@verdaccio/middleware 6.0.0-6-next.30 → 6.0.0-6-next.32

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +18 -0
  2. package/build/index.js +0 -2
  3. package/build/index.js.map +1 -1
  4. package/build/middleware-utils.js +0 -1
  5. package/build/middleware-utils.js.map +1 -1
  6. package/build/middleware.d.ts +4 -4
  7. package/build/middleware.js +27 -84
  8. package/build/middleware.js.map +1 -1
  9. package/package.json +5 -5
package/CHANGELOG.md CHANGED
@@ -1,5 +1,23 @@
1
1
  # @verdaccio/middleware
2
2
 
3
+ ## 6.0.0-6-next.32
4
+
5
+ ### Patch Changes
6
+
7
+ - @verdaccio/auth@6.0.0-6-next.32
8
+ - @verdaccio/core@6.0.0-6-next.53
9
+ - @verdaccio/logger@6.0.0-6-next.21
10
+ - @verdaccio/utils@6.0.0-6-next.21
11
+
12
+ ## 6.0.0-6-next.31
13
+
14
+ ### Patch Changes
15
+
16
+ - @verdaccio/core@6.0.0-6-next.52
17
+ - @verdaccio/auth@6.0.0-6-next.31
18
+ - @verdaccio/logger@6.0.0-6-next.20
19
+ - @verdaccio/utils@6.0.0-6-next.20
20
+
3
21
  ## 6.0.0-6-next.30
4
22
 
5
23
  ### Minor Changes
package/build/index.js CHANGED
@@ -3,9 +3,7 @@
3
3
  Object.defineProperty(exports, "__esModule", {
4
4
  value: true
5
5
  });
6
-
7
6
  var _middleware = require("./middleware");
8
-
9
7
  Object.keys(_middleware).forEach(function (key) {
10
8
  if (key === "default" || key === "__esModule") return;
11
9
  if (key in exports && exports[key] === _middleware[key]) return;
package/build/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export * from './middleware';\n"],"mappings":";;;;;;AAAA;;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
1
+ {"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export * from './middleware';\n"],"mappings":";;;;;AAAA;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
package/build/middleware-utils.js CHANGED
@@ -4,7 +4,6 @@ Object.defineProperty(exports, "__esModule", {
4
4
  value: true
5
5
  });
6
6
  exports.getVersionFromTarball = getVersionFromTarball;
7
-
8
7
  /**
9
8
  * return package version from tarball name
10
9
  * @param {String} name
package/build/middleware-utils.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"middleware-utils.js","names":["getVersionFromTarball","name","groups","match","undefined"],"sources":["../src/middleware-utils.ts"],"sourcesContent":["/**\n * return package version from tarball name\n * @param {String} name\n * @returns {String}\n */\nexport function getVersionFromTarball(name: string): string | void {\n const groups = name.match(/.+-(\\d.+)\\.tgz/);\n\n return groups !== null ? groups[1] : undefined;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AACA;AACA;AACA;AACO,SAASA,qBAAT,CAA+BC,IAA/B,EAA4D;EACjE,MAAMC,MAAM,GAAGD,IAAI,CAACE,KAAL,CAAW,gBAAX,CAAf;EAEA,OAAOD,MAAM,KAAK,IAAX,GAAkBA,MAAM,CAAC,CAAD,CAAxB,GAA8BE,SAArC;AACD"}
1
+ {"version":3,"file":"middleware-utils.js","names":["getVersionFromTarball","name","groups","match","undefined"],"sources":["../src/middleware-utils.ts"],"sourcesContent":["/**\n * return package version from tarball name\n * @param {String} name\n * @returns {String}\n */\nexport function getVersionFromTarball(name: string): string | void {\n const groups = name.match(/.+-(\\d.+)\\.tgz/);\n\n return groups !== null ? groups[1] : undefined;\n}\n"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACO,SAASA,qBAAqB,CAACC,IAAY,EAAiB;EACjE,MAAMC,MAAM,GAAGD,IAAI,CAACE,KAAK,CAAC,gBAAgB,CAAC;EAE3C,OAAOD,MAAM,KAAK,IAAI,GAAGA,MAAM,CAAC,CAAC,CAAC,GAAGE,SAAS;AAChD"}
package/build/middleware.d.ts CHANGED
@@ -2,14 +2,14 @@ import { NextFunction, Request, Response } from 'express';
2
2
  import { HttpError } from 'http-errors';
3
3
  import { Auth } from '@verdaccio/auth';
4
4
  import { Config, Logger, Package, RemoteUser } from '@verdaccio/types';
5
- export declare type $RequestExtend = Request & {
5
+ export type $RequestExtend = Request & {
6
6
  remote_user?: RemoteUser;
7
7
  log: Logger;
8
8
  };
9
- export declare type $ResponseExtend = Response & {
9
+ export type $ResponseExtend = Response & {
10
10
  cookies?: any;
11
11
  };
12
- export declare type $NextFunctionVer = NextFunction & any;
12
+ export type $NextFunctionVer = NextFunction & any;
13
13
  export declare function match(regexp: RegExp): any;
14
14
  export declare function setSecurityWebHeaders(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;
15
15
  export declare function validateName(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer, value: string, name: string): void;
@@ -22,7 +22,7 @@ export declare function allow(auth: Auth): Function;
22
22
  export interface MiddlewareError {
23
23
  error: string;
24
24
  }
25
- export declare type FinalBody = Package | MiddlewareError | string;
25
+ export type FinalBody = Package | MiddlewareError | string;
26
26
  export declare function final(body: FinalBody, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;
27
27
  export declare const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
28
28
  export declare const LOG_VERDACCIO_ERROR: string;
package/build/middleware.js CHANGED
@@ -17,23 +17,14 @@ exports.media = media;
17
17
  exports.setSecurityWebHeaders = setSecurityWebHeaders;
18
18
  exports.validateName = validateName;
19
19
  exports.validatePackage = validatePackage;
20
-
21
20
  var _debug = _interopRequireDefault(require("debug"));
22
-
23
21
  var _lodash = _interopRequireDefault(require("lodash"));
24
-
25
22
  var _core = require("@verdaccio/core");
26
-
27
23
  var _logger = require("@verdaccio/logger");
28
-
29
24
  var _utils = require("@verdaccio/utils");
30
-
31
25
  var _middlewareUtils = require("./middleware-utils");
32
-
33
26
  function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
34
-
35
27
  const debug = (0, _debug.default)('verdaccio:middleware');
36
-
37
28
  function match(regexp) {
38
29
  return function (req, res, next, value) {
39
30
  if (regexp.exec(value)) {
@@ -42,22 +33,21 @@ function match(regexp) {
42
33
  next('route');
43
34
  }
44
35
  };
45
- } // TODO: remove, was relocated to web package
46
- // @ts-deprecated
47
-
36
+ }
48
37
 
38
+ // TODO: remove, was relocated to web package
39
+ // @ts-deprecated
49
40
  function setSecurityWebHeaders(req, res, next) {
50
41
  // disable loading in frames (clickjacking, etc.)
51
- res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny'); // avoid stablish connections outside of domain
52
-
53
- res.header(_core.HEADERS.CSP, "connect-src 'self'"); // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
54
-
55
- res.header(_core.HEADERS.CTO, 'nosniff'); // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
56
-
42
+ res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
43
+ // avoid stablish connections outside of domain
44
+ res.header(_core.HEADERS.CSP, "connect-src 'self'");
45
+ // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
46
+ res.header(_core.HEADERS.CTO, 'nosniff');
47
+ // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
57
48
  res.header(_core.HEADERS.XSS, '1; mode=block');
58
49
  next();
59
50
  }
60
-
61
51
  function validateName(req, res, next, value, name) {
62
52
  if (value === '-') {
63
53
  // special case in couchdb usually
@@ -68,7 +58,6 @@ function validateName(req, res, next, value, name) {
68
58
  next(_core.errorUtils.getForbidden('invalid ' + name));
69
59
  }
70
60
  }
71
-
72
61
  function validatePackage(req, res, next, value, name) {
73
62
  if (value === '-') {
74
63
  // special case in couchdb usually
@@ -79,7 +68,6 @@ function validatePackage(req, res, next, value, name) {
79
68
  next(_core.errorUtils.getForbidden('invalid ' + name));
80
69
  }
81
70
  }
82
-
83
71
  function media(expect) {
84
72
  return function (req, res, next) {
85
73
  if (req.headers[_core.HEADER_TYPE.CONTENT_TYPE] !== expect) {
@@ -89,44 +77,34 @@ function media(expect) {
89
77
  }
90
78
  };
91
79
  }
92
-
93
80
  function encodeScopePackage(req, res, next) {
94
81
  if (req.url.indexOf('@') !== -1) {
95
82
  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
96
83
  req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
97
84
  }
98
-
99
85
  next();
100
86
  }
101
-
102
87
  function expectJson(req, res, next) {
103
88
  if (!(0, _utils.isObject)(req.body)) {
104
89
  return next(_core.errorUtils.getBadRequest("can't parse incoming json"));
105
90
  }
106
-
107
91
  next();
108
92
  }
109
-
110
93
  function antiLoop(config) {
111
94
  return function (req, res, next) {
112
95
  var _req$headers;
113
-
114
96
  if ((req === null || req === void 0 ? void 0 : (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.via) != null) {
115
97
  const arr = req.headers.via.split(',');
116
-
117
98
  for (let i = 0; i < arr.length; i++) {
118
99
  const m = arr[i].match(/\s*(\S+)\s+(\S+)/);
119
-
120
100
  if (m && m[2] === config.server_id) {
121
101
  return next(_core.errorUtils.getCode(_core.HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
122
102
  }
123
103
  }
124
104
  }
125
-
126
105
  next();
127
106
  };
128
107
  }
129
-
130
108
  function allow(auth) {
131
109
  return function (action) {
132
110
  return function (req, res, next) {
@@ -134,18 +112,15 @@ function allow(auth) {
134
112
  const packageName = req.params.scope ? `@${req.params.scope}/${req.params.package}` : req.params.package;
135
113
  const packageVersion = req.params.filename ? (0, _middlewareUtils.getVersionFromTarball)(req.params.filename) : undefined;
136
114
  const remote = req.remote_user;
137
-
138
115
  _logger.logger.trace({
139
116
  action,
140
117
  user: remote === null || remote === void 0 ? void 0 : remote.name
141
118
  }, `[middleware/allow][@{action}] allow for @{user}`);
142
-
143
119
  auth['allow_' + action]({
144
120
  packageName,
145
121
  packageVersion
146
122
  }, remote, function (error, allowed) {
147
123
  req.resume();
148
-
149
124
  if (error) {
150
125
  next(error);
151
126
  } else if (allowed) {
@@ -159,34 +134,34 @@ function allow(auth) {
159
134
  };
160
135
  };
161
136
  }
162
-
163
- function final(body, req, res, // if we remove `next` breaks test
137
+ function final(body, req, res,
138
+ // if we remove `next` breaks test
164
139
  // eslint-disable-next-line @typescript-eslint/no-unused-vars
165
140
  next) {
166
141
  if (res.statusCode === _core.HTTP_STATUS.UNAUTHORIZED && !res.getHeader(_core.HEADERS.WWW_AUTH)) {
167
142
  // they say it's required for 401, so...
168
143
  res.header(_core.HEADERS.WWW_AUTH, `${_core.TOKEN_BASIC}, ${_core.TOKEN_BEARER}`);
169
144
  }
170
-
171
145
  try {
172
146
  if (_lodash.default.isString(body) || _lodash.default.isObject(body)) {
173
147
  if (!res.getHeader(_core.HEADERS.CONTENT_TYPE)) {
174
148
  res.header(_core.HEADERS.CONTENT_TYPE, _core.HEADERS.JSON);
175
149
  }
176
-
177
150
  if (typeof body === 'object' && _lodash.default.isNil(body) === false) {
178
151
  if (typeof body.error === 'string') {
179
- res.locals._verdaccio_error = body.error; // res._verdaccio_error = (body as MiddlewareError).error;
152
+ res.locals._verdaccio_error = body.error;
153
+ // res._verdaccio_error = (body as MiddlewareError).error;
180
154
  }
181
155
 
182
156
  body = JSON.stringify(body, undefined, ' ') + '\n';
183
- } // don't send etags with errors
184
-
157
+ }
185
158
 
159
+ // don't send etags with errors
186
160
  if (!res.statusCode || res.statusCode >= _core.HTTP_STATUS.OK && res.statusCode < _core.HTTP_STATUS.MULTIPLE_CHOICES) {
187
161
  res.header(_core.HEADERS.ETAG, '"' + (0, _utils.stringToMD5)(body) + '"');
188
162
  }
189
- } else {// send(null), send(204), etc.
163
+ } else {
164
+ // send(null), send(204), etc.
190
165
  }
191
166
  } catch (err) {
192
167
  // if verdaccio sends headers first, and then calls res.send()
@@ -195,87 +170,71 @@ next) {
195
170
  if (err.message.match(/set headers after they are sent/)) {
196
171
  if (_lodash.default.isNil(res.socket) === false) {
197
172
  var _res$socket;
198
-
199
173
  (_res$socket = res.socket) === null || _res$socket === void 0 ? void 0 : _res$socket.destroy();
200
174
  }
201
-
202
175
  return;
203
176
  }
204
-
205
177
  throw err;
206
178
  }
207
-
208
179
  res.send(body);
209
- } // FIXME: deprecated, moved to @verdaccio/dev-commons
210
-
180
+ }
211
181
 
182
+ // FIXME: deprecated, moved to @verdaccio/dev-commons
212
183
  const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
213
184
  exports.LOG_STATUS_MESSAGE = LOG_STATUS_MESSAGE;
214
185
  const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;
215
186
  exports.LOG_VERDACCIO_ERROR = LOG_VERDACCIO_ERROR;
216
187
  const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;
217
188
  exports.LOG_VERDACCIO_BYTES = LOG_VERDACCIO_BYTES;
218
-
219
189
  function log(req, res, next) {
220
190
  // logger
221
191
  req.log = _logger.logger.child({
222
192
  sub: 'in'
223
193
  });
224
194
  const _auth = req.headers.authorization;
225
-
226
195
  if (_lodash.default.isNil(_auth) === false) {
227
196
  req.headers.authorization = '<Classified>';
228
197
  }
229
-
230
198
  const _cookie = req.get('cookie');
231
-
232
199
  if (_lodash.default.isNil(_cookie) === false) {
233
200
  req.headers.cookie = '<Classified>';
234
201
  }
235
-
236
202
  req.url = req.originalUrl;
237
203
  req.log.info({
238
204
  req: req,
239
205
  ip: req.ip
240
206
  }, "@{ip} requested '@{req.method} @{req.url}'");
241
207
  req.originalUrl = req.url;
242
-
243
208
  if (_lodash.default.isNil(_auth) === false) {
244
209
  req.headers.authorization = _auth;
245
210
  }
246
-
247
211
  if (_lodash.default.isNil(_cookie) === false) {
248
212
  req.headers.cookie = _cookie;
249
213
  }
250
-
251
214
  let bytesin = 0;
252
215
  req.on('data', function (chunk) {
253
216
  bytesin += chunk.length;
254
217
  });
255
218
  let bytesout = 0;
256
- const _write = res.write; // FIXME: res.write should return boolean
219
+ const _write = res.write;
220
+ // FIXME: res.write should return boolean
257
221
  // @ts-ignore
258
-
259
222
  res.write = function (buf) {
260
223
  bytesout += buf.length;
261
224
  /* eslint prefer-rest-params: "off" */
262
225
  // @ts-ignore
263
-
264
226
  _write.apply(res, arguments);
265
227
  };
266
-
267
228
  const log = function () {
268
229
  const forwardedFor = req.get('x-forwarded-for');
269
230
  const remoteAddress = req.connection.remoteAddress;
270
231
  const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
271
232
  let message;
272
-
273
233
  if (res.locals._verdaccio_error) {
274
234
  message = LOG_VERDACCIO_ERROR;
275
235
  } else {
276
236
  message = LOG_VERDACCIO_BYTES;
277
237
  }
278
-
279
238
  req.url = req.originalUrl;
280
239
  req.log.http({
281
240
  request: {
@@ -293,45 +252,35 @@ function log(req, res, next) {
293
252
  }, message);
294
253
  req.originalUrl = req.url;
295
254
  };
296
-
297
255
  req.on('close', function () {
298
256
  log();
299
257
  });
300
- const _end = res.end; // @ts-ignore
301
-
258
+ const _end = res.end;
259
+ // @ts-ignore
302
260
  res.end = function (buf) {
303
261
  if (buf) {
304
262
  bytesout += buf.length;
305
263
  }
306
264
  /* eslint prefer-rest-params: "off" */
307
265
  // @ts-ignore
308
-
309
-
310
266
  _end.apply(res, arguments);
311
-
312
267
  log();
313
268
  };
314
-
315
269
  next();
316
270
  }
317
-
318
271
  function handleError(err, req, res, next) {
319
272
  debug('error handler init');
320
-
321
273
  if (_lodash.default.isError(err)) {
322
274
  debug('is native error');
323
-
324
275
  if (err.code === 'ECONNABORT' && res.statusCode === _core.HTTP_STATUS.NOT_MODIFIED) {
325
276
  return next();
326
277
  }
327
-
328
278
  if (_lodash.default.isFunction(res.locals.report_error) === false) {
329
- debug('is locals error report ref'); // in case of very early error this middleware may not be loaded before error is generated
279
+ debug('is locals error report ref');
280
+ // in case of very early error this middleware may not be loaded before error is generated
330
281
  // fixing that
331
-
332
282
  errorReportingMiddleware(req, res, _lodash.default.noop);
333
283
  }
334
-
335
284
  debug('set locals error report ref');
336
285
  res.locals.report_error(err);
337
286
  } else {
@@ -339,16 +288,14 @@ function handleError(err, req, res, next) {
339
288
  debug('no error to report, jump next layer');
340
289
  return next(err);
341
290
  }
342
- } // Middleware
343
-
291
+ }
344
292
 
293
+ // Middleware
345
294
  function errorReportingMiddleware(req, res, next) {
346
295
  debug('error report middleware');
347
-
348
296
  res.locals.report_error = res.locals.report_error || function (err) {
349
297
  if (err.status && err.status >= _core.HTTP_STATUS.BAD_REQUEST && err.status < 600) {
350
298
  debug('is error > 409 %o', err === null || err === void 0 ? void 0 : err.status);
351
-
352
299
  if (_lodash.default.isNil(res.headersSent) === false) {
353
300
  debug('send status %o', err === null || err === void 0 ? void 0 : err.status);
354
301
  res.status(err.status);
@@ -359,15 +306,12 @@ function errorReportingMiddleware(req, res, next) {
359
306
  }
360
307
  } else {
361
308
  debug('is error < 409 %o', err === null || err === void 0 ? void 0 : err.status);
362
-
363
309
  _logger.logger.error({
364
310
  err: err
365
311
  }, 'unexpected error: @{!err.message}\n@{err.stack}');
366
-
367
312
  if (!res.status || !res.send) {
368
313
  // TODO: decide which debug keep
369
314
  _logger.logger.error('this is an error in express.js, please report this');
370
-
371
315
  debug('this is an error in express.js, please report this, destroy response %o', err);
372
316
  res.destroy();
373
317
  } else if (!res.headersSent) {
@@ -382,7 +326,6 @@ function errorReportingMiddleware(req, res, next) {
382
326
  }
383
327
  }
384
328
  };
385
-
386
329
  debug('error report middleware next()');
387
330
  next();
388
331
  }
package/build/middleware.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","get","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.get('x-forwarded-for');\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;;AAGA;;AAGA;;AAUA;;AAEA;;AAOA;;;;AAMA,MAAMA,KAAK,GAAG,IAAAC,cAAA,EAAW,sBAAX,CAAd;;AAEO,SAASC,KAAT,CAAeC,MAAf,EAAoC;EACzC,OAAO,UACLC,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKC;IACN,IAAIJ,MAAM,CAACK,IAAP,CAAYD,KAAZ,CAAJ,EAAwB;MACtBD,IAAI;IACL,CAFD,MAEO;MACLA,IAAI,CAAC,OAAD,CAAJ;IACD;EACF,CAXD;AAYD,C,CAED;AACA;;;AACO,SAASG,qBAAT,CACLL,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN;EACAD,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQC,cAAnB,EAAmC,MAAnC,EAFM,CAGN;;EACAP,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQE,GAAnB,EAAwB,oBAAxB,EAJM,CAKN;;EACAR,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQG,GAAnB,EAAwB,SAAxB,EANM,CAON;;EACAT,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQI,GAAnB,EAAwB,eAAxB;EACAT,IAAI;AACL;;AAEM,SAASU,YAAT,CACLZ,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAY,mBAAA,EAAiBX,KAAjB,CAAJ,EAA6B;IAClCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASI,eAAT,CACLjB,GADK,EAELC,GAFK,EAGLC,IAHK,EAILC,KAJK,EAKLU,IALK,EAMC;EACN,IAAIV,KAAK,KAAK,GAAd,EAAmB;IACjB;IACAD,IAAI,CAAC,OAAD,CAAJ;EACD,CAHD,MAGO,IAAI,IAAAgB,sBAAA,EAAoBf,KAApB,CAAJ,EAAgC;IACrCD,IAAI;EACL,CAFM,MAEA;IACLA,IAAI,CAACa,gBAAA,CAAWC,YAAX,CAAwB,aAAaH,IAArC,CAAD,CAAJ;EACD;AACF;;AAEM,SAASM,KAAT,CAAeC,MAAf,EAA2C;EAChD,OAAO,UAAUpB,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IACxF,IAAIF,GAAG,CAACqB,OAAJ,CAAYC,iBAAA,CAAYC,YAAxB,MAA0CH,MAA9C,EAAsD;MACpDlB,IAAI,CACFa,gBAAA,CAAWS,OAAX,CACEC,iBAAA,CAAYC,iBADd,EAEE,iCAAiCN,MAAjC,GAA0C,SAA1C,GAAsDpB,GAAG,CAAC2B,GAAJ,CAAQL,iBAAA,CAAYC,YAApB,CAFxD,CADE,CAAJ;IAMD,CAPD,MAOO;MACLrB,IAAI;IACL;EACF,CAXD;AAYD;;AAEM,SAAS0B,kBAAT,CACL5B,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAIF,GAAG,CAAC6B,GAAJ,CAAQC,OAAR,CAAgB,GAAhB,MAAyB,CAAC,CAA9B,EAAiC;IAC/B;IACA9B,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAAC6B,GAAJ,CAAQE,OAAR,CAAgB,sBAAhB,EAAwC,OAAxC,CAAV;EACD;;EACD7B,IAAI;AACL;;AAEM,SAAS8B,UAAT,CACLhC,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACN,IAAI,CAAC,IAAA+B,eAAA,EAASjC,GAAG,CAACkC,IAAb,CAAL,EAAyB;IACvB,OAAOhC,IAAI,CAACa,gBAAA,CAAWoB,aAAX,CAAyB,2BAAzB,CAAD,CAAX;EACD;;EACDjC,IAAI;AACL;;AAEM,SAASkC,QAAT,CAAkBC,MAAlB,EAA4C;EACjD,OAAO,UAAUrC,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;IAAA;;IACxF,IAAI,CAAAF,GAAG,SAAH,IAAAA,GAAG,WAAH,4BAAAA,GAAG,CAAEqB,OAAL,8DAAciB,GAAd,KAAqB,IAAzB,EAA+B;MAC7B,MAAMC,GAAG,GAAGvC,GAAG,CAACqB,OAAJ,CAAYiB,GAAZ,CAAgBE,KAAhB,CAAsB,GAAtB,CAAZ;;MAEA,KAAK,IAAIC,CAAC,GAAG,CAAb,EAAgBA,CAAC,GAAGF,GAAG,CAACG,MAAxB,EAAgCD,CAAC,EAAjC,EAAqC;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAD,CAAH,CAAO3C,KAAP,CAAa,kBAAb,CAAV;;QACA,IAAI6C,CAAC,IAAIA,CAAC,CAAC,CAAD,CAAD,KAASN,MAAM,CAACO,SAAzB,EAAoC;UAClC,OAAO1C,IAAI,CAACa,gBAAA,CAAWS,OAAX,CAAmBC,iBAAA,CAAYoB,aAA/B,EAA8C,eAA9C,CAAD,CAAX;QACD;MACF;IACF;;IACD3C,IAAI;EACL,CAZD;AAaD;;AAEM,SAAS4C,KAAT,CAAeC,IAAf,EAAqC;EAC1C,OAAO,UAAUC,MAAV,EAAoC;IACzC,OAAO,UAAUhD,GAAV,EAA+BC,GAA/B,EAAqDC,IAArD,EAAmF;MACxFF,GAAG,CAACiD,KAAJ;MACA,MAAMC,WAAW,GAAGlD,GAAG,CAACmD,MAAJ,CAAWC,KAAX,GACf,IAAGpD,GAAG,CAACmD,MAAJ,CAAWC,KAAM,IAAGpD,GAAG,CAACmD,MAAJ,CAAWE,OAAQ,EAD3B,GAEhBrD,GAAG,CAACmD,MAAJ,CAAWE,OAFf;MAGA,MAAMC,cAAc,GAAGtD,GAAG,CAACmD,MAAJ,CAAWI,QAAX,GACnB,IAAAC,sCAAA,EAAsBxD,GAAG,CAACmD,MAAJ,CAAWI,QAAjC,CADmB,GAEnBE,SAFJ;MAGA,MAAMC,MAAM,GAAG1D,GAAG,CAAC2D,WAAnB;;MACAC,cAAA,CAAOC,KAAP,CACE;QAAEb,MAAF;QAAUc,IAAI,EAAEJ,MAAF,aAAEA,MAAF,uBAAEA,MAAM,CAAE7C;MAAxB,CADF,EAEG,iDAFH;;MAIAkC,IAAI,CAAC,WAAWC,MAAZ,CAAJ,CACE;QAAEE,WAAF;QAAeI;MAAf,CADF,EAEEI,MAFF,EAGE,UAAUK,KAAV,EAAiBC,OAAjB,EAAgC;QAC9BhE,GAAG,CAACiE,MAAJ;;QACA,IAAIF,KAAJ,EAAW;UACT7D,IAAI,CAAC6D,KAAD,CAAJ;QACD,CAFD,MAEO,IAAIC,OAAJ,EAAa;UAClB9D,IAAI;QACL,CAFM,MAEA;UACL;UACA;UACA,MAAMa,gBAAA,CAAWmD,gBAAX,CAA4BC,eAAA,CAAUC,YAAtC,CAAN;QACD;MACF,CAdH;IAgBD,CA7BD;EA8BD,CA/BD;AAgCD;;AAQM,SAASC,KAAT,CACLnC,IADK,EAELlC,GAFK,EAGLC,GAHK,EAIL;AACA;AACAC,IANK,EAOC;EACN,IAAID,GAAG,CAACqE,UAAJ,KAAmB7C,iBAAA,CAAY8C,YAA/B,IAA+C,CAACtE,GAAG,CAACuE,SAAJ,CAAcjE,aAAA,CAAQkE,QAAtB,CAApD,EAAqF;IACnF;IACAxE,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQkE,QAAnB,EAA8B,GAAEC,iBAAY,KAAIC,kBAAa,EAA7D;EACD;;EAED,IAAI;IACF,IAAIC,eAAA,CAAEC,QAAF,CAAW3C,IAAX,KAAoB0C,eAAA,CAAE3C,QAAF,CAAWC,IAAX,CAAxB,EAA0C;MACxC,IAAI,CAACjC,GAAG,CAACuE,SAAJ,CAAcjE,aAAA,CAAQgB,YAAtB,CAAL,EAA0C;QACxCtB,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQgB,YAAnB,EAAiChB,aAAA,CAAQuE,IAAzC;MACD;;MAED,IAAI,OAAO5C,IAAP,KAAgB,QAAhB,IAA4B0C,eAAA,CAAEG,KAAF,CAAQ7C,IAAR,MAAkB,KAAlD,EAAyD;QACvD,IAAI,OAAQA,IAAD,CAA0B6B,KAAjC,KAA2C,QAA/C,EAAyD;UACvD9D,GAAG,CAAC+E,MAAJ,CAAWC,gBAAX,GAA+B/C,IAAD,CAA0B6B,KAAxD,CADuD,CAEvD;QACD;;QACD7B,IAAI,GAAG4C,IAAI,CAACI,SAAL,CAAehD,IAAf,EAAqBuB,SAArB,EAAgC,IAAhC,IAAwC,IAA/C;MACD,CAXuC,CAaxC;;;MACA,IACE,CAACxD,GAAG,CAACqE,UAAL,IACCrE,GAAG,CAACqE,UAAJ,IAAkB7C,iBAAA,CAAY0D,EAA9B,IAAoClF,GAAG,CAACqE,UAAJ,GAAiB7C,iBAAA,CAAY2D,gBAFpE,EAGE;QACAnF,GAAG,CAACK,MAAJ,CAAWC,aAAA,CAAQ8E,IAAnB,EAAyB,MAAM,IAAAC,kBAAA,EAAYpD,IAAZ,CAAN,GAAoC,GAA7D;MACD;IACF,CApBD,MAoBO,CACL;IACD;EACF,CAxBD,CAwBE,OAAOqD,GAAP,EAAiB;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAJ,CAAY1F,KAAZ,CAAkB,iCAAlB,CAAJ,EAA0D;MACxD,IAAI8E,eAAA,CAAEG,KAAF,CAAQ9E,GAAG,CAACwF,MAAZ,MAAwB,KAA5B,EAAmC;QAAA;;QACjC,eAAAxF,GAAG,CAACwF,MAAJ,4DAAYC,OAAZ;MACD;;MACD;IACD;;IACD,MAAMH,GAAN;EACD;;EAEDtF,GAAG,CAAC0F,IAAJ,CAASzD,IAAT;AACD,C,CAED;;;AACO,MAAM0D,kBAAkB,GAC7B,gFADK;;AAEA,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAlD;;AACA,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAlD;;;AAEA,SAASG,GAAT,CAAa/F,GAAb,EAAkCC,GAAlC,EAAwDC,IAAxD,EAAsF;EAC3F;EACAF,GAAG,CAAC+F,GAAJ,GAAUnC,cAAA,CAAOoC,KAAP,CAAa;IAAEC,GAAG,EAAE;EAAP,CAAb,CAAV;EAEA,MAAMC,KAAK,GAAGlG,GAAG,CAACqB,OAAJ,CAAY8E,aAA1B;;EACA,IAAIvB,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BlG,GAAG,CAACqB,OAAJ,CAAY8E,aAAZ,GAA4B,cAA5B;EACD;;EAED,MAAMC,OAAO,GAAGpG,GAAG,CAAC2B,GAAJ,CAAQ,QAAR,CAAhB;;EACA,IAAIiD,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BpG,GAAG,CAACqB,OAAJ,CAAYgF,MAAZ,GAAqB,cAArB;EACD;;EAEDrG,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAACsG,WAAd;EACAtG,GAAG,CAAC+F,GAAJ,CAAQQ,IAAR,CAAa;IAAEvG,GAAG,EAAEA,GAAP;IAAYwG,EAAE,EAAExG,GAAG,CAACwG;EAApB,CAAb,EAAuC,4CAAvC;EACAxG,GAAG,CAACsG,WAAJ,GAAkBtG,GAAG,CAAC6B,GAAtB;;EAEA,IAAI+C,eAAA,CAAEG,KAAF,CAAQmB,KAAR,MAAmB,KAAvB,EAA8B;IAC5BlG,GAAG,CAACqB,OAAJ,CAAY8E,aAAZ,GAA4BD,KAA5B;EACD;;EAED,IAAItB,eAAA,CAAEG,KAAF,CAAQqB,OAAR,MAAqB,KAAzB,EAAgC;IAC9BpG,GAAG,CAACqB,OAAJ,CAAYgF,MAAZ,GAAqBD,OAArB;EACD;;EAED,IAAIK,OAAO,GAAG,CAAd;EACAzG,GAAG,CAAC0G,EAAJ,CAAO,MAAP,EAAe,UAAUC,KAAV,EAAuB;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAjB;EACD,CAFD;EAIA,IAAIkE,QAAQ,GAAG,CAAf;EACA,MAAMC,MAAM,GAAG5G,GAAG,CAAC6G,KAAnB,CAhC2F,CAiC3F;EACA;;EACA7G,GAAG,CAAC6G,KAAJ,GAAY,UAAUC,GAAV,EAAwB;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACA;IACA;;IACAmE,MAAM,CAACG,KAAP,CAAa/G,GAAb,EAAkBgH,SAAlB;EACD,CALD;;EAOA,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGlH,GAAG,CAAC2B,GAAJ,CAAQ,iBAAR,CAArB;IACA,MAAMwF,aAAa,GAAGnH,GAAG,CAACoH,UAAJ,CAAeD,aAArC;IACA,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAxC,GAA4CA,aAAzE;IACA,IAAI3B,OAAJ;;IACA,IAAIvF,GAAG,CAAC+E,MAAJ,CAAWC,gBAAf,EAAiC;MAC/BO,OAAO,GAAGK,mBAAV;IACD,CAFD,MAEO;MACLL,OAAO,GAAGM,mBAAV;IACD;;IAED9F,GAAG,CAAC6B,GAAJ,GAAU7B,GAAG,CAACsG,WAAd;IACAtG,GAAG,CAAC+F,GAAJ,CAAQuB,IAAR,CACE;MACEC,OAAO,EAAE;QACPC,MAAM,EAAExH,GAAG,CAACwH,MADL;QAEP3F,GAAG,EAAE7B,GAAG,CAAC6B;MAFF,CADX;MAKEiC,IAAI,EAAG9D,GAAG,CAAC2D,WAAJ,IAAmB3D,GAAG,CAAC2D,WAAJ,CAAgB9C,IAApC,IAA6C,IALrD;MAMEwG,QANF;MAOEI,MAAM,EAAExH,GAAG,CAACqE,UAPd;MAQEP,KAAK,EAAE9D,GAAG,CAAC+E,MAAJ,CAAWC,gBARpB;MASEyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OADC;QAELmB,GAAG,EAAEhB;MAFA;IATT,CADF,EAeEpB,OAfF;IAiBAxF,GAAG,CAACsG,WAAJ,GAAkBtG,GAAG,CAAC6B,GAAtB;EACD,CA9BD;;EAgCA7B,GAAG,CAAC0G,EAAJ,CAAO,OAAP,EAAgB,YAAkB;IAChCX,GAAG;EACJ,CAFD;EAIA,MAAM8B,IAAI,GAAG5H,GAAG,CAAC6H,GAAjB,CA9E2F,CA+E3F;;EACA7H,GAAG,CAAC6H,GAAJ,GAAU,UAAUf,GAAV,EAAqB;IAC7B,IAAIA,GAAJ,EAAS;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAhB;IACD;IACD;IACA;;;IACAmF,IAAI,CAACb,KAAL,CAAW/G,GAAX,EAAgBgH,SAAhB;;IACAlB,GAAG;EACJ,CARD;;EASA7F,IAAI;AACL;;AAEM,SAAS6H,WAAT,CACLxC,GADK,EAELvF,GAFK,EAGLC,GAHK,EAILC,IAJK,EAKL;EACAN,KAAK,CAAC,oBAAD,CAAL;;EACA,IAAIgF,eAAA,CAAEoD,OAAF,CAAUzC,GAAV,CAAJ,EAAoB;IAClB3F,KAAK,CAAC,iBAAD,CAAL;;IACA,IAAI2F,GAAG,CAAC0C,IAAJ,KAAa,YAAb,IAA6BhI,GAAG,CAACqE,UAAJ,KAAmB7C,iBAAA,CAAYyG,YAAhE,EAA8E;MAC5E,OAAOhI,IAAI,EAAX;IACD;;IACD,IAAI0E,eAAA,CAAEuD,UAAF,CAAalI,GAAG,CAAC+E,MAAJ,CAAWoD,YAAxB,MAA0C,KAA9C,EAAqD;MACnDxI,KAAK,CAAC,4BAAD,CAAL,CADmD,CAEnD;MACA;;MACAyI,wBAAwB,CAACrI,GAAD,EAAMC,GAAN,EAAW2E,eAAA,CAAE0D,IAAb,CAAxB;IACD;;IACD1I,KAAK,CAAC,6BAAD,CAAL;IACAK,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,CAAwB7C,GAAxB;EACD,CAbD,MAaO;IACL;IACA3F,KAAK,CAAC,qCAAD,CAAL;IACA,OAAOM,IAAI,CAACqF,GAAD,CAAX;EACD;AACF,C,CAED;;;AACO,SAAS8C,wBAAT,CACLrI,GADK,EAELC,GAFK,EAGLC,IAHK,EAIC;EACNN,KAAK,CAAC,yBAAD,CAAL;;EACAK,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,GACEnI,GAAG,CAAC+E,MAAJ,CAAWoD,YAAX,IACA,UAAU7C,GAAV,EAAqC;IACnC,IAAIA,GAAG,CAACkC,MAAJ,IAAclC,GAAG,CAACkC,MAAJ,IAAchG,iBAAA,CAAY8G,WAAxC,IAAuDhD,GAAG,CAACkC,MAAJ,GAAa,GAAxE,EAA6E;MAC3E7H,KAAK,CAAC,mBAAD,EAAsB2F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA,IAAI7C,eAAA,CAAEG,KAAF,CAAQ9E,GAAG,CAACuI,WAAZ,MAA6B,KAAjC,EAAwC;QACtC5I,KAAK,CAAC,gBAAD,EAAmB2F,GAAnB,aAAmBA,GAAnB,uBAAmBA,GAAG,CAAEkC,MAAxB,CAAL;QACAxH,GAAG,CAACwH,MAAJ,CAAWlC,GAAG,CAACkC,MAAf;QACA7H,KAAK,CAAC,eAAD,EAAkB2F,GAAlB,aAAkBA,GAAlB,uBAAkBA,GAAG,CAAEC,OAAvB,CAAL;QACAtF,IAAI,CAAC;UAAE6D,KAAK,EAAEwB,GAAG,CAACC,OAAJ,IAAerB,eAAA,CAAUsE;QAAlC,CAAD,CAAJ;MACD;IACF,CARD,MAQO;MACL7I,KAAK,CAAC,mBAAD,EAAsB2F,GAAtB,aAAsBA,GAAtB,uBAAsBA,GAAG,CAAEkC,MAA3B,CAAL;;MACA7D,cAAA,CAAOG,KAAP,CAAa;QAAEwB,GAAG,EAAEA;MAAP,CAAb,EAA2B,iDAA3B;;MACA,IAAI,CAACtF,GAAG,CAACwH,MAAL,IAAe,CAACxH,GAAG,CAAC0F,IAAxB,EAA8B;QAC5B;QACA/B,cAAA,CAAOG,KAAP,CAAa,oDAAb;;QACAnE,KAAK,CAAC,yEAAD,EAA4E2F,GAA5E,CAAL;QACAtF,GAAG,CAACyF,OAAJ;MACD,CALD,MAKO,IAAI,CAACzF,GAAG,CAACuI,WAAT,EAAsB;QAC3B5I,KAAK,CAAC,0BAAD,EAA6B2F,GAA7B,CAAL;QACAtF,GAAG,CAACwH,MAAJ,CAAWhG,iBAAA,CAAYiH,cAAvB;QACAxI,IAAI,CAAC;UAAE6D,KAAK,EAAEI,eAAA,CAAUwE;QAAnB,CAAD,CAAJ;MACD,CAJM,MAIA;QACL;QACA/I,KAAK,CAAC,6CAAD,EAAgD2F,GAAhD,CAAL;MACD;IACF;EACF,CA5BH;;EA8BA3F,KAAK,CAAC,gCAAD,CAAL;EACAM,IAAI;AACL"}
1
+ {"version":3,"file":"middleware.js","names":["debug","buildDebug","match","regexp","req","res","next","value","exec","setSecurityWebHeaders","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS","validateName","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage","media","expect","headers","HEADER_TYPE","CONTENT_TYPE","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","get","encodeScopePackage","url","indexOf","replace","expectJson","isObject","body","getBadRequest","antiLoop","config","via","arr","split","i","length","m","server_id","LOOP_DETECTED","allow","auth","action","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","error","allowed","resume","getInternalError","API_ERROR","PLUGIN_ERROR","final","statusCode","UNAUTHORIZED","getHeader","WWW_AUTH","TOKEN_BASIC","TOKEN_BEARER","_","isString","JSON","isNil","locals","_verdaccio_error","stringify","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","socket","destroy","send","LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","child","sub","_auth","authorization","_cookie","cookie","originalUrl","info","ip","bytesin","on","chunk","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","http","request","method","status","bytes","in","out","_end","end","handleError","isError","code","NOT_MODIFIED","isFunction","report_error","errorReportingMiddleware","noop","BAD_REQUEST","headersSent","UNKNOWN_ERROR","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../src/middleware.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { NextFunction, Request, Response } from 'express';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n API_ERROR,\n HEADERS,\n HEADER_TYPE,\n HTTP_STATUS,\n TOKEN_BASIC,\n TOKEN_BEARER,\n VerdaccioError,\n errorUtils,\n} from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { Config, Logger, Package, RemoteUser } from '@verdaccio/types';\nimport {\n isObject,\n stringToMD5,\n validateName as utilValidateName,\n validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { getVersionFromTarball } from './middleware-utils';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nconst debug = buildDebug('verdaccio:middleware');\n\nexport function match(regexp: RegExp): any {\n return function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string\n ): void {\n if (regexp.exec(value)) {\n next();\n } else {\n next('route');\n }\n };\n}\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n // disable loading in frames (clickjacking, etc.)\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n // avoid stablish connections outside of domain\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n res.header(HEADERS.CTO, 'nosniff');\n // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n res.header(HEADERS.XSS, '1; mode=block');\n next();\n}\n\nexport function validateName(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidateName(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function validatePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer,\n value: string,\n name: string\n): void {\n if (value === '-') {\n // special case in couchdb usually\n next('route');\n } else if (utilValidatePackage(value)) {\n next();\n } else {\n next(errorUtils.getForbidden('invalid ' + name));\n }\n}\n\nexport function media(expect: string | null): any {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n next(\n errorUtils.getCode(\n HTTP_STATUS.UNSUPPORTED_MEDIA,\n 'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n )\n );\n } else {\n next();\n }\n };\n}\n\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (req.url.indexOf('@') !== -1) {\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n }\n next();\n}\n\nexport function expectJson(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n if (!isObject(req.body)) {\n return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n }\n next();\n}\n\nexport function antiLoop(config: Config): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.headers.via.split(',');\n\n for (let i = 0; i < arr.length; i++) {\n const m = arr[i].match(/\\s*(\\S+)\\s+(\\S+)/);\n if (m && m[2] === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n next();\n };\n}\n\nexport function allow(auth: Auth): Function {\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const packageName = req.params.scope\n ? `@${req.params.scope}/${req.params.package}`\n : req.params.package;\n const packageVersion = req.params.filename\n ? getVersionFromTarball(req.params.filename)\n : undefined;\n const remote = req.remote_user;\n logger.trace(\n { action, user: remote?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote,\n function (error, allowed): void {\n req.resume();\n if (error) {\n next(error);\n } else if (allowed) {\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n\nexport interface MiddlewareError {\n error: string;\n}\n\nexport type FinalBody = Package | MiddlewareError | string;\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n // they say it's required for 401, so...\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (_.isString(body) || _.isObject(body)) {\n if (!res.getHeader(HEADERS.CONTENT_TYPE)) {\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && _.isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n // res._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n }\n } else {\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n if (_.isNil(res.socket) === false) {\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (_.isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n req.originalUrl = req.url;\n\n if (_.isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (_.isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n // FIXME: res.write should return boolean\n // @ts-ignore\n res.write = function (buf): boolean {\n bytesout += buf.length;\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _write.apply(res, arguments);\n };\n\n const log = function (): void {\n const forwardedFor = req.get('x-forwarded-for');\n const remoteAddress = req.connection.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n let message;\n if (res.locals._verdaccio_error) {\n message = LOG_VERDACCIO_ERROR;\n } else {\n message = LOG_VERDACCIO_BYTES;\n }\n\n req.url = req.originalUrl;\n req.log.http(\n {\n request: {\n method: req.method,\n url: req.url,\n },\n user: (req.remote_user && req.remote_user.name) || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n },\n message\n );\n req.originalUrl = req.url;\n };\n\n req.on('close', function (): void {\n log();\n });\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (buf): void {\n if (buf) {\n bytesout += buf.length;\n }\n /* eslint prefer-rest-params: \"off\" */\n // @ts-ignore\n _end.apply(res, arguments);\n log();\n };\n next();\n}\n\nexport function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n) {\n debug('error handler init');\n if (_.isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (_.isFunction(res.locals.report_error) === false) {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(req, res, _.noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n}\n\n// Middleware\nexport function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n debug('error report middleware');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (_.isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('report internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware next()');\n next();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAGA;AAGA;AAUA;AAEA;AAOA;AAA2D;AAM3D,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEzC,SAASC,KAAK,CAACC,MAAc,EAAO;EACzC,OAAO,UACLC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACP;IACN,IAAIJ,MAAM,CAACK,IAAI,CAACD,KAAK,CAAC,EAAE;MACtBD,IAAI,EAAE;IACR,CAAC,MAAM;MACLA,IAAI,CAAC,OAAO,CAAC;IACf;EACF,CAAC;AACH;;AAEA;AACA;AACO,SAASG,qBAAqB,CACnCL,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN;EACAD,GAAG,CAACK,MAAM,CAACC,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC1C;EACAP,GAAG,CAACK,MAAM,CAACC,aAAO,CAACE,GAAG,EAAE,oBAAoB,CAAC;EAC7C;EACAR,GAAG,CAACK,MAAM,CAACC,aAAO,CAACG,GAAG,EAAE,SAAS,CAAC;EAClC;EACAT,GAAG,CAACK,MAAM,CAACC,aAAO,CAACI,GAAG,EAAE,eAAe,CAAC;EACxCT,IAAI,EAAE;AACR;AAEO,SAASU,YAAY,CAC1BZ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACbU,IAAY,EACN;EACN,IAAIV,KAAK,KAAK,GAAG,EAAE;IACjB;IACAD,IAAI,CAAC,OAAO,CAAC;EACf,CAAC,MAAM,IAAI,IAAAY,mBAAgB,EAACX,KAAK,CAAC,EAAE;IAClCD,IAAI,EAAE;EACR,CAAC,MAAM;IACLA,IAAI,CAACa,gBAAU,CAACC,YAAY,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EAClD;AACF;AAEO,SAASI,eAAe,CAC7BjB,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACbU,IAAY,EACN;EACN,IAAIV,KAAK,KAAK,GAAG,EAAE;IACjB;IACAD,IAAI,CAAC,OAAO,CAAC;EACf,CAAC,MAAM,IAAI,IAAAgB,sBAAmB,EAACf,KAAK,CAAC,EAAE;IACrCD,IAAI,EAAE;EACR,CAAC,MAAM;IACLA,IAAI,CAACa,gBAAU,CAACC,YAAY,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EAClD;AACF;AAEO,SAASM,KAAK,CAACC,MAAqB,EAAO;EAChD,OAAO,UAAUpB,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACxF,IAAIF,GAAG,CAACqB,OAAO,CAACC,iBAAW,CAACC,YAAY,CAAC,KAAKH,MAAM,EAAE;MACpDlB,IAAI,CACFa,gBAAU,CAACS,OAAO,CAChBC,iBAAW,CAACC,iBAAiB,EAC7B,8BAA8B,GAAGN,MAAM,GAAG,SAAS,GAAGpB,GAAG,CAAC2B,GAAG,CAACL,iBAAW,CAACC,YAAY,CAAC,CACxF,CACF;IACH,CAAC,MAAM;MACLrB,IAAI,EAAE;IACR;EACF,CAAC;AACH;AAEO,SAAS0B,kBAAkB,CAChC5B,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAIF,GAAG,CAAC6B,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;IAC/B;IACA9B,GAAG,CAAC6B,GAAG,GAAG7B,GAAG,CAAC6B,GAAG,CAACE,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAC5D;EACA7B,IAAI,EAAE;AACR;AAEO,SAAS8B,UAAU,CACxBhC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAI,CAAC,IAAA+B,eAAQ,EAACjC,GAAG,CAACkC,IAAI,CAAC,EAAE;IACvB,OAAOhC,IAAI,CAACa,gBAAU,CAACoB,aAAa,CAAC,2BAA2B,CAAC,CAAC;EACpE;EACAjC,IAAI,EAAE;AACR;AAEO,SAASkC,QAAQ,CAACC,MAAc,EAAY;EACjD,OAAO,UAAUrC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IAAA;IACxF,IAAI,CAAAF,GAAG,aAAHA,GAAG,uCAAHA,GAAG,CAAEqB,OAAO,iDAAZ,aAAciB,GAAG,KAAI,IAAI,EAAE;MAC7B,MAAMC,GAAG,GAAGvC,GAAG,CAACqB,OAAO,CAACiB,GAAG,CAACE,KAAK,CAAC,GAAG,CAAC;MAEtC,KAAK,IAAIC,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGF,GAAG,CAACG,MAAM,EAAED,CAAC,EAAE,EAAE;QACnC,MAAME,CAAC,GAAGJ,GAAG,CAACE,CAAC,CAAC,CAAC3C,KAAK,CAAC,kBAAkB,CAAC;QAC1C,IAAI6C,CAAC,IAAIA,CAAC,CAAC,CAAC,CAAC,KAAKN,MAAM,CAACO,SAAS,EAAE;UAClC,OAAO1C,IAAI,CAACa,gBAAU,CAACS,OAAO,CAACC,iBAAW,CAACoB,aAAa,EAAE,eAAe,CAAC,CAAC;QAC7E;MACF;IACF;IACA3C,IAAI,EAAE;EACR,CAAC;AACH;AAEO,SAAS4C,KAAK,CAACC,IAAU,EAAY;EAC1C,OAAO,UAAUC,MAAc,EAAY;IACzC,OAAO,UAAUhD,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;MACxFF,GAAG,CAACiD,KAAK,EAAE;MACX,MAAMC,WAAW,GAAGlD,GAAG,CAACmD,MAAM,CAACC,KAAK,GAC/B,IAAGpD,GAAG,CAACmD,MAAM,CAACC,KAAM,IAAGpD,GAAG,CAACmD,MAAM,CAACE,OAAQ,EAAC,GAC5CrD,GAAG,CAACmD,MAAM,CAACE,OAAO;MACtB,MAAMC,cAAc,GAAGtD,GAAG,CAACmD,MAAM,CAACI,QAAQ,GACtC,IAAAC,sCAAqB,EAACxD,GAAG,CAACmD,MAAM,CAACI,QAAQ,CAAC,GAC1CE,SAAS;MACb,MAAMC,MAAM,GAAG1D,GAAG,CAAC2D,WAAW;MAC9BC,cAAM,CAACC,KAAK,CACV;QAAEb,MAAM;QAAEc,IAAI,EAAEJ,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE7C;MAAK,CAAC,EAC7B,iDAAgD,CAClD;MACDkC,IAAI,CAAC,QAAQ,GAAGC,MAAM,CAAC,CACrB;QAAEE,WAAW;QAAEI;MAAe,CAAC,EAC/BI,MAAM,EACN,UAAUK,KAAK,EAAEC,OAAO,EAAQ;QAC9BhE,GAAG,CAACiE,MAAM,EAAE;QACZ,IAAIF,KAAK,EAAE;UACT7D,IAAI,CAAC6D,KAAK,CAAC;QACb,CAAC,MAAM,IAAIC,OAAO,EAAE;UAClB9D,IAAI,EAAE;QACR,CAAC,MAAM;UACL;UACA;UACA,MAAMa,gBAAU,CAACmD,gBAAgB,CAACC,eAAS,CAACC,YAAY,CAAC;QAC3D;MACF,CAAC,CACF;IACH,CAAC;EACH,CAAC;AACH;AAQO,SAASC,KAAK,CACnBnC,IAAe,EACflC,GAAmB,EACnBC,GAAoB;AACpB;AACA;AACAC,IAAsB,EAChB;EACN,IAAID,GAAG,CAACqE,UAAU,KAAK7C,iBAAW,CAAC8C,YAAY,IAAI,CAACtE,GAAG,CAACuE,SAAS,CAACjE,aAAO,CAACkE,QAAQ,CAAC,EAAE;IACnF;IACAxE,GAAG,CAACK,MAAM,CAACC,aAAO,CAACkE,QAAQ,EAAG,GAAEC,iBAAY,KAAIC,kBAAa,EAAC,CAAC;EACjE;EAEA,IAAI;IACF,IAAIC,eAAC,CAACC,QAAQ,CAAC3C,IAAI,CAAC,IAAI0C,eAAC,CAAC3C,QAAQ,CAACC,IAAI,CAAC,EAAE;MACxC,IAAI,CAACjC,GAAG,CAACuE,SAAS,CAACjE,aAAO,CAACgB,YAAY,CAAC,EAAE;QACxCtB,GAAG,CAACK,MAAM,CAACC,aAAO,CAACgB,YAAY,EAAEhB,aAAO,CAACuE,IAAI,CAAC;MAChD;MAEA,IAAI,OAAO5C,IAAI,KAAK,QAAQ,IAAI0C,eAAC,CAACG,KAAK,CAAC7C,IAAI,CAAC,KAAK,KAAK,EAAE;QACvD,IAAI,OAAQA,IAAI,CAAqB6B,KAAK,KAAK,QAAQ,EAAE;UACvD9D,GAAG,CAAC+E,MAAM,CAACC,gBAAgB,GAAI/C,IAAI,CAAqB6B,KAAK;UAC7D;QACF;;QACA7B,IAAI,GAAG4C,IAAI,CAACI,SAAS,CAAChD,IAAI,EAAEuB,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI;MACrD;;MAEA;MACA,IACE,CAACxD,GAAG,CAACqE,UAAU,IACdrE,GAAG,CAACqE,UAAU,IAAI7C,iBAAW,CAAC0D,EAAE,IAAIlF,GAAG,CAACqE,UAAU,GAAG7C,iBAAW,CAAC2D,gBAAiB,EACnF;QACAnF,GAAG,CAACK,MAAM,CAACC,aAAO,CAAC8E,IAAI,EAAE,GAAG,GAAG,IAAAC,kBAAW,EAACpD,IAAI,CAAW,GAAG,GAAG,CAAC;MACnE;IACF,CAAC,MAAM;MACL;IAAA;EAEJ,CAAC,CAAC,OAAOqD,GAAQ,EAAE;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAO,CAAC1F,KAAK,CAAC,iCAAiC,CAAC,EAAE;MACxD,IAAI8E,eAAC,CAACG,KAAK,CAAC9E,GAAG,CAACwF,MAAM,CAAC,KAAK,KAAK,EAAE;QAAA;QACjC,eAAAxF,GAAG,CAACwF,MAAM,gDAAV,YAAYC,OAAO,EAAE;MACvB;MACA;IACF;IACA,MAAMH,GAAG;EACX;EAEAtF,GAAG,CAAC0F,IAAI,CAACzD,IAAI,CAAC;AAChB;;AAEA;AACO,MAAM0D,kBAAkB,GAC7B,gFAAgF;AAAC;AAC5E,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAmB;AAAC;AACtE,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAkC;AAAC;AAErF,SAASG,GAAG,CAAC/F,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;EAC3F;EACAF,GAAG,CAAC+F,GAAG,GAAGnC,cAAM,CAACoC,KAAK,CAAC;IAAEC,GAAG,EAAE;EAAK,CAAC,CAAC;EAErC,MAAMC,KAAK,GAAGlG,GAAG,CAACqB,OAAO,CAAC8E,aAAa;EACvC,IAAIvB,eAAC,CAACG,KAAK,CAACmB,KAAK,CAAC,KAAK,KAAK,EAAE;IAC5BlG,GAAG,CAACqB,OAAO,CAAC8E,aAAa,GAAG,cAAc;EAC5C;EAEA,MAAMC,OAAO,GAAGpG,GAAG,CAAC2B,GAAG,CAAC,QAAQ,CAAC;EACjC,IAAIiD,eAAC,CAACG,KAAK,CAACqB,OAAO,CAAC,KAAK,KAAK,EAAE;IAC9BpG,GAAG,CAACqB,OAAO,CAACgF,MAAM,GAAG,cAAc;EACrC;EAEArG,GAAG,CAAC6B,GAAG,GAAG7B,GAAG,CAACsG,WAAW;EACzBtG,GAAG,CAAC+F,GAAG,CAACQ,IAAI,CAAC;IAAEvG,GAAG,EAAEA,GAAG;IAAEwG,EAAE,EAAExG,GAAG,CAACwG;EAAG,CAAC,EAAE,4CAA4C,CAAC;EACpFxG,GAAG,CAACsG,WAAW,GAAGtG,GAAG,CAAC6B,GAAG;EAEzB,IAAI+C,eAAC,CAACG,KAAK,CAACmB,KAAK,CAAC,KAAK,KAAK,EAAE;IAC5BlG,GAAG,CAACqB,OAAO,CAAC8E,aAAa,GAAGD,KAAK;EACnC;EAEA,IAAItB,eAAC,CAACG,KAAK,CAACqB,OAAO,CAAC,KAAK,KAAK,EAAE;IAC9BpG,GAAG,CAACqB,OAAO,CAACgF,MAAM,GAAGD,OAAO;EAC9B;EAEA,IAAIK,OAAO,GAAG,CAAC;EACfzG,GAAG,CAAC0G,EAAE,CAAC,MAAM,EAAE,UAAUC,KAAK,EAAQ;IACpCF,OAAO,IAAIE,KAAK,CAACjE,MAAM;EACzB,CAAC,CAAC;EAEF,IAAIkE,QAAQ,GAAG,CAAC;EAChB,MAAMC,MAAM,GAAG5G,GAAG,CAAC6G,KAAK;EACxB;EACA;EACA7G,GAAG,CAAC6G,KAAK,GAAG,UAAUC,GAAG,EAAW;IAClCH,QAAQ,IAAIG,GAAG,CAACrE,MAAM;IACtB;IACA;IACAmE,MAAM,CAACG,KAAK,CAAC/G,GAAG,EAAEgH,SAAS,CAAC;EAC9B,CAAC;EAED,MAAMlB,GAAG,GAAG,YAAkB;IAC5B,MAAMmB,YAAY,GAAGlH,GAAG,CAAC2B,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAMwF,aAAa,GAAGnH,GAAG,CAACoH,UAAU,CAACD,aAAa;IAClD,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAC,GAAGA,aAAa;IACtF,IAAI3B,OAAO;IACX,IAAIvF,GAAG,CAAC+E,MAAM,CAACC,gBAAgB,EAAE;MAC/BO,OAAO,GAAGK,mBAAmB;IAC/B,CAAC,MAAM;MACLL,OAAO,GAAGM,mBAAmB;IAC/B;IAEA9F,GAAG,CAAC6B,GAAG,GAAG7B,GAAG,CAACsG,WAAW;IACzBtG,GAAG,CAAC+F,GAAG,CAACuB,IAAI,CACV;MACEC,OAAO,EAAE;QACPC,MAAM,EAAExH,GAAG,CAACwH,MAAM;QAClB3F,GAAG,EAAE7B,GAAG,CAAC6B;MACX,CAAC;MACDiC,IAAI,EAAG9D,GAAG,CAAC2D,WAAW,IAAI3D,GAAG,CAAC2D,WAAW,CAAC9C,IAAI,IAAK,IAAI;MACvDwG,QAAQ;MACRI,MAAM,EAAExH,GAAG,CAACqE,UAAU;MACtBP,KAAK,EAAE9D,GAAG,CAAC+E,MAAM,CAACC,gBAAgB;MAClCyC,KAAK,EAAE;QACLC,EAAE,EAAElB,OAAO;QACXmB,GAAG,EAAEhB;MACP;IACF,CAAC,EACDpB,OAAO,CACR;IACDxF,GAAG,CAACsG,WAAW,GAAGtG,GAAG,CAAC6B,GAAG;EAC3B,CAAC;EAED7B,GAAG,CAAC0G,EAAE,CAAC,OAAO,EAAE,YAAkB;IAChCX,GAAG,EAAE;EACP,CAAC,CAAC;EAEF,MAAM8B,IAAI,GAAG5H,GAAG,CAAC6H,GAAG;EACpB;EACA7H,GAAG,CAAC6H,GAAG,GAAG,UAAUf,GAAG,EAAQ;IAC7B,IAAIA,GAAG,EAAE;MACPH,QAAQ,IAAIG,GAAG,CAACrE,MAAM;IACxB;IACA;IACA;IACAmF,IAAI,CAACb,KAAK,CAAC/G,GAAG,EAAEgH,SAAS,CAAC;IAC1BlB,GAAG,EAAE;EACP,CAAC;EACD7F,IAAI,EAAE;AACR;AAEO,SAAS6H,WAAW,CACzBxC,GAAc,EACdvF,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtB;EACAN,KAAK,CAAC,oBAAoB,CAAC;EAC3B,IAAIgF,eAAC,CAACoD,OAAO,CAACzC,GAAG,CAAC,EAAE;IAClB3F,KAAK,CAAC,iBAAiB,CAAC;IACxB,IAAI2F,GAAG,CAAC0C,IAAI,KAAK,YAAY,IAAIhI,GAAG,CAACqE,UAAU,KAAK7C,iBAAW,CAACyG,YAAY,EAAE;MAC5E,OAAOhI,IAAI,EAAE;IACf;IACA,IAAI0E,eAAC,CAACuD,UAAU,CAAClI,GAAG,CAAC+E,MAAM,CAACoD,YAAY,CAAC,KAAK,KAAK,EAAE;MACnDxI,KAAK,CAAC,4BAA4B,CAAC;MACnC;MACA;MACAyI,wBAAwB,CAACrI,GAAG,EAAEC,GAAG,EAAE2E,eAAC,CAAC0D,IAAI,CAAC;IAC5C;IACA1I,KAAK,CAAC,6BAA6B,CAAC;IACpCK,GAAG,CAAC+E,MAAM,CAACoD,YAAY,CAAC7C,GAAG,CAAC;EAC9B,CAAC,MAAM;IACL;IACA3F,KAAK,CAAC,qCAAqC,CAAC;IAC5C,OAAOM,IAAI,CAACqF,GAAG,CAAC;EAClB;AACF;;AAEA;AACO,SAAS8C,wBAAwB,CACtCrI,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACNN,KAAK,CAAC,yBAAyB,CAAC;EAChCK,GAAG,CAAC+E,MAAM,CAACoD,YAAY,GACrBnI,GAAG,CAAC+E,MAAM,CAACoD,YAAY,IACvB,UAAU7C,GAAmB,EAAQ;IACnC,IAAIA,GAAG,CAACkC,MAAM,IAAIlC,GAAG,CAACkC,MAAM,IAAIhG,iBAAW,CAAC8G,WAAW,IAAIhD,GAAG,CAACkC,MAAM,GAAG,GAAG,EAAE;MAC3E7H,KAAK,CAAC,mBAAmB,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEkC,MAAM,CAAC;MACvC,IAAI7C,eAAC,CAACG,KAAK,CAAC9E,GAAG,CAACuI,WAAW,CAAC,KAAK,KAAK,EAAE;QACtC5I,KAAK,CAAC,gBAAgB,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEkC,MAAM,CAAC;QACpCxH,GAAG,CAACwH,MAAM,CAAClC,GAAG,CAACkC,MAAM,CAAC;QACtB7H,KAAK,CAAC,eAAe,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEC,OAAO,CAAC;QACpCtF,IAAI,CAAC;UAAE6D,KAAK,EAAEwB,GAAG,CAACC,OAAO,IAAIrB,eAAS,CAACsE;QAAc,CAAC,CAAC;MACzD;IACF,CAAC,MAAM;MACL7I,KAAK,CAAC,mBAAmB,EAAE2F,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEkC,MAAM,CAAC;MACvC7D,cAAM,CAACG,KAAK,CAAC;QAAEwB,GAAG,EAAEA;MAAI,CAAC,EAAE,iDAAiD,CAAC;MAC7E,IAAI,CAACtF,GAAG,CAACwH,MAAM,IAAI,CAACxH,GAAG,CAAC0F,IAAI,EAAE;QAC5B;QACA/B,cAAM,CAACG,KAAK,CAAC,oDAAoD,CAAC;QAClEnE,KAAK,CAAC,yEAAyE,EAAE2F,GAAG,CAAC;QACrFtF,GAAG,CAACyF,OAAO,EAAE;MACf,CAAC,MAAM,IAAI,CAACzF,GAAG,CAACuI,WAAW,EAAE;QAC3B5I,KAAK,CAAC,0BAA0B,EAAE2F,GAAG,CAAC;QACtCtF,GAAG,CAACwH,MAAM,CAAChG,iBAAW,CAACiH,cAAc,CAAC;QACtCxI,IAAI,CAAC;UAAE6D,KAAK,EAAEI,eAAS,CAACwE;QAAsB,CAAC,CAAC;MAClD,CAAC,MAAM;QACL;QACA/I,KAAK,CAAC,6CAA6C,EAAE2F,GAAG,CAAC;MAC3D;IACF;EACF,CAAC;EAEH3F,KAAK,CAAC,gCAAgC,CAAC;EACvCM,IAAI,EAAE;AACR"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@verdaccio/middleware",
3
- "version": "6.0.0-6-next.30",
3
+ "version": "6.0.0-6-next.32",
4
4
  "description": "loaders logic",
5
5
  "main": "./build/index.js",
6
6
  "types": "build/index.d.ts",
@@ -32,10 +32,10 @@
32
32
  "dependencies": {
33
33
  "debug": "4.3.4",
34
34
  "body-parser": "1.20.1",
35
- "@verdaccio/auth": "6.0.0-6-next.30",
36
- "@verdaccio/core": "6.0.0-6-next.51",
37
- "@verdaccio/logger": "6.0.0-6-next.19",
38
- "@verdaccio/utils": "6.0.0-6-next.19",
35
+ "@verdaccio/auth": "6.0.0-6-next.32",
36
+ "@verdaccio/core": "6.0.0-6-next.53",
37
+ "@verdaccio/logger": "6.0.0-6-next.21",
38
+ "@verdaccio/utils": "6.0.0-6-next.21",
39
39
  "lodash": "4.17.21"
40
40
  },
41
41
  "funding": {