@verdaccio/middleware 8.0.0-next-8.12 → 8.0.0-next-8.13

package/src/index.ts

@@ -1,23 +0,0 @@
-export { match } from './middlewares/match';
-export { setSecurityWebHeaders } from './middlewares/security-headers';
-export { validateName, validatePackage } from './middlewares/validation';
-export { media } from './middlewares/media';
-export { makeURLrelative } from './middlewares/make-url-relative';
-export { encodeScopePackage } from './middlewares/encode-pkg';
-export { expectJson } from './middlewares/json';
-export { antiLoop } from './middlewares/antiLoop';
-export { final } from './middlewares/final';
-export { allow } from './middlewares/allow';
-export { rateLimit } from './middlewares/rate-limit';
-export { userAgent } from './middlewares/user-agent';
-export { webMiddleware, renderWebMiddleware } from './middlewares/web';
-export { errorReportingMiddleware, handleError } from './middlewares/error';
-export {
-  log,
-  LOG_STATUS_MESSAGE,
-  LOG_VERDACCIO_BYTES,
-  LOG_VERDACCIO_ERROR,
-} from './middlewares/log';
-export * from './types';
-export * from './middlewares/api_urls';
-export * from './middlewares/web/web-urls';

package/src/middlewares/allow.ts

@@ -1,66 +0,0 @@
-import buildDebug from 'debug';
-
-import { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-const debug = buildDebug('verdaccio:middleware:allow');
-
-export function allow<T>(
-  auth: T,
-  options = {
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    beforeAll: (_a: any, _b: any) => {},
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    afterAll: (_a: any, _b: any) => {},
-  }
-): Function {
-  const { beforeAll, afterAll } = options;
-  return function (action: string): Function {
-    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
-      req.pause();
-      const packageName = req.params.scope
-        ? `@${req.params.scope}/${req.params.package}`
-        : req.params.package;
-      const packageVersion = req.params.filename
-        ? tarballUtils.getVersionFromTarball(req.params.filename)
-        : req.params.version
-          ? req.params.version
-          : undefined;
-      const remote_user = req.remote_user;
-      debug(
-        'check if user %o can %o package %o version %o',
-        remote_user?.name,
-        action,
-        packageName,
-        packageVersion
-      );
-      beforeAll?.(
-        { action, user: remote_user?.name },
-        `[middleware/allow][@{action}] allow for @{user}`
-      );
-      auth['allow_' + action](
-        { packageName, packageVersion },
-        remote_user,
-        function (error, allowed): void {
-          req.resume();
-          if (error) {
-            debug('user is NOT allowed to %o', action);
-            next(error);
-          } else if (allowed) {
-            debug('user is allowed to %o', action);
-            afterAll?.(
-              { action, user: remote_user?.name },
-              `[middleware/allow][@{action}] allowed for @{user}`
-            );
-            next();
-          } else {
-            // last plugin (that's our built-in one) returns either
-            // cb(err) or cb(null, true), so this should never happen
-            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);
-          }
-        }
-      );
-    };
-  };
-}

package/src/middlewares/antiLoop.ts

@@ -1,41 +0,0 @@
-import { HTTP_STATUS, errorUtils } from '@verdaccio/core';
-import { Config } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-/**
- * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
- * @param config
- * @returns
- */
-export function antiLoop(config: Config) {
-  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
-    if (req?.headers?.via != null) {
-      const arr = req.get('via')?.split(',');
-      if (Array.isArray(arr)) {
-        for (let i = 0; i < arr.length; i++) {
-          // the "via" header must contain a specific value, this has to be in sync
-          // with the proxy request
-          // match eg: Server 1 or Server 2
-
-          // RFC 7230: Via = 1*( "," OWS Via-value )
-          //           Via-value = received-protocol RWS received-by [ RWS comment ]
-          //           received-protocol = [ protocol-name "/" ] protocol-version
-          //           received-by = ( uri-host [ ":" port ] ) / pseudonym
-
-          // Split the trimmed header value into parts
-          const parts = arr[i].trim().split(/\s+/);
-          // Check if we have at least protocol/version and received-by parts
-          if (parts.length >= 2) {
-            // Get the received-by value (server id), removing any comment
-            const serverId = parts[1].split('(')[0].trim();
-            if (serverId === config.server_id) {
-              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
-            }
-          }
-        }
-      }
-    }
-    next();
-  };
-}

package/src/middlewares/api_urls.ts

@@ -1,45 +0,0 @@
-export enum USER_API_ENDPOINTS {
-  whoami = '/-/whoami',
-  get_user = '/-/user/:org_couchdb_user',
-  add_user = '/-/user/:org_couchdb_user/:_rev?/:revision?',
-  user_token = '/-/user/token/*',
-}
-
-export enum STARS_API_ENDPOINTS {
-  get_user_starred_packages = '/-/_view/starredByUser',
-}
-
-export enum SEARCH_API_ENDPOINTS {
-  search = '/-/v1/search',
-  deprecated_search = '/-/all(/since)?',
-}
-
-export enum PUBLISH_API_ENDPOINTS {
-  add_package = '/:package',
-  publish_package = '/:package/-rev/:revision',
-  remove_tarball = '/:package/-/:filename/-rev/:revision',
-}
-
-export enum PING_API_ENDPOINTS {
-  ping = '/-/ping',
-}
-
-export enum PACKAGE_API_ENDPOINTS {
-  get_package_by_version = '/:package/:version?',
-  get_package_tarball = '/:package/-/:filename',
-}
-
-export enum DIST_TAGS_API_ENDPOINTS {
-  tagging = '/:package/:tag',
-  tagging_package = '/-/package/:package/dist-tags/:tag',
-  get_dist_tags = '/-/package/:package/dist-tags',
-}
-
-export enum PROFILE_API_ENDPOINTS {
-  get_profile = '/-/npm/v1/user',
-}
-
-export enum TOKEN_API_ENDPOINTS {
-  get_tokens = '/-/npm/v1/tokens',
-  delete_token = '/-/npm/v1/tokens/token/:tokenKey',
-}

package/src/middlewares/encode-pkg.ts

@@ -1,39 +0,0 @@
-import buildDebug from 'debug';
-
-import { errorUtils } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-const debug = buildDebug('verdaccio:middleware:encode');
-
-/**
- * Encode / in a scoped package name to be matched as a single parameter in routes
- * @param req
- * @param res
- * @param next
- */
-export function encodeScopePackage(
-  req: $RequestExtend,
-  res: $ResponseExtend,
-  next: $NextFunctionVer
-): void {
-  const original = req.url;
-
-  // Expect relative URLs i.e. should call makeURLrelative before this middleware
-  if (!req.url.startsWith('/')) {
-    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));
-  }
-
-  // If the @ sign is encoded, we need to decode it first
-  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3
-  // For scoped packages, encode the slash to make it a single path segment/parameter
-  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
-  req.url = req.url.replace(/^\/%40/, '/@').replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
-
-  if (original !== req.url) {
-    debug('encodeScopePackage: %o -> %o', original, req.url);
-  } else {
-    debug('encodeScopePackage: %o (unchanged)', original);
-  }
-  next();
-}

package/src/middlewares/error.ts

@@ -1,79 +0,0 @@
-import buildDebug from 'debug';
-import { HttpError } from 'http-errors';
-import _ from 'lodash';
-
-import { API_ERROR, HTTP_STATUS, VerdaccioError } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-const debug = buildDebug('verdaccio:middleware:error');
-
-export const handleError = (logger) =>
-  function handleError(
-    err: HttpError,
-    req: $RequestExtend,
-    res: $ResponseExtend,
-    next: $NextFunctionVer
-  ) {
-    debug('error handler init');
-    if (_.isError(err)) {
-      debug('is native error');
-      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {
-        return next();
-      }
-      if (_.isFunction(res.locals.report_error) === false) {
-        debug('is locals error report ref');
-        // in case of very early error this middleware may not be loaded before error is generated
-        // fixing that
-        errorReportingMiddleware(logger)(req, res, _.noop);
-      }
-      debug('set locals error report ref');
-      res.locals.report_error(err);
-    } else {
-      // Fall to Middleware.final
-      debug('no error to report, jump next layer');
-      return next(err);
-    }
-  };
-
-// Middleware
-export const errorReportingMiddleware = (logger) =>
-  function errorReportingMiddleware(
-    req: $RequestExtend,
-    res: $ResponseExtend,
-    next: $NextFunctionVer
-  ): void {
-    debug('error report middleware start');
-    res.locals.report_error =
-      res.locals.report_error ||
-      function (err: VerdaccioError): void {
-        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {
-          debug('is error > 409 %o', err?.status);
-          if (_.isNil(res.headersSent) === false) {
-            debug('send status %o', err?.status);
-            res.status(err.status);
-            debug('next layer %o', err?.message);
-            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });
-          }
-        } else {
-          debug('is error < 409 %o', err?.status);
-          logger.error({ err: err }, 'unexpected error: @{!err.message}\n@{err.stack}');
-          if (!res.status || !res.send) {
-            // TODO: decide which debug keep
-            logger.error('this is an error in express.js, please report this');
-            debug('this is an error in express.js, please report this, destroy response %o', err);
-            res.destroy();
-          } else if (!res.headersSent) {
-            debug('send internal error %o', err);
-            res.status(HTTP_STATUS.INTERNAL_ERROR);
-            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });
-          } else {
-            // socket should be already closed
-            debug('this should not happen, otherwise report %o', err);
-          }
-        }
-      };
-
-    debug('error report middleware end (skip next layer) next()');
-    next();
-  };

package/src/middlewares/final.ts

@@ -1,71 +0,0 @@
-import buildDebug from 'debug';
-import _ from 'lodash';
-
-import { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
-import { Manifest } from '@verdaccio/types';
-import { stringToMD5 } from '@verdaccio/utils';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';
-
-export type FinalBody = Manifest | MiddlewareError | string;
-
-const debug = buildDebug('verdaccio:middleware:final');
-
-export function final(
-  body: FinalBody,
-  req: $RequestExtend,
-  res: $ResponseExtend,
-  // if we remove `next` breaks test
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
-  next: $NextFunctionVer
-): void {
-  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {
-    debug('set auth header support');
-    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);
-  }
-
-  try {
-    if (_.isString(body) || _.isObject(body)) {
-      if (!res.get(HEADERS.CONTENT_TYPE)) {
-        debug('set json type header support');
-        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);
-      }
-
-      if (typeof body === 'object' && _.isNil(body) === false) {
-        if (typeof (body as MiddlewareError).error === 'string') {
-          debug('set verdaccio_error method');
-          res.locals._verdaccio_error = (body as MiddlewareError).error;
-        }
-        body = JSON.stringify(body, undefined, '  ') + '\n';
-      }
-
-      // don't send etags with errors
-      if (
-        !res.statusCode ||
-        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)
-      ) {
-        const etag = stringToMD5(body as string);
-        debug('set etag header %s', etag);
-        res.header(HEADERS.ETAG, '"' + etag + '"');
-      }
-    } else {
-      debug('this line should never be visible, if does report');
-      // send(null), send(204), etc.
-    }
-  } catch (err: any) {
-    // if verdaccio sends headers first, and then calls res.send()
-    // as an error handler, we can't report error properly,
-    // and should just close socket
-    if (err.message.match(/set headers after they are sent/)) {
-      debug('set headers after they are sent');
-      if (_.isNil(res.socket) === false) {
-        debug('force destroy socket');
-        res.socket?.destroy();
-      }
-      return;
-    }
-    throw err;
-  }
-
-  res.send(body);
-}

package/src/middlewares/json.ts

@@ -1,15 +0,0 @@
-import { errorUtils } from '@verdaccio/core';
-import { isObject } from '@verdaccio/utils';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-export function expectJson(
-  req: $RequestExtend,
-  res: $ResponseExtend,
-  next: $NextFunctionVer
-): void {
-  if (!isObject(req.body)) {
-    return next(errorUtils.getBadRequest("can't parse incoming json"));
-  }
-  next();
-}

package/src/middlewares/log.ts

@@ -1,105 +0,0 @@
-import _ from 'lodash';
-
-import { HEADERS } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-// FIXME: deprecated, moved to @verdaccio/dev-commons
-export const LOG_STATUS_MESSAGE =
-  "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
-export const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;
-export const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;
-
-export const log = (logger) => {
-  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
-    // logger
-    req.log = logger.child({ sub: 'in' });
-
-    const _auth = req.headers.authorization;
-    if (_.isNil(_auth) === false) {
-      req.headers.authorization = '<Classified>';
-    }
-
-    const _cookie = req.get('cookie');
-    if (_.isNil(_cookie) === false) {
-      req.headers.cookie = '<Classified>';
-    }
-
-    req.url = req.originalUrl;
-    req.log.info({ req: req, ip: req.ip }, "@{ip} requested '@{req.method} @{req.url}'");
-    req.originalUrl = req.url;
-
-    if (_.isNil(_auth) === false) {
-      req.headers.authorization = _auth;
-    }
-
-    if (_.isNil(_cookie) === false) {
-      req.headers.cookie = _cookie;
-    }
-
-    let bytesin = 0;
-    req.on('data', function (chunk): void {
-      bytesin += chunk.length;
-    });
-
-    let bytesout = 0;
-    const _write = res.write;
-    // FIXME: res.write should return boolean
-    // @ts-ignore
-    res.write = function (buf): boolean {
-      bytesout += buf.length;
-      /* eslint prefer-rest-params: "off" */
-      // @ts-ignore
-      _write.apply(res, arguments);
-    };
-
-    const log = function (): void {
-      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);
-      const remoteAddress = req.connection.remoteAddress;
-      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
-      let message;
-      if (res.locals._verdaccio_error) {
-        message = LOG_VERDACCIO_ERROR;
-      } else {
-        message = LOG_VERDACCIO_BYTES;
-      }
-
-      req.url = req.originalUrl;
-      req.log.http(
-        {
-          request: {
-            method: req.method,
-            url: req.url,
-          },
-          user: req.remote_user?.name || null,
-          remoteIP,
-          status: res.statusCode,
-          error: res.locals._verdaccio_error,
-          bytes: {
-            in: bytesin,
-            out: bytesout,
-          },
-        },
-        message
-      );
-      req.originalUrl = req.url;
-    };
-
-    req.on('close', function (): void {
-      log();
-    });
-
-    const _end = res.end;
-    // @ts-ignore
-    res.end = function (buf): void {
-      if (buf) {
-        bytesout += buf.length;
-      }
-      /* eslint prefer-rest-params: "off" */
-      // @ts-ignore
-      _end.apply(res, arguments);
-      log();
-    };
-    next();
-  };
-};

package/src/middlewares/make-url-relative.ts

@@ -1,46 +0,0 @@
-import buildDebug from 'debug';
-import { URL } from 'node:url';
-
-import { errorUtils } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-const debug = buildDebug('verdaccio:middleware:make-url-relative');
-
-/**
- * Removes the host from the URL and turns it into a relative URL.
- * @param req
- * @param res
- * @param next
- */
-export function makeURLrelative(
-  req: $RequestExtend,
-  res: $ResponseExtend,
-  next: $NextFunctionVer
-): void {
-  const original = req.url;
-
-  // npm requests can contain the full URL, including the hostname, for example:
-  // tarball downloads. Removing the hostname makes the URL relative and allows
-  // the application to handle requests in a more consistent way.
-
-  let url;
-  try {
-    // In productive use, the URL is absolute (and base will be ignored)
-    // In tests, the URL might brelative (and base will be used)
-    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base
-    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);
-  } catch (error) {
-    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));
-  }
-
-  // Rebuild the URL without hostname
-  req.url = url.pathname + url.search + url.hash;
-
-  if (original !== req.url) {
-    debug('makeURLrelative: %o -> %o', original, req.url);
-  } else {
-    debug('makeURLrelative: %o (unchanged)', original);
-  }
-  next();
-}

package/src/middlewares/match.ts

@@ -1,16 +0,0 @@
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-export function match(regexp: RegExp): any {
-  return function (
-    req: $RequestExtend,
-    res: $ResponseExtend,
-    next: $NextFunctionVer,
-    value: string
-  ): void {
-    if (regexp.exec(value)) {
-      next();
-    } else {
-      next('route');
-    }
-  };
-}

package/src/middlewares/media.ts

@@ -1,29 +0,0 @@
-import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-export function media(expect: string | null): any {
-  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
-    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];
-    if (!header) {
-      next(
-        errorUtils.getCode(
-          HTTP_STATUS.UNSUPPORTED_MEDIA,
-          'content-type is missing, expect: ' + expect
-        )
-      );
-      return;
-    }
-
-    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {
-      next(
-        errorUtils.getCode(
-          HTTP_STATUS.UNSUPPORTED_MEDIA,
-          'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]
-        )
-      );
-    } else {
-      next();
-    }
-  };
-}

package/src/middlewares/rate-limit.ts

@@ -1,8 +0,0 @@
-import RateLimit from 'express-rate-limit';
-
-import { RateLimit as RateLimitType } from '@verdaccio/types';
-
-export function rateLimit(rateLimitOptions?: RateLimitType) {
-  const limiter = new RateLimit(rateLimitOptions);
-  return limiter;
-}

package/src/middlewares/security-headers.ts

@@ -1,21 +0,0 @@
-import { HEADERS } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-// TODO: remove, was relocated to web package
-// @ts-deprecated
-export function setSecurityWebHeaders(
-  req: $RequestExtend,
-  res: $ResponseExtend,
-  next: $NextFunctionVer
-): void {
-  // disable loading in frames (clickjacking, etc.)
-  res.header(HEADERS.FRAMES_OPTIONS, 'deny');
-  // avoid stablish connections outside of domain
-  res.header(HEADERS.CSP, "connect-src 'self'");
-  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
-  res.header(HEADERS.CTO, 'nosniff');
-  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
-  res.header(HEADERS.XSS, '1; mode=block');
-  next();
-}

package/src/middlewares/user-agent.ts

@@ -1,11 +0,0 @@
-import { getUserAgent } from '@verdaccio/config';
-import { HEADERS } from '@verdaccio/core';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
-
-export function userAgent(config) {
-  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
-    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));
-    next();
-  };
-}

package/src/middlewares/validation.ts

@@ -1,31 +0,0 @@
-import { NextFunction, Request, Response } from 'express';
-
-import { errorUtils, validationUtils } from '@verdaccio/core';
-
-export function validateName(
-  _req: Request,
-  _res: Response,
-  next: NextFunction,
-  value: string,
-  name: string
-) {
-  if (validationUtils.validateName(value)) {
-    next();
-  } else {
-    next(errorUtils.getBadRequest('invalid ' + name));
-  }
-}
-
-export function validatePackage(
-  _req: Request,
-  _res,
-  next: NextFunction,
-  value: string,
-  name: string
-) {
-  if (validationUtils.validatePackage(value)) {
-    next();
-  } else {
-    next(errorUtils.getBadRequest('invalid ' + name));
-  }
-}

package/src/middlewares/web/index.ts

@@ -1,4 +0,0 @@
-export { default as webMiddleware } from './web-middleware';
-export { webAPIMiddleware } from './web-api';
-export { setSecurityWebHeaders } from './security';
-export { renderWebMiddleware } from './render-web';