@verdaccio/middleware 8.0.7 → 8.1.0

package/build/middlewares/log.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"log.mjs","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport const log = (logger) => {\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (_.isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (_.isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    req.originalUrl = req.url;\n\n    if (_.isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (_.isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // FIXME: res.write should return boolean\n    // @ts-ignore\n    res.write = function (buf): boolean {\n      bytesout += buf.length;\n      // @ts-ignore\n      _write.apply(res, arguments);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.connection.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      req.log.http(\n        {\n          request: {\n            method: req.method,\n            url: req.url,\n          },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: {\n            in: bytesin,\n            out: bytesout,\n          },\n        },\n        message\n      );\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (buf): void {\n      if (buf) {\n        bytesout += buf.length;\n      }\n      // @ts-ignore\n      _end.apply(res, arguments);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;AAOA,IAAa,qBACX;AACF,IAAa,sBAAsB,GAAG,mBAAmB;AACzD,IAAa,sBAAsB,GAAG,mBAAmB;AAEzD,IAAa,OAAO,WAAW;CAC7B,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,EAAE,MAAM,KAAK,MAAM,OACrB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,IAAI,EAAE,MAAM,OAAO,MAAM,OACvB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,IAAI,IAAI,KAAK;GAAO;GAAK,IAAI,IAAI;EAAG,GAAG,4CAA4C;EACnF,IAAI,cAAc,IAAI;EAEtB,IAAI,EAAE,MAAM,KAAK,MAAM,OACrB,IAAI,QAAQ,gBAAgB;EAG9B,IAAI,EAAE,MAAM,OAAO,MAAM,OACvB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EAGnB,IAAI,QAAQ,SAAU,KAAc;GAClC,YAAY,IAAI;GAEhB,OAAO,MAAM,KAAK,SAAS;EAC7B;EAEA,MAAM,MAAM,WAAkB;GAC5B,MAAM,eAAe,IAAI,IAAI,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,WAAW;GACrC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,IAAI;GACJ,IAAI,IAAI,OAAO,kBACb,UAAU;QAEV,UAAU;GAGZ,IAAI,MAAM,IAAI;GACd,IAAI,IAAI,KACN;IACE,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF,GACA,OACF;GACA,IAAI,cAAc,IAAI;EACxB;EAEA,IAAI,GAAG,SAAS,WAAkB;GAChC,IAAI;EACN,CAAC;EAED,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,KAAW;GAC7B,IAAI,KACF,YAAY,IAAI;GAGlB,KAAK,MAAM,KAAK,SAAS;GACzB,IAAI;EACN;EACA,KAAK;CACP;AACF"}

package/build/middlewares/make-url-relative.js

@@ -1,45 +1,30 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.makeURLrelative = makeURLrelative;
-var _debug = _interopRequireDefault(require("debug"));
-var _nodeUrl = require("node:url");
-var _core = require("@verdaccio/core");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:middleware:make-url-relative');
-
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let _verdaccio_core = require("@verdaccio/core");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let node_url = require("node:url");
+//#region src/middlewares/make-url-relative.ts
+var debug$1 = (0, debug.default)("verdaccio:middleware:make-url-relative");
 /**
- * Removes the host from the URL and turns it into a relative URL.
- * @param req
- * @param res
- * @param next
- */
+* Removes the host from the URL and turns it into a relative URL.
+* @param req
+* @param res
+* @param next
+*/
 function makeURLrelative(req, res, next) {
-  const original = req.url;
-
-  // npm requests can contain the full URL, including the hostname, for example:
-  // tarball downloads. Removing the hostname makes the URL relative and allows
-  // the application to handle requests in a more consistent way.
-
-  let url;
-  try {
-    // In productive use, the URL is absolute (and base will be ignored)
-    // In tests, the URL might brelative (and base will be used)
-    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base
-    url = new _nodeUrl.URL(req.url, `${req.protocol}://${req.headers.host}/`);
-  } catch (error) {
-    return next(_core.errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));
-  }
-
-  // Rebuild the URL without hostname
-  req.url = url.pathname + url.search + url.hash;
-  if (original !== req.url) {
-    debug('makeURLrelative: %o -> %o', original, req.url);
-  } else {
-    debug('makeURLrelative: %o (unchanged)', original);
-  }
-  next();
+	const original = req.url;
+	let url;
+	try {
+		url = new node_url.URL(req.url, `${req.protocol}://${req.headers.host}/`);
+	} catch (error) {
+		return next(_verdaccio_core.errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));
+	}
+	req.url = url.pathname + url.search + url.hash;
+	if (original !== req.url) debug$1("makeURLrelative: %o -> %o", original, req.url);
+	else debug$1("makeURLrelative: %o (unchanged)", original);
+	next();
 }
+//#endregion
+exports.makeURLrelative = makeURLrelative;
+
 //# sourceMappingURL=make-url-relative.js.map

package/build/middlewares/make-url-relative.js.map

@@ -1 +1 @@
-{"version":3,"file":"make-url-relative.js","names":["_debug","_interopRequireDefault","require","_nodeUrl","_core","e","__esModule","default","debug","buildDebug","makeURLrelative","req","res","next","original","url","URL","protocol","headers","host","error","errorUtils","getBadRequest","pathname","search","hash"],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AAEA,IAAAE,KAAA,GAAAF,OAAA;AAA6C,SAAAD,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAI7C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,wCAAwC,CAAC;;AAElE;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,eAAeA,CAC7BC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EAChB;EACN,MAAMC,QAAQ,GAAGH,GAAG,CAACI,GAAG;;EAExB;EACA;EACA;;EAEA,IAAIA,GAAG;EACP,IAAI;IACF;IACA;IACA;IACAA,GAAG,GAAG,IAAIC,YAAG,CAACL,GAAG,CAACI,GAAG,EAAE,GAAGJ,GAAG,CAACM,QAAQ,MAAMN,GAAG,CAACO,OAAO,CAACC,IAAI,GAAG,CAAC;EAClE,CAAC,CAAC,OAAOC,KAAK,EAAE;IACd,OAAOP,IAAI,CAACQ,gBAAU,CAACC,aAAa,CAAC,gBAAgBX,GAAG,CAACI,GAAG,KAAKK,KAAK,GAAG,CAAC,CAAC;EAC7E;;EAEA;EACAT,GAAG,CAACI,GAAG,GAAGA,GAAG,CAACQ,QAAQ,GAAGR,GAAG,CAACS,MAAM,GAAGT,GAAG,CAACU,IAAI;EAE9C,IAAIX,QAAQ,KAAKH,GAAG,CAACI,GAAG,EAAE;IACxBP,KAAK,CAAC,2BAA2B,EAAEM,QAAQ,EAAEH,GAAG,CAACI,GAAG,CAAC;EACvD,CAAC,MAAM;IACLP,KAAK,CAAC,iCAAiC,EAAEM,QAAQ,CAAC;EACpD;EACAD,IAAI,CAAC,CAAC;AACR","ignoreList":[]}
+{"version":3,"file":"make-url-relative.js","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,wCAAwC;;;;;;;AAQjE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;CACJ,IAAI;EAIF,MAAM,IAAI,SAAA,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,EAAE;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;CAC5E;CAGA,IAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;CAE1C,IAAI,aAAa,IAAI,KACnB,QAAM,6BAA6B,UAAU,IAAI,GAAG;MAEpD,QAAM,mCAAmC,QAAQ;CAEnD,KAAK;AACP"}

package/build/middlewares/make-url-relative.mjs

@@ -0,0 +1,28 @@
+import { errorUtils } from "@verdaccio/core";
+import buildDebug from "debug";
+import { URL } from "node:url";
+//#region src/middlewares/make-url-relative.ts
+var debug = buildDebug("verdaccio:middleware:make-url-relative");
+/**
+* Removes the host from the URL and turns it into a relative URL.
+* @param req
+* @param res
+* @param next
+*/
+function makeURLrelative(req, res, next) {
+	const original = req.url;
+	let url;
+	try {
+		url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);
+	} catch (error) {
+		return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));
+	}
+	req.url = url.pathname + url.search + url.hash;
+	if (original !== req.url) debug("makeURLrelative: %o -> %o", original, req.url);
+	else debug("makeURLrelative: %o (unchanged)", original);
+	next();
+}
+//#endregion
+export { makeURLrelative };
+
+//# sourceMappingURL=make-url-relative.mjs.map

package/build/middlewares/make-url-relative.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"make-url-relative.mjs","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,wCAAwC;;;;;;;AAQjE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;CACJ,IAAI;EAIF,MAAM,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,EAAE;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;CAC5E;CAGA,IAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;CAE1C,IAAI,aAAa,IAAI,KACnB,MAAM,6BAA6B,UAAU,IAAI,GAAG;MAEpD,MAAM,mCAAmC,QAAQ;CAEnD,KAAK;AACP"}

package/build/middlewares/match.js

@@ -1,16 +1,11 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.match = match;
+//#region src/middlewares/match.ts
 function match(regexp) {
-  return function (req, res, next, value) {
-    if (regexp.exec(value)) {
-      next();
-    } else {
-      next('route');
-    }
-  };
+	return function(req, res, next, value) {
+		if (regexp.exec(value)) next();
+		else next("route");
+	};
 }
+//#endregion
+exports.match = match;
+
 //# sourceMappingURL=match.js.map

package/build/middlewares/match.js.map

@@ -1 +1 @@
-{"version":3,"file":"match.js","names":["match","regexp","req","res","next","value","exec"],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";;;;;;AAEO,SAASA,KAAKA,CAACC,MAAc,EAAO;EACzC,OAAO,UACLC,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACtBC,KAAa,EACP;IACN,IAAIJ,MAAM,CAACK,IAAI,CAACD,KAAK,CAAC,EAAE;MACtBD,IAAI,CAAC,CAAC;IACR,CAAC,MAAM;MACLA,IAAI,CAAC,OAAO,CAAC;IACf;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"match.js","names":[],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";AAEA,SAAgB,MAAM,QAAqB;CACzC,OAAO,SACL,KACA,KACA,MACA,OACM;EACN,IAAI,OAAO,KAAK,KAAK,GACnB,KAAK;OAEL,KAAK,OAAO;CAEhB;AACF"}

package/build/middlewares/match.mjs

@@ -0,0 +1,11 @@
+//#region src/middlewares/match.ts
+function match(regexp) {
+	return function(req, res, next, value) {
+		if (regexp.exec(value)) next();
+		else next("route");
+	};
+}
+//#endregion
+export { match };
+
+//# sourceMappingURL=match.mjs.map

package/build/middlewares/match.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.mjs","names":[],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";AAEA,SAAgB,MAAM,QAAqB;CACzC,OAAO,SACL,KACA,KACA,MACA,OACM;EACN,IAAI,OAAO,KAAK,KAAK,GACnB,KAAK;OAEL,KAAK,OAAO;CAEhB;AACF"}

package/build/middlewares/media.js

@@ -1,22 +1,17 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.media = media;
-var _core = require("@verdaccio/core");
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/middlewares/media.ts
 function media(expect) {
-  return function (req, res, next) {
-    const header = req.headers[_core.HEADER_TYPE.CONTENT_TYPE];
-    if (!header) {
-      next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'content-type is missing, expect: ' + expect));
-      return;
-    }
-    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {
-      next(_core.errorUtils.getCode(_core.HTTP_STATUS.UNSUPPORTED_MEDIA, 'wrong content-type, expect: ' + expect + ', got: ' + req.get[_core.HEADER_TYPE.CONTENT_TYPE]));
-    } else {
-      next();
-    }
-  };
+	return function(req, res, next) {
+		const header = req.headers[_verdaccio_core.HEADER_TYPE.CONTENT_TYPE];
+		if (!header) {
+			next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.UNSUPPORTED_MEDIA, "content-type is missing, expect: " + expect));
+			return;
+		}
+		if (typeof header !== "string" || header.split(";")[0].trim() !== expect) next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.UNSUPPORTED_MEDIA, "wrong content-type, expect: " + expect + ", got: " + req.get[_verdaccio_core.HEADER_TYPE.CONTENT_TYPE]));
+		else next();
+	};
 }
+//#endregion
+exports.media = media;
+
 //# sourceMappingURL=media.js.map

package/build/middlewares/media.js.map

@@ -1 +1 @@
-{"version":3,"file":"media.js","names":["_core","require","media","expect","req","res","next","header","headers","HEADER_TYPE","CONTENT_TYPE","errorUtils","getCode","HTTP_STATUS","UNSUPPORTED_MEDIA","split","trim","get"],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,KAAA,GAAAC,OAAA;AAIO,SAASC,KAAKA,CAACC,MAAqB,EAAO;EAChD,OAAO,UAAUC,GAAmB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACxF,MAAMC,MAAM,GAAGH,GAAG,CAACI,OAAO,CAACC,iBAAW,CAACC,YAAY,CAAC;IACpD,IAAI,CAACH,MAAM,EAAE;MACXD,IAAI,CACFK,gBAAU,CAACC,OAAO,CAChBC,iBAAW,CAACC,iBAAiB,EAC7B,mCAAmC,GAAGX,MACxC,CACF,CAAC;MACD;IACF;IAEA,IAAI,OAAOI,MAAM,KAAK,QAAQ,IAAIA,MAAM,CAACQ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAACC,IAAI,CAAC,CAAC,KAAKb,MAAM,EAAE;MACxEG,IAAI,CACFK,gBAAU,CAACC,OAAO,CAChBC,iBAAW,CAACC,iBAAiB,EAC7B,8BAA8B,GAAGX,MAAM,GAAG,SAAS,GAAGC,GAAG,CAACa,GAAG,CAACR,iBAAW,CAACC,YAAY,CACxF,CACF,CAAC;IACH,CAAC,MAAM;MACLJ,IAAI,CAAC,CAAC;IACR;EACF,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"media.js","names":[],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;AAIA,SAAgB,MAAM,QAA4B;CAChD,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,MAAM,SAAS,IAAI,QAAQ,gBAAA,YAAY;EACvC,IAAI,CAAC,QAAQ;GACX,KACE,gBAAA,WAAW,QACT,gBAAA,YAAY,mBACZ,sCAAsC,MACxC,CACF;GACA;EACF;EAEA,IAAI,OAAO,WAAW,YAAY,OAAO,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,QAChE,KACE,gBAAA,WAAW,QACT,gBAAA,YAAY,mBACZ,iCAAiC,SAAS,YAAY,IAAI,IAAI,gBAAA,YAAY,aAC5E,CACF;OAEA,KAAK;CAET;AACF"}

package/build/middlewares/media.mjs

@@ -0,0 +1,17 @@
+import { HEADER_TYPE, HTTP_STATUS, errorUtils } from "@verdaccio/core";
+//#region src/middlewares/media.ts
+function media(expect) {
+	return function(req, res, next) {
+		const header = req.headers[HEADER_TYPE.CONTENT_TYPE];
+		if (!header) {
+			next(errorUtils.getCode(HTTP_STATUS.UNSUPPORTED_MEDIA, "content-type is missing, expect: " + expect));
+			return;
+		}
+		if (typeof header !== "string" || header.split(";")[0].trim() !== expect) next(errorUtils.getCode(HTTP_STATUS.UNSUPPORTED_MEDIA, "wrong content-type, expect: " + expect + ", got: " + req.get[HEADER_TYPE.CONTENT_TYPE]));
+		else next();
+	};
+}
+//#endregion
+export { media };
+
+//# sourceMappingURL=media.mjs.map

package/build/middlewares/media.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.mjs","names":[],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get[HEADER_TYPE.CONTENT_TYPE]\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;AAIA,SAAgB,MAAM,QAA4B;CAChD,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,MAAM,SAAS,IAAI,QAAQ,YAAY;EACvC,IAAI,CAAC,QAAQ;GACX,KACE,WAAW,QACT,YAAY,mBACZ,sCAAsC,MACxC,CACF;GACA;EACF;EAEA,IAAI,OAAO,WAAW,YAAY,OAAO,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,QAChE,KACE,WAAW,QACT,YAAY,mBACZ,iCAAiC,SAAS,YAAY,IAAI,IAAI,YAAY,aAC5E,CACF;OAEA,KAAK;CAET;AACF"}

package/build/middlewares/rate-limit.js

@@ -1,13 +1,11 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.rateLimit = rateLimit;
-var _expressRateLimit = _interopRequireDefault(require("express-rate-limit"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let express_rate_limit = require("express-rate-limit");
+express_rate_limit = require_runtime.__toESM(express_rate_limit);
+//#region src/middlewares/rate-limit.ts
 function rateLimit(rateLimitOptions) {
-  const limiter = new _expressRateLimit.default(rateLimitOptions);
-  return limiter;
+	return new express_rate_limit.default(rateLimitOptions);
 }
+//#endregion
+exports.rateLimit = rateLimit;
+
 //# sourceMappingURL=rate-limit.js.map

package/build/middlewares/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","names":["_expressRateLimit","_interopRequireDefault","require","e","__esModule","default","rateLimit","rateLimitOptions","limiter","RateLimit"],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = new RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,iBAAA,GAAAC,sBAAA,CAAAC,OAAA;AAA2C,SAAAD,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAIpC,SAASG,SAASA,CAACC,gBAAgC,EAAE;EAC1D,MAAMC,OAAO,GAAG,IAAIC,yBAAS,CAACF,gBAAgB,CAAC;EAC/C,OAAOC,OAAO;AAChB","ignoreList":[]}
+{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = new RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;;;AAIA,SAAgB,UAAU,kBAAkC;CAE1D,OAAO,IADa,mBAAA,QAAU,gBACvB;AACT"}

package/build/middlewares/rate-limit.mjs

@@ -0,0 +1,9 @@
+import RateLimit from "express-rate-limit";
+//#region src/middlewares/rate-limit.ts
+function rateLimit(rateLimitOptions) {
+	return new RateLimit(rateLimitOptions);
+}
+//#endregion
+export { rateLimit };
+
+//# sourceMappingURL=rate-limit.mjs.map

package/build/middlewares/rate-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = new RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;AAIA,SAAgB,UAAU,kBAAkC;CAE1D,OAAO,IADa,UAAU,gBACvB;AACT"}

package/build/middlewares/request-options.js

@@ -1,30 +1,21 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.getRequestOptions = getRequestOptions;
-var _debug = _interopRequireDefault(require("debug"));
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:middleware:request-options');
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+//#region src/middlewares/request-options.ts
+var debug$1 = (0, debug.default)("verdaccio:middleware:request-options");
 function getRequestOptions(req) {
-  const requestOptions = {
-    // FIXME: decide if host should contain port or not
-    //
-    // Express 4:
-    // - req.host is marked as deprecated since it does not include the port
-    // - use req.headers['host'] instead, which includes the port
-    // Express 5:
-    // - req.host is fully supported and includes the port
-    // - https://expressjs.com/en/api.html#req.host
-    host: req.host,
-    protocol: req.protocol,
-    headers: req.headers,
-    remoteAddress: req.socket.remoteAddress,
-    byPassCache: req.query.write === 'true',
-    username: req.remote_user?.name ?? undefined
-  };
-  debug('request options: %o', requestOptions);
-  return requestOptions;
+	const requestOptions = {
+		host: req.host,
+		protocol: req.protocol,
+		headers: req.headers,
+		remoteAddress: req.socket.remoteAddress,
+		byPassCache: req.query.write === "true",
+		username: req.remote_user?.name ?? void 0
+	};
+	debug$1("request options: %o", requestOptions);
+	return requestOptions;
 }
+//#endregion
+exports.getRequestOptions = getRequestOptions;
+
 //# sourceMappingURL=request-options.js.map

package/build/middlewares/request-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-options.js","names":["_debug","_interopRequireDefault","require","e","__esModule","default","debug","buildDebug","getRequestOptions","req","requestOptions","host","protocol","headers","remoteAddress","socket","byPassCache","query","write","username","remote_user","name","undefined"],"sources":["../../src/middlewares/request-options.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\n\nimport type { RequestOptions } from '@verdaccio/url';\n\nimport type { $RequestExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:request-options');\n\nexport function getRequestOptions(req: $RequestExtend): RequestOptions {\n  const requestOptions = {\n    // FIXME: decide if host should contain port or not\n    //\n    // Express 4:\n    // - req.host is marked as deprecated since it does not include the port\n    // - use req.headers['host'] instead, which includes the port\n    // Express 5:\n    // - req.host is fully supported and includes the port\n    // - https://expressjs.com/en/api.html#req.host\n    host: req.host,\n    protocol: req.protocol,\n    headers: req.headers as IncomingHttpHeaders,\n    remoteAddress: req.socket.remoteAddress,\n    byPassCache: req.query.write === 'true',\n    username: req.remote_user?.name ?? undefined,\n  };\n\n  debug('request options: %o', requestOptions);\n\n  return requestOptions;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAA+B,SAAAD,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAO/B,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sCAAsC,CAAC;AAEzD,SAASC,iBAAiBA,CAACC,GAAmB,EAAkB;EACrE,MAAMC,cAAc,GAAG;IACrB;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACAC,IAAI,EAAEF,GAAG,CAACE,IAAI;IACdC,QAAQ,EAAEH,GAAG,CAACG,QAAQ;IACtBC,OAAO,EAAEJ,GAAG,CAACI,OAA8B;IAC3CC,aAAa,EAAEL,GAAG,CAACM,MAAM,CAACD,aAAa;IACvCE,WAAW,EAAEP,GAAG,CAACQ,KAAK,CAACC,KAAK,KAAK,MAAM;IACvCC,QAAQ,EAAEV,GAAG,CAACW,WAAW,EAAEC,IAAI,IAAIC;EACrC,CAAC;EAEDhB,KAAK,CAAC,qBAAqB,EAAEI,cAAc,CAAC;EAE5C,OAAOA,cAAc;AACvB","ignoreList":[]}
+{"version":3,"file":"request-options.js","names":[],"sources":["../../src/middlewares/request-options.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\n\nimport type { RequestOptions } from '@verdaccio/url';\n\nimport type { $RequestExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:request-options');\n\nexport function getRequestOptions(req: $RequestExtend): RequestOptions {\n  const requestOptions = {\n    // FIXME: decide if host should contain port or not\n    //\n    // Express 4:\n    // - req.host is marked as deprecated since it does not include the port\n    // - use req.headers['host'] instead, which includes the port\n    // Express 5:\n    // - req.host is fully supported and includes the port\n    // - https://expressjs.com/en/api.html#req.host\n    host: req.host,\n    protocol: req.protocol,\n    headers: req.headers as IncomingHttpHeaders,\n    remoteAddress: req.socket.remoteAddress,\n    byPassCache: req.query.write === 'true',\n    username: req.remote_user?.name ?? undefined,\n  };\n\n  debug('request options: %o', requestOptions);\n\n  return requestOptions;\n}\n"],"mappings":";;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,sCAAsC;AAE/D,SAAgB,kBAAkB,KAAqC;CACrE,MAAM,iBAAiB;EASrB,MAAM,IAAI;EACV,UAAU,IAAI;EACd,SAAS,IAAI;EACb,eAAe,IAAI,OAAO;EAC1B,aAAa,IAAI,MAAM,UAAU;EACjC,UAAU,IAAI,aAAa,QAAQ,KAAA;CACrC;CAEA,QAAM,uBAAuB,cAAc;CAE3C,OAAO;AACT"}

package/build/middlewares/request-options.mjs

@@ -0,0 +1,19 @@
+import buildDebug from "debug";
+//#region src/middlewares/request-options.ts
+var debug = buildDebug("verdaccio:middleware:request-options");
+function getRequestOptions(req) {
+	const requestOptions = {
+		host: req.host,
+		protocol: req.protocol,
+		headers: req.headers,
+		remoteAddress: req.socket.remoteAddress,
+		byPassCache: req.query.write === "true",
+		username: req.remote_user?.name ?? void 0
+	};
+	debug("request options: %o", requestOptions);
+	return requestOptions;
+}
+//#endregion
+export { getRequestOptions };
+
+//# sourceMappingURL=request-options.mjs.map

package/build/middlewares/request-options.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-options.mjs","names":[],"sources":["../../src/middlewares/request-options.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\n\nimport type { RequestOptions } from '@verdaccio/url';\n\nimport type { $RequestExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:request-options');\n\nexport function getRequestOptions(req: $RequestExtend): RequestOptions {\n  const requestOptions = {\n    // FIXME: decide if host should contain port or not\n    //\n    // Express 4:\n    // - req.host is marked as deprecated since it does not include the port\n    // - use req.headers['host'] instead, which includes the port\n    // Express 5:\n    // - req.host is fully supported and includes the port\n    // - https://expressjs.com/en/api.html#req.host\n    host: req.host,\n    protocol: req.protocol,\n    headers: req.headers as IncomingHttpHeaders,\n    remoteAddress: req.socket.remoteAddress,\n    byPassCache: req.query.write === 'true',\n    username: req.remote_user?.name ?? undefined,\n  };\n\n  debug('request options: %o', requestOptions);\n\n  return requestOptions;\n}\n"],"mappings":";;AAOA,IAAM,QAAQ,WAAW,sCAAsC;AAE/D,SAAgB,kBAAkB,KAAqC;CACrE,MAAM,iBAAiB;EASrB,MAAM,IAAI;EACV,UAAU,IAAI;EACd,SAAS,IAAI;EACb,eAAe,IAAI,OAAO;EAC1B,aAAa,IAAI,MAAM,UAAU;EACjC,UAAU,IAAI,aAAa,QAAQ,KAAA;CACrC;CAEA,MAAM,uBAAuB,cAAc;CAE3C,OAAO;AACT"}

package/build/middlewares/token-auth.js

@@ -1,115 +1,100 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.enforceGeneratedTokenMetadata = enforceGeneratedTokenMetadata;
-var _core = require("@verdaccio/core");
-const WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);
-
-/**
- * Minimal storage surface required to enforce generated token metadata. Typed
- * structurally so this package does not need to depend on `@verdaccio/store`.
- */
-
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/middlewares/token-auth.ts
+var WRITE_METHODS = new Set([
+	"DELETE",
+	"PATCH",
+	"POST",
+	"PUT"
+]);
 /**
- * Resolve the client address of an incoming request for CIDR matching.
- *
- * Uses Express' `req.ip`, which already honors the application's `trust proxy`
- * setting (`config.server.trustProxy`): when the operator has declared trusted
- * proxies, `req.ip` is the upstream-most untrusted address parsed from
- * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded
- * header is ignored entirely.
- *
- * The middleware must NOT read `X-Forwarded-For` on its own — doing so
- * unconditionally would let any client spoof its address (and bypass a token's
- * CIDR whitelist) simply by sending the header. Falls back to the raw socket
- * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via
- * {@link ipUtils.normalizeAddress}.
- *
- * @param req the incoming Express request
- * @returns the normalized client address, or `undefined` when none can be determined
- */
+* Resolve the client address of an incoming request for CIDR matching.
+*
+* Uses Express' `req.ip`, which already honors the application's `trust proxy`
+* setting (`config.server.trustProxy`): when the operator has declared trusted
+* proxies, `req.ip` is the upstream-most untrusted address parsed from
+* `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded
+* header is ignored entirely.
+*
+* The middleware must NOT read `X-Forwarded-For` on its own — doing so
+* unconditionally would let any client spoof its address (and bypass a token's
+* CIDR whitelist) simply by sending the header. Falls back to the raw socket
+* address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via
+* {@link ipUtils.normalizeAddress}.
+*
+* @param req the incoming Express request
+* @returns the normalized client address, or `undefined` when none can be determined
+*/
 function getClientAddress(req) {
-  return _core.ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);
+	return _verdaccio_core.ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);
 }
-
 /**
- * Find the stored token whose `key` matches the key carried by the request.
- *
- * @param tokens the tokens persisted for the authenticated user
- * @param tokenKey the key extracted from the presented generated token
- * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed
- */
+* Find the stored token whose `key` matches the key carried by the request.
+*
+* @param tokens the tokens persisted for the authenticated user
+* @param tokenKey the key extracted from the presented generated token
+* @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed
+*/
 function findToken(tokens, tokenKey) {
-  return tokens.find(({
-    key
-  }) => key === tokenKey);
+	return tokens.find(({ key }) => key === tokenKey);
 }
-
 /**
- * Express middleware that enforces the metadata of npm-style generated tokens
- * (created via `POST /-/npm/v1/tokens`).
- *
- * A generated token embeds a server-issued `key` that is recovered from the
- * verified credentials as `remote_user.token.key`. This middleware looks that
- * key up in storage and rejects the request when the token:
- * - is missing from storage (revoked or never issued);
- * - is used from a client address outside its `cidr` whitelist;
- * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).
- *
- * Requests that do not carry a generated token key (e.g. interactive logins)
- * pass through untouched. It must run after the JWT/auth middleware has
- * populated `remote_user`. Failures fail closed: a storage lookup error yields
- * an internal error rather than allowing the request.
- *
- * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens
- * @param logger logger used to record rejected attempts and lookup failures
- * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject
- */
+* Express middleware that enforces the metadata of npm-style generated tokens
+* (created via `POST /-/npm/v1/tokens`).
+*
+* A generated token embeds a server-issued `key` that is recovered from the
+* verified credentials as `remote_user.token.key`. This middleware looks that
+* key up in storage and rejects the request when the token:
+* - is missing from storage (revoked or never issued);
+* - is used from a client address outside its `cidr` whitelist;
+* - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).
+*
+* Requests that do not carry a generated token key (e.g. interactive logins)
+* pass through untouched. It must run after the JWT/auth middleware has
+* populated `remote_user`. Failures fail closed: a storage lookup error yields
+* an internal error rather than allowing the request.
+*
+* @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens
+* @param logger logger used to record rejected attempts and lookup failures
+* @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject
+*/
 function enforceGeneratedTokenMetadata(storage, logger) {
-  return async function (req, _res, next) {
-    const remoteUser = req.remote_user;
-    const tokenKey = remoteUser?.token?.key;
-    if (!tokenKey) {
-      return next();
-    }
-    const user = remoteUser?.name;
-    if (typeof user !== 'string') {
-      return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
-    }
-    try {
-      const token = findToken(await storage.readTokens({
-        user
-      }), tokenKey);
-      if (!token) {
-        logger.warn({
-          tokenKey,
-          user
-        }, 'generated token @{tokenKey} for user @{user} is missing');
-        return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
-      }
-      if (!_core.ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {
-        logger.warn({
-          tokenKey,
-          user
-        }, 'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist');
-        return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
-      }
-      if (token.readonly && WRITE_METHODS.has(req.method)) {
-        logger.warn({
-          tokenKey,
-          user
-        }, 'readonly generated token @{tokenKey} for user @{user} was used for a write request');
-        return next(_core.errorUtils.getForbidden(_core.API_ERROR.UNAUTHORIZED_ACCESS));
-      }
-      return next();
-    } catch (error) {
-      logger.error({
-        error: error.msg
-      }, 'generated token metadata lookup failed: @{error}');
-      return next(_core.errorUtils.getInternalError(error.message));
-    }
-  };
+	return async function(req, _res, next) {
+		const remoteUser = req.remote_user;
+		const tokenKey = remoteUser?.token?.key;
+		if (!tokenKey) return next();
+		const user = remoteUser?.name;
+		if (typeof user !== "string") return next(_verdaccio_core.errorUtils.getForbidden(_verdaccio_core.API_ERROR.UNAUTHORIZED_ACCESS));
+		try {
+			const token = findToken(await storage.readTokens({ user }), tokenKey);
+			if (!token) {
+				logger.warn({
+					tokenKey,
+					user
+				}, "generated token @{tokenKey} for user @{user} is missing");
+				return next(_verdaccio_core.errorUtils.getForbidden(_verdaccio_core.API_ERROR.UNAUTHORIZED_ACCESS));
+			}
+			if (!_verdaccio_core.ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {
+				logger.warn({
+					tokenKey,
+					user
+				}, "generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist");
+				return next(_verdaccio_core.errorUtils.getForbidden(_verdaccio_core.API_ERROR.UNAUTHORIZED_ACCESS));
+			}
+			if (token.readonly && WRITE_METHODS.has(req.method)) {
+				logger.warn({
+					tokenKey,
+					user
+				}, "readonly generated token @{tokenKey} for user @{user} was used for a write request");
+				return next(_verdaccio_core.errorUtils.getForbidden(_verdaccio_core.API_ERROR.UNAUTHORIZED_ACCESS));
+			}
+			return next();
+		} catch (error) {
+			logger.error({ error: error.msg }, "generated token metadata lookup failed: @{error}");
+			return next(_verdaccio_core.errorUtils.getInternalError(error.message));
+		}
+	};
 }
+//#endregion
+exports.enforceGeneratedTokenMetadata = enforceGeneratedTokenMetadata;
+
 //# sourceMappingURL=token-auth.js.map