@verdaccio/middleware 8.0.5 → 8.1.0

package/build/_virtual/_rolldown/runtime.js

@@ -0,0 +1,23 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+//#endregion
+exports.__toESM = __toESM;

package/build/index.js

@@ -1,229 +1,62 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-var _exportNames = {
-  match: true,
-  validateName: true,
-  validatePackage: true,
-  media: true,
-  makeURLrelative: true,
-  encodeScopePackage: true,
-  expectJson: true,
-  antiLoop: true,
-  final: true,
-  allow: true,
-  enforceGeneratedTokenMetadata: true,
-  rateLimit: true,
-  registerBodyParser: true,
-  userAgent: true,
-  webMiddleware: true,
-  renderWebMiddleware: true,
-  setSecurityWebHeaders: true,
-  errorReportingMiddleware: true,
-  handleError: true,
-  getRequestOptions: true,
-  log: true,
-  LOG_STATUS_MESSAGE: true,
-  LOG_VERDACCIO_BYTES: true,
-  LOG_VERDACCIO_ERROR: true
-};
-Object.defineProperty(exports, "LOG_STATUS_MESSAGE", {
-  enumerable: true,
-  get: function () {
-    return _log.LOG_STATUS_MESSAGE;
-  }
-});
-Object.defineProperty(exports, "LOG_VERDACCIO_BYTES", {
-  enumerable: true,
-  get: function () {
-    return _log.LOG_VERDACCIO_BYTES;
-  }
-});
-Object.defineProperty(exports, "LOG_VERDACCIO_ERROR", {
-  enumerable: true,
-  get: function () {
-    return _log.LOG_VERDACCIO_ERROR;
-  }
-});
-Object.defineProperty(exports, "allow", {
-  enumerable: true,
-  get: function () {
-    return _allow.allow;
-  }
-});
-Object.defineProperty(exports, "antiLoop", {
-  enumerable: true,
-  get: function () {
-    return _antiLoop.antiLoop;
-  }
-});
-Object.defineProperty(exports, "encodeScopePackage", {
-  enumerable: true,
-  get: function () {
-    return _encodePkg.encodeScopePackage;
-  }
-});
-Object.defineProperty(exports, "enforceGeneratedTokenMetadata", {
-  enumerable: true,
-  get: function () {
-    return _tokenAuth.enforceGeneratedTokenMetadata;
-  }
-});
-Object.defineProperty(exports, "errorReportingMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _error.errorReportingMiddleware;
-  }
-});
-Object.defineProperty(exports, "expectJson", {
-  enumerable: true,
-  get: function () {
-    return _json.expectJson;
-  }
-});
-Object.defineProperty(exports, "final", {
-  enumerable: true,
-  get: function () {
-    return _final.final;
-  }
-});
-Object.defineProperty(exports, "getRequestOptions", {
-  enumerable: true,
-  get: function () {
-    return _requestOptions.getRequestOptions;
-  }
-});
-Object.defineProperty(exports, "handleError", {
-  enumerable: true,
-  get: function () {
-    return _error.handleError;
-  }
-});
-Object.defineProperty(exports, "log", {
-  enumerable: true,
-  get: function () {
-    return _log.log;
-  }
-});
-Object.defineProperty(exports, "makeURLrelative", {
-  enumerable: true,
-  get: function () {
-    return _makeUrlRelative.makeURLrelative;
-  }
-});
-Object.defineProperty(exports, "match", {
-  enumerable: true,
-  get: function () {
-    return _match.match;
-  }
-});
-Object.defineProperty(exports, "media", {
-  enumerable: true,
-  get: function () {
-    return _media.media;
-  }
-});
-Object.defineProperty(exports, "rateLimit", {
-  enumerable: true,
-  get: function () {
-    return _rateLimit.rateLimit;
-  }
-});
-Object.defineProperty(exports, "registerBodyParser", {
-  enumerable: true,
-  get: function () {
-    return _bodyParser.registerBodyParser;
-  }
-});
-Object.defineProperty(exports, "renderWebMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _web.renderWebMiddleware;
-  }
-});
-Object.defineProperty(exports, "setSecurityWebHeaders", {
-  enumerable: true,
-  get: function () {
-    return _web.setSecurityWebHeaders;
-  }
-});
-Object.defineProperty(exports, "userAgent", {
-  enumerable: true,
-  get: function () {
-    return _userAgent.userAgent;
-  }
-});
-Object.defineProperty(exports, "validateName", {
-  enumerable: true,
-  get: function () {
-    return _validation.validateName;
-  }
-});
-Object.defineProperty(exports, "validatePackage", {
-  enumerable: true,
-  get: function () {
-    return _validation.validatePackage;
-  }
-});
-Object.defineProperty(exports, "webMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _web.webMiddleware;
-  }
-});
-var _match = require("./middlewares/match");
-var _validation = require("./middlewares/validation");
-var _media = require("./middlewares/media");
-var _makeUrlRelative = require("./middlewares/make-url-relative");
-var _encodePkg = require("./middlewares/encode-pkg");
-var _json = require("./middlewares/json");
-var _antiLoop = require("./middlewares/antiLoop");
-var _final = require("./middlewares/final");
-var _allow = require("./middlewares/allow");
-var _tokenAuth = require("./middlewares/token-auth");
-var _rateLimit = require("./middlewares/rate-limit");
-var _bodyParser = require("./middlewares/body-parser");
-var _userAgent = require("./middlewares/user-agent");
-var _web = require("./middlewares/web");
-var _error = require("./middlewares/error");
-var _requestOptions = require("./middlewares/request-options");
-var _log = require("./middlewares/log");
-var _types = require("./types");
-Object.keys(_types).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _types[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _types[key];
-    }
-  });
-});
-var _api_urls = require("./middlewares/api_urls");
-Object.keys(_api_urls).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _api_urls[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _api_urls[key];
-    }
-  });
-});
-var _webUrls = require("./middlewares/web/web-urls");
-Object.keys(_webUrls).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  if (Object.prototype.hasOwnProperty.call(_exportNames, key)) return;
-  if (key in exports && exports[key] === _webUrls[key]) return;
-  Object.defineProperty(exports, key, {
-    enumerable: true,
-    get: function () {
-      return _webUrls[key];
-    }
-  });
-});
-//# sourceMappingURL=index.js.map
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+const require_match = require("./middlewares/match.js");
+const require_validation = require("./middlewares/validation.js");
+const require_media = require("./middlewares/media.js");
+const require_make_url_relative = require("./middlewares/make-url-relative.js");
+const require_encode_pkg = require("./middlewares/encode-pkg.js");
+const require_json = require("./middlewares/json.js");
+const require_antiLoop = require("./middlewares/antiLoop.js");
+const require_final = require("./middlewares/final.js");
+const require_allow = require("./middlewares/allow.js");
+const require_token_auth = require("./middlewares/token-auth.js");
+const require_rate_limit = require("./middlewares/rate-limit.js");
+const require_body_parser = require("./middlewares/body-parser.js");
+const require_user_agent = require("./middlewares/user-agent.js");
+const require_security = require("./middlewares/web/security.js");
+const require_web_urls = require("./middlewares/web/web-urls.js");
+const require_render_web = require("./middlewares/web/render-web.js");
+const require_web_middleware = require("./middlewares/web/web-middleware.js");
+require("./middlewares/web/index.js");
+const require_error = require("./middlewares/error.js");
+const require_request_options = require("./middlewares/request-options.js");
+const require_log = require("./middlewares/log.js");
+const require_api_urls = require("./middlewares/api_urls.js");
+exports.DIST_TAGS_API_ENDPOINTS = require_api_urls.DIST_TAGS_API_ENDPOINTS;
+exports.LOGIN_API_ENDPOINTS = require_api_urls.LOGIN_API_ENDPOINTS;
+exports.LOG_STATUS_MESSAGE = require_log.LOG_STATUS_MESSAGE;
+exports.LOG_VERDACCIO_BYTES = require_log.LOG_VERDACCIO_BYTES;
+exports.LOG_VERDACCIO_ERROR = require_log.LOG_VERDACCIO_ERROR;
+exports.PACKAGE_API_ENDPOINTS = require_api_urls.PACKAGE_API_ENDPOINTS;
+exports.PING_API_ENDPOINTS = require_api_urls.PING_API_ENDPOINTS;
+exports.PROFILE_API_ENDPOINTS = require_api_urls.PROFILE_API_ENDPOINTS;
+exports.PUBLISH_API_ENDPOINTS = require_api_urls.PUBLISH_API_ENDPOINTS;
+exports.SEARCH_API_ENDPOINTS = require_api_urls.SEARCH_API_ENDPOINTS;
+exports.STARS_API_ENDPOINTS = require_api_urls.STARS_API_ENDPOINTS;
+exports.TOKEN_API_ENDPOINTS = require_api_urls.TOKEN_API_ENDPOINTS;
+exports.USER_API_ENDPOINTS = require_api_urls.USER_API_ENDPOINTS;
+exports.WebUrls = require_web_urls.WebUrls;
+exports.WebUrlsNamespace = require_web_urls.WebUrlsNamespace;
+exports.allow = require_allow.allow;
+exports.antiLoop = require_antiLoop.antiLoop;
+exports.encodeScopePackage = require_encode_pkg.encodeScopePackage;
+exports.enforceGeneratedTokenMetadata = require_token_auth.enforceGeneratedTokenMetadata;
+exports.errorReportingMiddleware = require_error.errorReportingMiddleware;
+exports.expectJson = require_json.expectJson;
+exports.final = require_final.final;
+exports.getRequestOptions = require_request_options.getRequestOptions;
+exports.handleError = require_error.handleError;
+exports.log = require_log.log;
+exports.makeURLrelative = require_make_url_relative.makeURLrelative;
+exports.match = require_match.match;
+exports.media = require_media.media;
+exports.rateLimit = require_rate_limit.rateLimit;
+exports.registerBodyParser = require_body_parser.registerBodyParser;
+exports.renderWebMiddleware = require_render_web.renderWebMiddleware;
+exports.setSecurityWebHeaders = require_security.setSecurityWebHeaders;
+exports.userAgent = require_user_agent.userAgent;
+exports.validateName = require_validation.validateName;
+exports.validatePackage = require_validation.validatePackage;
+exports.webMiddleware = require_web_middleware.default;

package/build/index.mjs

@@ -0,0 +1,23 @@
+import { match } from "./middlewares/match.mjs";
+import { validateName, validatePackage } from "./middlewares/validation.mjs";
+import { media } from "./middlewares/media.mjs";
+import { makeURLrelative } from "./middlewares/make-url-relative.mjs";
+import { encodeScopePackage } from "./middlewares/encode-pkg.mjs";
+import { expectJson } from "./middlewares/json.mjs";
+import { antiLoop } from "./middlewares/antiLoop.mjs";
+import { final } from "./middlewares/final.mjs";
+import { allow } from "./middlewares/allow.mjs";
+import { enforceGeneratedTokenMetadata } from "./middlewares/token-auth.mjs";
+import { rateLimit } from "./middlewares/rate-limit.mjs";
+import { registerBodyParser } from "./middlewares/body-parser.mjs";
+import { userAgent } from "./middlewares/user-agent.mjs";
+import { setSecurityWebHeaders } from "./middlewares/web/security.mjs";
+import { WebUrls, WebUrlsNamespace } from "./middlewares/web/web-urls.mjs";
+import { renderWebMiddleware } from "./middlewares/web/render-web.mjs";
+import web_middleware_default from "./middlewares/web/web-middleware.mjs";
+import "./middlewares/web/index.mjs";
+import { errorReportingMiddleware, handleError } from "./middlewares/error.mjs";
+import { getRequestOptions } from "./middlewares/request-options.mjs";
+import { LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, log } from "./middlewares/log.mjs";
+import { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS } from "./middlewares/api_urls.mjs";
+export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS, WebUrls, WebUrlsNamespace, allow, antiLoop, encodeScopePackage, enforceGeneratedTokenMetadata, errorReportingMiddleware, expectJson, final, getRequestOptions, handleError, log, makeURLrelative, match, media, rateLimit, registerBodyParser, renderWebMiddleware, setSecurityWebHeaders, userAgent, validateName, validatePackage, web_middleware_default as webMiddleware };

package/build/middlewares/allow.js

@@ -1,54 +1,46 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.allow = allow;
-var _debug = _interopRequireDefault(require("debug"));
-var _core = require("@verdaccio/core");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:middleware:allow');
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let _verdaccio_core = require("@verdaccio/core");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+//#region src/middlewares/allow.ts
+var debug$1 = (0, debug.default)("verdaccio:middleware:allow");
 function allow(auth, options = {
-  beforeAll: (_a, _b) => {},
-  afterAll: (_a, _b) => {}
+	beforeAll: (_a, _b) => {},
+	afterAll: (_a, _b) => {}
 }) {
-  const {
-    beforeAll,
-    afterAll
-  } = options;
-  return function (action) {
-    return function (req, res, next) {
-      req.pause();
-      const packageName = req.params.scope ? `${req.params.scope}/${req.params.package}` : req.params.package;
-      const packageVersion = req.params.filename ? _core.tarballUtils.getVersionFromTarball(req.params.filename) : req.params.version ? req.params.version : undefined;
-      const remote_user = req.remote_user;
-      debug('check if user %o can %o package %o version %o', remote_user?.name, action, packageName, packageVersion);
-      beforeAll?.({
-        action,
-        user: remote_user?.name
-      }, `[middleware/allow][@{action}] allow for @{user}`);
-      auth['allow_' + action]({
-        packageName,
-        packageVersion
-      }, remote_user, function (error, allowed) {
-        req.resume();
-        if (error) {
-          debug('user is NOT allowed to %o', action);
-          next(error);
-        } else if (allowed) {
-          debug('user is allowed to %o', action);
-          afterAll?.({
-            action,
-            user: remote_user?.name
-          }, `[middleware/allow][@{action}] allowed for @{user}`);
-          next();
-        } else {
-          // last plugin (that's our built-in one) returns either
-          // cb(err) or cb(null, true), so this should never happen
-          throw _core.errorUtils.getInternalError(_core.API_ERROR.PLUGIN_ERROR);
-        }
-      });
-    };
-  };
+	const { beforeAll, afterAll } = options;
+	return function(action) {
+		return function(req, res, next) {
+			req.pause();
+			const packageName = req.params.scope ? `${req.params.scope}/${req.params.package}` : req.params.package;
+			const packageVersion = req.params.filename ? _verdaccio_core.tarballUtils.getVersionFromTarball(req.params.filename) : req.params.version ? req.params.version : void 0;
+			const remote_user = req.remote_user;
+			debug$1("check if user %o can %o package %o version %o", remote_user?.name, action, packageName, packageVersion);
+			beforeAll?.({
+				action,
+				user: remote_user?.name
+			}, `[middleware/allow][@{action}] allow for @{user}`);
+			auth["allow_" + action]({
+				packageName,
+				packageVersion
+			}, remote_user, function(error, allowed) {
+				req.resume();
+				if (error) {
+					debug$1("user is NOT allowed to %o", action);
+					next(error);
+				} else if (allowed) {
+					debug$1("user is allowed to %o", action);
+					afterAll?.({
+						action,
+						user: remote_user?.name
+					}, `[middleware/allow][@{action}] allowed for @{user}`);
+					next();
+				} else throw _verdaccio_core.errorUtils.getInternalError(_verdaccio_core.API_ERROR.PLUGIN_ERROR);
+			});
+		};
+	};
 }
+//#endregion
+exports.allow = allow;
+
 //# sourceMappingURL=allow.js.map

package/build/middlewares/allow.js.map

@@ -1 +1 @@
-{"version":3,"file":"allow.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","allow","auth","options","beforeAll","_a","_b","afterAll","action","req","res","next","pause","packageName","params","scope","package","packageVersion","filename","tarballUtils","getVersionFromTarball","version","undefined","remote_user","name","user","error","allowed","resume","errorUtils","getInternalError","API_ERROR","PLUGIN_ERROR"],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAAsE,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAItE,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,4BAA4B,CAAC;AAE/C,SAASC,KAAKA,CACnBC,IAAO,EACPC,OAAO,GAAG;EACRC,SAAS,EAAEA,CAACC,EAAO,EAAEC,EAAO,KAAK,CAAC,CAAC;EAEnCC,QAAQ,EAAEA,CAACF,EAAO,EAAEC,EAAO,KAAK,CAAC;AACnC,CAAC,EACS;EACV,MAAM;IAAEF,SAAS;IAAEG;EAAS,CAAC,GAAGJ,OAAO;EACvC,OAAO,UAAUK,MAAc,EAAY;IACzC,OAAO,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;MACxFF,GAAG,CAACG,KAAK,CAAC,CAAC;MACX,MAAMC,WAAW,GAAGJ,GAAG,CAACK,MAAM,CAACC,KAAK,GAChC,GAAGN,GAAG,CAACK,MAAM,CAACC,KAAK,IAAIN,GAAG,CAACK,MAAM,CAACE,OAAO,EAAE,GAC3CP,GAAG,CAACK,MAAM,CAACE,OAAO;MACtB,MAAMC,cAAc,GAAGR,GAAG,CAACK,MAAM,CAACI,QAAQ,GACtCC,kBAAY,CAACC,qBAAqB,CAACX,GAAG,CAACK,MAAM,CAACI,QAAQ,CAAC,GACvDT,GAAG,CAACK,MAAM,CAACO,OAAO,GAChBZ,GAAG,CAACK,MAAM,CAACO,OAAO,GAClBC,SAAS;MACf,MAAMC,WAAW,GAAGd,GAAG,CAACc,WAAW;MACnCxB,KAAK,CACH,+CAA+C,EAC/CwB,WAAW,EAAEC,IAAI,EACjBhB,MAAM,EACNK,WAAW,EACXI,cACF,CAAC;MACDb,SAAS,GACP;QAAEI,MAAM;QAAEiB,IAAI,EAAEF,WAAW,EAAEC;MAAK,CAAC,EACnC,iDACF,CAAC;MACDtB,IAAI,CAAC,QAAQ,GAAGM,MAAM,CAAC,CACrB;QAAEK,WAAW;QAAEI;MAAe,CAAC,EAC/BM,WAAW,EACX,UAAUG,KAAK,EAAEC,OAAO,EAAQ;QAC9BlB,GAAG,CAACmB,MAAM,CAAC,CAAC;QACZ,IAAIF,KAAK,EAAE;UACT3B,KAAK,CAAC,2BAA2B,EAAES,MAAM,CAAC;UAC1CG,IAAI,CAACe,KAAK,CAAC;QACb,CAAC,MAAM,IAAIC,OAAO,EAAE;UAClB5B,KAAK,CAAC,uBAAuB,EAAES,MAAM,CAAC;UACtCD,QAAQ,GACN;YAAEC,MAAM;YAAEiB,IAAI,EAAEF,WAAW,EAAEC;UAAK,CAAC,EACnC,mDACF,CAAC;UACDb,IAAI,CAAC,CAAC;QACR,CAAC,MAAM;UACL;UACA;UACA,MAAMkB,gBAAU,CAACC,gBAAgB,CAACC,eAAS,CAACC,YAAY,CAAC;QAC3D;MACF,CACF,CAAC;IACH,CAAC;EACH,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,gBAAA,aAAa,sBAAsB,IAAI,OAAO,QAAQ,IACtD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,QACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,QACd;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,QAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,QAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}

package/build/middlewares/allow.mjs

@@ -0,0 +1,44 @@
+import { API_ERROR, errorUtils, tarballUtils } from "@verdaccio/core";
+import buildDebug from "debug";
+//#region src/middlewares/allow.ts
+var debug = buildDebug("verdaccio:middleware:allow");
+function allow(auth, options = {
+	beforeAll: (_a, _b) => {},
+	afterAll: (_a, _b) => {}
+}) {
+	const { beforeAll, afterAll } = options;
+	return function(action) {
+		return function(req, res, next) {
+			req.pause();
+			const packageName = req.params.scope ? `${req.params.scope}/${req.params.package}` : req.params.package;
+			const packageVersion = req.params.filename ? tarballUtils.getVersionFromTarball(req.params.filename) : req.params.version ? req.params.version : void 0;
+			const remote_user = req.remote_user;
+			debug("check if user %o can %o package %o version %o", remote_user?.name, action, packageName, packageVersion);
+			beforeAll?.({
+				action,
+				user: remote_user?.name
+			}, `[middleware/allow][@{action}] allow for @{user}`);
+			auth["allow_" + action]({
+				packageName,
+				packageVersion
+			}, remote_user, function(error, allowed) {
+				req.resume();
+				if (error) {
+					debug("user is NOT allowed to %o", action);
+					next(error);
+				} else if (allowed) {
+					debug("user is allowed to %o", action);
+					afterAll?.({
+						action,
+						user: remote_user?.name
+					}, `[middleware/allow][@{action}] allowed for @{user}`);
+					next();
+				} else throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);
+			});
+		};
+	};
+}
+//#endregion
+export { allow };
+
+//# sourceMappingURL=allow.mjs.map

package/build/middlewares/allow.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"allow.mjs","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,aAAa,sBAAsB,IAAI,OAAO,QAAQ,IACtD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,MACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,QACd;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,MAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,MAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,WAAW,iBAAiB,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}

package/build/middlewares/antiLoop.js

@@ -1,44 +1,25 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.antiLoop = antiLoop;
-var _core = require("@verdaccio/core");
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/middlewares/antiLoop.ts
 /**
- * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
- * @param config
- * @returns
- */
+* A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
+* @param config
+* @returns
+*/
 function antiLoop(config) {
-  return function (req, res, next) {
-    if (req?.headers?.via != null) {
-      const arr = req.get('via')?.split(',');
-      if (Array.isArray(arr)) {
-        for (let i = 0; i < arr.length; i++) {
-          // the "via" header must contain a specific value, this has to be in sync
-          // with the proxy request
-          // match eg: Server 1 or Server 2
-
-          // RFC 7230: Via = 1*( "," OWS Via-value )
-          //           Via-value = received-protocol RWS received-by [ RWS comment ]
-          //           received-protocol = [ protocol-name "/" ] protocol-version
-          //           received-by = ( uri-host [ ":" port ] ) / pseudonym
-
-          // Split the trimmed header value into parts
-          const parts = arr[i].trim().split(/\s+/);
-          // Check if we have at least protocol/version and received-by parts
-          if (parts.length >= 2) {
-            // Get the received-by value (server id), removing any comment
-            const serverId = parts[1].split('(')[0].trim();
-            if (serverId === config.server_id) {
-              return next(_core.errorUtils.getCode(_core.HTTP_STATUS.LOOP_DETECTED, 'loop detected'));
-            }
-          }
-        }
-      }
-    }
-    next();
-  };
+	return function(req, res, next) {
+		if (req?.headers?.via != null) {
+			const arr = req.get("via")?.split(",");
+			if (Array.isArray(arr)) for (let i = 0; i < arr.length; i++) {
+				const parts = arr[i].trim().split(/\s+/);
+				if (parts.length >= 2) {
+					if (parts[1].split("(")[0].trim() === config.server_id) return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.LOOP_DETECTED, "loop detected"));
+				}
+			}
+		}
+		next();
+	};
 }
+//#endregion
+exports.antiLoop = antiLoop;
+
 //# sourceMappingURL=antiLoop.js.map

package/build/middlewares/antiLoop.js.map

@@ -1 +1 @@
-{"version":3,"file":"antiLoop.js","names":["_core","require","antiLoop","config","req","res","next","headers","via","arr","get","split","Array","isArray","i","length","parts","trim","serverId","server_id","errorUtils","getCode","HTTP_STATUS","LOOP_DETECTED"],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAKA;AACA;AACA;AACA;AACA;AACO,SAASC,QAAQA,CAACC,MAAc,EAAE;EACvC,OAAO,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACxF,IAAIF,GAAG,EAAEG,OAAO,EAAEC,GAAG,IAAI,IAAI,EAAE;MAC7B,MAAMC,GAAG,GAAGL,GAAG,CAACM,GAAG,CAAC,KAAK,CAAC,EAAEC,KAAK,CAAC,GAAG,CAAC;MACtC,IAAIC,KAAK,CAACC,OAAO,CAACJ,GAAG,CAAC,EAAE;QACtB,KAAK,IAAIK,CAAC,GAAG,CAAC,EAAEA,CAAC,GAAGL,GAAG,CAACM,MAAM,EAAED,CAAC,EAAE,EAAE;UACnC;UACA;UACA;;UAEA;UACA;UACA;UACA;;UAEA;UACA,MAAME,KAAK,GAAGP,GAAG,CAACK,CAAC,CAAC,CAACG,IAAI,CAAC,CAAC,CAACN,KAAK,CAAC,KAAK,CAAC;UACxC;UACA,IAAIK,KAAK,CAACD,MAAM,IAAI,CAAC,EAAE;YACrB;YACA,MAAMG,QAAQ,GAAGF,KAAK,CAAC,CAAC,CAAC,CAACL,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAACM,IAAI,CAAC,CAAC;YAC9C,IAAIC,QAAQ,KAAKf,MAAM,CAACgB,SAAS,EAAE;cACjC,OAAOb,IAAI,CAACc,gBAAU,CAACC,OAAO,CAACC,iBAAW,CAACC,aAAa,EAAE,eAAe,CAAC,CAAC;YAC7E;UACF;QACF;MACF;IACF;IACAjB,IAAI,CAAC,CAAC;EACR,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,KAAK,EAAE,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}

package/build/middlewares/antiLoop.mjs

@@ -0,0 +1,25 @@
+import { HTTP_STATUS, errorUtils } from "@verdaccio/core";
+//#region src/middlewares/antiLoop.ts
+/**
+* A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
+* @param config
+* @returns
+*/
+function antiLoop(config) {
+	return function(req, res, next) {
+		if (req?.headers?.via != null) {
+			const arr = req.get("via")?.split(",");
+			if (Array.isArray(arr)) for (let i = 0; i < arr.length; i++) {
+				const parts = arr[i].trim().split(/\s+/);
+				if (parts.length >= 2) {
+					if (parts[1].split("(")[0].trim() === config.server_id) return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, "loop detected"));
+				}
+			}
+		}
+		next();
+	};
+}
+//#endregion
+export { antiLoop };
+
+//# sourceMappingURL=antiLoop.mjs.map

package/build/middlewares/antiLoop.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,KAAK,EAAE,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}