@verdaccio/middleware 8.0.0-next-8.3 → 8.0.0-next-8.5

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @verdaccio/middleware
 
+## 8.0.0-next-8.5
+
+### Patch Changes
+
+- Updated dependencies [ba71932]
+- Updated dependencies [64a7fc0]
+- Updated dependencies [4adaa83]
+- Updated dependencies [5cbee6f]
+- Updated dependencies [a049bba]
+  - @verdaccio/config@8.0.0-next-8.5
+  - @verdaccio/core@8.0.0-next-8.5
+  - @verdaccio/url@13.0.0-next-8.5
+  - @verdaccio/utils@8.1.0-next-8.5
+
+## 8.0.0-next-8.4
+
+### Patch Changes
+
+- 48aa89f: chore: request header constants
+- 58e0d95: fix(middleware): error 404 when getting scoped tarballs
+- 1076a89: chore(middleware): fix syntax of test files
+- e93d6a3: chore: auth package requires logger as parameter
+- Updated dependencies [48aa89f]
+- Updated dependencies [58e0d95]
+  - @verdaccio/core@8.0.0-next-8.4
+  - @verdaccio/config@8.0.0-next-8.4
+  - @verdaccio/url@13.0.0-next-8.4
+  - @verdaccio/utils@8.1.0-next-8.4
+
 ## 8.0.0-next-8.3
 
 ### Patch Changes

package/build/index.d.ts

@@ -2,6 +2,7 @@ export { match } from './middlewares/match';
 export { setSecurityWebHeaders } from './middlewares/security-headers';
 export { validateName, validatePackage } from './middlewares/validation';
 export { media } from './middlewares/media';
+export { makeURLrelative } from './middlewares/make-url-relative';
 export { encodeScopePackage } from './middlewares/encode-pkg';
 export { expectJson } from './middlewares/json';
 export { antiLoop } from './middlewares/antiLoop';

package/build/index.js

@@ -9,6 +9,7 @@ var _exportNames = {
   validateName: true,
   validatePackage: true,
   media: true,
+  makeURLrelative: true,
   encodeScopePackage: true,
   expectJson: true,
   antiLoop: true,
@@ -91,6 +92,12 @@ Object.defineProperty(exports, "log", {
     return _log.log;
   }
 });
+Object.defineProperty(exports, "makeURLrelative", {
+  enumerable: true,
+  get: function () {
+    return _makeUrlRelative.makeURLrelative;
+  }
+});
 Object.defineProperty(exports, "match", {
   enumerable: true,
   get: function () {
@@ -149,6 +156,7 @@ var _match = require("./middlewares/match");
 var _securityHeaders = require("./middlewares/security-headers");
 var _validation = require("./middlewares/validation");
 var _media = require("./middlewares/media");
+var _makeUrlRelative = require("./middlewares/make-url-relative");
 var _encodePkg = require("./middlewares/encode-pkg");
 var _json = require("./middlewares/json");
 var _antiLoop = require("./middlewares/antiLoop");

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_match","require","_securityHeaders","_validation","_media","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_userAgent","_web","_error","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { setSecurityWebHeaders } from './middlewares/security-headers';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,MAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,UAAA,GAAAT,OAAA;AACA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,IAAA,GAAAX,OAAA;AACA,IAAAY,MAAA,GAAAZ,OAAA;AACA,IAAAa,IAAA,GAAAb,OAAA;AAMA,IAAAc,MAAA,GAAAd,OAAA;AAAAe,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}
+{"version":3,"file":"index.js","names":["_match","require","_securityHeaders","_validation","_media","_makeUrlRelative","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_userAgent","_web","_error","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { setSecurityWebHeaders } from './middlewares/security-headers';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { makeURLrelative } from './middlewares/make-url-relative';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,gBAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,MAAA,GAAAH,OAAA;AACA,IAAAI,gBAAA,GAAAJ,OAAA;AACA,IAAAK,UAAA,GAAAL,OAAA;AACA,IAAAM,KAAA,GAAAN,OAAA;AACA,IAAAO,SAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,MAAA,GAAAT,OAAA;AACA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,UAAA,GAAAX,OAAA;AACA,IAAAY,IAAA,GAAAZ,OAAA;AACA,IAAAa,MAAA,GAAAb,OAAA;AACA,IAAAc,IAAA,GAAAd,OAAA;AAMA,IAAAe,MAAA,GAAAf,OAAA;AAAAgB,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}

package/build/middlewares/encode-pkg.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.encodeScopePackage = encodeScopePackage;
 var _debug = _interopRequireDefault(require("debug"));
+var _core = require("@verdaccio/core");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:middleware:encode');
 
@@ -16,16 +17,22 @@ const debug = (0, _debug.default)('verdaccio:middleware:encode');
  */
 function encodeScopePackage(req, res, next) {
   const original = req.url;
+
+  // Expect relative URLs i.e. should call makeURLrelative before this middleware
+  if (!req.url.startsWith('/')) {
+    return next(_core.errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));
+  }
+
   // If the @ sign is encoded, we need to decode it first
   // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3
-  if (req.url.indexOf('%40') !== -1) {
-    req.url = req.url.replace(/^\/%40/, '/@');
-  }
-  if (req.url.indexOf('@') !== -1) {
-    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
-    req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
+  // For scoped packages, encode the slash to make it a single path segment/parameter
+  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
+  req.url = req.url.replace(/^\/%40/, '/@').replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
+  if (original !== req.url) {
+    debug('encodeScopePackage: %o -> %o', original, req.url);
+  } else {
+    debug('encodeScopePackage: %o (unchanged)', original);
   }
-  debug('encodeScopePackage: %o -> %o', original, req.url);
   next();
 }
 //# sourceMappingURL=encode-pkg.js.map

package/build/middlewares/encode-pkg.js.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.js","names":["_debug","_interopRequireDefault","require","e","__esModule","default","debug","buildDebug","encodeScopePackage","req","res","next","original","url","indexOf","replace"],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  if (req.url.indexOf('%40') !== -1) {\n    req.url = req.url.replace(/^\\/%40/, '/@');\n  }\n  if (req.url.indexOf('@') !== -1) {\n    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n    req.url = req.url.replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n  }\n  debug('encodeScopePackage: %o -> %o', original, req.url);\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAA+B,SAAAD,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI/B,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,MAAMC,QAAQ,GAAGH,GAAG,CAACI,GAAG;EACxB;EACA;EACA,IAAIJ,GAAG,CAACI,GAAG,CAACC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE;IACjCL,GAAG,CAACI,GAAG,GAAGJ,GAAG,CAACI,GAAG,CAACE,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;EAC3C;EACA,IAAIN,GAAG,CAACI,GAAG,CAACC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE;IAC/B;IACAL,GAAG,CAACI,GAAG,GAAGJ,GAAG,CAACI,GAAG,CAACE,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAC5D;EACAT,KAAK,CAAC,8BAA8B,EAAEM,QAAQ,EAAEH,GAAG,CAACI,GAAG,CAAC;EACxDF,IAAI,CAAC,CAAC;AACR","ignoreList":[]}
+{"version":3,"file":"encode-pkg.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","encodeScopePackage","req","res","next","original","url","startsWith","errorUtils","getBadRequest","replace"],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  req.url = req.url.replace(/^\\/%40/, '/@').replace(/^(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAA6C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;;AAEvD;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAChCC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,MAAMC,QAAQ,GAAGH,GAAG,CAACI,GAAG;;EAExB;EACA,IAAI,CAACJ,GAAG,CAACI,GAAG,CAACC,UAAU,CAAC,GAAG,CAAC,EAAE;IAC5B,OAAOH,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,gBAAgBP,GAAG,CAACI,GAAG,qBAAqB,CAAC,CAAC;EACrF;;EAEA;EACA;EACA;EACA;EACAJ,GAAG,CAACI,GAAG,GAAGJ,GAAG,CAACI,GAAG,CAACI,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAACA,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;EAElF,IAAIL,QAAQ,KAAKH,GAAG,CAACI,GAAG,EAAE;IACxBP,KAAK,CAAC,8BAA8B,EAAEM,QAAQ,EAAEH,GAAG,CAACI,GAAG,CAAC;EAC1D,CAAC,MAAM;IACLP,KAAK,CAAC,oCAAoC,EAAEM,QAAQ,CAAC;EACvD;EACAD,IAAI,CAAC,CAAC;AACR","ignoreList":[]}

package/build/middlewares/log.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.log = exports.LOG_VERDACCIO_ERROR = exports.LOG_VERDACCIO_BYTES = exports.LOG_STATUS_MESSAGE = void 0;
 var _lodash = _interopRequireDefault(require("lodash"));
+var _core = require("@verdaccio/core");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 // FIXME: deprecated, moved to @verdaccio/dev-commons
 const LOG_STATUS_MESSAGE = exports.LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
@@ -51,7 +52,7 @@ const log = logger => {
       _write.apply(res, arguments);
     };
     const log = function () {
-      const forwardedFor = req.get('x-forwarded-for');
+      const forwardedFor = req.get(_core.HEADERS.FORWARDED_FOR);
       const remoteAddress = req.connection.remoteAddress;
       const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
       let message;

package/build/middlewares/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","names":["_lodash","_interopRequireDefault","require","e","__esModule","default","LOG_STATUS_MESSAGE","exports","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","logger","req","res","next","child","sub","_auth","headers","authorization","_","isNil","_cookie","get","cookie","url","originalUrl","info","ip","bytesin","on","chunk","length","bytesout","_write","write","buf","apply","arguments","forwardedFor","remoteAddress","connection","remoteIP","message","locals","_verdaccio_error","http","request","method","user","remote_user","name","status","statusCode","error","bytes","in","out","_end","end"],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport const log = (logger) => {\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (_.isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (_.isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    req.originalUrl = req.url;\n\n    if (_.isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (_.isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // FIXME: res.write should return boolean\n    // @ts-ignore\n    res.write = function (buf): boolean {\n      bytesout += buf.length;\n      /* eslint prefer-rest-params: \"off\" */\n      // @ts-ignore\n      _write.apply(res, arguments);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get('x-forwarded-for');\n      const remoteAddress = req.connection.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      req.log.http(\n        {\n          request: {\n            method: req.method,\n            url: req.url,\n          },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: {\n            in: bytesin,\n            out: bytesout,\n          },\n        },\n        message\n      );\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (buf): void {\n      if (buf) {\n        bytesout += buf.length;\n      }\n      /* eslint prefer-rest-params: \"off\" */\n      // @ts-ignore\n      _end.apply(res, arguments);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAAuB,SAAAD,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAIvB;AACO,MAAMG,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAC7B,gFAAgF;AAC3E,MAAME,mBAAmB,GAAAD,OAAA,CAAAC,mBAAA,GAAG,GAAGF,kBAAkB,oBAAoB;AACrE,MAAMG,mBAAmB,GAAAF,OAAA,CAAAE,mBAAA,GAAG,GAAGH,kBAAkB,mCAAmC;AAEpF,MAAMI,GAAG,GAAIC,MAAM,IAAK;EAC7B,OAAO,SAASD,GAAGA,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IAC3F;IACAF,GAAG,CAACF,GAAG,GAAGC,MAAM,CAACI,KAAK,CAAC;MAAEC,GAAG,EAAE;IAAK,CAAC,CAAC;IAErC,MAAMC,KAAK,GAAGL,GAAG,CAACM,OAAO,CAACC,aAAa;IACvC,IAAIC,eAAC,CAACC,KAAK,CAACJ,KAAK,CAAC,KAAK,KAAK,EAAE;MAC5BL,GAAG,CAACM,OAAO,CAACC,aAAa,GAAG,cAAc;IAC5C;IAEA,MAAMG,OAAO,GAAGV,GAAG,CAACW,GAAG,CAAC,QAAQ,CAAC;IACjC,IAAIH,eAAC,CAACC,KAAK,CAACC,OAAO,CAAC,KAAK,KAAK,EAAE;MAC9BV,GAAG,CAACM,OAAO,CAACM,MAAM,GAAG,cAAc;IACrC;IAEAZ,GAAG,CAACa,GAAG,GAAGb,GAAG,CAACc,WAAW;IACzBd,GAAG,CAACF,GAAG,CAACiB,IAAI,CAAC;MAAEf,GAAG,EAAEA,GAAG;MAAEgB,EAAE,EAAEhB,GAAG,CAACgB;IAAG,CAAC,EAAE,4CAA4C,CAAC;IACpFhB,GAAG,CAACc,WAAW,GAAGd,GAAG,CAACa,GAAG;IAEzB,IAAIL,eAAC,CAACC,KAAK,CAACJ,KAAK,CAAC,KAAK,KAAK,EAAE;MAC5BL,GAAG,CAACM,OAAO,CAACC,aAAa,GAAGF,KAAK;IACnC;IAEA,IAAIG,eAAC,CAACC,KAAK,CAACC,OAAO,CAAC,KAAK,KAAK,EAAE;MAC9BV,GAAG,CAACM,OAAO,CAACM,MAAM,GAAGF,OAAO;IAC9B;IAEA,IAAIO,OAAO,GAAG,CAAC;IACfjB,GAAG,CAACkB,EAAE,CAAC,MAAM,EAAE,UAAUC,KAAK,EAAQ;MACpCF,OAAO,IAAIE,KAAK,CAACC,MAAM;IACzB,CAAC,CAAC;IAEF,IAAIC,QAAQ,GAAG,CAAC;IAChB,MAAMC,MAAM,GAAGrB,GAAG,CAACsB,KAAK;IACxB;IACA;IACAtB,GAAG,CAACsB,KAAK,GAAG,UAAUC,GAAG,EAAW;MAClCH,QAAQ,IAAIG,GAAG,CAACJ,MAAM;MACtB;MACA;MACAE,MAAM,CAACG,KAAK,CAACxB,GAAG,EAAEyB,SAAS,CAAC;IAC9B,CAAC;IAED,MAAM5B,GAAG,GAAG,SAAAA,CAAA,EAAkB;MAC5B,MAAM6B,YAAY,GAAG3B,GAAG,CAACW,GAAG,CAAC,iBAAiB,CAAC;MAC/C,MAAMiB,aAAa,GAAG5B,GAAG,CAAC6B,UAAU,CAACD,aAAa;MAClD,MAAME,QAAQ,GAAGH,YAAY,GAAG,GAAGA,YAAY,QAAQC,aAAa,EAAE,GAAGA,aAAa;MACtF,IAAIG,OAAO;MACX,IAAI9B,GAAG,CAAC+B,MAAM,CAACC,gBAAgB,EAAE;QAC/BF,OAAO,GAAGnC,mBAAmB;MAC/B,CAAC,MAAM;QACLmC,OAAO,GAAGlC,mBAAmB;MAC/B;MAEAG,GAAG,CAACa,GAAG,GAAGb,GAAG,CAACc,WAAW;MACzBd,GAAG,CAACF,GAAG,CAACoC,IAAI,CACV;QACEC,OAAO,EAAE;UACPC,MAAM,EAAEpC,GAAG,CAACoC,MAAM;UAClBvB,GAAG,EAAEb,GAAG,CAACa;QACX,CAAC;QACDwB,IAAI,EAAErC,GAAG,CAACsC,WAAW,EAAEC,IAAI,IAAI,IAAI;QACnCT,QAAQ;QACRU,MAAM,EAAEvC,GAAG,CAACwC,UAAU;QACtBC,KAAK,EAAEzC,GAAG,CAAC+B,MAAM,CAACC,gBAAgB;QAClCU,KAAK,EAAE;UACLC,EAAE,EAAE3B,OAAO;UACX4B,GAAG,EAAExB;QACP;MACF,CAAC,EACDU,OACF,CAAC;MACD/B,GAAG,CAACc,WAAW,GAAGd,GAAG,CAACa,GAAG;IAC3B,CAAC;IAEDb,GAAG,CAACkB,EAAE,CAAC,OAAO,EAAE,YAAkB;MAChCpB,GAAG,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAMgD,IAAI,GAAG7C,GAAG,CAAC8C,GAAG;IACpB;IACA9C,GAAG,CAAC8C,GAAG,GAAG,UAAUvB,GAAG,EAAQ;MAC7B,IAAIA,GAAG,EAAE;QACPH,QAAQ,IAAIG,GAAG,CAACJ,MAAM;MACxB;MACA;MACA;MACA0B,IAAI,CAACrB,KAAK,CAACxB,GAAG,EAAEyB,SAAS,CAAC;MAC1B5B,GAAG,CAAC,CAAC;IACP,CAAC;IACDI,IAAI,CAAC,CAAC;EACR,CAAC;AACH,CAAC;AAACP,OAAA,CAAAG,GAAA,GAAAA,GAAA","ignoreList":[]}
+{"version":3,"file":"log.js","names":["_lodash","_interopRequireDefault","require","_core","e","__esModule","default","LOG_STATUS_MESSAGE","exports","LOG_VERDACCIO_ERROR","LOG_VERDACCIO_BYTES","log","logger","req","res","next","child","sub","_auth","headers","authorization","_","isNil","_cookie","get","cookie","url","originalUrl","info","ip","bytesin","on","chunk","length","bytesout","_write","write","buf","apply","arguments","forwardedFor","HEADERS","FORWARDED_FOR","remoteAddress","connection","remoteIP","message","locals","_verdaccio_error","http","request","method","user","remote_user","name","status","statusCode","error","bytes","in","out","_end","end"],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport const log = (logger) => {\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (_.isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (_.isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    req.originalUrl = req.url;\n\n    if (_.isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (_.isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // FIXME: res.write should return boolean\n    // @ts-ignore\n    res.write = function (buf): boolean {\n      bytesout += buf.length;\n      /* eslint prefer-rest-params: \"off\" */\n      // @ts-ignore\n      _write.apply(res, arguments);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.connection.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      req.log.http(\n        {\n          request: {\n            method: req.method,\n            url: req.url,\n          },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: {\n            in: bytesin,\n            out: bytesout,\n          },\n        },\n        message\n      );\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (buf): void {\n      if (buf) {\n        bytesout += buf.length;\n      }\n      /* eslint prefer-rest-params: \"off\" */\n      // @ts-ignore\n      _end.apply(res, arguments);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAA0C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI1C;AACO,MAAMG,kBAAkB,GAAAC,OAAA,CAAAD,kBAAA,GAC7B,gFAAgF;AAC3E,MAAME,mBAAmB,GAAAD,OAAA,CAAAC,mBAAA,GAAG,GAAGF,kBAAkB,oBAAoB;AACrE,MAAMG,mBAAmB,GAAAF,OAAA,CAAAE,mBAAA,GAAG,GAAGH,kBAAkB,mCAAmC;AAEpF,MAAMI,GAAG,GAAIC,MAAM,IAAK;EAC7B,OAAO,SAASD,GAAGA,CAACE,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IAC3F;IACAF,GAAG,CAACF,GAAG,GAAGC,MAAM,CAACI,KAAK,CAAC;MAAEC,GAAG,EAAE;IAAK,CAAC,CAAC;IAErC,MAAMC,KAAK,GAAGL,GAAG,CAACM,OAAO,CAACC,aAAa;IACvC,IAAIC,eAAC,CAACC,KAAK,CAACJ,KAAK,CAAC,KAAK,KAAK,EAAE;MAC5BL,GAAG,CAACM,OAAO,CAACC,aAAa,GAAG,cAAc;IAC5C;IAEA,MAAMG,OAAO,GAAGV,GAAG,CAACW,GAAG,CAAC,QAAQ,CAAC;IACjC,IAAIH,eAAC,CAACC,KAAK,CAACC,OAAO,CAAC,KAAK,KAAK,EAAE;MAC9BV,GAAG,CAACM,OAAO,CAACM,MAAM,GAAG,cAAc;IACrC;IAEAZ,GAAG,CAACa,GAAG,GAAGb,GAAG,CAACc,WAAW;IACzBd,GAAG,CAACF,GAAG,CAACiB,IAAI,CAAC;MAAEf,GAAG,EAAEA,GAAG;MAAEgB,EAAE,EAAEhB,GAAG,CAACgB;IAAG,CAAC,EAAE,4CAA4C,CAAC;IACpFhB,GAAG,CAACc,WAAW,GAAGd,GAAG,CAACa,GAAG;IAEzB,IAAIL,eAAC,CAACC,KAAK,CAACJ,KAAK,CAAC,KAAK,KAAK,EAAE;MAC5BL,GAAG,CAACM,OAAO,CAACC,aAAa,GAAGF,KAAK;IACnC;IAEA,IAAIG,eAAC,CAACC,KAAK,CAACC,OAAO,CAAC,KAAK,KAAK,EAAE;MAC9BV,GAAG,CAACM,OAAO,CAACM,MAAM,GAAGF,OAAO;IAC9B;IAEA,IAAIO,OAAO,GAAG,CAAC;IACfjB,GAAG,CAACkB,EAAE,CAAC,MAAM,EAAE,UAAUC,KAAK,EAAQ;MACpCF,OAAO,IAAIE,KAAK,CAACC,MAAM;IACzB,CAAC,CAAC;IAEF,IAAIC,QAAQ,GAAG,CAAC;IAChB,MAAMC,MAAM,GAAGrB,GAAG,CAACsB,KAAK;IACxB;IACA;IACAtB,GAAG,CAACsB,KAAK,GAAG,UAAUC,GAAG,EAAW;MAClCH,QAAQ,IAAIG,GAAG,CAACJ,MAAM;MACtB;MACA;MACAE,MAAM,CAACG,KAAK,CAACxB,GAAG,EAAEyB,SAAS,CAAC;IAC9B,CAAC;IAED,MAAM5B,GAAG,GAAG,SAAAA,CAAA,EAAkB;MAC5B,MAAM6B,YAAY,GAAG3B,GAAG,CAACW,GAAG,CAACiB,aAAO,CAACC,aAAa,CAAC;MACnD,MAAMC,aAAa,GAAG9B,GAAG,CAAC+B,UAAU,CAACD,aAAa;MAClD,MAAME,QAAQ,GAAGL,YAAY,GAAG,GAAGA,YAAY,QAAQG,aAAa,EAAE,GAAGA,aAAa;MACtF,IAAIG,OAAO;MACX,IAAIhC,GAAG,CAACiC,MAAM,CAACC,gBAAgB,EAAE;QAC/BF,OAAO,GAAGrC,mBAAmB;MAC/B,CAAC,MAAM;QACLqC,OAAO,GAAGpC,mBAAmB;MAC/B;MAEAG,GAAG,CAACa,GAAG,GAAGb,GAAG,CAACc,WAAW;MACzBd,GAAG,CAACF,GAAG,CAACsC,IAAI,CACV;QACEC,OAAO,EAAE;UACPC,MAAM,EAAEtC,GAAG,CAACsC,MAAM;UAClBzB,GAAG,EAAEb,GAAG,CAACa;QACX,CAAC;QACD0B,IAAI,EAAEvC,GAAG,CAACwC,WAAW,EAAEC,IAAI,IAAI,IAAI;QACnCT,QAAQ;QACRU,MAAM,EAAEzC,GAAG,CAAC0C,UAAU;QACtBC,KAAK,EAAE3C,GAAG,CAACiC,MAAM,CAACC,gBAAgB;QAClCU,KAAK,EAAE;UACLC,EAAE,EAAE7B,OAAO;UACX8B,GAAG,EAAE1B;QACP;MACF,CAAC,EACDY,OACF,CAAC;MACDjC,GAAG,CAACc,WAAW,GAAGd,GAAG,CAACa,GAAG;IAC3B,CAAC;IAEDb,GAAG,CAACkB,EAAE,CAAC,OAAO,EAAE,YAAkB;MAChCpB,GAAG,CAAC,CAAC;IACP,CAAC,CAAC;IAEF,MAAMkD,IAAI,GAAG/C,GAAG,CAACgD,GAAG;IACpB;IACAhD,GAAG,CAACgD,GAAG,GAAG,UAAUzB,GAAG,EAAQ;MAC7B,IAAIA,GAAG,EAAE;QACPH,QAAQ,IAAIG,GAAG,CAACJ,MAAM;MACxB;MACA;MACA;MACA4B,IAAI,CAACvB,KAAK,CAACxB,GAAG,EAAEyB,SAAS,CAAC;MAC1B5B,GAAG,CAAC,CAAC;IACP,CAAC;IACDI,IAAI,CAAC,CAAC;EACR,CAAC;AACH,CAAC;AAACP,OAAA,CAAAG,GAAA,GAAAA,GAAA","ignoreList":[]}

package/build/middlewares/make-url-relative.d.ts

@@ -0,0 +1,8 @@
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+/**
+ * Removes the host from the URL and turns it into a relative URL.
+ * @param req
+ * @param res
+ * @param next
+ */
+export declare function makeURLrelative(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/make-url-relative.js

@@ -0,0 +1,45 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.makeURLrelative = makeURLrelative;
+var _debug = _interopRequireDefault(require("debug"));
+var _nodeUrl = require("node:url");
+var _core = require("@verdaccio/core");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const debug = (0, _debug.default)('verdaccio:middleware:make-url-relative');
+
+/**
+ * Removes the host from the URL and turns it into a relative URL.
+ * @param req
+ * @param res
+ * @param next
+ */
+function makeURLrelative(req, res, next) {
+  const original = req.url;
+
+  // npm requests can contain the full URL, including the hostname, for example:
+  // tarball downloads. Removing the hostname makes the URL relative and allows
+  // the application to handle requests in a more consistent way.
+
+  let url;
+  try {
+    // In productive use, the URL is absolute (and base will be ignored)
+    // In tests, the URL might brelative (and base will be used)
+    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base
+    url = new _nodeUrl.URL(req.url, `${req.protocol}://${req.headers.host}/`);
+  } catch (error) {
+    return next(_core.errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));
+  }
+
+  // Rebuild the URL without hostname
+  req.url = url.pathname + url.search + url.hash;
+  if (original !== req.url) {
+    debug('makeURLrelative: %o -> %o', original, req.url);
+  } else {
+    debug('makeURLrelative: %o (unchanged)', original);
+  }
+  next();
+}
+//# sourceMappingURL=make-url-relative.js.map

package/build/middlewares/make-url-relative.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-url-relative.js","names":["_debug","_interopRequireDefault","require","_nodeUrl","_core","e","__esModule","default","debug","buildDebug","makeURLrelative","req","res","next","original","url","URL","protocol","headers","host","error","errorUtils","getBadRequest","pathname","search","hash"],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,wCAAwC,CAAC;;AAElE;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,eAAeA,CAC7BC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,MAAMC,QAAQ,GAAGH,GAAG,CAACI,GAAG;;EAExB;EACA;EACA;;EAEA,IAAIA,GAAG;EACP,IAAI;IACF;IACA;IACA;IACAA,GAAG,GAAG,IAAIC,YAAG,CAACL,GAAG,CAACI,GAAG,EAAE,GAAGJ,GAAG,CAACM,QAAQ,MAAMN,GAAG,CAACO,OAAO,CAACC,IAAI,GAAG,CAAC;EAClE,CAAC,CAAC,OAAOC,KAAK,EAAE;IACd,OAAOP,IAAI,CAACQ,gBAAU,CAACC,aAAa,CAAC,gBAAgBX,GAAG,CAACI,GAAG,KAAKK,KAAK,GAAG,CAAC,CAAC;EAC7E;;EAEA;EACAT,GAAG,CAACI,GAAG,GAAGA,GAAG,CAACQ,QAAQ,GAAGR,GAAG,CAACS,MAAM,GAAGT,GAAG,CAACU,IAAI;EAE9C,IAAIX,QAAQ,KAAKH,GAAG,CAACI,GAAG,EAAE;IACxBP,KAAK,CAAC,2BAA2B,EAAEM,QAAQ,EAAEH,GAAG,CAACI,GAAG,CAAC;EACvD,CAAC,MAAM;IACLP,KAAK,CAAC,iCAAiC,EAAEM,QAAQ,CAAC;EACpD;EACAD,IAAI,CAAC,CAAC;AACR","ignoreList":[]}

package/build/middlewares/user-agent.js

@@ -5,9 +5,10 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.userAgent = userAgent;
 var _config = require("@verdaccio/config");
+var _core = require("@verdaccio/core");
 function userAgent(config) {
   return function (_req, res, next) {
-    res.setHeader('x-powered-by', (0, _config.getUserAgent)(config?.user_agent));
+    res.setHeader(_core.HEADERS.POWERED_BY, (0, _config.getUserAgent)(config?.user_agent));
     next();
   };
 }

package/build/middlewares/user-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-agent.js","names":["_config","require","userAgent","config","_req","res","next","setHeader","getUserAgent","user_agent"],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader('x-powered-by', getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAIO,SAASC,SAASA,CAACC,MAAM,EAAE;EAChC,OAAO,UAAUC,IAAoB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACzFD,GAAG,CAACE,SAAS,CAAC,cAAc,EAAE,IAAAC,oBAAY,EAACL,MAAM,EAAEM,UAAU,CAAC,CAAC;IAC/DH,IAAI,CAAC,CAAC;EACR,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"user-agent.js","names":["_config","require","_core","userAgent","config","_req","res","next","setHeader","HEADERS","POWERED_BY","getUserAgent","user_agent"],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAIO,SAASE,SAASA,CAACC,MAAM,EAAE;EAChC,OAAO,UAAUC,IAAoB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACzFD,GAAG,CAACE,SAAS,CAACC,aAAO,CAACC,UAAU,EAAE,IAAAC,oBAAY,EAACP,MAAM,EAAEQ,UAAU,CAAC,CAAC;IACnEL,IAAI,CAAC,CAAC;EACR,CAAC;AACH","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "8.0.0-next-8.3",
+  "version": "8.0.0-next-8.5",
   "description": "express middleware utils",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,12 +29,12 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/config": "8.0.0-next-8.3",
-    "@verdaccio/core": "8.0.0-next-8.3",
-    "@verdaccio/url": "13.0.0-next-8.3",
-    "@verdaccio/utils": "8.1.0-next-8.3",
+    "@verdaccio/config": "8.0.0-next-8.5",
+    "@verdaccio/core": "8.0.0-next-8.5",
+    "@verdaccio/url": "13.0.0-next-8.5",
+    "@verdaccio/utils": "8.1.0-next-8.5",
     "debug": "4.3.7",
-    "express": "4.21.0",
+    "express": "4.21.1",
     "express-rate-limit": "5.5.1",
     "lodash": "4.17.21",
     "lru-cache": "7.18.3",
@@ -45,7 +45,7 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@verdaccio/logger": "8.0.0-next-8.3",
+    "@verdaccio/logger": "8.0.0-next-8.5",
     "body-parser": "1.20.3",
     "supertest": "7.0.0",
     "jsdom": "25.0.1"
@@ -57,7 +57,6 @@
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
     "watch": "pnpm build:js -- --watch",
     "test": "vitest run",
-    "test:snap": "jest --updateSnapshot",
     "build": "pnpm run build:js && pnpm run build:types"
   }
 }

package/src/index.ts

@@ -2,6 +2,7 @@ export { match } from './middlewares/match';
 export { setSecurityWebHeaders } from './middlewares/security-headers';
 export { validateName, validatePackage } from './middlewares/validation';
 export { media } from './middlewares/media';
+export { makeURLrelative } from './middlewares/make-url-relative';
 export { encodeScopePackage } from './middlewares/encode-pkg';
 export { expectJson } from './middlewares/json';
 export { antiLoop } from './middlewares/antiLoop';

package/src/middlewares/encode-pkg.ts

@@ -1,5 +1,7 @@
 import buildDebug from 'debug';
 
+import { errorUtils } from '@verdaccio/core';
+
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 
 const debug = buildDebug('verdaccio:middleware:encode');
@@ -16,15 +18,22 @@ export function encodeScopePackage(
   next: $NextFunctionVer
 ): void {
   const original = req.url;
+
+  // Expect relative URLs i.e. should call makeURLrelative before this middleware
+  if (!req.url.startsWith('/')) {
+    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));
+  }
+
   // If the @ sign is encoded, we need to decode it first
   // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3
-  if (req.url.indexOf('%40') !== -1) {
-    req.url = req.url.replace(/^\/%40/, '/@');
-  }
-  if (req.url.indexOf('@') !== -1) {
-    // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
-    req.url = req.url.replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
+  // For scoped packages, encode the slash to make it a single path segment/parameter
+  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3
+  req.url = req.url.replace(/^\/%40/, '/@').replace(/^(\/@[^\/%]+)\/(?!$)/, '$1%2F');
+
+  if (original !== req.url) {
+    debug('encodeScopePackage: %o -> %o', original, req.url);
+  } else {
+    debug('encodeScopePackage: %o (unchanged)', original);
   }
-  debug('encodeScopePackage: %o -> %o', original, req.url);
   next();
 }

package/src/middlewares/log.ts

@@ -1,5 +1,7 @@
 import _ from 'lodash';
 
+import { HEADERS } from '@verdaccio/core';
+
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 
 // FIXME: deprecated, moved to @verdaccio/dev-commons
@@ -52,7 +54,7 @@ export const log = (logger) => {
     };
 
     const log = function (): void {
-      const forwardedFor = req.get('x-forwarded-for');
+      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);
       const remoteAddress = req.connection.remoteAddress;
       const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
       let message;

package/src/middlewares/make-url-relative.ts

@@ -0,0 +1,46 @@
+import buildDebug from 'debug';
+import { URL } from 'node:url';
+
+import { errorUtils } from '@verdaccio/core';
+
+import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+
+const debug = buildDebug('verdaccio:middleware:make-url-relative');
+
+/**
+ * Removes the host from the URL and turns it into a relative URL.
+ * @param req
+ * @param res
+ * @param next
+ */
+export function makeURLrelative(
+  req: $RequestExtend,
+  res: $ResponseExtend,
+  next: $NextFunctionVer
+): void {
+  const original = req.url;
+
+  // npm requests can contain the full URL, including the hostname, for example:
+  // tarball downloads. Removing the hostname makes the URL relative and allows
+  // the application to handle requests in a more consistent way.
+
+  let url;
+  try {
+    // In productive use, the URL is absolute (and base will be ignored)
+    // In tests, the URL might brelative (and base will be used)
+    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base
+    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);
+  } catch (error) {
+    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));
+  }
+
+  // Rebuild the URL without hostname
+  req.url = url.pathname + url.search + url.hash;
+
+  if (original !== req.url) {
+    debug('makeURLrelative: %o -> %o', original, req.url);
+  } else {
+    debug('makeURLrelative: %o (unchanged)', original);
+  }
+  next();
+}

package/src/middlewares/user-agent.ts

@@ -1,10 +1,11 @@
 import { getUserAgent } from '@verdaccio/config';
+import { HEADERS } from '@verdaccio/core';
 
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 
 export function userAgent(config) {
   return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {
-    res.setHeader('x-powered-by', getUserAgent(config?.user_agent));
+    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));
     next();
   };
 }

package/test/encode.spec.ts

@@ -1,16 +1,15 @@
 import request from 'supertest';
-import { expect, test } from 'vitest';
+import { describe, expect, test } from 'vitest';
 
 import { HTTP_STATUS } from '@verdaccio/core';
 
 import { encodeScopePackage } from '../src';
 import { getApp } from './helper';
 
-test('encode is json', async () => {
+test('encode is json with relative path', async () => {
   const app = getApp([]);
   // @ts-ignore
   app.use(encodeScopePackage);
-  // @ts-ignore
   app.get('/:id', (req, res) => {
     const { id } = req.params;
     res.status(HTTP_STATUS.OK).json({ id });
@@ -21,84 +20,112 @@ test('encode is json', async () => {
   expect(res.status).toEqual(HTTP_STATUS.OK);
 });
 
-test('packages with version/scope', async () => {
+describe('packages requests', () => {
   const app = getApp([]);
   // @ts-ignore
   app.use(encodeScopePackage);
-  // @ts-ignore
   app.get('/:package/:version?', (req, res) => {
     const { package: pkg, version } = req.params;
     res.status(HTTP_STATUS.OK).json({ package: pkg, version });
   });
 
-  const res = await request(app).get('/foo');
-  expect(res.body).toEqual({ package: 'foo' });
-  expect(res.status).toEqual(HTTP_STATUS.OK);
+  test('just package', async () => {
+    const res = await request(app).get('/foo');
+    expect(res.body).toEqual({ package: 'foo' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res2 = await request(app).get('/foo/1.0.0');
-  expect(res2.body).toEqual({ package: 'foo', version: '1.0.0' });
-  expect(res2.status).toEqual(HTTP_STATUS.OK);
+  test('package with version', async () => {
+    const res = await request(app).get('/foo/1.0.0');
+    expect(res.body).toEqual({ package: 'foo', version: '1.0.0' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res3 = await request(app).get('/@scope/foo');
-  expect(res3.body).toEqual({ package: '@scope/foo' });
-  expect(res3.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package', async () => {
+    const res = await request(app).get('/@scope/foo');
+    expect(res.body).toEqual({ package: '@scope/foo' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res4 = await request(app).get('/@scope/foo/1.0.0');
-  expect(res4.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
-  expect(res4.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with version', async () => {
+    const res = await request(app).get('/@scope/foo/1.0.0');
+    expect(res.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res5 = await request(app).get('/@scope%2ffoo');
-  expect(res5.body).toEqual({ package: '@scope/foo' });
-  expect(res5.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with encoded path', async () => {
+    const res = await request(app).get('/@scope%2ffoo');
+    expect(res.body).toEqual({ package: '@scope/foo' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res6 = await request(app).get('/@scope%2ffoo/1.0.0');
-  expect(res6.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
-  expect(res6.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package and version with encoded path', async () => {
+    const res = await request(app).get('/@scope%2ffoo/1.0.0');
+    expect(res.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res7 = await request(app).get('/%40scope%2ffoo');
-  expect(res7.body).toEqual({ package: '@scope/foo' });
-  expect(res7.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with encoded @ and path ', async () => {
+    const res = await request(app).get('/%40scope%2ffoo');
+    expect(res.body).toEqual({ package: '@scope/foo' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res8 = await request(app).get('/%40scope%2ffoo/1.0.0');
-  expect(res8.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
-  expect(res8.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package and version with encoded @ and path', async () => {
+    const res = await request(app).get('/%40scope%2ffoo/1.0.0');
+    expect(res.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res9 = await request(app).get('/%40scope/foo');
-  expect(res9.body).toEqual({ package: '@scope/foo' });
-  expect(res9.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with encoded @', async () => {
+    const res = await request(app).get('/%40scope/foo');
+    expect(res.body).toEqual({ package: '@scope/foo' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res10 = await request(app).get('/%40scope/foo/1.0.0');
-  expect(res10.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
-  expect(res10.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package and version with encoded @', async () => {
+    const res = await request(app).get('/%40scope/foo/1.0.0');
+    expect(res.body).toEqual({ package: '@scope/foo', version: '1.0.0' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 });
 
-test('tarballs with and without scope', async () => {
+describe('tarball requests', () => {
   const app = getApp([]);
   // @ts-ignore
   app.use(encodeScopePackage);
-  // @ts-ignore
   app.get('/:package/-/:filename', (req, res) => {
     const { package: pkg, filename } = req.params;
     res.status(HTTP_STATUS.OK).json({ package: pkg, filename });
   });
 
-  const res = await request(app).get('/foo/-/foo-1.2.3.tgz');
-  expect(res.body).toEqual({ package: 'foo', filename: 'foo-1.2.3.tgz' });
-  expect(res.status).toEqual(HTTP_STATUS.OK);
+  test('just package', async () => {
+    const res = await request(app).get('/foo/-/foo-1.2.3.tgz');
+    expect(res.body).toEqual({ package: 'foo', filename: 'foo-1.2.3.tgz' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res2 = await request(app).get('/@scope/foo/-/foo-1.2.3.tgz');
-  expect(res2.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
-  expect(res2.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package', async () => {
+    const res = await request(app).get('/@scope/foo/-/foo-1.2.3.tgz');
+    expect(res.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res3 = await request(app).get('/@scope%2ffoo/-/foo-1.2.3.tgz');
-  expect(res3.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
-  expect(res3.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with encoded path', async () => {
+    const res = await request(app).get('/@scope%2ffoo/-/foo-1.2.3.tgz');
+    expect(res.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res4 = await request(app).get('/%40scope%2ffoo/-/foo-1.2.3.tgz');
-  expect(res4.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
-  expect(res4.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with encoded @ and path', async () => {
+    const res = await request(app).get('/%40scope%2ffoo/-/foo-1.2.3.tgz');
+    expect(res.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 
-  const res5 = await request(app).get('/%40scope/foo/-/foo-1.2.3.tgz');
-  expect(res5.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
-  expect(res5.status).toEqual(HTTP_STATUS.OK);
+  test('scoped package with encoded @', async () => {
+    const res = await request(app).get('/%40scope/foo/-/foo-1.2.3.tgz');
+    expect(res.body).toEqual({ package: '@scope/foo', filename: 'foo-1.2.3.tgz' });
+    expect(res.status).toEqual(HTTP_STATUS.OK);
+  });
 });

package/test/make-url-relative.spec.ts

@@ -0,0 +1,42 @@
+import request from 'supertest';
+import { expect, test } from 'vitest';
+
+import { HEADERS, HTTP_STATUS } from '@verdaccio/core';
+
+import { makeURLrelative } from '../src';
+import { getApp } from './helper';
+
+const testHosts = [
+  'localhost:4873', // with port
+  'myregistry.com', // no port
+  '42.42.42.42', // ip
+  '[2001:db8:85a3:8d3:1319:8a2e:370:7348]:443', // ip6
+];
+
+test.each([testHosts])('remove host from url', async (host) => {
+  const app = getApp([]);
+  // @ts-ignore
+  app.use(makeURLrelative);
+  app.get('/:id', (req, res) => {
+    const { id } = req.params;
+    res.status(HTTP_STATUS.OK).json({ id, url: req.url });
+  });
+
+  const res = await request(app).get('/foo').set(HEADERS.HOST, host);
+  expect(res.body).toEqual({ id: 'foo', url: '/foo' });
+  expect(res.status).toEqual(HTTP_STATUS.OK);
+});
+
+test('invalid url', async () => {
+  const app = getApp([]);
+  // @ts-ignore
+  app.use(makeURLrelative);
+  app.get('/:id', (req, res) => {
+    const { id } = req.params;
+    res.status(HTTP_STATUS.OK).json({ id });
+  });
+
+  const res = await request(app).get('/foo').set(HEADERS.HOST, 'invalid::host');
+  expect(res.status).toEqual(HTTP_STATUS.BAD_REQUEST);
+  expect(res.text).toContain('Invalid URL');
+});

package/test/static/runtime.js

@@ -0,0 +1,3 @@
+{
+  runtime: '';
+}

package/test/static/vendors.js

@@ -0,0 +1,3 @@
+{
+  vendors: '';
+}

package/test/static/vendor.js

@@ -1,3 +0,0 @@
-{
-  'vendors': '';
-}