@verdaccio/middleware 9.0.0-next-9.16 → 9.0.0-next-9.18

package/build/index.d.ts

@@ -9,6 +9,8 @@ export { expectJson } from './middlewares/json';
 export { antiLoop } from './middlewares/antiLoop';
 export { final } from './middlewares/final';
 export { allow } from './middlewares/allow';
+export { enforceGeneratedTokenMetadata } from './middlewares/token-auth';
+export type { TokenReadableStorage } from './middlewares/token-auth';
 export { rateLimit } from './middlewares/rate-limit';
 export { registerBodyParser } from './middlewares/body-parser';
 export { userAgent } from './middlewares/user-agent';

package/build/index.js

@@ -12,6 +12,7 @@ const require_json = require("./middlewares/json.js");
 const require_antiLoop = require("./middlewares/antiLoop.js");
 const require_final = require("./middlewares/final.js");
 const require_allow = require("./middlewares/allow.js");
+const require_token_auth = require("./middlewares/token-auth.js");
 const require_rate_limit = require("./middlewares/rate-limit.js");
 const require_body_parser = require("./middlewares/body-parser.js");
 const require_user_agent = require("./middlewares/user-agent.js");
@@ -43,6 +44,7 @@ exports.allow = require_allow.allow;
 exports.antiLoop = require_antiLoop.antiLoop;
 exports.dotfiles = require_dotfiles.dotfiles;
 exports.encodeScopePackage = require_encode_pkg.encodeScopePackage;
+exports.enforceGeneratedTokenMetadata = require_token_auth.enforceGeneratedTokenMetadata;
 exports.errorReportingMiddleware = require_error.errorReportingMiddleware;
 exports.expectJson = require_json.expectJson;
 exports.final = require_final.final;

package/build/index.mjs

@@ -8,6 +8,7 @@ import { expectJson } from "./middlewares/json.mjs";
 import { antiLoop } from "./middlewares/antiLoop.mjs";
 import { final } from "./middlewares/final.mjs";
 import { allow } from "./middlewares/allow.mjs";
+import { enforceGeneratedTokenMetadata } from "./middlewares/token-auth.mjs";
 import { rateLimit } from "./middlewares/rate-limit.mjs";
 import { registerBodyParser } from "./middlewares/body-parser.mjs";
 import { userAgent } from "./middlewares/user-agent.mjs";
@@ -20,4 +21,4 @@ import { errorReportingMiddleware, handleError } from "./middlewares/error.mjs";
 import { getRequestOptions } from "./middlewares/request-options.mjs";
 import { LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, log } from "./middlewares/log.mjs";
 import { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS } from "./middlewares/api_urls.mjs";
-export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS, WebUrls, WebUrlsNamespace, allow, antiLoop, dotfiles, encodeScopePackage, errorReportingMiddleware, expectJson, final, getRequestOptions, handleError, log, makeURLrelative, match, media, rateLimit, registerBodyParser, renderWebMiddleware, setSecurityWebHeaders, userAgent, validateName, validatePackage, web_middleware_default as webMiddleware };
+export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS, WebUrls, WebUrlsNamespace, allow, antiLoop, dotfiles, encodeScopePackage, enforceGeneratedTokenMetadata, errorReportingMiddleware, expectJson, final, getRequestOptions, handleError, log, makeURLrelative, match, media, rateLimit, registerBodyParser, renderWebMiddleware, setSecurityWebHeaders, userAgent, validateName, validatePackage, web_middleware_default as webMiddleware };

package/build/middlewares/allow.js.map

@@ -1 +1 @@
-{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,6BAA6B;AAEtD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY;CAEjC,WAAW,IAAS,OAAY;CACjC,EACS;CACV,MAAM,EAAE,WAAW,aAAa;AAChC,QAAO,SAAU,QAA0B;AACzC,SAAO,SAAU,KAAqB,KAAsB,MAA8B;AACxF,OAAI,OAAO;GACX,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,gBAAA,aAAa,sBAAsB,IAAI,OAAO,SAAS,GACvD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;AACxB,WACE,iDACA,aAAa,MACb,QACA,aACA,eACD;AACD,eACE;IAAE;IAAQ,MAAM,aAAa;IAAM,EACnC,kDACD;AACD,QAAK,WAAW,QACd;IAAE;IAAa;IAAgB,EAC/B,aACA,SAAU,OAAO,SAAe;AAC9B,QAAI,QAAQ;AACZ,QAAI,OAAO;AACT,aAAM,6BAA6B,OAAO;AAC1C,UAAK,MAAM;eACF,SAAS;AAClB,aAAM,yBAAyB,OAAO;AACtC,gBACE;MAAE;MAAQ,MAAM,aAAa;MAAM,EACnC,oDACD;AACD,WAAM;UAIN,OAAM,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,aAAa;KAG9D"}
+{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,gBAAA,aAAa,sBAAsB,IAAI,OAAO,QAAQ,IACtD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,QACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,QACd;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,QAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,QAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}

package/build/middlewares/allow.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"allow.mjs","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,6BAA6B;AAEtD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY;CAEjC,WAAW,IAAS,OAAY;CACjC,EACS;CACV,MAAM,EAAE,WAAW,aAAa;AAChC,QAAO,SAAU,QAA0B;AACzC,SAAO,SAAU,KAAqB,KAAsB,MAA8B;AACxF,OAAI,OAAO;GACX,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,aAAa,sBAAsB,IAAI,OAAO,SAAS,GACvD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;AACxB,SACE,iDACA,aAAa,MACb,QACA,aACA,eACD;AACD,eACE;IAAE;IAAQ,MAAM,aAAa;IAAM,EACnC,kDACD;AACD,QAAK,WAAW,QACd;IAAE;IAAa;IAAgB,EAC/B,aACA,SAAU,OAAO,SAAe;AAC9B,QAAI,QAAQ;AACZ,QAAI,OAAO;AACT,WAAM,6BAA6B,OAAO;AAC1C,UAAK,MAAM;eACF,SAAS;AAClB,WAAM,yBAAyB,OAAO;AACtC,gBACE;MAAE;MAAQ,MAAM,aAAa;MAAM,EACnC,oDACD;AACD,WAAM;UAIN,OAAM,WAAW,iBAAiB,UAAU,aAAa;KAG9D"}
+{"version":3,"file":"allow.mjs","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,aAAa,sBAAsB,IAAI,OAAO,QAAQ,IACtD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,MACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,QACd;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,MAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,MAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,WAAW,iBAAiB,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}

package/build/middlewares/antiLoop.js

@@ -1,4 +1,3 @@
-require("../_virtual/_rolldown/runtime.js");
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/middlewares/antiLoop.ts
 /**

package/build/middlewares/antiLoop.js.map

@@ -1 +1 @@
-{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;AAUA,SAAgB,SAAS,QAAgB;AACvC,QAAO,SAAU,KAAqB,KAAsB,MAA8B;AACxF,MAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI;AACtC,OAAI,MAAM,QAAQ,IAAI,CACpB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,MAAM,CAAC,MAAM,MAAM;AAExC,QAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,KAC7B,OAAO,UACtB,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,eAAe,gBAAgB,CAAC;;;;AAMrF,QAAM"}
+{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,KAAK,EAAE,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}

package/build/middlewares/antiLoop.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;AACvC,QAAO,SAAU,KAAqB,KAAsB,MAA8B;AACxF,MAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,MAAM,EAAE,MAAM,IAAI;AACtC,OAAI,MAAM,QAAQ,IAAI,CACpB,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,MAAM,CAAC,MAAM,MAAM;AAExC,QAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,KAC7B,OAAO,UACtB,QAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,gBAAgB,CAAC;;;;AAMrF,QAAM"}
+{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,KAAK,EAAE,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}

package/build/middlewares/api_urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_urls.js","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,YAAA;AACA,oBAAA,cAAA;AACA,oBAAA,cAAA;AACA,oBAAA,gBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,+BAAA;;KACD;AAED,IAAY,uBAAL,yBAAA,sBAAA;AACL,sBAAA,YAAA;AACA,sBAAA,uBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;AACA,uBAAA,qBAAA;AACA,uBAAA,oBAAA;;KACD;AAED,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,UAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,4BAAA;AACA,uBAAA,yBAAA;;KACD;AAED,IAAY,0BAAL,yBAAA,yBAAA;AACL,yBAAA,aAAA;AACA,yBAAA,qBAAA;AACA,yBAAA,mBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,gBAAA;AACA,qBAAA,kBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,WAAA;AACA,qBAAA,eAAA;AACA,qBAAA,uBAAA;AACA,qBAAA,gBAAA;AACA,qBAAA,wBAAA;;KACD"}
+{"version":3,"file":"api_urls.js","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,YAAA;CACA,mBAAA,cAAA;CACA,mBAAA,cAAA;CACA,mBAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,+BAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,uBAAL,yBAAA,sBAAA;CACL,qBAAA,YAAA;CACA,qBAAA,uBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;CACA,sBAAA,qBAAA;CACA,sBAAA,oBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,UAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,4BAAA;CACA,sBAAA,yBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,0BAAL,yBAAA,yBAAA;CACL,wBAAA,aAAA;CACA,wBAAA,qBAAA;CACA,wBAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,gBAAA;CACA,oBAAA,kBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,WAAA;CACA,oBAAA,eAAA;CACA,oBAAA,uBAAA;CACA,oBAAA,gBAAA;CACA,oBAAA,wBAAA;;AACF,EAAA,CAAA,CAAA"}

package/build/middlewares/api_urls.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"api_urls.mjs","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,YAAA;AACA,oBAAA,cAAA;AACA,oBAAA,cAAA;AACA,oBAAA,gBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,+BAAA;;KACD;AAED,IAAY,uBAAL,yBAAA,sBAAA;AACL,sBAAA,YAAA;AACA,sBAAA,uBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;AACA,uBAAA,qBAAA;AACA,uBAAA,oBAAA;;KACD;AAED,IAAY,qBAAL,yBAAA,oBAAA;AACL,oBAAA,UAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,4BAAA;AACA,uBAAA,yBAAA;;KACD;AAED,IAAY,0BAAL,yBAAA,yBAAA;AACL,yBAAA,aAAA;AACA,yBAAA,qBAAA;AACA,yBAAA,mBAAA;;KACD;AAED,IAAY,wBAAL,yBAAA,uBAAA;AACL,uBAAA,iBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,gBAAA;AACA,qBAAA,kBAAA;;KACD;AAED,IAAY,sBAAL,yBAAA,qBAAA;AACL,qBAAA,WAAA;AACA,qBAAA,eAAA;AACA,qBAAA,uBAAA;AACA,qBAAA,gBAAA;AACA,qBAAA,wBAAA;;KACD"}
+{"version":3,"file":"api_urls.mjs","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,YAAA;CACA,mBAAA,cAAA;CACA,mBAAA,cAAA;CACA,mBAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,+BAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,uBAAL,yBAAA,sBAAA;CACL,qBAAA,YAAA;CACA,qBAAA,uBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;CACA,sBAAA,qBAAA;CACA,sBAAA,oBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,UAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,4BAAA;CACA,sBAAA,yBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,0BAAL,yBAAA,yBAAA;CACL,wBAAA,aAAA;CACA,wBAAA,qBAAA;CACA,wBAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,gBAAA;CACA,oBAAA,kBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,WAAA;CACA,oBAAA,eAAA;CACA,oBAAA,uBAAA;CACA,oBAAA,gBAAA;CACA,oBAAA,wBAAA;;AACF,EAAA,CAAA,CAAA"}

package/build/middlewares/body-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,mCAAmC;;;;AAK5D,SAAS,cAAc,KAAoC;AAGzD,SADe,IAAY,SAAU,IAAY,SAAS,SAAS,EAAE,EACxD,MAAM,eAAoB;AACrC,SAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;GACvE;;;;;;;AAQJ,SAAgB,mBAAmB,KAA2B,QAAsB;AAElF,KAAI,cAAc,IAAI,CACpB,SAAM,iCAAiC;KAEvC,KAAI,IACF,QAAA,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;EAChC,CAAC,CACH"}
+{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,GACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,QAAM,gCAAgC;MAEtC,IAAI,IACF,QAAA,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}

package/build/middlewares/body-parser.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"body-parser.mjs","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,mCAAmC;;;;AAK5D,SAAS,cAAc,KAAoC;AAGzD,SADe,IAAY,SAAU,IAAY,SAAS,SAAS,EAAE,EACxD,MAAM,eAAoB;AACrC,SAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;GACvE;;;;;;;AAQJ,SAAgB,mBAAmB,KAA2B,QAAsB;AAElF,KAAI,cAAc,IAAI,CACpB,OAAM,iCAAiC;KAEvC,KAAI,IACF,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;EAChC,CAAC,CACH"}
+{"version":3,"file":"body-parser.mjs","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,GACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,MAAM,gCAAgC;MAEtC,IAAI,IACF,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}

package/build/middlewares/dotfiles.js

@@ -1,4 +1,3 @@
-require("../_virtual/_rolldown/runtime.js");
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/middlewares/dotfiles.ts
 /**

package/build/middlewares/dotfiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"dotfiles.js","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;AAC1D,QAAO,SAAS,mBACd,KACA,KACA,MACM;AACN,MACE,WAAW,WACX,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,YAAY,QAAQ,WAAW,IAAI,IAAI,QAAQ,SAAS,EAAE,EACpF;AACA,OAAI,WAAW,QAAQ;AACrB,QAAI,aAAa,gBAAA,YAAY;AAC7B,QAAI,KAAK;SAET,MAAK,gBAAA,WAAW,YAAY,qBAAqB,CAAC;AAEpD;;AAEF,QAAM"}
+{"version":3,"file":"dotfiles.js","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;CAC1D,OAAO,SAAS,mBACd,KACA,KACA,MACM;EACN,IACE,WAAW,WACX,IAAI,KAAK,MAAM,GAAG,EAAE,MAAM,YAAY,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,GACnF;GACA,IAAI,WAAW,QAAQ;IACrB,IAAI,aAAa,gBAAA,YAAY;IAC7B,IAAI,IAAI;GACV,OACE,KAAK,gBAAA,WAAW,YAAY,oBAAoB,CAAC;GAEnD;EACF;EACA,KAAK;CACP;AACF"}

package/build/middlewares/dotfiles.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dotfiles.mjs","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;AAC1D,QAAO,SAAS,mBACd,KACA,KACA,MACM;AACN,MACE,WAAW,WACX,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,YAAY,QAAQ,WAAW,IAAI,IAAI,QAAQ,SAAS,EAAE,EACpF;AACA,OAAI,WAAW,QAAQ;AACrB,QAAI,aAAa,YAAY;AAC7B,QAAI,KAAK;SAET,MAAK,WAAW,YAAY,qBAAqB,CAAC;AAEpD;;AAEF,QAAM"}
+{"version":3,"file":"dotfiles.mjs","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;CAC1D,OAAO,SAAS,mBACd,KACA,KACA,MACM;EACN,IACE,WAAW,WACX,IAAI,KAAK,MAAM,GAAG,EAAE,MAAM,YAAY,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,GACnF;GACA,IAAI,WAAW,QAAQ;IACrB,IAAI,aAAa,YAAY;IAC7B,IAAI,IAAI;GACV,OACE,KAAK,WAAW,YAAY,oBAAoB,CAAC;GAEnD;EACF;EACA,KAAK;CACP;AACF"}

package/build/middlewares/encode-pkg.js.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,8BAA8B;;;;;;;AAQvD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;AAGrB,KAAI,CAAC,IAAI,IAAI,WAAW,IAAI,CAC1B,QAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,qBAAqB,CAAC;AASrF,KAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,KAAK,CAAC,QAAQ,uBAAuB,QAAQ;AAEhF,KAAI,aAAa,IAAI,IACnB,SAAM,gCAAgC,UAAU,IAAI,IAAI;KAExD,SAAM,sCAAsC,SAAS;AAEvD,OAAM"}
+{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,EAAE,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,QAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,QAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}

package/build/middlewares/encode-pkg.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.mjs","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,8BAA8B;;;;;;;AAQvD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;AAGrB,KAAI,CAAC,IAAI,IAAI,WAAW,IAAI,CAC1B,QAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,qBAAqB,CAAC;AASrF,KAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,KAAK,CAAC,QAAQ,uBAAuB,QAAQ;AAEhF,KAAI,aAAa,IAAI,IACnB,OAAM,gCAAgC,UAAU,IAAI,IAAI;KAExD,OAAM,sCAAsC,SAAS;AAEvD,OAAM"}
+{"version":3,"file":"encode-pkg.mjs","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,EAAE,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,MAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,MAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}

package/build/middlewares/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,SAAmB,6BAA6B;AAEtD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;AACA,SAAM,qBAAqB;AAC3B,MAAA,GAAA,UAAA,SAAY,IAAI,EAAE;AAChB,UAAM,kBAAkB;AACxB,MAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,gBAAA,YAAY,aAC9D,QAAO,MAAM;AAEf,MAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;AACjD,WAAM,6BAA6B;AAGnC,4BAAyB,OAAO,CAAC,KAAK,KAAK,UAAA,KAAK;;AAElD,UAAM,8BAA8B;AACpC,MAAI,OAAO,aAAa,IAAI;QACvB;AAEL,UAAM,sCAAsC;AAC5C,SAAO,KAAK,IAAI;;;AAKtB,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;AACN,SAAM,gCAAgC;AACtC,KAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;AACnC,MAAI,IAAI,UAAU,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,KAAK;AAC3E,WAAM,qBAAqB,KAAK,OAAO;AACvC,QAAA,GAAA,UAAA,OAAU,IAAI,YAAY,KAAK,OAAO;AACpC,YAAM,kBAAkB,KAAK,OAAO;AACpC,QAAI,OAAO,IAAI,OAAO;AACtB,YAAM,iBAAiB,KAAK,QAAQ;AACpC,SAAK,EAAE,OAAO,IAAI,WAAW,gBAAA,UAAU,eAAe,CAAC;;SAEpD;AACL,WAAM,qBAAqB,KAAK,OAAO;AACvC,UAAO,MAAM,EAAO,KAAK,EAAE,kDAAkD;AAC7E,OAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAE5B,WAAO,MAAM,qDAAqD;AAClE,YAAM,2EAA2E,IAAI;AACrF,QAAI,SAAS;cACJ,CAAC,IAAI,aAAa;AAC3B,YAAM,0BAA0B,IAAI;AACpC,QAAI,OAAO,gBAAA,YAAY,eAAe;AACtC,SAAK,EAAE,OAAO,gBAAA,UAAU,uBAAuB,CAAC;SAGhD,SAAM,+CAA+C,IAAI;;;AAKjE,SAAM,uDAAuD;AAC7D,OAAM"}
+{"version":3,"file":"error.js","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,QAAM,oBAAoB;CAC1B,KAAA,GAAA,UAAA,SAAY,GAAG,GAAG;EAChB,QAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,gBAAA,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,QAAM,4BAA4B;GAGlC,yBAAyB,MAAM,EAAE,KAAK,KAAK,UAAA,IAAI;EACjD;EACA,QAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,QAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,QAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,QAAM,qBAAqB,KAAK,MAAM;GACtC,KAAA,GAAA,UAAA,OAAU,IAAI,WAAW,MAAM,OAAO;IACpC,QAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,QAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,gBAAA,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,QAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,QAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,QAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,gBAAA,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,gBAAA,UAAU,sBAAsB,CAAC;GACjD,OAEE,QAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,QAAM,sDAAsD;CAC5D,KAAK;AACP"}

package/build/middlewares/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;AAUA,IAAM,QAAQ,WAAW,6BAA6B;AAEtD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;AACA,OAAM,qBAAqB;AAC3B,KAAI,QAAQ,IAAI,EAAE;AAChB,QAAM,kBAAkB;AACxB,MAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,YAAY,aAC9D,QAAO,MAAM;AAEf,MAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;AACjD,SAAM,6BAA6B;AAGnC,4BAAyB,OAAO,CAAC,KAAK,KAAK,KAAK;;AAElD,QAAM,8BAA8B;AACpC,MAAI,OAAO,aAAa,IAAI;QACvB;AAEL,QAAM,sCAAsC;AAC5C,SAAO,KAAK,IAAI;;;AAKtB,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;AACN,OAAM,gCAAgC;AACtC,KAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;AACnC,MAAI,IAAI,UAAU,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,KAAK;AAC3E,SAAM,qBAAqB,KAAK,OAAO;AACvC,OAAI,MAAM,IAAI,YAAY,KAAK,OAAO;AACpC,UAAM,kBAAkB,KAAK,OAAO;AACpC,QAAI,OAAO,IAAI,OAAO;AACtB,UAAM,iBAAiB,KAAK,QAAQ;AACpC,SAAK,EAAE,OAAO,IAAI,WAAW,UAAU,eAAe,CAAC;;SAEpD;AACL,SAAM,qBAAqB,KAAK,OAAO;AACvC,UAAO,MAAM,EAAO,KAAK,EAAE,kDAAkD;AAC7E,OAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;AAE5B,WAAO,MAAM,qDAAqD;AAClE,UAAM,2EAA2E,IAAI;AACrF,QAAI,SAAS;cACJ,CAAC,IAAI,aAAa;AAC3B,UAAM,0BAA0B,IAAI;AACpC,QAAI,OAAO,YAAY,eAAe;AACtC,SAAK,EAAE,OAAO,UAAU,uBAAuB,CAAC;SAGhD,OAAM,+CAA+C,IAAI;;;AAKjE,OAAM,uDAAuD;AAC7D,OAAM"}
+{"version":3,"file":"error.mjs","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;AAUA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,MAAM,oBAAoB;CAC1B,IAAI,QAAQ,GAAG,GAAG;EAChB,MAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,MAAM,4BAA4B;GAGlC,yBAAyB,MAAM,EAAE,KAAK,KAAK,IAAI;EACjD;EACA,MAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,MAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,MAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,MAAM,qBAAqB,KAAK,MAAM;GACtC,IAAI,MAAM,IAAI,WAAW,MAAM,OAAO;IACpC,MAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,MAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,MAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,MAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,MAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,UAAU,sBAAsB,CAAC;GACjD,OAEE,MAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,MAAM,sDAAsD;CAC5D,KAAK;AACP"}

package/build/middlewares/final.js.map

@@ -1 +1 @@
-{"version":3,"file":"final.js","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    debug('set auth header support');\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (typeof body === 'string' || isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        debug('set json type header support');\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          debug('set verdaccio_error method');\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        const etag = cryptoUtils.stringToMD5(body as string);\n        debug('set etag header %s', etag);\n        res.header(HEADERS.ETAG, '\"' + etag + '\"');\n      }\n    } else {\n      debug('this line should never be visible, if does report');\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      debug('set headers after they are sent');\n      if (isNil(res.socket) === false) {\n        debug('force destroy socket');\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,SAAmB,6BAA6B;AAEtD,SAAgB,MACd,MACA,KACA,KAGA,MACM;AACN,KAAI,IAAI,eAAe,gBAAA,YAAY,gBAAgB,CAAC,IAAI,UAAU,gBAAA,QAAQ,SAAS,EAAE;AACnF,UAAM,0BAA0B;AAChC,MAAI,OAAO,gBAAA,QAAQ,UAAU,GAAG,gBAAA,YAAY,IAAI,gBAAA,eAAe;;AAGjE,KAAI;AACF,MAAI,OAAO,SAAS,aAAA,GAAA,UAAA,UAAqB,KAAK,EAAE;AAC9C,OAAI,CAAC,IAAI,IAAI,gBAAA,QAAQ,aAAa,EAAE;AAClC,YAAM,+BAA+B;AACrC,QAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,KAAK;;AAGhD,OAAI,OAAO,SAAS,aAAA,GAAA,UAAA,OAAkB,KAAK,KAAK,OAAO;AACrD,QAAI,OAAQ,KAAyB,UAAU,UAAU;AACvD,aAAM,6BAA6B;AACnC,SAAI,OAAO,mBAAoB,KAAyB;;AAE1D,WAAO,KAAK,UAAU,MAAM,KAAA,GAAW,KAAK,GAAG;;AAIjD,OACE,CAAC,IAAI,cACJ,IAAI,cAAc,gBAAA,YAAY,MAAM,IAAI,aAAa,gBAAA,YAAY,kBAClE;IACA,MAAM,OAAO,gBAAA,YAAY,YAAY,KAAe;AACpD,YAAM,sBAAsB,KAAK;AACjC,QAAI,OAAO,gBAAA,QAAQ,MAAM,OAAM,OAAO,KAAI;;QAG5C,SAAM,oDAAoD;UAGrD,KAAU;AAIjB,MAAI,IAAI,QAAQ,MAAM,kCAAkC,EAAE;AACxD,WAAM,kCAAkC;AACxC,QAAA,GAAA,UAAA,OAAU,IAAI,OAAO,KAAK,OAAO;AAC/B,YAAM,uBAAuB;AAC7B,QAAI,QAAQ,SAAS;;AAEvB;;AAEF,QAAM;;AAGR,KAAI,KAAK,KAAK"}
+{"version":3,"file":"final.js","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    debug('set auth header support');\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (typeof body === 'string' || isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        debug('set json type header support');\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          debug('set verdaccio_error method');\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        const etag = cryptoUtils.stringToMD5(body as string);\n        debug('set etag header %s', etag);\n        res.header(HEADERS.ETAG, '\"' + etag + '\"');\n      }\n    } else {\n      debug('this line should never be visible, if does report');\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      debug('set headers after they are sent');\n      if (isNil(res.socket) === false) {\n        debug('force destroy socket');\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,KACA,KAGA,MACM;CACN,IAAI,IAAI,eAAe,gBAAA,YAAY,gBAAgB,CAAC,IAAI,UAAU,gBAAA,QAAQ,QAAQ,GAAG;EACnF,QAAM,yBAAyB;EAC/B,IAAI,OAAO,gBAAA,QAAQ,UAAU,GAAG,gBAAA,YAAY,IAAI,gBAAA,cAAc;CAChE;CAEA,IAAI;EACF,IAAI,OAAO,SAAS,aAAA,GAAA,UAAA,UAAqB,IAAI,GAAG;GAC9C,IAAI,CAAC,IAAI,IAAI,gBAAA,QAAQ,YAAY,GAAG;IAClC,QAAM,8BAA8B;IACpC,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,IAAI;GAC/C;GAEA,IAAI,OAAO,SAAS,aAAA,GAAA,UAAA,OAAkB,IAAI,MAAM,OAAO;IACrD,IAAI,OAAQ,KAAyB,UAAU,UAAU;KACvD,QAAM,4BAA4B;KAClC,IAAI,OAAO,mBAAoB,KAAyB;IAC1D;IACA,OAAO,KAAK,UAAU,MAAM,KAAA,GAAW,IAAI,IAAI;GACjD;GAGA,IACE,CAAC,IAAI,cACJ,IAAI,cAAc,gBAAA,YAAY,MAAM,IAAI,aAAa,gBAAA,YAAY,kBAClE;IACA,MAAM,OAAO,gBAAA,YAAY,YAAY,IAAc;IACnD,QAAM,sBAAsB,IAAI;IAChC,IAAI,OAAO,gBAAA,QAAQ,MAAM,OAAM,OAAO,IAAG;GAC3C;EACF,OACE,QAAM,mDAAmD;CAG7D,SAAS,KAAU;EAIjB,IAAI,IAAI,QAAQ,MAAM,iCAAiC,GAAG;GACxD,QAAM,iCAAiC;GACvC,KAAA,GAAA,UAAA,OAAU,IAAI,MAAM,MAAM,OAAO;IAC/B,QAAM,sBAAsB;IAC5B,IAAI,QAAQ,QAAQ;GACtB;GACA;EACF;EACA,MAAM;CACR;CAEA,IAAI,KAAK,IAAI;AACf"}

package/build/middlewares/final.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"final.mjs","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    debug('set auth header support');\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (typeof body === 'string' || isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        debug('set json type header support');\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          debug('set verdaccio_error method');\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        const etag = cryptoUtils.stringToMD5(body as string);\n        debug('set etag header %s', etag);\n        res.header(HEADERS.ETAG, '\"' + etag + '\"');\n      }\n    } else {\n      debug('this line should never be visible, if does report');\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      debug('set headers after they are sent');\n      if (isNil(res.socket) === false) {\n        debug('force destroy socket');\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;AAUA,IAAM,QAAQ,WAAW,6BAA6B;AAEtD,SAAgB,MACd,MACA,KACA,KAGA,MACM;AACN,KAAI,IAAI,eAAe,YAAY,gBAAgB,CAAC,IAAI,UAAU,QAAQ,SAAS,EAAE;AACnF,QAAM,0BAA0B;AAChC,MAAI,OAAO,QAAQ,UAAU,GAAG,YAAY,IAAI,eAAe;;AAGjE,KAAI;AACF,MAAI,OAAO,SAAS,YAAY,SAAS,KAAK,EAAE;AAC9C,OAAI,CAAC,IAAI,IAAI,QAAQ,aAAa,EAAE;AAClC,UAAM,+BAA+B;AACrC,QAAI,OAAO,QAAQ,cAAc,QAAQ,KAAK;;AAGhD,OAAI,OAAO,SAAS,YAAY,MAAM,KAAK,KAAK,OAAO;AACrD,QAAI,OAAQ,KAAyB,UAAU,UAAU;AACvD,WAAM,6BAA6B;AACnC,SAAI,OAAO,mBAAoB,KAAyB;;AAE1D,WAAO,KAAK,UAAU,MAAM,KAAA,GAAW,KAAK,GAAG;;AAIjD,OACE,CAAC,IAAI,cACJ,IAAI,cAAc,YAAY,MAAM,IAAI,aAAa,YAAY,kBAClE;IACA,MAAM,OAAO,YAAY,YAAY,KAAe;AACpD,UAAM,sBAAsB,KAAK;AACjC,QAAI,OAAO,QAAQ,MAAM,OAAM,OAAO,KAAI;;QAG5C,OAAM,oDAAoD;UAGrD,KAAU;AAIjB,MAAI,IAAI,QAAQ,MAAM,kCAAkC,EAAE;AACxD,SAAM,kCAAkC;AACxC,OAAI,MAAM,IAAI,OAAO,KAAK,OAAO;AAC/B,UAAM,uBAAuB;AAC7B,QAAI,QAAQ,SAAS;;AAEvB;;AAEF,QAAM;;AAGR,KAAI,KAAK,KAAK"}
+{"version":3,"file":"final.mjs","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    debug('set auth header support');\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (typeof body === 'string' || isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        debug('set json type header support');\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          debug('set verdaccio_error method');\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        const etag = cryptoUtils.stringToMD5(body as string);\n        debug('set etag header %s', etag);\n        res.header(HEADERS.ETAG, '\"' + etag + '\"');\n      }\n    } else {\n      debug('this line should never be visible, if does report');\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      debug('set headers after they are sent');\n      if (isNil(res.socket) === false) {\n        debug('force destroy socket');\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;AAUA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,KACA,KAGA,MACM;CACN,IAAI,IAAI,eAAe,YAAY,gBAAgB,CAAC,IAAI,UAAU,QAAQ,QAAQ,GAAG;EACnF,MAAM,yBAAyB;EAC/B,IAAI,OAAO,QAAQ,UAAU,GAAG,YAAY,IAAI,cAAc;CAChE;CAEA,IAAI;EACF,IAAI,OAAO,SAAS,YAAY,SAAS,IAAI,GAAG;GAC9C,IAAI,CAAC,IAAI,IAAI,QAAQ,YAAY,GAAG;IAClC,MAAM,8BAA8B;IACpC,IAAI,OAAO,QAAQ,cAAc,QAAQ,IAAI;GAC/C;GAEA,IAAI,OAAO,SAAS,YAAY,MAAM,IAAI,MAAM,OAAO;IACrD,IAAI,OAAQ,KAAyB,UAAU,UAAU;KACvD,MAAM,4BAA4B;KAClC,IAAI,OAAO,mBAAoB,KAAyB;IAC1D;IACA,OAAO,KAAK,UAAU,MAAM,KAAA,GAAW,IAAI,IAAI;GACjD;GAGA,IACE,CAAC,IAAI,cACJ,IAAI,cAAc,YAAY,MAAM,IAAI,aAAa,YAAY,kBAClE;IACA,MAAM,OAAO,YAAY,YAAY,IAAc;IACnD,MAAM,sBAAsB,IAAI;IAChC,IAAI,OAAO,QAAQ,MAAM,OAAM,OAAO,IAAG;GAC3C;EACF,OACE,MAAM,mDAAmD;CAG7D,SAAS,KAAU;EAIjB,IAAI,IAAI,QAAQ,MAAM,iCAAiC,GAAG;GACxD,MAAM,iCAAiC;GACvC,IAAI,MAAM,IAAI,MAAM,MAAM,OAAO;IAC/B,MAAM,sBAAsB;IAC5B,IAAI,QAAQ,QAAQ;GACtB;GACA;EACF;EACA,MAAM;CACR;CAEA,IAAI,KAAK,IAAI;AACf"}

package/build/middlewares/json.js

@@ -1,4 +1,3 @@
-require("../_virtual/_rolldown/runtime.js");
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/middlewares/json.ts
 function expectJson(req, res, next) {

package/build/middlewares/json.js.map

@@ -1 +1 @@
-{"version":3,"file":"json.js","names":[],"sources":["../../src/middlewares/json.ts"],"sourcesContent":["import { errorUtils, validationUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function expectJson(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (!validationUtils.isObject(req.body)) {\n    return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n  }\n  next();\n}\n"],"mappings":";;;AAIA,SAAgB,WACd,KACA,KACA,MACM;AACN,KAAI,CAAC,gBAAA,gBAAgB,SAAS,IAAI,KAAK,CACrC,QAAO,KAAK,gBAAA,WAAW,cAAc,4BAA4B,CAAC;AAEpE,OAAM"}
+{"version":3,"file":"json.js","names":[],"sources":["../../src/middlewares/json.ts"],"sourcesContent":["import { errorUtils, validationUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function expectJson(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (!validationUtils.isObject(req.body)) {\n    return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n  }\n  next();\n}\n"],"mappings":";;AAIA,SAAgB,WACd,KACA,KACA,MACM;CACN,IAAI,CAAC,gBAAA,gBAAgB,SAAS,IAAI,IAAI,GACpC,OAAO,KAAK,gBAAA,WAAW,cAAc,2BAA2B,CAAC;CAEnE,KAAK;AACP"}

package/build/middlewares/json.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"json.mjs","names":[],"sources":["../../src/middlewares/json.ts"],"sourcesContent":["import { errorUtils, validationUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function expectJson(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (!validationUtils.isObject(req.body)) {\n    return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n  }\n  next();\n}\n"],"mappings":";;AAIA,SAAgB,WACd,KACA,KACA,MACM;AACN,KAAI,CAAC,gBAAgB,SAAS,IAAI,KAAK,CACrC,QAAO,KAAK,WAAW,cAAc,4BAA4B,CAAC;AAEpE,OAAM"}
+{"version":3,"file":"json.mjs","names":[],"sources":["../../src/middlewares/json.ts"],"sourcesContent":["import { errorUtils, validationUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function expectJson(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  if (!validationUtils.isObject(req.body)) {\n    return next(errorUtils.getBadRequest(\"can't parse incoming json\"));\n  }\n  next();\n}\n"],"mappings":";;AAIA,SAAgB,WACd,KACA,KACA,MACM;CACN,IAAI,CAAC,gBAAgB,SAAS,IAAI,IAAI,GACpC,OAAO,KAAK,WAAW,cAAc,2BAA2B,CAAC;CAEnE,KAAK;AACP"}

package/build/middlewares/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n  return url.startsWith('/-/static/');\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport type LogOptions = {\n  // When true, static file requests (/-/static/*) are hidden from pino logs\n  // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n  hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n  const { hideStaticLogs = true } = options;\n\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n    if (_skipLog) {\n      debug(\"@{ip} requested '@{req.method} @{req.url}'\", { ip: req.ip, req });\n    } else {\n      req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    }\n    req.originalUrl = req.url;\n\n    if (isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // @ts-ignore\n    res.write = function (...args): boolean {\n      bytesout += args[0]?.length || 0;\n      // @ts-ignore\n      return _write.apply(res, args);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.socket.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      if (_skipLog) {\n        debug(message, {\n          request: { method: req.method, url: req.url },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: { in: bytesin, out: bytesout },\n        });\n      } else {\n        req.log.http(\n          {\n            request: {\n              method: req.method,\n              url: req.url,\n            },\n            user: req.remote_user?.name || null,\n            remoteIP,\n            status: res.statusCode,\n            error: res.locals._verdaccio_error,\n            bytes: {\n              in: bytesin,\n              out: bytesout,\n            },\n          },\n          message\n        );\n      }\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (...args): void {\n      if (args[0]) {\n        bytesout += args[0].length;\n      }\n      // @ts-ignore\n      _end.apply(res, args);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,2BAA2B;AAEpD,SAAS,gBAAgB,KAAsB;AAC7C,QAAO,IAAI,WAAW,aAAa;;AAIrC,IAAa,qBACX;AACF,IAAa,sBAAsB,GAAG,mBAAmB;AACzD,IAAa,sBAAsB,GAAG,mBAAmB;AAQzD,IAAa,OAAO,QAAQ,UAAsB,EAAE,KAAK;CACvD,MAAM,EAAE,iBAAiB,SAAS;AAElC,QAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;AAE3F,MAAI,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,CAAC;EAErC,MAAM,QAAQ,IAAI,QAAQ;AAC1B,OAAA,GAAA,UAAA,OAAU,MAAM,KAAK,MACnB,KAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,SAAS;AACjC,OAAA,GAAA,UAAA,OAAU,QAAQ,KAAK,MACrB,KAAI,QAAQ,SAAS;AAGvB,MAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,IAAI;AAC3D,MAAI,SACF,SAAM,8CAA8C;GAAE,IAAI,IAAI;GAAI;GAAK,CAAC;MAExE,KAAI,IAAI,KAAK;GAAO;GAAK,IAAI,IAAI;GAAI,EAAE,6CAA6C;AAEtF,MAAI,cAAc,IAAI;AAEtB,OAAA,GAAA,UAAA,OAAU,MAAM,KAAK,MACnB,KAAI,QAAQ,gBAAgB;AAG9B,OAAA,GAAA,UAAA,OAAU,QAAQ,KAAK,MACrB,KAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;AACd,MAAI,GAAG,QAAQ,SAAU,OAAa;AACpC,cAAW,MAAM;IACjB;EAEF,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;AAEnB,MAAI,QAAQ,SAAU,GAAG,MAAe;AACtC,eAAY,KAAK,IAAI,UAAU;AAE/B,UAAO,OAAO,MAAM,KAAK,KAAK;;EAGhC,MAAM,MAAM,WAAkB;GAC5B,MAAM,eAAe,IAAI,IAAI,gBAAA,QAAQ,cAAc;GACnD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,IAAI;AACJ,OAAI,IAAI,OAAO,iBACb,WAAU;OAEV,WAAU;AAGZ,OAAI,MAAM,IAAI;AACd,OAAI,SACF,SAAM,SAAS;IACb,SAAS;KAAE,QAAQ,IAAI;KAAQ,KAAK,IAAI;KAAK;IAC7C,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KAAE,IAAI;KAAS,KAAK;KAAU;IACtC,CAAC;OAEF,KAAI,IAAI,KACN;IACE,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;KACV;IACD,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;KACN;IACF,EACD,QACD;AAEH,OAAI,cAAc,IAAI;;AAGxB,MAAI,GAAG,SAAS,WAAkB;AAChC,QAAK;IACL;EAEF,MAAM,OAAO,IAAI;AAEjB,MAAI,MAAM,SAAU,GAAG,MAAY;AACjC,OAAI,KAAK,GACP,aAAY,KAAK,GAAG;AAGtB,QAAK,MAAM,KAAK,KAAK;AACrB,QAAK;;AAEP,QAAM"}
+{"version":3,"file":"log.js","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n  return url.startsWith('/-/static/');\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport type LogOptions = {\n  // When true, static file requests (/-/static/*) are hidden from pino logs\n  // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n  hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n  const { hideStaticLogs = true } = options;\n\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n    if (_skipLog) {\n      debug(\"@{ip} requested '@{req.method} @{req.url}'\", { ip: req.ip, req });\n    } else {\n      req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    }\n    req.originalUrl = req.url;\n\n    if (isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // @ts-ignore\n    res.write = function (...args): boolean {\n      bytesout += args[0]?.length || 0;\n      // @ts-ignore\n      return _write.apply(res, args);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.socket.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      if (_skipLog) {\n        debug(message, {\n          request: { method: req.method, url: req.url },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: { in: bytesin, out: bytesout },\n        });\n      } else {\n        req.log.http(\n          {\n            request: {\n              method: req.method,\n              url: req.url,\n            },\n            user: req.remote_user?.name || null,\n            remoteIP,\n            status: res.statusCode,\n            error: res.locals._verdaccio_error,\n            bytes: {\n              in: bytesin,\n              out: bytesout,\n            },\n          },\n          message\n        );\n      }\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (...args): void {\n      if (args[0]) {\n        bytesout += args[0].length;\n      }\n      // @ts-ignore\n      _end.apply(res, args);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY;AACpC;AAGA,IAAa,qBACX;AACF,IAAa,sBAAsB,GAAG,mBAAmB;AACzD,IAAa,sBAAsB,GAAG,mBAAmB;AAQzD,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,KAAA,GAAA,UAAA,OAAU,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,KAAA,GAAA,UAAA,OAAU,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI,UACF,QAAM,8CAA8C;GAAE,IAAI,IAAI;GAAI;EAAI,CAAC;OAEvE,IAAI,IAAI,KAAK;GAAO;GAAK,IAAI,IAAI;EAAG,GAAG,4CAA4C;EAErF,IAAI,cAAc,IAAI;EAEtB,KAAA,GAAA,UAAA,OAAU,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,KAAA,GAAA,UAAA,OAAU,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EAEnB,IAAI,QAAQ,SAAU,GAAG,MAAe;GACtC,YAAY,KAAK,IAAI,UAAU;GAE/B,OAAO,OAAO,MAAM,KAAK,IAAI;EAC/B;EAEA,MAAM,MAAM,WAAkB;GAC5B,MAAM,eAAe,IAAI,IAAI,gBAAA,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,IAAI;GACJ,IAAI,IAAI,OAAO,kBACb,UAAU;QAEV,UAAU;GAGZ,IAAI,MAAM,IAAI;GACd,IAAI,UACF,QAAM,SAAS;IACb,SAAS;KAAE,QAAQ,IAAI;KAAQ,KAAK,IAAI;IAAI;IAC5C,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KAAE,IAAI;KAAS,KAAK;IAAS;GACtC,CAAC;QAED,IAAI,IAAI,KACN;IACE,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF,GACA,OACF;GAEF,IAAI,cAAc,IAAI;EACxB;EAEA,IAAI,GAAG,SAAS,WAAkB;GAChC,IAAI;EACN,CAAC;EAED,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,GAAG,MAAY;GACjC,IAAI,KAAK,IACP,YAAY,KAAK,GAAG;GAGtB,KAAK,MAAM,KAAK,IAAI;GACpB,IAAI;EACN;EACA,KAAK;CACP;AACF"}

package/build/middlewares/log.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"log.mjs","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n  return url.startsWith('/-/static/');\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport type LogOptions = {\n  // When true, static file requests (/-/static/*) are hidden from pino logs\n  // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n  hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n  const { hideStaticLogs = true } = options;\n\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n    if (_skipLog) {\n      debug(\"@{ip} requested '@{req.method} @{req.url}'\", { ip: req.ip, req });\n    } else {\n      req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    }\n    req.originalUrl = req.url;\n\n    if (isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // @ts-ignore\n    res.write = function (...args): boolean {\n      bytesout += args[0]?.length || 0;\n      // @ts-ignore\n      return _write.apply(res, args);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.socket.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      if (_skipLog) {\n        debug(message, {\n          request: { method: req.method, url: req.url },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: { in: bytesin, out: bytesout },\n        });\n      } else {\n        req.log.http(\n          {\n            request: {\n              method: req.method,\n              url: req.url,\n            },\n            user: req.remote_user?.name || null,\n            remoteIP,\n            status: res.statusCode,\n            error: res.locals._verdaccio_error,\n            bytes: {\n              in: bytesin,\n              out: bytesout,\n            },\n          },\n          message\n        );\n      }\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (...args): void {\n      if (args[0]) {\n        bytesout += args[0].length;\n      }\n      // @ts-ignore\n      _end.apply(res, args);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,2BAA2B;AAEpD,SAAS,gBAAgB,KAAsB;AAC7C,QAAO,IAAI,WAAW,aAAa;;AAIrC,IAAa,qBACX;AACF,IAAa,sBAAsB,GAAG,mBAAmB;AACzD,IAAa,sBAAsB,GAAG,mBAAmB;AAQzD,IAAa,OAAO,QAAQ,UAAsB,EAAE,KAAK;CACvD,MAAM,EAAE,iBAAiB,SAAS;AAElC,QAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;AAE3F,MAAI,MAAM,OAAO,MAAM,EAAE,KAAK,MAAM,CAAC;EAErC,MAAM,QAAQ,IAAI,QAAQ;AAC1B,MAAI,MAAM,MAAM,KAAK,MACnB,KAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,SAAS;AACjC,MAAI,MAAM,QAAQ,KAAK,MACrB,KAAI,QAAQ,SAAS;AAGvB,MAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,IAAI;AAC3D,MAAI,SACF,OAAM,8CAA8C;GAAE,IAAI,IAAI;GAAI;GAAK,CAAC;MAExE,KAAI,IAAI,KAAK;GAAO;GAAK,IAAI,IAAI;GAAI,EAAE,6CAA6C;AAEtF,MAAI,cAAc,IAAI;AAEtB,MAAI,MAAM,MAAM,KAAK,MACnB,KAAI,QAAQ,gBAAgB;AAG9B,MAAI,MAAM,QAAQ,KAAK,MACrB,KAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;AACd,MAAI,GAAG,QAAQ,SAAU,OAAa;AACpC,cAAW,MAAM;IACjB;EAEF,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;AAEnB,MAAI,QAAQ,SAAU,GAAG,MAAe;AACtC,eAAY,KAAK,IAAI,UAAU;AAE/B,UAAO,OAAO,MAAM,KAAK,KAAK;;EAGhC,MAAM,MAAM,WAAkB;GAC5B,MAAM,eAAe,IAAI,IAAI,QAAQ,cAAc;GACnD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,IAAI;AACJ,OAAI,IAAI,OAAO,iBACb,WAAU;OAEV,WAAU;AAGZ,OAAI,MAAM,IAAI;AACd,OAAI,SACF,OAAM,SAAS;IACb,SAAS;KAAE,QAAQ,IAAI;KAAQ,KAAK,IAAI;KAAK;IAC7C,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KAAE,IAAI;KAAS,KAAK;KAAU;IACtC,CAAC;OAEF,KAAI,IAAI,KACN;IACE,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;KACV;IACD,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;KACN;IACF,EACD,QACD;AAEH,OAAI,cAAc,IAAI;;AAGxB,MAAI,GAAG,SAAS,WAAkB;AAChC,QAAK;IACL;EAEF,MAAM,OAAO,IAAI;AAEjB,MAAI,MAAM,SAAU,GAAG,MAAY;AACjC,OAAI,KAAK,GACP,aAAY,KAAK,GAAG;AAGtB,QAAK,MAAM,KAAK,KAAK;AACrB,QAAK;;AAEP,QAAM"}
+{"version":3,"file":"log.mjs","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n  return url.startsWith('/-/static/');\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport type LogOptions = {\n  // When true, static file requests (/-/static/*) are hidden from pino logs\n  // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n  hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n  const { hideStaticLogs = true } = options;\n\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n    if (_skipLog) {\n      debug(\"@{ip} requested '@{req.method} @{req.url}'\", { ip: req.ip, req });\n    } else {\n      req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    }\n    req.originalUrl = req.url;\n\n    if (isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // @ts-ignore\n    res.write = function (...args): boolean {\n      bytesout += args[0]?.length || 0;\n      // @ts-ignore\n      return _write.apply(res, args);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.socket.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      if (_skipLog) {\n        debug(message, {\n          request: { method: req.method, url: req.url },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: { in: bytesin, out: bytesout },\n        });\n      } else {\n        req.log.http(\n          {\n            request: {\n              method: req.method,\n              url: req.url,\n            },\n            user: req.remote_user?.name || null,\n            remoteIP,\n            status: res.statusCode,\n            error: res.locals._verdaccio_error,\n            bytes: {\n              in: bytesin,\n              out: bytesout,\n            },\n          },\n          message\n        );\n      }\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (...args): void {\n      if (args[0]) {\n        bytesout += args[0].length;\n      }\n      // @ts-ignore\n      _end.apply(res, args);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY;AACpC;AAGA,IAAa,qBACX;AACF,IAAa,sBAAsB,GAAG,mBAAmB;AACzD,IAAa,sBAAsB,GAAG,mBAAmB;AAQzD,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,MAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,IAAI,MAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI,UACF,MAAM,8CAA8C;GAAE,IAAI,IAAI;GAAI;EAAI,CAAC;OAEvE,IAAI,IAAI,KAAK;GAAO;GAAK,IAAI,IAAI;EAAG,GAAG,4CAA4C;EAErF,IAAI,cAAc,IAAI;EAEtB,IAAI,MAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,IAAI,MAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EAEnB,IAAI,QAAQ,SAAU,GAAG,MAAe;GACtC,YAAY,KAAK,IAAI,UAAU;GAE/B,OAAO,OAAO,MAAM,KAAK,IAAI;EAC/B;EAEA,MAAM,MAAM,WAAkB;GAC5B,MAAM,eAAe,IAAI,IAAI,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,IAAI;GACJ,IAAI,IAAI,OAAO,kBACb,UAAU;QAEV,UAAU;GAGZ,IAAI,MAAM,IAAI;GACd,IAAI,UACF,MAAM,SAAS;IACb,SAAS;KAAE,QAAQ,IAAI;KAAQ,KAAK,IAAI;IAAI;IAC5C,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KAAE,IAAI;KAAS,KAAK;IAAS;GACtC,CAAC;QAED,IAAI,IAAI,KACN;IACE,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF,GACA,OACF;GAEF,IAAI,cAAc,IAAI;EACxB;EAEA,IAAI,GAAG,SAAS,WAAkB;GAChC,IAAI;EACN,CAAC;EAED,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,GAAG,MAAY;GACjC,IAAI,KAAK,IACP,YAAY,KAAK,GAAG;GAGtB,KAAK,MAAM,KAAK,IAAI;GACpB,IAAI;EACN;EACA,KAAK;CACP;AACF"}

package/build/middlewares/make-url-relative.js.map

@@ -1 +1 @@
-{"version":3,"file":"make-url-relative.js","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,yCAAyC;;;;;;;AAQlE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;AACJ,KAAI;AAIF,QAAM,IAAI,SAAA,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,GAAG;UACzD,OAAO;AACd,SAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC;;AAI7E,KAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;AAE1C,KAAI,aAAa,IAAI,IACnB,SAAM,6BAA6B,UAAU,IAAI,IAAI;KAErD,SAAM,mCAAmC,SAAS;AAEpD,OAAM"}
+{"version":3,"file":"make-url-relative.js","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,wCAAwC;;;;;;;AAQjE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;CACJ,IAAI;EAIF,MAAM,IAAI,SAAA,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,EAAE;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;CAC5E;CAGA,IAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;CAE1C,IAAI,aAAa,IAAI,KACnB,QAAM,6BAA6B,UAAU,IAAI,GAAG;MAEpD,QAAM,mCAAmC,QAAQ;CAEnD,KAAK;AACP"}

package/build/middlewares/make-url-relative.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"make-url-relative.mjs","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,yCAAyC;;;;;;;AAQlE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;AACJ,KAAI;AAIF,QAAM,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,GAAG;UACzD,OAAO;AACd,SAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,GAAG,CAAC;;AAI7E,KAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;AAE1C,KAAI,aAAa,IAAI,IACnB,OAAM,6BAA6B,UAAU,IAAI,IAAI;KAErD,OAAM,mCAAmC,SAAS;AAEpD,OAAM"}
+{"version":3,"file":"make-url-relative.mjs","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // npm requests can contain the full URL, including the hostname, for example:\n  // tarball downloads. Removing the hostname makes the URL relative and allows\n  // the application to handle requests in a more consistent way.\n\n  let url;\n  try {\n    // In productive use, the URL is absolute (and base will be ignored)\n    // In tests, the URL might brelative (and base will be used)\n    // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n    url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n  } catch (error) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n  }\n\n  // Rebuild the URL without hostname\n  req.url = url.pathname + url.search + url.hash;\n\n  if (original !== req.url) {\n    debug('makeURLrelative: %o -> %o', original, req.url);\n  } else {\n    debug('makeURLrelative: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,wCAAwC;;;;;;;AAQjE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;CACJ,IAAI;EAIF,MAAM,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,EAAE;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;CAC5E;CAGA,IAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;CAE1C,IAAI,aAAa,IAAI,KACnB,MAAM,6BAA6B,UAAU,IAAI,GAAG;MAEpD,MAAM,mCAAmC,QAAQ;CAEnD,KAAK;AACP"}

package/build/middlewares/match.js.map

@@ -1 +1 @@
-{"version":3,"file":"match.js","names":[],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";AAEA,SAAgB,MAAM,QAAqB;AACzC,QAAO,SACL,KACA,KACA,MACA,OACM;AACN,MAAI,OAAO,KAAK,MAAM,CACpB,OAAM;MAEN,MAAK,QAAQ"}
+{"version":3,"file":"match.js","names":[],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";AAEA,SAAgB,MAAM,QAAqB;CACzC,OAAO,SACL,KACA,KACA,MACA,OACM;EACN,IAAI,OAAO,KAAK,KAAK,GACnB,KAAK;OAEL,KAAK,OAAO;CAEhB;AACF"}

package/build/middlewares/match.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"match.mjs","names":[],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";AAEA,SAAgB,MAAM,QAAqB;AACzC,QAAO,SACL,KACA,KACA,MACA,OACM;AACN,MAAI,OAAO,KAAK,MAAM,CACpB,OAAM;MAEN,MAAK,QAAQ"}
+{"version":3,"file":"match.mjs","names":[],"sources":["../../src/middlewares/match.ts"],"sourcesContent":["import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function match(regexp: RegExp): any {\n  return function (\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer,\n    value: string\n  ): void {\n    if (regexp.exec(value)) {\n      next();\n    } else {\n      next('route');\n    }\n  };\n}\n"],"mappings":";AAEA,SAAgB,MAAM,QAAqB;CACzC,OAAO,SACL,KACA,KACA,MACA,OACM;EACN,IAAI,OAAO,KAAK,KAAK,GACnB,KAAK;OAEL,KAAK,OAAO;CAEhB;AACF"}

package/build/middlewares/media.js

@@ -1,4 +1,3 @@
-require("../_virtual/_rolldown/runtime.js");
 let _verdaccio_core = require("@verdaccio/core");
 //#region src/middlewares/media.ts
 function media(expect) {

package/build/middlewares/media.js.map

@@ -1 +1 @@
-{"version":3,"file":"media.js","names":[],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get(HEADER_TYPE.CONTENT_TYPE)\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;;AAIA,SAAgB,MAAM,QAA4B;AAChD,QAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,MAAM,SAAS,IAAI,QAAQ,gBAAA,YAAY;AACvC,MAAI,CAAC,QAAQ;AACX,QACE,gBAAA,WAAW,QACT,gBAAA,YAAY,mBACZ,sCAAsC,OACvC,CACF;AACD;;AAGF,MAAI,OAAO,WAAW,YAAY,OAAO,MAAM,IAAI,CAAC,GAAG,MAAM,KAAK,OAChE,MACE,gBAAA,WAAW,QACT,gBAAA,YAAY,mBACZ,iCAAiC,SAAS,YAAY,IAAI,IAAI,gBAAA,YAAY,aAAa,CACxF,CACF;MAED,OAAM"}
+{"version":3,"file":"media.js","names":[],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get(HEADER_TYPE.CONTENT_TYPE)\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;AAIA,SAAgB,MAAM,QAA4B;CAChD,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,MAAM,SAAS,IAAI,QAAQ,gBAAA,YAAY;EACvC,IAAI,CAAC,QAAQ;GACX,KACE,gBAAA,WAAW,QACT,gBAAA,YAAY,mBACZ,sCAAsC,MACxC,CACF;GACA;EACF;EAEA,IAAI,OAAO,WAAW,YAAY,OAAO,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,QAChE,KACE,gBAAA,WAAW,QACT,gBAAA,YAAY,mBACZ,iCAAiC,SAAS,YAAY,IAAI,IAAI,gBAAA,YAAY,YAAY,CACxF,CACF;OAEA,KAAK;CAET;AACF"}

package/build/middlewares/media.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"media.mjs","names":[],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get(HEADER_TYPE.CONTENT_TYPE)\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;AAIA,SAAgB,MAAM,QAA4B;AAChD,QAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,MAAM,SAAS,IAAI,QAAQ,YAAY;AACvC,MAAI,CAAC,QAAQ;AACX,QACE,WAAW,QACT,YAAY,mBACZ,sCAAsC,OACvC,CACF;AACD;;AAGF,MAAI,OAAO,WAAW,YAAY,OAAO,MAAM,IAAI,CAAC,GAAG,MAAM,KAAK,OAChE,MACE,WAAW,QACT,YAAY,mBACZ,iCAAiC,SAAS,YAAY,IAAI,IAAI,YAAY,aAAa,CACxF,CACF;MAED,OAAM"}
+{"version":3,"file":"media.mjs","names":[],"sources":["../../src/middlewares/media.ts"],"sourcesContent":["import { HEADER_TYPE, HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function media(expect: string | null): any {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    const header = req.headers[HEADER_TYPE.CONTENT_TYPE];\n    if (!header) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'content-type is missing, expect: ' + expect\n        )\n      );\n      return;\n    }\n\n    if (typeof header !== 'string' || header.split(';')[0].trim() !== expect) {\n      next(\n        errorUtils.getCode(\n          HTTP_STATUS.UNSUPPORTED_MEDIA,\n          'wrong content-type, expect: ' + expect + ', got: ' + req.get(HEADER_TYPE.CONTENT_TYPE)\n        )\n      );\n    } else {\n      next();\n    }\n  };\n}\n"],"mappings":";;AAIA,SAAgB,MAAM,QAA4B;CAChD,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,MAAM,SAAS,IAAI,QAAQ,YAAY;EACvC,IAAI,CAAC,QAAQ;GACX,KACE,WAAW,QACT,YAAY,mBACZ,sCAAsC,MACxC,CACF;GACA;EACF;EAEA,IAAI,OAAO,WAAW,YAAY,OAAO,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,QAChE,KACE,WAAW,QACT,YAAY,mBACZ,iCAAiC,SAAS,YAAY,IAAI,IAAI,YAAY,YAAY,CACxF,CACF;OAEA,KAAK;CAET;AACF"}

package/build/middlewares/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;;;AAIA,SAAgB,UAAU,kBAAkC;AAE1D,SAAA,GAAA,mBAAA,SAD0B,iBAAiB"}
+{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;;;AAIA,SAAgB,UAAU,kBAAkC;CAE1D,QAAA,GAAA,mBAAA,SAD0B,gBACnB;AACT"}

package/build/middlewares/rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;AAIA,SAAgB,UAAU,kBAAkC;AAE1D,QADgB,UAAU,iBAAiB"}
+{"version":3,"file":"rate-limit.mjs","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n  const limiter = RateLimit(rateLimitOptions);\n  return limiter;\n}\n"],"mappings":";;AAIA,SAAgB,UAAU,kBAAkC;CAE1D,OADgB,UAAU,gBACnB;AACT"}

package/build/middlewares/request-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-options.js","names":[],"sources":["../../src/middlewares/request-options.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\n\nimport type { RequestOptions } from '@verdaccio/url';\n\nimport type { $RequestExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:request-options');\n\nexport function getRequestOptions(req: $RequestExtend): RequestOptions {\n  const requestOptions = {\n    // FIXME: decide if host should contain port or not\n    //\n    // Express 4:\n    // - req.host is marked as deprecated since it does not include the port\n    // - use req.headers['host'] instead, which includes the port\n    // Express 5:\n    // - req.host is fully supported and includes the port\n    // - https://expressjs.com/en/api.html#req.host\n    host: req.host,\n    protocol: req.protocol,\n    headers: req.headers as IncomingHttpHeaders,\n    remoteAddress: req.socket.remoteAddress,\n    byPassCache: req.query.write === 'true',\n    username: req.remote_user?.name ?? undefined,\n  };\n\n  debug('request options: %o', requestOptions);\n\n  return requestOptions;\n}\n"],"mappings":";;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,uCAAuC;AAEhE,SAAgB,kBAAkB,KAAqC;CACrE,MAAM,iBAAiB;EASrB,MAAM,IAAI;EACV,UAAU,IAAI;EACd,SAAS,IAAI;EACb,eAAe,IAAI,OAAO;EAC1B,aAAa,IAAI,MAAM,UAAU;EACjC,UAAU,IAAI,aAAa,QAAQ,KAAA;EACpC;AAED,SAAM,uBAAuB,eAAe;AAE5C,QAAO"}
+{"version":3,"file":"request-options.js","names":[],"sources":["../../src/middlewares/request-options.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { IncomingHttpHeaders } from 'node:http';\n\nimport type { RequestOptions } from '@verdaccio/url';\n\nimport type { $RequestExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:request-options');\n\nexport function getRequestOptions(req: $RequestExtend): RequestOptions {\n  const requestOptions = {\n    // FIXME: decide if host should contain port or not\n    //\n    // Express 4:\n    // - req.host is marked as deprecated since it does not include the port\n    // - use req.headers['host'] instead, which includes the port\n    // Express 5:\n    // - req.host is fully supported and includes the port\n    // - https://expressjs.com/en/api.html#req.host\n    host: req.host,\n    protocol: req.protocol,\n    headers: req.headers as IncomingHttpHeaders,\n    remoteAddress: req.socket.remoteAddress,\n    byPassCache: req.query.write === 'true',\n    username: req.remote_user?.name ?? undefined,\n  };\n\n  debug('request options: %o', requestOptions);\n\n  return requestOptions;\n}\n"],"mappings":";;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,sCAAsC;AAE/D,SAAgB,kBAAkB,KAAqC;CACrE,MAAM,iBAAiB;EASrB,MAAM,IAAI;EACV,UAAU,IAAI;EACd,SAAS,IAAI;EACb,eAAe,IAAI,OAAO;EAC1B,aAAa,IAAI,MAAM,UAAU;EACjC,UAAU,IAAI,aAAa,QAAQ,KAAA;CACrC;CAEA,QAAM,uBAAuB,cAAc;CAE3C,OAAO;AACT"}