@verdaccio/middleware 6.0.0-6-next.34 → 6.0.0-6-next.35

package/build/middlewares/log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.js","names":["LOG_STATUS_MESSAGE","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","req","res","next","logger","child","sub","_auth","headers","authorization","_","isNil","_cookie","get","cookie","url","originalUrl","info","ip","bytesin","on","chunk","length","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","message","locals","_verdaccio_error","http","request","method","user","remote_user","name","status","statusCode","error","bytes","in","out","_end","end"],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { logger } from '@verdaccio/logger';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n  // logger\n  req.log = logger.child({ sub: 'in' });\n\n  const _auth = req.headers.authorization;\n  if (_.isNil(_auth) === false) {\n    req.headers.authorization = '<Classified>';\n  }\n\n  const _cookie = req.get('cookie');\n  if (_.isNil(_cookie) === false) {\n    req.headers.cookie = '<Classified>';\n  }\n\n  req.url = req.originalUrl;\n  req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n  req.originalUrl = req.url;\n\n  if (_.isNil(_auth) === false) {\n    req.headers.authorization = _auth;\n  }\n\n  if (_.isNil(_cookie) === false) {\n    req.headers.cookie = _cookie;\n  }\n\n  let bytesin = 0;\n  req.on('data', function (chunk): void {\n    bytesin += chunk.length;\n  });\n\n  let bytesout = 0;\n  const _write = res.write;\n  // FIXME: res.write should return boolean\n  // @ts-ignore\n  res.write = function (buf): boolean {\n    bytesout += buf.length;\n    /* eslint prefer-rest-params: \"off\" */\n    // @ts-ignore\n    _write.apply(res, arguments);\n  };\n\n  const log = function (): void {\n    const forwardedFor = req.get('x-forwarded-for');\n    const remoteAddress = req.connection.remoteAddress;\n    const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n    let message;\n    if (res.locals._verdaccio_error) {\n      message = LOG_VERDACCIO_ERROR;\n    } else {\n      message = LOG_VERDACCIO_BYTES;\n    }\n\n    req.url = req.originalUrl;\n    req.log.http(\n      {\n        request: {\n          method: req.method,\n          url: req.url,\n        },\n        user: req.remote_user?.name || null,\n        remoteIP,\n        status: res.statusCode,\n        error: res.locals._verdaccio_error,\n        bytes: {\n          in: bytesin,\n          out: bytesout,\n        },\n      },\n      message\n    );\n    req.originalUrl = req.url;\n  };\n\n  req.on('close', function (): void {\n    log();\n  });\n\n  const _end = res.end;\n  // @ts-ignore\n  res.end = function (buf): void {\n    if (buf) {\n      bytesout += buf.length;\n    }\n    /* eslint prefer-rest-params: \"off\" */\n    // @ts-ignore\n    _end.apply(res, arguments);\n    log();\n  };\n  next();\n}\n"],"mappings":";;;;;;;AAAA;AAEA;AAA2C;AAI3C;AACO,MAAMA,kBAAkB,GAC7B,gFAAgF;AAAC;AAC5E,MAAMC,mBAAmB,GAAI,GAAED,kBAAmB,oBAAmB;AAAC;AACtE,MAAME,mBAAmB,GAAI,GAAEF,kBAAmB,mCAAkC;AAAC;AAErF,SAASG,GAAG,CAACC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;EAC3F;EACAF,GAAG,CAACD,GAAG,GAAGI,cAAM,CAACC,KAAK,CAAC;IAAEC,GAAG,EAAE;EAAK,CAAC,CAAC;EAErC,MAAMC,KAAK,GAAGN,GAAG,CAACO,OAAO,CAACC,aAAa;EACvC,IAAIC,eAAC,CAACC,KAAK,CAACJ,KAAK,CAAC,KAAK,KAAK,EAAE;IAC5BN,GAAG,CAACO,OAAO,CAACC,aAAa,GAAG,cAAc;EAC5C;EAEA,MAAMG,OAAO,GAAGX,GAAG,CAACY,GAAG,CAAC,QAAQ,CAAC;EACjC,IAAIH,eAAC,CAACC,KAAK,CAACC,OAAO,CAAC,KAAK,KAAK,EAAE;IAC9BX,GAAG,CAACO,OAAO,CAACM,MAAM,GAAG,cAAc;EACrC;EAEAb,GAAG,CAACc,GAAG,GAAGd,GAAG,CAACe,WAAW;EACzBf,GAAG,CAACD,GAAG,CAACiB,IAAI,CAAC;IAAEhB,GAAG,EAAEA,GAAG;IAAEiB,EAAE,EAAEjB,GAAG,CAACiB;EAAG,CAAC,EAAE,4CAA4C,CAAC;EACpFjB,GAAG,CAACe,WAAW,GAAGf,GAAG,CAACc,GAAG;EAEzB,IAAIL,eAAC,CAACC,KAAK,CAACJ,KAAK,CAAC,KAAK,KAAK,EAAE;IAC5BN,GAAG,CAACO,OAAO,CAACC,aAAa,GAAGF,KAAK;EACnC;EAEA,IAAIG,eAAC,CAACC,KAAK,CAACC,OAAO,CAAC,KAAK,KAAK,EAAE;IAC9BX,GAAG,CAACO,OAAO,CAACM,MAAM,GAAGF,OAAO;EAC9B;EAEA,IAAIO,OAAO,GAAG,CAAC;EACflB,GAAG,CAACmB,EAAE,CAAC,MAAM,EAAE,UAAUC,KAAK,EAAQ;IACpCF,OAAO,IAAIE,KAAK,CAACC,MAAM;EACzB,CAAC,CAAC;EAEF,IAAIC,QAAQ,GAAG,CAAC;EAChB,MAAMC,MAAM,GAAGtB,GAAG,CAACuB,KAAK;EACxB;EACA;EACAvB,GAAG,CAACuB,KAAK,GAAG,UAAUC,GAAG,EAAW;IAClCH,QAAQ,IAAIG,GAAG,CAACJ,MAAM;IACtB;IACA;IACAE,MAAM,CAACG,KAAK,CAACzB,GAAG,EAAE0B,SAAS,CAAC;EAC9B,CAAC;EAED,MAAM5B,GAAG,GAAG,YAAkB;IAAA;IAC5B,MAAM6B,YAAY,GAAG5B,GAAG,CAACY,GAAG,CAAC,iBAAiB,CAAC;IAC/C,MAAMiB,aAAa,GAAG7B,GAAG,CAAC8B,UAAU,CAACD,aAAa;IAClD,MAAME,QAAQ,GAAGH,YAAY,GAAI,GAAEA,YAAa,QAAOC,aAAc,EAAC,GAAGA,aAAa;IACtF,IAAIG,OAAO;IACX,IAAI/B,GAAG,CAACgC,MAAM,CAACC,gBAAgB,EAAE;MAC/BF,OAAO,GAAGnC,mBAAmB;IAC/B,CAAC,MAAM;MACLmC,OAAO,GAAGlC,mBAAmB;IAC/B;IAEAE,GAAG,CAACc,GAAG,GAAGd,GAAG,CAACe,WAAW;IACzBf,GAAG,CAACD,GAAG,CAACoC,IAAI,CACV;MACEC,OAAO,EAAE;QACPC,MAAM,EAAErC,GAAG,CAACqC,MAAM;QAClBvB,GAAG,EAAEd,GAAG,CAACc;MACX,CAAC;MACDwB,IAAI,EAAE,qBAAAtC,GAAG,CAACuC,WAAW,qDAAf,iBAAiBC,IAAI,KAAI,IAAI;MACnCT,QAAQ;MACRU,MAAM,EAAExC,GAAG,CAACyC,UAAU;MACtBC,KAAK,EAAE1C,GAAG,CAACgC,MAAM,CAACC,gBAAgB;MAClCU,KAAK,EAAE;QACLC,EAAE,EAAE3B,OAAO;QACX4B,GAAG,EAAExB;MACP;IACF,CAAC,EACDU,OAAO,CACR;IACDhC,GAAG,CAACe,WAAW,GAAGf,GAAG,CAACc,GAAG;EAC3B,CAAC;EAEDd,GAAG,CAACmB,EAAE,CAAC,OAAO,EAAE,YAAkB;IAChCpB,GAAG,EAAE;EACP,CAAC,CAAC;EAEF,MAAMgD,IAAI,GAAG9C,GAAG,CAAC+C,GAAG;EACpB;EACA/C,GAAG,CAAC+C,GAAG,GAAG,UAAUvB,GAAG,EAAQ;IAC7B,IAAIA,GAAG,EAAE;MACPH,QAAQ,IAAIG,GAAG,CAACJ,MAAM;IACxB;IACA;IACA;IACA0B,IAAI,CAACrB,KAAK,CAACzB,GAAG,EAAE0B,SAAS,CAAC;IAC1B5B,GAAG,EAAE;EACP,CAAC;EACDG,IAAI,EAAE;AACR"}

package/build/middlewares/match.d.ts

@@ -0,0 +1 @@
+export declare function match(regexp: RegExp): any;

package/build/middlewares/match.js

@@ -0,0 +1,16 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.match = match;
+function match(regexp) {
+  return function (req, res, next, value) {
+    if (regexp.exec(value)) {
+      next();
+    } else {
+      next('route');
+    }
+  };
+}
+//# sourceMappingURL=match.js.map

package/build/middlewares/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","names":["match","regexp","req","res","next","value","exec"],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";;;;;;AAEO,SAASA,KAAK,CAACC,MAAc,EAAO;EACzC,OAAO,UACLC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACP;IACN,IAAIJ,MAAM,CAACK,IAAI,CAACD,KAAK,CAAC,EAAE;MACtBD,IAAI,EAAE;IACR,CAAC,MAAM;MACLA,IAAI,CAAC,OAAO,CAAC;IACf;EACF,CAAC;AACH"}

package/build/middlewares/media.d.ts

@@ -0,0 +1 @@
+export declare function media(expect: string | null): any;

package/build/middlewares/media.js

@@ -0,0 +1,17 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.media = media;
+var _core = require("@verdaccio/core");
+function media(expect) {
+  return function (req, res, next) {
+    if (req.headers[_core.HEADER_TYPE.CONTENT_TYPE] !== expect) {
+      next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.get[_core.HEADER_TYPE.CONTENT_TYPE]));
+    } else {
+      next();
+    }
+  };
+}
+//# sourceMappingURL=media.js.map

package/build/middlewares/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","names":["media","expect","req","res","next","headers","HEADER_TYPE","CONTENT_TYPE","errorUtils","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","get"],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;;;;;AAAA;AAIO,SAASA,KAAK,CAACC,MAAqB,EAAO;EAChD,OAAO,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACxF,IAAIF,GAAG,CAACG,OAAO,CAACC,iBAAW,CAACC,YAAY,CAAC,KAAKN,MAAM,EAAE;MACpDG,IAAI,CACFI,gBAAU,CAACC,OAAO,CAChBC,iBAAW,CAACC,iBAAiB,EAC7B,8BAA8B,GAAGV,MAAM,GAAG,SAAS,GAAGC,GAAG,CAACU,GAAG,CAACN,iBAAW,CAACC,YAAY,CAAC,CACxF,CACF;IACH,CAAC,MAAM;MACLH,IAAI,EAAE;IACR;EACF,CAAC;AACH"}

package/build/middlewares/security-headers.d.ts

@@ -0,0 +1,2 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+export declare function setSecurityWebHeaders(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/security-headers.js

@@ -0,0 +1,21 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.setSecurityWebHeaders = setSecurityWebHeaders;
+var _core = require("@verdaccio/core");
+// TODO: remove, was relocated to web package
+// @ts-deprecated
+function setSecurityWebHeaders(req, res, next) {
+  // disable loading in frames (clickjacking, etc.)
+  res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
+  // avoid stablish connections outside of domain
+  res.header(_core.HEADERS.CSP, "connect-src 'self'");
+  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
+  res.header(_core.HEADERS.CTO, 'nosniff');
+  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
+  res.header(_core.HEADERS.XSS, '1; mode=block');
+  next();
+}
+//# sourceMappingURL=security-headers.js.map

package/build/middlewares/security-headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-headers.js","names":["setSecurityWebHeaders","req","res","next","header","HEADERS","FRAMES_OPTIONS","CSP","CTO","XSS"],"sources":["../../src/middlewares/security-headers.ts"],"sourcesContent":["import { HEADERS } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n// TODO: remove, was relocated to web package\n// @ts-deprecated\nexport function setSecurityWebHeaders(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  // disable loading in frames (clickjacking, etc.)\n  res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n  // avoid stablish connections outside of domain\n  res.header(HEADERS.CSP, \"connect-src 'self'\");\n  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff\n  res.header(HEADERS.CTO, 'nosniff');\n  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection\n  res.header(HEADERS.XSS, '1; mode=block');\n  next();\n}\n"],"mappings":";;;;;;AAAA;AAIA;AACA;AACO,SAASA,qBAAqB,CACnCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN;EACAD,GAAG,CAACE,MAAM,CAACC,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC1C;EACAJ,GAAG,CAACE,MAAM,CAACC,aAAO,CAACE,GAAG,EAAE,oBAAoB,CAAC;EAC7C;EACAL,GAAG,CAACE,MAAM,CAACC,aAAO,CAACG,GAAG,EAAE,SAAS,CAAC;EAClC;EACAN,GAAG,CAACE,MAAM,CAACC,aAAO,CAACI,GAAG,EAAE,eAAe,CAAC;EACxCN,IAAI,EAAE;AACR"}

package/build/middlewares/validation.d.ts

@@ -0,0 +1,3 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+export declare function validateName(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer, value: string, name: string): void;
+export declare function validatePackage(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer, value: string, name: string): void;

package/build/middlewares/validation.js

@@ -0,0 +1,30 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.validateName = validateName;
+exports.validatePackage = validatePackage;
+var _core = require("@verdaccio/core");
+var _utils = require("@verdaccio/utils");
+function validateName(req, res, next, value, name) {
+  if (value === '-') {
+    // special case in couchdb usually
+    next('route');
+  } else if ((0, _utils.validateName)(value)) {
+    next();
+  } else {
+    next(_core.errorUtils.getForbidden('invalid ' + name));
+  }
+}
+function validatePackage(req, res, next, value, name) {
+  if (value === '-') {
+    // special case in couchdb usually
+    next('route');
+  } else if ((0, _utils.validatePackage)(value)) {
+    next();
+  } else {
+    next(_core.errorUtils.getForbidden('invalid ' + name));
+  }
+}
+//# sourceMappingURL=validation.js.map

package/build/middlewares/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","names":["validateName","req","res","next","value","name","utilValidateName","errorUtils","getForbidden","validatePackage","utilValidatePackage"],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import { errorUtils } from '@verdaccio/core';\nimport {\n  validateName as utilValidateName,\n  validatePackage as utilValidatePackage,\n} from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function validateName(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer,\n  value: string,\n  name: string\n): void {\n  if (value === '-') {\n    // special case in couchdb usually\n    next('route');\n  } else if (utilValidateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getForbidden('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer,\n  value: string,\n  name: string\n): void {\n  if (value === '-') {\n    // special case in couchdb usually\n    next('route');\n  } else if (utilValidatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getForbidden('invalid ' + name));\n  }\n}\n"],"mappings":";;;;;;;AAAA;AACA;AAOO,SAASA,YAAY,CAC1BC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACbC,IAAY,EACN;EACN,IAAID,KAAK,KAAK,GAAG,EAAE;IACjB;IACAD,IAAI,CAAC,OAAO,CAAC;EACf,CAAC,MAAM,IAAI,IAAAG,mBAAgB,EAACF,KAAK,CAAC,EAAE;IAClCD,IAAI,EAAE;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,YAAY,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EAClD;AACF;AAEO,SAASI,eAAe,CAC7BR,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACbC,IAAY,EACN;EACN,IAAID,KAAK,KAAK,GAAG,EAAE;IACjB;IACAD,IAAI,CAAC,OAAO,CAAC;EACf,CAAC,MAAM,IAAI,IAAAO,sBAAmB,EAACN,KAAK,CAAC,EAAE;IACrCD,IAAI,EAAE;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,YAAY,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EAClD;AACF"}

package/build/types.d.ts

@@ -0,0 +1,13 @@
+import { NextFunction, Request, Response } from 'express';
+import { Logger, RemoteUser } from '@verdaccio/types';
+export type $RequestExtend = Request & {
+    remote_user?: RemoteUser;
+    log: Logger;
+};
+export type $ResponseExtend = Response & {
+    cookies?: any;
+};
+export type $NextFunctionVer = NextFunction & any;
+export interface MiddlewareError {
+    error: string;
+}

package/build/types.js

@@ -0,0 +1,6 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["import { NextFunction, Request, Response } from 'express';\n\nimport { Logger, RemoteUser } from '@verdaccio/types';\n\nexport type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };\nexport type $ResponseExtend = Response & { cookies?: any };\nexport type $NextFunctionVer = NextFunction & any;\n\nexport interface MiddlewareError {\n  error: string;\n}\n"],"mappings":""}

package/jest.config.js

@@ -1,3 +1,12 @@
 const config = require('../../jest/config');
 
-module.exports = Object.assign({}, config, {});
+module.exports = Object.assign({}, config, {
+  coverageThreshold: {
+    global: {
+      lines: 67,
+      functions: 80,
+      branches: 56,
+      statements: 67,
+    },
+  },
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "6.0.0-6-next.34",
+  "version": "6.0.0-6-next.35",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -30,24 +30,28 @@
     "npm": ">=6"
   },
   "dependencies": {
+    "@verdaccio/core": "6.0.0-6-next.56",
+    "@verdaccio/logger": "6.0.0-6-next.24",
+    "@verdaccio/utils": "6.0.0-6-next.24",
     "debug": "4.3.4",
-    "body-parser": "1.20.1",
-    "@verdaccio/auth": "6.0.0-6-next.34",
-    "@verdaccio/core": "6.0.0-6-next.55",
-    "@verdaccio/logger": "6.0.0-6-next.23",
-    "@verdaccio/utils": "6.0.0-6-next.23",
-    "lodash": "4.17.21"
+    "lodash": "4.17.21",
+    "mime": "2.6.0"
   },
   "funding": {
     "type": "opencollective",
     "url": "https://opencollective.com/verdaccio"
   },
+  "devDependencies": {
+    "body-parser": "1.20.1",
+    "supertest": "6.3.3"
+  },
   "scripts": {
     "clean": "rimraf ./build",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
     "watch": "pnpm build:js -- --watch",
+    "test": "jest",
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "readme": "# @verdaccio/middleware\n\n[![backers](https://opencollective.com/verdaccio/tiers/backer/badge.svg?label=Backer&color=brightgreen)](https://opencollective.com/verdaccio)\n[![stackshare](https://img.shields.io/badge/Follow%20on-StackShare-blue.svg?logo=stackshare&style=flat)](https://stackshare.io/verdaccio)\n[![MIT](https://img.shields.io/github/license/mashape/apistatus.svg)](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)\n[![Crowdin](https://d322cqt584bo4o.cloudfront.net/verdaccio/localized.svg)](https://crowdin.com/project/verdaccio)\n[![TODOs](https://badgen.net/https/api.tickgit.com/badgen/github.com/verdaccio/verdaccio)](https://www.tickgit.com/browse?repo=github.com/verdaccio/verdaccio)\n\n[![Twitter followers](https://img.shields.io/twitter/follow/verdaccio_npm.svg?style=social&label=Follow)](https://twitter.com/verdaccio_npm)\n[![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)\n\n## Donations\n\nVerdaccio is run by **volunteers**; nobody is working full-time on it. If you find this project to be useful and would like to support its development, consider making a donation - **your logo might end up in this readme.** 😉\n\n**[Donate](https://opencollective.com/verdaccio)** 💵👍🏻 starting from _\\$1/month_ or just one single contribution.\n\n## Report a vulnerability\n\nIf you want to report a security vulnerability, please follow the steps which we have defined for you in our [security policy](https://github.com/verdaccio/verdaccio/security/policy).\n\n## Open Collective Sponsors\n\nSupport this project by becoming a sponsor. Your logo will show up here with a link to your website. [[Become a sponsor](https://opencollective.com/verdaccio#sponsor)]\n\n[![sponsor](https://opencollective.com/verdaccio/sponsor/0/avatar.svg)](https://opencollective.com/verdaccio/sponsor/0/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/1/avatar.svg)](https://opencollective.com/verdaccio/sponsor/1/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/2/avatar.svg)](https://opencollective.com/verdaccio/sponsor/2/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/3/avatar.svg)](https://opencollective.com/verdaccio/sponsor/3/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/4/avatar.svg)](https://opencollective.com/verdaccio/sponsor/4/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/5/avatar.svg)](https://opencollective.com/verdaccio/sponsor/5/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/6/avatar.svg)](https://opencollective.com/verdaccio/sponsor/6/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/7/avatar.svg)](https://opencollective.com/verdaccio/sponsor/7/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/8/avatar.svg)](https://opencollective.com/verdaccio/sponsor/8/website)\n[![sponsor](https://opencollective.com/verdaccio/sponsor/9/avatar.svg)](https://opencollective.com/verdaccio/sponsor/9/website)\n\n## Open Collective Backers\n\nThank you to all our backers! 🙏 [[Become a backer](https://opencollective.com/verdaccio#backer)]\n\n[![backers](https://opencollective.com/verdaccio/backers.svg?width=890)](https://opencollective.com/verdaccio#backers)\n\n## Special Thanks\n\nThanks to the following companies to help us to achieve our goals providing free open source licenses.\n\n[![jetbrain](assets/thanks/jetbrains/logo.png)](https://www.jetbrains.com/)\n[![crowdin](assets/thanks/crowdin/logo.png)](https://crowdin.com/)\n[![balsamiq](assets/thanks/balsamiq/logo.jpg)](https://balsamiq.com/)\n\n## Contributors\n\nThis project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].\n\n[![contributors](https://opencollective.com/verdaccio/contributors.svg?width=890&button=true)](../../graphs/contributors)\n\n### FAQ / Contact / Troubleshoot\n\nIf you have any issue you can try the following options, do no desist to ask or check our issues database, perhaps someone has asked already what you are looking for.\n\n- [Blog](https://verdaccio.org/blog/)\n- [Donations](https://opencollective.com/verdaccio)\n- [Reporting an issue](https://github.com/verdaccio/verdaccio/blob/master/CONTRIBUTING.md#reporting-a-bug)\n- [Running discussions](https://github.com/verdaccio/verdaccio/issues?q=is%3Aissue+is%3Aopen+label%3Adiscuss)\n- [Chat](http://chat.verdaccio.org/)\n- [Logos](https://verdaccio.org/docs/en/logo)\n- [Docker Examples](https://github.com/verdaccio/docker-examples)\n- [FAQ](https://github.com/verdaccio/verdaccio/issues?utf8=%E2%9C%93&q=is%3Aissue%20label%3Aquestion%20)\n\n### License\n\nVerdaccio is [MIT licensed](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)\n\nThe Verdaccio documentation and logos (excluding /thanks, e.g., .md, .png, .sketch) files within the /assets folder) is\n[Creative Commons licensed](https://github.com/verdaccio/verdaccio/blob/master/LICENSE-docs).\n"

package/src/index.ts

@@ -1 +1,17 @@
-export * from './middleware';
+export { match } from './middlewares/match';
+export { setSecurityWebHeaders } from './middlewares/security-headers';
+export { validateName, validatePackage } from './middlewares/validation';
+export { media } from './middlewares/media';
+export { encodeScopePackage } from './middlewares/encode-pkg';
+export { expectJson } from './middlewares/json';
+export { antiLoop } from './middlewares/antiLoop';
+export { final } from './middlewares/final';
+export { allow } from './middlewares/allow';
+export { errorReportingMiddleware, handleError } from './middlewares/error';
+export {
+  log,
+  LOG_STATUS_MESSAGE,
+  LOG_VERDACCIO_BYTES,
+  LOG_VERDACCIO_ERROR,
+} from './middlewares/log';
+export * from './types';

package/src/middlewares/allow.ts

@@ -0,0 +1,40 @@
+import { API_ERROR, errorUtils } from '@verdaccio/core';
+import { logger } from '@verdaccio/logger';
+import { getVersionFromTarball } from '@verdaccio/utils';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+export function allow<T>(auth: T): Function {
+  return function (action: string): Function {
+    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
+      req.pause();
+      const packageName = req.params.scope
+        ? `@${req.params.scope}/${req.params.package}`
+        : req.params.package;
+      const packageVersion = req.params.filename
+        ? getVersionFromTarball(req.params.filename)
+        : undefined;
+      const remote = req.remote_user;
+      logger.trace(
+        { action, user: remote?.name },
+        `[middleware/allow][@{action}] allow for @{user}`
+      );
+      auth['allow_' + action](
+        { packageName, packageVersion },
+        remote,
+        function (error, allowed): void {
+          req.resume();
+          if (error) {
+            next(error);
+          } else if (allowed) {
+            next();
+          } else {
+            // last plugin (that's our built-in one) returns either
+            // cb(err) or cb(null, true), so this should never happen
+            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);
+          }
+        }
+      );
+    };
+  };
+}

package/src/middlewares/antiLoop.ts

@@ -0,0 +1,30 @@
+import { HTTP_STATUS, errorUtils } from '@verdaccio/core';
+import { Config } from '@verdaccio/types';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+/**
+ * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
+ * @param config
+ * @returns
+ */
+export function antiLoop(config: Config): Function {
+  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
+    if (req?.headers?.via != null) {
+      const arr = req.get('via')?.split(',');
+      if (Array.isArray(arr)) {
+        for (let i = 0; i < arr.length; i++) {
+          // the "via" header must contains an specific headers, this has to be on sync
+          // with the proxy request
+          // match eg: Server 1 or Server 2
+          // TODO: improve this RegEX
+          const m = arr[i].trim().match(/\s*(\S+)\s+(\S+)/);
+          if (m && m[2] === config.server_id) {
+            return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
+          }
+        }
+      }
+    }
+    next();
+  };
+}

package/src/middlewares/encode-pkg.ts

@@ -0,0 +1,19 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+/**
+ * Encode / in a scoped package name to be matched as a single parameter in routes
+ * @param req
+ * @param res
+ * @param next
+ */
+export function encodeScopePackage(
+  req: $RequestExtend,
+  res: $ResponseExtend,
+  next: $NextFunctionVer
+): void {
+  if (req.url.indexOf('@') !== -1) {
+    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
+    req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
+  }
+  next();
+}

package/src/middlewares/error.ts

@@ -0,0 +1,78 @@
+import buildDebug from 'debug';
+import { HttpError } from 'http-errors';
+import _ from 'lodash';
+
+import { API_ERROR, HTTP_STATUS, VerdaccioError } from '@verdaccio/core';
+import { logger } from '@verdaccio/logger';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+const debug = buildDebug('verdaccio:middleware:error');
+
+export function handleError(
+  err: HttpError,
+  req: $RequestExtend,
+  res: $ResponseExtend,
+  next: $NextFunctionVer
+) {
+  debug('error handler init');
+  if (_.isError(err)) {
+    debug('is native error');
+    if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {
+      return next();
+    }
+    if (_.isFunction(res.locals.report_error) === false) {
+      debug('is locals error report ref');
+      // in case of very early error this middleware may not be loaded before error is generated
+      // fixing that
+      errorReportingMiddleware(req, res, _.noop);
+    }
+    debug('set locals error report ref');
+    res.locals.report_error(err);
+  } else {
+    // Fall to Middleware.final
+    debug('no error to report, jump next layer');
+    return next(err);
+  }
+}
+
+// Middleware
+export function errorReportingMiddleware(
+  req: $RequestExtend,
+  res: $ResponseExtend,
+  next: $NextFunctionVer
+): void {
+  debug('error report middleware');
+  res.locals.report_error =
+    res.locals.report_error ||
+    function (err: VerdaccioError): void {
+      if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {
+        debug('is error > 409 %o', err?.status);
+        if (_.isNil(res.headersSent) === false) {
+          debug('send status %o', err?.status);
+          res.status(err.status);
+          debug('next layer %o', err?.message);
+          next({ error: err.message || API_ERROR.UNKNOWN_ERROR });
+        }
+      } else {
+        debug('is error < 409 %o', err?.status);
+        logger.error({ err: err }, 'unexpected error: @{!err.message}\n@{err.stack}');
+        if (!res.status || !res.send) {
+          // TODO: decide which debug keep
+          logger.error('this is an error in express.js, please report this');
+          debug('this is an error in express.js, please report this, destroy response %o', err);
+          res.destroy();
+        } else if (!res.headersSent) {
+          debug('report internal error %o', err);
+          res.status(HTTP_STATUS.INTERNAL_ERROR);
+          next({ error: API_ERROR.INTERNAL_SERVER_ERROR });
+        } else {
+          // socket should be already closed
+          debug('this should not happen, otherwise report %o', err);
+        }
+      }
+    };
+
+  debug('error report middleware next()');
+  next();
+}

package/src/middlewares/final.ts

@@ -0,0 +1,60 @@
+import _ from 'lodash';
+
+import { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
+import { Manifest } from '@verdaccio/types';
+import { stringToMD5 } from '@verdaccio/utils';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';
+
+export type FinalBody = Manifest | MiddlewareError | string;
+
+export function final(
+  body: FinalBody,
+  req: $RequestExtend,
+  res: $ResponseExtend,
+  // if we remove `next` breaks test
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  next: $NextFunctionVer
+): void {
+  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {
+    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);
+  }
+
+  try {
+    if (_.isString(body) || _.isObject(body)) {
+      if (!res.get(HEADERS.CONTENT_TYPE)) {
+        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);
+      }
+
+      if (typeof body === 'object' && _.isNil(body) === false) {
+        if (typeof (body as MiddlewareError).error === 'string') {
+          res.locals._verdaccio_error = (body as MiddlewareError).error;
+        }
+        body = JSON.stringify(body, undefined, '  ') + '\n';
+      }
+
+      // don't send etags with errors
+      if (
+        !res.statusCode ||
+        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)
+      ) {
+        res.header(HEADERS.ETAG, '"' + stringToMD5(body as string) + '"');
+      }
+    } else {
+      // send(null), send(204), etc.
+    }
+  } catch (err: any) {
+    // if verdaccio sends headers first, and then calls res.send()
+    // as an error handler, we can't report error properly,
+    // and should just close socket
+    if (err.message.match(/set headers after they are sent/)) {
+      if (_.isNil(res.socket) === false) {
+        res.socket?.destroy();
+      }
+      return;
+    }
+    throw err;
+  }
+
+  res.send(body);
+}

package/src/middlewares/json.ts

@@ -0,0 +1,15 @@
+import { errorUtils } from '@verdaccio/core';
+import { isObject } from '@verdaccio/utils';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+export function expectJson(
+  req: $RequestExtend,
+  res: $ResponseExtend,
+  next: $NextFunctionVer
+): void {
+  if (!isObject(req.body)) {
+    return next(errorUtils.getBadRequest("can't parse incoming json"));
+  }
+  next();
+}

package/src/middlewares/log.ts

@@ -0,0 +1,103 @@
+import _ from 'lodash';
+
+import { logger } from '@verdaccio/logger';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+// FIXME: deprecated, moved to @verdaccio/dev-commons
+export const LOG_STATUS_MESSAGE =
+  "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
+export const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;
+export const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;
+
+export function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
+  // logger
+  req.log = logger.child({ sub: 'in' });
+
+  const _auth = req.headers.authorization;
+  if (_.isNil(_auth) === false) {
+    req.headers.authorization = '<Classified>';
+  }
+
+  const _cookie = req.get('cookie');
+  if (_.isNil(_cookie) === false) {
+    req.headers.cookie = '<Classified>';
+  }
+
+  req.url = req.originalUrl;
+  req.log.info({ req: req, ip: req.ip }, "@{ip} requested '@{req.method} @{req.url}'");
+  req.originalUrl = req.url;
+
+  if (_.isNil(_auth) === false) {
+    req.headers.authorization = _auth;
+  }
+
+  if (_.isNil(_cookie) === false) {
+    req.headers.cookie = _cookie;
+  }
+
+  let bytesin = 0;
+  req.on('data', function (chunk): void {
+    bytesin += chunk.length;
+  });
+
+  let bytesout = 0;
+  const _write = res.write;
+  // FIXME: res.write should return boolean
+  // @ts-ignore
+  res.write = function (buf): boolean {
+    bytesout += buf.length;
+    /* eslint prefer-rest-params: "off" */
+    // @ts-ignore
+    _write.apply(res, arguments);
+  };
+
+  const log = function (): void {
+    const forwardedFor = req.get('x-forwarded-for');
+    const remoteAddress = req.connection.remoteAddress;
+    const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
+    let message;
+    if (res.locals._verdaccio_error) {
+      message = LOG_VERDACCIO_ERROR;
+    } else {
+      message = LOG_VERDACCIO_BYTES;
+    }
+
+    req.url = req.originalUrl;
+    req.log.http(
+      {
+        request: {
+          method: req.method,
+          url: req.url,
+        },
+        user: req.remote_user?.name || null,
+        remoteIP,
+        status: res.statusCode,
+        error: res.locals._verdaccio_error,
+        bytes: {
+          in: bytesin,
+          out: bytesout,
+        },
+      },
+      message
+    );
+    req.originalUrl = req.url;
+  };
+
+  req.on('close', function (): void {
+    log();
+  });
+
+  const _end = res.end;
+  // @ts-ignore
+  res.end = function (buf): void {
+    if (buf) {
+      bytesout += buf.length;
+    }
+    /* eslint prefer-rest-params: "off" */
+    // @ts-ignore
+    _end.apply(res, arguments);
+    log();
+  };
+  next();
+}

package/src/middlewares/match.ts

@@ -0,0 +1,16 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+export function match(regexp: RegExp): any {
+  return function (
+    req: $RequestExtend,
+    res: $ResponseExtend,
+    next: $NextFunctionVer,
+    value: string
+  ): void {
+    if (regexp.exec(value)) {
+      next();
+    } else {
+      next('route');
+    }
+  };
+}

package/src/middlewares/media.ts

@@ -0,0 +1,18 @@
+import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+export function media(expect: string | null): any {
+  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
+    if (req.headers[HEADER_TYPE.CONTENT_TYPE] !== expect) {
+      next(
+        errorUtils.getCode(
+          HTTP_STATUS.UNSUPPORTED_MEDIA,
+          'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]
+        )
+      );
+    } else {
+      next();
+    }
+  };
+}