verdaccio-security-filter 1.3.1 → 1.3.3

package/build/lib/package-age-checker.js

@@ -1,9 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageAgeChecker = void 0;
-/**
- * Package age checker to protect against newly created malicious packages
- */
 class PackageAgeChecker {
     constructor(config) {
         var _a, _b, _c;
@@ -14,17 +11,12 @@ class PackageAgeChecker {
             warnOnly: (_c = config === null || config === void 0 ? void 0 : config.warnOnly) !== null && _c !== void 0 ? _c : false,
         };
     }
-    /**
-     * Check if a package is old enough to be trusted
-     */
     checkPackageAge(packageData) {
         if (!this.config.enabled) {
             return { allowed: true };
         }
-        // Get package creation date from time field
         const createdDate = this.getPackageCreationDate(packageData);
         if (!createdDate) {
-            // If we can't determine creation date, allow but warn
             return {
                 allowed: true,
                 reason: 'Cannot determine package creation date',
@@ -42,17 +34,12 @@ class PackageAgeChecker {
         }
         return { allowed: true, ageDays };
     }
-    /**
-     * Check if a specific version is old enough to be trusted
-     */
     checkVersionAge(packageData, version) {
         if (!this.config.enabled || !this.config.minVersionAgeDays) {
             return { allowed: true };
         }
-        // Get version publish date from time field
         const versionDate = this.getVersionPublishDate(packageData, version);
         if (!versionDate) {
-            // If we can't determine version date, allow but warn
             return {
                 allowed: true,
                 reason: `Cannot determine version ${version} publish date`,
@@ -70,22 +57,16 @@ class PackageAgeChecker {
         }
         return { allowed: true, ageDays };
     }
-    /**
-     * Get package creation date from time field
-     * The 'created' field in package.time represents when the package was first published
-     */
     getPackageCreationDate(packageData) {
         if (!packageData.time) {
             return null;
         }
-        // Try to get 'created' field first
         if ('created' in packageData.time) {
             const created = packageData.time.created;
             if (typeof created === 'string') {
                 return new Date(created);
             }
         }
-        // Fallback: find the oldest version
         const versions = Object.keys(packageData.time).filter(key => key !== 'modified' && key !== 'created');
         if (versions.length === 0) {
             return null;
@@ -99,12 +80,8 @@ class PackageAgeChecker {
         if (dates.length === 0) {
             return null;
         }
-        // Return the oldest date
         return new Date(Math.min(...dates.map(d => d.getTime())));
     }
-    /**
-     * Get version publish date from time field
-     */
     getVersionPublishDate(packageData, version) {
         if (!packageData.time || !(version in packageData.time)) {
             return null;
@@ -115,17 +92,11 @@ class PackageAgeChecker {
         }
         return null;
     }
-    /**
-     * Calculate age in days from a date
-     */
     calculateAgeDays(date) {
         const now = new Date();
         const diffMs = now.getTime() - date.getTime();
         return Math.floor(diffMs / (1000 * 60 * 60 * 24));
     }
-    /**
-     * Get summary of configuration
-     */
     getSummary() {
         return {
             enabled: this.config.enabled,

package/build/lib/whitelist-checker.d.ts

@@ -1,45 +1,19 @@
 import { WhitelistConfig } from '../types';
-/**
- * Whitelist checker for package validation
- */
 export declare class WhitelistChecker {
     private config;
     constructor(config?: WhitelistConfig);
-    /**
-     * Check if a package is whitelisted
-     */
     isWhitelisted(packageName: string, version?: string): {
         allowed: boolean;
         reason?: string;
     };
-    /**
-     * Check if package name matches any whitelist pattern
-     */
     private matchesPattern;
-    /**
-     * Add package to whitelist
-     */
     addPackage(packageName: string, versionRange?: string): void;
-    /**
-     * Remove package from whitelist
-     */
     removePackage(packageName: string): void;
-    /**
-     * Add pattern to whitelist
-     */
     addPattern(pattern: string): void;
-    /**
-     * Check if package meets auto-approve criteria
-     * Note: This is a placeholder. Real implementation would require
-     * integration with npm registry API to fetch download stats, etc.
-     */
     meetsAutoApproveCriteria(_packageName: string): Promise<{
         approved: boolean;
         reason?: string;
     }>;
-    /**
-     * Get whitelist summary
-     */
     getSummary(): {
         totalPackages: number;
         totalPatterns: number;

package/build/lib/whitelist-checker.js

@@ -44,9 +44,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WhitelistChecker = void 0;
 const semver = __importStar(require("semver"));
-/**
- * Whitelist checker for package validation
- */
 class WhitelistChecker {
     constructor(config) {
         this.config = {
@@ -56,13 +53,8 @@ class WhitelistChecker {
             autoApprove: config === null || config === void 0 ? void 0 : config.autoApprove,
         };
     }
-    /**
-     * Check if a package is whitelisted
-     */
     isWhitelisted(packageName, version) {
-        // Check exact package name match
         if (this.config.packages.includes(packageName)) {
-            // If version is specified, check version constraint
             if (version && this.config.versions && packageName in this.config.versions) {
                 const versionRange = this.config.versions[packageName];
                 if (!semver.satisfies(version, versionRange)) {
@@ -74,19 +66,14 @@ class WhitelistChecker {
             }
             return { allowed: true };
         }
-        // Check pattern match
         if (this.matchesPattern(packageName)) {
             return { allowed: true };
         }
-        // Not in whitelist
         return {
             allowed: false,
             reason: 'Package is not in whitelist',
         };
     }
-    /**
-     * Check if package name matches any whitelist pattern
-     */
     matchesPattern(packageName) {
         return this.config.patterns.some(pattern => {
             try {
@@ -99,9 +86,6 @@ class WhitelistChecker {
             }
         });
     }
-    /**
-     * Add package to whitelist
-     */
     addPackage(packageName, versionRange) {
         if (!this.config.packages.includes(packageName)) {
             this.config.packages.push(packageName);
@@ -111,9 +95,6 @@ class WhitelistChecker {
             this.config.versions[packageName] = versionRange;
         }
     }
-    /**
-     * Remove package from whitelist
-     */
     removePackage(packageName) {
         const index = this.config.packages.indexOf(packageName);
         if (index > -1) {
@@ -123,40 +104,22 @@ class WhitelistChecker {
             delete this.config.versions[packageName];
         }
     }
-    /**
-     * Add pattern to whitelist
-     */
     addPattern(pattern) {
         if (!this.config.patterns.includes(pattern)) {
             this.config.patterns.push(pattern);
         }
     }
-    /**
-     * Check if package meets auto-approve criteria
-     * Note: This is a placeholder. Real implementation would require
-     * integration with npm registry API to fetch download stats, etc.
-     */
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
     meetsAutoApproveCriteria(_packageName) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.config.autoApprove) {
                 return { approved: false, reason: 'Auto-approve not configured' };
             }
-            // Placeholder for npm registry API integration
-            // In a real implementation, you would:
-            // 1. Fetch package info from npm registry
-            // 2. Check weekly downloads against minDownloads
-            // 3. Check GitHub stars against minStars
-            // 4. Check if publisher is verified
             return {
                 approved: false,
                 reason: 'Auto-approve requires npm registry API integration (not implemented)',
             };
         });
     }
-    /**
-     * Get whitelist summary
-     */
     getSummary() {
         return {
             totalPackages: this.config.packages.length,

package/build/types.d.ts

@@ -90,11 +90,8 @@ export interface SecurityRules {
     versionRangeRules: VersionRangeRule[];
 }
 export interface VersionData extends Version {
-    /** Internal flag for fallback versions */
     _fallback?: boolean;
-    /** Original version this is falling back from */
     _fallbackFrom?: string;
-    /** Reason for fallback */
     _fallbackReason?: string;
 }
 export interface FilterResult {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -53,6 +53,9 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.0.0"
   },
+  "overrides": {
+    "qs": "^6.14.1"
+  },
   "author": {
     "name": "Vitaliy Ponomarenko",
     "url": "https://github.com/ponomarenko"
@@ -67,7 +70,9 @@
   },
   "homepage": "https://github.com/ponomarenko/verdaccio-security-filter#readme",
   "files": [
-    "build/",
-    "README.md"
+    "build/**/*.js",
+    "build/**/*.d.ts",
+    "README.md",
+    "LICENSE"
   ]
 }