verdaccio-security-filter 1.3.1 → 1.3.3

package/build/lib/cve-checker.js

@@ -46,9 +46,6 @@ exports.CVEChecker = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const lru_cache_1 = require("./lru-cache");
-/**
- * CVE Checker that integrates with vulnerability databases
- */
 class CVEChecker {
     constructor(config) {
         this.lastUpdate = 0;
@@ -68,9 +65,6 @@ class CVEChecker {
             this.loadCache();
         }
     }
-    /**
-     * Check if a package version has known vulnerabilities
-     */
     checkPackage(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.config.enabled) {
@@ -83,13 +77,10 @@ class CVEChecker {
                 };
             }
             const cacheKey = `${packageName}@${version}`;
-            // Check cache first
             if (this.cache.has(cacheKey) && !this.isCacheStale()) {
                 return this.cache.get(cacheKey);
             }
-            // Fetch from databases
             const vulnerabilities = yield this.fetchVulnerabilities(packageName, version);
-            // Filter by configured severity
             const filteredVulnerabilities = vulnerabilities.filter(vuln => this.config.severity.includes(vuln.severity));
             const result = {
                 package: packageName,
@@ -98,15 +89,11 @@ class CVEChecker {
                 isVulnerable: filteredVulnerabilities.length > 0,
                 checkedAt: new Date().toISOString(),
             };
-            // Cache result
             this.cache.set(cacheKey, result);
             this.debouncedSaveCache();
             return result;
         });
     }
-    /**
-     * Fetch vulnerabilities from configured databases
-     */
     fetchVulnerabilities(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             const vulnerabilities = [];
@@ -117,10 +104,8 @@ class CVEChecker {
                             vulnerabilities.push(...yield this.fetchFromOSV(packageName, version));
                             break;
                         case 'snyk':
-                            // Snyk integration would go here (requires API key)
                             break;
                         case 'github':
-                            // GitHub Advisory Database integration would go here
                             break;
                     }
                 }
@@ -132,10 +117,6 @@ class CVEChecker {
             return vulnerabilities;
         });
     }
-    /**
-     * Fetch vulnerabilities from OSV (Open Source Vulnerabilities) database
-     * https://osv.dev/
-     */
     fetchFromOSV(packageName, version) {
         return __awaiter(this, void 0, void 0, function* () {
             const maxRetries = 3;
@@ -203,20 +184,13 @@ class CVEChecker {
             return [];
         });
     }
-    /**
-     * Sleep utility for retry delays
-     */
     sleep(ms) {
         return new Promise(resolve => setTimeout(resolve, ms));
     }
-    /**
-     * Map OSV severity to our severity levels
-     */
     mapOSVSeverity(osvSeverity) {
         if (!osvSeverity || osvSeverity.length === 0) {
             return 'medium';
         }
-        // OSV uses CVSS scores
         const severity = osvSeverity[0];
         if (severity.type === 'CVSS_V3') {
             const score = parseFloat(severity.score);
@@ -230,17 +204,11 @@ class CVEChecker {
         }
         return 'medium';
     }
-    /**
-     * Check if cache is stale
-     */
     isCacheStale() {
         const now = Date.now();
         const updateIntervalMs = this.config.updateInterval * 60 * 60 * 1000;
         return now - this.lastUpdate > updateIntervalMs;
     }
-    /**
-     * Load cache from disk
-     */
     loadCache() {
         try {
             const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
@@ -260,9 +228,6 @@ class CVEChecker {
             console.error('[CVE Checker] Failed to load cache:', message);
         }
     }
-    /**
-     * Debounced save cache to reduce I/O operations
-     */
     debouncedSaveCache() {
         if (this.saveTimer) {
             clearTimeout(this.saveTimer);
@@ -272,9 +237,6 @@ class CVEChecker {
             this.saveTimer = null;
         }, this.SAVE_DEBOUNCE_MS);
     }
-    /**
-     * Save cache to disk immediately
-     */
     saveCache() {
         try {
             const cacheFile = path.join(this.config.cacheDir, 'cve-cache.json');
@@ -294,17 +256,11 @@ class CVEChecker {
             console.error('[CVE Checker] Failed to save cache:', message);
         }
     }
-    /**
-     * Clear cache
-     */
     clearCache() {
         this.cache.clear();
         this.lastUpdate = 0;
         this.saveCache();
     }
-    /**
-     * Cleanup resources
-     */
     destroy() {
         if (this.saveTimer) {
             clearTimeout(this.saveTimer);

package/build/lib/license-checker.d.ts

@@ -1,37 +1,16 @@
 import { LicenseConfig } from '../types';
 import { Version } from '@verdaccio/types';
-/**
- * License checker for validating package licenses
- */
 export declare class LicenseChecker {
     private config;
     constructor(config?: LicenseConfig);
-    /**
-     * Check if a package version's license is allowed
-     */
     checkLicense(versionData: Version): {
         allowed: boolean;
         reason?: string;
         license?: string;
     };
-    /**
-     * Extract license from version data
-     */
     private extractLicense;
-    /**
-     * Check if license is blocked
-     */
     private isLicenseBlocked;
-    /**
-     * Check if license is allowed
-     */
     private isLicenseAllowed;
-    /**
-     * Get common open source licenses
-     */
     static getCommonOpenSourceLicenses(): string[];
-    /**
-     * Get common copyleft licenses
-     */
     static getCopyleftLicenses(): string[];
 }

package/build/lib/license-checker.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LicenseChecker = void 0;
-/**
- * License checker for validating package licenses
- */
 class LicenseChecker {
     constructor(config) {
         this.config = {
@@ -12,12 +9,8 @@ class LicenseChecker {
             requireLicense: (config === null || config === void 0 ? void 0 : config.requireLicense) !== false,
         };
     }
-    /**
-     * Check if a package version's license is allowed
-     */
     checkLicense(versionData) {
         const license = this.extractLicense(versionData);
-        // Check if license is missing
         if (!license || license === 'UNLICENSED' || license === '') {
             if (this.config.requireLicense) {
                 return {
@@ -28,7 +21,6 @@ class LicenseChecker {
             }
             return { allowed: true };
         }
-        // Check blocked list
         if (this.isLicenseBlocked(license)) {
             return {
                 allowed: false,
@@ -36,7 +28,6 @@ class LicenseChecker {
                 license,
             };
         }
-        // Check allowed list (if specified)
         if (this.config.allowed.length > 0 && !this.isLicenseAllowed(license)) {
             return {
                 allowed: false,
@@ -46,54 +37,36 @@ class LicenseChecker {
         }
         return { allowed: true, license };
     }
-    /**
-     * Extract license from version data
-     */
     extractLicense(versionData) {
         if (!versionData.license) {
             return null;
         }
-        // Handle string license
         if (typeof versionData.license === 'string') {
             return versionData.license;
         }
-        // Handle SPDX license object
         if (typeof versionData.license === 'object' && 'type' in versionData.license) {
             return versionData.license.type;
         }
         return null;
     }
-    /**
-     * Check if license is blocked
-     */
     isLicenseBlocked(license) {
         return this.config.blocked.some(blocked => {
-            // Exact match
             if (blocked === license) {
                 return true;
             }
-            // Handle SPDX expressions (e.g., "MIT OR Apache-2.0")
             const licenseTokens = license.split(/\s+(?:OR|AND)\s+/i);
             return licenseTokens.some(token => token.trim() === blocked);
         });
     }
-    /**
-     * Check if license is allowed
-     */
     isLicenseAllowed(license) {
         return this.config.allowed.some(allowed => {
-            // Exact match
             if (allowed === license) {
                 return true;
             }
-            // Handle SPDX expressions (e.g., "MIT OR Apache-2.0")
             const licenseTokens = license.split(/\s+(?:OR|AND)\s+/i);
             return licenseTokens.some(token => token.trim() === allowed);
         });
     }
-    /**
-     * Get common open source licenses
-     */
     static getCommonOpenSourceLicenses() {
         return [
             'MIT',
@@ -106,9 +79,6 @@ class LicenseChecker {
             'Unlicense',
         ];
     }
-    /**
-     * Get common copyleft licenses
-     */
     static getCopyleftLicenses() {
         return [
             'GPL-2.0',

package/build/lib/logger.d.ts

@@ -1,8 +1,5 @@
 import { Logger } from '@verdaccio/types';
 import { LoggerConfig } from '../types';
-/**
- * Enhanced logger wrapper with configurable log levels and formatting
- */
 export declare class SecurityLogger {
     private verdaccioLogger;
     private config;
@@ -15,28 +12,10 @@ export declare class SecurityLogger {
     info(message: string, ...args: any[]): void;
     warn(message: string, ...args: any[]): void;
     error(message: string, ...args: any[]): void;
-    /**
-     * Log package blocking event
-     */
     logBlock(packageName: string, version: string, reason: string): void;
-    /**
-     * Log fallback event
-     */
     logFallback(packageName: string, fromVersion: string, toVersion: string, reason?: string): void;
-    /**
-     * Log CVE detection
-     */
     logCVE(packageName: string, version: string, cveId: string, severity: string): void;
-    /**
-     * Log license violation
-     */
     logLicense(packageName: string, version: string, license: string, reason: string): void;
-    /**
-     * Log publish rejection
-     */
     logPublishRejected(packageName: string, version: string, reason: string): void;
-    /**
-     * Log initialization
-     */
     logInit(features: string[]): void;
 }

package/build/lib/logger.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SecurityLogger = void 0;
-/**
- * Enhanced logger wrapper with configurable log levels and formatting
- */
 class SecurityLogger {
     constructor(verdaccioLogger, config) {
         this.prefix = '[Security Filter]';
@@ -54,40 +51,22 @@ class SecurityLogger {
             this.verdaccioLogger.error(this.formatMessage(message), ...args);
         }
     }
-    /**
-     * Log package blocking event
-     */
     logBlock(packageName, version, reason) {
         this.warn(`Blocked ${packageName}@${version} - ${reason}`);
     }
-    /**
-     * Log fallback event
-     */
     logFallback(packageName, fromVersion, toVersion, reason) {
         const reasonText = reason ? ` (${reason})` : '';
         this.info(`Fallback applied: ${packageName}@${fromVersion} -> ${toVersion}${reasonText}`);
     }
-    /**
-     * Log CVE detection
-     */
     logCVE(packageName, version, cveId, severity) {
         this.warn(`CVE detected: ${cveId} [${severity}] in ${packageName}@${version}`);
     }
-    /**
-     * Log license violation
-     */
     logLicense(packageName, version, license, reason) {
         this.warn(`License violation: ${packageName}@${version} has ${license} - ${reason}`);
     }
-    /**
-     * Log publish rejection
-     */
     logPublishRejected(packageName, version, reason) {
         this.warn(`Publish rejected: ${packageName}@${version} - ${reason}`);
     }
-    /**
-     * Log initialization
-     */
     logInit(features) {
         this.info(`Plugin initialized with features: ${features.join(', ')}`);
     }

package/build/lib/lru-cache.d.ts

@@ -1,6 +1,3 @@
-/**
- * Simple LRU (Least Recently Used) Cache implementation with size limits
- */
 export declare class LRUCache<K, V> {
     private cache;
     private readonly maxSize;

package/build/lib/lru-cache.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LRUCache = void 0;
-/**
- * Simple LRU (Least Recently Used) Cache implementation with size limits
- */
 class LRUCache {
     constructor(maxSize = 1000) {
         this.cache = new Map();

package/build/lib/metrics.d.ts

@@ -1,55 +1,19 @@
 import { MetricsConfig, MetricsData } from '../types';
-/**
- * Metrics collector for tracking security events
- */
 export declare class MetricsCollector {
     private config;
     private metricsBuffer;
     private readonly bufferSize;
     private readonly maxBufferSize;
     constructor(config?: MetricsConfig);
-    /**
-     * Record a security event
-     */
     record(event: MetricsData): void;
-    /**
-     * Record a block event
-     */
     recordBlock(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
-    /**
-     * Record a fallback event
-     */
     recordFallback(packageName: string, fromVersion: string, toVersion: string, reason: string): void;
-    /**
-     * Record a publish rejection
-     */
     recordPublishRejected(packageName: string, version: string, reason: string): void;
-    /**
-     * Record a CVE detection
-     */
     recordCVE(packageName: string, version: string, cveId: string, severity: string): void;
-    /**
-     * Record a license block
-     */
     recordLicenseBlock(packageName: string, version: string, license: string, reason: string): void;
-    /**
-     * Record a package-too-new event
-     */
     recordPackageTooNew(packageName: string, version: string, reason: string, metadata?: Record<string, any>): void;
-    /**
-     * Flush metrics buffer to output
-     */
     flush(): void;
-    /**
-     * Write metrics to file
-     */
     private writeToFile;
-    /**
-     * Get metrics summary
-     */
     getSummary(): Record<string, number>;
-    /**
-     * Cleanup - flush remaining metrics
-     */
     cleanup(): void;
 }

package/build/lib/metrics.js

@@ -36,9 +36,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MetricsCollector = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-/**
- * Metrics collector for tracking security events
- */
 class MetricsCollector {
     constructor(config) {
         this.metricsBuffer = [];
@@ -50,9 +47,6 @@ class MetricsCollector {
             filePath: (config === null || config === void 0 ? void 0 : config.filePath) || './security-metrics.json',
         };
     }
-    /**
-     * Record a security event
-     */
     record(event) {
         if (!this.config.enabled) {
             return;
@@ -65,9 +59,6 @@ class MetricsCollector {
             this.flush();
         }
     }
-    /**
-     * Record a block event
-     */
     recordBlock(packageName, version, reason, metadata) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -78,9 +69,6 @@ class MetricsCollector {
             metadata,
         });
     }
-    /**
-     * Record a fallback event
-     */
     recordFallback(packageName, fromVersion, toVersion, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -91,9 +79,6 @@ class MetricsCollector {
             metadata: { toVersion },
         });
     }
-    /**
-     * Record a publish rejection
-     */
     recordPublishRejected(packageName, version, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -103,9 +88,6 @@ class MetricsCollector {
             reason,
         });
     }
-    /**
-     * Record a CVE detection
-     */
     recordCVE(packageName, version, cveId, severity) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -116,9 +98,6 @@ class MetricsCollector {
             metadata: { cveId, severity },
         });
     }
-    /**
-     * Record a license block
-     */
     recordLicenseBlock(packageName, version, license, reason) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -129,9 +108,6 @@ class MetricsCollector {
             metadata: { license },
         });
     }
-    /**
-     * Record a package-too-new event
-     */
     recordPackageTooNew(packageName, version, reason, metadata) {
         this.record({
             timestamp: new Date().toISOString(),
@@ -142,9 +118,6 @@ class MetricsCollector {
             metadata,
         });
     }
-    /**
-     * Flush metrics buffer to output
-     */
     flush() {
         if (this.metricsBuffer.length === 0) {
             return;
@@ -159,18 +132,13 @@ class MetricsCollector {
         }
         this.metricsBuffer = [];
     }
-    /**
-     * Write metrics to file
-     */
     writeToFile(metrics) {
         try {
             const filePath = this.config.filePath;
             const dir = path.dirname(filePath);
-            // Ensure directory exists
             if (!fs.existsSync(dir)) {
                 fs.mkdirSync(dir, { recursive: true });
             }
-            // Append to file
             const content = metrics.map(m => JSON.stringify(m)).join('\n') + '\n';
             fs.appendFileSync(filePath, content, 'utf8');
         }
@@ -179,9 +147,6 @@ class MetricsCollector {
             console.error('[Security Filter] Failed to write metrics:', message);
         }
     }
-    /**
-     * Get metrics summary
-     */
     getSummary() {
         const summary = {
             block: 0,
@@ -197,9 +162,6 @@ class MetricsCollector {
         });
         return summary;
     }
-    /**
-     * Cleanup - flush remaining metrics
-     */
     cleanup() {
         this.flush();
     }

package/build/lib/package-age-checker.d.ts

@@ -1,45 +1,23 @@
 import { PackageAgeConfig } from '../types';
 import { Package } from '@verdaccio/types';
-/**
- * Package age checker to protect against newly created malicious packages
- */
 export declare class PackageAgeChecker {
     private config;
     constructor(config?: PackageAgeConfig);
-    /**
-     * Check if a package is old enough to be trusted
-     */
     checkPackageAge(packageData: Package): {
         allowed: boolean;
         reason?: string;
         ageDays?: number;
         warnOnly?: boolean;
     };
-    /**
-     * Check if a specific version is old enough to be trusted
-     */
     checkVersionAge(packageData: Package, version: string): {
         allowed: boolean;
         reason?: string;
         ageDays?: number;
         warnOnly?: boolean;
     };
-    /**
-     * Get package creation date from time field
-     * The 'created' field in package.time represents when the package was first published
-     */
     private getPackageCreationDate;
-    /**
-     * Get version publish date from time field
-     */
     private getVersionPublishDate;
-    /**
-     * Calculate age in days from a date
-     */
     private calculateAgeDays;
-    /**
-     * Get summary of configuration
-     */
     getSummary(): {
         enabled: boolean;
         minPackageAgeDays: number;