@verdaccio/web 9.0.0-next-9.29 → 9.0.0-next-9.31

package/build/api/index.js

@@ -17,7 +17,7 @@ var api_default = (auth, storage, config) => {
 	route.use(_verdaccio_middleware.WebUrlsNamespace.data, require_package.default(storage, auth, config));
 	route.use(_verdaccio_middleware.WebUrlsNamespace.data, require_search.default(storage, auth));
 	route.use(_verdaccio_middleware.WebUrlsNamespace.data, require_sidebar.default(config, storage, auth));
-	route.use(_verdaccio_middleware.WebUrlsNamespace.data, require_readme.default(storage, auth));
+	route.use(_verdaccio_middleware.WebUrlsNamespace.data, require_readme.default(storage, auth, config));
 	if (require_web_utils.hasLogin(config)) route.use(_verdaccio_middleware.WebUrlsNamespace.sec, require_user.default(auth, config, storage));
 	return route;
 };

package/build/api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.use(\n    WebUrlsNamespace.data,\n    rateLimit({\n      windowMs: 2 * 60 * 1000, // 2  minutes\n      max: 5000, // limit each IP to 1000 requests per windowMs\n      ...config?.web?.rateLimit,\n    })\n  );\n  route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));\n  route.use(WebUrlsNamespace.data, search(storage, auth));\n  route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));\n  route.use(WebUrlsNamespace.data, readme(storage, auth));\n  if (hasLogin(config)) {\n    route.use(WebUrlsNamespace.sec, user(auth, config, storage));\n  }\n  return route;\n};\n"],"mappings":";;;;;;;;;AAWA,IAAA,eAAgB,MAAM,SAAS,WAAW;CACxC,MAAM,SAAA,GAAQ,QAAA,OAAA,CAAO;CACrB,MAAM,IACJ,sBAAA,iBAAiB,OAAA,GACjB,sBAAA,UAAA,CAAU;EACR,UAAU;EACV,KAAK;EACL,GAAG,QAAQ,KAAK;CAClB,CAAC,CACH;CACA,MAAM,IAAI,sBAAA,iBAAiB,MAAM,gBAAA,QAAW,SAAS,MAAM,MAAM,CAAC;CAClE,MAAM,IAAI,sBAAA,iBAAiB,MAAM,eAAA,QAAO,SAAS,IAAI,CAAC;CACtD,MAAM,IAAI,sBAAA,iBAAiB,MAAM,gBAAA,QAAQ,QAAQ,SAAS,IAAI,CAAC;CAC/D,MAAM,IAAI,sBAAA,iBAAiB,MAAM,eAAA,QAAO,SAAS,IAAI,CAAC;CACtD,IAAI,kBAAA,SAAS,MAAM,GACjB,MAAM,IAAI,sBAAA,iBAAiB,KAAK,aAAA,QAAK,MAAM,QAAQ,OAAO,CAAC;CAE7D,OAAO;AACT"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.use(\n    WebUrlsNamespace.data,\n    rateLimit({\n      windowMs: 2 * 60 * 1000, // 2  minutes\n      max: 5000, // limit each IP to 1000 requests per windowMs\n      ...config?.web?.rateLimit,\n    })\n  );\n  route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));\n  route.use(WebUrlsNamespace.data, search(storage, auth));\n  route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));\n  route.use(WebUrlsNamespace.data, readme(storage, auth, config));\n  if (hasLogin(config)) {\n    route.use(WebUrlsNamespace.sec, user(auth, config, storage));\n  }\n  return route;\n};\n"],"mappings":";;;;;;;;;AAWA,IAAA,eAAgB,MAAM,SAAS,WAAW;CACxC,MAAM,SAAA,GAAQ,QAAA,OAAA,CAAO;CACrB,MAAM,IACJ,sBAAA,iBAAiB,OAAA,GACjB,sBAAA,UAAA,CAAU;EACR,UAAU;EACV,KAAK;EACL,GAAG,QAAQ,KAAK;CAClB,CAAC,CACH;CACA,MAAM,IAAI,sBAAA,iBAAiB,MAAM,gBAAA,QAAW,SAAS,MAAM,MAAM,CAAC;CAClE,MAAM,IAAI,sBAAA,iBAAiB,MAAM,eAAA,QAAO,SAAS,IAAI,CAAC;CACtD,MAAM,IAAI,sBAAA,iBAAiB,MAAM,gBAAA,QAAQ,QAAQ,SAAS,IAAI,CAAC;CAC/D,MAAM,IAAI,sBAAA,iBAAiB,MAAM,eAAA,QAAO,SAAS,MAAM,MAAM,CAAC;CAC9D,IAAI,kBAAA,SAAS,MAAM,GACjB,MAAM,IAAI,sBAAA,iBAAiB,KAAK,aAAA,QAAK,MAAM,QAAQ,OAAO,CAAC;CAE7D,OAAO;AACT"}

package/build/api/index.mjs

@@ -17,7 +17,7 @@ var api_default = (auth, storage, config) => {
 	route.use(WebUrlsNamespace.data, addPackageWebApi(storage, auth, config));
 	route.use(WebUrlsNamespace.data, addSearchWebApi(storage, auth));
 	route.use(WebUrlsNamespace.data, addSidebarWebApi(config, storage, auth));
-	route.use(WebUrlsNamespace.data, addReadmeWebApi(storage, auth));
+	route.use(WebUrlsNamespace.data, addReadmeWebApi(storage, auth, config));
 	if (hasLogin(config)) route.use(WebUrlsNamespace.sec, addUserAuthApi(auth, config, storage));
 	return route;
 };

package/build/api/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.use(\n    WebUrlsNamespace.data,\n    rateLimit({\n      windowMs: 2 * 60 * 1000, // 2  minutes\n      max: 5000, // limit each IP to 1000 requests per windowMs\n      ...config?.web?.rateLimit,\n    })\n  );\n  route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));\n  route.use(WebUrlsNamespace.data, search(storage, auth));\n  route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));\n  route.use(WebUrlsNamespace.data, readme(storage, auth));\n  if (hasLogin(config)) {\n    route.use(WebUrlsNamespace.sec, user(auth, config, storage));\n  }\n  return route;\n};\n"],"mappings":";;;;;;;;;AAWA,IAAA,eAAgB,MAAM,SAAS,WAAW;CACxC,MAAM,QAAQ,OAAO;CACrB,MAAM,IACJ,iBAAiB,MACjB,UAAU;EACR,UAAU;EACV,KAAK;EACL,GAAG,QAAQ,KAAK;CAClB,CAAC,CACH;CACA,MAAM,IAAI,iBAAiB,MAAM,iBAAW,SAAS,MAAM,MAAM,CAAC;CAClE,MAAM,IAAI,iBAAiB,MAAM,gBAAO,SAAS,IAAI,CAAC;CACtD,MAAM,IAAI,iBAAiB,MAAM,iBAAQ,QAAQ,SAAS,IAAI,CAAC;CAC/D,MAAM,IAAI,iBAAiB,MAAM,gBAAO,SAAS,IAAI,CAAC;CACtD,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,iBAAiB,KAAK,eAAK,MAAM,QAAQ,OAAO,CAAC;CAE7D,OAAO;AACT"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/api/index.ts"],"sourcesContent":["import { Router } from 'express';\n\nimport { WebUrlsNamespace, rateLimit } from '@verdaccio/middleware';\n\nimport { hasLogin } from '../web-utils';\nimport packageApi from './package';\nimport readme from './readme';\nimport search from './search';\nimport sidebar from './sidebar';\nimport user from './user';\n\nexport default (auth, storage, config) => {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.use(\n    WebUrlsNamespace.data,\n    rateLimit({\n      windowMs: 2 * 60 * 1000, // 2  minutes\n      max: 5000, // limit each IP to 1000 requests per windowMs\n      ...config?.web?.rateLimit,\n    })\n  );\n  route.use(WebUrlsNamespace.data, packageApi(storage, auth, config));\n  route.use(WebUrlsNamespace.data, search(storage, auth));\n  route.use(WebUrlsNamespace.data, sidebar(config, storage, auth));\n  route.use(WebUrlsNamespace.data, readme(storage, auth, config));\n  if (hasLogin(config)) {\n    route.use(WebUrlsNamespace.sec, user(auth, config, storage));\n  }\n  return route;\n};\n"],"mappings":";;;;;;;;;AAWA,IAAA,eAAgB,MAAM,SAAS,WAAW;CACxC,MAAM,QAAQ,OAAO;CACrB,MAAM,IACJ,iBAAiB,MACjB,UAAU;EACR,UAAU;EACV,KAAK;EACL,GAAG,QAAQ,KAAK;CAClB,CAAC,CACH;CACA,MAAM,IAAI,iBAAiB,MAAM,iBAAW,SAAS,MAAM,MAAM,CAAC;CAClE,MAAM,IAAI,iBAAiB,MAAM,gBAAO,SAAS,IAAI,CAAC;CACtD,MAAM,IAAI,iBAAiB,MAAM,iBAAQ,QAAQ,SAAS,IAAI,CAAC;CAC/D,MAAM,IAAI,iBAAiB,MAAM,gBAAO,SAAS,MAAM,MAAM,CAAC;CAC9D,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,iBAAiB,KAAK,eAAK,MAAM,QAAQ,OAAO,CAAC;CAE7D,OAAO;AACT"}

package/build/api/readme.d.ts

@@ -2,7 +2,8 @@ import { Router } from 'express';
 import type { Auth } from '@verdaccio/auth';
 import { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';
 import type { Storage } from '@verdaccio/store';
+import type { Config } from '@verdaccio/types';
 export { $RequestExtend, $ResponseExtend, $NextFunctionVer };
 export declare const NOT_README_FOUND = "ERROR: No README data found!";
-declare function addReadmeWebApi(storage: Storage, auth: Auth): Router;
+declare function addReadmeWebApi(storage: Storage, auth: Auth, config: Config): Router;
 export default addReadmeWebApi;

package/build/api/readme.js

@@ -1,10 +1,10 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.js");
 const require_web_utils = require("../web-utils.js");
+const require_scoped_access = require("./scoped-access.js");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug);
 let express = require("express");
 let _verdaccio_core = require("@verdaccio/core");
-let _verdaccio_logger = require("@verdaccio/logger");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 //#region src/api/readme.ts
 var NOT_README_FOUND = "ERROR: No README data found!";
@@ -32,18 +32,12 @@ var getReadmeFromManifest = (manifest, v) => {
 	debug$1("readme: %o %o", v, id);
 	return readme;
 };
-function addReadmeWebApi(storage, auth) {
+function addReadmeWebApi(storage, auth, config) {
 	debug$1("initialized readme web api");
-	const can = (0, _verdaccio_middleware.allow)(auth, {
-		beforeAll: (a, b) => _verdaccio_logger.logger.trace(a, b),
-		afterAll: (a, b) => _verdaccio_logger.logger.trace(a, b)
-	});
 	const pkgRouter = (0, express.Router)();
-	pkgRouter.get([_verdaccio_middleware.WebUrls.readme_package_scoped_version, _verdaccio_middleware.WebUrls.readme_package_version], can("access"), async function(req, res, next) {
+	pkgRouter.get([_verdaccio_middleware.WebUrls.readme_package_scoped_version, _verdaccio_middleware.WebUrls.readme_package_version], require_scoped_access.scopedPackageAccess(auth, config), async function(req, res, next) {
 		debug$1("readme hit");
-		const scope = _verdaccio_core.reqUtils.paramToString(req.params.scope).replace(/^@/, "");
-		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
-		const name = scope ? require_web_utils.addScope(scope, packageName) : packageName;
+		const name = req.scopedPackageName;
 		debug$1("readme name %o", name);
 		const requestOptions = (0, _verdaccio_middleware.getRequestOptions)(req);
 		try {
@@ -54,9 +48,19 @@ function addReadmeWebApi(storage, auth) {
 				requestOptions
 			});
 			debug$1("readme pkg %o", manifest?.name);
-			res.set(_verdaccio_core.HEADER_TYPE.CONTENT_TYPE, _verdaccio_core.HEADERS.TEXT_PLAIN_UTF8);
 			const { v } = req.query;
-			next(getReadme(getReadmeFromManifest(manifest, v)));
+			let requestedVersion;
+			if (typeof v === "string") {
+				requestedVersion = require_web_utils.resolveVersion(manifest, v);
+				if (!requestedVersion) {
+					debug$1("version %o not found for %o", v, name);
+					res.status(_verdaccio_core.HTTP_STATUS.NOT_FOUND);
+					res.end();
+					return;
+				}
+			}
+			res.set(_verdaccio_core.HEADER_TYPE.CONTENT_TYPE, _verdaccio_core.HEADERS.TEXT_PLAIN_UTF8);
+			next(getReadme(getReadmeFromManifest(manifest, requestedVersion)));
 		} catch (err) {
 			next(err);
 		}

package/build/api/readme.js.map

@@ -1 +1 @@
-{"version":3,"file":"readme.js","names":[],"sources":["../../src/api/readme.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HEADERS, HEADER_TYPE, reqUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  allow,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Manifest } from '@verdaccio/types';\n\nimport { addScope, isVersionValid } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nexport const NOT_README_FOUND = 'ERROR: No README data found!';\n\nconst debug = buildDebug('verdaccio:web:api:readme');\n\nconst getReadme = (readme) => {\n  if (typeof readme === 'string' && readme.length === 0) {\n    return NOT_README_FOUND;\n  }\n  if (typeof readme !== 'string') {\n    return NOT_README_FOUND;\n  } else {\n    return readme;\n  }\n};\n\nconst getReadmeFromManifest = (manifest: Manifest, v?: any): string | undefined => {\n  let id;\n  let readme;\n  if (typeof v === 'string' && isVersionValid(manifest, v)) {\n    id = 'version';\n    readme = manifest.versions[v].readme;\n  }\n  if (!readme && isVersionValid(manifest, manifest[DIST_TAGS]?.latest)) {\n    id = 'latest';\n    readme = manifest.versions[manifest[DIST_TAGS].latest].readme;\n  }\n  if (!readme && manifest.readme) {\n    id = 'root';\n    readme = manifest.readme;\n  }\n  debug('readme: %o %o', v, id);\n  return readme;\n};\n\nfunction addReadmeWebApi(storage: Storage, auth: Auth): Router {\n  debug('initialized readme web api');\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n\n  pkgRouter.get(\n    [WebUrls.readme_package_scoped_version, WebUrls.readme_package_version],\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('readme hit');\n      const scope = reqUtils.paramToString(req.params.scope).replace(/^@/, '');\n      const packageName = reqUtils.paramToString(req.params.package);\n      const name = scope ? addScope(scope, packageName) : packageName;\n      debug('readme name %o', name);\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated: false,\n          requestOptions,\n        })) as Manifest;\n        debug('readme pkg %o', manifest?.name);\n        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);\n        // TODO: sanitize query\n        const { v } = req.query;\n        const readme = getReadmeFromManifest(manifest, v);\n        next(getReadme(readme));\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n  return pkgRouter;\n}\n\nexport default addReadmeWebApi;\n"],"mappings":";;;;;;;;;AAqBA,IAAa,mBAAmB;AAEhC,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,0BAA0B;AAEnD,IAAM,aAAa,WAAW;CAC5B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,OAAO;CAET,IAAI,OAAO,WAAW,UACpB,OAAO;MAEP,OAAO;AAEX;AAEA,IAAM,yBAAyB,UAAoB,MAAgC;CACjF,IAAI;CACJ,IAAI;CACJ,IAAI,OAAO,MAAM,YAAY,kBAAA,eAAe,UAAU,CAAC,GAAG;EACxD,KAAK;EACL,SAAS,SAAS,SAAS,EAAE,CAAC;CAChC;CACA,IAAI,CAAC,UAAU,kBAAA,eAAe,UAAU,SAAS,gBAAA,UAAU,EAAE,MAAM,GAAG;EACpE,KAAK;EACL,SAAS,SAAS,SAAS,SAAS,gBAAA,UAAU,CAAC,OAAO,CAAC;CACzD;CACA,IAAI,CAAC,UAAU,SAAS,QAAQ;EAC9B,KAAK;EACL,SAAS,SAAS;CACpB;CACA,QAAM,iBAAiB,GAAG,EAAE;CAC5B,OAAO;AACT;AAEA,SAAS,gBAAgB,SAAkB,MAAoB;CAC7D,QAAM,4BAA4B;CAClC,MAAM,OAAA,GAAM,sBAAA,MAAA,CAAM,MAAM;EACtB,YAAY,GAAG,MAAM,kBAAA,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,kBAAA,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,aAAA,GAAY,QAAA,OAAA,CAAO;CAEzB,UAAU,IACR,CAAC,sBAAA,QAAQ,+BAA+B,sBAAA,QAAQ,sBAAsB,GACtE,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,QAAM,YAAY;EAClB,MAAM,QAAQ,gBAAA,SAAS,cAAc,IAAI,OAAO,KAAK,CAAC,CAAC,QAAQ,MAAM,EAAE;EACvE,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,OAAO,QAAQ,kBAAA,SAAS,OAAO,WAAW,IAAI;EACpD,QAAM,kBAAkB,IAAI;EAC5B,MAAM,kBAAA,GAAiB,sBAAA,kBAAA,CAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,WAAY,MAAM,QAAQ,oBAAoB;IAClD;IACA,aAAa;IACb,aAAa;IACb;GACF,CAAC;GACD,QAAM,iBAAiB,UAAU,IAAI;GACrC,IAAI,IAAI,gBAAA,YAAY,cAAc,gBAAA,QAAQ,eAAe;GAEzD,MAAM,EAAE,MAAM,IAAI;GAElB,KAAK,UADU,sBAAsB,UAAU,CAChC,CAAM,CAAC;EACxB,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CACA,OAAO;AACT"}
+{"version":3,"file":"readme.js","names":[],"sources":["../../src/api/readme.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Manifest } from '@verdaccio/types';\n\nimport { isVersionValid, resolveVersion } from '../web-utils';\nimport { scopedPackageAccess } from './scoped-access';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nexport const NOT_README_FOUND = 'ERROR: No README data found!';\n\nconst debug = buildDebug('verdaccio:web:api:readme');\n\nconst getReadme = (readme) => {\n  if (typeof readme === 'string' && readme.length === 0) {\n    return NOT_README_FOUND;\n  }\n  if (typeof readme !== 'string') {\n    return NOT_README_FOUND;\n  } else {\n    return readme;\n  }\n};\n\nconst getReadmeFromManifest = (manifest: Manifest, v?: any): string | undefined => {\n  let id;\n  let readme;\n  if (typeof v === 'string' && isVersionValid(manifest, v)) {\n    id = 'version';\n    readme = manifest.versions[v].readme;\n  }\n  if (!readme && isVersionValid(manifest, manifest[DIST_TAGS]?.latest)) {\n    id = 'latest';\n    readme = manifest.versions[manifest[DIST_TAGS].latest].readme;\n  }\n  if (!readme && manifest.readme) {\n    id = 'root';\n    readme = manifest.readme;\n  }\n  debug('readme: %o %o', v, id);\n  return readme;\n};\n\nfunction addReadmeWebApi(storage: Storage, auth: Auth, config: Config): Router {\n  debug('initialized readme web api');\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n\n  pkgRouter.get(\n    [WebUrls.readme_package_scoped_version, WebUrls.readme_package_version],\n    scopedPackageAccess(auth, config),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('readme hit');\n      const name = (req as $RequestExtend & { scopedPackageName: string }).scopedPackageName;\n      debug('readme name %o', name);\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated: false,\n          requestOptions,\n        })) as Manifest;\n        debug('readme pkg %o', manifest?.name);\n        // TODO: sanitize query\n        const { v } = req.query;\n        // `v` may be a version or a dist-tag; anything else is a 404\n        let requestedVersion: string | undefined;\n        if (typeof v === 'string') {\n          requestedVersion = resolveVersion(manifest, v);\n          if (!requestedVersion) {\n            debug('version %o not found for %o', v, name);\n            res.status(HTTP_STATUS.NOT_FOUND);\n            res.end();\n            return;\n          }\n        }\n        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);\n        const readme = getReadmeFromManifest(manifest, requestedVersion);\n        next(getReadme(readme));\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n  return pkgRouter;\n}\n\nexport default addReadmeWebApi;\n"],"mappings":";;;;;;;;;AAoBA,IAAa,mBAAmB;AAEhC,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,0BAA0B;AAEnD,IAAM,aAAa,WAAW;CAC5B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,OAAO;CAET,IAAI,OAAO,WAAW,UACpB,OAAO;MAEP,OAAO;AAEX;AAEA,IAAM,yBAAyB,UAAoB,MAAgC;CACjF,IAAI;CACJ,IAAI;CACJ,IAAI,OAAO,MAAM,YAAY,kBAAA,eAAe,UAAU,CAAC,GAAG;EACxD,KAAK;EACL,SAAS,SAAS,SAAS,EAAE,CAAC;CAChC;CACA,IAAI,CAAC,UAAU,kBAAA,eAAe,UAAU,SAAS,gBAAA,UAAU,EAAE,MAAM,GAAG;EACpE,KAAK;EACL,SAAS,SAAS,SAAS,SAAS,gBAAA,UAAU,CAAC,OAAO,CAAC;CACzD;CACA,IAAI,CAAC,UAAU,SAAS,QAAQ;EAC9B,KAAK;EACL,SAAS,SAAS;CACpB;CACA,QAAM,iBAAiB,GAAG,EAAE;CAC5B,OAAO;AACT;AAEA,SAAS,gBAAgB,SAAkB,MAAY,QAAwB;CAC7E,QAAM,4BAA4B;CAClC,MAAM,aAAA,GAAY,QAAA,OAAA,CAAO;CAEzB,UAAU,IACR,CAAC,sBAAA,QAAQ,+BAA+B,sBAAA,QAAQ,sBAAsB,GACtE,sBAAA,oBAAoB,MAAM,MAAM,GAChC,eACE,KACA,KACA,MACe;EACf,QAAM,YAAY;EAClB,MAAM,OAAQ,IAAuD;EACrE,QAAM,kBAAkB,IAAI;EAC5B,MAAM,kBAAA,GAAiB,sBAAA,kBAAA,CAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,WAAY,MAAM,QAAQ,oBAAoB;IAClD;IACA,aAAa;IACb,aAAa;IACb;GACF,CAAC;GACD,QAAM,iBAAiB,UAAU,IAAI;GAErC,MAAM,EAAE,MAAM,IAAI;GAElB,IAAI;GACJ,IAAI,OAAO,MAAM,UAAU;IACzB,mBAAmB,kBAAA,eAAe,UAAU,CAAC;IAC7C,IAAI,CAAC,kBAAkB;KACrB,QAAM,+BAA+B,GAAG,IAAI;KAC5C,IAAI,OAAO,gBAAA,YAAY,SAAS;KAChC,IAAI,IAAI;KACR;IACF;GACF;GACA,IAAI,IAAI,gBAAA,YAAY,cAAc,gBAAA,QAAQ,eAAe;GAEzD,KAAK,UADU,sBAAsB,UAAU,gBAChC,CAAM,CAAC;EACxB,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CACA,OAAO;AACT"}

package/build/api/readme.mjs

@@ -1,9 +1,9 @@
-import { addScope, isVersionValid } from "../web-utils.mjs";
+import { isVersionValid, resolveVersion } from "../web-utils.mjs";
+import { scopedPackageAccess } from "./scoped-access.mjs";
 import buildDebug from "debug";
 import { Router } from "express";
-import { DIST_TAGS, HEADERS, HEADER_TYPE, reqUtils } from "@verdaccio/core";
-import { logger } from "@verdaccio/logger";
-import { WebUrls, allow, getRequestOptions } from "@verdaccio/middleware";
+import { DIST_TAGS, HEADERS, HEADER_TYPE, HTTP_STATUS } from "@verdaccio/core";
+import { WebUrls, getRequestOptions } from "@verdaccio/middleware";
 //#region src/api/readme.ts
 var NOT_README_FOUND = "ERROR: No README data found!";
 var debug = buildDebug("verdaccio:web:api:readme");
@@ -30,18 +30,12 @@ var getReadmeFromManifest = (manifest, v) => {
 	debug("readme: %o %o", v, id);
 	return readme;
 };
-function addReadmeWebApi(storage, auth) {
+function addReadmeWebApi(storage, auth, config) {
 	debug("initialized readme web api");
-	const can = allow(auth, {
-		beforeAll: (a, b) => logger.trace(a, b),
-		afterAll: (a, b) => logger.trace(a, b)
-	});
 	const pkgRouter = Router();
-	pkgRouter.get([WebUrls.readme_package_scoped_version, WebUrls.readme_package_version], can("access"), async function(req, res, next) {
+	pkgRouter.get([WebUrls.readme_package_scoped_version, WebUrls.readme_package_version], scopedPackageAccess(auth, config), async function(req, res, next) {
 		debug("readme hit");
-		const scope = reqUtils.paramToString(req.params.scope).replace(/^@/, "");
-		const packageName = reqUtils.paramToString(req.params.package);
-		const name = scope ? addScope(scope, packageName) : packageName;
+		const name = req.scopedPackageName;
 		debug("readme name %o", name);
 		const requestOptions = getRequestOptions(req);
 		try {
@@ -52,9 +46,19 @@ function addReadmeWebApi(storage, auth) {
 				requestOptions
 			});
 			debug("readme pkg %o", manifest?.name);
-			res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);
 			const { v } = req.query;
-			next(getReadme(getReadmeFromManifest(manifest, v)));
+			let requestedVersion;
+			if (typeof v === "string") {
+				requestedVersion = resolveVersion(manifest, v);
+				if (!requestedVersion) {
+					debug("version %o not found for %o", v, name);
+					res.status(HTTP_STATUS.NOT_FOUND);
+					res.end();
+					return;
+				}
+			}
+			res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);
+			next(getReadme(getReadmeFromManifest(manifest, requestedVersion)));
 		} catch (err) {
 			next(err);
 		}

package/build/api/readme.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"readme.mjs","names":[],"sources":["../../src/api/readme.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HEADERS, HEADER_TYPE, reqUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  allow,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Manifest } from '@verdaccio/types';\n\nimport { addScope, isVersionValid } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nexport const NOT_README_FOUND = 'ERROR: No README data found!';\n\nconst debug = buildDebug('verdaccio:web:api:readme');\n\nconst getReadme = (readme) => {\n  if (typeof readme === 'string' && readme.length === 0) {\n    return NOT_README_FOUND;\n  }\n  if (typeof readme !== 'string') {\n    return NOT_README_FOUND;\n  } else {\n    return readme;\n  }\n};\n\nconst getReadmeFromManifest = (manifest: Manifest, v?: any): string | undefined => {\n  let id;\n  let readme;\n  if (typeof v === 'string' && isVersionValid(manifest, v)) {\n    id = 'version';\n    readme = manifest.versions[v].readme;\n  }\n  if (!readme && isVersionValid(manifest, manifest[DIST_TAGS]?.latest)) {\n    id = 'latest';\n    readme = manifest.versions[manifest[DIST_TAGS].latest].readme;\n  }\n  if (!readme && manifest.readme) {\n    id = 'root';\n    readme = manifest.readme;\n  }\n  debug('readme: %o %o', v, id);\n  return readme;\n};\n\nfunction addReadmeWebApi(storage: Storage, auth: Auth): Router {\n  debug('initialized readme web api');\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n\n  pkgRouter.get(\n    [WebUrls.readme_package_scoped_version, WebUrls.readme_package_version],\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('readme hit');\n      const scope = reqUtils.paramToString(req.params.scope).replace(/^@/, '');\n      const packageName = reqUtils.paramToString(req.params.package);\n      const name = scope ? addScope(scope, packageName) : packageName;\n      debug('readme name %o', name);\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated: false,\n          requestOptions,\n        })) as Manifest;\n        debug('readme pkg %o', manifest?.name);\n        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);\n        // TODO: sanitize query\n        const { v } = req.query;\n        const readme = getReadmeFromManifest(manifest, v);\n        next(getReadme(readme));\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n  return pkgRouter;\n}\n\nexport default addReadmeWebApi;\n"],"mappings":";;;;;;;AAqBA,IAAa,mBAAmB;AAEhC,IAAM,QAAQ,WAAW,0BAA0B;AAEnD,IAAM,aAAa,WAAW;CAC5B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,OAAO;CAET,IAAI,OAAO,WAAW,UACpB,OAAO;MAEP,OAAO;AAEX;AAEA,IAAM,yBAAyB,UAAoB,MAAgC;CACjF,IAAI;CACJ,IAAI;CACJ,IAAI,OAAO,MAAM,YAAY,eAAe,UAAU,CAAC,GAAG;EACxD,KAAK;EACL,SAAS,SAAS,SAAS,EAAE,CAAC;CAChC;CACA,IAAI,CAAC,UAAU,eAAe,UAAU,SAAS,UAAU,EAAE,MAAM,GAAG;EACpE,KAAK;EACL,SAAS,SAAS,SAAS,SAAS,UAAU,CAAC,OAAO,CAAC;CACzD;CACA,IAAI,CAAC,UAAU,SAAS,QAAQ;EAC9B,KAAK;EACL,SAAS,SAAS;CACpB;CACA,MAAM,iBAAiB,GAAG,EAAE;CAC5B,OAAO;AACT;AAEA,SAAS,gBAAgB,SAAkB,MAAoB;CAC7D,MAAM,4BAA4B;CAClC,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CACD,MAAM,YAAY,OAAO;CAEzB,UAAU,IACR,CAAC,QAAQ,+BAA+B,QAAQ,sBAAsB,GACtE,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,YAAY;EAClB,MAAM,QAAQ,SAAS,cAAc,IAAI,OAAO,KAAK,CAAC,CAAC,QAAQ,MAAM,EAAE;EACvE,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI;EACpD,MAAM,kBAAkB,IAAI;EAC5B,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,WAAY,MAAM,QAAQ,oBAAoB;IAClD;IACA,aAAa;IACb,aAAa;IACb;GACF,CAAC;GACD,MAAM,iBAAiB,UAAU,IAAI;GACrC,IAAI,IAAI,YAAY,cAAc,QAAQ,eAAe;GAEzD,MAAM,EAAE,MAAM,IAAI;GAElB,KAAK,UADU,sBAAsB,UAAU,CAChC,CAAM,CAAC;EACxB,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CACA,OAAO;AACT"}
+{"version":3,"file":"readme.mjs","names":[],"sources":["../../src/api/readme.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HEADERS, HEADER_TYPE, HTTP_STATUS } from '@verdaccio/core';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport type { Config, Manifest } from '@verdaccio/types';\n\nimport { isVersionValid, resolveVersion } from '../web-utils';\nimport { scopedPackageAccess } from './scoped-access';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nexport const NOT_README_FOUND = 'ERROR: No README data found!';\n\nconst debug = buildDebug('verdaccio:web:api:readme');\n\nconst getReadme = (readme) => {\n  if (typeof readme === 'string' && readme.length === 0) {\n    return NOT_README_FOUND;\n  }\n  if (typeof readme !== 'string') {\n    return NOT_README_FOUND;\n  } else {\n    return readme;\n  }\n};\n\nconst getReadmeFromManifest = (manifest: Manifest, v?: any): string | undefined => {\n  let id;\n  let readme;\n  if (typeof v === 'string' && isVersionValid(manifest, v)) {\n    id = 'version';\n    readme = manifest.versions[v].readme;\n  }\n  if (!readme && isVersionValid(manifest, manifest[DIST_TAGS]?.latest)) {\n    id = 'latest';\n    readme = manifest.versions[manifest[DIST_TAGS].latest].readme;\n  }\n  if (!readme && manifest.readme) {\n    id = 'root';\n    readme = manifest.readme;\n  }\n  debug('readme: %o %o', v, id);\n  return readme;\n};\n\nfunction addReadmeWebApi(storage: Storage, auth: Auth, config: Config): Router {\n  debug('initialized readme web api');\n  const pkgRouter = Router(); /* eslint new-cap: 0 */\n\n  pkgRouter.get(\n    [WebUrls.readme_package_scoped_version, WebUrls.readme_package_version],\n    scopedPackageAccess(auth, config),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      debug('readme hit');\n      const name = (req as $RequestExtend & { scopedPackageName: string }).scopedPackageName;\n      debug('readme name %o', name);\n      const requestOptions = getRequestOptions(req);\n      try {\n        const manifest = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          abbreviated: false,\n          requestOptions,\n        })) as Manifest;\n        debug('readme pkg %o', manifest?.name);\n        // TODO: sanitize query\n        const { v } = req.query;\n        // `v` may be a version or a dist-tag; anything else is a 404\n        let requestedVersion: string | undefined;\n        if (typeof v === 'string') {\n          requestedVersion = resolveVersion(manifest, v);\n          if (!requestedVersion) {\n            debug('version %o not found for %o', v, name);\n            res.status(HTTP_STATUS.NOT_FOUND);\n            res.end();\n            return;\n          }\n        }\n        res.set(HEADER_TYPE.CONTENT_TYPE, HEADERS.TEXT_PLAIN_UTF8);\n        const readme = getReadmeFromManifest(manifest, requestedVersion);\n        next(getReadme(readme));\n      } catch (err) {\n        next(err);\n      }\n    }\n  );\n  return pkgRouter;\n}\n\nexport default addReadmeWebApi;\n"],"mappings":";;;;;;;AAoBA,IAAa,mBAAmB;AAEhC,IAAM,QAAQ,WAAW,0BAA0B;AAEnD,IAAM,aAAa,WAAW;CAC5B,IAAI,OAAO,WAAW,YAAY,OAAO,WAAW,GAClD,OAAO;CAET,IAAI,OAAO,WAAW,UACpB,OAAO;MAEP,OAAO;AAEX;AAEA,IAAM,yBAAyB,UAAoB,MAAgC;CACjF,IAAI;CACJ,IAAI;CACJ,IAAI,OAAO,MAAM,YAAY,eAAe,UAAU,CAAC,GAAG;EACxD,KAAK;EACL,SAAS,SAAS,SAAS,EAAE,CAAC;CAChC;CACA,IAAI,CAAC,UAAU,eAAe,UAAU,SAAS,UAAU,EAAE,MAAM,GAAG;EACpE,KAAK;EACL,SAAS,SAAS,SAAS,SAAS,UAAU,CAAC,OAAO,CAAC;CACzD;CACA,IAAI,CAAC,UAAU,SAAS,QAAQ;EAC9B,KAAK;EACL,SAAS,SAAS;CACpB;CACA,MAAM,iBAAiB,GAAG,EAAE;CAC5B,OAAO;AACT;AAEA,SAAS,gBAAgB,SAAkB,MAAY,QAAwB;CAC7E,MAAM,4BAA4B;CAClC,MAAM,YAAY,OAAO;CAEzB,UAAU,IACR,CAAC,QAAQ,+BAA+B,QAAQ,sBAAsB,GACtE,oBAAoB,MAAM,MAAM,GAChC,eACE,KACA,KACA,MACe;EACf,MAAM,YAAY;EAClB,MAAM,OAAQ,IAAuD;EACrE,MAAM,kBAAkB,IAAI;EAC5B,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,WAAY,MAAM,QAAQ,oBAAoB;IAClD;IACA,aAAa;IACb,aAAa;IACb;GACF,CAAC;GACD,MAAM,iBAAiB,UAAU,IAAI;GAErC,MAAM,EAAE,MAAM,IAAI;GAElB,IAAI;GACJ,IAAI,OAAO,MAAM,UAAU;IACzB,mBAAmB,eAAe,UAAU,CAAC;IAC7C,IAAI,CAAC,kBAAkB;KACrB,MAAM,+BAA+B,GAAG,IAAI;KAC5C,IAAI,OAAO,YAAY,SAAS;KAChC,IAAI,IAAI;KACR;IACF;GACF;GACA,IAAI,IAAI,YAAY,cAAc,QAAQ,eAAe;GAEzD,KAAK,UADU,sBAAsB,UAAU,gBAChC,CAAM,CAAC;EACxB,SAAS,KAAK;GACZ,KAAK,GAAG;EACV;CACF,CACF;CACA,OAAO;AACT"}

package/build/api/scoped-access.d.ts

@@ -0,0 +1,14 @@
+import type { Auth } from '@verdaccio/auth';
+import type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';
+import type { Config } from '@verdaccio/types';
+/**
+ * Builds the package name from the route params; returns null for a malformed
+ * `:scope` segment.
+ */
+type Param = string | string[] | undefined;
+export declare function resolveScopedName(rawScope: Param, rawPackage: Param): string | null;
+/**
+ * Validates the route params and checks access before the handlers run.
+ */
+export declare function scopedPackageAccess(auth: Auth, config: Config): (req: $RequestExtend, _res: $ResponseExtend, next: $NextFunctionVer) => void;
+export {};

package/build/api/scoped-access.js

@@ -0,0 +1,33 @@
+const require_web_utils = require("../web-utils.js");
+let _verdaccio_core = require("@verdaccio/core");
+let _verdaccio_config = require("@verdaccio/config");
+//#region src/api/scoped-access.ts
+function resolveScopedName(rawScope, rawPackage) {
+	const packageName = _verdaccio_core.reqUtils.paramToString(rawPackage);
+	const scope = _verdaccio_core.reqUtils.paramToString(rawScope);
+	if (!scope) return packageName;
+	if (scope[0] !== "@") return null;
+	const name = require_web_utils.addScope(scope.slice(1), packageName);
+	return _verdaccio_core.validationUtils.validatePackage(name) && !name.includes("*") ? name : null;
+}
+/**
+* Validates the route params and checks access before the handlers run.
+*/
+function scopedPackageAccess(auth, config) {
+	return function(req, _res, next) {
+		const packageName = resolveScopedName(req.params.scope, req.params.package);
+		if (packageName === null) return next(_verdaccio_core.errorUtils.getNotFound());
+		req.scopedPackageName = packageName;
+		const remoteUser = require_web_utils.hasLogin(config) ? req.remote_user : (0, _verdaccio_config.createAnonymousRemoteUser)();
+		auth.allow_access({ packageName }, remoteUser, (err, allowed) => {
+			if (err) return next(err);
+			if (allowed) return next();
+			return next(_verdaccio_core.errorUtils.getForbidden());
+		});
+	};
+}
+//#endregion
+exports.resolveScopedName = resolveScopedName;
+exports.scopedPackageAccess = scopedPackageAccess;
+
+//# sourceMappingURL=scoped-access.js.map

package/build/api/scoped-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-access.js","names":[],"sources":["../../src/api/scoped-access.ts"],"sourcesContent":["import type { Auth } from '@verdaccio/auth';\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport { errorUtils, reqUtils, validationUtils } from '@verdaccio/core';\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';\nimport type { Config, RemoteUser } from '@verdaccio/types';\n\nimport { addScope, hasLogin } from '../web-utils';\n\n/**\n * Builds the package name from the route params; returns null for a malformed\n * `:scope` segment.\n */\ntype Param = string | string[] | undefined;\n\nexport function resolveScopedName(rawScope: Param, rawPackage: Param): string | null {\n  const packageName = reqUtils.paramToString(rawPackage);\n  const scope = reqUtils.paramToString(rawScope);\n  if (!scope) {\n    return packageName;\n  }\n  if (scope[0] !== '@') {\n    return null;\n  }\n  const name = addScope(scope.slice(1), packageName);\n  return validationUtils.validatePackage(name) && !name.includes('*') ? name : null;\n}\n\n/**\n * Validates the route params and checks access before the handlers run.\n */\nexport function scopedPackageAccess(auth: Auth, config: Config) {\n  return function (req: $RequestExtend, _res: $ResponseExtend, next: $NextFunctionVer): void {\n    const packageName = resolveScopedName(req.params.scope, req.params.package);\n    if (packageName === null) {\n      return next(errorUtils.getNotFound());\n    }\n    (req as $RequestExtend & { scopedPackageName?: string }).scopedPackageName = packageName;\n    const remoteUser: RemoteUser = hasLogin(config) ? req.remote_user : createAnonymousRemoteUser();\n    auth.allow_access({ packageName }, remoteUser, (err, allowed): void => {\n      if (err) {\n        return next(err);\n      }\n      if (allowed) {\n        return next();\n      }\n      return next(errorUtils.getForbidden());\n    });\n  };\n}\n"],"mappings":";;;;AAcA,SAAgB,kBAAkB,UAAiB,YAAkC;CACnF,MAAM,cAAc,gBAAA,SAAS,cAAc,UAAU;CACrD,MAAM,QAAQ,gBAAA,SAAS,cAAc,QAAQ;CAC7C,IAAI,CAAC,OACH,OAAO;CAET,IAAI,MAAM,OAAO,KACf,OAAO;CAET,MAAM,OAAO,kBAAA,SAAS,MAAM,MAAM,CAAC,GAAG,WAAW;CACjD,OAAO,gBAAA,gBAAgB,gBAAgB,IAAI,KAAK,CAAC,KAAK,SAAS,GAAG,IAAI,OAAO;AAC/E;;;;AAKA,SAAgB,oBAAoB,MAAY,QAAgB;CAC9D,OAAO,SAAU,KAAqB,MAAuB,MAA8B;EACzF,MAAM,cAAc,kBAAkB,IAAI,OAAO,OAAO,IAAI,OAAO,OAAO;EAC1E,IAAI,gBAAgB,MAClB,OAAO,KAAK,gBAAA,WAAW,YAAY,CAAC;EAEtC,IAAyD,oBAAoB;EAC7E,MAAM,aAAyB,kBAAA,SAAS,MAAM,IAAI,IAAI,eAAA,GAAc,kBAAA,0BAAA,CAA0B;EAC9F,KAAK,aAAa,EAAE,YAAY,GAAG,aAAa,KAAK,YAAkB;GACrE,IAAI,KACF,OAAO,KAAK,GAAG;GAEjB,IAAI,SACF,OAAO,KAAK;GAEd,OAAO,KAAK,gBAAA,WAAW,aAAa,CAAC;EACvC,CAAC;CACH;AACF"}

package/build/api/scoped-access.mjs

@@ -0,0 +1,32 @@
+import { addScope, hasLogin } from "../web-utils.mjs";
+import { errorUtils, reqUtils, validationUtils } from "@verdaccio/core";
+import { createAnonymousRemoteUser } from "@verdaccio/config";
+//#region src/api/scoped-access.ts
+function resolveScopedName(rawScope, rawPackage) {
+	const packageName = reqUtils.paramToString(rawPackage);
+	const scope = reqUtils.paramToString(rawScope);
+	if (!scope) return packageName;
+	if (scope[0] !== "@") return null;
+	const name = addScope(scope.slice(1), packageName);
+	return validationUtils.validatePackage(name) && !name.includes("*") ? name : null;
+}
+/**
+* Validates the route params and checks access before the handlers run.
+*/
+function scopedPackageAccess(auth, config) {
+	return function(req, _res, next) {
+		const packageName = resolveScopedName(req.params.scope, req.params.package);
+		if (packageName === null) return next(errorUtils.getNotFound());
+		req.scopedPackageName = packageName;
+		const remoteUser = hasLogin(config) ? req.remote_user : createAnonymousRemoteUser();
+		auth.allow_access({ packageName }, remoteUser, (err, allowed) => {
+			if (err) return next(err);
+			if (allowed) return next();
+			return next(errorUtils.getForbidden());
+		});
+	};
+}
+//#endregion
+export { resolveScopedName, scopedPackageAccess };
+
+//# sourceMappingURL=scoped-access.mjs.map

package/build/api/scoped-access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-access.mjs","names":[],"sources":["../../src/api/scoped-access.ts"],"sourcesContent":["import type { Auth } from '@verdaccio/auth';\nimport { createAnonymousRemoteUser } from '@verdaccio/config';\nimport { errorUtils, reqUtils, validationUtils } from '@verdaccio/core';\nimport type { $NextFunctionVer, $RequestExtend, $ResponseExtend } from '@verdaccio/middleware';\nimport type { Config, RemoteUser } from '@verdaccio/types';\n\nimport { addScope, hasLogin } from '../web-utils';\n\n/**\n * Builds the package name from the route params; returns null for a malformed\n * `:scope` segment.\n */\ntype Param = string | string[] | undefined;\n\nexport function resolveScopedName(rawScope: Param, rawPackage: Param): string | null {\n  const packageName = reqUtils.paramToString(rawPackage);\n  const scope = reqUtils.paramToString(rawScope);\n  if (!scope) {\n    return packageName;\n  }\n  if (scope[0] !== '@') {\n    return null;\n  }\n  const name = addScope(scope.slice(1), packageName);\n  return validationUtils.validatePackage(name) && !name.includes('*') ? name : null;\n}\n\n/**\n * Validates the route params and checks access before the handlers run.\n */\nexport function scopedPackageAccess(auth: Auth, config: Config) {\n  return function (req: $RequestExtend, _res: $ResponseExtend, next: $NextFunctionVer): void {\n    const packageName = resolveScopedName(req.params.scope, req.params.package);\n    if (packageName === null) {\n      return next(errorUtils.getNotFound());\n    }\n    (req as $RequestExtend & { scopedPackageName?: string }).scopedPackageName = packageName;\n    const remoteUser: RemoteUser = hasLogin(config) ? req.remote_user : createAnonymousRemoteUser();\n    auth.allow_access({ packageName }, remoteUser, (err, allowed): void => {\n      if (err) {\n        return next(err);\n      }\n      if (allowed) {\n        return next();\n      }\n      return next(errorUtils.getForbidden());\n    });\n  };\n}\n"],"mappings":";;;;AAcA,SAAgB,kBAAkB,UAAiB,YAAkC;CACnF,MAAM,cAAc,SAAS,cAAc,UAAU;CACrD,MAAM,QAAQ,SAAS,cAAc,QAAQ;CAC7C,IAAI,CAAC,OACH,OAAO;CAET,IAAI,MAAM,OAAO,KACf,OAAO;CAET,MAAM,OAAO,SAAS,MAAM,MAAM,CAAC,GAAG,WAAW;CACjD,OAAO,gBAAgB,gBAAgB,IAAI,KAAK,CAAC,KAAK,SAAS,GAAG,IAAI,OAAO;AAC/E;;;;AAKA,SAAgB,oBAAoB,MAAY,QAAgB;CAC9D,OAAO,SAAU,KAAqB,MAAuB,MAA8B;EACzF,MAAM,cAAc,kBAAkB,IAAI,OAAO,OAAO,IAAI,OAAO,OAAO;EAC1E,IAAI,gBAAgB,MAClB,OAAO,KAAK,WAAW,YAAY,CAAC;EAEtC,IAAyD,oBAAoB;EAC7E,MAAM,aAAyB,SAAS,MAAM,IAAI,IAAI,cAAc,0BAA0B;EAC9F,KAAK,aAAa,EAAE,YAAY,GAAG,aAAa,KAAK,YAAkB;GACrE,IAAI,KACF,OAAO,KAAK,GAAG;GAEjB,IAAI,SACF,OAAO,KAAK;GAEd,OAAO,KAAK,WAAW,aAAa,CAAC;EACvC,CAAC;CACH;AACF"}

package/build/api/sidebar.js

@@ -1,11 +1,11 @@
 const require_runtime = require("../_virtual/_rolldown/runtime.js");
 const require_web_utils = require("../web-utils.js");
 const require_author_utils = require("../author-utils.js");
+const require_scoped_access = require("./scoped-access.js");
 let debug = require("debug");
 debug = require_runtime.__toESM(debug);
 let express = require("express");
 let _verdaccio_core = require("@verdaccio/core");
-let _verdaccio_logger = require("@verdaccio/logger");
 let _verdaccio_middleware = require("@verdaccio/middleware");
 let _verdaccio_tarball = require("@verdaccio/tarball");
 //#region src/api/sidebar.ts
@@ -13,14 +13,8 @@ var debug$1 = (0, debug.default)("verdaccio:web:api:sidebar");
 function addSidebarWebApi(config, storage, auth) {
 	debug$1("initialized sidebar web api");
 	const router = (0, express.Router)();
-	const can = (0, _verdaccio_middleware.allow)(auth, {
-		beforeAll: (a, b) => _verdaccio_logger.logger.trace(a, b),
-		afterAll: (a, b) => _verdaccio_logger.logger.trace(a, b)
-	});
-	router.get([_verdaccio_middleware.WebUrls.sidebar_scopped_package, _verdaccio_middleware.WebUrls.sidebar_package], can("access"), async function(req, res, next) {
-		const scope = _verdaccio_core.reqUtils.paramToString(req.params.scope).replace(/^@/, "");
-		const packageName = _verdaccio_core.reqUtils.paramToString(req.params.package);
-		const name = scope ? require_web_utils.addScope(scope, packageName) : packageName;
+	router.get([_verdaccio_middleware.WebUrls.sidebar_scopped_package, _verdaccio_middleware.WebUrls.sidebar_package], require_scoped_access.scopedPackageAccess(auth, config), async function(req, res, next) {
+		const name = req.scopedPackageName;
 		const requestOptions = (0, _verdaccio_middleware.getRequestOptions)(req);
 		try {
 			const info = await storage.getPackageByOptions({
@@ -30,15 +24,31 @@ function addSidebarWebApi(config, storage, auth) {
 				requestOptions
 			});
 			const { v } = req.query;
+			let requestedVersion;
+			if (typeof v === "string") {
+				requestedVersion = require_web_utils.resolveVersion(info, v);
+				if (!requestedVersion) {
+					debug$1("version %o not found for %o", v, name);
+					res.status(_verdaccio_core.HTTP_STATUS.NOT_FOUND);
+					res.end();
+					return;
+				}
+			}
 			let sideBarInfo = { ...info };
 			sideBarInfo.versions = (0, _verdaccio_tarball.convertDistRemoteToLocalTarballUrls)(info, requestOptions, config.url_prefix).versions;
-			if (typeof v === "string" && require_web_utils.isVersionValid(info, v)) {
-				sideBarInfo.latest = sideBarInfo.versions[v];
-				sideBarInfo.latest.author = require_author_utils.formatAuthor(sideBarInfo.latest.author);
-			} else {
-				sideBarInfo.latest = sideBarInfo.versions[info[_verdaccio_core.DIST_TAGS].latest];
-				sideBarInfo.latest.author = require_author_utils.formatAuthor(sideBarInfo.latest.author);
+			if (requestedVersion) sideBarInfo.latest = sideBarInfo.versions[requestedVersion];
+			else {
+				const latestTag = info[_verdaccio_core.DIST_TAGS]?.latest;
+				const versionKeys = Object.keys(sideBarInfo.versions);
+				const latestVersion = typeof latestTag === "string" && sideBarInfo.versions[latestTag] ? latestTag : _verdaccio_core.pkgUtils.semverSort(versionKeys).pop() ?? versionKeys.pop();
+				if (!latestVersion) {
+					res.status(_verdaccio_core.HTTP_STATUS.NOT_FOUND);
+					res.end();
+					return;
+				}
+				sideBarInfo.latest = sideBarInfo.versions[latestVersion];
 			}
+			sideBarInfo.latest.author = require_author_utils.formatAuthor(sideBarInfo.latest.author);
 			sideBarInfo = require_web_utils.deleteProperties([
 				"readme",
 				"_attachments",

package/build/api/sidebar.js.map

@@ -1 +1 @@
-{"version":3,"file":"sidebar.js","names":[],"sources":["../../src/api/sidebar.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HTTP_STATUS, reqUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  allow,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';\nimport type { Config, Manifest, WebManifest } from '@verdaccio/types';\n\nimport { addGravatarSupport, formatAuthor } from '../author-utils';\nimport { addScope, deleteProperties, isVersionValid } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst debug = buildDebug('verdaccio:web:api:sidebar');\n\nfunction addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {\n  debug('initialized sidebar web api');\n  const router = Router(); /* eslint new-cap: 0 */\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  // Get package sidebar\n  router.get(\n    [WebUrls.sidebar_scopped_package, WebUrls.sidebar_package],\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const scope = reqUtils.paramToString(req.params.scope).replace(/^@/, '');\n      const packageName = reqUtils.paramToString(req.params.package);\n      const name = scope ? addScope(scope, packageName) : packageName;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const info = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          keepUpLinkData: true,\n          requestOptions,\n        })) as Manifest;\n        // TODO: sanitize query\n        const { v } = req.query;\n        let sideBarInfo = { ...info } as WebManifest;\n        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(\n          info,\n          requestOptions,\n          config.url_prefix\n        ).versions;\n        if (typeof v === 'string' && isVersionValid(info, v)) {\n          sideBarInfo.latest = sideBarInfo.versions[v];\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        } else {\n          sideBarInfo.latest = sideBarInfo.versions[info[DIST_TAGS].latest];\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        }\n        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);\n        const authorAvatar = config.web\n          ? addGravatarSupport(sideBarInfo, config.web.gravatar)\n          : addGravatarSupport(sideBarInfo);\n        next(authorAvatar);\n      } catch {\n        res.status(HTTP_STATUS.NOT_FOUND);\n        res.end();\n      }\n    }\n  );\n\n  return router;\n}\n\nexport default addSidebarWebApi;\n"],"mappings":";;;;;;;;;;;AAuBA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,2BAA2B;AAEpD,SAAS,iBAAiB,QAAgB,SAAkB,MAAoB;CAC9E,QAAM,6BAA6B;CACnC,MAAM,UAAA,GAAS,QAAA,OAAA,CAAO;CACtB,MAAM,OAAA,GAAM,sBAAA,MAAA,CAAM,MAAM;EACtB,YAAY,GAAG,MAAM,kBAAA,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,kBAAA,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CAED,OAAO,IACL,CAAC,sBAAA,QAAQ,yBAAyB,sBAAA,QAAQ,eAAe,GACzD,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,QAAQ,gBAAA,SAAS,cAAc,IAAI,OAAO,KAAK,CAAC,CAAC,QAAQ,MAAM,EAAE;EACvE,MAAM,cAAc,gBAAA,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,OAAO,QAAQ,kBAAA,SAAS,OAAO,WAAW,IAAI;EACpD,MAAM,kBAAA,GAAiB,sBAAA,kBAAA,CAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,OAAQ,MAAM,QAAQ,oBAAoB;IAC9C;IACA,aAAa;IACb,gBAAgB;IAChB;GACF,CAAC;GAED,MAAM,EAAE,MAAM,IAAI;GAClB,IAAI,cAAc,EAAE,GAAG,KAAK;GAC5B,YAAY,YAAA,GAAW,mBAAA,oCAAA,CACrB,MACA,gBACA,OAAO,UACT,CAAC,CAAC;GACF,IAAI,OAAO,MAAM,YAAY,kBAAA,eAAe,MAAM,CAAC,GAAG;IACpD,YAAY,SAAS,YAAY,SAAS;IAC1C,YAAY,OAAO,SAAS,qBAAA,aAAa,YAAY,OAAO,MAAM;GACpE,OAAO;IACL,YAAY,SAAS,YAAY,SAAS,KAAK,gBAAA,UAAU,CAAC;IAC1D,YAAY,OAAO,SAAS,qBAAA,aAAa,YAAY,OAAO,MAAM;GACpE;GACA,cAAc,kBAAA,iBAAiB;IAAC;IAAU;IAAgB;IAAQ;GAAM,GAAG,WAAW;GAItF,KAHqB,OAAO,MACxB,qBAAA,mBAAmB,aAAa,OAAO,IAAI,QAAQ,IACnD,qBAAA,mBAAmB,WAAW,CACjB;EACnB,QAAQ;GACN,IAAI,OAAO,gBAAA,YAAY,SAAS;GAChC,IAAI,IAAI;EACV;CACF,CACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"sidebar.js","names":[],"sources":["../../src/api/sidebar.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HTTP_STATUS, pkgUtils } from '@verdaccio/core';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';\nimport type { Config, Manifest, WebManifest } from '@verdaccio/types';\n\nimport { addGravatarSupport, formatAuthor } from '../author-utils';\nimport { deleteProperties, resolveVersion } from '../web-utils';\nimport { scopedPackageAccess } from './scoped-access';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst debug = buildDebug('verdaccio:web:api:sidebar');\n\nfunction addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {\n  debug('initialized sidebar web api');\n  const router = Router(); /* eslint new-cap: 0 */\n  // Get package sidebar\n  router.get(\n    [WebUrls.sidebar_scopped_package, WebUrls.sidebar_package],\n    scopedPackageAccess(auth, config),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = (req as $RequestExtend & { scopedPackageName: string }).scopedPackageName;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const info = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          keepUpLinkData: true,\n          requestOptions,\n        })) as Manifest;\n        const { v } = req.query;\n        // `v` may be a version or a dist-tag; anything else is a 404\n        let requestedVersion: string | undefined;\n        if (typeof v === 'string') {\n          requestedVersion = resolveVersion(info, v);\n          if (!requestedVersion) {\n            debug('version %o not found for %o', v, name);\n            res.status(HTTP_STATUS.NOT_FOUND);\n            res.end();\n            return;\n          }\n        }\n        let sideBarInfo = { ...info } as WebManifest;\n        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(\n          info,\n          requestOptions,\n          config.url_prefix\n        ).versions;\n        if (requestedVersion) {\n          sideBarInfo.latest = sideBarInfo.versions[requestedVersion];\n        } else {\n          // a manifest without a resolvable dist-tags.latest (corrupt or partial\n          // uplink data) used to crash here and surface as a 404 for a package\n          // that exists; fall back to the highest available version — semver\n          // sorted, since key insertion order reflects publish order, and if\n          // every key is invalid semver (fully corrupt manifest), last key wins\n          const latestTag = info[DIST_TAGS]?.latest;\n          const versionKeys = Object.keys(sideBarInfo.versions);\n          const latestVersion =\n            typeof latestTag === 'string' && sideBarInfo.versions[latestTag]\n              ? latestTag\n              : (pkgUtils.semverSort(versionKeys).pop() ?? versionKeys.pop());\n          if (!latestVersion) {\n            res.status(HTTP_STATUS.NOT_FOUND);\n            res.end();\n            return;\n          }\n          sideBarInfo.latest = sideBarInfo.versions[latestVersion];\n        }\n        sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);\n        const authorAvatar = config.web\n          ? addGravatarSupport(sideBarInfo, config.web.gravatar)\n          : addGravatarSupport(sideBarInfo);\n        next(authorAvatar);\n      } catch {\n        res.status(HTTP_STATUS.NOT_FOUND);\n        res.end();\n      }\n    }\n  );\n\n  return router;\n}\n\nexport default addSidebarWebApi;\n"],"mappings":";;;;;;;;;;;AAsBA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,2BAA2B;AAEpD,SAAS,iBAAiB,QAAgB,SAAkB,MAAoB;CAC9E,QAAM,6BAA6B;CACnC,MAAM,UAAA,GAAS,QAAA,OAAA,CAAO;CAEtB,OAAO,IACL,CAAC,sBAAA,QAAQ,yBAAyB,sBAAA,QAAQ,eAAe,GACzD,sBAAA,oBAAoB,MAAM,MAAM,GAChC,eACE,KACA,KACA,MACe;EACf,MAAM,OAAQ,IAAuD;EACrE,MAAM,kBAAA,GAAiB,sBAAA,kBAAA,CAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,OAAQ,MAAM,QAAQ,oBAAoB;IAC9C;IACA,aAAa;IACb,gBAAgB;IAChB;GACF,CAAC;GACD,MAAM,EAAE,MAAM,IAAI;GAElB,IAAI;GACJ,IAAI,OAAO,MAAM,UAAU;IACzB,mBAAmB,kBAAA,eAAe,MAAM,CAAC;IACzC,IAAI,CAAC,kBAAkB;KACrB,QAAM,+BAA+B,GAAG,IAAI;KAC5C,IAAI,OAAO,gBAAA,YAAY,SAAS;KAChC,IAAI,IAAI;KACR;IACF;GACF;GACA,IAAI,cAAc,EAAE,GAAG,KAAK;GAC5B,YAAY,YAAA,GAAW,mBAAA,oCAAA,CACrB,MACA,gBACA,OAAO,UACT,CAAC,CAAC;GACF,IAAI,kBACF,YAAY,SAAS,YAAY,SAAS;QACrC;IAML,MAAM,YAAY,KAAK,gBAAA,UAAU,EAAE;IACnC,MAAM,cAAc,OAAO,KAAK,YAAY,QAAQ;IACpD,MAAM,gBACJ,OAAO,cAAc,YAAY,YAAY,SAAS,aAClD,YACC,gBAAA,SAAS,WAAW,WAAW,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI;IACjE,IAAI,CAAC,eAAe;KAClB,IAAI,OAAO,gBAAA,YAAY,SAAS;KAChC,IAAI,IAAI;KACR;IACF;IACA,YAAY,SAAS,YAAY,SAAS;GAC5C;GACA,YAAY,OAAO,SAAS,qBAAA,aAAa,YAAY,OAAO,MAAM;GAClE,cAAc,kBAAA,iBAAiB;IAAC;IAAU;IAAgB;IAAQ;GAAM,GAAG,WAAW;GAItF,KAHqB,OAAO,MACxB,qBAAA,mBAAmB,aAAa,OAAO,IAAI,QAAQ,IACnD,qBAAA,mBAAmB,WAAW,CACjB;EACnB,QAAQ;GACN,IAAI,OAAO,gBAAA,YAAY,SAAS;GAChC,IAAI,IAAI;EACV;CACF,CACF;CAEA,OAAO;AACT"}

package/build/api/sidebar.mjs

@@ -1,24 +1,18 @@
-import { addScope, deleteProperties, isVersionValid } from "../web-utils.mjs";
+import { deleteProperties, resolveVersion } from "../web-utils.mjs";
 import { addGravatarSupport, formatAuthor } from "../author-utils.mjs";
+import { scopedPackageAccess } from "./scoped-access.mjs";
 import buildDebug from "debug";
 import { Router } from "express";
-import { DIST_TAGS, HTTP_STATUS, reqUtils } from "@verdaccio/core";
-import { logger } from "@verdaccio/logger";
-import { WebUrls, allow, getRequestOptions } from "@verdaccio/middleware";
+import { DIST_TAGS, HTTP_STATUS, pkgUtils } from "@verdaccio/core";
+import { WebUrls, getRequestOptions } from "@verdaccio/middleware";
 import { convertDistRemoteToLocalTarballUrls } from "@verdaccio/tarball";
 //#region src/api/sidebar.ts
 var debug = buildDebug("verdaccio:web:api:sidebar");
 function addSidebarWebApi(config, storage, auth) {
 	debug("initialized sidebar web api");
 	const router = Router();
-	const can = allow(auth, {
-		beforeAll: (a, b) => logger.trace(a, b),
-		afterAll: (a, b) => logger.trace(a, b)
-	});
-	router.get([WebUrls.sidebar_scopped_package, WebUrls.sidebar_package], can("access"), async function(req, res, next) {
-		const scope = reqUtils.paramToString(req.params.scope).replace(/^@/, "");
-		const packageName = reqUtils.paramToString(req.params.package);
-		const name = scope ? addScope(scope, packageName) : packageName;
+	router.get([WebUrls.sidebar_scopped_package, WebUrls.sidebar_package], scopedPackageAccess(auth, config), async function(req, res, next) {
+		const name = req.scopedPackageName;
 		const requestOptions = getRequestOptions(req);
 		try {
 			const info = await storage.getPackageByOptions({
@@ -28,15 +22,31 @@ function addSidebarWebApi(config, storage, auth) {
 				requestOptions
 			});
 			const { v } = req.query;
+			let requestedVersion;
+			if (typeof v === "string") {
+				requestedVersion = resolveVersion(info, v);
+				if (!requestedVersion) {
+					debug("version %o not found for %o", v, name);
+					res.status(HTTP_STATUS.NOT_FOUND);
+					res.end();
+					return;
+				}
+			}
 			let sideBarInfo = { ...info };
 			sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(info, requestOptions, config.url_prefix).versions;
-			if (typeof v === "string" && isVersionValid(info, v)) {
-				sideBarInfo.latest = sideBarInfo.versions[v];
-				sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);
-			} else {
-				sideBarInfo.latest = sideBarInfo.versions[info[DIST_TAGS].latest];
-				sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);
+			if (requestedVersion) sideBarInfo.latest = sideBarInfo.versions[requestedVersion];
+			else {
+				const latestTag = info[DIST_TAGS]?.latest;
+				const versionKeys = Object.keys(sideBarInfo.versions);
+				const latestVersion = typeof latestTag === "string" && sideBarInfo.versions[latestTag] ? latestTag : pkgUtils.semverSort(versionKeys).pop() ?? versionKeys.pop();
+				if (!latestVersion) {
+					res.status(HTTP_STATUS.NOT_FOUND);
+					res.end();
+					return;
+				}
+				sideBarInfo.latest = sideBarInfo.versions[latestVersion];
 			}
+			sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);
 			sideBarInfo = deleteProperties([
 				"readme",
 				"_attachments",

package/build/api/sidebar.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"sidebar.mjs","names":[],"sources":["../../src/api/sidebar.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HTTP_STATUS, reqUtils } from '@verdaccio/core';\nimport { logger } from '@verdaccio/logger';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  allow,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';\nimport type { Config, Manifest, WebManifest } from '@verdaccio/types';\n\nimport { addGravatarSupport, formatAuthor } from '../author-utils';\nimport { addScope, deleteProperties, isVersionValid } from '../web-utils';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst debug = buildDebug('verdaccio:web:api:sidebar');\n\nfunction addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {\n  debug('initialized sidebar web api');\n  const router = Router(); /* eslint new-cap: 0 */\n  const can = allow(auth, {\n    beforeAll: (a, b) => logger.trace(a, b),\n    afterAll: (a, b) => logger.trace(a, b),\n  });\n  // Get package sidebar\n  router.get(\n    [WebUrls.sidebar_scopped_package, WebUrls.sidebar_package],\n    can('access'),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const scope = reqUtils.paramToString(req.params.scope).replace(/^@/, '');\n      const packageName = reqUtils.paramToString(req.params.package);\n      const name = scope ? addScope(scope, packageName) : packageName;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const info = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          keepUpLinkData: true,\n          requestOptions,\n        })) as Manifest;\n        // TODO: sanitize query\n        const { v } = req.query;\n        let sideBarInfo = { ...info } as WebManifest;\n        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(\n          info,\n          requestOptions,\n          config.url_prefix\n        ).versions;\n        if (typeof v === 'string' && isVersionValid(info, v)) {\n          sideBarInfo.latest = sideBarInfo.versions[v];\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        } else {\n          sideBarInfo.latest = sideBarInfo.versions[info[DIST_TAGS].latest];\n          sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        }\n        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);\n        const authorAvatar = config.web\n          ? addGravatarSupport(sideBarInfo, config.web.gravatar)\n          : addGravatarSupport(sideBarInfo);\n        next(authorAvatar);\n      } catch {\n        res.status(HTTP_STATUS.NOT_FOUND);\n        res.end();\n      }\n    }\n  );\n\n  return router;\n}\n\nexport default addSidebarWebApi;\n"],"mappings":";;;;;;;;;AAuBA,IAAM,QAAQ,WAAW,2BAA2B;AAEpD,SAAS,iBAAiB,QAAgB,SAAkB,MAAoB;CAC9E,MAAM,6BAA6B;CACnC,MAAM,SAAS,OAAO;CACtB,MAAM,MAAM,MAAM,MAAM;EACtB,YAAY,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;EACtC,WAAW,GAAG,MAAM,OAAO,MAAM,GAAG,CAAC;CACvC,CAAC;CAED,OAAO,IACL,CAAC,QAAQ,yBAAyB,QAAQ,eAAe,GACzD,IAAI,QAAQ,GACZ,eACE,KACA,KACA,MACe;EACf,MAAM,QAAQ,SAAS,cAAc,IAAI,OAAO,KAAK,CAAC,CAAC,QAAQ,MAAM,EAAE;EACvE,MAAM,cAAc,SAAS,cAAc,IAAI,OAAO,OAAO;EAC7D,MAAM,OAAO,QAAQ,SAAS,OAAO,WAAW,IAAI;EACpD,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,OAAQ,MAAM,QAAQ,oBAAoB;IAC9C;IACA,aAAa;IACb,gBAAgB;IAChB;GACF,CAAC;GAED,MAAM,EAAE,MAAM,IAAI;GAClB,IAAI,cAAc,EAAE,GAAG,KAAK;GAC5B,YAAY,WAAW,oCACrB,MACA,gBACA,OAAO,UACT,CAAC,CAAC;GACF,IAAI,OAAO,MAAM,YAAY,eAAe,MAAM,CAAC,GAAG;IACpD,YAAY,SAAS,YAAY,SAAS;IAC1C,YAAY,OAAO,SAAS,aAAa,YAAY,OAAO,MAAM;GACpE,OAAO;IACL,YAAY,SAAS,YAAY,SAAS,KAAK,UAAU,CAAC;IAC1D,YAAY,OAAO,SAAS,aAAa,YAAY,OAAO,MAAM;GACpE;GACA,cAAc,iBAAiB;IAAC;IAAU;IAAgB;IAAQ;GAAM,GAAG,WAAW;GAItF,KAHqB,OAAO,MACxB,mBAAmB,aAAa,OAAO,IAAI,QAAQ,IACnD,mBAAmB,WAAW,CACjB;EACnB,QAAQ;GACN,IAAI,OAAO,YAAY,SAAS;GAChC,IAAI,IAAI;EACV;CACF,CACF;CAEA,OAAO;AACT"}
+{"version":3,"file":"sidebar.mjs","names":[],"sources":["../../src/api/sidebar.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport { Router } from 'express';\n\nimport type { Auth } from '@verdaccio/auth';\nimport { DIST_TAGS, HTTP_STATUS, pkgUtils } from '@verdaccio/core';\nimport {\n  $NextFunctionVer,\n  $RequestExtend,\n  $ResponseExtend,\n  WebUrls,\n  getRequestOptions,\n} from '@verdaccio/middleware';\nimport type { Storage } from '@verdaccio/store';\nimport { convertDistRemoteToLocalTarballUrls } from '@verdaccio/tarball';\nimport type { Config, Manifest, WebManifest } from '@verdaccio/types';\n\nimport { addGravatarSupport, formatAuthor } from '../author-utils';\nimport { deleteProperties, resolveVersion } from '../web-utils';\nimport { scopedPackageAccess } from './scoped-access';\n\nexport { $RequestExtend, $ResponseExtend, $NextFunctionVer }; // Was required by other packages\n\nconst debug = buildDebug('verdaccio:web:api:sidebar');\n\nfunction addSidebarWebApi(config: Config, storage: Storage, auth: Auth): Router {\n  debug('initialized sidebar web api');\n  const router = Router(); /* eslint new-cap: 0 */\n  // Get package sidebar\n  router.get(\n    [WebUrls.sidebar_scopped_package, WebUrls.sidebar_package],\n    scopedPackageAccess(auth, config),\n    async function (\n      req: $RequestExtend,\n      res: $ResponseExtend,\n      next: $NextFunctionVer\n    ): Promise<void> {\n      const name = (req as $RequestExtend & { scopedPackageName: string }).scopedPackageName;\n      const requestOptions = getRequestOptions(req);\n      try {\n        const info = (await storage.getPackageByOptions({\n          name,\n          uplinksLook: true,\n          keepUpLinkData: true,\n          requestOptions,\n        })) as Manifest;\n        const { v } = req.query;\n        // `v` may be a version or a dist-tag; anything else is a 404\n        let requestedVersion: string | undefined;\n        if (typeof v === 'string') {\n          requestedVersion = resolveVersion(info, v);\n          if (!requestedVersion) {\n            debug('version %o not found for %o', v, name);\n            res.status(HTTP_STATUS.NOT_FOUND);\n            res.end();\n            return;\n          }\n        }\n        let sideBarInfo = { ...info } as WebManifest;\n        sideBarInfo.versions = convertDistRemoteToLocalTarballUrls(\n          info,\n          requestOptions,\n          config.url_prefix\n        ).versions;\n        if (requestedVersion) {\n          sideBarInfo.latest = sideBarInfo.versions[requestedVersion];\n        } else {\n          // a manifest without a resolvable dist-tags.latest (corrupt or partial\n          // uplink data) used to crash here and surface as a 404 for a package\n          // that exists; fall back to the highest available version — semver\n          // sorted, since key insertion order reflects publish order, and if\n          // every key is invalid semver (fully corrupt manifest), last key wins\n          const latestTag = info[DIST_TAGS]?.latest;\n          const versionKeys = Object.keys(sideBarInfo.versions);\n          const latestVersion =\n            typeof latestTag === 'string' && sideBarInfo.versions[latestTag]\n              ? latestTag\n              : (pkgUtils.semverSort(versionKeys).pop() ?? versionKeys.pop());\n          if (!latestVersion) {\n            res.status(HTTP_STATUS.NOT_FOUND);\n            res.end();\n            return;\n          }\n          sideBarInfo.latest = sideBarInfo.versions[latestVersion];\n        }\n        sideBarInfo.latest.author = formatAuthor(sideBarInfo.latest.author);\n        sideBarInfo = deleteProperties(['readme', '_attachments', '_rev', 'name'], sideBarInfo);\n        const authorAvatar = config.web\n          ? addGravatarSupport(sideBarInfo, config.web.gravatar)\n          : addGravatarSupport(sideBarInfo);\n        next(authorAvatar);\n      } catch {\n        res.status(HTTP_STATUS.NOT_FOUND);\n        res.end();\n      }\n    }\n  );\n\n  return router;\n}\n\nexport default addSidebarWebApi;\n"],"mappings":";;;;;;;;;AAsBA,IAAM,QAAQ,WAAW,2BAA2B;AAEpD,SAAS,iBAAiB,QAAgB,SAAkB,MAAoB;CAC9E,MAAM,6BAA6B;CACnC,MAAM,SAAS,OAAO;CAEtB,OAAO,IACL,CAAC,QAAQ,yBAAyB,QAAQ,eAAe,GACzD,oBAAoB,MAAM,MAAM,GAChC,eACE,KACA,KACA,MACe;EACf,MAAM,OAAQ,IAAuD;EACrE,MAAM,iBAAiB,kBAAkB,GAAG;EAC5C,IAAI;GACF,MAAM,OAAQ,MAAM,QAAQ,oBAAoB;IAC9C;IACA,aAAa;IACb,gBAAgB;IAChB;GACF,CAAC;GACD,MAAM,EAAE,MAAM,IAAI;GAElB,IAAI;GACJ,IAAI,OAAO,MAAM,UAAU;IACzB,mBAAmB,eAAe,MAAM,CAAC;IACzC,IAAI,CAAC,kBAAkB;KACrB,MAAM,+BAA+B,GAAG,IAAI;KAC5C,IAAI,OAAO,YAAY,SAAS;KAChC,IAAI,IAAI;KACR;IACF;GACF;GACA,IAAI,cAAc,EAAE,GAAG,KAAK;GAC5B,YAAY,WAAW,oCACrB,MACA,gBACA,OAAO,UACT,CAAC,CAAC;GACF,IAAI,kBACF,YAAY,SAAS,YAAY,SAAS;QACrC;IAML,MAAM,YAAY,KAAK,UAAU,EAAE;IACnC,MAAM,cAAc,OAAO,KAAK,YAAY,QAAQ;IACpD,MAAM,gBACJ,OAAO,cAAc,YAAY,YAAY,SAAS,aAClD,YACC,SAAS,WAAW,WAAW,CAAC,CAAC,IAAI,KAAK,YAAY,IAAI;IACjE,IAAI,CAAC,eAAe;KAClB,IAAI,OAAO,YAAY,SAAS;KAChC,IAAI,IAAI;KACR;IACF;IACA,YAAY,SAAS,YAAY,SAAS;GAC5C;GACA,YAAY,OAAO,SAAS,aAAa,YAAY,OAAO,MAAM;GAClE,cAAc,iBAAiB;IAAC;IAAU;IAAgB;IAAQ;GAAM,GAAG,WAAW;GAItF,KAHqB,OAAO,MACxB,mBAAmB,aAAa,OAAO,IAAI,QAAQ,IACnD,mBAAmB,WAAW,CACjB;EACnB,QAAQ;GACN,IAAI,OAAO,YAAY,SAAS;GAChC,IAAI,IAAI;EACV;CACF,CACF;CAEA,OAAO;AACT"}

package/build/api/user.d.ts

@@ -1,5 +1,5 @@
 import { Router } from 'express';
-import { type Auth } from '@verdaccio/auth';
+import type { Auth } from '@verdaccio/auth';
 import type { Config } from '@verdaccio/types';
 declare function addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router;
 export default addUserAuthApi;

package/build/api/user.js

@@ -5,7 +5,6 @@ let express = require("express");
 let lodash_es = require("lodash-es");
 let _verdaccio_core = require("@verdaccio/core");
 let _verdaccio_middleware = require("@verdaccio/middleware");
-let _verdaccio_auth = require("@verdaccio/auth");
 //#region src/api/user.ts
 var debug$1 = (0, debug.default)("verdaccio:web:api:user");
 var WEB_LOGIN_SESSION_ID = "web-login-sessionId";
@@ -68,8 +67,9 @@ function addUserAuthApi(auth, config, storage) {
 				res.json({ token: tokens[0].token });
 				return;
 			}
-			const token = name && password ? await (0, _verdaccio_auth.getApiToken)(auth, config, user, password) : void 0;
-			if (token) {
+			if (name && password) {
+				const jWTSignOptions = config.security.web.sign;
+				const token = await auth.jwtEncrypt(user, jWTSignOptions);
 				debug$1("adduser: new token %o", _verdaccio_core.cryptoUtils.mask(token, 4));
 				return next({
 					token,

package/build/api/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":[],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport { isNil } from 'lodash-es';\n\nimport { type Auth, getApiToken } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  TOKEN_BEARER,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            // Prevent the final middleware from adding WWW-Authenticate header,\n            // which triggers the browser's native basic auth popup instead of\n            // letting the WebUI handle the error in JavaScript.\n            if (errorCode === HTTP_STATUS.UNAUTHORIZED) {\n              res.set(HEADERS.WWW_AUTH, TOKEN_BEARER);\n            }\n            return next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n            return next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;;;;AAsBA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wBAAwB;AAEjD,IAAM,uBAAuB;AAE7B,SAAS,eAAe,MAAY,QAAgB,SAA0B;CAC5E,MAAM,SAAA,GAAQ,QAAA,OAAA,CAAO;CACrB,MAAM,KACJ,sBAAA,QAAQ,aAAA,GACR,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,QAAM,mBAAmB,QAAQ;EACjC,KAAK,aACH,UACA,UACA,OAAO,KAA4B,SAAqC;GACtE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,gBAAA,YAAY,eAAe,gBAAA,YAAY;IACvE,QAAM,yBAAyB,SAAS;IAIxC,IAAI,cAAc,gBAAA,YAAY,cAC5B,IAAI,IAAI,gBAAA,QAAQ,UAAU,gBAAA,YAAY;IAExC,OAAO,KAAK,gBAAA,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD,OAAO;IACL,IAAI,cAAc;IAClB,MAAM,iBAAiC,OAAO,SAAS,IAAI;IAC3D,IAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;IAC/C,OAAO,KAAK;KACV,OAAO,MAAM,KAAK,WAAW,MAAoB,cAAc;KAC/D,UAAU,IAAI,YAAY;IAC5B,CAAC;GACH;EACF,CACF;CACF,CACF;CAEA,IAAI,QAAQ,OAAO,eAAe,MAChC,MAAM,IACJ,sBAAA,QAAQ,cAAA,GACR,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,MAAM,UAAU,OAAO,cAAc,IAAI;EACjD,QAAM,kBAAkB;EAGxB,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,IAAI;GAC5D,QAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,kBAAkB,CAAC;EACvF;EAEA,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OACzB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,QAAQ,CAAC;EAG7E,KAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;GACtE,IAAI,KAAK;IACP,IAAI,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,gBAAA,YAAY,gBAAgB;KACpF,QAAM,+BAA+B;KAIrC,OAAO,KACL,gBAAA,WAAW,QAAQ,IAAI,QAAQ,IAAI,OAAO,KAAK,gBAAA,WAAW,YAAY,IAAI,OAAO,CACnF;IACF;IACA,OAAO,KAAK,GAAG;GACjB;GAEA,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,UAAU,CAAC;GAC3D,QAAM,qCAAqC,WAAW,OAAO,MAAM;GACnE,IAAI,UAAU,OAAO,WAAW,KAAK,OAAO,EAAE,CAAC,QAAQ,sBAAsB;IAC3E,IAAI,OAAO,EAAE,CAAC,MAAM,WAAW,GAAG;KAChC,QAAM,4BAA4B;KAGlC,IAAI,OAAO,gBAAA,YAAY,QAAQ;KAC/B,IAAI,IAAI,gBAAA,QAAQ,aAAa,GAAG;KAChC,IAAI,KAAK,CAAC,CAAC;KACX;IACF;IAGA,QAAM,wBAAwB;IAC9B,MAAM,QAAQ,YAAY,WAAW,OAAO,EAAE,CAAC,GAAG;IAMlD,IAAI,IAFyB,KAAK,OAAO,EAAE,CAAC,OAExC,oBAAmB,IADA,KAAK,KAAK,IAAI,IAAI,IAClB,GAAY;KACjC,QAAM,uBAAuB;KAC7B,OAAO,KAAK,gBAAA,WAAW,gBAAgB,gBAAA,UAAU,qBAAqB,CAAC;IACzE;IAEA,QAAM,0CAA0C;IAChD,IAAI,OAAO,gBAAA,YAAY,EAAE;IACzB,IAAI,KAAK,EAAE,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC;IACnC;GACF;GAEA,MAAM,QACJ,QAAQ,WACJ,OAAA,GAAM,gBAAA,YAAA,CAAY,MAAM,QAAQ,MAAoB,QAAQ,IAC5D,KAAA;GACN,IAAI,OAAO;IACT,QAAM,yBAAyB,gBAAA,YAAY,KAAK,OAAiB,CAAC,CAAC;IACnE,OAAO,KAAK;KAAE;KAAO,UAAU;IAAK,CAAC;GACvC;GACA,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;EAC1C,CAAC;CACH,CACF;CAGF,IAAI,QAAQ,OAAO,mBAAmB,MACpC,MAAM,IACJ,sBAAA,QAAQ,iBAAA,GACR,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,KAAA,GAAI,UAAA,MAAA,CAAM,IAAI,YAAY,IAAI,GAAG;GAC/B,IAAI,OAAO,gBAAA,YAAY,YAAY;GACnC,OAAO,KAAK,EAEV,SAAS,gBAAA,UAAU,eACrB,CAAC;EACH;EAEA,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;EAErB,IACE,gBAAA,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,uBAClB,MAAM,OAEN,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EAGxF,KAAK,eAAe,MAAgB,SAAS,KAAK,SAAS,MAAM,KAAK,cAAoB;GACxF,KAAA,GAAI,UAAA,MAAA,CAAM,GAAG,KAAK,WAChB,KAAK,EACH,IAAI,KACN,CAAC;QAED,OAAO,KAAK,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,qBAAqB,CAAC;EAE5E,CAAC;CACH,CACF;CAGF,OAAO;AACT"}
+{"version":3,"file":"user.js","names":[],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport { isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  TOKEN_BEARER,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            // Prevent the final middleware from adding WWW-Authenticate header,\n            // which triggers the browser's native basic auth popup instead of\n            // letting the WebUI handle the error in JavaScript.\n            if (errorCode === HTTP_STATUS.UNAUTHORIZED) {\n              res.set(HEADERS.WWW_AUTH, TOKEN_BEARER);\n            }\n            return next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n            return next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          // the UI stores this token as its web session: it must be the web\n          // JWT the login endpoint issues, not the opaque npm API token\n          if (name && password) {\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            const token = await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions);\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;;;AAsBA,IAAM,WAAA,GAAQ,MAAA,QAAA,CAAW,wBAAwB;AAEjD,IAAM,uBAAuB;AAE7B,SAAS,eAAe,MAAY,QAAgB,SAA0B;CAC5E,MAAM,SAAA,GAAQ,QAAA,OAAA,CAAO;CACrB,MAAM,KACJ,sBAAA,QAAQ,aAAA,GACR,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,QAAM,mBAAmB,QAAQ;EACjC,KAAK,aACH,UACA,UACA,OAAO,KAA4B,SAAqC;GACtE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,gBAAA,YAAY,eAAe,gBAAA,YAAY;IACvE,QAAM,yBAAyB,SAAS;IAIxC,IAAI,cAAc,gBAAA,YAAY,cAC5B,IAAI,IAAI,gBAAA,QAAQ,UAAU,gBAAA,YAAY;IAExC,OAAO,KAAK,gBAAA,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD,OAAO;IACL,IAAI,cAAc;IAClB,MAAM,iBAAiC,OAAO,SAAS,IAAI;IAC3D,IAAI,IAAI,gBAAA,QAAQ,eAAe,gBAAA,QAAQ,QAAQ;IAC/C,OAAO,KAAK;KACV,OAAO,MAAM,KAAK,WAAW,MAAoB,cAAc;KAC/D,UAAU,IAAI,YAAY;IAC5B,CAAC;GACH;EACF,CACF;CACF,CACF;CAEA,IAAI,QAAQ,OAAO,eAAe,MAChC,MAAM,IACJ,sBAAA,QAAQ,cAAA,GACR,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,MAAM,UAAU,OAAO,cAAc,IAAI;EACjD,QAAM,kBAAkB;EAGxB,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,IAAI;GAC5D,QAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,kBAAkB,CAAC;EACvF;EAEA,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OACzB,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,QAAQ,CAAC;EAG7E,KAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;GACtE,IAAI,KAAK;IACP,IAAI,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,gBAAA,YAAY,gBAAgB;KACpF,QAAM,+BAA+B;KAIrC,OAAO,KACL,gBAAA,WAAW,QAAQ,IAAI,QAAQ,IAAI,OAAO,KAAK,gBAAA,WAAW,YAAY,IAAI,OAAO,CACnF;IACF;IACA,OAAO,KAAK,GAAG;GACjB;GAEA,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,UAAU,CAAC;GAC3D,QAAM,qCAAqC,WAAW,OAAO,MAAM;GACnE,IAAI,UAAU,OAAO,WAAW,KAAK,OAAO,EAAE,CAAC,QAAQ,sBAAsB;IAC3E,IAAI,OAAO,EAAE,CAAC,MAAM,WAAW,GAAG;KAChC,QAAM,4BAA4B;KAGlC,IAAI,OAAO,gBAAA,YAAY,QAAQ;KAC/B,IAAI,IAAI,gBAAA,QAAQ,aAAa,GAAG;KAChC,IAAI,KAAK,CAAC,CAAC;KACX;IACF;IAGA,QAAM,wBAAwB;IAC9B,MAAM,QAAQ,YAAY,WAAW,OAAO,EAAE,CAAC,GAAG;IAMlD,IAAI,IAFyB,KAAK,OAAO,EAAE,CAAC,OAExC,oBAAmB,IADA,KAAK,KAAK,IAAI,IAAI,IAClB,GAAY;KACjC,QAAM,uBAAuB;KAC7B,OAAO,KAAK,gBAAA,WAAW,gBAAgB,gBAAA,UAAU,qBAAqB,CAAC;IACzE;IAEA,QAAM,0CAA0C;IAChD,IAAI,OAAO,gBAAA,YAAY,EAAE;IACzB,IAAI,KAAK,EAAE,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC;IACnC;GACF;GAIA,IAAI,QAAQ,UAAU;IACpB,MAAM,iBAAiC,OAAO,SAAS,IAAI;IAC3D,MAAM,QAAQ,MAAM,KAAK,WAAW,MAAoB,cAAc;IACtE,QAAM,yBAAyB,gBAAA,YAAY,KAAK,OAAiB,CAAC,CAAC;IACnE,OAAO,KAAK;KAAE;KAAO,UAAU;IAAK,CAAC;GACvC;GACA,OAAO,KAAK,gBAAA,WAAW,gBAAgB,CAAC;EAC1C,CAAC;CACH,CACF;CAGF,IAAI,QAAQ,OAAO,mBAAmB,MACpC,MAAM,IACJ,sBAAA,QAAQ,iBAAA,GACR,sBAAA,UAAA,CAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,KAAA,GAAI,UAAA,MAAA,CAAM,IAAI,YAAY,IAAI,GAAG;GAC/B,IAAI,OAAO,gBAAA,YAAY,YAAY;GACnC,OAAO,KAAK,EAEV,SAAS,gBAAA,UAAU,eACrB,CAAC;EACH;EAEA,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;EAErB,IACE,gBAAA,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,uBAClB,MAAM,OAEN,OAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;EAGxF,KAAK,eAAe,MAAgB,SAAS,KAAK,SAAS,MAAM,KAAK,cAAoB;GACxF,KAAA,GAAI,UAAA,MAAA,CAAM,GAAG,KAAK,WAChB,KAAK,EACH,IAAI,KACN,CAAC;QAED,OAAO,KAAK,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,qBAAqB,CAAC;EAE5E,CAAC;CACH,CACF;CAGF,OAAO;AACT"}

package/build/api/user.mjs

@@ -3,7 +3,6 @@ import { Router } from "express";
 import { isNil } from "lodash-es";
 import { API_ERROR, APP_ERROR, HEADERS, HTTP_STATUS, TOKEN_BEARER, cryptoUtils, errorUtils, validationUtils } from "@verdaccio/core";
 import { WebUrls, rateLimit } from "@verdaccio/middleware";
-import { getApiToken } from "@verdaccio/auth";
 //#region src/api/user.ts
 var debug = buildDebug("verdaccio:web:api:user");
 var WEB_LOGIN_SESSION_ID = "web-login-sessionId";
@@ -66,8 +65,9 @@ function addUserAuthApi(auth, config, storage) {
 				res.json({ token: tokens[0].token });
 				return;
 			}
-			const token = name && password ? await getApiToken(auth, config, user, password) : void 0;
-			if (token) {
+			if (name && password) {
+				const jWTSignOptions = config.security.web.sign;
+				const token = await auth.jwtEncrypt(user, jWTSignOptions);
 				debug("adduser: new token %o", cryptoUtils.mask(token, 4));
 				return next({
 					token,

package/build/api/user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"user.mjs","names":[],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport { isNil } from 'lodash-es';\n\nimport { type Auth, getApiToken } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  TOKEN_BEARER,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            // Prevent the final middleware from adding WWW-Authenticate header,\n            // which triggers the browser's native basic auth popup instead of\n            // letting the WebUI handle the error in JavaScript.\n            if (errorCode === HTTP_STATUS.UNAUTHORIZED) {\n              res.set(HEADERS.WWW_AUTH, TOKEN_BEARER);\n            }\n            return next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n            return next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;;AAsBA,IAAM,QAAQ,WAAW,wBAAwB;AAEjD,IAAM,uBAAuB;AAE7B,SAAS,eAAe,MAAY,QAAgB,SAA0B;CAC5E,MAAM,QAAQ,OAAO;CACrB,MAAM,KACJ,QAAQ,YACR,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,mBAAmB,QAAQ;EACjC,KAAK,aACH,UACA,UACA,OAAO,KAA4B,SAAqC;GACtE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;IACvE,MAAM,yBAAyB,SAAS;IAIxC,IAAI,cAAc,YAAY,cAC5B,IAAI,IAAI,QAAQ,UAAU,YAAY;IAExC,OAAO,KAAK,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD,OAAO;IACL,IAAI,cAAc;IAClB,MAAM,iBAAiC,OAAO,SAAS,IAAI;IAC3D,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAC/C,OAAO,KAAK;KACV,OAAO,MAAM,KAAK,WAAW,MAAoB,cAAc;KAC/D,UAAU,IAAI,YAAY;IAC5B,CAAC;GACH;EACF,CACF;CACF,CACF;CAEA,IAAI,QAAQ,OAAO,eAAe,MAChC,MAAM,IACJ,QAAQ,aACR,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,MAAM,UAAU,OAAO,cAAc,IAAI;EACjD,MAAM,kBAAkB;EAGxB,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,IAAI;GAC5D,MAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,kBAAkB,CAAC;EACvF;EAEA,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OACzB,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,QAAQ,CAAC;EAG7E,KAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;GACtE,IAAI,KAAK;IACP,IAAI,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,YAAY,gBAAgB;KACpF,MAAM,+BAA+B;KAIrC,OAAO,KACL,WAAW,QAAQ,IAAI,QAAQ,IAAI,OAAO,KAAK,WAAW,YAAY,IAAI,OAAO,CACnF;IACF;IACA,OAAO,KAAK,GAAG;GACjB;GAEA,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,UAAU,CAAC;GAC3D,MAAM,qCAAqC,WAAW,OAAO,MAAM;GACnE,IAAI,UAAU,OAAO,WAAW,KAAK,OAAO,EAAE,CAAC,QAAQ,sBAAsB;IAC3E,IAAI,OAAO,EAAE,CAAC,MAAM,WAAW,GAAG;KAChC,MAAM,4BAA4B;KAGlC,IAAI,OAAO,YAAY,QAAQ;KAC/B,IAAI,IAAI,QAAQ,aAAa,GAAG;KAChC,IAAI,KAAK,CAAC,CAAC;KACX;IACF;IAGA,MAAM,wBAAwB;IAC9B,MAAM,QAAQ,YAAY,WAAW,OAAO,EAAE,CAAC,GAAG;IAMlD,IAAI,IAFyB,KAAK,OAAO,EAAE,CAAC,OAExC,oBAAmB,IADA,KAAK,KAAK,IAAI,IAAI,IAClB,GAAY;KACjC,MAAM,uBAAuB;KAC7B,OAAO,KAAK,WAAW,gBAAgB,UAAU,qBAAqB,CAAC;IACzE;IAEA,MAAM,0CAA0C;IAChD,IAAI,OAAO,YAAY,EAAE;IACzB,IAAI,KAAK,EAAE,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC;IACnC;GACF;GAEA,MAAM,QACJ,QAAQ,WACJ,MAAM,YAAY,MAAM,QAAQ,MAAoB,QAAQ,IAC5D,KAAA;GACN,IAAI,OAAO;IACT,MAAM,yBAAyB,YAAY,KAAK,OAAiB,CAAC,CAAC;IACnE,OAAO,KAAK;KAAE;KAAO,UAAU;IAAK,CAAC;GACvC;GACA,OAAO,KAAK,WAAW,gBAAgB,CAAC;EAC1C,CAAC;CACH,CACF;CAGF,IAAI,QAAQ,OAAO,mBAAmB,MACpC,MAAM,IACJ,QAAQ,gBACR,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,IAAI,MAAM,IAAI,YAAY,IAAI,GAAG;GAC/B,IAAI,OAAO,YAAY,YAAY;GACnC,OAAO,KAAK,EAEV,SAAS,UAAU,eACrB,CAAC;EACH;EAEA,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;EAErB,IACE,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,uBAClB,MAAM,OAEN,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;EAGxF,KAAK,eAAe,MAAgB,SAAS,KAAK,SAAS,MAAM,KAAK,cAAoB;GACxF,IAAI,MAAM,GAAG,KAAK,WAChB,KAAK,EACH,IAAI,KACN,CAAC;QAED,OAAO,KAAK,WAAW,iBAAiB,UAAU,qBAAqB,CAAC;EAE5E,CAAC;CACH,CACF;CAGF,OAAO;AACT"}
+{"version":3,"file":"user.mjs","names":[],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport { isNil } from 'lodash-es';\n\nimport type { Auth } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  TOKEN_BEARER,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            // Prevent the final middleware from adding WWW-Authenticate header,\n            // which triggers the browser's native basic auth popup instead of\n            // letting the WebUI handle the error in JavaScript.\n            if (errorCode === HTTP_STATUS.UNAUTHORIZED) {\n              res.set(HEADERS.WWW_AUTH, TOKEN_BEARER);\n            }\n            return next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, HEADERS.NO_CACHE);\n            return next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          // the UI stores this token as its web session: it must be the web\n          // JWT the login endpoint issues, not the opaque npm API token\n          if (name && password) {\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            const token = await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions);\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;AAsBA,IAAM,QAAQ,WAAW,wBAAwB;AAEjD,IAAM,uBAAuB;AAE7B,SAAS,eAAe,MAAY,QAAgB,SAA0B;CAC5E,MAAM,QAAQ,OAAO;CACrB,MAAM,KACJ,QAAQ,YACR,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,UAAU,aAAa,IAAI;EACnC,MAAM,mBAAmB,QAAQ;EACjC,KAAK,aACH,UACA,UACA,OAAO,KAA4B,SAAqC;GACtE,IAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;IACvE,MAAM,yBAAyB,SAAS;IAIxC,IAAI,cAAc,YAAY,cAC5B,IAAI,IAAI,QAAQ,UAAU,YAAY;IAExC,OAAO,KAAK,WAAW,QAAQ,WAAW,IAAI,OAAO,CAAC;GACxD,OAAO;IACL,IAAI,cAAc;IAClB,MAAM,iBAAiC,OAAO,SAAS,IAAI;IAC3D,IAAI,IAAI,QAAQ,eAAe,QAAQ,QAAQ;IAC/C,OAAO,KAAK;KACV,OAAO,MAAM,KAAK,WAAW,MAAoB,cAAc;KAC/D,UAAU,IAAI,YAAY;IAC5B,CAAC;GACH;EACF,CACF;CACF,CACF;CAEA,IAAI,QAAQ,OAAO,eAAe,MAChC,MAAM,IACJ,QAAQ,aACR,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,MAAM,UAAU,OAAO,cAAc,IAAI;EACjD,MAAM,kBAAkB;EAGxB,IAAI,OAAO,cAAc,YAAY,UAAU,WAAW,IAAI;GAC5D,MAAM,mCAAmC,UAAU,MAAM;GACzD,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,kBAAkB,CAAC;EACvF;EAEA,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,OACzB,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,QAAQ,CAAC;EAG7E,KAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;GACtE,IAAI,KAAK;IACP,IAAI,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,YAAY,gBAAgB;KACpF,MAAM,+BAA+B;KAIrC,OAAO,KACL,WAAW,QAAQ,IAAI,QAAQ,IAAI,OAAO,KAAK,WAAW,YAAY,IAAI,OAAO,CACnF;IACF;IACA,OAAO,KAAK,GAAG;GACjB;GAEA,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,UAAU,CAAC;GAC3D,MAAM,qCAAqC,WAAW,OAAO,MAAM;GACnE,IAAI,UAAU,OAAO,WAAW,KAAK,OAAO,EAAE,CAAC,QAAQ,sBAAsB;IAC3E,IAAI,OAAO,EAAE,CAAC,MAAM,WAAW,GAAG;KAChC,MAAM,4BAA4B;KAGlC,IAAI,OAAO,YAAY,QAAQ;KAC/B,IAAI,IAAI,QAAQ,aAAa,GAAG;KAChC,IAAI,KAAK,CAAC,CAAC;KACX;IACF;IAGA,MAAM,wBAAwB;IAC9B,MAAM,QAAQ,YAAY,WAAW,OAAO,EAAE,CAAC,GAAG;IAMlD,IAAI,IAFyB,KAAK,OAAO,EAAE,CAAC,OAExC,oBAAmB,IADA,KAAK,KAAK,IAAI,IAAI,IAClB,GAAY;KACjC,MAAM,uBAAuB;KAC7B,OAAO,KAAK,WAAW,gBAAgB,UAAU,qBAAqB,CAAC;IACzE;IAEA,MAAM,0CAA0C;IAChD,IAAI,OAAO,YAAY,EAAE;IACzB,IAAI,KAAK,EAAE,OAAO,OAAO,EAAE,CAAC,MAAM,CAAC;IACnC;GACF;GAIA,IAAI,QAAQ,UAAU;IACpB,MAAM,iBAAiC,OAAO,SAAS,IAAI;IAC3D,MAAM,QAAQ,MAAM,KAAK,WAAW,MAAoB,cAAc;IACtE,MAAM,yBAAyB,YAAY,KAAK,OAAiB,CAAC,CAAC;IACnE,OAAO,KAAK;KAAE;KAAO,UAAU;IAAK,CAAC;GACvC;GACA,OAAO,KAAK,WAAW,gBAAgB,CAAC;EAC1C,CAAC;CACH,CACF;CAGF,IAAI,QAAQ,OAAO,mBAAmB,MACpC,MAAM,IACJ,QAAQ,gBACR,UAAU,QAAQ,aAAa,GAC/B,SAAU,KAAc,KAAe,MAA8B;EACnE,IAAI,MAAM,IAAI,YAAY,IAAI,GAAG;GAC/B,IAAI,OAAO,YAAY,YAAY;GACnC,OAAO,KAAK,EAEV,SAAS,UAAU,eACrB,CAAC;EACH;EAEA,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;EAErB,IACE,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,uBAClB,MAAM,OAEN,OAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;EAGxF,KAAK,eAAe,MAAgB,SAAS,KAAK,SAAS,MAAM,KAAK,cAAoB;GACxF,IAAI,MAAM,GAAG,KAAK,WAChB,KAAK,EACH,IAAI,KACN,CAAC;QAED,OAAO,KAAK,WAAW,iBAAiB,UAAU,qBAAqB,CAAC;EAE5E,CAAC;CACH,CACF;CAGF,OAAO;AACT"}

package/build/index.js

@@ -15,5 +15,6 @@ exports.formatAuthor = require_author_utils.formatAuthor;
 exports.generateGravatarUrl = require_author_utils.generateGravatarUrl;
 exports.hasLogin = require_web_utils.hasLogin;
 exports.isVersionValid = require_web_utils.isVersionValid;
+exports.resolveVersion = require_web_utils.resolveVersion;
 exports.sortByName = require_web_utils.sortByName;
 exports.sortByTime = require_web_utils.sortByTime;

package/build/index.mjs

@@ -1,4 +1,4 @@
-import { addScope, deleteProperties, hasLogin, isVersionValid, sortByName, sortByTime } from "./web-utils.mjs";
+import { addScope, deleteProperties, hasLogin, isVersionValid, resolveVersion, sortByName, sortByTime } from "./web-utils.mjs";
 import { GENERIC_AVATAR, addGravatarSupport, formatAuthor, generateGravatarUrl } from "./author-utils.mjs";
 import middleware_default, { DEFAULT_PLUGIN_UI_THEME } from "./middleware.mjs";
-export { DEFAULT_PLUGIN_UI_THEME, GENERIC_AVATAR, addGravatarSupport, addScope, middleware_default as default, deleteProperties, formatAuthor, generateGravatarUrl, hasLogin, isVersionValid, sortByName, sortByTime };
+export { DEFAULT_PLUGIN_UI_THEME, GENERIC_AVATAR, addGravatarSupport, addScope, middleware_default as default, deleteProperties, formatAuthor, generateGravatarUrl, hasLogin, isVersionValid, resolveVersion, sortByName, sortByTime };

package/build/web-utils.d.ts

@@ -5,3 +5,9 @@ export declare function sortByTime(packages: any[], orderAscending?: boolean | v
 export declare function addScope(scope: string, packageName: string): string;
 export declare function deleteProperties(propertiesToDelete: string[], objectItem: any): any;
 export declare function isVersionValid(packageMeta: Manifest, packageVersion: string): boolean;
+/**
+ * Resolve a user-supplied version or dist-tag to a concrete version of the
+ * manifest, or undefined. Own-property checks only: `__proto__` must never
+ * resolve against inherited properties.
+ */
+export declare function resolveVersion(packageMeta: Manifest, version: string): string | undefined;

package/build/web-utils.js

@@ -1,4 +1,5 @@
 let lodash_es = require("lodash-es");
+let _verdaccio_core = require("@verdaccio/core");
 //#region src/web-utils.ts
 function hasLogin(config) {
 	return (0, lodash_es.isNil)(config?.web?.login) || config?.web?.login === true;
@@ -26,13 +27,27 @@ function deleteProperties(propertiesToDelete, objectItem) {
 }
 function isVersionValid(packageMeta, packageVersion) {
 	if (!(typeof packageVersion !== "undefined")) return false;
-	return Object.keys(packageMeta.versions).includes(packageVersion);
+	return Object.hasOwn(packageMeta.versions, packageVersion);
+}
+/**
+* Resolve a user-supplied version or dist-tag to a concrete version of the
+* manifest, or undefined. Own-property checks only: `__proto__` must never
+* resolve against inherited properties.
+*/
+function resolveVersion(packageMeta, version) {
+	if (isVersionValid(packageMeta, version)) return version;
+	const distTags = packageMeta[_verdaccio_core.DIST_TAGS];
+	if (distTags && Object.hasOwn(distTags, version)) {
+		const resolved = distTags[version];
+		if (typeof resolved === "string" && isVersionValid(packageMeta, resolved)) return resolved;
+	}
 }
 //#endregion
 exports.addScope = addScope;
 exports.deleteProperties = deleteProperties;
 exports.hasLogin = hasLogin;
 exports.isVersionValid = isVersionValid;
+exports.resolveVersion = resolveVersion;
 exports.sortByName = sortByName;
 exports.sortByTime = sortByTime;
 

package/build/web-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"web-utils.js","names":[],"sources":["../src/web-utils.ts"],"sourcesContent":["import { forEach, isNil } from 'lodash-es';\n\nimport type { ConfigYaml, Manifest } from '@verdaccio/types';\n\nexport function hasLogin(config: ConfigYaml) {\n  return isNil(config?.web?.login) || config?.web?.login === true;\n}\n\nexport function sortByName(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorNames = a.name.toLowerCase() < b.name.toLowerCase();\n    return orderAscending ? (comparatorNames ? -1 : 1) : comparatorNames ? 1 : -1;\n  });\n}\n\nexport function sortByTime(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorTime = a.time < b.time;\n    return orderAscending ? (comparatorTime ? -1 : 1) : comparatorTime ? 1 : -1;\n  });\n}\n\nexport function addScope(scope: string, packageName: string): string {\n  return `@${scope}/${packageName}`;\n}\n\nexport function deleteProperties(propertiesToDelete: string[], objectItem: any): any {\n  forEach(propertiesToDelete, (property): any => {\n    delete objectItem[property];\n  });\n\n  return objectItem;\n}\n\nexport function isVersionValid(packageMeta: Manifest, packageVersion: string): boolean {\n  const hasVersion = typeof packageVersion !== 'undefined';\n  if (!hasVersion) {\n    return false;\n  }\n\n  const hasMatchVersion = Object.keys(packageMeta.versions).includes(packageVersion);\n  return hasMatchVersion;\n}\n"],"mappings":";;AAIA,SAAgB,SAAS,QAAoB;CAC3C,QAAA,GAAO,UAAA,MAAA,CAAM,QAAQ,KAAK,KAAK,KAAK,QAAQ,KAAK,UAAU;AAC7D;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,kBAAkB,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,YAAY;EAClE,OAAO,iBAAkB,kBAAkB,KAAK,IAAK,kBAAkB,IAAI;CAC7E,CAAC;AACH;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,iBAAiB,EAAE,OAAO,EAAE;EAClC,OAAO,iBAAkB,iBAAiB,KAAK,IAAK,iBAAiB,IAAI;CAC3E,CAAC;AACH;AAEA,SAAgB,SAAS,OAAe,aAA6B;CACnE,OAAO,IAAI,MAAM,GAAG;AACtB;AAEA,SAAgB,iBAAiB,oBAA8B,YAAsB;CACnF,CAAA,GAAA,UAAA,QAAA,CAAQ,qBAAqB,aAAkB;EAC7C,OAAO,WAAW;CACpB,CAAC;CAED,OAAO;AACT;AAEA,SAAgB,eAAe,aAAuB,gBAAiC;CAErF,IAAI,EADe,OAAO,mBAAmB,cAE3C,OAAO;CAIT,OADwB,OAAO,KAAK,YAAY,QAAQ,CAAC,CAAC,SAAS,cAC5D;AACT"}
+{"version":3,"file":"web-utils.js","names":[],"sources":["../src/web-utils.ts"],"sourcesContent":["import { forEach, isNil } from 'lodash-es';\n\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { ConfigYaml, Manifest } from '@verdaccio/types';\n\nexport function hasLogin(config: ConfigYaml) {\n  return isNil(config?.web?.login) || config?.web?.login === true;\n}\n\nexport function sortByName(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorNames = a.name.toLowerCase() < b.name.toLowerCase();\n    return orderAscending ? (comparatorNames ? -1 : 1) : comparatorNames ? 1 : -1;\n  });\n}\n\nexport function sortByTime(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorTime = a.time < b.time;\n    return orderAscending ? (comparatorTime ? -1 : 1) : comparatorTime ? 1 : -1;\n  });\n}\n\nexport function addScope(scope: string, packageName: string): string {\n  return `@${scope}/${packageName}`;\n}\n\nexport function deleteProperties(propertiesToDelete: string[], objectItem: any): any {\n  forEach(propertiesToDelete, (property): any => {\n    delete objectItem[property];\n  });\n\n  return objectItem;\n}\n\nexport function isVersionValid(packageMeta: Manifest, packageVersion: string): boolean {\n  const hasVersion = typeof packageVersion !== 'undefined';\n  if (!hasVersion) {\n    return false;\n  }\n\n  // own-property check: the version may come from user input, and values like\n  // `__proto__` must never validate against inherited properties\n  return Object.hasOwn(packageMeta.versions, packageVersion);\n}\n\n/**\n * Resolve a user-supplied version or dist-tag to a concrete version of the\n * manifest, or undefined. Own-property checks only: `__proto__` must never\n * resolve against inherited properties.\n */\nexport function resolveVersion(packageMeta: Manifest, version: string): string | undefined {\n  if (isVersionValid(packageMeta, version)) {\n    return version;\n  }\n\n  const distTags = packageMeta[DIST_TAGS];\n  if (distTags && Object.hasOwn(distTags, version)) {\n    const resolved = distTags[version];\n    if (typeof resolved === 'string' && isVersionValid(packageMeta, resolved)) {\n      return resolved;\n    }\n  }\n\n  return undefined;\n}\n"],"mappings":";;;AAKA,SAAgB,SAAS,QAAoB;CAC3C,QAAA,GAAO,UAAA,MAAA,CAAM,QAAQ,KAAK,KAAK,KAAK,QAAQ,KAAK,UAAU;AAC7D;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,kBAAkB,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,YAAY;EAClE,OAAO,iBAAkB,kBAAkB,KAAK,IAAK,kBAAkB,IAAI;CAC7E,CAAC;AACH;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,iBAAiB,EAAE,OAAO,EAAE;EAClC,OAAO,iBAAkB,iBAAiB,KAAK,IAAK,iBAAiB,IAAI;CAC3E,CAAC;AACH;AAEA,SAAgB,SAAS,OAAe,aAA6B;CACnE,OAAO,IAAI,MAAM,GAAG;AACtB;AAEA,SAAgB,iBAAiB,oBAA8B,YAAsB;CACnF,CAAA,GAAA,UAAA,QAAA,CAAQ,qBAAqB,aAAkB;EAC7C,OAAO,WAAW;CACpB,CAAC;CAED,OAAO;AACT;AAEA,SAAgB,eAAe,aAAuB,gBAAiC;CAErF,IAAI,EADe,OAAO,mBAAmB,cAE3C,OAAO;CAKT,OAAO,OAAO,OAAO,YAAY,UAAU,cAAc;AAC3D;;;;;;AAOA,SAAgB,eAAe,aAAuB,SAAqC;CACzF,IAAI,eAAe,aAAa,OAAO,GACrC,OAAO;CAGT,MAAM,WAAW,YAAY,gBAAA;CAC7B,IAAI,YAAY,OAAO,OAAO,UAAU,OAAO,GAAG;EAChD,MAAM,WAAW,SAAS;EAC1B,IAAI,OAAO,aAAa,YAAY,eAAe,aAAa,QAAQ,GACtE,OAAO;CAEX;AAGF"}

package/build/web-utils.mjs

@@ -1,4 +1,5 @@
 import { forEach, isNil } from "lodash-es";
+import { DIST_TAGS } from "@verdaccio/core";
 //#region src/web-utils.ts
 function hasLogin(config) {
 	return isNil(config?.web?.login) || config?.web?.login === true;
@@ -26,9 +27,22 @@ function deleteProperties(propertiesToDelete, objectItem) {
 }
 function isVersionValid(packageMeta, packageVersion) {
 	if (!(typeof packageVersion !== "undefined")) return false;
-	return Object.keys(packageMeta.versions).includes(packageVersion);
+	return Object.hasOwn(packageMeta.versions, packageVersion);
+}
+/**
+* Resolve a user-supplied version or dist-tag to a concrete version of the
+* manifest, or undefined. Own-property checks only: `__proto__` must never
+* resolve against inherited properties.
+*/
+function resolveVersion(packageMeta, version) {
+	if (isVersionValid(packageMeta, version)) return version;
+	const distTags = packageMeta[DIST_TAGS];
+	if (distTags && Object.hasOwn(distTags, version)) {
+		const resolved = distTags[version];
+		if (typeof resolved === "string" && isVersionValid(packageMeta, resolved)) return resolved;
+	}
 }
 //#endregion
-export { addScope, deleteProperties, hasLogin, isVersionValid, sortByName, sortByTime };
+export { addScope, deleteProperties, hasLogin, isVersionValid, resolveVersion, sortByName, sortByTime };
 
 //# sourceMappingURL=web-utils.mjs.map

package/build/web-utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"web-utils.mjs","names":[],"sources":["../src/web-utils.ts"],"sourcesContent":["import { forEach, isNil } from 'lodash-es';\n\nimport type { ConfigYaml, Manifest } from '@verdaccio/types';\n\nexport function hasLogin(config: ConfigYaml) {\n  return isNil(config?.web?.login) || config?.web?.login === true;\n}\n\nexport function sortByName(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorNames = a.name.toLowerCase() < b.name.toLowerCase();\n    return orderAscending ? (comparatorNames ? -1 : 1) : comparatorNames ? 1 : -1;\n  });\n}\n\nexport function sortByTime(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorTime = a.time < b.time;\n    return orderAscending ? (comparatorTime ? -1 : 1) : comparatorTime ? 1 : -1;\n  });\n}\n\nexport function addScope(scope: string, packageName: string): string {\n  return `@${scope}/${packageName}`;\n}\n\nexport function deleteProperties(propertiesToDelete: string[], objectItem: any): any {\n  forEach(propertiesToDelete, (property): any => {\n    delete objectItem[property];\n  });\n\n  return objectItem;\n}\n\nexport function isVersionValid(packageMeta: Manifest, packageVersion: string): boolean {\n  const hasVersion = typeof packageVersion !== 'undefined';\n  if (!hasVersion) {\n    return false;\n  }\n\n  const hasMatchVersion = Object.keys(packageMeta.versions).includes(packageVersion);\n  return hasMatchVersion;\n}\n"],"mappings":";;AAIA,SAAgB,SAAS,QAAoB;CAC3C,OAAO,MAAM,QAAQ,KAAK,KAAK,KAAK,QAAQ,KAAK,UAAU;AAC7D;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,kBAAkB,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,YAAY;EAClE,OAAO,iBAAkB,kBAAkB,KAAK,IAAK,kBAAkB,IAAI;CAC7E,CAAC;AACH;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,iBAAiB,EAAE,OAAO,EAAE;EAClC,OAAO,iBAAkB,iBAAiB,KAAK,IAAK,iBAAiB,IAAI;CAC3E,CAAC;AACH;AAEA,SAAgB,SAAS,OAAe,aAA6B;CACnE,OAAO,IAAI,MAAM,GAAG;AACtB;AAEA,SAAgB,iBAAiB,oBAA8B,YAAsB;CACnF,QAAQ,qBAAqB,aAAkB;EAC7C,OAAO,WAAW;CACpB,CAAC;CAED,OAAO;AACT;AAEA,SAAgB,eAAe,aAAuB,gBAAiC;CAErF,IAAI,EADe,OAAO,mBAAmB,cAE3C,OAAO;CAIT,OADwB,OAAO,KAAK,YAAY,QAAQ,CAAC,CAAC,SAAS,cAC5D;AACT"}
+{"version":3,"file":"web-utils.mjs","names":[],"sources":["../src/web-utils.ts"],"sourcesContent":["import { forEach, isNil } from 'lodash-es';\n\nimport { DIST_TAGS } from '@verdaccio/core';\nimport type { ConfigYaml, Manifest } from '@verdaccio/types';\n\nexport function hasLogin(config: ConfigYaml) {\n  return isNil(config?.web?.login) || config?.web?.login === true;\n}\n\nexport function sortByName(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorNames = a.name.toLowerCase() < b.name.toLowerCase();\n    return orderAscending ? (comparatorNames ? -1 : 1) : comparatorNames ? 1 : -1;\n  });\n}\n\nexport function sortByTime(packages: any[], orderAscending: boolean | void = true): string[] {\n  return packages.slice().sort(function (a, b): number {\n    const comparatorTime = a.time < b.time;\n    return orderAscending ? (comparatorTime ? -1 : 1) : comparatorTime ? 1 : -1;\n  });\n}\n\nexport function addScope(scope: string, packageName: string): string {\n  return `@${scope}/${packageName}`;\n}\n\nexport function deleteProperties(propertiesToDelete: string[], objectItem: any): any {\n  forEach(propertiesToDelete, (property): any => {\n    delete objectItem[property];\n  });\n\n  return objectItem;\n}\n\nexport function isVersionValid(packageMeta: Manifest, packageVersion: string): boolean {\n  const hasVersion = typeof packageVersion !== 'undefined';\n  if (!hasVersion) {\n    return false;\n  }\n\n  // own-property check: the version may come from user input, and values like\n  // `__proto__` must never validate against inherited properties\n  return Object.hasOwn(packageMeta.versions, packageVersion);\n}\n\n/**\n * Resolve a user-supplied version or dist-tag to a concrete version of the\n * manifest, or undefined. Own-property checks only: `__proto__` must never\n * resolve against inherited properties.\n */\nexport function resolveVersion(packageMeta: Manifest, version: string): string | undefined {\n  if (isVersionValid(packageMeta, version)) {\n    return version;\n  }\n\n  const distTags = packageMeta[DIST_TAGS];\n  if (distTags && Object.hasOwn(distTags, version)) {\n    const resolved = distTags[version];\n    if (typeof resolved === 'string' && isVersionValid(packageMeta, resolved)) {\n      return resolved;\n    }\n  }\n\n  return undefined;\n}\n"],"mappings":";;;AAKA,SAAgB,SAAS,QAAoB;CAC3C,OAAO,MAAM,QAAQ,KAAK,KAAK,KAAK,QAAQ,KAAK,UAAU;AAC7D;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,kBAAkB,EAAE,KAAK,YAAY,IAAI,EAAE,KAAK,YAAY;EAClE,OAAO,iBAAkB,kBAAkB,KAAK,IAAK,kBAAkB,IAAI;CAC7E,CAAC;AACH;AAEA,SAAgB,WAAW,UAAiB,iBAAiC,MAAgB;CAC3F,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,SAAU,GAAG,GAAW;EACnD,MAAM,iBAAiB,EAAE,OAAO,EAAE;EAClC,OAAO,iBAAkB,iBAAiB,KAAK,IAAK,iBAAiB,IAAI;CAC3E,CAAC;AACH;AAEA,SAAgB,SAAS,OAAe,aAA6B;CACnE,OAAO,IAAI,MAAM,GAAG;AACtB;AAEA,SAAgB,iBAAiB,oBAA8B,YAAsB;CACnF,QAAQ,qBAAqB,aAAkB;EAC7C,OAAO,WAAW;CACpB,CAAC;CAED,OAAO;AACT;AAEA,SAAgB,eAAe,aAAuB,gBAAiC;CAErF,IAAI,EADe,OAAO,mBAAmB,cAE3C,OAAO;CAKT,OAAO,OAAO,OAAO,YAAY,UAAU,cAAc;AAC3D;;;;;;AAOA,SAAgB,eAAe,aAAuB,SAAqC;CACzF,IAAI,eAAe,aAAa,OAAO,GACrC,OAAO;CAGT,MAAM,WAAW,YAAY;CAC7B,IAAI,YAAY,OAAO,OAAO,UAAU,OAAO,GAAG;EAChD,MAAM,WAAW,SAAS;EAC1B,IAAI,OAAO,aAAa,YAAY,eAAe,aAAa,QAAQ,GACtE,OAAO;CAEX;AAGF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/web",
-  "version": "9.0.0-next-9.29",
+  "version": "9.0.0-next-9.31",
   "description": "Verdaccio Web Middleware",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -28,29 +28,29 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "9.0.0-next-9.29",
-    "@verdaccio/config": "9.0.0-next-9.29",
-    "@verdaccio/core": "9.0.0-next-9.29",
-    "@verdaccio/loaders": "9.0.0-next-9.29",
-    "@verdaccio/logger": "9.0.0-next-9.29",
-    "@verdaccio/middleware": "9.0.0-next-9.29",
-    "@verdaccio/store": "9.0.0-next-9.29",
-    "@verdaccio/tarball": "14.0.0-next-9.29",
-    "@verdaccio/ui-theme": "9.0.0-next-9.29",
+    "@verdaccio/auth": "9.0.0-next-9.31",
+    "@verdaccio/config": "9.0.0-next-9.31",
+    "@verdaccio/core": "9.0.0-next-9.31",
+    "@verdaccio/loaders": "9.0.0-next-9.31",
+    "@verdaccio/logger": "9.0.0-next-9.31",
+    "@verdaccio/middleware": "9.0.0-next-9.31",
+    "@verdaccio/store": "9.0.0-next-9.31",
+    "@verdaccio/tarball": "14.0.0-next-9.31",
+    "@verdaccio/ui-theme": "9.0.0-next-9.31",
     "debug": "4.4.3",
     "express": "5.2.1",
     "lodash-es": "4.18.1"
   },
   "devDependencies": {
     "@types/lodash-es": "4.17.12",
-    "@verdaccio/api": "9.0.0-next-9.29",
-    "@verdaccio/test-helper": "5.0.0-next-9.30",
-    "@verdaccio/types": "14.0.0-next-9.13",
+    "@verdaccio/api": "9.0.0-next-9.31",
+    "@verdaccio/test-helper": "5.0.0-next-9.32",
+    "@verdaccio/types": "14.0.0-next-9.14",
     "jsdom": "29.1.1",
     "nock": "13.5.6",
     "supertest": "7.1.4",
     "rimraf": "6.1.3",
-    "vite": "8.2.1",
+    "vite": "8.2.2",
     "vitest": "4.1.10"
   },
   "funding": {