@verdaccio/middleware 9.0.0-next-9.20 → 9.0.0-next-9.22

package/build/middlewares/allow.js

@@ -12,8 +12,12 @@ function allow(auth, options = {
 	return function(action) {
 		return function(req, res, next) {
 			req.pause();
-			const packageName = req.params.scope ? `${req.params.scope}/${req.params.package}` : req.params.package;
-			const packageVersion = req.params.filename ? _verdaccio_core.tarballUtils.getVersionFromTarball(req.params.filename) : req.params.version ? req.params.version : void 0;
+			const scope = _verdaccio_core.reqUtils.paramToString(req.params.scope);
+			const name = _verdaccio_core.reqUtils.paramToString(req.params.package);
+			const version = _verdaccio_core.reqUtils.paramToString(req.params.version);
+			const filename = _verdaccio_core.reqUtils.paramToString(req.params.filename);
+			const packageName = scope ? `${scope}/${name}` : name;
+			const packageVersion = filename ? _verdaccio_core.tarballUtils.getVersionFromTarball(filename) : version ? version : void 0;
 			const remote_user = req.remote_user;
 			debug$1("check if user %o can %o package %o version %o", remote_user?.name, action, packageName, packageVersion);
 			beforeAll?.({

package/build/middlewares/allow.js.map

@@ -1 +1 @@
-{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,gBAAA,aAAa,sBAAsB,IAAI,OAAO,QAAQ,IACtD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,QACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,QACd;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,QAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,QAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}
+{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, reqUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const scope = reqUtils.paramToString(req.params.scope);\n      const name = reqUtils.paramToString(req.params.package);\n      const version = reqUtils.paramToString(req.params.version);\n      const filename = reqUtils.paramToString(req.params.filename);\n      const packageName = scope ? `${scope}/${name}` : name;\n      const packageVersion = filename\n        ? tarballUtils.getVersionFromTarball(filename)\n        : version\n          ? version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,QAAQ,gBAAA,SAAS,cAAc,IAAI,OAAO,KAAK;GACrD,MAAM,OAAO,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;GACtD,MAAM,UAAU,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;GACzD,MAAM,WAAW,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;GAC3D,MAAM,cAAc,QAAQ,GAAG,MAAM,GAAG,SAAS;GACjD,MAAM,iBAAiB,WACnB,gBAAA,aAAa,sBAAsB,QAAQ,IAC3C,UACE,UACA,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,QACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,OAAO,CACrB;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,QAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,QAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}

package/build/middlewares/allow.mjs

@@ -1,4 +1,4 @@
-import { API_ERROR, errorUtils, tarballUtils } from "@verdaccio/core";
+import { API_ERROR, errorUtils, reqUtils, tarballUtils } from "@verdaccio/core";
 import buildDebug from "debug";
 //#region src/middlewares/allow.ts
 var debug = buildDebug("verdaccio:middleware:allow");
@@ -10,8 +10,12 @@ function allow(auth, options = {
 	return function(action) {
 		return function(req, res, next) {
 			req.pause();
-			const packageName = req.params.scope ? `${req.params.scope}/${req.params.package}` : req.params.package;
-			const packageVersion = req.params.filename ? tarballUtils.getVersionFromTarball(req.params.filename) : req.params.version ? req.params.version : void 0;
+			const scope = reqUtils.paramToString(req.params.scope);
+			const name = reqUtils.paramToString(req.params.package);
+			const version = reqUtils.paramToString(req.params.version);
+			const filename = reqUtils.paramToString(req.params.filename);
+			const packageName = scope ? `${scope}/${name}` : name;
+			const packageVersion = filename ? tarballUtils.getVersionFromTarball(filename) : version ? version : void 0;
 			const remote_user = req.remote_user;
 			debug("check if user %o can %o package %o version %o", remote_user?.name, action, packageName, packageVersion);
 			beforeAll?.({

package/build/middlewares/allow.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"allow.mjs","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const packageName = req.params.scope\n        ? `${req.params.scope}/${req.params.package}`\n        : req.params.package;\n      const packageVersion = req.params.filename\n        ? tarballUtils.getVersionFromTarball(req.params.filename)\n        : req.params.version\n          ? req.params.version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,cAAc,IAAI,OAAO,QAC3B,GAAG,IAAI,OAAO,MAAM,GAAG,IAAI,OAAO,YAClC,IAAI,OAAO;GACf,MAAM,iBAAiB,IAAI,OAAO,WAC9B,aAAa,sBAAsB,IAAI,OAAO,QAAQ,IACtD,IAAI,OAAO,UACT,IAAI,OAAO,UACX,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,MACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,QACd;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,MAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,MAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,WAAW,iBAAiB,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}
+{"version":3,"file":"allow.mjs","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, reqUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n  auth: T,\n  options = {\n    beforeAll: (_a: any, _b: any) => {},\n\n    afterAll: (_a: any, _b: any) => {},\n  }\n): Function {\n  const { beforeAll, afterAll } = options;\n  return function (action: string): Function {\n    return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n      req.pause();\n      const scope = reqUtils.paramToString(req.params.scope);\n      const name = reqUtils.paramToString(req.params.package);\n      const version = reqUtils.paramToString(req.params.version);\n      const filename = reqUtils.paramToString(req.params.filename);\n      const packageName = scope ? `${scope}/${name}` : name;\n      const packageVersion = filename\n        ? tarballUtils.getVersionFromTarball(filename)\n        : version\n          ? version\n          : undefined;\n      const remote_user = req.remote_user;\n      debug(\n        'check if user %o can %o package %o version %o',\n        remote_user?.name,\n        action,\n        packageName,\n        packageVersion\n      );\n      beforeAll?.(\n        { action, user: remote_user?.name },\n        `[middleware/allow][@{action}] allow for @{user}`\n      );\n      auth['allow_' + action](\n        { packageName, packageVersion },\n        remote_user,\n        function (error, allowed): void {\n          req.resume();\n          if (error) {\n            debug('user is NOT allowed to %o', action);\n            next(error);\n          } else if (allowed) {\n            debug('user is allowed to %o', action);\n            afterAll?.(\n              { action, user: remote_user?.name },\n              `[middleware/allow][@{action}] allowed for @{user}`\n            );\n            next();\n          } else {\n            // last plugin (that's our built-in one) returns either\n            // cb(err) or cb(null, true), so this should never happen\n            throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n          }\n        }\n      );\n    };\n  };\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,QAAQ,SAAS,cAAc,IAAI,OAAO,KAAK;GACrD,MAAM,OAAO,SAAS,cAAc,IAAI,OAAO,OAAO;GACtD,MAAM,UAAU,SAAS,cAAc,IAAI,OAAO,OAAO;GACzD,MAAM,WAAW,SAAS,cAAc,IAAI,OAAO,QAAQ;GAC3D,MAAM,cAAc,QAAQ,GAAG,MAAM,GAAG,SAAS;GACjD,MAAM,iBAAiB,WACnB,aAAa,sBAAsB,QAAQ,IAC3C,UACE,UACA,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,MACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,OAAO,CACrB;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,MAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,MAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,WAAW,iBAAiB,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}

package/build/middlewares/antiLoop.d.ts

@@ -1,5 +1,5 @@
-import { Config } from '@verdaccio/types';
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import type { Config } from '@verdaccio/types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 /**
  * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.
  * @param config

package/build/middlewares/antiLoop.js.map

@@ -1 +1 @@
-{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,KAAK,EAAE,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}
+{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}

package/build/middlewares/antiLoop.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,GAAG,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,GAAG,KAAK,EAAE,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,GAAG,MAAM,GAAG,EAAE,GAAG,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}
+{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n  return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    if (req?.headers?.via != null) {\n      const arr = req.get('via')?.split(',');\n      if (Array.isArray(arr)) {\n        for (let i = 0; i < arr.length; i++) {\n          // the \"via\" header must contain a specific value, this has to be in sync\n          // with the proxy request\n          // match eg: Server 1 or Server 2\n\n          // RFC 7230: Via = 1*( \",\" OWS Via-value )\n          //           Via-value = received-protocol RWS received-by [ RWS comment ]\n          //           received-protocol = [ protocol-name \"/\" ] protocol-version\n          //           received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n          // Split the trimmed header value into parts\n          const parts = arr[i].trim().split(/\\s+/);\n          // Check if we have at least protocol/version and received-by parts\n          if (parts.length >= 2) {\n            // Get the received-by value (server id), removing any comment\n            const serverId = parts[1].split('(')[0].trim();\n            if (serverId === config.server_id) {\n              return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n            }\n          }\n        }\n      }\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;SAED,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}

package/build/middlewares/body-parser.d.ts

@@ -1,5 +1,5 @@
-import { Application, Router } from 'express';
-import { Config } from '@verdaccio/types';
+import type { Application, Router } from 'express';
+import type { Config } from '@verdaccio/types';
 /**
  * Register JSON body parser on a router if not already registered
  * @param app Express router instance

package/build/middlewares/body-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,GACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,QAAM,gCAAgC;MAEtC,IAAI,IACF,QAAA,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}
+{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,EAAA,CACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,QAAM,gCAAgC;MAEtC,IAAI,IACF,QAAA,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}

package/build/middlewares/body-parser.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"body-parser.mjs","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,GACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,MAAM,gCAAgC;MAEtC,IAAI,IACF,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}
+{"version":3,"file":"body-parser.mjs","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n  // @ts-ignore - Express internals: app.stack is not part of the public API\n  const stack = (app as any).stack || (app as any)._router?.stack || [];\n  return stack.some((middleware: any) => {\n    return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n  });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n  // middleware might have registered a json parser already\n  if (hasBodyParser(app)) {\n    debug('json parser already registered');\n  } else {\n    app.use(\n      express.json({\n        strict: false,\n        limit: config.max_body_size || '10mb',\n      })\n    );\n  }\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,EAAA,CACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,MAAM,gCAAgC;MAEtC,IAAI,IACF,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}

package/build/middlewares/dotfiles.d.ts

@@ -1,4 +1,4 @@
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 export type DotfilesPolicy = 'allow' | 'deny' | 'ignore';
 /**
  * Middleware that controls how requests with dotfile path segments

package/build/middlewares/dotfiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"dotfiles.js","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;CAC1D,OAAO,SAAS,mBACd,KACA,KACA,MACM;EACN,IACE,WAAW,WACX,IAAI,KAAK,MAAM,GAAG,EAAE,MAAM,YAAY,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,GACnF;GACA,IAAI,WAAW,QAAQ;IACrB,IAAI,aAAa,gBAAA,YAAY;IAC7B,IAAI,IAAI;GACV,OACE,KAAK,gBAAA,WAAW,YAAY,oBAAoB,CAAC;GAEnD;EACF;EACA,KAAK;CACP;AACF"}
+{"version":3,"file":"dotfiles.js","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;CAC1D,OAAO,SAAS,mBACd,KACA,KACA,MACM;EACN,IACE,WAAW,WACX,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,GACnF;GACA,IAAI,WAAW,QAAQ;IACrB,IAAI,aAAa,gBAAA,YAAY;IAC7B,IAAI,IAAI;GACV,OACE,KAAK,gBAAA,WAAW,YAAY,oBAAoB,CAAC;GAEnD;EACF;EACA,KAAK;CACP;AACF"}

package/build/middlewares/dotfiles.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dotfiles.mjs","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;CAC1D,OAAO,SAAS,mBACd,KACA,KACA,MACM;EACN,IACE,WAAW,WACX,IAAI,KAAK,MAAM,GAAG,EAAE,MAAM,YAAY,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,GACnF;GACA,IAAI,WAAW,QAAQ;IACrB,IAAI,aAAa,YAAY;IAC7B,IAAI,IAAI;GACV,OACE,KAAK,WAAW,YAAY,oBAAoB,CAAC;GAEnD;EACF;EACA,KAAK;CACP;AACF"}
+{"version":3,"file":"dotfiles.mjs","names":[],"sources":["../../src/middlewares/dotfiles.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport type DotfilesPolicy = 'allow' | 'deny' | 'ignore';\n\n/**\n * Middleware that controls how requests with dotfile path segments\n * (e.g. /.env, /.well-known/, /.git/) are handled.\n *\n * Mirrors the semantics of serve-static's `dotfiles` option:\n * - 'deny': respond with 403\n * - 'ignore': respond with 404 (default)\n * - 'allow': pass through to next middleware\n */\nexport function dotfiles(policy: DotfilesPolicy = 'ignore') {\n  return function dotfilesMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    if (\n      policy !== 'allow' &&\n      req.path.split('/').some((segment) => segment.startsWith('.') && segment.length > 1)\n    ) {\n      if (policy === 'deny') {\n        res.statusCode = HTTP_STATUS.FORBIDDEN;\n        res.end();\n      } else {\n        next(errorUtils.getNotFound('resource not found'));\n      }\n      return;\n    }\n    next();\n  };\n}\n"],"mappings":";;;;;;;;;;;AAeA,SAAgB,SAAS,SAAyB,UAAU;CAC1D,OAAO,SAAS,mBACd,KACA,KACA,MACM;EACN,IACE,WAAW,WACX,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,CAAC,GACnF;GACA,IAAI,WAAW,QAAQ;IACrB,IAAI,aAAa,YAAY;IAC7B,IAAI,IAAI;GACV,OACE,KAAK,WAAW,YAAY,oBAAoB,CAAC;GAEnD;EACF;EACA,KAAK;CACP;AACF"}

package/build/middlewares/encode-pkg.d.ts

@@ -1,4 +1,4 @@
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 /**
  * Encode / in a scoped package name to be matched as a single parameter in routes
  * @param req

package/build/middlewares/encode-pkg.js.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,SAAmB,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,EAAE,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,QAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,QAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}
+{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,CAAC,CAAC,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,QAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,QAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}

package/build/middlewares/encode-pkg.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"encode-pkg.mjs","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,EAAE,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,MAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,MAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}
+{"version":3,"file":"encode-pkg.mjs","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  next: $NextFunctionVer\n): void {\n  const original = req.url;\n\n  // Expect relative URLs i.e. should call makeURLrelative before this middleware\n  if (!req.url.startsWith('/')) {\n    return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n  }\n\n  // If the @ sign is encoded, we need to decode it first\n  // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n  // For scoped packages, encode the slash to make it a single path segment/parameter\n  // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n  // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n  // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n  req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n  if (original !== req.url) {\n    debug('encodeScopePackage: %o -> %o', original, req.url);\n  } else {\n    debug('encodeScopePackage: %o (unchanged)', original);\n  }\n  next();\n}\n"],"mappings":";;;AAMA,IAAM,QAAQ,WAAW,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,CAAC,CAAC,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,MAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,MAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}

package/build/middlewares/error.d.ts

@@ -1,5 +1,5 @@
-import { HttpError } from 'http-errors';
-import { Logger } from '@verdaccio/types';
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import type { HttpError } from 'http-errors';
+import type { Logger } from '@verdaccio/types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 export declare const handleError: (logger: Logger) => (err: HttpError, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => any;
 export declare const errorReportingMiddleware: (logger: Logger) => (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer) => void;

package/build/middlewares/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,QAAM,oBAAoB;CAC1B,KAAA,GAAA,UAAA,SAAY,GAAG,GAAG;EAChB,QAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,gBAAA,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,QAAM,4BAA4B;GAGlC,yBAAyB,MAAM,EAAE,KAAK,KAAK,UAAA,IAAI;EACjD;EACA,QAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,QAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,QAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,QAAM,qBAAqB,KAAK,MAAM;GACtC,KAAA,GAAA,UAAA,OAAU,IAAI,WAAW,MAAM,OAAO;IACpC,QAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,QAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,gBAAA,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,QAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,QAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,QAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,gBAAA,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,gBAAA,UAAU,sBAAsB,CAAC;GACjD,OAEE,QAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,QAAM,sDAAsD;CAC5D,KAAK;AACP"}
+{"version":3,"file":"error.js","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,QAAM,oBAAoB;CAC1B,KAAA,GAAA,UAAA,QAAA,CAAY,GAAG,GAAG;EAChB,QAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,gBAAA,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,QAAM,4BAA4B;GAGlC,yBAAyB,MAAM,CAAC,CAAC,KAAK,KAAK,UAAA,IAAI;EACjD;EACA,QAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,QAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,QAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,QAAM,qBAAqB,KAAK,MAAM;GACtC,KAAA,GAAA,UAAA,MAAA,CAAU,IAAI,WAAW,MAAM,OAAO;IACpC,QAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,QAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,gBAAA,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,QAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,QAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,QAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,gBAAA,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,gBAAA,UAAU,sBAAsB,CAAC;GACjD,OAEE,QAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,QAAM,sDAAsD;CAC5D,KAAK;AACP"}

package/build/middlewares/error.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"error.mjs","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;AAUA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,MAAM,oBAAoB;CAC1B,IAAI,QAAQ,GAAG,GAAG;EAChB,MAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,MAAM,4BAA4B;GAGlC,yBAAyB,MAAM,EAAE,KAAK,KAAK,IAAI;EACjD;EACA,MAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,MAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,MAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,MAAM,qBAAqB,KAAK,MAAM;GACtC,IAAI,MAAM,IAAI,WAAW,MAAM,OAAO;IACpC,MAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,MAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,MAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,MAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,MAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,UAAU,sBAAsB,CAAC;GACjD,OAEE,MAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,MAAM,sDAAsD;CAC5D,KAAK;AACP"}
+{"version":3,"file":"error.mjs","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n  function handleError(\n    err: HttpError,\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ) {\n    debug('error handler init');\n    if (isError(err)) {\n      debug('is native error');\n      if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n        return next();\n      }\n      if (typeof res.locals.report_error !== 'function') {\n        debug('is locals error report ref');\n        // in case of very early error this middleware may not be loaded before error is generated\n        // fixing that\n        errorReportingMiddleware(logger)(req, res, noop);\n      }\n      debug('set locals error report ref');\n      res.locals.report_error(err);\n    } else {\n      // Fall to Middleware.final\n      debug('no error to report, jump next layer');\n      return next(err);\n    }\n  };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n  function errorReportingMiddleware(\n    req: $RequestExtend,\n    res: $ResponseExtend,\n    next: $NextFunctionVer\n  ): void {\n    debug('error report middleware start');\n    res.locals.report_error =\n      res.locals.report_error ||\n      function (err: VerdaccioError): void {\n        if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n          debug('is error > 409 %o', err?.status);\n          if (isNil(res.headersSent) === false) {\n            debug('send status %o', err?.status);\n            res.status(err.status);\n            debug('next layer %o', err?.message);\n            next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n          }\n        } else {\n          debug('is error < 409 %o', err?.status);\n          logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n          if (!res.status || !res.send) {\n            // TODO: decide which debug keep\n            logger.error('this is an error in express.js, please report this');\n            debug('this is an error in express.js, please report this, destroy response %o', err);\n            res.destroy();\n          } else if (!res.headersSent) {\n            debug('send internal error %o', err);\n            res.status(HTTP_STATUS.INTERNAL_ERROR);\n            next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n          } else {\n            // socket should be already closed\n            debug('this should not happen, otherwise report %o', err);\n          }\n        }\n      };\n\n    debug('error report middleware end (skip next layer) next()');\n    next();\n  };\n"],"mappings":";;;;AAUA,IAAM,QAAQ,WAAW,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,MAAM,oBAAoB;CAC1B,IAAI,QAAQ,GAAG,GAAG;EAChB,MAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,MAAM,4BAA4B;GAGlC,yBAAyB,MAAM,CAAC,CAAC,KAAK,KAAK,IAAI;EACjD;EACA,MAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,MAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,MAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,MAAM,qBAAqB,KAAK,MAAM;GACtC,IAAI,MAAM,IAAI,WAAW,MAAM,OAAO;IACpC,MAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,MAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,MAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,MAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,MAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,UAAU,sBAAsB,CAAC;GACjD,OAEE,MAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,MAAM,sDAAsD;CAC5D,KAAK;AACP"}

package/build/middlewares/final.d.ts

@@ -1,4 +1,4 @@
-import { Manifest } from '@verdaccio/types';
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';
+import type { Manifest } from '@verdaccio/types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';
 export type FinalBody = Manifest | MiddlewareError | string;
 export declare function final(body: FinalBody, req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/final.js.map

@@ -1 +1 @@
-{"version":3,"file":"final.js","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    debug('set auth header support');\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (typeof body === 'string' || isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        debug('set json type header support');\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          debug('set verdaccio_error method');\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        const etag = cryptoUtils.stringToMD5(body as string);\n        debug('set etag header %s', etag);\n        res.header(HEADERS.ETAG, '\"' + etag + '\"');\n      }\n    } else {\n      debug('this line should never be visible, if does report');\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      debug('set headers after they are sent');\n      if (isNil(res.socket) === false) {\n        debug('force destroy socket');\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,SAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,KACA,KAGA,MACM;CACN,IAAI,IAAI,eAAe,gBAAA,YAAY,gBAAgB,CAAC,IAAI,UAAU,gBAAA,QAAQ,QAAQ,GAAG;EACnF,QAAM,yBAAyB;EAC/B,IAAI,OAAO,gBAAA,QAAQ,UAAU,GAAG,gBAAA,YAAY,IAAI,gBAAA,cAAc;CAChE;CAEA,IAAI;EACF,IAAI,OAAO,SAAS,aAAA,GAAA,UAAA,UAAqB,IAAI,GAAG;GAC9C,IAAI,CAAC,IAAI,IAAI,gBAAA,QAAQ,YAAY,GAAG;IAClC,QAAM,8BAA8B;IACpC,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,IAAI;GAC/C;GAEA,IAAI,OAAO,SAAS,aAAA,GAAA,UAAA,OAAkB,IAAI,MAAM,OAAO;IACrD,IAAI,OAAQ,KAAyB,UAAU,UAAU;KACvD,QAAM,4BAA4B;KAClC,IAAI,OAAO,mBAAoB,KAAyB;IAC1D;IACA,OAAO,KAAK,UAAU,MAAM,KAAA,GAAW,IAAI,IAAI;GACjD;GAGA,IACE,CAAC,IAAI,cACJ,IAAI,cAAc,gBAAA,YAAY,MAAM,IAAI,aAAa,gBAAA,YAAY,kBAClE;IACA,MAAM,OAAO,gBAAA,YAAY,YAAY,IAAc;IACnD,QAAM,sBAAsB,IAAI;IAChC,IAAI,OAAO,gBAAA,QAAQ,MAAM,OAAM,OAAO,IAAG;GAC3C;EACF,OACE,QAAM,mDAAmD;CAG7D,SAAS,KAAU;EAIjB,IAAI,IAAI,QAAQ,MAAM,iCAAiC,GAAG;GACxD,QAAM,iCAAiC;GACvC,KAAA,GAAA,UAAA,OAAU,IAAI,MAAM,MAAM,OAAO;IAC/B,QAAM,sBAAsB;IAC5B,IAAI,QAAQ,QAAQ;GACtB;GACA;EACF;EACA,MAAM;CACR;CAEA,IAAI,KAAK,IAAI;AACf"}
+{"version":3,"file":"final.js","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n  body: FinalBody,\n  req: $RequestExtend,\n  res: $ResponseExtend,\n  // if we remove `next` breaks test\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  next: $NextFunctionVer\n): void {\n  if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n    debug('set auth header support');\n    res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n  }\n\n  try {\n    if (typeof body === 'string' || isObject(body)) {\n      if (!res.get(HEADERS.CONTENT_TYPE)) {\n        debug('set json type header support');\n        res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n      }\n\n      if (typeof body === 'object' && isNil(body) === false) {\n        if (typeof (body as MiddlewareError).error === 'string') {\n          debug('set verdaccio_error method');\n          res.locals._verdaccio_error = (body as MiddlewareError).error;\n        }\n        body = JSON.stringify(body, undefined, '  ') + '\\n';\n      }\n\n      // don't send etags with errors\n      if (\n        !res.statusCode ||\n        (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n      ) {\n        const etag = cryptoUtils.stringToMD5(body as string);\n        debug('set etag header %s', etag);\n        res.header(HEADERS.ETAG, '\"' + etag + '\"');\n      }\n    } else {\n      debug('this line should never be visible, if does report');\n      // send(null), send(204), etc.\n    }\n  } catch (err: any) {\n    // if verdaccio sends headers first, and then calls res.send()\n    // as an error handler, we can't report error properly,\n    // and should just close socket\n    if (err.message.match(/set headers after they are sent/)) {\n      debug('set headers after they are sent');\n      if (isNil(res.socket) === false) {\n        debug('force destroy socket');\n        res.socket?.destroy();\n      }\n      return;\n    }\n    throw err;\n  }\n\n  res.send(body);\n}\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,4BAA4B;AAErD,SAAgB,MACd,MACA,KACA,KAGA,MACM;CACN,IAAI,IAAI,eAAe,gBAAA,YAAY,gBAAgB,CAAC,IAAI,UAAU,gBAAA,QAAQ,QAAQ,GAAG;EACnF,QAAM,yBAAyB;EAC/B,IAAI,OAAO,gBAAA,QAAQ,UAAU,GAAG,gBAAA,YAAY,IAAI,gBAAA,cAAc;CAChE;CAEA,IAAI;EACF,IAAI,OAAO,SAAS,aAAA,GAAA,UAAA,SAAA,CAAqB,IAAI,GAAG;GAC9C,IAAI,CAAC,IAAI,IAAI,gBAAA,QAAQ,YAAY,GAAG;IAClC,QAAM,8BAA8B;IACpC,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,IAAI;GAC/C;GAEA,IAAI,OAAO,SAAS,aAAA,GAAA,UAAA,MAAA,CAAkB,IAAI,MAAM,OAAO;IACrD,IAAI,OAAQ,KAAyB,UAAU,UAAU;KACvD,QAAM,4BAA4B;KAClC,IAAI,OAAO,mBAAoB,KAAyB;IAC1D;IACA,OAAO,KAAK,UAAU,MAAM,KAAA,GAAW,IAAI,IAAI;GACjD;GAGA,IACE,CAAC,IAAI,cACJ,IAAI,cAAc,gBAAA,YAAY,MAAM,IAAI,aAAa,gBAAA,YAAY,kBAClE;IACA,MAAM,OAAO,gBAAA,YAAY,YAAY,IAAc;IACnD,QAAM,sBAAsB,IAAI;IAChC,IAAI,OAAO,gBAAA,QAAQ,MAAM,OAAM,OAAO,IAAG;GAC3C;EACF,OACE,QAAM,mDAAmD;CAG7D,SAAS,KAAU;EAIjB,IAAI,IAAI,QAAQ,MAAM,iCAAiC,GAAG;GACxD,QAAM,iCAAiC;GACvC,KAAA,GAAA,UAAA,MAAA,CAAU,IAAI,MAAM,MAAM,OAAO;IAC/B,QAAM,sBAAsB;IAC5B,IAAI,QAAQ,QAAQ;GACtB;GACA;EACF;EACA,MAAM;CACR;CAEA,IAAI,KAAK,IAAI;AACf"}

package/build/middlewares/json.d.ts

@@ -1,2 +1,2 @@
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 export declare function expectJson(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void;

package/build/middlewares/log.d.ts

@@ -1,4 +1,4 @@
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';
 export declare const LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
 export declare const LOG_VERDACCIO_ERROR = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}', error: @{!error}";
 export declare const LOG_VERDACCIO_BYTES = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}', bytes: @{bytes.in}/@{bytes.out}";

package/build/middlewares/log.js

@@ -6,11 +6,14 @@ let lodash_es = require("lodash-es");
 //#region src/middlewares/log.ts
 var debug$1 = (0, debug.default)("verdaccio:middleware:log");
 function isStaticRequest(url) {
-	return url.startsWith("/-/static/");
+	return url.startsWith("/-/static/") || url.startsWith("/favicon");
+}
+var LOG_STATUS_MESSAGE = _verdaccio_core.constants.LOG_STATUS_MESSAGE;
+var LOG_VERDACCIO_ERROR = _verdaccio_core.constants.LOG_VERDACCIO_ERROR;
+var LOG_VERDACCIO_BYTES = _verdaccio_core.constants.LOG_VERDACCIO_BYTES;
+function convertToDebugString(template) {
+	return template.replace(/@\{[^}]+\}/g, "%o");
 }
-var LOG_STATUS_MESSAGE = "@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'";
-var LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;
-var LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;
 var log = (logger, options = {}) => {
 	const { hideStaticLogs = true } = options;
 	return function log(req, res, next) {
@@ -21,14 +24,12 @@ var log = (logger, options = {}) => {
 		if ((0, lodash_es.isNil)(_cookie) === false) req.headers.cookie = "<Classified>";
 		req.url = req.originalUrl;
 		const _skipLog = hideStaticLogs && isStaticRequest(req.url);
-		if (_skipLog) debug$1("@{ip} requested '@{req.method} @{req.url}'", {
-			ip: req.ip,
-			req
-		});
-		else req.log.info({
+		if (_skipLog) {
+			if (debug$1.enabled) debug$1(convertToDebugString(_verdaccio_core.constants.LOG_REQUEST_MESSAGE), req.ip, req.method, req.url);
+		} else req.log.info({
 			req,
 			ip: req.ip
-		}, "@{ip} requested '@{req.method} @{req.url}'");
+		}, _verdaccio_core.constants.LOG_REQUEST_MESSAGE);
 		req.originalUrl = req.url;
 		if ((0, lodash_es.isNil)(_auth) === false) req.headers.authorization = _auth;
 		if ((0, lodash_es.isNil)(_cookie) === false) req.headers.cookie = _cookie;
@@ -42,18 +43,16 @@ var log = (logger, options = {}) => {
 			bytesout += args[0]?.length || 0;
 			return _write.apply(res, args);
 		};
-		const log = function() {
+		let requestCompleted = false;
+		let abortLogged = false;
+		const getRequestContext = () => {
 			const forwardedFor = req.get(_verdaccio_core.HEADERS.FORWARDED_FOR);
 			const remoteAddress = req.socket.remoteAddress;
 			const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;
-			let message;
-			if (res.locals._verdaccio_error) message = LOG_VERDACCIO_ERROR;
-			else message = LOG_VERDACCIO_BYTES;
-			req.url = req.originalUrl;
-			if (_skipLog) debug$1(message, {
+			return {
 				request: {
 					method: req.method,
-					url: req.url
+					url: req.originalUrl
 				},
 				user: req.remote_user?.name || null,
 				remoteIP,
@@ -63,32 +62,49 @@ var log = (logger, options = {}) => {
 					in: bytesin,
 					out: bytesout
 				}
-			});
-			else req.log.http({
-				request: {
-					method: req.method,
-					url: req.url
-				},
-				user: req.remote_user?.name || null,
-				remoteIP,
-				status: res.statusCode,
-				error: res.locals._verdaccio_error,
-				bytes: {
-					in: bytesin,
-					out: bytesout
-				}
-			}, message);
-			req.originalUrl = req.url;
+			};
+		};
+		const logAbortedRequest = () => {
+			if (abortLogged || requestCompleted) return;
+			abortLogged = true;
+			const context = {
+				...getRequestContext(),
+				status: _verdaccio_core.constants.HTTP_STATUS.CLIENT_CLOSED_REQUEST
+			};
+			if (_skipLog) {
+				if (debug$1.enabled) debug$1(convertToDebugString(_verdaccio_core.constants.LOG_VERDACCIO_ABORT), context.status, context.user, context.remoteIP, context.request.method, context.request.url);
+			} else req.log.info(context, _verdaccio_core.constants.LOG_VERDACCIO_ABORT);
+		};
+		const cleanupSocketListeners = () => {
+			req.socket.removeListener("close", onClose);
+			req.socket.removeListener("error", onError);
+		};
+		const onClose = () => {
+			if (!requestCompleted) logAbortedRequest();
+			cleanupSocketListeners();
+		};
+		const onError = () => {
+			if (!requestCompleted) logAbortedRequest();
+			cleanupSocketListeners();
+		};
+		const logCompletedRequest = () => {
+			requestCompleted = true;
+			const context = getRequestContext();
+			const message = context.error ? _verdaccio_core.constants.LOG_VERDACCIO_ERROR : _verdaccio_core.constants.LOG_VERDACCIO_BYTES;
+			if (_skipLog) {
+				if (debug$1.enabled) if (context.error) debug$1(convertToDebugString(message), context.status, context.user, context.remoteIP, context.request.method, context.request.url, context.error);
+				else debug$1(convertToDebugString(message), context.status, context.user, context.remoteIP, context.request.method, context.request.url, context.bytes.in, context.bytes.out);
+			} else req.log.http(context, message);
+			cleanupSocketListeners();
 		};
-		req.on("close", function() {
-			log();
-		});
 		const _end = res.end;
 		res.end = function(...args) {
 			if (args[0]) bytesout += args[0].length;
 			_end.apply(res, args);
-			log();
+			logCompletedRequest();
 		};
+		req.socket.on("close", onClose);
+		req.socket.on("error", onError);
 		next();
 	};
 };

package/build/middlewares/log.js.map

@@ -1 +1 @@
-{"version":3,"file":"log.js","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n  return url.startsWith('/-/static/');\n}\n\n// FIXME: deprecated, moved to @verdaccio/dev-commons\nexport const LOG_STATUS_MESSAGE =\n  \"@{status}, user: @{user}(@{remoteIP}), req: '@{request.method} @{request.url}'\";\nexport const LOG_VERDACCIO_ERROR = `${LOG_STATUS_MESSAGE}, error: @{!error}`;\nexport const LOG_VERDACCIO_BYTES = `${LOG_STATUS_MESSAGE}, bytes: @{bytes.in}/@{bytes.out}`;\n\nexport type LogOptions = {\n  // When true, static file requests (/-/static/*) are hidden from pino logs\n  // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n  hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n  const { hideStaticLogs = true } = options;\n\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n    if (_skipLog) {\n      debug(\"@{ip} requested '@{req.method} @{req.url}'\", { ip: req.ip, req });\n    } else {\n      req.log.info({ req: req, ip: req.ip }, \"@{ip} requested '@{req.method} @{req.url}'\");\n    }\n    req.originalUrl = req.url;\n\n    if (isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    // @ts-ignore\n    res.write = function (...args): boolean {\n      bytesout += args[0]?.length || 0;\n      // @ts-ignore\n      return _write.apply(res, args);\n    };\n\n    const log = function (): void {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.socket.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      let message;\n      if (res.locals._verdaccio_error) {\n        message = LOG_VERDACCIO_ERROR;\n      } else {\n        message = LOG_VERDACCIO_BYTES;\n      }\n\n      req.url = req.originalUrl;\n      if (_skipLog) {\n        debug(message, {\n          request: { method: req.method, url: req.url },\n          user: req.remote_user?.name || null,\n          remoteIP,\n          status: res.statusCode,\n          error: res.locals._verdaccio_error,\n          bytes: { in: bytesin, out: bytesout },\n        });\n      } else {\n        req.log.http(\n          {\n            request: {\n              method: req.method,\n              url: req.url,\n            },\n            user: req.remote_user?.name || null,\n            remoteIP,\n            status: res.statusCode,\n            error: res.locals._verdaccio_error,\n            bytes: {\n              in: bytesin,\n              out: bytesout,\n            },\n          },\n          message\n        );\n      }\n      req.originalUrl = req.url;\n    };\n\n    req.on('close', function (): void {\n      log();\n    });\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (...args): void {\n      if (args[0]) {\n        bytesout += args[0].length;\n      }\n      // @ts-ignore\n      _end.apply(res, args);\n      log();\n    };\n    next();\n  };\n};\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,SAAmB,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY;AACpC;AAGA,IAAa,qBACX;AACF,IAAa,sBAAsB,GAAG,mBAAmB;AACzD,IAAa,sBAAsB,GAAG,mBAAmB;AAQzD,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,KAAA,GAAA,UAAA,OAAU,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,KAAA,GAAA,UAAA,OAAU,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI,UACF,QAAM,8CAA8C;GAAE,IAAI,IAAI;GAAI;EAAI,CAAC;OAEvE,IAAI,IAAI,KAAK;GAAO;GAAK,IAAI,IAAI;EAAG,GAAG,4CAA4C;EAErF,IAAI,cAAc,IAAI;EAEtB,KAAA,GAAA,UAAA,OAAU,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,KAAA,GAAA,UAAA,OAAU,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EAEnB,IAAI,QAAQ,SAAU,GAAG,MAAe;GACtC,YAAY,KAAK,IAAI,UAAU;GAE/B,OAAO,OAAO,MAAM,KAAK,IAAI;EAC/B;EAEA,MAAM,MAAM,WAAkB;GAC5B,MAAM,eAAe,IAAI,IAAI,gBAAA,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,IAAI;GACJ,IAAI,IAAI,OAAO,kBACb,UAAU;QAEV,UAAU;GAGZ,IAAI,MAAM,IAAI;GACd,IAAI,UACF,QAAM,SAAS;IACb,SAAS;KAAE,QAAQ,IAAI;KAAQ,KAAK,IAAI;IAAI;IAC5C,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KAAE,IAAI;KAAS,KAAK;IAAS;GACtC,CAAC;QAED,IAAI,IAAI,KACN;IACE,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF,GACA,OACF;GAEF,IAAI,cAAc,IAAI;EACxB;EAEA,IAAI,GAAG,SAAS,WAAkB;GAChC,IAAI;EACN,CAAC;EAED,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,GAAG,MAAY;GACjC,IAAI,KAAK,IACP,YAAY,KAAK,GAAG;GAGtB,KAAK,MAAM,KAAK,IAAI;GACpB,IAAI;EACN;EACA,KAAK;CACP;AACF"}
+{"version":3,"file":"log.js","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS, constants } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n  return url.startsWith('/-/static/') || url.startsWith('/favicon');\n}\n\n// Keep export of constants for backward compatibility\nexport const LOG_STATUS_MESSAGE = constants.LOG_STATUS_MESSAGE;\nexport const LOG_VERDACCIO_ERROR = constants.LOG_VERDACCIO_ERROR;\nexport const LOG_VERDACCIO_BYTES = constants.LOG_VERDACCIO_BYTES;\n\n// Converts all @{...} to %o for debug compatibility\nfunction convertToDebugString(template: string): string {\n  return template.replace(/@\\{[^}]+\\}/g, '%o');\n}\n\nexport type LogOptions = {\n  // When true, static file requests (/-/static/*) are hidden from pino logs\n  // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n  hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n  const { hideStaticLogs = true } = options;\n\n  return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    // logger\n    req.log = logger.child({ sub: 'in' });\n\n    const _auth = req.headers.authorization;\n    if (isNil(_auth) === false) {\n      req.headers.authorization = '<Classified>';\n    }\n\n    const _cookie = req.get('cookie');\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = '<Classified>';\n    }\n\n    req.url = req.originalUrl;\n    const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n    if (_skipLog) {\n      if (debug.enabled) {\n        debug(convertToDebugString(constants.LOG_REQUEST_MESSAGE), req.ip, req.method, req.url);\n      }\n    } else {\n      req.log.info({ req, ip: req.ip }, constants.LOG_REQUEST_MESSAGE);\n    }\n    req.originalUrl = req.url;\n\n    if (isNil(_auth) === false) {\n      req.headers.authorization = _auth;\n    }\n\n    if (isNil(_cookie) === false) {\n      req.headers.cookie = _cookie;\n    }\n\n    let bytesin = 0;\n    req.on('data', function (chunk): void {\n      bytesin += chunk.length;\n    });\n\n    let bytesout = 0;\n    const _write = res.write;\n    res.write = function (...args): boolean {\n      bytesout += args[0]?.length || 0;\n      // @ts-ignore\n      return _write.apply(res, args);\n    };\n\n    // Track if the request completed normally\n    let requestCompleted = false;\n    let abortLogged = false;\n\n    const getRequestContext = () => {\n      const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n      const remoteAddress = req.socket.remoteAddress;\n      const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n      return {\n        request: {\n          method: req.method,\n          url: req.originalUrl,\n        },\n        user: req.remote_user?.name || null,\n        remoteIP,\n        status: res.statusCode,\n        error: res.locals._verdaccio_error,\n        bytes: {\n          in: bytesin,\n          out: bytesout,\n        },\n      };\n    };\n\n    const logAbortedRequest = () => {\n      if (abortLogged || requestCompleted) return;\n      abortLogged = true;\n\n      const context = {\n        ...getRequestContext(),\n        status: constants.HTTP_STATUS.CLIENT_CLOSED_REQUEST,\n      };\n\n      if (_skipLog) {\n        if (debug.enabled) {\n          debug(\n            convertToDebugString(constants.LOG_VERDACCIO_ABORT),\n            context.status,\n            context.user,\n            context.remoteIP,\n            context.request.method,\n            context.request.url\n          );\n        }\n      } else {\n        req.log.info(context, constants.LOG_VERDACCIO_ABORT);\n      }\n    };\n\n    const cleanupSocketListeners = () => {\n      req.socket.removeListener('close', onClose);\n      req.socket.removeListener('error', onError);\n    };\n\n    const onClose = () => {\n      if (!requestCompleted) {\n        logAbortedRequest();\n      }\n      cleanupSocketListeners();\n    };\n\n    const onError = () => {\n      if (!requestCompleted) {\n        logAbortedRequest();\n      }\n      cleanupSocketListeners();\n    };\n\n    const logCompletedRequest = () => {\n      requestCompleted = true;\n\n      const context = getRequestContext();\n      const message = context.error ? constants.LOG_VERDACCIO_ERROR : constants.LOG_VERDACCIO_BYTES;\n\n      if (_skipLog) {\n        if (debug.enabled) {\n          if (context.error) {\n            debug(\n              convertToDebugString(message),\n              context.status,\n              context.user,\n              context.remoteIP,\n              context.request.method,\n              context.request.url,\n              context.error\n            );\n          } else {\n            debug(\n              convertToDebugString(message),\n              context.status,\n              context.user,\n              context.remoteIP,\n              context.request.method,\n              context.request.url,\n              context.bytes.in,\n              context.bytes.out\n            );\n          }\n        }\n      } else {\n        req.log.http(context, message);\n      }\n\n      cleanupSocketListeners();\n    };\n\n    const _end = res.end;\n    // @ts-ignore\n    res.end = function (...args): void {\n      if (args[0]) {\n        bytesout += args[0].length;\n      }\n      // @ts-ignore\n      _end.apply(res, args);\n      logCompletedRequest();\n    };\n\n    req.socket.on('close', onClose);\n    req.socket.on('error', onError);\n\n    next();\n  };\n};\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAA,MAAA,QAAA,CAAmB,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY,KAAK,IAAI,WAAW,UAAU;AAClE;AAGA,IAAa,qBAAqB,gBAAA,UAAU;AAC5C,IAAa,sBAAsB,gBAAA,UAAU;AAC7C,IAAa,sBAAsB,gBAAA,UAAU;AAG7C,SAAS,qBAAqB,UAA0B;CACtD,OAAO,SAAS,QAAQ,eAAe,IAAI;AAC7C;AAQA,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,KAAA,GAAA,UAAA,MAAA,CAAU,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,KAAA,GAAA,UAAA,MAAA,CAAU,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI;OACE,QAAM,SACR,QAAM,qBAAqB,gBAAA,UAAU,mBAAmB,GAAG,IAAI,IAAI,IAAI,QAAQ,IAAI,GAAG;EAAA,OAGxF,IAAI,IAAI,KAAK;GAAE;GAAK,IAAI,IAAI;EAAG,GAAG,gBAAA,UAAU,mBAAmB;EAEjE,IAAI,cAAc,IAAI;EAEtB,KAAA,GAAA,UAAA,MAAA,CAAU,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,KAAA,GAAA,UAAA,MAAA,CAAU,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EACnB,IAAI,QAAQ,SAAU,GAAG,MAAe;GACtC,YAAY,KAAK,EAAE,EAAE,UAAU;GAE/B,OAAO,OAAO,MAAM,KAAK,IAAI;EAC/B;EAGA,IAAI,mBAAmB;EACvB,IAAI,cAAc;EAElB,MAAM,0BAA0B;GAC9B,MAAM,eAAe,IAAI,IAAI,gBAAA,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,OAAO;IACL,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF;EACF;EAEA,MAAM,0BAA0B;GAC9B,IAAI,eAAe,kBAAkB;GACrC,cAAc;GAEd,MAAM,UAAU;IACd,GAAG,kBAAkB;IACrB,QAAQ,gBAAA,UAAU,YAAY;GAChC;GAEA,IAAI;QACE,QAAM,SACR,QACE,qBAAqB,gBAAA,UAAU,mBAAmB,GAClD,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,GAClB;GAAA,OAGF,IAAI,IAAI,KAAK,SAAS,gBAAA,UAAU,mBAAmB;EAEvD;EAEA,MAAM,+BAA+B;GACnC,IAAI,OAAO,eAAe,SAAS,OAAO;GAC1C,IAAI,OAAO,eAAe,SAAS,OAAO;EAC5C;EAEA,MAAM,gBAAgB;GACpB,IAAI,CAAC,kBACH,kBAAkB;GAEpB,uBAAuB;EACzB;EAEA,MAAM,gBAAgB;GACpB,IAAI,CAAC,kBACH,kBAAkB;GAEpB,uBAAuB;EACzB;EAEA,MAAM,4BAA4B;GAChC,mBAAmB;GAEnB,MAAM,UAAU,kBAAkB;GAClC,MAAM,UAAU,QAAQ,QAAQ,gBAAA,UAAU,sBAAsB,gBAAA,UAAU;GAE1E,IAAI;QACE,QAAM,SACR,IAAI,QAAQ,OACV,QACE,qBAAqB,OAAO,GAC5B,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,KAChB,QAAQ,KACV;SAEA,QACE,qBAAqB,OAAO,GAC5B,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,KAChB,QAAQ,MAAM,IACd,QAAQ,MAAM,GAChB;GAAA,OAIJ,IAAI,IAAI,KAAK,SAAS,OAAO;GAG/B,uBAAuB;EACzB;EAEA,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,GAAG,MAAY;GACjC,IAAI,KAAK,IACP,YAAY,KAAK,EAAE,CAAC;GAGtB,KAAK,MAAM,KAAK,IAAI;GACpB,oBAAoB;EACtB;EAEA,IAAI,OAAO,GAAG,SAAS,OAAO;EAC9B,IAAI,OAAO,GAAG,SAAS,OAAO;EAE9B,KAAK;CACP;AACF"}