@verdaccio/web 8.1.0-next-8.10 → 8.1.0-next-8.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +37 -0
- package/build/api/index.js +6 -6
- package/build/api/index.js.map +1 -1
- package/build/api/package.js +6 -11
- package/build/api/package.js.map +1 -1
- package/package.json +13 -13
- package/src/api/index.ts +7 -7
- package/src/api/package.ts +6 -11
- package/test/api.packages.test.ts +54 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,42 @@
|
|
|
1
1
|
# @verdaccio/web
|
|
2
2
|
|
|
3
|
+
## 8.1.0-next-8.12
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [95ac124]
|
|
8
|
+
- @verdaccio/core@8.0.0-next-8.12
|
|
9
|
+
- @verdaccio/store@8.0.0-next-8.12
|
|
10
|
+
- @verdaccio/auth@8.0.0-next-8.12
|
|
11
|
+
- @verdaccio/config@8.0.0-next-8.12
|
|
12
|
+
- @verdaccio/tarball@13.0.0-next-8.12
|
|
13
|
+
- @verdaccio/url@13.0.0-next-8.12
|
|
14
|
+
- @verdaccio/loaders@8.0.0-next-8.4
|
|
15
|
+
- @verdaccio/middleware@8.0.0-next-8.12
|
|
16
|
+
- @verdaccio/utils@8.1.0-next-8.12
|
|
17
|
+
- @verdaccio/logger@8.0.0-next-8.12
|
|
18
|
+
|
|
19
|
+
## 8.1.0-next-8.11
|
|
20
|
+
|
|
21
|
+
### Patch Changes
|
|
22
|
+
|
|
23
|
+
- 66bc284: chore: middleware package update
|
|
24
|
+
- Updated dependencies [83dbde5]
|
|
25
|
+
- Updated dependencies [4110873]
|
|
26
|
+
- Updated dependencies [85e0e13]
|
|
27
|
+
- Updated dependencies [7e48ac6]
|
|
28
|
+
- Updated dependencies [66bc284]
|
|
29
|
+
- @verdaccio/store@8.0.0-next-8.11
|
|
30
|
+
- @verdaccio/middleware@8.0.0-next-8.11
|
|
31
|
+
- @verdaccio/utils@8.1.0-next-8.11
|
|
32
|
+
- @verdaccio/auth@8.0.0-next-8.11
|
|
33
|
+
- @verdaccio/config@8.0.0-next-8.11
|
|
34
|
+
- @verdaccio/tarball@13.0.0-next-8.11
|
|
35
|
+
- @verdaccio/loaders@8.0.0-next-8.4
|
|
36
|
+
- @verdaccio/core@8.0.0-next-8.11
|
|
37
|
+
- @verdaccio/url@13.0.0-next-8.11
|
|
38
|
+
- @verdaccio/logger@8.0.0-next-8.11
|
|
39
|
+
|
|
3
40
|
## 8.1.0-next-8.10
|
|
4
41
|
|
|
5
42
|
### Patch Changes
|
package/build/api/index.js
CHANGED
|
@@ -15,19 +15,19 @@ var _user = _interopRequireDefault(require("./user"));
|
|
|
15
15
|
function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
|
|
16
16
|
var _default = (auth, storage, config) => {
|
|
17
17
|
const route = (0, _express.Router)(); /* eslint new-cap: 0 */
|
|
18
|
-
route.use(
|
|
18
|
+
route.use(_middleware.WebUrlsNamespace.data, (0, _middleware.rateLimit)({
|
|
19
19
|
windowMs: 2 * 60 * 1000,
|
|
20
20
|
// 2 minutes
|
|
21
21
|
max: 5000,
|
|
22
22
|
// limit each IP to 1000 requests per windowMs
|
|
23
23
|
...config?.web?.rateLimit
|
|
24
24
|
}));
|
|
25
|
-
route.use(
|
|
26
|
-
route.use(
|
|
27
|
-
route.use(
|
|
28
|
-
route.use(
|
|
25
|
+
route.use(_middleware.WebUrlsNamespace.data, (0, _package.default)(storage, auth, config));
|
|
26
|
+
route.use(_middleware.WebUrlsNamespace.data, (0, _search.default)(storage, auth));
|
|
27
|
+
route.use(_middleware.WebUrlsNamespace.data, (0, _sidebar.default)(config, storage, auth));
|
|
28
|
+
route.use(_middleware.WebUrlsNamespace.data, (0, _readme.default)(storage, auth));
|
|
29
29
|
if ((0, _webUtils.hasLogin)(config)) {
|
|
30
|
-
route.use(
|
|
30
|
+
route.use(_middleware.WebUrlsNamespace.sec, (0, _user.default)(auth, config));
|
|
31
31
|
}
|
|
32
32
|
return route;
|
|
33
33
|
};
|
package/build/api/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","names":["_express","require","_middleware","_webUtils","_package","_interopRequireDefault","_readme","_search","_sidebar","_user","e","__esModule","default","_default","auth","storage","config","route","Router","use","rateLimit","windowMs","max","web","packageApi","search","sidebar","readme","hasLogin","user","exports"],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n const route = Router(); /* eslint new-cap: 0 */\n route.use(\n
|
|
1
|
+
{"version":3,"file":"index.js","names":["_express","require","_middleware","_webUtils","_package","_interopRequireDefault","_readme","_search","_sidebar","_user","e","__esModule","default","_default","auth","storage","config","route","Router","use","WebUrlsNamespace","data","rateLimit","windowMs","max","web","packageApi","search","sidebar","readme","hasLogin","sec","user","exports"],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n const route = Router(); /* eslint new-cap: 0 */\n route.use(\n WebUrlsNamespace.data,\n rateLimit({\n windowMs: 2 * 60 * 1000, // 2 minutes\n max: 5000, // limit each IP to 1000 requests per windowMs\n ...config?.web?.rateLimit,\n })\n );\n route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));\n route.use(WebUrlsNamespace.data, search(storage, auth));\n route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));\n route.use(WebUrlsNamespace.data, readme(storage, auth));\n if (hasLogin(config)) {\n route.use(WebUrlsNamespace.sec, user(auth, config));\n }\n return route;\n};\n"],"mappings":";;;;;;AAAA,IAAAA,QAAA,GAAAC,OAAA;AAEA,IAAAC,WAAA,GAAAD,OAAA;AAEA,IAAAE,SAAA,GAAAF,OAAA;AACA,IAAAG,QAAA,GAAAC,sBAAA,CAAAJ,OAAA;AACA,IAAAK,OAAA,GAAAD,sBAAA,CAAAJ,OAAA;AACA,IAAAM,OAAA,GAAAF,sBAAA,CAAAJ,OAAA;AACA,IAAAO,QAAA,GAAAH,sBAAA,CAAAJ,OAAA;AACA,IAAAQ,KAAA,GAAAJ,sBAAA,CAAAJ,OAAA;AAA0B,SAAAI,uBAAAK,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAAA,IAAAG,QAAA,GAEXA,CAACC,IAAI,EAAEC,OAAO,EAAEC,MAAM,KAAK;EACxC,MAAMC,KAAK,GAAG,IAAAC,eAAM,EAAC,CAAC,CAAC,CAAC;EACxBD,KAAK,CAACE,GAAG,CACPC,4BAAgB,CAACC,IAAI,EACrB,IAAAC,qBAAS,EAAC;IACRC,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI;IAAE;IACzBC,GAAG,EAAE,IAAI;IAAE;IACX,GAAGR,MAAM,EAAES,GAAG,EAAEH;EAClB,CAAC,CACH,CAAC;EACDL,KAAK,CAACE,GAAG,CAACC,4BAAgB,CAACC,IAAI,EAAE,IAAAK,gBAAU,EAACX,OAAO,EAAED,IAAI,EAAEE,MAAM,CAAC,CAAC;EACnEC,KAAK,CAACE,GAAG,CAACC,4BAAgB,CAACC,IAAI,EAAE,IAAAM,eAAM,EAACZ,OAAO,EAAED,IAAI,CAAC,CAAC;EACvDG,KAAK,CAACE,GAAG,CAACC,4BAAgB,CAACC,IAAI,EAAE,IAAAO,gBAAO,EAACZ,MAAM,EAAED,OAAO,EAAED,IAAI,CAAC,CAAC;EAChEG,KAAK,CAACE,GAAG,CAACC,4BAAgB,CAACC,IAAI,EAAE,IAAAQ,eAAM,EAACd,OAAO,EAAED,IAAI,CAAC,CAAC;EACvD,IAAI,IAAAgB,kBAAQ,EAACd,MAAM,CAAC,EAAE;IACpBC,KAAK,CAACE,GAAG,CAACC,4BAAgB,CAACW,GAAG,EAAE,IAAAC,aAAI,EAAClB,IAAI,EAAEE,MAAM,CAAC,CAAC;EACrD;EACA,OAAOC,KAAK;AACd,CAAC;AAAAgB,OAAA,CAAArB,OAAA,GAAAC,QAAA","ignoreList":[]}
|
package/build/api/package.js
CHANGED
|
@@ -25,6 +25,7 @@ exports.default = void 0;
|
|
|
25
25
|
var _debug = _interopRequireDefault(require("debug"));
|
|
26
26
|
var _express = require("express");
|
|
27
27
|
var _lodash = _interopRequireDefault(require("lodash"));
|
|
28
|
+
var _config = require("@verdaccio/config");
|
|
28
29
|
var _logger = require("@verdaccio/logger");
|
|
29
30
|
var _middleware = require("@verdaccio/middleware");
|
|
30
31
|
var _tarball = require("@verdaccio/tarball");
|
|
@@ -38,23 +39,17 @@ const getOrder = (order = 'asc') => {
|
|
|
38
39
|
};
|
|
39
40
|
const debug = (0, _debug.default)('verdaccio:web:api:package');
|
|
40
41
|
function addPackageWebApi(storage, auth, config) {
|
|
41
|
-
const isLoginEnabled = config?.web?.login === true
|
|
42
|
+
const isLoginEnabled = config?.web?.login === true;
|
|
42
43
|
const pkgRouter = (0, _express.Router)(); /* eslint new-cap: 0 */
|
|
43
|
-
|
|
44
|
-
const anonymousRemoteUser = {
|
|
45
|
-
name: undefined,
|
|
46
|
-
real_groups: [],
|
|
47
|
-
groups: []
|
|
48
|
-
};
|
|
44
|
+
const anonymousRemoteUser = (0, _config.createAnonymousRemoteUser)();
|
|
49
45
|
debug('initialized package web api');
|
|
50
46
|
const checkAllow = (name, remoteUser) => new Promise((resolve, reject) => {
|
|
51
|
-
debug('is login
|
|
52
|
-
|
|
53
|
-
// const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;
|
|
47
|
+
debug('is login enabled: %o', isLoginEnabled);
|
|
48
|
+
const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;
|
|
54
49
|
try {
|
|
55
50
|
auth.allow_access({
|
|
56
51
|
packageName: name
|
|
57
|
-
},
|
|
52
|
+
}, remoteUserAccess, (err, allowed) => {
|
|
58
53
|
if (err) {
|
|
59
54
|
resolve(false);
|
|
60
55
|
}
|
package/build/api/package.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"package.js","names":["_debug","_interopRequireDefault","require","_express","_lodash","_logger","_middleware","_tarball","_utils","_webUtils","e","__esModule","default","getOrder","order","debug","buildDebug","addPackageWebApi","storage","auth","config","isLoginEnabled","web","login","pkgRouter","Router","anonymousRemoteUser","
|
|
1
|
+
{"version":3,"file":"package.js","names":["_debug","_interopRequireDefault","require","_express","_lodash","_config","_logger","_middleware","_tarball","_utils","_webUtils","e","__esModule","default","getOrder","order","debug","buildDebug","addPackageWebApi","storage","auth","config","isLoginEnabled","web","login","pkgRouter","Router","anonymousRemoteUser","createAnonymousRemoteUser","checkAllow","name","remoteUser","Promise","resolve","reject","remoteUserAccess","allow_access","packageName","err","allowed","processPackages","packages","req","permissions","packagesToProcess","slice","pkg","pkgCopy","author","formatAuthor","remote_user","avatar","generateGravatarUrl","email","gravatar","_","isNil","dist","isNull","tarball","getLocalRegistryTarballUri","protocol","headers","host","hostname","url_prefix","push","logger","error","get","WebUrls","packages_all","res","next","localPackages","getLocalDatabase","sort_packages","pkgs","sortByName","_default","exports"],"sources":["../../src/api/package.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\nimport _ from 'lodash';\n\nimport { Auth } from '@verdaccio/auth';\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport { logger } from '@verdaccio/logger';\nimport { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';\nimport { WebUrls } from '@verdaccio/middleware';\nimport { Storage } from '@verdaccio/store';\nimport { getLocalRegistryTarballUri } from '@verdaccio/tarball';\nimport { Config, RemoteUser, Version } from '@verdaccio/types';\nimport { formatAuthor, generateGravatarUrl } from '@verdaccio/utils';\n\nimport { sortByName } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst getOrder = (order = 'asc') => {\n return order === 'asc';\n};\n\nconst debug = buildDebug('verdaccio:web:api:package');\n\nfunction addPackageWebApi(storage: Storage, auth: Auth, config: Config): Router {\n const isLoginEnabled = config?.web?.login === true;\n const pkgRouter = Router(); /* eslint new-cap: 0 */\n const anonymousRemoteUser: RemoteUser = createAnonymousRemoteUser();\n\n debug('initialized package web api');\n const checkAllow = (name: string, remoteUser: RemoteUser): Promise<boolean> =>\n new Promise((resolve, reject): void => {\n debug('is login enabled: %o', isLoginEnabled);\n const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;\n try {\n auth.allow_access({ packageName: name }, remoteUserAccess, (err, allowed): void => {\n if (err) {\n resolve(false);\n }\n return resolve(allowed as boolean);\n });\n } catch (err: any) {\n reject(err);\n }\n });\n\n async function processPackages(packages: Version[] = [], req): Promise<Version[]> {\n const permissions: Version[] = [];\n const packagesToProcess = packages.slice();\n debug('process packages %o', packagesToProcess);\n for (const pkg of packagesToProcess) {\n const pkgCopy = { ...pkg };\n pkgCopy.author = formatAuthor(pkg.author);\n try {\n if (await checkAllow(pkg.name, req.remote_user)) {\n if (config.web) {\n // @ts-ignore\n pkgCopy.author.avatar = generateGravatarUrl(pkgCopy.author.email, config.web.gravatar);\n }\n // convert any remote dist to a local reference\n // eg: if the dist points to npmjs, switch to localhost:4873/prefix/etc.tar.gz\n if (!_.isNil(pkgCopy.dist) && !_.isNull(pkgCopy.dist.tarball)) {\n pkgCopy.dist.tarball = getLocalRegistryTarballUri(\n pkgCopy.dist.tarball,\n pkg.name,\n { protocol: req.protocol, headers: req.headers as any, host: req.hostname },\n config?.url_prefix\n );\n }\n permissions.push(pkgCopy);\n }\n } catch (err: any) {\n debug('process packages error %o', err);\n logger.error(\n { name: pkg.name, error: err },\n 'permission process for @{name} has failed: @{error}'\n );\n throw err;\n }\n }\n\n return permissions;\n }\n\n // Get list of all visible package\n pkgRouter.get(\n WebUrls.packages_all,\n async function (\n req: $RequestExtend,\n res: $ResponseExtend,\n next: $NextFunctionVer\n ): Promise<void> {\n debug('hit package web api %o');\n\n try {\n const localPackages: Version[] = await storage.getLocalDatabase();\n\n const order = getOrder(config?.web?.sort_packages);\n debug('order %o', order);\n const pkgs = await processPackages(localPackages, req);\n next(sortByName(pkgs, order));\n } catch (error: any) {\n next(error);\n }\n }\n );\n\n return pkgRouter;\n}\n\nexport default addPackageWebApi;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAGA,IAAAG,OAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AACA,IAAAK,WAAA,GAAAL,OAAA;AAGA,IAAAM,QAAA,GAAAN,OAAA;AAEA,IAAAO,MAAA,GAAAP,OAAA;AAEA,IAAAQ,SAAA,GAAAR,OAAA;AAA0C,SAAAD,uBAAAU,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAEoB;;AAE9D,MAAMG,QAAQ,GAAGA,CAACC,KAAK,GAAG,KAAK,KAAK;EAClC,OAAOA,KAAK,KAAK,KAAK;AACxB,CAAC;AAED,MAAMC,KAAK,GAAG,IAAAC,cAAU,EAAC,2BAA2B,CAAC;AAErD,SAASC,gBAAgBA,CAACC,OAAgB,EAAEC,IAAU,EAAEC,MAAc,EAAU;EAC9E,MAAMC,cAAc,GAAGD,MAAM,EAAEE,GAAG,EAAEC,KAAK,KAAK,IAAI;EAClD,MAAMC,SAAS,GAAG,IAAAC,eAAM,EAAC,CAAC,CAAC,CAAC;EAC5B,MAAMC,mBAA+B,GAAG,IAAAC,iCAAyB,EAAC,CAAC;EAEnEZ,KAAK,CAAC,6BAA6B,CAAC;EACpC,MAAMa,UAAU,GAAGA,CAACC,IAAY,EAAEC,UAAsB,KACtD,IAAIC,OAAO,CAAC,CAACC,OAAO,EAAEC,MAAM,KAAW;IACrClB,KAAK,CAAC,sBAAsB,EAAEM,cAAc,CAAC;IAC7C,MAAMa,gBAAgB,GAAG,CAACb,cAAc,GAAGK,mBAAmB,GAAGI,UAAU;IAC3E,IAAI;MACFX,IAAI,CAACgB,YAAY,CAAC;QAAEC,WAAW,EAAEP;MAAK,CAAC,EAAEK,gBAAgB,EAAE,CAACG,GAAG,EAAEC,OAAO,KAAW;QACjF,IAAID,GAAG,EAAE;UACPL,OAAO,CAAC,KAAK,CAAC;QAChB;QACA,OAAOA,OAAO,CAACM,OAAkB,CAAC;MACpC,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOD,GAAQ,EAAE;MACjBJ,MAAM,CAACI,GAAG,CAAC;IACb;EACF,CAAC,CAAC;EAEJ,eAAeE,eAAeA,CAACC,QAAmB,GAAG,EAAE,EAAEC,GAAG,EAAsB;IAChF,MAAMC,WAAsB,GAAG,EAAE;IACjC,MAAMC,iBAAiB,GAAGH,QAAQ,CAACI,KAAK,CAAC,CAAC;IAC1C7B,KAAK,CAAC,qBAAqB,EAAE4B,iBAAiB,CAAC;IAC/C,KAAK,MAAME,GAAG,IAAIF,iBAAiB,EAAE;MACnC,MAAMG,OAAO,GAAG;QAAE,GAAGD;MAAI,CAAC;MAC1BC,OAAO,CAACC,MAAM,GAAG,IAAAC,mBAAY,EAACH,GAAG,CAACE,MAAM,CAAC;MACzC,IAAI;QACF,IAAI,MAAMnB,UAAU,CAACiB,GAAG,CAAChB,IAAI,EAAEY,GAAG,CAACQ,WAAW,CAAC,EAAE;UAC/C,IAAI7B,MAAM,CAACE,GAAG,EAAE;YACd;YACAwB,OAAO,CAACC,MAAM,CAACG,MAAM,GAAG,IAAAC,0BAAmB,EAACL,OAAO,CAACC,MAAM,CAACK,KAAK,EAAEhC,MAAM,CAACE,GAAG,CAAC+B,QAAQ,CAAC;UACxF;UACA;UACA;UACA,IAAI,CAACC,eAAC,CAACC,KAAK,CAACT,OAAO,CAACU,IAAI,CAAC,IAAI,CAACF,eAAC,CAACG,MAAM,CAACX,OAAO,CAACU,IAAI,CAACE,OAAO,CAAC,EAAE;YAC7DZ,OAAO,CAACU,IAAI,CAACE,OAAO,GAAG,IAAAC,mCAA0B,EAC/Cb,OAAO,CAACU,IAAI,CAACE,OAAO,EACpBb,GAAG,CAAChB,IAAI,EACR;cAAE+B,QAAQ,EAAEnB,GAAG,CAACmB,QAAQ;cAAEC,OAAO,EAAEpB,GAAG,CAACoB,OAAc;cAAEC,IAAI,EAAErB,GAAG,CAACsB;YAAS,CAAC,EAC3E3C,MAAM,EAAE4C,UACV,CAAC;UACH;UACAtB,WAAW,CAACuB,IAAI,CAACnB,OAAO,CAAC;QAC3B;MACF,CAAC,CAAC,OAAOT,GAAQ,EAAE;QACjBtB,KAAK,CAAC,2BAA2B,EAAEsB,GAAG,CAAC;QACvC6B,cAAM,CAACC,KAAK,CACV;UAAEtC,IAAI,EAAEgB,GAAG,CAAChB,IAAI;UAAEsC,KAAK,EAAE9B;QAAI,CAAC,EAC9B,qDACF,CAAC;QACD,MAAMA,GAAG;MACX;IACF;IAEA,OAAOK,WAAW;EACpB;;EAEA;EACAlB,SAAS,CAAC4C,GAAG,CACXC,mBAAO,CAACC,YAAY,EACpB,gBACE7B,GAAmB,EACnB8B,GAAoB,EACpBC,IAAsB,EACP;IACfzD,KAAK,CAAC,wBAAwB,CAAC;IAE/B,IAAI;MACF,MAAM0D,aAAwB,GAAG,MAAMvD,OAAO,CAACwD,gBAAgB,CAAC,CAAC;MAEjE,MAAM5D,KAAK,GAAGD,QAAQ,CAACO,MAAM,EAAEE,GAAG,EAAEqD,aAAa,CAAC;MAClD5D,KAAK,CAAC,UAAU,EAAED,KAAK,CAAC;MACxB,MAAM8D,IAAI,GAAG,MAAMrC,eAAe,CAACkC,aAAa,EAAEhC,GAAG,CAAC;MACtD+B,IAAI,CAAC,IAAAK,oBAAU,EAACD,IAAI,EAAE9D,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,OAAOqD,KAAU,EAAE;MACnBK,IAAI,CAACL,KAAK,CAAC;IACb;EACF,CACF,CAAC;EAED,OAAO3C,SAAS;AAClB;AAAC,IAAAsD,QAAA,GAAAC,OAAA,CAAAnE,OAAA,GAEcK,gBAAgB","ignoreList":[]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@verdaccio/web",
|
|
3
|
-
"version": "8.1.0-next-8.
|
|
3
|
+
"version": "8.1.0-next-8.12",
|
|
4
4
|
"description": "web ui middleware",
|
|
5
5
|
"main": "./build/index.js",
|
|
6
6
|
"types": "build/index.d.ts",
|
|
@@ -24,29 +24,29 @@
|
|
|
24
24
|
},
|
|
25
25
|
"license": "MIT",
|
|
26
26
|
"dependencies": {
|
|
27
|
-
"@verdaccio/auth": "8.0.0-next-8.
|
|
28
|
-
"@verdaccio/config": "8.0.0-next-8.
|
|
29
|
-
"@verdaccio/core": "8.0.0-next-8.
|
|
27
|
+
"@verdaccio/auth": "8.0.0-next-8.12",
|
|
28
|
+
"@verdaccio/config": "8.0.0-next-8.12",
|
|
29
|
+
"@verdaccio/core": "8.0.0-next-8.12",
|
|
30
30
|
"@verdaccio/loaders": "8.0.0-next-8.4",
|
|
31
|
-
"@verdaccio/logger": "8.0.0-next-8.
|
|
32
|
-
"@verdaccio/middleware": "8.0.0-next-8.
|
|
33
|
-
"@verdaccio/store": "8.0.0-next-8.
|
|
34
|
-
"@verdaccio/tarball": "13.0.0-next-8.
|
|
35
|
-
"@verdaccio/url": "13.0.0-next-8.
|
|
36
|
-
"@verdaccio/utils": "8.1.0-next-8.
|
|
31
|
+
"@verdaccio/logger": "8.0.0-next-8.12",
|
|
32
|
+
"@verdaccio/middleware": "8.0.0-next-8.12",
|
|
33
|
+
"@verdaccio/store": "8.0.0-next-8.12",
|
|
34
|
+
"@verdaccio/tarball": "13.0.0-next-8.12",
|
|
35
|
+
"@verdaccio/url": "13.0.0-next-8.12",
|
|
36
|
+
"@verdaccio/utils": "8.1.0-next-8.12",
|
|
37
37
|
"debug": "4.4.0",
|
|
38
38
|
"express": "4.21.2",
|
|
39
39
|
"lodash": "4.17.21"
|
|
40
40
|
},
|
|
41
41
|
"devDependencies": {
|
|
42
|
-
"@verdaccio/api": "8.1.0-next-8.
|
|
42
|
+
"@verdaccio/api": "8.1.0-next-8.12",
|
|
43
43
|
"@verdaccio/test-helper": "4.0.0-next-8.3",
|
|
44
44
|
"@verdaccio/types": "13.0.0-next-8.3",
|
|
45
45
|
"jsdom": "25.0.1",
|
|
46
46
|
"node-html-parser": "4.1.5",
|
|
47
47
|
"supertest": "7.0.0",
|
|
48
|
-
"verdaccio-auth-memory": "13.0.0-next-8.
|
|
49
|
-
"verdaccio-memory": "13.0.0-next-8.
|
|
48
|
+
"verdaccio-auth-memory": "13.0.0-next-8.12",
|
|
49
|
+
"verdaccio-memory": "13.0.0-next-8.12"
|
|
50
50
|
},
|
|
51
51
|
"funding": {
|
|
52
52
|
"type": "opencollective",
|
package/src/api/index.ts
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { Router } from 'express';
|
|
2
2
|
|
|
3
|
-
import { rateLimit } from '@verdaccio/middleware';
|
|
3
|
+
import { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';
|
|
4
4
|
|
|
5
5
|
import { hasLogin } from '../web-utils';
|
|
6
6
|
import packageApi from './package';
|
|
@@ -12,19 +12,19 @@ import user from './user';
|
|
|
12
12
|
export default (auth, storage, config) => {
|
|
13
13
|
const route = Router(); /* eslint new-cap: 0 */
|
|
14
14
|
route.use(
|
|
15
|
-
|
|
15
|
+
WebUrlsNamespace.data,
|
|
16
16
|
rateLimit({
|
|
17
17
|
windowMs: 2 * 60 * 1000, // 2 minutes
|
|
18
18
|
max: 5000, // limit each IP to 1000 requests per windowMs
|
|
19
19
|
...config?.web?.rateLimit,
|
|
20
20
|
})
|
|
21
21
|
);
|
|
22
|
-
route.use(
|
|
23
|
-
route.use(
|
|
24
|
-
route.use(
|
|
25
|
-
route.use(
|
|
22
|
+
route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));
|
|
23
|
+
route.use(WebUrlsNamespace.data, search(storage, auth));
|
|
24
|
+
route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));
|
|
25
|
+
route.use(WebUrlsNamespace.data, readme(storage, auth));
|
|
26
26
|
if (hasLogin(config)) {
|
|
27
|
-
route.use(
|
|
27
|
+
route.use(WebUrlsNamespace.sec, user(auth, config));
|
|
28
28
|
}
|
|
29
29
|
return route;
|
|
30
30
|
};
|
package/src/api/package.ts
CHANGED
|
@@ -3,6 +3,7 @@ import { Router } from 'express';
|
|
|
3
3
|
import _ from 'lodash';
|
|
4
4
|
|
|
5
5
|
import { Auth } from '@verdaccio/auth';
|
|
6
|
+
import { createAnonymousRemoteUser } from '@verdaccio/config';
|
|
6
7
|
import { logger } from '@verdaccio/logger';
|
|
7
8
|
import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';
|
|
8
9
|
import { WebUrls } from '@verdaccio/middleware';
|
|
@@ -22,23 +23,17 @@ const getOrder = (order = 'asc') => {
|
|
|
22
23
|
const debug = buildDebug('verdaccio:web:api:package');
|
|
23
24
|
|
|
24
25
|
function addPackageWebApi(storage: Storage, auth: Auth, config: Config): Router {
|
|
25
|
-
const isLoginEnabled = config?.web?.login === true
|
|
26
|
+
const isLoginEnabled = config?.web?.login === true;
|
|
26
27
|
const pkgRouter = Router(); /* eslint new-cap: 0 */
|
|
27
|
-
|
|
28
|
-
const anonymousRemoteUser: RemoteUser = {
|
|
29
|
-
name: undefined,
|
|
30
|
-
real_groups: [],
|
|
31
|
-
groups: [],
|
|
32
|
-
};
|
|
28
|
+
const anonymousRemoteUser: RemoteUser = createAnonymousRemoteUser();
|
|
33
29
|
|
|
34
30
|
debug('initialized package web api');
|
|
35
31
|
const checkAllow = (name: string, remoteUser: RemoteUser): Promise<boolean> =>
|
|
36
32
|
new Promise((resolve, reject): void => {
|
|
37
|
-
debug('is login
|
|
38
|
-
|
|
39
|
-
// const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;
|
|
33
|
+
debug('is login enabled: %o', isLoginEnabled);
|
|
34
|
+
const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;
|
|
40
35
|
try {
|
|
41
|
-
auth.allow_access({ packageName: name },
|
|
36
|
+
auth.allow_access({ packageName: name }, remoteUserAccess, (err, allowed): void => {
|
|
42
37
|
if (err) {
|
|
43
38
|
resolve(false);
|
|
44
39
|
}
|
|
@@ -33,4 +33,58 @@ describe('test web server', () => {
|
|
|
33
33
|
.expect(HTTP_STATUS.OK);
|
|
34
34
|
expect(response.body).toEqual([]);
|
|
35
35
|
});
|
|
36
|
+
|
|
37
|
+
test('should allow anonymous user to access package api when login is disabled', async () => {
|
|
38
|
+
mockManifest.mockReturnValue(() => ({
|
|
39
|
+
staticPath: path.join(__dirname, 'static'),
|
|
40
|
+
manifestFiles: {
|
|
41
|
+
js: ['runtime.js', 'vendors.js', 'main.js'],
|
|
42
|
+
},
|
|
43
|
+
manifest: require('./partials/manifest/manifest.json'),
|
|
44
|
+
}));
|
|
45
|
+
|
|
46
|
+
const response = await supertest(await initializeServer('login-disabled.yaml'))
|
|
47
|
+
.get('/-/verdaccio/data/packages')
|
|
48
|
+
.set('Accept', HEADERS.JSON_CHARSET)
|
|
49
|
+
.expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
|
|
50
|
+
.expect(HTTP_STATUS.OK);
|
|
51
|
+
|
|
52
|
+
expect(response.body).toEqual([]);
|
|
53
|
+
});
|
|
54
|
+
|
|
55
|
+
test('should allow authenticated user to access package api', async () => {
|
|
56
|
+
mockManifest.mockReturnValue(() => ({
|
|
57
|
+
staticPath: path.join(__dirname, 'static'),
|
|
58
|
+
manifestFiles: {
|
|
59
|
+
js: ['runtime.js', 'vendors.js', 'main.js'],
|
|
60
|
+
},
|
|
61
|
+
manifest: require('./partials/manifest/manifest.json'),
|
|
62
|
+
}));
|
|
63
|
+
|
|
64
|
+
const api = supertest(await initializeServer('default-test.yaml'));
|
|
65
|
+
|
|
66
|
+
// First login to get the token
|
|
67
|
+
const loginRes = await api
|
|
68
|
+
.post('/-/verdaccio/sec/login')
|
|
69
|
+
.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON)
|
|
70
|
+
.send(
|
|
71
|
+
JSON.stringify({
|
|
72
|
+
username: 'test',
|
|
73
|
+
password: 'test',
|
|
74
|
+
})
|
|
75
|
+
)
|
|
76
|
+
.expect(HTTP_STATUS.OK);
|
|
77
|
+
|
|
78
|
+
expect(loginRes.body.token).toBeDefined();
|
|
79
|
+
|
|
80
|
+
// Then access the packages API with the token
|
|
81
|
+
const response = await api
|
|
82
|
+
.get('/-/verdaccio/data/packages')
|
|
83
|
+
.set('Accept', HEADERS.JSON_CHARSET)
|
|
84
|
+
.set(HEADER_TYPE.AUTHORIZATION, `Bearer ${loginRes.body.token}`)
|
|
85
|
+
.expect(HEADER_TYPE.CONTENT_TYPE, HEADERS.JSON_CHARSET)
|
|
86
|
+
.expect(HTTP_STATUS.OK);
|
|
87
|
+
|
|
88
|
+
expect(response.body).toEqual([]);
|
|
89
|
+
});
|
|
36
90
|
});
|