@verdaccio/middleware 8.0.0-next-8.12 → 8.0.0-next-8.13

package/src/middlewares/web/render-web.ts

@@ -1,107 +0,0 @@
-import buildDebug from 'debug';
-import express from 'express';
-import fs from 'fs';
-import path from 'path';
-
-import { HTTP_STATUS } from '@verdaccio/core';
-import { isURLhasValidProtocol } from '@verdaccio/url';
-
-import { setSecurityWebHeaders } from './security';
-import renderHTML from './utils/renderHTML';
-import { WebUrlsNamespace } from './web-urls';
-
-const debug = buildDebug('verdaccio:web:render');
-
-const sendFileCallback = (next) => (err) => {
-  if (!err) {
-    return;
-  }
-  if (err.status === HTTP_STATUS.NOT_FOUND) {
-    next();
-  } else {
-    next(err);
-  }
-};
-
-export function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
-  const { staticPath, manifest, manifestFiles } = pluginOptions;
-  debug('static path %o', staticPath);
-
-  /* eslint new-cap:off */
-  const router = express.Router();
-  if (typeof tokenMiddleware === 'function') {
-    router.use(tokenMiddleware);
-  }
-
-  router.use(setSecurityWebHeaders);
-
-  // any match within the static is routed to the file system
-  router.get(WebUrlsNamespace.static + '*', function (req, res, next) {
-    const filename = req.params[0];
-    let file = `${staticPath}/${filename}`;
-    if (filename === 'favicon.ico' && config?.web?.favicon) {
-      file = config?.web?.favicon;
-      if (isURLhasValidProtocol(file)) {
-        debug('redirect to favicon %s', file);
-        req.url = file;
-        return next();
-      }
-    }
-    debug('render static file %o', file);
-    res.sendFile(file, sendFileCallback(next));
-  });
-
-  function renderLogo(logo: string | undefined): string | undefined {
-    // check the origin of the logo
-    if (logo && !isURLhasValidProtocol(logo)) {
-      // URI related to a local file
-      const absoluteLocalFile = path.posix.resolve(logo);
-      debug('serve local logo %s', absoluteLocalFile);
-      try {
-        // TODO: replace existsSync by async alternative
-        if (
-          fs.existsSync(absoluteLocalFile) &&
-          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'
-        ) {
-          // Note: `path.join` will break on Windows, because it transforms `/` to `\`
-          // Use POSIX version `path.posix.join` instead.
-          logo = path.posix.join(WebUrlsNamespace.static, path.basename(logo));
-          router.get(logo, function (_req, res, next) {
-            // @ts-ignore
-            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);
-            res.sendFile(absoluteLocalFile, sendFileCallback(next));
-          });
-          debug('enabled custom logo %s', logo);
-        } else {
-          logo = undefined;
-          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
-        }
-      } catch {
-        logo = undefined;
-        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
-      }
-    }
-    return logo;
-  }
-
-  const logo = renderLogo(config?.web?.logo);
-  if (config?.web?.logo) {
-    config.web.logo = logo;
-  }
-  const logoDark = renderLogo(config?.web?.logoDark);
-  if (config?.web?.logoDark) {
-    config.web.logoDark = logoDark;
-  }
-
-  router.get(WebUrlsNamespace.web + ':section/*', function (req, res) {
-    renderHTML(config, manifest, manifestFiles, req, res);
-    debug('render html section');
-  });
-
-  router.get(WebUrlsNamespace.root, function (req, res) {
-    renderHTML(config, manifest, manifestFiles, req, res);
-    debug('render root');
-  });
-
-  return router;
-}

package/src/middlewares/web/security.ts

@@ -1,13 +0,0 @@
-import { HEADERS } from '@verdaccio/core';
-
-export function setSecurityWebHeaders(_req, res, next): void {
-  // disable loading in frames (clickjacking, etc.)
-  res.header(HEADERS.FRAMES_OPTIONS, 'deny');
-  // avoid stablish connections outside of domain
-  res.header(HEADERS.CSP, "connect-src 'self'");
-  // https://stackoverflow.com/questions/18337630/what-is-x-content-type-options-nosniff
-  res.header(HEADERS.CTO, 'nosniff');
-  // https://stackoverflow.com/questions/9090577/what-is-the-http-header-x-xss-protection
-  res.header(HEADERS.XSS, '1; mode=block');
-  next();
-}

package/src/middlewares/web/utils/manifest.ts

@@ -1,31 +0,0 @@
-import buildDebug from 'debug';
-
-export type Manifest = {
-  // goes on first place at the header
-  ico: string;
-  css: string[];
-  js: string[];
-};
-
-const debug = buildDebug('verdaccio:middleware:web:render:manifest');
-
-export function getManifestValue(
-  manifestItems: string[],
-  manifest,
-  basePath: string = ''
-): string[] {
-  return manifestItems?.map((item) => {
-    debug('resolve item %o', item);
-    const resolvedItem = `${stripTrailingSlash(basePath)}/${stripLeadingSlash(manifest[item])}`;
-    debug('resolved item %o', resolvedItem);
-    return resolvedItem;
-  });
-}
-
-function stripTrailingSlash(path: string): string {
-  return path.replace(/\/$/, '');
-}
-
-function stripLeadingSlash(path: string): string {
-  return path.replace(/^\//, '');
-}

package/src/middlewares/web/utils/renderHTML.ts

@@ -1,157 +0,0 @@
-import buildDebug from 'debug';
-import type { Response } from 'express';
-import LRU from 'lru-cache';
-import path from 'path';
-import { URL } from 'url';
-
-import { WEB_TITLE } from '@verdaccio/config';
-import { HEADERS } from '@verdaccio/core';
-import { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';
-import type { RequestOptions } from '@verdaccio/url';
-import { getPublicUrl, isURLhasValidProtocol } from '@verdaccio/url';
-
-import type { Manifest } from './manifest';
-import renderTemplate from './template';
-import type { WebpackManifest } from './template';
-import { hasLogin, validatePrimaryColor } from './web-utils';
-
-const DEFAULT_LANGUAGE = 'es-US';
-const cache = new LRU({ max: 500, ttl: 1000 * 60 * 60 });
-
-const debug = buildDebug('verdaccio:web:render');
-
-const defaultManifestFiles: Manifest = {
-  js: ['runtime.js', 'vendors.js', 'main.js'],
-  ico: 'favicon.ico',
-  css: [],
-};
-
-export function resolveLogo(
-  logo: string | undefined,
-  url_prefix: string | undefined,
-  requestOptions: RequestOptions
-) {
-  if (typeof logo !== 'string') {
-    return '';
-  }
-  const isLocalFile = logo && !isURLhasValidProtocol(logo);
-
-  if (isLocalFile) {
-    return `${getPublicUrl(url_prefix, requestOptions)}-/static/${path.basename(logo)}`;
-  } else if (isURLhasValidProtocol(logo)) {
-    return logo;
-  } else {
-    return '';
-  }
-}
-
-export default function renderHTML(
-  config: ConfigYaml,
-  manifest: WebpackManifest,
-  manifestFiles: Manifest | null | undefined,
-  requestOptions: RequestOptions,
-  res: Response
-) {
-  const { url_prefix } = config;
-  const base = getPublicUrl(config?.url_prefix, requestOptions);
-  const basename = new URL(base).pathname;
-  const language = config?.i18n?.web ?? DEFAULT_LANGUAGE;
-  const hideDeprecatedVersions = config?.web?.hideDeprecatedVersions ?? false;
-  // @ts-ignore
-  const needHtmlCache = [undefined, null].includes(config?.web?.html_cache)
-    ? true
-    : config?.web?.html_cache;
-  const darkMode = config?.web?.darkMode ?? false;
-  const title = config?.web?.title ?? WEB_TITLE;
-  const login = hasLogin(config);
-  const scope = config?.web?.scope ?? '';
-  const favicon = resolveLogo(config?.web?.favicon, config?.url_prefix, requestOptions);
-  const logo = resolveLogo(config?.web?.logo, config?.url_prefix, requestOptions);
-  const logoDark = resolveLogo(config?.web?.logoDark, config?.url_prefix, requestOptions);
-  const pkgManagers = config?.web?.pkgManagers ?? ['yarn', 'pnpm', 'npm'];
-  const version = res.locals.app_version ?? '';
-  const flags = {
-    ...config.flags,
-    // legacy from 5.x
-    ...config.experiments,
-  };
-  const primaryColor =
-    validatePrimaryColor(config?.web?.primary_color ?? config?.web?.primaryColor) ?? '#4b5e40';
-  const {
-    scriptsBodyAfter,
-    metaScripts,
-    scriptsbodyBefore,
-    showInfo,
-    showSettings,
-    showThemeSwitch,
-    showFooter,
-    showSearch,
-    showDownloadTarball,
-    showRaw,
-    showUplinks,
-  } = Object.assign(
-    {},
-    {
-      scriptsBodyAfter: [],
-      bodyBefore: [],
-      metaScripts: [],
-    },
-    config?.web
-  );
-  const options: TemplateUIOptions = {
-    showInfo,
-    showSettings,
-    showThemeSwitch,
-    showFooter,
-    showSearch,
-    showDownloadTarball,
-    showRaw,
-    showUplinks,
-    darkMode,
-    url_prefix,
-    basename,
-    base,
-    primaryColor,
-    version,
-    logo,
-    logoDark,
-    favicon,
-    flags,
-    login,
-    pkgManagers,
-    title,
-    scope,
-    language,
-    hideDeprecatedVersions,
-  };
-
-  let webPage;
-
-  try {
-    webPage = cache.get('template');
-    if (!webPage) {
-      webPage = renderTemplate(
-        {
-          manifest: manifestFiles ?? defaultManifestFiles,
-          options,
-          scriptsBodyAfter,
-          metaScripts,
-          scriptsbodyBefore,
-        },
-        manifest
-      );
-
-      if (needHtmlCache) {
-        cache.set('template', webPage);
-        debug('set template cache');
-      }
-    } else {
-      debug('reuse template cache');
-    }
-  } catch (error: any) {
-    throw new Error(`theme could not be load, stack ${error.stack}`);
-  }
-  res.setHeader('Content-Type', HEADERS.TEXT_HTML);
-  res.send(webPage);
-  debug('web rendered');
-}

package/src/middlewares/web/utils/template.ts

@@ -1,50 +0,0 @@
-import buildDebug from 'debug';
-
-import { TemplateUIOptions } from '@verdaccio/types';
-
-import { Manifest, getManifestValue } from './manifest';
-
-const debug = buildDebug('verdaccio:web:render:template');
-
-export type Template = {
-  manifest: Manifest;
-  options: TemplateUIOptions;
-  metaScripts?: string[];
-  scriptsBodyAfter?: string[];
-  scriptsbodyBefore?: string[];
-};
-
-// the outcome of the Webpack Manifest Plugin
-export interface WebpackManifest {
-  [key: string]: string;
-}
-
-export default function renderTemplate(template: Template, manifest: WebpackManifest) {
-  debug('template %o', template);
-  debug('manifest %o', manifest);
-
-  return `
-    <!DOCTYPE html>
-      <html lang="en-us">
-      <head>
-        <meta charset="utf-8">
-        <base href="${template?.options.base}">
-        <title>${template?.options?.title ?? ''}</title>
-        <link rel="icon" href="${template?.options.base}-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script>
-            window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(template.options)}
-        </script>
-        ${template?.metaScripts ? template.metaScripts.join('') : ''}
-      </head>
-      <body class="body">
-        ${template?.scriptsbodyBefore ? template.scriptsbodyBefore.join('') : ''}
-        <div id="root"></div>
-        ${getManifestValue(template.manifest.js, manifest, template?.options.base)
-          .map((item) => `<script defer="defer" src="${item}"></script>`)
-          .join(`\n        `)}
-        ${template?.scriptsBodyAfter ? template.scriptsBodyAfter.join('') : ''}
-      </body>
-    </html>
-  `;
-}

package/src/middlewares/web/utils/web-utils.ts

@@ -1,18 +0,0 @@
-import buildDebug from 'debug';
-import _ from 'lodash';
-
-const debug = buildDebug('verdaccio:web:middlwares');
-
-export function validatePrimaryColor(primaryColor) {
-  const isHex = /^#([0-9A-F]{3}){1,2}$/i.test(primaryColor);
-  if (!isHex) {
-    debug('invalid primary color %o', primaryColor);
-    return;
-  }
-
-  return primaryColor;
-}
-
-export function hasLogin(config: any) {
-  return _.isNil(config?.web?.login) || config?.web?.login === true;
-}

package/src/middlewares/web/web-api.ts

@@ -1,30 +0,0 @@
-import express from 'express';
-import { RequestHandler, Router } from 'express';
-
-import { validateName, validatePackage } from '../validation';
-import { setSecurityWebHeaders } from './security';
-
-export function webAPIMiddleware(
-  tokenMiddleware: RequestHandler,
-  webEndpointsApi: RequestHandler
-): Router {
-  // eslint-disable-next-line new-cap
-  const route = Router();
-  // validate all of these params as a package name
-  // this might be too harsh, so ask if it causes trouble=
-  route.param('package', validatePackage);
-  route.param('filename', validateName);
-  route.param('version', validateName);
-  route.use(express.urlencoded({ extended: false }));
-  route.use(setSecurityWebHeaders);
-
-  if (typeof tokenMiddleware === 'function') {
-    route.use(tokenMiddleware);
-  }
-
-  if (typeof webEndpointsApi === 'function') {
-    route.use(webEndpointsApi);
-  }
-
-  return route;
-}

package/src/middlewares/web/web-middleware.ts

@@ -1,16 +0,0 @@
-import express from 'express';
-
-import { renderWebMiddleware } from './render-web';
-import { webAPIMiddleware } from './web-api';
-import { WebUrlsNamespace } from './web-urls';
-
-export default (config, middlewares, pluginOptions): any => {
-  // eslint-disable-next-line new-cap
-  const router = express.Router();
-  const { tokenMiddleware, webEndpointsApi } = middlewares;
-  // render web
-  router.use(WebUrlsNamespace.root, renderWebMiddleware(config, tokenMiddleware, pluginOptions));
-  // web endpoints: search, packages, readme, sidebar, etc
-  router.use(WebUrlsNamespace.endpoints, webAPIMiddleware(tokenMiddleware, webEndpointsApi));
-  return router;
-};

package/src/middlewares/web/web-urls.ts

@@ -1,25 +0,0 @@
-/**
- * Enum for web urls, used on the web middleware
- */
-export enum WebUrls {
-  sidebar_scopped_package = '/sidebar/:scope/:package',
-  sidebar_package = '/sidebar/:package',
-  readme_package_scoped_version = '/package/readme/:scope/:package/:version?',
-  readme_package_version = '/package/readme/:package/:version?',
-  packages_all = '/packages',
-  user_login = '/login',
-  search = '/search/:anything',
-  reset_password = '/reset_password',
-}
-
-/**
- * Enum for web urls namespace, used on the web middleware
- */
-export enum WebUrlsNamespace {
-  root = '/',
-  static = '/-/static/',
-  endpoints = '/-/verdaccio/',
-  web = '/-/web/',
-  data = '/data/',
-  sec = '/sec/',
-}

package/src/types.ts

@@ -1,11 +0,0 @@
-import { NextFunction, Request, Response } from 'express';
-
-import { Logger, RemoteUser } from '@verdaccio/types';
-
-export type $RequestExtend = Request & { remote_user?: RemoteUser; log: Logger };
-export type $ResponseExtend = Response & { cookies?: any };
-export type $NextFunctionVer = NextFunction & any;
-
-export interface MiddlewareError {
-  error: string;
-}

package/test/__snapshots__/template.test.ts.snap

@@ -1,131 +0,0 @@
-// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
-
-exports[`template > custom body after 1`] = `
-"
-    <!DOCTYPE html>
-      <html lang="en-us">
-      <head>
-        <meta charset="utf-8">
-        <base href="http://domain.com/">
-        <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script>
-            window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
-        </script>
-        
-      </head>
-      <body class="body">
-        
-        <div id="root"></div>
-        <script defer="defer" src="http://domain.com/-/static/runtime.6126058572f989c948b1.js"></script>
-        <script defer="defer" src="http://domain.com/-/static/main.6126058572f989c948b1.js"></script>
-        <script src="foo"/>
-      </body>
-    </html>
-  "
-`;
-
-exports[`template > custom body before 1`] = `
-"
-    <!DOCTYPE html>
-      <html lang="en-us">
-      <head>
-        <meta charset="utf-8">
-        <base href="http://domain.com/">
-        <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script>
-            window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
-        </script>
-        
-      </head>
-      <body class="body">
-        <script src="fooBefore"/><script src="barBefore"/>
-        <div id="root"></div>
-        <script defer="defer" src="http://domain.com/-/static/runtime.6126058572f989c948b1.js"></script>
-        <script defer="defer" src="http://domain.com/-/static/main.6126058572f989c948b1.js"></script>
-        
-      </body>
-    </html>
-  "
-`;
-
-exports[`template > custom render 1`] = `
-"
-    <!DOCTYPE html>
-      <html lang="en-us">
-      <head>
-        <meta charset="utf-8">
-        <base href="http://domain.com/">
-        <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script>
-            window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
-        </script>
-        
-      </head>
-      <body class="body">
-        
-        <div id="root"></div>
-        <script defer="defer" src="http://domain.com/-/static/runtime.6126058572f989c948b1.js"></script>
-        <script defer="defer" src="http://domain.com/-/static/main.6126058572f989c948b1.js"></script>
-        
-      </body>
-    </html>
-  "
-`;
-
-exports[`template > custom title 1`] = `
-"
-    <!DOCTYPE html>
-      <html lang="en-us">
-      <head>
-        <meta charset="utf-8">
-        <base href="http://domain.com/">
-        <title>foo title</title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script>
-            window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/","title":"foo title"}
-        </script>
-        
-      </head>
-      <body class="body">
-        
-        <div id="root"></div>
-        <script defer="defer" src="http://domain.com/-/static/runtime.6126058572f989c948b1.js"></script>
-        <script defer="defer" src="http://domain.com/-/static/main.6126058572f989c948b1.js"></script>
-        
-      </body>
-    </html>
-  "
-`;
-
-exports[`template > meta scripts 1`] = `
-"
-    <!DOCTYPE html>
-      <html lang="en-us">
-      <head>
-        <meta charset="utf-8">
-        <base href="http://domain.com/">
-        <title></title>
-        <link rel="icon" href="http://domain.com/-/static/favicon.ico"/>
-        <meta name="viewport" content="width=device-width, initial-scale=1" />
-        <script>
-            window.__VERDACCIO_BASENAME_UI_OPTIONS={"base":"http://domain.com/"}
-        </script>
-        <style>.someclass{font-size:10px;}</style>
-      </head>
-      <body class="body">
-        
-        <div id="root"></div>
-        <script defer="defer" src="http://domain.com/-/static/runtime.6126058572f989c948b1.js"></script>
-        <script defer="defer" src="http://domain.com/-/static/main.6126058572f989c948b1.js"></script>
-        
-      </body>
-    </html>
-  "
-`;

package/test/_helper.ts

@@ -1,8 +0,0 @@
-import path from 'path';
-
-import { parseConfigFile } from '@verdaccio/config';
-
-export const getConf = (configName: string) => {
-  const configPath = path.join(__dirname, 'config', configName);
-  return parseConfigFile(configPath);
-};