verdaccio-security-filter 1.3.0 → 1.3.2

package/build/lib/metrics.js

@@ -36,34 +36,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MetricsCollector = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-/**
- * Metrics collector for tracking security events
- */
 class MetricsCollector {
     constructor(config) {
         this.metricsBuffer = [];
         this.bufferSize = 100;
+        this.maxBufferSize = 500;
         this.config = {
             enabled: (config === null || config === void 0 ? void 0 : config.enabled) || false,
             output: (config === null || config === void 0 ? void 0 : config.output) || 'stdout',
             filePath: (config === null || config === void 0 ? void 0 : config.filePath) || './security-metrics.json',
         };
     }
-    /**
-     * Record a security event
-     */
     record(event) {
         if (!this.config.enabled) {
             return;
         }
+        if (this.metricsBuffer.length >= this.maxBufferSize) {
+            this.flush();
+        }
         this.metricsBuffer.push(event);
         if (this.metricsBuffer.length >= this.bufferSize) {
             this.flush();
         }
     }
-    /**
-     * Record a block event
-     */
     recordBlock(packageName, version, reason, metadata) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -74,9 +69,6 @@ class MetricsCollector {
             metadata,
         });
     }
-    /**
-     * Record a fallback event
-     */
     recordFallback(packageName, fromVersion, toVersion, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -87,9 +79,6 @@ class MetricsCollector {
             metadata: { toVersion },
         });
     }
-    /**
-     * Record a publish rejection
-     */
     recordPublishRejected(packageName, version, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -99,9 +88,6 @@ class MetricsCollector {
             reason,
         });
     }
-    /**
-     * Record a CVE detection
-     */
     recordCVE(packageName, version, cveId, severity) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -112,9 +98,6 @@ class MetricsCollector {
             metadata: { cveId, severity },
         });
     }
-    /**
-     * Record a license block
-     */
     recordLicenseBlock(packageName, version, license, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -125,9 +108,6 @@ class MetricsCollector {
             metadata: { license },
         });
     }
-    /**
-     * Record a package-too-new event
-     */
     recordPackageTooNew(packageName, version, reason, metadata) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -138,9 +118,6 @@ class MetricsCollector {
             metadata,
         });
     }
-    /**
-     * Flush metrics buffer to output
-     */
     flush() {
         if (this.metricsBuffer.length === 0) {
             return;
@@ -155,18 +132,13 @@ class MetricsCollector {
         }
         this.metricsBuffer = [];
     }
-    /**
-     * Write metrics to file
-     */
     writeToFile(metrics) {
         try {
             const filePath = this.config.filePath;
             const dir = path.dirname(filePath);
-            // Ensure directory exists
             if (!fs.existsSync(dir)) {
                 fs.mkdirSync(dir, { recursive: true });
             }
-            // Append to file
             const content = metrics.map(m => JSON.stringify(m)).join('\n') + '\n';
             fs.appendFileSync(filePath, content, 'utf8');
         }
@@ -175,9 +147,6 @@ class MetricsCollector {
             console.error('[Security Filter] Failed to write metrics:', message);
         }
     }
-    /**
-     * Get metrics summary
-     */
     getSummary() {
         const summary = {
             block: 0,
@@ -193,9 +162,6 @@ class MetricsCollector {
         });
         return summary;
     }
-    /**
-     * Cleanup - flush remaining metrics
-     */
     cleanup() {
         this.flush();
     }

package/build/lib/package-age-checker.d.ts

@@ -1,45 +1,23 @@
 import { PackageAgeConfig } from '../types';
 import { Package } from '@verdaccio/types';
-/**
- * Package age checker to protect against newly created malicious packages
- */
 export declare class PackageAgeChecker {
     private config;
     constructor(config?: PackageAgeConfig);
-    /**
-     * Check if a package is old enough to be trusted
-     */
     checkPackageAge(packageData: Package): {
         allowed: boolean;
         reason?: string;
         ageDays?: number;
         warnOnly?: boolean;
     };
-    /**
-     * Check if a specific version is old enough to be trusted
-     */
     checkVersionAge(packageData: Package, version: string): {
         allowed: boolean;
         reason?: string;
         ageDays?: number;
         warnOnly?: boolean;
     };
-    /**
-     * Get package creation date from time field
-     * The 'created' field in package.time represents when the package was first published
-     */
     private getPackageCreationDate;
-    /**
-     * Get version publish date from time field
-     */
     private getVersionPublishDate;
-    /**
-     * Calculate age in days from a date
-     */
     private calculateAgeDays;
-    /**
-     * Get summary of configuration
-     */
     getSummary(): {
         enabled: boolean;
         minPackageAgeDays: number;

package/build/lib/package-age-checker.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageAgeChecker = void 0;
-/**
- * Package age checker to protect against newly created malicious packages
- */
 class PackageAgeChecker {
     constructor(config) {
         var _a, _b, _c;
@@ -14,17 +11,12 @@ class PackageAgeChecker {
             warnOnly: (_c = config === null || config === void 0 ? void 0 : config.warnOnly) !== null && _c !== void 0 ? _c : false,
         };
     }
-    /**
-     * Check if a package is old enough to be trusted
-     */
     checkPackageAge(packageData) {
         if (!this.config.enabled) {
             return { allowed: true };
         }
-        // Get package creation date from time field
         const createdDate = this.getPackageCreationDate(packageData);
         if (!createdDate) {
-            // If we can't determine creation date, allow but warn
             return {
                 allowed: true,
                 reason: 'Cannot determine package creation date',
@@ -42,17 +34,12 @@ class PackageAgeChecker {
         }
         return { allowed: true, ageDays };
     }
-    /**
-     * Check if a specific version is old enough to be trusted
-     */
     checkVersionAge(packageData, version) {
         if (!this.config.enabled || !this.config.minVersionAgeDays) {
             return { allowed: true };
         }
-        // Get version publish date from time field
         const versionDate = this.getVersionPublishDate(packageData, version);
         if (!versionDate) {
-            // If we can't determine version date, allow but warn
             return {
                 allowed: true,
                 reason: `Cannot determine version ${version} publish date`,
@@ -70,22 +57,16 @@ class PackageAgeChecker {
         }
         return { allowed: true, ageDays };
     }
-    /**
-     * Get package creation date from time field
-     * The 'created' field in package.time represents when the package was first published
-     */
     getPackageCreationDate(packageData) {
         if (!packageData.time) {
             return null;
         }
-        // Try to get 'created' field first
         if ('created' in packageData.time) {
             const created = packageData.time.created;
             if (typeof created === 'string') {
                 return new Date(created);
             }
         }
-        // Fallback: find the oldest version
         const versions = Object.keys(packageData.time).filter(key => key !== 'modified' && key !== 'created');
         if (versions.length === 0) {
             return null;
@@ -99,12 +80,8 @@ class PackageAgeChecker {
         if (dates.length === 0) {
             return null;
         }
-        // Return the oldest date
         return new Date(Math.min(...dates.map(d => d.getTime())));
     }
-    /**
-     * Get version publish date from time field
-     */
     getVersionPublishDate(packageData, version) {
         if (!packageData.time || !(version in packageData.time)) {
             return null;
@@ -115,17 +92,11 @@ class PackageAgeChecker {
         }
         return null;
     }
-    /**
-     * Calculate age in days from a date
-     */
     calculateAgeDays(date) {
         const now = new Date();
         const diffMs = now.getTime() - date.getTime();
         return Math.floor(diffMs / (1000 * 60 * 60 * 24));
     }
-    /**
-     * Get summary of configuration
-     */
     getSummary() {
         return {
             enabled: this.config.enabled,

package/build/lib/whitelist-checker.d.ts

@@ -1,45 +1,19 @@
 import { WhitelistConfig } from '../types';
-/**
- * Whitelist checker for package validation
- */
 export declare class WhitelistChecker {
     private config;
     constructor(config?: WhitelistConfig);
-    /**
-     * Check if a package is whitelisted
-     */
     isWhitelisted(packageName: string, version?: string): {
         allowed: boolean;
         reason?: string;
     };
-    /**
-     * Check if package name matches any whitelist pattern
-     */
     private matchesPattern;
-    /**
-     * Add package to whitelist
-     */
     addPackage(packageName: string, versionRange?: string): void;
-    /**
-     * Remove package from whitelist
-     */
     removePackage(packageName: string): void;
-    /**
-     * Add pattern to whitelist
-     */
     addPattern(pattern: string): void;
-    /**
-     * Check if package meets auto-approve criteria
-     * Note: This is a placeholder. Real implementation would require
-     * integration with npm registry API to fetch download stats, etc.
-     */
     meetsAutoApproveCriteria(_packageName: string): Promise<{
         approved: boolean;
         reason?: string;
     }>;
-    /**
-     * Get whitelist summary
-     */
     getSummary(): {
         totalPackages: number;
         totalPatterns: number;

package/build/lib/whitelist-checker.js

@@ -44,9 +44,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WhitelistChecker = void 0;
 const semver = __importStar(require("semver"));
-/**
- * Whitelist checker for package validation
- */
 class WhitelistChecker {
     constructor(config) {
         this.config = {
@@ -56,13 +53,8 @@ class WhitelistChecker {
             autoApprove: config === null || config === void 0 ? void 0 : config.autoApprove,
         };
     }
-    /**
-     * Check if a package is whitelisted
-     */
     isWhitelisted(packageName, version) {
-        // Check exact package name match
         if (this.config.packages.includes(packageName)) {
-            // If version is specified, check version constraint
             if (version && this.config.versions && packageName in this.config.versions) {
                 const versionRange = this.config.versions[packageName];
                 if (!semver.satisfies(version, versionRange)) {
@@ -74,19 +66,14 @@ class WhitelistChecker {
             }
             return { allowed: true };
         }
-        // Check pattern match
         if (this.matchesPattern(packageName)) {
             return { allowed: true };
         }
-        // Not in whitelist
         return {
             allowed: false,
             reason: 'Package is not in whitelist',
         };
     }
-    /**
-     * Check if package name matches any whitelist pattern
-     */
     matchesPattern(packageName) {
         return this.config.patterns.some(pattern => {
             try {
@@ -99,9 +86,6 @@ class WhitelistChecker {
             }
         });
     }
-    /**
-     * Add package to whitelist
-     */
     addPackage(packageName, versionRange) {
         if (!this.config.packages.includes(packageName)) {
             this.config.packages.push(packageName);
@@ -111,9 +95,6 @@ class WhitelistChecker {
             this.config.versions[packageName] = versionRange;
         }
     }
-    /**
-     * Remove package from whitelist
-     */
     removePackage(packageName) {
         const index = this.config.packages.indexOf(packageName);
         if (index > -1) {
@@ -123,40 +104,22 @@ class WhitelistChecker {
             delete this.config.versions[packageName];
         }
     }
-    /**
-     * Add pattern to whitelist
-     */
     addPattern(pattern) {
         if (!this.config.patterns.includes(pattern)) {
             this.config.patterns.push(pattern);
         }
     }
-    /**
-     * Check if package meets auto-approve criteria
-     * Note: This is a placeholder. Real implementation would require
-     * integration with npm registry API to fetch download stats, etc.
-     */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     meetsAutoApproveCriteria(_packageName) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.config.autoApprove) {
                 return { approved: false, reason: 'Auto-approve not configured' };
             }
-            // Placeholder for npm registry API integration
-            // In a real implementation, you would:
-            // 1. Fetch package info from npm registry
-            // 2. Check weekly downloads against minDownloads
-            // 3. Check GitHub stars against minStars
-            // 4. Check if publisher is verified
             return {
                 approved: false,
                 reason: 'Auto-approve requires npm registry API integration (not implemented)',
             };
         });
     }
-    /**
-     * Get whitelist summary
-     */
     getSummary() {
         return {
             totalPackages: this.config.packages.length,

package/build/types.d.ts

@@ -90,11 +90,8 @@ export interface SecurityRules {
     versionRangeRules: VersionRangeRule[];
 }
 export interface VersionData extends Version {
-    /** Internal flag for fallback versions */
     _fallback?: boolean;
-    /** Original version this is falling back from */
     _fallbackFrom?: string;
-    /** Reason for fallback */
     _fallbackReason?: string;
 }
 export interface FilterResult {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -67,7 +67,9 @@
   },
   "homepage": "https://github.com/ponomarenko/verdaccio-security-filter#readme",
   "files": [
-    "build/",
-    "README.md"
+    "build/**/*.js",
+    "build/**/*.d.ts",
+    "README.md",
+    "LICENSE"
   ]
 }