verdaccio-security-filter 1.4.1 → 1.4.2

package/README.md

@@ -448,9 +448,9 @@ Recommended before turning on `cveCheck.autoBlock`, a license policy or the auth
 |--------|------|---------|-------------|
 | `licenses.allowed` | `string[]` | `[]` | Allowed license list |
 | `licenses.blocked` | `string[]` | `[]` | Blocked license list |
-| `licenses.requireLicense` | `boolean` | `true` | Reject versions without a license field |
+| `licenses.requireLicense` | `boolean` | `true` with `allowed`, otherwise `false` | Reject versions without a license field |
 
-The license check runs when `licenses.allowed` is not empty. Every version is checked: versions with a rejected license are removed from the metadata, and the package is blocked as a whole only when no version is left.
+The license check runs when `licenses.allowed` or `licenses.blocked` is not empty, or `licenses.requireLicense` is `true`. Every version is checked: versions with a rejected license are removed from the metadata, and the package is blocked as a whole only when no version is left.
 
 ### Whitelist Options
 

package/build/index.js

@@ -146,7 +146,7 @@ class SecurityFilterPlugin {
         }
     }
     _getEnabledFeatures() {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d;
         const features = [];
         if (this.config.dryRun)
             features.push('dry-run');
@@ -156,11 +156,11 @@ class SecurityFilterPlugin {
             features.push('metrics');
         if ((_b = this.config.cveCheck) === null || _b === void 0 ? void 0 : _b.enabled)
             features.push('cve-checking');
-        if (((_c = this.config.licenses) === null || _c === void 0 ? void 0 : _c.allowed) && this.config.licenses.allowed.length > 0)
+        if (this.licenseChecker.enabled)
             features.push('license-filtering');
-        if ((_d = this.config.packageAge) === null || _d === void 0 ? void 0 : _d.enabled)
+        if ((_c = this.config.packageAge) === null || _c === void 0 ? void 0 : _c.enabled)
             features.push('package-age-verification');
-        if ((_e = this.config.authorFilter) === null || _e === void 0 ? void 0 : _e.enabled)
+        if ((_d = this.config.authorFilter) === null || _d === void 0 ? void 0 : _d.enabled)
             features.push('author-filtering');
         if (this.securityRules.versionRangeRules.length > 0)
             features.push('version-range-rules');
@@ -403,7 +403,7 @@ class SecurityFilterPlugin {
                         pkg = this._removeVersions(pkg, vulnerableVersions);
                     }
                 }
-                if (this.config.licenses && this.config.licenses.allowed && this.config.licenses.allowed.length > 0) {
+                if (this.licenseChecker.enabled) {
                     const rejected = this._rejectedVersions(pkg, data => this.licenseChecker.checkLicense(data));
                     if (rejected.all) {
                         const reason = rejected.first.reason || 'License not allowed';

package/build/lib/license-checker.d.ts

@@ -3,6 +3,7 @@ import { Version } from '@verdaccio/types';
 export declare class LicenseChecker {
     private config;
     constructor(config?: LicenseConfig);
+    get enabled(): boolean;
     checkLicense(versionData: Version): {
         allowed: boolean;
         reason?: string;

package/build/lib/license-checker.js

@@ -3,12 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.LicenseChecker = void 0;
 class LicenseChecker {
     constructor(config) {
+        var _a;
         this.config = {
             allowed: (config === null || config === void 0 ? void 0 : config.allowed) || [],
             blocked: (config === null || config === void 0 ? void 0 : config.blocked) || [],
-            requireLicense: (config === null || config === void 0 ? void 0 : config.requireLicense) !== false,
+            requireLicense: (_a = config === null || config === void 0 ? void 0 : config.requireLicense) !== null && _a !== void 0 ? _a : ((config === null || config === void 0 ? void 0 : config.allowed) || []).length > 0,
         };
     }
+    get enabled() {
+        return this.config.allowed.length > 0 || this.config.blocked.length > 0 || this.config.requireLicense;
+    }
     checkLicense(versionData) {
         const license = this.extractLicense(versionData);
         if (!license || license === 'UNLICENSED' || license === '') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-security-filter",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Advanced security filter plugin for Verdaccio with version range blocking and fallback strategies",
   "main": "build/index.js",
   "types": "build/index.d.ts",