@verdaccio/middleware 6.0.0-6-next.34 → 6.0.0-6-next.36

package/.babelrc

@@ -1,3 +1,14 @@
 {
-  "extends": "../../.babelrc"
+  "extends": "../../.babelrc",
+  "presets": [
+    [
+      "@babel/env",
+      {
+        "targets": {
+          "node": 12
+        }
+      }
+    ],
+    "@babel/typescript"
+  ]
 }

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @verdaccio/middleware
 
+## 6.0.0-6-next.36
+
+### Patch Changes
+
+- 9943e2b1: fix: extract logger from middleware
+  - @verdaccio/core@6.0.0-6-next.57
+  - @verdaccio/utils@6.0.0-6-next.25
+
+## 6.0.0-6-next.35
+
+### Minor Changes
+
+- a1986e09: feat: expose middleware utils
+
+### Patch Changes
+
+- Updated dependencies [a1986e09]
+  - @verdaccio/utils@6.0.0-6-next.24
+  - @verdaccio/core@6.0.0-6-next.56
+  - @verdaccio/logger@6.0.0-6-next.24
+
 ## 6.0.0-6-next.34
 
 ### Patch Changes

package/build/index.d.ts

@@ -1 +1,12 @@
-export * from './middleware';
+export { match } from './middlewares/match';
+export { setSecurityWebHeaders } from './middlewares/security-headers';
+export { validateName, validatePackage } from './middlewares/validation';
+export { media } from './middlewares/media';
+export { encodeScopePackage } from './middlewares/encode-pkg';
+export { expectJson } from './middlewares/json';
+export { antiLoop } from './middlewares/antiLoop';
+export { final } from './middlewares/final';
+export { allow } from './middlewares/allow';
+export { errorReportingMiddleware, handleError } from './middlewares/error';
+export { log, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, } from './middlewares/log';
+export * from './types';

package/build/index.js

@@ -3,14 +3,140 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-var _middleware = require("./middleware");
-Object.keys(_middleware).forEach(function (key) {
+var _exportNames = {
+  match: true,
+  setSecurityWebHeaders: true,
+  validateName: true,
+  validatePackage: true,
+  media: true,
+  encodeScopePackage: true,
+  expectJson: true,
+  antiLoop: true,
+  final: true,
+  allow: true,
+  errorReportingMiddleware: true,
+  handleError: true,
+  log: true,
+  LOG_STATUS_MESSAGE: true,
+  LOG_VERDACCIO_BYTES: true,
+  LOG_VERDACCIO_ERROR: true
+};
+Object.defineProperty(exports, "LOG_STATUS_MESSAGE", {
+  enumerable: true,
+  get: function () {
+    return _log.LOG_STATUS_MESSAGE;
+  }
+});
+Object.defineProperty(exports, "LOG_VERDACCIO_BYTES", {
+  enumerable: true,
+  get: function () {
+    return _log.LOG_VERDACCIO_BYTES;
+  }
+});
+Object.defineProperty(exports, "LOG_VERDACCIO_ERROR", {
+  enumerable: true,
+  get: function () {
+    return _log.LOG_VERDACCIO_ERROR;
+  }
+});
+Object.defineProperty(exports, "allow", {
+  enumerable: true,
+  get: function () {
+    return _allow.allow;
+  }
+});
+Object.defineProperty(exports, "antiLoop", {
+  enumerable: true,
+  get: function () {
+    return _antiLoop.antiLoop;
+  }
+});
+Object.defineProperty(exports, "encodeScopePackage", {
+  enumerable: true,
+  get: function () {
+    return _encodePkg.encodeScopePackage;
+  }
+});
+Object.defineProperty(exports, "errorReportingMiddleware", {
+  enumerable: true,
+  get: function () {
+    return _error.errorReportingMiddleware;
+  }
+});
+Object.defineProperty(exports, "expectJson", {
+  enumerable: true,
+  get: function () {
+    return _json.expectJson;
+  }
+});
+Object.defineProperty(exports, "final", {
+  enumerable: true,
+  get: function () {
+    return _final.final;
+  }
+});
+Object.defineProperty(exports, "handleError", {
+  enumerable: true,
+  get: function () {
+    return _error.handleError;
+  }
+});
+Object.defineProperty(exports, "log", {
+  enumerable: true,
+  get: function () {
+    return _log.log;
+  }
+});
+Object.defineProperty(exports, "match", {
+  enumerable: true,
+  get: function () {
+    return _match.match;
+  }
+});
+Object.defineProperty(exports, "media", {
+  enumerable: true,
+  get: function () {
+    return _media.media;
+  }
+});
+Object.defineProperty(exports, "setSecurityWebHeaders", {
+  enumerable: true,
+  get: function () {
+    return _securityHeaders.setSecurityWebHeaders;
+  }
+});
+Object.defineProperty(exports, "validateName", {
+  enumerable: true,
+  get: function () {
+    return _validation.validateName;
+  }
+});
+Object.defineProperty(exports, "validatePackage", {
+  enumerable: true,
+  get: function () {
+    return _validation.validatePackage;
+  }
+});
+var _match = require("./middlewares/match");
+var _securityHeaders = require("./middlewares/security-headers");
+var _validation = require("./middlewares/validation");
+var _media = require("./middlewares/media");
+var _encodePkg = require("./middlewares/encode-pkg");
+var _json = require("./middlewares/json");
+var _antiLoop = require("./middlewares/antiLoop");
+var _final = require("./middlewares/final");
+var _allow = require("./middlewares/allow");
+var _error = require("./middlewares/error");
+var _log = require("./middlewares/log");
+var _types = require("./types");
+Object.keys(_types).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
-  if (key in exports && exports[key] === _middleware[key]) return;
+  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
+  if (key in exports && exports[key] === _types[key]) return;
   Object.defineProperty(exports, key, {
     enumerable: true,
     get: function () {
-      return _middleware[key];
+      return _types[key];
     }
   });
 });

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export * from './middleware';\n"],"mappings":";;;;;AAAA;AAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { setSecurityWebHeaders } from './middlewares/security-headers';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAMA;AAAA;EAAA;EAAA;EAAA;EAAA;IAAA;IAAA;MAAA;IAAA;EAAA;AAAA"}

package/build/middlewares/allow.d.ts

@@ -0,0 +1 @@
+export declare function allow<T>(auth: T): Function;

package/build/middlewares/allow.js

@@ -0,0 +1,39 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.allow = allow;
+var _core = require("@verdaccio/core");
+var _logger = require("@verdaccio/logger");
+var _utils = require("@verdaccio/utils");
+function allow(auth) {
+  return function (action) {
+    return function (req, res, next) {
+      req.pause();
+      const packageName = req.params.scope ? `@${req.params.scope}/${req.params.package}` : req.params.package;
+      const packageVersion = req.params.filename ? (0, _utils.getVersionFromTarball)(req.params.filename) : undefined;
+      const remote = req.remote_user;
+      _logger.logger.trace({
+        action,
+        user: remote === null || remote === void 0 ? void 0 : remote.name
+      }, `[middleware/allow][@{action}] allow for @{user}`);
+      auth['allow_' + action]({
+        packageName,
+        packageVersion
+      }, remote, function (error, allowed) {
+        req.resume();
+        if (error) {
+          next(error);
+        } else if (allowed) {
+          next();
+        } else {
+          // last plugin (that's our built-in one) returns either
+          // cb(err) or cb(null, true), so this should never happen
+          throw _core.errorUtils.getInternalError(_core.API_ERROR.PLUGIN_ERROR);
+        }
+      });
+    };
+  };
+}
+//# sourceMappingURL=allow.js.map

package/build/middlewares/allow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow.js","names":["allow","auth","action","req","res","next","pause","packageName","params","scope","package","packageVersion","filename","getVersionFromTarball","undefined","remote","remote_user","logger","trace","user","name","error","allowed","resume","errorUtils","getInternalError","API_ERROR","PLUGIN_ERROR"],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import { API_ERROR, errorUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { getVersionFromTarball } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function allow<T>(auth: T): Function {\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `@${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? getVersionFromTarball(req.params.filename)\n        : undefined;\n      const remote = req.remote_user;\n      logger.trace(\n        { action, user: remote?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            next(error);\n          } else if (allowed) {\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;;AAAA;AACA;AACA;AAIO,SAASA,KAAK,CAAIC,IAAO,EAAY;EAC1C,OAAO,UAAUC,MAAc,EAAY;IACzC,OAAO,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;MACxFF,GAAG,CAACG,KAAK,EAAE;MACX,MAAMC,WAAW,GAAGJ,GAAG,CAACK,MAAM,CAACC,KAAK,GAC/B,IAAGN,GAAG,CAACK,MAAM,CAACC,KAAM,IAAGN,GAAG,CAACK,MAAM,CAACE,OAAQ,EAAC,GAC5CP,GAAG,CAACK,MAAM,CAACE,OAAO;MACtB,MAAMC,cAAc,GAAGR,GAAG,CAACK,MAAM,CAACI,QAAQ,GACtC,IAAAC,4BAAqB,EAACV,GAAG,CAACK,MAAM,CAACI,QAAQ,CAAC,GAC1CE,SAAS;MACb,MAAMC,MAAM,GAAGZ,GAAG,CAACa,WAAW;MAC9BC,cAAM,CAACC,KAAK,CACV;QAAEhB,MAAM;QAAEiB,IAAI,EAAEJ,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEK;MAAK,CAAC,EAC7B,iDAAgD,CAClD;MACDnB,IAAI,CAAC,QAAQ,GAAGC,MAAM,CAAC,CACrB;QAAEK,WAAW;QAAEI;MAAe,CAAC,EAC/BI,MAAM,EACN,UAAUM,KAAK,EAAEC,OAAO,EAAQ;QAC9BnB,GAAG,CAACoB,MAAM,EAAE;QACZ,IAAIF,KAAK,EAAE;UACThB,IAAI,CAACgB,KAAK,CAAC;QACb,CAAC,MAAM,IAAIC,OAAO,EAAE;UAClBjB,IAAI,EAAE;QACR,CAAC,MAAM;UACL;UACA;UACA,MAAMmB,gBAAU,CAACC,gBAAgB,CAACC,eAAS,CAACC,YAAY,CAAC;QAC3D;MACF,CAAC,CACF;IACH,CAAC;EACH,CAAC;AACH"}

package/build/middlewares/antiLoop.d.ts

@@ -0,0 +1,7 @@
+import { Config } from '@verdaccio/types';
+/**
+ * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
+ * @param config
+ * @returns
+ */
+export declare function antiLoop(config: Config): Function;

package/build/middlewares/antiLoop.js

@@ -0,0 +1,35 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.antiLoop = antiLoop;
+var _core = require("@verdaccio/core");
+/**
+ * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
+ * @param config
+ * @returns
+ */
+function antiLoop(config) {
+  return function (req, res, next) {
+    var _req$headers;
+    if ((req === null || req === void 0 ? void 0 : (_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers.via) != null) {
+      var _req$get;
+      const arr = (_req$get = req.get('via')) === null || _req$get === void 0 ? void 0 : _req$get.split(',');
+      if (Array.isArray(arr)) {
+        for (let i = 0; i < arr.length; i++) {
+          // the "via" header must contains an specific headers, this has to be on sync
+          // with the proxy request
+          // match eg: Server 1 or Server 2
+          // TODO: improve this RegEX
+          const m = arr[i].trim().match(/\s*(\S+)\s+(\S+)/);
+          if (m && m[2] === config.server_id) {
+            return next(_core.errorUtils.getCode(_core.HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
+          }
+        }
+      }
+    }
+    next();
+  };
+}
+//# sourceMappingURL=antiLoop.js.map

package/build/middlewares/antiLoop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antiLoop.js","names":["antiLoop","config","req","res","next","headers","via","arr","get","split","Array","isArray","i","length","m","trim","match","server_id","errorUtils","getCode","HTTP_STATUS","LOOP_DETECTED"],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport { Config } from '@verdaccio/types';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config): Function {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contains an specific headers, this has to be on sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n          // TODO: improve this RegEX\n          const m = arr[i].trim().match(/\\s*(\\S+)\\s+(\\S+)/);\n          if (m && m[2] === config.server_id) {\n            return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA;AAKA;AACA;AACA;AACA;AACA;AACO,SAASA,QAAQ,CAACC,MAAc,EAAY;EACjD,OAAO,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IAAA;IACxF,IAAI,CAAAF,GAAG,aAAHA,GAAG,uCAAHA,GAAG,CAAEG,OAAO,iDAAZ,aAAcC,GAAG,KAAI,IAAI,EAAE;MAAA;MAC7B,MAAMC,GAAG,eAAGL,GAAG,CAACM,GAAG,CAAC,KAAK,CAAC,6CAAd,SAAgBC,KAAK,CAAC,GAAG,CAAC;MACtC,IAAIC,KAAK,CAACC,OAAO,CAACJ,GAAG,CAAC,EAAE;QACtB,KAAK,IAAIK,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGL,GAAG,CAACM,MAAM,EAAED,CAAC,EAAE,EAAE;UACnC;UACA;UACA;UACA;UACA,MAAME,CAAC,GAAGP,GAAG,CAACK,CAAC,CAAC,CAACG,IAAI,EAAE,CAACC,KAAK,CAAC,kBAAkB,CAAC;UACjD,IAAIF,CAAC,IAAIA,CAAC,CAAC,CAAC,CAAC,KAAKb,MAAM,CAACgB,SAAS,EAAE;YAClC,OAAOb,IAAI,CAACc,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,aAAa,EAAE,eAAe,CAAC,CAAC;UAC7E;QACF;MACF;IACF;IACAjB,IAAI,EAAE;EACR,CAAC;AACH"}

package/build/middlewares/encode-pkg.d.ts

@@ -0,0 +1,8 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+/**
+ * Encode / in a scoped package name to be matched as a single parameter in routes
+ * @param req
+ * @param res
+ * @param next
+ */
+export declare function encodeScopePackage(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/encode-pkg.js

@@ -0,0 +1,20 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.encodeScopePackage = encodeScopePackage;
+/**
+ * Encode / in a scoped package name to be matched as a single parameter in routes
+ * @param req
+ * @param res
+ * @param next
+ */
+function encodeScopePackage(req, res, next) {
+  if (req.url.indexOf('@') !== -1) {
+    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
+    req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
+  }
+  next();
+}
+//# sourceMappingURL=encode-pkg.js.map

package/build/middlewares/encode-pkg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode-pkg.js","names":["encodeScopePackage","req","res","next","url","indexOf","replace"],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (req.url.indexOf('@') !== -1) {\n    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n    req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n  }\n  next();\n}\n"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,kBAAkB,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAIF,GAAG,CAACG,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;IAC/B;IACAJ,GAAG,CAACG,GAAG,GAAGH,GAAG,CAACG,GAAG,CAACE,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAC5D;EACAH,IAAI,EAAE;AACR"}

package/build/middlewares/error.d.ts

@@ -0,0 +1,4 @@
+import { HttpError } from 'http-errors';
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+export declare const handleError: (logger: any) => (err: HttpError, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => any;
+export declare const errorReportingMiddleware: (logger: any) => (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;

package/build/middlewares/error.js

@@ -0,0 +1,75 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.handleError = exports.errorReportingMiddleware = void 0;
+var _debug = _interopRequireDefault(require("debug"));
+var _lodash = _interopRequireDefault(require("lodash"));
+var _core = require("@verdaccio/core");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+const debug = (0, _debug.default)('verdaccio:middleware:error');
+const handleError = logger => function handleError(err, req, res, next) {
+  debug('error handler init');
+  if (_lodash.default.isError(err)) {
+    debug('is native error');
+    if (err.code === 'ECONNABORT' && res.statusCode === _core.HTTP_STATUS.NOT_MODIFIED) {
+      return next();
+    }
+    if (_lodash.default.isFunction(res.locals.report_error) === false) {
+      debug('is locals error report ref');
+      // in case of very early error this middleware may not be loaded before error is generated
+      // fixing that
+      errorReportingMiddleware(logger)(req, res, _lodash.default.noop);
+    }
+    debug('set locals error report ref');
+    res.locals.report_error(err);
+  } else {
+    // Fall to Middleware.final
+    debug('no error to report, jump next layer');
+    return next(err);
+  }
+};
+
+// Middleware
+exports.handleError = handleError;
+const errorReportingMiddleware = logger => function errorReportingMiddleware(req, res, next) {
+  debug('error report middleware');
+  res.locals.report_error = res.locals.report_error || function (err) {
+    if (err.status && err.status >= _core.HTTP_STATUS.BAD_REQUEST && err.status < 600) {
+      debug('is error > 409 %o', err === null || err === void 0 ? void 0 : err.status);
+      if (_lodash.default.isNil(res.headersSent) === false) {
+        debug('send status %o', err === null || err === void 0 ? void 0 : err.status);
+        res.status(err.status);
+        debug('next layer %o', err === null || err === void 0 ? void 0 : err.message);
+        next({
+          error: err.message || _core.API_ERROR.UNKNOWN_ERROR
+        });
+      }
+    } else {
+      debug('is error < 409 %o', err === null || err === void 0 ? void 0 : err.status);
+      logger.error({
+        err: err
+      }, 'unexpected error: @{!err.message}\n@{err.stack}');
+      if (!res.status || !res.send) {
+        // TODO: decide which debug keep
+        logger.error('this is an error in express.js, please report this');
+        debug('this is an error in express.js, please report this, destroy response %o', err);
+        res.destroy();
+      } else if (!res.headersSent) {
+        debug('report internal error %o', err);
+        res.status(_core.HTTP_STATUS.INTERNAL_ERROR);
+        next({
+          error: _core.API_ERROR.INTERNAL_SERVER_ERROR
+        });
+      } else {
+        // socket should be already closed
+        debug('this should not happen, otherwise report %o', err);
+      }
+    }
+  };
+  debug('error report middleware next()');
+  next();
+};
+exports.errorReportingMiddleware = errorReportingMiddleware;
+//# sourceMappingURL=error.js.map

package/build/middlewares/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","names":["debug","buildDebug","handleError","logger","err","req","res","next","_","isError","code","statusCode","HTTP_STATUS","NOT_MODIFIED","isFunction","locals","report_error","errorReportingMiddleware","noop","status","BAD_REQUEST","isNil","headersSent","message","error","API_ERROR","UNKNOWN_ERROR","send","destroy","INTERNAL_ERROR","INTERNAL_SERVER_ERROR"],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { HttpError } from 'http-errors';\nimport _ from 'lodash';\n\nimport { API_ERROR, HTTP_STATUS, VerdaccioError } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (_.isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (_.isFunction(res.locals.report_error) === false) {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, _.noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (_.isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('report internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware next()');\n    next();\n  };\n"],"mappings":";;;;;;AAAA;AAEA;AAEA;AAAyE;AAIzE,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,4BAA4B,CAAC;AAE/C,MAAMC,WAAW,GAAIC,MAAM,IAChC,SAASD,WAAW,CAClBE,GAAc,EACdC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtB;EACAP,KAAK,CAAC,oBAAoB,CAAC;EAC3B,IAAIQ,eAAC,CAACC,OAAO,CAACL,GAAG,CAAC,EAAE;IAClBJ,KAAK,CAAC,iBAAiB,CAAC;IACxB,IAAII,GAAG,CAACM,IAAI,KAAK,YAAY,IAAIJ,GAAG,CAACK,UAAU,KAAKC,iBAAW,CAACC,YAAY,EAAE;MAC5E,OAAON,IAAI,EAAE;IACf;IACA,IAAIC,eAAC,CAACM,UAAU,CAACR,GAAG,CAACS,MAAM,CAACC,YAAY,CAAC,KAAK,KAAK,EAAE;MACnDhB,KAAK,CAAC,4BAA4B,CAAC;MACnC;MACA;MACAiB,wBAAwB,CAACd,MAAM,CAAC,CAACE,GAAG,EAAEC,GAAG,EAAEE,eAAC,CAACU,IAAI,CAAC;IACpD;IACAlB,KAAK,CAAC,6BAA6B,CAAC;IACpCM,GAAG,CAACS,MAAM,CAACC,YAAY,CAACZ,GAAG,CAAC;EAC9B,CAAC,MAAM;IACL;IACAJ,KAAK,CAAC,qCAAqC,CAAC;IAC5C,OAAOO,IAAI,CAACH,GAAG,CAAC;EAClB;AACF,CAAC;;AAEH;AAAA;AACO,MAAMa,wBAAwB,GAAId,MAAM,IAC7C,SAASc,wBAAwB,CAC/BZ,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACNP,KAAK,CAAC,yBAAyB,CAAC;EAChCM,GAAG,CAACS,MAAM,CAACC,YAAY,GACrBV,GAAG,CAACS,MAAM,CAACC,YAAY,IACvB,UAAUZ,GAAmB,EAAQ;IACnC,IAAIA,GAAG,CAACe,MAAM,IAAIf,GAAG,CAACe,MAAM,IAAIP,iBAAW,CAACQ,WAAW,IAAIhB,GAAG,CAACe,MAAM,GAAG,GAAG,EAAE;MAC3EnB,KAAK,CAAC,mBAAmB,EAAEI,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEe,MAAM,CAAC;MACvC,IAAIX,eAAC,CAACa,KAAK,CAACf,GAAG,CAACgB,WAAW,CAAC,KAAK,KAAK,EAAE;QACtCtB,KAAK,CAAC,gBAAgB,EAAEI,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEe,MAAM,CAAC;QACpCb,GAAG,CAACa,MAAM,CAACf,GAAG,CAACe,MAAM,CAAC;QACtBnB,KAAK,CAAC,eAAe,EAAEI,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEmB,OAAO,CAAC;QACpChB,IAAI,CAAC;UAAEiB,KAAK,EAAEpB,GAAG,CAACmB,OAAO,IAAIE,eAAS,CAACC;QAAc,CAAC,CAAC;MACzD;IACF,CAAC,MAAM;MACL1B,KAAK,CAAC,mBAAmB,EAAEI,GAAG,aAAHA,GAAG,uBAAHA,GAAG,CAAEe,MAAM,CAAC;MACvChB,MAAM,CAACqB,KAAK,CAAC;QAAEpB,GAAG,EAAEA;MAAI,CAAC,EAAE,iDAAiD,CAAC;MAC7E,IAAI,CAACE,GAAG,CAACa,MAAM,IAAI,CAACb,GAAG,CAACqB,IAAI,EAAE;QAC5B;QACAxB,MAAM,CAACqB,KAAK,CAAC,oDAAoD,CAAC;QAClExB,KAAK,CAAC,yEAAyE,EAAEI,GAAG,CAAC;QACrFE,GAAG,CAACsB,OAAO,EAAE;MACf,CAAC,MAAM,IAAI,CAACtB,GAAG,CAACgB,WAAW,EAAE;QAC3BtB,KAAK,CAAC,0BAA0B,EAAEI,GAAG,CAAC;QACtCE,GAAG,CAACa,MAAM,CAACP,iBAAW,CAACiB,cAAc,CAAC;QACtCtB,IAAI,CAAC;UAAEiB,KAAK,EAAEC,eAAS,CAACK;QAAsB,CAAC,CAAC;MAClD,CAAC,MAAM;QACL;QACA9B,KAAK,CAAC,6CAA6C,EAAEI,GAAG,CAAC;MAC3D;IACF;EACF,CAAC;EAEHJ,KAAK,CAAC,gCAAgC,CAAC;EACvCO,IAAI,EAAE;AACR,CAAC;AAAC"}

package/build/middlewares/final.d.ts

@@ -0,0 +1,4 @@
+import { Manifest } from '@verdaccio/types';
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';
+export type FinalBody = Manifest | MiddlewareError | string;
+export declare function final(body: FinalBody, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/final.js

@@ -0,0 +1,52 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.final = final;
+var _lodash = _interopRequireDefault(require("lodash"));
+var _core = require("@verdaccio/core");
+var _utils = require("@verdaccio/utils");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function final(body, req, res,
+// if we remove `next` breaks test
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+next) {
+  if (res.statusCode === _core.HTTP_STATUS.UNAUTHORIZED && !res.getHeader(_core.HEADERS.WWW_AUTH)) {
+    res.header(_core.HEADERS.WWW_AUTH, `${_core.TOKEN_BASIC}, ${_core.TOKEN_BEARER}`);
+  }
+  try {
+    if (_lodash.default.isString(body) || _lodash.default.isObject(body)) {
+      if (!res.get(_core.HEADERS.CONTENT_TYPE)) {
+        res.header(_core.HEADERS.CONTENT_TYPE, _core.HEADERS.JSON);
+      }
+      if (typeof body === 'object' && _lodash.default.isNil(body) === false) {
+        if (typeof body.error === 'string') {
+          res.locals._verdaccio_error = body.error;
+        }
+        body = JSON.stringify(body, undefined, '  ') + '\n';
+      }
+
+      // don't send etags with errors
+      if (!res.statusCode || res.statusCode >= _core.HTTP_STATUS.OK && res.statusCode < _core.HTTP_STATUS.MULTIPLE_CHOICES) {
+        res.header(_core.HEADERS.ETAG, '"' + (0, _utils.stringToMD5)(body) + '"');
+      }
+    } else {
+      // send(null), send(204), etc.
+    }
+  } catch (err) {
+    // if verdaccio sends headers first, and then calls res.send()
+    // as an error handler, we can't report error properly,
+    // and should just close socket
+    if (err.message.match(/set headers after they are sent/)) {
+      if (_lodash.default.isNil(res.socket) === false) {
+        var _res$socket;
+        (_res$socket = res.socket) === null || _res$socket === void 0 ? void 0 : _res$socket.destroy();
+      }
+      return;
+    }
+    throw err;
+  }
+  res.send(body);
+}
+//# sourceMappingURL=final.js.map

package/build/middlewares/final.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"final.js","names":["final","body","req","res","next","statusCode","HTTP_STATUS","UNAUTHORIZED","getHeader","HEADERS","WWW_AUTH","header","TOKEN_BASIC","TOKEN_BEARER","_","isString","isObject","get","CONTENT_TYPE","JSON","isNil","error","locals","_verdaccio_error","stringify","undefined","OK","MULTIPLE_CHOICES","ETAG","stringToMD5","err","message","match","socket","destroy","send"],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';\nimport { Manifest } from '@verdaccio/types';\nimport { stringToMD5 } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (_.isString(body) || _.isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && _.isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        res.header(HEADERS.ETAG, '\"' + stringToMD5(body as string) + '\"');\n      }\n    } else {\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      if (_.isNil(res.socket) === false) {\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;;;AAAA;AAEA;AAEA;AAA+C;AAMxC,SAASA,KAAK,CACnBC,IAAe,EACfC,GAAmB,EACnBC,GAAoB;AACpB;AACA;AACAC,IAAsB,EAChB;EACN,IAAID,GAAG,CAACE,UAAU,KAAKC,iBAAW,CAACC,YAAY,IAAI,CAACJ,GAAG,CAACK,SAAS,CAACC,aAAO,CAACC,QAAQ,CAAC,EAAE;IACnFP,GAAG,CAACQ,MAAM,CAACF,aAAO,CAACC,QAAQ,EAAG,GAAEE,iBAAY,KAAIC,kBAAa,EAAC,CAAC;EACjE;EAEA,IAAI;IACF,IAAIC,eAAC,CAACC,QAAQ,CAACd,IAAI,CAAC,IAAIa,eAAC,CAACE,QAAQ,CAACf,IAAI,CAAC,EAAE;MACxC,IAAI,CAACE,GAAG,CAACc,GAAG,CAACR,aAAO,CAACS,YAAY,CAAC,EAAE;QAClCf,GAAG,CAACQ,MAAM,CAACF,aAAO,CAACS,YAAY,EAAET,aAAO,CAACU,IAAI,CAAC;MAChD;MAEA,IAAI,OAAOlB,IAAI,KAAK,QAAQ,IAAIa,eAAC,CAACM,KAAK,CAACnB,IAAI,CAAC,KAAK,KAAK,EAAE;QACvD,IAAI,OAAQA,IAAI,CAAqBoB,KAAK,KAAK,QAAQ,EAAE;UACvDlB,GAAG,CAACmB,MAAM,CAACC,gBAAgB,GAAItB,IAAI,CAAqBoB,KAAK;QAC/D;QACApB,IAAI,GAAGkB,IAAI,CAACK,SAAS,CAACvB,IAAI,EAAEwB,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI;MACrD;;MAEA;MACA,IACE,CAACtB,GAAG,CAACE,UAAU,IACdF,GAAG,CAACE,UAAU,IAAIC,iBAAW,CAACoB,EAAE,IAAIvB,GAAG,CAACE,UAAU,GAAGC,iBAAW,CAACqB,gBAAiB,EACnF;QACAxB,GAAG,CAACQ,MAAM,CAACF,aAAO,CAACmB,IAAI,EAAE,GAAG,GAAG,IAAAC,kBAAW,EAAC5B,IAAI,CAAW,GAAG,GAAG,CAAC;MACnE;IACF,CAAC,MAAM;MACL;IAAA;EAEJ,CAAC,CAAC,OAAO6B,GAAQ,EAAE;IACjB;IACA;IACA;IACA,IAAIA,GAAG,CAACC,OAAO,CAACC,KAAK,CAAC,iCAAiC,CAAC,EAAE;MACxD,IAAIlB,eAAC,CAACM,KAAK,CAACjB,GAAG,CAAC8B,MAAM,CAAC,KAAK,KAAK,EAAE;QAAA;QACjC,eAAA9B,GAAG,CAAC8B,MAAM,gDAAV,YAAYC,OAAO,EAAE;MACvB;MACA;IACF;IACA,MAAMJ,GAAG;EACX;EAEA3B,GAAG,CAACgC,IAAI,CAAClC,IAAI,CAAC;AAChB"}

package/build/middlewares/json.d.ts

@@ -0,0 +1,2 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+export declare function expectJson(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/json.js

@@ -0,0 +1,15 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.expectJson = expectJson;
+var _core = require("@verdaccio/core");
+var _utils = require("@verdaccio/utils");
+function expectJson(req, res, next) {
+  if (!(0, _utils.isObject)(req.body)) {
+    return next(_core.errorUtils.getBadRequest("can't parse incoming json"));
+  }
+  next();
+}
+//# sourceMappingURL=json.js.map

package/build/middlewares/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","names":["expectJson","req","res","next","isObject","body","errorUtils","getBadRequest"],"sources":["../../src/middlewares/json.ts"],"sourcesContent":["import { errorUtils } from '@verdaccio/core';\nimport { isObject } from '@verdaccio/utils';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function expectJson(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (!isObject(req.body)) {\n    return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA;AACA;AAIO,SAASA,UAAU,CACxBC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAI,CAAC,IAAAC,eAAQ,EAACH,GAAG,CAACI,IAAI,CAAC,EAAE;IACvB,OAAOF,IAAI,CAACG,gBAAU,CAACC,aAAa,CAAC,2BAA2B,CAAC,CAAC;EACpE;EACAJ,IAAI,EAAE;AACR"}

package/build/middlewares/log.d.ts

@@ -0,0 +1,5 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+export declare const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
+export declare const LOG_VERDACCIO_ERROR: string;
+export declare const LOG_VERDACCIO_BYTES: string;
+export declare const log: (logger: any) => (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;

package/build/middlewares/log.js

@@ -0,0 +1,102 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.log = exports.LOG_VERDACCIO_ERROR = exports.LOG_VERDACCIO_BYTES = exports.LOG_STATUS_MESSAGE = void 0;
+var _lodash = _interopRequireDefault(require("lodash"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+// FIXME: deprecated, moved to @verdaccio/dev-commons
+const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
+exports.LOG_STATUS_MESSAGE = LOG_STATUS_MESSAGE;
+const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;
+exports.LOG_VERDACCIO_ERROR = LOG_VERDACCIO_ERROR;
+const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;
+exports.LOG_VERDACCIO_BYTES = LOG_VERDACCIO_BYTES;
+const log = logger => {
+  return function log(req, res, next) {
+    // logger
+    req.log = logger.child({
+      sub: 'in'
+    });
+    const _auth = req.headers.authorization;
+    if (_lodash.default.isNil(_auth) === false) {
+      req.headers.authorization = '<Classified>';
+    }
+    const _cookie = req.get('cookie');
+    if (_lodash.default.isNil(_cookie) === false) {
+      req.headers.cookie = '<Classified>';
+    }
+    req.url = req.originalUrl;
+    req.log.info({
+      req: req,
+      ip: req.ip
+    }, "@{ip} requested '@{req.method} @{req.url}'");
+    req.originalUrl = req.url;
+    if (_lodash.default.isNil(_auth) === false) {
+      req.headers.authorization = _auth;
+    }
+    if (_lodash.default.isNil(_cookie) === false) {
+      req.headers.cookie = _cookie;
+    }
+    let bytesin = 0;
+    req.on('data', function (chunk) {
+      bytesin += chunk.length;
+    });
+    let bytesout = 0;
+    const _write = res.write;
+    // FIXME: res.write should return boolean
+    // @ts-ignore
+    res.write = function (buf) {
+      bytesout += buf.length;
+      /* eslint prefer-rest-params: "off" */
+      // @ts-ignore
+      _write.apply(res, arguments);
+    };
+    const log = function () {
+      var _req$remote_user;
+      const forwardedFor = req.get('x-forwarded-for');
+      const remoteAddress = req.connection.remoteAddress;
+      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
+      let message;
+      if (res.locals._verdaccio_error) {
+        message = LOG_VERDACCIO_ERROR;
+      } else {
+        message = LOG_VERDACCIO_BYTES;
+      }
+      req.url = req.originalUrl;
+      req.log.http({
+        request: {
+          method: req.method,
+          url: req.url
+        },
+        user: ((_req$remote_user = req.remote_user) === null || _req$remote_user === void 0 ? void 0 : _req$remote_user.name) || null,
+        remoteIP,
+        status: res.statusCode,
+        error: res.locals._verdaccio_error,
+        bytes: {
+          in: bytesin,
+          out: bytesout
+        }
+      }, message);
+      req.originalUrl = req.url;
+    };
+    req.on('close', function () {
+      log();
+    });
+    const _end = res.end;
+    // @ts-ignore
+    res.end = function (buf) {
+      if (buf) {
+        bytesout += buf.length;
+      }
+      /* eslint prefer-rest-params: "off" */
+      // @ts-ignore
+      _end.apply(res, arguments);
+      log();
+    };
+    next();
+  };
+};
+exports.log = log;
+//# sourceMappingURL=log.js.map