verdaccio-security-filter 1.3.0 → 1.3.2

package/README.md

@@ -2,6 +2,7 @@
 
 Advanced security filter plugin for Verdaccio with **dual-layer protection architecture** combining middleware interception and metadata filtering for comprehensive package security.
 
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 [![npm version](https://img.shields.io/npm/v/verdaccio-security-filter.svg)](https://www.npmjs.com/package/verdaccio-security-filter)
 [![npm downloads](https://img.shields.io/npm/dm/verdaccio-security-filter.svg)](https://www.npmjs.com/package/verdaccio-security-filter)
 [![CI](https://github.com/ponomarenko/verdaccio-security-filter/actions/workflows/ci.yml/badge.svg)](https://github.com/ponomarenko/verdaccio-security-filter/actions/workflows/ci.yml)

package/build/index.d.ts

@@ -2,15 +2,6 @@ import { IPluginMiddleware, IPluginStorageFilter, PluginOptions, IBasicAuth, ISt
 import { Application } from 'express';
 import { SecurityConfig } from './types';
 import { SecurityLogger } from './lib/logger';
-/**
- * Security Filter Plugin for Verdaccio
- * Works with both middleware and filter interfaces for complete protection
- * Compatible with Verdaccio 6.x and 7.x
- *
- * Two-layer protection:
- * - Layer 1 (filter_metadata): CVE/License/Age checks when metadata is available
- * - Layer 2 (middleware): Whitelist/Pattern/Scope checks + tarball blocking
- */
 export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityConfig>, IPluginStorageFilter<SecurityConfig> {
     logger: SecurityLogger;
     config: SecurityConfig;
@@ -21,62 +12,18 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     private readonly licenseChecker;
     private readonly packageAgeChecker;
     private readonly authorChecker;
-    /**
-     * Creates a new SecurityFilterPlugin instance
-     * @param {SecurityConfig} config - Plugin configuration
-     * @param {PluginOptions} options - Verdaccio plugin options
-     */
     constructor(config: SecurityConfig, options: PluginOptions<SecurityConfig>);
-    /**
-     * Parse and validate version range rules
-     * @private
-     */
     private _parseVersionRangeRules;
-    /**
-     * Log initialization details
-     * @private
-     */
     private _logInitialization;
-    /**
-     * Get list of enabled features
-     * @private
-     */
     private _getEnabledFeatures;
-    /**
-     * Check if package name matches blocked patterns
-     * @private
-     */
     private _isBlockedByPattern;
-    /**
-     * Check if package scope is allowed
-     * @private
-     */
     private _isScopeAllowed;
-    /**
-     * Get version range rule for a specific package and version
-     * @private
-     */
     private _getVersionRangeRule;
-    /**
-     * Register Express middleware to intercept package requests
-     * Intercepts both metadata and tarball requests
-     */
     register_middlewares(app: Application, _auth: IBasicAuth<SecurityConfig>, _storage: IStorageManager<SecurityConfig>): void;
-    /**
-     * Filter package metadata before returning to client
-     * This provides CVE, License, and Age checking when metadata is available
-     */
     filter_metadata(packageInfo: Package): Promise<Package>;
-    /**
-     * Check if package should be blocked (used by middleware)
-     * @private
-     */
     private _checkPackageBlock;
-    /**
-     * Get applied security rules for a package
-     * @private
-     */
     private _getAppliedRules;
+    destroy(): void;
 }
 export { SecurityLogger } from './lib/logger';
 export { MetricsCollector } from './lib/metrics';

package/build/index.js

@@ -54,24 +54,9 @@ const cve_checker_1 = require("./lib/cve-checker");
 const license_checker_1 = require("./lib/license-checker");
 const package_age_checker_1 = require("./lib/package-age-checker");
 const author_checker_1 = require("./lib/author-checker");
-/**
- * Security Filter Plugin for Verdaccio
- * Works with both middleware and filter interfaces for complete protection
- * Compatible with Verdaccio 6.x and 7.x
- *
- * Two-layer protection:
- * - Layer 1 (filter_metadata): CVE/License/Age checks when metadata is available
- * - Layer 2 (middleware): Whitelist/Pattern/Scope checks + tarball blocking
- */
 class SecurityFilterPlugin {
-    /**
-     * Creates a new SecurityFilterPlugin instance
-     * @param {SecurityConfig} config - Plugin configuration
-     * @param {PluginOptions} options - Verdaccio plugin options
-     */
     constructor(config, options) {
         this.config = config || {};
-        // Set default error handling strategy if not provided
         if (!this.config.errorHandling) {
             this.config.errorHandling = {
                 onFilterError: 'fail-open',
@@ -79,23 +64,18 @@ class SecurityFilterPlugin {
                 onLicenseCheckError: 'fail-open',
             };
         }
-        // Initialize enhanced logger
         this.logger = new logger_1.SecurityLogger(options.logger, this.config.logger);
-        // Initialize metrics collector
         this.metrics = new metrics_1.MetricsCollector(this.config.metrics);
-        // Initialize whitelist checker
         this.whitelistChecker = new whitelist_checker_1.WhitelistChecker(this.config.whitelist);
-        // Initialize security checkers
         this.cveChecker = new cve_checker_1.CVEChecker(this.config.cveCheck);
         this.licenseChecker = new license_checker_1.LicenseChecker(this.config.licenses);
         this.packageAgeChecker = new package_age_checker_1.PackageAgeChecker(this.config.packageAge);
         this.authorChecker = new author_checker_1.AuthorChecker(this.config.authorFilter);
-        // Security rules configuration
         this.securityRules = {
             blockedVersions: this.config.blockedVersions || [],
             blockedPatterns: this.config.blockedPatterns || [],
             minPackageSize: this.config.minPackageSize || 0,
-            maxPackageSize: this.config.maxPackageSize || 100 * 1024 * 1024, // 100MB
+            maxPackageSize: this.config.maxPackageSize || 100 * 1024 * 1024,
             allowedScopes: this.config.allowedScopes || [],
             blockedScopes: this.config.blockedScopes || [],
             enforceChecksum: this.config.enforceChecksum !== false,
@@ -103,10 +83,6 @@ class SecurityFilterPlugin {
         };
         this._logInitialization();
     }
-    /**
-     * Parse and validate version range rules
-     * @private
-     */
     _parseVersionRangeRules(rules) {
         return rules.map((rule, index) => {
             if (!rule.package || !rule.range || !rule.strategy) {
@@ -117,7 +93,6 @@ class SecurityFilterPlugin {
                 this.logger.warn(`Fallback strategy requires fallbackVersion for ${rule.package}, skipping`);
                 return null;
             }
-            // Validate semver range
             try {
                 const validRange = semver.validRange(rule.range);
                 if (!validRange) {
@@ -132,10 +107,6 @@ class SecurityFilterPlugin {
             return rule;
         }).filter((rule) => rule !== null);
     }
-    /**
-     * Log initialization details
-     * @private
-     */
     _logInitialization() {
         var _a;
         const features = this._getEnabledFeatures();
@@ -159,10 +130,6 @@ class SecurityFilterPlugin {
             this.logger.info(`Author filtering enabled: ${summary.blockedAuthors} authors, ${summary.blockedEmails} emails, ${summary.blockedRegions} regions blocked`);
         }
     }
-    /**
-     * Get list of enabled features
-     * @private
-     */
     _getEnabledFeatures() {
         var _a, _b, _c, _d, _e;
         const features = [];
@@ -188,40 +155,25 @@ class SecurityFilterPlugin {
             features.push('scope-blocking');
         return features;
     }
-    /**
-     * Check if package name matches blocked patterns
-     * @private
-     */
     _isBlockedByPattern(packageName) {
         return this.securityRules.blockedPatterns.some(pattern => {
             const regex = new RegExp(pattern);
             return regex.test(packageName);
         });
     }
-    /**
-     * Check if package scope is allowed
-     * @private
-     */
     _isScopeAllowed(packageName) {
-        // If not a scoped package, check if allowedScopes is empty
         if (!packageName.startsWith('@')) {
             return this.securityRules.allowedScopes.length === 0;
         }
         const scope = packageName.split('/')[0];
-        // Check blacklist
         if (this.securityRules.blockedScopes.includes(scope)) {
             return false;
         }
-        // Check whitelist (if exists)
         if (this.securityRules.allowedScopes.length > 0) {
             return this.securityRules.allowedScopes.includes(scope);
         }
         return true;
     }
-    /**
-     * Get version range rule for a specific package and version
-     * @private
-     */
     _getVersionRangeRule(packageName, version) {
         return this.securityRules.versionRangeRules.find(rule => {
             if (rule.package !== packageName) {
@@ -236,43 +188,28 @@ class SecurityFilterPlugin {
             }
         }) || null;
     }
-    /**
-     * Register Express middleware to intercept package requests
-     * Intercepts both metadata and tarball requests
-     */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     register_middlewares(app, _auth, _storage) {
         this.logger.info('[Middleware] Registering security filter middleware');
         this.logger.info(`[Middleware] Config mode: ${this.config.mode || 'NOT SET'}`);
-        // Middleware to intercept all package requests
         app.use((req, res, next) => __awaiter(this, void 0, void 0, function* () {
             try {
-                // Extract package name and version from URL
-                // Tarball URLs: /:package/-/:filename.tgz
-                // Scoped tarball URLs: /@scope/:package/-/:filename.tgz
-                // Metadata URLs: /:package or /@scope/:package
                 const urlMatch = req.url.match(/^\/(@[^/]+\/)?([^/]+)(?:\/-\/([^/]+\.tgz))?/);
                 if (!urlMatch) {
-                    // Not a package-related request, pass through
                     this.logger.debug(`[Middleware] Non-package request: ${req.method} ${req.url}`);
                     return next();
                 }
                 const scope = urlMatch[1] || '';
                 const packageName = scope + urlMatch[2];
                 const tarballFile = urlMatch[3];
-                // Extract version from tarball filename if present
                 let version;
                 if (tarballFile) {
-                    // This is a tarball download request - block it immediately
                     const versionMatch = tarballFile.match(/-([\d.]+(?:-[a-zA-Z0-9.]+)?)\.tgz$/);
                     version = versionMatch ? versionMatch[1] : undefined;
                     this.logger.info(`[Middleware] TARBALL REQUEST: ${packageName}@${version || 'unknown'}`);
-                    // Apply all security checks for tarball downloads
                     const blockResult = yield this._checkPackageBlock(packageName, version);
                     if (blockResult.blocked) {
                         this.logger.warn(`[Middleware] [X] BLOCKED TARBALL: ${packageName}@${version || '*'} - ${blockResult.reason}`);
                         this.metrics.recordBlock(packageName, version || '*', blockResult.reason);
-                        // Return 403 Forbidden with detailed error
                         res.status(403).json({
                             error: 'Package blocked by security filter',
                             package: packageName,
@@ -285,90 +222,41 @@ class SecurityFilterPlugin {
                     this.logger.info(`[Middleware] [OK] ALLOWED TARBALL: ${packageName}@${version || 'unknown'}`);
                 }
                 else {
-                    // This is a metadata request - intercept response and modify it
                     this.logger.info(`[Middleware] METADATA REQUEST: ${packageName} - will intercept response`);
-                    // Check if package should be blocked
                     const blockResult = yield this._checkPackageBlock(packageName);
                     if (blockResult.blocked) {
-                        // Intercept the response
-                        const originalSend = res.send;
-                        const originalJson = res.json;
-                        // eslint-disable-next-line @typescript-eslint/no-this-alias
-                        const self = this;
-                        // Override res.json to intercept JSON responses
-                        res.json = function (body) {
-                            if (body && typeof body === 'object' && body.name === packageName) {
-                                // This is package metadata - modify it to show blocked info
-                                self.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
-                                self.logger.info(`[Middleware] Modifying response to show blocking info`);
-                                const blockedResponse = {
-                                    name: packageName,
-                                    versions: {},
-                                    'dist-tags': {},
-                                    security: {
-                                        blocked: true,
-                                        reason: blockResult.reason,
-                                        plugin: {
-                                            name: 'verdaccio-security-filter',
-                                            version: '1.0.0',
-                                            mode: self.config.mode || 'blacklist',
-                                        },
-                                        blockedAt: new Date().toISOString(),
-                                        rules: self._getAppliedRules(packageName),
-                                        message: `This package has been blocked by security filter: ${blockResult.reason}`,
-                                        contact: 'Please contact your registry administrator for more information',
-                                    },
-                                    _security: {
-                                        blocked: true,
-                                        reason: blockResult.reason,
-                                        blockedBy: 'verdaccio-security-filter',
-                                        blockedAt: new Date().toISOString(),
-                                    }
-                                };
-                                return originalJson.call(this, blockedResponse);
-                            }
-                            return originalJson.call(this, body);
-                        };
-                        // Override res.send for non-JSON responses
-                        res.send = function (body) {
-                            if (typeof body === 'string') {
-                                try {
-                                    const parsed = JSON.parse(body);
-                                    if (parsed && parsed.name === packageName) {
-                                        self.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
-                                        const blockedResponse = {
-                                            name: packageName,
-                                            versions: {},
-                                            'dist-tags': {},
-                                            security: {
-                                                blocked: true,
-                                                reason: blockResult.reason,
-                                                plugin: {
-                                                    name: 'verdaccio-security-filter',
-                                                    version: '1.0.0',
-                                                    mode: self.config.mode || 'blacklist',
-                                                },
-                                                blockedAt: new Date().toISOString(),
-                                                rules: self._getAppliedRules(packageName),
-                                                message: `This package has been blocked by security filter: ${blockResult.reason}`,
-                                                contact: 'Please contact your registry administrator for more information',
-                                            }
-                                        };
-                                        return originalSend.call(this, JSON.stringify(blockedResponse));
-                                    }
-                                }
-                                catch (_a) {
-                                    // Not JSON, pass through
-                                }
+                        this.logger.warn(`[Middleware] [X] BLOCKED METADATA: ${packageName} - ${blockResult.reason}`);
+                        const blockedResponse = {
+                            name: packageName,
+                            versions: {},
+                            'dist-tags': {},
+                            security: {
+                                blocked: true,
+                                reason: blockResult.reason,
+                                plugin: {
+                                    name: 'verdaccio-security-filter',
+                                    version: '1.0.0',
+                                    mode: this.config.mode || 'blacklist',
+                                },
+                                blockedAt: new Date().toISOString(),
+                                rules: this._getAppliedRules(packageName),
+                                message: `This package has been blocked by security filter: ${blockResult.reason}`,
+                                contact: 'Please contact your registry administrator for more information',
+                            },
+                            _security: {
+                                blocked: true,
+                                reason: blockResult.reason,
+                                blockedBy: 'verdaccio-security-filter',
+                                blockedAt: new Date().toISOString(),
                             }
-                            return originalSend.call(this, body);
                         };
+                        res.status(200).json(blockedResponse);
+                        return;
                     }
                     else {
                         this.logger.info(`[Middleware] [OK] ALLOWED METADATA: ${packageName}`);
                     }
                 }
-                // Continue to next middleware
                 next();
             }
             catch (error) {
@@ -378,22 +266,16 @@ class SecurityFilterPlugin {
         }));
         this.logger.info('[Middleware] Security filter middleware registered successfully');
     }
-    /**
-     * Filter package metadata before returning to client
-     * This provides CVE, License, and Age checking when metadata is available
-     */
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a, _b, _c, _d, _e, _f, _g, _h;
             const packageName = packageInfo.name;
             this.logger.info(`[filter_metadata] --> Processing: ${packageName}`);
             try {
-                // 1. Whitelist/blacklist check (basic filtering)
                 const blockResult = yield this._checkPackageBlock(packageName);
                 if (blockResult.blocked) {
                     this.logger.warn(`[filter_metadata] BLOCKED: ${packageName}@* - ${blockResult.reason}`);
                     this.metrics.recordBlock(packageName, '*', blockResult.reason);
-                    // Return empty versions with security field
                     return Object.assign(Object.assign({}, packageInfo), { versions: {}, 'dist-tags': {}, security: {
                             blocked: true,
                             reason: blockResult.reason,
@@ -406,18 +288,24 @@ class SecurityFilterPlugin {
                             rules: this._getAppliedRules(packageName),
                         } });
                 }
-                // 2. CVE Check - check all versions
                 if ((_a = this.config.cveCheck) === null || _a === void 0 ? void 0 : _a.enabled) {
                     const versions = Object.keys(packageInfo.versions || {});
                     const vulnerableVersions = [];
-                    for (const version of versions) {
-                        const cveResult = yield this.cveChecker.checkPackage(packageName, version);
-                        if (cveResult.isVulnerable) {
-                            vulnerableVersions.push(version);
-                            this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${cveResult.vulnerabilities.length} vulnerabilities`);
-                        }
+                    const BATCH_SIZE = 10;
+                    for (let i = 0; i < versions.length; i += BATCH_SIZE) {
+                        const batch = versions.slice(i, i + BATCH_SIZE);
+                        const results = yield Promise.allSettled(batch.map(version => this.cveChecker.checkPackage(packageName, version)));
+                        results.forEach((result, index) => {
+                            if (result.status === 'fulfilled' && result.value.isVulnerable) {
+                                const version = batch[index];
+                                vulnerableVersions.push(version);
+                                this.logger.warn(`[filter_metadata] CVE found in ${packageName}@${version}: ${result.value.vulnerabilities.length} vulnerabilities`);
+                            }
+                            else if (result.status === 'rejected') {
+                                this.logger.error(`[filter_metadata] CVE check failed for ${packageName}@${batch[index]}: ${result.reason}`);
+                            }
+                        });
                     }
-                    // If configured to auto-block and vulnerabilities found
                     if (this.config.cveCheck.autoBlock && vulnerableVersions.length > 0) {
                         const reason = `Package has ${vulnerableVersions.length} vulnerable version(s)`;
                         this.logger.warn(`[filter_metadata] CVE BLOCKED: ${packageName} - ${reason}`);
@@ -434,7 +322,6 @@ class SecurityFilterPlugin {
                             } });
                     }
                 }
-                // 3. License Check - check latest version
                 if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
                     const latestVersion = (_b = packageInfo['dist-tags']) === null || _b === void 0 ? void 0 : _b.latest;
                     if (latestVersion && ((_c = packageInfo.versions) === null || _c === void 0 ? void 0 : _c[latestVersion])) {
@@ -456,7 +343,6 @@ class SecurityFilterPlugin {
                         }
                     }
                 }
-                // 4. Package Age Check
                 if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled) {
                     const ageResult = this.packageAgeChecker.checkPackageAge(packageInfo);
                     if (!ageResult.allowed && !ageResult.warnOnly) {
@@ -477,7 +363,6 @@ class SecurityFilterPlugin {
                         this.logger.warn(`[filter_metadata] AGE WARNING: ${packageName} - ${ageResult.reason} (warn-only mode)`);
                     }
                 }
-                // 5. Author Filter Check
                 if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled) {
                     const latestVersion = (_f = packageInfo['dist-tags']) === null || _f === void 0 ? void 0 : _f.latest;
                     if (latestVersion && ((_g = packageInfo.versions) === null || _g === void 0 ? void 0 : _g[latestVersion])) {
@@ -537,34 +422,25 @@ class SecurityFilterPlugin {
             }
         });
     }
-    /**
-     * Check if package should be blocked (used by middleware)
-     * @private
-     */
     _checkPackageBlock(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
-            // 1. Whitelist mode
             if (this.config.mode === 'whitelist') {
                 const whitelistCheck = this.whitelistChecker.isWhitelisted(packageName, version);
                 if (!whitelistCheck.allowed) {
                     return { blocked: true, reason: whitelistCheck.reason || 'Package is not in whitelist' };
                 }
             }
-            // 2. Blocked patterns
             if (this._isBlockedByPattern(packageName)) {
                 return { blocked: true, reason: 'Package name matches blocked pattern' };
             }
-            // 3. Scopes
             if (!this._isScopeAllowed(packageName)) {
                 return { blocked: true, reason: 'Package scope not allowed' };
             }
-            // 4. Exact version blocking
             if (version) {
                 const versionKey = `${packageName}@${version}`;
                 if (this.securityRules.blockedVersions.includes(versionKey)) {
                     return { blocked: true, reason: 'Exact version match in blocklist' };
                 }
-                // 5. Version range rules
                 const rangeRule = this._getVersionRangeRule(packageName, version);
                 if (rangeRule && rangeRule.strategy === 'block') {
                     return { blocked: true, reason: `Version matches blocked range: ${rangeRule.range}` };
@@ -573,13 +449,8 @@ class SecurityFilterPlugin {
             return { blocked: false, reason: '' };
         });
     }
-    /**
-     * Get applied security rules for a package
-     * @private
-     */
     _getAppliedRules(packageName) {
         const rules = {};
-        // Check which rules apply to this package
         if (this.config.mode === 'whitelist') {
             rules.mode = 'whitelist';
             rules.whitelisted = false;
@@ -610,9 +481,19 @@ class SecurityFilterPlugin {
         }
         return rules;
     }
+    destroy() {
+        this.logger.info('[Cleanup] Shutting down security filter plugin');
+        try {
+            this.cveChecker.destroy();
+            this.metrics.cleanup();
+            this.logger.info('[Cleanup] Plugin resources cleaned up successfully');
+        }
+        catch (error) {
+            this.logger.error(`[Cleanup] Error during cleanup: ${error.message}`);
+        }
+    }
 }
 exports.default = SecurityFilterPlugin;
-// Export utility classes for testing
 var logger_2 = require("./lib/logger");
 Object.defineProperty(exports, "SecurityLogger", { enumerable: true, get: function () { return logger_2.SecurityLogger; } });
 var metrics_2 = require("./lib/metrics");

package/build/lib/author-checker.d.ts

@@ -1,9 +1,5 @@
 import { Version } from '@verdaccio/types';
 import { AuthorFilterConfig, AuthorCheckResult } from '../types';
-/**
- * AuthorChecker validates package authors and maintainers
- * against configured security policies.
- */
 export declare class AuthorChecker {
     private readonly config?;
     private readonly blockedAuthors;
@@ -13,25 +9,10 @@ export declare class AuthorChecker {
     private readonly blockedEmailDomains;
     private readonly regionDomainMap;
     constructor(config?: AuthorFilterConfig);
-    /**
-     * Check if package author/maintainer is allowed
-     */
     checkAuthor(versionData: Version): AuthorCheckResult;
-    /**
-     * Extract author information from package version data
-     */
     private _extractAuthors;
-    /**
-     * Normalize author data to AuthorInfo format
-     */
     private _normalizeAuthor;
-    /**
-     * Check a single author against all blocking rules
-     */
     private _checkSingleAuthor;
-    /**
-     * Get summary of configuration
-     */
     getSummary(): {
         enabled: boolean;
         blockedAuthors: number;

package/build/lib/author-checker.js

@@ -1,23 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthorChecker = void 0;
-/**
- * Region to TLD mapping for email domain filtering
- */
 const REGION_DOMAINS = {
     'ru': ['.ru', 'yandex.ru', 'mail.ru', 'rambler.ru', 'ya.ru', 'bk.ru', 'list.ru'],
     'cn': ['.cn', 'qq.com', '163.com', '126.com', 'sina.com', 'sohu.com'],
     'by': ['.by', 'tut.by', 'mail.by'],
-    'kp': ['.kp'], // North Korea
-    'ir': ['.ir'], // Iran
-    'sy': ['.sy'], // Syria
-    'cu': ['.cu'], // Cuba
-    'sd': ['.sd'], // Sudan
+    'kp': ['.kp'],
+    'ir': ['.ir'],
+    'sy': ['.sy'],
+    'cu': ['.cu'],
+    'sd': ['.sd'],
 };
-/**
- * AuthorChecker validates package authors and maintainers
- * against configured security policies.
- */
 class AuthorChecker {
     constructor(config) {
         this.config = config;
@@ -34,9 +27,6 @@ class AuthorChecker {
             this.regionDomainMap.set(region.toLowerCase(), new Set(domains));
         });
     }
-    /**
-     * Check if package author/maintainer is allowed
-     */
     checkAuthor(versionData) {
         var _a;
         if (!((_a = this.config) === null || _a === void 0 ? void 0 : _a.enabled)) {
@@ -61,9 +51,6 @@ class AuthorChecker {
         }
         return { allowed: true };
     }
-    /**
-     * Extract author information from package version data
-     */
     _extractAuthors(versionData) {
         const authors = [];
         if (versionData.author) {
@@ -81,9 +68,6 @@ class AuthorChecker {
         }
         return authors;
     }
-    /**
-     * Normalize author data to AuthorInfo format
-     */
     _normalizeAuthor(author) {
         if (typeof author === 'string') {
             const emailMatch = author.match(/<([^>]+)>/);
@@ -99,11 +83,7 @@ class AuthorChecker {
             url: author.url,
         };
     }
-    /**
-     * Check a single author against all blocking rules
-     */
     _checkSingleAuthor(author) {
-        // Check blocked author names
         if (author.name) {
             const normalizedName = author.name.toLowerCase().trim();
             if (this.blockedAuthors.has(normalizedName)) {
@@ -125,7 +105,6 @@ class AuthorChecker {
                 }
             }
         }
-        // Check blocked emails
         if (author.email) {
             const normalizedEmail = author.email.toLowerCase().trim();
             if (this.blockedEmails.has(normalizedEmail)) {
@@ -146,7 +125,6 @@ class AuthorChecker {
                     };
                 }
             }
-            // Check blocked email domains
             for (const domain of this.blockedEmailDomains) {
                 if (normalizedEmail.endsWith(domain) || normalizedEmail.includes(`@${domain}`)) {
                     return {
@@ -157,7 +135,6 @@ class AuthorChecker {
                     };
                 }
             }
-            // Check blocked regions
             for (const [region, domains] of this.regionDomainMap.entries()) {
                 for (const domain of domains) {
                     if (normalizedEmail.endsWith(domain) ||
@@ -175,9 +152,6 @@ class AuthorChecker {
         }
         return { allowed: true };
     }
-    /**
-     * Get summary of configuration
-     */
     getSummary() {
         var _a;
         return {