verdaccio-security-filter 1.3.11 → 1.3.12

package/README.md

@@ -422,7 +422,7 @@ middlewares:
 | `cveCheck.updateInterval` | `number` | `24` | How long a package's vulnerability data is cached (hours) |
 | `cveCheck.cacheDir` | `string` | `./.security-cache` | Cache directory path |
 
-> **Note on `autoBlock` and dist-tags:** only the vulnerable versions are removed; unaffected versions stay installable. Any dist-tag (including `latest`) that points to a removed version is dropped and **not** re-pointed to another version. If `latest` is vulnerable, `npm install <pkg>` without a version or range will fail - install an explicit safe version or range instead (e.g. `npm install <pkg>@^1.2.0`).
+> **Note on removed versions and dist-tags:** whenever a check removes versions (CVE `autoBlock`, license, author, age, version rules, `whitelist.versions`), the other versions stay installable. The plugin drops every dist-tag that points to a removed version. Verdaccio then points `latest` at the highest version that is left (verified with Verdaccio 6.2), so `npm install <pkg>` keeps working. Other dist-tags that pointed to a removed version are gone.
 
 > **When OSV is unreachable:** a lookup gets one retry with a 5 second timeout each. After a failure the same package is not looked up again for 60 seconds. Previously cached data, even if older than `updateInterval`, keeps being used. With no cached data, `errorHandling.onCveCheckError` decides: `fail-open` serves the package unchecked, `fail-closed` blocks it.
 
@@ -432,7 +432,9 @@ middlewares:
 |--------|------|---------|-------------|
 | `licenses.allowed` | `string[]` | `[]` | Allowed license list |
 | `licenses.blocked` | `string[]` | `[]` | Blocked license list |
-| `licenses.requireLicense` | `boolean` | `false` | Require license field |
+| `licenses.requireLicense` | `boolean` | `true` | Reject versions without a license field |
+
+The license check runs when `licenses.allowed` is not empty. Every version is checked: versions with a rejected license are removed from the metadata, and the package is blocked as a whole only when no version is left.
 
 ### Whitelist Options
 
@@ -481,6 +483,8 @@ middlewares:
 | `authorFilter.requireVerifiedEmail` | `boolean` | `false` | Require author email information |
 | `authorFilter.warnOnly` | `boolean` | `false` | Only warn, don't block |
 
+Every version is checked against the author rules: versions published by a blocked author are removed from the metadata, and the package is blocked as a whole only when no version is left.
+
 ### Error Handling Options
 
 | Option | Type | Default | Description |

package/build/index.d.ts

@@ -23,6 +23,7 @@ export default class SecurityFilterPlugin implements IPluginMiddleware<SecurityC
     register_middlewares(app: Application, _auth: IBasicAuth<SecurityConfig>, _storage: IStorageManager<SecurityConfig>): void;
     private _blockedPackage;
     private _removeVersions;
+    private _rejectedVersions;
     filter_metadata(packageInfo: Package): Promise<Package>;
     private _versionBlockReason;
     private _checkPackageBlock;

package/build/index.js

@@ -306,9 +306,23 @@ class SecurityFilterPlugin {
         }
         return Object.assign(Object.assign({}, pkg), { versions, 'dist-tags': distTags });
     }
+    _rejectedVersions(pkg, check) {
+        var _a;
+        const all = Object.entries(pkg.versions || {});
+        const results = all
+            .map(([version, data]) => [version, check(data)])
+            .filter(([, result]) => !result.allowed);
+        const latest = results.find(([version]) => { var _a; return version === ((_a = pkg['dist-tags']) === null || _a === void 0 ? void 0 : _a.latest); });
+        return {
+            results,
+            versions: results.map(([version]) => version),
+            first: (_a = (latest || results[0])) === null || _a === void 0 ? void 0 : _a[1],
+            all: all.length > 0 && results.length === all.length,
+        };
+    }
     filter_metadata(packageInfo) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+            var _a, _b, _c, _d, _e;
             let pkg = packageInfo;
             const packageName = pkg.name;
             this.logger.debug(`[filter_metadata] --> Processing: ${packageName}`);
@@ -361,19 +375,22 @@ class SecurityFilterPlugin {
                     }
                 }
                 if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
-                    const latestVersion = (_c = pkg['dist-tags']) === null || _c === void 0 ? void 0 : _c.latest;
-                    if (latestVersion && ((_d = pkg.versions) === null || _d === void 0 ? void 0 : _d[latestVersion])) {
-                        const versionData = pkg.versions[latestVersion];
-                        const licenseResult = this.licenseChecker.checkLicense(versionData);
-                        if (!licenseResult.allowed) {
-                            const reason = licenseResult.reason || 'License not allowed';
-                            this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${reason}`);
-                            this.metrics.recordBlock(packageName, '*', reason);
-                            return this._blockedPackage(pkg, reason, { license: licenseResult.license });
+                    const rejected = this._rejectedVersions(pkg, data => this.licenseChecker.checkLicense(data));
+                    if (rejected.all) {
+                        const reason = rejected.first.reason || 'License not allowed';
+                        this.logger.warn(`[filter_metadata] LICENSE BLOCKED: ${packageName} - ${reason}`);
+                        this.metrics.recordBlock(packageName, '*', reason);
+                        return this._blockedPackage(pkg, reason, { license: rejected.first.license });
+                    }
+                    if (rejected.versions.length > 0) {
+                        this.logger.warn(`[filter_metadata] LICENSE FILTERED: ${packageName}: ${rejected.versions.join(', ')}`);
+                        for (const [version, result] of rejected.results) {
+                            this.metrics.recordBlock(packageName, version, result.reason || 'License not allowed');
                         }
+                        pkg = this._removeVersions(pkg, rejected.versions);
                     }
                 }
-                if ((_e = this.config.packageAge) === null || _e === void 0 ? void 0 : _e.enabled) {
+                if ((_c = this.config.packageAge) === null || _c === void 0 ? void 0 : _c.enabled) {
                     const ageResult = this.packageAgeChecker.checkPackageAge(pkg);
                     if (!ageResult.allowed && !ageResult.warnOnly) {
                         const reason = ageResult.reason || 'Package too new';
@@ -400,33 +417,38 @@ class SecurityFilterPlugin {
                         pkg = this._removeVersions(pkg, removedVersions);
                     }
                 }
-                if ((_f = this.config.authorFilter) === null || _f === void 0 ? void 0 : _f.enabled) {
-                    const latestVersion = (_g = pkg['dist-tags']) === null || _g === void 0 ? void 0 : _g.latest;
-                    if (latestVersion && ((_h = pkg.versions) === null || _h === void 0 ? void 0 : _h[latestVersion])) {
-                        const versionData = pkg.versions[latestVersion];
-                        const authorResult = this.authorChecker.checkAuthor(versionData);
-                        if (!authorResult.allowed && !this.config.authorFilter.warnOnly) {
-                            const reason = authorResult.reason || 'Author not allowed';
-                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${reason}`);
+                if ((_d = this.config.authorFilter) === null || _d === void 0 ? void 0 : _d.enabled) {
+                    const rejected = this._rejectedVersions(pkg, data => this.authorChecker.checkAuthor(data));
+                    if (rejected.versions.length > 0 && this.config.authorFilter.warnOnly) {
+                        this.logger.warn(`[filter_metadata] AUTHOR WARNING: ${packageName}: ${rejected.versions.join(', ')} - ${rejected.first.reason} (warn-only mode)`);
+                    }
+                    else if (rejected.versions.length > 0) {
+                        for (const [version, result] of rejected.results) {
                             this.metrics.record({
                                 timestamp: new Date().toISOString(),
                                 event: 'author_blocked',
                                 packageName,
-                                version: latestVersion,
-                                reason,
+                                version: rejected.all ? '*' : version,
+                                reason: result.reason || 'Author not allowed',
                                 metadata: {
-                                    blockedBy: authorResult.blockedBy,
-                                    authorInfo: authorResult.authorInfo,
+                                    blockedBy: result.blockedBy,
+                                    authorInfo: result.authorInfo,
                                 },
                             });
+                            if (rejected.all) {
+                                break;
+                            }
+                        }
+                        if (rejected.all) {
+                            const reason = rejected.first.reason || 'Author not allowed';
+                            this.logger.warn(`[filter_metadata] AUTHOR BLOCKED: ${packageName} - ${reason}`);
                             return this._blockedPackage(pkg, reason, {
-                                blockedBy: authorResult.blockedBy,
-                                authorInfo: authorResult.authorInfo,
+                                blockedBy: rejected.first.blockedBy,
+                                authorInfo: rejected.first.authorInfo,
                             });
                         }
-                        else if (!authorResult.allowed && this.config.authorFilter.warnOnly) {
-                            this.logger.warn(`[filter_metadata] AUTHOR WARNING: ${packageName} - ${authorResult.reason} (warn-only mode)`);
-                        }
+                        this.logger.warn(`[filter_metadata] AUTHOR FILTERED: ${packageName}: ${rejected.versions.join(', ')}`);
+                        pkg = this._removeVersions(pkg, rejected.versions);
                     }
                 }
                 this.logger.debug(`[filter_metadata] [OK] ALLOWED: ${packageName}`);
@@ -434,7 +456,7 @@ class SecurityFilterPlugin {
             }
             catch (error) {
                 this.logger.error(`[filter_metadata] Error processing ${packageName}: ${error.message}`);
-                const errorStrategy = ((_j = this.config.errorHandling) === null || _j === void 0 ? void 0 : _j.onFilterError) || 'fail-open';
+                const errorStrategy = ((_e = this.config.errorHandling) === null || _e === void 0 ? void 0 : _e.onFilterError) || 'fail-open';
                 if (errorStrategy === 'fail-closed') {
                     this.logger.warn(`[filter_metadata] Error handling: fail-closed - BLOCKING ${packageName}`);
                     this.metrics.recordBlock(packageName, '*', `Error during processing: ${error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.3.11",
+  "version": "1.3.12",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",