@verdaccio/signature 7.0.0-next.2 → 7.0.0-next.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +6 -0
- package/build/jwt-token.js +1 -1
- package/build/jwt-token.js.map +1 -1
- package/build/signature.js +1 -1
- package/build/signature.js.map +1 -1
- package/package.json +4 -5
- package/src/jwt-token.ts +1 -1
- package/src/signature.ts +1 -1
package/CHANGELOG.md
CHANGED
package/build/jwt-token.js
CHANGED
|
@@ -37,7 +37,7 @@ async function signPayload(payload, secretOrPrivateKey, options = {}) {
|
|
|
37
37
|
});
|
|
38
38
|
}
|
|
39
39
|
function verifyPayload(token, secretOrPrivateKey) {
|
|
40
|
-
debug('
|
|
40
|
+
debug('verifying jwt token');
|
|
41
41
|
return _jsonwebtoken.default.verify(token, secretOrPrivateKey);
|
|
42
42
|
}
|
|
43
43
|
//# sourceMappingURL=jwt-token.js.map
|
package/build/jwt-token.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"jwt-token.js","names":["_debug","_interopRequireDefault","require","_jsonwebtoken","obj","__esModule","default","debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","message","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt, { SignOptions } from 'jsonwebtoken';\n\nimport { RemoteUser } from '@verdaccio/types';\n\nexport type SignOptionsSignature = Pick<SignOptions, 'algorithm' | 'expiresIn' | 'notBefore'>;\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n payload: RemoteUser,\n secretOrPrivateKey: string,\n options: SignOptionsSignature = {}\n): Promise<string> {\n return new Promise(function (resolve, reject) {\n debug('sign jwt token');\n jwt.sign(\n payload,\n secretOrPrivateKey, // FIXME: upgrade to the latest library and types\n {\n // 1 === 1ms (one millisecond)\n notBefore: '1', // Make sure the time will not rollback :)\n ...options,\n },\n (error, token) => {\n if (error) {\n debug('error on sign jwt token %s', error.message);\n return reject(error);\n }\n debug('signed jwt token successfully');\n return resolve(token as string);\n }\n );\n });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n debug('
|
|
1
|
+
{"version":3,"file":"jwt-token.js","names":["_debug","_interopRequireDefault","require","_jsonwebtoken","obj","__esModule","default","debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","message","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt, { SignOptions } from 'jsonwebtoken';\n\nimport { RemoteUser } from '@verdaccio/types';\n\nexport type SignOptionsSignature = Pick<SignOptions, 'algorithm' | 'expiresIn' | 'notBefore'>;\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n payload: RemoteUser,\n secretOrPrivateKey: string,\n options: SignOptionsSignature = {}\n): Promise<string> {\n return new Promise(function (resolve, reject) {\n debug('sign jwt token');\n jwt.sign(\n payload,\n secretOrPrivateKey, // FIXME: upgrade to the latest library and types\n {\n // 1 === 1ms (one millisecond)\n notBefore: '1', // Make sure the time will not rollback :)\n ...options,\n },\n (error, token) => {\n if (error) {\n debug('error on sign jwt token %s', error.message);\n return reject(error);\n }\n debug('signed jwt token successfully');\n return resolve(token as string);\n }\n );\n });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n debug('verifying jwt token');\n return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,aAAA,GAAAF,sBAAA,CAAAC,OAAA;AAAgD,SAAAD,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAMhD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAWA,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAA6B,GAAG,CAAC,CAAC,EACjB;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAE;IAC5CR,KAAK,CAAC,gBAAgB,CAAC;IACvBS,qBAAG,CAACC,IAAI,CACNP,OAAO,EACPC,kBAAkB;IAAE;IACpB;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAK,KAAK;MAChB,IAAID,KAAK,EAAE;QACTZ,KAAK,CAAC,4BAA4B,EAAEY,KAAK,CAACE,OAAO,CAAC;QAClD,OAAON,MAAM,CAACI,KAAK,CAAC;MACtB;MACAZ,KAAK,CAAC,+BAA+B,CAAC;MACtC,OAAOO,OAAO,CAACM,KAAe,CAAC;IACjC,CACF,CAAC;EACH,CAAC,CAAC;AACJ;AAEO,SAASE,aAAaA,CAACF,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,OAAOS,qBAAG,CAACO,MAAM,CAACH,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}
|
package/build/signature.js
CHANGED
|
@@ -23,7 +23,7 @@ function aesEncrypt(value, key) {
|
|
|
23
23
|
debug('encrypt %o', value);
|
|
24
24
|
debug('algorithm %o', defaultAlgorithm);
|
|
25
25
|
// IV must be a buffer of length 16
|
|
26
|
-
const iv =
|
|
26
|
+
const iv = (0, _crypto.randomBytes)(16);
|
|
27
27
|
const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
|
|
28
28
|
const isKeyValid = (secretKey === null || secretKey === void 0 ? void 0 : secretKey.length) === _config.TOKEN_VALID_LENGTH;
|
|
29
29
|
debug('length secret key %o', secretKey === null || secretKey === void 0 ? void 0 : secretKey.length);
|
package/build/signature.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"signature.js","names":["_crypto","require","_debug","_interopRequireDefault","_config","obj","__esModule","default","debug","buildDebug","defaultAlgorithm","exports","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","
|
|
1
|
+
{"version":3,"file":"signature.js","names":["_crypto","require","_debug","_interopRequireDefault","_config","obj","__esModule","default","debug","buildDebug","defaultAlgorithm","exports","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","Buffer","from","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/signature.ts"],"sourcesContent":["import {\n BinaryToTextEncoding,\n CharacterEncoding,\n createCipheriv,\n createDecipheriv,\n randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv\n debug('encrypt %o', value);\n debug('algorithm %o', defaultAlgorithm);\n // IV must be a buffer of length 16\n const iv = randomBytes(16);\n const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n debug('length secret key %o', secretKey?.length);\n debug('is valid secret %o', isKeyValid);\n if (!value || !secretKey || !isKeyValid) {\n return;\n }\n\n const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n // @ts-ignore\n encrypted += cipher.final(outputEncoding);\n const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n debug('token generated successfully');\n return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n try {\n const buff = Buffer.from(value, 'base64');\n const textParts = buff.toString().split(':');\n\n // extract the IV from the first half of the value\n // @ts-ignore\n const IV = Buffer.from(textParts.shift(), outputEncoding);\n // extract the encrypted text without the IV\n const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n // decipher the string\n const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n // FIXME: fix type here should allow Buffer\n let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n decrypted += decipher.final(inputEncoding);\n debug('token decrypted successfully');\n return decrypted.toString();\n } catch (_: any) {\n return;\n }\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAOA,IAAAC,MAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AAAuD,SAAAE,uBAAAE,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAGE,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AACvF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA;AACA,MAAMC,+BAA+B,GAAGL,OAAO,CAACC,GAAG,CAACI,+BAA+B;AAE5E,SAASC,UAAUA,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAZ,KAAK,CAAC,YAAY,EAAEW,KAAK,CAAC;EAC1BX,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC;EACA,MAAMW,EAAE,GAAG,IAAAC,mBAAW,EAAC,EAAE,CAAC;EAC1B,MAAMC,SAAS,GAAGN,+BAA+B,IAAIG,GAAG;EACxD,MAAMI,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DlB,KAAK,CAAC,sBAAsB,EAAEe,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDjB,KAAK,CAAC,oBAAoB,EAAEgB,UAAU,CAAC;EACvC,IAAI,CAACL,KAAK,IAAI,CAACI,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAAClB,gBAAgB,EAAEa,SAAS,EAAEF,EAAE,CAAC;EAC9D,IAAIQ,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACX,KAAK,EAAEJ,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAa,SAAS,IAAIF,MAAM,CAACI,KAAK,CAACf,cAAc,CAAC;EACzC,MAAMgB,KAAK,GAAI,GAAEX,EAAE,CAACY,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,CAAC,CAAE,EAAC;EAC7DzB,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAO0B,MAAM,CAACC,IAAI,CAACH,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASG,UAAUA,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGH,MAAM,CAACC,IAAI,CAAChB,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACJ,QAAQ,CAAC,CAAC,CAACM,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGN,MAAM,CAACC,IAAI,CAACG,SAAS,CAACG,KAAK,CAAC,CAAC,EAAEzB,cAAc,CAAC;IACzD;IACA,MAAM0B,aAAa,GAAGR,MAAM,CAACC,IAAI,CAACG,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE3B,cAAc,CAAC;IACtE,MAAMO,SAAS,GAAGN,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAACnC,gBAAgB,EAAEa,SAAS,EAAEiB,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACd,MAAM,CAACY,aAAa,EAAS1B,cAAc,EAAED,aAAa,CAAC;IACpF+B,SAAS,IAAIF,QAAQ,CAACb,KAAK,CAAChB,aAAa,CAAC;IAC1CP,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOsC,SAAS,CAACb,QAAQ,CAAC,CAAC;EAC7B,CAAC,CAAC,OAAOc,CAAM,EAAE;IACf;EACF;AACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/signature",
|
|
3
|
-
"version": "7.0.0-next.
|
|
3
|
+
"version": "7.0.0-next.3",
|
|
4
4
|
"description": "verdaccio signature utils",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -30,12 +30,11 @@
|
|
|
30
30
|
},
|
|
31
31
|
"dependencies": {
|
|
32
32
|
"jsonwebtoken": "9.0.2",
|
|
33
|
-
"debug": "4.3.4"
|
|
34
|
-
"lodash": "4.17.21"
|
|
33
|
+
"debug": "4.3.4"
|
|
35
34
|
},
|
|
36
35
|
"devDependencies": {
|
|
37
|
-
"@verdaccio/config": "7.0.0-next.
|
|
38
|
-
"@verdaccio/types": "12.0.0-next.
|
|
36
|
+
"@verdaccio/config": "7.0.0-next.5",
|
|
37
|
+
"@verdaccio/types": "12.0.0-next.2"
|
|
39
38
|
},
|
|
40
39
|
"funding": {
|
|
41
40
|
"type": "opencollective",
|
package/src/jwt-token.ts
CHANGED
|
@@ -41,6 +41,6 @@ export async function signPayload(
|
|
|
41
41
|
}
|
|
42
42
|
|
|
43
43
|
export function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {
|
|
44
|
-
debug('
|
|
44
|
+
debug('verifying jwt token');
|
|
45
45
|
return jwt.verify(token, secretOrPrivateKey) as RemoteUser;
|
|
46
46
|
}
|
package/src/signature.ts
CHANGED
|
@@ -24,7 +24,7 @@ export function aesEncrypt(value: string, key: string): string | void {
|
|
|
24
24
|
debug('encrypt %o', value);
|
|
25
25
|
debug('algorithm %o', defaultAlgorithm);
|
|
26
26
|
// IV must be a buffer of length 16
|
|
27
|
-
const iv =
|
|
27
|
+
const iv = randomBytes(16);
|
|
28
28
|
const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
|
|
29
29
|
const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;
|
|
30
30
|
debug('length secret key %o', secretKey?.length);
|