@verdaccio/middleware 9.0.0-next-9.25 → 9.0.0-next-9.26
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/build/_virtual/_rolldown/runtime.js +1 -1
- package/build/middlewares/allow.js.map +1 -1
- package/build/middlewares/antiLoop.js.map +1 -1
- package/build/middlewares/antiLoop.mjs.map +1 -1
- package/build/middlewares/body-parser.js.map +1 -1
- package/build/middlewares/encode-pkg.js.map +1 -1
- package/build/middlewares/error.js.map +1 -1
- package/build/middlewares/final.js.map +1 -1
- package/build/middlewares/log.js +4 -2
- package/build/middlewares/log.js.map +1 -1
- package/build/middlewares/log.mjs +4 -2
- package/build/middlewares/log.mjs.map +1 -1
- package/build/middlewares/make-url-relative.js.map +1 -1
- package/build/middlewares/rate-limit.js.map +1 -1
- package/build/middlewares/user-agent.js.map +1 -1
- package/build/middlewares/web/render-web.js.map +1 -1
- package/build/middlewares/web/security.js.map +1 -1
- package/build/middlewares/web/utils/file-utils.js.map +1 -1
- package/build/middlewares/web/utils/manifest.js.map +1 -1
- package/build/middlewares/web/utils/renderHTML.js +1 -1
- package/build/middlewares/web/utils/renderHTML.js.map +1 -1
- package/build/middlewares/web/utils/renderHTML.mjs +1 -1
- package/build/middlewares/web/utils/renderHTML.mjs.map +1 -1
- package/build/middlewares/web/utils/template.js.map +1 -1
- package/build/middlewares/web/utils/ui-options.js.map +1 -1
- package/build/middlewares/web/utils/web-utils.js.map +1 -1
- package/build/middlewares/web/web-api.js.map +1 -1
- package/package.json +6 -6
|
@@ -15,7 +15,7 @@ var __copyProps = (to, from, except, desc) => {
|
|
|
15
15
|
}
|
|
16
16
|
return to;
|
|
17
17
|
};
|
|
18
|
-
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
|
|
18
|
+
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
|
|
19
19
|
value: mod,
|
|
20
20
|
enumerable: true
|
|
21
21
|
}) : target, mod));
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, reqUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n auth: T,\n options = {\n beforeAll: (_a: any, _b: any) => {},\n\n afterAll: (_a: any, _b: any) => {},\n }\n): Function {\n const { beforeAll, afterAll } = options;\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const scope = reqUtils.paramToString(req.params.scope);\n const name = reqUtils.paramToString(req.params.package);\n const version = reqUtils.paramToString(req.params.version);\n const filename = reqUtils.paramToString(req.params.filename);\n const packageName = scope ? `${scope}/${name}` : name;\n const packageVersion = filename\n ? tarballUtils.getVersionFromTarball(filename)\n : version\n ? version\n : undefined;\n const remote_user = req.remote_user;\n debug(\n 'check if user %o can %o package %o version %o',\n remote_user?.name,\n action,\n packageName,\n packageVersion\n );\n beforeAll?.(\n { action, user: remote_user?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote_user,\n function (error, allowed): void {\n req.resume();\n if (error) {\n debug('user is NOT allowed to %o', action);\n next(error);\n } else if (allowed) {\n debug('user is allowed to %o', action);\n afterAll?.(\n { action, user: remote_user?.name },\n `[middleware/allow][@{action}] allowed for @{user}`\n );\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"allow.js","names":[],"sources":["../../src/middlewares/allow.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { API_ERROR, errorUtils, reqUtils, tarballUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:allow');\n\nexport function allow<T>(\n auth: T,\n options = {\n beforeAll: (_a: any, _b: any) => {},\n\n afterAll: (_a: any, _b: any) => {},\n }\n): Function {\n const { beforeAll, afterAll } = options;\n return function (action: string): Function {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n req.pause();\n const scope = reqUtils.paramToString(req.params.scope);\n const name = reqUtils.paramToString(req.params.package);\n const version = reqUtils.paramToString(req.params.version);\n const filename = reqUtils.paramToString(req.params.filename);\n const packageName = scope ? `${scope}/${name}` : name;\n const packageVersion = filename\n ? tarballUtils.getVersionFromTarball(filename)\n : version\n ? version\n : undefined;\n const remote_user = req.remote_user;\n debug(\n 'check if user %o can %o package %o version %o',\n remote_user?.name,\n action,\n packageName,\n packageVersion\n );\n beforeAll?.(\n { action, user: remote_user?.name },\n `[middleware/allow][@{action}] allow for @{user}`\n );\n auth['allow_' + action](\n { packageName, packageVersion },\n remote_user,\n function (error, allowed): void {\n req.resume();\n if (error) {\n debug('user is NOT allowed to %o', action);\n next(error);\n } else if (allowed) {\n debug('user is allowed to %o', action);\n afterAll?.(\n { action, user: remote_user?.name },\n `[middleware/allow][@{action}] allowed for @{user}`\n );\n next();\n } else {\n // last plugin (that's our built-in one) returns either\n // cb(err) or cb(null, true), so this should never happen\n throw errorUtils.getInternalError(API_ERROR.PLUGIN_ERROR);\n }\n }\n );\n };\n };\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,UAAU;CACR,YAAY,IAAS,OAAY,CAAC;CAElC,WAAW,IAAS,OAAY,CAAC;AACnC,GACU;CACV,MAAM,EAAE,WAAW,aAAa;CAChC,OAAO,SAAU,QAA0B;EACzC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;GACxF,IAAI,MAAM;GACV,MAAM,QAAQ,gBAAA,SAAS,cAAc,IAAI,OAAO,KAAK;GACrD,MAAM,OAAO,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;GACtD,MAAM,UAAU,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;GACzD,MAAM,WAAW,gBAAA,SAAS,cAAc,IAAI,OAAO,QAAQ;GAC3D,MAAM,cAAc,QAAQ,GAAG,MAAM,GAAG,SAAS;GACjD,MAAM,iBAAiB,WACnB,gBAAA,aAAa,sBAAsB,QAAQ,IAC3C,UACE,UACA,KAAA;GACN,MAAM,cAAc,IAAI;GACxB,QACE,iDACA,aAAa,MACb,QACA,aACA,cACF;GACA,YACE;IAAE;IAAQ,MAAM,aAAa;GAAK,GAClC,iDACF;GACA,KAAK,WAAW,OAAO,CACrB;IAAE;IAAa;GAAe,GAC9B,aACA,SAAU,OAAO,SAAe;IAC9B,IAAI,OAAO;IACX,IAAI,OAAO;KACT,QAAM,6BAA6B,MAAM;KACzC,KAAK,KAAK;IACZ,OAAO,IAAI,SAAS;KAClB,QAAM,yBAAyB,MAAM;KACrC,WACE;MAAE;MAAQ,MAAM,aAAa;KAAK,GAClC,mDACF;KACA,KAAK;IACP,OAGE,MAAM,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,YAAY;GAE5D,CACF;EACF;CACF;AACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.get('via')?.split(',');\n if (Array.isArray(arr)) {\n for (let i = 0; i < arr.length; i++) {\n // the \"via\" header must contain a specific value, this has to be in sync\n // with the proxy request\n // match eg: Server 1 or Server 2\n\n // RFC 7230: Via = 1*( \",\" OWS Via-value )\n // Via-value = received-protocol RWS received-by [ RWS comment ]\n // received-protocol = [ protocol-name \"/\" ] protocol-version\n // received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n // Split the trimmed header value into parts\n const parts = arr[i].trim().split(/\\s+/);\n // Check if we have at least protocol/version and received-by parts\n if (parts.length >= 2) {\n // Get the received-by value (server id), removing any comment\n const serverId = parts[1].split('(')[0].trim();\n if (serverId === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n }\n }\n next();\n };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;
|
|
1
|
+
{"version":3,"file":"antiLoop.js","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.get('via')?.split(',');\n if (Array.isArray(arr)) {\n for (let i = 0; i < arr.length; i++) {\n // the \"via\" header must contain a specific value, this has to be in sync\n // with the proxy request\n // match eg: Server 1 or Server 2\n\n // RFC 7230: Via = 1*( \",\" OWS Via-value )\n // Via-value = received-protocol RWS received-by [ RWS comment ]\n // received-protocol = [ protocol-name \"/\" ] protocol-version\n // received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n // Split the trimmed header value into parts\n const parts = arr[i].trim().split(/\\s+/);\n // Check if we have at least protocol/version and received-by parts\n if (parts.length >= 2) {\n // Get the received-by value (server id), removing any comment\n const serverId = parts[1].split('(')[0].trim();\n if (serverId === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n }\n }\n next();\n };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU,GAED;SAAA,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.get('via')?.split(',');\n if (Array.isArray(arr)) {\n for (let i = 0; i < arr.length; i++) {\n // the \"via\" header must contain a specific value, this has to be in sync\n // with the proxy request\n // match eg: Server 1 or Server 2\n\n // RFC 7230: Via = 1*( \",\" OWS Via-value )\n // Via-value = received-protocol RWS received-by [ RWS comment ]\n // received-protocol = [ protocol-name \"/\" ] protocol-version\n // received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n // Split the trimmed header value into parts\n const parts = arr[i].trim().split(/\\s+/);\n // Check if we have at least protocol/version and received-by parts\n if (parts.length >= 2) {\n // Get the received-by value (server id), removing any comment\n const serverId = parts[1].split('(')[0].trim();\n if (serverId === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n }\n }\n next();\n };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU;
|
|
1
|
+
{"version":3,"file":"antiLoop.mjs","names":[],"sources":["../../src/middlewares/antiLoop.ts"],"sourcesContent":["import { HTTP_STATUS, errorUtils } from '@verdaccio/core';\nimport type { Config } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\n/**\n * A middleware that avoid a registry points itself as proxy and avoid create infinite loops.\n * @param config\n * @returns\n */\nexport function antiLoop(config: Config) {\n return function (req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n if (req?.headers?.via != null) {\n const arr = req.get('via')?.split(',');\n if (Array.isArray(arr)) {\n for (let i = 0; i < arr.length; i++) {\n // the \"via\" header must contain a specific value, this has to be in sync\n // with the proxy request\n // match eg: Server 1 or Server 2\n\n // RFC 7230: Via = 1*( \",\" OWS Via-value )\n // Via-value = received-protocol RWS received-by [ RWS comment ]\n // received-protocol = [ protocol-name \"/\" ] protocol-version\n // received-by = ( uri-host [ \":\" port ] ) / pseudonym\n\n // Split the trimmed header value into parts\n const parts = arr[i].trim().split(/\\s+/);\n // Check if we have at least protocol/version and received-by parts\n if (parts.length >= 2) {\n // Get the received-by value (server id), removing any comment\n const serverId = parts[1].split('(')[0].trim();\n if (serverId === config.server_id) {\n return next(errorUtils.getCode(HTTP_STATUS.LOOP_DETECTED, 'loop detected'));\n }\n }\n }\n }\n }\n next();\n };\n}\n"],"mappings":";;;;;;;AAUA,SAAgB,SAAS,QAAgB;CACvC,OAAO,SAAU,KAAqB,KAAsB,MAA8B;EACxF,IAAI,KAAK,SAAS,OAAO,MAAM;GAC7B,MAAM,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,MAAM,GAAG;GACrC,IAAI,MAAM,QAAQ,GAAG,GACnB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;IAWnC,MAAM,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK;IAEvC,IAAI,MAAM,UAAU,GAED;SAAA,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KACpC,MAAa,OAAO,WACtB,OAAO,KAAK,WAAW,QAAQ,YAAY,eAAe,eAAe,CAAC;IAAA;GAGhF;EAEJ;EACA,KAAK;CACP;AACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n // @ts-ignore - Express internals: app.stack is not part of the public API\n const stack = (app as any).stack || (app as any)._router?.stack || [];\n return stack.some((middleware: any) => {\n return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n // middleware might have registered a json parser already\n if (hasBodyParser(app)) {\n debug('json parser already registered');\n } else {\n app.use(\n express.json({\n strict: false,\n limit: config.max_body_size || '10mb',\n })\n );\n }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"body-parser.js","names":[],"sources":["../../src/middlewares/body-parser.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Application, Router } from 'express';\nimport express from 'express';\n\nimport type { Config } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:middleware:body-parser');\n\n/**\n * Check if a body parser is already registered on the router\n */\nfunction hasBodyParser(app: Router | Application): boolean {\n // @ts-ignore - Express internals: app.stack is not part of the public API\n const stack = (app as any).stack || (app as any)._router?.stack || [];\n return stack.some((middleware: any) => {\n return middleware.handle?.name === 'jsonParser' || middleware.name === 'jsonParser';\n });\n}\n\n/**\n * Register JSON body parser on a router if not already registered\n * @param app Express router instance\n * @param config Verdaccio config\n */\nexport function registerBodyParser(app: Router | Application, config: Config): void {\n // middleware might have registered a json parser already\n if (hasBodyParser(app)) {\n debug('json parser already registered');\n } else {\n app.use(\n express.json({\n strict: false,\n limit: config.max_body_size || '10mb',\n })\n );\n }\n}\n"],"mappings":";;;;;;AAMA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,kCAAkC;;;;AAK3D,SAAS,cAAc,KAAoC;CAGzD,QADe,IAAY,SAAU,IAAY,SAAS,SAAS,CAAC,EAAA,CACvD,MAAM,eAAoB;EACrC,OAAO,WAAW,QAAQ,SAAS,gBAAgB,WAAW,SAAS;CACzE,CAAC;AACH;;;;;;AAOA,SAAgB,mBAAmB,KAA2B,QAAsB;CAElF,IAAI,cAAc,GAAG,GACnB,QAAM,gCAAgC;MAEtC,IAAI,IACF,QAAA,QAAQ,KAAK;EACX,QAAQ;EACR,OAAO,OAAO,iBAAiB;CACjC,CAAC,CACH;AAEJ"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n const original = req.url;\n\n // Expect relative URLs i.e. should call makeURLrelative before this middleware\n if (!req.url.startsWith('/')) {\n return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n }\n\n // If the @ sign is encoded, we need to decode it first\n // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n // For scoped packages, encode the slash to make it a single path segment/parameter\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n if (original !== req.url) {\n debug('encodeScopePackage: %o -> %o', original, req.url);\n } else {\n debug('encodeScopePackage: %o (unchanged)', original);\n }\n next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"encode-pkg.js","names":[],"sources":["../../src/middlewares/encode-pkg.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:encode');\n\n/**\n * Encode / in a scoped package name to be matched as a single parameter in routes\n * @param req\n * @param res\n * @param next\n */\nexport function encodeScopePackage(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n const original = req.url;\n\n // Expect relative URLs i.e. should call makeURLrelative before this middleware\n if (!req.url.startsWith('/')) {\n return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (must be relative)`));\n }\n\n // If the @ sign is encoded, we need to decode it first\n // e.g.: /%40org/pkg/1.2.3 -> /@org/pkg/1.2.3\n // For scoped packages, encode the slash to make it a single path segment/parameter\n // e.g.: /@org/pkg/1.2.3 -> /@org%2Fpkg/1.2.3, /@org%2Fpkg/1.2.3 -> /@org%2Fpkg/1.2.3\n // also handle cases for dist-tags where package is in the middle of the path and not at the beginning\n // e.g.: /-/package/@org/pkg/dist-tags/latest -> /-/package/@org%2Fpkg/dist-tags/latest\n req.url = req.url.replace(/\\/%40/, '/@').replace(/(\\/@[^\\/%]+)\\/(?!$)/, '$1%2F');\n\n if (original !== req.url) {\n debug('encodeScopePackage: %o -> %o', original, req.url);\n } else {\n debug('encodeScopePackage: %o (unchanged)', original);\n }\n next();\n}\n"],"mappings":";;;;;AAMA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,6BAA6B;;;;;;;AAQtD,SAAgB,mBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAGrB,IAAI,CAAC,IAAI,IAAI,WAAW,GAAG,GACzB,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,oBAAoB,CAAC;CASpF,IAAI,MAAM,IAAI,IAAI,QAAQ,SAAS,IAAI,CAAC,CAAC,QAAQ,uBAAuB,OAAO;CAE/E,IAAI,aAAa,IAAI,KACnB,QAAM,gCAAgC,UAAU,IAAI,GAAG;MAEvD,QAAM,sCAAsC,QAAQ;CAEtD,KAAK;AACP"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"error.js","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ) {\n debug('error handler init');\n if (isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (typeof res.locals.report_error !== 'function') {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(logger)(req, res, noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): void {\n debug('error report middleware start');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('send internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware end (skip next layer) next()');\n next();\n };\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"error.js","names":[],"sources":["../../src/middlewares/error.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { HttpError } from 'http-errors';\nimport { isError, isNil, noop } from 'lodash-es';\n\nimport type { VerdaccioError } from '@verdaccio/core';\nimport { API_ERROR, HTTP_STATUS } from '@verdaccio/core';\nimport type { Logger } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:error');\n\nexport const handleError = (logger: Logger) =>\n function handleError(\n err: HttpError,\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ) {\n debug('error handler init');\n if (isError(err)) {\n debug('is native error');\n if (err.code === 'ECONNABORT' && res.statusCode === HTTP_STATUS.NOT_MODIFIED) {\n return next();\n }\n if (typeof res.locals.report_error !== 'function') {\n debug('is locals error report ref');\n // in case of very early error this middleware may not be loaded before error is generated\n // fixing that\n errorReportingMiddleware(logger)(req, res, noop);\n }\n debug('set locals error report ref');\n res.locals.report_error(err);\n } else {\n // Fall to Middleware.final\n debug('no error to report, jump next layer');\n return next(err);\n }\n };\n\n// Middleware\nexport const errorReportingMiddleware = (logger: Logger) =>\n function errorReportingMiddleware(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): void {\n debug('error report middleware start');\n res.locals.report_error =\n res.locals.report_error ||\n function (err: VerdaccioError): void {\n if (err.status && err.status >= HTTP_STATUS.BAD_REQUEST && err.status < 600) {\n debug('is error > 409 %o', err?.status);\n if (isNil(res.headersSent) === false) {\n debug('send status %o', err?.status);\n res.status(err.status);\n debug('next layer %o', err?.message);\n next({ error: err.message || API_ERROR.UNKNOWN_ERROR });\n }\n } else {\n debug('is error < 409 %o', err?.status);\n logger.error({ err: err }, 'unexpected error: @{!err.message}\\n@{err.stack}');\n if (!res.status || !res.send) {\n // TODO: decide which debug keep\n logger.error('this is an error in express.js, please report this');\n debug('this is an error in express.js, please report this, destroy response %o', err);\n res.destroy();\n } else if (!res.headersSent) {\n debug('send internal error %o', err);\n res.status(HTTP_STATUS.INTERNAL_ERROR);\n next({ error: API_ERROR.INTERNAL_SERVER_ERROR });\n } else {\n // socket should be already closed\n debug('this should not happen, otherwise report %o', err);\n }\n }\n };\n\n debug('error report middleware end (skip next layer) next()');\n next();\n };\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,4BAA4B;AAErD,IAAa,eAAe,WAC1B,SAAS,YACP,KACA,KACA,KACA,MACA;CACA,QAAM,oBAAoB;CAC1B,KAAA,GAAI,UAAA,QAAA,CAAQ,GAAG,GAAG;EAChB,QAAM,iBAAiB;EACvB,IAAI,IAAI,SAAS,gBAAgB,IAAI,eAAe,gBAAA,YAAY,cAC9D,OAAO,KAAK;EAEd,IAAI,OAAO,IAAI,OAAO,iBAAiB,YAAY;GACjD,QAAM,4BAA4B;GAGlC,yBAAyB,MAAM,CAAC,CAAC,KAAK,KAAK,UAAA,IAAI;EACjD;EACA,QAAM,6BAA6B;EACnC,IAAI,OAAO,aAAa,GAAG;CAC7B,OAAO;EAEL,QAAM,qCAAqC;EAC3C,OAAO,KAAK,GAAG;CACjB;AACF;AAGF,IAAa,4BAA4B,WACvC,SAAS,yBACP,KACA,KACA,MACM;CACN,QAAM,+BAA+B;CACrC,IAAI,OAAO,eACT,IAAI,OAAO,gBACX,SAAU,KAA2B;EACnC,IAAI,IAAI,UAAU,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,KAAK;GAC3E,QAAM,qBAAqB,KAAK,MAAM;GACtC,KAAA,GAAI,UAAA,MAAA,CAAM,IAAI,WAAW,MAAM,OAAO;IACpC,QAAM,kBAAkB,KAAK,MAAM;IACnC,IAAI,OAAO,IAAI,MAAM;IACrB,QAAM,iBAAiB,KAAK,OAAO;IACnC,KAAK,EAAE,OAAO,IAAI,WAAW,gBAAA,UAAU,cAAc,CAAC;GACxD;EACF,OAAO;GACL,QAAM,qBAAqB,KAAK,MAAM;GACtC,OAAO,MAAM,EAAO,IAAI,GAAG,iDAAiD;GAC5E,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,MAAM;IAE5B,OAAO,MAAM,oDAAoD;IACjE,QAAM,2EAA2E,GAAG;IACpF,IAAI,QAAQ;GACd,OAAO,IAAI,CAAC,IAAI,aAAa;IAC3B,QAAM,0BAA0B,GAAG;IACnC,IAAI,OAAO,gBAAA,YAAY,cAAc;IACrC,KAAK,EAAE,OAAO,gBAAA,UAAU,sBAAsB,CAAC;GACjD,OAEE,QAAM,+CAA+C,GAAG;EAE5D;CACF;CAEF,QAAM,sDAAsD;CAC5D,KAAK;AACP"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"final.js","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n debug('set auth header support');\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (typeof body === 'string' || isObject(body)) {\n if (!res.get(HEADERS.CONTENT_TYPE)) {\n debug('set json type header support');\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n debug('set verdaccio_error method');\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n const etag = cryptoUtils.stringToMD5(body as string);\n debug('set etag header %s', etag);\n res.header(HEADERS.ETAG, '\"' + etag + '\"');\n }\n } else {\n debug('this line should never be visible, if does report');\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n debug('set headers after they are sent');\n if (isNil(res.socket) === false) {\n debug('force destroy socket');\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"final.js","names":[],"sources":["../../src/middlewares/final.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil, isObject } from 'lodash-es';\n\nimport { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER, cryptoUtils } from '@verdaccio/core';\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } from '../types';\n\nexport type FinalBody = Manifest | MiddlewareError | string;\n\nconst debug = buildDebug('verdaccio:middleware:final');\n\nexport function final(\n body: FinalBody,\n req: $RequestExtend,\n res: $ResponseExtend,\n // if we remove `next` breaks test\n // eslint-disable-next-line @typescript-eslint/no-unused-vars\n next: $NextFunctionVer\n): void {\n if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {\n debug('set auth header support');\n res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);\n }\n\n try {\n if (typeof body === 'string' || isObject(body)) {\n if (!res.get(HEADERS.CONTENT_TYPE)) {\n debug('set json type header support');\n res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);\n }\n\n if (typeof body === 'object' && isNil(body) === false) {\n if (typeof (body as MiddlewareError).error === 'string') {\n debug('set verdaccio_error method');\n res.locals._verdaccio_error = (body as MiddlewareError).error;\n }\n body = JSON.stringify(body, undefined, ' ') + '\\n';\n }\n\n // don't send etags with errors\n if (\n !res.statusCode ||\n (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)\n ) {\n const etag = cryptoUtils.stringToMD5(body as string);\n debug('set etag header %s', etag);\n res.header(HEADERS.ETAG, '\"' + etag + '\"');\n }\n } else {\n debug('this line should never be visible, if does report');\n // send(null), send(204), etc.\n }\n } catch (err: any) {\n // if verdaccio sends headers first, and then calls res.send()\n // as an error handler, we can't report error properly,\n // and should just close socket\n if (err.message.match(/set headers after they are sent/)) {\n debug('set headers after they are sent');\n if (isNil(res.socket) === false) {\n debug('force destroy socket');\n res.socket?.destroy();\n }\n return;\n }\n throw err;\n }\n\n res.send(body);\n}\n"],"mappings":";;;;;;AAUA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,4BAA4B;AAErD,SAAgB,MACd,MACA,KACA,KAGA,MACM;CACN,IAAI,IAAI,eAAe,gBAAA,YAAY,gBAAgB,CAAC,IAAI,UAAU,gBAAA,QAAQ,QAAQ,GAAG;EACnF,QAAM,yBAAyB;EAC/B,IAAI,OAAO,gBAAA,QAAQ,UAAU,GAAG,gBAAA,YAAY,IAAI,gBAAA,cAAc;CAChE;CAEA,IAAI;EACF,IAAI,OAAO,SAAS,aAAA,GAAY,UAAA,SAAA,CAAS,IAAI,GAAG;GAC9C,IAAI,CAAC,IAAI,IAAI,gBAAA,QAAQ,YAAY,GAAG;IAClC,QAAM,8BAA8B;IACpC,IAAI,OAAO,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,IAAI;GAC/C;GAEA,IAAI,OAAO,SAAS,aAAA,GAAY,UAAA,MAAA,CAAM,IAAI,MAAM,OAAO;IACrD,IAAI,OAAQ,KAAyB,UAAU,UAAU;KACvD,QAAM,4BAA4B;KAClC,IAAI,OAAO,mBAAoB,KAAyB;IAC1D;IACA,OAAO,KAAK,UAAU,MAAM,KAAA,GAAW,IAAI,IAAI;GACjD;GAGA,IACE,CAAC,IAAI,cACJ,IAAI,cAAc,gBAAA,YAAY,MAAM,IAAI,aAAa,gBAAA,YAAY,kBAClE;IACA,MAAM,OAAO,gBAAA,YAAY,YAAY,IAAc;IACnD,QAAM,sBAAsB,IAAI;IAChC,IAAI,OAAO,gBAAA,QAAQ,MAAM,OAAM,OAAO,IAAG;GAC3C;EACF,OACE,QAAM,mDAAmD;CAG7D,SAAS,KAAU;EAIjB,IAAI,IAAI,QAAQ,MAAM,iCAAiC,GAAG;GACxD,QAAM,iCAAiC;GACvC,KAAA,GAAI,UAAA,MAAA,CAAM,IAAI,MAAM,MAAM,OAAO;IAC/B,QAAM,sBAAsB;IAC5B,IAAI,QAAQ,QAAQ;GACtB;GACA;EACF;EACA,MAAM;CACR;CAEA,IAAI,KAAK,IAAI;AACf"}
|
package/build/middlewares/log.js
CHANGED
|
@@ -92,8 +92,10 @@ var log = (logger, options = {}) => {
|
|
|
92
92
|
const context = getRequestContext();
|
|
93
93
|
const message = context.error ? _verdaccio_core.constants.LOG_VERDACCIO_ERROR : _verdaccio_core.constants.LOG_VERDACCIO_BYTES;
|
|
94
94
|
if (_skipLog) {
|
|
95
|
-
if (debug$1.enabled)
|
|
96
|
-
|
|
95
|
+
if (debug$1.enabled) {
|
|
96
|
+
if (context.error) debug$1(convertToDebugString(message), context.status, context.user, context.remoteIP, context.request.method, context.request.url, context.error);
|
|
97
|
+
else debug$1(convertToDebugString(message), context.status, context.user, context.remoteIP, context.request.method, context.request.url, context.bytes.in, context.bytes.out);
|
|
98
|
+
}
|
|
97
99
|
} else req.log.http(context, message);
|
|
98
100
|
cleanupSocketListeners();
|
|
99
101
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.js","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS, constants } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n return url.startsWith('/-/static/') || url.startsWith('/favicon');\n}\n\n// Keep export of constants for backward compatibility\nexport const LOG_STATUS_MESSAGE = constants.LOG_STATUS_MESSAGE;\nexport const LOG_VERDACCIO_ERROR = constants.LOG_VERDACCIO_ERROR;\nexport const LOG_VERDACCIO_BYTES = constants.LOG_VERDACCIO_BYTES;\n\n// Converts all @{...} to %o for debug compatibility\nfunction convertToDebugString(template: string): string {\n return template.replace(/@\\{[^}]+\\}/g, '%o');\n}\n\nexport type LogOptions = {\n // When true, static file requests (/-/static/*) are hidden from pino logs\n // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n const { hideStaticLogs = true } = options;\n\n return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n if (_skipLog) {\n if (debug.enabled) {\n debug(convertToDebugString(constants.LOG_REQUEST_MESSAGE), req.ip, req.method, req.url);\n }\n } else {\n req.log.info({ req, ip: req.ip }, constants.LOG_REQUEST_MESSAGE);\n }\n req.originalUrl = req.url;\n\n if (isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n res.write = function (...args): boolean {\n bytesout += args[0]?.length || 0;\n // @ts-ignore\n return _write.apply(res, args);\n };\n\n // Track if the request completed normally\n let requestCompleted = false;\n let abortLogged = false;\n\n const getRequestContext = () => {\n const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n const remoteAddress = req.socket.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n return {\n request: {\n method: req.method,\n url: req.originalUrl,\n },\n user: req.remote_user?.name || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n };\n };\n\n const logAbortedRequest = () => {\n if (abortLogged || requestCompleted) return;\n abortLogged = true;\n\n const context = {\n ...getRequestContext(),\n status: constants.HTTP_STATUS.CLIENT_CLOSED_REQUEST,\n };\n\n if (_skipLog) {\n if (debug.enabled) {\n debug(\n convertToDebugString(constants.LOG_VERDACCIO_ABORT),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url\n );\n }\n } else {\n req.log.info(context, constants.LOG_VERDACCIO_ABORT);\n }\n };\n\n const cleanupSocketListeners = () => {\n req.socket.removeListener('close', onClose);\n req.socket.removeListener('error', onError);\n };\n\n const onClose = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const onError = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const logCompletedRequest = () => {\n requestCompleted = true;\n\n const context = getRequestContext();\n const message = context.error ? constants.LOG_VERDACCIO_ERROR : constants.LOG_VERDACCIO_BYTES;\n\n if (_skipLog) {\n if (debug.enabled) {\n if (context.error) {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.error\n );\n } else {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.bytes.in,\n context.bytes.out\n );\n }\n }\n } else {\n req.log.http(context, message);\n }\n\n cleanupSocketListeners();\n };\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (...args): void {\n if (args[0]) {\n bytesout += args[0].length;\n }\n // @ts-ignore\n _end.apply(res, args);\n logCompletedRequest();\n };\n\n req.socket.on('close', onClose);\n req.socket.on('error', onError);\n\n next();\n };\n};\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"log.js","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS, constants } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n return url.startsWith('/-/static/') || url.startsWith('/favicon');\n}\n\n// Keep export of constants for backward compatibility\nexport const LOG_STATUS_MESSAGE = constants.LOG_STATUS_MESSAGE;\nexport const LOG_VERDACCIO_ERROR = constants.LOG_VERDACCIO_ERROR;\nexport const LOG_VERDACCIO_BYTES = constants.LOG_VERDACCIO_BYTES;\n\n// Converts all @{...} to %o for debug compatibility\nfunction convertToDebugString(template: string): string {\n return template.replace(/@\\{[^}]+\\}/g, '%o');\n}\n\nexport type LogOptions = {\n // When true, static file requests (/-/static/*) are hidden from pino logs\n // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n const { hideStaticLogs = true } = options;\n\n return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n if (_skipLog) {\n if (debug.enabled) {\n debug(convertToDebugString(constants.LOG_REQUEST_MESSAGE), req.ip, req.method, req.url);\n }\n } else {\n req.log.info({ req, ip: req.ip }, constants.LOG_REQUEST_MESSAGE);\n }\n req.originalUrl = req.url;\n\n if (isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n res.write = function (...args): boolean {\n bytesout += args[0]?.length || 0;\n // @ts-ignore\n return _write.apply(res, args);\n };\n\n // Track if the request completed normally\n let requestCompleted = false;\n let abortLogged = false;\n\n const getRequestContext = () => {\n const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n const remoteAddress = req.socket.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n return {\n request: {\n method: req.method,\n url: req.originalUrl,\n },\n user: req.remote_user?.name || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n };\n };\n\n const logAbortedRequest = () => {\n if (abortLogged || requestCompleted) return;\n abortLogged = true;\n\n const context = {\n ...getRequestContext(),\n status: constants.HTTP_STATUS.CLIENT_CLOSED_REQUEST,\n };\n\n if (_skipLog) {\n if (debug.enabled) {\n debug(\n convertToDebugString(constants.LOG_VERDACCIO_ABORT),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url\n );\n }\n } else {\n req.log.info(context, constants.LOG_VERDACCIO_ABORT);\n }\n };\n\n const cleanupSocketListeners = () => {\n req.socket.removeListener('close', onClose);\n req.socket.removeListener('error', onError);\n };\n\n const onClose = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const onError = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const logCompletedRequest = () => {\n requestCompleted = true;\n\n const context = getRequestContext();\n const message = context.error ? constants.LOG_VERDACCIO_ERROR : constants.LOG_VERDACCIO_BYTES;\n\n if (_skipLog) {\n if (debug.enabled) {\n if (context.error) {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.error\n );\n } else {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.bytes.in,\n context.bytes.out\n );\n }\n }\n } else {\n req.log.http(context, message);\n }\n\n cleanupSocketListeners();\n };\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (...args): void {\n if (args[0]) {\n bytesout += args[0].length;\n }\n // @ts-ignore\n _end.apply(res, args);\n logCompletedRequest();\n };\n\n req.socket.on('close', onClose);\n req.socket.on('error', onError);\n\n next();\n };\n};\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY,KAAK,IAAI,WAAW,UAAU;AAClE;AAGA,IAAa,qBAAqB,gBAAA,UAAU;AAC5C,IAAa,sBAAsB,gBAAA,UAAU;AAC7C,IAAa,sBAAsB,gBAAA,UAAU;AAG7C,SAAS,qBAAqB,UAA0B;CACtD,OAAO,SAAS,QAAQ,eAAe,IAAI;AAC7C;AAQA,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,KAAA,GAAI,UAAA,MAAA,CAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,KAAA,GAAI,UAAA,MAAA,CAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI,UACE;OAAA,QAAM,SACR,QAAM,qBAAqB,gBAAA,UAAU,mBAAmB,GAAG,IAAI,IAAI,IAAI,QAAQ,IAAI,GAAG;EAAA,OAGxF,IAAI,IAAI,KAAK;GAAE;GAAK,IAAI,IAAI;EAAG,GAAG,gBAAA,UAAU,mBAAmB;EAEjE,IAAI,cAAc,IAAI;EAEtB,KAAA,GAAI,UAAA,MAAA,CAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,KAAA,GAAI,UAAA,MAAA,CAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EACnB,IAAI,QAAQ,SAAU,GAAG,MAAe;GACtC,YAAY,KAAK,EAAE,EAAE,UAAU;GAE/B,OAAO,OAAO,MAAM,KAAK,IAAI;EAC/B;EAGA,IAAI,mBAAmB;EACvB,IAAI,cAAc;EAElB,MAAM,0BAA0B;GAC9B,MAAM,eAAe,IAAI,IAAI,gBAAA,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,OAAO;IACL,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF;EACF;EAEA,MAAM,0BAA0B;GAC9B,IAAI,eAAe,kBAAkB;GACrC,cAAc;GAEd,MAAM,UAAU;IACd,GAAG,kBAAkB;IACrB,QAAQ,gBAAA,UAAU,YAAY;GAChC;GAEA,IAAI,UACE;QAAA,QAAM,SACR,QACE,qBAAqB,gBAAA,UAAU,mBAAmB,GAClD,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,GAClB;GAAA,OAGF,IAAI,IAAI,KAAK,SAAS,gBAAA,UAAU,mBAAmB;EAEvD;EAEA,MAAM,+BAA+B;GACnC,IAAI,OAAO,eAAe,SAAS,OAAO;GAC1C,IAAI,OAAO,eAAe,SAAS,OAAO;EAC5C;EAEA,MAAM,gBAAgB;GACpB,IAAI,CAAC,kBACH,kBAAkB;GAEpB,uBAAuB;EACzB;EAEA,MAAM,gBAAgB;GACpB,IAAI,CAAC,kBACH,kBAAkB;GAEpB,uBAAuB;EACzB;EAEA,MAAM,4BAA4B;GAChC,mBAAmB;GAEnB,MAAM,UAAU,kBAAkB;GAClC,MAAM,UAAU,QAAQ,QAAQ,gBAAA,UAAU,sBAAsB,gBAAA,UAAU;GAE1E,IAAI,UACE;QAAA,QAAM,SAAS;KACjB,IAAI,QAAQ,OACV,QACE,qBAAqB,OAAO,GAC5B,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,KAChB,QAAQ,KACV;UAEA,QACE,qBAAqB,OAAO,GAC5B,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,KAChB,QAAQ,MAAM,IACd,QAAQ,MAAM,GAChB;IAEJ;UAEA,IAAI,IAAI,KAAK,SAAS,OAAO;GAG/B,uBAAuB;EACzB;EAEA,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,GAAG,MAAY;GACjC,IAAI,KAAK,IACP,YAAY,KAAK,EAAE,CAAC;GAGtB,KAAK,MAAM,KAAK,IAAI;GACpB,oBAAoB;EACtB;EAEA,IAAI,OAAO,GAAG,SAAS,OAAO;EAC9B,IAAI,OAAO,GAAG,SAAS,OAAO;EAE9B,KAAK;CACP;AACF"}
|
|
@@ -90,8 +90,10 @@ var log = (logger, options = {}) => {
|
|
|
90
90
|
const context = getRequestContext();
|
|
91
91
|
const message = context.error ? constants.LOG_VERDACCIO_ERROR : constants.LOG_VERDACCIO_BYTES;
|
|
92
92
|
if (_skipLog) {
|
|
93
|
-
if (debug.enabled)
|
|
94
|
-
|
|
93
|
+
if (debug.enabled) {
|
|
94
|
+
if (context.error) debug(convertToDebugString(message), context.status, context.user, context.remoteIP, context.request.method, context.request.url, context.error);
|
|
95
|
+
else debug(convertToDebugString(message), context.status, context.user, context.remoteIP, context.request.method, context.request.url, context.bytes.in, context.bytes.out);
|
|
96
|
+
}
|
|
95
97
|
} else req.log.http(context, message);
|
|
96
98
|
cleanupSocketListeners();
|
|
97
99
|
};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"log.mjs","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS, constants } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n return url.startsWith('/-/static/') || url.startsWith('/favicon');\n}\n\n// Keep export of constants for backward compatibility\nexport const LOG_STATUS_MESSAGE = constants.LOG_STATUS_MESSAGE;\nexport const LOG_VERDACCIO_ERROR = constants.LOG_VERDACCIO_ERROR;\nexport const LOG_VERDACCIO_BYTES = constants.LOG_VERDACCIO_BYTES;\n\n// Converts all @{...} to %o for debug compatibility\nfunction convertToDebugString(template: string): string {\n return template.replace(/@\\{[^}]+\\}/g, '%o');\n}\n\nexport type LogOptions = {\n // When true, static file requests (/-/static/*) are hidden from pino logs\n // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n const { hideStaticLogs = true } = options;\n\n return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n if (_skipLog) {\n if (debug.enabled) {\n debug(convertToDebugString(constants.LOG_REQUEST_MESSAGE), req.ip, req.method, req.url);\n }\n } else {\n req.log.info({ req, ip: req.ip }, constants.LOG_REQUEST_MESSAGE);\n }\n req.originalUrl = req.url;\n\n if (isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n res.write = function (...args): boolean {\n bytesout += args[0]?.length || 0;\n // @ts-ignore\n return _write.apply(res, args);\n };\n\n // Track if the request completed normally\n let requestCompleted = false;\n let abortLogged = false;\n\n const getRequestContext = () => {\n const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n const remoteAddress = req.socket.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n return {\n request: {\n method: req.method,\n url: req.originalUrl,\n },\n user: req.remote_user?.name || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n };\n };\n\n const logAbortedRequest = () => {\n if (abortLogged || requestCompleted) return;\n abortLogged = true;\n\n const context = {\n ...getRequestContext(),\n status: constants.HTTP_STATUS.CLIENT_CLOSED_REQUEST,\n };\n\n if (_skipLog) {\n if (debug.enabled) {\n debug(\n convertToDebugString(constants.LOG_VERDACCIO_ABORT),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url\n );\n }\n } else {\n req.log.info(context, constants.LOG_VERDACCIO_ABORT);\n }\n };\n\n const cleanupSocketListeners = () => {\n req.socket.removeListener('close', onClose);\n req.socket.removeListener('error', onError);\n };\n\n const onClose = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const onError = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const logCompletedRequest = () => {\n requestCompleted = true;\n\n const context = getRequestContext();\n const message = context.error ? constants.LOG_VERDACCIO_ERROR : constants.LOG_VERDACCIO_BYTES;\n\n if (_skipLog) {\n if (debug.enabled) {\n if (context.error) {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.error\n );\n } else {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.bytes.in,\n context.bytes.out\n );\n }\n }\n } else {\n req.log.http(context, message);\n }\n\n cleanupSocketListeners();\n };\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (...args): void {\n if (args[0]) {\n bytesout += args[0].length;\n }\n // @ts-ignore\n _end.apply(res, args);\n logCompletedRequest();\n };\n\n req.socket.on('close', onClose);\n req.socket.on('error', onError);\n\n next();\n };\n};\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY,KAAK,IAAI,WAAW,UAAU;AAClE;AAGA,IAAa,qBAAqB,UAAU;AAC5C,IAAa,sBAAsB,UAAU;AAC7C,IAAa,sBAAsB,UAAU;AAG7C,SAAS,qBAAqB,UAA0B;CACtD,OAAO,SAAS,QAAQ,eAAe,IAAI;AAC7C;AAQA,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,MAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,IAAI,MAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI;
|
|
1
|
+
{"version":3,"file":"log.mjs","names":[],"sources":["../../src/middlewares/log.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nimport { HEADERS, constants } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:log');\n\nfunction isStaticRequest(url: string): boolean {\n return url.startsWith('/-/static/') || url.startsWith('/favicon');\n}\n\n// Keep export of constants for backward compatibility\nexport const LOG_STATUS_MESSAGE = constants.LOG_STATUS_MESSAGE;\nexport const LOG_VERDACCIO_ERROR = constants.LOG_VERDACCIO_ERROR;\nexport const LOG_VERDACCIO_BYTES = constants.LOG_VERDACCIO_BYTES;\n\n// Converts all @{...} to %o for debug compatibility\nfunction convertToDebugString(template: string): string {\n return template.replace(/@\\{[^}]+\\}/g, '%o');\n}\n\nexport type LogOptions = {\n // When true, static file requests (/-/static/*) are hidden from pino logs\n // and only visible via DEBUG=verdaccio:middleware:log. Defaults to true.\n hideStaticLogs?: boolean;\n};\n\nexport const log = (logger, options: LogOptions = {}) => {\n const { hideStaticLogs = true } = options;\n\n return function log(req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n // logger\n req.log = logger.child({ sub: 'in' });\n\n const _auth = req.headers.authorization;\n if (isNil(_auth) === false) {\n req.headers.authorization = '<Classified>';\n }\n\n const _cookie = req.get('cookie');\n if (isNil(_cookie) === false) {\n req.headers.cookie = '<Classified>';\n }\n\n req.url = req.originalUrl;\n const _skipLog = hideStaticLogs && isStaticRequest(req.url);\n if (_skipLog) {\n if (debug.enabled) {\n debug(convertToDebugString(constants.LOG_REQUEST_MESSAGE), req.ip, req.method, req.url);\n }\n } else {\n req.log.info({ req, ip: req.ip }, constants.LOG_REQUEST_MESSAGE);\n }\n req.originalUrl = req.url;\n\n if (isNil(_auth) === false) {\n req.headers.authorization = _auth;\n }\n\n if (isNil(_cookie) === false) {\n req.headers.cookie = _cookie;\n }\n\n let bytesin = 0;\n req.on('data', function (chunk): void {\n bytesin += chunk.length;\n });\n\n let bytesout = 0;\n const _write = res.write;\n res.write = function (...args): boolean {\n bytesout += args[0]?.length || 0;\n // @ts-ignore\n return _write.apply(res, args);\n };\n\n // Track if the request completed normally\n let requestCompleted = false;\n let abortLogged = false;\n\n const getRequestContext = () => {\n const forwardedFor = req.get(HEADERS.FORWARDED_FOR);\n const remoteAddress = req.socket.remoteAddress;\n const remoteIP = forwardedFor ? `${forwardedFor} via ${remoteAddress}` : remoteAddress;\n return {\n request: {\n method: req.method,\n url: req.originalUrl,\n },\n user: req.remote_user?.name || null,\n remoteIP,\n status: res.statusCode,\n error: res.locals._verdaccio_error,\n bytes: {\n in: bytesin,\n out: bytesout,\n },\n };\n };\n\n const logAbortedRequest = () => {\n if (abortLogged || requestCompleted) return;\n abortLogged = true;\n\n const context = {\n ...getRequestContext(),\n status: constants.HTTP_STATUS.CLIENT_CLOSED_REQUEST,\n };\n\n if (_skipLog) {\n if (debug.enabled) {\n debug(\n convertToDebugString(constants.LOG_VERDACCIO_ABORT),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url\n );\n }\n } else {\n req.log.info(context, constants.LOG_VERDACCIO_ABORT);\n }\n };\n\n const cleanupSocketListeners = () => {\n req.socket.removeListener('close', onClose);\n req.socket.removeListener('error', onError);\n };\n\n const onClose = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const onError = () => {\n if (!requestCompleted) {\n logAbortedRequest();\n }\n cleanupSocketListeners();\n };\n\n const logCompletedRequest = () => {\n requestCompleted = true;\n\n const context = getRequestContext();\n const message = context.error ? constants.LOG_VERDACCIO_ERROR : constants.LOG_VERDACCIO_BYTES;\n\n if (_skipLog) {\n if (debug.enabled) {\n if (context.error) {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.error\n );\n } else {\n debug(\n convertToDebugString(message),\n context.status,\n context.user,\n context.remoteIP,\n context.request.method,\n context.request.url,\n context.bytes.in,\n context.bytes.out\n );\n }\n }\n } else {\n req.log.http(context, message);\n }\n\n cleanupSocketListeners();\n };\n\n const _end = res.end;\n // @ts-ignore\n res.end = function (...args): void {\n if (args[0]) {\n bytesout += args[0].length;\n }\n // @ts-ignore\n _end.apply(res, args);\n logCompletedRequest();\n };\n\n req.socket.on('close', onClose);\n req.socket.on('error', onError);\n\n next();\n };\n};\n"],"mappings":";;;;AAOA,IAAM,QAAQ,WAAW,0BAA0B;AAEnD,SAAS,gBAAgB,KAAsB;CAC7C,OAAO,IAAI,WAAW,YAAY,KAAK,IAAI,WAAW,UAAU;AAClE;AAGA,IAAa,qBAAqB,UAAU;AAC5C,IAAa,sBAAsB,UAAU;AAC7C,IAAa,sBAAsB,UAAU;AAG7C,SAAS,qBAAqB,UAA0B;CACtD,OAAO,SAAS,QAAQ,eAAe,IAAI;AAC7C;AAQA,IAAa,OAAO,QAAQ,UAAsB,CAAC,MAAM;CACvD,MAAM,EAAE,iBAAiB,SAAS;CAElC,OAAO,SAAS,IAAI,KAAqB,KAAsB,MAA8B;EAE3F,IAAI,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,CAAC;EAEpC,MAAM,QAAQ,IAAI,QAAQ;EAC1B,IAAI,MAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,MAAM,UAAU,IAAI,IAAI,QAAQ;EAChC,IAAI,MAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,MAAM,IAAI;EACd,MAAM,WAAW,kBAAkB,gBAAgB,IAAI,GAAG;EAC1D,IAAI,UACE;OAAA,MAAM,SACR,MAAM,qBAAqB,UAAU,mBAAmB,GAAG,IAAI,IAAI,IAAI,QAAQ,IAAI,GAAG;EAAA,OAGxF,IAAI,IAAI,KAAK;GAAE;GAAK,IAAI,IAAI;EAAG,GAAG,UAAU,mBAAmB;EAEjE,IAAI,cAAc,IAAI;EAEtB,IAAI,MAAM,KAAK,MAAM,OACnB,IAAI,QAAQ,gBAAgB;EAG9B,IAAI,MAAM,OAAO,MAAM,OACrB,IAAI,QAAQ,SAAS;EAGvB,IAAI,UAAU;EACd,IAAI,GAAG,QAAQ,SAAU,OAAa;GACpC,WAAW,MAAM;EACnB,CAAC;EAED,IAAI,WAAW;EACf,MAAM,SAAS,IAAI;EACnB,IAAI,QAAQ,SAAU,GAAG,MAAe;GACtC,YAAY,KAAK,EAAE,EAAE,UAAU;GAE/B,OAAO,OAAO,MAAM,KAAK,IAAI;EAC/B;EAGA,IAAI,mBAAmB;EACvB,IAAI,cAAc;EAElB,MAAM,0BAA0B;GAC9B,MAAM,eAAe,IAAI,IAAI,QAAQ,aAAa;GAClD,MAAM,gBAAgB,IAAI,OAAO;GACjC,MAAM,WAAW,eAAe,GAAG,aAAa,OAAO,kBAAkB;GACzE,OAAO;IACL,SAAS;KACP,QAAQ,IAAI;KACZ,KAAK,IAAI;IACX;IACA,MAAM,IAAI,aAAa,QAAQ;IAC/B;IACA,QAAQ,IAAI;IACZ,OAAO,IAAI,OAAO;IAClB,OAAO;KACL,IAAI;KACJ,KAAK;IACP;GACF;EACF;EAEA,MAAM,0BAA0B;GAC9B,IAAI,eAAe,kBAAkB;GACrC,cAAc;GAEd,MAAM,UAAU;IACd,GAAG,kBAAkB;IACrB,QAAQ,UAAU,YAAY;GAChC;GAEA,IAAI,UACE;QAAA,MAAM,SACR,MACE,qBAAqB,UAAU,mBAAmB,GAClD,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,GAClB;GAAA,OAGF,IAAI,IAAI,KAAK,SAAS,UAAU,mBAAmB;EAEvD;EAEA,MAAM,+BAA+B;GACnC,IAAI,OAAO,eAAe,SAAS,OAAO;GAC1C,IAAI,OAAO,eAAe,SAAS,OAAO;EAC5C;EAEA,MAAM,gBAAgB;GACpB,IAAI,CAAC,kBACH,kBAAkB;GAEpB,uBAAuB;EACzB;EAEA,MAAM,gBAAgB;GACpB,IAAI,CAAC,kBACH,kBAAkB;GAEpB,uBAAuB;EACzB;EAEA,MAAM,4BAA4B;GAChC,mBAAmB;GAEnB,MAAM,UAAU,kBAAkB;GAClC,MAAM,UAAU,QAAQ,QAAQ,UAAU,sBAAsB,UAAU;GAE1E,IAAI,UACE;QAAA,MAAM,SAAS;KACjB,IAAI,QAAQ,OACV,MACE,qBAAqB,OAAO,GAC5B,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,KAChB,QAAQ,KACV;UAEA,MACE,qBAAqB,OAAO,GAC5B,QAAQ,QACR,QAAQ,MACR,QAAQ,UACR,QAAQ,QAAQ,QAChB,QAAQ,QAAQ,KAChB,QAAQ,MAAM,IACd,QAAQ,MAAM,GAChB;IAEJ;UAEA,IAAI,IAAI,KAAK,SAAS,OAAO;GAG/B,uBAAuB;EACzB;EAEA,MAAM,OAAO,IAAI;EAEjB,IAAI,MAAM,SAAU,GAAG,MAAY;GACjC,IAAI,KAAK,IACP,YAAY,KAAK,EAAE,CAAC;GAGtB,KAAK,MAAM,KAAK,IAAI;GACpB,oBAAoB;EACtB;EAEA,IAAI,OAAO,GAAG,SAAS,OAAO;EAC9B,IAAI,OAAO,GAAG,SAAS,OAAO;EAE9B,KAAK;CACP;AACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"make-url-relative.js","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n const original = req.url;\n\n // npm requests can contain the full URL, including the hostname, for example:\n // tarball downloads. Removing the hostname makes the URL relative and allows\n // the application to handle requests in a more consistent way.\n\n let url;\n try {\n // In productive use, the URL is absolute (and base will be ignored)\n // In tests, the URL might brelative (and base will be used)\n // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n } catch (error) {\n return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n }\n\n // Rebuild the URL without hostname\n req.url = url.pathname + url.search + url.hash;\n\n if (original !== req.url) {\n debug('makeURLrelative: %o -> %o', original, req.url);\n } else {\n debug('makeURLrelative: %o (unchanged)', original);\n }\n next();\n}\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"make-url-relative.js","names":[],"sources":["../../src/middlewares/make-url-relative.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { URL } from 'node:url';\n\nimport { errorUtils } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nconst debug = buildDebug('verdaccio:middleware:make-url-relative');\n\n/**\n * Removes the host from the URL and turns it into a relative URL.\n * @param req\n * @param res\n * @param next\n */\nexport function makeURLrelative(\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n): void {\n const original = req.url;\n\n // npm requests can contain the full URL, including the hostname, for example:\n // tarball downloads. Removing the hostname makes the URL relative and allows\n // the application to handle requests in a more consistent way.\n\n let url;\n try {\n // In productive use, the URL is absolute (and base will be ignored)\n // In tests, the URL might brelative (and base will be used)\n // https://nodejs.org/docs/latest/api/url.html#new-urlinput-base\n url = new URL(req.url, `${req.protocol}://${req.headers.host}/`);\n } catch (error) {\n return next(errorUtils.getBadRequest(`Invalid URL: ${req.url} (${error})`));\n }\n\n // Rebuild the URL without hostname\n req.url = url.pathname + url.search + url.hash;\n\n if (original !== req.url) {\n debug('makeURLrelative: %o -> %o', original, req.url);\n } else {\n debug('makeURLrelative: %o (unchanged)', original);\n }\n next();\n}\n"],"mappings":";;;;;;AAOA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wCAAwC;;;;;;;AAQjE,SAAgB,gBACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI;CAMrB,IAAI;CACJ,IAAI;EAIF,MAAM,IAAI,SAAA,IAAI,IAAI,KAAK,GAAG,IAAI,SAAS,KAAK,IAAI,QAAQ,KAAK,EAAE;CACjE,SAAS,OAAO;EACd,OAAO,KAAK,gBAAA,WAAW,cAAc,gBAAgB,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;CAC5E;CAGA,IAAI,MAAM,IAAI,WAAW,IAAI,SAAS,IAAI;CAE1C,IAAI,aAAa,IAAI,KACnB,QAAM,6BAA6B,UAAU,IAAI,GAAG;MAEpD,QAAM,mCAAmC,QAAQ;CAEnD,KAAK;AACP"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n const limiter = RateLimit(rateLimitOptions);\n return limiter;\n}\n"],"mappings":";;;;AAIA,SAAgB,UAAU,kBAAkC;CAE1D,QAAA,
|
|
1
|
+
{"version":3,"file":"rate-limit.js","names":[],"sources":["../../src/middlewares/rate-limit.ts"],"sourcesContent":["import RateLimit from 'express-rate-limit';\n\nimport type { RateLimit as RateLimitType } from '@verdaccio/types';\n\nexport function rateLimit(rateLimitOptions?: RateLimitType) {\n const limiter = RateLimit(rateLimitOptions);\n return limiter;\n}\n"],"mappings":";;;;AAIA,SAAgB,UAAU,kBAAkC;CAE1D,QAAA,GADgB,mBAAA,QAAA,CAAU,gBACnB;AACT"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"user-agent.js","names":[],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n next();\n };\n}\n"],"mappings":";;;AAKA,SAAgB,UAAU,QAAQ;CAChC,OAAO,SAAU,MAAsB,KAAsB,MAA8B;EACzF,IAAI,UAAU,gBAAA,QAAQ,aAAA,
|
|
1
|
+
{"version":3,"file":"user-agent.js","names":[],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n next();\n };\n}\n"],"mappings":";;;AAKA,SAAgB,UAAU,QAAQ;CAChC,OAAO,SAAU,MAAsB,KAAsB,MAA8B;EACzF,IAAI,UAAU,gBAAA,QAAQ,aAAA,GAAY,kBAAA,aAAA,CAAa,QAAQ,UAAU,CAAC;EAClE,KAAK;CACP;AACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"render-web.js","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport { sendFileCallback, sendFileSafe } from './utils/file-utils';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:middleware:web:render');\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n const { staticPath, manifest, manifestFiles } = pluginOptions;\n debug('static path %o', staticPath);\n\n /* eslint new-cap:off */\n const router = express.Router();\n if (typeof tokenMiddleware === 'function') {\n router.use(tokenMiddleware);\n }\n\n router.use(setSecurityWebHeaders);\n\n // any match within the static is routed to the file system\n router.get(\n WebUrlsNamespace.static,\n function (req: express.Request<{ all: string | string[] }>, res, next) {\n const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n if (filename === 'favicon.ico' && config?.web?.favicon) {\n const file = config?.web?.favicon;\n if (isURLhasValidProtocol(file)) {\n debug('redirect to favicon %s', file);\n req.url = file;\n return next();\n }\n debug('render custom favicon %o', file);\n // see sendFileSafe for the reasoning behind `dotfiles: 'allow'`\n res.sendFile(file, { dotfiles: 'allow' }, sendFileCallback(next));\n return;\n }\n debug('render static file %o', filename);\n sendFileSafe(staticPath, filename, res, next);\n }\n );\n\n function renderLogo(logo: string | undefined): string | undefined {\n // check the origin of the logo\n if (logo && !isURLhasValidProtocol(logo)) {\n // URI related to a local file\n const absoluteLocalFile = path.posix.resolve(logo);\n debug('serve local logo %s', absoluteLocalFile);\n try {\n // TODO: replace existsSync by async alternative\n if (\n fs.existsSync(absoluteLocalFile) &&\n typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n ) {\n // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n // Use POSIX version `path.posix.join` instead.\n logo = `/-/static/${path.basename(logo)}`;\n router.get(logo, function (_req, res, next) {\n // @ts-ignore\n debug('serve custom logo web:%s - local:%s', logo, absoluteLocalFile);\n res.sendFile(\n path.basename(absoluteLocalFile),\n { root: path.dirname(absoluteLocalFile), dotfiles: 'allow' },\n sendFileCallback(next)\n );\n });\n debug('enabled custom logo %s', logo);\n } else {\n logo = undefined;\n debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n }\n } catch {\n logo = undefined;\n debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n }\n }\n return logo;\n }\n\n const logo = renderLogo(config?.web?.logo);\n if (config?.web?.logo) {\n config.web.logo = logo;\n }\n const logoDark = renderLogo(config?.web?.logoDark);\n if (config?.web?.logoDark) {\n config.web.logoDark = logoDark;\n }\n\n // Serve external script that loads UI options\n router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n const options = getUIOptions(config, req, res);\n const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n res.send(script);\n });\n\n // Handle all web routes including security routes\n router.get(WebUrlsNamespace.web, function (req, res) {\n const options = getUIOptions(config, req, res);\n renderHTML(config, manifest, manifestFiles, options, res);\n debug('render html section');\n });\n\n router.get(WebUrlsNamespace.root, function (req, res) {\n const options = getUIOptions(config, req, res);\n renderHTML(config, manifest, manifestFiles, options, res);\n debug('render root');\n });\n\n // any match within the asset folder is routed to the file system\n if (config?.web?.assetFolder) {\n router.get(\n WebUrlsNamespace.assets,\n function (req: express.Request<{ all: string | string[] }>, res, next) {\n const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n sendFileSafe(config.web.assetFolder, filename, res, next);\n }\n );\n }\n\n return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"render-web.js","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HEADERS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport { sendFileCallback, sendFileSafe } from './utils/file-utils';\nimport renderHTML from './utils/renderHTML';\nimport { getUIOptions } from './utils/ui-options';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:middleware:web:render');\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n const { staticPath, manifest, manifestFiles } = pluginOptions;\n debug('static path %o', staticPath);\n\n /* eslint new-cap:off */\n const router = express.Router();\n if (typeof tokenMiddleware === 'function') {\n router.use(tokenMiddleware);\n }\n\n router.use(setSecurityWebHeaders);\n\n // any match within the static is routed to the file system\n router.get(\n WebUrlsNamespace.static,\n function (req: express.Request<{ all: string | string[] }>, res, next) {\n const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n if (filename === 'favicon.ico' && config?.web?.favicon) {\n const file = config?.web?.favicon;\n if (isURLhasValidProtocol(file)) {\n debug('redirect to favicon %s', file);\n req.url = file;\n return next();\n }\n debug('render custom favicon %o', file);\n // see sendFileSafe for the reasoning behind `dotfiles: 'allow'`\n res.sendFile(file, { dotfiles: 'allow' }, sendFileCallback(next));\n return;\n }\n debug('render static file %o', filename);\n sendFileSafe(staticPath, filename, res, next);\n }\n );\n\n function renderLogo(logo: string | undefined): string | undefined {\n // check the origin of the logo\n if (logo && !isURLhasValidProtocol(logo)) {\n // URI related to a local file\n const absoluteLocalFile = path.posix.resolve(logo);\n debug('serve local logo %s', absoluteLocalFile);\n try {\n // TODO: replace existsSync by async alternative\n if (\n fs.existsSync(absoluteLocalFile) &&\n typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n ) {\n // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n // Use POSIX version `path.posix.join` instead.\n logo = `/-/static/${path.basename(logo)}`;\n router.get(logo, function (_req, res, next) {\n // @ts-ignore\n debug('serve custom logo web:%s - local:%s', logo, absoluteLocalFile);\n res.sendFile(\n path.basename(absoluteLocalFile),\n { root: path.dirname(absoluteLocalFile), dotfiles: 'allow' },\n sendFileCallback(next)\n );\n });\n debug('enabled custom logo %s', logo);\n } else {\n logo = undefined;\n debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n }\n } catch {\n logo = undefined;\n debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n }\n }\n return logo;\n }\n\n const logo = renderLogo(config?.web?.logo);\n if (config?.web?.logo) {\n config.web.logo = logo;\n }\n const logoDark = renderLogo(config?.web?.logoDark);\n if (config?.web?.logoDark) {\n config.web.logoDark = logoDark;\n }\n\n // Serve external script that loads UI options\n router.get(WebUrlsNamespace.static + 'ui-options.js', function (req, res) {\n const options = getUIOptions(config, req, res);\n const script = `window.__VERDACCIO_BASENAME_UI_OPTIONS=${JSON.stringify(options)};`;\n res.setHeader(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n res.setHeader(HEADERS.CONTENT_TYPE, HEADERS.JAVASCRIPT_CHARSET);\n res.send(script);\n });\n\n // Handle all web routes including security routes\n router.get(WebUrlsNamespace.web, function (req, res) {\n const options = getUIOptions(config, req, res);\n renderHTML(config, manifest, manifestFiles, options, res);\n debug('render html section');\n });\n\n router.get(WebUrlsNamespace.root, function (req, res) {\n const options = getUIOptions(config, req, res);\n renderHTML(config, manifest, manifestFiles, options, res);\n debug('render root');\n });\n\n // any match within the asset folder is routed to the file system\n if (config?.web?.assetFolder) {\n router.get(\n WebUrlsNamespace.assets,\n function (req: express.Request<{ all: string | string[] }>, res, next) {\n const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n sendFileSafe(config.web.assetFolder, filename, res, next);\n }\n );\n }\n\n return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,iCAAiC;AAE1D,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;CAChD,QAAM,kBAAkB,UAAU;CAGlC,MAAM,SAAS,QAAA,QAAQ,OAAO;CAC9B,IAAI,OAAO,oBAAoB,YAC7B,OAAO,IAAI,eAAe;CAG5B,OAAO,IAAI,iBAAA,qBAAqB;CAGhC,OAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,IAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;GAC1B,KAAA,GAAI,eAAA,sBAAA,CAAsB,IAAI,GAAG;IAC/B,QAAM,0BAA0B,IAAI;IACpC,IAAI,MAAM;IACV,OAAO,KAAK;GACd;GACA,QAAM,4BAA4B,IAAI;GAEtC,IAAI,SAAS,MAAM,EAAE,UAAU,QAAQ,GAAG,mBAAA,iBAAiB,IAAI,CAAC;GAChE;EACF;EACA,QAAM,yBAAyB,QAAQ;EACvC,mBAAA,aAAa,YAAY,UAAU,KAAK,IAAI;CAC9C,CACF;CAEA,SAAS,WAAW,MAA8C;EAEhE,IAAI,QAAQ,EAAA,GAAC,eAAA,sBAAA,CAAsB,IAAI,GAAG;GAExC,MAAM,oBAAoB,UAAA,QAAK,MAAM,QAAQ,IAAI;GACjD,QAAM,uBAAuB,iBAAiB;GAC9C,IAAI;IAEF,IACE,QAAA,QAAG,WAAW,iBAAiB,KAC/B,OAAO,QAAA,QAAG,WAAW,mBAAmB,QAAA,QAAG,UAAU,IAAI,MAAM,aAC/D;KAGA,OAAO,aAAa,UAAA,QAAK,SAAS,IAAI;KACtC,OAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;MAE1C,QAAM,wCAAwC,MAAM,iBAAiB;MACrE,IAAI,SACF,UAAA,QAAK,SAAS,iBAAiB,GAC/B;OAAE,MAAM,UAAA,QAAK,QAAQ,iBAAiB;OAAG,UAAU;MAAQ,GAC3D,mBAAA,iBAAiB,IAAI,CACvB;KACF,CAAC;KACD,QAAM,0BAA0B,IAAI;IACtC,OAAO;KACL,OAAO,KAAA;KACP,QAAM,2BAA2B,kBAAkB,mCAAmC;IACxF;GACF,QAAQ;IACN,OAAO,KAAA;IACP,QAAM,2BAA2B,kBAAkB,mCAAmC;GACxF;EACF;EACA,OAAO;CACT;CAEA,MAAM,OAAO,WAAW,QAAQ,KAAK,IAAI;CACzC,IAAI,QAAQ,KAAK,MACf,OAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,QAAQ;CACjD,IAAI,QAAQ,KAAK,UACf,OAAO,IAAI,WAAW;CAIxB,OAAO,IAAI,iBAAA,iBAAiB,SAAS,iBAAiB,SAAU,KAAK,KAAK;EACxE,MAAM,UAAU,mBAAA,aAAa,QAAQ,KAAK,GAAG;EAC7C,MAAM,SAAS,0CAA0C,KAAK,UAAU,OAAO,EAAE;EACjF,IAAI,UAAU,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;EACrD,IAAI,UAAU,gBAAA,QAAQ,cAAc,gBAAA,QAAQ,kBAAkB;EAC9D,IAAI,KAAK,MAAM;CACjB,CAAC;CAGD,OAAO,IAAI,iBAAA,iBAAiB,KAAK,SAAU,KAAK,KAAK;EACnD,MAAM,UAAU,mBAAA,aAAa,QAAQ,KAAK,GAAG;EAC7C,mBAAA,QAAW,QAAQ,UAAU,eAAe,SAAS,GAAG;EACxD,QAAM,qBAAqB;CAC7B,CAAC;CAED,OAAO,IAAI,iBAAA,iBAAiB,MAAM,SAAU,KAAK,KAAK;EACpD,MAAM,UAAU,mBAAA,aAAa,QAAQ,KAAK,GAAG;EAC7C,mBAAA,QAAW,QAAQ,UAAU,eAAe,SAAS,GAAG;EACxD,QAAM,aAAa;CACrB,CAAC;CAGD,IAAI,QAAQ,KAAK,aACf,OAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,GAAG,IAAI,IAAI,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,OAAO;EACvF,mBAAA,aAAa,OAAO,IAAI,aAAa,UAAU,KAAK,IAAI;CAC1D,CACF;CAGF,OAAO;AACT"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"security.js","names":[],"sources":["../../../src/middlewares/web/security.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:security');\n\nexport function setSecurityWebHeaders(_req, res, next): void {\n // disable loading in frames (clickjacking, etc.)\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options\n const framesOptions = res.getHeader(HEADERS.FRAMES_OPTIONS);\n if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {\n debug('Missing or invalid X-Frame-Options header; setting to \"deny\"');\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n }\n\n // avoid establishing connections outside of domain\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy\n if (!res.getHeader(HEADERS.CSP)) {\n debug('Missing Content-Security-Policy header; setting to \"connect-src \\'self\\'\"');\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n }\n\n // respect the content type of the response\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options\n const cto = res.getHeader(HEADERS.CTO);\n if (!cto || cto !== 'nosniff') {\n debug('Missing or invalid X-Content-Type-Options header; setting to \"nosniff\"');\n res.header(HEADERS.CTO, 'nosniff');\n }\n\n // block rendering of the page in case of XSS attack\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection\n const xss = res.getHeader(HEADERS.XSS);\n if (!xss || !(xss === '0' || xss.startsWith('1'))) {\n debug('Missing or invalid X-XSS-Protection header; setting to \"1; mode=block\"');\n res.header(HEADERS.XSS, '1; mode=block');\n }\n next();\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"security.js","names":[],"sources":["../../../src/middlewares/web/security.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:security');\n\nexport function setSecurityWebHeaders(_req, res, next): void {\n // disable loading in frames (clickjacking, etc.)\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options\n const framesOptions = res.getHeader(HEADERS.FRAMES_OPTIONS);\n if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {\n debug('Missing or invalid X-Frame-Options header; setting to \"deny\"');\n res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n }\n\n // avoid establishing connections outside of domain\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy\n if (!res.getHeader(HEADERS.CSP)) {\n debug('Missing Content-Security-Policy header; setting to \"connect-src \\'self\\'\"');\n res.header(HEADERS.CSP, \"connect-src 'self'\");\n }\n\n // respect the content type of the response\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options\n const cto = res.getHeader(HEADERS.CTO);\n if (!cto || cto !== 'nosniff') {\n debug('Missing or invalid X-Content-Type-Options header; setting to \"nosniff\"');\n res.header(HEADERS.CTO, 'nosniff');\n }\n\n // block rendering of the page in case of XSS attack\n // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection\n const xss = res.getHeader(HEADERS.XSS);\n if (!xss || !(xss === '0' || xss.startsWith('1'))) {\n debug('Missing or invalid X-XSS-Protection header; setting to \"1; mode=block\"');\n res.header(HEADERS.XSS, '1; mode=block');\n }\n next();\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,mCAAmC;AAE5D,SAAgB,sBAAsB,MAAM,KAAK,MAAY;CAG3D,MAAM,gBAAgB,IAAI,UAAU,gBAAA,QAAQ,cAAc;CAC1D,IAAI,CAAC,iBAAiB,EAAE,kBAAkB,UAAU,kBAAkB,eAAe;EACnF,QAAM,gEAA8D;EACpE,IAAI,OAAO,gBAAA,QAAQ,gBAAgB,MAAM;CAC3C;CAIA,IAAI,CAAC,IAAI,UAAU,gBAAA,QAAQ,GAAG,GAAG;EAC/B,QAAM,2EAA2E;EACjF,IAAI,OAAO,gBAAA,QAAQ,KAAK,oBAAoB;CAC9C;CAIA,MAAM,MAAM,IAAI,UAAU,gBAAA,QAAQ,GAAG;CACrC,IAAI,CAAC,OAAO,QAAQ,WAAW;EAC7B,QAAM,0EAAwE;EAC9E,IAAI,OAAO,gBAAA,QAAQ,KAAK,SAAS;CACnC;CAIA,MAAM,MAAM,IAAI,UAAU,gBAAA,QAAQ,GAAG;CACrC,IAAI,CAAC,OAAO,EAAE,QAAQ,OAAO,IAAI,WAAW,GAAG,IAAI;EACjD,QAAM,0EAAwE;EAC9E,IAAI,OAAO,gBAAA,QAAQ,KAAK,eAAe;CACzC;CACA,KAAK;AACP"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-utils.js","names":[],"sources":["../../../../src/middlewares/web/utils/file-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport path from 'node:path';\n\nimport { HTTP_STATUS, fileUtils } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:utils');\n\nexport const sendFileCallback = (next) => (err) => {\n if (!err) {\n return;\n }\n if (err.status === HTTP_STATUS.NOT_FOUND) {\n next();\n } else {\n next(err);\n }\n};\n\n/**\n * Safely serve a file by validating and resolving the path to prevent directory traversal.\n * @param baseDir Base directory path\n * @param filename Requested filename (user input)\n * @param res Express response object\n * @param next Express next function\n */\nexport function sendFileSafe(baseDir: string, filename: string, res, next) {\n // The splat may match nothing (e.g. \"/-/assets/.\" collapses to no segment),\n // leaving filename undefined/empty. Nothing to serve, fall through to 404.\n if (!filename) {\n debug('empty filename requested');\n return next();\n }\n\n // First validation layer: check filename for basic validity\n const safeFilename = fileUtils.sanitizeFilename(filename);\n\n // Second validation layer: resolve safe path within base directory\n const safe = fileUtils.resolveSafePath(baseDir, safeFilename);\n if (!safe) {\n debug('unsafe filename requested %o', safeFilename);\n return next();\n }\n\n // Prevent attempting to send a directory (e.g., base directory via \".\" or \"subdir/..\")\n const baseDirResolved = path.resolve(baseDir);\n if (safe === baseDirResolved) {\n debug('directory requested instead of file %o', safe);\n return next();\n }\n\n debug('serve file %o', safe);\n // `dotfiles: 'allow'` is required because the absolute path may legitimately\n // contain dot-prefixed ancestor directories (e.g. pnpm's `node_modules/.pnpm/...`\n // content-addressable store). Path traversal is already enforced by\n // `resolveSafePath` above.\n // Requests for dot-prefixed URL segments are handled separately by the global `dotfiles` middleware.\n res.sendFile(safe, { dotfiles: 'allow' }, sendFileCallback(next));\n}\n"],"mappings":";;;;;;;AAKA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"file-utils.js","names":[],"sources":["../../../../src/middlewares/web/utils/file-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport path from 'node:path';\n\nimport { HTTP_STATUS, fileUtils } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:utils');\n\nexport const sendFileCallback = (next) => (err) => {\n if (!err) {\n return;\n }\n if (err.status === HTTP_STATUS.NOT_FOUND) {\n next();\n } else {\n next(err);\n }\n};\n\n/**\n * Safely serve a file by validating and resolving the path to prevent directory traversal.\n * @param baseDir Base directory path\n * @param filename Requested filename (user input)\n * @param res Express response object\n * @param next Express next function\n */\nexport function sendFileSafe(baseDir: string, filename: string, res, next) {\n // The splat may match nothing (e.g. \"/-/assets/.\" collapses to no segment),\n // leaving filename undefined/empty. Nothing to serve, fall through to 404.\n if (!filename) {\n debug('empty filename requested');\n return next();\n }\n\n // First validation layer: check filename for basic validity\n const safeFilename = fileUtils.sanitizeFilename(filename);\n\n // Second validation layer: resolve safe path within base directory\n const safe = fileUtils.resolveSafePath(baseDir, safeFilename);\n if (!safe) {\n debug('unsafe filename requested %o', safeFilename);\n return next();\n }\n\n // Prevent attempting to send a directory (e.g., base directory via \".\" or \"subdir/..\")\n const baseDirResolved = path.resolve(baseDir);\n if (safe === baseDirResolved) {\n debug('directory requested instead of file %o', safe);\n return next();\n }\n\n debug('serve file %o', safe);\n // `dotfiles: 'allow'` is required because the absolute path may legitimately\n // contain dot-prefixed ancestor directories (e.g. pnpm's `node_modules/.pnpm/...`\n // content-addressable store). Path traversal is already enforced by\n // `resolveSafePath` above.\n // Requests for dot-prefixed URL segments are handled separately by the global `dotfiles` middleware.\n res.sendFile(safe, { dotfiles: 'allow' }, sendFileCallback(next));\n}\n"],"mappings":";;;;;;;AAKA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,gCAAgC;AAEzD,IAAa,oBAAoB,UAAU,QAAQ;CACjD,IAAI,CAAC,KACH;CAEF,IAAI,IAAI,WAAW,gBAAA,YAAY,WAC7B,KAAK;MAEL,KAAK,GAAG;AAEZ;;;;;;;;AASA,SAAgB,aAAa,SAAiB,UAAkB,KAAK,MAAM;CAGzE,IAAI,CAAC,UAAU;EACb,QAAM,0BAA0B;EAChC,OAAO,KAAK;CACd;CAGA,MAAM,eAAe,gBAAA,UAAU,iBAAiB,QAAQ;CAGxD,MAAM,OAAO,gBAAA,UAAU,gBAAgB,SAAS,YAAY;CAC5D,IAAI,CAAC,MAAM;EACT,QAAM,gCAAgC,YAAY;EAClD,OAAO,KAAK;CACd;CAIA,IAAI,SADoB,UAAA,QAAK,QAAQ,OACxB,GAAiB;EAC5B,QAAM,0CAA0C,IAAI;EACpD,OAAO,KAAK;CACd;CAEA,QAAM,iBAAiB,IAAI;CAM3B,IAAI,SAAS,MAAM,EAAE,UAAU,QAAQ,GAAG,iBAAiB,IAAI,CAAC;AAClE"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manifest.js","names":[],"sources":["../../../../src/middlewares/web/utils/manifest.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nexport type Manifest = {\n // goes on first place at the header\n ico: string;\n css: string[];\n js: string[];\n};\n\nconst debug = buildDebug('verdaccio:middleware:web:render:manifest');\n\nexport function getManifestValue(\n manifestItems: string[],\n manifest,\n basePath: string = ''\n): string[] {\n return manifestItems?.map((item) => {\n debug('resolve item %o', item);\n const resolvedItem = `${stripTrailingSlash(basePath)}/${stripLeadingSlash(manifest[item])}`;\n debug('resolved item %o', resolvedItem);\n return resolvedItem;\n });\n}\n\nfunction stripTrailingSlash(path: string): string {\n return path.replace(/\\/$/, '');\n}\n\nfunction stripLeadingSlash(path: string): string {\n return path.replace(/^\\//, '');\n}\n"],"mappings":";;;;AASA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"manifest.js","names":[],"sources":["../../../../src/middlewares/web/utils/manifest.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nexport type Manifest = {\n // goes on first place at the header\n ico: string;\n css: string[];\n js: string[];\n};\n\nconst debug = buildDebug('verdaccio:middleware:web:render:manifest');\n\nexport function getManifestValue(\n manifestItems: string[],\n manifest,\n basePath: string = ''\n): string[] {\n return manifestItems?.map((item) => {\n debug('resolve item %o', item);\n const resolvedItem = `${stripTrailingSlash(basePath)}/${stripLeadingSlash(manifest[item])}`;\n debug('resolved item %o', resolvedItem);\n return resolvedItem;\n });\n}\n\nfunction stripTrailingSlash(path: string): string {\n return path.replace(/\\/$/, '');\n}\n\nfunction stripLeadingSlash(path: string): string {\n return path.replace(/^\\//, '');\n}\n"],"mappings":";;;;AASA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,0CAA0C;AAEnE,SAAgB,iBACd,eACA,UACA,WAAmB,IACT;CACV,OAAO,eAAe,KAAK,SAAS;EAClC,QAAM,mBAAmB,IAAI;EAC7B,MAAM,eAAe,GAAG,mBAAmB,QAAQ,EAAE,GAAG,kBAAkB,SAAS,KAAK;EACxF,QAAM,oBAAoB,YAAY;EACtC,OAAO;CACT,CAAC;AACH;AAEA,SAAS,mBAAmB,MAAsB;CAChD,OAAO,KAAK,QAAQ,OAAO,EAAE;AAC/B;AAEA,SAAS,kBAAkB,MAAsB;CAC/C,OAAO,KAAK,QAAQ,OAAO,EAAE;AAC/B"}
|
|
@@ -6,7 +6,7 @@ debug = require_runtime.__toESM(debug);
|
|
|
6
6
|
//#region src/middlewares/web/utils/renderHTML.ts
|
|
7
7
|
var cache = new (require("lru-cache")).LRUCache({
|
|
8
8
|
max: 500,
|
|
9
|
-
ttl:
|
|
9
|
+
ttl: 36e5
|
|
10
10
|
});
|
|
11
11
|
var debug$1 = (0, debug.default)("verdaccio:middleware:web:render:html");
|
|
12
12
|
var defaultManifestFiles = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"renderHTML.js","names":[],"sources":["../../../../src/middlewares/web/utils/renderHTML.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response } from 'express';\nimport { LRUCache } from 'lru-cache';\n\nimport { HEADERS } from '@verdaccio/core';\nimport type { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';\n\nimport type { Manifest } from './manifest';\nimport renderTemplate from './template';\nimport type { AssetManifest } from './template';\n\n// Cache for rendered HTML templates: max 500 entries, 1 hour TTL\nconst cache = new LRUCache({ max: 500, ttl: 1000 * 60 * 60 });\n\nconst debug = buildDebug('verdaccio:middleware:web:render:html');\n\nconst defaultManifestFiles: Manifest = {\n js: ['vendors.js', 'main.js'],\n ico: 'favicon.ico',\n css: [],\n};\n\nexport default function renderHTML(\n config: ConfigYaml,\n manifest: AssetManifest,\n manifestFiles: Manifest | null | undefined,\n options: TemplateUIOptions,\n res: Response\n) {\n // @ts-ignore\n const needHtmlCache = [undefined, null].includes(config?.web?.html_cache)\n ? true\n : config?.web?.html_cache;\n\n const scriptsBodyBefore = config?.web?.scriptsBodyBefore || config?.web?.scriptsbodyBefore || [];\n const scriptsBodyAfter = config?.web?.scriptsBodyAfter || [];\n const metaScripts = config?.web?.metaScripts || [];\n\n let webPage;\n\n const cacheKey = `template:${JSON.stringify(options)}`;\n\n try {\n webPage = cache.get(cacheKey);\n if (!webPage) {\n webPage = renderTemplate(\n {\n manifest: manifestFiles ?? defaultManifestFiles,\n options,\n scriptsBodyAfter,\n metaScripts,\n scriptsBodyBefore,\n },\n manifest\n );\n\n if (needHtmlCache) {\n cache.set(cacheKey, webPage);\n debug('set template cache');\n }\n } else {\n debug('reuse template cache');\n }\n } catch (error: any) {\n throw new Error('theme could not be loaded', { cause: error });\n }\n res.setHeader('Content-Type', HEADERS.TEXT_HTML);\n res.send(webPage);\n debug('web rendered');\n}\n"],"mappings":";;;;;;AAYA,IAAM,QAAQ,wBAAI,EAAA,CAAA,SAAS;CAAE,KAAK;CAAK,KAAK
|
|
1
|
+
{"version":3,"file":"renderHTML.js","names":[],"sources":["../../../../src/middlewares/web/utils/renderHTML.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response } from 'express';\nimport { LRUCache } from 'lru-cache';\n\nimport { HEADERS } from '@verdaccio/core';\nimport type { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';\n\nimport type { Manifest } from './manifest';\nimport renderTemplate from './template';\nimport type { AssetManifest } from './template';\n\n// Cache for rendered HTML templates: max 500 entries, 1 hour TTL\nconst cache = new LRUCache({ max: 500, ttl: 1000 * 60 * 60 });\n\nconst debug = buildDebug('verdaccio:middleware:web:render:html');\n\nconst defaultManifestFiles: Manifest = {\n js: ['vendors.js', 'main.js'],\n ico: 'favicon.ico',\n css: [],\n};\n\nexport default function renderHTML(\n config: ConfigYaml,\n manifest: AssetManifest,\n manifestFiles: Manifest | null | undefined,\n options: TemplateUIOptions,\n res: Response\n) {\n // @ts-ignore\n const needHtmlCache = [undefined, null].includes(config?.web?.html_cache)\n ? true\n : config?.web?.html_cache;\n\n const scriptsBodyBefore = config?.web?.scriptsBodyBefore || config?.web?.scriptsbodyBefore || [];\n const scriptsBodyAfter = config?.web?.scriptsBodyAfter || [];\n const metaScripts = config?.web?.metaScripts || [];\n\n let webPage;\n\n const cacheKey = `template:${JSON.stringify(options)}`;\n\n try {\n webPage = cache.get(cacheKey);\n if (!webPage) {\n webPage = renderTemplate(\n {\n manifest: manifestFiles ?? defaultManifestFiles,\n options,\n scriptsBodyAfter,\n metaScripts,\n scriptsBodyBefore,\n },\n manifest\n );\n\n if (needHtmlCache) {\n cache.set(cacheKey, webPage);\n debug('set template cache');\n }\n } else {\n debug('reuse template cache');\n }\n } catch (error: any) {\n throw new Error('theme could not be loaded', { cause: error });\n }\n res.setHeader('Content-Type', HEADERS.TEXT_HTML);\n res.send(webPage);\n debug('web rendered');\n}\n"],"mappings":";;;;;;AAYA,IAAM,QAAQ,wBAAI,EAAA,CAAA,SAAS;CAAE,KAAK;CAAK,KAAK;AAAe,CAAC;AAE5D,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,sCAAsC;AAE/D,IAAM,uBAAiC;CACrC,IAAI,CAAC,cAAc,SAAS;CAC5B,KAAK;CACL,KAAK,CAAC;AACR;AAEA,SAAwB,WACtB,QACA,UACA,eACA,SACA,KACA;CAEA,MAAM,gBAAgB,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,SAAS,QAAQ,KAAK,UAAU,IACpE,OACA,QAAQ,KAAK;CAEjB,MAAM,oBAAoB,QAAQ,KAAK,qBAAqB,QAAQ,KAAK,qBAAqB,CAAC;CAC/F,MAAM,mBAAmB,QAAQ,KAAK,oBAAoB,CAAC;CAC3D,MAAM,cAAc,QAAQ,KAAK,eAAe,CAAC;CAEjD,IAAI;CAEJ,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,IAAI;EACF,UAAU,MAAM,IAAI,QAAQ;EAC5B,IAAI,CAAC,SAAS;GACZ,UAAU,iBAAA,QACR;IACE,UAAU,iBAAiB;IAC3B;IACA;IACA;IACA;GACF,GACA,QACF;GAEA,IAAI,eAAe;IACjB,MAAM,IAAI,UAAU,OAAO;IAC3B,QAAM,oBAAoB;GAC5B;EACF,OACE,QAAM,sBAAsB;CAEhC,SAAS,OAAY;EACnB,MAAM,IAAI,MAAM,6BAA6B,EAAE,OAAO,MAAM,CAAC;CAC/D;CACA,IAAI,UAAU,gBAAgB,gBAAA,QAAQ,SAAS;CAC/C,IAAI,KAAK,OAAO;CAChB,QAAM,cAAc;AACtB"}
|
|
@@ -5,7 +5,7 @@ import { LRUCache } from "lru-cache";
|
|
|
5
5
|
//#region src/middlewares/web/utils/renderHTML.ts
|
|
6
6
|
var cache = new LRUCache({
|
|
7
7
|
max: 500,
|
|
8
|
-
ttl:
|
|
8
|
+
ttl: 36e5
|
|
9
9
|
});
|
|
10
10
|
var debug = buildDebug("verdaccio:middleware:web:render:html");
|
|
11
11
|
var defaultManifestFiles = {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"renderHTML.mjs","names":[],"sources":["../../../../src/middlewares/web/utils/renderHTML.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response } from 'express';\nimport { LRUCache } from 'lru-cache';\n\nimport { HEADERS } from '@verdaccio/core';\nimport type { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';\n\nimport type { Manifest } from './manifest';\nimport renderTemplate from './template';\nimport type { AssetManifest } from './template';\n\n// Cache for rendered HTML templates: max 500 entries, 1 hour TTL\nconst cache = new LRUCache({ max: 500, ttl: 1000 * 60 * 60 });\n\nconst debug = buildDebug('verdaccio:middleware:web:render:html');\n\nconst defaultManifestFiles: Manifest = {\n js: ['vendors.js', 'main.js'],\n ico: 'favicon.ico',\n css: [],\n};\n\nexport default function renderHTML(\n config: ConfigYaml,\n manifest: AssetManifest,\n manifestFiles: Manifest | null | undefined,\n options: TemplateUIOptions,\n res: Response\n) {\n // @ts-ignore\n const needHtmlCache = [undefined, null].includes(config?.web?.html_cache)\n ? true\n : config?.web?.html_cache;\n\n const scriptsBodyBefore = config?.web?.scriptsBodyBefore || config?.web?.scriptsbodyBefore || [];\n const scriptsBodyAfter = config?.web?.scriptsBodyAfter || [];\n const metaScripts = config?.web?.metaScripts || [];\n\n let webPage;\n\n const cacheKey = `template:${JSON.stringify(options)}`;\n\n try {\n webPage = cache.get(cacheKey);\n if (!webPage) {\n webPage = renderTemplate(\n {\n manifest: manifestFiles ?? defaultManifestFiles,\n options,\n scriptsBodyAfter,\n metaScripts,\n scriptsBodyBefore,\n },\n manifest\n );\n\n if (needHtmlCache) {\n cache.set(cacheKey, webPage);\n debug('set template cache');\n }\n } else {\n debug('reuse template cache');\n }\n } catch (error: any) {\n throw new Error('theme could not be loaded', { cause: error });\n }\n res.setHeader('Content-Type', HEADERS.TEXT_HTML);\n res.send(webPage);\n debug('web rendered');\n}\n"],"mappings":";;;;;AAYA,IAAM,QAAQ,IAAI,SAAS;CAAE,KAAK;CAAK,KAAK
|
|
1
|
+
{"version":3,"file":"renderHTML.mjs","names":[],"sources":["../../../../src/middlewares/web/utils/renderHTML.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Response } from 'express';\nimport { LRUCache } from 'lru-cache';\n\nimport { HEADERS } from '@verdaccio/core';\nimport type { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';\n\nimport type { Manifest } from './manifest';\nimport renderTemplate from './template';\nimport type { AssetManifest } from './template';\n\n// Cache for rendered HTML templates: max 500 entries, 1 hour TTL\nconst cache = new LRUCache({ max: 500, ttl: 1000 * 60 * 60 });\n\nconst debug = buildDebug('verdaccio:middleware:web:render:html');\n\nconst defaultManifestFiles: Manifest = {\n js: ['vendors.js', 'main.js'],\n ico: 'favicon.ico',\n css: [],\n};\n\nexport default function renderHTML(\n config: ConfigYaml,\n manifest: AssetManifest,\n manifestFiles: Manifest | null | undefined,\n options: TemplateUIOptions,\n res: Response\n) {\n // @ts-ignore\n const needHtmlCache = [undefined, null].includes(config?.web?.html_cache)\n ? true\n : config?.web?.html_cache;\n\n const scriptsBodyBefore = config?.web?.scriptsBodyBefore || config?.web?.scriptsbodyBefore || [];\n const scriptsBodyAfter = config?.web?.scriptsBodyAfter || [];\n const metaScripts = config?.web?.metaScripts || [];\n\n let webPage;\n\n const cacheKey = `template:${JSON.stringify(options)}`;\n\n try {\n webPage = cache.get(cacheKey);\n if (!webPage) {\n webPage = renderTemplate(\n {\n manifest: manifestFiles ?? defaultManifestFiles,\n options,\n scriptsBodyAfter,\n metaScripts,\n scriptsBodyBefore,\n },\n manifest\n );\n\n if (needHtmlCache) {\n cache.set(cacheKey, webPage);\n debug('set template cache');\n }\n } else {\n debug('reuse template cache');\n }\n } catch (error: any) {\n throw new Error('theme could not be loaded', { cause: error });\n }\n res.setHeader('Content-Type', HEADERS.TEXT_HTML);\n res.send(webPage);\n debug('web rendered');\n}\n"],"mappings":";;;;;AAYA,IAAM,QAAQ,IAAI,SAAS;CAAE,KAAK;CAAK,KAAK;AAAe,CAAC;AAE5D,IAAM,QAAQ,WAAW,sCAAsC;AAE/D,IAAM,uBAAiC;CACrC,IAAI,CAAC,cAAc,SAAS;CAC5B,KAAK;CACL,KAAK,CAAC;AACR;AAEA,SAAwB,WACtB,QACA,UACA,eACA,SACA,KACA;CAEA,MAAM,gBAAgB,CAAC,KAAA,GAAW,IAAI,CAAC,CAAC,SAAS,QAAQ,KAAK,UAAU,IACpE,OACA,QAAQ,KAAK;CAEjB,MAAM,oBAAoB,QAAQ,KAAK,qBAAqB,QAAQ,KAAK,qBAAqB,CAAC;CAC/F,MAAM,mBAAmB,QAAQ,KAAK,oBAAoB,CAAC;CAC3D,MAAM,cAAc,QAAQ,KAAK,eAAe,CAAC;CAEjD,IAAI;CAEJ,MAAM,WAAW,YAAY,KAAK,UAAU,OAAO;CAEnD,IAAI;EACF,UAAU,MAAM,IAAI,QAAQ;EAC5B,IAAI,CAAC,SAAS;GACZ,UAAU,eACR;IACE,UAAU,iBAAiB;IAC3B;IACA;IACA;IACA;GACF,GACA,QACF;GAEA,IAAI,eAAe;IACjB,MAAM,IAAI,UAAU,OAAO;IAC3B,MAAM,oBAAoB;GAC5B;EACF,OACE,MAAM,sBAAsB;CAEhC,SAAS,OAAY;EACnB,MAAM,IAAI,MAAM,6BAA6B,EAAE,OAAO,MAAM,CAAC;CAC/D;CACA,IAAI,UAAU,gBAAgB,QAAQ,SAAS;CAC/C,IAAI,KAAK,OAAO;CAChB,MAAM,cAAc;AACtB"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"template.js","names":[],"sources":["../../../../src/middlewares/web/utils/template.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { TemplateUIOptions } from '@verdaccio/types';\n\nimport type { Manifest } from './manifest';\nimport { getManifestValue } from './manifest';\n\nconst debug = buildDebug('verdaccio:web:render:template');\n\nexport type Template = {\n manifest: Manifest;\n options: TemplateUIOptions;\n metaScripts?: string[];\n scriptsBodyAfter?: string[];\n scriptsBodyBefore?: string[];\n};\n\nexport interface AssetManifest {\n [key: string]: string;\n}\n\nexport default function renderTemplate(template: Template, manifest: AssetManifest) {\n debug('template %o', template);\n debug('manifest %o', manifest);\n\n return `\n <!DOCTYPE html>\n <html lang=\"en-us\">\n <head>\n <meta charset=\"utf-8\">\n <base href=\"${template?.options.base}\">\n <title>${template?.options?.title ?? ''}</title>\n <link rel=\"icon\" href=\"${template?.options.base}-/static/favicon.ico\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <script src=\"${template?.options.base}-/static/ui-options.js\"></script>\n ${\n template.manifest.css?.length\n ? getManifestValue(template.manifest.css, manifest, template?.options.base)\n .map((item) => `<link rel=\"stylesheet\" href=\"${item}\">`)\n .join('\\n ')\n : ''\n }\n ${template?.metaScripts ? template.metaScripts.join('') : ''}\n </head>\n <body class=\"body\">\n ${template?.scriptsBodyBefore ? template.scriptsBodyBefore.join('') : ''}\n <div id=\"root\"></div>\n ${getManifestValue(template.manifest.js, manifest, template?.options.base)\n .map((item) => `<script type=\"module\" src=\"${item}\"></script>`)\n .join(`\\n `)}\n ${template?.scriptsBodyAfter ? template.scriptsBodyAfter.join('') : ''}\n </body>\n </html>\n `;\n}\n"],"mappings":";;;;;AAOA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"template.js","names":[],"sources":["../../../../src/middlewares/web/utils/template.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { TemplateUIOptions } from '@verdaccio/types';\n\nimport type { Manifest } from './manifest';\nimport { getManifestValue } from './manifest';\n\nconst debug = buildDebug('verdaccio:web:render:template');\n\nexport type Template = {\n manifest: Manifest;\n options: TemplateUIOptions;\n metaScripts?: string[];\n scriptsBodyAfter?: string[];\n scriptsBodyBefore?: string[];\n};\n\nexport interface AssetManifest {\n [key: string]: string;\n}\n\nexport default function renderTemplate(template: Template, manifest: AssetManifest) {\n debug('template %o', template);\n debug('manifest %o', manifest);\n\n return `\n <!DOCTYPE html>\n <html lang=\"en-us\">\n <head>\n <meta charset=\"utf-8\">\n <base href=\"${template?.options.base}\">\n <title>${template?.options?.title ?? ''}</title>\n <link rel=\"icon\" href=\"${template?.options.base}-/static/favicon.ico\">\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n <script src=\"${template?.options.base}-/static/ui-options.js\"></script>\n ${\n template.manifest.css?.length\n ? getManifestValue(template.manifest.css, manifest, template?.options.base)\n .map((item) => `<link rel=\"stylesheet\" href=\"${item}\">`)\n .join('\\n ')\n : ''\n }\n ${template?.metaScripts ? template.metaScripts.join('') : ''}\n </head>\n <body class=\"body\">\n ${template?.scriptsBodyBefore ? template.scriptsBodyBefore.join('') : ''}\n <div id=\"root\"></div>\n ${getManifestValue(template.manifest.js, manifest, template?.options.base)\n .map((item) => `<script type=\"module\" src=\"${item}\"></script>`)\n .join(`\\n `)}\n ${template?.scriptsBodyAfter ? template.scriptsBodyAfter.join('') : ''}\n </body>\n </html>\n `;\n}\n"],"mappings":";;;;;AAOA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,+BAA+B;AAcxD,SAAwB,eAAe,UAAoB,UAAyB;CAClF,QAAM,eAAe,QAAQ;CAC7B,QAAM,eAAe,QAAQ;CAE7B,OAAO;;;;;sBAKa,UAAU,QAAQ,KAAK;iBAC5B,UAAU,SAAS,SAAS,GAAG;iCACf,UAAU,QAAQ,KAAK;;uBAEjC,UAAU,QAAQ,KAAK;UAEpC,SAAS,SAAS,KAAK,SACnB,iBAAA,iBAAiB,SAAS,SAAS,KAAK,UAAU,UAAU,QAAQ,IAAI,CAAC,CACtE,KAAK,SAAS,gCAAgC,KAAK,GAAG,CAAC,CACvD,KAAK,YAAY,IACpB,GACL;UACC,UAAU,cAAc,SAAS,YAAY,KAAK,EAAE,IAAI,GAAG;;;UAG3D,UAAU,oBAAoB,SAAS,kBAAkB,KAAK,EAAE,IAAI,GAAG;;UAEvE,iBAAA,iBAAiB,SAAS,SAAS,IAAI,UAAU,UAAU,QAAQ,IAAI,CAAC,CACvE,KAAK,SAAS,8BAA8B,KAAK,aAAY,CAAC,CAC9D,KAAK,YAAY,EAAE;UACpB,UAAU,mBAAmB,SAAS,iBAAiB,KAAK,EAAE,IAAI,GAAG;;;;AAI/E"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ui-options.js","names":[],"sources":["../../../../src/middlewares/web/utils/ui-options.ts"],"sourcesContent":["import type { Response } from 'express';\nimport path from 'node:path';\nimport { URL } from 'node:url';\n\nimport { WEB_TITLE } from '@verdaccio/config';\nimport type { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';\nimport { type RequestOptions, getPublicUrl, isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { hasLogin, validatePrimaryColor } from './web-utils';\n\nconst DEFAULT_LANGUAGE = 'en-US';\n\nfunction resolveLogo(\n logo: string | undefined,\n url_prefix: string | undefined,\n requestOptions: RequestOptions\n) {\n if (typeof logo !== 'string') {\n return '';\n }\n const isLocalFile = logo && !isURLhasValidProtocol(logo);\n\n if (isLocalFile) {\n return `${getPublicUrl(url_prefix, requestOptions)}-/static/${path.basename(logo)}`;\n } else if (isURLhasValidProtocol(logo)) {\n return logo;\n } else {\n return '';\n }\n}\n\nexport function getUIOptions(\n config: ConfigYaml,\n requestOptions: RequestOptions,\n res: Response\n): TemplateUIOptions {\n const { url_prefix } = config;\n const base = getPublicUrl(config?.url_prefix, requestOptions);\n const basename = URL.canParse(base) ? new URL(base).pathname : base;\n const language = config?.i18n?.web ?? DEFAULT_LANGUAGE;\n const hideDeprecatedVersions = config?.web?.hideDeprecatedVersions ?? false;\n const darkMode = config?.web?.darkMode ?? false;\n const title = config?.web?.title ?? WEB_TITLE;\n const login = hasLogin(config);\n const scope = config?.web?.scope ?? '';\n const favicon = resolveLogo(config?.web?.favicon, config?.url_prefix, requestOptions);\n const logo = resolveLogo(config?.web?.logo, config?.url_prefix, requestOptions);\n const logoDark = resolveLogo(config?.web?.logoDark, config?.url_prefix, requestOptions);\n const pkgManagers = config?.web?.pkgManagers ?? ['yarn', 'pnpm', 'npm'];\n const version = res.locals.app_version ?? '';\n const flags = {\n ...config.flags,\n // legacy from 5.x\n ...config.experiments,\n };\n const primaryColor =\n validatePrimaryColor(config?.web?.primary_color ?? config?.web?.primaryColor) ?? '#4b5e40';\n const {\n showInfo,\n showSettings,\n showThemeSwitch,\n showFooter,\n showSearch,\n showDownloadTarball,\n showRaw,\n showUplinks,\n } = Object.assign({}, config?.web);\n\n return {\n showInfo,\n showSettings,\n showThemeSwitch,\n showFooter,\n showSearch,\n showDownloadTarball,\n showRaw,\n showUplinks,\n darkMode,\n url_prefix,\n basename,\n base,\n primaryColor,\n version,\n logo,\n logoDark,\n favicon,\n flags,\n login,\n pkgManagers,\n title,\n scope,\n language,\n hideDeprecatedVersions,\n };\n}\n"],"mappings":";;;;;;;;AAUA,IAAM,mBAAmB;AAEzB,SAAS,YACP,MACA,YACA,gBACA;CACA,IAAI,OAAO,SAAS,UAClB,OAAO;CAIT,IAFoB,QAAQ,EAAA,
|
|
1
|
+
{"version":3,"file":"ui-options.js","names":[],"sources":["../../../../src/middlewares/web/utils/ui-options.ts"],"sourcesContent":["import type { Response } from 'express';\nimport path from 'node:path';\nimport { URL } from 'node:url';\n\nimport { WEB_TITLE } from '@verdaccio/config';\nimport type { ConfigYaml, TemplateUIOptions } from '@verdaccio/types';\nimport { type RequestOptions, getPublicUrl, isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { hasLogin, validatePrimaryColor } from './web-utils';\n\nconst DEFAULT_LANGUAGE = 'en-US';\n\nfunction resolveLogo(\n logo: string | undefined,\n url_prefix: string | undefined,\n requestOptions: RequestOptions\n) {\n if (typeof logo !== 'string') {\n return '';\n }\n const isLocalFile = logo && !isURLhasValidProtocol(logo);\n\n if (isLocalFile) {\n return `${getPublicUrl(url_prefix, requestOptions)}-/static/${path.basename(logo)}`;\n } else if (isURLhasValidProtocol(logo)) {\n return logo;\n } else {\n return '';\n }\n}\n\nexport function getUIOptions(\n config: ConfigYaml,\n requestOptions: RequestOptions,\n res: Response\n): TemplateUIOptions {\n const { url_prefix } = config;\n const base = getPublicUrl(config?.url_prefix, requestOptions);\n const basename = URL.canParse(base) ? new URL(base).pathname : base;\n const language = config?.i18n?.web ?? DEFAULT_LANGUAGE;\n const hideDeprecatedVersions = config?.web?.hideDeprecatedVersions ?? false;\n const darkMode = config?.web?.darkMode ?? false;\n const title = config?.web?.title ?? WEB_TITLE;\n const login = hasLogin(config);\n const scope = config?.web?.scope ?? '';\n const favicon = resolveLogo(config?.web?.favicon, config?.url_prefix, requestOptions);\n const logo = resolveLogo(config?.web?.logo, config?.url_prefix, requestOptions);\n const logoDark = resolveLogo(config?.web?.logoDark, config?.url_prefix, requestOptions);\n const pkgManagers = config?.web?.pkgManagers ?? ['yarn', 'pnpm', 'npm'];\n const version = res.locals.app_version ?? '';\n const flags = {\n ...config.flags,\n // legacy from 5.x\n ...config.experiments,\n };\n const primaryColor =\n validatePrimaryColor(config?.web?.primary_color ?? config?.web?.primaryColor) ?? '#4b5e40';\n const {\n showInfo,\n showSettings,\n showThemeSwitch,\n showFooter,\n showSearch,\n showDownloadTarball,\n showRaw,\n showUplinks,\n } = Object.assign({}, config?.web);\n\n return {\n showInfo,\n showSettings,\n showThemeSwitch,\n showFooter,\n showSearch,\n showDownloadTarball,\n showRaw,\n showUplinks,\n darkMode,\n url_prefix,\n basename,\n base,\n primaryColor,\n version,\n logo,\n logoDark,\n favicon,\n flags,\n login,\n pkgManagers,\n title,\n scope,\n language,\n hideDeprecatedVersions,\n };\n}\n"],"mappings":";;;;;;;;AAUA,IAAM,mBAAmB;AAEzB,SAAS,YACP,MACA,YACA,gBACA;CACA,IAAI,OAAO,SAAS,UAClB,OAAO;CAIT,IAFoB,QAAQ,EAAA,GAAC,eAAA,sBAAA,CAAsB,IAAI,GAGrD,OAAO,IAAA,GAAG,eAAA,aAAA,CAAa,YAAY,cAAc,EAAE,WAAW,UAAA,QAAK,SAAS,IAAI;MAC3E,KAAA,GAAI,eAAA,sBAAA,CAAsB,IAAI,GACnC,OAAO;MAEP,OAAO;AAEX;AAEA,SAAgB,aACd,QACA,gBACA,KACmB;CACnB,MAAM,EAAE,eAAe;CACvB,MAAM,QAAA,GAAO,eAAA,aAAA,CAAa,QAAQ,YAAY,cAAc;CAC5D,MAAM,WAAW,SAAA,IAAI,SAAS,IAAI,IAAI,IAAI,SAAA,IAAI,IAAI,CAAC,CAAC,WAAW;CAC/D,MAAM,WAAW,QAAQ,MAAM,OAAO;CACtC,MAAM,yBAAyB,QAAQ,KAAK,0BAA0B;CACtE,MAAM,WAAW,QAAQ,KAAK,YAAY;CAC1C,MAAM,QAAQ,QAAQ,KAAK,SAAS,kBAAA;CACpC,MAAM,QAAQ,kBAAA,SAAS,MAAM;CAC7B,MAAM,QAAQ,QAAQ,KAAK,SAAS;CACpC,MAAM,UAAU,YAAY,QAAQ,KAAK,SAAS,QAAQ,YAAY,cAAc;CACpF,MAAM,OAAO,YAAY,QAAQ,KAAK,MAAM,QAAQ,YAAY,cAAc;CAC9E,MAAM,WAAW,YAAY,QAAQ,KAAK,UAAU,QAAQ,YAAY,cAAc;CACtF,MAAM,cAAc,QAAQ,KAAK,eAAe;EAAC;EAAQ;EAAQ;CAAK;CACtE,MAAM,UAAU,IAAI,OAAO,eAAe;CAC1C,MAAM,QAAQ;EACZ,GAAG,OAAO;EAEV,GAAG,OAAO;CACZ;CACA,MAAM,eACJ,kBAAA,qBAAqB,QAAQ,KAAK,iBAAiB,QAAQ,KAAK,YAAY,KAAK;CACnF,MAAM,EACJ,UACA,cACA,iBACA,YACA,YACA,qBACA,SACA,gBACE,OAAO,OAAO,CAAC,GAAG,QAAQ,GAAG;CAEjC,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"web-utils.js","names":[],"sources":["../../../../src/middlewares/web/utils/web-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nconst debug = buildDebug('verdaccio:web:middlwares');\n\nexport function validatePrimaryColor(primaryColor) {\n const isHex = /^#([0-9A-F]{3}){1,2}$/i.test(primaryColor);\n if (!isHex) {\n debug('invalid primary color %o', primaryColor);\n return;\n }\n\n return primaryColor;\n}\n\nexport function hasLogin(config: any) {\n return isNil(config?.web?.login) || config?.web?.login === true;\n}\n"],"mappings":";;;;;AAGA,IAAM,WAAA,
|
|
1
|
+
{"version":3,"file":"web-utils.js","names":[],"sources":["../../../../src/middlewares/web/utils/web-utils.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { isNil } from 'lodash-es';\n\nconst debug = buildDebug('verdaccio:web:middlwares');\n\nexport function validatePrimaryColor(primaryColor) {\n const isHex = /^#([0-9A-F]{3}){1,2}$/i.test(primaryColor);\n if (!isHex) {\n debug('invalid primary color %o', primaryColor);\n return;\n }\n\n return primaryColor;\n}\n\nexport function hasLogin(config: any) {\n return isNil(config?.web?.login) || config?.web?.login === true;\n}\n"],"mappings":";;;;;AAGA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,0BAA0B;AAEnD,SAAgB,qBAAqB,cAAc;CAEjD,IAAI,CADU,yBAAyB,KAAK,YACvC,GAAO;EACV,QAAM,4BAA4B,YAAY;EAC9C;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,SAAS,QAAa;CACpC,QAAA,GAAO,UAAA,MAAA,CAAM,QAAQ,KAAK,KAAK,KAAK,QAAQ,KAAK,UAAU;AAC7D"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"web-api.js","names":[],"sources":["../../../src/middlewares/web/web-api.ts"],"sourcesContent":["import type { RequestHandler } from 'express';\nimport express, { Router } from 'express';\n\nimport { validateName, validatePackage } from '../validation';\nimport { setSecurityWebHeaders } from './security';\n\nexport function webAPIMiddleware(\n tokenMiddleware: RequestHandler,\n webEndpointsApi: RequestHandler\n): Router {\n const route = Router();\n // validate all of these params as a package name\n // this might be too harsh, so ask if it causes trouble=\n route.param('package', validatePackage);\n route.param('filename', validateName);\n route.param('version', validateName);\n route.use(express.urlencoded({ extended: false }));\n route.use(setSecurityWebHeaders);\n\n if (typeof tokenMiddleware === 'function') {\n route.use(tokenMiddleware);\n }\n\n if (typeof webEndpointsApi === 'function') {\n route.use(webEndpointsApi);\n }\n\n return route;\n}\n"],"mappings":";;;;;;AAMA,SAAgB,iBACd,iBACA,iBACQ;CACR,MAAM,SAAA,
|
|
1
|
+
{"version":3,"file":"web-api.js","names":[],"sources":["../../../src/middlewares/web/web-api.ts"],"sourcesContent":["import type { RequestHandler } from 'express';\nimport express, { Router } from 'express';\n\nimport { validateName, validatePackage } from '../validation';\nimport { setSecurityWebHeaders } from './security';\n\nexport function webAPIMiddleware(\n tokenMiddleware: RequestHandler,\n webEndpointsApi: RequestHandler\n): Router {\n const route = Router();\n // validate all of these params as a package name\n // this might be too harsh, so ask if it causes trouble=\n route.param('package', validatePackage);\n route.param('filename', validateName);\n route.param('version', validateName);\n route.use(express.urlencoded({ extended: false }));\n route.use(setSecurityWebHeaders);\n\n if (typeof tokenMiddleware === 'function') {\n route.use(tokenMiddleware);\n }\n\n if (typeof webEndpointsApi === 'function') {\n route.use(webEndpointsApi);\n }\n\n return route;\n}\n"],"mappings":";;;;;;AAMA,SAAgB,iBACd,iBACA,iBACQ;CACR,MAAM,SAAA,GAAQ,QAAA,OAAA,CAAO;CAGrB,MAAM,MAAM,WAAW,mBAAA,eAAe;CACtC,MAAM,MAAM,YAAY,mBAAA,YAAY;CACpC,MAAM,MAAM,WAAW,mBAAA,YAAY;CACnC,MAAM,IAAI,QAAA,QAAQ,WAAW,EAAE,UAAU,MAAM,CAAC,CAAC;CACjD,MAAM,IAAI,iBAAA,qBAAqB;CAE/B,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,eAAe;CAG3B,IAAI,OAAO,oBAAoB,YAC7B,MAAM,IAAI,eAAe;CAG3B,OAAO;AACT"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/middleware",
|
|
3
|
-
"version": "9.0.0-next-9.
|
|
3
|
+
"version": "9.0.0-next-9.26",
|
|
4
4
|
"description": "Verdaccio Express Middleware",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -33,9 +33,9 @@
|
|
|
33
33
|
"node": ">=24"
|
|
34
34
|
},
|
|
35
35
|
"dependencies": {
|
|
36
|
-
"@verdaccio/config": "9.0.0-next-9.
|
|
37
|
-
"@verdaccio/core": "9.0.0-next-9.
|
|
38
|
-
"@verdaccio/url": "14.0.0-next-9.
|
|
36
|
+
"@verdaccio/config": "9.0.0-next-9.26",
|
|
37
|
+
"@verdaccio/core": "9.0.0-next-9.26",
|
|
38
|
+
"@verdaccio/url": "14.0.0-next-9.26",
|
|
39
39
|
"debug": "4.4.3",
|
|
40
40
|
"express": "5.2.1",
|
|
41
41
|
"express-rate-limit": "8.6.0",
|
|
@@ -48,12 +48,12 @@
|
|
|
48
48
|
},
|
|
49
49
|
"devDependencies": {
|
|
50
50
|
"@types/lodash-es": "4.17.12",
|
|
51
|
-
"@verdaccio/logger": "9.0.0-next-9.
|
|
51
|
+
"@verdaccio/logger": "9.0.0-next-9.26",
|
|
52
52
|
"@verdaccio/types": "14.0.0-next-9.12",
|
|
53
53
|
"http-errors": "2.0.1",
|
|
54
54
|
"rimraf": "6.1.3",
|
|
55
55
|
"supertest": "7.1.4",
|
|
56
|
-
"vite": "8.1
|
|
56
|
+
"vite": "8.2.1",
|
|
57
57
|
"vitest": "4.1.10"
|
|
58
58
|
},
|
|
59
59
|
"module": "./build/index.mjs",
|