@verdaccio/middleware 8.0.2 → 8.0.4

package/build/index.d.ts

@@ -7,6 +7,8 @@ export { expectJson } from './middlewares/json';
 export { antiLoop } from './middlewares/antiLoop';
 export { final } from './middlewares/final';
 export { allow } from './middlewares/allow';
+export { enforceGeneratedTokenMetadata } from './middlewares/token-auth';
+export type { TokenReadableStorage } from './middlewares/token-auth';
 export { rateLimit } from './middlewares/rate-limit';
 export { registerBodyParser } from './middlewares/body-parser';
 export { userAgent } from './middlewares/user-agent';

package/build/index.js

@@ -14,6 +14,7 @@ var _exportNames = {
   antiLoop: true,
   final: true,
   allow: true,
+  enforceGeneratedTokenMetadata: true,
   rateLimit: true,
   registerBodyParser: true,
   userAgent: true,
@@ -64,6 +65,12 @@ Object.defineProperty(exports, "encodeScopePackage", {
     return _encodePkg.encodeScopePackage;
   }
 });
+Object.defineProperty(exports, "enforceGeneratedTokenMetadata", {
+  enumerable: true,
+  get: function () {
+    return _tokenAuth.enforceGeneratedTokenMetadata;
+  }
+});
 Object.defineProperty(exports, "errorReportingMiddleware", {
   enumerable: true,
   get: function () {
@@ -175,6 +182,7 @@ var _json = require("./middlewares/json");
 var _antiLoop = require("./middlewares/antiLoop");
 var _final = require("./middlewares/final");
 var _allow = require("./middlewares/allow");
+var _tokenAuth = require("./middlewares/token-auth");
 var _rateLimit = require("./middlewares/rate-limit");
 var _bodyParser = require("./middlewares/body-parser");
 var _userAgent = require("./middlewares/user-agent");

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_match","require","_validation","_media","_makeUrlRelative","_encodePkg","_json","_antiLoop","_final","_allow","_rateLimit","_bodyParser","_userAgent","_web","_error","_requestOptions","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_api_urls","_webUrls"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { makeURLrelative } from './middlewares/make-url-relative';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { registerBodyParser } from './middlewares/body-parser';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware, setSecurityWebHeaders } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport { getRequestOptions } from './middlewares/request-options';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\nexport * from './middlewares/api_urls';\nexport * from './middlewares/web/web-urls';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,MAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,UAAA,GAAAT,OAAA;AACA,IAAAU,WAAA,GAAAV,OAAA;AACA,IAAAW,UAAA,GAAAX,OAAA;AACA,IAAAY,IAAA,GAAAZ,OAAA;AACA,IAAAa,MAAA,GAAAb,OAAA;AACA,IAAAc,eAAA,GAAAd,OAAA;AACA,IAAAe,IAAA,GAAAf,OAAA;AAMA,IAAAgB,MAAA,GAAAhB,OAAA;AAAAiB,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AACA,IAAAS,SAAA,GAAA7B,OAAA;AAAAiB,MAAA,CAAAC,IAAA,CAAAW,SAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,SAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAC,SAAA,CAAAT,GAAA;IAAA;EAAA;AAAA;AACA,IAAAU,QAAA,GAAA9B,OAAA;AAAAiB,MAAA,CAAAC,IAAA,CAAAY,QAAA,EAAAX,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAU,QAAA,CAAAV,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAE,QAAA,CAAAV,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}
+{"version":3,"file":"index.js","names":["_match","require","_validation","_media","_makeUrlRelative","_encodePkg","_json","_antiLoop","_final","_allow","_tokenAuth","_rateLimit","_bodyParser","_userAgent","_web","_error","_requestOptions","_log","_types","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_api_urls","_webUrls"],"sources":["../src/index.ts"],"sourcesContent":["export { match } from './middlewares/match';\nexport { validateName, validatePackage } from './middlewares/validation';\nexport { media } from './middlewares/media';\nexport { makeURLrelative } from './middlewares/make-url-relative';\nexport { encodeScopePackage } from './middlewares/encode-pkg';\nexport { expectJson } from './middlewares/json';\nexport { antiLoop } from './middlewares/antiLoop';\nexport { final } from './middlewares/final';\nexport { allow } from './middlewares/allow';\nexport { enforceGeneratedTokenMetadata } from './middlewares/token-auth';\nexport type { TokenReadableStorage } from './middlewares/token-auth';\nexport { rateLimit } from './middlewares/rate-limit';\nexport { registerBodyParser } from './middlewares/body-parser';\nexport { userAgent } from './middlewares/user-agent';\nexport { webMiddleware, renderWebMiddleware, setSecurityWebHeaders } from './middlewares/web';\nexport { errorReportingMiddleware, handleError } from './middlewares/error';\nexport { getRequestOptions } from './middlewares/request-options';\nexport {\n  log,\n  LOG_STATUS_MESSAGE,\n  LOG_VERDACCIO_BYTES,\n  LOG_VERDACCIO_ERROR,\n} from './middlewares/log';\nexport * from './types';\nexport * from './middlewares/api_urls';\nexport * from './middlewares/web/web-urls';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,gBAAA,GAAAH,OAAA;AACA,IAAAI,UAAA,GAAAJ,OAAA;AACA,IAAAK,KAAA,GAAAL,OAAA;AACA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,MAAA,GAAAP,OAAA;AACA,IAAAQ,MAAA,GAAAR,OAAA;AACA,IAAAS,UAAA,GAAAT,OAAA;AAEA,IAAAU,UAAA,GAAAV,OAAA;AACA,IAAAW,WAAA,GAAAX,OAAA;AACA,IAAAY,UAAA,GAAAZ,OAAA;AACA,IAAAa,IAAA,GAAAb,OAAA;AACA,IAAAc,MAAA,GAAAd,OAAA;AACA,IAAAe,eAAA,GAAAf,OAAA;AACA,IAAAgB,IAAA,GAAAhB,OAAA;AAMA,IAAAiB,MAAA,GAAAjB,OAAA;AAAAkB,MAAA,CAAAC,IAAA,CAAAF,MAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,MAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,MAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AACA,IAAAS,SAAA,GAAA9B,OAAA;AAAAkB,MAAA,CAAAC,IAAA,CAAAW,SAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,SAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAC,SAAA,CAAAT,GAAA;IAAA;EAAA;AAAA;AACA,IAAAU,QAAA,GAAA/B,OAAA;AAAAkB,MAAA,CAAAC,IAAA,CAAAY,QAAA,EAAAX,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAU,QAAA,CAAAV,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAE,QAAA,CAAAV,GAAA;IAAA;EAAA;AAAA","ignoreList":[]}

package/build/middlewares/token-auth.d.ts

@@ -0,0 +1,38 @@
+import type { RequestHandler } from 'express';
+import type { Logger, Token } from '@verdaccio/types';
+/**
+ * Minimal storage surface required to enforce generated token metadata. Typed
+ * structurally so this package does not need to depend on `@verdaccio/store`.
+ */
+export interface TokenReadableStorage {
+    /**
+     * Load the generated tokens stored for a user.
+     *
+     * @param filter narrows the lookup to a single `user`
+     * @returns the user's persisted tokens
+     */
+    readTokens(filter: {
+        user: string;
+    }): Promise<Token[]>;
+}
+/**
+ * Express middleware that enforces the metadata of npm-style generated tokens
+ * (created via `POST /-/npm/v1/tokens`).
+ *
+ * A generated token embeds a server-issued `key` that is recovered from the
+ * verified credentials as `remote_user.token.key`. This middleware looks that
+ * key up in storage and rejects the request when the token:
+ * - is missing from storage (revoked or never issued);
+ * - is used from a client address outside its `cidr` whitelist;
+ * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).
+ *
+ * Requests that do not carry a generated token key (e.g. interactive logins)
+ * pass through untouched. It must run after the JWT/auth middleware has
+ * populated `remote_user`. Failures fail closed: a storage lookup error yields
+ * an internal error rather than allowing the request.
+ *
+ * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens
+ * @param logger logger used to record rejected attempts and lookup failures
+ * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject
+ */
+export declare function enforceGeneratedTokenMetadata(storage: TokenReadableStorage, logger: Logger): RequestHandler;

package/build/middlewares/token-auth.js

@@ -0,0 +1,115 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.enforceGeneratedTokenMetadata = enforceGeneratedTokenMetadata;
+var _core = require("@verdaccio/core");
+const WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);
+
+/**
+ * Minimal storage surface required to enforce generated token metadata. Typed
+ * structurally so this package does not need to depend on `@verdaccio/store`.
+ */
+
+/**
+ * Resolve the client address of an incoming request for CIDR matching.
+ *
+ * Uses Express' `req.ip`, which already honors the application's `trust proxy`
+ * setting (`config.server.trustProxy`): when the operator has declared trusted
+ * proxies, `req.ip` is the upstream-most untrusted address parsed from
+ * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded
+ * header is ignored entirely.
+ *
+ * The middleware must NOT read `X-Forwarded-For` on its own — doing so
+ * unconditionally would let any client spoof its address (and bypass a token's
+ * CIDR whitelist) simply by sending the header. Falls back to the raw socket
+ * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via
+ * {@link ipUtils.normalizeAddress}.
+ *
+ * @param req the incoming Express request
+ * @returns the normalized client address, or `undefined` when none can be determined
+ */
+function getClientAddress(req) {
+  return _core.ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);
+}
+
+/**
+ * Find the stored token whose `key` matches the key carried by the request.
+ *
+ * @param tokens the tokens persisted for the authenticated user
+ * @param tokenKey the key extracted from the presented generated token
+ * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed
+ */
+function findToken(tokens, tokenKey) {
+  return tokens.find(({
+    key
+  }) => key === tokenKey);
+}
+
+/**
+ * Express middleware that enforces the metadata of npm-style generated tokens
+ * (created via `POST /-/npm/v1/tokens`).
+ *
+ * A generated token embeds a server-issued `key` that is recovered from the
+ * verified credentials as `remote_user.token.key`. This middleware looks that
+ * key up in storage and rejects the request when the token:
+ * - is missing from storage (revoked or never issued);
+ * - is used from a client address outside its `cidr` whitelist;
+ * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).
+ *
+ * Requests that do not carry a generated token key (e.g. interactive logins)
+ * pass through untouched. It must run after the JWT/auth middleware has
+ * populated `remote_user`. Failures fail closed: a storage lookup error yields
+ * an internal error rather than allowing the request.
+ *
+ * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens
+ * @param logger logger used to record rejected attempts and lookup failures
+ * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject
+ */
+function enforceGeneratedTokenMetadata(storage, logger) {
+  return async function (req, _res, next) {
+    const remoteUser = req.remote_user;
+    const tokenKey = remoteUser?.token?.key;
+    if (!tokenKey) {
+      return next();
+    }
+    const user = remoteUser?.name;
+    if (typeof user !== 'string') {
+      return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
+    }
+    try {
+      const token = findToken(await storage.readTokens({
+        user
+      }), tokenKey);
+      if (!token) {
+        logger.warn({
+          tokenKey,
+          user
+        }, 'generated token @{tokenKey} for user @{user} is missing');
+        return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
+      }
+      if (!_core.ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {
+        logger.warn({
+          tokenKey,
+          user
+        }, 'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist');
+        return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
+      }
+      if (token.readonly && WRITE_METHODS.has(req.method)) {
+        logger.warn({
+          tokenKey,
+          user
+        }, 'readonly generated token @{tokenKey} for user @{user} was used for a write request');
+        return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
+      }
+      return next();
+    } catch (error) {
+      logger.error({
+        error: error.msg
+      }, 'generated token metadata lookup failed: @{error}');
+      return next(_core.errorUtils.getInternalError(error.message));
+    }
+  };
+}
+//# sourceMappingURL=token-auth.js.map

package/build/middlewares/token-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-auth.js","names":["_core","require","WRITE_METHODS","Set","getClientAddress","req","ipUtils","normalizeAddress","ip","socket","remoteAddress","findToken","tokens","tokenKey","find","key","enforceGeneratedTokenMetadata","storage","logger","_res","next","remoteUser","remote_user","token","user","name","errorUtils","getForbidden","API_ERROR","UNAUTHORIZED_ACCESS","readTokens","warn","isAddressAllowed","cidr","readonly","has","method","error","msg","getInternalError","message"],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Uses Express' `req.ip`, which already honors the application's `trust proxy`\n * setting (`config.server.trustProxy`): when the operator has declared trusted\n * proxies, `req.ip` is the upstream-most untrusted address parsed from\n * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded\n * header is ignored entirely.\n *\n * The middleware must NOT read `X-Forwarded-For` on its own — doing so\n * unconditionally would let any client spoof its address (and bypass a token's\n * CIDR whitelist) simply by sending the header. Falls back to the raw socket\n * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via\n * {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAKA,MAAMC,aAAa,GAAG,IAAIC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;;AAEjE;AACA;AACA;AACA;;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,gBAAgBA,CAACC,GAAY,EAAsB;EAC1D,OAAOC,aAAO,CAACC,gBAAgB,CAACF,GAAG,CAACG,EAAE,IAAIH,GAAG,CAACI,MAAM,CAACC,aAAa,CAAC;AACrE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAASC,SAASA,CAACC,MAAe,EAAEC,QAAgB,EAAqB;EACvE,OAAOD,MAAM,CAACE,IAAI,CAAC,CAAC;IAAEC;EAAI,CAAC,KAAKA,GAAG,KAAKF,QAAQ,CAAC;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,6BAA6BA,CAC3CC,OAA6B,EAC7BC,MAAc,EACE;EAChB,OAAO,gBAAgBb,GAAY,EAAEc,IAAc,EAAEC,IAAkB,EAAiB;IACtF,MAAMC,UAAU,GAAIhB,GAAG,CAAoBiB,WAAW;IACtD,MAAMT,QAAQ,GAAGQ,UAAU,EAAEE,KAAK,EAAER,GAAG;IAEvC,IAAI,CAACF,QAAQ,EAAE;MACb,OAAOO,IAAI,CAAC,CAAC;IACf;IAEA,MAAMI,IAAI,GAAGH,UAAU,EAAEI,IAAI;IAE7B,IAAI,OAAOD,IAAI,KAAK,QAAQ,EAAE;MAC5B,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;IACrE;IAEA,IAAI;MACF,MAAMN,KAAK,GAAGZ,SAAS,CAAC,MAAMM,OAAO,CAACa,UAAU,CAAC;QAAEN;MAAK,CAAC,CAAC,EAAEX,QAAQ,CAAC;MAErE,IAAI,CAACU,KAAK,EAAE;QACVL,MAAM,CAACa,IAAI,CAAC;UAAElB,QAAQ;UAAEW;QAAK,CAAC,EAAE,yDAAyD,CAAC;QAC1F,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACrE;MAEA,IAAI,CAACvB,aAAO,CAAC0B,gBAAgB,CAAC5B,gBAAgB,CAACC,GAAG,CAAC,EAAEkB,KAAK,CAACU,IAAI,CAAC,EAAE;QAChEf,MAAM,CAACa,IAAI,CACT;UAAElB,QAAQ;UAAEW;QAAK,CAAC,EAClB,kFACF,CAAC;QACD,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACrE;MAEA,IAAIN,KAAK,CAACW,QAAQ,IAAIhC,aAAa,CAACiC,GAAG,CAAC9B,GAAG,CAAC+B,MAAM,CAAC,EAAE;QACnDlB,MAAM,CAACa,IAAI,CACT;UAAElB,QAAQ;UAAEW;QAAK,CAAC,EAClB,oFACF,CAAC;QACD,OAAOJ,IAAI,CAACM,gBAAU,CAACC,YAAY,CAACC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACrE;MAEA,OAAOT,IAAI,CAAC,CAAC;IACf,CAAC,CAAC,OAAOiB,KAAU,EAAE;MACnBnB,MAAM,CAACmB,KAAK,CAAC;QAAEA,KAAK,EAAEA,KAAK,CAACC;MAAI,CAAC,EAAE,kDAAkD,CAAC;MACtF,OAAOlB,IAAI,CAACM,gBAAU,CAACa,gBAAgB,CAACF,KAAK,CAACG,OAAO,CAAC,CAAC;IACzD;EACF,CAAC;AACH","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "8.0.2",
+  "version": "8.0.4",
   "description": "Verdaccio Express Middleware",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,9 +33,9 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/config": "8.1.1",
-    "@verdaccio/core": "8.1.1",
-    "@verdaccio/url": "13.0.2",
+    "@verdaccio/config": "8.1.2",
+    "@verdaccio/core": "8.1.2",
+    "@verdaccio/url": "13.0.3",
     "debug": "4.4.3",
     "express": "4.22.1",
     "express-rate-limit": "5.5.1",
@@ -47,8 +47,8 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@verdaccio/logger": "8.0.2",
-    "@verdaccio/types": "13.0.1",
+    "@verdaccio/logger": "8.0.3",
+    "@verdaccio/types": "13.0.2",
     "http-errors": "2.0.1",
     "supertest": "7.1.4",
     "jsdom": "26.1.0",