@verdaccio/web 6.0.0-6-next.45 → 6.0.0-6-next.47

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @verdaccio/web
 
+## 6.0.0-6-next.47
+
+### Minor Changes
+
+- 45c03819: refactor: render html middleware
+
+### Patch Changes
+
+- Updated dependencies [45c03819]
+  - @verdaccio/config@6.0.0-6-next.60
+  - @verdaccio/middleware@6.0.0-6-next.39
+  - @verdaccio/store@6.0.0-6-next.40
+  - @verdaccio/auth@6.0.0-6-next.39
+  - @verdaccio/loaders@6.0.0-6-next.29
+  - @verdaccio/core@6.0.0-6-next.60
+  - @verdaccio/tarball@11.0.0-6-next.29
+  - @verdaccio/url@11.0.0-6-next.26
+  - @verdaccio/logger@6.0.0-6-next.28
+  - @verdaccio/utils@6.0.0-6-next.28
+
+## 6.0.0-6-next.46
+
+### Patch Changes
+
+- Updated dependencies [65f88b82]
+  - @verdaccio/logger@6.0.0-6-next.27
+  - @verdaccio/middleware@6.0.0-6-next.38
+  - @verdaccio/auth@6.0.0-6-next.38
+  - @verdaccio/loaders@6.0.0-6-next.28
+  - @verdaccio/store@6.0.0-6-next.39
+  - @verdaccio/core@6.0.0-6-next.59
+  - @verdaccio/config@6.0.0-6-next.59
+  - @verdaccio/tarball@11.0.0-6-next.28
+  - @verdaccio/url@11.0.0-6-next.25
+  - @verdaccio/utils@6.0.0-6-next.27
+
 ## 6.0.0-6-next.45
 
 ### Patch Changes

package/build/api/index.js

@@ -5,7 +5,8 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.default = void 0;
 var _express = require("express");
-var _webUtils = require("../utils/web-utils");
+var _middleware = require("@verdaccio/middleware");
+var _webUtils = require("../web-utils");
 var _package = _interopRequireDefault(require("./package"));
 var _readme = _interopRequireDefault(require("./readme"));
 var _search = _interopRequireDefault(require("./search"));
@@ -13,7 +14,15 @@ var _sidebar = _interopRequireDefault(require("./sidebar"));
 var _user = _interopRequireDefault(require("./user"));
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 var _default = (auth, storage, config) => {
+  var _config$web;
   const route = (0, _express.Router)(); /* eslint new-cap: 0 */
+  route.use('/data/', (0, _middleware.rateLimit)({
+    windowMs: 2 * 60 * 1000,
+    // 2  minutes
+    max: 5000,
+    // limit each IP to 1000 requests per windowMs
+    ...(config === null || config === void 0 ? void 0 : (_config$web = config.web) === null || _config$web === void 0 ? void 0 : _config$web.rateLimit)
+  }));
   route.use('/data/', (0, _package.default)(storage, auth, config));
   route.use('/data/', (0, _search.default)(storage, auth));
   route.use('/data/', (0, _sidebar.default)(config, storage, auth));

package/build/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["auth","storage","config","route","Router","use","packageApi","search","sidebar","readme","hasLogin","user"],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { hasLogin } from '../utils/web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.use('/data/', packageApi(storage, auth, config));\n  route.use('/data/', search(storage, auth));\n  route.use('/data/', sidebar(config, storage, auth));\n  route.use('/data/', readme(storage, auth));\n  if (hasLogin(config)) {\n    route.use('/sec/', user(auth, config));\n  }\n  return route;\n};\n"],"mappings":";;;;;;AAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AAA0B;AAAA,eAEX,CAACA,IAAI,EAAEC,OAAO,EAAEC,MAAM,KAAK;EACxC,MAAMC,KAAK,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EACxBD,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAC,gBAAU,EAACL,OAAO,EAAED,IAAI,EAAEE,MAAM,CAAC,CAAC;EACtDC,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAE,eAAM,EAACN,OAAO,EAAED,IAAI,CAAC,CAAC;EAC1CG,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAG,gBAAO,EAACN,MAAM,EAAED,OAAO,EAAED,IAAI,CAAC,CAAC;EACnDG,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAI,eAAM,EAACR,OAAO,EAAED,IAAI,CAAC,CAAC;EAC1C,IAAI,IAAAU,kBAAQ,EAACR,MAAM,CAAC,EAAE;IACpBC,KAAK,CAACE,GAAG,CAAC,OAAO,EAAE,IAAAM,aAAI,EAACX,IAAI,EAAEE,MAAM,CAAC,CAAC;EACxC;EACA,OAAOC,KAAK;AACd,CAAC;AAAA"}
+{"version":3,"file":"index.js","names":["auth","storage","config","route","Router","use","rateLimit","windowMs","max","web","packageApi","search","sidebar","readme","hasLogin","user"],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.use(\n    '/data/',\n    rateLimit({\n      windowMs: 2 * 60 * 1000, // 2  minutes\n      max: 5000, // limit each IP to 1000 requests per windowMs\n      ...config?.web?.rateLimit,\n    })\n  );\n  route.use('/data/', packageApi(storage, auth, config));\n  route.use('/data/', search(storage, auth));\n  route.use('/data/', sidebar(config, storage, auth));\n  route.use('/data/', readme(storage, auth));\n  if (hasLogin(config)) {\n    route.use('/sec/', user(auth, config));\n  }\n  return route;\n};\n"],"mappings":";;;;;;AAAA;AAEA;AAEA;AACA;AACA;AACA;AACA;AACA;AAA0B;AAAA,eAEX,CAACA,IAAI,EAAEC,OAAO,EAAEC,MAAM,KAAK;EAAA;EACxC,MAAMC,KAAK,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EACxBD,KAAK,CAACE,GAAG,CACP,QAAQ,EACR,IAAAC,qBAAS,EAAC;IACRC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IAAE;IACzBC,GAAG,EAAE,IAAI;IAAE;IACX,IAAGN,MAAM,aAANA,MAAM,sCAANA,MAAM,CAAEO,GAAG,gDAAX,YAAaH,SAAS;EAC3B,CAAC,CAAC,CACH;EACDH,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAK,gBAAU,EAACT,OAAO,EAAED,IAAI,EAAEE,MAAM,CAAC,CAAC;EACtDC,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAM,eAAM,EAACV,OAAO,EAAED,IAAI,CAAC,CAAC;EAC1CG,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAO,gBAAO,EAACV,MAAM,EAAED,OAAO,EAAED,IAAI,CAAC,CAAC;EACnDG,KAAK,CAACE,GAAG,CAAC,QAAQ,EAAE,IAAAQ,eAAM,EAACZ,OAAO,EAAED,IAAI,CAAC,CAAC;EAC1C,IAAI,IAAAc,kBAAQ,EAACZ,MAAM,CAAC,EAAE;IACpBC,KAAK,CAACE,GAAG,CAAC,OAAO,EAAE,IAAAU,aAAI,EAACf,IAAI,EAAEE,MAAM,CAAC,CAAC;EACxC;EACA,OAAOC,KAAK;AACd,CAAC;AAAA"}

package/build/api/package.js

@@ -29,7 +29,7 @@ var _logger = require("@verdaccio/logger");
 var _middleware = require("@verdaccio/middleware");
 var _tarball = require("@verdaccio/tarball");
 var _utils = require("@verdaccio/utils");
-var _webUtils = require("../utils/web-utils");
+var _webUtils = require("../web-utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 // Was required by other packages
 

package/build/api/package.js.map

@@ -1 +1 @@
-{"version":3,"file":"package.js","names":["getOrder","order","debug","buildDebug","addPackageWebApi","storage","auth","config","isLoginEnabled","web","login","pkgRouter","Router","anonymousRemoteUser","name","undefined","real_groups","groups","checkAllow","remoteUser","Promise","resolve","reject","allow_access","packageName","err","allowed","processPackages","packages","req","permissions","packagesToProcess","slice","pkg","pkgCopy","author","formatAuthor","remote_user","avatar","generateGravatarUrl","email","gravatar","_","isNil","dist","isNull","tarball","getLocalRegistryTarballUri","protocol","headers","host","hostname","url_prefix","push","logger","error","get","res","next","localPackages","getLocalDatabase","sort_packages","pkgs","sortByName"],"sources":["../../src/api/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { getLocalRegistryTarballUri } from '@verdaccio/tarball';\nimport { Config, RemoteUser, Version } from '@verdaccio/types';\nimport { formatAuthor, generateGravatarUrl } from '@verdaccio/utils';\n\nimport { sortByName } from '../utils/web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst getOrder = (order = 'asc') => {\n  return order === 'asc';\n};\n\nconst debug = buildDebug('verdaccio:web:api:package');\n\nfunction addPackageWebApi(storage: Storage, auth: Auth, config: Config): Router {\n  const isLoginEnabled = config?.web?.login === true ?? true;\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const anonymousRemoteUser: RemoteUser = {\n    name: undefined,\n    real_groups: [],\n    groups: [],\n  };\n\n  debug('initialized package web api');\n  const checkAllow = (name: string, remoteUser: RemoteUser): Promise<boolean> =>\n    new Promise((resolve, reject): void => {\n      debug('is login disabled %o', isLoginEnabled);\n      // FIXME: this logic does not work, review\n      // const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;\n      try {\n        auth.allow_access({ packageName: name }, remoteUser, (err, allowed): void => {\n          if (err) {\n            resolve(false);\n          }\n          return resolve(allowed as boolean);\n        });\n      } catch (err: any) {\n        reject(err);\n      }\n    });\n\n  async function processPackages(packages: Version[] = [], req): Promise<Version[]> {\n    const permissions: Version[] = [];\n    const packagesToProcess = packages.slice();\n    debug('process packages %o', packagesToProcess);\n    for (const pkg of packagesToProcess) {\n      const pkgCopy = { ...pkg };\n      pkgCopy.author = formatAuthor(pkg.author);\n      try {\n        if (await checkAllow(pkg.name, req.remote_user)) {\n          if (config.web) {\n            // @ts-ignore\n            pkgCopy.author.avatar = generateGravatarUrl(pkgCopy.author.email, config.web.gravatar);\n          }\n          // convert any remote dist to a local reference\n          // eg: if the dist points to npmjs, switch to localhost:4873/prefix/etc.tar.gz\n          if (!_.isNil(pkgCopy.dist) && !_.isNull(pkgCopy.dist.tarball)) {\n            pkgCopy.dist.tarball = getLocalRegistryTarballUri(\n              pkgCopy.dist.tarball,\n              pkg.name,\n              { protocol: req.protocol, headers: req.headers as any, host: req.hostname },\n              config?.url_prefix\n            );\n          }\n          permissions.push(pkgCopy);\n        }\n      } catch (err: any) {\n        debug('process packages error %o', err);\n        logger.error(\n          { name: pkg.name, error: err },\n          'permission process for @{name} has failed: @{error}'\n        );\n        throw err;\n      }\n    }\n\n    return permissions;\n  }\n\n  // Get list of all visible package\n  pkgRouter.get(\n    '/packages',\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('hit package web api %o');\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n\n        const order = getOrder(config?.web?.sort_packages);\n        debug('order %o', order);\n        const pkgs = await processPackages(localPackages, req);\n        next(sortByName(pkgs, order));\n      } catch (error: any) {\n        next(error);\n      }\n    }\n  );\n\n  return pkgRouter;\n}\n\nexport default addPackageWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAGA;AACA;AAEA;AAEA;AAEA;AAAgD;AAEc;;AAE9D,MAAMA,QAAQ,GAAG,CAACC,KAAK,GAAG,KAAK,KAAK;EAClC,OAAOA,KAAK,KAAK,KAAK;AACxB,CAAC;AAED,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,2BAA2B,CAAC;AAErD,SAASC,gBAAgB,CAACC,OAAgB,EAAEC,IAAU,EAAEC,MAAc,EAAU;EAAA;EAC9E,MAAMC,cAAc,GAAG,CAAAD,MAAM,aAANA,MAAM,sCAANA,MAAM,CAAEE,GAAG,gDAAX,YAAaC,KAAK,MAAK,IAAI,IAAI,IAAI;EAC1D,MAAMC,SAAS,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EAC5B;EACA,MAAMC,mBAA+B,GAAG;IACtCC,IAAI,EAAEC,SAAS;IACfC,WAAW,EAAE,EAAE;IACfC,MAAM,EAAE;EACV,CAAC;EAEDf,KAAK,CAAC,6BAA6B,CAAC;EACpC,MAAMgB,UAAU,GAAG,CAACJ,IAAY,EAAEK,UAAsB,KACtD,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAW;IACrCpB,KAAK,CAAC,sBAAsB,EAAEM,cAAc,CAAC;IAC7C;IACA;IACA,IAAI;MACFF,IAAI,CAACiB,YAAY,CAAC;QAAEC,WAAW,EAAEV;MAAK,CAAC,EAAEK,UAAU,EAAE,CAACM,GAAG,EAAEC,OAAO,KAAW;QAC3E,IAAID,GAAG,EAAE;UACPJ,OAAO,CAAC,KAAK,CAAC;QAChB;QACA,OAAOA,OAAO,CAACK,OAAO,CAAY;MACpC,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOD,GAAQ,EAAE;MACjBH,MAAM,CAACG,GAAG,CAAC;IACb;EACF,CAAC,CAAC;EAEJ,eAAeE,eAAe,CAACC,QAAmB,GAAG,EAAE,EAAEC,GAAG,EAAsB;IAChF,MAAMC,WAAsB,GAAG,EAAE;IACjC,MAAMC,iBAAiB,GAAGH,QAAQ,CAACI,KAAK,EAAE;IAC1C9B,KAAK,CAAC,qBAAqB,EAAE6B,iBAAiB,CAAC;IAC/C,KAAK,MAAME,GAAG,IAAIF,iBAAiB,EAAE;MACnC,MAAMG,OAAO,GAAG;QAAE,GAAGD;MAAI,CAAC;MAC1BC,OAAO,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACH,GAAG,CAACE,MAAM,CAAC;MACzC,IAAI;QACF,IAAI,MAAMjB,UAAU,CAACe,GAAG,CAACnB,IAAI,EAAEe,GAAG,CAACQ,WAAW,CAAC,EAAE;UAC/C,IAAI9B,MAAM,CAACE,GAAG,EAAE;YACd;YACAyB,OAAO,CAACC,MAAM,CAACG,MAAM,GAAG,IAAAC,0BAAmB,EAACL,OAAO,CAACC,MAAM,CAACK,KAAK,EAAEjC,MAAM,CAACE,GAAG,CAACgC,QAAQ,CAAC;UACxF;UACA;UACA;UACA,IAAI,CAACC,eAAC,CAACC,KAAK,CAACT,OAAO,CAACU,IAAI,CAAC,IAAI,CAACF,eAAC,CAACG,MAAM,CAACX,OAAO,CAACU,IAAI,CAACE,OAAO,CAAC,EAAE;YAC7DZ,OAAO,CAACU,IAAI,CAACE,OAAO,GAAG,IAAAC,mCAA0B,EAC/Cb,OAAO,CAACU,IAAI,CAACE,OAAO,EACpBb,GAAG,CAACnB,IAAI,EACR;cAAEkC,QAAQ,EAAEnB,GAAG,CAACmB,QAAQ;cAAEC,OAAO,EAAEpB,GAAG,CAACoB,OAAc;cAAEC,IAAI,EAAErB,GAAG,CAACsB;YAAS,CAAC,EAC3E5C,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6C,UAAU,CACnB;UACH;UACAtB,WAAW,CAACuB,IAAI,CAACnB,OAAO,CAAC;QAC3B;MACF,CAAC,CAAC,OAAOT,GAAQ,EAAE;QACjBvB,KAAK,CAAC,2BAA2B,EAAEuB,GAAG,CAAC;QACvC6B,cAAM,CAACC,KAAK,CACV;UAAEzC,IAAI,EAAEmB,GAAG,CAACnB,IAAI;UAAEyC,KAAK,EAAE9B;QAAI,CAAC,EAC9B,qDAAqD,CACtD;QACD,MAAMA,GAAG;MACX;IACF;IAEA,OAAOK,WAAW;EACpB;;EAEA;EACAnB,SAAS,CAAC6C,GAAG,CACX,WAAW,EACX,gBACE3B,GAAmB,EACnB4B,GAAoB,EACpBC,IAAsB,EACP;IACfxD,KAAK,CAAC,wBAAwB,CAAC;IAE/B,IAAI;MAAA;MACF,MAAMyD,aAAwB,GAAG,MAAMtD,OAAO,CAACuD,gBAAgB,EAAE;MAEjE,MAAM3D,KAAK,GAAGD,QAAQ,CAACO,MAAM,aAANA,MAAM,uCAANA,MAAM,CAAEE,GAAG,iDAAX,aAAaoD,aAAa,CAAC;MAClD3D,KAAK,CAAC,UAAU,EAAED,KAAK,CAAC;MACxB,MAAM6D,IAAI,GAAG,MAAMnC,eAAe,CAACgC,aAAa,EAAE9B,GAAG,CAAC;MACtD6B,IAAI,CAAC,IAAAK,oBAAU,EAACD,IAAI,EAAE7D,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,OAAOsD,KAAU,EAAE;MACnBG,IAAI,CAACH,KAAK,CAAC;IACb;EACF,CAAC,CACF;EAED,OAAO5C,SAAS;AAClB;AAAC,eAEcP,gBAAgB;AAAA"}
+{"version":3,"file":"package.js","names":["getOrder","order","debug","buildDebug","addPackageWebApi","storage","auth","config","isLoginEnabled","web","login","pkgRouter","Router","anonymousRemoteUser","name","undefined","real_groups","groups","checkAllow","remoteUser","Promise","resolve","reject","allow_access","packageName","err","allowed","processPackages","packages","req","permissions","packagesToProcess","slice","pkg","pkgCopy","author","formatAuthor","remote_user","avatar","generateGravatarUrl","email","gravatar","_","isNil","dist","isNull","tarball","getLocalRegistryTarballUri","protocol","headers","host","hostname","url_prefix","push","logger","error","get","res","next","localPackages","getLocalDatabase","sort_packages","pkgs","sortByName"],"sources":["../../src/api/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { getLocalRegistryTarballUri } from '@verdaccio/tarball';\nimport { Config, RemoteUser, Version } from '@verdaccio/types';\nimport { formatAuthor, generateGravatarUrl } from '@verdaccio/utils';\n\nimport { sortByName } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst getOrder = (order = 'asc') => {\n  return order === 'asc';\n};\n\nconst debug = buildDebug('verdaccio:web:api:package');\n\nfunction addPackageWebApi(storage: Storage, auth: Auth, config: Config): Router {\n  const isLoginEnabled = config?.web?.login === true ?? true;\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n  // eslint-disable-next-line @typescript-eslint/no-unused-vars\n  const anonymousRemoteUser: RemoteUser = {\n    name: undefined,\n    real_groups: [],\n    groups: [],\n  };\n\n  debug('initialized package web api');\n  const checkAllow = (name: string, remoteUser: RemoteUser): Promise<boolean> =>\n    new Promise((resolve, reject): void => {\n      debug('is login disabled %o', isLoginEnabled);\n      // FIXME: this logic does not work, review\n      // const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;\n      try {\n        auth.allow_access({ packageName: name }, remoteUser, (err, allowed): void => {\n          if (err) {\n            resolve(false);\n          }\n          return resolve(allowed as boolean);\n        });\n      } catch (err: any) {\n        reject(err);\n      }\n    });\n\n  async function processPackages(packages: Version[] = [], req): Promise<Version[]> {\n    const permissions: Version[] = [];\n    const packagesToProcess = packages.slice();\n    debug('process packages %o', packagesToProcess);\n    for (const pkg of packagesToProcess) {\n      const pkgCopy = { ...pkg };\n      pkgCopy.author = formatAuthor(pkg.author);\n      try {\n        if (await checkAllow(pkg.name, req.remote_user)) {\n          if (config.web) {\n            // @ts-ignore\n            pkgCopy.author.avatar = generateGravatarUrl(pkgCopy.author.email, config.web.gravatar);\n          }\n          // convert any remote dist to a local reference\n          // eg: if the dist points to npmjs, switch to localhost:4873/prefix/etc.tar.gz\n          if (!_.isNil(pkgCopy.dist) && !_.isNull(pkgCopy.dist.tarball)) {\n            pkgCopy.dist.tarball = getLocalRegistryTarballUri(\n              pkgCopy.dist.tarball,\n              pkg.name,\n              { protocol: req.protocol, headers: req.headers as any, host: req.hostname },\n              config?.url_prefix\n            );\n          }\n          permissions.push(pkgCopy);\n        }\n      } catch (err: any) {\n        debug('process packages error %o', err);\n        logger.error(\n          { name: pkg.name, error: err },\n          'permission process for @{name} has failed: @{error}'\n        );\n        throw err;\n      }\n    }\n\n    return permissions;\n  }\n\n  // Get list of all visible package\n  pkgRouter.get(\n    '/packages',\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('hit package web api %o');\n\n      try {\n        const localPackages: Version[] = await storage.getLocalDatabase();\n\n        const order = getOrder(config?.web?.sort_packages);\n        debug('order %o', order);\n        const pkgs = await processPackages(localPackages, req);\n        next(sortByName(pkgs, order));\n      } catch (error: any) {\n        next(error);\n      }\n    }\n  );\n\n  return pkgRouter;\n}\n\nexport default addPackageWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AACA;AAGA;AACA;AAEA;AAEA;AAEA;AAA0C;AAEoB;;AAE9D,MAAMA,QAAQ,GAAG,CAACC,KAAK,GAAG,KAAK,KAAK;EAClC,OAAOA,KAAK,KAAK,KAAK;AACxB,CAAC;AAED,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,2BAA2B,CAAC;AAErD,SAASC,gBAAgB,CAACC,OAAgB,EAAEC,IAAU,EAAEC,MAAc,EAAU;EAAA;EAC9E,MAAMC,cAAc,GAAG,CAAAD,MAAM,aAANA,MAAM,sCAANA,MAAM,CAAEE,GAAG,gDAAX,YAAaC,KAAK,MAAK,IAAI,IAAI,IAAI;EAC1D,MAAMC,SAAS,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EAC5B;EACA,MAAMC,mBAA+B,GAAG;IACtCC,IAAI,EAAEC,SAAS;IACfC,WAAW,EAAE,EAAE;IACfC,MAAM,EAAE;EACV,CAAC;EAEDf,KAAK,CAAC,6BAA6B,CAAC;EACpC,MAAMgB,UAAU,GAAG,CAACJ,IAAY,EAAEK,UAAsB,KACtD,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAW;IACrCpB,KAAK,CAAC,sBAAsB,EAAEM,cAAc,CAAC;IAC7C;IACA;IACA,IAAI;MACFF,IAAI,CAACiB,YAAY,CAAC;QAAEC,WAAW,EAAEV;MAAK,CAAC,EAAEK,UAAU,EAAE,CAACM,GAAG,EAAEC,OAAO,KAAW;QAC3E,IAAID,GAAG,EAAE;UACPJ,OAAO,CAAC,KAAK,CAAC;QAChB;QACA,OAAOA,OAAO,CAACK,OAAO,CAAY;MACpC,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOD,GAAQ,EAAE;MACjBH,MAAM,CAACG,GAAG,CAAC;IACb;EACF,CAAC,CAAC;EAEJ,eAAeE,eAAe,CAACC,QAAmB,GAAG,EAAE,EAAEC,GAAG,EAAsB;IAChF,MAAMC,WAAsB,GAAG,EAAE;IACjC,MAAMC,iBAAiB,GAAGH,QAAQ,CAACI,KAAK,EAAE;IAC1C9B,KAAK,CAAC,qBAAqB,EAAE6B,iBAAiB,CAAC;IAC/C,KAAK,MAAME,GAAG,IAAIF,iBAAiB,EAAE;MACnC,MAAMG,OAAO,GAAG;QAAE,GAAGD;MAAI,CAAC;MAC1BC,OAAO,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACH,GAAG,CAACE,MAAM,CAAC;MACzC,IAAI;QACF,IAAI,MAAMjB,UAAU,CAACe,GAAG,CAACnB,IAAI,EAAEe,GAAG,CAACQ,WAAW,CAAC,EAAE;UAC/C,IAAI9B,MAAM,CAACE,GAAG,EAAE;YACd;YACAyB,OAAO,CAACC,MAAM,CAACG,MAAM,GAAG,IAAAC,0BAAmB,EAACL,OAAO,CAACC,MAAM,CAACK,KAAK,EAAEjC,MAAM,CAACE,GAAG,CAACgC,QAAQ,CAAC;UACxF;UACA;UACA;UACA,IAAI,CAACC,eAAC,CAACC,KAAK,CAACT,OAAO,CAACU,IAAI,CAAC,IAAI,CAACF,eAAC,CAACG,MAAM,CAACX,OAAO,CAACU,IAAI,CAACE,OAAO,CAAC,EAAE;YAC7DZ,OAAO,CAACU,IAAI,CAACE,OAAO,GAAG,IAAAC,mCAA0B,EAC/Cb,OAAO,CAACU,IAAI,CAACE,OAAO,EACpBb,GAAG,CAACnB,IAAI,EACR;cAAEkC,QAAQ,EAAEnB,GAAG,CAACmB,QAAQ;cAAEC,OAAO,EAAEpB,GAAG,CAACoB,OAAc;cAAEC,IAAI,EAAErB,GAAG,CAACsB;YAAS,CAAC,EAC3E5C,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAE6C,UAAU,CACnB;UACH;UACAtB,WAAW,CAACuB,IAAI,CAACnB,OAAO,CAAC;QAC3B;MACF,CAAC,CAAC,OAAOT,GAAQ,EAAE;QACjBvB,KAAK,CAAC,2BAA2B,EAAEuB,GAAG,CAAC;QACvC6B,cAAM,CAACC,KAAK,CACV;UAAEzC,IAAI,EAAEmB,GAAG,CAACnB,IAAI;UAAEyC,KAAK,EAAE9B;QAAI,CAAC,EAC9B,qDAAqD,CACtD;QACD,MAAMA,GAAG;MACX;IACF;IAEA,OAAOK,WAAW;EACpB;;EAEA;EACAnB,SAAS,CAAC6C,GAAG,CACX,WAAW,EACX,gBACE3B,GAAmB,EACnB4B,GAAoB,EACpBC,IAAsB,EACP;IACfxD,KAAK,CAAC,wBAAwB,CAAC;IAE/B,IAAI;MAAA;MACF,MAAMyD,aAAwB,GAAG,MAAMtD,OAAO,CAACuD,gBAAgB,EAAE;MAEjE,MAAM3D,KAAK,GAAGD,QAAQ,CAACO,MAAM,aAANA,MAAM,uCAANA,MAAM,CAAEE,GAAG,iDAAX,aAAaoD,aAAa,CAAC;MAClD3D,KAAK,CAAC,UAAU,EAAED,KAAK,CAAC;MACxB,MAAM6D,IAAI,GAAG,MAAMnC,eAAe,CAACgC,aAAa,EAAE9B,GAAG,CAAC;MACtD6B,IAAI,CAAC,IAAAK,oBAAU,EAACD,IAAI,EAAE7D,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,OAAOsD,KAAU,EAAE;MACnBG,IAAI,CAACH,KAAK,CAAC;IACb;EACF,CAAC,CACF;EAED,OAAO5C,SAAS;AAClB;AAAC,eAEcP,gBAAgB;AAAA"}

package/build/api/readme.d.ts

@@ -3,7 +3,7 @@ import { Auth } from '@verdaccio/auth';
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Manifest } from '@verdaccio/types';
-import { AuthorAvatar } from '../utils/web-utils';
+import { AuthorAvatar } from '../web-utils';
 export { $RequestExtend, $ResponseExtend, $NextFunctionVer };
 export type PackageExt = Manifest & {
     author: AuthorAvatar;

package/build/api/readme.js

@@ -27,7 +27,7 @@ var _express = require("express");
 var _core = require("@verdaccio/core");
 var _logger = require("@verdaccio/logger");
 var _middleware = require("@verdaccio/middleware");
-var _webUtils = require("../utils/web-utils");
+var _webUtils = require("../web-utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const NOT_README_FOUND = 'ERROR: No README data found!';
 exports.NOT_README_FOUND = NOT_README_FOUND;

package/build/api/readme.js.map

@@ -1 +1 @@
-{"version":3,"file":"readme.js","names":["NOT_README_FOUND","debug","buildDebug","getReadme","readme","length","addReadmeWebApi","storage","auth","can","allow","beforeAll","a","b","logger","trace","afterAll","pkgRouter","Router","get","req","res","next","name","params","scope","addScope","package","requestOptions","protocol","headers","host","remoteAddress","socket","manifest","getPackageByOptions","uplinksLook","abbreviated","set","HEADER_TYPE","CONTENT_TYPE","HEADERS","TEXT_PLAIN_UTF8","err"],"sources":["../../src/api/readme.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Manifest } from '@verdaccio/types';\n\nimport { AuthorAvatar, addScope } from '../utils/web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\n// TODO: review this type, should be on @verdacid/types\nexport type PackageExt = Manifest & { author: AuthorAvatar; dist?: { tarball: string } };\nexport const NOT_README_FOUND = 'ERROR: No README data found!';\nconst debug = buildDebug('verdaccio:web:api:readme');\nconst getReadme = (readme) => {\n  if (typeof readme === 'string' && readme.length === 0) {\n    return NOT_README_FOUND;\n  }\n  if (typeof readme !== 'string') {\n    return NOT_README_FOUND;\n  } else {\n    return readme;\n  }\n};\n\nfunction addReadmeWebApi(storage: Storage, auth: Auth): Router {\n  debug('initialized readme web api');\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n\n  pkgRouter.get(\n    '/package/readme/(@:scope/)?:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('readme hit');\n      const name = req.params.scope\n        ? addScope(req.params.scope, req.params.package)\n        : req.params.package;\n      debug('readme name %o', name);\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const manifest = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated: false,\n          requestOptions,\n        })) as Manifest;\n        debug('readme pkg %o', manifest?.name);\n        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);\n        next(getReadme(manifest.readme));\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n  return pkgRouter;\n}\n\nexport default addReadmeWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAGA;AACA;AACA;AAIA;AAA4D;AAMrD,MAAMA,gBAAgB,GAAG,8BAA8B;AAAC;AAC/D,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD,MAAMC,SAAS,GAAIC,MAAM,IAAK;EAC5B,IAAI,OAAOA,MAAM,KAAK,QAAQ,IAAIA,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;IACrD,OAAOL,gBAAgB;EACzB;EACA,IAAI,OAAOI,MAAM,KAAK,QAAQ,EAAE;IAC9B,OAAOJ,gBAAgB;EACzB,CAAC,MAAM;IACL,OAAOI,MAAM;EACf;AACF,CAAC;AAED,SAASE,eAAe,CAACC,OAAgB,EAAEC,IAAU,EAAU;EAC7DP,KAAK,CAAC,4BAA4B,CAAC;EACnC,MAAMQ,GAAG,GAAG,IAAAC,iBAAK,EAACF,IAAI,EAAE;IACtBG,SAAS,EAAE,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAE,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACF,MAAMI,SAAS,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;;EAE5BD,SAAS,CAACE,GAAG,CACX,+CAA+C,EAC/CV,GAAG,CAAC,QAAQ,CAAC,EACb,gBACEW,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACfrB,KAAK,CAAC,YAAY,CAAC;IACnB,MAAMsB,IAAI,GAAGH,GAAG,CAACI,MAAM,CAACC,KAAK,GACzB,IAAAC,kBAAQ,EAACN,GAAG,CAACI,MAAM,CAACC,KAAK,EAAEL,GAAG,CAACI,MAAM,CAACG,OAAO,CAAC,GAC9CP,GAAG,CAACI,MAAM,CAACG,OAAO;IACtB1B,KAAK,CAAC,gBAAgB,EAAEsB,IAAI,CAAC;IAC7B,MAAMK,cAAc,GAAG;MACrBC,QAAQ,EAAET,GAAG,CAACS,QAAQ;MACtBC,OAAO,EAAEV,GAAG,CAACU,OAAc;MAC3B;MACAC,IAAI,EAAEX,GAAG,CAACW,IAAI;MACdC,aAAa,EAAEZ,GAAG,CAACa,MAAM,CAACD;IAC5B,CAAC;IACD,IAAI;MACF,MAAME,QAAQ,GAAI,MAAM3B,OAAO,CAAC4B,mBAAmB,CAAC;QAClDZ,IAAI;QACJa,WAAW,EAAE,IAAI;QACjBC,WAAW,EAAE,KAAK;QAClBT;MACF,CAAC,CAAc;MACf3B,KAAK,CAAC,eAAe,EAAEiC,QAAQ,aAARA,QAAQ,uBAARA,QAAQ,CAAEX,IAAI,CAAC;MACtCF,GAAG,CAACiB,GAAG,CAACC,iBAAW,CAACC,YAAY,EAAEC,aAAO,CAACC,eAAe,CAAC;MAC1DpB,IAAI,CAACnB,SAAS,CAAC+B,QAAQ,CAAC9B,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,OAAOuC,GAAG,EAAE;MACZrB,IAAI,CAACqB,GAAG,CAAC;IACX;EACF,CAAC,CACF;EACD,OAAO1B,SAAS;AAClB;AAAC,eAEcX,eAAe;AAAA"}
+{"version":3,"file":"readme.js","names":["NOT_README_FOUND","debug","buildDebug","getReadme","readme","length","addReadmeWebApi","storage","auth","can","allow","beforeAll","a","b","logger","trace","afterAll","pkgRouter","Router","get","req","res","next","name","params","scope","addScope","package","requestOptions","protocol","headers","host","remoteAddress","socket","manifest","getPackageByOptions","uplinksLook","abbreviated","set","HEADER_TYPE","CONTENT_TYPE","HEADERS","TEXT_PLAIN_UTF8","err"],"sources":["../../src/api/readme.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { HEADERS, HEADER_TYPE } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { Manifest } from '@verdaccio/types';\n\nimport { AuthorAvatar, addScope } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\n// TODO: review this type, should be on @verdacid/types\nexport type PackageExt = Manifest & { author: AuthorAvatar; dist?: { tarball: string } };\nexport const NOT_README_FOUND = 'ERROR: No README data found!';\nconst debug = buildDebug('verdaccio:web:api:readme');\nconst getReadme = (readme) => {\n  if (typeof readme === 'string' && readme.length === 0) {\n    return NOT_README_FOUND;\n  }\n  if (typeof readme !== 'string') {\n    return NOT_README_FOUND;\n  } else {\n    return readme;\n  }\n};\n\nfunction addReadmeWebApi(storage: Storage, auth: Auth): Router {\n  debug('initialized readme web api');\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n\n  pkgRouter.get(\n    '/package/readme/(@:scope/)?:package/:version?',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('readme hit');\n      const name = req.params.scope\n        ? addScope(req.params.scope, req.params.package)\n        : req.params.package;\n      debug('readme name %o', name);\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const manifest = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated: false,\n          requestOptions,\n        })) as Manifest;\n        debug('readme pkg %o', manifest?.name);\n        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);\n        next(getReadme(manifest.readme));\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n  return pkgRouter;\n}\n\nexport default addReadmeWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAGA;AACA;AACA;AAIA;AAAsD;AAM/C,MAAMA,gBAAgB,GAAG,8BAA8B;AAAC;AAC/D,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,0BAA0B,CAAC;AACpD,MAAMC,SAAS,GAAIC,MAAM,IAAK;EAC5B,IAAI,OAAOA,MAAM,KAAK,QAAQ,IAAIA,MAAM,CAACC,MAAM,KAAK,CAAC,EAAE;IACrD,OAAOL,gBAAgB;EACzB;EACA,IAAI,OAAOI,MAAM,KAAK,QAAQ,EAAE;IAC9B,OAAOJ,gBAAgB;EACzB,CAAC,MAAM;IACL,OAAOI,MAAM;EACf;AACF,CAAC;AAED,SAASE,eAAe,CAACC,OAAgB,EAAEC,IAAU,EAAU;EAC7DP,KAAK,CAAC,4BAA4B,CAAC;EACnC,MAAMQ,GAAG,GAAG,IAAAC,iBAAK,EAACF,IAAI,EAAE;IACtBG,SAAS,EAAE,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAE,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACF,MAAMI,SAAS,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;;EAE5BD,SAAS,CAACE,GAAG,CACX,+CAA+C,EAC/CV,GAAG,CAAC,QAAQ,CAAC,EACb,gBACEW,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACfrB,KAAK,CAAC,YAAY,CAAC;IACnB,MAAMsB,IAAI,GAAGH,GAAG,CAACI,MAAM,CAACC,KAAK,GACzB,IAAAC,kBAAQ,EAACN,GAAG,CAACI,MAAM,CAACC,KAAK,EAAEL,GAAG,CAACI,MAAM,CAACG,OAAO,CAAC,GAC9CP,GAAG,CAACI,MAAM,CAACG,OAAO;IACtB1B,KAAK,CAAC,gBAAgB,EAAEsB,IAAI,CAAC;IAC7B,MAAMK,cAAc,GAAG;MACrBC,QAAQ,EAAET,GAAG,CAACS,QAAQ;MACtBC,OAAO,EAAEV,GAAG,CAACU,OAAc;MAC3B;MACAC,IAAI,EAAEX,GAAG,CAACW,IAAI;MACdC,aAAa,EAAEZ,GAAG,CAACa,MAAM,CAACD;IAC5B,CAAC;IACD,IAAI;MACF,MAAME,QAAQ,GAAI,MAAM3B,OAAO,CAAC4B,mBAAmB,CAAC;QAClDZ,IAAI;QACJa,WAAW,EAAE,IAAI;QACjBC,WAAW,EAAE,KAAK;QAClBT;MACF,CAAC,CAAc;MACf3B,KAAK,CAAC,eAAe,EAAEiC,QAAQ,aAARA,QAAQ,uBAARA,QAAQ,CAAEX,IAAI,CAAC;MACtCF,GAAG,CAACiB,GAAG,CAACC,iBAAW,CAACC,YAAY,EAAEC,aAAO,CAACC,eAAe,CAAC;MAC1DpB,IAAI,CAACnB,SAAS,CAAC+B,QAAQ,CAAC9B,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,OAAOuC,GAAG,EAAE;MACZrB,IAAI,CAACqB,GAAG,CAAC;IACX;EACF,CAAC,CACF;EACD,OAAO1B,SAAS;AAClB;AAAC,eAEcX,eAAe;AAAA"}

package/build/api/sidebar.d.ts

@@ -3,7 +3,7 @@ import { Auth } from '@verdaccio/auth';
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';
 import { Storage } from '@verdaccio/store';
 import { Config, Manifest, Version } from '@verdaccio/types';
-import { AuthorAvatar } from '../utils/web-utils';
+import { AuthorAvatar } from '../web-utils';
 export { $RequestExtend, $ResponseExtend, $NextFunctionVer };
 export type PackageExt = Manifest & {
     author: AuthorAvatar;

package/build/api/sidebar.js

@@ -29,7 +29,7 @@ var _logger = require("@verdaccio/logger");
 var _middleware = require("@verdaccio/middleware");
 var _tarball = require("@verdaccio/tarball");
 var _utils = require("@verdaccio/utils");
-var _webUtils = require("../utils/web-utils");
+var _webUtils = require("../web-utils");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:web:api:sidebar');
 function addSidebarWebApi(config, storage, auth) {

package/build/api/sidebar.js.map

@@ -1 +1 @@
-{"version":3,"file":"sidebar.js","names":["debug","buildDebug","addSidebarWebApi","config","storage","auth","router","Router","can","allow","beforeAll","a","b","logger","trace","afterAll","get","req","res","next","name","params","scope","addScope","package","requestOptions","protocol","headers","host","remoteAddress","socket","info","getPackageByOptions","uplinksLook","keepUpLinkData","v","query","sideBarInfo","versions","convertDistRemoteToLocalTarballUrls","hostname","url_prefix","isVersionValid","latest","author","formatAuthor","DIST_TAGS","deleteProperties","authorAvatar","web","addGravatarSupport","gravatar","err","status","HTTP_STATUS","NOT_FOUND","end"],"sources":["../../src/api/sidebar.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';\nimport { Config, Manifest, Version } from '@verdaccio/types';\nimport { addGravatarSupport, formatAuthor, isVersionValid } from '@verdaccio/utils';\n\nimport { AuthorAvatar, addScope, deleteProperties } from '../utils/web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nexport type PackageExt = Manifest & { author: AuthorAvatar; dist?: { tarball: string } };\n\nexport type $SidebarPackage = Manifest & { latest: Version };\nconst debug = buildDebug('verdaccio:web:api:sidebar');\n\nfunction addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {\n  debug('initialized sidebar web api');\n  const router = Router(); /* eslint new-cap: 0 */\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  // Get package readme\n  router.get(\n    '/sidebar/(@:scope/)?:package',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name: string = req.params.scope\n        ? addScope(req.params.scope, req.params.package)\n        : req.params.package;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const info = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          keepUpLinkData: true,\n          requestOptions,\n        })) as Manifest;\n        const { v } = req.query;\n        let sideBarInfo = { ...info };\n        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(\n          info,\n          { protocol: req.protocol, headers: req.headers as any, host: req.hostname },\n          config.url_prefix\n        ).versions;\n        // TODO: review this implementation\n        if (typeof v === 'string' && isVersionValid(info, v)) {\n          // @ts-ignore\n          sideBarInfo.latest = sideBarInfo.versions[v];\n          // @ts-ignore\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        } else {\n          // @ts-ignore\n          sideBarInfo.latest = sideBarInfo.versions[info[DIST_TAGS].latest];\n          // @ts-ignore\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        }\n        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);\n        const authorAvatar = config.web\n          ? addGravatarSupport(sideBarInfo, config.web.gravatar)\n          : addGravatarSupport(sideBarInfo);\n        next(authorAvatar);\n      } catch (err) {\n        res.status(HTTP_STATUS.NOT_FOUND);\n        res.end();\n      }\n    }\n  );\n\n  return router;\n}\n\nexport default addSidebarWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAGA;AACA;AACA;AAEA;AAEA;AAEA;AAA8E;AAO9E,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,2BAA2B,CAAC;AAErD,SAASC,gBAAgB,CAACC,MAAc,EAAEC,OAAgB,EAAEC,IAAU,EAAU;EAC9EL,KAAK,CAAC,6BAA6B,CAAC;EACpC,MAAMM,MAAM,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EACzB,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAE,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAE,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACF;EACAN,MAAM,CAACU,GAAG,CACR,8BAA8B,EAC9BR,GAAG,CAAC,QAAQ,CAAC,EACb,gBACES,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,IAAY,GAAGH,GAAG,CAACI,MAAM,CAACC,KAAK,GACjC,IAAAC,kBAAQ,EAACN,GAAG,CAACI,MAAM,CAACC,KAAK,EAAEL,GAAG,CAACI,MAAM,CAACG,OAAO,CAAC,GAC9CP,GAAG,CAACI,MAAM,CAACG,OAAO;IACtB,MAAMC,cAAc,GAAG;MACrBC,QAAQ,EAAET,GAAG,CAACS,QAAQ;MACtBC,OAAO,EAAEV,GAAG,CAACU,OAAc;MAC3B;MACAC,IAAI,EAAEX,GAAG,CAACW,IAAI;MACdC,aAAa,EAAEZ,GAAG,CAACa,MAAM,CAACD;IAC5B,CAAC;IACD,IAAI;MACF,MAAME,IAAI,GAAI,MAAM3B,OAAO,CAAC4B,mBAAmB,CAAC;QAC9CZ,IAAI;QACJa,WAAW,EAAE,IAAI;QACjBC,cAAc,EAAE,IAAI;QACpBT;MACF,CAAC,CAAc;MACf,MAAM;QAAEU;MAAE,CAAC,GAAGlB,GAAG,CAACmB,KAAK;MACvB,IAAIC,WAAW,GAAG;QAAE,GAAGN;MAAK,CAAC;MAC7BM,WAAW,CAACC,QAAQ,GAAG,IAAAC,4CAAmC,EACxDR,IAAI,EACJ;QAAEL,QAAQ,EAAET,GAAG,CAACS,QAAQ;QAAEC,OAAO,EAAEV,GAAG,CAACU,OAAc;QAAEC,IAAI,EAAEX,GAAG,CAACuB;MAAS,CAAC,EAC3ErC,MAAM,CAACsC,UAAU,CAClB,CAACH,QAAQ;MACV;MACA,IAAI,OAAOH,CAAC,KAAK,QAAQ,IAAI,IAAAO,qBAAc,EAACX,IAAI,EAAEI,CAAC,CAAC,EAAE;QACpD;QACAE,WAAW,CAACM,MAAM,GAAGN,WAAW,CAACC,QAAQ,CAACH,CAAC,CAAC;QAC5C;QACAE,WAAW,CAACM,MAAM,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACR,WAAW,CAACM,MAAM,CAACC,MAAM,CAAC;MACrE,CAAC,MAAM;QACL;QACAP,WAAW,CAACM,MAAM,GAAGN,WAAW,CAACC,QAAQ,CAACP,IAAI,CAACe,eAAS,CAAC,CAACH,MAAM,CAAC;QACjE;QACAN,WAAW,CAACM,MAAM,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACR,WAAW,CAACM,MAAM,CAACC,MAAM,CAAC;MACrE;MACAP,WAAW,GAAG,IAAAU,0BAAgB,EAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAEV,WAAW,CAAC;MACvF,MAAMW,YAAY,GAAG7C,MAAM,CAAC8C,GAAG,GAC3B,IAAAC,yBAAkB,EAACb,WAAW,EAAElC,MAAM,CAAC8C,GAAG,CAACE,QAAQ,CAAC,GACpD,IAAAD,yBAAkB,EAACb,WAAW,CAAC;MACnClB,IAAI,CAAC6B,YAAY,CAAC;IACpB,CAAC,CAAC,OAAOI,GAAG,EAAE;MACZlC,GAAG,CAACmC,MAAM,CAACC,iBAAW,CAACC,SAAS,CAAC;MACjCrC,GAAG,CAACsC,GAAG,EAAE;IACX;EACF,CAAC,CACF;EAED,OAAOlD,MAAM;AACf;AAAC,eAEcJ,gBAAgB;AAAA"}
+{"version":3,"file":"sidebar.js","names":["debug","buildDebug","addSidebarWebApi","config","storage","auth","router","Router","can","allow","beforeAll","a","b","logger","trace","afterAll","get","req","res","next","name","params","scope","addScope","package","requestOptions","protocol","headers","host","remoteAddress","socket","info","getPackageByOptions","uplinksLook","keepUpLinkData","v","query","sideBarInfo","versions","convertDistRemoteToLocalTarballUrls","hostname","url_prefix","isVersionValid","latest","author","formatAuthor","DIST_TAGS","deleteProperties","authorAvatar","web","addGravatarSupport","gravatar","err","status","HTTP_STATUS","NOT_FOUND","end"],"sources":["../../src/api/sidebar.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HTTP_STATUS } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';\nimport { Config, Manifest, Version } from '@verdaccio/types';\nimport { addGravatarSupport, formatAuthor, isVersionValid } from '@verdaccio/utils';\n\nimport { AuthorAvatar, addScope, deleteProperties } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nexport type PackageExt = Manifest & { author: AuthorAvatar; dist?: { tarball: string } };\n\nexport type $SidebarPackage = Manifest & { latest: Version };\nconst debug = buildDebug('verdaccio:web:api:sidebar');\n\nfunction addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {\n  debug('initialized sidebar web api');\n  const router = Router(); /* eslint new-cap: 0 */\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  // Get package readme\n  router.get(\n    '/sidebar/(@:scope/)?:package',\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name: string = req.params.scope\n        ? addScope(req.params.scope, req.params.package)\n        : req.params.package;\n      const requestOptions = {\n        protocol: req.protocol,\n        headers: req.headers as any,\n        // FIXME: if we migrate to req.hostname, the port is not longer included.\n        host: req.host,\n        remoteAddress: req.socket.remoteAddress,\n      };\n      try {\n        const info = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          keepUpLinkData: true,\n          requestOptions,\n        })) as Manifest;\n        const { v } = req.query;\n        let sideBarInfo = { ...info };\n        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(\n          info,\n          { protocol: req.protocol, headers: req.headers as any, host: req.hostname },\n          config.url_prefix\n        ).versions;\n        // TODO: review this implementation\n        if (typeof v === 'string' && isVersionValid(info, v)) {\n          // @ts-ignore\n          sideBarInfo.latest = sideBarInfo.versions[v];\n          // @ts-ignore\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        } else {\n          // @ts-ignore\n          sideBarInfo.latest = sideBarInfo.versions[info[DIST_TAGS].latest];\n          // @ts-ignore\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        }\n        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);\n        const authorAvatar = config.web\n          ? addGravatarSupport(sideBarInfo, config.web.gravatar)\n          : addGravatarSupport(sideBarInfo);\n        next(authorAvatar);\n      } catch (err) {\n        res.status(HTTP_STATUS.NOT_FOUND);\n        res.end();\n      }\n    }\n  );\n\n  return router;\n}\n\nexport default addSidebarWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA;AACA;AAGA;AACA;AACA;AAEA;AAEA;AAEA;AAAwE;AAOxE,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,2BAA2B,CAAC;AAErD,SAASC,gBAAgB,CAACC,MAAc,EAAEC,OAAgB,EAAEC,IAAU,EAAU;EAC9EL,KAAK,CAAC,6BAA6B,CAAC;EACpC,MAAMM,MAAM,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EACzB,MAAMC,GAAG,GAAG,IAAAC,iBAAK,EAACJ,IAAI,EAAE;IACtBK,SAAS,EAAE,CAACC,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC,CAAC;IACvCG,QAAQ,EAAE,CAACJ,CAAC,EAAEC,CAAC,KAAKC,cAAM,CAACC,KAAK,CAACH,CAAC,EAAEC,CAAC;EACvC,CAAC,CAAC;EACF;EACAN,MAAM,CAACU,GAAG,CACR,8BAA8B,EAC9BR,GAAG,CAAC,QAAQ,CAAC,EACb,gBACES,GAAmB,EACnBC,GAAoB,EACpBC,IAAsB,EACP;IACf,MAAMC,IAAY,GAAGH,GAAG,CAACI,MAAM,CAACC,KAAK,GACjC,IAAAC,kBAAQ,EAACN,GAAG,CAACI,MAAM,CAACC,KAAK,EAAEL,GAAG,CAACI,MAAM,CAACG,OAAO,CAAC,GAC9CP,GAAG,CAACI,MAAM,CAACG,OAAO;IACtB,MAAMC,cAAc,GAAG;MACrBC,QAAQ,EAAET,GAAG,CAACS,QAAQ;MACtBC,OAAO,EAAEV,GAAG,CAACU,OAAc;MAC3B;MACAC,IAAI,EAAEX,GAAG,CAACW,IAAI;MACdC,aAAa,EAAEZ,GAAG,CAACa,MAAM,CAACD;IAC5B,CAAC;IACD,IAAI;MACF,MAAME,IAAI,GAAI,MAAM3B,OAAO,CAAC4B,mBAAmB,CAAC;QAC9CZ,IAAI;QACJa,WAAW,EAAE,IAAI;QACjBC,cAAc,EAAE,IAAI;QACpBT;MACF,CAAC,CAAc;MACf,MAAM;QAAEU;MAAE,CAAC,GAAGlB,GAAG,CAACmB,KAAK;MACvB,IAAIC,WAAW,GAAG;QAAE,GAAGN;MAAK,CAAC;MAC7BM,WAAW,CAACC,QAAQ,GAAG,IAAAC,4CAAmC,EACxDR,IAAI,EACJ;QAAEL,QAAQ,EAAET,GAAG,CAACS,QAAQ;QAAEC,OAAO,EAAEV,GAAG,CAACU,OAAc;QAAEC,IAAI,EAAEX,GAAG,CAACuB;MAAS,CAAC,EAC3ErC,MAAM,CAACsC,UAAU,CAClB,CAACH,QAAQ;MACV;MACA,IAAI,OAAOH,CAAC,KAAK,QAAQ,IAAI,IAAAO,qBAAc,EAACX,IAAI,EAAEI,CAAC,CAAC,EAAE;QACpD;QACAE,WAAW,CAACM,MAAM,GAAGN,WAAW,CAACC,QAAQ,CAACH,CAAC,CAAC;QAC5C;QACAE,WAAW,CAACM,MAAM,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACR,WAAW,CAACM,MAAM,CAACC,MAAM,CAAC;MACrE,CAAC,MAAM;QACL;QACAP,WAAW,CAACM,MAAM,GAAGN,WAAW,CAACC,QAAQ,CAACP,IAAI,CAACe,eAAS,CAAC,CAACH,MAAM,CAAC;QACjE;QACAN,WAAW,CAACM,MAAM,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACR,WAAW,CAACM,MAAM,CAACC,MAAM,CAAC;MACrE;MACAP,WAAW,GAAG,IAAAU,0BAAgB,EAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAEV,WAAW,CAAC;MACvF,MAAMW,YAAY,GAAG7C,MAAM,CAAC8C,GAAG,GAC3B,IAAAC,yBAAkB,EAACb,WAAW,EAAElC,MAAM,CAAC8C,GAAG,CAACE,QAAQ,CAAC,GACpD,IAAAD,yBAAkB,EAACb,WAAW,CAAC;MACnClB,IAAI,CAAC6B,YAAY,CAAC;IACpB,CAAC,CAAC,OAAOI,GAAG,EAAE;MACZlC,GAAG,CAACmC,MAAM,CAACC,iBAAW,CAACC,SAAS,CAAC;MACjCrC,GAAG,CAACsC,GAAG,EAAE;IACX;EACF,CAAC,CACF;EAED,OAAOlD,MAAM;AACf;AAAC,eAEcJ,gBAAgB;AAAA"}

package/build/api/user.js

@@ -8,12 +8,13 @@ var _debug = _interopRequireDefault(require("debug"));
 var _express = require("express");
 var _lodash = _interopRequireDefault(require("lodash"));
 var _core = require("@verdaccio/core");
+var _middleware = require("@verdaccio/middleware");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 const debug = (0, _debug.default)('verdaccio:web:api:user');
 function addUserAuthApi(auth, config) {
   var _config$flags;
   const route = (0, _express.Router)(); /* eslint new-cap: 0 */
-  route.post('/login', function (req, res, next) {
+  route.post('/login', (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), function (req, res, next) {
     const {
       username,
       password
@@ -36,7 +37,7 @@ function addUserAuthApi(auth, config) {
     });
   });
   if ((config === null || config === void 0 ? void 0 : (_config$flags = config.flags) === null || _config$flags === void 0 ? void 0 : _config$flags.changePassword) === true) {
-    route.put('/reset_password', function (req, res, next) {
+    route.put('/reset_password', (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), function (req, res, next) {
       var _config$serverSetting;
       if (_lodash.default.isNil(req.remote_user.name)) {
         res.status(_core.HTTP_STATUS.UNAUTHORIZED);

package/build/api/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["debug","buildDebug","addUserAuthApi","auth","config","route","Router","post","req","res","next","username","password","body","authenticate","err","user","errorCode","message","HTTP_STATUS","UNAUTHORIZED","INTERNAL_ERROR","errorUtils","getCode","remote_user","jWTSignOptions","security","web","sign","set","HEADERS","CACHE_CONTROL","token","jwtEncrypt","name","flags","changePassword","put","_","isNil","status","API_ERROR","MUST_BE_LOGGED","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","old","isUpdated","ok","getInternalError","INTERNAL_SERVER_ERROR","BAD_REQUEST","APP_ERROR","PASSWORD_VALIDATION"],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Request, Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  VerdaccioError,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nfunction addUserAuthApi(auth: Auth, config: Config): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post('/login', function (req: Request, res: Response, next: $NextFunctionVer): void {\n    const { username, password } = req.body;\n    debug('authenticate %o', username);\n    auth.authenticate(\n      username,\n      password,\n      async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n        if (err) {\n          const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n          debug('error authenticate %o', errorCode);\n          next(errorUtils.getCode(errorCode, err.message));\n        } else {\n          req.remote_user = user as RemoteUser;\n          const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n          res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n          next({\n            token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n            username: req.remote_user.name,\n          });\n        }\n      }\n    );\n  });\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      '/reset_password',\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (_.isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validatioUtils.validatePassword(\n            password.new,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          auth.changePassword(\n            name as string,\n            password.old,\n            password.new,\n            (err, isUpdated): void => {\n              if (_.isNil(err) && isUpdated) {\n                next({\n                  ok: true,\n                });\n              } else {\n                return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n              }\n            }\n          );\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;AAAA;AACA;AACA;AAGA;AAQyB;AAKzB,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,wBAAwB,CAAC;AAElD,SAASC,cAAc,CAACC,IAAU,EAAEC,MAAc,EAAU;EAAA;EAC1D,MAAMC,KAAK,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EACxBD,KAAK,CAACE,IAAI,CAAC,QAAQ,EAAE,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IACxF,MAAM;MAAEC,QAAQ;MAAEC;IAAS,CAAC,GAAGJ,GAAG,CAACK,IAAI;IACvCb,KAAK,CAAC,iBAAiB,EAAEW,QAAQ,CAAC;IAClCR,IAAI,CAACW,YAAY,CACfH,QAAQ,EACRC,QAAQ,EACR,OAAOG,GAA0B,EAAEC,IAAiB,KAAoB;MACtE,IAAID,GAAG,EAAE;QACP,MAAME,SAAS,GAAGF,GAAG,CAACG,OAAO,GAAGC,iBAAW,CAACC,YAAY,GAAGD,iBAAW,CAACE,cAAc;QACrFrB,KAAK,CAAC,uBAAuB,EAAEiB,SAAS,CAAC;QACzCP,IAAI,CAACY,gBAAU,CAACC,OAAO,CAACN,SAAS,EAAEF,GAAG,CAACG,OAAO,CAAC,CAAC;MAClD,CAAC,MAAM;QACLV,GAAG,CAACgB,WAAW,GAAGR,IAAkB;QACpC,MAAMS,cAA8B,GAAGrB,MAAM,CAACsB,QAAQ,CAACC,GAAG,CAACC,IAAI;QAC/DnB,GAAG,CAACoB,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpDrB,IAAI,CAAC;UACHsB,KAAK,EAAE,MAAM7B,IAAI,CAAC8B,UAAU,CAACjB,IAAI,EAAgBS,cAAc,CAAC;UAChEd,QAAQ,EAAEH,GAAG,CAACgB,WAAW,CAACU;QAC5B,CAAC,CAAC;MACJ;IACF,CAAC,CACF;EACH,CAAC,CAAC;EAEF,IAAI,CAAA9B,MAAM,aAANA,MAAM,wCAANA,MAAM,CAAE+B,KAAK,kDAAb,cAAeC,cAAc,MAAK,IAAI,EAAE;IAC1C/B,KAAK,CAACgC,GAAG,CACP,iBAAiB,EACjB,UAAU7B,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;MAAA;MACnE,IAAI4B,eAAC,CAACC,KAAK,CAAC/B,GAAG,CAACgB,WAAW,CAACU,IAAI,CAAC,EAAE;QACjCzB,GAAG,CAAC+B,MAAM,CAACrB,iBAAW,CAACC,YAAY,CAAC;QACpC,OAAOV,IAAI,CAAC;UACV;UACAQ,OAAO,EAAEuB,eAAS,CAACC;QACrB,CAAC,CAAC;MACJ;MAEA,MAAM;QAAE9B;MAAS,CAAC,GAAGJ,GAAG,CAACK,IAAI;MAC7B,MAAM;QAAEqB;MAAK,CAAC,GAAG1B,GAAG,CAACgB,WAAW;MAEhC,IACEmB,oBAAc,CAACC,gBAAgB,CAC7BhC,QAAQ,CAACiC,GAAG,EACZzC,MAAM,aAANA,MAAM,gDAANA,MAAM,CAAE0C,cAAc,0DAAtB,sBAAwBC,uBAAuB,CAChD,KAAK,KAAK,EACX;QACA5C,IAAI,CAACiC,cAAc,CACjBF,IAAI,EACJtB,QAAQ,CAACoC,GAAG,EACZpC,QAAQ,CAACiC,GAAG,EACZ,CAAC9B,GAAG,EAAEkC,SAAS,KAAW;UACxB,IAAIX,eAAC,CAACC,KAAK,CAACxB,GAAG,CAAC,IAAIkC,SAAS,EAAE;YAC7BvC,IAAI,CAAC;cACHwC,EAAE,EAAE;YACN,CAAC,CAAC;UACJ,CAAC,MAAM;YACL,OAAOxC,IAAI,CAACY,gBAAU,CAAC6B,gBAAgB,CAACV,eAAS,CAACW,qBAAqB,CAAC,CAAC;UAC3E;QACF,CAAC,CACF;MACH,CAAC,MAAM;QACL,OAAO1C,IAAI,CAACY,gBAAU,CAACC,OAAO,CAACJ,iBAAW,CAACkC,WAAW,EAAEC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACzF;IACF,CAAC,CACF;EACH;EAEA,OAAOlD,KAAK;AACd;AAAC,eAEcH,cAAc;AAAA"}
+{"version":3,"file":"user.js","names":["debug","buildDebug","addUserAuthApi","auth","config","route","Router","post","rateLimit","userRateLimit","req","res","next","username","password","body","authenticate","err","user","errorCode","message","HTTP_STATUS","UNAUTHORIZED","INTERNAL_ERROR","errorUtils","getCode","remote_user","jWTSignOptions","security","web","sign","set","HEADERS","CACHE_CONTROL","token","jwtEncrypt","name","flags","changePassword","put","_","isNil","status","API_ERROR","MUST_BE_LOGGED","validatioUtils","validatePassword","new","serverSettings","passwordValidationRegex","old","isUpdated","ok","getInternalError","INTERNAL_SERVER_ERROR","BAD_REQUEST","APP_ERROR","PASSWORD_VALIDATION"],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Request, Response, Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  VerdaccioError,\n  errorUtils,\n  validatioUtils,\n} from '@verdaccio/core';\nimport { rateLimit } from '@verdaccio/middleware';\nimport { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nfunction addUserAuthApi(auth: Auth, config: Config): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    '/login',\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n            next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      '/reset_password',\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (_.isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validatioUtils.validatePassword(\n            password.new,\n            config?.serverSettings?.passwordValidationRegex\n          ) === false\n        ) {\n          auth.changePassword(\n            name as string,\n            password.old,\n            password.new,\n            (err, isUpdated): void => {\n              if (_.isNil(err) && isUpdated) {\n                next({\n                  ok: true,\n                });\n              } else {\n                return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n              }\n            }\n          );\n        } else {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;AAAA;AACA;AACA;AAGA;AASA;AAAkD;AAKlD,MAAMA,KAAK,GAAG,IAAAC,cAAU,EAAC,wBAAwB,CAAC;AAElD,SAASC,cAAc,CAACC,IAAU,EAAEC,MAAc,EAAU;EAAA;EAC1D,MAAMC,KAAK,GAAG,IAAAC,eAAM,GAAE,CAAC,CAAC;EACxBD,KAAK,CAACE,IAAI,CACR,QAAQ,EACR,IAAAC,qBAAS,EAACJ,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEK,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IACnE,MAAM;MAAEC,QAAQ;MAAEC;IAAS,CAAC,GAAGJ,GAAG,CAACK,IAAI;IACvCf,KAAK,CAAC,iBAAiB,EAAEa,QAAQ,CAAC;IAClCV,IAAI,CAACa,YAAY,CACfH,QAAQ,EACRC,QAAQ,EACR,OAAOG,GAA0B,EAAEC,IAAiB,KAAoB;MACtE,IAAID,GAAG,EAAE;QACP,MAAME,SAAS,GAAGF,GAAG,CAACG,OAAO,GAAGC,iBAAW,CAACC,YAAY,GAAGD,iBAAW,CAACE,cAAc;QACrFvB,KAAK,CAAC,uBAAuB,EAAEmB,SAAS,CAAC;QACzCP,IAAI,CAACY,gBAAU,CAACC,OAAO,CAACN,SAAS,EAAEF,GAAG,CAACG,OAAO,CAAC,CAAC;MAClD,CAAC,MAAM;QACLV,GAAG,CAACgB,WAAW,GAAGR,IAAkB;QACpC,MAAMS,cAA8B,GAAGvB,MAAM,CAACwB,QAAQ,CAACC,GAAG,CAACC,IAAI;QAC/DnB,GAAG,CAACoB,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;QACpDrB,IAAI,CAAC;UACHsB,KAAK,EAAE,MAAM/B,IAAI,CAACgC,UAAU,CAACjB,IAAI,EAAgBS,cAAc,CAAC;UAChEd,QAAQ,EAAEH,GAAG,CAACgB,WAAW,CAACU;QAC5B,CAAC,CAAC;MACJ;IACF,CAAC,CACF;EACH,CAAC,CACF;EAED,IAAI,CAAAhC,MAAM,aAANA,MAAM,wCAANA,MAAM,CAAEiC,KAAK,kDAAb,cAAeC,cAAc,MAAK,IAAI,EAAE;IAC1CjC,KAAK,CAACkC,GAAG,CACP,iBAAiB,EACjB,IAAA/B,qBAAS,EAACJ,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEK,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;MAAA;MACnE,IAAI4B,eAAC,CAACC,KAAK,CAAC/B,GAAG,CAACgB,WAAW,CAACU,IAAI,CAAC,EAAE;QACjCzB,GAAG,CAAC+B,MAAM,CAACrB,iBAAW,CAACC,YAAY,CAAC;QACpC,OAAOV,IAAI,CAAC;UACV;UACAQ,OAAO,EAAEuB,eAAS,CAACC;QACrB,CAAC,CAAC;MACJ;MAEA,MAAM;QAAE9B;MAAS,CAAC,GAAGJ,GAAG,CAACK,IAAI;MAC7B,MAAM;QAAEqB;MAAK,CAAC,GAAG1B,GAAG,CAACgB,WAAW;MAEhC,IACEmB,oBAAc,CAACC,gBAAgB,CAC7BhC,QAAQ,CAACiC,GAAG,EACZ3C,MAAM,aAANA,MAAM,gDAANA,MAAM,CAAE4C,cAAc,0DAAtB,sBAAwBC,uBAAuB,CAChD,KAAK,KAAK,EACX;QACA9C,IAAI,CAACmC,cAAc,CACjBF,IAAI,EACJtB,QAAQ,CAACoC,GAAG,EACZpC,QAAQ,CAACiC,GAAG,EACZ,CAAC9B,GAAG,EAAEkC,SAAS,KAAW;UACxB,IAAIX,eAAC,CAACC,KAAK,CAACxB,GAAG,CAAC,IAAIkC,SAAS,EAAE;YAC7BvC,IAAI,CAAC;cACHwC,EAAE,EAAE;YACN,CAAC,CAAC;UACJ,CAAC,MAAM;YACL,OAAOxC,IAAI,CAACY,gBAAU,CAAC6B,gBAAgB,CAACV,eAAS,CAACW,qBAAqB,CAAC,CAAC;UAC3E;QACF,CAAC,CACF;MACH,CAAC,MAAM;QACL,OAAO1C,IAAI,CAACY,gBAAU,CAACC,OAAO,CAACJ,iBAAW,CAACkC,WAAW,EAAEC,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACzF;IACF,CAAC,CACF;EACH;EAEA,OAAOpD,KAAK;AACd;AAAC,eAEcH,cAAc;AAAA"}

package/build/index.d.ts

@@ -1 +1 @@
-export { default } from './web-middleware';
+export { default } from './middleware';

package/build/index.js

@@ -6,9 +6,9 @@ Object.defineProperty(exports, "__esModule", {
 Object.defineProperty(exports, "default", {
   enumerable: true,
   get: function () {
-    return _webMiddleware.default;
+    return _middleware.default;
   }
 });
-var _webMiddleware = _interopRequireDefault(require("./web-middleware"));
+var _middleware = _interopRequireDefault(require("./middleware"));
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { default } from './web-middleware';\n"],"mappings":";;;;;;;;;;;AAAA;AAA2C"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/index.ts"],"sourcesContent":["export { default } from './middleware';\n"],"mappings":";;;;;;;;;;;AAAA;AAAuC"}

package/build/{web-middleware.d.ts → middleware.d.ts}

@@ -1,2 +1,3 @@
+export declare function loadTheme(config: any): Promise<any>;
 declare const _default: (config: any, auth: any, storage: any) => Promise<import("express-serve-static-core").Router>;
 export default _default;

package/build/middleware.js

@@ -0,0 +1,45 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+exports.loadTheme = loadTheme;
+var _express = _interopRequireDefault(require("express"));
+var _lodash = _interopRequireDefault(require("lodash"));
+var _loaders = require("@verdaccio/loaders");
+var _logger = require("@verdaccio/logger");
+var _middleware = require("@verdaccio/middleware");
+var _api = _interopRequireDefault(require("./api"));
+function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+async function loadTheme(config) {
+  if (_lodash.default.isNil(config.theme) === false) {
+    var _config$serverSetting;
+    const plugin = await (0, _loaders.asyncLoadPlugin)(config.theme, {
+      config,
+      logger: _logger.logger
+    },
+    // TODO: add types { staticPath: string; manifest: unknown; manifestFiles: unknown }
+    function (plugin) {
+      return plugin.staticPath && plugin.manifest && plugin.manifestFiles;
+    }, (config === null || config === void 0 ? void 0 : (_config$serverSetting = config.serverSettings) === null || _config$serverSetting === void 0 ? void 0 : _config$serverSetting.pluginPrefix) ?? 'verdaccio-theme');
+    if (plugin.length > 1) {
+      _logger.logger.warn('multiple ui themes are not supported , only the first plugin is used used');
+    }
+    return _lodash.default.head(plugin);
+  }
+}
+var _default = async (config, auth, storage) => {
+  const pluginOptions = (await loadTheme(config)) || require('@verdaccio/ui-theme')();
+
+  // eslint-disable-next-line new-cap
+  const router = _express.default.Router();
+  // load application
+  router.use((0, _middleware.webMiddleware)(config, {
+    tokenMiddleware: auth.webUIJWTmiddleware(),
+    webEndpointsApi: (0, _api.default)(auth, storage, config)
+  }, pluginOptions));
+  return router;
+};
+exports.default = _default;
+//# sourceMappingURL=middleware.js.map

package/build/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","names":["loadTheme","config","_","isNil","theme","plugin","asyncLoadPlugin","logger","staticPath","manifest","manifestFiles","serverSettings","pluginPrefix","length","warn","head","auth","storage","pluginOptions","require","router","express","Router","use","webMiddleware","tokenMiddleware","webUIJWTmiddleware","webEndpointsApi"],"sources":["../src/middleware.ts"],"sourcesContent":["import express from 'express';\nimport _ from 'lodash';\n\nimport { asyncLoadPlugin } from '@verdaccio/loaders';\nimport { logger } from '@verdaccio/logger';\nimport { webMiddleware } from '@verdaccio/middleware';\n\nimport webEndpointsApi from './api';\n\nexport async function loadTheme(config: any) {\n  if (_.isNil(config.theme) === false) {\n    const plugin = await asyncLoadPlugin(\n      config.theme,\n      { config, logger },\n      // TODO: add types { staticPath: string; manifest: unknown; manifestFiles: unknown }\n      function (plugin: any) {\n        return plugin.staticPath && plugin.manifest && plugin.manifestFiles;\n      },\n      config?.serverSettings?.pluginPrefix ?? 'verdaccio-theme'\n    );\n    if (plugin.length > 1) {\n      logger.warn('multiple ui themes are not supported , only the first plugin is used used');\n    }\n\n    return _.head(plugin);\n  }\n}\n\nexport default async (config, auth, storage) => {\n  const pluginOptions = (await loadTheme(config)) || require('@verdaccio/ui-theme')();\n\n  // eslint-disable-next-line new-cap\n  const router = express.Router();\n  // load application\n  router.use(\n    webMiddleware(\n      config,\n      {\n        tokenMiddleware: auth.webUIJWTmiddleware(),\n        webEndpointsApi: webEndpointsApi(auth, storage, config),\n      },\n      pluginOptions\n    )\n  );\n  return router;\n};\n"],"mappings":";;;;;;;AAAA;AACA;AAEA;AACA;AACA;AAEA;AAAoC;AAE7B,eAAeA,SAAS,CAACC,MAAW,EAAE;EAC3C,IAAIC,eAAC,CAACC,KAAK,CAACF,MAAM,CAACG,KAAK,CAAC,KAAK,KAAK,EAAE;IAAA;IACnC,MAAMC,MAAM,GAAG,MAAM,IAAAC,wBAAe,EAClCL,MAAM,CAACG,KAAK,EACZ;MAAEH,MAAM;MAAEM,MAAM,EAANA;IAAO,CAAC;IAClB;IACA,UAAUF,MAAW,EAAE;MACrB,OAAOA,MAAM,CAACG,UAAU,IAAIH,MAAM,CAACI,QAAQ,IAAIJ,MAAM,CAACK,aAAa;IACrE,CAAC,EACD,CAAAT,MAAM,aAANA,MAAM,gDAANA,MAAM,CAAEU,cAAc,0DAAtB,sBAAwBC,YAAY,KAAI,iBAAiB,CAC1D;IACD,IAAIP,MAAM,CAACQ,MAAM,GAAG,CAAC,EAAE;MACrBN,cAAM,CAACO,IAAI,CAAC,2EAA2E,CAAC;IAC1F;IAEA,OAAOZ,eAAC,CAACa,IAAI,CAACV,MAAM,CAAC;EACvB;AACF;AAAC,eAEc,OAAOJ,MAAM,EAAEe,IAAI,EAAEC,OAAO,KAAK;EAC9C,MAAMC,aAAa,GAAG,CAAC,MAAMlB,SAAS,CAACC,MAAM,CAAC,KAAKkB,OAAO,CAAC,qBAAqB,CAAC,EAAE;;EAEnF;EACA,MAAMC,MAAM,GAAGC,gBAAO,CAACC,MAAM,EAAE;EAC/B;EACAF,MAAM,CAACG,GAAG,CACR,IAAAC,yBAAa,EACXvB,MAAM,EACN;IACEwB,eAAe,EAAET,IAAI,CAACU,kBAAkB,EAAE;IAC1CC,eAAe,EAAE,IAAAA,YAAe,EAACX,IAAI,EAAEC,OAAO,EAAEhB,MAAM;EACxD,CAAC,EACDiB,aAAa,CACd,CACF;EACD,OAAOE,MAAM;AACf,CAAC;AAAA"}

package/build/{utils/web-utils.d.ts → web-utils.d.ts}

@@ -1,9 +1,8 @@
 import { Author, ConfigYaml } from '@verdaccio/types';
+export declare function hasLogin(config: ConfigYaml): boolean;
+export declare function sortByName(packages: any[], orderAscending?: boolean | void): string[];
 export type AuthorAvatar = Author & {
     avatar?: string;
 };
-export declare function validatePrimaryColor(primaryColor: any): any;
-export declare function deleteProperties(propertiesToDelete: string[], objectItem: any): any;
 export declare function addScope(scope: string, packageName: string): string;
-export declare function sortByName(packages: any[], orderAscending?: boolean | void): string[];
-export declare function hasLogin(config: ConfigYaml): boolean;
+export declare function deleteProperties(propertiesToDelete: string[], objectItem: any): any;

package/build/{utils/web-utils.js → web-utils.js}

@@ -7,28 +7,11 @@ exports.addScope = addScope;
 exports.deleteProperties = deleteProperties;
 exports.hasLogin = hasLogin;
 exports.sortByName = sortByName;
-exports.validatePrimaryColor = validatePrimaryColor;
-var _debug = _interopRequireDefault(require("debug"));
 var _lodash = _interopRequireDefault(require("lodash"));
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
-const debug = (0, _debug.default)('verdaccio:web:utils');
-function validatePrimaryColor(primaryColor) {
-  const isHex = /^#([0-9A-F]{3}){1,2}$/i.test(primaryColor);
-  if (!isHex) {
-    debug('invalid primary color %o', primaryColor);
-    return;
-  }
-  return primaryColor;
-}
-function deleteProperties(propertiesToDelete, objectItem) {
-  debug('deleted unused version properties');
-  _lodash.default.forEach(propertiesToDelete, property => {
-    delete objectItem[property];
-  });
-  return objectItem;
-}
-function addScope(scope, packageName) {
-  return `@${scope}/${packageName}`;
+function hasLogin(config) {
+  var _config$web, _config$web2;
+  return _lodash.default.isNil(config === null || config === void 0 ? void 0 : (_config$web = config.web) === null || _config$web === void 0 ? void 0 : _config$web.login) || (config === null || config === void 0 ? void 0 : (_config$web2 = config.web) === null || _config$web2 === void 0 ? void 0 : _config$web2.login) === true;
 }
 function sortByName(packages, orderAscending = true) {
   return packages.slice().sort(function (a, b) {
@@ -36,8 +19,13 @@ function sortByName(packages, orderAscending = true) {
     return orderAscending ? comparatorNames ? -1 : 1 : comparatorNames ? 1 : -1;
   });
 }
-function hasLogin(config) {
-  var _config$web, _config$web2;
-  return _lodash.default.isNil(config === null || config === void 0 ? void 0 : (_config$web = config.web) === null || _config$web === void 0 ? void 0 : _config$web.login) || (config === null || config === void 0 ? void 0 : (_config$web2 = config.web) === null || _config$web2 === void 0 ? void 0 : _config$web2.login) === true;
+function addScope(scope, packageName) {
+  return `@${scope}/${packageName}`;
+}
+function deleteProperties(propertiesToDelete, objectItem) {
+  _lodash.default.forEach(propertiesToDelete, property => {
+    delete objectItem[property];
+  });
+  return objectItem;
 }
 //# sourceMappingURL=web-utils.js.map

package/build/web-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-utils.js","names":["hasLogin","config","_","isNil","web","login","sortByName","packages","orderAscending","slice","sort","a","b","comparatorNames","name","toLowerCase","addScope","scope","packageName","deleteProperties","propertiesToDelete","objectItem","forEach","property"],"sources":["../src/web-utils.ts"],"sourcesContent":["import _ from 'lodash';\n\nimport { Author, ConfigYaml } from '@verdaccio/types';\n\nexport function hasLogin(config: ConfigYaml) {\n  return _.isNil(config?.web?.login) || config?.web?.login === true;\n}\n\nexport function sortByName(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorNames = a.name.toLowerCase() < b.name.toLowerCase();\n    return orderAscending ? (comparatorNames ? -1 : 1) : comparatorNames ? 1 : -1;\n  });\n}\n\nexport type AuthorAvatar = Author & { avatar?: string };\n\nexport function addScope(scope: string, packageName: string): string {\n  return `@${scope}/${packageName}`;\n}\n\nexport function deleteProperties(propertiesToDelete: string[], objectItem: any): any {\n  _.forEach(propertiesToDelete, (property): any => {\n    delete objectItem[property];\n  });\n\n  return objectItem;\n}\n"],"mappings":";;;;;;;;;AAAA;AAAuB;AAIhB,SAASA,QAAQ,CAACC,MAAkB,EAAE;EAAA;EAC3C,OAAOC,eAAC,CAACC,KAAK,CAACF,MAAM,aAANA,MAAM,sCAANA,MAAM,CAAEG,GAAG,gDAAX,YAAaC,KAAK,CAAC,IAAI,CAAAJ,MAAM,aAANA,MAAM,uCAANA,MAAM,CAAEG,GAAG,iDAAX,aAAaC,KAAK,MAAK,IAAI;AACnE;AAEO,SAASC,UAAU,CAACC,QAAe,EAAEC,cAA8B,GAAG,IAAI,EAAY;EAC3F,OAAOD,QAAQ,CAACE,KAAK,EAAE,CAACC,IAAI,CAAC,UAAUC,CAAC,EAAEC,CAAC,EAAU;IACnD,MAAMC,eAAe,GAAGF,CAAC,CAACG,IAAI,CAACC,WAAW,EAAE,GAAGH,CAAC,CAACE,IAAI,CAACC,WAAW,EAAE;IACnE,OAAOP,cAAc,GAAIK,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,GAAIA,eAAe,GAAG,CAAC,GAAG,CAAC,CAAC;EAC/E,CAAC,CAAC;AACJ;AAIO,SAASG,QAAQ,CAACC,KAAa,EAAEC,WAAmB,EAAU;EACnE,OAAQ,IAAGD,KAAM,IAAGC,WAAY,EAAC;AACnC;AAEO,SAASC,gBAAgB,CAACC,kBAA4B,EAAEC,UAAe,EAAO;EACnFnB,eAAC,CAACoB,OAAO,CAACF,kBAAkB,EAAGG,QAAQ,IAAU;IAC/C,OAAOF,UAAU,CAACE,QAAQ,CAAC;EAC7B,CAAC,CAAC;EAEF,OAAOF,UAAU;AACnB"}

package/jest.config.js

@@ -4,7 +4,7 @@ module.exports = Object.assign({}, config, {
   coverageThreshold: {
     global: {
       // FIXME: increase to 90
-      lines: 79,
+      lines: 72,
     },
   },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/web",
-  "version": "6.0.0-6-next.45",
+  "version": "6.0.0-6-next.47",
   "description": "web ui middleware",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -25,34 +25,32 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "6.0.0-6-next.37",
-    "@verdaccio/core": "6.0.0-6-next.58",
-    "@verdaccio/config": "6.0.0-6-next.58",
-    "@verdaccio/loaders": "6.0.0-6-next.27",
-    "@verdaccio/logger": "6.0.0-6-next.26",
-    "@verdaccio/middleware": "6.0.0-6-next.37",
-    "@verdaccio/store": "6.0.0-6-next.38",
-    "@verdaccio/tarball": "11.0.0-6-next.27",
-    "@verdaccio/url": "11.0.0-6-next.24",
-    "@verdaccio/utils": "6.0.0-6-next.26",
-    "body-parser": "1.20.1",
+    "@verdaccio/auth": "6.0.0-6-next.39",
+    "@verdaccio/core": "6.0.0-6-next.60",
+    "@verdaccio/config": "6.0.0-6-next.60",
+    "@verdaccio/loaders": "6.0.0-6-next.29",
+    "@verdaccio/logger": "6.0.0-6-next.28",
+    "@verdaccio/middleware": "6.0.0-6-next.39",
+    "@verdaccio/store": "6.0.0-6-next.40",
+    "@verdaccio/tarball": "11.0.0-6-next.29",
+    "@verdaccio/url": "11.0.0-6-next.26",
+    "@verdaccio/utils": "6.0.0-6-next.28",
     "debug": "4.3.4",
     "express": "4.18.2",
-    "lodash": "4.17.21",
-    "lru-cache": "7.14.1"
+    "lodash": "4.17.21"
   },
   "devDependencies": {
     "@types/node": "16.18.10",
-    "@verdaccio/types": "11.0.0-6-next.19",
+    "@verdaccio/types": "11.0.0-6-next.20",
     "@verdaccio/test-helper": "2.0.0-6-next.7",
-    "@verdaccio/api": "6.0.0-6-next.41",
+    "@verdaccio/api": "6.0.0-6-next.43",
     "node-html-parser": "4.1.5",
     "supertest": "6.3.3",
     "nock": "13.2.9",
     "jsdom": "20.0.3",
     "undici": "4.16.0",
-    "verdaccio-auth-memory": "11.0.0-6-next.23",
-    "verdaccio-memory": "11.0.0-6-next.25"
+    "verdaccio-auth-memory": "11.0.0-6-next.25",
+    "verdaccio-memory": "11.0.0-6-next.27"
   },
   "funding": {
     "type": "opencollective",

package/src/api/index.ts

@@ -1,6 +1,8 @@
 import { Router } from 'express';
 
-import { hasLogin } from '../utils/web-utils';
+import { rateLimit } from '@verdaccio/middleware';
+
+import { hasLogin } from '../web-utils';
 import packageApi from './package';
 import readme from './readme';
 import search from './search';
@@ -9,6 +11,14 @@ import user from './user';
 
 export default (auth, storage, config) => {
   const route = Router(); /* eslint new-cap: 0 */
+  route.use(
+    '/data/',
+    rateLimit({
+      windowMs: 2 * 60 * 1000, // 2  minutes
+      max: 5000, // limit each IP to 1000 requests per windowMs
+      ...config?.web?.rateLimit,
+    })
+  );
   route.use('/data/', packageApi(storage, auth, config));
   route.use('/data/', search(storage, auth));
   route.use('/data/', sidebar(config, storage, auth));

package/src/api/package.ts

@@ -10,7 +10,7 @@ import { getLocalRegistryTarballUri } from '@verdaccio/tarball';
 import { Config, RemoteUser, Version } from '@verdaccio/types';
 import { formatAuthor, generateGravatarUrl } from '@verdaccio/utils';
 
-import { sortByName } from '../utils/web-utils';
+import { sortByName } from '../web-utils';
 
 export { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages
 

package/src/api/readme.ts

@@ -8,7 +8,7 @@ import { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verda
 import { Storage } from '@verdaccio/store';
 import { Manifest } from '@verdaccio/types';
 
-import { AuthorAvatar, addScope } from '../utils/web-utils';
+import { AuthorAvatar, addScope } from '../web-utils';
 
 export { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages
 

package/src/api/sidebar.ts

@@ -10,7 +10,7 @@ import { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';
 import { Config, Manifest, Version } from '@verdaccio/types';
 import { addGravatarSupport, formatAuthor, isVersionValid } from '@verdaccio/utils';
 
-import { AuthorAvatar, addScope, deleteProperties } from '../utils/web-utils';
+import { AuthorAvatar, addScope, deleteProperties } from '../web-utils';
 
 export { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages