@verdaccio/signature 7.0.0-next.2 → 8.0.0-next-8.0

package/CHANGELOG.md

@@ -1,5 +1,47 @@
 # @verdaccio/signature
 
+## 8.0.0-next-8.0
+
+### Major Changes
+
+- chore: move v7 next to v8 next
+
+## 7.0.0
+
+### Major Changes
+
+- 47f61c6: feat!: bump to v7
+- e7ebccb: update major dependencies, remove old nodejs support
+
+### Minor Changes
+
+- daceb6d: restore legacy support
+- b6d5652: support for createCipher backward compatible
+- f047cc8: refactor: auth with legacy sign support
+- bd8703e: feat: add migrateToSecureLegacySignature and remove enhancedLegacySignature property
+
+### Patch Changes
+
+- 312bc10: chore: export signature options type
+
+## 7.0.0-next-7.5
+
+### Minor Changes
+
+- bd8703e: feat: add migrateToSecureLegacySignature and remove enhancedLegacySignature property
+
+## 7.0.0-next-7.4
+
+### Minor Changes
+
+- b6d5652: support for createCipher backward compatible
+
+## 7.0.0-next.3
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
 ## 7.0.0-next.2
 
 ### Patch Changes

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2021 Verdaccio contributors
+Copyright (c) 2024 Verdaccio contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/build/index.js

@@ -67,5 +67,5 @@ var _types = _interopRequireWildcard(require("./types"));
 exports.types = _types;
 var _token = require("./token");
 function _getRequireWildcardCache(e) { if ("function" != typeof WeakMap) return null; var r = new WeakMap(), t = new WeakMap(); return (_getRequireWildcardCache = function (e) { return e ? t : r; })(e); }
-function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && Object.prototype.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
+function _interopRequireWildcard(e, r) { if (!r && e && e.__esModule) return e; if (null === e || "object" != typeof e && "function" != typeof e) return { default: e }; var t = _getRequireWildcardCache(r); if (t && t.has(e)) return t.get(e); var n = { __proto__: null }, a = Object.defineProperty && Object.getOwnPropertyDescriptor; for (var u in e) if ("default" !== u && {}.hasOwnProperty.call(e, u)) { var i = a ? Object.getOwnPropertyDescriptor(e, u) : null; i && (i.get || i.set) ? Object.defineProperty(n, u, i) : n[u] = e[u]; } return n.default = e, t && t.set(e, n), n; }
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_legacySignature","require","_signature","_jwtToken","_utils","_interopRequireWildcard","exports","utils","_types","types","_token","_getRequireWildcardCache","e","WeakMap","r","t","__esModule","default","has","get","n","__proto__","a","Object","defineProperty","getOwnPropertyDescriptor","u","prototype","hasOwnProperty","call","i","set"],"sources":["../src/index.ts"],"sourcesContent":["export {\n  aesDecryptDeprecated,\n  aesEncryptDeprecated,\n  generateRandomSecretKeyDeprecated,\n} from './legacy-signature';\nexport { aesDecrypt, aesEncrypt } from './signature';\nexport { signPayload, verifyPayload, SignOptionsSignature } from './jwt-token';\nexport * as utils from './utils';\nexport * as types from './types';\nexport { parseBasicPayload } from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,gBAAA,GAAAC,OAAA;AAKA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAA+E,IAAAG,MAAA,GAAAC,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAC,KAAA,GAAAH,MAAA;AAAA,IAAAI,MAAA,GAAAH,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAG,KAAA,GAAAD,MAAA;AAG/E,IAAAE,MAAA,GAAAT,OAAA;AAA4C,SAAAU,yBAAAC,CAAA,6BAAAC,OAAA,mBAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,CAAA,WAAAA,CAAA,GAAAG,CAAA,GAAAD,CAAA,KAAAF,CAAA;AAAA,SAAAP,wBAAAO,CAAA,EAAAE,CAAA,SAAAA,CAAA,IAAAF,CAAA,IAAAA,CAAA,CAAAI,UAAA,SAAAJ,CAAA,eAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,WAAAK,OAAA,EAAAL,CAAA,QAAAG,CAAA,GAAAJ,wBAAA,CAAAG,CAAA,OAAAC,CAAA,IAAAA,CAAA,CAAAG,GAAA,CAAAN,CAAA,UAAAG,CAAA,CAAAI,GAAA,CAAAP,CAAA,OAAAQ,CAAA,KAAAC,SAAA,UAAAC,CAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,CAAA,IAAAd,CAAA,oBAAAc,CAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAjB,CAAA,EAAAc,CAAA,SAAAI,CAAA,GAAAR,CAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAb,CAAA,EAAAc,CAAA,UAAAI,CAAA,KAAAA,CAAA,CAAAX,GAAA,IAAAW,CAAA,CAAAC,GAAA,IAAAR,MAAA,CAAAC,cAAA,CAAAJ,CAAA,EAAAM,CAAA,EAAAI,CAAA,IAAAV,CAAA,CAAAM,CAAA,IAAAd,CAAA,CAAAc,CAAA,YAAAN,CAAA,CAAAH,OAAA,GAAAL,CAAA,EAAAG,CAAA,IAAAA,CAAA,CAAAgB,GAAA,CAAAnB,CAAA,EAAAQ,CAAA,GAAAA,CAAA"}
+{"version":3,"file":"index.js","names":["_legacySignature","require","_signature","_jwtToken","_utils","_interopRequireWildcard","exports","utils","_types","types","_token","_getRequireWildcardCache","e","WeakMap","r","t","__esModule","default","has","get","n","__proto__","a","Object","defineProperty","getOwnPropertyDescriptor","u","hasOwnProperty","call","i","set"],"sources":["../src/index.ts"],"sourcesContent":["export {\n  aesDecryptDeprecated,\n  aesEncryptDeprecated,\n  generateRandomSecretKeyDeprecated,\n} from './legacy-signature';\n\nexport { aesDecrypt, aesEncrypt } from './signature';\nexport { signPayload, verifyPayload, SignOptionsSignature } from './jwt-token';\nexport * as utils from './utils';\nexport * as types from './types';\nexport { parseBasicPayload } from './token';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,gBAAA,GAAAC,OAAA;AAMA,IAAAC,UAAA,GAAAD,OAAA;AACA,IAAAE,SAAA,GAAAF,OAAA;AAA+E,IAAAG,MAAA,GAAAC,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAC,KAAA,GAAAH,MAAA;AAAA,IAAAI,MAAA,GAAAH,uBAAA,CAAAJ,OAAA;AAAAK,OAAA,CAAAG,KAAA,GAAAD,MAAA;AAG/E,IAAAE,MAAA,GAAAT,OAAA;AAA4C,SAAAU,yBAAAC,CAAA,6BAAAC,OAAA,mBAAAC,CAAA,OAAAD,OAAA,IAAAE,CAAA,OAAAF,OAAA,YAAAF,wBAAA,YAAAA,CAAAC,CAAA,WAAAA,CAAA,GAAAG,CAAA,GAAAD,CAAA,KAAAF,CAAA;AAAA,SAAAP,wBAAAO,CAAA,EAAAE,CAAA,SAAAA,CAAA,IAAAF,CAAA,IAAAA,CAAA,CAAAI,UAAA,SAAAJ,CAAA,eAAAA,CAAA,uBAAAA,CAAA,yBAAAA,CAAA,WAAAK,OAAA,EAAAL,CAAA,QAAAG,CAAA,GAAAJ,wBAAA,CAAAG,CAAA,OAAAC,CAAA,IAAAA,CAAA,CAAAG,GAAA,CAAAN,CAAA,UAAAG,CAAA,CAAAI,GAAA,CAAAP,CAAA,OAAAQ,CAAA,KAAAC,SAAA,UAAAC,CAAA,GAAAC,MAAA,CAAAC,cAAA,IAAAD,MAAA,CAAAE,wBAAA,WAAAC,CAAA,IAAAd,CAAA,oBAAAc,CAAA,OAAAC,cAAA,CAAAC,IAAA,CAAAhB,CAAA,EAAAc,CAAA,SAAAG,CAAA,GAAAP,CAAA,GAAAC,MAAA,CAAAE,wBAAA,CAAAb,CAAA,EAAAc,CAAA,UAAAG,CAAA,KAAAA,CAAA,CAAAV,GAAA,IAAAU,CAAA,CAAAC,GAAA,IAAAP,MAAA,CAAAC,cAAA,CAAAJ,CAAA,EAAAM,CAAA,EAAAG,CAAA,IAAAT,CAAA,CAAAM,CAAA,IAAAd,CAAA,CAAAc,CAAA,YAAAN,CAAA,CAAAH,OAAA,GAAAL,CAAA,EAAAG,CAAA,IAAAA,CAAA,CAAAe,GAAA,CAAAlB,CAAA,EAAAQ,CAAA,GAAAA,CAAA","ignoreList":[]}

package/build/jwt-token.js

@@ -7,7 +7,7 @@ exports.signPayload = signPayload;
 exports.verifyPayload = verifyPayload;
 var _debug = _interopRequireDefault(require("debug"));
 var _jsonwebtoken = _interopRequireDefault(require("jsonwebtoken"));
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:auth:token:jwt');
 /**
  * Sign the payload and return JWT
@@ -37,7 +37,7 @@ async function signPayload(payload, secretOrPrivateKey, options = {}) {
   });
 }
 function verifyPayload(token, secretOrPrivateKey) {
-  debug('verify jwt token');
+  debug('verifying jwt token');
   return _jsonwebtoken.default.verify(token, secretOrPrivateKey);
 }
 //# sourceMappingURL=jwt-token.js.map

package/build/jwt-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt-token.js","names":["_debug","_interopRequireDefault","require","_jsonwebtoken","obj","__esModule","default","debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","message","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt, { SignOptions } from 'jsonwebtoken';\n\nimport { RemoteUser } from '@verdaccio/types';\n\nexport type SignOptionsSignature = Pick<SignOptions, 'algorithm' | 'expiresIn' | 'notBefore'>;\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: SignOptionsSignature = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject) {\n    debug('sign jwt token');\n    jwt.sign(\n      payload,\n      secretOrPrivateKey, // FIXME: upgrade to the latest library and types\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        if (error) {\n          debug('error on sign jwt token %s', error.message);\n          return reject(error);\n        }\n        debug('signed jwt token successfully');\n        return resolve(token as string);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verify jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,aAAA,GAAAF,sBAAA,CAAAC,OAAA;AAAgD,SAAAD,uBAAAG,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAMhD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAWA,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAA6B,GAAG,CAAC,CAAC,EACjB;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAE;IAC5CR,KAAK,CAAC,gBAAgB,CAAC;IACvBS,qBAAG,CAACC,IAAI,CACNP,OAAO,EACPC,kBAAkB;IAAE;IACpB;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAK,KAAK;MAChB,IAAID,KAAK,EAAE;QACTZ,KAAK,CAAC,4BAA4B,EAAEY,KAAK,CAACE,OAAO,CAAC;QAClD,OAAON,MAAM,CAACI,KAAK,CAAC;MACtB;MACAZ,KAAK,CAAC,+BAA+B,CAAC;MACtC,OAAOO,OAAO,CAACM,KAAe,CAAC;IACjC,CACF,CAAC;EACH,CAAC,CAAC;AACJ;AAEO,SAASE,aAAaA,CAACF,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,kBAAkB,CAAC;EACzB,OAAOS,qBAAG,CAACO,MAAM,CAACH,KAAK,EAAET,kBAAkB,CAAC;AAC9C"}
+{"version":3,"file":"jwt-token.js","names":["_debug","_interopRequireDefault","require","_jsonwebtoken","e","__esModule","default","debug","buildDebug","signPayload","payload","secretOrPrivateKey","options","Promise","resolve","reject","jwt","sign","notBefore","error","token","message","verifyPayload","verify"],"sources":["../src/jwt-token.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport jwt, { SignOptions } from 'jsonwebtoken';\n\nimport { RemoteUser } from '@verdaccio/types';\n\nexport type SignOptionsSignature = Pick<SignOptions, 'algorithm' | 'expiresIn' | 'notBefore'>;\n\nconst debug = buildDebug('verdaccio:auth:token:jwt');\n/**\n * Sign the payload and return JWT\n * https://github.com/auth0/node-jsonwebtoken#jwtsignpayload-secretorprivatekey-options-callback\n * @param payload\n * @param secretOrPrivateKey\n * @param options\n */\nexport async function signPayload(\n  payload: RemoteUser,\n  secretOrPrivateKey: string,\n  options: SignOptionsSignature = {}\n): Promise<string> {\n  return new Promise(function (resolve, reject) {\n    debug('sign jwt token');\n    jwt.sign(\n      payload,\n      secretOrPrivateKey, // FIXME: upgrade to the latest library and types\n      {\n        // 1 === 1ms (one millisecond)\n        notBefore: '1', // Make sure the time will not rollback :)\n        ...options,\n      },\n      (error, token) => {\n        if (error) {\n          debug('error on sign jwt token %s', error.message);\n          return reject(error);\n        }\n        debug('signed jwt token successfully');\n        return resolve(token as string);\n      }\n    );\n  });\n}\n\nexport function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {\n  debug('verifying jwt token');\n  return jwt.verify(token, secretOrPrivateKey) as RemoteUser;\n}\n"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,aAAA,GAAAF,sBAAA,CAAAC,OAAA;AAAgD,SAAAD,uBAAAG,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAMhD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAeC,WAAWA,CAC/BC,OAAmB,EACnBC,kBAA0B,EAC1BC,OAA6B,GAAG,CAAC,CAAC,EACjB;EACjB,OAAO,IAAIC,OAAO,CAAC,UAAUC,OAAO,EAAEC,MAAM,EAAE;IAC5CR,KAAK,CAAC,gBAAgB,CAAC;IACvBS,qBAAG,CAACC,IAAI,CACNP,OAAO,EACPC,kBAAkB;IAAE;IACpB;MACE;MACAO,SAAS,EAAE,GAAG;MAAE;MAChB,GAAGN;IACL,CAAC,EACD,CAACO,KAAK,EAAEC,KAAK,KAAK;MAChB,IAAID,KAAK,EAAE;QACTZ,KAAK,CAAC,4BAA4B,EAAEY,KAAK,CAACE,OAAO,CAAC;QAClD,OAAON,MAAM,CAACI,KAAK,CAAC;MACtB;MACAZ,KAAK,CAAC,+BAA+B,CAAC;MACtC,OAAOO,OAAO,CAACM,KAAe,CAAC;IACjC,CACF,CAAC;EACH,CAAC,CAAC;AACJ;AAEO,SAASE,aAAaA,CAACF,KAAa,EAAET,kBAA0B,EAAc;EACnFJ,KAAK,CAAC,qBAAqB,CAAC;EAC5B,OAAOS,qBAAG,CAACO,MAAM,CAACH,KAAK,EAAET,kBAAkB,CAAC;AAC9C","ignoreList":[]}

package/build/legacy-signature/index.js

@@ -9,9 +9,12 @@ exports.aesEncryptDeprecated = aesEncryptDeprecated;
 exports.defaultTarballHashAlgorithm = exports.defaultAlgorithm = void 0;
 exports.generateRandomSecretKeyDeprecated = generateRandomSecretKeyDeprecated;
 var _crypto = require("crypto");
+var _debug = _interopRequireDefault(require("debug"));
 var _utils = require("../utils");
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const defaultAlgorithm = exports.defaultAlgorithm = 'aes192';
 const defaultTarballHashAlgorithm = exports.defaultTarballHashAlgorithm = 'sha1';
+const debug = (0, _debug.default)('verdaccio:auth:token:legacy:deprecated');
 
 /**
  *
@@ -20,12 +23,15 @@ const defaultTarballHashAlgorithm = exports.defaultTarballHashAlgorithm = 'sha1'
  * @returns
  */
 function aesEncryptDeprecated(buf, secret) {
+  debug('aesEncryptDeprecated init');
+  debug('algorithm %o', defaultAlgorithm);
   // deprecated (it will be removed in Verdaccio 6), it is a breaking change
   // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
   // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
   const c = (0, _crypto.createCipher)(defaultAlgorithm, secret);
   const b1 = c.update(buf);
   const b2 = c.final();
+  debug('deprecated legacy token generated successfully');
   return Buffer.concat([b1, b2]);
 }
 
@@ -37,11 +43,13 @@ function aesEncryptDeprecated(buf, secret) {
  */
 function aesDecryptDeprecated(buf, secret) {
   try {
+    debug('aesDecryptDeprecated init');
     // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options
     // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
     const c = (0, _crypto.createDecipher)(defaultAlgorithm, secret);
     const b1 = c.update(buf);
     const b2 = c.final();
+    debug('deprecated legacy token payload decrypted successfully');
     return Buffer.concat([b1, b2]);
   } catch (_) {
     return Buffer.alloc(0);

package/build/legacy-signature/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["_crypto","require","_utils","defaultAlgorithm","exports","defaultTarballHashAlgorithm","aesEncryptDeprecated","buf","secret","c","createCipher","b1","update","b2","final","Buffer","concat","aesDecryptDeprecated","createDecipher","_","alloc","TOKEN_VALID_LENGTH_DEPRECATED","generateRandomSecretKeyDeprecated","generateRandomHexString"],"sources":["../../src/legacy-signature/index.ts"],"sourcesContent":["import { createCipher, createDecipher } from 'crypto';\n\nimport { generateRandomHexString } from '../utils';\n\nexport const defaultAlgorithm = 'aes192';\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {\n  // deprecated (it will be removed in Verdaccio 6), it is a breaking change\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  const c = createCipher(defaultAlgorithm, secret);\n  const b1 = c.update(buf);\n  const b2 = c.final();\n  return Buffer.concat([b1, b2]);\n}\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {\n  try {\n    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options\n    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n    const c = createDecipher(defaultAlgorithm, secret);\n    const b1 = c.update(buf);\n    const b2 = c.final();\n    return Buffer.concat([b1, b2]);\n  } catch (_) {\n    return Buffer.alloc(0);\n  }\n}\n\nexport const TOKEN_VALID_LENGTH_DEPRECATED = 64;\n\n/**\n * Generate a secret key of 64 characters.\n */\nexport function generateRandomSecretKeyDeprecated(): string {\n  return generateRandomHexString(6);\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEA,IAAAC,MAAA,GAAAD,OAAA;AAEO,MAAME,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,QAAQ;AACjC,MAAME,2BAA2B,GAAAD,OAAA,CAAAC,2BAAA,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,GAAW,EAAEC,MAAc,EAAU;EACxE;EACA;EACA;EACA,MAAMC,CAAC,GAAG,IAAAC,oBAAY,EAACP,gBAAgB,EAAEK,MAAM,CAAC;EAChD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;EACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;EACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;AAChC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,oBAAoBA,CAACV,GAAW,EAAEC,MAAc,EAAU;EACxE,IAAI;IACF;IACA;IACA,MAAMC,CAAC,GAAG,IAAAS,sBAAc,EAACf,gBAAgB,EAAEK,MAAM,CAAC;IAClD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;IACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;IACpB,OAAOC,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;EAChC,CAAC,CAAC,OAAOM,CAAC,EAAE;IACV,OAAOJ,MAAM,CAACK,KAAK,CAAC,CAAC,CAAC;EACxB;AACF;AAEO,MAAMC,6BAA6B,GAAAjB,OAAA,CAAAiB,6BAAA,GAAG,EAAE;;AAE/C;AACA;AACA;AACO,SAASC,iCAAiCA,CAAA,EAAW;EAC1D,OAAO,IAAAC,8BAAuB,EAAC,CAAC,CAAC;AACnC"}
+{"version":3,"file":"index.js","names":["_crypto","require","_debug","_interopRequireDefault","_utils","e","__esModule","default","defaultAlgorithm","exports","defaultTarballHashAlgorithm","debug","buildDebug","aesEncryptDeprecated","buf","secret","c","createCipher","b1","update","b2","final","Buffer","concat","aesDecryptDeprecated","createDecipher","_","alloc","TOKEN_VALID_LENGTH_DEPRECATED","generateRandomSecretKeyDeprecated","generateRandomHexString"],"sources":["../../src/legacy-signature/index.ts"],"sourcesContent":["import { createCipher, createDecipher } from 'crypto';\nimport buildDebug from 'debug';\n\nimport { generateRandomHexString } from '../utils';\n\nexport const defaultAlgorithm = 'aes192';\nexport const defaultTarballHashAlgorithm = 'sha1';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy:deprecated');\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {\n  debug('aesEncryptDeprecated init');\n  debug('algorithm %o', defaultAlgorithm);\n  // deprecated (it will be removed in Verdaccio 6), it is a breaking change\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n  const c = createCipher(defaultAlgorithm, secret);\n  const b1 = c.update(buf);\n  const b2 = c.final();\n  debug('deprecated legacy token generated successfully');\n  return Buffer.concat([b1, b2]);\n}\n\n/**\n *\n * @param buf\n * @param secret\n * @returns\n */\nexport function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {\n  try {\n    debug('aesDecryptDeprecated init');\n    // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options\n    // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/\n    const c = createDecipher(defaultAlgorithm, secret);\n    const b1 = c.update(buf);\n    const b2 = c.final();\n    debug('deprecated legacy token payload decrypted successfully');\n    return Buffer.concat([b1, b2]);\n  } catch (_) {\n    return Buffer.alloc(0);\n  }\n}\n\nexport const TOKEN_VALID_LENGTH_DEPRECATED = 64;\n\n/**\n * Generate a secret key of 64 characters.\n */\nexport function generateRandomSecretKeyDeprecated(): string {\n  return generateRandomHexString(6);\n}\n"],"mappings":";;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,MAAA,GAAAH,OAAA;AAAmD,SAAAE,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAE5C,MAAMG,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAG,QAAQ;AACjC,MAAME,2BAA2B,GAAAD,OAAA,CAAAC,2BAAA,GAAG,MAAM;AAEjD,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,wCAAwC,CAAC;;AAElE;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,oBAAoBA,CAACC,GAAW,EAAEC,MAAc,EAAU;EACxEJ,KAAK,CAAC,2BAA2B,CAAC;EAClCA,KAAK,CAAC,cAAc,EAAEH,gBAAgB,CAAC;EACvC;EACA;EACA;EACA,MAAMQ,CAAC,GAAG,IAAAC,oBAAY,EAACT,gBAAgB,EAAEO,MAAM,CAAC;EAChD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;EACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;EACpBV,KAAK,CAAC,gDAAgD,CAAC;EACvD,OAAOW,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;AAChC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,oBAAoBA,CAACV,GAAW,EAAEC,MAAc,EAAU;EACxE,IAAI;IACFJ,KAAK,CAAC,2BAA2B,CAAC;IAClC;IACA;IACA,MAAMK,CAAC,GAAG,IAAAS,sBAAc,EAACjB,gBAAgB,EAAEO,MAAM,CAAC;IAClD,MAAMG,EAAE,GAAGF,CAAC,CAACG,MAAM,CAACL,GAAG,CAAC;IACxB,MAAMM,EAAE,GAAGJ,CAAC,CAACK,KAAK,CAAC,CAAC;IACpBV,KAAK,CAAC,wDAAwD,CAAC;IAC/D,OAAOW,MAAM,CAACC,MAAM,CAAC,CAACL,EAAE,EAAEE,EAAE,CAAC,CAAC;EAChC,CAAC,CAAC,OAAOM,CAAC,EAAE;IACV,OAAOJ,MAAM,CAACK,KAAK,CAAC,CAAC,CAAC;EACxB;AACF;AAEO,MAAMC,6BAA6B,GAAAnB,OAAA,CAAAmB,6BAAA,GAAG,EAAE;;AAE/C;AACA;AACA;AACO,SAASC,iCAAiCA,CAAA,EAAW;EAC1D,OAAO,IAAAC,8BAAuB,EAAC,CAAC,CAAC;AACnC","ignoreList":[]}

package/build/signature.js

@@ -9,7 +9,7 @@ exports.defaultAlgorithm = void 0;
 var _crypto = require("crypto");
 var _debug = _interopRequireDefault(require("debug"));
 var _config = require("@verdaccio/config");
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 const debug = (0, _debug.default)('verdaccio:auth:token:legacy');
 const defaultAlgorithm = exports.defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';
 const inputEncoding = 'utf8';
@@ -18,14 +18,17 @@ const outputEncoding = 'hex';
 // https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356
 const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
 function aesEncrypt(value, key) {
+  debug('aesEncrypt init');
   // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
   // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv
-  debug('encrypt %o', value);
   debug('algorithm %o', defaultAlgorithm);
   // IV must be a buffer of length 16
-  const iv = Buffer.from((0, _crypto.randomBytes)(16));
+  const iv = (0, _crypto.randomBytes)(16);
   const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
   const isKeyValid = (secretKey === null || secretKey === void 0 ? void 0 : secretKey.length) === _config.TOKEN_VALID_LENGTH;
+  if (isKeyValid === false) {
+    throw new Error('Invalid secret key length');
+  }
   debug('length secret key %o', secretKey === null || secretKey === void 0 ? void 0 : secretKey.length);
   debug('is valid secret %o', isKeyValid);
   if (!value || !secretKey || !isKeyValid) {
@@ -36,11 +39,12 @@ function aesEncrypt(value, key) {
   // @ts-ignore
   encrypted += cipher.final(outputEncoding);
   const token = `${iv.toString('hex')}:${encrypted.toString()}`;
-  debug('token generated successfully');
+  debug('legacy token generated successfully');
   return Buffer.from(token).toString('base64');
 }
 function aesDecrypt(value, key) {
   try {
+    debug('aesDecrypt init');
     const buff = Buffer.from(value, 'base64');
     const textParts = buff.toString().split(':');
 
@@ -55,7 +59,7 @@ function aesDecrypt(value, key) {
     // FIXME: fix type here should allow Buffer
     let decrypted = decipher.update(encryptedText, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
-    debug('token decrypted successfully');
+    debug('legacy token payload decrypted successfully');
     return decrypted.toString();
   } catch (_) {
     return;

package/build/signature.js.map

@@ -1 +1 @@
-{"version":3,"file":"signature.js","names":["_crypto","require","_debug","_interopRequireDefault","_config","obj","__esModule","default","debug","buildDebug","defaultAlgorithm","exports","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","Buffer","from","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","cipher","createCipheriv","encrypted","update","final","token","toString","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/signature.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv\n  debug('encrypt %o', value);\n  debug('algorithm %o', defaultAlgorithm);\n  // IV must be a buffer of length 16\n  const iv = Buffer.from(randomBytes(16));\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('token decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAOA,IAAAC,MAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AAAuD,SAAAE,uBAAAE,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AAEvD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAGE,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AACvF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA;AACA,MAAMC,+BAA+B,GAAGL,OAAO,CAACC,GAAG,CAACI,+BAA+B;AAE5E,SAASC,UAAUA,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpE;EACA;EACAZ,KAAK,CAAC,YAAY,EAAEW,KAAK,CAAC;EAC1BX,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC;EACA,MAAMW,EAAE,GAAGC,MAAM,CAACC,IAAI,CAAC,IAAAC,mBAAW,EAAC,EAAE,CAAC,CAAC;EACvC,MAAMC,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;EACxD,MAAMM,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3DpB,KAAK,CAAC,sBAAsB,EAAEiB,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDnB,KAAK,CAAC,oBAAoB,EAAEkB,UAAU,CAAC;EACvC,IAAI,CAACP,KAAK,IAAI,CAACM,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMG,MAAM,GAAG,IAAAC,sBAAc,EAACpB,gBAAgB,EAAEe,SAAS,EAAEJ,EAAE,CAAC;EAC9D,IAAIU,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACb,KAAK,EAAEJ,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAe,SAAS,IAAIF,MAAM,CAACI,KAAK,CAACjB,cAAc,CAAC;EACzC,MAAMkB,KAAK,GAAI,GAAEb,EAAE,CAACc,QAAQ,CAAC,KAAK,CAAE,IAAGJ,SAAS,CAACI,QAAQ,CAAC,CAAE,EAAC;EAC7D3B,KAAK,CAAC,8BAA8B,CAAC;EACrC,OAAOc,MAAM,CAACC,IAAI,CAACW,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASC,UAAUA,CAACjB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACF,MAAMiB,IAAI,GAAGf,MAAM,CAACC,IAAI,CAACJ,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMmB,SAAS,GAAGD,IAAI,CAACF,QAAQ,CAAC,CAAC,CAACI,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGlB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACG,KAAK,CAAC,CAAC,EAAEzB,cAAc,CAAC;IACzD;IACA,MAAM0B,aAAa,GAAGpB,MAAM,CAACC,IAAI,CAACe,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE3B,cAAc,CAAC;IACtE,MAAMS,SAAS,GAAGR,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMwB,QAAQ,GAAG,IAAAC,wBAAgB,EAACnC,gBAAgB,EAAEe,SAAS,EAAEe,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACZ,MAAM,CAACU,aAAa,EAAS1B,cAAc,EAAED,aAAa,CAAC;IACpF+B,SAAS,IAAIF,QAAQ,CAACX,KAAK,CAAClB,aAAa,CAAC;IAC1CP,KAAK,CAAC,8BAA8B,CAAC;IACrC,OAAOsC,SAAS,CAACX,QAAQ,CAAC,CAAC;EAC7B,CAAC,CAAC,OAAOY,CAAM,EAAE;IACf;EACF;AACF"}
+{"version":3,"file":"signature.js","names":["_crypto","require","_debug","_interopRequireDefault","_config","e","__esModule","default","debug","buildDebug","defaultAlgorithm","exports","process","env","VERDACCIO_LEGACY_ALGORITHM","inputEncoding","outputEncoding","VERDACCIO_LEGACY_ENCRYPTION_KEY","aesEncrypt","value","key","iv","randomBytes","secretKey","isKeyValid","length","TOKEN_VALID_LENGTH","Error","cipher","createCipheriv","encrypted","update","final","token","toString","Buffer","from","aesDecrypt","buff","textParts","split","IV","shift","encryptedText","join","decipher","createDecipheriv","decrypted","_"],"sources":["../src/signature.ts"],"sourcesContent":["import {\n  BinaryToTextEncoding,\n  CharacterEncoding,\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from 'crypto';\nimport buildDebug from 'debug';\n\nimport { TOKEN_VALID_LENGTH } from '@verdaccio/config';\n\nconst debug = buildDebug('verdaccio:auth:token:legacy');\n\nexport const defaultAlgorithm = process.env.VERDACCIO_LEGACY_ALGORITHM || 'aes-256-ctr';\nconst inputEncoding: CharacterEncoding = 'utf8';\nconst outputEncoding: BinaryToTextEncoding = 'hex';\n// Must be 256 bits (32 characters)\n// https://stackoverflow.com/questions/50963160/invalid-key-length-in-crypto-createcipheriv#50963356\nconst VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;\n\nexport function aesEncrypt(value: string, key: string): string | void {\n  debug('aesEncrypt init');\n  // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options\n  // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv\n  debug('algorithm %o', defaultAlgorithm);\n  // IV must be a buffer of length 16\n  const iv = randomBytes(16);\n  const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n\n  const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;\n  if (isKeyValid === false) {\n    throw new Error('Invalid secret key length');\n  }\n  debug('length secret key %o', secretKey?.length);\n  debug('is valid secret %o', isKeyValid);\n  if (!value || !secretKey || !isKeyValid) {\n    return;\n  }\n\n  const cipher = createCipheriv(defaultAlgorithm, secretKey, iv);\n  let encrypted = cipher.update(value, inputEncoding, outputEncoding);\n  // @ts-ignore\n  encrypted += cipher.final(outputEncoding);\n  const token = `${iv.toString('hex')}:${encrypted.toString()}`;\n  debug('legacy token generated successfully');\n  return Buffer.from(token).toString('base64');\n}\n\nexport function aesDecrypt(value: string, key: string): string | void {\n  try {\n    debug('aesDecrypt init');\n    const buff = Buffer.from(value, 'base64');\n    const textParts = buff.toString().split(':');\n\n    // extract the IV from the first half of the value\n    // @ts-ignore\n    const IV = Buffer.from(textParts.shift(), outputEncoding);\n    // extract the encrypted text without the IV\n    const encryptedText = Buffer.from(textParts.join(':'), outputEncoding);\n    const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;\n    // decipher the string\n    const decipher = createDecipheriv(defaultAlgorithm, secretKey, IV);\n    // FIXME: fix type here should allow Buffer\n    let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);\n    decrypted += decipher.final(inputEncoding);\n    debug('legacy token payload decrypted successfully');\n    return decrypted.toString();\n  } catch (_: any) {\n    return;\n  }\n}\n"],"mappings":";;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAOA,IAAAC,MAAA,GAAAC,sBAAA,CAAAF,OAAA;AAEA,IAAAG,OAAA,GAAAH,OAAA;AAAuD,SAAAE,uBAAAE,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEvD,MAAMG,KAAK,GAAG,IAAAC,cAAU,EAAC,6BAA6B,CAAC;AAEhD,MAAMC,gBAAgB,GAAAC,OAAA,CAAAD,gBAAA,GAAGE,OAAO,CAACC,GAAG,CAACC,0BAA0B,IAAI,aAAa;AACvF,MAAMC,aAAgC,GAAG,MAAM;AAC/C,MAAMC,cAAoC,GAAG,KAAK;AAClD;AACA;AACA,MAAMC,+BAA+B,GAAGL,OAAO,CAACC,GAAG,CAACI,+BAA+B;AAE5E,SAASC,UAAUA,CAACC,KAAa,EAAEC,GAAW,EAAiB;EACpEZ,KAAK,CAAC,iBAAiB,CAAC;EACxB;EACA;EACAA,KAAK,CAAC,cAAc,EAAEE,gBAAgB,CAAC;EACvC;EACA,MAAMW,EAAE,GAAG,IAAAC,mBAAW,EAAC,EAAE,CAAC;EAC1B,MAAMC,SAAS,GAAGN,+BAA+B,IAAIG,GAAG;EAExD,MAAMI,UAAU,GAAG,CAAAD,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,MAAKC,0BAAkB;EAC3D,IAAIF,UAAU,KAAK,KAAK,EAAE;IACxB,MAAM,IAAIG,KAAK,CAAC,2BAA2B,CAAC;EAC9C;EACAnB,KAAK,CAAC,sBAAsB,EAAEe,SAAS,aAATA,SAAS,uBAATA,SAAS,CAAEE,MAAM,CAAC;EAChDjB,KAAK,CAAC,oBAAoB,EAAEgB,UAAU,CAAC;EACvC,IAAI,CAACL,KAAK,IAAI,CAACI,SAAS,IAAI,CAACC,UAAU,EAAE;IACvC;EACF;EAEA,MAAMI,MAAM,GAAG,IAAAC,sBAAc,EAACnB,gBAAgB,EAAEa,SAAS,EAAEF,EAAE,CAAC;EAC9D,IAAIS,SAAS,GAAGF,MAAM,CAACG,MAAM,CAACZ,KAAK,EAAEJ,aAAa,EAAEC,cAAc,CAAC;EACnE;EACAc,SAAS,IAAIF,MAAM,CAACI,KAAK,CAAChB,cAAc,CAAC;EACzC,MAAMiB,KAAK,GAAG,GAAGZ,EAAE,CAACa,QAAQ,CAAC,KAAK,CAAC,IAAIJ,SAAS,CAACI,QAAQ,CAAC,CAAC,EAAE;EAC7D1B,KAAK,CAAC,qCAAqC,CAAC;EAC5C,OAAO2B,MAAM,CAACC,IAAI,CAACH,KAAK,CAAC,CAACC,QAAQ,CAAC,QAAQ,CAAC;AAC9C;AAEO,SAASG,UAAUA,CAAClB,KAAa,EAAEC,GAAW,EAAiB;EACpE,IAAI;IACFZ,KAAK,CAAC,iBAAiB,CAAC;IACxB,MAAM8B,IAAI,GAAGH,MAAM,CAACC,IAAI,CAACjB,KAAK,EAAE,QAAQ,CAAC;IACzC,MAAMoB,SAAS,GAAGD,IAAI,CAACJ,QAAQ,CAAC,CAAC,CAACM,KAAK,CAAC,GAAG,CAAC;;IAE5C;IACA;IACA,MAAMC,EAAE,GAAGN,MAAM,CAACC,IAAI,CAACG,SAAS,CAACG,KAAK,CAAC,CAAC,EAAE1B,cAAc,CAAC;IACzD;IACA,MAAM2B,aAAa,GAAGR,MAAM,CAACC,IAAI,CAACG,SAAS,CAACK,IAAI,CAAC,GAAG,CAAC,EAAE5B,cAAc,CAAC;IACtE,MAAMO,SAAS,GAAGN,+BAA+B,IAAIG,GAAG;IACxD;IACA,MAAMyB,QAAQ,GAAG,IAAAC,wBAAgB,EAACpC,gBAAgB,EAAEa,SAAS,EAAEkB,EAAE,CAAC;IAClE;IACA,IAAIM,SAAS,GAAGF,QAAQ,CAACd,MAAM,CAACY,aAAa,EAAS3B,cAAc,EAAED,aAAa,CAAC;IACpFgC,SAAS,IAAIF,QAAQ,CAACb,KAAK,CAACjB,aAAa,CAAC;IAC1CP,KAAK,CAAC,6CAA6C,CAAC;IACpD,OAAOuC,SAAS,CAACb,QAAQ,CAAC,CAAC;EAC7B,CAAC,CAAC,OAAOc,CAAM,EAAE;IACf;EACF;AACF","ignoreList":[]}

package/build/token.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.js","names":["parseBasicPayload","credentials","index","indexOf","user","slice","password"],"sources":["../src/token.ts"],"sourcesContent":["import { BasicPayload } from './types';\n\n/**\n *\n * @param credentials\n * @returns\n */\nexport function parseBasicPayload(credentials: string): BasicPayload {\n  const index = credentials.indexOf(':');\n  if (index < 0) {\n    return;\n  }\n\n  const user: string = credentials.slice(0, index);\n  const password: string = credentials.slice(index + 1);\n\n  return { user, password };\n}\n"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASA,iBAAiBA,CAACC,WAAmB,EAAgB;EACnE,MAAMC,KAAK,GAAGD,WAAW,CAACE,OAAO,CAAC,GAAG,CAAC;EACtC,IAAID,KAAK,GAAG,CAAC,EAAE;IACb;EACF;EAEA,MAAME,IAAY,GAAGH,WAAW,CAACI,KAAK,CAAC,CAAC,EAAEH,KAAK,CAAC;EAChD,MAAMI,QAAgB,GAAGL,WAAW,CAACI,KAAK,CAACH,KAAK,GAAG,CAAC,CAAC;EAErD,OAAO;IAAEE,IAAI;IAAEE;EAAS,CAAC;AAC3B"}
+{"version":3,"file":"token.js","names":["parseBasicPayload","credentials","index","indexOf","user","slice","password"],"sources":["../src/token.ts"],"sourcesContent":["import { BasicPayload } from './types';\n\n/**\n *\n * @param credentials\n * @returns\n */\nexport function parseBasicPayload(credentials: string): BasicPayload {\n  const index = credentials.indexOf(':');\n  if (index < 0) {\n    return;\n  }\n\n  const user: string = credentials.slice(0, index);\n  const password: string = credentials.slice(index + 1);\n\n  return { user, password };\n}\n"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASA,iBAAiBA,CAACC,WAAmB,EAAgB;EACnE,MAAMC,KAAK,GAAGD,WAAW,CAACE,OAAO,CAAC,GAAG,CAAC;EACtC,IAAID,KAAK,GAAG,CAAC,EAAE;IACb;EACF;EAEA,MAAME,IAAY,GAAGH,WAAW,CAACI,KAAK,CAAC,CAAC,EAAEH,KAAK,CAAC;EAChD,MAAMI,QAAgB,GAAGL,WAAW,CAACI,KAAK,CAACH,KAAK,GAAG,CAAC,CAAC;EAErD,OAAO;IAAEE,IAAI;IAAEE;EAAS,CAAC;AAC3B","ignoreList":[]}

package/build/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["export interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type BasicPayload = AESPayload | void;\n"],"mappings":""}
+{"version":3,"file":"types.js","names":[],"sources":["../src/types.ts"],"sourcesContent":["export interface AESPayload {\n  user: string;\n  password: string;\n}\n\nexport type BasicPayload = AESPayload | void;\n"],"mappings":"","ignoreList":[]}

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","names":["_crypto","require","defaultTarballHashAlgorithm","exports","createTarballHash","algorithm","createHash","stringToMD5","data","update","digest","generateRandomHexString","length","pseudoRandomBytes","toString","TOKEN_VALID_LENGTH","generateRandomSecretKey","randomBytes","substring"],"sources":["../src/utils.ts"],"sourcesContent":["import { Hash, createHash, pseudoRandomBytes, randomBytes } from 'crypto';\n\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @returns\n */\nexport function createTarballHash(algorithm = defaultTarballHashAlgorithm): Hash {\n  return createHash(algorithm);\n}\n\n/**\n * Express doesn't do ETAGS with requests <= 1024b\n * we use md5 here, it works well on 1k+ bytes, but with fewer data\n * could improve performance using crc32 after benchmarks.\n * @param {Object} data\n * @return {String}\n */\nexport function stringToMD5(data: Buffer | string): string {\n  return createHash('md5').update(data).digest('hex');\n}\n\n/**\n *\n * @param length\n * @returns\n */\nexport function generateRandomHexString(length = 8): string {\n  return pseudoRandomBytes(length).toString('hex');\n}\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Generate a secret of 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACO,SAASE,iBAAiBA,CAACC,SAAS,GAAGH,2BAA2B,EAAQ;EAC/E,OAAO,IAAAI,kBAAU,EAACD,SAAS,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,WAAWA,CAACC,IAAqB,EAAU;EACzD,OAAO,IAAAF,kBAAU,EAAC,KAAK,CAAC,CAACG,MAAM,CAACD,IAAI,CAAC,CAACE,MAAM,CAAC,KAAK,CAAC;AACrD;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,uBAAuBA,CAACC,MAAM,GAAG,CAAC,EAAU;EAC1D,OAAO,IAAAC,yBAAiB,EAACD,MAAM,CAAC,CAACE,QAAQ,CAAC,KAAK,CAAC;AAClD;AAEO,MAAMC,kBAAkB,GAAAZ,OAAA,CAAAY,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACO,SAASC,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACF,kBAAkB,CAAC,CAACD,QAAQ,CAAC,QAAQ,CAAC,CAACI,SAAS,CAAC,CAAC,EAAEH,kBAAkB,CAAC;AAC5F"}
+{"version":3,"file":"utils.js","names":["_crypto","require","defaultTarballHashAlgorithm","exports","createTarballHash","algorithm","createHash","stringToMD5","data","update","digest","generateRandomHexString","length","pseudoRandomBytes","toString","TOKEN_VALID_LENGTH","generateRandomSecretKey","randomBytes","substring"],"sources":["../src/utils.ts"],"sourcesContent":["import { Hash, createHash, pseudoRandomBytes, randomBytes } from 'crypto';\n\nexport const defaultTarballHashAlgorithm = 'sha1';\n\n/**\n *\n * @returns\n */\nexport function createTarballHash(algorithm = defaultTarballHashAlgorithm): Hash {\n  return createHash(algorithm);\n}\n\n/**\n * Express doesn't do ETAGS with requests <= 1024b\n * we use md5 here, it works well on 1k+ bytes, but with fewer data\n * could improve performance using crc32 after benchmarks.\n * @param {Object} data\n * @return {String}\n */\nexport function stringToMD5(data: Buffer | string): string {\n  return createHash('md5').update(data).digest('hex');\n}\n\n/**\n *\n * @param length\n * @returns\n */\nexport function generateRandomHexString(length = 8): string {\n  return pseudoRandomBytes(length).toString('hex');\n}\n\nexport const TOKEN_VALID_LENGTH = 32;\n\n/**\n * Generate a secret of 32 characters.\n */\nexport function generateRandomSecretKey(): string {\n  return randomBytes(TOKEN_VALID_LENGTH).toString('base64').substring(0, TOKEN_VALID_LENGTH);\n}\n"],"mappings":";;;;;;;;;;;AAAA,IAAAA,OAAA,GAAAC,OAAA;AAEO,MAAMC,2BAA2B,GAAAC,OAAA,CAAAD,2BAAA,GAAG,MAAM;;AAEjD;AACA;AACA;AACA;AACO,SAASE,iBAAiBA,CAACC,SAAS,GAAGH,2BAA2B,EAAQ;EAC/E,OAAO,IAAAI,kBAAU,EAACD,SAAS,CAAC;AAC9B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASE,WAAWA,CAACC,IAAqB,EAAU;EACzD,OAAO,IAAAF,kBAAU,EAAC,KAAK,CAAC,CAACG,MAAM,CAACD,IAAI,CAAC,CAACE,MAAM,CAAC,KAAK,CAAC;AACrD;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASC,uBAAuBA,CAACC,MAAM,GAAG,CAAC,EAAU;EAC1D,OAAO,IAAAC,yBAAiB,EAACD,MAAM,CAAC,CAACE,QAAQ,CAAC,KAAK,CAAC;AAClD;AAEO,MAAMC,kBAAkB,GAAAZ,OAAA,CAAAY,kBAAA,GAAG,EAAE;;AAEpC;AACA;AACA;AACO,SAASC,uBAAuBA,CAAA,EAAW;EAChD,OAAO,IAAAC,mBAAW,EAACF,kBAAkB,CAAC,CAACD,QAAQ,CAAC,QAAQ,CAAC,CAACI,SAAS,CAAC,CAAC,EAAEH,kBAAkB,CAAC;AAC5F","ignoreList":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/signature",
-  "version": "7.0.0-next.2",
+  "version": "8.0.0-next-8.0",
   "description": "verdaccio signature utils",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -26,16 +26,15 @@
     "verdaccio"
   ],
   "engines": {
-    "node": ">=12"
+    "node": ">=14"
   },
   "dependencies": {
     "jsonwebtoken": "9.0.2",
-    "debug": "4.3.4",
-    "lodash": "4.17.21"
+    "debug": "4.3.7"
   },
   "devDependencies": {
-    "@verdaccio/config": "7.0.0-next.4",
-    "@verdaccio/types": "12.0.0-next.1"
+    "@verdaccio/config": "8.0.0-next-8.0",
+    "@verdaccio/types": "13.0.0-next-8.0"
   },
   "funding": {
     "type": "opencollective",
@@ -43,7 +42,7 @@
   },
   "scripts": {
     "clean": "rimraf ./build",
-    "test": "jest",
+    "test": "vitest run",
     "type-check": "tsc --noEmit -p tsconfig.build.json",
     "build:types": "tsc --emitDeclarationOnly -p tsconfig.build.json",
     "build:js": "babel src/ --out-dir build/ --copy-files --extensions \".ts,.tsx\" --source-maps",

package/src/index.ts

@@ -3,6 +3,7 @@ export {
   aesEncryptDeprecated,
   generateRandomSecretKeyDeprecated,
 } from './legacy-signature';
+
 export { aesDecrypt, aesEncrypt } from './signature';
 export { signPayload, verifyPayload, SignOptionsSignature } from './jwt-token';
 export * as utils from './utils';

package/src/jwt-token.ts

@@ -41,6 +41,6 @@ export async function signPayload(
 }
 
 export function verifyPayload(token: string, secretOrPrivateKey: string): RemoteUser {
-  debug('verify jwt token');
+  debug('verifying jwt token');
   return jwt.verify(token, secretOrPrivateKey) as RemoteUser;
 }

package/src/legacy-signature/index.ts

@@ -1,10 +1,13 @@
 import { createCipher, createDecipher } from 'crypto';
+import buildDebug from 'debug';
 
 import { generateRandomHexString } from '../utils';
 
 export const defaultAlgorithm = 'aes192';
 export const defaultTarballHashAlgorithm = 'sha1';
 
+const debug = buildDebug('verdaccio:auth:token:legacy:deprecated');
+
 /**
  *
  * @param buf
@@ -12,12 +15,15 @@ export const defaultTarballHashAlgorithm = 'sha1';
  * @returns
  */
 export function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {
+  debug('aesEncryptDeprecated init');
+  debug('algorithm %o', defaultAlgorithm);
   // deprecated (it will be removed in Verdaccio 6), it is a breaking change
   // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
   // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
   const c = createCipher(defaultAlgorithm, secret);
   const b1 = c.update(buf);
   const b2 = c.final();
+  debug('deprecated legacy token generated successfully');
   return Buffer.concat([b1, b2]);
 }
 
@@ -29,11 +35,13 @@ export function aesEncryptDeprecated(buf: Buffer, secret: string): Buffer {
  */
 export function aesDecryptDeprecated(buf: Buffer, secret: string): Buffer {
   try {
+    debug('aesDecryptDeprecated init');
     // https://nodejs.org/api/crypto.html#crypto_crypto_createdecipher_algorithm_password_options
     // https://www.grainger.xyz/changing-from-cipher-to-cipheriv/
     const c = createDecipher(defaultAlgorithm, secret);
     const b1 = c.update(buf);
     const b2 = c.final();
+    debug('deprecated legacy token payload decrypted successfully');
     return Buffer.concat([b1, b2]);
   } catch (_) {
     return Buffer.alloc(0);

package/src/signature.ts

@@ -19,14 +19,18 @@ const outputEncoding: BinaryToTextEncoding = 'hex';
 const VERDACCIO_LEGACY_ENCRYPTION_KEY = process.env.VERDACCIO_LEGACY_ENCRYPTION_KEY;
 
 export function aesEncrypt(value: string, key: string): string | void {
+  debug('aesEncrypt init');
   // https://nodejs.org/api/crypto.html#crypto_crypto_createcipher_algorithm_password_options
   // https://www.grainger.xyz/posts/changing-from-cipher-to-cipheriv
-  debug('encrypt %o', value);
   debug('algorithm %o', defaultAlgorithm);
   // IV must be a buffer of length 16
-  const iv = Buffer.from(randomBytes(16));
+  const iv = randomBytes(16);
   const secretKey = VERDACCIO_LEGACY_ENCRYPTION_KEY || key;
+
   const isKeyValid = secretKey?.length === TOKEN_VALID_LENGTH;
+  if (isKeyValid === false) {
+    throw new Error('Invalid secret key length');
+  }
   debug('length secret key %o', secretKey?.length);
   debug('is valid secret %o', isKeyValid);
   if (!value || !secretKey || !isKeyValid) {
@@ -38,12 +42,13 @@ export function aesEncrypt(value: string, key: string): string | void {
   // @ts-ignore
   encrypted += cipher.final(outputEncoding);
   const token = `${iv.toString('hex')}:${encrypted.toString()}`;
-  debug('token generated successfully');
+  debug('legacy token generated successfully');
   return Buffer.from(token).toString('base64');
 }
 
 export function aesDecrypt(value: string, key: string): string | void {
   try {
+    debug('aesDecrypt init');
     const buff = Buffer.from(value, 'base64');
     const textParts = buff.toString().split(':');
 
@@ -58,7 +63,7 @@ export function aesDecrypt(value: string, key: string): string | void {
     // FIXME: fix type here should allow Buffer
     let decrypted = decipher.update(encryptedText as any, outputEncoding, inputEncoding);
     decrypted += decipher.final(inputEncoding);
-    debug('token decrypted successfully');
+    debug('legacy token payload decrypted successfully');
     return decrypted.toString();
   } catch (_: any) {
     return;

package/test/jwt.spec.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { createRemoteUser } from '@verdaccio/config';
 
 import { signPayload, verifyPayload } from '../src';

package/test/legacy-token-deprecated.spec.ts

@@ -1,14 +1,26 @@
+import { describe, expect, test } from 'vitest';
+
+import { isNodeVersionGreaterThan21 } from '@verdaccio/config';
+
 import {
   aesDecryptDeprecated,
   aesEncryptDeprecated,
   generateRandomSecretKeyDeprecated,
 } from '../src';
 
-describe('test deprecated crypto utils', () => {
+const itdescribe = (condition) => (condition ? describe : describe.skip);
+
+itdescribe(isNodeVersionGreaterThan21() === false)('test deprecated crypto utils', () => {
+  test('generateRandomSecretKeyDeprecated', () => {
+    expect(generateRandomSecretKeyDeprecated()).toHaveLength(12);
+  });
+
   test('decrypt payload flow', () => {
-    const secret = generateRandomSecretKeyDeprecated();
+    const secret = '4b4512c6ce20';
     const payload = 'juan:password';
     const token = aesEncryptDeprecated(Buffer.from(payload), secret);
+
+    expect(token.toString('base64')).toEqual('auizc1j3lSEd2wEB5CyGbQ==');
     const data = aesDecryptDeprecated(token, secret);
 
     expect(data.toString()).toEqual(payload.toString());

package/test/legacy-token.spec.ts

@@ -1,3 +1,5 @@
+import { describe, expect, test } from 'vitest';
+
 import { aesDecrypt, aesEncrypt } from '../src';
 
 describe('test crypto utils', () => {
@@ -13,7 +15,6 @@ describe('test crypto utils', () => {
   test('crypt fails if secret is incorrect', () => {
     const secret = 'f5bb945cc57fea2f25961e1bd6fb3c89_TO_LONG';
     const payload = 'juan';
-    const token = aesEncrypt(payload, secret) as string;
-    expect(token).toBeUndefined();
+    expect(() => aesEncrypt(payload, secret)).toThrow('Invalid secret key length');
   });
 });

package/test/utilts.spec.ts

@@ -1,3 +1,5 @@
+import { expect, test } from 'vitest';
+
 import {
   TOKEN_VALID_LENGTH,
   createTarballHash,

package/jest.config.js

@@ -1,3 +0,0 @@
-const config = require('../../jest/config');
-
-module.exports = Object.assign({}, config, {});