@verdaccio/web 9.0.0-next-9.3 → 9.0.0-next-9.5

package/build/api/user.js

@@ -1,215 +1,100 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports["default"] = void 0;
-var _debug = _interopRequireDefault(require("debug"));
-var _express = require("express");
-var _lodash = _interopRequireDefault(require("lodash"));
-var _auth = require("@verdaccio/auth");
-var _core = require("@verdaccio/core");
-var _middleware = require("@verdaccio/middleware");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { "default": e }; }
-function _regenerator() { /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/babel/babel/blob/main/packages/babel-helpers/LICENSE */ var e, t, r = "function" == typeof Symbol ? Symbol : {}, n = r.iterator || "@@iterator", o = r.toStringTag || "@@toStringTag"; function i(r, n, o, i) { var c = n && n.prototype instanceof Generator ? n : Generator, u = Object.create(c.prototype); return _regeneratorDefine2(u, "_invoke", function (r, n, o) { var i, c, u, f = 0, p = o || [], y = !1, G = { p: 0, n: 0, v: e, a: d, f: d.bind(e, 4), d: function d(t, r) { return i = t, c = 0, u = e, G.n = r, a; } }; function d(r, n) { for (c = r, u = n, t = 0; !y && f && !o && t < p.length; t++) { var o, i = p[t], d = G.p, l = i[2]; r > 3 ? (o = l === n) && (u = i[(c = i[4]) ? 5 : (c = 3, 3)], i[4] = i[5] = e) : i[0] <= d && ((o = r < 2 && d < i[1]) ? (c = 0, G.v = n, G.n = i[1]) : d < l && (o = r < 3 || i[0] > n || n > l) && (i[4] = r, i[5] = n, G.n = l, c = 0)); } if (o || r > 1) return a; throw y = !0, n; } return function (o, p, l) { if (f > 1) throw TypeError("Generator is already running"); for (y && 1 === p && d(p, l), c = p, u = l; (t = c < 2 ? e : u) || !y;) { i || (c ? c < 3 ? (c > 1 && (G.n = -1), d(c, u)) : G.n = u : G.v = u); try { if (f = 2, i) { if (c || (o = "next"), t = i[o]) { if (!(t = t.call(i, u))) throw TypeError("iterator result is not an object"); if (!t.done) return t; u = t.value, c < 2 && (c = 0); } else 1 === c && (t = i["return"]) && t.call(i), c < 2 && (u = TypeError("The iterator does not provide a '" + o + "' method"), c = 1); i = e; } else if ((t = (y = G.n < 0) ? u : r.call(n, G)) !== a) break; } catch (t) { i = e, c = 1, u = t; } finally { f = 1; } } return { value: t, done: y }; }; }(r, o, i), !0), u; } var a = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} t = Object.getPrototypeOf; var c = [][n] ? t(t([][n]())) : (_regeneratorDefine2(t = {}, n, function () { return this; }), t), u = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(c); function f(e) { return Object.setPrototypeOf ? Object.setPrototypeOf(e, GeneratorFunctionPrototype) : (e.__proto__ = GeneratorFunctionPrototype, _regeneratorDefine2(e, o, "GeneratorFunction")), e.prototype = Object.create(u), e; } return GeneratorFunction.prototype = GeneratorFunctionPrototype, _regeneratorDefine2(u, "constructor", GeneratorFunctionPrototype), _regeneratorDefine2(GeneratorFunctionPrototype, "constructor", GeneratorFunction), GeneratorFunction.displayName = "GeneratorFunction", _regeneratorDefine2(GeneratorFunctionPrototype, o, "GeneratorFunction"), _regeneratorDefine2(u), _regeneratorDefine2(u, o, "Generator"), _regeneratorDefine2(u, n, function () { return this; }), _regeneratorDefine2(u, "toString", function () { return "[object Generator]"; }), (_regenerator = function _regenerator() { return { w: i, m: f }; })(); }
-function _regeneratorDefine2(e, r, n, t) { var i = Object.defineProperty; try { i({}, "", {}); } catch (e) { i = 0; } _regeneratorDefine2 = function _regeneratorDefine(e, r, n, t) { function o(r, n) { _regeneratorDefine2(e, r, function (e) { return this._invoke(r, n, e); }); } r ? i ? i(e, r, { value: n, enumerable: !t, configurable: !t, writable: !t }) : e[r] = n : (o("next", 0), o("throw", 1), o("return", 2)); }, _regeneratorDefine2(e, r, n, t); }
-function asyncGeneratorStep(n, t, e, r, o, a, c) { try { var i = n[a](c), u = i.value; } catch (n) { return void e(n); } i.done ? t(u) : Promise.resolve(u).then(r, o); }
-function _asyncToGenerator(n) { return function () { var t = this, e = arguments; return new Promise(function (r, o) { var a = n.apply(t, e); function _next(n) { asyncGeneratorStep(a, r, o, _next, _throw, "next", n); } function _throw(n) { asyncGeneratorStep(a, r, o, _next, _throw, "throw", n); } _next(void 0); }); }; }
-var debug = (0, _debug["default"])('verdaccio:web:api:user');
-var WEB_LOGIN_SESSION_ID = 'web-login-sessionId';
+const require_runtime = require("../_virtual/_rolldown/runtime.js");
+let express = require("express");
+let lodash = require("lodash");
+lodash = require_runtime.__toESM(lodash);
+let _verdaccio_core = require("@verdaccio/core");
+let _verdaccio_middleware = require("@verdaccio/middleware");
+let debug = require("debug");
+debug = require_runtime.__toESM(debug);
+let _verdaccio_auth = require("@verdaccio/auth");
+//#region src/api/user.ts
+var debug$1 = (0, debug.default)("verdaccio:web:api:user");
+var WEB_LOGIN_SESSION_ID = "web-login-sessionId";
 function addUserAuthApi(auth, config, storage) {
-  var _config$flags, _config$flags2;
-  var route = (0, _express.Router)(); /* eslint new-cap: 0 */
-  route.post(_middleware.WebUrls.user_login, (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), function (req, res, next) {
-    var _req$body = req.body,
-      username = _req$body.username,
-      password = _req$body.password;
-    debug('authenticate %o', username);
-    auth.authenticate(username, password, /*#__PURE__*/function () {
-      var _ref = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee(err, user) {
-        var errorCode, jWTSignOptions, _t, _t2, _t3;
-        return _regenerator().w(function (_context) {
-          while (1) switch (_context.n) {
-            case 0:
-              if (!err) {
-                _context.n = 1;
-                break;
-              }
-              errorCode = err.message ? _core.HTTP_STATUS.UNAUTHORIZED : _core.HTTP_STATUS.INTERNAL_ERROR;
-              debug('error authenticate %o', errorCode);
-              next(_core.errorUtils.getCode(errorCode, err.message));
-              _context.n = 3;
-              break;
-            case 1:
-              req.remote_user = user;
-              jWTSignOptions = config.security.web.sign;
-              res.set(_core.HEADERS.CACHE_CONTROL, 'no-cache, no-store');
-              _t = next;
-              _context.n = 2;
-              return auth.jwtEncrypt(user, jWTSignOptions);
-            case 2:
-              _t2 = _context.v;
-              _t3 = req.remote_user.name;
-              _t({
-                token: _t2,
-                username: _t3
-              });
-            case 3:
-              return _context.a(2);
-          }
-        }, _callee);
-      }));
-      return function (_x, _x2) {
-        return _ref.apply(this, arguments);
-      };
-    }());
-  });
-  if ((config === null || config === void 0 || (_config$flags = config.flags) === null || _config$flags === void 0 ? void 0 : _config$flags.createUser) === true) {
-    route.put(_middleware.WebUrls.user_signup, (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), function (req, res, next) {
-      var _req$body2 = req.body,
-        name = _req$body2.name,
-        password = _req$body2.password,
-        email = _req$body2.email,
-        sessionId = _req$body2.sessionId;
-      debug('login or adduser');
-
-      // TOOD: reuse with login.ts file
-      if (typeof sessionId !== 'string' || sessionId.length !== 36) {
-        debug('sessionId is invalid length: %o', sessionId.length);
-        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.SESSION_ID_INVALID));
-      }
-      if (!name || !password || !email) {
-        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.API_ERROR.BAD_DATA));
-      }
-      auth.add_user(name, password, /*#__PURE__*/function () {
-        var _ref2 = _asyncToGenerator(/*#__PURE__*/_regenerator().m(function _callee2(err, user) {
-          var tokens, tokenCreatedDate, minutesAgo, token, _t4;
-          return _regenerator().w(function (_context2) {
-            while (1) switch (_context2.n) {
-              case 0:
-                if (!err) {
-                  _context2.n = 2;
-                  break;
-                }
-                if (!(err.status >= _core.HTTP_STATUS.BAD_REQUEST && err.status < _core.HTTP_STATUS.INTERNAL_ERROR)) {
-                  _context2.n = 1;
-                  break;
-                }
-                debug('adduser: error on create user');
-                // With npm registering is the same as logging in,
-                // and npm accepts only an 409 error.
-                // So, changing status code here.
-                return _context2.a(2, next(_core.errorUtils.getCode(err.status, err.message) || _core.errorUtils.getConflict(err.message)));
-              case 1:
-                return _context2.a(2, next(err));
-              case 2:
-                _context2.n = 3;
-                return storage.readTokens({
-                  user: sessionId
-                });
-              case 3:
-                tokens = _context2.v;
-                debug('tokens found for sessionId %o: %o', sessionId, tokens.length);
-                if (!(tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID)) {
-                  _context2.n = 7;
-                  break;
-                }
-                if (!(tokens[0].token.length === 0)) {
-                  _context2.n = 4;
-                  break;
-                }
-                debug('waiting for authentication');
-                // Poll again after short delay
-                // TODO: make this configurable (default 5 seconds)
-                res.status(_core.HTTP_STATUS.ACCEPTED);
-                res.set(_core.HEADERS.RETRY_AFTER, '5');
-                res.json({});
-                return _context2.a(2);
-              case 4:
-                // session token can only be used once
-                debug('deleting session token');
-                _context2.n = 5;
-                return storage.deleteToken(sessionId, tokens[0].key);
-              case 5:
-                // Check if token has expired
-                // TODO: make this configurable (default 2 minutes)
-                tokenCreatedDate = new Date(tokens[0].created);
-                minutesAgo = new Date(Date.now() - 2 * 60 * 1000);
-                if (!(tokenCreatedDate < minutesAgo)) {
-                  _context2.n = 6;
-                  break;
-                }
-                debug('session token expired');
-                return _context2.a(2, next(_core.errorUtils.getUnauthorized(_core.API_ERROR.SESSION_TOKEN_EXPIRED)));
-              case 6:
-                debug('session token is valid, login successful');
-                res.status(_core.HTTP_STATUS.OK);
-                res.json({
-                  token: tokens[0].token
-                });
-                return _context2.a(2);
-              case 7:
-                if (!(name && password)) {
-                  _context2.n = 9;
-                  break;
-                }
-                _context2.n = 8;
-                return (0, _auth.getApiToken)(auth, config, user, password);
-              case 8:
-                _t4 = _context2.v;
-                _context2.n = 10;
-                break;
-              case 9:
-                _t4 = undefined;
-              case 10:
-                token = _t4;
-                if (!token) {
-                  _context2.n = 11;
-                  break;
-                }
-                debug('adduser: new token %o', _core.cryptoUtils.mask(token, 4));
-                return _context2.a(2, next({
-                  token: token,
-                  username: name
-                }));
-              case 11:
-                return _context2.a(2, next(_core.errorUtils.getUnauthorized()));
-            }
-          }, _callee2);
-        }));
-        return function (_x3, _x4) {
-          return _ref2.apply(this, arguments);
-        };
-      }());
-    });
-  }
-  if ((config === null || config === void 0 || (_config$flags2 = config.flags) === null || _config$flags2 === void 0 ? void 0 : _config$flags2.changePassword) === true) {
-    route.put(_middleware.WebUrls.reset_password, (0, _middleware.rateLimit)(config === null || config === void 0 ? void 0 : config.userRateLimit), function (req, res, next) {
-      var _config$server;
-      if (_lodash["default"].isNil(req.remote_user.name)) {
-        res.status(_core.HTTP_STATUS.UNAUTHORIZED);
-        return next({
-          // FUTURE: update to a more meaningful message
-          message: _core.API_ERROR.MUST_BE_LOGGED
-        });
-      }
-      var password = req.body.password;
-      var name = req.remote_user.name;
-      if (_core.validationUtils.validatePassword(password["new"], config === null || config === void 0 || (_config$server = config.server) === null || _config$server === void 0 ? void 0 : _config$server.passwordValidationRegex) === false) {
-        return next(_core.errorUtils.getCode(_core.HTTP_STATUS.BAD_REQUEST, _core.APP_ERROR.PASSWORD_VALIDATION));
-      }
-      auth.changePassword(name, password.old, password["new"], function (err, isUpdated) {
-        if (_lodash["default"].isNil(err) && isUpdated) {
-          next({
-            ok: true
-          });
-        } else {
-          return next(_core.errorUtils.getInternalError(_core.API_ERROR.INTERNAL_SERVER_ERROR));
-        }
-      });
-    });
-  }
-  return route;
+	const route = (0, express.Router)();
+	route.post(_verdaccio_middleware.WebUrls.user_login, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), function(req, res, next) {
+		const { username, password } = req.body;
+		debug$1("authenticate %o", username);
+		auth.authenticate(username, password, async (err, user) => {
+			if (err) {
+				const errorCode = err.message ? _verdaccio_core.HTTP_STATUS.UNAUTHORIZED : _verdaccio_core.HTTP_STATUS.INTERNAL_ERROR;
+				debug$1("error authenticate %o", errorCode);
+				next(_verdaccio_core.errorUtils.getCode(errorCode, err.message));
+			} else {
+				req.remote_user = user;
+				const jWTSignOptions = config.security.web.sign;
+				res.set(_verdaccio_core.HEADERS.CACHE_CONTROL, "no-cache, no-store");
+				next({
+					token: await auth.jwtEncrypt(user, jWTSignOptions),
+					username: req.remote_user.name
+				});
+			}
+		});
+	});
+	if (config?.flags?.createUser === true) route.put(_verdaccio_middleware.WebUrls.user_signup, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), function(req, res, next) {
+		const { name, password, email, sessionId } = req.body;
+		debug$1("login or adduser");
+		if (typeof sessionId !== "string" || sessionId.length !== 36) {
+			debug$1("sessionId is invalid length: %o", sessionId.length);
+			return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.SESSION_ID_INVALID));
+		}
+		if (!name || !password || !email) return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.API_ERROR.BAD_DATA));
+		auth.add_user(name, password, async function(err, user) {
+			if (err) {
+				if (err.status >= _verdaccio_core.HTTP_STATUS.BAD_REQUEST && err.status < _verdaccio_core.HTTP_STATUS.INTERNAL_ERROR) {
+					debug$1("adduser: error on create user");
+					return next(_verdaccio_core.errorUtils.getCode(err.status, err.message) || _verdaccio_core.errorUtils.getConflict(err.message));
+				}
+				return next(err);
+			}
+			const tokens = await storage.readTokens({ user: sessionId });
+			debug$1("tokens found for sessionId %o: %o", sessionId, tokens.length);
+			if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {
+				if (tokens[0].token.length === 0) {
+					debug$1("waiting for authentication");
+					res.status(_verdaccio_core.HTTP_STATUS.ACCEPTED);
+					res.set(_verdaccio_core.HEADERS.RETRY_AFTER, "5");
+					res.json({});
+					return;
+				}
+				debug$1("deleting session token");
+				await storage.deleteToken(sessionId, tokens[0].key);
+				if (new Date(tokens[0].created) < /* @__PURE__ */ new Date(Date.now() - 120 * 1e3)) {
+					debug$1("session token expired");
+					return next(_verdaccio_core.errorUtils.getUnauthorized(_verdaccio_core.API_ERROR.SESSION_TOKEN_EXPIRED));
+				}
+				debug$1("session token is valid, login successful");
+				res.status(_verdaccio_core.HTTP_STATUS.OK);
+				res.json({ token: tokens[0].token });
+				return;
+			}
+			const token = name && password ? await (0, _verdaccio_auth.getApiToken)(auth, config, user, password) : void 0;
+			if (token) {
+				debug$1("adduser: new token %o", _verdaccio_core.cryptoUtils.mask(token, 4));
+				return next({
+					token,
+					username: name
+				});
+			}
+			return next(_verdaccio_core.errorUtils.getUnauthorized());
+		});
+	});
+	if (config?.flags?.changePassword === true) route.put(_verdaccio_middleware.WebUrls.reset_password, (0, _verdaccio_middleware.rateLimit)(config?.userRateLimit), function(req, res, next) {
+		if (lodash.default.isNil(req.remote_user.name)) {
+			res.status(_verdaccio_core.HTTP_STATUS.UNAUTHORIZED);
+			return next({ message: _verdaccio_core.API_ERROR.MUST_BE_LOGGED });
+		}
+		const { password } = req.body;
+		const { name } = req.remote_user;
+		if (_verdaccio_core.validationUtils.validatePassword(password.new, config?.server?.passwordValidationRegex) === false) return next(_verdaccio_core.errorUtils.getCode(_verdaccio_core.HTTP_STATUS.BAD_REQUEST, _verdaccio_core.APP_ERROR.PASSWORD_VALIDATION));
+		auth.changePassword(name, password.old, password.new, (err, isUpdated) => {
+			if (lodash.default.isNil(err) && isUpdated) next({ ok: true });
+			else return next(_verdaccio_core.errorUtils.getInternalError(_verdaccio_core.API_ERROR.INTERNAL_SERVER_ERROR));
+		});
+	});
+	return route;
 }
-var _default = exports["default"] = addUserAuthApi;
+//#endregion
+exports.default = addUserAuthApi;
+
 //# sourceMappingURL=user.js.map

package/build/api/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","names":["_debug","_interopRequireDefault","require","_express","_lodash","_auth","_core","_middleware","e","__esModule","_regenerator","t","r","Symbol","n","iterator","o","toStringTag","i","c","prototype","Generator","u","Object","create","_regeneratorDefine2","f","p","y","G","v","a","d","bind","length","l","TypeError","call","done","value","GeneratorFunction","GeneratorFunctionPrototype","getPrototypeOf","setPrototypeOf","__proto__","displayName","w","m","defineProperty","_regeneratorDefine","_invoke","enumerable","configurable","writable","asyncGeneratorStep","Promise","resolve","then","_asyncToGenerator","arguments","apply","_next","_throw","debug","buildDebug","WEB_LOGIN_SESSION_ID","addUserAuthApi","auth","config","storage","_config$flags","_config$flags2","route","Router","post","WebUrls","user_login","rateLimit","userRateLimit","req","res","next","_req$body","body","username","password","authenticate","_ref","_callee","err","user","errorCode","jWTSignOptions","_t","_t2","_t3","_context","message","HTTP_STATUS","UNAUTHORIZED","INTERNAL_ERROR","errorUtils","getCode","remote_user","security","web","sign","set","HEADERS","CACHE_CONTROL","jwtEncrypt","name","token","_x","_x2","flags","createUser","put","user_signup","_req$body2","email","sessionId","BAD_REQUEST","API_ERROR","SESSION_ID_INVALID","BAD_DATA","add_user","_ref2","_callee2","tokens","tokenCreatedDate","minutesAgo","_t4","_context2","status","getConflict","readTokens","key","ACCEPTED","RETRY_AFTER","json","deleteToken","Date","created","now","getUnauthorized","SESSION_TOKEN_EXPIRED","OK","getApiToken","undefined","cryptoUtils","mask","_x3","_x4","changePassword","reset_password","_config$server","_","isNil","MUST_BE_LOGGED","validationUtils","validatePassword","server","passwordValidationRegex","APP_ERROR","PASSWORD_VALIDATION","old","isUpdated","ok","getInternalError","INTERNAL_SERVER_ERROR","_default","exports"],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport _ from 'lodash';\n\nimport { type Auth, getApiToken } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n            next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (_.isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (_.isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,sBAAA,CAAAC,OAAA;AAEA,IAAAC,QAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAH,sBAAA,CAAAC,OAAA;AAEA,IAAAG,KAAA,GAAAH,OAAA;AAEA,IAAAI,KAAA,GAAAJ,OAAA;AASA,IAAAK,WAAA,GAAAL,OAAA;AAA2D,SAAAD,uBAAAO,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,gBAAAA,CAAA;AAAA,SAAAE,aAAA,IAf3D,uKAAAF,CAAA,EAAAG,CAAA,EAAAC,CAAA,wBAAAC,MAAA,GAAAA,MAAA,OAAAC,CAAA,GAAAF,CAAA,CAAAG,QAAA,kBAAAC,CAAA,GAAAJ,CAAA,CAAAK,WAAA,8BAAAC,EAAAN,CAAA,EAAAE,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAC,CAAA,GAAAL,CAAA,IAAAA,CAAA,CAAAM,SAAA,YAAAC,SAAA,GAAAP,CAAA,GAAAO,SAAA,EAAAC,CAAA,GAAAC,MAAA,CAAAC,MAAA,CAAAL,CAAA,CAAAC,SAAA,UAAAK,mBAAA,CAAAH,CAAA,uBAAAV,CAAA,EAAAE,CAAA,EAAAE,CAAA,QAAAE,CAAA,EAAAC,CAAA,EAAAG,CAAA,EAAAI,CAAA,MAAAC,CAAA,GAAAX,CAAA,QAAAY,CAAA,OAAAC,CAAA,KAAAF,CAAA,KAAAb,CAAA,KAAAgB,CAAA,EAAAtB,CAAA,EAAAuB,CAAA,EAAAC,CAAA,EAAAN,CAAA,EAAAM,CAAA,CAAAC,IAAA,CAAAzB,CAAA,MAAAwB,CAAA,WAAAA,EAAArB,CAAA,EAAAC,CAAA,WAAAM,CAAA,GAAAP,CAAA,EAAAQ,CAAA,MAAAG,CAAA,GAAAd,CAAA,EAAAqB,CAAA,CAAAf,CAAA,GAAAF,CAAA,EAAAmB,CAAA,gBAAAC,EAAApB,CAAA,EAAAE,CAAA,SAAAK,CAAA,GAAAP,CAAA,EAAAU,CAAA,GAAAR,CAAA,EAAAH,CAAA,OAAAiB,CAAA,IAAAF,CAAA,KAAAV,CAAA,IAAAL,CAAA,GAAAgB,CAAA,CAAAO,MAAA,EAAAvB,CAAA,UAAAK,CAAA,EAAAE,CAAA,GAAAS,CAAA,CAAAhB,CAAA,GAAAqB,CAAA,GAAAH,CAAA,CAAAF,CAAA,EAAAQ,CAAA,GAAAjB,CAAA,KAAAN,CAAA,QAAAI,CAAA,GAAAmB,CAAA,KAAArB,CAAA,MAAAQ,CAAA,GAAAJ,CAAA,EAAAC,CAAA,GAAAD,CAAA,YAAAC,CAAA,WAAAD,CAAA,MAAAA,CAAA,MAAAV,CAAA,IAAAU,CAAA,OAAAc,CAAA,MAAAhB,CAAA,GAAAJ,CAAA,QAAAoB,CAAA,GAAAd,CAAA,QAAAC,CAAA,MAAAU,CAAA,CAAAC,CAAA,GAAAhB,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAI,CAAA,OAAAc,CAAA,GAAAG,CAAA,KAAAnB,CAAA,GAAAJ,CAAA,QAAAM,CAAA,MAAAJ,CAAA,IAAAA,CAAA,GAAAqB,CAAA,MAAAjB,CAAA,MAAAN,CAAA,EAAAM,CAAA,MAAAJ,CAAA,EAAAe,CAAA,CAAAf,CAAA,GAAAqB,CAAA,EAAAhB,CAAA,cAAAH,CAAA,IAAAJ,CAAA,aAAAmB,CAAA,QAAAH,CAAA,OAAAd,CAAA,qBAAAE,CAAA,EAAAW,CAAA,EAAAQ,CAAA,QAAAT,CAAA,YAAAU,SAAA,uCAAAR,CAAA,UAAAD,CAAA,IAAAK,CAAA,CAAAL,CAAA,EAAAQ,CAAA,GAAAhB,CAAA,GAAAQ,CAAA,EAAAL,CAAA,GAAAa,CAAA,GAAAxB,CAAA,GAAAQ,CAAA,OAAAX,CAAA,GAAAc,CAAA,MAAAM,CAAA,KAAAV,CAAA,KAAAC,CAAA,GAAAA,CAAA,QAAAA,CAAA,SAAAU,CAAA,CAAAf,CAAA,QAAAkB,CAAA,CAAAb,CAAA,EAAAG,CAAA,KAAAO,CAAA,CAAAf,CAAA,GAAAQ,CAAA,GAAAO,CAAA,CAAAC,CAAA,GAAAR,CAAA,aAAAI,CAAA,MAAAR,CAAA,QAAAC,CAAA,KAAAH,CAAA,YAAAL,CAAA,GAAAO,CAAA,CAAAF,CAAA,WAAAL,CAAA,GAAAA,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,EAAAI,CAAA,UAAAc,SAAA,2CAAAzB,CAAA,CAAA2B,IAAA,SAAA3B,CAAA,EAAAW,CAAA,GAAAX,CAAA,CAAA4B,KAAA,EAAApB,CAAA,SAAAA,CAAA,oBAAAA,CAAA,KAAAR,CAAA,GAAAO,CAAA,eAAAP,CAAA,CAAA0B,IAAA,CAAAnB,CAAA,GAAAC,CAAA,SAAAG,CAAA,GAAAc,SAAA,uCAAApB,CAAA,gBAAAG,CAAA,OAAAD,CAAA,GAAAV,CAAA,cAAAG,CAAA,IAAAiB,CAAA,GAAAC,CAAA,CAAAf,CAAA,QAAAQ,CAAA,GAAAV,CAAA,CAAAyB,IAAA,CAAAvB,CAAA,EAAAe,CAAA,OAAAE,CAAA,kBAAApB,CAAA,IAAAO,CAAA,GAAAV,CAAA,EAAAW,CAAA,MAAAG,CAAA,GAAAX,CAAA,cAAAe,CAAA,mBAAAa,KAAA,EAAA5B,CAAA,EAAA2B,IAAA,EAAAV,CAAA,SAAAhB,CAAA,EAAAI,CAAA,EAAAE,CAAA,QAAAI,CAAA,QAAAS,CAAA,gBAAAV,UAAA,cAAAmB,kBAAA,cAAAC,2BAAA,KAAA9B,CAAA,GAAAY,MAAA,CAAAmB,cAAA,MAAAvB,CAAA,MAAAL,CAAA,IAAAH,CAAA,CAAAA,CAAA,IAAAG,CAAA,SAAAW,mBAAA,CAAAd,CAAA,OAAAG,CAAA,iCAAAH,CAAA,GAAAW,CAAA,GAAAmB,0BAAA,CAAArB,SAAA,GAAAC,SAAA,CAAAD,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAL,CAAA,YAAAO,EAAAlB,CAAA,WAAAe,MAAA,CAAAoB,cAAA,GAAApB,MAAA,CAAAoB,cAAA,CAAAnC,CAAA,EAAAiC,0BAAA,KAAAjC,CAAA,CAAAoC,SAAA,GAAAH,0BAAA,EAAAhB,mBAAA,CAAAjB,CAAA,EAAAQ,CAAA,yBAAAR,CAAA,CAAAY,SAAA,GAAAG,MAAA,CAAAC,MAAA,CAAAF,CAAA,GAAAd,CAAA,WAAAgC,iBAAA,CAAApB,SAAA,GAAAqB,0BAAA,EAAAhB,mBAAA,CAAAH,CAAA,iBAAAmB,0BAAA,GAAAhB,mBAAA,CAAAgB,0BAAA,iBAAAD,iBAAA,GAAAA,iBAAA,CAAAK,WAAA,wBAAApB,mBAAA,CAAAgB,0BAAA,EAAAzB,CAAA,wBAAAS,mBAAA,CAAAH,CAAA,GAAAG,mBAAA,CAAAH,CAAA,EAAAN,CAAA,gBAAAS,mBAAA,CAAAH,CAAA,EAAAR,CAAA,iCAAAW,mBAAA,CAAAH,CAAA,8DAAAZ,YAAA,YAAAA,aAAA,aAAAoC,CAAA,EAAA5B,CAAA,EAAA6B,CAAA,EAAArB,CAAA;AAAA,SAAAD,oBAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,QAAAO,CAAA,GAAAK,MAAA,CAAAyB,cAAA,QAAA9B,CAAA,uBAAAV,CAAA,IAAAU,CAAA,QAAAO,mBAAA,YAAAwB,mBAAAzC,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA,aAAAK,EAAAJ,CAAA,EAAAE,CAAA,IAAAW,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,YAAAJ,CAAA,gBAAA0C,OAAA,CAAAtC,CAAA,EAAAE,CAAA,EAAAN,CAAA,SAAAI,CAAA,GAAAM,CAAA,GAAAA,CAAA,CAAAV,CAAA,EAAAI,CAAA,IAAA2B,KAAA,EAAAzB,CAAA,EAAAqC,UAAA,GAAAxC,CAAA,EAAAyC,YAAA,GAAAzC,CAAA,EAAA0C,QAAA,GAAA1C,CAAA,MAAAH,CAAA,CAAAI,CAAA,IAAAE,CAAA,IAAAE,CAAA,aAAAA,CAAA,cAAAA,CAAA,mBAAAS,mBAAA,CAAAjB,CAAA,EAAAI,CAAA,EAAAE,CAAA,EAAAH,CAAA;AAAA,SAAA2C,mBAAAxC,CAAA,EAAAH,CAAA,EAAAH,CAAA,EAAAI,CAAA,EAAAI,CAAA,EAAAe,CAAA,EAAAZ,CAAA,cAAAD,CAAA,GAAAJ,CAAA,CAAAiB,CAAA,EAAAZ,CAAA,GAAAG,CAAA,GAAAJ,CAAA,CAAAqB,KAAA,WAAAzB,CAAA,gBAAAN,CAAA,CAAAM,CAAA,KAAAI,CAAA,CAAAoB,IAAA,GAAA3B,CAAA,CAAAW,CAAA,IAAAiC,OAAA,CAAAC,OAAA,CAAAlC,CAAA,EAAAmC,IAAA,CAAA7C,CAAA,EAAAI,CAAA;AAAA,SAAA0C,kBAAA5C,CAAA,6BAAAH,CAAA,SAAAH,CAAA,GAAAmD,SAAA,aAAAJ,OAAA,WAAA3C,CAAA,EAAAI,CAAA,QAAAe,CAAA,GAAAjB,CAAA,CAAA8C,KAAA,CAAAjD,CAAA,EAAAH,CAAA,YAAAqD,MAAA/C,CAAA,IAAAwC,kBAAA,CAAAvB,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA6C,KAAA,EAAAC,MAAA,UAAAhD,CAAA,cAAAgD,OAAAhD,CAAA,IAAAwC,kBAAA,CAAAvB,CAAA,EAAAnB,CAAA,EAAAI,CAAA,EAAA6C,KAAA,EAAAC,MAAA,WAAAhD,CAAA,KAAA+C,KAAA;AAoBA,IAAME,KAAK,GAAG,IAAAC,iBAAU,EAAC,wBAAwB,CAAC;AAElD,IAAMC,oBAAoB,GAAG,qBAAqB;AAElD,SAASC,cAAcA,CAACC,IAAU,EAAEC,MAAc,EAAEC,OAAgB,EAAU;EAAA,IAAAC,aAAA,EAAAC,cAAA;EAC5E,IAAMC,KAAK,GAAG,IAAAC,eAAM,EAAC,CAAC,CAAC,CAAC;EACxBD,KAAK,CAACE,IAAI,CACRC,mBAAO,CAACC,UAAU,EAClB,IAAAC,qBAAS,EAACT,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEU,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;IACnE,IAAAC,SAAA,GAA+BH,GAAG,CAACI,IAAI;MAA/BC,QAAQ,GAAAF,SAAA,CAARE,QAAQ;MAAEC,QAAQ,GAAAH,SAAA,CAARG,QAAQ;IAC1BtB,KAAK,CAAC,iBAAiB,EAAEqB,QAAQ,CAAC;IAClCjB,IAAI,CAACmB,YAAY,CACfF,QAAQ,EACRC,QAAQ;MAAA,IAAAE,IAAA,GAAA7B,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CACR,SAAAyC,QAAOC,GAA0B,EAAEC,IAAiB;QAAA,IAAAC,SAAA,EAAAC,cAAA,EAAAC,EAAA,EAAAC,GAAA,EAAAC,GAAA;QAAA,OAAArF,YAAA,GAAAoC,CAAA,WAAAkD,QAAA;UAAA,kBAAAA,QAAA,CAAAlF,CAAA;YAAA;cAAA,KAC9C2E,GAAG;gBAAAO,QAAA,CAAAlF,CAAA;gBAAA;cAAA;cACC6E,SAAS,GAAGF,GAAG,CAACQ,OAAO,GAAGC,iBAAW,CAACC,YAAY,GAAGD,iBAAW,CAACE,cAAc;cACrFrC,KAAK,CAAC,uBAAuB,EAAE4B,SAAS,CAAC;cACzCV,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACX,SAAS,EAAEF,GAAG,CAACQ,OAAO,CAAC,CAAC;cAACD,QAAA,CAAAlF,CAAA;cAAA;YAAA;cAEjDiE,GAAG,CAACwB,WAAW,GAAGb,IAAkB;cAC9BE,cAA8B,GAAGxB,MAAM,CAACoC,QAAQ,CAACC,GAAG,CAACC,IAAI;cAC/D1B,GAAG,CAAC2B,GAAG,CAACC,aAAO,CAACC,aAAa,EAAE,oBAAoB,CAAC;cAAChB,EAAA,GACrDZ,IAAI;cAAAe,QAAA,CAAAlF,CAAA;cAAA,OACWqD,IAAI,CAAC2C,UAAU,CAACpB,IAAI,EAAgBE,cAAc,CAAC;YAAA;cAAAE,GAAA,GAAAE,QAAA,CAAAlE,CAAA;cAAAiE,GAAA,GACtDhB,GAAG,CAACwB,WAAW,CAACQ,IAAI;cAAAlB,EAAA;gBAD9BmB,KAAK,EAAAlB,GAAA;gBACLV,QAAQ,EAAAW;cAAA;YAAA;cAAA,OAAAC,QAAA,CAAAjE,CAAA;UAAA;QAAA,GAAAyD,OAAA;MAAA,CAGb;MAAA,iBAAAyB,EAAA,EAAAC,GAAA;QAAA,OAAA3B,IAAA,CAAA3B,KAAA,OAAAD,SAAA;MAAA;IAAA,GACH,CAAC;EACH,CACF,CAAC;EAED,IAAI,CAAAS,MAAM,aAANA,MAAM,gBAAAE,aAAA,GAANF,MAAM,CAAE+C,KAAK,cAAA7C,aAAA,uBAAbA,aAAA,CAAe8C,UAAU,MAAK,IAAI,EAAE;IACtC5C,KAAK,CAAC6C,GAAG,CACP1C,mBAAO,CAAC2C,WAAW,EACnB,IAAAzC,qBAAS,EAACT,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEU,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;MACnE,IAAAsC,UAAA,GAA6CxC,GAAG,CAACI,IAAI;QAA7C4B,IAAI,GAAAQ,UAAA,CAAJR,IAAI;QAAE1B,QAAQ,GAAAkC,UAAA,CAARlC,QAAQ;QAAEmC,KAAK,GAAAD,UAAA,CAALC,KAAK;QAAEC,SAAS,GAAAF,UAAA,CAATE,SAAS;MACxC1D,KAAK,CAAC,kBAAkB,CAAC;;MAEzB;MACA,IAAI,OAAO0D,SAAS,KAAK,QAAQ,IAAIA,SAAS,CAACvF,MAAM,KAAK,EAAE,EAAE;QAC5D6B,KAAK,CAAC,iCAAiC,EAAE0D,SAAS,CAACvF,MAAM,CAAC;QAC1D,OAAO+C,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACJ,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACC,kBAAkB,CAAC,CAAC;MACxF;MAEA,IAAI,CAACb,IAAI,IAAI,CAAC1B,QAAQ,IAAI,CAACmC,KAAK,EAAE;QAChC,OAAOvC,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACJ,iBAAW,CAACwB,WAAW,EAAEC,eAAS,CAACE,QAAQ,CAAC,CAAC;MAC9E;MAEA1D,IAAI,CAAC2D,QAAQ,CAACf,IAAI,EAAE1B,QAAQ;QAAA,IAAA0C,KAAA,GAAArE,iBAAA,cAAAhD,YAAA,GAAAqC,CAAA,CAAE,SAAAiF,SAAgBvC,GAAG,EAAEC,IAAI;UAAA,IAAAuC,MAAA,EAAAC,gBAAA,EAAAC,UAAA,EAAAnB,KAAA,EAAAoB,GAAA;UAAA,OAAA1H,YAAA,GAAAoC,CAAA,WAAAuF,SAAA;YAAA,kBAAAA,SAAA,CAAAvH,CAAA;cAAA;gBAAA,KACjD2E,GAAG;kBAAA4C,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBAAA,MACD2E,GAAG,CAAC6C,MAAM,IAAIpC,iBAAW,CAACwB,WAAW,IAAIjC,GAAG,CAAC6C,MAAM,GAAGpC,iBAAW,CAACE,cAAc;kBAAAiC,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBAClFiD,KAAK,CAAC,+BAA+B,CAAC;gBACtC;gBACA;gBACA;gBAAA,OAAAsE,SAAA,CAAAtG,CAAA,IACOkD,IAAI,CACToB,gBAAU,CAACC,OAAO,CAACb,GAAG,CAAC6C,MAAM,EAAE7C,GAAG,CAACQ,OAAO,CAAC,IAAII,gBAAU,CAACkC,WAAW,CAAC9C,GAAG,CAACQ,OAAO,CACnF,CAAC;cAAA;gBAAA,OAAAoC,SAAA,CAAAtG,CAAA,IAEIkD,IAAI,CAACQ,GAAG,CAAC;cAAA;gBAAA4C,SAAA,CAAAvH,CAAA;gBAAA,OAGGuD,OAAO,CAACmE,UAAU,CAAC;kBAAE9C,IAAI,EAAE+B;gBAAU,CAAC,CAAC;cAAA;gBAAtDQ,MAAM,GAAAI,SAAA,CAAAvG,CAAA;gBACZiC,KAAK,CAAC,mCAAmC,EAAE0D,SAAS,EAAEQ,MAAM,CAAC/F,MAAM,CAAC;gBAAC,MACjE+F,MAAM,IAAIA,MAAM,CAAC/F,MAAM,KAAK,CAAC,IAAI+F,MAAM,CAAC,CAAC,CAAC,CAACQ,GAAG,KAAKxE,oBAAoB;kBAAAoE,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBAAA,MACrEmH,MAAM,CAAC,CAAC,CAAC,CAACjB,KAAK,CAAC9E,MAAM,KAAK,CAAC;kBAAAmG,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBAC9BiD,KAAK,CAAC,4BAA4B,CAAC;gBACnC;gBACA;gBACAiB,GAAG,CAACsD,MAAM,CAACpC,iBAAW,CAACwC,QAAQ,CAAC;gBAChC1D,GAAG,CAAC2B,GAAG,CAACC,aAAO,CAAC+B,WAAW,EAAE,GAAG,CAAC;gBACjC3D,GAAG,CAAC4D,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAC,OAAAP,SAAA,CAAAtG,CAAA;cAAA;gBAIf;gBACAgC,KAAK,CAAC,wBAAwB,CAAC;gBAACsE,SAAA,CAAAvH,CAAA;gBAAA,OAC1BuD,OAAO,CAACwE,WAAW,CAACpB,SAAS,EAAEQ,MAAM,CAAC,CAAC,CAAC,CAACQ,GAAG,CAAC;cAAA;gBAEnD;gBACA;gBACMP,gBAAgB,GAAG,IAAIY,IAAI,CAACb,MAAM,CAAC,CAAC,CAAC,CAACc,OAAO,CAAC;gBAC9CZ,UAAU,GAAG,IAAIW,IAAI,CAACA,IAAI,CAACE,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAA,MACnDd,gBAAgB,GAAGC,UAAU;kBAAAE,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBAC/BiD,KAAK,CAAC,uBAAuB,CAAC;gBAAC,OAAAsE,SAAA,CAAAtG,CAAA,IACxBkD,IAAI,CAACoB,gBAAU,CAAC4C,eAAe,CAACtB,eAAS,CAACuB,qBAAqB,CAAC,CAAC;cAAA;gBAG1EnF,KAAK,CAAC,0CAA0C,CAAC;gBACjDiB,GAAG,CAACsD,MAAM,CAACpC,iBAAW,CAACiD,EAAE,CAAC;gBAC1BnE,GAAG,CAAC4D,IAAI,CAAC;kBAAE5B,KAAK,EAAEiB,MAAM,CAAC,CAAC,CAAC,CAACjB;gBAAM,CAAC,CAAC;gBAAC,OAAAqB,SAAA,CAAAtG,CAAA;cAAA;gBAAA,MAKrCgF,IAAI,IAAI1B,QAAQ;kBAAAgD,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBAAAuH,SAAA,CAAAvH,CAAA;gBAAA,OACN,IAAAsI,iBAAW,EAACjF,IAAI,EAAEC,MAAM,EAAEsB,IAAI,EAAgBL,QAAQ,CAAC;cAAA;gBAAA+C,GAAA,GAAAC,SAAA,CAAAvG,CAAA;gBAAAuG,SAAA,CAAAvH,CAAA;gBAAA;cAAA;gBAAAsH,GAAA,GAC7DiB,SAAS;cAAA;gBAHTrC,KAAK,GAAAoB,GAAA;gBAAA,KAIPpB,KAAK;kBAAAqB,SAAA,CAAAvH,CAAA;kBAAA;gBAAA;gBACPiD,KAAK,CAAC,uBAAuB,EAAEuF,iBAAW,CAACC,IAAI,CAACvC,KAAK,EAAY,CAAC,CAAC,CAAC;gBAAC,OAAAqB,SAAA,CAAAtG,CAAA,IAC9DkD,IAAI,CAAC;kBAAE+B,KAAK,EAALA,KAAK;kBAAE5B,QAAQ,EAAE2B;gBAAK,CAAC,CAAC;cAAA;gBAAA,OAAAsB,SAAA,CAAAtG,CAAA,IAEjCkD,IAAI,CAACoB,gBAAU,CAAC4C,eAAe,CAAC,CAAC,CAAC;YAAA;UAAA,GAAAjB,QAAA;QAAA,CAC1C;QAAA,iBAAAwB,GAAA,EAAAC,GAAA;UAAA,OAAA1B,KAAA,CAAAnE,KAAA,OAAAD,SAAA;QAAA;MAAA,IAAC;IACJ,CACF,CAAC;EACH;EAEA,IAAI,CAAAS,MAAM,aAANA,MAAM,gBAAAG,cAAA,GAANH,MAAM,CAAE+C,KAAK,cAAA5C,cAAA,uBAAbA,cAAA,CAAemF,cAAc,MAAK,IAAI,EAAE;IAC1ClF,KAAK,CAAC6C,GAAG,CACP1C,mBAAO,CAACgF,cAAc,EACtB,IAAA9E,qBAAS,EAACT,MAAM,aAANA,MAAM,uBAANA,MAAM,CAAEU,aAAa,CAAC,EAChC,UAAUC,GAAY,EAAEC,GAAa,EAAEC,IAAsB,EAAQ;MAAA,IAAA2E,cAAA;MACnE,IAAIC,kBAAC,CAACC,KAAK,CAAC/E,GAAG,CAACwB,WAAW,CAACQ,IAAI,CAAC,EAAE;QACjC/B,GAAG,CAACsD,MAAM,CAACpC,iBAAW,CAACC,YAAY,CAAC;QACpC,OAAOlB,IAAI,CAAC;UACV;UACAgB,OAAO,EAAE0B,eAAS,CAACoC;QACrB,CAAC,CAAC;MACJ;MAEA,IAAQ1E,QAAQ,GAAKN,GAAG,CAACI,IAAI,CAArBE,QAAQ;MAChB,IAAQ0B,IAAI,GAAKhC,GAAG,CAACwB,WAAW,CAAxBQ,IAAI;MAEZ,IACEiD,qBAAe,CAACC,gBAAgB,CAC9B5E,QAAQ,OAAI,EACZjB,MAAM,aAANA,MAAM,gBAAAwF,cAAA,GAANxF,MAAM,CAAE8F,MAAM,cAAAN,cAAA,uBAAdA,cAAA,CAAgBO,uBAClB,CAAC,KAAK,KAAK,EACX;QACA,OAAOlF,IAAI,CAACoB,gBAAU,CAACC,OAAO,CAACJ,iBAAW,CAACwB,WAAW,EAAE0C,eAAS,CAACC,mBAAmB,CAAC,CAAC;MACzF;MAEAlG,IAAI,CAACuF,cAAc,CAAC3C,IAAI,EAAY1B,QAAQ,CAACiF,GAAG,EAAEjF,QAAQ,OAAI,EAAE,UAACI,GAAG,EAAE8E,SAAS,EAAW;QACxF,IAAIV,kBAAC,CAACC,KAAK,CAACrE,GAAG,CAAC,IAAI8E,SAAS,EAAE;UAC7BtF,IAAI,CAAC;YACHuF,EAAE,EAAE;UACN,CAAC,CAAC;QACJ,CAAC,MAAM;UACL,OAAOvF,IAAI,CAACoB,gBAAU,CAACoE,gBAAgB,CAAC9C,eAAS,CAAC+C,qBAAqB,CAAC,CAAC;QAC3E;MACF,CAAC,CAAC;IACJ,CACF,CAAC;EACH;EAEA,OAAOlG,KAAK;AACd;AAAC,IAAAmG,QAAA,GAAAC,OAAA,cAEc1G,cAAc","ignoreList":[]}
+{"version":3,"file":"user.js","names":[],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport _ from 'lodash';\n\nimport { type Auth, getApiToken } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n            next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (_.isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (_.isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;;;;;AAqBA,IAAM,WAAA,GAAA,MAAA,SAAmB,yBAAyB;AAElD,IAAM,uBAAuB;AAE7B,SAAS,eAAe,MAAY,QAAgB,SAA0B;CAC5E,MAAM,SAAA,GAAA,QAAA,SAAgB;AACtB,OAAM,KACJ,sBAAA,QAAQ,aAAA,GAAA,sBAAA,WACE,QAAQ,cAAc,EAChC,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,UAAU,aAAa,IAAI;AACnC,UAAM,mBAAmB,SAAS;AAClC,OAAK,aACH,UACA,UACA,OAAO,KAA4B,SAAqC;AACtE,OAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,gBAAA,YAAY,eAAe,gBAAA,YAAY;AACvE,YAAM,yBAAyB,UAAU;AACzC,SAAK,gBAAA,WAAW,QAAQ,WAAW,IAAI,QAAQ,CAAC;UAC3C;AACL,QAAI,cAAc;IAClB,MAAM,iBAAiC,OAAO,SAAS,IAAI;AAC3D,QAAI,IAAI,gBAAA,QAAQ,eAAe,qBAAqB;AACpD,SAAK;KACH,OAAO,MAAM,KAAK,WAAW,MAAoB,eAAe;KAChE,UAAU,IAAI,YAAY;KAC3B,CAAC;;IAGP;GAEJ;AAED,KAAI,QAAQ,OAAO,eAAe,KAChC,OAAM,IACJ,sBAAA,QAAQ,cAAA,GAAA,sBAAA,WACE,QAAQ,cAAc,EAChC,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,MAAM,UAAU,OAAO,cAAc,IAAI;AACjD,UAAM,mBAAmB;AAGzB,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,IAAI;AAC5D,WAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,mBAAmB,CAAC;;AAGxF,MAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MACzB,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,SAAS,CAAC;AAG9E,OAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;AACtE,OAAI,KAAK;AACP,QAAI,IAAI,UAAU,gBAAA,YAAY,eAAe,IAAI,SAAS,gBAAA,YAAY,gBAAgB;AACpF,aAAM,gCAAgC;AAItC,YAAO,KACL,gBAAA,WAAW,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,gBAAA,WAAW,YAAY,IAAI,QAAQ,CACnF;;AAEH,WAAO,KAAK,IAAI;;GAGlB,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,WAAM,qCAAqC,WAAW,OAAO,OAAO;AACpE,OAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,sBAAsB;AAC3E,QAAI,OAAO,GAAG,MAAM,WAAW,GAAG;AAChC,aAAM,6BAA6B;AAGnC,SAAI,OAAO,gBAAA,YAAY,SAAS;AAChC,SAAI,IAAI,gBAAA,QAAQ,aAAa,IAAI;AACjC,SAAI,KAAK,EAAE,CAAC;AACZ;;AAIF,YAAM,yBAAyB;AAC/B,UAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,IAAI;AAMnD,QAFyB,IAAI,KAAK,OAAO,GAAG,QAAQ,mBACjC,IAAI,KAAK,KAAK,KAAK,GAAG,MAAS,IAAK,EACpB;AACjC,aAAM,wBAAwB;AAC9B,YAAO,KAAK,gBAAA,WAAW,gBAAgB,gBAAA,UAAU,sBAAsB,CAAC;;AAG1E,YAAM,2CAA2C;AACjD,QAAI,OAAO,gBAAA,YAAY,GAAG;AAC1B,QAAI,KAAK,EAAE,OAAO,OAAO,GAAG,OAAO,CAAC;AACpC;;GAGF,MAAM,QACJ,QAAQ,WACJ,OAAA,GAAA,gBAAA,aAAkB,MAAM,QAAQ,MAAoB,SAAS,GAC7D,KAAA;AACN,OAAI,OAAO;AACT,YAAM,yBAAyB,gBAAA,YAAY,KAAK,OAAiB,EAAE,CAAC;AACpE,WAAO,KAAK;KAAE;KAAO,UAAU;KAAM,CAAC;;AAExC,UAAO,KAAK,gBAAA,WAAW,iBAAiB,CAAC;IACzC;GAEL;AAGH,KAAI,QAAQ,OAAO,mBAAmB,KACpC,OAAM,IACJ,sBAAA,QAAQ,iBAAA,GAAA,sBAAA,WACE,QAAQ,cAAc,EAChC,SAAU,KAAc,KAAe,MAA8B;AACnE,MAAI,OAAA,QAAE,MAAM,IAAI,YAAY,KAAK,EAAE;AACjC,OAAI,OAAO,gBAAA,YAAY,aAAa;AACpC,UAAO,KAAK,EAEV,SAAS,gBAAA,UAAU,gBACpB,CAAC;;EAGJ,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;AAErB,MACE,gBAAA,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,wBACjB,KAAK,MAEN,QAAO,KAAK,gBAAA,WAAW,QAAQ,gBAAA,YAAY,aAAa,gBAAA,UAAU,oBAAoB,CAAC;AAGzF,OAAK,eAAe,MAAgB,SAAS,KAAK,SAAS,MAAM,KAAK,cAAoB;AACxF,OAAI,OAAA,QAAE,MAAM,IAAI,IAAI,UAClB,MAAK,EACH,IAAI,MACL,CAAC;OAEF,QAAO,KAAK,gBAAA,WAAW,iBAAiB,gBAAA,UAAU,sBAAsB,CAAC;IAE3E;GAEL;AAGH,QAAO"}

package/build/api/user.mjs

@@ -0,0 +1,97 @@
+import { Router } from "express";
+import _ from "lodash";
+import { API_ERROR, APP_ERROR, HEADERS, HTTP_STATUS, cryptoUtils, errorUtils, validationUtils } from "@verdaccio/core";
+import { WebUrls, rateLimit } from "@verdaccio/middleware";
+import buildDebug from "debug";
+import { getApiToken } from "@verdaccio/auth";
+//#region src/api/user.ts
+var debug = buildDebug("verdaccio:web:api:user");
+var WEB_LOGIN_SESSION_ID = "web-login-sessionId";
+function addUserAuthApi(auth, config, storage) {
+	const route = Router();
+	route.post(WebUrls.user_login, rateLimit(config?.userRateLimit), function(req, res, next) {
+		const { username, password } = req.body;
+		debug("authenticate %o", username);
+		auth.authenticate(username, password, async (err, user) => {
+			if (err) {
+				const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;
+				debug("error authenticate %o", errorCode);
+				next(errorUtils.getCode(errorCode, err.message));
+			} else {
+				req.remote_user = user;
+				const jWTSignOptions = config.security.web.sign;
+				res.set(HEADERS.CACHE_CONTROL, "no-cache, no-store");
+				next({
+					token: await auth.jwtEncrypt(user, jWTSignOptions),
+					username: req.remote_user.name
+				});
+			}
+		});
+	});
+	if (config?.flags?.createUser === true) route.put(WebUrls.user_signup, rateLimit(config?.userRateLimit), function(req, res, next) {
+		const { name, password, email, sessionId } = req.body;
+		debug("login or adduser");
+		if (typeof sessionId !== "string" || sessionId.length !== 36) {
+			debug("sessionId is invalid length: %o", sessionId.length);
+			return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));
+		}
+		if (!name || !password || !email) return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));
+		auth.add_user(name, password, async function(err, user) {
+			if (err) {
+				if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {
+					debug("adduser: error on create user");
+					return next(errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message));
+				}
+				return next(err);
+			}
+			const tokens = await storage.readTokens({ user: sessionId });
+			debug("tokens found for sessionId %o: %o", sessionId, tokens.length);
+			if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {
+				if (tokens[0].token.length === 0) {
+					debug("waiting for authentication");
+					res.status(HTTP_STATUS.ACCEPTED);
+					res.set(HEADERS.RETRY_AFTER, "5");
+					res.json({});
+					return;
+				}
+				debug("deleting session token");
+				await storage.deleteToken(sessionId, tokens[0].key);
+				if (new Date(tokens[0].created) < /* @__PURE__ */ new Date(Date.now() - 120 * 1e3)) {
+					debug("session token expired");
+					return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));
+				}
+				debug("session token is valid, login successful");
+				res.status(HTTP_STATUS.OK);
+				res.json({ token: tokens[0].token });
+				return;
+			}
+			const token = name && password ? await getApiToken(auth, config, user, password) : void 0;
+			if (token) {
+				debug("adduser: new token %o", cryptoUtils.mask(token, 4));
+				return next({
+					token,
+					username: name
+				});
+			}
+			return next(errorUtils.getUnauthorized());
+		});
+	});
+	if (config?.flags?.changePassword === true) route.put(WebUrls.reset_password, rateLimit(config?.userRateLimit), function(req, res, next) {
+		if (_.isNil(req.remote_user.name)) {
+			res.status(HTTP_STATUS.UNAUTHORIZED);
+			return next({ message: API_ERROR.MUST_BE_LOGGED });
+		}
+		const { password } = req.body;
+		const { name } = req.remote_user;
+		if (validationUtils.validatePassword(password.new, config?.server?.passwordValidationRegex) === false) return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));
+		auth.changePassword(name, password.old, password.new, (err, isUpdated) => {
+			if (_.isNil(err) && isUpdated) next({ ok: true });
+			else return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));
+		});
+	});
+	return route;
+}
+//#endregion
+export { addUserAuthApi as default };
+
+//# sourceMappingURL=user.mjs.map

package/build/api/user.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.mjs","names":[],"sources":["../../src/api/user.ts"],"sourcesContent":["import buildDebug from 'debug';\nimport type { Request, Response } from 'express';\nimport { Router } from 'express';\nimport _ from 'lodash';\n\nimport { type Auth, getApiToken } from '@verdaccio/auth';\nimport type { VerdaccioError } from '@verdaccio/core';\nimport {\n  API_ERROR,\n  APP_ERROR,\n  HEADERS,\n  HTTP_STATUS,\n  cryptoUtils,\n  errorUtils,\n  validationUtils,\n} from '@verdaccio/core';\nimport { WebUrls, rateLimit } from '@verdaccio/middleware';\nimport type { Config, JWTSignOptions, RemoteUser } from '@verdaccio/types';\n\nimport type { $NextFunctionVer } from './package';\n\nconst debug = buildDebug('verdaccio:web:api:user');\n\nconst WEB_LOGIN_SESSION_ID = 'web-login-sessionId';\n\nfunction addUserAuthApi(auth: Auth, config: Config, storage: Storage): Router {\n  const route = Router(); /* eslint new-cap: 0 */\n  route.post(\n    WebUrls.user_login,\n    rateLimit(config?.userRateLimit),\n    function (req: Request, res: Response, next: $NextFunctionVer): void {\n      const { username, password } = req.body;\n      debug('authenticate %o', username);\n      auth.authenticate(\n        username,\n        password,\n        async (err: VerdaccioError | null, user?: RemoteUser): Promise<void> => {\n          if (err) {\n            const errorCode = err.message ? HTTP_STATUS.UNAUTHORIZED : HTTP_STATUS.INTERNAL_ERROR;\n            debug('error authenticate %o', errorCode);\n            next(errorUtils.getCode(errorCode, err.message));\n          } else {\n            req.remote_user = user as RemoteUser;\n            const jWTSignOptions: JWTSignOptions = config.security.web.sign;\n            res.set(HEADERS.CACHE_CONTROL, 'no-cache, no-store');\n            next({\n              token: await auth.jwtEncrypt(user as RemoteUser, jWTSignOptions),\n              username: req.remote_user.name,\n            });\n          }\n        }\n      );\n    }\n  );\n\n  if (config?.flags?.createUser === true) {\n    route.put(\n      WebUrls.user_signup,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        const { name, password, email, sessionId } = req.body;\n        debug('login or adduser');\n\n        // TOOD: reuse with login.ts file\n        if (typeof sessionId !== 'string' || sessionId.length !== 36) {\n          debug('sessionId is invalid length: %o', sessionId.length);\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.SESSION_ID_INVALID));\n        }\n\n        if (!name || !password || !email) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, API_ERROR.BAD_DATA));\n        }\n\n        auth.add_user(name, password, async function (err, user): Promise<void> {\n          if (err) {\n            if (err.status >= HTTP_STATUS.BAD_REQUEST && err.status < HTTP_STATUS.INTERNAL_ERROR) {\n              debug('adduser: error on create user');\n              // With npm registering is the same as logging in,\n              // and npm accepts only an 409 error.\n              // So, changing status code here.\n              return next(\n                errorUtils.getCode(err.status, err.message) || errorUtils.getConflict(err.message)\n              );\n            }\n            return next(err);\n          }\n\n          const tokens = await storage.readTokens({ user: sessionId });\n          debug('tokens found for sessionId %o: %o', sessionId, tokens.length);\n          if (tokens && tokens.length === 1 && tokens[0].key === WEB_LOGIN_SESSION_ID) {\n            if (tokens[0].token.length === 0) {\n              debug('waiting for authentication');\n              // Poll again after short delay\n              // TODO: make this configurable (default 5 seconds)\n              res.status(HTTP_STATUS.ACCEPTED);\n              res.set(HEADERS.RETRY_AFTER, '5');\n              res.json({});\n              return;\n            }\n\n            // session token can only be used once\n            debug('deleting session token');\n            await storage.deleteToken(sessionId, tokens[0].key);\n\n            // Check if token has expired\n            // TODO: make this configurable (default 2 minutes)\n            const tokenCreatedDate = new Date(tokens[0].created);\n            const minutesAgo = new Date(Date.now() - 2 * 60 * 1000);\n            if (tokenCreatedDate < minutesAgo) {\n              debug('session token expired');\n              return next(errorUtils.getUnauthorized(API_ERROR.SESSION_TOKEN_EXPIRED));\n            }\n\n            debug('session token is valid, login successful');\n            res.status(HTTP_STATUS.OK);\n            res.json({ token: tokens[0].token });\n            return;\n          }\n\n          const token =\n            name && password\n              ? await getApiToken(auth, config, user as RemoteUser, password)\n              : undefined;\n          if (token) {\n            debug('adduser: new token %o', cryptoUtils.mask(token as string, 4));\n            return next({ token, username: name });\n          }\n          return next(errorUtils.getUnauthorized());\n        });\n      }\n    );\n  }\n\n  if (config?.flags?.changePassword === true) {\n    route.put(\n      WebUrls.reset_password,\n      rateLimit(config?.userRateLimit),\n      function (req: Request, res: Response, next: $NextFunctionVer): void {\n        if (_.isNil(req.remote_user.name)) {\n          res.status(HTTP_STATUS.UNAUTHORIZED);\n          return next({\n            // FUTURE: update to a more meaningful message\n            message: API_ERROR.MUST_BE_LOGGED,\n          });\n        }\n\n        const { password } = req.body;\n        const { name } = req.remote_user;\n\n        if (\n          validationUtils.validatePassword(\n            password.new,\n            config?.server?.passwordValidationRegex\n          ) === false\n        ) {\n          return next(errorUtils.getCode(HTTP_STATUS.BAD_REQUEST, APP_ERROR.PASSWORD_VALIDATION));\n        }\n\n        auth.changePassword(name as string, password.old, password.new, (err, isUpdated): void => {\n          if (_.isNil(err) && isUpdated) {\n            next({\n              ok: true,\n            });\n          } else {\n            return next(errorUtils.getInternalError(API_ERROR.INTERNAL_SERVER_ERROR));\n          }\n        });\n      }\n    );\n  }\n\n  return route;\n}\n\nexport default addUserAuthApi;\n"],"mappings":";;;;;;;AAqBA,IAAM,QAAQ,WAAW,yBAAyB;AAElD,IAAM,uBAAuB;AAE7B,SAAS,eAAe,MAAY,QAAgB,SAA0B;CAC5E,MAAM,QAAQ,QAAQ;AACtB,OAAM,KACJ,QAAQ,YACR,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,UAAU,aAAa,IAAI;AACnC,QAAM,mBAAmB,SAAS;AAClC,OAAK,aACH,UACA,UACA,OAAO,KAA4B,SAAqC;AACtE,OAAI,KAAK;IACP,MAAM,YAAY,IAAI,UAAU,YAAY,eAAe,YAAY;AACvE,UAAM,yBAAyB,UAAU;AACzC,SAAK,WAAW,QAAQ,WAAW,IAAI,QAAQ,CAAC;UAC3C;AACL,QAAI,cAAc;IAClB,MAAM,iBAAiC,OAAO,SAAS,IAAI;AAC3D,QAAI,IAAI,QAAQ,eAAe,qBAAqB;AACpD,SAAK;KACH,OAAO,MAAM,KAAK,WAAW,MAAoB,eAAe;KAChE,UAAU,IAAI,YAAY;KAC3B,CAAC;;IAGP;GAEJ;AAED,KAAI,QAAQ,OAAO,eAAe,KAChC,OAAM,IACJ,QAAQ,aACR,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAc,KAAe,MAA8B;EACnE,MAAM,EAAE,MAAM,UAAU,OAAO,cAAc,IAAI;AACjD,QAAM,mBAAmB;AAGzB,MAAI,OAAO,cAAc,YAAY,UAAU,WAAW,IAAI;AAC5D,SAAM,mCAAmC,UAAU,OAAO;AAC1D,UAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,mBAAmB,CAAC;;AAGxF,MAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MACzB,QAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,SAAS,CAAC;AAG9E,OAAK,SAAS,MAAM,UAAU,eAAgB,KAAK,MAAqB;AACtE,OAAI,KAAK;AACP,QAAI,IAAI,UAAU,YAAY,eAAe,IAAI,SAAS,YAAY,gBAAgB;AACpF,WAAM,gCAAgC;AAItC,YAAO,KACL,WAAW,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,WAAW,YAAY,IAAI,QAAQ,CACnF;;AAEH,WAAO,KAAK,IAAI;;GAGlB,MAAM,SAAS,MAAM,QAAQ,WAAW,EAAE,MAAM,WAAW,CAAC;AAC5D,SAAM,qCAAqC,WAAW,OAAO,OAAO;AACpE,OAAI,UAAU,OAAO,WAAW,KAAK,OAAO,GAAG,QAAQ,sBAAsB;AAC3E,QAAI,OAAO,GAAG,MAAM,WAAW,GAAG;AAChC,WAAM,6BAA6B;AAGnC,SAAI,OAAO,YAAY,SAAS;AAChC,SAAI,IAAI,QAAQ,aAAa,IAAI;AACjC,SAAI,KAAK,EAAE,CAAC;AACZ;;AAIF,UAAM,yBAAyB;AAC/B,UAAM,QAAQ,YAAY,WAAW,OAAO,GAAG,IAAI;AAMnD,QAFyB,IAAI,KAAK,OAAO,GAAG,QAAQ,mBACjC,IAAI,KAAK,KAAK,KAAK,GAAG,MAAS,IAAK,EACpB;AACjC,WAAM,wBAAwB;AAC9B,YAAO,KAAK,WAAW,gBAAgB,UAAU,sBAAsB,CAAC;;AAG1E,UAAM,2CAA2C;AACjD,QAAI,OAAO,YAAY,GAAG;AAC1B,QAAI,KAAK,EAAE,OAAO,OAAO,GAAG,OAAO,CAAC;AACpC;;GAGF,MAAM,QACJ,QAAQ,WACJ,MAAM,YAAY,MAAM,QAAQ,MAAoB,SAAS,GAC7D,KAAA;AACN,OAAI,OAAO;AACT,UAAM,yBAAyB,YAAY,KAAK,OAAiB,EAAE,CAAC;AACpE,WAAO,KAAK;KAAE;KAAO,UAAU;KAAM,CAAC;;AAExC,UAAO,KAAK,WAAW,iBAAiB,CAAC;IACzC;GAEL;AAGH,KAAI,QAAQ,OAAO,mBAAmB,KACpC,OAAM,IACJ,QAAQ,gBACR,UAAU,QAAQ,cAAc,EAChC,SAAU,KAAc,KAAe,MAA8B;AACnE,MAAI,EAAE,MAAM,IAAI,YAAY,KAAK,EAAE;AACjC,OAAI,OAAO,YAAY,aAAa;AACpC,UAAO,KAAK,EAEV,SAAS,UAAU,gBACpB,CAAC;;EAGJ,MAAM,EAAE,aAAa,IAAI;EACzB,MAAM,EAAE,SAAS,IAAI;AAErB,MACE,gBAAgB,iBACd,SAAS,KACT,QAAQ,QAAQ,wBACjB,KAAK,MAEN,QAAO,KAAK,WAAW,QAAQ,YAAY,aAAa,UAAU,oBAAoB,CAAC;AAGzF,OAAK,eAAe,MAAgB,SAAS,KAAK,SAAS,MAAM,KAAK,cAAoB;AACxF,OAAI,EAAE,MAAM,IAAI,IAAI,UAClB,MAAK,EACH,IAAI,MACL,CAAC;OAEF,QAAO,KAAK,WAAW,iBAAiB,UAAU,sBAAsB,CAAC;IAE3E;GAEL;AAGH,QAAO"}

package/build/author-utils.d.ts

@@ -1,4 +1,4 @@
-import type { Author, Person, WebManifest } from '@verdaccio/types';
+import { Author, Person, WebManifest } from '@verdaccio/types';
 export declare const GENERIC_AVATAR: string;
 /**
  * Formats author field for webui.