@verdaccio/middleware 9.0.0-next-9.3 → 9.0.0-next-9.4

package/build/middlewares/user-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-agent.js","names":["_config","require","_core","userAgent","config","_req","res","next","setHeader","HEADERS","POWERED_BY","getUserAgent","user_agent"],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,KAAA,GAAAD,OAAA;AAIO,SAASE,SAASA,CAACC,MAAM,EAAE;EAChC,OAAO,UAAUC,IAAoB,EAAEC,GAAoB,EAAEC,IAAsB,EAAQ;IACzFD,GAAG,CAACE,SAAS,CAACC,aAAO,CAACC,UAAU,EAAE,IAAAC,oBAAY,EAACP,MAAM,EAAEQ,UAAU,CAAC,CAAC;IACnEL,IAAI,CAAC,CAAC;EACR,CAAC;AACH","ignoreList":[]}
+{"version":3,"file":"user-agent.js","names":[],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;;AAKA,SAAgB,UAAU,QAAQ;AAChC,QAAO,SAAU,MAAsB,KAAsB,MAA8B;AACzF,MAAI,UAAU,gBAAA,QAAQ,aAAA,GAAA,kBAAA,cAAyB,QAAQ,WAAW,CAAC;AACnE,QAAM"}

package/build/middlewares/user-agent.mjs

@@ -0,0 +1,13 @@
+import { HEADERS } from "@verdaccio/core";
+import { getUserAgent } from "@verdaccio/config";
+//#region src/middlewares/user-agent.ts
+function userAgent(config) {
+	return function(_req, res, next) {
+		res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));
+		next();
+	};
+}
+//#endregion
+export { userAgent };
+
+//# sourceMappingURL=user-agent.mjs.map

package/build/middlewares/user-agent.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-agent.mjs","names":[],"sources":["../../src/middlewares/user-agent.ts"],"sourcesContent":["import { getUserAgent } from '@verdaccio/config';\nimport { HEADERS } from '@verdaccio/core';\n\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '../types';\n\nexport function userAgent(config) {\n  return function (_req: $RequestExtend, res: $ResponseExtend, next: $NextFunctionVer): void {\n    res.setHeader(HEADERS.POWERED_BY, getUserAgent(config?.user_agent));\n    next();\n  };\n}\n"],"mappings":";;;AAKA,SAAgB,UAAU,QAAQ;AAChC,QAAO,SAAU,MAAsB,KAAsB,MAA8B;AACzF,MAAI,UAAU,QAAQ,YAAY,aAAa,QAAQ,WAAW,CAAC;AACnE,QAAM"}

package/build/middlewares/validation.d.ts

@@ -1,3 +1,3 @@
-import type { NextFunction, Request, Response } from 'express';
+import { NextFunction, Request, Response } from 'express';
 export declare function validateName(_req: Request, _res: Response, next: NextFunction, value: string, name: string): void;
 export declare function validatePackage(_req: Request, _res: any, next: NextFunction, value: string, name: string): void;

package/build/middlewares/validation.js

@@ -1,23 +1,16 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.validateName = validateName;
-exports.validatePackage = validatePackage;
-var _core = require("@verdaccio/core");
+require("../_virtual/_rolldown/runtime.js");
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/middlewares/validation.ts
 function validateName(_req, _res, next, value, name) {
-  if (_core.validationUtils.validateName(value)) {
-    next();
-  } else {
-    next(_core.errorUtils.getBadRequest('invalid ' + name));
-  }
+	if (_verdaccio_core.validationUtils.validateName(value)) next();
+	else next(_verdaccio_core.errorUtils.getBadRequest("invalid " + name));
 }
 function validatePackage(_req, _res, next, value, name) {
-  if (_core.validationUtils.validatePackage(value)) {
-    next();
-  } else {
-    next(_core.errorUtils.getBadRequest('invalid ' + name));
-  }
+	if (_verdaccio_core.validationUtils.validatePackage(value)) next();
+	else next(_verdaccio_core.errorUtils.getBadRequest("invalid " + name));
 }
+//#endregion
+exports.validateName = validateName;
+exports.validatePackage = validatePackage;
+
 //# sourceMappingURL=validation.js.map

package/build/middlewares/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","names":["_core","require","validateName","_req","_res","next","value","name","validationUtils","errorUtils","getBadRequest","validatePackage"],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n  _req: Request,\n  _res: Response,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  _req: Request,\n  _res,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n"],"mappings":";;;;;;;AAEA,IAAAA,KAAA,GAAAC,OAAA;AAEO,SAASC,YAAYA,CAC1BC,IAAa,EACbC,IAAc,EACdC,IAAkB,EAClBC,KAAa,EACbC,IAAY,EACZ;EACA,IAAIC,qBAAe,CAACN,YAAY,CAACI,KAAK,CAAC,EAAE;IACvCD,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EACnD;AACF;AAEO,SAASI,eAAeA,CAC7BR,IAAa,EACbC,IAAI,EACJC,IAAkB,EAClBC,KAAa,EACbC,IAAY,EACZ;EACA,IAAIC,qBAAe,CAACG,eAAe,CAACL,KAAK,CAAC,EAAE;IAC1CD,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACI,gBAAU,CAACC,aAAa,CAAC,UAAU,GAAGH,IAAI,CAAC,CAAC;EACnD;AACF","ignoreList":[]}
+{"version":3,"file":"validation.js","names":[],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n  _req: Request,\n  _res: Response,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  _req: Request,\n  _res,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n"],"mappings":";;;AAIA,SAAgB,aACd,MACA,MACA,MACA,OACA,MACA;AACA,KAAI,gBAAA,gBAAgB,aAAa,MAAM,CACrC,OAAM;KAEN,MAAK,gBAAA,WAAW,cAAc,aAAa,KAAK,CAAC;;AAIrD,SAAgB,gBACd,MACA,MACA,MACA,OACA,MACA;AACA,KAAI,gBAAA,gBAAgB,gBAAgB,MAAM,CACxC,OAAM;KAEN,MAAK,gBAAA,WAAW,cAAc,aAAa,KAAK,CAAC"}

package/build/middlewares/validation.mjs

@@ -0,0 +1,14 @@
+import { errorUtils, validationUtils } from "@verdaccio/core";
+//#region src/middlewares/validation.ts
+function validateName(_req, _res, next, value, name) {
+	if (validationUtils.validateName(value)) next();
+	else next(errorUtils.getBadRequest("invalid " + name));
+}
+function validatePackage(_req, _res, next, value, name) {
+	if (validationUtils.validatePackage(value)) next();
+	else next(errorUtils.getBadRequest("invalid " + name));
+}
+//#endregion
+export { validateName, validatePackage };
+
+//# sourceMappingURL=validation.mjs.map

package/build/middlewares/validation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.mjs","names":[],"sources":["../../src/middlewares/validation.ts"],"sourcesContent":["import type { NextFunction, Request, Response } from 'express';\n\nimport { errorUtils, validationUtils } from '@verdaccio/core';\n\nexport function validateName(\n  _req: Request,\n  _res: Response,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validateName(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n\nexport function validatePackage(\n  _req: Request,\n  _res,\n  next: NextFunction,\n  value: string,\n  name: string\n) {\n  if (validationUtils.validatePackage(value)) {\n    next();\n  } else {\n    next(errorUtils.getBadRequest('invalid ' + name));\n  }\n}\n"],"mappings":";;AAIA,SAAgB,aACd,MACA,MACA,MACA,OACA,MACA;AACA,KAAI,gBAAgB,aAAa,MAAM,CACrC,OAAM;KAEN,MAAK,WAAW,cAAc,aAAa,KAAK,CAAC;;AAIrD,SAAgB,gBACd,MACA,MACA,MACA,OACA,MACA;AACA,KAAI,gBAAgB,gBAAgB,MAAM,CACxC,OAAM;KAEN,MAAK,WAAW,cAAc,aAAa,KAAK,CAAC"}

package/build/middlewares/web/index.js

@@ -1,35 +1,4 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-Object.defineProperty(exports, "renderWebMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _renderWeb.renderWebMiddleware;
-  }
-});
-Object.defineProperty(exports, "setSecurityWebHeaders", {
-  enumerable: true,
-  get: function () {
-    return _security.setSecurityWebHeaders;
-  }
-});
-Object.defineProperty(exports, "webAPIMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _webApi.webAPIMiddleware;
-  }
-});
-Object.defineProperty(exports, "webMiddleware", {
-  enumerable: true,
-  get: function () {
-    return _webMiddleware.default;
-  }
-});
-var _webMiddleware = _interopRequireDefault(require("./web-middleware"));
-var _webApi = require("./web-api");
-var _security = require("./security");
-var _renderWeb = require("./render-web");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-//# sourceMappingURL=index.js.map
+require("./security.js");
+require("./render-web.js");
+require("./web-api.js");
+require("./web-middleware.js");

package/build/middlewares/web/index.mjs

@@ -0,0 +1,4 @@
+import "./security.mjs";
+import "./render-web.mjs";
+import "./web-api.mjs";
+import "./web-middleware.mjs";

package/build/middlewares/web/render-web.d.ts

@@ -1 +1 @@
-export declare function renderWebMiddleware(config: any, tokenMiddleware: any, pluginOptions: any): import("express-serve-static-core").Router;
+export declare function renderWebMiddleware(config: any, tokenMiddleware: any, pluginOptions: any): import('express-serve-static-core').Router;

package/build/middlewares/web/render-web.js

@@ -1,113 +1,84 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.renderWebMiddleware = renderWebMiddleware;
-var _debug = _interopRequireDefault(require("debug"));
-var _express = _interopRequireDefault(require("express"));
-var _nodeFs = _interopRequireDefault(require("node:fs"));
-var _nodePath = _interopRequireDefault(require("node:path"));
-var _core = require("@verdaccio/core");
-var _url = require("@verdaccio/url");
-var _security = require("./security");
-var _renderHTML = _interopRequireDefault(require("./utils/renderHTML"));
-var _webUrls = require("./web-urls");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:web:render');
-const sendFileCallback = next => err => {
-  if (!err) {
-    return;
-  }
-  if (err.status === _core.HTTP_STATUS.NOT_FOUND) {
-    next();
-  } else {
-    next(err);
-  }
+const require_runtime = require("../../_virtual/_rolldown/runtime.js");
+const require_security = require("./security.js");
+const require_renderHTML = require("./utils/renderHTML.js");
+const require_web_urls = require("./web-urls.js");
+let _verdaccio_core = require("@verdaccio/core");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let express = require("express");
+express = require_runtime.__toESM(express);
+let node_fs = require("node:fs");
+node_fs = require_runtime.__toESM(node_fs);
+let node_path = require("node:path");
+node_path = require_runtime.__toESM(node_path);
+let _verdaccio_url = require("@verdaccio/url");
+//#region src/middlewares/web/render-web.ts
+var debug$1 = (0, debug.default)("verdaccio:web:render");
+var sendFileCallback = (next) => (err) => {
+	if (!err) return;
+	if (err.status === _verdaccio_core.HTTP_STATUS.NOT_FOUND) next();
+	else next(err);
 };
 function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
-  const {
-    staticPath,
-    manifest,
-    manifestFiles
-  } = pluginOptions;
-  debug('static path %o', staticPath);
-
-  /* eslint new-cap:off */
-  const router = _express.default.Router();
-  if (typeof tokenMiddleware === 'function') {
-    router.use(tokenMiddleware);
-  }
-  router.use(_security.setSecurityWebHeaders);
-
-  // any match within the static is routed to the file system
-  router.get(_webUrls.WebUrlsNamespace.static, function (req, res, next) {
-    const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;
-    if (filename === 'favicon.ico' && config?.web?.favicon) {
-      const file = config?.web?.favicon;
-      if ((0, _url.isURLhasValidProtocol)(file)) {
-        debug('redirect to favicon %s', file);
-        req.url = file;
-        return next();
-      }
-      debug('render custom favicon %o', file);
-      res.sendFile(file, sendFileCallback(next));
-      return;
-    }
-    debug('render static file %o', filename);
-    res.sendFile(filename, {
-      root: staticPath
-    }, sendFileCallback(next));
-  });
-  function renderLogo(logo) {
-    // check the origin of the logo
-    if (logo && !(0, _url.isURLhasValidProtocol)(logo)) {
-      // URI related to a local file
-      const absoluteLocalFile = _nodePath.default.posix.resolve(logo);
-      debug('serve local logo %s', absoluteLocalFile);
-      try {
-        // TODO: replace existsSync by async alternative
-        if (_nodeFs.default.existsSync(absoluteLocalFile) && typeof _nodeFs.default.accessSync(absoluteLocalFile, _nodeFs.default.constants.R_OK) === 'undefined') {
-          // Note: `path.join` will break on Windows, because it transforms `/` to `\`
-          // Use POSIX version `path.posix.join` instead.
-          logo = `/-/static/${_nodePath.default.basename(logo)}`;
-          router.get(logo, function (_req, res, next) {
-            // @ts-ignore
-            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);
-            res.sendFile(_nodePath.default.basename(absoluteLocalFile), {
-              root: _nodePath.default.dirname(absoluteLocalFile)
-            }, sendFileCallback(next));
-          });
-          debug('enabled custom logo %s', logo);
-        } else {
-          logo = undefined;
-          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
-        }
-      } catch {
-        logo = undefined;
-        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
-      }
-    }
-    return logo;
-  }
-  const logo = renderLogo(config?.web?.logo);
-  if (config?.web?.logo) {
-    config.web.logo = logo;
-  }
-  const logoDark = renderLogo(config?.web?.logoDark);
-  if (config?.web?.logoDark) {
-    config.web.logoDark = logoDark;
-  }
-
-  // Handle all web routes including security routes
-  router.get(_webUrls.WebUrlsNamespace.web, function (req, res) {
-    (0, _renderHTML.default)(config, manifest, manifestFiles, req, res);
-    debug('render html section');
-  });
-  router.get(_webUrls.WebUrlsNamespace.root, function (req, res) {
-    (0, _renderHTML.default)(config, manifest, manifestFiles, req, res);
-    debug('render root');
-  });
-  return router;
+	const { staticPath, manifest, manifestFiles } = pluginOptions;
+	debug$1("static path %o", staticPath);
+	const router = express.default.Router();
+	if (typeof tokenMiddleware === "function") router.use(tokenMiddleware);
+	router.use(require_security.setSecurityWebHeaders);
+	router.get(require_web_urls.WebUrlsNamespace.static, function(req, res, next) {
+		const filename = Array.isArray(req.params.all) ? req.params.all.join("/") : req.params.all;
+		if (filename === "favicon.ico" && config?.web?.favicon) {
+			const file = config?.web?.favicon;
+			if ((0, _verdaccio_url.isURLhasValidProtocol)(file)) {
+				debug$1("redirect to favicon %s", file);
+				req.url = file;
+				return next();
+			}
+			debug$1("render custom favicon %o", file);
+			res.sendFile(file, sendFileCallback(next));
+			return;
+		}
+		debug$1("render static file %o", filename);
+		res.sendFile(filename, { root: staticPath }, sendFileCallback(next));
+	});
+	function renderLogo(logo) {
+		if (logo && !(0, _verdaccio_url.isURLhasValidProtocol)(logo)) {
+			const absoluteLocalFile = node_path.default.posix.resolve(logo);
+			debug$1("serve local logo %s", absoluteLocalFile);
+			try {
+				if (node_fs.default.existsSync(absoluteLocalFile) && typeof node_fs.default.accessSync(absoluteLocalFile, node_fs.default.constants.R_OK) === "undefined") {
+					logo = `/-/static/${node_path.default.basename(logo)}`;
+					router.get(logo, function(_req, res, next) {
+						debug$1("serve custom logo  web:%s - local:%s", logo, absoluteLocalFile);
+						res.sendFile(node_path.default.basename(absoluteLocalFile), { root: node_path.default.dirname(absoluteLocalFile) }, sendFileCallback(next));
+					});
+					debug$1("enabled custom logo %s", logo);
+				} else {
+					logo = void 0;
+					debug$1(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
+				}
+			} catch {
+				logo = void 0;
+				debug$1(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
+			}
+		}
+		return logo;
+	}
+	const logo = renderLogo(config?.web?.logo);
+	if (config?.web?.logo) config.web.logo = logo;
+	const logoDark = renderLogo(config?.web?.logoDark);
+	if (config?.web?.logoDark) config.web.logoDark = logoDark;
+	router.get(require_web_urls.WebUrlsNamespace.web, function(req, res) {
+		require_renderHTML.default(config, manifest, manifestFiles, req, res);
+		debug$1("render html section");
+	});
+	router.get(require_web_urls.WebUrlsNamespace.root, function(req, res) {
+		require_renderHTML.default(config, manifest, manifestFiles, req, res);
+		debug$1("render root");
+	});
+	return router;
 }
+//#endregion
+exports.renderWebMiddleware = renderWebMiddleware;
+
 //# sourceMappingURL=render-web.js.map

package/build/middlewares/web/render-web.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-web.js","names":["_debug","_interopRequireDefault","require","_express","_nodeFs","_nodePath","_core","_url","_security","_renderHTML","_webUrls","e","__esModule","default","debug","buildDebug","sendFileCallback","next","err","status","HTTP_STATUS","NOT_FOUND","renderWebMiddleware","config","tokenMiddleware","pluginOptions","staticPath","manifest","manifestFiles","router","express","Router","use","setSecurityWebHeaders","get","WebUrlsNamespace","static","req","res","filename","Array","isArray","params","all","join","web","favicon","file","isURLhasValidProtocol","url","sendFile","root","renderLogo","logo","absoluteLocalFile","path","posix","resolve","fs","existsSync","accessSync","constants","R_OK","basename","_req","dirname","undefined","logoDark","renderHTML"],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport renderHTML from './utils/renderHTML';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:web:render');\n\nconst sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        res.sendFile(file, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      res.sendFile(filename, { root: staticPath }, sendFileCallback(next));\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile) },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    renderHTML(config, manifest, manifestFiles, req, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    renderHTML(config, manifest, manifestFiles, req, res);\n    debug('render root');\n  });\n\n  return router;\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,QAAA,GAAAF,sBAAA,CAAAC,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AACA,IAAAG,SAAA,GAAAJ,sBAAA,CAAAC,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA;AACA,IAAAK,IAAA,GAAAL,OAAA;AAEA,IAAAM,SAAA,GAAAN,OAAA;AACA,IAAAO,WAAA,GAAAR,sBAAA,CAAAC,OAAA;AACA,IAAAQ,QAAA,GAAAR,OAAA;AAA8C,SAAAD,uBAAAU,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAE9C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,sBAAsB,CAAC;AAEhD,MAAMC,gBAAgB,GAAIC,IAAI,IAAMC,GAAG,IAAK;EAC1C,IAAI,CAACA,GAAG,EAAE;IACR;EACF;EACA,IAAIA,GAAG,CAACC,MAAM,KAAKC,iBAAW,CAACC,SAAS,EAAE;IACxCJ,IAAI,CAAC,CAAC;EACR,CAAC,MAAM;IACLA,IAAI,CAACC,GAAG,CAAC;EACX;AACF,CAAC;AAEM,SAASI,mBAAmBA,CAACC,MAAM,EAAEC,eAAe,EAAEC,aAAa,EAAE;EAC1E,MAAM;IAAEC,UAAU;IAAEC,QAAQ;IAAEC;EAAc,CAAC,GAAGH,aAAa;EAC7DX,KAAK,CAAC,gBAAgB,EAAEY,UAAU,CAAC;;EAEnC;EACA,MAAMG,MAAM,GAAGC,gBAAO,CAACC,MAAM,CAAC,CAAC;EAC/B,IAAI,OAAOP,eAAe,KAAK,UAAU,EAAE;IACzCK,MAAM,CAACG,GAAG,CAACR,eAAe,CAAC;EAC7B;EAEAK,MAAM,CAACG,GAAG,CAACC,+BAAqB,CAAC;;EAEjC;EACAJ,MAAM,CAACK,GAAG,CACRC,yBAAgB,CAACC,MAAM,EACvB,UAAUC,GAAgD,EAAEC,GAAG,EAAErB,IAAI,EAAE;IACrE,MAAMsB,QAAQ,GAAGC,KAAK,CAACC,OAAO,CAACJ,GAAG,CAACK,MAAM,CAACC,GAAG,CAAC,GAAGN,GAAG,CAACK,MAAM,CAACC,GAAG,CAACC,IAAI,CAAC,GAAG,CAAC,GAAGP,GAAG,CAACK,MAAM,CAACC,GAAG;IAC1F,IAAIJ,QAAQ,KAAK,aAAa,IAAIhB,MAAM,EAAEsB,GAAG,EAAEC,OAAO,EAAE;MACtD,MAAMC,IAAI,GAAGxB,MAAM,EAAEsB,GAAG,EAAEC,OAAO;MACjC,IAAI,IAAAE,0BAAqB,EAACD,IAAI,CAAC,EAAE;QAC/BjC,KAAK,CAAC,wBAAwB,EAAEiC,IAAI,CAAC;QACrCV,GAAG,CAACY,GAAG,GAAGF,IAAI;QACd,OAAO9B,IAAI,CAAC,CAAC;MACf;MACAH,KAAK,CAAC,0BAA0B,EAAEiC,IAAI,CAAC;MACvCT,GAAG,CAACY,QAAQ,CAACH,IAAI,EAAE/B,gBAAgB,CAACC,IAAI,CAAC,CAAC;MAC1C;IACF;IACAH,KAAK,CAAC,uBAAuB,EAAEyB,QAAQ,CAAC;IACxCD,GAAG,CAACY,QAAQ,CAACX,QAAQ,EAAE;MAAEY,IAAI,EAAEzB;IAAW,CAAC,EAAEV,gBAAgB,CAACC,IAAI,CAAC,CAAC;EACtE,CACF,CAAC;EAED,SAASmC,UAAUA,CAACC,IAAwB,EAAsB;IAChE;IACA,IAAIA,IAAI,IAAI,CAAC,IAAAL,0BAAqB,EAACK,IAAI,CAAC,EAAE;MACxC;MACA,MAAMC,iBAAiB,GAAGC,iBAAI,CAACC,KAAK,CAACC,OAAO,CAACJ,IAAI,CAAC;MAClDvC,KAAK,CAAC,qBAAqB,EAAEwC,iBAAiB,CAAC;MAC/C,IAAI;QACF;QACA,IACEI,eAAE,CAACC,UAAU,CAACL,iBAAiB,CAAC,IAChC,OAAOI,eAAE,CAACE,UAAU,CAACN,iBAAiB,EAAEI,eAAE,CAACG,SAAS,CAACC,IAAI,CAAC,KAAK,WAAW,EAC1E;UACA;UACA;UACAT,IAAI,GAAG,aAAaE,iBAAI,CAACQ,QAAQ,CAACV,IAAI,CAAC,EAAE;UACzCxB,MAAM,CAACK,GAAG,CAACmB,IAAI,EAAE,UAAUW,IAAI,EAAE1B,GAAG,EAAErB,IAAI,EAAE;YAC1C;YACAH,KAAK,CAAC,sCAAsC,EAAEuC,IAAI,EAAEC,iBAAiB,CAAC;YACtEhB,GAAG,CAACY,QAAQ,CACVK,iBAAI,CAACQ,QAAQ,CAACT,iBAAiB,CAAC,EAChC;cAAEH,IAAI,EAAEI,iBAAI,CAACU,OAAO,CAACX,iBAAiB;YAAE,CAAC,EACzCtC,gBAAgB,CAACC,IAAI,CACvB,CAAC;UACH,CAAC,CAAC;UACFH,KAAK,CAAC,wBAAwB,EAAEuC,IAAI,CAAC;QACvC,CAAC,MAAM;UACLA,IAAI,GAAGa,SAAS;UAChBpD,KAAK,CAAC,2BAA2BwC,iBAAiB,oCAAoC,CAAC;QACzF;MACF,CAAC,CAAC,MAAM;QACND,IAAI,GAAGa,SAAS;QAChBpD,KAAK,CAAC,2BAA2BwC,iBAAiB,oCAAoC,CAAC;MACzF;IACF;IACA,OAAOD,IAAI;EACb;EAEA,MAAMA,IAAI,GAAGD,UAAU,CAAC7B,MAAM,EAAEsB,GAAG,EAAEQ,IAAI,CAAC;EAC1C,IAAI9B,MAAM,EAAEsB,GAAG,EAAEQ,IAAI,EAAE;IACrB9B,MAAM,CAACsB,GAAG,CAACQ,IAAI,GAAGA,IAAI;EACxB;EACA,MAAMc,QAAQ,GAAGf,UAAU,CAAC7B,MAAM,EAAEsB,GAAG,EAAEsB,QAAQ,CAAC;EAClD,IAAI5C,MAAM,EAAEsB,GAAG,EAAEsB,QAAQ,EAAE;IACzB5C,MAAM,CAACsB,GAAG,CAACsB,QAAQ,GAAGA,QAAQ;EAChC;;EAEA;EACAtC,MAAM,CAACK,GAAG,CAACC,yBAAgB,CAACU,GAAG,EAAE,UAAUR,GAAG,EAAEC,GAAG,EAAE;IACnD,IAAA8B,mBAAU,EAAC7C,MAAM,EAAEI,QAAQ,EAAEC,aAAa,EAAES,GAAG,EAAEC,GAAG,CAAC;IACrDxB,KAAK,CAAC,qBAAqB,CAAC;EAC9B,CAAC,CAAC;EAEFe,MAAM,CAACK,GAAG,CAACC,yBAAgB,CAACgB,IAAI,EAAE,UAAUd,GAAG,EAAEC,GAAG,EAAE;IACpD,IAAA8B,mBAAU,EAAC7C,MAAM,EAAEI,QAAQ,EAAEC,aAAa,EAAES,GAAG,EAAEC,GAAG,CAAC;IACrDxB,KAAK,CAAC,aAAa,CAAC;EACtB,CAAC,CAAC;EAEF,OAAOe,MAAM;AACf","ignoreList":[]}
+{"version":3,"file":"render-web.js","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport renderHTML from './utils/renderHTML';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:web:render');\n\nconst sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        res.sendFile(file, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      res.sendFile(filename, { root: staticPath }, sendFileCallback(next));\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile) },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    renderHTML(config, manifest, manifestFiles, req, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    renderHTML(config, manifest, manifestFiles, req, res);\n    debug('render root');\n  });\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAYA,IAAM,WAAA,GAAA,MAAA,SAAmB,uBAAuB;AAEhD,IAAM,oBAAoB,UAAU,QAAQ;AAC1C,KAAI,CAAC,IACH;AAEF,KAAI,IAAI,WAAW,gBAAA,YAAY,UAC7B,OAAM;KAEN,MAAK,IAAI;;AAIb,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;AAChD,SAAM,kBAAkB,WAAW;CAGnC,MAAM,SAAS,QAAA,QAAQ,QAAQ;AAC/B,KAAI,OAAO,oBAAoB,WAC7B,QAAO,IAAI,gBAAgB;AAG7B,QAAO,IAAI,iBAAA,sBAAsB;AAGjC,QAAO,IACL,iBAAA,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,IAAI,KAAK,IAAI,GAAG,IAAI,OAAO;AACvF,MAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;AAC1B,QAAA,GAAA,eAAA,uBAA0B,KAAK,EAAE;AAC/B,YAAM,0BAA0B,KAAK;AACrC,QAAI,MAAM;AACV,WAAO,MAAM;;AAEf,WAAM,4BAA4B,KAAK;AACvC,OAAI,SAAS,MAAM,iBAAiB,KAAK,CAAC;AAC1C;;AAEF,UAAM,yBAAyB,SAAS;AACxC,MAAI,SAAS,UAAU,EAAE,MAAM,YAAY,EAAE,iBAAiB,KAAK,CAAC;GAEvE;CAED,SAAS,WAAW,MAA8C;AAEhE,MAAI,QAAQ,EAAA,GAAA,eAAA,uBAAuB,KAAK,EAAE;GAExC,MAAM,oBAAoB,UAAA,QAAK,MAAM,QAAQ,KAAK;AAClD,WAAM,uBAAuB,kBAAkB;AAC/C,OAAI;AAEF,QACE,QAAA,QAAG,WAAW,kBAAkB,IAChC,OAAO,QAAA,QAAG,WAAW,mBAAmB,QAAA,QAAG,UAAU,KAAK,KAAK,aAC/D;AAGA,YAAO,aAAa,UAAA,QAAK,SAAS,KAAK;AACvC,YAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;AAE1C,cAAM,wCAAwC,MAAM,kBAAkB;AACtE,UAAI,SACF,UAAA,QAAK,SAAS,kBAAkB,EAChC,EAAE,MAAM,UAAA,QAAK,QAAQ,kBAAkB,EAAE,EACzC,iBAAiB,KAAK,CACvB;OACD;AACF,aAAM,0BAA0B,KAAK;WAChC;AACL,YAAO,KAAA;AACP,aAAM,2BAA2B,kBAAkB,oCAAoC;;WAEnF;AACN,WAAO,KAAA;AACP,YAAM,2BAA2B,kBAAkB,oCAAoC;;;AAG3F,SAAO;;CAGT,MAAM,OAAO,WAAW,QAAQ,KAAK,KAAK;AAC1C,KAAI,QAAQ,KAAK,KACf,QAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,SAAS;AAClD,KAAI,QAAQ,KAAK,SACf,QAAO,IAAI,WAAW;AAIxB,QAAO,IAAI,iBAAA,iBAAiB,KAAK,SAAU,KAAK,KAAK;AACnD,qBAAA,QAAW,QAAQ,UAAU,eAAe,KAAK,IAAI;AACrD,UAAM,sBAAsB;GAC5B;AAEF,QAAO,IAAI,iBAAA,iBAAiB,MAAM,SAAU,KAAK,KAAK;AACpD,qBAAA,QAAW,QAAQ,UAAU,eAAe,KAAK,IAAI;AACrD,UAAM,cAAc;GACpB;AAEF,QAAO"}

package/build/middlewares/web/render-web.mjs

@@ -0,0 +1,79 @@
+import { setSecurityWebHeaders } from "./security.mjs";
+import renderHTML from "./utils/renderHTML.mjs";
+import { WebUrlsNamespace } from "./web-urls.mjs";
+import { HTTP_STATUS } from "@verdaccio/core";
+import buildDebug from "debug";
+import express from "express";
+import fs from "node:fs";
+import path from "node:path";
+import { isURLhasValidProtocol } from "@verdaccio/url";
+//#region src/middlewares/web/render-web.ts
+var debug = buildDebug("verdaccio:web:render");
+var sendFileCallback = (next) => (err) => {
+	if (!err) return;
+	if (err.status === HTTP_STATUS.NOT_FOUND) next();
+	else next(err);
+};
+function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {
+	const { staticPath, manifest, manifestFiles } = pluginOptions;
+	debug("static path %o", staticPath);
+	const router = express.Router();
+	if (typeof tokenMiddleware === "function") router.use(tokenMiddleware);
+	router.use(setSecurityWebHeaders);
+	router.get(WebUrlsNamespace.static, function(req, res, next) {
+		const filename = Array.isArray(req.params.all) ? req.params.all.join("/") : req.params.all;
+		if (filename === "favicon.ico" && config?.web?.favicon) {
+			const file = config?.web?.favicon;
+			if (isURLhasValidProtocol(file)) {
+				debug("redirect to favicon %s", file);
+				req.url = file;
+				return next();
+			}
+			debug("render custom favicon %o", file);
+			res.sendFile(file, sendFileCallback(next));
+			return;
+		}
+		debug("render static file %o", filename);
+		res.sendFile(filename, { root: staticPath }, sendFileCallback(next));
+	});
+	function renderLogo(logo) {
+		if (logo && !isURLhasValidProtocol(logo)) {
+			const absoluteLocalFile = path.posix.resolve(logo);
+			debug("serve local logo %s", absoluteLocalFile);
+			try {
+				if (fs.existsSync(absoluteLocalFile) && typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === "undefined") {
+					logo = `/-/static/${path.basename(logo)}`;
+					router.get(logo, function(_req, res, next) {
+						debug("serve custom logo  web:%s - local:%s", logo, absoluteLocalFile);
+						res.sendFile(path.basename(absoluteLocalFile), { root: path.dirname(absoluteLocalFile) }, sendFileCallback(next));
+					});
+					debug("enabled custom logo %s", logo);
+				} else {
+					logo = void 0;
+					debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
+				}
+			} catch {
+				logo = void 0;
+				debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);
+			}
+		}
+		return logo;
+	}
+	const logo = renderLogo(config?.web?.logo);
+	if (config?.web?.logo) config.web.logo = logo;
+	const logoDark = renderLogo(config?.web?.logoDark);
+	if (config?.web?.logoDark) config.web.logoDark = logoDark;
+	router.get(WebUrlsNamespace.web, function(req, res) {
+		renderHTML(config, manifest, manifestFiles, req, res);
+		debug("render html section");
+	});
+	router.get(WebUrlsNamespace.root, function(req, res) {
+		renderHTML(config, manifest, manifestFiles, req, res);
+		debug("render root");
+	});
+	return router;
+}
+//#endregion
+export { renderWebMiddleware };
+
+//# sourceMappingURL=render-web.mjs.map

package/build/middlewares/web/render-web.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-web.mjs","names":[],"sources":["../../../src/middlewares/web/render-web.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport express from 'express';\nimport fs from 'node:fs';\nimport path from 'node:path';\n\nimport { HTTP_STATUS } from '@verdaccio/core';\nimport { isURLhasValidProtocol } from '@verdaccio/url';\n\nimport { setSecurityWebHeaders } from './security';\nimport renderHTML from './utils/renderHTML';\nimport { WebUrlsNamespace } from './web-urls';\n\nconst debug = buildDebug('verdaccio:web:render');\n\nconst sendFileCallback = (next) => (err) => {\n  if (!err) {\n    return;\n  }\n  if (err.status === HTTP_STATUS.NOT_FOUND) {\n    next();\n  } else {\n    next(err);\n  }\n};\n\nexport function renderWebMiddleware(config, tokenMiddleware, pluginOptions) {\n  const { staticPath, manifest, manifestFiles } = pluginOptions;\n  debug('static path %o', staticPath);\n\n  /* eslint new-cap:off */\n  const router = express.Router();\n  if (typeof tokenMiddleware === 'function') {\n    router.use(tokenMiddleware);\n  }\n\n  router.use(setSecurityWebHeaders);\n\n  // any match within the static is routed to the file system\n  router.get(\n    WebUrlsNamespace.static,\n    function (req: express.Request<{ all: string | string[] }>, res, next) {\n      const filename = Array.isArray(req.params.all) ? req.params.all.join('/') : req.params.all;\n      if (filename === 'favicon.ico' && config?.web?.favicon) {\n        const file = config?.web?.favicon;\n        if (isURLhasValidProtocol(file)) {\n          debug('redirect to favicon %s', file);\n          req.url = file;\n          return next();\n        }\n        debug('render custom favicon %o', file);\n        res.sendFile(file, sendFileCallback(next));\n        return;\n      }\n      debug('render static file %o', filename);\n      res.sendFile(filename, { root: staticPath }, sendFileCallback(next));\n    }\n  );\n\n  function renderLogo(logo: string | undefined): string | undefined {\n    // check the origin of the logo\n    if (logo && !isURLhasValidProtocol(logo)) {\n      // URI related to a local file\n      const absoluteLocalFile = path.posix.resolve(logo);\n      debug('serve local logo %s', absoluteLocalFile);\n      try {\n        // TODO: replace existsSync by async alternative\n        if (\n          fs.existsSync(absoluteLocalFile) &&\n          typeof fs.accessSync(absoluteLocalFile, fs.constants.R_OK) === 'undefined'\n        ) {\n          // Note: `path.join` will break on Windows, because it transforms `/` to `\\`\n          // Use POSIX version `path.posix.join` instead.\n          logo = `/-/static/${path.basename(logo)}`;\n          router.get(logo, function (_req, res, next) {\n            // @ts-ignore\n            debug('serve custom logo  web:%s - local:%s', logo, absoluteLocalFile);\n            res.sendFile(\n              path.basename(absoluteLocalFile),\n              { root: path.dirname(absoluteLocalFile) },\n              sendFileCallback(next)\n            );\n          });\n          debug('enabled custom logo %s', logo);\n        } else {\n          logo = undefined;\n          debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n        }\n      } catch {\n        logo = undefined;\n        debug(`web logo is wrong, path ${absoluteLocalFile} does not exist or is not readable`);\n      }\n    }\n    return logo;\n  }\n\n  const logo = renderLogo(config?.web?.logo);\n  if (config?.web?.logo) {\n    config.web.logo = logo;\n  }\n  const logoDark = renderLogo(config?.web?.logoDark);\n  if (config?.web?.logoDark) {\n    config.web.logoDark = logoDark;\n  }\n\n  // Handle all web routes including security routes\n  router.get(WebUrlsNamespace.web, function (req, res) {\n    renderHTML(config, manifest, manifestFiles, req, res);\n    debug('render html section');\n  });\n\n  router.get(WebUrlsNamespace.root, function (req, res) {\n    renderHTML(config, manifest, manifestFiles, req, res);\n    debug('render root');\n  });\n\n  return router;\n}\n"],"mappings":";;;;;;;;;;AAYA,IAAM,QAAQ,WAAW,uBAAuB;AAEhD,IAAM,oBAAoB,UAAU,QAAQ;AAC1C,KAAI,CAAC,IACH;AAEF,KAAI,IAAI,WAAW,YAAY,UAC7B,OAAM;KAEN,MAAK,IAAI;;AAIb,SAAgB,oBAAoB,QAAQ,iBAAiB,eAAe;CAC1E,MAAM,EAAE,YAAY,UAAU,kBAAkB;AAChD,OAAM,kBAAkB,WAAW;CAGnC,MAAM,SAAS,QAAQ,QAAQ;AAC/B,KAAI,OAAO,oBAAoB,WAC7B,QAAO,IAAI,gBAAgB;AAG7B,QAAO,IAAI,sBAAsB;AAGjC,QAAO,IACL,iBAAiB,QACjB,SAAU,KAAkD,KAAK,MAAM;EACrE,MAAM,WAAW,MAAM,QAAQ,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,IAAI,KAAK,IAAI,GAAG,IAAI,OAAO;AACvF,MAAI,aAAa,iBAAiB,QAAQ,KAAK,SAAS;GACtD,MAAM,OAAO,QAAQ,KAAK;AAC1B,OAAI,sBAAsB,KAAK,EAAE;AAC/B,UAAM,0BAA0B,KAAK;AACrC,QAAI,MAAM;AACV,WAAO,MAAM;;AAEf,SAAM,4BAA4B,KAAK;AACvC,OAAI,SAAS,MAAM,iBAAiB,KAAK,CAAC;AAC1C;;AAEF,QAAM,yBAAyB,SAAS;AACxC,MAAI,SAAS,UAAU,EAAE,MAAM,YAAY,EAAE,iBAAiB,KAAK,CAAC;GAEvE;CAED,SAAS,WAAW,MAA8C;AAEhE,MAAI,QAAQ,CAAC,sBAAsB,KAAK,EAAE;GAExC,MAAM,oBAAoB,KAAK,MAAM,QAAQ,KAAK;AAClD,SAAM,uBAAuB,kBAAkB;AAC/C,OAAI;AAEF,QACE,GAAG,WAAW,kBAAkB,IAChC,OAAO,GAAG,WAAW,mBAAmB,GAAG,UAAU,KAAK,KAAK,aAC/D;AAGA,YAAO,aAAa,KAAK,SAAS,KAAK;AACvC,YAAO,IAAI,MAAM,SAAU,MAAM,KAAK,MAAM;AAE1C,YAAM,wCAAwC,MAAM,kBAAkB;AACtE,UAAI,SACF,KAAK,SAAS,kBAAkB,EAChC,EAAE,MAAM,KAAK,QAAQ,kBAAkB,EAAE,EACzC,iBAAiB,KAAK,CACvB;OACD;AACF,WAAM,0BAA0B,KAAK;WAChC;AACL,YAAO,KAAA;AACP,WAAM,2BAA2B,kBAAkB,oCAAoC;;WAEnF;AACN,WAAO,KAAA;AACP,UAAM,2BAA2B,kBAAkB,oCAAoC;;;AAG3F,SAAO;;CAGT,MAAM,OAAO,WAAW,QAAQ,KAAK,KAAK;AAC1C,KAAI,QAAQ,KAAK,KACf,QAAO,IAAI,OAAO;CAEpB,MAAM,WAAW,WAAW,QAAQ,KAAK,SAAS;AAClD,KAAI,QAAQ,KAAK,SACf,QAAO,IAAI,WAAW;AAIxB,QAAO,IAAI,iBAAiB,KAAK,SAAU,KAAK,KAAK;AACnD,aAAW,QAAQ,UAAU,eAAe,KAAK,IAAI;AACrD,QAAM,sBAAsB;GAC5B;AAEF,QAAO,IAAI,iBAAiB,MAAM,SAAU,KAAK,KAAK;AACpD,aAAW,QAAQ,UAAU,eAAe,KAAK,IAAI;AACrD,QAAM,cAAc;GACpB;AAEF,QAAO"}

package/build/middlewares/web/security.js

@@ -1,44 +1,32 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.setSecurityWebHeaders = setSecurityWebHeaders;
-var _debug = _interopRequireDefault(require("debug"));
-var _core = require("@verdaccio/core");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-const debug = (0, _debug.default)('verdaccio:middleware:web:security');
+const require_runtime = require("../../_virtual/_rolldown/runtime.js");
+let _verdaccio_core = require("@verdaccio/core");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+//#region src/middlewares/web/security.ts
+var debug$1 = (0, debug.default)("verdaccio:middleware:web:security");
 function setSecurityWebHeaders(_req, res, next) {
-  // disable loading in frames (clickjacking, etc.)
-  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
-  const framesOptions = res.getHeader(_core.HEADERS.FRAMES_OPTIONS);
-  if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {
-    debug('Missing or invalid X-Frame-Options header; setting to "deny"');
-    res.header(_core.HEADERS.FRAMES_OPTIONS, 'deny');
-  }
-
-  // avoid establishing connections outside of domain
-  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
-  if (!res.getHeader(_core.HEADERS.CSP)) {
-    debug('Missing Content-Security-Policy header; setting to "connect-src \'self\'"');
-    res.header(_core.HEADERS.CSP, "connect-src 'self'");
-  }
-
-  // respect the content type of the response
-  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
-  const cto = res.getHeader(_core.HEADERS.CTO);
-  if (!cto || cto !== 'nosniff') {
-    debug('Missing or invalid X-Content-Type-Options header; setting to "nosniff"');
-    res.header(_core.HEADERS.CTO, 'nosniff');
-  }
-
-  // block rendering of the page in case of XSS attack
-  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection
-  const xss = res.getHeader(_core.HEADERS.XSS);
-  if (!xss || !(xss === '0' || xss.startsWith('1'))) {
-    debug('Missing or invalid X-XSS-Protection header; setting to "1; mode=block"');
-    res.header(_core.HEADERS.XSS, '1; mode=block');
-  }
-  next();
+	const framesOptions = res.getHeader(_verdaccio_core.HEADERS.FRAMES_OPTIONS);
+	if (!framesOptions || !(framesOptions === "deny" || framesOptions === "sameorigin")) {
+		debug$1("Missing or invalid X-Frame-Options header; setting to \"deny\"");
+		res.header(_verdaccio_core.HEADERS.FRAMES_OPTIONS, "deny");
+	}
+	if (!res.getHeader(_verdaccio_core.HEADERS.CSP)) {
+		debug$1("Missing Content-Security-Policy header; setting to \"connect-src 'self'\"");
+		res.header(_verdaccio_core.HEADERS.CSP, "connect-src 'self'");
+	}
+	const cto = res.getHeader(_verdaccio_core.HEADERS.CTO);
+	if (!cto || cto !== "nosniff") {
+		debug$1("Missing or invalid X-Content-Type-Options header; setting to \"nosniff\"");
+		res.header(_verdaccio_core.HEADERS.CTO, "nosniff");
+	}
+	const xss = res.getHeader(_verdaccio_core.HEADERS.XSS);
+	if (!xss || !(xss === "0" || xss.startsWith("1"))) {
+		debug$1("Missing or invalid X-XSS-Protection header; setting to \"1; mode=block\"");
+		res.header(_verdaccio_core.HEADERS.XSS, "1; mode=block");
+	}
+	next();
 }
+//#endregion
+exports.setSecurityWebHeaders = setSecurityWebHeaders;
+
 //# sourceMappingURL=security.js.map

package/build/middlewares/web/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","names":["_debug","_interopRequireDefault","require","_core","e","__esModule","default","debug","buildDebug","setSecurityWebHeaders","_req","res","next","framesOptions","getHeader","HEADERS","FRAMES_OPTIONS","header","CSP","cto","CTO","xss","XSS","startsWith"],"sources":["../../../src/middlewares/web/security.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:security');\n\nexport function setSecurityWebHeaders(_req, res, next): void {\n  // disable loading in frames (clickjacking, etc.)\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options\n  const framesOptions = res.getHeader(HEADERS.FRAMES_OPTIONS);\n  if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {\n    debug('Missing or invalid X-Frame-Options header; setting to \"deny\"');\n    res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n  }\n\n  // avoid establishing connections outside of domain\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy\n  if (!res.getHeader(HEADERS.CSP)) {\n    debug('Missing Content-Security-Policy header; setting to \"connect-src \\'self\\'\"');\n    res.header(HEADERS.CSP, \"connect-src 'self'\");\n  }\n\n  // respect the content type of the response\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options\n  const cto = res.getHeader(HEADERS.CTO);\n  if (!cto || cto !== 'nosniff') {\n    debug('Missing or invalid X-Content-Type-Options header; setting to \"nosniff\"');\n    res.header(HEADERS.CTO, 'nosniff');\n  }\n\n  // block rendering of the page in case of XSS attack\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection\n  const xss = res.getHeader(HEADERS.XSS);\n  if (!xss || !(xss === '0' || xss.startsWith('1'))) {\n    debug('Missing or invalid X-XSS-Protection header; setting to \"1; mode=block\"');\n    res.header(HEADERS.XSS, '1; mode=block');\n  }\n  next();\n}\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,KAAA,GAAAD,OAAA;AAA0C,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAE1C,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,mCAAmC,CAAC;AAEtD,SAASC,qBAAqBA,CAACC,IAAI,EAAEC,GAAG,EAAEC,IAAI,EAAQ;EAC3D;EACA;EACA,MAAMC,aAAa,GAAGF,GAAG,CAACG,SAAS,CAACC,aAAO,CAACC,cAAc,CAAC;EAC3D,IAAI,CAACH,aAAa,IAAI,EAAEA,aAAa,KAAK,MAAM,IAAIA,aAAa,KAAK,YAAY,CAAC,EAAE;IACnFN,KAAK,CAAC,8DAA8D,CAAC;IACrEI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACC,cAAc,EAAE,MAAM,CAAC;EAC5C;;EAEA;EACA;EACA,IAAI,CAACL,GAAG,CAACG,SAAS,CAACC,aAAO,CAACG,GAAG,CAAC,EAAE;IAC/BX,KAAK,CAAC,2EAA2E,CAAC;IAClFI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACG,GAAG,EAAE,oBAAoB,CAAC;EAC/C;;EAEA;EACA;EACA,MAAMC,GAAG,GAAGR,GAAG,CAACG,SAAS,CAACC,aAAO,CAACK,GAAG,CAAC;EACtC,IAAI,CAACD,GAAG,IAAIA,GAAG,KAAK,SAAS,EAAE;IAC7BZ,KAAK,CAAC,wEAAwE,CAAC;IAC/EI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACK,GAAG,EAAE,SAAS,CAAC;EACpC;;EAEA;EACA;EACA,MAAMC,GAAG,GAAGV,GAAG,CAACG,SAAS,CAACC,aAAO,CAACO,GAAG,CAAC;EACtC,IAAI,CAACD,GAAG,IAAI,EAAEA,GAAG,KAAK,GAAG,IAAIA,GAAG,CAACE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE;IACjDhB,KAAK,CAAC,wEAAwE,CAAC;IAC/EI,GAAG,CAACM,MAAM,CAACF,aAAO,CAACO,GAAG,EAAE,eAAe,CAAC;EAC1C;EACAV,IAAI,CAAC,CAAC;AACR","ignoreList":[]}
+{"version":3,"file":"security.js","names":[],"sources":["../../../src/middlewares/web/security.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { HEADERS } from '@verdaccio/core';\n\nconst debug = buildDebug('verdaccio:middleware:web:security');\n\nexport function setSecurityWebHeaders(_req, res, next): void {\n  // disable loading in frames (clickjacking, etc.)\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options\n  const framesOptions = res.getHeader(HEADERS.FRAMES_OPTIONS);\n  if (!framesOptions || !(framesOptions === 'deny' || framesOptions === 'sameorigin')) {\n    debug('Missing or invalid X-Frame-Options header; setting to \"deny\"');\n    res.header(HEADERS.FRAMES_OPTIONS, 'deny');\n  }\n\n  // avoid establishing connections outside of domain\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy\n  if (!res.getHeader(HEADERS.CSP)) {\n    debug('Missing Content-Security-Policy header; setting to \"connect-src \\'self\\'\"');\n    res.header(HEADERS.CSP, \"connect-src 'self'\");\n  }\n\n  // respect the content type of the response\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options\n  const cto = res.getHeader(HEADERS.CTO);\n  if (!cto || cto !== 'nosniff') {\n    debug('Missing or invalid X-Content-Type-Options header; setting to \"nosniff\"');\n    res.header(HEADERS.CTO, 'nosniff');\n  }\n\n  // block rendering of the page in case of XSS attack\n  // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection\n  const xss = res.getHeader(HEADERS.XSS);\n  if (!xss || !(xss === '0' || xss.startsWith('1'))) {\n    debug('Missing or invalid X-XSS-Protection header; setting to \"1; mode=block\"');\n    res.header(HEADERS.XSS, '1; mode=block');\n  }\n  next();\n}\n"],"mappings":";;;;;AAIA,IAAM,WAAA,GAAA,MAAA,SAAmB,oCAAoC;AAE7D,SAAgB,sBAAsB,MAAM,KAAK,MAAY;CAG3D,MAAM,gBAAgB,IAAI,UAAU,gBAAA,QAAQ,eAAe;AAC3D,KAAI,CAAC,iBAAiB,EAAE,kBAAkB,UAAU,kBAAkB,eAAe;AACnF,UAAM,iEAA+D;AACrE,MAAI,OAAO,gBAAA,QAAQ,gBAAgB,OAAO;;AAK5C,KAAI,CAAC,IAAI,UAAU,gBAAA,QAAQ,IAAI,EAAE;AAC/B,UAAM,4EAA4E;AAClF,MAAI,OAAO,gBAAA,QAAQ,KAAK,qBAAqB;;CAK/C,MAAM,MAAM,IAAI,UAAU,gBAAA,QAAQ,IAAI;AACtC,KAAI,CAAC,OAAO,QAAQ,WAAW;AAC7B,UAAM,2EAAyE;AAC/E,MAAI,OAAO,gBAAA,QAAQ,KAAK,UAAU;;CAKpC,MAAM,MAAM,IAAI,UAAU,gBAAA,QAAQ,IAAI;AACtC,KAAI,CAAC,OAAO,EAAE,QAAQ,OAAO,IAAI,WAAW,IAAI,GAAG;AACjD,UAAM,2EAAyE;AAC/E,MAAI,OAAO,gBAAA,QAAQ,KAAK,gBAAgB;;AAE1C,OAAM"}