@verdaccio/middleware 9.0.0-next-9.18 → 9.0.0-next-9.20

package/build/index.js

@@ -35,7 +35,6 @@ exports.PING_API_ENDPOINTS = require_api_urls.PING_API_ENDPOINTS;
 exports.PROFILE_API_ENDPOINTS = require_api_urls.PROFILE_API_ENDPOINTS;
 exports.PUBLISH_API_ENDPOINTS = require_api_urls.PUBLISH_API_ENDPOINTS;
 exports.SEARCH_API_ENDPOINTS = require_api_urls.SEARCH_API_ENDPOINTS;
-exports.STARS_API_ENDPOINTS = require_api_urls.STARS_API_ENDPOINTS;
 exports.TOKEN_API_ENDPOINTS = require_api_urls.TOKEN_API_ENDPOINTS;
 exports.USER_API_ENDPOINTS = require_api_urls.USER_API_ENDPOINTS;
 exports.WebUrls = require_web_urls.WebUrls;

package/build/index.mjs

@@ -20,5 +20,5 @@ import "./middlewares/web/index.mjs";
 import { errorReportingMiddleware, handleError } from "./middlewares/error.mjs";
 import { getRequestOptions } from "./middlewares/request-options.mjs";
 import { LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, log } from "./middlewares/log.mjs";
-import { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS } from "./middlewares/api_urls.mjs";
-export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS, WebUrls, WebUrlsNamespace, allow, antiLoop, dotfiles, encodeScopePackage, enforceGeneratedTokenMetadata, errorReportingMiddleware, expectJson, final, getRequestOptions, handleError, log, makeURLrelative, match, media, rateLimit, registerBodyParser, renderWebMiddleware, setSecurityWebHeaders, userAgent, validateName, validatePackage, web_middleware_default as webMiddleware };
+import { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS } from "./middlewares/api_urls.mjs";
+export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, LOG_STATUS_MESSAGE, LOG_VERDACCIO_BYTES, LOG_VERDACCIO_ERROR, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS, WebUrls, WebUrlsNamespace, allow, antiLoop, dotfiles, encodeScopePackage, enforceGeneratedTokenMetadata, errorReportingMiddleware, expectJson, final, getRequestOptions, handleError, log, makeURLrelative, match, media, rateLimit, registerBodyParser, renderWebMiddleware, setSecurityWebHeaders, userAgent, validateName, validatePackage, web_middleware_default as webMiddleware };

package/build/middlewares/api_urls.d.ts

@@ -4,9 +4,6 @@ export declare enum USER_API_ENDPOINTS {
     add_user = "/-/user/:org_couchdb_user{/:_rev}{/:revision}",
     user_token = "/-/user/token/{*subject}"
 }
-export declare enum STARS_API_ENDPOINTS {
-    get_user_starred_packages = "/-/_view/starredByUser"
-}
 export declare enum SEARCH_API_ENDPOINTS {
     search = "/-/v1/search",
     deprecated_search = "/-/all{/:since}"

package/build/middlewares/api_urls.js

@@ -6,10 +6,6 @@ var USER_API_ENDPOINTS = /* @__PURE__ */ function(USER_API_ENDPOINTS) {
 	USER_API_ENDPOINTS["user_token"] = "/-/user/token/{*subject}";
 	return USER_API_ENDPOINTS;
 }({});
-var STARS_API_ENDPOINTS = /* @__PURE__ */ function(STARS_API_ENDPOINTS) {
-	STARS_API_ENDPOINTS["get_user_starred_packages"] = "/-/_view/starredByUser";
-	return STARS_API_ENDPOINTS;
-}({});
 var SEARCH_API_ENDPOINTS = /* @__PURE__ */ function(SEARCH_API_ENDPOINTS) {
 	SEARCH_API_ENDPOINTS["search"] = "/-/v1/search";
 	SEARCH_API_ENDPOINTS["deprecated_search"] = "/-/all{/:since}";
@@ -61,7 +57,6 @@ exports.PING_API_ENDPOINTS = PING_API_ENDPOINTS;
 exports.PROFILE_API_ENDPOINTS = PROFILE_API_ENDPOINTS;
 exports.PUBLISH_API_ENDPOINTS = PUBLISH_API_ENDPOINTS;
 exports.SEARCH_API_ENDPOINTS = SEARCH_API_ENDPOINTS;
-exports.STARS_API_ENDPOINTS = STARS_API_ENDPOINTS;
 exports.TOKEN_API_ENDPOINTS = TOKEN_API_ENDPOINTS;
 exports.USER_API_ENDPOINTS = USER_API_ENDPOINTS;
 

package/build/middlewares/api_urls.js.map

@@ -1 +1 @@
-{"version":3,"file":"api_urls.js","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,YAAA;CACA,mBAAA,cAAA;CACA,mBAAA,cAAA;CACA,mBAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,+BAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,uBAAL,yBAAA,sBAAA;CACL,qBAAA,YAAA;CACA,qBAAA,uBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;CACA,sBAAA,qBAAA;CACA,sBAAA,oBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,UAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,4BAAA;CACA,sBAAA,yBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,0BAAL,yBAAA,yBAAA;CACL,wBAAA,aAAA;CACA,wBAAA,qBAAA;CACA,wBAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,gBAAA;CACA,oBAAA,kBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,WAAA;CACA,oBAAA,eAAA;CACA,oBAAA,uBAAA;CACA,oBAAA,gBAAA;CACA,oBAAA,wBAAA;;AACF,EAAA,CAAA,CAAA"}
+{"version":3,"file":"api_urls.js","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,YAAA;CACA,mBAAA,cAAA;CACA,mBAAA,cAAA;CACA,mBAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,uBAAL,yBAAA,sBAAA;CACL,qBAAA,YAAA;CACA,qBAAA,uBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;CACA,sBAAA,qBAAA;CACA,sBAAA,oBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,UAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,4BAAA;CACA,sBAAA,yBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,0BAAL,yBAAA,yBAAA;CACL,wBAAA,aAAA;CACA,wBAAA,qBAAA;CACA,wBAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,gBAAA;CACA,oBAAA,kBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,WAAA;CACA,oBAAA,eAAA;CACA,oBAAA,uBAAA;CACA,oBAAA,gBAAA;CACA,oBAAA,wBAAA;;AACF,EAAA,CAAA,CAAA"}

package/build/middlewares/api_urls.mjs

@@ -6,10 +6,6 @@ var USER_API_ENDPOINTS = /* @__PURE__ */ function(USER_API_ENDPOINTS) {
 	USER_API_ENDPOINTS["user_token"] = "/-/user/token/{*subject}";
 	return USER_API_ENDPOINTS;
 }({});
-var STARS_API_ENDPOINTS = /* @__PURE__ */ function(STARS_API_ENDPOINTS) {
-	STARS_API_ENDPOINTS["get_user_starred_packages"] = "/-/_view/starredByUser";
-	return STARS_API_ENDPOINTS;
-}({});
 var SEARCH_API_ENDPOINTS = /* @__PURE__ */ function(SEARCH_API_ENDPOINTS) {
 	SEARCH_API_ENDPOINTS["search"] = "/-/v1/search";
 	SEARCH_API_ENDPOINTS["deprecated_search"] = "/-/all{/:since}";
@@ -54,6 +50,6 @@ var LOGIN_API_ENDPOINTS = /* @__PURE__ */ function(LOGIN_API_ENDPOINTS) {
 	return LOGIN_API_ENDPOINTS;
 }({});
 //#endregion
-export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, STARS_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS };
+export { DIST_TAGS_API_ENDPOINTS, LOGIN_API_ENDPOINTS, PACKAGE_API_ENDPOINTS, PING_API_ENDPOINTS, PROFILE_API_ENDPOINTS, PUBLISH_API_ENDPOINTS, SEARCH_API_ENDPOINTS, TOKEN_API_ENDPOINTS, USER_API_ENDPOINTS };
 
 //# sourceMappingURL=api_urls.mjs.map

package/build/middlewares/api_urls.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"api_urls.mjs","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum STARS_API_ENDPOINTS {\n  get_user_starred_packages = '/-/_view/starredByUser',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,YAAA;CACA,mBAAA,cAAA;CACA,mBAAA,cAAA;CACA,mBAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,+BAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,uBAAL,yBAAA,sBAAA;CACL,qBAAA,YAAA;CACA,qBAAA,uBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;CACA,sBAAA,qBAAA;CACA,sBAAA,oBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,UAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,4BAAA;CACA,sBAAA,yBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,0BAAL,yBAAA,yBAAA;CACL,wBAAA,aAAA;CACA,wBAAA,qBAAA;CACA,wBAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,gBAAA;CACA,oBAAA,kBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,WAAA;CACA,oBAAA,eAAA;CACA,oBAAA,uBAAA;CACA,oBAAA,gBAAA;CACA,oBAAA,wBAAA;;AACF,EAAA,CAAA,CAAA"}
+{"version":3,"file":"api_urls.mjs","names":[],"sources":["../../src/middlewares/api_urls.ts"],"sourcesContent":["export enum USER_API_ENDPOINTS {\n  whoami = '/-/whoami',\n  get_user = '/-/user/:org_couchdb_user',\n  add_user = '/-/user/:org_couchdb_user{/:_rev}{/:revision}',\n  user_token = '/-/user/token/{*subject}',\n}\n\nexport enum SEARCH_API_ENDPOINTS {\n  search = '/-/v1/search',\n  deprecated_search = '/-/all{/:since}',\n}\n\nexport enum PUBLISH_API_ENDPOINTS {\n  add_package = '/:package',\n  publish_package = '/:package/-rev/:revision',\n  remove_tarball = '/:package/-/:filename/-rev/:revision',\n}\n\nexport enum PING_API_ENDPOINTS {\n  ping = '/-/ping',\n}\n\nexport enum PACKAGE_API_ENDPOINTS {\n  get_package_by_version = '/:package{/:version}',\n  get_package_tarball = '/:package/-/:filename',\n}\n\nexport enum DIST_TAGS_API_ENDPOINTS {\n  tagging = '/:package/:tag',\n  tagging_package = '/-/package/:package/dist-tags/:tag',\n  get_dist_tags = '/-/package/:package/dist-tags',\n}\n\nexport enum PROFILE_API_ENDPOINTS {\n  get_profile = '/-/npm/v1/user',\n}\n\nexport enum TOKEN_API_ENDPOINTS {\n  get_tokens = '/-/npm/v1/tokens',\n  delete_token = '/-/npm/v1/tokens/token/:tokenKey',\n}\n\nexport enum LOGIN_API_ENDPOINTS {\n  login = '/-/v1/login',\n  login_cli = '/-/v1/login_cli',\n  login_cli_session = '/-/v1/login_cli/:sessionId',\n  login_done = '/-/v1/done',\n  login_done_session = '/-/v1/done/:sessionId',\n}\n"],"mappings":";AAAA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,YAAA;CACA,mBAAA,cAAA;CACA,mBAAA,cAAA;CACA,mBAAA,gBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,uBAAL,yBAAA,sBAAA;CACL,qBAAA,YAAA;CACA,qBAAA,uBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;CACA,sBAAA,qBAAA;CACA,sBAAA,oBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,qBAAL,yBAAA,oBAAA;CACL,mBAAA,UAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,4BAAA;CACA,sBAAA,yBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,0BAAL,yBAAA,yBAAA;CACL,wBAAA,aAAA;CACA,wBAAA,qBAAA;CACA,wBAAA,mBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,wBAAL,yBAAA,uBAAA;CACL,sBAAA,iBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,gBAAA;CACA,oBAAA,kBAAA;;AACF,EAAA,CAAA,CAAA;AAEA,IAAY,sBAAL,yBAAA,qBAAA;CACL,oBAAA,WAAA;CACA,oBAAA,eAAA;CACA,oBAAA,uBAAA;CACA,oBAAA,gBAAA;CACA,oBAAA,wBAAA;;AACF,EAAA,CAAA,CAAA"}

package/build/middlewares/token-auth.js

@@ -9,18 +9,22 @@ var WRITE_METHODS = new Set([
 /**
 * Resolve the client address of an incoming request for CIDR matching.
 *
-* Prefers the `x-forwarded-for` header (taking the first, client-most entry of
-* the comma-separated list) and falls back to `req.ip` and then the raw socket
-* address. The result is normalized (trimmed and IPv4-mapped IPv6 prefixes
-* stripped) via {@link ipUtils.normalizeAddress}.
+* Uses Express' `req.ip`, which already honors the application's `trust proxy`
+* setting (`config.server.trustProxy`): when the operator has declared trusted
+* proxies, `req.ip` is the upstream-most untrusted address parsed from
+* `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded
+* header is ignored entirely.
+*
+* The middleware must NOT read `X-Forwarded-For` on its own — doing so
+* unconditionally would let any client spoof its address (and bypass a token's
+* CIDR whitelist) simply by sending the header. Falls back to the raw socket
+* address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via
+* {@link ipUtils.normalizeAddress}.
 *
 * @param req the incoming Express request
 * @returns the normalized client address, or `undefined` when none can be determined
 */
 function getClientAddress(req) {
-	const forwardedFor = req.headers["x-forwarded-for"];
-	if (Array.isArray(forwardedFor)) return _verdaccio_core.ipUtils.normalizeAddress(forwardedFor[0]?.split(",")[0]);
-	if (typeof forwardedFor === "string") return _verdaccio_core.ipUtils.normalizeAddress(forwardedFor.split(",")[0]);
 	return _verdaccio_core.ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);
 }
 /**

package/build/middlewares/token-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-auth.js","names":[],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Prefers the `x-forwarded-for` header (taking the first, client-most entry of\n * the comma-separated list) and falls back to `req.ip` and then the raw socket\n * address. The result is normalized (trimmed and IPv4-mapped IPv6 prefixes\n * stripped) via {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  const forwardedFor = req.headers['x-forwarded-for'];\n\n  if (Array.isArray(forwardedFor)) {\n    return ipUtils.normalizeAddress(forwardedFor[0]?.split(',')[0]);\n  }\n\n  if (typeof forwardedFor === 'string') {\n    return ipUtils.normalizeAddress(forwardedFor.split(',')[0]);\n  }\n\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;AAOA,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAU;CAAS;CAAQ;AAAK,CAAC;;;;;;;;;;;;AA2BhE,SAAS,iBAAiB,KAAkC;CAC1D,MAAM,eAAe,IAAI,QAAQ;CAEjC,IAAI,MAAM,QAAQ,YAAY,GAC5B,OAAO,gBAAA,QAAQ,iBAAiB,aAAa,IAAI,MAAM,GAAG,EAAE,EAAE;CAGhE,IAAI,OAAO,iBAAiB,UAC1B,OAAO,gBAAA,QAAQ,iBAAiB,aAAa,MAAM,GAAG,EAAE,EAAE;CAG5D,OAAO,gBAAA,QAAQ,iBAAiB,IAAI,MAAM,IAAI,OAAO,aAAa;AACpE;;;;;;;;AASA,SAAS,UAAU,QAAiB,UAAqC;CACvE,OAAO,OAAO,MAAM,EAAE,UAAU,QAAQ,QAAQ;AAClD;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,8BACd,SACA,QACgB;CAChB,OAAO,eAAgB,KAAc,MAAgB,MAAmC;EACtF,MAAM,aAAc,IAAuB;EAC3C,MAAM,WAAW,YAAY,OAAO;EAEpC,IAAI,CAAC,UACH,OAAO,KAAK;EAGd,MAAM,OAAO,YAAY;EAEzB,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EAGpE,IAAI;GACF,MAAM,QAAQ,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,QAAQ;GAEpE,IAAI,CAAC,OAAO;IACV,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,yDAAyD;IACzF,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,CAAC,gBAAA,QAAQ,iBAAiB,iBAAiB,GAAG,GAAG,MAAM,IAAI,GAAG;IAChE,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,kFACF;IACA,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,MAAM,YAAY,cAAc,IAAI,IAAI,MAAM,GAAG;IACnD,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,oFACF;IACA,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,OAAO,KAAK;EACd,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,kDAAkD;GACrF,OAAO,KAAK,gBAAA,WAAW,iBAAiB,MAAM,OAAO,CAAC;EACxD;CACF;AACF"}
+{"version":3,"file":"token-auth.js","names":[],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Uses Express' `req.ip`, which already honors the application's `trust proxy`\n * setting (`config.server.trustProxy`): when the operator has declared trusted\n * proxies, `req.ip` is the upstream-most untrusted address parsed from\n * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded\n * header is ignored entirely.\n *\n * The middleware must NOT read `X-Forwarded-For` on its own — doing so\n * unconditionally would let any client spoof its address (and bypass a token's\n * CIDR whitelist) simply by sending the header. Falls back to the raw socket\n * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via\n * {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;AAOA,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAU;CAAS;CAAQ;AAAK,CAAC;;;;;;;;;;;;;;;;;;;AAkChE,SAAS,iBAAiB,KAAkC;CAC1D,OAAO,gBAAA,QAAQ,iBAAiB,IAAI,MAAM,IAAI,OAAO,aAAa;AACpE;;;;;;;;AASA,SAAS,UAAU,QAAiB,UAAqC;CACvE,OAAO,OAAO,MAAM,EAAE,UAAU,QAAQ,QAAQ;AAClD;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,8BACd,SACA,QACgB;CAChB,OAAO,eAAgB,KAAc,MAAgB,MAAmC;EACtF,MAAM,aAAc,IAAuB;EAC3C,MAAM,WAAW,YAAY,OAAO;EAEpC,IAAI,CAAC,UACH,OAAO,KAAK;EAGd,MAAM,OAAO,YAAY;EAEzB,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EAGpE,IAAI;GACF,MAAM,QAAQ,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,QAAQ;GAEpE,IAAI,CAAC,OAAO;IACV,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,yDAAyD;IACzF,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,CAAC,gBAAA,QAAQ,iBAAiB,iBAAiB,GAAG,GAAG,MAAM,IAAI,GAAG;IAChE,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,kFACF;IACA,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,MAAM,YAAY,cAAc,IAAI,IAAI,MAAM,GAAG;IACnD,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,oFACF;IACA,OAAO,KAAK,gBAAA,WAAW,aAAa,gBAAA,UAAU,mBAAmB,CAAC;GACpE;GAEA,OAAO,KAAK;EACd,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,kDAAkD;GACrF,OAAO,KAAK,gBAAA,WAAW,iBAAiB,MAAM,OAAO,CAAC;EACxD;CACF;AACF"}

package/build/middlewares/token-auth.mjs

@@ -9,18 +9,22 @@ var WRITE_METHODS = new Set([
 /**
 * Resolve the client address of an incoming request for CIDR matching.
 *
-* Prefers the `x-forwarded-for` header (taking the first, client-most entry of
-* the comma-separated list) and falls back to `req.ip` and then the raw socket
-* address. The result is normalized (trimmed and IPv4-mapped IPv6 prefixes
-* stripped) via {@link ipUtils.normalizeAddress}.
+* Uses Express' `req.ip`, which already honors the application's `trust proxy`
+* setting (`config.server.trustProxy`): when the operator has declared trusted
+* proxies, `req.ip` is the upstream-most untrusted address parsed from
+* `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded
+* header is ignored entirely.
+*
+* The middleware must NOT read `X-Forwarded-For` on its own — doing so
+* unconditionally would let any client spoof its address (and bypass a token's
+* CIDR whitelist) simply by sending the header. Falls back to the raw socket
+* address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via
+* {@link ipUtils.normalizeAddress}.
 *
 * @param req the incoming Express request
 * @returns the normalized client address, or `undefined` when none can be determined
 */
 function getClientAddress(req) {
-	const forwardedFor = req.headers["x-forwarded-for"];
-	if (Array.isArray(forwardedFor)) return ipUtils.normalizeAddress(forwardedFor[0]?.split(",")[0]);
-	if (typeof forwardedFor === "string") return ipUtils.normalizeAddress(forwardedFor.split(",")[0]);
 	return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);
 }
 /**

package/build/middlewares/token-auth.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"token-auth.mjs","names":[],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Prefers the `x-forwarded-for` header (taking the first, client-most entry of\n * the comma-separated list) and falls back to `req.ip` and then the raw socket\n * address. The result is normalized (trimmed and IPv4-mapped IPv6 prefixes\n * stripped) via {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  const forwardedFor = req.headers['x-forwarded-for'];\n\n  if (Array.isArray(forwardedFor)) {\n    return ipUtils.normalizeAddress(forwardedFor[0]?.split(',')[0]);\n  }\n\n  if (typeof forwardedFor === 'string') {\n    return ipUtils.normalizeAddress(forwardedFor.split(',')[0]);\n  }\n\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;AAOA,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAU;CAAS;CAAQ;AAAK,CAAC;;;;;;;;;;;;AA2BhE,SAAS,iBAAiB,KAAkC;CAC1D,MAAM,eAAe,IAAI,QAAQ;CAEjC,IAAI,MAAM,QAAQ,YAAY,GAC5B,OAAO,QAAQ,iBAAiB,aAAa,IAAI,MAAM,GAAG,EAAE,EAAE;CAGhE,IAAI,OAAO,iBAAiB,UAC1B,OAAO,QAAQ,iBAAiB,aAAa,MAAM,GAAG,EAAE,EAAE;CAG5D,OAAO,QAAQ,iBAAiB,IAAI,MAAM,IAAI,OAAO,aAAa;AACpE;;;;;;;;AASA,SAAS,UAAU,QAAiB,UAAqC;CACvE,OAAO,OAAO,MAAM,EAAE,UAAU,QAAQ,QAAQ;AAClD;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,8BACd,SACA,QACgB;CAChB,OAAO,eAAgB,KAAc,MAAgB,MAAmC;EACtF,MAAM,aAAc,IAAuB;EAC3C,MAAM,WAAW,YAAY,OAAO;EAEpC,IAAI,CAAC,UACH,OAAO,KAAK;EAGd,MAAM,OAAO,YAAY;EAEzB,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;EAGpE,IAAI;GACF,MAAM,QAAQ,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,QAAQ;GAEpE,IAAI,CAAC,OAAO;IACV,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,yDAAyD;IACzF,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,CAAC,QAAQ,iBAAiB,iBAAiB,GAAG,GAAG,MAAM,IAAI,GAAG;IAChE,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,kFACF;IACA,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,MAAM,YAAY,cAAc,IAAI,IAAI,MAAM,GAAG;IACnD,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,oFACF;IACA,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,OAAO,KAAK;EACd,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,kDAAkD;GACrF,OAAO,KAAK,WAAW,iBAAiB,MAAM,OAAO,CAAC;EACxD;CACF;AACF"}
+{"version":3,"file":"token-auth.mjs","names":[],"sources":["../../src/middlewares/token-auth.ts"],"sourcesContent":["import type { NextFunction, Request, RequestHandler, Response } from 'express';\n\nimport { API_ERROR, errorUtils, ipUtils } from '@verdaccio/core';\nimport type { Logger, Token } from '@verdaccio/types';\n\nimport type { $RequestExtend } from '../types';\n\nconst WRITE_METHODS = new Set(['DELETE', 'PATCH', 'POST', 'PUT']);\n\n/**\n * Minimal storage surface required to enforce generated token metadata. Typed\n * structurally so this package does not need to depend on `@verdaccio/store`.\n */\nexport interface TokenReadableStorage {\n  /**\n   * Load the generated tokens stored for a user.\n   *\n   * @param filter narrows the lookup to a single `user`\n   * @returns the user's persisted tokens\n   */\n  readTokens(filter: { user: string }): Promise<Token[]>;\n}\n\n/**\n * Resolve the client address of an incoming request for CIDR matching.\n *\n * Uses Express' `req.ip`, which already honors the application's `trust proxy`\n * setting (`config.server.trustProxy`): when the operator has declared trusted\n * proxies, `req.ip` is the upstream-most untrusted address parsed from\n * `X-Forwarded-For`; otherwise it is the direct socket peer and the forwarded\n * header is ignored entirely.\n *\n * The middleware must NOT read `X-Forwarded-For` on its own — doing so\n * unconditionally would let any client spoof its address (and bypass a token's\n * CIDR whitelist) simply by sending the header. Falls back to the raw socket\n * address and is normalized (trimmed, IPv4-mapped IPv6 prefix stripped) via\n * {@link ipUtils.normalizeAddress}.\n *\n * @param req the incoming Express request\n * @returns the normalized client address, or `undefined` when none can be determined\n */\nfunction getClientAddress(req: Request): string | undefined {\n  return ipUtils.normalizeAddress(req.ip || req.socket.remoteAddress);\n}\n\n/**\n * Find the stored token whose `key` matches the key carried by the request.\n *\n * @param tokens the tokens persisted for the authenticated user\n * @param tokenKey the key extracted from the presented generated token\n * @returns the matching {@link Token}, or `undefined` when it has been revoked / never existed\n */\nfunction findToken(tokens: Token[], tokenKey: string): Token | undefined {\n  return tokens.find(({ key }) => key === tokenKey);\n}\n\n/**\n * Express middleware that enforces the metadata of npm-style generated tokens\n * (created via `POST /-/npm/v1/tokens`).\n *\n * A generated token embeds a server-issued `key` that is recovered from the\n * verified credentials as `remote_user.token.key`. This middleware looks that\n * key up in storage and rejects the request when the token:\n * - is missing from storage (revoked or never issued);\n * - is used from a client address outside its `cidr` whitelist;\n * - is `readonly` and the request uses a write method (`DELETE`/`PATCH`/`POST`/`PUT`).\n *\n * Requests that do not carry a generated token key (e.g. interactive logins)\n * pass through untouched. It must run after the JWT/auth middleware has\n * populated `remote_user`. Failures fail closed: a storage lookup error yields\n * an internal error rather than allowing the request.\n *\n * @param storage storage exposing {@link TokenReadableStorage.readTokens} to load the user's tokens\n * @param logger logger used to record rejected attempts and lookup failures\n * @returns an Express {@link RequestHandler} that calls `next()` to allow or `next(error)` to reject\n */\nexport function enforceGeneratedTokenMetadata(\n  storage: TokenReadableStorage,\n  logger: Logger\n): RequestHandler {\n  return async function (req: Request, _res: Response, next: NextFunction): Promise<void> {\n    const remoteUser = (req as $RequestExtend).remote_user;\n    const tokenKey = remoteUser?.token?.key;\n\n    if (!tokenKey) {\n      return next();\n    }\n\n    const user = remoteUser?.name;\n\n    if (typeof user !== 'string') {\n      return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n    }\n\n    try {\n      const token = findToken(await storage.readTokens({ user }), tokenKey);\n\n      if (!token) {\n        logger.warn({ tokenKey, user }, 'generated token @{tokenKey} for user @{user} is missing');\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (!ipUtils.isAddressAllowed(getClientAddress(req), token.cidr)) {\n        logger.warn(\n          { tokenKey, user },\n          'generated token @{tokenKey} for user @{user} was used outside its CIDR whitelist'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      if (token.readonly && WRITE_METHODS.has(req.method)) {\n        logger.warn(\n          { tokenKey, user },\n          'readonly generated token @{tokenKey} for user @{user} was used for a write request'\n        );\n        return next(errorUtils.getForbidden(API_ERROR.UNAUTHORIZED_ACCESS));\n      }\n\n      return next();\n    } catch (error: any) {\n      logger.error({ error: error.msg }, 'generated token metadata lookup failed: @{error}');\n      return next(errorUtils.getInternalError(error.message));\n    }\n  };\n}\n"],"mappings":";;AAOA,IAAM,gBAAgB,IAAI,IAAI;CAAC;CAAU;CAAS;CAAQ;AAAK,CAAC;;;;;;;;;;;;;;;;;;;AAkChE,SAAS,iBAAiB,KAAkC;CAC1D,OAAO,QAAQ,iBAAiB,IAAI,MAAM,IAAI,OAAO,aAAa;AACpE;;;;;;;;AASA,SAAS,UAAU,QAAiB,UAAqC;CACvE,OAAO,OAAO,MAAM,EAAE,UAAU,QAAQ,QAAQ;AAClD;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,8BACd,SACA,QACgB;CAChB,OAAO,eAAgB,KAAc,MAAgB,MAAmC;EACtF,MAAM,aAAc,IAAuB;EAC3C,MAAM,WAAW,YAAY,OAAO;EAEpC,IAAI,CAAC,UACH,OAAO,KAAK;EAGd,MAAM,OAAO,YAAY;EAEzB,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;EAGpE,IAAI;GACF,MAAM,QAAQ,UAAU,MAAM,QAAQ,WAAW,EAAE,KAAK,CAAC,GAAG,QAAQ;GAEpE,IAAI,CAAC,OAAO;IACV,OAAO,KAAK;KAAE;KAAU;IAAK,GAAG,yDAAyD;IACzF,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,CAAC,QAAQ,iBAAiB,iBAAiB,GAAG,GAAG,MAAM,IAAI,GAAG;IAChE,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,kFACF;IACA,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,IAAI,MAAM,YAAY,cAAc,IAAI,IAAI,MAAM,GAAG;IACnD,OAAO,KACL;KAAE;KAAU;IAAK,GACjB,oFACF;IACA,OAAO,KAAK,WAAW,aAAa,UAAU,mBAAmB,CAAC;GACpE;GAEA,OAAO,KAAK;EACd,SAAS,OAAY;GACnB,OAAO,MAAM,EAAE,OAAO,MAAM,IAAI,GAAG,kDAAkD;GACrF,OAAO,KAAK,WAAW,iBAAiB,MAAM,OAAO,CAAC;EACxD;CACF;AACF"}

package/build/middlewares/web/render-web.js

@@ -32,7 +32,7 @@ function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
 				return next();
 			}
 			debug$1("render custom favicon %o", file);
-			res.sendFile(file, require_file_utils.sendFileCallback(next));
+			res.sendFile(file, { dotfiles: "allow" }, require_file_utils.sendFileCallback(next));
 			return;
 		}
 		debug$1("render static file %o", filename);
@@ -47,7 +47,10 @@ function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
 					logo = `/-/static/${node_path.default.basename(logo)}`;
 					router.get(logo, function(_req, res, next) {
 						debug$1("serve custom logo  web:%s - local:%s", logo, absoluteLocalFile);
-						res.sendFile(node_path.default.basename(absoluteLocalFile), { root: node_path.default.dirname(absoluteLocalFile) }, require_file_utils.sendFileCallback(next));
+						res.sendFile(node_path.default.basename(absoluteLocalFile), {
+							root: node_path.default.dirname(absoluteLocalFile),
+							dotfiles: "allow"
+						}, require_file_utils.sendFileCallback(next));
 					});
 					debug$1("enabled custom logo %s", logo);
 				} else {

package/build/middlewares/web/render-web.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-web.js","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport { sendFileCallback, sendFileSafe } from './utils/file-utils';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:middleware:web:render');\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        res.sendFile(file, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      sendFileSafe(staticPath, filename, res, next);\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile) },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Serve external script that loads UI options\n  router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n    res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n    res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n    res.send(script);\n  });\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render root');\n  });\n\n  // any match within the asset folder is routed to the file system\n  if (config?.web?.assetFolder) {\n    router.get(\n      WebUrlsNamespace.assets,\n      function (req: express.Request<{ all: string | string[] }>, res, next) {\n        const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n        sendFileSafe(config.web.assetFolder, filename, res, next);\n      }\n    );\n  }\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,IAAM,WAAA,GAAA,MAAA,SAAmB,iCAAiC;AAE1D,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;CAChD,QAAM,kBAAkB,UAAU;CAGlC,MAAM,SAAS,QAAA,QAAQ,OAAO;CAC9B,IAAI,OAAO,oBAAoB,YAC7B,OAAO,IAAI,eAAe;CAG5B,OAAO,IAAI,iBAAA,qBAAqB;CAGhC,OAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,IAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;GAC1B,KAAA,GAAA,eAAA,uBAA0B,IAAI,GAAG;IAC/B,QAAM,0BAA0B,IAAI;IACpC,IAAI,MAAM;IACV,OAAO,KAAK;GACd;GACA,QAAM,4BAA4B,IAAI;GACtC,IAAI,SAAS,MAAM,mBAAA,iBAAiB,IAAI,CAAC;GACzC;EACF;EACA,QAAM,yBAAyB,QAAQ;EACvC,mBAAA,aAAa,YAAY,UAAU,KAAK,IAAI;CAC9C,CACF;CAEA,SAAS,WAAW,MAA8C;EAEhE,IAAI,QAAQ,EAAA,GAAA,eAAA,uBAAuB,IAAI,GAAG;GAExC,MAAM,oBAAoB,UAAA,QAAK,MAAM,QAAQ,IAAI;GACjD,QAAM,uBAAuB,iBAAiB;GAC9C,IAAI;IAEF,IACE,QAAA,QAAG,WAAW,iBAAiB,KAC/B,OAAO,QAAA,QAAG,WAAW,mBAAmB,QAAA,QAAG,UAAU,IAAI,MAAM,aAC/D;KAGA,OAAO,aAAa,UAAA,QAAK,SAAS,IAAI;KACtC,OAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;MAE1C,QAAM,wCAAwC,MAAM,iBAAiB;MACrE,IAAI,SACF,UAAA,QAAK,SAAS,iBAAiB,GAC/B,EAAE,MAAM,UAAA,QAAK,QAAQ,iBAAiB,EAAE,GACxC,mBAAA,iBAAiB,IAAI,CACvB;KACF,CAAC;KACD,QAAM,0BAA0B,IAAI;IACtC,OAAO;KACL,OAAO,KAAA;KACP,QAAM,2BAA2B,kBAAkB,mCAAmC;IACxF;GACF,QAAQ;IACN,OAAO,KAAA;IACP,QAAM,2BAA2B,kBAAkB,mCAAmC;GACxF;EACF;EACA,OAAO;CACT;CAEA,MAAM,OAAO,WAAW,QAAQ,KAAK,IAAI;CACzC,IAAI,QAAQ,KAAK,MACf,OAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,QAAQ;CACjD,IAAI,QAAQ,KAAK,UACf,OAAO,IAAI,WAAW;CAIxB,OAAO,IAAI,iBAAA,iBAAiB,SAAS,iBAAiB,SAAU,KAAK,KAAK;EACxE,MAAM,UAAU,mBAAA,aAAa,QAAQ,KAAK,GAAG;EAC7C,MAAM,SAAS,0CAA0C,KAAK,UAAU,OAAO,EAAE;EACjF,IAAI,UAAU,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;EACrD,IAAI,UAAU,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,kBAAkB;EAC9D,IAAI,KAAK,MAAM;CACjB,CAAC;CAGD,OAAO,IAAI,iBAAA,iBAAiB,KAAK,SAAU,KAAK,KAAK;EAEnD,mBAAA,QAAW,QAAQ,UAAU,eADb,mBAAA,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,QAAM,qBAAqB;CAC7B,CAAC;CAED,OAAO,IAAI,iBAAA,iBAAiB,MAAM,SAAU,KAAK,KAAK;EAEpD,mBAAA,QAAW,QAAQ,UAAU,eADb,mBAAA,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,QAAM,aAAa;CACrB,CAAC;CAGD,IAAI,QAAQ,KAAK,aACf,OAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,mBAAA,aAAa,OAAO,IAAI,aAAa,UAAU,KAAK,IAAI;CAC1D,CACF;CAGF,OAAO;AACT"}
+{"version":3,"file":"render-web.js","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport { sendFileCallback, sendFileSafe } from './utils/file-utils';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:middleware:web:render');\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        // see sendFileSafe for the reasoning behind `dotfiles: 'allow'`\n        res.sendFile(file, { dotfiles: 'allow' }, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      sendFileSafe(staticPath, filename, res, next);\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile), dotfiles: 'allow' },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Serve external script that loads UI options\n  router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n    res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n    res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n    res.send(script);\n  });\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render root');\n  });\n\n  // any match within the asset folder is routed to the file system\n  if (config?.web?.assetFolder) {\n    router.get(\n      WebUrlsNamespace.assets,\n      function (req: express.Request<{ all: string | string[] }>, res, next) {\n        const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n        sendFileSafe(config.web.assetFolder, filename, res, next);\n      }\n    );\n  }\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,IAAM,WAAA,GAAA,MAAA,SAAmB,iCAAiC;AAE1D,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;CAChD,QAAM,kBAAkB,UAAU;CAGlC,MAAM,SAAS,QAAA,QAAQ,OAAO;CAC9B,IAAI,OAAO,oBAAoB,YAC7B,OAAO,IAAI,eAAe;CAG5B,OAAO,IAAI,iBAAA,qBAAqB;CAGhC,OAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,IAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;GAC1B,KAAA,GAAA,eAAA,uBAA0B,IAAI,GAAG;IAC/B,QAAM,0BAA0B,IAAI;IACpC,IAAI,MAAM;IACV,OAAO,KAAK;GACd;GACA,QAAM,4BAA4B,IAAI;GAEtC,IAAI,SAAS,MAAM,EAAE,UAAU,QAAQ,GAAG,mBAAA,iBAAiB,IAAI,CAAC;GAChE;EACF;EACA,QAAM,yBAAyB,QAAQ;EACvC,mBAAA,aAAa,YAAY,UAAU,KAAK,IAAI;CAC9C,CACF;CAEA,SAAS,WAAW,MAA8C;EAEhE,IAAI,QAAQ,EAAA,GAAA,eAAA,uBAAuB,IAAI,GAAG;GAExC,MAAM,oBAAoB,UAAA,QAAK,MAAM,QAAQ,IAAI;GACjD,QAAM,uBAAuB,iBAAiB;GAC9C,IAAI;IAEF,IACE,QAAA,QAAG,WAAW,iBAAiB,KAC/B,OAAO,QAAA,QAAG,WAAW,mBAAmB,QAAA,QAAG,UAAU,IAAI,MAAM,aAC/D;KAGA,OAAO,aAAa,UAAA,QAAK,SAAS,IAAI;KACtC,OAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;MAE1C,QAAM,wCAAwC,MAAM,iBAAiB;MACrE,IAAI,SACF,UAAA,QAAK,SAAS,iBAAiB,GAC/B;OAAE,MAAM,UAAA,QAAK,QAAQ,iBAAiB;OAAG,UAAU;MAAQ,GAC3D,mBAAA,iBAAiB,IAAI,CACvB;KACF,CAAC;KACD,QAAM,0BAA0B,IAAI;IACtC,OAAO;KACL,OAAO,KAAA;KACP,QAAM,2BAA2B,kBAAkB,mCAAmC;IACxF;GACF,QAAQ;IACN,OAAO,KAAA;IACP,QAAM,2BAA2B,kBAAkB,mCAAmC;GACxF;EACF;EACA,OAAO;CACT;CAEA,MAAM,OAAO,WAAW,QAAQ,KAAK,IAAI;CACzC,IAAI,QAAQ,KAAK,MACf,OAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,QAAQ;CACjD,IAAI,QAAQ,KAAK,UACf,OAAO,IAAI,WAAW;CAIxB,OAAO,IAAI,iBAAA,iBAAiB,SAAS,iBAAiB,SAAU,KAAK,KAAK;EACxE,MAAM,UAAU,mBAAA,aAAa,QAAQ,KAAK,GAAG;EAC7C,MAAM,SAAS,0CAA0C,KAAK,UAAU,OAAO,EAAE;EACjF,IAAI,UAAU,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;EACrD,IAAI,UAAU,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,kBAAkB;EAC9D,IAAI,KAAK,MAAM;CACjB,CAAC;CAGD,OAAO,IAAI,iBAAA,iBAAiB,KAAK,SAAU,KAAK,KAAK;EAEnD,mBAAA,QAAW,QAAQ,UAAU,eADb,mBAAA,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,QAAM,qBAAqB;CAC7B,CAAC;CAED,OAAO,IAAI,iBAAA,iBAAiB,MAAM,SAAU,KAAK,KAAK;EAEpD,mBAAA,QAAW,QAAQ,UAAU,eADb,mBAAA,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,QAAM,aAAa;CACrB,CAAC;CAGD,IAAI,QAAQ,KAAK,aACf,OAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,mBAAA,aAAa,OAAO,IAAI,aAAa,UAAU,KAAK,IAAI;CAC1D,CACF;CAGF,OAAO;AACT"}

package/build/middlewares/web/render-web.mjs

@@ -27,7 +27,7 @@ function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
 				return next();
 			}
 			debug("render custom favicon %o", file);
-			res.sendFile(file, sendFileCallback(next));
+			res.sendFile(file, { dotfiles: "allow" }, sendFileCallback(next));
 			return;
 		}
 		debug("render static file %o", filename);
@@ -42,7 +42,10 @@ function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
 					logo = `/-/static/${path.basename(logo)}`;
 					router.get(logo, function(_req, res, next) {
 						debug("serve custom logo  web:%s - local:%s", logo, absoluteLocalFile);
-						res.sendFile(path.basename(absoluteLocalFile), { root: path.dirname(absoluteLocalFile) }, sendFileCallback(next));
+						res.sendFile(path.basename(absoluteLocalFile), {
+							root: path.dirname(absoluteLocalFile),
+							dotfiles: "allow"
+						}, sendFileCallback(next));
 					});
 					debug("enabled custom logo %s", logo);
 				} else {

package/build/middlewares/web/render-web.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"render-web.mjs","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport { sendFileCallback, sendFileSafe } from './utils/file-utils';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:middleware:web:render');\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        res.sendFile(file, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      sendFileSafe(staticPath, filename, res, next);\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile) },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Serve external script that loads UI options\n  router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n    res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n    res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n    res.send(script);\n  });\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render root');\n  });\n\n  // any match within the asset folder is routed to the file system\n  if (config?.web?.assetFolder) {\n    router.get(\n      WebUrlsNamespace.assets,\n      function (req: express.Request<{ all: string | string[] }>, res, next) {\n        const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n        sendFileSafe(config.web.assetFolder, filename, res, next);\n      }\n    );\n  }\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;;;AAcA,IAAM,QAAQ,WAAW,iCAAiC;AAE1D,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;CAChD,MAAM,kBAAkB,UAAU;CAGlC,MAAM,SAAS,QAAQ,OAAO;CAC9B,IAAI,OAAO,oBAAoB,YAC7B,OAAO,IAAI,eAAe;CAG5B,OAAO,IAAI,qBAAqB;CAGhC,OAAO,IACL,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,IAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;GAC1B,IAAI,sBAAsB,IAAI,GAAG;IAC/B,MAAM,0BAA0B,IAAI;IACpC,IAAI,MAAM;IACV,OAAO,KAAK;GACd;GACA,MAAM,4BAA4B,IAAI;GACtC,IAAI,SAAS,MAAM,iBAAiB,IAAI,CAAC;GACzC;EACF;EACA,MAAM,yBAAyB,QAAQ;EACvC,aAAa,YAAY,UAAU,KAAK,IAAI;CAC9C,CACF;CAEA,SAAS,WAAW,MAA8C;EAEhE,IAAI,QAAQ,CAAC,sBAAsB,IAAI,GAAG;GAExC,MAAM,oBAAoB,KAAK,MAAM,QAAQ,IAAI;GACjD,MAAM,uBAAuB,iBAAiB;GAC9C,IAAI;IAEF,IACE,GAAG,WAAW,iBAAiB,KAC/B,OAAO,GAAG,WAAW,mBAAmB,GAAG,UAAU,IAAI,MAAM,aAC/D;KAGA,OAAO,aAAa,KAAK,SAAS,IAAI;KACtC,OAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;MAE1C,MAAM,wCAAwC,MAAM,iBAAiB;MACrE,IAAI,SACF,KAAK,SAAS,iBAAiB,GAC/B,EAAE,MAAM,KAAK,QAAQ,iBAAiB,EAAE,GACxC,iBAAiB,IAAI,CACvB;KACF,CAAC;KACD,MAAM,0BAA0B,IAAI;IACtC,OAAO;KACL,OAAO,KAAA;KACP,MAAM,2BAA2B,kBAAkB,mCAAmC;IACxF;GACF,QAAQ;IACN,OAAO,KAAA;IACP,MAAM,2BAA2B,kBAAkB,mCAAmC;GACxF;EACF;EACA,OAAO;CACT;CAEA,MAAM,OAAO,WAAW,QAAQ,KAAK,IAAI;CACzC,IAAI,QAAQ,KAAK,MACf,OAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,QAAQ;CACjD,IAAI,QAAQ,KAAK,UACf,OAAO,IAAI,WAAW;CAIxB,OAAO,IAAI,iBAAiB,SAAS,iBAAiB,SAAU,KAAK,KAAK;EACxE,MAAM,UAAU,aAAa,QAAQ,KAAK,GAAG;EAC7C,MAAM,SAAS,0CAA0C,KAAK,UAAU,OAAO,EAAE;EACjF,IAAI,UAAU,QAAQ,eAAe,QAAQ,QAAQ;EACrD,IAAI,UAAU,QAAQ,cAAc,QAAQ,kBAAkB;EAC9D,IAAI,KAAK,MAAM;CACjB,CAAC;CAGD,OAAO,IAAI,iBAAiB,KAAK,SAAU,KAAK,KAAK;EAEnD,WAAW,QAAQ,UAAU,eADb,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,MAAM,qBAAqB;CAC7B,CAAC;CAED,OAAO,IAAI,iBAAiB,MAAM,SAAU,KAAK,KAAK;EAEpD,WAAW,QAAQ,UAAU,eADb,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,MAAM,aAAa;CACrB,CAAC;CAGD,IAAI,QAAQ,KAAK,aACf,OAAO,IACL,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,aAAa,OAAO,IAAI,aAAa,UAAU,KAAK,IAAI;CAC1D,CACF;CAGF,OAAO;AACT"}
+{"version":3,"file":"render-web.mjs","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport { sendFileCallback, sendFileSafe } from './utils/file-utils';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:middleware:web:render');\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        // see sendFileSafe for the reasoning behind `dotfiles: 'allow'`\n        res.sendFile(file, { dotfiles: 'allow' }, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      sendFileSafe(staticPath, filename, res, next);\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile), dotfiles: 'allow' },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Serve external script that loads UI options\n  router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n    const options = getUIOptions(config, req, res);\n    const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n    res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n    res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n    res.send(script);\n  });\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    const options = getUIOptions(config, req, res);\n    renderHTML(config, manifest, manifestFiles, options, res);\n    debug('render root');\n  });\n\n  // any match within the asset folder is routed to the file system\n  if (config?.web?.assetFolder) {\n    router.get(\n      WebUrlsNamespace.assets,\n      function (req: express.Request<{ all: string | string[] }>, res, next) {\n        const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n        sendFileSafe(config.web.assetFolder, filename, res, next);\n      }\n    );\n  }\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;;;AAcA,IAAM,QAAQ,WAAW,iCAAiC;AAE1D,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;CAChD,MAAM,kBAAkB,UAAU;CAGlC,MAAM,SAAS,QAAQ,OAAO;CAC9B,IAAI,OAAO,oBAAoB,YAC7B,OAAO,IAAI,eAAe;CAG5B,OAAO,IAAI,qBAAqB;CAGhC,OAAO,IACL,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,IAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;GAC1B,IAAI,sBAAsB,IAAI,GAAG;IAC/B,MAAM,0BAA0B,IAAI;IACpC,IAAI,MAAM;IACV,OAAO,KAAK;GACd;GACA,MAAM,4BAA4B,IAAI;GAEtC,IAAI,SAAS,MAAM,EAAE,UAAU,QAAQ,GAAG,iBAAiB,IAAI,CAAC;GAChE;EACF;EACA,MAAM,yBAAyB,QAAQ;EACvC,aAAa,YAAY,UAAU,KAAK,IAAI;CAC9C,CACF;CAEA,SAAS,WAAW,MAA8C;EAEhE,IAAI,QAAQ,CAAC,sBAAsB,IAAI,GAAG;GAExC,MAAM,oBAAoB,KAAK,MAAM,QAAQ,IAAI;GACjD,MAAM,uBAAuB,iBAAiB;GAC9C,IAAI;IAEF,IACE,GAAG,WAAW,iBAAiB,KAC/B,OAAO,GAAG,WAAW,mBAAmB,GAAG,UAAU,IAAI,MAAM,aAC/D;KAGA,OAAO,aAAa,KAAK,SAAS,IAAI;KACtC,OAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;MAE1C,MAAM,wCAAwC,MAAM,iBAAiB;MACrE,IAAI,SACF,KAAK,SAAS,iBAAiB,GAC/B;OAAE,MAAM,KAAK,QAAQ,iBAAiB;OAAG,UAAU;MAAQ,GAC3D,iBAAiB,IAAI,CACvB;KACF,CAAC;KACD,MAAM,0BAA0B,IAAI;IACtC,OAAO;KACL,OAAO,KAAA;KACP,MAAM,2BAA2B,kBAAkB,mCAAmC;IACxF;GACF,QAAQ;IACN,OAAO,KAAA;IACP,MAAM,2BAA2B,kBAAkB,mCAAmC;GACxF;EACF;EACA,OAAO;CACT;CAEA,MAAM,OAAO,WAAW,QAAQ,KAAK,IAAI;CACzC,IAAI,QAAQ,KAAK,MACf,OAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,QAAQ;CACjD,IAAI,QAAQ,KAAK,UACf,OAAO,IAAI,WAAW;CAIxB,OAAO,IAAI,iBAAiB,SAAS,iBAAiB,SAAU,KAAK,KAAK;EACxE,MAAM,UAAU,aAAa,QAAQ,KAAK,GAAG;EAC7C,MAAM,SAAS,0CAA0C,KAAK,UAAU,OAAO,EAAE;EACjF,IAAI,UAAU,QAAQ,eAAe,QAAQ,QAAQ;EACrD,IAAI,UAAU,QAAQ,cAAc,QAAQ,kBAAkB;EAC9D,IAAI,KAAK,MAAM;CACjB,CAAC;CAGD,OAAO,IAAI,iBAAiB,KAAK,SAAU,KAAK,KAAK;EAEnD,WAAW,QAAQ,UAAU,eADb,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,MAAM,qBAAqB;CAC7B,CAAC;CAED,OAAO,IAAI,iBAAiB,MAAM,SAAU,KAAK,KAAK;EAEpD,WAAW,QAAQ,UAAU,eADb,aAAa,QAAQ,KAAK,GACE,GAAS,GAAG;EACxD,MAAM,aAAa;CACrB,CAAC;CAGD,IAAI,QAAQ,KAAK,aACf,OAAO,IACL,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,aAAa,OAAO,IAAI,aAAa,UAAU,KAAK,IAAI;CAC1D,CACF;CAGF,OAAO;AACT"}

package/build/middlewares/web/utils/file-utils.js

@@ -34,7 +34,7 @@ function sendFileSafe(baseDir, filename, res, next) {
 		return next();
 	}
 	debug$1("serve file %o", safe);
-	res.sendFile(safe, sendFileCallback(next));
+	res.sendFile(safe, { dotfiles: "allow" }, sendFileCallback(next));
 }
 //#endregion
 exports.sendFileCallback = sendFileCallback;

package/build/middlewares/web/utils/file-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-utils.js","names":[],"sources":["../../../../src/middlewares/web/utils/file-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport path from 'node:path';\n\nimport { HTTP_STATUS, fileUtils } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:utils');\n\nexport const sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\n/**\n * Safely serve a file by validating and resolving the path to prevent directory traversal.\n * @param baseDir Base directory path\n * @param filename Requested filename (user input)\n * @param res Express response object\n * @param next Express next function\n */\nexport function sendFileSafe(baseDir: string, filename: string, res, next) {\n  // The splat may match nothing (e.g. \"/-/assets/.\" collapses to no segment),\n  // leaving filename undefined/empty. Nothing to serve, fall through to 404.\n  if (!filename) {\n    debug('empty filename requested');\n    return next();\n  }\n\n  // First validation layer: check filename for basic validity\n  const safeFilename = fileUtils.sanitizeFilename(filename);\n\n  // Second validation layer: resolve safe path within base directory\n  const safe = fileUtils.resolveSafePath(baseDir, safeFilename);\n  if (!safe) {\n    debug('unsafe filename requested %o', safeFilename);\n    return next();\n  }\n\n  // Prevent attempting to send a directory (e.g., base directory via \".\" or \"subdir/..\")\n  const baseDirResolved = path.resolve(baseDir);\n  if (safe === baseDirResolved) {\n    debug('directory requested instead of file %o', safe);\n    return next();\n  }\n\n  debug('serve file %o', safe);\n  res.sendFile(safe, sendFileCallback(next));\n}\n"],"mappings":";;;;;;;AAKA,IAAM,WAAA,GAAA,MAAA,SAAmB,gCAAgC;AAEzD,IAAa,oBAAoB,UAAU,QAAQ;CACjD,IAAI,CAAC,KACH;CAEF,IAAI,IAAI,WAAW,gBAAA,YAAY,WAC7B,KAAK;MAEL,KAAK,GAAG;AAEZ;;;;;;;;AASA,SAAgB,aAAa,SAAiB,UAAkB,KAAK,MAAM;CAGzE,IAAI,CAAC,UAAU;EACb,QAAM,0BAA0B;EAChC,OAAO,KAAK;CACd;CAGA,MAAM,eAAe,gBAAA,UAAU,iBAAiB,QAAQ;CAGxD,MAAM,OAAO,gBAAA,UAAU,gBAAgB,SAAS,YAAY;CAC5D,IAAI,CAAC,MAAM;EACT,QAAM,gCAAgC,YAAY;EAClD,OAAO,KAAK;CACd;CAIA,IAAI,SADoB,UAAA,QAAK,QAAQ,OACxB,GAAiB;EAC5B,QAAM,0CAA0C,IAAI;EACpD,OAAO,KAAK;CACd;CAEA,QAAM,iBAAiB,IAAI;CAC3B,IAAI,SAAS,MAAM,iBAAiB,IAAI,CAAC;AAC3C"}
+{"version":3,"file":"file-utils.js","names":[],"sources":["../../../../src/middlewares/web/utils/file-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport path from 'node:path';\n\nimport { HTTP_STATUS, fileUtils } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:utils');\n\nexport const sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\n/**\n * Safely serve a file by validating and resolving the path to prevent directory traversal.\n * @param baseDir Base directory path\n * @param filename Requested filename (user input)\n * @param res Express response object\n * @param next Express next function\n */\nexport function sendFileSafe(baseDir: string, filename: string, res, next) {\n  // The splat may match nothing (e.g. \"/-/assets/.\" collapses to no segment),\n  // leaving filename undefined/empty. Nothing to serve, fall through to 404.\n  if (!filename) {\n    debug('empty filename requested');\n    return next();\n  }\n\n  // First validation layer: check filename for basic validity\n  const safeFilename = fileUtils.sanitizeFilename(filename);\n\n  // Second validation layer: resolve safe path within base directory\n  const safe = fileUtils.resolveSafePath(baseDir, safeFilename);\n  if (!safe) {\n    debug('unsafe filename requested %o', safeFilename);\n    return next();\n  }\n\n  // Prevent attempting to send a directory (e.g., base directory via \".\" or \"subdir/..\")\n  const baseDirResolved = path.resolve(baseDir);\n  if (safe === baseDirResolved) {\n    debug('directory requested instead of file %o', safe);\n    return next();\n  }\n\n  debug('serve file %o', safe);\n  // `dotfiles: 'allow'` is required because the absolute path may legitimately\n  // contain dot-prefixed ancestor directories (e.g. pnpm's `node_modules/.pnpm/...`\n  // content-addressable store). Path traversal is already enforced by\n  // `resolveSafePath` above.\n  // Requests for dot-prefixed URL segments are handled separately by the global `dotfiles` middleware.\n  res.sendFile(safe, { dotfiles: 'allow' }, sendFileCallback(next));\n}\n"],"mappings":";;;;;;;AAKA,IAAM,WAAA,GAAA,MAAA,SAAmB,gCAAgC;AAEzD,IAAa,oBAAoB,UAAU,QAAQ;CACjD,IAAI,CAAC,KACH;CAEF,IAAI,IAAI,WAAW,gBAAA,YAAY,WAC7B,KAAK;MAEL,KAAK,GAAG;AAEZ;;;;;;;;AASA,SAAgB,aAAa,SAAiB,UAAkB,KAAK,MAAM;CAGzE,IAAI,CAAC,UAAU;EACb,QAAM,0BAA0B;EAChC,OAAO,KAAK;CACd;CAGA,MAAM,eAAe,gBAAA,UAAU,iBAAiB,QAAQ;CAGxD,MAAM,OAAO,gBAAA,UAAU,gBAAgB,SAAS,YAAY;CAC5D,IAAI,CAAC,MAAM;EACT,QAAM,gCAAgC,YAAY;EAClD,OAAO,KAAK;CACd;CAIA,IAAI,SADoB,UAAA,QAAK,QAAQ,OACxB,GAAiB;EAC5B,QAAM,0CAA0C,IAAI;EACpD,OAAO,KAAK;CACd;CAEA,QAAM,iBAAiB,IAAI;CAM3B,IAAI,SAAS,MAAM,EAAE,UAAU,QAAQ,GAAG,iBAAiB,IAAI,CAAC;AAClE"}

package/build/middlewares/web/utils/file-utils.mjs

@@ -31,7 +31,7 @@ function sendFileSafe(baseDir, filename, res, next) {
 		return next();
 	}
 	debug("serve file %o", safe);
-	res.sendFile(safe, sendFileCallback(next));
+	res.sendFile(safe, { dotfiles: "allow" }, sendFileCallback(next));
 }
 //#endregion
 export { sendFileCallback, sendFileSafe };

package/build/middlewares/web/utils/file-utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"file-utils.mjs","names":[],"sources":["../../../../src/middlewares/web/utils/file-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport path from 'node:path';\n\nimport { HTTP_STATUS, fileUtils } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:utils');\n\nexport const sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\n/**\n * Safely serve a file by validating and resolving the path to prevent directory traversal.\n * @param baseDir Base directory path\n * @param filename Requested filename (user input)\n * @param res Express response object\n * @param next Express next function\n */\nexport function sendFileSafe(baseDir: string, filename: string, res, next) {\n  // The splat may match nothing (e.g. \"/-/assets/.\" collapses to no segment),\n  // leaving filename undefined/empty. Nothing to serve, fall through to 404.\n  if (!filename) {\n    debug('empty filename requested');\n    return next();\n  }\n\n  // First validation layer: check filename for basic validity\n  const safeFilename = fileUtils.sanitizeFilename(filename);\n\n  // Second validation layer: resolve safe path within base directory\n  const safe = fileUtils.resolveSafePath(baseDir, safeFilename);\n  if (!safe) {\n    debug('unsafe filename requested %o', safeFilename);\n    return next();\n  }\n\n  // Prevent attempting to send a directory (e.g., base directory via \".\" or \"subdir/..\")\n  const baseDirResolved = path.resolve(baseDir);\n  if (safe === baseDirResolved) {\n    debug('directory requested instead of file %o', safe);\n    return next();\n  }\n\n  debug('serve file %o', safe);\n  res.sendFile(safe, sendFileCallback(next));\n}\n"],"mappings":";;;;AAKA,IAAM,QAAQ,WAAW,gCAAgC;AAEzD,IAAa,oBAAoB,UAAU,QAAQ;CACjD,IAAI,CAAC,KACH;CAEF,IAAI,IAAI,WAAW,YAAY,WAC7B,KAAK;MAEL,KAAK,GAAG;AAEZ;;;;;;;;AASA,SAAgB,aAAa,SAAiB,UAAkB,KAAK,MAAM;CAGzE,IAAI,CAAC,UAAU;EACb,MAAM,0BAA0B;EAChC,OAAO,KAAK;CACd;CAGA,MAAM,eAAe,UAAU,iBAAiB,QAAQ;CAGxD,MAAM,OAAO,UAAU,gBAAgB,SAAS,YAAY;CAC5D,IAAI,CAAC,MAAM;EACT,MAAM,gCAAgC,YAAY;EAClD,OAAO,KAAK;CACd;CAIA,IAAI,SADoB,KAAK,QAAQ,OACxB,GAAiB;EAC5B,MAAM,0CAA0C,IAAI;EACpD,OAAO,KAAK;CACd;CAEA,MAAM,iBAAiB,IAAI;CAC3B,IAAI,SAAS,MAAM,iBAAiB,IAAI,CAAC;AAC3C"}
+{"version":3,"file":"file-utils.mjs","names":[],"sources":["../../../../src/middlewares/web/utils/file-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport path from 'node:path';\n\nimport { HTTP_STATUS, fileUtils } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:utils');\n\nexport const sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\n/**\n * Safely serve a file by validating and resolving the path to prevent directory traversal.\n * @param baseDir Base directory path\n * @param filename Requested filename (user input)\n * @param res Express response object\n * @param next Express next function\n */\nexport function sendFileSafe(baseDir: string, filename: string, res, next) {\n  // The splat may match nothing (e.g. \"/-/assets/.\" collapses to no segment),\n  // leaving filename undefined/empty. Nothing to serve, fall through to 404.\n  if (!filename) {\n    debug('empty filename requested');\n    return next();\n  }\n\n  // First validation layer: check filename for basic validity\n  const safeFilename = fileUtils.sanitizeFilename(filename);\n\n  // Second validation layer: resolve safe path within base directory\n  const safe = fileUtils.resolveSafePath(baseDir, safeFilename);\n  if (!safe) {\n    debug('unsafe filename requested %o', safeFilename);\n    return next();\n  }\n\n  // Prevent attempting to send a directory (e.g., base directory via \".\" or \"subdir/..\")\n  const baseDirResolved = path.resolve(baseDir);\n  if (safe === baseDirResolved) {\n    debug('directory requested instead of file %o', safe);\n    return next();\n  }\n\n  debug('serve file %o', safe);\n  // `dotfiles: 'allow'` is required because the absolute path may legitimately\n  // contain dot-prefixed ancestor directories (e.g. pnpm's `node_modules/.pnpm/...`\n  // content-addressable store). Path traversal is already enforced by\n  // `resolveSafePath` above.\n  // Requests for dot-prefixed URL segments are handled separately by the global `dotfiles` middleware.\n  res.sendFile(safe, { dotfiles: 'allow' }, sendFileCallback(next));\n}\n"],"mappings":";;;;AAKA,IAAM,QAAQ,WAAW,gCAAgC;AAEzD,IAAa,oBAAoB,UAAU,QAAQ;CACjD,IAAI,CAAC,KACH;CAEF,IAAI,IAAI,WAAW,YAAY,WAC7B,KAAK;MAEL,KAAK,GAAG;AAEZ;;;;;;;;AASA,SAAgB,aAAa,SAAiB,UAAkB,KAAK,MAAM;CAGzE,IAAI,CAAC,UAAU;EACb,MAAM,0BAA0B;EAChC,OAAO,KAAK;CACd;CAGA,MAAM,eAAe,UAAU,iBAAiB,QAAQ;CAGxD,MAAM,OAAO,UAAU,gBAAgB,SAAS,YAAY;CAC5D,IAAI,CAAC,MAAM;EACT,MAAM,gCAAgC,YAAY;EAClD,OAAO,KAAK;CACd;CAIA,IAAI,SADoB,KAAK,QAAQ,OACxB,GAAiB;EAC5B,MAAM,0CAA0C,IAAI;EACpD,OAAO,KAAK;CACd;CAEA,MAAM,iBAAiB,IAAI;CAM3B,IAAI,SAAS,MAAM,EAAE,UAAU,QAAQ,GAAG,iBAAiB,IAAI,CAAC;AAClE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "9.0.0-next-9.18",
+  "version": "9.0.0-next-9.20",
   "description": "Verdaccio Express Middleware",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -33,9 +33,9 @@
     "node": ">=24"
   },
   "dependencies": {
-    "@verdaccio/config": "9.0.0-next-9.18",
-    "@verdaccio/core": "9.0.0-next-9.18",
-    "@verdaccio/url": "14.0.0-next-9.18",
+    "@verdaccio/config": "9.0.0-next-9.20",
+    "@verdaccio/core": "9.0.0-next-9.20",
+    "@verdaccio/url": "14.0.0-next-9.20",
     "debug": "4.4.3",
     "express": "5.2.1",
     "express-rate-limit": "8.5.2",
@@ -48,10 +48,12 @@
   },
   "devDependencies": {
     "@types/lodash-es": "4.17.12",
-    "@verdaccio/logger": "9.0.0-next-9.18",
-    "@verdaccio/types": "14.0.0-next-9.9",
+    "@verdaccio/logger": "9.0.0-next-9.20",
+    "@verdaccio/types": "14.0.0-next-9.11",
     "http-errors": "2.0.1",
     "supertest": "7.1.4",
+    "rimraf": "6.1.3",
+    "vite": "8.0.14",
     "vitest": "4.1.7"
   },
   "module": "./build/index.mjs",