@verdaccio/middleware 8.0.0-next-8.2 → 8.0.0-next-8.3

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @verdaccio/middleware
 
+## 8.0.0-next-8.3
+
+### Patch Changes
+
+- 5bb81eb: fix(middleware): encoding of scope package name
+  - @verdaccio/core@8.0.0-next-8.3
+  - @verdaccio/config@8.0.0-next-8.3
+  - @verdaccio/url@13.0.0-next-8.3
+  - @verdaccio/utils@8.1.0-next-8.3
+
 ## 8.0.0-next-8.2
 
 ### Minor Changes

package/build/middlewares/encode-pkg.js

@@ -4,6 +4,10 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.encodeScopePackage = encodeScopePackage;
+var _debug = _interopRequireDefault(require("debug"));
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('verdaccio:middleware:encode');
+
 /**
  * Encode / in a scoped package name to be matched as a single parameter in routes
  * @param req
@@ -11,10 +15,17 @@ exports.encodeScopePackage = encodeScopePackage;
  * @param next
  */
 function encodeScopePackage(req, res, next) {
+  const original = req.url;
+  // If the @ sign is encoded, we need to decode it first
+  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3
+  if (req.url.indexOf('%40') !== -1) {
+    req.url = req.url.replace(/^\/%40/, '/@');
+  }
   if (req.url.indexOf('@') !== -1) {
     // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
     req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
   }
+  debug('encodeScopePackage: %o -> %o', original, req.url);
   next();
 }
 //# sourceMappingURL=encode-pkg.js.map

package/build/middlewares/encode-pkg.js.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.js","names":["encodeScopePackage","req","res","next","url","indexOf","replace"],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (req.url.indexOf('@') !== -1) {\n    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n    req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n  }\n  next();\n}\n"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,kBAAkBA,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,IAAIF,GAAG,CAACG,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;IAC/B;IACAJ,GAAG,CAACG,GAAG,GAAGH,GAAG,CAACG,GAAG,CAACE,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAC5D;EACAH,IAAI,CAAC,CAAC;AACR","ignoreList":[]}
+{"version":3,"file":"encode-pkg.js","names":["_debug","_interopRequireDefault","require","e","__esModule","default","debug","buildDebug","encodeScopePackage","req","res","next","original","url","indexOf","replace"],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  if (req.url.indexOf('%40') !== -1) {\n    req.url = req.url.replace(/^\\/%40/, '/@');\n  }\n  if (req.url.indexOf('@') !== -1) {\n    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n    req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n  }\n  debug('encodeScopePackage: %o -> %o', original, req.url);\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAA+B,SAAAD,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI/B,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,MAAMC,QAAQ,GAAGH,GAAG,CAACI,GAAG;EACxB;EACA;EACA,IAAIJ,GAAG,CAACI,GAAG,CAACC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE;IACjCL,GAAG,CAACI,GAAG,GAAGJ,GAAG,CAACI,GAAG,CAACE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;EAC3C;EACA,IAAIN,GAAG,CAACI,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;IAC/B;IACAL,GAAG,CAACI,GAAG,GAAGJ,GAAG,CAACI,GAAG,CAACE,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAC5D;EACAT,KAAK,CAAC,8BAA8B,EAAEM,QAAQ,EAAEH,GAAG,CAACI,GAAG,CAAC;EACxDF,IAAI,CAAC,CAAC;AACR","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "8.0.0-next-8.2",
+  "version": "8.0.0-next-8.3",
   "description": "express middleware utils",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,10 +29,10 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/config": "8.0.0-next-8.2",
-    "@verdaccio/core": "8.0.0-next-8.2",
-    "@verdaccio/url": "13.0.0-next-8.2",
-    "@verdaccio/utils": "7.1.0-next-8.2",
+    "@verdaccio/config": "8.0.0-next-8.3",
+    "@verdaccio/core": "8.0.0-next-8.3",
+    "@verdaccio/url": "13.0.0-next-8.3",
+    "@verdaccio/utils": "8.1.0-next-8.3",
     "debug": "4.3.7",
     "express": "4.21.0",
     "express-rate-limit": "5.5.1",
@@ -45,9 +45,10 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@verdaccio/logger": "8.0.0-next-8.2",
+    "@verdaccio/logger": "8.0.0-next-8.3",
     "body-parser": "1.20.3",
-    "supertest": "7.0.0"
+    "supertest": "7.0.0",
+    "jsdom": "25.0.1"
   },
   "scripts": {
     "clean": "rimraf ./build",
@@ -55,7 +56,7 @@
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
     "watch": "pnpm build:js -- --watch",
-    "test": "jest",
+    "test": "vitest run",
     "test:snap": "jest --updateSnapshot",
     "build": "pnpm run build:js && pnpm run build:types"
   }

package/src/middlewares/encode-pkg.ts

@@ -1,5 +1,9 @@
+import buildDebug from 'debug';
+
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 
+const debug = buildDebug('verdaccio:middleware:encode');
+
 /**
  * Encode / in a scoped package name to be matched as a single parameter in routes
  * @param req
@@ -11,9 +15,16 @@ export function encodeScopePackage(
   res: $ResponseExtend,
   next: $NextFunctionVer
 ): void {
+  const original = req.url;
+  // If the @ sign is encoded, we need to decode it first
+  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3
+  if (req.url.indexOf('%40') !== -1) {
+    req.url = req.url.replace(/^\/%40/, '/@');
+  }
   if (req.url.indexOf('@') !== -1) {
     // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
     req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
   }
+  debug('encodeScopePackage: %o -> %o', original, req.url);
   next();
 }

package/test/__snapshots__/template.test.ts.snap

@@ -1,6 +1,6 @@
-// Jest Snapshot v1, https://goo.gl/fbAQLP
+// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
 
-exports[`template custom body after 1`] = `
+exports[`template > custom body after 1`] = `
 "
     <!DOCTYPE html>
       <html lang="en-us">
@@ -26,7 +26,7 @@ exports[`template custom body after 1`] = `
   "
 `;
 
-exports[`template custom body before 1`] = `
+exports[`template > custom body before 1`] = `
 "
     <!DOCTYPE html>
       <html lang="en-us">
@@ -52,7 +52,7 @@ exports[`template custom body before 1`] = `
   "
 `;
 
-exports[`template custom render 1`] = `
+exports[`template > custom render 1`] = `
 "
     <!DOCTYPE html>
       <html lang="en-us">
@@ -78,7 +78,7 @@ exports[`template custom render 1`] = `
   "
 `;
 
-exports[`template custom title 1`] = `
+exports[`template > custom title 1`] = `
 "
     <!DOCTYPE html>
       <html lang="en-us">
@@ -104,7 +104,7 @@ exports[`template custom title 1`] = `
   "
 `;
 
-exports[`template meta scripts 1`] = `
+exports[`template > meta scripts 1`] = `
 "
     <!DOCTYPE html>
       <html lang="en-us">

package/test/allow.spec.ts

@@ -1,4 +1,5 @@
 import request from 'supertest';
+import { test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 

package/test/encode.spec.ts

@@ -1,4 +1,5 @@
 import request from 'supertest';
+import { expect, test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 
@@ -19,3 +20,85 @@ test('encode is json', async () => {
   expect(res.body).toEqual({ id: '@scope/foo' });
   expect(res.status).toEqual(HTTP_STATUS.OK);
 });
+
+test('packages with version/scope', async () => {
+  const app = getApp([]);
+  // @ts-ignore
+  app.use(encodeScopePackage);
+  // @ts-ignore
+  app.get('/:package/:version?', (req, res) => {
+    const { package: pkg, version } = req.params;
+    res.status(HTTP_STATUS.OK).json({ package: pkg, version });
+  });
+
+  const res = await request(app).get('/foo');
+  expect(res.body).toEqual({ package: 'foo' });
+  expect(res.status).toEqual(HTTP_STATUS.OK);
+
+  const res2 = await request(app).get('/foo/1.0.0');
+  expect(res2.body).toEqual({ package: 'foo', version: '1.0.0' });
+  expect(res2.status).toEqual(HTTP_STATUS.OK);
+
+  const res3 = await request(app).get('/@scope/foo');
+  expect(res3.body).toEqual({ package: '@scope/foo' });
+  expect(res3.status).toEqual(HTTP_STATUS.OK);
+
+  const res4 = await request(app).get('/@scope/foo/1.0.0');
+  expect(res4.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+  expect(res4.status).toEqual(HTTP_STATUS.OK);
+
+  const res5 = await request(app).get('/@scope%2ffoo');
+  expect(res5.body).toEqual({ package: '@scope/foo' });
+  expect(res5.status).toEqual(HTTP_STATUS.OK);
+
+  const res6 = await request(app).get('/@scope%2ffoo/1.0.0');
+  expect(res6.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+  expect(res6.status).toEqual(HTTP_STATUS.OK);
+
+  const res7 = await request(app).get('/%40scope%2ffoo');
+  expect(res7.body).toEqual({ package: '@scope/foo' });
+  expect(res7.status).toEqual(HTTP_STATUS.OK);
+
+  const res8 = await request(app).get('/%40scope%2ffoo/1.0.0');
+  expect(res8.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+  expect(res8.status).toEqual(HTTP_STATUS.OK);
+
+  const res9 = await request(app).get('/%40scope/foo');
+  expect(res9.body).toEqual({ package: '@scope/foo' });
+  expect(res9.status).toEqual(HTTP_STATUS.OK);
+
+  const res10 = await request(app).get('/%40scope/foo/1.0.0');
+  expect(res10.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+  expect(res10.status).toEqual(HTTP_STATUS.OK);
+});
+
+test('tarballs with and without scope', async () => {
+  const app = getApp([]);
+  // @ts-ignore
+  app.use(encodeScopePackage);
+  // @ts-ignore
+  app.get('/:package/-/:filename', (req, res) => {
+    const { package: pkg, filename } = req.params;
+    res.status(HTTP_STATUS.OK).json({ package: pkg, filename });
+  });
+
+  const res = await request(app).get('/foo/-/foo-1.2.3.tgz');
+  expect(res.body).toEqual({ package: 'foo', filename: 'foo-1.2.3.tgz' });
+  expect(res.status).toEqual(HTTP_STATUS.OK);
+
+  const res2 = await request(app).get('/@scope/foo/-/foo-1.2.3.tgz');
+  expect(res2.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+  expect(res2.status).toEqual(HTTP_STATUS.OK);
+
+  const res3 = await request(app).get('/@scope%2ffoo/-/foo-1.2.3.tgz');
+  expect(res3.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+  expect(res3.status).toEqual(HTTP_STATUS.OK);
+
+  const res4 = await request(app).get('/%40scope%2ffoo/-/foo-1.2.3.tgz');
+  expect(res4.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+  expect(res4.status).toEqual(HTTP_STATUS.OK);
+
+  const res5 = await request(app).get('/%40scope/foo/-/foo-1.2.3.tgz');
+  expect(res5.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+  expect(res5.status).toEqual(HTTP_STATUS.OK);
+});

package/test/final.spec.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import request from 'supertest';
+import { expect, test } from 'vitest';
 
 import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
 

package/test/json.spec.ts

@@ -1,5 +1,6 @@
 import express from 'express';
 import request from 'supertest';
+import { test } from 'vitest';
 
 import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
 

package/test/log.spec.ts

@@ -1,5 +1,6 @@
 import path from 'path';
 import request from 'supertest';
+import { test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 import { logger, setup } from '@verdaccio/logger';

package/test/loop.spec.ts

@@ -1,4 +1,5 @@
 import request from 'supertest';
+import { test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 

package/test/manifest.test.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { getManifestValue } from '../src/middlewares/web/utils/manifest';
 
 const manifest = require('./partials/manifest/manifest.json');

package/test/media.spec.ts

@@ -1,5 +1,6 @@
 import mime from 'mime';
 import request from 'supertest';
+import { test } from 'vitest';
 
 import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
 

package/test/params.spec.ts

@@ -1,4 +1,5 @@
 import request from 'supertest';
+import { describe, test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 

package/test/render.spec.ts

@@ -2,6 +2,7 @@ import express from 'express';
 import { JSDOM } from 'jsdom';
 import path from 'path';
 import supertest from 'supertest';
+import { describe, expect, test } from 'vitest';
 
 import { HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';
 import { setup } from '@verdaccio/logger';

package/test/security.spec.ts

@@ -1,4 +1,5 @@
 import request from 'supertest';
+import { expect, test } from 'vitest';
 
 import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
 

package/test/template.test.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import template from '../src/middlewares/web/utils/template';
 
 const manifest = require('./partials/manifest/manifest.json');

package/test/utils.spec.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { validatePrimaryColor } from '../src/middlewares/web/utils/web-utils';
 
 describe('Utilities', () => {

package/test/validation.spec.ts

@@ -1,4 +1,5 @@
 import request from 'supertest';
+import { describe, test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 

package/jest.config.js

@@ -1,12 +0,0 @@
-const config = require('../../jest/config');
-
-module.exports = Object.assign({}, config, {
-  coverageThreshold: {
-    global: {
-      lines: 67,
-      functions: 70,
-      branches: 55,
-      statements: 67,
-    },
-  },
-});