+ } else {
164
+ // send(null), send(204), etc.
188
165
  }
189
166
  } catch (err) {
190
167
  // if verdaccio sends headers first, and then calls res.send()
@@ -193,87 +170,71 @@ next) {
193
170
  if (err.message.match(/set headers after they are sent/)) {
194
171
  if (_lodash.default.isNil(res.socket) === false) {
195
172
  var _res$socket;
196
-
197
173
  (_res$socket = res.socket) === null || _res$socket === void 0 ? void 0 : _res$socket.destroy();
198
174
  }
199
-
200
175
  return;
201
176
  }
202
-
203
177
  throw err;
204
178
  }
205
-
206
179
  res.send(body);
207
- } // FIXME: deprecated, moved to @verdaccio/dev-commons
208
-
180
+ }
209
181
 
182
+ // FIXME: deprecated, moved to @verdaccio/dev-commons
210
183
  const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
211
184
  exports.LOG_STATUS_MESSAGE = LOG_STATUS_MESSAGE;
212
185
  const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;
213
186
  exports.LOG_VERDACCIO_ERROR = LOG_VERDACCIO_ERROR;
214
187
  const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;
215
188
  exports.LOG_VERDACCIO_BYTES = LOG_VERDACCIO_BYTES;
216
-
217
189
  function log(req, res, next) {
218
190
  // logger
219
191
  req.log = _logger.logger.child({
220
192
  sub: 'in'
221
193
  });
222
194
  const _auth = req.headers.authorization;
223
-
224
195
  if (_lodash.default.isNil(_auth) === false) {
225
196
  req.headers.authorization = '<Classified>';
226
197
  }
227
-
228
- const _cookie = req.headers.cookie;
229
-
198
+ const _cookie = req.get('cookie');
230
199
  if (_lodash.default.isNil(_cookie) === false) {
231
200
  req.headers.cookie = '<Classified>';
232
201
  }
233
-
234
202
  req.url = req.originalUrl;
235
203
  req.log.info({
236
204
  req: req,
237
205
  ip: req.ip
238
206
  }, "@{ip} requested '@{req.method} @{req.url}'");
239
207
  req.originalUrl = req.url;
240
-
241
208
  if (_lodash.default.isNil(_auth) === false) {
242
209
  req.headers.authorization = _auth;
243
210
  }
244
-
245
211
  if (_lodash.default.isNil(_cookie) === false) {
246
212
  req.headers.cookie = _cookie;
247
213
  }
248
-
249
214
  let bytesin = 0;
250
215
  req.on('data', function (chunk) {
251
216
  bytesin += chunk.length;
252
217
  });
253
218
  let bytesout = 0;
254
- const _write = res.write; // FIXME: res.write should return boolean
219
+ const _write = res.write;
220
+ // FIXME: res.write should return boolean
255
221
  // @ts-ignore
256
-
257
222
  res.write = function (buf) {
258
223
  bytesout += buf.length;
259
224
  /* eslint prefer-rest-params: "off" */
260
225
  // @ts-ignore
261
-
262
226
  _write.apply(res, arguments);
263
227
  };
264
-
265
228
  const log = function () {
266
- const forwardedFor = req.headers['x-forwarded-for'];
229
+ const forwardedFor = req.get('x-forwarded-for');
267
230
  const remoteAddress = req.connection.remoteAddress;
268
231
  const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
269
232
  let message;
270
-
271
233
  if (res.locals._verdaccio_error) {
272
234
  message = LOG_VERDACCIO_ERROR;
273
235
  } else {
274
236
  message = LOG_VERDACCIO_BYTES;
275
237
  }
276
-
277
238
  req.url = req.originalUrl;
278
239
  req.log.http({
279
240
  request: {
@@ -291,45 +252,35 @@ function log(req, res, next) {
291
252
  }, message);
292
253
  req.originalUrl = req.url;
293
254
  };
294
-
295
255
  req.on('close', function () {
296
256
  log();
297
257
  });
298
- const _end = res.end; // @ts-ignore
299
-
258
+ const _end = res.end;
259
+ // @ts-ignore
300
260
  res.end = function (buf) {
301
261
  if (buf) {
302
262
  bytesout += buf.length;
303
263
  }
304
264
  /* eslint prefer-rest-params: "off" */
305
265
  // @ts-ignore
306
-
307
-
308
266
  _end.apply(res, arguments);
309
-
310
267
  log();
311
268
  };
312
-
313
269
  next();
314
270
  }
315
-
316
271
  function handleError(err, req, res, next) {
317
272
  debug('error handler init');
318
-
319
273
  if (_lodash.default.isError(err)) {
320
274
  debug('is native error');
321
-
322
275
  if (err.code === 'ECONNABORT' && res.statusCode === _core.HTTP_STATUS.NOT_MODIFIED) {
323
276
  return next();
324
277
  }
325
-
326
278
  if (_lodash.default.isFunction(res.locals.report_error) === false) {
327
- debug('is locals error report ref'); // in case of very early error this middleware may not be loaded before error is generated
279
+ debug('is locals error report ref');
280
+ // in case of very early error this middleware may not be loaded before error is generated
328
281
  // fixing that
329
-
330
282
  errorReportingMiddleware(req, res, _lodash.default.noop);
331
283
  }
332
-
333
284
  debug('set locals error report ref');
334
285
  res.locals.report_error(err);
335
286
  } else {
@@ -337,16 +288,14 @@ function handleError(err, req, res, next) {
337
288
  debug('no error to report, jump next layer');
338
289
  return next(err);
339
290
  }
340
- } // Middleware
341
-
291
+ }
342
292
 
293
+ // Middleware
343
294
  function errorReportingMiddleware(req, res, next) {
344
295
  debug('error report middleware');
345
-
346
296
  res.locals.report_error = res.locals.report_error || function (err) {
347
297
  if (err.status && err.status >= _core.HTTP_STATUS.BAD_REQUEST && err.status < 600) {
348
298
  debug('is error > 409 %o', err === null || err === void 0 ? void 0 : err.status);
349
-
350
299
  if (_lodash.default.isNil(res.headersSent) === false) {
351
300
  debug('send status %o', err === null || err === void 0 ? void 0 : err.status);
352
301
  res.status(err.status);
@@ -357,15 +306,12 @@ function errorReportingMiddleware(req, res, next) {
357
306
  }
358
307
  } else {
359
308
  debug('is error < 409 %o', err === null || err === void 0 ? void 0 : err.status);
360
-
361
309
  _logger.logger.error({
362
310
  err: err
363
311
  }, 'unexpected error: @{!err.message}\n@{err.stack}');
364
-
365
312
  if (!res.status || !res.send) {
366
313
  // TODO: decide which debug keep
367
314
  _logger.logger.error('this is an error in express.js, please report this');
368
-
369
315
  debug('this is an error in express.js, please report this, destroy response %o', err);
370
316
  res.destroy();
371
317
  } else if (!res.headersSent) {
@@ -380,7 +326,6 @@ function errorReportingMiddleware(req, res, next) {
380
326
  }
381
327
  }
382
328
  };
383
-
384
329
  debug('error report middleware next()');
385
330
  next();
386
331
  }
package/build/middleware.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' +\n expect +\n ', got: ' +\n req.headers[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.headers.cookie;\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.headers['x-forwarded-for'];\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;EACzC,OAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;IACN,IAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;MACtBD,IAAI;IACL,CAFD,MAEO;MACLA,IAAI,CAAC,OAAD,CAAJ;IACD;EACF,CAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN;EACAD,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;EACAP,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;EACAR,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;EACAT,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQI,GAAnB,EAAwB,eAAxB;EACAT,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAY,mBAAA,EAAiBX,KAAjB,CAAJ,EAA6B;IAClCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASI,eAAT,CACLjB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAgB,sBAAA,EAAoBf,KAApB,CAAJ,EAAgC;IACrCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASM,KAAT,CAAeC,MAAf,EAA2C;EAChD,OAAO,UAAUpB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;MACpDlB,IAAI,CACFa,gBAAA,CAAWS,OAAX,CACEC,iBAAA,CAAYC,iBADd,EAEE,iCACEN,MADF,GAEE,SAFF,GAGEpB,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,CALJ,CADE,CAAJ;IASD,CAVD,MAUO;MACLrB,IAAI;IACL;EACF,CAdD;AAeD;;AAEM,SAASyB,kBAAT,CACL3B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAIF,GAAG,CAAC4B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;IAC/B;IACA7B,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAAC4B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;EACD;;EACD5B,IAAI;AACL;;AAEM,SAAS6B,UAAT,CACL/B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAI,CAAC,IAAA8B,eAAA,EAAShC,GAAG,CAACiC,IAAb,CAAL,EAAyB;IACvB,OAAO/B,IAAI,CAACa,gBAAA,CAAWmB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;EACD;;EACDhC,IAAI;AACL;;AAEM,SAASiC,QAAT,CAAkBC,MAAlB,EAA4C;EACjD,OAAO,UAAUpC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYgB,GAAZ,IAAmB,IAAvB,EAA6B;MAC3B,MAAMC,GAAG,GAAGtC,GAAG,CAACqB,OAAJ,CAAYgB,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;MAEA,KAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAO1C,KAAP,CAAa,kBAAb,CAAV;;QACA,IAAI4C,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;UAClC,OAAOzC,IAAI,CAACa,gBAAA,CAAWS,OAAX,CAAmBC,iBAAA,CAAYmB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;QACD;MACF;IACF;;IACD1C,IAAI;EACL,CAZD;AAaD;;AAEM,SAAS2C,KAAT,CAAeC,IAAf,EAAqC;EAC1C,OAAO,UAAUC,MAAV,EAAoC;IACzC,OAAO,UAAU/C,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;MACxFF,GAAG,CAACgD,KAAJ;MACA,MAAMC,WAAW,GAAGjD,GAAG,CAACkD,MAAJ,CAAWC,KAAX,GACf,IAAGnD,GAAG,CAACkD,MAAJ,CAAWC,KAAM,IAAGnD,GAAG,CAACkD,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBpD,GAAG,CAACkD,MAAJ,CAAWE,OAFf;MAGA,MAAMC,cAAc,GAAGrD,GAAG,CAACkD,MAAJ,CAAWI,QAAX,GACnB,IAAAC,sCAAA,EAAsBvD,GAAG,CAACkD,MAAJ,CAAWI,QAAjC,CADmB,GAEnBE,SAFJ;MAGA,MAAMC,MAAM,GAAGzD,GAAG,CAAC0D,WAAnB;;MACAC,cAAA,CAAOC,KAAP,CACE;QAAEb,MAAF;QAAUc,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAE5C;MAAxB,CADF,EAEG,iDAFH;;MAIAiC,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;QAAEE,WAAF;QAAeI;MAAf,CADF,EAEEI,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;QAC9B/D,GAAG,CAACgE,MAAJ;;QACA,IAAIF,KAAJ,EAAW;UACT5D,IAAI,CAAC4D,KAAD,CAAJ;QACD,CAFD,MAEO,IAAIC,OAAJ,EAAa;UAClB7D,IAAI;QACL,CAFM,MAEA;UACL;UACA;UACA,MAAMa,gBAAA,CAAWkD,gBAAX,CAA4BC,eAAA,CAAUC,YAAtC,CAAN;QACD;MACF,CAdH;IAgBD,CA7BD;EA8BD,CA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLnC,IADK,EAELjC,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;EACN,IAAID,GAAG,CAACoE,UAAJ,KAAmB5C,iBAAA,CAAY6C,YAA/B,IAA+C,CAACrE,GAAG,CAACsE,SAAJ,CAAchE,aAAA,CAAQiE,QAAtB,CAApD,EAAqF;IACnF;IACAvE,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQiE,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;EACD;;EAED,IAAI;IACF,IAAIC,eAAA,CAAEC,QAAF,CAAW3C,IAAX,KAAoB0C,eAAA,CAAE3C,QAAF,CAAWC,IAAX,CAAxB,EAA0C;MACxC,IAAI,CAAChC,GAAG,CAACsE,SAAJ,CAAchE,aAAA,CAAQgB,YAAtB,CAAL,EAA0C;QACxCtB,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQgB,YAAnB,EAAiChB,aAAA,CAAQsE,IAAzC;MACD;;MAED,IAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4B0C,eAAA,CAAEG,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;QACvD,IAAI,OAAQA,IAAD,CAA0B6B,KAAjC,KAA2C,QAA/C,EAAyD;UACvD7D,GAAG,CAAC8E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B6B,KAAxD,CADuD,CAEvD;QACD;;QACD7B,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBuB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;MACD,CAXuC,CAaxC;;;MACA,IACE,CAACvD,GAAG,CAACoE,UAAL,IACCpE,GAAG,CAACoE,UAAJ,IAAkB5C,iBAAA,CAAYyD,EAA9B,IAAoCjF,GAAG,CAACoE,UAAJ,GAAiB5C,iBAAA,CAAY0D,gBAFpE,EAGE;QACAlF,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQ6E,IAAnB,EAAyB,MAAM,IAAAC,kBAAA,EAAYpD,IAAZ,CAAN,GAAoC,GAA7D;MACD;IACF,CApBD,MAoBO,CACL;IACD;EACF,CAxBD,CAwBE,OAAOqD,GAAP,EAAiB;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAJ,CAAYzF,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;MACxD,IAAI6E,eAAA,CAAEG,KAAF,CAAQ7E,GAAG,CAACuF,MAAZ,MAAwB,KAA5B,EAAmC;QAAA;;QACjC,eAAAvF,GAAG,CAACuF,MAAJ,4DAAYC,OAAZ;MACD;;MACD;IACD;;IACD,MAAMH,GAAN;EACD;;EAEDrF,GAAG,CAACyF,IAAJ,CAASzD,IAAT;AACD,C,CAED;;;AACO,MAAM0D,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa9F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;EAC3F;EACAF,GAAG,CAAC8F,GAAJ,GAAUnC,cAAA,CAAOoC,KAAP,CAAa;IAAEC,GAAG,EAAE;EAAP,CAAb,CAAV;EAEA,MAAMC,KAAK,GAAGjG,GAAG,CAACqB,OAAJ,CAAY6E,aAA1B;;EACA,IAAIvB,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BjG,GAAG,CAACqB,OAAJ,CAAY6E,aAAZ,GAA4B,cAA5B;EACD;;EAED,MAAMC,OAAO,GAAGnG,GAAG,CAACqB,OAAJ,CAAY+E,MAA5B;;EACA,IAAIzB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BnG,GAAG,CAACqB,OAAJ,CAAY+E,MAAZ,GAAqB,cAArB;EACD;;EAEDpG,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAACqG,WAAd;EACArG,GAAG,CAAC8F,GAAJ,CAAQQ,IAAR,CAAa;IAAEtG,GAAG,EAAEA,GAAP;IAAYuG,EAAE,EAAEvG,GAAG,CAACuG;EAApB,CAAb,EAAuC,4CAAvC;EACAvG,GAAG,CAACqG,WAAJ,GAAkBrG,GAAG,CAAC4B,GAAtB;;EAEA,IAAI+C,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BjG,GAAG,CAACqB,OAAJ,CAAY6E,aAAZ,GAA4BD,KAA5B;EACD;;EAED,IAAItB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BnG,GAAG,CAACqB,OAAJ,CAAY+E,MAAZ,GAAqBD,OAArB;EACD;;EAED,IAAIK,OAAO,GAAG,CAAd;EACAxG,GAAG,CAACyG,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAjB;EACD,CAFD;EAIA,IAAIkE,QAAQ,GAAG,CAAf;EACA,MAAMC,MAAM,GAAG3G,GAAG,CAAC4G,KAAnB,CAhC2F,CAiC3F;EACA;;EACA5G,GAAG,CAAC4G,KAAJ,GAAY,UAAUC,GAAV,EAAwB;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACA;IACA;;IACAmE,MAAM,CAACG,KAAP,CAAa9G,GAAb,EAAkB+G,SAAlB;EACD,CALD;;EAOA,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGjH,GAAG,CAACqB,OAAJ,CAAY,iBAAZ,CAArB;IACA,MAAM6F,aAAa,GAAGlH,GAAG,CAACmH,UAAJ,CAAeD,aAArC;IACA,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;IACA,IAAI3B,OAAJ;;IACA,IAAItF,GAAG,CAAC8E,MAAJ,CAAWC,gBAAf,EAAiC;MAC/BO,OAAO,GAAGK,mBAAV;IACD,CAFD,MAEO;MACLL,OAAO,GAAGM,mBAAV;IACD;;IAED7F,GAAG,CAAC4B,GAAJ,GAAU5B,GAAG,CAACqG,WAAd;IACArG,GAAG,CAAC8F,GAAJ,CAAQuB,IAAR,CACE;MACEC,OAAO,EAAE;QACPC,MAAM,EAAEvH,GAAG,CAACuH,MADL;QAEP3F,GAAG,EAAE5B,GAAG,CAAC4B;MAFF,CADX;MAKEiC,IAAI,EAAG7D,GAAG,CAAC0D,WAAJ,IAAmB1D,GAAG,CAAC0D,WAAJ,CAAgB7C,IAApC,IAA6C,IALrD;MAMEuG,QANF;MAOEI,MAAM,EAAEvH,GAAG,CAACoE,UAPd;MAQEP,KAAK,EAAE7D,GAAG,CAAC8E,MAAJ,CAAWC,gBARpB;MASEyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OADC;QAELmB,GAAG,EAAEhB;MAFA;IATT,CADF,EAeEpB,OAfF;IAiBAvF,GAAG,CAACqG,WAAJ,GAAkBrG,GAAG,CAAC4B,GAAtB;EACD,CA9BD;;EAgCA5B,GAAG,CAACyG,EAAJ,CAAO,OAAP,EAAgB,YAAkB;IAChCX,GAAG;EACJ,CAFD;EAIA,MAAM8B,IAAI,GAAG3H,GAAG,CAAC4H,GAAjB,CA9E2F,CA+E3F;;EACA5H,GAAG,CAAC4H,GAAJ,GAAU,UAAUf,GAAV,EAAqB;IAC7B,IAAIA,GAAJ,EAAS;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACD;IACD;IACA;;;IACAmF,IAAI,CAACb,KAAL,CAAW9G,GAAX,EAAgB+G,SAAhB;;IACAlB,GAAG;EACJ,CARD;;EASA5F,IAAI;AACL;;AAEM,SAAS4H,WAAT,CACLxC,GADK,EAELtF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;EACAN,KAAK,CAAC,oBAAD,CAAL;;EACA,IAAI+E,eAAA,CAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;IAClB1F,KAAK,CAAC,iBAAD,CAAL;;IACA,IAAI0F,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6B/H,GAAG,CAACoE,UAAJ,KAAmB5C,iBAAA,CAAYwG,YAAhE,EAA8E;MAC5E,OAAO/H,IAAI,EAAX;IACD;;IACD,IAAIyE,eAAA,CAAEuD,UAAF,CAAajI,GAAG,CAAC8E,MAAJ,CAAWoD,YAAxB,MAA0C,KAA9C,EAAqD;MACnDvI,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;MACA;;MACAwI,wBAAwB,CAACpI,GAAD,EAAMC,GAAN,EAAW0E,eAAA,CAAE0D,IAAb,CAAxB;IACD;;IACDzI,KAAK,CAAC,6BAAD,CAAL;IACAK,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,CAAwB7C,GAAxB;EACD,CAbD,MAaO;IACL;IACA1F,KAAK,CAAC,qCAAD,CAAL;IACA,OAAOM,IAAI,CAACoF,GAAD,CAAX;EACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLpI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACNN,KAAK,CAAC,yBAAD,CAAL;;EACAK,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,GACElI,GAAG,CAAC8E,MAAJ,CAAWoD,YAAX,IACA,UAAU7C,GAAV,EAAqC;IACnC,IAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAc/F,iBAAA,CAAY6G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;MAC3E5H,KAAK,CAAC,mBAAD,EAAsB0F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA,IAAI7C,eAAA,CAAEG,KAAF,CAAQ7E,GAAG,CAACsI,WAAZ,MAA6B,KAAjC,EAAwC;QACtC3I,KAAK,CAAC,gBAAD,EAAmB0F,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;QACAvH,GAAG,CAACuH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;QACA5H,KAAK,CAAC,eAAD,EAAkB0F,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;QACArF,IAAI,CAAC;UAAE4D,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,eAAA,CAAUsE;QAAlC,CAAD,CAAJ;MACD;IACF,CARD,MAQO;MACL5I,KAAK,CAAC,mBAAD,EAAsB0F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA7D,cAAA,CAAOG,KAAP,CAAa;QAAEwB,GAAG,EAAEA;MAAP,CAAb,EAA2B,iDAA3B;;MACA,IAAI,CAACrF,GAAG,CAACuH,MAAL,IAAe,CAACvH,GAAG,CAACyF,IAAxB,EAA8B;QAC5B;QACA/B,cAAA,CAAOG,KAAP,CAAa,oDAAb;;QACAlE,KAAK,CAAC,yEAAD,EAA4E0F,GAA5E,CAAL;QACArF,GAAG,CAACwF,OAAJ;MACD,CALD,MAKO,IAAI,CAACxF,GAAG,CAACsI,WAAT,EAAsB;QAC3B3I,KAAK,CAAC,0BAAD,EAA6B0F,GAA7B,CAAL;QACArF,GAAG,CAACuH,MAAJ,CAAW/F,iBAAA,CAAYgH,cAAvB;QACAvI,IAAI,CAAC;UAAE4D,KAAK,EAAEI,eAAA,CAAUwE;QAAnB,CAAD,CAAJ;MACD,CAJM,MAIA;QACL;QACA9I,KAAK,CAAC,6CAAD,EAAgD0F,GAAhD,CAAL;MACD;IACF;EACF,CA5BH;;EA8BA1F,KAAK,CAAC,gCAAD,CAAL;EACAM,IAAI;AACL"}
1
+ {"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","get","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.get('x-forwarded-for');\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAGA;AAGA;AAUA;AAEA;AAOA;AAA2D;AAM3D,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEzC,SAASC,KAAK,CAACC,MAAc,EAAO;EACzC,OAAO,UACLC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACP;IACN,IAAIJ,MAAM,CAACK,IAAI,CAACD,KAAK,CAAC,EAAE;MACtBD,IAAI,EAAE;IACR,CAAC,MAAM;MACLA,IAAI,CAAC,OAAO,CAAC;IACf;EACF,CAAC;AACH;;AAEA;AACA;AACO,SAASG,qBAAqB,CACnCL,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN;EACAD,GAAG,CAACK,MAAM,CAACC,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC1C;EACAP,GAAG,CAACK,MAAM,CAACC,aAAO,CAACE,GAAG,EAAE,oBAAoB,CAAC;EAC7C;EACAR,GAAG,CAACK,MAAM,CAACC,aAAO,CAACG,GAAG,EAAE,SAAS,CAAC;EAClC;EACAT,GAAG,CAACK,MAAM,CAACC,aAAO,CAACI,GAAG,EAAE,eAAe,CAAC;EACxCT,IAAI,EAAE;AACR;AAEO,SAASU,YAAY,CAC1BZ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACbU,IAAY,EACN;EACN,IAAIV,KAAK,KAAK,GAAG,EAAE;IACjB;IACAD,IAAI,CAAC,OAAO,CAAC;EACf,CAAC,MAAM,IAAI,IAAAY,mBAAgB,EAACX,KAAK,CAAC,EAAE;IAClCD,IAAI,EAAE;EACR,CAAC,MAAM;IACLA,IAAI,CAACa,gBAAU,CAACC,YAAY,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EAClD;AACF;AAEO,SAASI,eAAe,CAC7BjB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACbU,IAAY,EACN;EACN,IAAIV,KAAK,KAAK,GAAG,EAAE;IACjB;IACAD,IAAI,CAAC,OAAO,CAAC;EACf,CAAC,MAAM,IAAI,IAAAgB,sBAAmB,EAACf,KAAK,CAAC,EAAE;IACrCD,IAAI,EAAE;EACR,CAAC,MAAM;IACLA,IAAI,CAACa,gBAAU,CAACC,YAAY,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EAClD;AACF;AAEO,SAASM,KAAK,CAACC,MAAqB,EAAO;EAChD,OAAO,UAAUpB,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACxF,IAAIF,GAAG,CAACqB,OAAO,CAACC,iBAAW,CAACC,YAAY,CAAC,KAAKH,MAAM,EAAE;MACpDlB,IAAI,CACFa,gBAAU,CAACS,OAAO,CAChBC,iBAAW,CAACC,iBAAiB,EAC7B,8BAA8B,GAAGN,MAAM,GAAG,SAAS,GAAGpB,GAAG,CAAC2B,GAAG,CAACL,iBAAW,CAACC,YAAY,CAAC,CACxF,CACF;IACH,CAAC,MAAM;MACLrB,IAAI,EAAE;IACR;EACF,CAAC;AACH;AAEO,SAAS0B,kBAAkB,CAChC5B,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAIF,GAAG,CAAC6B,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;IAC/B;IACA9B,GAAG,CAAC6B,GAAG,GAAG7B,GAAG,CAAC6B,GAAG,CAACE,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAC5D;EACA7B,IAAI,EAAE;AACR;AAEO,SAAS8B,UAAU,CACxBhC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAI,CAAC,IAAA+B,eAAQ,EAACjC,GAAG,CAACkC,IAAI,CAAC,EAAE;IACvB,OAAOhC,IAAI,CAACa,gBAAU,CAACoB,aAAa,CAAC,2BAA2B,CAAC,CAAC;EACpE;EACAjC,IAAI,EAAE;AACR;AAEO,SAASkC,QAAQ,CAACC,MAAc,EAAY;EACjD,OAAO,UAAUrC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IAAA;IACxF,IAAI,CAAAF,GAAG,aAAHA,GAAG,uCAAHA,GAAG,CAAEqB,OAAO,iDAAZ,aAAciB,GAAG,KAAI,IAAI,EAAE;MAC7B,MAAMC,GAAG,GAAGvC,GAAG,CAACqB,OAAO,CAACiB,GAAG,CAACE,KAAK,CAAC,GAAG,CAAC;MAEtC,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGF,GAAG,CAACG,MAAM,EAAED,CAAC,EAAE,EAAE;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAC,CAAC,CAAC3C,KAAK,CAAC,kBAAkB,CAAC;QAC1C,IAAI6C,CAAC,IAAIA,CAAC,CAAC,CAAC,CAAC,KAAKN,MAAM,CAACO,SAAS,EAAE;UAClC,OAAO1C,IAAI,CAACa,gBAAU,CAACS,OAAO,CAACC,iBAAW,CAACoB,aAAa,EAAE,eAAe,CAAC,CAAC;QAC7E;MACF;IACF;IACA3C,IAAI,EAAE;EACR,CAAC;AACH;AAEO,SAAS4C,KAAK,CAACC,IAAU,EAAY;EAC1C,OAAO,UAAUC,MAAc,EAAY;IACzC,OAAO,UAAUhD,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;MACxFF,GAAG,CAACiD,KAAK,EAAE;MACX,MAAMC,WAAW,GAAGlD,GAAG,CAACmD,MAAM,CAACC,KAAK,GAC/B,IAAGpD,GAAG,CAACmD,MAAM,CAACC,KAAM,IAAGpD,GAAG,CAACmD,MAAM,CAACE,OAAQ,EAAC,GAC5CrD,GAAG,CAACmD,MAAM,CAACE,OAAO;MACtB,MAAMC,cAAc,GAAGtD,GAAG,CAACmD,MAAM,CAACI,QAAQ,GACtC,IAAAC,sCAAqB,EAACxD,GAAG,CAACmD,MAAM,CAACI,QAAQ,CAAC,GAC1CE,SAAS;MACb,MAAMC,MAAM,GAAG1D,GAAG,CAAC2D,WAAW;MAC9BC,cAAM,CAACC,KAAK,CACV;QAAEb,MAAM;QAAEc,IAAI,EAAEJ,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE7C;MAAK,CAAC,EAC7B,iDAAgD,CAClD;MACDkC,IAAI,CAAC,QAAQ,GAAGC,MAAM,CAAC,CACrB;QAAEE,WAAW;QAAEI;MAAe,CAAC,EAC/BI,MAAM,EACN,UAAUK,KAAK,EAAEC,OAAO,EAAQ;QAC9BhE,GAAG,CAACiE,MAAM,EAAE;QACZ,IAAIF,KAAK,EAAE;UACT7D,IAAI,CAAC6D,KAAK,CAAC;QACb,CAAC,MAAM,IAAIC,OAAO,EAAE;UAClB9D,IAAI,EAAE;QACR,CAAC,MAAM;UACL;UACA;UACA,MAAMa,gBAAU,CAACmD,gBAAgB,CAACC,eAAS,CAACC,YAAY,CAAC;QAC3D;MACF,CAAC,CACF;IACH,CAAC;EACH,CAAC;AACH;AAQO,SAASC,KAAK,CACnBnC,IAAe,EACflC,GAAmB,EACnBC,GAAoB;AACpB;AACA;AACAC,IAAsB,EAChB;EACN,IAAID,GAAG,CAACqE,UAAU,KAAK7C,iBAAW,CAAC8C,YAAY,IAAI,CAACtE,GAAG,CAACuE,SAAS,CAACjE,aAAO,CAACkE,QAAQ,CAAC,EAAE;IACnF;IACAxE,GAAG,CAACK,MAAM,CAACC,aAAO,CAACkE,QAAQ,EAAG,GAAEC,iBAAY,KAAIC,kBAAa,EAAC,CAAC;EACjE;EAEA,IAAI;IACF,IAAIC,eAAC,CAACC,QAAQ,CAAC3C,IAAI,CAAC,IAAI0C,eAAC,CAAC3C,QAAQ,CAACC,IAAI,CAAC,EAAE;MACxC,IAAI,CAACjC,GAAG,CAACuE,SAAS,CAACjE,aAAO,CAACgB,YAAY,CAAC,EAAE;QACxCtB,GAAG,CAACK,MAAM,CAACC,aAAO,CAACgB,YAAY,EAAEhB,aAAO,CAACuE,IAAI,CAAC;MAChD;MAEA,IAAI,OAAO5C,IAAI,KAAK,QAAQ,IAAI0C,eAAC,CAACG,KAAK,CAAC7C,IAAI,CAAC,KAAK,KAAK,EAAE;QACvD,IAAI,OAAQA,IAAI,CAAqB6B,KAAK,KAAK,QAAQ,EAAE;UACvD9D,GAAG,CAAC+E,MAAM,CAACC,gBAAgB,GAAI/C,IAAI,CAAqB6B,KAAK;UAC7D;QACF;;QACA7B,IAAI,GAAG4C,IAAI,CAACI,SAAS,CAAChD,IAAI,EAAEuB,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI;MACrD;;MAEA;MACA,IACE,CAACxD,GAAG,CAACqE,UAAU,IACdrE,GAAG,CAACqE,UAAU,IAAI7C,iBAAW,CAAC0D,EAAE,IAAIlF,GAAG,CAACqE,UAAU,GAAG7C,iBAAW,CAAC2D,gBAAiB,EACnF;QACAnF,GAAG,CAACK,MAAM,CAACC,aAAO,CAAC8E,IAAI,EAAE,GAAG,GAAG,IAAAC,kBAAW,EAACpD,IAAI,CAAW,GAAG,GAAG,CAAC;MACnE;IACF,CAAC,MAAM;MACL;IAAA;EAEJ,CAAC,CAAC,OAAOqD,GAAQ,EAAE;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAO,CAAC1F,KAAK,CAAC,iCAAiC,CAAC,EAAE;MACxD,IAAI8E,eAAC,CAACG,KAAK,CAAC9E,GAAG,CAACwF,MAAM,CAAC,KAAK,KAAK,EAAE;QAAA;QACjC,eAAAxF,GAAG,CAACwF,MAAM,gDAAV,YAAYC,OAAO,EAAE;MACvB;MACA;IACF;IACA,MAAMH,GAAG;EACX;EAEAtF,GAAG,CAAC0F,IAAI,CAACzD,IAAI,CAAC;AAChB;;AAEA;AACO,MAAM0D,kBAAkB,GAC7B,gFAAgF;AAAC;AAC5E,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAmB;AAAC;AACtE,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAkC;AAAC;AAErF,SAASG,GAAG,CAAC/F,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;EAC3F;EACAF,GAAG,CAAC+F,GAAG,GAAGnC,cAAM,CAACoC,KAAK,CAAC;IAAEC,GAAG,EAAE;EAAK,CAAC,CAAC;EAErC,MAAMC,KAAK,GAAGlG,GAAG,CAACqB,OAAO,CAAC8E,aAAa;EACvC,IAAIvB,eAAC,CAACG,KAAK,CAACmB,KAAK,CAAC,KAAK,KAAK,EAAE;IAC5BlG,GAAG,CAACqB,OAAO,CAAC8E,aAAa,GAAG,cAAc;EAC5C;EAEA,MAAMC,OAAO,GAAGpG,GAAG,CAAC2B,GAAG,CAAC,QAAQ,CAAC;EACjC,IAAIiD,eAAC,CAACG,KAAK,CAACqB,OAAO,CAAC,KAAK,KAAK,EAAE;IAC9BpG,GAAG,CAACqB,OAAO,CAACgF,MAAM,GAAG,cAAc;EACrC;EAEArG,GAAG,CAAC6B,GAAG,GAAG7B,GAAG,CAACsG,WAAW;EACzBtG,GAAG,CAAC+F,GAAG,CAACQ,IAAI,CAAC;IAAEvG,GAAG,EAAEA,GAAG;IAAEwG,EAAE,EAAExG,GAAG,CAACwG;EAAG,CAAC,EAAE,4CAA4C,CAAC;EACpFxG,GAAG,CAACsG,WAAW,GAAGtG,GAAG,CAAC6B,GAAG;EAEzB,IAAI+C,eAAC,CAACG,KAAK,CAACmB,KAAK,CAAC,KAAK,KAAK,EAAE;IAC5BlG,GAAG,CAACqB,OAAO,CAAC8E,aAAa,GAAGD,KAAK;EACnC;EAEA,IAAItB,eAAC,CAACG,KAAK,CAACqB,OAAO,CAAC,KAAK,KAAK,EAAE;IAC9BpG,GAAG,CAACqB,OAAO,CAACgF,MAAM,GAAGD,OAAO;EAC9B;EAEA,IAAIK,OAAO,GAAG,CAAC;EACfzG,GAAG,CAAC0G,EAAE,CAAC,MAAM,EAAE,UAAUC,KAAK,EAAQ;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAM;EACzB,CAAC,CAAC;EAEF,IAAIkE,QAAQ,GAAG,CAAC;EAChB,MAAMC,MAAM,GAAG5G,GAAG,CAAC6G,KAAK;EACxB;EACA;EACA7G,GAAG,CAAC6G,KAAK,GAAG,UAAUC,GAAG,EAAW;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAM;IACtB;IACA;IACAmE,MAAM,CAACG,KAAK,CAAC/G,GAAG,EAAEgH,SAAS,CAAC;EAC9B,CAAC;EAED,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGlH,GAAG,CAAC2B,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAMwF,aAAa,GAAGnH,GAAG,CAACoH,UAAU,CAACD,aAAa;IAClD,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAC,GAAGA,aAAa;IACtF,IAAI3B,OAAO;IACX,IAAIvF,GAAG,CAAC+E,MAAM,CAACC,gBAAgB,EAAE;MAC/BO,OAAO,GAAGK,mBAAmB;IAC/B,CAAC,MAAM;MACLL,OAAO,GAAGM,mBAAmB;IAC/B;IAEA9F,GAAG,CAAC6B,GAAG,GAAG7B,GAAG,CAACsG,WAAW;IACzBtG,GAAG,CAAC+F,GAAG,CAACuB,IAAI,CACV;MACEC,OAAO,EAAE;QACPC,MAAM,EAAExH,GAAG,CAACwH,MAAM;QAClB3F,GAAG,EAAE7B,GAAG,CAAC6B;MACX,CAAC;MACDiC,IAAI,EAAG9D,GAAG,CAAC2D,WAAW,IAAI3D,GAAG,CAAC2D,WAAW,CAAC9C,IAAI,IAAK,IAAI;MACvDwG,QAAQ;MACRI,MAAM,EAAExH,GAAG,CAACqE,UAAU;MACtBP,KAAK,EAAE9D,GAAG,CAAC+E,MAAM,CAACC,gBAAgB;MAClCyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OAAO;QACXmB,GAAG,EAAEhB;MACP;IACF,CAAC,EACDpB,OAAO,CACR;IACDxF,GAAG,CAACsG,WAAW,GAAGtG,GAAG,CAAC6B,GAAG;EAC3B,CAAC;EAED7B,GAAG,CAAC0G,EAAE,CAAC,OAAO,EAAE,YAAkB;IAChCX,GAAG,EAAE;EACP,CAAC,CAAC;EAEF,MAAM8B,IAAI,GAAG5H,GAAG,CAAC6H,GAAG;EACpB;EACA7H,GAAG,CAAC6H,GAAG,GAAG,UAAUf,GAAG,EAAQ;IAC7B,IAAIA,GAAG,EAAE;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAM;IACxB;IACA;IACA;IACAmF,IAAI,CAACb,KAAK,CAAC/G,GAAG,EAAEgH,SAAS,CAAC;IAC1BlB,GAAG,EAAE;EACP,CAAC;EACD7F,IAAI,EAAE;AACR;AAEO,SAAS6H,WAAW,CACzBxC,GAAc,EACdvF,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtB;EACAN,KAAK,CAAC,oBAAoB,CAAC;EAC3B,IAAIgF,eAAC,CAACoD,OAAO,CAACzC,GAAG,CAAC,EAAE;IAClB3F,KAAK,CAAC,iBAAiB,CAAC;IACxB,IAAI2F,GAAG,CAAC0C,IAAI,KAAK,YAAY,IAAIhI,GAAG,CAACqE,UAAU,KAAK7C,iBAAW,CAACyG,YAAY,EAAE;MAC5E,OAAOhI,IAAI,EAAE;IACf;IACA,IAAI0E,eAAC,CAACuD,UAAU,CAAClI,GAAG,CAAC+E,MAAM,CAACoD,YAAY,CAAC,KAAK,KAAK,EAAE;MACnDxI,KAAK,CAAC,4BAA4B,CAAC;MACnC;MACA;MACAyI,wBAAwB,CAACrI,GAAG,EAAEC,GAAG,EAAE2E,eAAC,CAAC0D,IAAI,CAAC;IAC5C;IACA1I,KAAK,CAAC,6BAA6B,CAAC;IACpCK,GAAG,CAAC+E,MAAM,CAACoD,YAAY,CAAC7C,GAAG,CAAC;EAC9B,CAAC,MAAM;IACL;IACA3F,KAAK,CAAC,qCAAqC,CAAC;IAC5C,OAAOM,IAAI,CAACqF,GAAG,CAAC;EAClB;AACF;;AAEA;AACO,SAAS8C,wBAAwB,CACtCrI,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACNN,KAAK,CAAC,yBAAyB,CAAC;EAChCK,GAAG,CAAC+E,MAAM,CAACoD,YAAY,GACrBnI,GAAG,CAAC+E,MAAM,CAACoD,YAAY,IACvB,UAAU7C,GAAmB,EAAQ;IACnC,IAAIA,GAAG,CAACkC,MAAM,IAAIlC,GAAG,CAACkC,MAAM,IAAIhG,iBAAW,CAAC8G,WAAW,IAAIhD,GAAG,CAACkC,MAAM,GAAG,GAAG,EAAE;MAC3E7H,KAAK,CAAC,mBAAmB,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEkC,MAAM,CAAC;MACvC,IAAI7C,eAAC,CAACG,KAAK,CAAC9E,GAAG,CAACuI,WAAW,CAAC,KAAK,KAAK,EAAE;QACtC5I,KAAK,CAAC,gBAAgB,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEkC,MAAM,CAAC;QACpCxH,GAAG,CAACwH,MAAM,CAAClC,GAAG,CAACkC,MAAM,CAAC;QACtB7H,KAAK,CAAC,eAAe,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEC,OAAO,CAAC;QACpCtF,IAAI,CAAC;UAAE6D,KAAK,EAAEwB,GAAG,CAACC,OAAO,IAAIrB,eAAS,CAACsE;QAAc,CAAC,CAAC;MACzD;IACF,CAAC,MAAM;MACL7I,KAAK,CAAC,mBAAmB,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEkC,MAAM,CAAC;MACvC7D,cAAM,CAACG,KAAK,CAAC;QAAEwB,GAAG,EAAEA;MAAI,CAAC,EAAE,iDAAiD,CAAC;MAC7E,IAAI,CAACtF,GAAG,CAACwH,MAAM,IAAI,CAACxH,GAAG,CAAC0F,IAAI,EAAE;QAC5B;QACA/B,cAAM,CAACG,KAAK,CAAC,oDAAoD,CAAC;QAClEnE,KAAK,CAAC,yEAAyE,EAAE2F,GAAG,CAAC;QACrFtF,GAAG,CAACyF,OAAO,EAAE;MACf,CAAC,MAAM,IAAI,CAACzF,GAAG,CAACuI,WAAW,EAAE;QAC3B5I,KAAK,CAAC,0BAA0B,EAAE2F,GAAG,CAAC;QACtCtF,GAAG,CAACwH,MAAM,CAAChG,iBAAW,CAACiH,cAAc,CAAC;QACtCxI,IAAI,CAAC;UAAE6D,KAAK,EAAEI,eAAS,CAACwE;QAAsB,CAAC,CAAC;MAClD,CAAC,MAAM;QACL;QACA/I,KAAK,CAAC,6CAA6C,EAAE2F,GAAG,CAAC;MAC3D;IACF;EACF,CAAC;EAEH3F,KAAK,CAAC,gCAAgC,CAAC;EACvCM,IAAI,EAAE;AACR"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@verdaccio/middleware",
3
- "version": "6.0.0-6-next.29",
3
+ "version": "6.0.0-6-next.31",
4
4
  "description": "loaders logic",
5
5
  "main": "./build/index.js",
6
6
  "types": "build/index.d.ts",
@@ -32,10 +32,10 @@
32
32
  "dependencies": {
33
33
  "debug": "4.3.4",
34
34
  "body-parser": "1.20.1",
35
- "@verdaccio/auth": "6.0.0-6-next.29",
36
- "@verdaccio/core": "6.0.0-6-next.50",
37
- "@verdaccio/logger": "6.0.0-6-next.18",
38
- "@verdaccio/utils": "6.0.0-6-next.18",
35
+ "@verdaccio/auth": "6.0.0-6-next.31",
36
+ "@verdaccio/core": "6.0.0-6-next.52",
37
+ "@verdaccio/logger": "6.0.0-6-next.20",
38
+ "@verdaccio/utils": "6.0.0-6-next.20",
39
39
  "lodash": "4.17.21"
40
40
  },
41
41
  "funding": {
package/src/middleware.ts CHANGED
@@ -104,10 +104,7 @@ export function media(expect: string | null): any {
104
104
  next(
105
105
  errorUtils.getCode(
106
106
  HTTP_STATUS.UNSUPPORTED_MEDIA,
107
- 'wrong content-type, expect: ' +
108
- expect +
109
- ', got: ' +
110
- req.headers[HEADER_TYPE.CONTENT_TYPE]
107
+ 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]
111
108
  )
112
109
  );
113
110
  } else {
@@ -141,7 +138,7 @@ export function expectJson(
141
138
 
142
139
  export function antiLoop(config: Config): Function {
143
140
  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
144
- if (req.headers.via != null) {
141
+ if (req?.headers?.via != null) {
145
142
  const arr = req.headers.via.split(',');
146
143
 
147
144
  for (let i = 0; i < arr.length; i++) {
@@ -264,7 +261,7 @@ export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFuncti
264
261
  req.headers.authorization = '<Classified>';
265
262
  }
266
263
 
267
- const _cookie = req.headers.cookie;
264
+ const _cookie = req.get('cookie');
268
265
  if (_.isNil(_cookie) === false) {
269
266
  req.headers.cookie = '<Classified>';
270
267
  }
@@ -298,7 +295,7 @@ export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFuncti
298
295
  };
299
296
 
300
297
  const log = function (): void {
301
- const forwardedFor = req.headers['x-forwarded-for'];
298
+ const forwardedFor = req.get('x-forwarded-for');
302
299
  const remoteAddress = req.connection.remoteAddress;
303
300
  const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
304
301
  let message;