@verdaccio/signature 7.0.0-next.1 → 7.0.0-next.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @verdaccio/signature
 
+## 7.0.0-next.3
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+## 7.0.0-next.2
+
+### Patch Changes
+
+- 312bc100f: chore: export signature options type
+
 ## 7.0.0-next.1
 
 ### Major Changes

package/build/index.d.ts

@@ -1,6 +1,6 @@
 export { aesDecryptDeprecated, aesEncryptDeprecated, generateRandomSecretKeyDeprecated, } from './legacy-signature';
 export { aesDecrypt, aesEncrypt } from './signature';
-export { signPayload, verifyPayload } from './jwt-token';
+export { signPayload, verifyPayload, SignOptionsSignature } from './jwt-token';
 export * as utils from './utils';
 export * as types from './types';
 export { parseBasicPayload } from './token';

package/build/index.js

@@ -3,6 +3,12 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+Object.defineProperty(exports, "SignOptionsSignature", {
+  enumerable: true,
+  get: function () {
+    return _jwtToken.SignOptionsSignature;
+  }
+});
 Object.defineProperty(exports, "aesDecrypt", {
   enumerable: true,
   get: function () {
@@ -60,6 +66,6 @@ exports.utils = _utils;
 var _types = _interopRequireWildcard(require("./types"));
 exports.types = _types;
 var _token = require("./token");
-function _getRequireWildcardCache(nodeInterop) { if (typeof WeakMap !== "function") return null; var cacheBabelInterop = new WeakMap(); var cacheNodeInterop = new WeakMap(); return (_getRequireWildcardCache = function (nodeInterop) { return nodeInterop ? cacheNodeInterop : cacheBabelInterop; })(nodeInterop); }
-function _interopRequireWildcard(obj, nodeInterop) { if (!nodeInterop && obj && obj.__esModule) { return obj; } if (obj === null || typeof obj !== "object" && typeof obj !== "function") { return { default: obj }; } var cache = _getRequireWildcardCache(nodeInterop); if (cache && cache.has(obj)) { return cache.get(obj); } var newObj = {}; var hasPropertyDescriptor = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var key in obj) { if (key !== "default" && Object.prototype.hasOwnProperty.call(obj, key)) { var desc = hasPropertyDescriptor ? Object.getOwnPropertyDescriptor(obj, key) : null; if (desc && (desc.get || desc.set)) { Object.defineProperty(newObj, key, desc); } else { newObj[key] = obj[key]; } } } newObj.default = obj; if (cache) { cache.set(obj, newObj); } return newObj; }
+function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
+function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && Object.prototype.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_legacySignature","require","_signature","_jwtToken","_utils","_interopRequireWildcard","exports","utils","_types","types","_token","_getRequireWildcardCache","nodeInterop","WeakMap","cacheBabelInterop","cacheNodeInterop","obj","__esModule","default","cache","has","get","newObj","hasPropertyDescriptor","Object","defineProperty","getOwnPropertyDescriptor","key","prototype","hasOwnProperty","call","desc","set"],"sources":["../src/index.ts"],"sourcesContent":["export {\n  aesDecryptDeprecated,\n  aesEncryptDeprecated,\n  generateRandomSecretKeyDeprecated,\n} from './legacy-signature';\nexport { aesDecrypt, aesEncrypt } from './signature';\nexport { signPayload, verifyPayload } from './jwt-token';\nexport * as utils from './utils';\nexport * as types from './types';\nexport { parseBasicPayload } from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,gBAAA,GAAAC,OAAA;AAKA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAAyD,IAAAG,MAAA,GAAAC,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAC,KAAA,GAAAH,MAAA;AAAA,IAAAI,MAAA,GAAAH,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAG,KAAA,GAAAD,MAAA;AAGzD,IAAAE,MAAA,GAAAT,OAAA;AAA4C,SAAAU,yBAAAC,WAAA,eAAAC,OAAA,kCAAAC,iBAAA,OAAAD,OAAA,QAAAE,gBAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,WAAA,WAAAA,WAAA,GAAAG,gBAAA,GAAAD,iBAAA,KAAAF,WAAA;AAAA,SAAAP,wBAAAW,GAAA,EAAAJ,WAAA,SAAAA,WAAA,IAAAI,GAAA,IAAAA,GAAA,CAAAC,UAAA,WAAAD,GAAA,QAAAA,GAAA,oBAAAA,GAAA,wBAAAA,GAAA,4BAAAE,OAAA,EAAAF,GAAA,UAAAG,KAAA,GAAAR,wBAAA,CAAAC,WAAA,OAAAO,KAAA,IAAAA,KAAA,CAAAC,GAAA,CAAAJ,GAAA,YAAAG,KAAA,CAAAE,GAAA,CAAAL,GAAA,SAAAM,MAAA,WAAAC,qBAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,GAAA,IAAAX,GAAA,QAAAW,GAAA,kBAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAd,GAAA,EAAAW,GAAA,SAAAI,IAAA,GAAAR,qBAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAV,GAAA,EAAAW,GAAA,cAAAI,IAAA,KAAAA,IAAA,CAAAV,GAAA,IAAAU,IAAA,CAAAC,GAAA,KAAAR,MAAA,CAAAC,cAAA,CAAAH,MAAA,EAAAK,GAAA,EAAAI,IAAA,YAAAT,MAAA,CAAAK,GAAA,IAAAX,GAAA,CAAAW,GAAA,SAAAL,MAAA,CAAAJ,OAAA,GAAAF,GAAA,MAAAG,KAAA,IAAAA,KAAA,CAAAa,GAAA,CAAAhB,GAAA,EAAAM,MAAA,YAAAA,MAAA"}
+{"version":3,"file":"index.js","names":["_legacySignature","require","_signature","_jwtToken","_utils","_interopRequireWildcard","exports","utils","_types","types","_token","_getRequireWildcardCache","e","WeakMap","r","t","__esModule","default","has","get","n","__proto__","a","Object","defineProperty","getOwnPropertyDescriptor","u","prototype","hasOwnProperty","call","i","set"],"sources":["../src/index.ts"],"sourcesContent":["export {\n  aesDecryptDeprecated,\n  aesEncryptDeprecated,\n  generateRandomSecretKeyDeprecated,\n} from './legacy-signature';\nexport { aesDecrypt, aesEncrypt } from './signature';\nexport { signPayload, verifyPayload, SignOptionsSignature } from './jwt-token';\nexport * as utils from './utils';\nexport * as types from './types';\nexport { parseBasicPayload } from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,gBAAA,GAAAC,OAAA;AAKA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAA+E,IAAAG,MAAA,GAAAC,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAC,KAAA,GAAAH,MAAA;AAAA,IAAAI,MAAA,GAAAH,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAG,KAAA,GAAAD,MAAA;AAG/E,IAAAE,MAAA,GAAAT,OAAA;AAA4C,SAAAU,yBAAAC,CAAA,6BAAAC,OAAA,mBAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,CAAA,WAAAA,CAAA,GAAAG,CAAA,GAAAD,CAAA,KAAAF,CAAA;AAAA,SAAAP,wBAAAO,CAAA,EAAAE,CAAA,SAAAA,CAAA,IAAAF,CAAA,IAAAA,CAAA,CAAAI,UAAA,SAAAJ,CAAA,eAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,WAAAK,OAAA,EAAAL,CAAA,QAAAG,CAAA,GAAAJ,wBAAA,CAAAG,CAAA,OAAAC,CAAA,IAAAA,CAAA,CAAAG,GAAA,CAAAN,CAAA,UAAAG,CAAA,CAAAI,GAAA,CAAAP,CAAA,OAAAQ,CAAA,KAAAC,SAAA,UAAAC,CAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,CAAA,IAAAd,CAAA,oBAAAc,CAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAjB,CAAA,EAAAc,CAAA,SAAAI,CAAA,GAAAR,CAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAb,CAAA,EAAAc,CAAA,UAAAI,CAAA,KAAAA,CAAA,CAAAX,GAAA,IAAAW,CAAA,CAAAC,GAAA,IAAAR,MAAA,CAAAC,cAAA,CAAAJ,CAAA,EAAAM,CAAA,EAAAI,CAAA,IAAAV,CAAA,CAAAM,CAAA,IAAAd,CAAA,CAAAc,CAAA,YAAAN,CAAA,CAAAH,OAAA,GAAAL,CAAA,EAAAG,CAAA,IAAAA,CAAA,CAAAgB,GAAA,CAAAnB,CAAA,EAAAQ,CAAA,GAAAA,CAAA"}

package/build/jwt-token.js

@@ -37,7 +37,7 @@ async function signPayload(payload, secretOrPrivateKey, options = {}) {
   });
 }
 function verifyPayload(token, secretOrPrivateKey) {
-  debug('verify jwt token');
+  debug('verifying jwt token');
   return _jsonwebtoken.default.verify(token, secretOrPrivateKey);
 }
 //# sourceMappingURL=jwt-token.js.map

package/build/jwt-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-token.js","names":["_debug","_interopRequireDefault","require","_jsonwebtoken","obj","__esModule","default","debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","message","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt, { SignOptions } from 'jsonwebtoken';\n\nimport { RemoteUser } from '@verdaccio/types';\n\nexport type SignOptionsSignature = Pick<SignOptions, 'algorithm' | 'expiresIn' | 'notBefore'>;\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: SignOptionsSignature = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject) {\n    debug('sign jwt token');\n    jwt.sign(\n      payload,\n      secretOrPrivateKey, // FIXME: upgrade to the latest library and types\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        if (error) {\n          debug('error on sign jwt token %s', error.message);\n          return reject(error);\n        }\n        debug('signed jwt token successfully');\n        return resolve(token as string);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,aAAA,GAAAF,sBAAA,CAAAC,OAAA;AAAgD,SAAAD,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAMhD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAWA,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAA6B,GAAG,CAAC,CAAC,EACjB;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAE;IAC5CR,KAAK,CAAC,gBAAgB,CAAC;IACvBS,qBAAG,CAACC,IAAI,CACNP,OAAO,EACPC,kBAAkB;IAAE;IACpB;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAK,KAAK;MAChB,IAAID,KAAK,EAAE;QACTZ,KAAK,CAAC,4BAA4B,EAAEY,KAAK,CAACE,OAAO,CAAC;QAClD,OAAON,MAAM,CAACI,KAAK,CAAC;MACtB;MACAZ,KAAK,CAAC,+BAA+B,CAAC;MACtC,OAAOO,OAAO,CAACM,KAAe,CAAC;IACjC,CACF,CAAC;EACH,CAAC,CAAC;AACJ;AAEO,SAASE,aAAaA,CAACF,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,kBAAkB,CAAC;EACzB,OAAOS,qBAAG,CAACO,MAAM,CAACH,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}
+{"version":3,"file":"jwt-token.js","names":["_debug","_interopRequireDefault","require","_jsonwebtoken","obj","__esModule","default","debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","message","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt, { SignOptions } from 'jsonwebtoken';\n\nimport { RemoteUser } from '@verdaccio/types';\n\nexport type SignOptionsSignature = Pick<SignOptions, 'algorithm' | 'expiresIn' | 'notBefore'>;\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: SignOptionsSignature = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject) {\n    debug('sign jwt token');\n    jwt.sign(\n      payload,\n      secretOrPrivateKey, // FIXME: upgrade to the latest library and types\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        if (error) {\n          debug('error on sign jwt token %s', error.message);\n          return reject(error);\n        }\n        debug('signed jwt token successfully');\n        return resolve(token as string);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verifying jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,aAAA,GAAAF,sBAAA,CAAAC,OAAA;AAAgD,SAAAD,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAMhD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAWA,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAA6B,GAAG,CAAC,CAAC,EACjB;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAE;IAC5CR,KAAK,CAAC,gBAAgB,CAAC;IACvBS,qBAAG,CAACC,IAAI,CACNP,OAAO,EACPC,kBAAkB;IAAE;IACpB;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAK,KAAK;MAChB,IAAID,KAAK,EAAE;QACTZ,KAAK,CAAC,4BAA4B,EAAEY,KAAK,CAACE,OAAO,CAAC;QAClD,OAAON,MAAM,CAACI,KAAK,CAAC;MACtB;MACAZ,KAAK,CAAC,+BAA+B,CAAC;MACtC,OAAOO,OAAO,CAACM,KAAe,CAAC;IACjC,CACF,CAAC;EACH,CAAC,CAAC;AACJ;AAEO,SAASE,aAAaA,CAACF,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,OAAOS,qBAAG,CAACO,MAAM,CAACH,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}

package/build/legacy-signature/index.js

@@ -10,9 +10,8 @@ exports.defaultTarballHashAlgorithm = exports.defaultAlgorithm = void 0;
 exports.generateRandomSecretKeyDeprecated = generateRandomSecretKeyDeprecated;
 var _crypto = require("crypto");
 var _utils = require("../utils");
-const defaultAlgorithm = 'aes192';
-exports.defaultAlgorithm = defaultAlgorithm;
-const defaultTarballHashAlgorithm = 'sha1';
+const defaultAlgorithm = exports.defaultAlgorithm = 'aes192';
+const defaultTarballHashAlgorithm = exports.defaultTarballHashAlgorithm = 'sha1';
 
 /**
  *
@@ -20,7 +19,6 @@ const defaultTarballHashAlgorithm = 'sha1';
  * @param secret
  * @returns
  */
-exports.defaultTarballHashAlgorithm = defaultTarballHashAlgorithm;
 function aesEncryptDeprecated(buf, secret) {
   // deprecated (it will be removed in Verdaccio 6), it is a breaking change
   // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
@@ -49,12 +47,11 @@ function aesDecryptDeprecated(buf, secret) {
     return Buffer.alloc(0);
   }
 }
-const TOKEN_VALID_LENGTH_DEPRECATED = 64;
+const TOKEN_VALID_LENGTH_DEPRECATED = exports.TOKEN_VALID_LENGTH_DEPRECATED = 64;
 
 /**
  * Generate a secret key of 64 characters.
  */
-exports.TOKEN_VALID_LENGTH_DEPRECATED = TOKEN_VALID_LENGTH_DEPRECATED;
 function generateRandomSecretKeyDeprecated() {
   return (0, _utils.generateRandomHexString)(6);
 }

package/build/legacy-signature/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_crypto","require","_utils","defaultAlgorithm","exports","defaultTarballHashAlgorithm","aesEncryptDeprecated","buf","secret","c","createCipher","b1","update","b2","final","Buffer","concat","aesDecryptDeprecated","createDecipher","_","alloc","TOKEN_VALID_LENGTH_DEPRECATED","generateRandomSecretKeyDeprecated","generateRandomHexString"],"sources":["../../src/legacy-signature/index.ts"],"sourcesContent":["import { createCipher, createDecipher } from 'crypto';\n\nimport { generateRandomHexString } from '../utils';\n\nexport const defaultAlgorithm = 'aes192';\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {\n  // deprecated (it will be removed in Verdaccio 6), it is a breaking change\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  const c = createCipher(defaultAlgorithm, secret);\n  const b1 = c.update(buf);\n  const b2 = c.final();\n  return Buffer.concat([b1, b2]);\n}\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {\n  try {\n    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options\n    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n    const c = createDecipher(defaultAlgorithm, secret);\n    const b1 = c.update(buf);\n    const b2 = c.final();\n    return Buffer.concat([b1, b2]);\n  } catch (_) {\n    return Buffer.alloc(0);\n  }\n}\n\nexport const TOKEN_VALID_LENGTH_DEPRECATED = 64;\n\n/**\n * Generate a secret key of 64 characters.\n */\nexport function generateRandomSecretKeyDeprecated(): string {\n  return generateRandomHexString(6);\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAEO,MAAME,gBAAgB,GAAG,QAAQ;AAACC,OAAA,CAAAD,gBAAA,GAAAA,gBAAA;AAClC,MAAME,2BAA2B,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACA;AACA;AALAD,OAAA,CAAAC,2BAAA,GAAAA,2BAAA;AAMO,SAASC,oBAAoBA,CAACC,GAAW,EAAEC,MAAc,EAAU;EACxE;EACA;EACA;EACA,MAAMC,CAAC,GAAG,IAAAC,oBAAY,EAACP,gBAAgB,EAAEK,MAAM,CAAC;EAChD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;EACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;EACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;AAChC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,oBAAoBA,CAACV,GAAW,EAAEC,MAAc,EAAU;EACxE,IAAI;IACF;IACA;IACA,MAAMC,CAAC,GAAG,IAAAS,sBAAc,EAACf,gBAAgB,EAAEK,MAAM,CAAC;IAClD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;IACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;IACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;EAChC,CAAC,CAAC,OAAOM,CAAC,EAAE;IACV,OAAOJ,MAAM,CAACK,KAAK,CAAC,CAAC,CAAC;EACxB;AACF;AAEO,MAAMC,6BAA6B,GAAG,EAAE;;AAE/C;AACA;AACA;AAFAjB,OAAA,CAAAiB,6BAAA,GAAAA,6BAAA;AAGO,SAASC,iCAAiCA,CAAA,EAAW;EAC1D,OAAO,IAAAC,8BAAuB,EAAC,CAAC,CAAC;AACnC"}
+{"version":3,"file":"index.js","names":["_crypto","require","_utils","defaultAlgorithm","exports","defaultTarballHashAlgorithm","aesEncryptDeprecated","buf","secret","c","createCipher","b1","update","b2","final","Buffer","concat","aesDecryptDeprecated","createDecipher","_","alloc","TOKEN_VALID_LENGTH_DEPRECATED","generateRandomSecretKeyDeprecated","generateRandomHexString"],"sources":["../../src/legacy-signature/index.ts"],"sourcesContent":["import { createCipher, createDecipher } from 'crypto';\n\nimport { generateRandomHexString } from '../utils';\n\nexport const defaultAlgorithm = 'aes192';\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {\n  // deprecated (it will be removed in Verdaccio 6), it is a breaking change\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  const c = createCipher(defaultAlgorithm, secret);\n  const b1 = c.update(buf);\n  const b2 = c.final();\n  return Buffer.concat([b1, b2]);\n}\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {\n  try {\n    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options\n    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n    const c = createDecipher(defaultAlgorithm, secret);\n    const b1 = c.update(buf);\n    const b2 = c.final();\n    return Buffer.concat([b1, b2]);\n  } catch (_) {\n    return Buffer.alloc(0);\n  }\n}\n\nexport const TOKEN_VALID_LENGTH_DEPRECATED = 64;\n\n/**\n * Generate a secret key of 64 characters.\n */\nexport function generateRandomSecretKeyDeprecated(): string {\n  return generateRandomHexString(6);\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAEO,MAAME,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,QAAQ;AACjC,MAAME,2BAA2B,GAAAD,OAAA,CAAAC,2BAAA,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,GAAW,EAAEC,MAAc,EAAU;EACxE;EACA;EACA;EACA,MAAMC,CAAC,GAAG,IAAAC,oBAAY,EAACP,gBAAgB,EAAEK,MAAM,CAAC;EAChD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;EACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;EACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;AAChC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,oBAAoBA,CAACV,GAAW,EAAEC,MAAc,EAAU;EACxE,IAAI;IACF;IACA;IACA,MAAMC,CAAC,GAAG,IAAAS,sBAAc,EAACf,gBAAgB,EAAEK,MAAM,CAAC;IAClD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;IACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;IACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;EAChC,CAAC,CAAC,OAAOM,CAAC,EAAE;IACV,OAAOJ,MAAM,CAACK,KAAK,CAAC,CAAC,CAAC;EACxB;AACF;AAEO,MAAMC,6BAA6B,GAAAjB,OAAA,CAAAiB,6BAAA,GAAG,EAAE;;AAE/C;AACA;AACA;AACO,SAASC,iCAAiCA,CAAA,EAAW;EAC1D,OAAO,IAAAC,8BAAuB,EAAC,CAAC,CAAC;AACnC"}

package/build/signature.js

@@ -11,8 +11,7 @@ var _debug = _interopRequireDefault(require("debug"));
 var _config = require("@verdaccio/config");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:auth:token:legacy');
-const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
-exports.defaultAlgorithm = defaultAlgorithm;
+const defaultAlgorithm = exports.defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
 const inputEncoding = 'utf8';
 const outputEncoding = 'hex';
 // Must be 256 bits (32 characters)
@@ -24,7 +23,7 @@ function aesEncrypt(value, key) {
   debug('encrypt %o', value);
   debug('algorithm %o', defaultAlgorithm);
   // IV must be a buffer of length 16
-  const iv = Buffer.from((0, _crypto.randomBytes)(16));
+  const iv = (0, _crypto.randomBytes)(16);
   const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
   const isKeyValid = (secretKey === null || secretKey === void 0 ? void 0 : secretKey.length) === _config.TOKEN_VALID_LENGTH;
   debug('length secret key %o', secretKey === null || secretKey === void 0 ? void 0 : secretKey.length);

package/build/signature.js.map

@@ -1 +1 @@
-{"version":3,"file":"signature.js","names":["_crypto","require","_debug","_interopRequireDefault","_config","obj","__esModule","default","debug","buildDebug","defaultAlgorithm","process","env","VERDACCIO_LEGACY_ALGORITHM","exports","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/signature.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  // IV must be a buffer of length 16\n  const iv = Buffer.from(randomBytes(16));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAOA,IAAAC,MAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AAAuD,SAAAE,uBAAAE,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAGC,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AAACC,OAAA,CAAAJ,gBAAA,GAAAA,gBAAA;AACxF,MAAMK,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA;AACA,MAAMC,+BAA+B,GAAGN,OAAO,CAACC,GAAG,CAACK,+BAA+B;AAE5E,SAASC,UAAUA,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAZ,KAAK,CAAC,YAAY,EAAEW,KAAK,CAAC;EAC1BX,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC;EACA,MAAMW,EAAE,GAAGC,MAAM,CAACC,IAAI,CAAC,IAAAC,mBAAW,EAAC,EAAE,CAAC,CAAC;EACvC,MAAMC,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;EACxD,MAAMM,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DpB,KAAK,CAAC,sBAAsB,EAAEiB,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDnB,KAAK,CAAC,oBAAoB,EAAEkB,UAAU,CAAC;EACvC,IAAI,CAACP,KAAK,IAAI,CAACM,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAACpB,gBAAgB,EAAEe,SAAS,EAAEJ,EAAE,CAAC;EAC9D,IAAIU,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACb,KAAK,EAAEJ,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAe,SAAS,IAAIF,MAAM,CAACI,KAAK,CAACjB,cAAc,CAAC;EACzC,MAAMkB,KAAK,GAAI,GAAEb,EAAE,CAACc,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,CAAC,CAAE,EAAC;EAC7D3B,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAOc,MAAM,CAACC,IAAI,CAACW,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASC,UAAUA,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGf,MAAM,CAACC,IAAI,CAACJ,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACF,QAAQ,CAAC,CAAC,CAACI,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGlB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACG,KAAK,CAAC,CAAC,EAAEzB,cAAc,CAAC;IACzD;IACA,MAAM0B,aAAa,GAAGpB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE3B,cAAc,CAAC;IACtE,MAAMS,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAACnC,gBAAgB,EAAEe,SAAS,EAAEe,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACZ,MAAM,CAACU,aAAa,EAAS1B,cAAc,EAAED,aAAa,CAAC;IACpF+B,SAAS,IAAIF,QAAQ,CAACX,KAAK,CAAClB,aAAa,CAAC;IAC1CP,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOsC,SAAS,CAACX,QAAQ,CAAC,CAAC;EAC7B,CAAC,CAAC,OAAOY,CAAM,EAAE;IACf;EACF;AACF"}
+{"version":3,"file":"signature.js","names":["_crypto","require","_debug","_interopRequireDefault","_config","obj","__esModule","default","debug","buildDebug","defaultAlgorithm","exports","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","Buffer","from","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/signature.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  // IV must be a buffer of length 16\n  const iv = randomBytes(16);\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAOA,IAAAC,MAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AAAuD,SAAAE,uBAAAE,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAGE,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AACvF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA;AACA,MAAMC,+BAA+B,GAAGL,OAAO,CAACC,GAAG,CAACI,+BAA+B;AAE5E,SAASC,UAAUA,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAZ,KAAK,CAAC,YAAY,EAAEW,KAAK,CAAC;EAC1BX,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC;EACA,MAAMW,EAAE,GAAG,IAAAC,mBAAW,EAAC,EAAE,CAAC;EAC1B,MAAMC,SAAS,GAAGN,+BAA+B,IAAIG,GAAG;EACxD,MAAMI,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DlB,KAAK,CAAC,sBAAsB,EAAEe,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDjB,KAAK,CAAC,oBAAoB,EAAEgB,UAAU,CAAC;EACvC,IAAI,CAACL,KAAK,IAAI,CAACI,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAAClB,gBAAgB,EAAEa,SAAS,EAAEF,EAAE,CAAC;EAC9D,IAAIQ,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACX,KAAK,EAAEJ,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAa,SAAS,IAAIF,MAAM,CAACI,KAAK,CAACf,cAAc,CAAC;EACzC,MAAMgB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,CAAC,CAAE,EAAC;EAC7DzB,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAO0B,MAAM,CAACC,IAAI,CAACH,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASG,UAAUA,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGH,MAAM,CAACC,IAAI,CAAChB,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACJ,QAAQ,CAAC,CAAC,CAACM,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGN,MAAM,CAACC,IAAI,CAACG,SAAS,CAACG,KAAK,CAAC,CAAC,EAAEzB,cAAc,CAAC;IACzD;IACA,MAAM0B,aAAa,GAAGR,MAAM,CAACC,IAAI,CAACG,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE3B,cAAc,CAAC;IACtE,MAAMO,SAAS,GAAGN,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAACnC,gBAAgB,EAAEa,SAAS,EAAEiB,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACd,MAAM,CAACY,aAAa,EAAS1B,cAAc,EAAED,aAAa,CAAC;IACpF+B,SAAS,IAAIF,QAAQ,CAACb,KAAK,CAAChB,aAAa,CAAC;IAC1CP,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOsC,SAAS,CAACb,QAAQ,CAAC,CAAC;EAC7B,CAAC,CAAC,OAAOc,CAAM,EAAE;IACf;EACF;AACF"}

package/build/utils.js

@@ -10,13 +10,12 @@ exports.generateRandomHexString = generateRandomHexString;
 exports.generateRandomSecretKey = generateRandomSecretKey;
 exports.stringToMD5 = stringToMD5;
 var _crypto = require("crypto");
-const defaultTarballHashAlgorithm = 'sha1';
+const defaultTarballHashAlgorithm = exports.defaultTarballHashAlgorithm = 'sha1';
 
 /**
  *
  * @returns
  */
-exports.defaultTarballHashAlgorithm = defaultTarballHashAlgorithm;
 function createTarballHash(algorithm = defaultTarballHashAlgorithm) {
   return (0, _crypto.createHash)(algorithm);
 }
@@ -40,12 +39,11 @@ function stringToMD5(data) {
 function generateRandomHexString(length = 8) {
   return (0, _crypto.pseudoRandomBytes)(length).toString('hex');
 }
-const TOKEN_VALID_LENGTH = 32;
+const TOKEN_VALID_LENGTH = exports.TOKEN_VALID_LENGTH = 32;
 
 /**
  * Generate a secret of 32 characters.
  */
-exports.TOKEN_VALID_LENGTH = TOKEN_VALID_LENGTH;
 function generateRandomSecretKey() {
   return (0, _crypto.randomBytes)(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);
 }

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["_crypto","require","defaultTarballHashAlgorithm","exports","createTarballHash","algorithm","createHash","stringToMD5","data","update","digest","generateRandomHexString","length","pseudoRandomBytes","toString","TOKEN_VALID_LENGTH","generateRandomSecretKey","randomBytes","substring"],"sources":["../src/utils.ts"],"sourcesContent":["import { Hash, createHash, pseudoRandomBytes, randomBytes } from 'crypto';\n\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @returns\n */\nexport function createTarballHash(algorithm = defaultTarballHashAlgorithm): Hash {\n  return createHash(algorithm);\n}\n\n/**\n * Express doesn't do ETAGS with requests <= 1024b\n * we use md5 here, it works well on 1k+ bytes, but with fewer data\n * could improve performance using crc32 after benchmarks.\n * @param {Object} data\n * @return {String}\n */\nexport function stringToMD5(data: Buffer | string): string {\n  return createHash('md5').update(data).digest('hex');\n}\n\n/**\n *\n * @param length\n * @returns\n */\nexport function generateRandomHexString(length = 8): string {\n  return pseudoRandomBytes(length).toString('hex');\n}\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Generate a secret of 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,2BAA2B,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AAHAC,OAAA,CAAAD,2BAAA,GAAAA,2BAAA;AAIO,SAASE,iBAAiBA,CAACC,SAAS,GAAGH,2BAA2B,EAAQ;EAC/E,OAAO,IAAAI,kBAAU,EAACD,SAAS,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,WAAWA,CAACC,IAAqB,EAAU;EACzD,OAAO,IAAAF,kBAAU,EAAC,KAAK,CAAC,CAACG,MAAM,CAACD,IAAI,CAAC,CAACE,MAAM,CAAC,KAAK,CAAC;AACrD;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,uBAAuBA,CAACC,MAAM,GAAG,CAAC,EAAU;EAC1D,OAAO,IAAAC,yBAAiB,EAACD,MAAM,CAAC,CAACE,QAAQ,CAAC,KAAK,CAAC;AAClD;AAEO,MAAMC,kBAAkB,GAAG,EAAE;;AAEpC;AACA;AACA;AAFAZ,OAAA,CAAAY,kBAAA,GAAAA,kBAAA;AAGO,SAASC,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACF,kBAAkB,CAAC,CAACD,QAAQ,CAAC,QAAQ,CAAC,CAACI,SAAS,CAAC,CAAC,EAAEH,kBAAkB,CAAC;AAC5F"}
+{"version":3,"file":"utils.js","names":["_crypto","require","defaultTarballHashAlgorithm","exports","createTarballHash","algorithm","createHash","stringToMD5","data","update","digest","generateRandomHexString","length","pseudoRandomBytes","toString","TOKEN_VALID_LENGTH","generateRandomSecretKey","randomBytes","substring"],"sources":["../src/utils.ts"],"sourcesContent":["import { Hash, createHash, pseudoRandomBytes, randomBytes } from 'crypto';\n\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @returns\n */\nexport function createTarballHash(algorithm = defaultTarballHashAlgorithm): Hash {\n  return createHash(algorithm);\n}\n\n/**\n * Express doesn't do ETAGS with requests <= 1024b\n * we use md5 here, it works well on 1k+ bytes, but with fewer data\n * could improve performance using crc32 after benchmarks.\n * @param {Object} data\n * @return {String}\n */\nexport function stringToMD5(data: Buffer | string): string {\n  return createHash('md5').update(data).digest('hex');\n}\n\n/**\n *\n * @param length\n * @returns\n */\nexport function generateRandomHexString(length = 8): string {\n  return pseudoRandomBytes(length).toString('hex');\n}\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Generate a secret of 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACO,SAASE,iBAAiBA,CAACC,SAAS,GAAGH,2BAA2B,EAAQ;EAC/E,OAAO,IAAAI,kBAAU,EAACD,SAAS,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,WAAWA,CAACC,IAAqB,EAAU;EACzD,OAAO,IAAAF,kBAAU,EAAC,KAAK,CAAC,CAACG,MAAM,CAACD,IAAI,CAAC,CAACE,MAAM,CAAC,KAAK,CAAC;AACrD;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,uBAAuBA,CAACC,MAAM,GAAG,CAAC,EAAU;EAC1D,OAAO,IAAAC,yBAAiB,EAACD,MAAM,CAAC,CAACE,QAAQ,CAAC,KAAK,CAAC;AAClD;AAEO,MAAMC,kBAAkB,GAAAZ,OAAA,CAAAY,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACO,SAASC,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACF,kBAAkB,CAAC,CAACD,QAAQ,CAAC,QAAQ,CAAC,CAACI,SAAS,CAAC,CAAC,EAAEH,kBAAkB,CAAC;AAC5F"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/signature",
-  "version": "7.0.0-next.1",
+  "version": "7.0.0-next.3",
   "description": "verdaccio signature utils",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -30,12 +30,11 @@
   },
   "dependencies": {
     "jsonwebtoken": "9.0.2",
-    "debug": "4.3.4",
-    "lodash": "4.17.21"
+    "debug": "4.3.4"
   },
   "devDependencies": {
-    "@verdaccio/config": "7.0.0-next.3",
-    "@verdaccio/types": "12.0.0-next.1"
+    "@verdaccio/config": "7.0.0-next.5",
+    "@verdaccio/types": "12.0.0-next.2"
   },
   "funding": {
     "type": "opencollective",

package/src/index.ts

@@ -4,7 +4,7 @@ export {
   generateRandomSecretKeyDeprecated,
 } from './legacy-signature';
 export { aesDecrypt, aesEncrypt } from './signature';
-export { signPayload, verifyPayload } from './jwt-token';
+export { signPayload, verifyPayload, SignOptionsSignature } from './jwt-token';
 export * as utils from './utils';
 export * as types from './types';
 export { parseBasicPayload } from './token';

package/src/jwt-token.ts

@@ -41,6 +41,6 @@ export async function signPayload(
 }
 
 export function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {
-  debug('verify jwt token');
+  debug('verifying jwt token');
   return jwt.verify(token, secretOrPrivateKey) as RemoteUser;
 }

package/src/signature.ts

@@ -24,7 +24,7 @@ export function aesEncrypt(value: string, key: string): string | void {
   debug('encrypt %o', value);
   debug('algorithm %o', defaultAlgorithm);
   // IV must be a buffer of length 16
-  const iv = Buffer.from(randomBytes(16));
+  const iv = randomBytes(16);
   const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
   const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;
   debug('length secret key %o', secretKey?.length);