@verdaccio/signature 6.0.0-6-next.2

package/.babelrc

@@ -0,0 +1,3 @@
+{
+  "extends": "../../.babelrc"
+}

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+# @verdaccio/signature
+
+## 6.0.0-6-next.2
+
+### Minor Changes
+
+- ddb6a223: feat: signature package
+- dc571aab: feat: add forceEnhancedLegacySignature

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Verdaccio contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/build/index.d.ts

@@ -0,0 +1,6 @@
+export { aesDecryptDeprecated, aesEncryptDeprecated, generateRandomSecretKeyDeprecated, } from './legacy-signature';
+export { aesDecrypt, aesEncrypt } from './signature';
+export { signPayload, verifyPayload } from './jwt-token';
+export * as utils from './utils';
+export * as types from './types';
+export { parseBasicPayload } from './token';

package/build/index.js

@@ -0,0 +1,65 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+Object.defineProperty(exports, "aesDecrypt", {
+  enumerable: true,
+  get: function () {
+    return _signature.aesDecrypt;
+  }
+});
+Object.defineProperty(exports, "aesDecryptDeprecated", {
+  enumerable: true,
+  get: function () {
+    return _legacySignature.aesDecryptDeprecated;
+  }
+});
+Object.defineProperty(exports, "aesEncrypt", {
+  enumerable: true,
+  get: function () {
+    return _signature.aesEncrypt;
+  }
+});
+Object.defineProperty(exports, "aesEncryptDeprecated", {
+  enumerable: true,
+  get: function () {
+    return _legacySignature.aesEncryptDeprecated;
+  }
+});
+Object.defineProperty(exports, "generateRandomSecretKeyDeprecated", {
+  enumerable: true,
+  get: function () {
+    return _legacySignature.generateRandomSecretKeyDeprecated;
+  }
+});
+Object.defineProperty(exports, "parseBasicPayload", {
+  enumerable: true,
+  get: function () {
+    return _token.parseBasicPayload;
+  }
+});
+Object.defineProperty(exports, "signPayload", {
+  enumerable: true,
+  get: function () {
+    return _jwtToken.signPayload;
+  }
+});
+exports.utils = exports.types = void 0;
+Object.defineProperty(exports, "verifyPayload", {
+  enumerable: true,
+  get: function () {
+    return _jwtToken.verifyPayload;
+  }
+});
+var _legacySignature = require("./legacy-signature");
+var _signature = require("./signature");
+var _jwtToken = require("./jwt-token");
+var _utils = _interopRequireWildcard(require("./utils"));
+exports.utils = _utils;
+var _types = _interopRequireWildcard(require("./types"));
+exports.types = _types;
+var _token = require("./token");
+function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
+function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+//# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export {\n  aesDecryptDeprecated,\n  aesEncryptDeprecated,\n  generateRandomSecretKeyDeprecated,\n} from './legacy-signature';\nexport { aesDecrypt, aesEncrypt } from './signature';\nexport { signPayload, verifyPayload } from './jwt-token';\nexport * as utils from './utils';\nexport * as types from './types';\nexport { parseBasicPayload } from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAKA;AACA;AAAyD;AAAA;AAAA;AAAA;AAGzD;AAA4C;AAAA"}

package/build/jwt-token.d.ts

@@ -0,0 +1,10 @@
+import { JWTSignOptions, RemoteUser } from '@verdaccio/types';
+/**
+ * Sign the payload and return JWT
+ * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback
+ * @param payload
+ * @param secretOrPrivateKey
+ * @param options
+ */
+export declare function signPayload(payload: RemoteUser, secretOrPrivateKey: string, options?: JWTSignOptions): Promise<string>;
+export declare function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser;

package/build/jwt-token.js

@@ -0,0 +1,40 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.signPayload = signPayload;
+exports.verifyPayload = verifyPayload;
+var _debug = _interopRequireDefault(require("debug"));
+var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
+/**
+ * Sign the payload and return JWT
+ * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback
+ * @param payload
+ * @param secretOrPrivateKey
+ * @param options
+ */
+async function signPayload(payload, secretOrPrivateKey, options = {}) {
+  return new Promise(function (resolve, reject) {
+    debug('sign jwt token');
+    return _jsonwebtoken.default.sign(payload, secretOrPrivateKey,
+    // FIXME: upgrade to the latest library and types
+    // @ts-ignore
+    {
+      // 1 === 1ms (one millisecond)
+      notBefore: '1',
+      // Make sure the time will not rollback :)
+      ...options
+    }, (error, token) => {
+      debug('error on sign jwt token');
+      return error ? reject(error) : resolve(token);
+    });
+  });
+}
+function verifyPayload(token, secretOrPrivateKey) {
+  debug('verify jwt token');
+  return _jsonwebtoken.default.verify(token, secretOrPrivateKey);
+}
+//# sourceMappingURL=jwt-token.js.map

package/build/jwt-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-token.js","names":["debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt from 'jsonwebtoken';\n\nimport { JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: JWTSignOptions = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject): Promise<string> {\n    debug('sign jwt token');\n    return jwt.sign(\n      payload,\n      secretOrPrivateKey,\n      // FIXME: upgrade to the latest library and types\n      // @ts-ignore\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token: string) => {\n        debug('error on sign jwt token');\n        return error ? reject(error) : resolve(token);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA;AACA;AAA+B;AAI/B,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAW,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAAuB,GAAG,CAAC,CAAC,EACX;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAmB;IAC7DR,KAAK,CAAC,gBAAgB,CAAC;IACvB,OAAOS,qBAAG,CAACC,IAAI,CACbP,OAAO,EACPC,kBAAkB;IAClB;IACA;IACA;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAa,KAAK;MACxBb,KAAK,CAAC,yBAAyB,CAAC;MAChC,OAAOY,KAAK,GAAGJ,MAAM,CAACI,KAAK,CAAC,GAAGL,OAAO,CAACM,KAAK,CAAC;IAC/C,CAAC,CACF;EACH,CAAC,CAAC;AACJ;AAEO,SAASC,aAAa,CAACD,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,kBAAkB,CAAC;EACzB,OAAOS,qBAAG,CAACM,MAAM,CAACF,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}

package/build/legacy-signature/index.d.ts

@@ -0,0 +1,22 @@
+/// <reference types="node" />
+export declare const defaultAlgorithm = "aes192";
+export declare const defaultTarballHashAlgorithm = "sha1";
+/**
+ *
+ * @param buf
+ * @param secret
+ * @returns
+ */
+export declare function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer;
+/**
+ *
+ * @param buf
+ * @param secret
+ * @returns
+ */
+export declare function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer;
+export declare const TOKEN_VALID_LENGTH_DEPRECATED = 64;
+/**
+ * Generate a secret key of 64 characters.
+ */
+export declare function generateRandomSecretKeyDeprecated(): string;

package/build/legacy-signature/index.js

@@ -0,0 +1,61 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.TOKEN_VALID_LENGTH_DEPRECATED = void 0;
+exports.aesDecryptDeprecated = aesDecryptDeprecated;
+exports.aesEncryptDeprecated = aesEncryptDeprecated;
+exports.defaultTarballHashAlgorithm = exports.defaultAlgorithm = void 0;
+exports.generateRandomSecretKeyDeprecated = generateRandomSecretKeyDeprecated;
+var _crypto = require("crypto");
+var _utils = require("../utils");
+const defaultAlgorithm = 'aes192';
+exports.defaultAlgorithm = defaultAlgorithm;
+const defaultTarballHashAlgorithm = 'sha1';
+
+/**
+ *
+ * @param buf
+ * @param secret
+ * @returns
+ */
+exports.defaultTarballHashAlgorithm = defaultTarballHashAlgorithm;
+function aesEncryptDeprecated(buf, secret) {
+  // deprecated (it will be removed in Verdaccio 6), it is a breaking change
+  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
+  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
+  const c = (0, _crypto.createCipher)(defaultAlgorithm, secret);
+  const b1 = c.update(buf);
+  const b2 = c.final();
+  return Buffer.concat([b1, b2]);
+}
+
+/**
+ *
+ * @param buf
+ * @param secret
+ * @returns
+ */
+function aesDecryptDeprecated(buf, secret) {
+  try {
+    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options
+    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
+    const c = (0, _crypto.createDecipher)(defaultAlgorithm, secret);
+    const b1 = c.update(buf);
+    const b2 = c.final();
+    return Buffer.concat([b1, b2]);
+  } catch (_) {
+    return Buffer.alloc(0);
+  }
+}
+const TOKEN_VALID_LENGTH_DEPRECATED = 64;
+
+/**
+ * Generate a secret key of 64 characters.
+ */
+exports.TOKEN_VALID_LENGTH_DEPRECATED = TOKEN_VALID_LENGTH_DEPRECATED;
+function generateRandomSecretKeyDeprecated() {
+  return (0, _utils.generateRandomHexString)(6);
+}
+//# sourceMappingURL=index.js.map

package/build/legacy-signature/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":["defaultAlgorithm","defaultTarballHashAlgorithm","aesEncryptDeprecated","buf","secret","c","createCipher","b1","update","b2","final","Buffer","concat","aesDecryptDeprecated","createDecipher","_","alloc","TOKEN_VALID_LENGTH_DEPRECATED","generateRandomSecretKeyDeprecated","generateRandomHexString"],"sources":["../../src/legacy-signature/index.ts"],"sourcesContent":["import { createCipher, createDecipher } from 'crypto';\n\nimport { generateRandomHexString } from '../utils';\n\nexport const defaultAlgorithm = 'aes192';\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {\n  // deprecated (it will be removed in Verdaccio 6), it is a breaking change\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  const c = createCipher(defaultAlgorithm, secret);\n  const b1 = c.update(buf);\n  const b2 = c.final();\n  return Buffer.concat([b1, b2]);\n}\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {\n  try {\n    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options\n    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n    const c = createDecipher(defaultAlgorithm, secret);\n    const b1 = c.update(buf);\n    const b2 = c.final();\n    return Buffer.concat([b1, b2]);\n  } catch (_) {\n    return Buffer.alloc(0);\n  }\n}\n\nexport const TOKEN_VALID_LENGTH_DEPRECATED = 64;\n\n/**\n * Generate a secret key of 64 characters.\n */\nexport function generateRandomSecretKeyDeprecated(): string {\n  return generateRandomHexString(6);\n}\n"],"mappings":";;;;;;;;;;AAAA;AAEA;AAEO,MAAMA,gBAAgB,GAAG,QAAQ;AAAC;AAClC,MAAMC,2BAA2B,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACA;AACA;AALA;AAMO,SAASC,oBAAoB,CAACC,GAAW,EAAEC,MAAc,EAAU;EACxE;EACA;EACA;EACA,MAAMC,CAAC,GAAG,IAAAC,oBAAY,EAACN,gBAAgB,EAAEI,MAAM,CAAC;EAChD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;EACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,EAAE;EACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;AAChC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,oBAAoB,CAACV,GAAW,EAAEC,MAAc,EAAU;EACxE,IAAI;IACF;IACA;IACA,MAAMC,CAAC,GAAG,IAAAS,sBAAc,EAACd,gBAAgB,EAAEI,MAAM,CAAC;IAClD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;IACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,EAAE;IACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;EAChC,CAAC,CAAC,OAAOM,CAAC,EAAE;IACV,OAAOJ,MAAM,CAACK,KAAK,CAAC,CAAC,CAAC;EACxB;AACF;AAEO,MAAMC,6BAA6B,GAAG,EAAE;;AAE/C;AACA;AACA;AAFA;AAGO,SAASC,iCAAiC,GAAW;EAC1D,OAAO,IAAAC,8BAAuB,EAAC,CAAC,CAAC;AACnC"}

package/build/signature.d.ts

@@ -0,0 +1,3 @@
+export declare const defaultAlgorithm: string;
+export declare function aesEncrypt(value: string, key: string): string | void;
+export declare function aesDecrypt(value: string, key: string): string | void;

package/build/signature.js

@@ -0,0 +1,65 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.aesDecrypt = aesDecrypt;
+exports.aesEncrypt = aesEncrypt;
+exports.defaultAlgorithm = void 0;
+var _crypto = require("crypto");
+var _debug = _interopRequireDefault(require("debug"));
+var _config = require("@verdaccio/config");
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+const debug = (0, _debug.default)('verdaccio:auth:token:legacy');
+const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
+exports.defaultAlgorithm = defaultAlgorithm;
+const inputEncoding = 'utf8';
+const outputEncoding = 'hex';
+// Must be 256 bits (32 characters)
+// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356
+const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
+function aesEncrypt(value, key) {
+  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
+  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv
+  debug('encrypt %o', value);
+  debug('algorithm %o', defaultAlgorithm);
+  // IV must be a buffer of length 16
+  const iv = Buffer.from((0, _crypto.randomBytes)(16));
+  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
+  const isKeyValid = (secretKey === null || secretKey === void 0 ? void 0 : secretKey.length) === _config.TOKEN_VALID_LENGTH;
+  debug('length secret key %o', secretKey === null || secretKey === void 0 ? void 0 : secretKey.length);
+  debug('is valid secret %o', isKeyValid);
+  if (!value || !secretKey || !isKeyValid) {
+    return;
+  }
+  const cipher = (0, _crypto.createCipheriv)(defaultAlgorithm, secretKey, iv);
+  let encrypted = cipher.update(value, inputEncoding, outputEncoding);
+  // @ts-ignore
+  encrypted += cipher.final(outputEncoding);
+  const token = `${iv.toString('hex')}:${encrypted.toString()}`;
+  debug('token generated successfully');
+  return Buffer.from(token).toString('base64');
+}
+function aesDecrypt(value, key) {
+  try {
+    const buff = Buffer.from(value, 'base64');
+    const textParts = buff.toString().split(':');
+
+    // extract the IV from the first half of the value
+    // @ts-ignore
+    const IV = Buffer.from(textParts.shift(), outputEncoding);
+    // extract the encrypted text without the IV
+    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
+    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
+    // decipher the string
+    const decipher = (0, _crypto.createDecipheriv)(defaultAlgorithm, secretKey, IV);
+    // FIXME: fix type here should allow Buffer
+    let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
+    decrypted += decipher.final(inputEncoding);
+    debug('token decrypted successfully');
+    return decrypted.toString();
+  } catch (_) {
+    return;
+  }
+}
+//# sourceMappingURL=signature.js.map

package/build/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.js","names":["debug","buildDebug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/signature.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  // IV must be a buffer of length 16\n  const iv = Buffer.from(randomBytes(16));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA;AAOA;AAEA;AAAuD;AAEvD,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AAAC;AACxF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA;AACA,MAAMC,+BAA+B,GAAGL,OAAO,CAACC,GAAG,CAACI,+BAA+B;AAE5E,SAASC,UAAU,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAX,KAAK,CAAC,YAAY,EAAEU,KAAK,CAAC;EAC1BV,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC;EACA,MAAMU,EAAE,GAAGC,MAAM,CAACC,IAAI,CAAC,IAAAC,mBAAW,EAAC,EAAE,CAAC,CAAC;EACvC,MAAMC,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;EACxD,MAAMM,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DnB,KAAK,CAAC,sBAAsB,EAAEgB,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDlB,KAAK,CAAC,oBAAoB,EAAEiB,UAAU,CAAC;EACvC,IAAI,CAACP,KAAK,IAAI,CAACM,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAACnB,gBAAgB,EAAEc,SAAS,EAAEJ,EAAE,CAAC;EAC9D,IAAIU,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACb,KAAK,EAAEJ,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAe,SAAS,IAAIF,MAAM,CAACI,KAAK,CAACjB,cAAc,CAAC;EACzC,MAAMkB,KAAK,GAAI,GAAEb,EAAE,CAACc,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,EAAG,EAAC;EAC7D1B,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAOa,MAAM,CAACC,IAAI,CAACW,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASC,UAAU,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGf,MAAM,CAACC,IAAI,CAACJ,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACF,QAAQ,EAAE,CAACI,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGlB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACG,KAAK,EAAE,EAAEzB,cAAc,CAAC;IACzD;IACA,MAAM0B,aAAa,GAAGpB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE3B,cAAc,CAAC;IACtE,MAAMS,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAAClC,gBAAgB,EAAEc,SAAS,EAAEe,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACZ,MAAM,CAACU,aAAa,EAAS1B,cAAc,EAAED,aAAa,CAAC;IACpF+B,SAAS,IAAIF,QAAQ,CAACX,KAAK,CAAClB,aAAa,CAAC;IAC1CN,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOqC,SAAS,CAACX,QAAQ,EAAE;EAC7B,CAAC,CAAC,OAAOY,CAAM,EAAE;IACf;EACF;AACF"}

package/build/token.d.ts

@@ -0,0 +1,7 @@
+import { BasicPayload } from './types';
+/**
+ *
+ * @param credentials
+ * @returns
+ */
+export declare function parseBasicPayload(credentials: string): BasicPayload;

package/build/token.js

@@ -0,0 +1,24 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.parseBasicPayload = parseBasicPayload;
+/**
+ *
+ * @param credentials
+ * @returns
+ */
+function parseBasicPayload(credentials) {
+  const index = credentials.indexOf(':');
+  if (index < 0) {
+    return;
+  }
+  const user = credentials.slice(0, index);
+  const password = credentials.slice(index + 1);
+  return {
+    user,
+    password
+  };
+}
+//# sourceMappingURL=token.js.map

package/build/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","names":["parseBasicPayload","credentials","index","indexOf","user","slice","password"],"sources":["../src/token.ts"],"sourcesContent":["import { BasicPayload } from './types';\n\n/**\n *\n * @param credentials\n * @returns\n */\nexport function parseBasicPayload(credentials: string): BasicPayload {\n  const index = credentials.indexOf(':');\n  if (index < 0) {\n    return;\n  }\n\n  const user: string = credentials.slice(0, index);\n  const password: string = credentials.slice(index + 1);\n\n  return { user, password };\n}\n"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASA,iBAAiB,CAACC,WAAmB,EAAgB;EACnE,MAAMC,KAAK,GAAGD,WAAW,CAACE,OAAO,CAAC,GAAG,CAAC;EACtC,IAAID,KAAK,GAAG,CAAC,EAAE;IACb;EACF;EAEA,MAAME,IAAY,GAAGH,WAAW,CAACI,KAAK,CAAC,CAAC,EAAEH,KAAK,CAAC;EAChD,MAAMI,QAAgB,GAAGL,WAAW,CAACI,KAAK,CAACH,KAAK,GAAG,CAAC,CAAC;EAErD,OAAO;IAAEE,IAAI;IAAEE;EAAS,CAAC;AAC3B"}

package/build/types.d.ts

@@ -0,0 +1,5 @@
+export interface AESPayload {
+    user: string;
+    password: string;
+}
+export type BasicPayload = AESPayload | void;

package/build/types.js

@@ -0,0 +1,6 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+//# sourceMappingURL=types.js.map

package/build/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["export interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type BasicPayload = AESPayload | void;\n"],"mappings":""}

package/build/utils.d.ts

@@ -0,0 +1,28 @@
+/// <reference types="node" />
+/// <reference types="node" />
+import { Hash } from 'crypto';
+export declare const defaultTarballHashAlgorithm = "sha1";
+/**
+ *
+ * @returns
+ */
+export declare function createTarballHash(algorithm?: string): Hash;
+/**
+ * Express doesn't do ETAGS with requests <= 1024b
+ * we use md5 here, it works well on 1k+ bytes, but with fewer data
+ * could improve performance using crc32 after benchmarks.
+ * @param {Object} data
+ * @return {String}
+ */
+export declare function stringToMD5(data: Buffer | string): string;
+/**
+ *
+ * @param length
+ * @returns
+ */
+export declare function generateRandomHexString(length?: number): string;
+export declare const TOKEN_VALID_LENGTH = 32;
+/**
+ * Generate a secret of 32 characters.
+ */
+export declare function generateRandomSecretKey(): string;

package/build/utils.js

@@ -0,0 +1,52 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.TOKEN_VALID_LENGTH = void 0;
+exports.createTarballHash = createTarballHash;
+exports.defaultTarballHashAlgorithm = void 0;
+exports.generateRandomHexString = generateRandomHexString;
+exports.generateRandomSecretKey = generateRandomSecretKey;
+exports.stringToMD5 = stringToMD5;
+var _crypto = require("crypto");
+const defaultTarballHashAlgorithm = 'sha1';
+
+/**
+ *
+ * @returns
+ */
+exports.defaultTarballHashAlgorithm = defaultTarballHashAlgorithm;
+function createTarballHash(algorithm = defaultTarballHashAlgorithm) {
+  return (0, _crypto.createHash)(algorithm);
+}
+
+/**
+ * Express doesn't do ETAGS with requests <= 1024b
+ * we use md5 here, it works well on 1k+ bytes, but with fewer data
+ * could improve performance using crc32 after benchmarks.
+ * @param {Object} data
+ * @return {String}
+ */
+function stringToMD5(data) {
+  return (0, _crypto.createHash)('md5').update(data).digest('hex');
+}
+
+/**
+ *
+ * @param length
+ * @returns
+ */
+function generateRandomHexString(length = 8) {
+  return (0, _crypto.pseudoRandomBytes)(length).toString('hex');
+}
+const TOKEN_VALID_LENGTH = 32;
+
+/**
+ * Generate a secret of 32 characters.
+ */
+exports.TOKEN_VALID_LENGTH = TOKEN_VALID_LENGTH;
+function generateRandomSecretKey() {
+  return (0, _crypto.randomBytes)(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);
+}
+//# sourceMappingURL=utils.js.map

package/build/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","names":["defaultTarballHashAlgorithm","createTarballHash","algorithm","createHash","stringToMD5","data","update","digest","generateRandomHexString","length","pseudoRandomBytes","toString","TOKEN_VALID_LENGTH","generateRandomSecretKey","randomBytes","substring"],"sources":["../src/utils.ts"],"sourcesContent":["import { Hash, createHash, pseudoRandomBytes, randomBytes } from 'crypto';\n\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @returns\n */\nexport function createTarballHash(algorithm = defaultTarballHashAlgorithm): Hash {\n  return createHash(algorithm);\n}\n\n/**\n * Express doesn't do ETAGS with requests <= 1024b\n * we use md5 here, it works well on 1k+ bytes, but with fewer data\n * could improve performance using crc32 after benchmarks.\n * @param {Object} data\n * @return {String}\n */\nexport function stringToMD5(data: Buffer | string): string {\n  return createHash('md5').update(data).digest('hex');\n}\n\n/**\n *\n * @param length\n * @returns\n */\nexport function generateRandomHexString(length = 8): string {\n  return pseudoRandomBytes(length).toString('hex');\n}\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Generate a secret of 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;AAAA;AAEO,MAAMA,2BAA2B,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AAHA;AAIO,SAASC,iBAAiB,CAACC,SAAS,GAAGF,2BAA2B,EAAQ;EAC/E,OAAO,IAAAG,kBAAU,EAACD,SAAS,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,WAAW,CAACC,IAAqB,EAAU;EACzD,OAAO,IAAAF,kBAAU,EAAC,KAAK,CAAC,CAACG,MAAM,CAACD,IAAI,CAAC,CAACE,MAAM,CAAC,KAAK,CAAC;AACrD;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,uBAAuB,CAACC,MAAM,GAAG,CAAC,EAAU;EAC1D,OAAO,IAAAC,yBAAiB,EAACD,MAAM,CAAC,CAACE,QAAQ,CAAC,KAAK,CAAC;AAClD;AAEO,MAAMC,kBAAkB,GAAG,EAAE;;AAEpC;AACA;AACA;AAFA;AAGO,SAASC,uBAAuB,GAAW;EAChD,OAAO,IAAAC,mBAAW,EAACF,kBAAkB,CAAC,CAACD,QAAQ,CAAC,QAAQ,CAAC,CAACI,SAAS,CAAC,CAAC,EAAEH,kBAAkB,CAAC;AAC5F"}

package/jest.config.js

@@ -0,0 +1,3 @@
+const config = require('../../jest/config');
+
+module.exports = Object.assign({}, config, {});

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@verdaccio/signature",
+  "version": "6.0.0-6-next.2",
+  "description": "verdaccio signature utils",
+  "main": "./build/index.js",
+  "types": "build/index.d.ts",
+  "author": {
+    "name": "Juan Picado",
+    "email": "juanpicado19@gmail.com"
+  },
+  "repository": {
+    "type": "https",
+    "url": "https://github.com/verdaccio/verdaccio"
+  },
+  "license": "MIT",
+  "homepage": "https://verdaccio.org",
+  "keywords": [
+    "private",
+    "package",
+    "repository",
+    "registry",
+    "enterprise",
+    "modules",
+    "proxy",
+    "server",
+    "verdaccio"
+  ],
+  "engines": {
+    "node": ">=12"
+  },
+  "dependencies": {
+    "jsonwebtoken": "9.0.0",
+    "debug": "4.3.4",
+    "lodash": "4.17.21"
+  },
+  "devDependencies": {
+    "@verdaccio/config": "6.0.0-6-next.63",
+    "@verdaccio/types": "11.0.0-6-next.22"
+  },
+  "funding": {
+    "type": "opencollective",
+    "url": "https://opencollective.com/verdaccio"
+  },
+  "scripts": {
+    "clean": "rimraf ./build",
+    "test": "jest",
+    "type-check": "tsc --noEmit -p tsconfig.build.json",
+    "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
+    "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",
+    "watch": "pnpm build:js -- --watch",
+    "build": "pnpm run build:js && pnpm run build:types"
+  }
+}

package/src/index.ts

@@ -0,0 +1,10 @@
+export {
+  aesDecryptDeprecated,
+  aesEncryptDeprecated,
+  generateRandomSecretKeyDeprecated,
+} from './legacy-signature';
+export { aesDecrypt, aesEncrypt } from './signature';
+export { signPayload, verifyPayload } from './jwt-token';
+export * as utils from './utils';
+export * as types from './types';
+export { parseBasicPayload } from './token';

package/src/jwt-token.ts

@@ -0,0 +1,42 @@
+import buildDebug from 'debug';
+import jwt from 'jsonwebtoken';
+
+import { JWTSignOptions, RemoteUser } from '@verdaccio/types';
+
+const debug = buildDebug('verdaccio:auth:token:jwt');
+/**
+ * Sign the payload and return JWT
+ * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback
+ * @param payload
+ * @param secretOrPrivateKey
+ * @param options
+ */
+export async function signPayload(
+  payload: RemoteUser,
+  secretOrPrivateKey: string,
+  options: JWTSignOptions = {}
+): Promise<string> {
+  return new Promise(function (resolve, reject): Promise<string> {
+    debug('sign jwt token');
+    return jwt.sign(
+      payload,
+      secretOrPrivateKey,
+      // FIXME: upgrade to the latest library and types
+      // @ts-ignore
+      {
+        // 1 === 1ms (one millisecond)
+        notBefore: '1', // Make sure the time will not rollback :)
+        ...options,
+      },
+      (error, token: string) => {
+        debug('error on sign jwt token');
+        return error ? reject(error) : resolve(token);
+      }
+    );
+  });
+}
+
+export function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {
+  debug('verify jwt token');
+  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;
+}

package/src/legacy-signature/index.ts

@@ -0,0 +1,50 @@
+import { createCipher, createDecipher } from 'crypto';
+
+import { generateRandomHexString } from '../utils';
+
+export const defaultAlgorithm = 'aes192';
+export const defaultTarballHashAlgorithm = 'sha1';
+
+/**
+ *
+ * @param buf
+ * @param secret
+ * @returns
+ */
+export function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {
+  // deprecated (it will be removed in Verdaccio 6), it is a breaking change
+  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
+  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
+  const c = createCipher(defaultAlgorithm, secret);
+  const b1 = c.update(buf);
+  const b2 = c.final();
+  return Buffer.concat([b1, b2]);
+}
+
+/**
+ *
+ * @param buf
+ * @param secret
+ * @returns
+ */
+export function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {
+  try {
+    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options
+    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
+    const c = createDecipher(defaultAlgorithm, secret);
+    const b1 = c.update(buf);
+    const b2 = c.final();
+    return Buffer.concat([b1, b2]);
+  } catch (_) {
+    return Buffer.alloc(0);
+  }
+}
+
+export const TOKEN_VALID_LENGTH_DEPRECATED = 64;
+
+/**
+ * Generate a secret key of 64 characters.
+ */
+export function generateRandomSecretKeyDeprecated(): string {
+  return generateRandomHexString(6);
+}

package/src/signature.ts

@@ -0,0 +1,66 @@
+import {
+  BinaryToTextEncoding,
+  CharacterEncoding,
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+} from 'crypto';
+import buildDebug from 'debug';
+
+import { TOKEN_VALID_LENGTH } from '@verdaccio/config';
+
+const debug = buildDebug('verdaccio:auth:token:legacy');
+
+export const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
+const inputEncoding: CharacterEncoding = 'utf8';
+const outputEncoding: BinaryToTextEncoding = 'hex';
+// Must be 256 bits (32 characters)
+// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356
+const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
+
+export function aesEncrypt(value: string, key: string): string | void {
+  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
+  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv
+  debug('encrypt %o', value);
+  debug('algorithm %o', defaultAlgorithm);
+  // IV must be a buffer of length 16
+  const iv = Buffer.from(randomBytes(16));
+  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
+  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;
+  debug('length secret key %o', secretKey?.length);
+  debug('is valid secret %o', isKeyValid);
+  if (!value || !secretKey || !isKeyValid) {
+    return;
+  }
+
+  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);
+  let encrypted = cipher.update(value, inputEncoding, outputEncoding);
+  // @ts-ignore
+  encrypted += cipher.final(outputEncoding);
+  const token = `${iv.toString('hex')}:${encrypted.toString()}`;
+  debug('token generated successfully');
+  return Buffer.from(token).toString('base64');
+}
+
+export function aesDecrypt(value: string, key: string): string | void {
+  try {
+    const buff = Buffer.from(value, 'base64');
+    const textParts = buff.toString().split(':');
+
+    // extract the IV from the first half of the value
+    // @ts-ignore
+    const IV = Buffer.from(textParts.shift(), outputEncoding);
+    // extract the encrypted text without the IV
+    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);
+    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
+    // decipher the string
+    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);
+    // FIXME: fix type here should allow Buffer
+    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);
+    decrypted += decipher.final(inputEncoding);
+    debug('token decrypted successfully');
+    return decrypted.toString();
+  } catch (_: any) {
+    return;
+  }
+}

package/src/token.ts

@@ -0,0 +1,18 @@
+import { BasicPayload } from './types';
+
+/**
+ *
+ * @param credentials
+ * @returns
+ */
+export function parseBasicPayload(credentials: string): BasicPayload {
+  const index = credentials.indexOf(':');
+  if (index < 0) {
+    return;
+  }
+
+  const user: string = credentials.slice(0, index);
+  const password: string = credentials.slice(index + 1);
+
+  return { user, password };
+}

package/src/types.ts

@@ -0,0 +1,6 @@
+export interface AESPayload {
+  user: string;
+  password: string;
+}
+
+export type BasicPayload = AESPayload | void;

package/src/utils.ts

@@ -0,0 +1,40 @@
+import { Hash, createHash, pseudoRandomBytes, randomBytes } from 'crypto';
+
+export const defaultTarballHashAlgorithm = 'sha1';
+
+/**
+ *
+ * @returns
+ */
+export function createTarballHash(algorithm = defaultTarballHashAlgorithm): Hash {
+  return createHash(algorithm);
+}
+
+/**
+ * Express doesn't do ETAGS with requests <= 1024b
+ * we use md5 here, it works well on 1k+ bytes, but with fewer data
+ * could improve performance using crc32 after benchmarks.
+ * @param {Object} data
+ * @return {String}
+ */
+export function stringToMD5(data: Buffer | string): string {
+  return createHash('md5').update(data).digest('hex');
+}
+
+/**
+ *
+ * @param length
+ * @returns
+ */
+export function generateRandomHexString(length = 8): string {
+  return pseudoRandomBytes(length).toString('hex');
+}
+
+export const TOKEN_VALID_LENGTH = 32;
+
+/**
+ * Generate a secret of 32 characters.
+ */
+export function generateRandomSecretKey(): string {
+  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);
+}

package/test/jwt.spec.ts

@@ -0,0 +1,13 @@
+import { createRemoteUser } from '@verdaccio/config';
+
+import { signPayload, verifyPayload } from '../src';
+
+describe('verifyJWTPayload', () => {
+  test('should verify the token and return a remote user', async () => {
+    const remoteUser = createRemoteUser('foo', []);
+    const token = await signPayload(remoteUser, '12345');
+    const verifiedToken = verifyPayload(token, '12345');
+    expect(verifiedToken.groups).toEqual(remoteUser.groups);
+    expect(verifiedToken.name).toEqual(remoteUser.name);
+  });
+});

package/test/legacy-token-deprecated.spec.ts

@@ -0,0 +1,23 @@
+import {
+  aesDecryptDeprecated,
+  aesEncryptDeprecated,
+  generateRandomSecretKeyDeprecated,
+} from '../src';
+
+describe('test deprecated crypto utils', () => {
+  test('decrypt payload flow', () => {
+    const secret = generateRandomSecretKeyDeprecated();
+    const payload = 'juan:password';
+    const token = aesEncryptDeprecated(Buffer.from(payload), secret);
+    const data = aesDecryptDeprecated(token, secret);
+
+    expect(data.toString()).toEqual(payload.toString());
+  });
+
+  test('crypt fails if secret is incorrect', () => {
+    const payload = 'juan:password';
+    expect(aesEncryptDeprecated(Buffer.from(payload), 'fake_token').toString()).not.toEqual(
+      Buffer.from(payload)
+    );
+  });
+});

package/test/legacy-token.spec.ts

@@ -0,0 +1,19 @@
+import { aesDecrypt, aesEncrypt } from '../src';
+
+describe('test crypto utils', () => {
+  test('decrypt payload flow', () => {
+    const secret = 'f5bb945cc57fea2f25961e1bd6fb3c89';
+    const payload = 'juan:password';
+    const token = aesEncrypt(payload, secret) as string;
+    const data = aesDecrypt(token, secret);
+
+    expect(payload).toEqual(data);
+  });
+
+  test('crypt fails if secret is incorrect', () => {
+    const secret = 'f5bb945cc57fea2f25961e1bd6fb3c89_TO_LONG';
+    const payload = 'juan';
+    const token = aesEncrypt(payload, secret) as string;
+    expect(token).toBeUndefined();
+  });
+});

package/test/utilts.spec.ts

@@ -0,0 +1,18 @@
+import {
+  TOKEN_VALID_LENGTH,
+  createTarballHash,
+  generateRandomSecretKey,
+  stringToMD5,
+} from '../src/utils';
+
+test('token generation length is valid', () => {
+  expect(generateRandomSecretKey()).toHaveLength(TOKEN_VALID_LENGTH);
+});
+
+test('string to md5 has valid length', () => {
+  expect(stringToMD5(Buffer.from('foo'))).toHaveLength(32);
+});
+
+test('create a hash of content', () => {
+  expect(typeof createTarballHash().update('1').digest('hex')).toEqual('string');
+});

package/tsconfig.build.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./build"
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["src/**/*.test.ts"]
+}

package/tsconfig.json

@@ -0,0 +1,17 @@
+{
+  "extends": "../../tsconfig.reference.json",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "outDir": "./build",
+    "noImplicitAny": false
+  },
+  "include": ["src/**/*.ts", "types/*.d.ts"],
+  "references": [
+    {
+      "path": "../config"
+    },
+    {
+      "path": "../utils"
+    }
+  ]
+}