@verdaccio/package-filter 14.0.0-next-9.30

package/build/filtering/matcher.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"matcher.mjs","names":[],"sources":["../../src/filtering/matcher.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { satisfies } from 'semver';\n\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { ParsedRule } from '../config/types';\nimport type { MatchResult } from './types';\nimport { MatchType } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:filter');\n\n/**\n * Split a package name into name itself and scope.\n */\nfunction splitName(name: string): { name: string; scope?: string } {\n  if (!name) {\n    return { name: '' };\n  }\n\n  const parts = name.split('/');\n\n  if (parts.length > 1) {\n    return {\n      scope: parts[0],\n      name: parts[1],\n    };\n  } else {\n    return {\n      name: parts[0],\n    };\n  }\n}\n\n/**\n * Try to find a rule that matches the package.\n * If found, returns the rule and the matched package versions from the manifest.\n */\nexport function matchRules(\n  manifest: Manifest,\n  rules: Map<string, ParsedRule>\n): MatchResult | undefined {\n  const { scope } = splitName(manifest.name);\n  if (scope) {\n    const rule = rules.get(scope);\n    if (rule === 'scope') {\n      debug('scope match: %s matched rule for %s', manifest.name, scope);\n      return {\n        type: MatchType.SCOPE,\n        rule,\n        scope,\n        versions: Object.keys(manifest.versions),\n      };\n    }\n  }\n\n  const rule = rules.get(manifest.name);\n  if (!rule) {\n    // No match\n    return undefined;\n  }\n\n  if (rule === 'package') {\n    debug('package match: %s', manifest.name);\n    return {\n      type: MatchType.PACKAGE,\n      rule,\n      package: manifest.name,\n      versions: Object.keys(manifest.versions),\n    };\n  }\n\n  if (rule === 'scope') {\n    throw new Error('Unexpected case - rule for package should never be \"scope\"');\n  }\n\n  const versionRanges = rule.versions;\n  if (versionRanges.length === 0) {\n    // No match\n    return undefined;\n  }\n\n  const matchedVersions: string[] = [];\n  Object.keys(manifest.versions).forEach((version) => {\n    versionRanges.forEach((versionRange) => {\n      if (\n        satisfies(version, versionRange, {\n          includePrerelease: true,\n          loose: true,\n        })\n      ) {\n        matchedVersions.push(version);\n      }\n    });\n  });\n\n  if (matchedVersions.length > 0) {\n    debug(\n      'version match: %s matched %d versions: %o',\n      manifest.name,\n      matchedVersions.length,\n      matchedVersions\n    );\n  }\n\n  return {\n    type: MatchType.VERSIONS,\n    rule,\n    versions: matchedVersions,\n  };\n}\n"],"mappings":";;;;AASA,IAAM,QAAQ,WAAW,yCAAyC;;;;AAKlE,SAAS,UAAU,MAAgD;AACjE,KAAI,CAAC,KACH,QAAO,EAAE,MAAM,IAAI;CAGrB,MAAM,QAAQ,KAAK,MAAM,IAAI;AAE7B,KAAI,MAAM,SAAS,EACjB,QAAO;EACL,OAAO,MAAM;EACb,MAAM,MAAM;EACb;KAED,QAAO,EACL,MAAM,MAAM,IACb;;;;;;AAQL,SAAgB,WACd,UACA,OACyB;CACzB,MAAM,EAAE,UAAU,UAAU,SAAS,KAAK;AAC1C,KAAI,OAAO;EACT,MAAM,OAAO,MAAM,IAAI,MAAM;AAC7B,MAAI,SAAS,SAAS;AACpB,SAAM,uCAAuC,SAAS,MAAM,MAAM;AAClE,UAAO;IACL,MAAM,UAAU;IAChB;IACA;IACA,UAAU,OAAO,KAAK,SAAS,SAAS;IACzC;;;CAIL,MAAM,OAAO,MAAM,IAAI,SAAS,KAAK;AACrC,KAAI,CAAC,KAEH;AAGF,KAAI,SAAS,WAAW;AACtB,QAAM,qBAAqB,SAAS,KAAK;AACzC,SAAO;GACL,MAAM,UAAU;GAChB;GACA,SAAS,SAAS;GAClB,UAAU,OAAO,KAAK,SAAS,SAAS;GACzC;;AAGH,KAAI,SAAS,QACX,OAAM,IAAI,MAAM,+DAA6D;CAG/E,MAAM,gBAAgB,KAAK;AAC3B,KAAI,cAAc,WAAW,EAE3B;CAGF,MAAM,kBAA4B,EAAE;AACpC,QAAO,KAAK,SAAS,SAAS,CAAC,SAAS,YAAY;AAClD,gBAAc,SAAS,iBAAiB;AACtC,OACE,UAAU,SAAS,cAAc;IAC/B,mBAAmB;IACnB,OAAO;IACR,CAAC,CAEF,iBAAgB,KAAK,QAAQ;IAE/B;GACF;AAEF,KAAI,gBAAgB,SAAS,EAC3B,OACE,6CACA,SAAS,MACT,gBAAgB,QAChB,gBACD;AAGH,QAAO;EACL,MAAM,UAAU;EAChB;EACA,UAAU;EACX"}

package/build/filtering/packageVersion.d.ts

@@ -0,0 +1,20 @@
+import { Logger, Manifest } from '@verdaccio/types';
+import { ParsedRule } from '../config/types';
+/**
+ * Filter out all blocked package versions.
+ * If package or scope is blocked, then block all versions.
+ *
+ * TODO: consider adding a `prerelease` filter option to block/allow
+ * prerelease versions independently. Currently prereleases are matched by
+ * semver ranges with `includePrerelease: true`, but there's no dedicated toggle.
+ *
+ * Example config (not yet implemented):
+ *   block:
+ *     - package: 'foo'
+ *       prerelease: true    # block 1.0.0-beta.1, 2.0.0-rc.1, keep 1.0.0, 2.0.0
+ *     - package: 'bar'
+ *       prerelease: false   # block 1.0.0, 2.0.0, keep 1.0.0-beta.1
+ *
+ * Today the only workaround is using awkward ranges like ">=1.0.0-0 <1.0.0".
+ */
+export declare function filterBlockedVersions(manifest: Manifest, blockRules: Map<string, ParsedRule>, allowRules: Map<string, ParsedRule>, logger: Logger): Manifest;

package/build/filtering/packageVersion.js

@@ -0,0 +1,129 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+const require_types = require("./types.js");
+const require_matcher = require("./matcher.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let semver = require("semver");
+//#region src/filtering/packageVersion.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter:filter");
+/**
+* Filter out all blocked package versions.
+* If package or scope is blocked, then block all versions.
+*
+* TODO: consider adding a `prerelease` filter option to block/allow
+* prerelease versions independently. Currently prereleases are matched by
+* semver ranges with `includePrerelease: true`, but there's no dedicated toggle.
+*
+* Example config (not yet implemented):
+*   block:
+*     - package: 'foo'
+*       prerelease: true    # block 1.0.0-beta.1, 2.0.0-rc.1, keep 1.0.0, 2.0.0
+*     - package: 'bar'
+*       prerelease: false   # block 1.0.0, 2.0.0, keep 1.0.0-beta.1
+*
+* Today the only workaround is using awkward ranges like ">=1.0.0-0 <1.0.0".
+*/
+function filterBlockedVersions(manifest, blockRules, allowRules, logger) {
+	const allowMatch = require_matcher.matchRules(manifest, allowRules);
+	if (allowMatch && (allowMatch.type === require_types.MatchType.SCOPE || allowMatch.type === require_types.MatchType.PACKAGE)) {
+		logger.trace({ name: manifest.name }, "package @{name} is allow-listed, skipping block rules");
+		return manifest;
+	}
+	const blockMatch = require_matcher.matchRules(manifest, blockRules);
+	if (!blockMatch) return manifest;
+	logger.trace({
+		name: manifest.name,
+		type: blockMatch.type
+	}, "block rule matched for @{name} (type: @{type})");
+	const whitelistedVersions = allowMatch ? allowMatch.versions : [];
+	let blockRule = {
+		versions: [new semver.Range("*")],
+		strategy: "block"
+	};
+	if (blockMatch.type === require_types.MatchType.SCOPE) {
+		if (whitelistedVersions.length === 0) {
+			debug$1("blocking all versions of %s (scope %s blocked)", manifest.name, blockMatch.scope);
+			logger.trace({
+				name: manifest.name,
+				scope: blockMatch.scope
+			}, "all versions of @{name} blocked (scope @{scope})");
+			return {
+				...manifest,
+				versions: {},
+				readme: `All packages in scope ${blockMatch.scope} are blocked by rule`
+			};
+		}
+	} else if (blockMatch.type === require_types.MatchType.PACKAGE) {
+		if (whitelistedVersions.length === 0) {
+			debug$1("blocking all versions of %s (package blocked)", manifest.name);
+			logger.trace({ name: manifest.name }, "all versions of @{name} blocked (package rule)");
+			return {
+				...manifest,
+				versions: {},
+				readme: `All package versions are blocked by rule`
+			};
+		}
+	} else blockRule = {
+		...blockRule,
+		...blockMatch.rule
+	};
+	const versionRanges = blockRule.versions;
+	if (blockRule.strategy === "block") {
+		const blockedVersions = blockMatch.versions.filter((v) => !whitelistedVersions.includes(v));
+		for (const version of blockedVersions) delete manifest.versions[version];
+		if (blockedVersions.length > 0) {
+			debug$1("blocked %d versions of %s: %o", blockedVersions.length, manifest.name, blockedVersions);
+			logger.trace({
+				name: manifest.name,
+				count: blockedVersions.length,
+				versions: blockedVersions.join(", ")
+			}, "@{count} versions of @{name} blocked: @{versions}");
+			manifest.readme = (manifest.readme || "") + `\nSome versions(${blockedVersions.length}) of package are blocked by rules: ${versionRanges.map((range) => range.raw)}`;
+		}
+		return manifest;
+	}
+	const nonBlockedVersions = { ...manifest.versions };
+	const newVersionsMapping = {};
+	versionRanges.forEach((versionRange) => {
+		const allVersions = Object.keys(nonBlockedVersions);
+		let lastNonBlockedVersion = null;
+		allVersions.forEach((version) => {
+			if (!whitelistedVersions.includes(version) && (0, semver.satisfies)(version, versionRange, {
+				includePrerelease: true,
+				loose: true
+			})) {
+				delete nonBlockedVersions[version];
+				newVersionsMapping[version] = lastNonBlockedVersion;
+			} else lastNonBlockedVersion = version;
+		});
+	});
+	debug$1("replacing versions for %s: %o", manifest.name, newVersionsMapping);
+	const removedVersions = Object.entries(newVersionsMapping).filter(([_, replace]) => replace === null);
+	const replacedVersions = Object.entries(newVersionsMapping).filter(([_, replace]) => replace !== null);
+	removedVersions.forEach(([version]) => {
+		debug$1("no version to replace %s in %s", version, manifest.name);
+		logger.trace({
+			name: manifest.name,
+			version
+		}, "version @{version} of @{name} removed (no replacement available)");
+		delete manifest.versions[version];
+	});
+	replacedVersions.forEach(([version, replaceVersion]) => {
+		logger.trace({
+			name: manifest.name,
+			version,
+			replaceVersion
+		}, "version @{version} of @{name} replaced with @{replaceVersion}");
+		manifest.versions[version] = {
+			...manifest.versions[replaceVersion],
+			version
+		};
+	});
+	if (removedVersions.length > 0) manifest.readme += `\nSome versions of package could not be replaced and thus are fully blocked (${removedVersions.length}): ${removedVersions.map((a) => a[0])}`;
+	if (replacedVersions.length > 0) manifest.readme += `\nSome versions of package are replaced by other(${replacedVersions.length}): ${replacedVersions.map((a) => `${a[0]} => ${a[1]}`)}`;
+	return manifest;
+}
+//#endregion
+exports.filterBlockedVersions = filterBlockedVersions;
+
+//# sourceMappingURL=packageVersion.js.map

package/build/filtering/packageVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageVersion.js","names":[],"sources":["../../src/filtering/packageVersion.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Range, satisfies } from 'semver';\n\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nimport type { ParsedConfigRule, ParsedRule } from '../config/types';\nimport { matchRules } from './matcher';\nimport { MatchType } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:filter');\n\n/**\n * Filter out all blocked package versions.\n * If package or scope is blocked, then block all versions.\n *\n * TODO: consider adding a `prerelease` filter option to block/allow\n * prerelease versions independently. Currently prereleases are matched by\n * semver ranges with `includePrerelease: true`, but there's no dedicated toggle.\n *\n * Example config (not yet implemented):\n *   block:\n *     - package: 'foo'\n *       prerelease: true    # block 1.0.0-beta.1, 2.0.0-rc.1, keep 1.0.0, 2.0.0\n *     - package: 'bar'\n *       prerelease: false   # block 1.0.0, 2.0.0, keep 1.0.0-beta.1\n *\n * Today the only workaround is using awkward ranges like \">=1.0.0-0 <1.0.0\".\n */\nexport function filterBlockedVersions(\n  manifest: Manifest,\n  blockRules: Map<string, ParsedRule>,\n  allowRules: Map<string, ParsedRule>,\n  logger: Logger\n): Manifest {\n  const allowMatch = matchRules(manifest, allowRules);\n  if (\n    allowMatch &&\n    (allowMatch.type === MatchType.SCOPE || allowMatch.type === MatchType.PACKAGE)\n  ) {\n    // An entire scope or package is whitelisted\n    logger.trace({ name: manifest.name }, 'package @{name} is allow-listed, skipping block rules');\n    return manifest;\n  }\n\n  const blockMatch = matchRules(manifest, blockRules);\n  if (!blockMatch) {\n    // No rule is blocking this package\n    return manifest;\n  }\n\n  logger.trace(\n    { name: manifest.name, type: blockMatch.type },\n    'block rule matched for @{name} (type: @{type})'\n  );\n\n  const whitelistedVersions: string[] = allowMatch ? allowMatch.versions : [];\n  let blockRule: ParsedConfigRule = {\n    versions: [new Range('*')],\n    strategy: 'block',\n  };\n\n  if (blockMatch.type === MatchType.SCOPE) {\n    if (whitelistedVersions.length === 0) {\n      debug('blocking all versions of %s (scope %s blocked)', manifest.name, blockMatch.scope);\n      logger.trace(\n        { name: manifest.name, scope: blockMatch.scope },\n        'all versions of @{name} blocked (scope @{scope})'\n      );\n      return {\n        ...manifest,\n        versions: {},\n        readme: `All packages in scope ${blockMatch.scope} are blocked by rule`,\n      };\n    }\n  } else if (blockMatch.type === MatchType.PACKAGE) {\n    if (whitelistedVersions.length === 0) {\n      debug('blocking all versions of %s (package blocked)', manifest.name);\n      logger.trace({ name: manifest.name }, 'all versions of @{name} blocked (package rule)');\n      return {\n        ...manifest,\n        versions: {},\n        readme: `All package versions are blocked by rule`,\n      };\n    }\n  } else {\n    blockRule = { ...blockRule, ...blockMatch.rule };\n  }\n\n  const versionRanges = blockRule.versions;\n\n  if (blockRule.strategy === 'block') {\n    const blockedVersions = blockMatch.versions.filter((v) => !whitelistedVersions.includes(v));\n    for (const version of blockedVersions) {\n      delete manifest.versions[version];\n    }\n\n    if (blockedVersions.length > 0) {\n      debug(\n        'blocked %d versions of %s: %o',\n        blockedVersions.length,\n        manifest.name,\n        blockedVersions\n      );\n      logger.trace(\n        {\n          name: manifest.name,\n          count: blockedVersions.length,\n          versions: blockedVersions.join(', '),\n        },\n        '@{count} versions of @{name} blocked: @{versions}'\n      );\n      // Add debug info for devs\n      manifest.readme =\n        (manifest.readme || '') +\n        `\\nSome versions(${blockedVersions.length}) of package are blocked by rules: ${versionRanges.map(\n          (range) => range.raw\n        )}`;\n    }\n\n    return manifest;\n  }\n\n  // Process block rule strategy 'replace'.\n  // We assume that the order of versions is already sorted.\n  const nonBlockedVersions = { ...manifest.versions };\n  const newVersionsMapping: Record<string, string | null> = {};\n\n  versionRanges.forEach((versionRange) => {\n    const allVersions = Object.keys(nonBlockedVersions);\n\n    let lastNonBlockedVersion: string | null = null;\n\n    allVersions.forEach((version) => {\n      if (\n        !whitelistedVersions.includes(version) &&\n        satisfies(version, versionRange, {\n          includePrerelease: true,\n          loose: true,\n        })\n      ) {\n        delete nonBlockedVersions[version];\n        newVersionsMapping[version] = lastNonBlockedVersion;\n      } else {\n        lastNonBlockedVersion = version;\n      }\n    });\n  });\n\n  debug('replacing versions for %s: %o', manifest.name, newVersionsMapping);\n\n  const removedVersions = Object.entries(newVersionsMapping).filter(\n    ([_, replace]) => replace === null\n  ) as [string, null][];\n  const replacedVersions = Object.entries(newVersionsMapping).filter(\n    ([_, replace]) => replace !== null\n  ) as [string, string][];\n\n  removedVersions.forEach(([version]) => {\n    debug('no version to replace %s in %s', version, manifest.name);\n    logger.trace(\n      { name: manifest.name, version },\n      'version @{version} of @{name} removed (no replacement available)'\n    );\n    delete manifest.versions[version];\n  });\n\n  replacedVersions.forEach(([version, replaceVersion]) => {\n    logger.trace(\n      { name: manifest.name, version, replaceVersion },\n      'version @{version} of @{name} replaced with @{replaceVersion}'\n    );\n    manifest.versions[version] = {\n      ...manifest.versions[replaceVersion],\n      version,\n    };\n  });\n\n  if (removedVersions.length > 0) {\n    manifest.readme +=\n      `\\nSome versions of package could not be replaced and thus are fully blocked (${removedVersions.length}):` +\n      ` ${removedVersions.map((a) => a[0])}`;\n  }\n\n  if (replacedVersions.length > 0) {\n    manifest.readme +=\n      `\\nSome versions of package are replaced by other(${replacedVersions.length}):` +\n      ` ${replacedVersions.map((a) => `${a[0]} => ${a[1]}`)}`;\n  }\n\n  return manifest;\n}\n"],"mappings":";;;;;;;AASA,IAAM,WAAA,GAAA,MAAA,SAAmB,yCAAyC;;;;;;;;;;;;;;;;;;AAmBlE,SAAgB,sBACd,UACA,YACA,YACA,QACU;CACV,MAAM,aAAa,gBAAA,WAAW,UAAU,WAAW;AACnD,KACE,eACC,WAAW,SAAS,cAAA,UAAU,SAAS,WAAW,SAAS,cAAA,UAAU,UACtE;AAEA,SAAO,MAAM,EAAE,MAAM,SAAS,MAAM,EAAE,wDAAwD;AAC9F,SAAO;;CAGT,MAAM,aAAa,gBAAA,WAAW,UAAU,WAAW;AACnD,KAAI,CAAC,WAEH,QAAO;AAGT,QAAO,MACL;EAAE,MAAM,SAAS;EAAM,MAAM,WAAW;EAAM,EAC9C,iDACD;CAED,MAAM,sBAAgC,aAAa,WAAW,WAAW,EAAE;CAC3E,IAAI,YAA8B;EAChC,UAAU,CAAC,IAAI,OAAA,MAAM,IAAI,CAAC;EAC1B,UAAU;EACX;AAED,KAAI,WAAW,SAAS,cAAA,UAAU;MAC5B,oBAAoB,WAAW,GAAG;AACpC,WAAM,kDAAkD,SAAS,MAAM,WAAW,MAAM;AACxF,UAAO,MACL;IAAE,MAAM,SAAS;IAAM,OAAO,WAAW;IAAO,EAChD,mDACD;AACD,UAAO;IACL,GAAG;IACH,UAAU,EAAE;IACZ,QAAQ,yBAAyB,WAAW,MAAM;IACnD;;YAEM,WAAW,SAAS,cAAA,UAAU;MACnC,oBAAoB,WAAW,GAAG;AACpC,WAAM,iDAAiD,SAAS,KAAK;AACrE,UAAO,MAAM,EAAE,MAAM,SAAS,MAAM,EAAE,iDAAiD;AACvF,UAAO;IACL,GAAG;IACH,UAAU,EAAE;IACZ,QAAQ;IACT;;OAGH,aAAY;EAAE,GAAG;EAAW,GAAG,WAAW;EAAM;CAGlD,MAAM,gBAAgB,UAAU;AAEhC,KAAI,UAAU,aAAa,SAAS;EAClC,MAAM,kBAAkB,WAAW,SAAS,QAAQ,MAAM,CAAC,oBAAoB,SAAS,EAAE,CAAC;AAC3F,OAAK,MAAM,WAAW,gBACpB,QAAO,SAAS,SAAS;AAG3B,MAAI,gBAAgB,SAAS,GAAG;AAC9B,WACE,iCACA,gBAAgB,QAChB,SAAS,MACT,gBACD;AACD,UAAO,MACL;IACE,MAAM,SAAS;IACf,OAAO,gBAAgB;IACvB,UAAU,gBAAgB,KAAK,KAAK;IACrC,EACD,oDACD;AAED,YAAS,UACN,SAAS,UAAU,MACpB,mBAAmB,gBAAgB,OAAO,qCAAqC,cAAc,KAC1F,UAAU,MAAM,IAClB;;AAGL,SAAO;;CAKT,MAAM,qBAAqB,EAAE,GAAG,SAAS,UAAU;CACnD,MAAM,qBAAoD,EAAE;AAE5D,eAAc,SAAS,iBAAiB;EACtC,MAAM,cAAc,OAAO,KAAK,mBAAmB;EAEnD,IAAI,wBAAuC;AAE3C,cAAY,SAAS,YAAY;AAC/B,OACE,CAAC,oBAAoB,SAAS,QAAQ,KAAA,GAAA,OAAA,WAC5B,SAAS,cAAc;IAC/B,mBAAmB;IACnB,OAAO;IACR,CAAC,EACF;AACA,WAAO,mBAAmB;AAC1B,uBAAmB,WAAW;SAE9B,yBAAwB;IAE1B;GACF;AAEF,SAAM,iCAAiC,SAAS,MAAM,mBAAmB;CAEzE,MAAM,kBAAkB,OAAO,QAAQ,mBAAmB,CAAC,QACxD,CAAC,GAAG,aAAa,YAAY,KAC/B;CACD,MAAM,mBAAmB,OAAO,QAAQ,mBAAmB,CAAC,QACzD,CAAC,GAAG,aAAa,YAAY,KAC/B;AAED,iBAAgB,SAAS,CAAC,aAAa;AACrC,UAAM,kCAAkC,SAAS,SAAS,KAAK;AAC/D,SAAO,MACL;GAAE,MAAM,SAAS;GAAM;GAAS,EAChC,mEACD;AACD,SAAO,SAAS,SAAS;GACzB;AAEF,kBAAiB,SAAS,CAAC,SAAS,oBAAoB;AACtD,SAAO,MACL;GAAE,MAAM,SAAS;GAAM;GAAS;GAAgB,EAChD,gEACD;AACD,WAAS,SAAS,WAAW;GAC3B,GAAG,SAAS,SAAS;GACrB;GACD;GACD;AAEF,KAAI,gBAAgB,SAAS,EAC3B,UAAS,UACP,gFAAgF,gBAAgB,OAAO,KACnG,gBAAgB,KAAK,MAAM,EAAE,GAAG;AAGxC,KAAI,iBAAiB,SAAS,EAC5B,UAAS,UACP,oDAAoD,iBAAiB,OAAO,KACxE,iBAAiB,KAAK,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK;AAGzD,QAAO"}

package/build/filtering/packageVersion.mjs

@@ -0,0 +1,127 @@
+import { MatchType } from "./types.mjs";
+import { matchRules } from "./matcher.mjs";
+import buildDebug from "debug";
+import { Range, satisfies } from "semver";
+//#region src/filtering/packageVersion.ts
+var debug = buildDebug("verdaccio:plugin:package-filter:filter");
+/**
+* Filter out all blocked package versions.
+* If package or scope is blocked, then block all versions.
+*
+* TODO: consider adding a `prerelease` filter option to block/allow
+* prerelease versions independently. Currently prereleases are matched by
+* semver ranges with `includePrerelease: true`, but there's no dedicated toggle.
+*
+* Example config (not yet implemented):
+*   block:
+*     - package: 'foo'
+*       prerelease: true    # block 1.0.0-beta.1, 2.0.0-rc.1, keep 1.0.0, 2.0.0
+*     - package: 'bar'
+*       prerelease: false   # block 1.0.0, 2.0.0, keep 1.0.0-beta.1
+*
+* Today the only workaround is using awkward ranges like ">=1.0.0-0 <1.0.0".
+*/
+function filterBlockedVersions(manifest, blockRules, allowRules, logger) {
+	const allowMatch = matchRules(manifest, allowRules);
+	if (allowMatch && (allowMatch.type === MatchType.SCOPE || allowMatch.type === MatchType.PACKAGE)) {
+		logger.trace({ name: manifest.name }, "package @{name} is allow-listed, skipping block rules");
+		return manifest;
+	}
+	const blockMatch = matchRules(manifest, blockRules);
+	if (!blockMatch) return manifest;
+	logger.trace({
+		name: manifest.name,
+		type: blockMatch.type
+	}, "block rule matched for @{name} (type: @{type})");
+	const whitelistedVersions = allowMatch ? allowMatch.versions : [];
+	let blockRule = {
+		versions: [new Range("*")],
+		strategy: "block"
+	};
+	if (blockMatch.type === MatchType.SCOPE) {
+		if (whitelistedVersions.length === 0) {
+			debug("blocking all versions of %s (scope %s blocked)", manifest.name, blockMatch.scope);
+			logger.trace({
+				name: manifest.name,
+				scope: blockMatch.scope
+			}, "all versions of @{name} blocked (scope @{scope})");
+			return {
+				...manifest,
+				versions: {},
+				readme: `All packages in scope ${blockMatch.scope} are blocked by rule`
+			};
+		}
+	} else if (blockMatch.type === MatchType.PACKAGE) {
+		if (whitelistedVersions.length === 0) {
+			debug("blocking all versions of %s (package blocked)", manifest.name);
+			logger.trace({ name: manifest.name }, "all versions of @{name} blocked (package rule)");
+			return {
+				...manifest,
+				versions: {},
+				readme: `All package versions are blocked by rule`
+			};
+		}
+	} else blockRule = {
+		...blockRule,
+		...blockMatch.rule
+	};
+	const versionRanges = blockRule.versions;
+	if (blockRule.strategy === "block") {
+		const blockedVersions = blockMatch.versions.filter((v) => !whitelistedVersions.includes(v));
+		for (const version of blockedVersions) delete manifest.versions[version];
+		if (blockedVersions.length > 0) {
+			debug("blocked %d versions of %s: %o", blockedVersions.length, manifest.name, blockedVersions);
+			logger.trace({
+				name: manifest.name,
+				count: blockedVersions.length,
+				versions: blockedVersions.join(", ")
+			}, "@{count} versions of @{name} blocked: @{versions}");
+			manifest.readme = (manifest.readme || "") + `\nSome versions(${blockedVersions.length}) of package are blocked by rules: ${versionRanges.map((range) => range.raw)}`;
+		}
+		return manifest;
+	}
+	const nonBlockedVersions = { ...manifest.versions };
+	const newVersionsMapping = {};
+	versionRanges.forEach((versionRange) => {
+		const allVersions = Object.keys(nonBlockedVersions);
+		let lastNonBlockedVersion = null;
+		allVersions.forEach((version) => {
+			if (!whitelistedVersions.includes(version) && satisfies(version, versionRange, {
+				includePrerelease: true,
+				loose: true
+			})) {
+				delete nonBlockedVersions[version];
+				newVersionsMapping[version] = lastNonBlockedVersion;
+			} else lastNonBlockedVersion = version;
+		});
+	});
+	debug("replacing versions for %s: %o", manifest.name, newVersionsMapping);
+	const removedVersions = Object.entries(newVersionsMapping).filter(([_, replace]) => replace === null);
+	const replacedVersions = Object.entries(newVersionsMapping).filter(([_, replace]) => replace !== null);
+	removedVersions.forEach(([version]) => {
+		debug("no version to replace %s in %s", version, manifest.name);
+		logger.trace({
+			name: manifest.name,
+			version
+		}, "version @{version} of @{name} removed (no replacement available)");
+		delete manifest.versions[version];
+	});
+	replacedVersions.forEach(([version, replaceVersion]) => {
+		logger.trace({
+			name: manifest.name,
+			version,
+			replaceVersion
+		}, "version @{version} of @{name} replaced with @{replaceVersion}");
+		manifest.versions[version] = {
+			...manifest.versions[replaceVersion],
+			version
+		};
+	});
+	if (removedVersions.length > 0) manifest.readme += `\nSome versions of package could not be replaced and thus are fully blocked (${removedVersions.length}): ${removedVersions.map((a) => a[0])}`;
+	if (replacedVersions.length > 0) manifest.readme += `\nSome versions of package are replaced by other(${replacedVersions.length}): ${replacedVersions.map((a) => `${a[0]} => ${a[1]}`)}`;
+	return manifest;
+}
+//#endregion
+export { filterBlockedVersions };
+
+//# sourceMappingURL=packageVersion.mjs.map

package/build/filtering/packageVersion.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageVersion.mjs","names":[],"sources":["../../src/filtering/packageVersion.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Range, satisfies } from 'semver';\n\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nimport type { ParsedConfigRule, ParsedRule } from '../config/types';\nimport { matchRules } from './matcher';\nimport { MatchType } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:filter');\n\n/**\n * Filter out all blocked package versions.\n * If package or scope is blocked, then block all versions.\n *\n * TODO: consider adding a `prerelease` filter option to block/allow\n * prerelease versions independently. Currently prereleases are matched by\n * semver ranges with `includePrerelease: true`, but there's no dedicated toggle.\n *\n * Example config (not yet implemented):\n *   block:\n *     - package: 'foo'\n *       prerelease: true    # block 1.0.0-beta.1, 2.0.0-rc.1, keep 1.0.0, 2.0.0\n *     - package: 'bar'\n *       prerelease: false   # block 1.0.0, 2.0.0, keep 1.0.0-beta.1\n *\n * Today the only workaround is using awkward ranges like \">=1.0.0-0 <1.0.0\".\n */\nexport function filterBlockedVersions(\n  manifest: Manifest,\n  blockRules: Map<string, ParsedRule>,\n  allowRules: Map<string, ParsedRule>,\n  logger: Logger\n): Manifest {\n  const allowMatch = matchRules(manifest, allowRules);\n  if (\n    allowMatch &&\n    (allowMatch.type === MatchType.SCOPE || allowMatch.type === MatchType.PACKAGE)\n  ) {\n    // An entire scope or package is whitelisted\n    logger.trace({ name: manifest.name }, 'package @{name} is allow-listed, skipping block rules');\n    return manifest;\n  }\n\n  const blockMatch = matchRules(manifest, blockRules);\n  if (!blockMatch) {\n    // No rule is blocking this package\n    return manifest;\n  }\n\n  logger.trace(\n    { name: manifest.name, type: blockMatch.type },\n    'block rule matched for @{name} (type: @{type})'\n  );\n\n  const whitelistedVersions: string[] = allowMatch ? allowMatch.versions : [];\n  let blockRule: ParsedConfigRule = {\n    versions: [new Range('*')],\n    strategy: 'block',\n  };\n\n  if (blockMatch.type === MatchType.SCOPE) {\n    if (whitelistedVersions.length === 0) {\n      debug('blocking all versions of %s (scope %s blocked)', manifest.name, blockMatch.scope);\n      logger.trace(\n        { name: manifest.name, scope: blockMatch.scope },\n        'all versions of @{name} blocked (scope @{scope})'\n      );\n      return {\n        ...manifest,\n        versions: {},\n        readme: `All packages in scope ${blockMatch.scope} are blocked by rule`,\n      };\n    }\n  } else if (blockMatch.type === MatchType.PACKAGE) {\n    if (whitelistedVersions.length === 0) {\n      debug('blocking all versions of %s (package blocked)', manifest.name);\n      logger.trace({ name: manifest.name }, 'all versions of @{name} blocked (package rule)');\n      return {\n        ...manifest,\n        versions: {},\n        readme: `All package versions are blocked by rule`,\n      };\n    }\n  } else {\n    blockRule = { ...blockRule, ...blockMatch.rule };\n  }\n\n  const versionRanges = blockRule.versions;\n\n  if (blockRule.strategy === 'block') {\n    const blockedVersions = blockMatch.versions.filter((v) => !whitelistedVersions.includes(v));\n    for (const version of blockedVersions) {\n      delete manifest.versions[version];\n    }\n\n    if (blockedVersions.length > 0) {\n      debug(\n        'blocked %d versions of %s: %o',\n        blockedVersions.length,\n        manifest.name,\n        blockedVersions\n      );\n      logger.trace(\n        {\n          name: manifest.name,\n          count: blockedVersions.length,\n          versions: blockedVersions.join(', '),\n        },\n        '@{count} versions of @{name} blocked: @{versions}'\n      );\n      // Add debug info for devs\n      manifest.readme =\n        (manifest.readme || '') +\n        `\\nSome versions(${blockedVersions.length}) of package are blocked by rules: ${versionRanges.map(\n          (range) => range.raw\n        )}`;\n    }\n\n    return manifest;\n  }\n\n  // Process block rule strategy 'replace'.\n  // We assume that the order of versions is already sorted.\n  const nonBlockedVersions = { ...manifest.versions };\n  const newVersionsMapping: Record<string, string | null> = {};\n\n  versionRanges.forEach((versionRange) => {\n    const allVersions = Object.keys(nonBlockedVersions);\n\n    let lastNonBlockedVersion: string | null = null;\n\n    allVersions.forEach((version) => {\n      if (\n        !whitelistedVersions.includes(version) &&\n        satisfies(version, versionRange, {\n          includePrerelease: true,\n          loose: true,\n        })\n      ) {\n        delete nonBlockedVersions[version];\n        newVersionsMapping[version] = lastNonBlockedVersion;\n      } else {\n        lastNonBlockedVersion = version;\n      }\n    });\n  });\n\n  debug('replacing versions for %s: %o', manifest.name, newVersionsMapping);\n\n  const removedVersions = Object.entries(newVersionsMapping).filter(\n    ([_, replace]) => replace === null\n  ) as [string, null][];\n  const replacedVersions = Object.entries(newVersionsMapping).filter(\n    ([_, replace]) => replace !== null\n  ) as [string, string][];\n\n  removedVersions.forEach(([version]) => {\n    debug('no version to replace %s in %s', version, manifest.name);\n    logger.trace(\n      { name: manifest.name, version },\n      'version @{version} of @{name} removed (no replacement available)'\n    );\n    delete manifest.versions[version];\n  });\n\n  replacedVersions.forEach(([version, replaceVersion]) => {\n    logger.trace(\n      { name: manifest.name, version, replaceVersion },\n      'version @{version} of @{name} replaced with @{replaceVersion}'\n    );\n    manifest.versions[version] = {\n      ...manifest.versions[replaceVersion],\n      version,\n    };\n  });\n\n  if (removedVersions.length > 0) {\n    manifest.readme +=\n      `\\nSome versions of package could not be replaced and thus are fully blocked (${removedVersions.length}):` +\n      ` ${removedVersions.map((a) => a[0])}`;\n  }\n\n  if (replacedVersions.length > 0) {\n    manifest.readme +=\n      `\\nSome versions of package are replaced by other(${replacedVersions.length}):` +\n      ` ${replacedVersions.map((a) => `${a[0]} => ${a[1]}`)}`;\n  }\n\n  return manifest;\n}\n"],"mappings":";;;;;AASA,IAAM,QAAQ,WAAW,yCAAyC;;;;;;;;;;;;;;;;;;AAmBlE,SAAgB,sBACd,UACA,YACA,YACA,QACU;CACV,MAAM,aAAa,WAAW,UAAU,WAAW;AACnD,KACE,eACC,WAAW,SAAS,UAAU,SAAS,WAAW,SAAS,UAAU,UACtE;AAEA,SAAO,MAAM,EAAE,MAAM,SAAS,MAAM,EAAE,wDAAwD;AAC9F,SAAO;;CAGT,MAAM,aAAa,WAAW,UAAU,WAAW;AACnD,KAAI,CAAC,WAEH,QAAO;AAGT,QAAO,MACL;EAAE,MAAM,SAAS;EAAM,MAAM,WAAW;EAAM,EAC9C,iDACD;CAED,MAAM,sBAAgC,aAAa,WAAW,WAAW,EAAE;CAC3E,IAAI,YAA8B;EAChC,UAAU,CAAC,IAAI,MAAM,IAAI,CAAC;EAC1B,UAAU;EACX;AAED,KAAI,WAAW,SAAS,UAAU;MAC5B,oBAAoB,WAAW,GAAG;AACpC,SAAM,kDAAkD,SAAS,MAAM,WAAW,MAAM;AACxF,UAAO,MACL;IAAE,MAAM,SAAS;IAAM,OAAO,WAAW;IAAO,EAChD,mDACD;AACD,UAAO;IACL,GAAG;IACH,UAAU,EAAE;IACZ,QAAQ,yBAAyB,WAAW,MAAM;IACnD;;YAEM,WAAW,SAAS,UAAU;MACnC,oBAAoB,WAAW,GAAG;AACpC,SAAM,iDAAiD,SAAS,KAAK;AACrE,UAAO,MAAM,EAAE,MAAM,SAAS,MAAM,EAAE,iDAAiD;AACvF,UAAO;IACL,GAAG;IACH,UAAU,EAAE;IACZ,QAAQ;IACT;;OAGH,aAAY;EAAE,GAAG;EAAW,GAAG,WAAW;EAAM;CAGlD,MAAM,gBAAgB,UAAU;AAEhC,KAAI,UAAU,aAAa,SAAS;EAClC,MAAM,kBAAkB,WAAW,SAAS,QAAQ,MAAM,CAAC,oBAAoB,SAAS,EAAE,CAAC;AAC3F,OAAK,MAAM,WAAW,gBACpB,QAAO,SAAS,SAAS;AAG3B,MAAI,gBAAgB,SAAS,GAAG;AAC9B,SACE,iCACA,gBAAgB,QAChB,SAAS,MACT,gBACD;AACD,UAAO,MACL;IACE,MAAM,SAAS;IACf,OAAO,gBAAgB;IACvB,UAAU,gBAAgB,KAAK,KAAK;IACrC,EACD,oDACD;AAED,YAAS,UACN,SAAS,UAAU,MACpB,mBAAmB,gBAAgB,OAAO,qCAAqC,cAAc,KAC1F,UAAU,MAAM,IAClB;;AAGL,SAAO;;CAKT,MAAM,qBAAqB,EAAE,GAAG,SAAS,UAAU;CACnD,MAAM,qBAAoD,EAAE;AAE5D,eAAc,SAAS,iBAAiB;EACtC,MAAM,cAAc,OAAO,KAAK,mBAAmB;EAEnD,IAAI,wBAAuC;AAE3C,cAAY,SAAS,YAAY;AAC/B,OACE,CAAC,oBAAoB,SAAS,QAAQ,IACtC,UAAU,SAAS,cAAc;IAC/B,mBAAmB;IACnB,OAAO;IACR,CAAC,EACF;AACA,WAAO,mBAAmB;AAC1B,uBAAmB,WAAW;SAE9B,yBAAwB;IAE1B;GACF;AAEF,OAAM,iCAAiC,SAAS,MAAM,mBAAmB;CAEzE,MAAM,kBAAkB,OAAO,QAAQ,mBAAmB,CAAC,QACxD,CAAC,GAAG,aAAa,YAAY,KAC/B;CACD,MAAM,mBAAmB,OAAO,QAAQ,mBAAmB,CAAC,QACzD,CAAC,GAAG,aAAa,YAAY,KAC/B;AAED,iBAAgB,SAAS,CAAC,aAAa;AACrC,QAAM,kCAAkC,SAAS,SAAS,KAAK;AAC/D,SAAO,MACL;GAAE,MAAM,SAAS;GAAM;GAAS,EAChC,mEACD;AACD,SAAO,SAAS,SAAS;GACzB;AAEF,kBAAiB,SAAS,CAAC,SAAS,oBAAoB;AACtD,SAAO,MACL;GAAE,MAAM,SAAS;GAAM;GAAS;GAAgB,EAChD,gEACD;AACD,WAAS,SAAS,WAAW;GAC3B,GAAG,SAAS,SAAS;GACrB;GACD;GACD;AAEF,KAAI,gBAAgB,SAAS,EAC3B,UAAS,UACP,gFAAgF,gBAAgB,OAAO,KACnG,gBAAgB,KAAK,MAAM,EAAE,GAAG;AAGxC,KAAI,iBAAiB,SAAS,EAC5B,UAAS,UACP,oDAAoD,iBAAiB,OAAO,KACxE,iBAAiB,KAAK,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK;AAGzD,QAAO"}

package/build/filtering/publishDate.d.ts

@@ -0,0 +1,6 @@
+import { Manifest } from '@verdaccio/types';
+import { ParsedRule } from '../config/types';
+/**
+ * Filter out all package versions that were published after dateThreshold.
+ */
+export declare function filterVersionsByPublishDate(manifest: Manifest, dateThreshold: Date, allowRules: Map<string, ParsedRule>): Manifest;

package/build/filtering/publishDate.js

@@ -0,0 +1,33 @@
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+const require_types = require("./types.js");
+const require_matcher = require("./matcher.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+//#region src/filtering/publishDate.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter:filter");
+/**
+* Filter out all package versions that were published after dateThreshold.
+*/
+function filterVersionsByPublishDate(manifest, dateThreshold, allowRules) {
+	const allowMatch = require_matcher.matchRules(manifest, allowRules);
+	if (allowMatch && (allowMatch.type === require_types.MatchType.SCOPE || allowMatch.type === require_types.MatchType.PACKAGE)) return manifest;
+	const { versions, time, name } = manifest;
+	if (!time) throw new TypeError(`Time of publication was not provided for package ${name}`);
+	const whitelistedVersions = allowMatch ? allowMatch.versions : [];
+	const clearVersions = [];
+	Object.keys(versions).forEach((version) => {
+		if (whitelistedVersions.includes(version)) return;
+		const publishTime = time[version];
+		if (!publishTime) throw new TypeError(`Time of publication was not provided for package ${name}, version ${version}`);
+		if (new Date(publishTime) > dateThreshold) clearVersions.push(version);
+	});
+	clearVersions.forEach((version) => {
+		delete manifest.versions[version];
+	});
+	if (clearVersions.length > 0) debug$1("date filter removed %d versions from %s: %o", clearVersions.length, manifest.name, clearVersions);
+	return manifest;
+}
+//#endregion
+exports.filterVersionsByPublishDate = filterVersionsByPublishDate;
+
+//# sourceMappingURL=publishDate.js.map

package/build/filtering/publishDate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishDate.js","names":[],"sources":["../../src/filtering/publishDate.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { ParsedRule } from '../config/types';\nimport { matchRules } from './matcher';\nimport { MatchType } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:filter');\n\n/**\n * Filter out all package versions that were published after dateThreshold.\n */\nexport function filterVersionsByPublishDate(\n  manifest: Manifest,\n  dateThreshold: Date,\n  allowRules: Map<string, ParsedRule>\n): Manifest {\n  const allowMatch = matchRules(manifest, allowRules);\n  if (\n    allowMatch &&\n    (allowMatch.type === MatchType.SCOPE || allowMatch.type === MatchType.PACKAGE)\n  ) {\n    // An entire scope or package is whitelisted\n    return manifest;\n  }\n\n  const { versions, time, name } = manifest;\n\n  if (!time) {\n    throw new TypeError(`Time of publication was not provided for package ${name}`);\n  }\n\n  const whitelistedVersions: string[] = allowMatch ? allowMatch.versions : [];\n  const clearVersions: string[] = [];\n\n  Object.keys(versions).forEach((version) => {\n    if (whitelistedVersions.includes(version)) {\n      return;\n    }\n\n    const publishTime = time[version];\n\n    if (!publishTime) {\n      throw new TypeError(\n        `Time of publication was not provided for package ${name}, version ${version}`\n      );\n    }\n\n    if (new Date(publishTime) > dateThreshold) {\n      // clear untrusted version\n      clearVersions.push(version);\n    }\n  });\n\n  // delete version from versions\n  clearVersions.forEach((version) => {\n    delete manifest.versions[version];\n  });\n\n  if (clearVersions.length > 0) {\n    debug(\n      'date filter removed %d versions from %s: %o',\n      clearVersions.length,\n      manifest.name,\n      clearVersions\n    );\n  }\n\n  return manifest;\n}\n"],"mappings":";;;;;;AAQA,IAAM,WAAA,GAAA,MAAA,SAAmB,yCAAyC;;;;AAKlE,SAAgB,4BACd,UACA,eACA,YACU;CACV,MAAM,aAAa,gBAAA,WAAW,UAAU,WAAW;AACnD,KACE,eACC,WAAW,SAAS,cAAA,UAAU,SAAS,WAAW,SAAS,cAAA,UAAU,SAGtE,QAAO;CAGT,MAAM,EAAE,UAAU,MAAM,SAAS;AAEjC,KAAI,CAAC,KACH,OAAM,IAAI,UAAU,oDAAoD,OAAO;CAGjF,MAAM,sBAAgC,aAAa,WAAW,WAAW,EAAE;CAC3E,MAAM,gBAA0B,EAAE;AAElC,QAAO,KAAK,SAAS,CAAC,SAAS,YAAY;AACzC,MAAI,oBAAoB,SAAS,QAAQ,CACvC;EAGF,MAAM,cAAc,KAAK;AAEzB,MAAI,CAAC,YACH,OAAM,IAAI,UACR,oDAAoD,KAAK,YAAY,UACtE;AAGH,MAAI,IAAI,KAAK,YAAY,GAAG,cAE1B,eAAc,KAAK,QAAQ;GAE7B;AAGF,eAAc,SAAS,YAAY;AACjC,SAAO,SAAS,SAAS;GACzB;AAEF,KAAI,cAAc,SAAS,EACzB,SACE,+CACA,cAAc,QACd,SAAS,MACT,cACD;AAGH,QAAO"}

package/build/filtering/publishDate.mjs

@@ -0,0 +1,31 @@
+import { MatchType } from "./types.mjs";
+import { matchRules } from "./matcher.mjs";
+import buildDebug from "debug";
+//#region src/filtering/publishDate.ts
+var debug = buildDebug("verdaccio:plugin:package-filter:filter");
+/**
+* Filter out all package versions that were published after dateThreshold.
+*/
+function filterVersionsByPublishDate(manifest, dateThreshold, allowRules) {
+	const allowMatch = matchRules(manifest, allowRules);
+	if (allowMatch && (allowMatch.type === MatchType.SCOPE || allowMatch.type === MatchType.PACKAGE)) return manifest;
+	const { versions, time, name } = manifest;
+	if (!time) throw new TypeError(`Time of publication was not provided for package ${name}`);
+	const whitelistedVersions = allowMatch ? allowMatch.versions : [];
+	const clearVersions = [];
+	Object.keys(versions).forEach((version) => {
+		if (whitelistedVersions.includes(version)) return;
+		const publishTime = time[version];
+		if (!publishTime) throw new TypeError(`Time of publication was not provided for package ${name}, version ${version}`);
+		if (new Date(publishTime) > dateThreshold) clearVersions.push(version);
+	});
+	clearVersions.forEach((version) => {
+		delete manifest.versions[version];
+	});
+	if (clearVersions.length > 0) debug("date filter removed %d versions from %s: %o", clearVersions.length, manifest.name, clearVersions);
+	return manifest;
+}
+//#endregion
+export { filterVersionsByPublishDate };
+
+//# sourceMappingURL=publishDate.mjs.map

package/build/filtering/publishDate.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"publishDate.mjs","names":[],"sources":["../../src/filtering/publishDate.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport type { Manifest } from '@verdaccio/types';\n\nimport type { ParsedRule } from '../config/types';\nimport { matchRules } from './matcher';\nimport { MatchType } from './types';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter:filter');\n\n/**\n * Filter out all package versions that were published after dateThreshold.\n */\nexport function filterVersionsByPublishDate(\n  manifest: Manifest,\n  dateThreshold: Date,\n  allowRules: Map<string, ParsedRule>\n): Manifest {\n  const allowMatch = matchRules(manifest, allowRules);\n  if (\n    allowMatch &&\n    (allowMatch.type === MatchType.SCOPE || allowMatch.type === MatchType.PACKAGE)\n  ) {\n    // An entire scope or package is whitelisted\n    return manifest;\n  }\n\n  const { versions, time, name } = manifest;\n\n  if (!time) {\n    throw new TypeError(`Time of publication was not provided for package ${name}`);\n  }\n\n  const whitelistedVersions: string[] = allowMatch ? allowMatch.versions : [];\n  const clearVersions: string[] = [];\n\n  Object.keys(versions).forEach((version) => {\n    if (whitelistedVersions.includes(version)) {\n      return;\n    }\n\n    const publishTime = time[version];\n\n    if (!publishTime) {\n      throw new TypeError(\n        `Time of publication was not provided for package ${name}, version ${version}`\n      );\n    }\n\n    if (new Date(publishTime) > dateThreshold) {\n      // clear untrusted version\n      clearVersions.push(version);\n    }\n  });\n\n  // delete version from versions\n  clearVersions.forEach((version) => {\n    delete manifest.versions[version];\n  });\n\n  if (clearVersions.length > 0) {\n    debug(\n      'date filter removed %d versions from %s: %o',\n      clearVersions.length,\n      manifest.name,\n      clearVersions\n    );\n  }\n\n  return manifest;\n}\n"],"mappings":";;;;AAQA,IAAM,QAAQ,WAAW,yCAAyC;;;;AAKlE,SAAgB,4BACd,UACA,eACA,YACU;CACV,MAAM,aAAa,WAAW,UAAU,WAAW;AACnD,KACE,eACC,WAAW,SAAS,UAAU,SAAS,WAAW,SAAS,UAAU,SAGtE,QAAO;CAGT,MAAM,EAAE,UAAU,MAAM,SAAS;AAEjC,KAAI,CAAC,KACH,OAAM,IAAI,UAAU,oDAAoD,OAAO;CAGjF,MAAM,sBAAgC,aAAa,WAAW,WAAW,EAAE;CAC3E,MAAM,gBAA0B,EAAE;AAElC,QAAO,KAAK,SAAS,CAAC,SAAS,YAAY;AACzC,MAAI,oBAAoB,SAAS,QAAQ,CACvC;EAGF,MAAM,cAAc,KAAK;AAEzB,MAAI,CAAC,YACH,OAAM,IAAI,UACR,oDAAoD,KAAK,YAAY,UACtE;AAGH,MAAI,IAAI,KAAK,YAAY,GAAG,cAE1B,eAAc,KAAK,QAAQ;GAE7B;AAGF,eAAc,SAAS,YAAY;AACjC,SAAO,SAAS,SAAS;GACzB;AAEF,KAAI,cAAc,SAAS,EACzB,OACE,+CACA,cAAc,QACd,SAAS,MACT,cACD;AAGH,QAAO"}

package/build/filtering/types.d.ts

@@ -0,0 +1,24 @@
+import { PackageScopeLevel, ParsedConfigRule } from '../config/types';
+export declare enum MatchType {
+    SCOPE = "scope",
+    PACKAGE = "package",
+    VERSIONS = "versions"
+}
+export interface MatchResultVersions {
+    versions: string[];
+}
+export interface MatchScopeResult extends MatchResultVersions {
+    type: MatchType.SCOPE;
+    rule: PackageScopeLevel;
+    scope: string;
+}
+export interface MatchPackageResult extends MatchResultVersions {
+    type: MatchType.PACKAGE;
+    rule: PackageScopeLevel;
+    package: string;
+}
+export interface MatchVersionsResult extends MatchResultVersions {
+    type: MatchType.VERSIONS;
+    rule: ParsedConfigRule;
+}
+export type MatchResult = MatchScopeResult | MatchPackageResult | MatchVersionsResult;

package/build/filtering/types.js

@@ -0,0 +1,11 @@
+//#region src/filtering/types.ts
+var MatchType = /* @__PURE__ */ function(MatchType) {
+	MatchType["SCOPE"] = "scope";
+	MatchType["PACKAGE"] = "package";
+	MatchType["VERSIONS"] = "versions";
+	return MatchType;
+}({});
+//#endregion
+exports.MatchType = MatchType;
+
+//# sourceMappingURL=types.js.map

package/build/filtering/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":[],"sources":["../../src/filtering/types.ts"],"sourcesContent":["import { PackageScopeLevel, ParsedConfigRule } from '../config/types';\n\nexport enum MatchType {\n  SCOPE = 'scope',\n  PACKAGE = 'package',\n  VERSIONS = 'versions',\n}\n\nexport interface MatchResultVersions {\n  versions: string[];\n}\n\nexport interface MatchScopeResult extends MatchResultVersions {\n  type: MatchType.SCOPE;\n  rule: PackageScopeLevel;\n  scope: string;\n}\n\nexport interface MatchPackageResult extends MatchResultVersions {\n  type: MatchType.PACKAGE;\n  rule: PackageScopeLevel;\n  package: string;\n}\n\nexport interface MatchVersionsResult extends MatchResultVersions {\n  type: MatchType.VERSIONS;\n  rule: ParsedConfigRule;\n}\n\nexport type MatchResult = MatchScopeResult | MatchPackageResult | MatchVersionsResult;\n"],"mappings":";AAEA,IAAY,YAAL,yBAAA,WAAA;AACL,WAAA,WAAA;AACA,WAAA,aAAA;AACA,WAAA,cAAA;;KACD"}

package/build/filtering/types.mjs

@@ -0,0 +1,11 @@
+//#region src/filtering/types.ts
+var MatchType = /* @__PURE__ */ function(MatchType) {
+	MatchType["SCOPE"] = "scope";
+	MatchType["PACKAGE"] = "package";
+	MatchType["VERSIONS"] = "versions";
+	return MatchType;
+}({});
+//#endregion
+export { MatchType };
+
+//# sourceMappingURL=types.mjs.map

package/build/filtering/types.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.mjs","names":[],"sources":["../../src/filtering/types.ts"],"sourcesContent":["import { PackageScopeLevel, ParsedConfigRule } from '../config/types';\n\nexport enum MatchType {\n  SCOPE = 'scope',\n  PACKAGE = 'package',\n  VERSIONS = 'versions',\n}\n\nexport interface MatchResultVersions {\n  versions: string[];\n}\n\nexport interface MatchScopeResult extends MatchResultVersions {\n  type: MatchType.SCOPE;\n  rule: PackageScopeLevel;\n  scope: string;\n}\n\nexport interface MatchPackageResult extends MatchResultVersions {\n  type: MatchType.PACKAGE;\n  rule: PackageScopeLevel;\n  package: string;\n}\n\nexport interface MatchVersionsResult extends MatchResultVersions {\n  type: MatchType.VERSIONS;\n  rule: ParsedConfigRule;\n}\n\nexport type MatchResult = MatchScopeResult | MatchPackageResult | MatchVersionsResult;\n"],"mappings":";AAEA,IAAY,YAAL,yBAAA,WAAA;AACL,WAAA,WAAA;AACA,WAAA,aAAA;AACA,WAAA,cAAA;;KACD"}

package/build/index.d.ts

@@ -0,0 +1,3 @@
+import { PackageFilterPlugin } from './packageFilter';
+export { PackageFilterPlugin };
+export default PackageFilterPlugin;

package/build/index.js

@@ -0,0 +1,12 @@
+Object.defineProperties(exports, {
+	__esModule: { value: true },
+	[Symbol.toStringTag]: { value: "Module" }
+});
+const require_packageFilter = require("./packageFilter.js");
+//#region src/index.ts
+var src_default = require_packageFilter.PackageFilterPlugin;
+//#endregion
+exports.PackageFilterPlugin = require_packageFilter.PackageFilterPlugin;
+exports.default = src_default;
+
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { PackageFilterPlugin } from './packageFilter';\n\nexport { PackageFilterPlugin };\nexport default PackageFilterPlugin;\n"],"mappings":";;;;;;AAGA,IAAA,cAAe,sBAAA"}

package/build/index.mjs

@@ -0,0 +1,7 @@
+import { PackageFilterPlugin } from "./packageFilter.mjs";
+//#region src/index.ts
+var src_default = PackageFilterPlugin;
+//#endregion
+export { PackageFilterPlugin, src_default as default };
+
+//# sourceMappingURL=index.mjs.map

package/build/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import { PackageFilterPlugin } from './packageFilter';\n\nexport { PackageFilterPlugin };\nexport default PackageFilterPlugin;\n"],"mappings":";;AAGA,IAAA,cAAe"}

package/build/packageFilter.d.ts

@@ -0,0 +1,10 @@
+import { pluginUtils } from '@verdaccio/core';
+import { Logger, Manifest } from '@verdaccio/types';
+import { PluginConfig } from './config/types';
+export declare class PackageFilterPlugin extends pluginUtils.Plugin<PluginConfig> implements pluginUtils.ManifestFilter<PluginConfig> {
+    readonly config: PluginConfig;
+    private readonly parsedConfig;
+    protected readonly logger: Logger;
+    constructor(config: PluginConfig, options: pluginUtils.PluginOptions);
+    filter_metadata(manifest: Readonly<Manifest>): Promise<Manifest>;
+}

package/build/packageFilter.js

@@ -0,0 +1,80 @@
+const require_runtime = require("./_virtual/_rolldown/runtime.js");
+const require_parser = require("./config/parser.js");
+const require_packageVersion = require("./filtering/packageVersion.js");
+const require_publishDate = require("./filtering/publishDate.js");
+const require_jsonUtils = require("./utils/jsonUtils.js");
+const require_manifestUtils = require("./utils/manifestUtils.js");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_core = require("@verdaccio/core");
+//#region src/packageFilter.ts
+var debug$1 = (0, debug.default)("verdaccio:plugin:package-filter");
+var PackageFilterPlugin = class extends _verdaccio_core.pluginUtils.Plugin {
+	config;
+	parsedConfig;
+	logger;
+	constructor(config, options) {
+		super(config, options);
+		this.config = config ?? {};
+		this.logger = options.logger;
+		this.parsedConfig = require_parser.parseConfig(this.config);
+		debug$1("plugin loaded: block rules: %d, allow rules: %d", this.parsedConfig.blockRules.size, this.parsedConfig.allowRules.size);
+		this.logger.debug({ config: JSON.stringify(this.parsedConfig, require_jsonUtils.jsonLogReplacer) }, "package-filter loaded with config: @{config}");
+		this.logger.trace({
+			blockRules: this.parsedConfig.blockRules.size,
+			allowRules: this.parsedConfig.allowRules.size
+		}, "package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules");
+		if (this.parsedConfig.dateThreshold) {
+			debug$1("date threshold: %s", this.parsedConfig.dateThreshold.toISOString());
+			this.logger.trace({ dateThreshold: this.parsedConfig.dateThreshold.toISOString() }, "package-filter date threshold: @{dateThreshold}");
+		}
+		if (this.parsedConfig.minAgeMs) {
+			const minAgeDays = this.parsedConfig.minAgeMs / (1440 * 60 * 1e3);
+			debug$1("min age: %d days", minAgeDays);
+			this.logger.trace({ minAgeDays }, "package-filter min age: @{minAgeDays} days");
+		}
+	}
+	async filter_metadata(manifest) {
+		const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;
+		const versionCount = Object.keys(manifest.versions ?? {}).length;
+		debug$1("filtering manifest for %s (%d versions)", manifest.name, versionCount);
+		this.logger.trace({
+			name: manifest.name,
+			versionCount
+		}, "package-filter processing @{name} (@{versionCount} versions)");
+		let newManifest = require_manifestUtils.getManifestClone(manifest);
+		if (blockRules.size > 0) newManifest = require_packageVersion.filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);
+		let earliestDateThreshold = null;
+		if (minAgeMs) earliestDateThreshold = new Date(Date.now() - minAgeMs);
+		if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) earliestDateThreshold = dateThreshold;
+		if (earliestDateThreshold) {
+			debug$1("applying date filter for %s, threshold: %s", manifest.name, earliestDateThreshold.toISOString());
+			this.logger.trace({
+				name: manifest.name,
+				threshold: earliestDateThreshold.toISOString()
+			}, "applying date filter for @{name}, cutoff: @{threshold}");
+			newManifest = require_publishDate.filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);
+		}
+		require_manifestUtils.cleanupTags(newManifest);
+		require_manifestUtils.setupLatestTag(newManifest);
+		require_manifestUtils.cleanupTime(newManifest);
+		require_manifestUtils.setupCreatedAndModified(newManifest);
+		require_manifestUtils.cleanupDistFiles(newManifest);
+		const filteredCount = Object.keys(newManifest.versions).length;
+		const removedCount = versionCount - filteredCount;
+		if (filteredCount !== versionCount) {
+			debug$1("filtered %s: %d -> %d versions (%d removed)", manifest.name, versionCount, filteredCount, removedCount);
+			this.logger.trace({
+				name: manifest.name,
+				before: versionCount,
+				after: filteredCount,
+				removed: removedCount
+			}, "package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)");
+		} else debug$1("no versions filtered for %s", manifest.name);
+		return newManifest;
+	}
+};
+//#endregion
+exports.PackageFilterPlugin = PackageFilterPlugin;
+
+//# sourceMappingURL=packageFilter.js.map

package/build/packageFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageFilter.js","names":[],"sources":["../src/packageFilter.ts"],"sourcesContent":["import buildDebug from 'debug';\n\nimport { pluginUtils } from '@verdaccio/core';\nimport type { Logger, Manifest } from '@verdaccio/types';\n\nimport { parseConfig } from './config/parser';\nimport type { ParsedConfig, PluginConfig } from './config/types';\nimport { filterBlockedVersions } from './filtering/packageVersion';\nimport { filterVersionsByPublishDate } from './filtering/publishDate';\nimport { jsonLogReplacer } from './utils/jsonUtils';\nimport {\n  cleanupDistFiles,\n  cleanupTags,\n  cleanupTime,\n  getManifestClone,\n  setupCreatedAndModified,\n  setupLatestTag,\n} from './utils/manifestUtils';\n\nconst debug = buildDebug('verdaccio:plugin:package-filter');\n\nexport class PackageFilterPlugin\n  extends pluginUtils.Plugin<PluginConfig>\n  implements pluginUtils.ManifestFilter<PluginConfig>\n{\n  public readonly config: PluginConfig;\n  private readonly parsedConfig: ParsedConfig;\n  protected readonly logger: Logger;\n\n  public constructor(config: PluginConfig, options: pluginUtils.PluginOptions) {\n    super(config, options);\n    this.config = config ?? {};\n    this.logger = options.logger;\n    this.parsedConfig = parseConfig(this.config);\n\n    debug(\n      'plugin loaded: block rules: %d, allow rules: %d',\n      this.parsedConfig.blockRules.size,\n      this.parsedConfig.allowRules.size\n    );\n    this.logger.debug(\n      { config: JSON.stringify(this.parsedConfig, jsonLogReplacer) },\n      'package-filter loaded with config: @{config}'\n    );\n    this.logger.trace(\n      {\n        blockRules: this.parsedConfig.blockRules.size,\n        allowRules: this.parsedConfig.allowRules.size,\n      },\n      'package-filter plugin initialized: @{blockRules} block rules, @{allowRules} allow rules'\n    );\n    if (this.parsedConfig.dateThreshold) {\n      debug('date threshold: %s', this.parsedConfig.dateThreshold.toISOString());\n      this.logger.trace(\n        { dateThreshold: this.parsedConfig.dateThreshold.toISOString() },\n        'package-filter date threshold: @{dateThreshold}'\n      );\n    }\n    if (this.parsedConfig.minAgeMs) {\n      const minAgeDays = this.parsedConfig.minAgeMs / (24 * 60 * 60 * 1000);\n      debug('min age: %d days', minAgeDays);\n      this.logger.trace({ minAgeDays }, 'package-filter min age: @{minAgeDays} days');\n    }\n  }\n\n  public async filter_metadata(manifest: Readonly<Manifest>): Promise<Manifest> {\n    const { dateThreshold, minAgeMs, blockRules, allowRules } = this.parsedConfig;\n    const versionCount = Object.keys(manifest.versions ?? {}).length;\n    debug('filtering manifest for %s (%d versions)', manifest.name, versionCount);\n    this.logger.trace(\n      { name: manifest.name, versionCount },\n      'package-filter processing @{name} (@{versionCount} versions)'\n    );\n\n    let newManifest = getManifestClone(manifest);\n    if (blockRules.size > 0) {\n      newManifest = filterBlockedVersions(newManifest, blockRules, allowRules, this.logger);\n    }\n\n    let earliestDateThreshold: Date | null = null;\n    if (minAgeMs) {\n      earliestDateThreshold = new Date(Date.now() - minAgeMs);\n    }\n\n    if (dateThreshold && (!earliestDateThreshold || dateThreshold < earliestDateThreshold)) {\n      earliestDateThreshold = dateThreshold;\n    }\n\n    if (earliestDateThreshold) {\n      debug(\n        'applying date filter for %s, threshold: %s',\n        manifest.name,\n        earliestDateThreshold.toISOString()\n      );\n      this.logger.trace(\n        { name: manifest.name, threshold: earliestDateThreshold.toISOString() },\n        'applying date filter for @{name}, cutoff: @{threshold}'\n      );\n      newManifest = filterVersionsByPublishDate(newManifest, earliestDateThreshold, allowRules);\n    }\n\n    cleanupTags(newManifest);\n    setupLatestTag(newManifest);\n    cleanupTime(newManifest);\n    setupCreatedAndModified(newManifest);\n    cleanupDistFiles(newManifest);\n\n    const filteredCount = Object.keys(newManifest.versions).length;\n    const removedCount = versionCount - filteredCount;\n    if (filteredCount !== versionCount) {\n      debug(\n        'filtered %s: %d -> %d versions (%d removed)',\n        manifest.name,\n        versionCount,\n        filteredCount,\n        removedCount\n      );\n      this.logger.trace(\n        { name: manifest.name, before: versionCount, after: filteredCount, removed: removedCount },\n        'package-filter @{name}: @{before} -> @{after} versions (@{removed} removed)'\n      );\n    } else {\n      debug('no versions filtered for %s', manifest.name);\n    }\n\n    return newManifest;\n  }\n}\n"],"mappings":";;;;;;;;;;AAmBA,IAAM,WAAA,GAAA,MAAA,SAAmB,kCAAkC;AAE3D,IAAa,sBAAb,cACU,gBAAA,YAAY,OAEtB;CACE;CACA;CACA;CAEA,YAAmB,QAAsB,SAAoC;AAC3E,QAAM,QAAQ,QAAQ;AACtB,OAAK,SAAS,UAAU,EAAE;AAC1B,OAAK,SAAS,QAAQ;AACtB,OAAK,eAAe,eAAA,YAAY,KAAK,OAAO;AAE5C,UACE,mDACA,KAAK,aAAa,WAAW,MAC7B,KAAK,aAAa,WAAW,KAC9B;AACD,OAAK,OAAO,MACV,EAAE,QAAQ,KAAK,UAAU,KAAK,cAAc,kBAAA,gBAAgB,EAAE,EAC9D,+CACD;AACD,OAAK,OAAO,MACV;GACE,YAAY,KAAK,aAAa,WAAW;GACzC,YAAY,KAAK,aAAa,WAAW;GAC1C,EACD,0FACD;AACD,MAAI,KAAK,aAAa,eAAe;AACnC,WAAM,sBAAsB,KAAK,aAAa,cAAc,aAAa,CAAC;AAC1E,QAAK,OAAO,MACV,EAAE,eAAe,KAAK,aAAa,cAAc,aAAa,EAAE,EAChE,kDACD;;AAEH,MAAI,KAAK,aAAa,UAAU;GAC9B,MAAM,aAAa,KAAK,aAAa,YAAY,OAAU,KAAK;AAChE,WAAM,oBAAoB,WAAW;AACrC,QAAK,OAAO,MAAM,EAAE,YAAY,EAAE,6CAA6C;;;CAInF,MAAa,gBAAgB,UAAiD;EAC5E,MAAM,EAAE,eAAe,UAAU,YAAY,eAAe,KAAK;EACjE,MAAM,eAAe,OAAO,KAAK,SAAS,YAAY,EAAE,CAAC,CAAC;AAC1D,UAAM,2CAA2C,SAAS,MAAM,aAAa;AAC7E,OAAK,OAAO,MACV;GAAE,MAAM,SAAS;GAAM;GAAc,EACrC,+DACD;EAED,IAAI,cAAc,sBAAA,iBAAiB,SAAS;AAC5C,MAAI,WAAW,OAAO,EACpB,eAAc,uBAAA,sBAAsB,aAAa,YAAY,YAAY,KAAK,OAAO;EAGvF,IAAI,wBAAqC;AACzC,MAAI,SACF,yBAAwB,IAAI,KAAK,KAAK,KAAK,GAAG,SAAS;AAGzD,MAAI,kBAAkB,CAAC,yBAAyB,gBAAgB,uBAC9D,yBAAwB;AAG1B,MAAI,uBAAuB;AACzB,WACE,8CACA,SAAS,MACT,sBAAsB,aAAa,CACpC;AACD,QAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,WAAW,sBAAsB,aAAa;IAAE,EACvE,yDACD;AACD,iBAAc,oBAAA,4BAA4B,aAAa,uBAAuB,WAAW;;AAG3F,wBAAA,YAAY,YAAY;AACxB,wBAAA,eAAe,YAAY;AAC3B,wBAAA,YAAY,YAAY;AACxB,wBAAA,wBAAwB,YAAY;AACpC,wBAAA,iBAAiB,YAAY;EAE7B,MAAM,gBAAgB,OAAO,KAAK,YAAY,SAAS,CAAC;EACxD,MAAM,eAAe,eAAe;AACpC,MAAI,kBAAkB,cAAc;AAClC,WACE,+CACA,SAAS,MACT,cACA,eACA,aACD;AACD,QAAK,OAAO,MACV;IAAE,MAAM,SAAS;IAAM,QAAQ;IAAc,OAAO;IAAe,SAAS;IAAc,EAC1F,8EACD;QAED,SAAM,+BAA+B,SAAS,KAAK;AAGrD,SAAO"}