verdaccio-security-filter 0.0.0 → 1.1.0

package/build/types.d.ts

@@ -0,0 +1,119 @@
+import { Config, Version } from '@verdaccio/types';
+export interface VersionRangeRule {
+    package: string;
+    range: string;
+    strategy: 'block' | 'fallback';
+    fallbackVersion?: string;
+    reason?: string;
+}
+export interface CVECheckConfig {
+    enabled: boolean;
+    databases: ('osv' | 'snyk' | 'github')[];
+    severity: ('low' | 'medium' | 'high' | 'critical')[];
+    autoBlock: boolean;
+    updateInterval?: number;
+    cacheDir?: string;
+}
+export interface WhitelistConfig {
+    packages: string[];
+    patterns: string[];
+    versions?: Record<string, string>;
+    autoApprove?: {
+        minDownloads?: number;
+        minStars?: number;
+        verifiedPublisher?: boolean;
+    };
+}
+export interface LicenseConfig {
+    allowed: string[];
+    blocked: string[];
+    requireLicense: boolean;
+}
+export interface LoggerConfig {
+    level: 'trace' | 'debug' | 'info' | 'warn' | 'error';
+    enabled: boolean;
+    includeTimestamp?: boolean;
+}
+export interface MetricsConfig {
+    enabled: boolean;
+    output?: 'stdout' | 'file';
+    filePath?: string;
+}
+export interface PackageAgeConfig {
+    enabled: boolean;
+    minPackageAgeDays: number;
+    minVersionAgeDays?: number;
+    warnOnly?: boolean;
+}
+export interface SecurityConfig extends Config {
+    blockedVersions?: string[];
+    blockedPatterns?: string[];
+    minPackageSize?: number;
+    maxPackageSize?: number;
+    allowedScopes?: string[];
+    blockedScopes?: string[];
+    enforceChecksum?: boolean;
+    versionRangeRules?: VersionRangeRule[];
+    mode?: 'blacklist' | 'whitelist';
+    whitelist?: WhitelistConfig;
+    licenses?: LicenseConfig;
+    cveCheck?: CVECheckConfig;
+    logger?: LoggerConfig;
+    metrics?: MetricsConfig;
+    packageAge?: PackageAgeConfig;
+    errorHandling?: {
+        onFilterError?: 'fail-open' | 'fail-closed';
+        onCveCheckError?: 'fail-open' | 'fail-closed';
+        onLicenseCheckError?: 'fail-open' | 'fail-closed';
+    };
+}
+export interface SecurityRules {
+    blockedVersions: string[];
+    blockedPatterns: string[];
+    minPackageSize: number;
+    maxPackageSize: number;
+    allowedScopes: string[];
+    blockedScopes: string[];
+    enforceChecksum: boolean;
+    versionRangeRules: VersionRangeRule[];
+}
+export interface VersionData extends Version {
+    /** Internal flag for fallback versions */
+    _fallback?: boolean;
+    /** Original version this is falling back from */
+    _fallbackFrom?: string;
+    /** Reason for fallback */
+    _fallbackReason?: string;
+}
+export interface FilterResult {
+    versions: Record<string, VersionData>;
+    blockedVersions: string[];
+    fallbacksApplied: Array<{
+        original: string;
+        fallback: string;
+    }>;
+}
+export interface CVEVulnerability {
+    id: string;
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    summary: string;
+    affectedVersions: string[];
+    fixedVersion?: string;
+    publishedDate: string;
+    source: string;
+}
+export interface CVECheckResult {
+    package: string;
+    version: string;
+    vulnerabilities: CVEVulnerability[];
+    isVulnerable: boolean;
+    checkedAt: string;
+}
+export interface MetricsData {
+    timestamp: string;
+    event: 'block' | 'fallback' | 'publish_rejected' | 'cve_detected' | 'license_blocked' | 'package_too_new';
+    packageName: string;
+    version?: string;
+    reason: string;
+    metadata?: Record<string, any>;
+}

package/build/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -1,8 +1,58 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "0.0.0",
-  "description": "Package name reserved. Full implementation coming soon.",
-  "main": "index.js",
+  "version": "1.1.0",
+  "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
+  "main": "build/index.js",
+  "types": "build/index.d.ts",
+  "keywords": [
+    "verdaccio",
+    "plugin",
+    "filter",
+    "security",
+    "npm",
+    "registry",
+    "vulnerability",
+    "semver",
+    "version-control"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "build:watch": "tsc -p tsconfig.json --watch",
+    "lint": "eslint src",
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --coverage",
+    "debug:verdaccio": "node --inspect-brk $(which verdaccio)",
+    "debug:build": "npm run build && npm link",
+    "prepack": "npm run build",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm test"
+  },
+  "peerDependencies": {
+    "verdaccio": ">=5.0.0"
+  },
+  "dependencies": {
+    "semver": "^7.7.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^9.0.0",
+    "@types/express": "^5.0.6",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.19.1",
+    "@types/semver": "^7.0.0",
+    "@verdaccio/types": "^10.0.0",
+    "eslint": "^9.0.0",
+    "jest": "^29.7.0",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.0.0"
+  },
   "author": {
     "name": "Vitaliy Ponomarenko",
     "url": "https://github.com/ponomarenko"
@@ -12,7 +62,12 @@
     "type": "git",
     "url": "git+https://github.com/ponomarenko/verdaccio-security-filter.git"
   },
-  "publishConfig": {
-    "access": "public"
-  }
+  "bugs": {
+    "url": "https://github.com/ponomarenko/verdaccio-security-filter/issues"
+  },
+  "homepage": "https://github.com/ponomarenko/verdaccio-security-filter#readme",
+  "files": [
+    "build/",
+    "README.md"
+  ]
 }

package/index.js

@@ -1,3 +0,0 @@
-module.exports = function() {
-  throw new Error('This package is a placeholder. Full implementation coming soon.');
-};