@verdaccio/web 8.1.0-next-8.12 → 8.1.0-next-8.13

package/src/api/index.ts

@@ -1,30 +0,0 @@
-import { Router } from 'express';
-
-import { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';
-
-import { hasLogin } from '../web-utils';
-import packageApi from './package';
-import readme from './readme';
-import search from './search';
-import sidebar from './sidebar';
-import user from './user';
-
-export default (auth, storage, config) => {
-  const route = Router(); /* eslint new-cap: 0 */
-  route.use(
-    WebUrlsNamespace.data,
-    rateLimit({
-      windowMs: 2 * 60 * 1000, // 2  minutes
-      max: 5000, // limit each IP to 1000 requests per windowMs
-      ...config?.web?.rateLimit,
-    })
-  );
-  route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));
-  route.use(WebUrlsNamespace.data, search(storage, auth));
-  route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));
-  route.use(WebUrlsNamespace.data, readme(storage, auth));
-  if (hasLogin(config)) {
-    route.use(WebUrlsNamespace.sec, user(auth, config));
-  }
-  return route;
-};

package/src/api/package.ts

@@ -1,111 +0,0 @@
-import buildDebug from 'debug';
-import { Router } from 'express';
-import _ from 'lodash';
-
-import { Auth } from '@verdaccio/auth';
-import { createAnonymousRemoteUser } from '@verdaccio/config';
-import { logger } from '@verdaccio/logger';
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';
-import { WebUrls } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { getLocalRegistryTarballUri } from '@verdaccio/tarball';
-import { Config, RemoteUser, Version } from '@verdaccio/types';
-import { formatAuthor, generateGravatarUrl } from '@verdaccio/utils';
-
-import { sortByName } from '../web-utils';
-
-export { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages
-
-const getOrder = (order = 'asc') => {
-  return order === 'asc';
-};
-
-const debug = buildDebug('verdaccio:web:api:package');
-
-function addPackageWebApi(storage: Storage, auth: Auth, config: Config): Router {
-  const isLoginEnabled = config?.web?.login === true;
-  const pkgRouter = Router(); /* eslint new-cap: 0 */
-  const anonymousRemoteUser: RemoteUser = createAnonymousRemoteUser();
-
-  debug('initialized package web api');
-  const checkAllow = (name: string, remoteUser: RemoteUser): Promise<boolean> =>
-    new Promise((resolve, reject): void => {
-      debug('is login enabled: %o', isLoginEnabled);
-      const remoteUserAccess = !isLoginEnabled ? anonymousRemoteUser : remoteUser;
-      try {
-        auth.allow_access({ packageName: name }, remoteUserAccess, (err, allowed): void => {
-          if (err) {
-            resolve(false);
-          }
-          return resolve(allowed as boolean);
-        });
-      } catch (err: any) {
-        reject(err);
-      }
-    });
-
-  async function processPackages(packages: Version[] = [], req): Promise<Version[]> {
-    const permissions: Version[] = [];
-    const packagesToProcess = packages.slice();
-    debug('process packages %o', packagesToProcess);
-    for (const pkg of packagesToProcess) {
-      const pkgCopy = { ...pkg };
-      pkgCopy.author = formatAuthor(pkg.author);
-      try {
-        if (await checkAllow(pkg.name, req.remote_user)) {
-          if (config.web) {
-            // @ts-ignore
-            pkgCopy.author.avatar = generateGravatarUrl(pkgCopy.author.email, config.web.gravatar);
-          }
-          // convert any remote dist to a local reference
-          // eg: if the dist points to npmjs, switch to localhost:4873/prefix/etc.tar.gz
-          if (!_.isNil(pkgCopy.dist) && !_.isNull(pkgCopy.dist.tarball)) {
-            pkgCopy.dist.tarball = getLocalRegistryTarballUri(
-              pkgCopy.dist.tarball,
-              pkg.name,
-              { protocol: req.protocol, headers: req.headers as any, host: req.hostname },
-              config?.url_prefix
-            );
-          }
-          permissions.push(pkgCopy);
-        }
-      } catch (err: any) {
-        debug('process packages error %o', err);
-        logger.error(
-          { name: pkg.name, error: err },
-          'permission process for @{name} has failed: @{error}'
-        );
-        throw err;
-      }
-    }
-
-    return permissions;
-  }
-
-  // Get list of all visible package
-  pkgRouter.get(
-    WebUrls.packages_all,
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      debug('hit package web api %o');
-
-      try {
-        const localPackages: Version[] = await storage.getLocalDatabase();
-
-        const order = getOrder(config?.web?.sort_packages);
-        debug('order %o', order);
-        const pkgs = await processPackages(localPackages, req);
-        next(sortByName(pkgs, order));
-      } catch (error: any) {
-        next(error);
-      }
-    }
-  );
-
-  return pkgRouter;
-}
-
-export default addPackageWebApi;

package/src/api/readme.ts

@@ -1,101 +0,0 @@
-import buildDebug from 'debug';
-import { Router } from 'express';
-
-import { Auth } from '@verdaccio/auth';
-import { DIST_TAGS, HEADERS, HEADER_TYPE } from '@verdaccio/core';
-import { logger } from '@verdaccio/logger';
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verdaccio/middleware';
-// Was required by other packages
-import { WebUrls } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Manifest } from '@verdaccio/types';
-import { isVersionValid } from '@verdaccio/utils';
-
-import { AuthorAvatar, addScope } from '../web-utils';
-
-export { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages
-
-// TODO: review this type, should be on @verdacid/types
-export type PackageExt = Manifest & { author: AuthorAvatar; dist?: { tarball: string } };
-export const NOT_README_FOUND = 'ERROR: No README data found!';
-const debug = buildDebug('verdaccio:web:api:readme');
-
-const getReadme = (readme) => {
-  if (typeof readme === 'string' && readme.length === 0) {
-    return NOT_README_FOUND;
-  }
-  if (typeof readme !== 'string') {
-    return NOT_README_FOUND;
-  } else {
-    return readme;
-  }
-};
-
-const getReadmeFromManifest = (manifest: Manifest, v?: any): string | undefined => {
-  let id;
-  let readme;
-  if (typeof v === 'string' && isVersionValid(manifest, v)) {
-    id = 'version';
-    readme = manifest.versions[v].readme;
-  }
-  if (!readme && isVersionValid(manifest, manifest[DIST_TAGS]?.latest)) {
-    id = 'latest';
-    readme = manifest.versions[manifest[DIST_TAGS].latest].readme;
-  }
-  if (!readme && manifest.readme) {
-    id = 'root';
-    readme = manifest.readme;
-  }
-  debug('readme: %o %o', v, id);
-  return readme;
-};
-
-function addReadmeWebApi(storage: Storage, auth: Auth): Router {
-  debug('initialized readme web api');
-  const can = allow(auth, {
-    beforeAll: (a, b) => logger.trace(a, b),
-    afterAll: (a, b) => logger.trace(a, b),
-  });
-  const pkgRouter = Router(); /* eslint new-cap: 0 */
-
-  pkgRouter.get(
-    [WebUrls.readme_package_scoped_version, WebUrls.readme_package_version],
-    can('access'),
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      debug('readme hit');
-      const rawScope = req.params.scope; // May include '@'
-      const scope = rawScope ? rawScope.slice(1) : null; // Remove '@' if present
-      const name = scope ? addScope(scope, req.params.package) : req.params.package;
-      debug('readme name %o', name);
-      const requestOptions = {
-        protocol: req.protocol,
-        headers: req.headers as any,
-        // FIXME: if we migrate to req.hostname, the port is not longer included.
-        host: req.host,
-        remoteAddress: req.socket.remoteAddress,
-      };
-      try {
-        const manifest = (await storage.getPackageByOptions({
-          name,
-          uplinksLook: true,
-          abbreviated: false,
-          requestOptions,
-        })) as Manifest;
-        debug('readme pkg %o', manifest?.name);
-        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);
-        const { v } = req.query;
-        const readme = getReadmeFromManifest(manifest, v);
-        next(getReadme(readme));
-      } catch (err) {
-        next(err);
-      }
-    }
-  );
-  return pkgRouter;
-}
-
-export default addReadmeWebApi;

package/src/api/search.ts

@@ -1,92 +0,0 @@
-import buildDebug from 'debug';
-import { Router } from 'express';
-import _ from 'lodash';
-import { URLSearchParams } from 'url';
-
-import { Auth } from '@verdaccio/auth';
-import { errorUtils, searchUtils } from '@verdaccio/core';
-import { SearchQuery } from '@verdaccio/core/src/search-utils';
-import { WebUrls } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { Manifest } from '@verdaccio/types';
-
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from './package';
-
-const debug = buildDebug('verdaccio:web:api:search');
-
-function checkAccess(pkg: any, auth: any, remoteUser): Promise<Manifest | null> {
-  return new Promise((resolve, reject) => {
-    auth.allow_access({ packageName: pkg?.package?.name }, remoteUser, function (err, allowed) {
-      if (err) {
-        if (err.status && String(err.status).match(/^4\d\d$/)) {
-          // auth plugin returns 4xx user error,
-          // that's equivalent of !allowed basically
-          allowed = false;
-          return resolve(null);
-        } else {
-          reject(err);
-        }
-      } else {
-        return resolve(allowed ? pkg : null);
-      }
-    });
-  });
-}
-
-function addSearchWebApi(storage: Storage, auth: Auth): Router {
-  const router = Router(); /* eslint new-cap: 0 */
-  router.get(
-    WebUrls.search,
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      try {
-        let data;
-        const abort = new AbortController();
-        req.socket.on('close', function () {
-          debug('search web aborted');
-          abort.abort();
-        });
-        const text: string = (req.params.anything as string) ?? '';
-        // These values are declared as optimal by npm cli
-        // FUTURE: could be overwritten by ui settings.
-        const size = 20;
-        const from = 0;
-        const query: SearchQuery = {
-          from: 0,
-          maintenance: 0.5,
-          popularity: 0.98,
-          quality: 0.65,
-          size: 20,
-          text,
-        };
-        // @ts-ignore
-        const urlParams = new URLSearchParams(query);
-        debug('search web init');
-        data = await storage?.search({
-          query,
-          url: `/-/v1/search?${urlParams.toString()}`,
-          abort,
-        });
-        const checkAccessPromises: searchUtils.SearchItemPkg[] = await Promise.all(
-          data.map((pkgItem) => {
-            return checkAccess(pkgItem, auth, req.remote_user);
-          })
-        );
-
-        const final: searchUtils.SearchItemPkg[] = checkAccessPromises
-          .filter((i) => !_.isNull(i))
-          .slice(from, size);
-
-        next(final);
-      } catch (err: any) {
-        next(errorUtils.getInternalError(err.message));
-      }
-    }
-  );
-  return router;
-}
-
-export default addSearchWebApi;

package/src/api/sidebar.ts

@@ -1,91 +0,0 @@
-import buildDebug from 'debug';
-import { Router } from 'express';
-
-import { Auth } from '@verdaccio/auth';
-import { DIST_TAGS, HTTP_STATUS } from '@verdaccio/core';
-import { logger } from '@verdaccio/logger';
-import { $NextFunctionVer, $RequestExtend, $ResponseExtend, allow } from '@verdaccio/middleware';
-// Was required by other packages
-import { WebUrls } from '@verdaccio/middleware';
-import { Storage } from '@verdaccio/store';
-import { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';
-import { Config, Manifest, Version } from '@verdaccio/types';
-import { addGravatarSupport, formatAuthor, isVersionValid } from '@verdaccio/utils';
-
-import { AuthorAvatar, addScope, deleteProperties } from '../web-utils';
-
-export { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages
-
-export type PackageExt = Manifest & { author: AuthorAvatar; dist?: { tarball: string } };
-
-export type $SidebarPackage = Manifest & { latest: Version };
-const debug = buildDebug('verdaccio:web:api:sidebar');
-
-function addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {
-  debug('initialized sidebar web api');
-  const router = Router(); /* eslint new-cap: 0 */
-  const can = allow(auth, {
-    beforeAll: (a, b) => logger.trace(a, b),
-    afterAll: (a, b) => logger.trace(a, b),
-  });
-  // Get package sidebar
-  router.get(
-    [WebUrls.sidebar_scopped_package, WebUrls.sidebar_package],
-    can('access'),
-    async function (
-      req: $RequestExtend,
-      res: $ResponseExtend,
-      next: $NextFunctionVer
-    ): Promise<void> {
-      const rawScope = req.params.scope; // May include '@'
-      const scope = rawScope ? rawScope.slice(1) : null; // Remove '@' if present
-      const name: string = scope ? addScope(scope, req.params.package) : req.params.package;
-      const requestOptions = {
-        protocol: req.protocol,
-        headers: req.headers as any,
-        // FIXME: if we migrate to req.hostname, the port is not longer included.
-        host: req.host,
-        remoteAddress: req.socket.remoteAddress,
-      };
-      try {
-        const info = (await storage.getPackageByOptions({
-          name,
-          uplinksLook: true,
-          keepUpLinkData: true,
-          requestOptions,
-        })) as Manifest;
-        const { v } = req.query;
-        let sideBarInfo = { ...info };
-        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(
-          info,
-          { protocol: req.protocol, headers: req.headers as any, host: req.hostname },
-          config.url_prefix
-        ).versions;
-        // TODO: review this implementation
-        if (typeof v === 'string' && isVersionValid(info, v)) {
-          // @ts-ignore
-          sideBarInfo.latest = sideBarInfo.versions[v];
-          // @ts-ignore
-          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);
-        } else {
-          // @ts-ignore
-          sideBarInfo.latest = sideBarInfo.versions[info[DIST_TAGS].latest];
-          // @ts-ignore
-          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);
-        }
-        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);
-        const authorAvatar = config.web
-          ? addGravatarSupport(sideBarInfo, config.web.gravatar)
-          : addGravatarSupport(sideBarInfo);
-        next(authorAvatar);
-      } catch (err) {
-        res.status(HTTP_STATUS.NOT_FOUND);
-        res.end();
-      }
-    }
-  );
-
-  return router;
-}
-
-export default addSidebarWebApi;

package/src/api/user.ts

@@ -1,94 +0,0 @@
-import buildDebug from 'debug';
-import { Request, Response, Router } from 'express';
-import _ from 'lodash';
-
-import { Auth } from '@verdaccio/auth';
-import {
-  API_ERROR,
-  APP_ERROR,
-  HEADERS,
-  HTTP_STATUS,
-  VerdaccioError,
-  errorUtils,
-  validatioUtils,
-} from '@verdaccio/core';
-import { rateLimit } from '@verdaccio/middleware';
-import { WebUrls } from '@verdaccio/middleware';
-import { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';
-
-import { $NextFunctionVer } from './package';
-
-const debug = buildDebug('verdaccio:web:api:user');
-
-function addUserAuthApi(auth: Auth, config: Config): Router {
-  const route = Router(); /* eslint new-cap: 0 */
-  route.post(
-    WebUrls.user_login,
-    rateLimit(config?.userRateLimit),
-    function (req: Request, res: Response, next: $NextFunctionVer): void {
-      const { username, password } = req.body;
-      debug('authenticate %o', username);
-      auth.authenticate(
-        username,
-        password,
-        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {
-          if (err) {
-            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;
-            debug('error authenticate %o', errorCode);
-            next(errorUtils.getCode(errorCode, err.message));
-          } else {
-            req.remote_user = user as RemoteUser;
-            const jWTSignOptions: JWTSignOptions = config.security.web.sign;
-            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');
-            next({
-              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),
-              username: req.remote_user.name,
-            });
-          }
-        }
-      );
-    }
-  );
-
-  if (config?.flags?.changePassword === true) {
-    route.put(
-      WebUrls.reset_password,
-      rateLimit(config?.userRateLimit),
-      function (req: Request, res: Response, next: $NextFunctionVer): void {
-        if (_.isNil(req.remote_user.name)) {
-          res.status(HTTP_STATUS.UNAUTHORIZED);
-          return next({
-            // FUTURE: update to a more meaningful message
-            message: API_ERROR.MUST_BE_LOGGED,
-          });
-        }
-
-        const { password } = req.body;
-        const { name } = req.remote_user;
-
-        if (
-          validatioUtils.validatePassword(
-            password.new,
-            config?.serverSettings?.passwordValidationRegex
-          ) === false
-        ) {
-          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));
-        }
-
-        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {
-          if (_.isNil(err) && isUpdated) {
-            next({
-              ok: true,
-            });
-          } else {
-            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));
-          }
-        });
-      }
-    );
-  }
-
-  return route;
-}
-
-export default addUserAuthApi;

package/src/index.ts

@@ -1,2 +0,0 @@
-export { default, PLUGIN_UI_PREFIX, DEFAULT_PLUGIN_UI_THEME } from './middleware';
-export * from './web-utils';

package/src/middleware.ts

@@ -1,64 +0,0 @@
-import express from 'express';
-import _ from 'lodash';
-
-import { PLUGIN_CATEGORY } from '@verdaccio/core';
-import { asyncLoadPlugin } from '@verdaccio/loaders';
-import { logger } from '@verdaccio/logger';
-import { webMiddleware } from '@verdaccio/middleware';
-
-import webEndpointsApi from './api';
-
-export const PLUGIN_UI_PREFIX = 'verdaccio-theme';
-export const DEFAULT_PLUGIN_UI_THEME = '@verdaccio/ui-theme';
-
-export async function loadTheme(config: any) {
-  if (_.isNil(config.theme) === false) {
-    const plugin = await asyncLoadPlugin(
-      config.theme,
-      { config, logger },
-      // TODO: add types { staticPath: string; manifest: unknown; manifestFiles: unknown }
-      function (plugin: any) {
-        /**
-         *
-          - `staticPath`: is the same data returned in Verdaccio 5.
-          - `manifest`: A webpack manifest object.
-          - `manifestFiles`: A object with one property `js` and the array (order matters) of the manifest id to be loaded in the template dynamically.
-         */
-        return plugin.staticPath && plugin.manifest && plugin.manifestFiles;
-      },
-      config?.serverSettings?.pluginPrefix ?? PLUGIN_UI_PREFIX,
-      PLUGIN_CATEGORY.THEME
-    );
-    if (plugin.length > 1) {
-      logger.warn('multiple ui themes are not supported; only the first plugin is used');
-    }
-
-    return _.head(plugin);
-  }
-}
-
-export default async (config, auth, storage, logger) => {
-  let pluginOptions = await loadTheme(config);
-  if (!pluginOptions) {
-    pluginOptions = require(DEFAULT_PLUGIN_UI_THEME)(config.web);
-    logger.info(
-      { name: DEFAULT_PLUGIN_UI_THEME, pluginCategory: PLUGIN_CATEGORY.THEME },
-      'plugin @{name} successfully loaded (@{pluginCategory})'
-    );
-  }
-
-  // eslint-disable-next-line new-cap
-  const router = express.Router();
-  // load application
-  router.use(
-    webMiddleware(
-      config,
-      {
-        tokenMiddleware: auth.webUIJWTmiddleware(),
-        webEndpointsApi: webEndpointsApi(auth, storage, config),
-      },
-      pluginOptions
-    )
-  );
-  return router;
-};

package/src/web-utils.ts

@@ -1,28 +0,0 @@
-import _ from 'lodash';
-
-import { Author, ConfigYaml } from '@verdaccio/types';
-
-export function hasLogin(config: ConfigYaml) {
-  return _.isNil(config?.web?.login) || config?.web?.login === true;
-}
-
-export function sortByName(packages: any[], orderAscending: boolean | void = true): string[] {
-  return packages.slice().sort(function (a, b): number {
-    const comparatorNames = a.name.toLowerCase() < b.name.toLowerCase();
-    return orderAscending ? (comparatorNames ? -1 : 1) : comparatorNames ? 1 : -1;
-  });
-}
-
-export type AuthorAvatar = Author & { avatar?: string };
-
-export function addScope(scope: string, packageName: string): string {
-  return `@${scope}/${packageName}`;
-}
-
-export function deleteProperties(propertiesToDelete: string[], objectItem: any): any {
-  _.forEach(propertiesToDelete, (property): any => {
-    delete objectItem[property];
-  });
-
-  return objectItem;
-}