Release 1.1.0

Add user to maintainers when publish. fixed #395

.gitignore

@@ -27,3 +27,4 @@ bin/mysql.js
 bin/test.sql
 coverage/
 config/web_readme.md
+.tmp/

.travis.yml

@@ -1,3 +1,5 @@
 language: node_js
 node_js:
   - '0.11'
+script: "make test-travis"
+after_script: "npm install coveralls@2 && cat ./coverage/lcov.info | coveralls"

History.md

@@ -1,4 +1,115 @@
 
+1.1.0 / 2014-08-07
+==================
+
+ * Add user to maintainers when publish. fixed #395
+ * List all npm registry api. close #413
+ * limit list since
+ * change deps by "~"
+ * use cfork to make sure worker fork and restart
+ * handle master uncaughtException. fixed #403
+
+1.0.6 / 2014-08-02
+==================
+
+ * WTF moment@2.8.0 missing
+
+1.0.5 / 2014-08-02
+==================
+
+ * unpublish pkg@version bug hotfix. fixed #400
+
+1.0.4 / 2014-08-01
+==================
+
+ * hotfix #399 use not exists
+
+1.0.3 / 2014-08-01
+==================
+
+ * add maintaining packages in user page
+
+1.0.2 / 2014-08-01
+==================
+
+  * ~_~ fix auth error response message
+
+1.0.1 / 2014-08-01
+==================
+
+  * Merge pull request #398 from cnpm/fix-auth
+  * hot fix auth error
+
+1.0.0 / 2014-08-01
+==================
+
+ * add private package list
+
+0.9.2 / 2014-07-30
+==================
+
+ * hotfix save custom user bug
+
+0.9.1 / 2014-07-30
+==================
+
+ * Handle user service auth throw custom error message
+ * add test for config private packages
+ * add config.privatePackages
+ * add more comments in config/index.js
+
+0.9.0 / 2014-07-29
+==================
+
+ * scopes init mv to services/user.js
+ * show user more profile
+ * registry show user support custom user service
+ * support custom user service for user auth
+ * remove session middleware
+ * add DefaultUserService
+ * check scopes in module.getAdapt
+ * test public mode, fix some logic, close #382
+ * move scope.js into publishable.js, add forcePublishWithScope
+ * config.scopes not exist, means do not support scope
+ * add assert scope middleware
+
+0.8.7 / 2014-07-24
+==================
+
+ * fix unpublished info missing maintainers cause TypeError
+
+0.8.6 / 2014-07-23
+==================
+
+ * show unpublished info on web package page. fixes #381
+
+0.8.5 / 2014-07-22
+==================
+
+ * Only private package support default scoped. fixed #378
+
+0.8.4 / 2014-07-22
+==================
+
+ * adapt default scpoe in /@:scope/:name/:version
+
+0.8.3 / 2014-07-22
+==================
+
+ * hot fix download
+
+0.8.2 / 2014-07-22
+==================
+
+ * fix default scope detect
+
+0.8.1 / 2014-07-21
+==================
+
+ * add more test cases
+ * support default @org. close #376
+ * hotfix redis init error
+
 0.8.0 / 2014-07-21
 ==================
 

Makefile

@@ -44,11 +44,26 @@ test-cov cov: install pretest
 		$(TESTS)
 	@./node_modules/.bin/cov coverage
 
+test-travis: install pretest
+	@NODE_ENV=test node --harmony \
+		node_modules/.bin/istanbul cover --preserve-comments \
+		./node_modules/.bin/_mocha \
+		--report lcovonly \
+		-- \
+		--reporter dot \
+		--timeout $(TIMEOUT) \
+		--require should \
+		--require should-http \
+		--require co-mocha \
+		--require ./test/init.js \
+		$(MOCHA_OPTS) \
+		$(TESTS)
+
 contributors: install
 	@./node_modules/.bin/contributors -f plain -o AUTHORS
 
 autod: install
-	@./node_modules/.bin/autod -w -e public,view,docs,backup,coverage
+	@./node_modules/.bin/autod -w -e public,view,docs,backup,coverage -k nodemailer --prefix "~"
 	@$(MAKE) install
 
 .PHONY: test

README.md

@@ -1,9 +1,22 @@
 cnpmjs.org
 =======
 
-[![Build Status](https://secure.travis-ci.org/cnpm/cnpmjs.org.svg)](http://travis-ci.org/cnpm/cnpmjs.org) [![Dependency Status](https://gemnasium.com/cnpm/cnpmjs.org.svg)](https://gemnasium.com/cnpm/cnpmjs.org)
+[![NPM version][npm-image]][npm-url]
+[![build status][travis-image]][travis-url]
+[![Test coverage][coveralls-image]][coveralls-url]
+[![Gittip][gittip-image]][gittip-url]
+[![David deps][david-image]][david-url]
 
-[![NPM](https://nodei.co/npm/cnpmjs.org.svg?downloads=true&stars=true)](https://nodei.co/npm/cnpmjs.org/)
+[npm-image]: https://img.shields.io/npm/v/cnpmjs.org.svg?style=flat
+[npm-url]: https://npmjs.org/package/cnpmjs.org
+[travis-image]: https://img.shields.io/travis/cnpm/cnpmjs.org.svg?style=flat
+[travis-url]: https://travis-ci.org/cnpm/cnpmjs.org
+[coveralls-image]: https://img.shields.io/coveralls/cnpm/cnpmjs.org.svg?style=flat
+[coveralls-url]: https://coveralls.io/r/cnpm/cnpmjs.org?branch=master
+[gittip-image]: https://img.shields.io/gittip/fengmk2.svg?style=flat
+[gittip-url]: https://www.gittip.com/fengmk2/
+[david-image]: https://img.shields.io/david/cnpm/cnpmjs.org.svg?style=flat
+[david-url]: https://david-dm.org/cnpm/cnpmjs.org
 
 ![logo](https://raw.github.com/cnpm/cnpmjs.org/master/logo.png)
 

common/logger.js

@@ -35,8 +35,8 @@ var logger = module.exports = Logger({
 });
 
 var to = [];
-for (var name in config.admins) {
-  to.push(config.admins[name]);
+for (var user in config.admins) {
+  to.push(config.admins[user]);
 }
 
 function errorFormater(err) {

common/redis.js

@@ -22,8 +22,7 @@ if (config.redis && config.redis.host && config.redis.port) {
   var redis = require('redis');
   var wrapper = require('co-redis');
   var logger = require('./logger');
-
-  var _client = redis.createClient(config.redis);
+  var _client = redis.createClient(config.redis.port, config.redis.host);
 
   _client.on('error', function (err) {
     logger.error(err);

common/session.js

@@ -1,34 +0,0 @@
-/*!
- * cnpmjs.org - common/session.js
- *
- * Copyright(c) cnpmjs.org and other contributors.
- * MIT Licensed
- *
- * Authors:
- *  fengmk2 <fengmk2@gmail.com> (http://fengmk2.github.com)
- *  dead_horse <dead_horse@qq.com> (http://deadhorse.me)
- */
-
-'use strict';
-
-/**
- * Module dependencies.
- */
-
-var middlewares = require('koa-middlewares');
-var config = require('../config');
-
-var key = 'AuthSession';
-var cookie = { path: '/', httpOnly: true, maxAge: 3600000 * 24 * 365, signed: false };
-var options = {
-  key: key,
-  cookie: cookie,
-  defer: true,
-  rolling: false
-};
-
-if (!config.debug) {
-  options.store = config.sessionStore || middlewares.RedisStore(config.redis);
-}
-
-module.exports = middlewares.session(options);

config/index.js

@@ -27,16 +27,88 @@ var version = require('../package.json').version;
 var root = path.dirname(__dirname);
 
 var config = {
+
   version: version,
+
+  /**
+   * Cluster mode
+   */
+  enableCluster: false,
+  numCPUs: os.cpus().length,
+
+  /*
+   * server configure
+   */
   registryPort: 7001,
   webPort: 7002,
   bindingHost: '127.0.0.1', // only binding on 127.0.0.1 for local access
-  enableCluster: false,
-  numCPUs: os.cpus().length,
-  debug: true, // if debug
+
+  // debug mode
+  // if in debug mode, some middleware like limit wont load
+  // logger module will print to stdout
+  debug: true,
+  // session secret
+  sessionSecret: 'cnpmjs.org test session secret',
+  // max request json body size
+  jsonLimit: '10mb',
+  // log dir name
   logdir: path.join(root, '.tmp', 'logs'),
+  // update file template dir
+  uploadDir: path.join(root, '.dist'),
+  // web page viewCache
   viewCache: false,
-  // mysql config
+
+  // config for koa-limit middleware
+  // for limit download rates
+  limit: {
+    enable: false,
+    token: 'koa-limit:download',
+    limit: 1000,
+    interval: 1000 * 60 * 60 * 24,
+    whiteList: [],
+    blackList: [],
+    message: 'request frequency limited, any question, please contact fengmk2@gmail.com',
+  },
+
+  enableCompress: false, // enable gzip response or not
+
+  // default system admins
+  admins: {
+    // name: email
+    fengmk2: 'fengmk2@gmail.com',
+    admin: 'admin@cnpmjs.org',
+    dead_horse: 'dead_horse@qq.com',
+    cnpmjstest10: 'cnpmjstest10@cnpmjs.org',
+  },
+
+  // email notification for errors
+  mail: {
+    appname: 'cnpmjs.org',
+    sender: 'cnpmjs.org mail sender <adderss@gmail.com>',
+    host: 'smtp.gmail.com',
+    port: 465,
+    user: 'address@gmail.com',
+    pass: 'your password',
+    ssl: true,
+    debug: false
+  },
+
+
+  logoURL: '//ww4.sinaimg.cn/large/69c1d4acgw1ebfly5kjlij208202oglr.jpg', // cnpm logo image url
+  customReadmeFile: '', // you can use your custom readme file instead the cnpm one
+  customFooter: '', // you can add copyright and site total script html here
+  npmClientName: 'cnpm', // use `${name} install package`
+  packagePageContributorSearch: true, // package page contributor link to search, default is true
+
+  // max handle number of package.json `dependencies` property
+  maxDependencies: 200,
+  // backup filepath prefix
+  backupFilePrefix: '/cnpm/backup/',
+
+  /**
+   * mysql config
+   */
+
   mysqlServers: [
     {
       host: '127.0.0.1',
@@ -49,73 +121,75 @@ var config = {
   mysqlMaxConnections: 4,
   mysqlQueryTimeout: 5000,
 
-  sessionSecret: 'cnpmjs.org test session secret',
-  redis: {
-    // host: 'pub-redis-19533.us-east-1-4.3.ec2.garantiadata.com',
-    // port: 19533,
-    // pass: 'cnpmjs_dev'
-  },
-  jsonLimit: '10mb', // max request json body size
-  uploadDir: path.join(root, '.dist'),
+
+  // redis config
+  // use for koa-limit module as storage
+  redis: null,
+
+  // package tarball store in qn by default
   // qiniu cdn: http://www.qiniu.com/, it free for dev.
   qn: {
-    // accessKey: "iN7NgwM31j4-BZacMjPrOQBs34UG1maYCAQmhdCV",
-    // secretKey: "6QTOr2Jg1gcZEWDQXKOGZh5PziC2MCV5KsntT70j",
-    // bucket: "qtestbucket",
-    // domain: "http://qtestbucket.qiniudn.com",
     accessKey: "5UyUq-l6jsWqZMU6tuQ85Msehrs3Dr58G-mCZ9rE",
     secretKey: "YaRsPKiYm4nGUt8mdz2QxeV5Q_yaUzVxagRuWTfM",
     bucket: "qiniu-sdk-test",
     domain: "http://qiniu-sdk-test.qiniudn.com",
   },
 
-  mail: {
-    appname: 'cnpmjs.org',
-    sender: 'cnpmjs.org mail sender <adderss@gmail.com>',
-    host: 'smtp.gmail.com',
-    port: 465,
-    user: 'address@gmail.com',
-    pass: 'your password',
-    ssl: true,
-    debug: false
-  },
+  // registry url name
+  registryHost: 'r.cnpmjs.org',
 
+
+  /**
+   * registry mode config
+   */
+
+  // enable private mode, only admin can publish, other use just can sync package from source npm
+  enablePrivate: true,
+
+  // registry scopes, if don't set, means do not support scopes
+  scopes: [
+    '@cnpm',
+    '@cnpmtest'
+  ],
+
+  // redirect @cnpm/private-package => private-package
+  // forward compatbility for update from lower version cnpmjs.org
+  adaptScope: true,
+
+  // force user publish with scope
+  // but admins still can publish without scope
+  forcePublishWithScope: true,
+
+  // some registry already have some private packages in global scope
+  // but we want to treat them as scoped private packages,
+  // so you can use this white list.
+  privatePackages: ['private-package'],
+
+  /**
+   * sync configs
+   */
+
+  // sync dist config
+  // sync node.js dist from nodejs.org
   noticeSyncDistError: true,
   disturl: 'http://nodejs.org/dist',
   syncDist: false,
-  logoURL: '//ww4.sinaimg.cn/large/69c1d4acgw1ebfly5kjlij208202oglr.jpg',
-  registryHost: 'r.cnpmjs.org',
-  // customReadmeFile: __dirname + '/web_readme.md',
-  customReadmeFile: '', // you can use your custom readme file instead the cnpm one
-  customFooter: '', // you can add copyright and site total script html here
-  npmClientName: 'cnpm', // use `${name} install package`
-  packagePageContributorSearch: true, // package page contributor link to search, default is true
-  sourceNpmRegistry: 'http://registry.npmjs.org',
-  enablePrivate: true, // enable private mode, only admin can publish, other use just can sync package from source npm
-  admins: {
-    // name: email
-    fengmk2: 'fengmk2@gmail.com',
-    admin: 'admin@cnpmjs.org',
-    dead_horse: 'dead_horse@qq.com',
-    cnpmjstest10: 'cnpmjstest10@cnpmjs.org',
-  },
-  syncByInstall: true,
-  backupFilePrefix: '/cnpm/backup/', // backup filepath prefix
-  syncModel: 'none', // 'none', 'all', 'exist'
-  syncConcurrency: 1,
-  syncInterval: '10m', // sync interval, default is 10 minutes
-  maxDependencies: 200, // max handle number of package.json `dependencies` property
 
-  limit: {
-    enable: false,
-    token: 'koa-limit:download',
-    limit: 1000,
-    interval: 1000 * 60 * 60 * 24,
-    whiteList: [],
-    blackList: [],
-    message: 'request frequency limited, any question, please contact fengmk2@gmail.com',
-  },
-  enableCompress: false, // enable gzip response or not
+  // sync source
+  sourceNpmRegistry: 'http://registry.npmjs.org',
+
+  // if install return 404, try to sync from source registry
+  syncByInstall: true,
+
+  // sync mode select
+  // none: do not sync any module
+  // exist: only sync exist modules
+  // all: sync all modules
+  syncModel: 'none', // 'none', 'all', 'exist'
+
+  syncConcurrency: 1,
+  // sync interval, default is 10 minutes
+  syncInterval: '10m',
 };
 
 // load config/config.js, everything in config.js will cover the same key in index.js

controllers/registry/module.js

@@ -39,6 +39,7 @@ var ModuleDeps = require('../../proxy/module_deps');
 var ModuleStar = require('../../proxy/module_star');
 var ModuleUnpublished = require('../../proxy/module_unpublished');
 var packageService = require('../../services/package');
+var UserService = require('../../services/user');
 var downloadAsReadStream = require('../utils').downloadAsReadStream;
 
 /**
@@ -46,14 +47,32 @@ var downloadAsReadStream = require('../utils').downloadAsReadStream;
  * GET /:name
  */
 exports.show = function* (next) {
-  var name = this.params.name || this.params[0];
+  var orginalName = this.params.name || this.params[0];
+  var name = orginalName;
   var rs = yield [
     Module.getLastModified(name),
     Module.listTags(name)
   ];
   var modifiedTime = rs[0];
   var tags = rs[1];
-  debug('show %s, last modified: %s, tags: %j', name, modifiedTime, tags);
+  var adaptDefaultScope = false;
+
+  if (tags.length === 0) {
+    var adaptName = yield* Module.getAdaptName(name);
+    if (adaptName) {
+      adaptDefaultScope = true;
+      // remove default scope name and retry
+      name = adaptName;
+      rs = yield [
+        Module.getLastModified(name),
+        Module.listTags(name),
+      ];
+      modifiedTime = rs[0];
+      tags = rs[1];
+    }
+  }
+
+  debug('show %s(%s), last modified: %s, tags: %j', name, orginalName, modifiedTime, tags);
   if (modifiedTime) {
     // find out the latest modfied time
     // because update tags only modfied tag, wont change module gmt_modified
@@ -101,8 +120,8 @@ exports.show = function* (next) {
     if (unpublishedInfo) {
       this.status = 404;
       this.body = {
-        _id: name,
-        name: name,
+        _id: orginalName,
+        name: orginalName,
         time: {
           modified: unpublishedInfo.package.time,
           unpublished: unpublishedInfo.package,
@@ -116,7 +135,7 @@ exports.show = function* (next) {
   // if module not exist in this registry,
   // sync the module backend and return package info from official registry
   if (rows.length === 0) {
-    if (!this.allowSync) {
+    if (!this.allowSync || adaptDefaultScope) {
       this.status = 404;
       this.body = {
         error: 'not_found',
@@ -124,13 +143,12 @@ exports.show = function* (next) {
       };
       return;
     }
-    var result = yield SyncModuleWorker.sync(name, 'sync-by-install');
+    var result = yield* SyncModuleWorker.sync(name, 'sync-by-install');
     this.body = result.pkg;
     this.status = result.ok ? 200 : (result.statusCode || 500);
     return;
   }
 
-  var nextMod = null;
   var latestMod = null;
   var readme = null;
   // set tags
@@ -147,28 +165,31 @@ exports.show = function* (next) {
   var createdTime = null;
   for (var i = 0; i < rows.length; i++) {
     var row = rows[i];
-    if (row.version === 'next') {
-      nextMod = row;
-      continue;
-    }
     var pkg = row.package;
     common.setDownloadURL(pkg, this);
     pkg._cnpm_publish_time = row.publish_time;
     versions[pkg.version] = pkg;
+
     var t = times[pkg.version] = row.publish_time ? new Date(row.publish_time) : row.gmt_modified;
-    if ((!distTags.latest && !latestMod) || distTags.latest === row.version) {
+    if ((!distTags.latest && !latestMod) || distTags.latest === pkg.version) {
       latestMod = row;
       readme = pkg.readme;
     }
+
     delete pkg.readme;
     if (maintainers.length > 0) {
-      // TODO: need to use newer maintainers
       pkg.maintainers = maintainers;
     }
 
     if (!createdTime || t < createdTime) {
       createdTime = t;
     }
+
+    if (adaptDefaultScope) {
+      // change to orginal name for default scope was removed above
+      pkg.name = orginalName;
+      pkg._id = orginalName + '@' + pkg.version;
+    }
   }
 
   if (modifiedTime && createdTime) {
@@ -183,30 +204,22 @@ exports.show = function* (next) {
   }
 
   if (!latestMod) {
-    latestMod = nextMod || rows[0];
-  }
-
-  if (!nextMod) {
-    nextMod = latestMod;
-  }
-
-  var rev = '';
-  if (nextMod) {
-    rev = String(nextMod.id);
+    latestMod = rows[0];
   }
 
+  var rev = String(latestMod.id);
   var pkg = latestMod.package;
 
-  if (tags.length === 0 && pkg.version !== 'next') {
+  if (tags.length === 0) {
     // some sync error reason, will cause tags missing
     // set latest tag at least
     distTags.latest = pkg.version;
   }
 
   var info = {
-    _id: name,
+    _id: orginalName,
     _rev: rev,
-    name: name,
+    name: orginalName,
     description: pkg.description,
     "dist-tags": distTags,
     maintainers: pkg.maintainers,
@@ -224,7 +237,7 @@ exports.show = function* (next) {
   info.bugs = pkg.bugs;
   info.license = pkg.license;
 
-  debug('show module %s: %s, latest: %s', name, rev, latestMod.version);
+  debug('show module %s: %s, latest: %s', orginalName, rev, latestMod.version);
   this.body = info;
 };
 
@@ -240,25 +253,36 @@ exports.get = function* (next) {
   var version = semver.valid(tag);
   var method = version ? 'get' : 'getByTag';
   var queryLabel = version ? version : tag;
+  var orginalName = name;
+  var adaptDefaultScope = false;
   debug('%s %s with %j', method, name, this.params);
 
-  var rs = yield [
-    Module[method](name, queryLabel),
-    packageService.listMaintainers(name),
-  ];
-  var mod = rs[0];
+  var mod = yield Module[method](name, queryLabel);
+  if (!mod) {
+    var adaptName = yield* Module.getAdaptName(name);
+    if (adaptName) {
+      name = adaptName;
+      mod = yield Module[method](name, queryLabel);
+      adaptDefaultScope = true;
+    }
+  }
+
   if (mod) {
     common.setDownloadURL(mod.package, this);
     mod.package._cnpm_publish_time = mod.publish_time;
-    var maintainers = rs[1];
+    var maintainers = yield* packageService.listMaintainers(name);
     if (maintainers.length > 0) {
       mod.package.maintainers = maintainers;
     }
+    if (adaptDefaultScope) {
+      mod.package.name = orginalName;
+      mod.package._id = orginalName + '@' + mod.package.version;
+    }
     this.body = mod.package;
     return;
   }
   // if not fond, sync from source registry
-  if (!this.allowSync) {
+  if (!this.allowSync || adaptDefaultScope) {
     this.status = 404;
     this.body = {
       error: 'not exist',
@@ -283,8 +307,8 @@ exports.get = function* (next) {
 var _downloads = {};
 
 exports.download = function *(next) {
-  var name = this.params.name;
-  var filename = this.params.filename;
+  var name = this.params.name || this.params[0];
+  var filename = this.params.filename || this.params[1];
   var version = filename.slice(name.length + 1, -4);
   var row = yield Module.get(name, version);
   // can not get dist
@@ -294,6 +318,8 @@ exports.download = function *(next) {
     url = nfs.url(common.getCDNKey(name, filename));
   }
 
+  debug('download %s %s %s %s', name, filename, version, url);
+
   if (!row || !row.package || !row.package.dist) {
     if (!url) {
       return yield* next;
@@ -400,10 +426,9 @@ exports.addPackageAndDist = function *(next) {
   //    { content_type: 'application/octet-stream',
   //      data: 'H4sIAAAAA
   //      length: 9883
-
   var pkg = this.request.body;
   var username = this.user.name;
-  var name = this.params.name;
+  var name = this.params.name || this.params[0];
   var filename = Object.keys(pkg._attachments || {})[0];
   var version = Object.keys(pkg.versions || {})[0];
   if (!version || !filename) {
@@ -417,6 +442,35 @@ exports.addPackageAndDist = function *(next) {
 
   var attachment = pkg._attachments[filename];
   var versionPackage = pkg.versions[version];
+  var maintainers = versionPackage.maintainers;
+
+  // should never happened in normal request
+  if (!maintainers) {
+    this.status = 400;
+    this.body = {
+      error: 'maintainers error',
+      reason: 'request body need maintainers'
+    };
+    return;
+  }
+
+  // notice that admins can not publish to all modules
+  // (but admins can add self to maintainers first)
+
+  // make sure user in auth is in maintainers
+  // should never happened in normal request
+  var m = maintainers.filter(function (maintainer) {
+    return maintainer.name === username;
+  });
+  if (!m.length) {
+    this.status = 403;
+    this.body = {
+      error: 'maintainers error',
+      reason: username + ' does not in maintainer list'
+    };
+    return;
+  }
+
   versionPackage._publish_on_cnpm = true;
   var distTags = pkg['dist-tags'] || {};
   var tags = []; // tag, version
@@ -526,6 +580,11 @@ exports.addPackageAndDist = function *(next) {
     });
   }
 
+  // ensure maintainers exists
+  yield* packageService.addMaintainers(name, maintainers.map(function (item) {
+    return item.name;
+  }));
+
   this.status = 201;
   this.body = {
     ok: true,
@@ -535,7 +594,9 @@ exports.addPackageAndDist = function *(next) {
 
 // PUT /:name/-rev/:rev
 exports.updateOrRemove = function* (next) {
-  debug('updateOrRemove module %s, %s, %j', this.url, this.params.name, this.request.body);
+  var name = this.params.name || this.params[0];
+  debug('updateOrRemove module %s, %s, %j', this.url, name, this.request.body);
+
   var body = this.request.body;
   if (body.versions) {
     yield* exports.removeWithVersions.call(this, next);
@@ -547,7 +608,7 @@ exports.updateOrRemove = function* (next) {
 };
 
 exports.updateMaintainers = function* (next) {
-  var name = this.params.name;
+  var name = this.params.name || this.params[0];
   var body = this.request.body;
   debug('updateMaintainers module %s, %j', name, body);
 
@@ -575,20 +636,59 @@ exports.updateMaintainers = function* (next) {
     return;
   }
 
-  var r = yield *packageService.updateMaintainers(name, usernames);
+  if (config.customUserService) {
+    // ensure new authors are vaild
+    var maintainers = yield* packageService.listMaintainerNamesOnly(name);
+    var map = {};
+    var newNames = [];
+    for (var i = 0; i < maintainers.length; i++) {
+      map[maintainers[i]] = 1;
+    }
+    for (var i = 0; i < usernames.length; i++) {
+      var username = usernames[i];
+      if (map[username] !== 1) {
+        newNames.push(username);
+      }
+    }
+    if (newNames.length > 0) {
+      var users = yield* UserService.list(newNames);
+      var map = {};
+      for (var i = 0; i < users.length; i++) {
+        var user = users[i];
+        map[user.login] = 1;
+      }
+      var invailds = [];
+      for (var i = 0; i < newNames.length; i++) {
+        var username = newNames[i];
+        if (map[username] !== 1) {
+          invailds.push(username);
+        }
+      }
+      if (invailds.length > 0) {
+        this.status = 403;
+        this.body = {
+          error: 'invalid user name',
+          reason: 'User: ' + invailds.join(', ') + ' not exists'
+        };
+        return;
+      }
+    }
+  }
+
+  var r = yield* packageService.updateMaintainers(name, usernames);
   debug('result: %j', r);
 
   this.status = 201;
   this.body = {
     ok: true,
     id: name,
-    rev: this.params.rev,
+    rev: this.params.rev || this.params[1],
   };
 };
 
 exports.removeWithVersions = function* (next) {
   var username = this.user.name;
-  var name = this.params.name;
+  var name = this.params.name || this.params[0];
   // left versions
   var versions = this.request.body.versions || {};
 
@@ -640,7 +740,7 @@ exports.removeWithVersions = function* (next) {
   debug('remove versions: %j, remain versions: %j', removeVersions, remainVersions);
 
   // step 4: remove all the versions which need to remove
-  yield Module.removeByNameAndVersions(name, removeVersions);
+  // let removeTar do remove versions from module table
   var tags = yield Module.listTags(name);
 
   var removeTags = [];
@@ -675,23 +775,27 @@ exports.removeWithVersions = function* (next) {
 };
 
 exports.removeTar = function* (next) {
-  debug('remove tarball with filename: %s, id: %s', this.params.filename, this.params.rev);
-  var id = Number(this.params.rev);
-  var filename = this.params.filename;
-  var name = this.params.name;
-  var username = this.user.name;
+  var name = this.params.name || this.params[0];
+  var filename = this.params.filename || this.params[1];
+  var id = Number(this.params.rev || this.params[2]);
+  // cnpmjs.org-2.0.0.tgz
+  var version = filename.split(name + '-')[1];
+  if (version) {
+    // 2.0.0.tgz
+    version = version.substring(0, version.lastIndexOf('.tgz'));
+  }
+  if (!version) {
+    return yield* next;
+  }
 
+  debug('remove tarball with filename: %s, version: %s, revert to => rev id: %s', filename, version, id);
+
+  var username = this.user.name;
   if (isNaN(id)) {
     return yield* next;
   }
 
-  var mod = yield Module.getById(id);
-  if (!mod || mod.name !== name) {
-    return yield* next;
-  }
-
   var isMaintainer = yield* packageService.isMaintainer(name, username);
-
   if (!isMaintainer && !this.user.isAdmin) {
     this.status = 403;
     this.body = {
@@ -700,16 +804,41 @@ exports.removeTar = function* (next) {
     };
     return;
   }
-  var key = mod.package.dist && mod.package.dist.key;
+
+  var rs = yield [
+    Module.getById(id),
+    Module.get(name, version),
+  ];
+  var revertTo = rs[0];
+  var mod = rs[1]; // module need to delete
+  if (!mod || mod.name !== name) {
+    return yield* next;
+  }
+
+  var key = mod.package && mod.package.dist && mod.package.dist.key;
   key = key || common.getCDNKey(mod.name, filename);
-  yield nfs.remove(key);
+
+  if (revertTo && revertTo.package) {
+    debug('removing key: %s from nfs, revert to %s@%s', key, revertTo.name, revertTo.package.version);
+  } else {
+    debug('removing key: %s from nfs, no revert mod', key);
+  }
+  try {
+    yield nfs.remove(key);
+  } catch (err) {
+    logger.error(err);
+  }
+  // remove version from table
+  yield Module.removeByNameAndVersions(name, [version]);
+  debug('removed %s@%s', name, version);
   this.body = { ok: true };
 };
 
 exports.removeAll = function* (next) {
-  debug('remove all the module with name: %s, id: %s', this.params.name, this.params.rev);
-  var name = this.params.name;
+  var name = this.params.name || this.params[0];
   var username = this.user.name;
+  var rev = this.params.rev || this.params[1];
+  debug('remove all the module with name: %s, id: %s', name, rev);
 
   var mods = yield Module.listByName(name);
   debug('removeAll module %s: %d', name, mods.length);
@@ -750,6 +879,9 @@ exports.removeAll = function* (next) {
     }
   }
 
+  // remove the maintainers
+  yield* packageService.removeAllMaintainers(name);
+
   this.body = { ok: true };
 };
 
@@ -786,6 +918,8 @@ exports.listAllModules = function *() {
   this.body = result;
 };
 
+var A_WEEK_MS = 3600000 * 24 * 7;
+
 exports.listAllModulesSince = function *() {
   var query = this.query || {};
   if (query.stale !== 'update_after') {
@@ -800,6 +934,11 @@ exports.listAllModulesSince = function *() {
   debug('list all modules from %s', query.startkey);
   var startkey = Number(query.startkey) || 0;
   var updated = Date.now();
+  if (updated - startkey > A_WEEK_MS) {
+    startkey = updated - A_WEEK_MS;
+    console.warn('[%s] list modules since time out of range: query: %j, ip: %s',
+      Date(), query, this.ip);
+  }
   var mods = yield Module.listSince(startkey);
   var result = { _updated: updated };
   mods.forEach(function (mod) {
@@ -818,8 +957,8 @@ exports.listAllModuleNames = function *() {
 // PUT /:name/:tag
 exports.updateTag = function* () {
   var version = this.request.body;
-  var tag = this.params.tag;
-  var name = this.params.name;
+  var name = this.params.name || this.params[0];
+  var tag = this.params.tag || this.params[1];
   debug('updateTag: %s %s to %s', name, version, tag);
 
   if (!version) {
@@ -856,7 +995,7 @@ exports.updateTag = function* () {
 
   // check permission
   var isMaintainer = yield* packageService.isMaintainer(name, this.user.name);
-  if (!isMaintainer) {
+  if (!isMaintainer && !this.user.isAdmin) {
     this.status = 403;
     this.body = {
       error: 'forbidden user',

controllers/registry/user.js

@@ -18,14 +18,31 @@
 var debug = require('debug')('cnpmjs.org:controllers:registry:user');
 var utility = require('utility');
 var crypto = require('crypto');
+var UserService = require('../../services/user');
 var User = require('../../proxy/user');
 var config = require('../../config');
+var common = require('../../lib/common');
 
-exports.show = function *(next) {
+exports.show = function* (next) {
   var name = this.params.name;
-  var user = yield User.get(name);
+  var isAdmin = common.isAdmin(name);
+  var scopes = config.scopes || [];
+  if (config.customUserService) {
+    var customUser = yield* UserService.get(name);
+    if (customUser) {
+      isAdmin = !!customUser.site_admin;
+      scopes = customUser.scopes;
+
+      var data = {
+        user: customUser
+      };
+      yield* User.saveCustomUser(data);
+    }
+  }
+
+  var user = yield* User.get(name);
   if (!user) {
-    return yield *next;
+    return yield* next;
   }
 
   var data = user.json;
@@ -40,12 +57,32 @@ exports.show = function *(next) {
       date: user.gmt_modified,
     };
   }
+
+  if (data.login) {
+    // custom user format
+    // convert to npm user format
+    data = {
+      _id: 'org.couchdb.user:' + user.name,
+      _rev: user.rev,
+      name: user.name,
+      email: user.email,
+      type: 'user',
+      roles: [],
+      date: user.gmt_modified,
+      avatar: data.avatar_url,
+      fullname: data.name || data.login,
+      homepage: data.html_url,
+    };
+  }
+
   data._cnpm_meta = {
     id: user.id,
-    npm_user: user.npm_user,
+    npm_user: user.npm_user === 1,
+    custom_user: user.npm_user === 2,
     gmt_create: user.gmt_create,
     gmt_modified: user.gmt_modified,
-    admin: !!config.admins[user.name],
+    admin: isAdmin,
+    scopes: scopes,
   };
 
   this.body = data;
@@ -85,20 +122,20 @@ function ensurePasswordSalt(user, body) {
 //   'content-length': '258',
 //   connection: 'keep-alive' }
 // { name: 'mk2',
-//   salt: '18d8d51936478446a5466d4fb1633b80f3838b4caaa03649a885ac722cd6',
-//   password_sha: '8f4408912a6db1d96b132a90856d99db029cef3d',
+//   salt: '12351936478446a5466d4fb1633b80f3838b4caaa03649a885ac722cd6',
+//   password_sha: '123408912a6db1d96b132a90856d99db029cef3d',
 //   email: 'fengmk2@gmail.com',
 //   _id: 'org.couchdb.user:mk2',
 //   type: 'user',
 //   roles: [],
 //   date: '2014-03-15T02:39:25.696Z' }
-exports.add = function *() {
+exports.add = function* () {
   var name = this.params.name;
   var body = this.request.body || {};
   var user = {
     name: body.name,
-    salt: body.salt,
-    password_sha: body.password_sha,
+    // salt: body.salt,
+    // password_sha: body.password_sha,
     email: body.email,
     ip: this.ip || '0.0.0.0',
     // roles: body.roles || [],
@@ -106,7 +143,7 @@ exports.add = function *() {
 
   ensurePasswordSalt(user, body);
 
-  if (!user.name || !user.salt || !user.password_sha || !user.email) {
+  if (!body.password || !user.name || !user.salt || !user.password_sha || !user.email) {
     this.status = 422;
     this.body = {
       error: 'paramError',
@@ -114,7 +151,47 @@ exports.add = function *() {
     };
     return;
   }
-  debug('add user: %j', user);
+
+  debug('add user: %j', body);
+
+  var loginedUser;
+  try {
+    loginedUser = yield UserService.auth(body.name, body.password);
+  } catch (err) {
+    this.status = err.status || 500;
+    this.body = {
+      error: err.name,
+      reason: err.message
+    };
+    return;
+  }
+  if (loginedUser) {
+    var rev = Date.now() + '-' + loginedUser.login;
+    if (config.customUserService) {
+      // make sure sync user meta to cnpm database
+      var data = user;
+      data.rev = rev;
+      data.user = loginedUser;
+      yield* User.saveCustomUser(data);
+    }
+    this.status = 201;
+    this.body = {
+      ok: true,
+      id: 'org.couchdb.user:' + loginedUser.login,
+      rev: rev,
+    };
+    return;
+  }
+
+  if (config.customUserService) {
+    // user login fail, not allow to add new user
+    this.status = 401;
+    this.body = {
+      error: 'unauthorized',
+      reason: 'Login fail, please check your login name and password'
+    };
+    return;
+  }
 
   var existUser = yield User.get(name);
   if (existUser) {
@@ -136,24 +213,23 @@ exports.add = function *() {
   };
 };
 
-exports.authSession = function *() {
-  // body: {"name":"foo","password":"****"}
-  var body = this.request.body || {};
-  var name = body.name;
-  var password = body.password;
-  var user = yield User.auth(name, password);
-  debug('authSession %s: %j', name, user);
-
-  if (!user) {
-    this.status = 401;
-    this.body = {ok: false, name: null, roles: []};
-    return;
-  }
-  var session = yield *this.session;
-  session.name = user.name;
-  this.body = {ok: true, name: user.name, roles: []};
-};
-
+// logined before update, no need to auth user again
+// { name: 'admin',
+// password: '123123',
+// email: 'fengmk2@gmail.com',
+// _id: 'org.couchdb.user:admin',
+// type: 'user',
+// roles: [],
+// date: '2014-08-05T16:08:22.645Z',
+// _rev: '1-1a18c3d73ba42e863523a399ff3304d8',
+// _cnpm_meta:
+//  { id: 14,
+//    npm_user: false,
+//    custom_user: false,
+//    gmt_create: '2014-08-05T15:46:58.000Z',
+//    gmt_modified: '2014-08-05T15:46:58.000Z',
+//    admin: true,
+//    scopes: [ '@cnpm', '@cnpmtest' ] } }
 exports.update = function *(next) {
   var name = this.params.name;
   var rev = this.params.rev;
@@ -175,17 +251,19 @@ exports.update = function *(next) {
   var body = this.request.body || {};
   var user = {
     name: body.name,
-    salt: body.salt,
-    password_sha: body.password_sha,
+    // salt: body.salt,
+    // password_sha: body.password_sha,
     email: body.email,
     ip: this.ip || '0.0.0.0',
     rev: body.rev || body._rev,
     // roles: body.roles || [],
   };
 
+  debug('update user %j', body);
+
   ensurePasswordSalt(user, body);
 
-  if (!user.name || !user.salt || !user.password_sha || !user.email) {
+  if (!body.password || !user.name || !user.salt || !user.password_sha || !user.email) {
     this.status = 422;
     this.body = {
       error: 'paramError',

controllers/web/package.js

@@ -32,12 +32,14 @@ var ModuleDeps = require('../../proxy/module_deps');
 var setDownloadURL = require('../../lib/common').setDownloadURL;
 var ModuleStar = require('../../proxy/module_star');
 var packageService = require('../../services/package');
+var ModuleUnpublished = require('../../proxy/module_unpublished');
 
 exports.display = function* (next) {
   var params = this.params;
   // normal: {name: $name, version: $version}
   // scope: [$name, $version]
-  var name = params.name || params[0];
+  var orginalName = params.name || params[0];
+  var name = orginalName;
   var tag = params.version || params[1];
   debug('display %s with %j', name, params);
 
@@ -51,24 +53,55 @@ exports.display = function* (next) {
     getPackageMethod = 'getByTag';
     getPackageArgs = [name, tag || 'latest'];
   }
+
+  var pkg = yield Module[getPackageMethod].apply(Module, getPackageArgs);
+  if (!pkg) {
+    var adaptName = yield* Module.getAdaptName(name);
+    if (adaptName) {
+      name = adaptName;
+      pkg = yield Module[getPackageMethod].apply(Module, [name, getPackageArgs[1]]);
+    }
+  }
+
+  if (!pkg || !pkg.package) {
+    // check if unpublished
+    var unpublishedInfo = yield* ModuleUnpublished.get(name);
+    debug('show unpublished %j', unpublishedInfo);
+    if (unpublishedInfo) {
+      var data = {
+        name: name,
+        unpublished: unpublishedInfo.package
+      };
+      data.unpublished.time = new Date(data.unpublished.time);
+      if (data.unpublished.maintainers) {
+        for (var i = 0; i < data.unpublished.maintainers.length; i++) {
+          var maintainer = data.unpublished.maintainers[i];
+          if (maintainer.email) {
+            maintainer.gravatar = gravatar.url(maintainer.email, {s: '50', d: 'retro'}, true);
+          }
+        }
+      }
+      yield this.render('package_unpublished', {
+        package: data
+      });
+      return;
+    }
+
+    return yield* next;
+  }
+
   var r = yield [
-    Module[getPackageMethod].apply(Module, getPackageArgs),
     down.total(name),
     ModuleDeps.list(name),
     ModuleStar.listUsers(name),
     packageService.listMaintainers(name)
   ];
-  var pkg = r[0];
-  var download = r[1];
-  var dependents = (r[2] || []).map(function (item) {
+  var download = r[0];
+  var dependents = (r[1] || []).map(function (item) {
     return item.deps;
   });
-  var users = r[3];
-  var maintainers = r[4];
-
-  if (!pkg || !pkg.package) {
-    return yield* next;
-  }
+  var users = r[2];
+  var maintainers = r[3];
 
   pkg.package.fromNow = moment(pkg.publish_time).fromNow();
   pkg = pkg.package;
@@ -124,6 +157,10 @@ exports.display = function* (next) {
     pkg.dist.size = bytes(pkg.dist.size || 0);
   }
 
+  if (pkg.name !== orginalName) {
+    pkg.name = orginalName;
+  }
+
   yield this.render('package', {
     title: 'Package - ' + pkg.name,
     package: pkg,
@@ -205,6 +242,14 @@ exports.displaySync = function* (next) {
   });
 };
 
+exports.listPrivates = function* () {
+  var packages = yield Module.listPrivates();
+  yield this.render('private', {
+      title: 'private packages',
+      packages: packages
+    });
+};
+
 function setLicense(pkg) {
   var license;
   license = pkg.license || pkg.licenses || pkg.licence || pkg.licences;

controllers/web/user.js

@@ -1,4 +1,4 @@
-/*!
+/**!
  * cnpmjs.org - controllers/web/package.js
  *
  * Copyright(c) cnpmjs.org and other contributors.
@@ -6,6 +6,7 @@
  *
  * Authors:
  *  dead_horse <dead_horse@qq.com> (http://deadhorse.me)
+ *  fengmk2 <fengmk2@gmail.com> (http://fengmk2.github.com)
  */
 
 'use strict';
@@ -13,26 +14,68 @@
 /**
  * Module dependencies.
  */
+
+var config = require('../../config');
 var Module = require('../../proxy/module');
 var User = require('../../proxy/user');
+var UserService = require('../../services/user');
+var common = require('../../lib/common');
 
-exports.display = function *(next) {
+exports.display = function* (next) {
   var name = this.params.name;
+  var isAdmin = common.isAdmin(name);
+  var scopes = config.scopes || [];
+  if (config.customUserService) {
+    var customUser = yield* UserService.get(name);
+    if (customUser) {
+      isAdmin = !!customUser.site_admin;
+      scopes = customUser.scopes;
+      var data = {
+        user: customUser
+      };
+      yield* User.saveCustomUser(data);
+    }
+  }
 
   var r = yield [Module.listByAuthor(name), User.get(name)];
-  var packages = r[0];
+  var packages = r[0] || [];
   var user = r[1];
   if (!user && !packages.length) {
     return yield* next;
   }
-  user = {
+
+  user = user || {};
+
+  var data = {
     name: name,
-    email: user && user.email
+    email: user.email,
+    json: user.json || {}
   };
 
+  if (data.json.login) {
+    // custom user format
+    // convert to npm user format
+    var json = data.json;
+    data.json = {
+      _id: 'org.couchdb.user:' + user.name,
+      _rev: user.rev,
+      name: user.name,
+      email: user.email,
+      type: 'user',
+      roles: [],
+      date: user.gmt_modified,
+      avatar: json.avatar_url,
+      fullname: json.name || json.login,
+      homepage: json.html_url,
+    };
+  }
+
   yield this.render('profile', {
     title: 'User - ' + name,
-    packages: packages || [],
-    user: user
+    packages: packages,
+    user: data,
+    lastModified: user && user.gmt_modified,
+    isAdmin: isAdmin,
+    scopes: scopes
   });
 };

dispatch.js

@@ -18,6 +18,7 @@
 var path = require('path');
 var util = require('util');
 var cluster = require('cluster');
+var cfork = require('cfork');
 var config = require('./config');
 var workerPath = path.join(__dirname, 'worker.js');
 var childProcess = require('child_process');
@@ -36,32 +37,21 @@ if (config.enableCluster) {
 }
 
 function forkWorker() {
-  cluster.setupMaster({
-    exec: workerPath
-  });
-
-  cluster.on('fork', function (worker) {
+  cfork({
+    exec: workerPath,
+    count: config.numCPUs,
+  }).on('fork', function (worker) {
     console.log('[%s] [worker:%d] new worker start', Date(), worker.process.pid);
-  });
-
-  cluster.on('disconnect', function (worker) {
-    var w = cluster.fork();
-    console.error('[%s] [master:%s] wroker:%s disconnect, suicide: %s, state: %s. New worker:%s fork',
-      Date(), process.pid, worker.process.pid, worker.suicide, worker.state, w.process.pid);
-  });
-
-  cluster.on('exit', function (worker, code, signal) {
+  }).on('disconnect', function (worker) {
+    console.error('[%s] [master:%s] wroker:%s disconnect, suicide: %s, state: %s.',
+      Date(), process.pid, worker.process.pid, worker.suicide, worker.state);
+  }).on('exit', function (worker, code, signal) {
     var exitCode = worker.process.exitCode;
     var err = new Error(util.format('worker %s died (code: %s, signal: %s, suicide: %s, state: %s)',
       worker.process.pid, exitCode, signal, worker.suicide, worker.state));
     err.name = 'WorkerDiedError';
     console.error('[%s] [master:%s] wroker exit: %s', Date(), process.pid, err.stack);
   });
-
-  // Fork workers.
-  for (var i = 0; i < config.numCPUs; i++) {
-    cluster.fork();
-  }
 }
 
 function forkSyncer() {

docs/registry-api.md

@@ -0,0 +1,833 @@
+# NPM Registry API
+
+## Overview
+
+* [Schema](/docs/registry-api.md#schema)
+* [Client Errors](/docs/registry-api.md#client-errors)
+* [Authentication](/docs/registry-api.md#authentication)
+* [Package](/docs/registry-api.md#package)
+* [User](/docs/registry-api.md#user)
+* [Search](/docs/registry-api.md#search)
+
+## Schema
+
+All API access is over HTTPS or HTTP,
+and accessed from the `registry.npmjs.org` domain.
+All data is sent and received as JSON.
+
+```bash
+$ curl -i https://registry.npmjs.org
+
+HTTP/1.1 200 OK
+Date: Tue, 05 Aug 2014 10:53:24 GMT
+Server: CouchDB/1.5.0 (Erlang OTP/R16B03)
+Content-Type: text/plain; charset=utf-8
+Cache-Control: max-age=60
+Content-Length: 258
+Accept-Ranges: bytes
+Via: 1.1 varnish
+Age: 11
+X-Served-By: cache-ty67-TYO
+X-Cache: HIT
+X-Cache-Hits: 1
+X-Timer: S1407236004.867906,VS0,VE0
+
+{"db_name":"registry","doc_count":90789,"doc_del_count":381,"update_seq":137250,"purge_seq":0,
+"compact_running":false,"disk_size":436228219,"data_size":332875061,
+"instance_start_time":"1405721973718703","disk_format_version":6,"committed_update_seq":137250}
+```
+
+## Client Errors
+
+```json
+Status: 4xx
+
+{
+  "error": "error_name",
+  "reason": "error reason string"
+}
+```
+
+## Authentication
+
+There is only one way to authenticate through the API.
+
+## Basic Authentication
+
+```bash
+$ curl -u "username:password" https://registry.npmjs.org
+```
+
+## Failed login limit
+
+```bash
+$ curl -i -X PUT -u foo:pwd \
+  -d '{"name":"foo","email":"foo@bar.com","type":"user","roles":[]}' \
+  https://registry.npmjs.org/-/user/org.couchdb.user:foo/-rev/11-d226c6afa9286ab5b9eb858c429bdabf
+
+HTTP/1.1 401 Unauthorized
+Date: Tue, 05 Aug 2014 15:33:25 GMT
+Server: CouchDB/1.5.0 (Erlang OTP/R14B04)
+Content-Type: text/plain; charset=utf-8
+Cache-Control: max-age=60
+Content-Length: 67
+Accept-Ranges: bytes
+Via: 1.1 varnish
+X-Served-By: cache-ty66-TYO
+X-Cache: MISS
+X-Cache-Hits: 0
+X-Timer: S1407252805.261390,VS0,VE434
+
+{"error":"unauthorized","reason":"Name or password is incorrect."}
+```
+
+## Package
+
+* Read
+  * [Get a single package](/docs/registry-api.md#get-a-single-package)
+  * [Get a special version or tag package](/docs/registry-api.md#get-a-special-version-or-tag-package)
+  * [List packages since from a update time](/docs/registry-api.md#list-packages-since-from-a-update-time)
+* Write
+  * [Publish a new package](/docs/registry-api.md#publish-a-new-package)
+  * [Update a package's tag](/docs/registry-api.md#update-a-packages-tag)
+  * [Update a package's maintainers](/docs/registry-api.md#update-a-packages-maintainers)
+  * [Remove one version from package](/docs/registry-api.md#remove-one-version-from-package)
+  * [Remove a tgz file from package](/docs/registry-api.md#remove-a-tgz-file-from-package)
+
+### Get a single package
+
+```
+GET /:package
+```
+
+#### Response
+
+```json
+HTTP/1.1 200 OK
+Etag: "8UDCP753LFXOG42NMX88JAN40"
+Content-Type: application/json
+Cache-Control: max-age=60
+Content-Length: 2243
+
+{
+  "_id": "pedding",
+  "_rev": "11-e6d1e6e96eaf72433fef6aaabe843af8",
+  "name": "pedding",
+  "description": "Just pedding for callback.",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "pedding",
+      "version": "1.0.0",
+      "description": "Just pedding for callback.",
+      "main": "index.js",
+      "scripts": {
+        "test": "make test-all"
+      },
+      "repository": {
+        "type": "git",
+        "url": "git://github.com/fengmk2/pedding.git"
+      },
+      "keywords": [
+        "pedding",
+        "callback"
+      ],
+      "devDependencies": {
+        "contributors": "*",
+        "mocha": "*",
+        "mocha-phantomjs": "*",
+        "component": "*",
+        "chai": "*"
+      },
+      "author": {
+        "name": "fengmk2",
+        "email": "fengmk2@gmail.com"
+      },
+      "license": "MIT",
+      "contributors": [
+        {
+          "name": "fengmk2",
+          "email": "fengmk2@gmail.com",
+          "url": "https://github.com/fengmk2"
+        },
+        {
+          "name": "dead-horse",
+          "email": "dead_horse@qq.com",
+          "url": "https://github.com/dead-horse"
+        }
+      ],
+      "gitHead": "b42a708414a704336e9dee570a963e2dbe43e529",
+      "bugs": {
+        "url": "https://github.com/fengmk2/pedding/issues"
+      },
+      "homepage": "https://github.com/fengmk2/pedding",
+      "_id": "pedding@1.0.0",
+      "_shasum": "7f5098d60307b4ef7240c3d693cb20a9473c6074",
+      "_from": ".",
+      "_npmVersion": "1.4.13",
+      "_npmUser": {
+        "name": "fengmk2",
+        "email": "fengmk2@gmail.com"
+      },
+      "maintainers": [
+        {
+          "name": "fengmk2",
+          "email": "fengmk2@gmail.com"
+        },
+        {
+          "name": "dead-horse",
+          "email": "dead_horse@qq.com"
+        }
+      ],
+      "dist": {
+        "shasum": "7f5098d60307b4ef7240c3d693cb20a9473c6074",
+        "tarball": "http://registry.npmjs.org/pedding/-/pedding-1.0.0.tgz"
+      },
+      "directories": {}
+    }
+  },
+  "readme": "# pedding\n readme...",
+  "maintainers": [
+    {
+      "name": "fengmk2",
+      "email": "fengmk2@gmail.com"
+    },
+    {
+      "name": "dead-horse",
+      "email": "dead_horse@qq.com"
+    },
+    {
+      "name": "dead_horse",
+      "email": "dead_horse@qq.com"
+    }
+  ],
+  "time": {
+    "modified": "2014-07-05T14:22:53.849Z",
+    "created": "2012-09-18T14:46:08.346Z",
+    "0.0.1": "2012-09-18T14:46:21.321Z",
+    "0.0.2": "2013-06-22T08:26:45.125Z",
+    "0.0.3": "2013-07-02T15:20:34.707Z",
+    "1.0.0": "2014-07-05T11:08:51.614Z"
+  },
+  "author": {
+    "name": "fengmk2",
+    "email": "fengmk2@gmail.com"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/fengmk2/pedding.git"
+  },
+  "keywords": [
+    "pedding",
+    "callback"
+  ],
+  "bugs": {
+    "url": "https://github.com/fengmk2/pedding/issues"
+  },
+  "license": "MIT",
+  "readmeFilename": "README.md",
+  "homepage": "https://github.com/fengmk2/pedding",
+  "contributors": [
+    {
+      "name": "fengmk2",
+      "email": "fengmk2@gmail.com",
+      "url": "https://github.com/fengmk2"
+    },
+    {
+      "name": "dead-horse",
+      "email": "dead_horse@qq.com",
+      "url": "https://github.com/dead-horse"
+    }
+  ],
+  "_attachments": {}
+}
+```
+
+### Get a special version or tag package
+
+```
+GET /:package/:tag_or_version
+```
+
+#### Reponse
+
+```json
+HTTP/1.1 200 OK
+Etag: "1WJ4JF535RO3BDZR2BARXSGLY"
+Content-Type: application/json
+Cache-Control: max-age=60
+Content-Length: 1183
+
+{
+  "name": "pedding",
+  "version": "1.0.0",
+  "description": "Just pedding for callback.",
+  "main": "index.js",
+  "scripts": {
+    "test": "make test-all"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/fengmk2/pedding.git"
+  },
+  "keywords": [
+    "pedding",
+    "callback"
+  ],
+  "devDependencies": {
+    "contributors": "*",
+    "mocha": "*",
+    "mocha-phantomjs": "*",
+    "component": "*",
+    "chai": "*"
+  },
+  "author": {
+    "name": "fengmk2",
+    "email": "fengmk2@gmail.com"
+  },
+  "license": "MIT",
+  "contributors": [
+    {
+      "name": "fengmk2",
+      "email": "fengmk2@gmail.com",
+      "url": "https://github.com/fengmk2"
+    },
+    {
+      "name": "dead-horse",
+      "email": "dead_horse@qq.com",
+      "url": "https://github.com/dead-horse"
+    }
+  ],
+  "gitHead": "b42a708414a704336e9dee570a963e2dbe43e529",
+  "bugs": {
+    "url": "https://github.com/fengmk2/pedding/issues"
+  },
+  "homepage": "https://github.com/fengmk2/pedding",
+  "_id": "pedding@1.0.0",
+  "_shasum": "7f5098d60307b4ef7240c3d693cb20a9473c6074",
+  "_from": ".",
+  "_npmVersion": "1.4.13",
+  "_npmUser": {
+    "name": "fengmk2",
+    "email": "fengmk2@gmail.com"
+  },
+  "maintainers": [
+    {
+      "name": "fengmk2",
+      "email": "fengmk2@gmail.com"
+    },
+    {
+      "name": "dead-horse",
+      "email": "dead_horse@qq.com"
+    }
+  ],
+  "dist": {
+    "shasum": "7f5098d60307b4ef7240c3d693cb20a9473c6074",
+    "tarball": "http://registry.npmjs.org/pedding/-/pedding-1.0.0.tgz"
+  },
+  "directories": {}
+}
+```
+
+### Publish a new package
+
+* Authentication required.
+
+```
+PUT /:package
+```
+
+#### Input
+
+```json
+{
+  "_id": "pedding",
+  "name": "pedding",
+  "description": "Just pedding for callback.",
+  "dist-tags": {
+    "latest": "1.0.0"
+  },
+  "versions": {
+    "1.0.0": {
+      "name": "pedding",
+      "version": "1.0.0",
+      "description": "Just pedding for callback.",
+      "main": "index.js",
+      "scripts": {
+        "test": "make test-all"
+      },
+      "repository": {
+        "type": "git",
+        "url": "git://github.com/fengmk2/pedding.git"
+      },
+      "keywords": [ "pedding","callback" ],
+      "devDependencies": {
+        "contributors": "*",
+        "mocha": "*",
+        "mocha-phantomjs": "*",
+        "component": "*",
+        "chai": "*"
+      },
+      "dependencies": {},
+      "author": {
+        "name": "fengmk2",
+        "email": "fengmk2@gmail.com"
+      },
+      "license": "MIT",
+      "contributors": [
+        {
+          "name": "fengmk2",
+          "email": "fengmk2@gmail.com",
+          "url": "https://github.com/fengmk2"
+        },
+        {
+          "name": "dead-horse",
+          "email": "dead_horse@qq.com",
+          "url": "https://github.com/dead-horse"
+        }
+      ],
+      "readme": "# pedding ...",
+      "readmeFilename": "README.md",
+      "gitHead": "b42a708414a704336e9dee570a963e2dbe43e529",
+      "bugs": {
+        "url": "https://github.com/fengmk2/pedding/issues"
+      },
+      "homepage": "https://github.com/fengmk2/pedding",
+      "_id": "pedding@1.0.0",
+      "_shasum": "7f5098d60307b4ef7240c3d693cb20a9473c6074",
+      "_from": ".",
+      "_npmVersion": "1.5.0-alpha-4",
+      "_npmUser": {
+        "name": "admin",
+        "email": "fengmk2@gmail.com"
+      },
+      "maintainers": [
+        {
+          "name": "admin",
+          "email": "fengmk2@gmail.com"
+        }
+      ],
+      "dist": {
+        "shasum": "7f5098d60307b4ef7240c3d693cb20a9473c6074",
+        "tarball": "https://registry.npmjs.org/pedding/-/pedding-1.0.0.tgz"
+      }
+    }
+  },
+  "readme": "# pedding ...",
+  "maintainers": [
+    {
+      "name": "admin",
+      "email": "fengmk2@gmail.com"
+    }
+  ],
+  "_attachments": {
+    "pedding-1.0.0.tgz":{
+      "content_type": "application/octet-stream",
+      "data": "H4sIAAAAAAAAA+0aa3PbNjKf8Su...",
+      "length": 2107
+    }
+  }
+}
+```
+
+#### Response
+
+```json
+Status: 201 Created
+
+{
+  "ok": true,
+  "rev": "11-e6d1e6e96eaf72433fef6aaabe843af8"
+}
+```
+
+### Update a package's tag
+
+* Authentication required.
+
+```
+PUT /:package/:tag
+```
+
+#### Input
+
+The total input body is the `version` string which's setting to the tag.
+
+```json
+"1.0.0"
+```
+
+#### Response
+
+```json
+Status: 201 Created
+
+{
+  "ok": true
+}
+```
+
+### Update a package's maintainers
+
+* Authentication required.
+
+```
+PUT /:package/-rev/:rev
+```
+
+#### Input
+
+```json
+{
+  "_id": "pedding",
+  "_rev": "11-e6d1e6e96eaf72433fef6aaabe843af8",
+  "maintainers":[
+    { "name": "fengmk2", "email": "fengmk2@gmail.com" },
+    { "name": "dead-horse", "email": "dead_horse@qq.com" }
+  ]
+}
+```
+
+#### Response
+
+```json
+Status: 201 Created
+
+{
+  "ok": true,
+  "id": "pedding",
+  "rev": "12-bb300a90c9aeb779748b83ec1b744039"
+}
+```
+
+### Remove one version from package
+
+* Authentication required.
+
+```
+PUT /:package/-rev/:rev
+```
+
+#### Input
+
+Example for removing `0.0.1` version:
+
+```json
+{
+  "_id": "pedding",
+  "_rev": "12-bb300a90c9aeb779748b83ec1b744039",
+  "name": "pedding",
+  "description": "desc",
+  "dist-tags": { "latest": "1.0.0" },
+  "maintainers":
+   [ ... ],
+  "time":
+   { ... },
+  "users": {},
+  "author": { ... },
+  "repository": { ... },
+  "versions":
+   { "1.0.0":
+      { ... },
+     "0.0.3":
+      { ... },
+     "0.0.2":
+      { ... } },
+  "readme": "...",
+  "homepage": "https://github.com/fengmk2/pedding",
+  "bugs": { ... },
+  "license": "MIT" }
+```
+
+#### Response
+
+```json
+Status: 201 Created
+
+{
+  "ok": true
+}
+```
+
+### Remove a tgz file from package
+
+* Authentication required.
+
+```
+DELETE /:tgzfilepath/-rev/:rev
+```
+
+Exmaple for removing `https://registry.npmjs.org/pedding/-/pedding-0.0.1.tgz` file:
+
+```
+DELETE /pedding/-/pedding-0.0.1.tgz/-rev/12-bb300a90c9aeb779748b83ec1b744039
+```
+
+#### Response
+
+```json
+Status: 200 OK
+
+{
+  "ok": true
+}
+```
+
+### List packages since from a update time
+
+```
+GET /-/all/since?stale=update_after&startkey=:startkey
+```
+
+* `startkey` is a ms timestamp
+
+#### Response
+
+```bash
+$ curl -i "https://registry.npmjs.org/-/all/since?stale=update_after&startkey=1407255748643"
+```
+
+```json
+HTTP/1.1 200 OK
+
+{
+  "_updated": 1407255883282,
+  "bacon-and-eggs": {
+    "name": "bacon-and-eggs",
+    "description": "A functional reactive Twitter API client in node",
+    "dist-tags": {
+      "latest": "0.0.4"
+    },
+    "maintainers": [
+      {
+        "name": "mikegroseclose",
+        "email": "mike.groseclose@gmail.com"
+      }
+    ],
+    "homepage": "http://github.com/mikegroseclose/bacon-and-eggs",
+    "keywords": [
+      "twitter",
+      "api",
+      "frp",
+      "functional",
+      "reactive",
+      "bacon",
+      "eggs",
+      "oauth",
+      "stream",
+      "streams"
+    ],
+    "repository": {
+      "type": "git",
+      "url": "git://github.com/mikegroseclose/gulp-regex-replace.git"
+    },
+    "author": {
+      "name": "Mike Groseclose",
+      "email": "mike.groseclose@gmail.com",
+      "url": "http://mikegroseclose.com"
+    },
+    "bugs": {
+      "url": "https://github.com/mikegroseclose/gulp-regex-replace/issues"
+    },
+    "readmeFilename": "README.md",
+    "time": {
+      "modified": "2014-08-05T16:21:17.041Z"
+    },
+    "versions": {
+      "0.0.4": "latest"
+    }
+  },
+  "git-perm-rm": {
+    "name": "git-perm-rm",
+    "description": "Permanently remove a file or directory from a git repo including all related commit records.",
+    "dist-tags": {
+      "latest": "1.0.1"
+    },
+    "maintainers": [
+      {
+        "name": "kael",
+        "email": "i@kael.me"
+      }
+    ],
+    "homepage": "https://github.com/kaelzhang/git-perm-rm",
+    "keywords": [
+      "git",
+      "rm",
+      "git-perm-rm",
+      "remove",
+      "permanently"
+    ],
+    "repository": {
+      "type": "git",
+      "url": "git://github.com/kaelzhang/git-perm-rm.git"
+    },
+    "author": {
+      "name": "Kael"
+    },
+    "bugs": {
+      "url": "https://github.com/kaelzhang/git-perm-rm/issues"
+    },
+    "license": "MIT",
+    "readmeFilename": "README.md",
+    "time": {
+      "modified": "2014-08-05T16:22:41.253Z"
+    },
+    "versions": {
+      "1.0.1": "latest"
+    }
+  }
+}
+```
+
+## User
+
+* [Get a single user](/docs/registry-api.md#get-a-single-user)
+* [Add a new user](/docs/registry-api.md#add-a-new-user)
+* [Update a exists user](/docs/registry-api.md#update-a-exists-user)
+
+### Get a single user
+
+```
+GET /-/user/org.couchdb.user::username
+```
+
+#### Response
+
+```json
+HTTP/1.1 200 OK
+ETag: "32-984ee97e01aea166dcab6d1517c730e3"
+
+{
+  "_id": "org.couchdb.user:fengmk2",
+  "_rev": "32-984ee97e01aea166dcab6d1517c730e3",
+  "name": "fengmk2",
+  "email": "fengmk2@gmail.com",
+  "type": "user",
+  "roles": [],
+  "date": "2014-08-04T10:43:07.063Z",
+  "fullname": "fengmk2",
+  "avatar": "https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=50&d=retro",
+  "freenode": "",
+  "github": "fengmk2",
+  "homepage": "http://fengmk2.github.com",
+  "twitter": "fengmk2",
+  "avatarMedium": "https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=100&d=retro",
+  "avatarLarge": "https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=496&d=retro",
+  "fields": [
+    {
+      "name": "fullname",
+      "value": "fengmk2",
+      "title": "Full Name",
+      "show": "fengmk2"
+    },
+    {
+      "name": "email",
+      "value": "fengmk2@gmail.com",
+      "title": "Email",
+      "show": "<a href=\"mailto:fengmk2@gmail.com\">fengmk2@gmail.com</a>"
+    },
+    {
+      "name": "github",
+      "value": "fengmk2",
+      "title": "Github",
+      "show": "<a rel=\"me\" href=\"https://github.com/fengmk2\">fengmk2</a>"
+    },
+    {
+      "name": "twitter",
+      "value": "fengmk2",
+      "title": "Twitter",
+      "show": "<a rel=\"me\" href=\"https://twitter.com/fengmk2\">@fengmk2</a>"
+    },
+    {
+      "name": "appdotnet",
+      "value": "",
+      "title": "App.net",
+      "show": ""
+    },
+    {
+      "name": "homepage",
+      "value": "http://fengmk2.github.com",
+      "title": "Homepage",
+      "show": "<a rel=\"me\" href=\"http://fengmk2.github.com/\">http://fengmk2.github.com</a>"
+    },
+    {
+      "name": "freenode",
+      "value": "",
+      "title": "IRC Handle",
+      "show": ""
+    }
+  ],
+  "appdotnet": "fengmk2"
+}
+```
+
+### Add a new user
+
+```
+PUT /-/user/org.couchdb.user::username
+```
+
+#### Input
+
+```json
+{
+  "name": "admin",
+  "password": "123",
+  "email": "fengmk2@gmail.com",
+  "_id": "org.couchdb.user:admin",
+  "type": "user",
+  "roles": [],
+  "date": "2014-08-05T16:05:17.792Z"
+}
+```
+
+#### Response
+
+```json
+Status: 201 Created
+
+{
+  "ok": true,
+  "id": "org.couchdb.user:fengmk2",
+  "rev": "32-984ee97e01aea166dcab6d1517c730e3"
+}
+```
+
+### Update a exists user
+
+* Authentication required.
+
+```
+PUT /-/user/org.couchdb.user::username/-rev/:rev
+```
+
+#### Input
+
+```json
+{
+  "name": "admin",
+  "password": "123",
+  "email": "fengmk2@gmail.com",
+  "_id": "org.couchdb.user:admin",
+  "type": "user",
+  "roles": [],
+  "date": "2014-08-05T16:05:17.792Z",
+  "_rev": "2-1a18c3d73ba42e863523a399ff3304d8"
+}
+```
+
+#### Response
+
+```json
+Status: 201 Created
+
+{
+  "ok": true,
+  "id": "org.couchdb.user:fengmk2",
+  "rev": "3-bb300a90c9aeb779748b83ec1b744039"
+}
+```
+
+## Search

docs/web/readme.md

@@ -177,8 +177,3 @@ Release [History](/history).
 ## npm and cnpm relation
 
 ![npm&cnpm](https://docs.google.com/drawings/d/12QeQfGalqjsB77mRnf5Iq5oSXHCIUTvZTwECMonqCmw/pub?w=383&h=284)
-
-## 捐赠 Donate
-如果您觉得 [cnpmjs.org](/) 对您有帮助，欢迎请作者一杯咖啡.
-
-[![Donate](https://img.alipay.com/sys/personalprod/style/mc/btn-index.png)](https://me.alipay.com/imk2)

middleware/auth.js

@@ -15,46 +15,50 @@
  */
 
 var debug = require('debug')('cnpmjs.org:middleware:auth');
-var User = require('../proxy/user');
-var config = require('../config');
-var common = require('../lib/common');
+var UserService = require('../services/user');
+
+/**
+ * Parse the request authorization
+ * get the real user
+ */
 
 module.exports = function (options) {
-  return function *auth(next) {
-    var session = yield *this.session;
-    debug('%s, %s, %j', this.url, this.sessionId, session);
+  return function* auth(next) {
     this.user = {};
 
-    if (session.name) {
-      this.user.name = session.name;
-      this.user.isAdmin = common.isAdmin(session.name);
-      debug('auth exists user: %j, headers: %j', this.user, this.header);
-      return yield *next;
-    }
-
     var authorization = (this.get('authorization') || '').split(' ')[1] || '';
     authorization = authorization.trim();
+    debug('%s %s with %j', this.method, this.url, authorization);
     if (!authorization) {
-      return yield *next;
+      return yield* next;
     }
 
     authorization = new Buffer(authorization, 'base64').toString().split(':');
     if (authorization.length !== 2) {
-      return yield *next;
+      return yield* next;
     }
 
     var username = authorization[0];
     var password = authorization[1];
 
-    var row = yield User.auth(username, password);
-    if (!row) {
-      debug('auth fail user: %j, headers: %j', row, this.header);
-      return yield *next;
+    var row;
+    try {
+      row = yield* UserService.auth(username, password);
+    } catch (err) {
+      // do not response error here
+      // many request do not need login
+      this.user.error = err;
     }
 
-    this.user.name = row.name;
-    this.user.isAdmin = common.isAdmin(row.name);
+    if (!row) {
+      debug('auth fail user: %j, headers: %j', row, this.header);
+      return yield* next;
+    }
+
+    this.user.name = row.login;
+    this.user.isAdmin = row.site_admin;
+    this.user.scopes = row.scopes;
     debug('auth pass user: %j, headers: %j', this.user, this.header);
-    yield *next;
+    yield* next;
   };
 };

middleware/login.js

@@ -15,7 +15,17 @@
  */
 
 module.exports = function *login(next) {
+  if (this.user.error) {
+    this.status = this.user.error.status || 500;
+    this.body = {
+      error: this.user.error.name,
+      reason: this.user.error.message
+    };
+    return;
+  }
+
   if (!this.user.name) {
+
     this.status = 401;
     this.body = {
       error: 'unauthorized',

middleware/publishable.js

@@ -14,11 +14,14 @@
  * Module dependencies.
  */
 
+var util = require('util');
 var config = require('../config');
+var debug = require('debug')('cnpmjs.org:middlewares/publishable');
 
 module.exports = function *publishable(next) {
+  // private mode, only admin user can publish
   if (config.enablePrivate && !this.user.isAdmin) {
-    // private mode, only admin user can publish
+
     this.status = 403;
     this.body = {
       error: 'no_perms',
@@ -26,5 +29,75 @@ module.exports = function *publishable(next) {
     };
     return;
   }
-  yield *next;
+
+  // public mode, all user have permission to publish
+  // but if `config.scopes` exist, only can publish with scopes in `config.scope`
+  // if `config.forcePublishWithScope` set to true, only admins can publish without scope
+
+  var name = this.params.name || this.params[0];
+
+  // check if is private package list in config
+  if (config.privatePackages && config.privatePackages.indexOf(name) !== -1) {
+    return yield* next;
+  }
+
+  // scope
+  if (name[0] === '@') {
+    if (checkScope(name, this)) {
+      return yield* next;
+    }
+    return;
+  }
+
+  // none-scope
+  if (checkNoneScope(this)) {
+    return yield* next;
+  }
 };
+
+/**
+ * check module's scope legal
+ */
+
+function checkScope(name, ctx) {
+  if (!ctx.user.scopes || !ctx.user.scopes.length) {
+    ctx.status = 404;
+    return false;
+  }
+
+  var scope = name.split('/')[0];
+  if (ctx.user.scopes.indexOf(scope) === -1) {
+    debug('assert scope  %s error', name);
+    ctx.status = 400;
+    ctx.body = {
+      error: 'invalid scope',
+      reason: util.format('scope %s not match legal scopes %j', scope, ctx.user.scopes)
+    };
+    return false;
+  }
+
+  return true;
+}
+
+/**
+ * check if user have permission to publish without scope
+ */
+
+function checkNoneScope(ctx) {
+  if (!config.scopes
+    || !config.scopes.length
+    || !config.forcePublishWithScope) {
+    return true;
+  }
+
+  // only admins can publish or unpublish non-scope modules
+  if (ctx.user.isAdmin) {
+    return true;
+  }
+
+  ctx.status = 403;
+  ctx.body = {
+    error: 'no_perms',
+    reason: 'only allow publish with ' + ctx.user.scopes.join(',') + ' scope(s)'
+  };
+}

middleware/web_not_found.js

@@ -26,7 +26,11 @@ module.exports = function *notFound(next) {
     return;
   }
 
-  var m = /^\/([\w\-\_\.]+)\/?$/.exec(this.url);
+  var m = /^\/([\w\-\.]+)\/?$/.exec(this.path);
+  if (!m) {
+    // scoped packages
+    m = /^\/(@[\w\-\.]+\/[\w\-\.]+)$/.exec(this.path);
+  }
   debug('%s match %j', this.url, m);
   if (m) {
     return this.redirect('/package/' + m[1]);

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cnpmjs.org",
-  "version": "0.8.0",
+  "version": "1.1.0",
   "description": "Private npm registry and web for Enterprise, base on MySQL and Simple Store Service",
   "main": "index.js",
   "scripts": {
@@ -10,57 +10,58 @@
     "stop": "./bin/nodejsctl stop"
   },
   "dependencies": {
-    "bytes": "1.0.0",
-    "cheerio": "0.17.0",
-    "co": "3.0.6",
-    "co-defer": "0.1.0",
-    "co-gather": "0.0.1",
-    "co-read": "0.1.0",
-    "co-redis": "1.1.0",
-    "co-urllib": "0.2.3",
-    "co-write": "0.3.0",
-    "copy-to": "1.0.1",
-    "debug": "1.0.4",
-    "error-formater": "1.0.3",
-    "eventproxy": "0.3.1",
-    "giturl": "0.0.3",
-    "graceful": "0.1.0",
-    "gravatar": "1.0.6",
-    "humanize-number": "0.0.2",
-    "koa": "0.8.1",
-    "koa-limit": "1.0.2",
-    "koa-markdown": "0.0.3",
-    "koa-middlewares": "1.2.0",
-    "marked": "0.3.2",
-    "mime": "1.2.11",
-    "mini-logger": "0.3.0",
-    "mkdirp": "0.5.0",
-    "moment": "2.7.0",
-    "ms": "0.6.2",
-    "multiline": "0.3.4",
-    "mysql": "2.4.1",
+    "bytes": "~1.0.0",
+    "cfork": "~1.0.1",
+    "cheerio": "~0.17.0",
+    "co": "~3.1.0",
+    "co-defer": "~0.1.0",
+    "co-gather": "~0.0.1",
+    "co-read": "~0.1.0",
+    "co-redis": "~1.1.0",
+    "co-urllib": "~0.2.3",
+    "co-write": "~0.3.0",
+    "copy-to": "~1.0.1",
+    "debug": "~1.0.4",
+    "error-formater": "~1.0.3",
+    "eventproxy": "~0.3.1",
+    "giturl": "~0.0.3",
+    "graceful": "~0.1.0",
+    "gravatar": "~1.0.6",
+    "humanize-number": "~0.0.2",
+    "koa": "~0.8.2",
+    "koa-limit": "~1.0.2",
+    "koa-markdown": "~0.0.3",
+    "koa-middlewares": "~1.2.0",
+    "marked": "~0.3.2",
+    "mime": "~1.2.11",
+    "mini-logger": "~0.3.0",
+    "mkdirp": "~0.5.0",
+    "moment": "~2.8.1",
+    "ms": "~0.6.2",
+    "multiline": "~0.3.4",
+    "mysql": "~2.4.2",
     "nodemailer": "0.7.1",
-    "qn": "0.2.2",
-    "ready": "0.1.1",
-    "redis": "0.11.0",
-    "semver": "2.3.1",
-    "thunkify-wrap": "1.0.1",
-    "utility": "0.1.16"
+    "qn": "~0.2.2",
+    "ready": "~0.1.1",
+    "redis": "~0.11.0",
+    "semver": "~3.0.1",
+    "thunkify-wrap": "~1.0.2",
+    "utility": "~1.0.0"
   },
   "devDependencies": {
     "autod": "~0.2.0",
-    "chunkstream": "0.0.1",
+    "chunkstream": "~0.0.1",
     "co-mocha": "0.0.2",
     "contributors": "*",
     "cov": "*",
     "istanbul-harmony": "*",
     "jshint": "*",
-    "mm": "0.2.1",
+    "mm": "~0.2.1",
     "mocha": "*",
-    "pedding": "1.0.0",
-    "should": "4.0.4",
+    "pedding": "~1.0.0",
+    "should": "~4.0.4",
     "should-http": "0.0.1",
-    "supertest": "0.13.0"
+    "supertest": "~0.13.0"
   },
   "homepage": "https://github.com/cnpm/cnpmjs.org",
   "repository": {

proxy/dist.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.

proxy/download.js

@@ -9,6 +9,8 @@
  */
 
 'use strict';
+/* jshint -W032 */
+
 
 /**
  * Module dependencies.

proxy/module.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.
@@ -494,63 +495,6 @@ exports.removeByNameAndVersions = function (name, versions, callback) {
   mysql.query(DELETE_MODULE_BY_NAME_AND_VERSIONS_SQL, [name, versions], callback);
 };
 
-var LIST_BY_AUTH_SQLS = [];
-LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
-  SELECT
-    distinct(name) AS name
-  FROM
-    module
-  WHERE
-    author=?
-  ORDER BY
-    publish_time DESC
-  LIMIT
-    100;
-*/}));
-LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
-  SELECT
-    module_id
-  FROM
-    tag
-  WHERE
-    tag="latest" AND name IN (?);
-*/}));
-LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
-  SELECT
-    name, description
-  FROM
-    module
-  WHERE
-    id IN (?)
-  ORDER BY
-    publish_time DESC;
-*/}));
-exports.listByAuthor = function (author, callback) {
-  var ep = eventproxy.create();
-  ep.fail(callback);
-  mysql.query(LIST_BY_AUTH_SQLS[0], [author], ep.done(function (rows) {
-    if (!rows || rows.length === 0) {
-      return callback(null, []);
-    }
-    ep.emit('names', rows.map(function (r) {
-      return r.name;
-    }));
-  }));
-  ep.on('names', function (names) {
-    mysql.query(LIST_BY_AUTH_SQLS[1], [names], ep.done(function (rows) {
-      if (!rows || rows.length === 0) {
-        return callback(null, []);
-      }
-      ep.emit('ids', rows.map(function (r) {
-        return r.module_id;
-      }));
-    }));
-  });
-  ep.on('ids', function (ids) {
-    mysql.query(LIST_BY_AUTH_SQLS[2], [ids], callback);
-  });
-};
-
 var SEARCH_MODULES_SQL = multiline(function () {;/*
   SELECT
     module_id
@@ -676,3 +620,129 @@ var DELETE_TAGS_BY_NAMES_SQL = 'DELETE FROM tag WHERE name=? AND tag IN (?);';
 exports.removeTagsByNames = function* (moduleName, tagNames) {
   return yield mysql.query(DELETE_TAGS_BY_NAMES_SQL, [moduleName, tagNames]);
 };
+
+/**
+ * forward compatbility for update from lower version cnpmjs.org
+ * redirect @scope/name => name
+ */
+exports.getAdaptName = function* (name) {
+  if (!config.scopes
+    || !config.scopes.length
+    || !config.adaptScope) {
+    return;
+  }
+
+  var tmp = name.split('/');
+  var scope = tmp[0];
+  name = tmp[1];
+
+  if (config.scopes.indexOf(scope) === -1) {
+    return;
+  }
+
+  var pkg = yield exports.getByTag(name, 'latest');
+  // only private module can adapt
+  if (pkg && pkg.package._publish_on_cnpm) {
+    return name;
+  }
+  return;
+};
+
+exports.listPrivates = function* () {
+  var scopes = config.scopes;
+  if (!scopes || !scopes.length) {
+    return [];
+  }
+  var privatePackages = config.privatePackages || [];
+
+  var args = [];
+  var sql = 'SELECT module_id AS id FROM tag WHERE tag="latest" AND (';
+  var wheres = [];
+
+  scopes.forEach(function (scope) {
+    wheres.push('name LIKE ?');
+    args.push(scope + '%');
+  });
+
+  if (privatePackages.length) {
+    wheres.push('name in (?)');
+    args.push(privatePackages);
+  }
+
+  sql = sql + wheres.join(' OR ') + ')';
+
+  var ids = yield mysql.query(sql, args);
+  ids = ids.map(function (row) {
+    return row.id;
+  });
+
+  if (!ids.length) {
+    return [];
+  }
+
+  return yield mysql.query(QUERY_MODULES_BY_ID_SQL, [ids]);
+};
+
+var LIST_BY_AUTH_SQLS = [];
+LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
+  SELECT
+    distinct(name) AS name
+  FROM
+    module
+  WHERE
+    author=?
+  ORDER BY
+    publish_time DESC
+  LIMIT
+    100;
+*/}));
+LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
+  SELECT
+    name
+  FROM
+    module_maintainer
+  WHERE
+    user = ?
+*/}));
+LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
+  SELECT
+    module_id
+  FROM
+    tag
+  WHERE
+    tag="latest" AND name IN (?);
+*/}));
+LIST_BY_AUTH_SQLS.push(multiline(function () {;/*
+  SELECT
+    name, description
+  FROM
+    module
+  WHERE
+    id IN (?)
+  ORDER BY
+    publish_time DESC;
+*/}));
+exports.listByAuthor = function* (author, callback) {
+  var names = yield [
+    mysql.query(LIST_BY_AUTH_SQLS[0], [author]),
+    mysql.query(LIST_BY_AUTH_SQLS[1], [author])
+  ];
+
+  names = names[0].concat(names[1]).map(function (n) {
+    return n.name;
+  }).sort();
+
+  if (!names.length) {
+    return [];
+  }
+
+  var ids = yield mysql.query(LIST_BY_AUTH_SQLS[2], [names]);
+  if (!ids.length) {
+    return [];
+  }
+
+  ids = ids.map(function (i) {
+    return i.module_id;
+  });
+  return yield mysql.query(LIST_BY_AUTH_SQLS[3], [ids]);
+};

proxy/module_deps.js

@@ -9,6 +9,7 @@
  */
 
 "use strict";
+/* jshint -W032 */
 
 /**
  * Module dependencies.

proxy/module_log.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.
@@ -26,7 +27,7 @@ exports.create = function (data, callback) {
     name: data.name,
     username: data.username,
     log: ''
-  }
+  };
   mysql.query(INSERT_LOG_SQL, [args], function (err, result) {
     if (err) {
       return callback(err);

proxy/module_maintainer.js

@@ -44,6 +44,20 @@ function* remove(name, usernames) {
   return yield mysql.query(REMOVE_SQL, [name, usernames]);
 }
 
+var REMOVE_ALL_SQL = 'DELETE FROM module_maintainer WHERE name = ?';
+
+exports.removeAll = function* (name) {
+  return yield mysql.query(REMOVE_ALL_SQL, [name]);
+};
+
+exports.addMulti = function* (name, usernames) {
+  var tasks = [];
+  for (var i = 0; i < usernames.length; i++) {
+    tasks.push(add(name, usernames[i]));
+  }
+  return yield tasks;
+};
+
 exports.update = function* (name, maintainers) {
   // maintainers should be [name1, name2, ...] format
   // find out the exists maintainers then remove the deletes and add the left
@@ -64,11 +78,8 @@ exports.update = function* (name, maintainers) {
       }
     }
   }
-  var tasks = [];
-  for (var i = 0; i < addUsers.length; i++) {
-    tasks.push(add(name, addUsers[i]));
-  }
-  yield tasks;
+
+  yield* exports.addMulti(name, addUsers);
   // make sure all add users success then remove users
   if (removeUsers.length > 0) {
     yield* remove(name, removeUsers);

proxy/module_star.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.

proxy/module_unpublished.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.

proxy/sync_module_worker.js

@@ -76,12 +76,14 @@ SyncModuleWorker.prototype.finish = function () {
   if (this._finished || Object.keys(this.syncingNames).length > 0) {
     return;
   }
+  this._finished = true;
   this.log('[done] Sync %s module finished, %d success, %d fail\nSuccess: [ %s ]\nFail: [ %s ]',
     this.startName,
     this.successes.length, this.fails.length,
     this.successes.join(', '), this.fails.join(', '));
   this.emit('end');
-  this._finished = true;
+  // make sure all event listeners release
+  this.removeAllListeners();
 };
 
 SyncModuleWorker.prototype.log = function (format, arg1, arg2) {
@@ -351,13 +353,13 @@ SyncModuleWorker.prototype._sync = function* (name, pkg) {
       maintainers = [maintainers];
     }
 
-    maintainers.forEach(function (m) {
-      if (m.name) {
-        npmUsernames[m.name.toLowerCase()] = 1;
-      }
-    });
+    maintainers.forEach(pushName);
+  }
+  function pushName(m) {
+    if (m.name) {
+      npmUsernames[m.name.toLowerCase()] = 1;
+    }
   }
-
   // get the missing star users
   var starUsers = pkg.users || {};
   for (var k in starUsers) {

proxy/total.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.

proxy/user.js

@@ -9,6 +9,7 @@
  */
 
 'use strict';
+/* jshint -W032 */
 
 /**
  * Module dependencies.
@@ -20,52 +21,10 @@ var config = require('../config');
 var mysql = require('../common/mysql');
 var multiline = require('multiline');
 
-var SELECT_USER_SQL = multiline(function () {;/*
-  SELECT
-    id, rev, name, email, salt, password_sha, ip,
-    roles, json, npm_user, gmt_create, gmt_modified
-  FROM
-    user
-  WHERE
-    name=?;
-*/});
-exports.get = function (name, callback) {
-  mysql.queryOne(SELECT_USER_SQL, [name], function (err, row) {
-    if (row) {
-      try {
-        row.roles = row.roles ? JSON.parse(row.roles) : [];
-      } catch (e) {
-        row.roles = [];
-      }
-      try {
-        row.json = row.json ? JSON.parse(row.json) : null;
-      } catch (e) {
-        row.json = null;
-      }
-    }
-    callback(err, row);
-  });
-};
-
 function passwordSha(password, salt) {
   return utility.sha1(password + salt);
 }
 
-exports.auth = function (name, password, callback) {
-  exports.get(name, function (err, row) {
-    if (err || !row) {
-      return callback(err, row);
-    }
-
-    var sha = passwordSha(password, row.salt);
-    if (row.password_sha !== sha) {
-      row = null;
-    }
-    callback(null, row);
-  });
-};
-
-
 var INSERT_USER_SQL = 'INSERT INTO user SET ?';
 exports.add = function (user, callback) {
   var roles = user.roles || [];
@@ -143,7 +102,42 @@ thunkify(exports);
 
 exports.passwordSha = passwordSha;
 
-exports.saveNpmUser = function *(user) {
+var SELECT_USER_SQL = 'SELECT \
+    id, rev, name, email, salt, password_sha, ip, \
+    roles, json, npm_user, gmt_create, gmt_modified \
+  FROM \
+    user \
+  WHERE \
+    name=?;';
+exports.get = function* (name) {
+  var row = yield mysql.queryOne(SELECT_USER_SQL, [name]);
+  if (row) {
+    try {
+      row.roles = row.roles ? JSON.parse(row.roles) : [];
+    } catch (e) {
+      row.roles = [];
+    }
+    try {
+      row.json = row.json ? JSON.parse(row.json) : null;
+    } catch (e) {
+      row.json = null;
+    }
+  }
+  return row;
+};
+
+exports.auth = function* (name, password) {
+  var row = yield* exports.get(name);
+  if (row) {
+    var sha = passwordSha(password, row.salt);
+    if (row.password_sha !== sha) {
+      row = null;
+    }
+  }
+  return row;
+};
+
+exports.saveNpmUser = function* (user) {
   var sql = 'SELECT id, json FROM user WHERE name=?;';
   var row = yield mysql.queryOne(sql, [user.name]);
   if (!row) {
@@ -156,17 +150,47 @@ exports.saveNpmUser = function *(user) {
   }
 };
 
-var LIST_BY_NAMES_SQL = multiline(function () {;/*
-  SELECT
-    id, name, email, json
-  FROM
-    user
-  WHERE
-    name in (?);
-*/});
-exports.listByNames = function *(names) {
+exports.saveCustomUser = function* (data) {
+  var sql = 'SELECT id, json FROM user WHERE name=?;';
+  var row = yield mysql.queryOne(sql, [data.user.login]);
+  var salt = data.salt || '0';
+  var password_sha = data.password_sha || '0';
+  var ip = data.ip || '0';
+  var rev = rev || '1-' + data.user.login;
+  var json = JSON.stringify(data.user);
+  if (!row) {
+    sql = 'INSERT INTO user(npm_user, json, rev, name, email, salt, password_sha, ip, gmt_create, gmt_modified) \
+      VALUES(2, ?, ?, ?, ?, ?, ?, ?, now(), now());';
+    yield mysql.query(sql, [
+      json, rev, data.user.login, data.user.email,
+      salt, password_sha, ip
+    ]);
+  } else {
+    sql = 'UPDATE user SET json=?, rev=?, salt=?, password_sha=?, ip=? WHERE id=?;';
+    yield mysql.query(sql, [
+      json, rev,
+      salt, password_sha, ip,
+      row.id
+    ]);
+  }
+};
+
+var LIST_BY_NAMES_SQL = 'SELECT \
+    id, name, email, json \
+  FROM \
+    user \
+  WHERE \
+    name in (?);';
+exports.listByNames = function* (names) {
   if (names.length === 0) {
     return [];
   }
   return yield mysql.query(LIST_BY_NAMES_SQL, [names]);
 };
+
+var SEARCH_SQL = 'SELECT id, name, email, json FROM user WHERE name LIKE ? LIMIT ?;';
+exports.search = function* (query, options) {
+  var limit = options.limit;
+  query = query + '%';
+  return yield mysql.query(SEARCH_SQL, [query, limit]);
+};

routes/registry.js

@@ -44,28 +44,35 @@ function routes(app) {
 
   // module
   // scope package: params: [$name]
-  app.get(/\/(@[\w\-\.]+\/[\w\-\.]+)$/, syncByInstall, mod.show);
+  app.get(/^\/(@[\w\-\.]+\/[\w\-\.]+)$/, syncByInstall, mod.show);
   // scope package: params: [$name, $version]
-  app.get(/\/(@[\w\-\.]+\/[\w\-\.]+)\/([\w\.\-]+)$/, syncByInstall, mod.get);
+  app.get(/^\/(@[\w\-\.]+\/[\w\-\.]+)\/([\w\.\-]+)$/, syncByInstall, mod.get);
 
   app.get('/:name', syncByInstall, mod.show);
   app.get('/:name/:version', syncByInstall, mod.get);
   // try to add module
+  app.put(/^\/(@[\w\-\.]+\/[\w\-\.]+)$/, login, publishable, mod.addPackageAndDist);
   app.put('/:name', login, publishable, mod.addPackageAndDist);
 
   // sync from source npm
   app.put('/:name/sync', sync.sync);
   app.get('/:name/sync/log/:id', sync.getSyncLog);
 
+  app.put(/^\/(@[\w\-\.]+\/[\w\-\.]+)\/([\w\-\.]+)$/, login, mod.updateTag);
   app.put('/:name/:tag', login, mod.updateTag);
 
   // need limit by ip
+  app.get(/^\/(@[\w\-\.]+\/[\w\-\.]+)\/download\/(@[\w\-\.]+\/[\w\-\.]+)$/, limit, mod.download);
   app.get('/:name/download/:filename', limit, mod.download);
 
   // delete tarball
+  app.delete(/^\/(@[\w\-\.]+\/[\w\-\.]+)\/download\/(@[\w\-\.]+\/[\w\-\.]+)\/\-rev\/([\w\-\.]+)$/,
+    login, publishable, mod.removeTar);
   app.delete('/:name/download/:filename/-rev/:rev', login, publishable, mod.removeTar);
 
   // update module, unpublish will PUT this
+  app.put(/^\/(@[\w\-\.]+\/[\w\-\.]+)\/\-rev\/([\w\-\.]+)$/, login, publishable, mod.updateOrRemove);
+  app.delete(/^\/(@[\w\-\.]+\/[\w\-\.]+)\/\-rev\/([\w\-\.]+)$/, login, publishable, mod.removeAll);
   app.put('/:name/-rev/:rev', login, publishable, mod.updateOrRemove);
   app.delete('/:name/-rev/:rev', login, publishable, mod.removeAll);
 
@@ -74,8 +81,6 @@ function routes(app) {
   app.put('/-/user/org.couchdb.user::name', user.add);
   app.get('/-/user/org.couchdb.user::name', user.show);
   app.put('/-/user/org.couchdb.user::name/-rev/:rev', login, user.update);
-  // _session
-  app.post('/_session', user.authSession);
 }
 
 module.exports = routes;

routes/web.js

@@ -31,15 +31,15 @@ function routes(app) {
   app.get('/package/:name', pkg.display);
   app.get('/package/:name/:version', pkg.display);
 
+  app.get('/privates', pkg.listPrivates);
+
   app.get(/\/browse\/keyword\/(@[\w\-\.]+\/[\w\-\.]+)$/, pkg.search);
   app.get('/browse/keyword/:word', pkg.search);
 
   app.get('/~:name', user.display);
 
-  app.get(/\/sync\/(@[\w\-\.]+\/[\w\-\.]+)$/, pkg.displaySync);
   app.get('/sync/:name', pkg.displaySync);
 
-  app.put(/\/sync\/(@[\w\-\.]+\/[\w\-\.]+)$/, sync.sync);
   app.put('/sync/:name', sync.sync);
 
   // params: [$name, $id]

servers/registry.js

@@ -22,7 +22,6 @@ var middlewares = require('koa-middlewares');
 var routes = require('../routes/registry');
 var logger = require('../common/logger');
 var config = require('../config');
-var session = require('../common/session');
 var auth = require('../middleware/auth');
 var staticCache = require('../middleware/static');
 var notFound = require('../middleware/registry_not_found');
@@ -34,7 +33,6 @@ app.use(staticCache);
 
 app.keys = ['todokey', config.sessionSecret];
 app.proxy = true;
-app.use(session);
 app.use(middlewares.bodyParser({jsonLimit: config.jsonLimit}));
 app.use(auth());
 app.use(notFound);
@@ -57,6 +55,7 @@ routes(app);
  */
 
 app.on('error', function (err, ctx) {
+  // console.log(err.stack)
   err.url = err.url || ctx.request.url;
   logger.error(err);
 });

servers/web.js

@@ -21,7 +21,6 @@ var fs = require('fs');
 var koa = require('koa');
 var middlewares = require('koa-middlewares');
 var markdown = require('koa-markdown');
-var session = require('../common/session');
 var opensearch = require('../middleware/opensearch');
 var notFound = require('../middleware/web_not_found');
 var staticCache = require('../middleware/static');
@@ -41,7 +40,6 @@ app.use(staticCache);
 app.use(opensearch);
 app.keys = ['todokey', config.sessionSecret];
 app.proxy = true;
-app.use(session);
 app.use(middlewares.bodyParser());
 app.use(auth());
 app.use(notFound);
@@ -107,6 +105,7 @@ routes(app);
 
 app.on('error', function (err, ctx) {
   err.url = err.url || ctx.request.url;
+  console.log(err.stack);
   logger.error(err);
 });
 

services/default_user_service.js

@@ -0,0 +1,139 @@
+/**!
+ * cnpmjs.org - services/default_user_service.js
+ *
+ * Copyright(c) fengmk2 and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *   fengmk2 <fengmk2@gmail.com> (http://fengmk2.github.com)
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var gravatar = require('gravatar');
+var User = require('../proxy/user');
+var isAdmin = require('../lib/common').isAdmin;
+var config = require('../config');
+
+// User: https://github.com/cnpm/cnpmjs.org/wiki/Use-Your-Own-User-Authorization#user-data-structure
+// {
+//   "login": "fengmk2",
+//   "email": "fengmk2@gmail.com",
+//   "name": "Yuan Feng",
+//   "html_url": "http://fengmk2.github.com",
+//   "avatar_url": "https://avatars3.githubusercontent.com/u/156269?s=460",
+//   "im_url": "",
+//   "site_admin": false,
+//   "scopes": ["@org1", "@org2"]
+// }
+
+module.exports = DefaultUserService;
+
+function convertToUser(row) {
+  var user = {
+    login: row.name,
+    email: row.email,
+    name: row.name,
+    html_url: 'http://cnpmjs.org/~' + row.name,
+    avatar_url: '',
+    im_url: '',
+    site_admin: isAdmin(row.name),
+    scopes: config.scopes
+  };
+  if (row.json) {
+    var data = row.json;
+    if (data.login) {
+      // custom user
+      user = data;
+    } else {
+      // npm user
+      if (data.avatar) {
+        user.avatar_url = data.avatar;
+      }
+      if (data.fullname) {
+        user.name = data.fullname;
+      }
+      if (data.homepage) {
+        user.html_url = data.homepage;
+      }
+      if (data.twitter) {
+        user.im_url = 'https://twitter.com/' + data.twitter;
+      }
+    }
+  }
+  if (!user.avatar_url) {
+    user.avatar_url = gravatar.url(user.email, {s: '50', d: 'retro'}, true);
+  }
+  return user;
+}
+
+function DefaultUserService() {}
+
+var proto = DefaultUserService.prototype;
+
+/**
+ * Auth user with login name and password
+ * @param  {String} login    login name
+ * @param  {String} password login password
+ * @return {User}
+ */
+proto.auth = function* (login, password) {
+  var row = yield* User.auth(login, password);
+  if (!row) {
+    return null;
+  }
+  return convertToUser(row);
+};
+
+/**
+ * Get user by login name
+ * @param  {String} login  login name
+ * @return {User}
+ */
+proto.get = function* (login) {
+  var row = yield* User.get(login);
+  if (!row) {
+    return null;
+  }
+  return convertToUser(row);
+};
+
+/**
+ * List users
+ * @param  {Array<String>} logins  login names
+ * @return {Array<User>}
+ */
+proto.list = function* (logins) {
+  var rows = yield* User.listByNames(logins);
+  var users = [];
+  rows.forEach(function (row) {
+    users.push(convertToUser(row));
+  });
+  return users;
+};
+
+/**
+ * Search users
+ * @param  {String} query  query keyword
+ * @param  {Object} [options] optional query params
+ *  - {Number} limit match users count, default is `20`
+ * @return {Array<User>}
+ */
+proto.search = function* (query, options) {
+  options = options || {};
+  options.limit = parseInt(options.limit);
+  if (!options.limit || options.limit < 0) {
+    options.limit = 20;
+  }
+
+  var rows = yield* User.search(query, options);
+  var users = [];
+  rows.forEach(function (row) {
+    users.push(convertToUser(row));
+  });
+  return users;
+};

services/package.js

@@ -32,6 +32,14 @@ exports.listMaintainers = function* (name) {
   });
 };
 
+exports.listMaintainerNamesOnly = function* (name) {
+  return yield* ModuleMaintainer.get(name);
+};
+
+exports.addMaintainers = function* (name, usernames) {
+  return yield* ModuleMaintainer.addMulti(name, usernames);
+};
+
 exports.updateMaintainers = function* (name, usernames) {
   var rs = yield [
     ModuleMaintainer.update(name, usernames),
@@ -40,11 +48,26 @@ exports.updateMaintainers = function* (name, usernames) {
   return rs[0];
 };
 
+exports.removeAllMaintainers = function* (name) {
+  return yield* ModuleMaintainer.removeAll(name);
+};
+
 exports.isMaintainer = function* (name, username) {
-  var maintainers = yield* ModuleMaintainer.get(name);
+  var rs = yield [
+    ModuleMaintainer.get(name),
+    Module.getLatest(name)
+  ];
+  var maintainers = rs[0];
+  var latestMod = rs[1];
+
+  if (latestMod && !latestMod.package._publish_on_cnpm) {
+    // no one can update public package maintainers
+    // public package only sync from source npm registry
+    return false;
+  }
+
   if (maintainers.length === 0) {
     // if not found maintainers, try to get from latest module package info
-    var latestMod = yield Module.getLatest(name);
     var ms = latestMod && latestMod.package && latestMod.package.maintainers;
     if (ms && ms.length > 0) {
       maintainers = ms.map(function (user) {

services/user.js

@@ -0,0 +1,56 @@
+/**!
+ * cnpmjs.org - services/user.js
+ *
+ * Copyright(c) fengmk2 and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *   fengmk2 <fengmk2@gmail.com> (http://fengmk2.github.com)
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var config = require('../config');
+if (!config.userService) {
+  var DefaultUserService = require('./default_user_service');
+  config.userService = new DefaultUserService();
+  config.customUserService = false;
+} else {
+  config.customUserService = true;
+}
+config.scopes = config.scopes || [];
+
+function convertUser(user) {
+  if (!user) {
+    return null;
+  }
+  user.scopes = user.scopes || [];
+  if (user.scopes.length === 0 && config.scopes.length > 0) {
+    user.scopes = config.scopes.slice();
+  }
+  return user;
+}
+
+exports.auth = function* (login, password) {
+  var user = yield* config.userService.auth(login, password);
+  return convertUser(user);
+};
+
+exports.get = function* (login) {
+  var user = yield* config.userService.get(login);
+  return convertUser(user);
+};
+
+exports.list = function* (logins) {
+  var users = yield* config.userService.list(logins);
+  return users.map(convertUser);
+};
+
+exports.search = function* (query, options) {
+  var users = yield* config.userService.search(query, options);
+  return users.map(convertUser);
+};

test/controllers/registry/module.test.js

@@ -30,12 +30,13 @@ var controller = require('../../../controllers/registry/module');
 var ModuleDeps = require('../../../proxy/module_deps');
 var SyncModuleWorker = require('../../../proxy/sync_module_worker');
 var utils = require('../../utils');
+var mysql = require('../../../common/mysql');
 
 var fixtures = path.join(path.dirname(path.dirname(__dirname)), 'fixtures');
 
 describe('controllers/registry/module.test.js', function () {
   before(function (done) {
-    app.listen(0, function () {
+    app = app.listen(0, function () {
       done = pedding(2, done);
       // name: mk2testmodule
       var pkg = utils.getPackage('mk2testmodule', '0.0.1', utils.admin);
@@ -420,6 +421,7 @@ describe('controllers/registry/module.test.js', function () {
 
     it('should 403 when not maintainer update in public mode', function (done) {
       mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
       request(app)
       .put('/mk2testmodule/-rev/1')
       .send({
@@ -491,6 +493,7 @@ describe('controllers/registry/module.test.js', function () {
     it('should try to add return 400 when not module user and only next module exists',
     function (done) {
       mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
       request(app)
       .put('/' + pkg.name)
       .set('authorization', baseauthOther)
@@ -530,7 +533,8 @@ describe('controllers/registry/module.test.js', function () {
 
   describe('PUT /:name publish new flow addPackageAndDist()', function () {
     it('should publish with tgz base64, addPackageAndDist()', function (done) {
-      var pkg = utils.getPackage('testpublishmodule', '0.0.2');
+      done = pedding(2, done);
+      var pkg = utils.getPackage('testpublishmodule-new-add', '0.0.2');
       request(app)
       .put('/' + pkg.name)
       .set('authorization', utils.adminAuth)
@@ -553,6 +557,15 @@ describe('controllers/registry/module.test.js', function () {
           });
           done();
         });
+
+        // maintainers should exists
+        mysql.query('SELECT user FROM module_maintainer WHERE name=?', ['testpublishmodule-new-add'],
+        function (err, rows) {
+          should.not.exist(err);
+          rows.length.should.above(0);
+          rows.should.eql([ { user: 'cnpmjstest10' } ]);
+          done();
+        });
       });
     });
 
@@ -920,7 +933,7 @@ describe('controllers/registry/module.test.js', function () {
         .expect(201, done);
       });
 
-      it('shold fail when user not maintainer', function (done) {
+      it('should fail when user not maintainer', function (done) {
         request(app)
         .del('/remove-all-module/-rev/1')
         .set('authorization', utils.otherUserAuth)
@@ -934,14 +947,19 @@ describe('controllers/registry/module.test.js', function () {
         });
       });
 
-      it('shold ok', function (done) {
+      it('should remove all versions ok', function (done) {
         request(app)
         .del('/remove-all-module/-rev/1')
         .set('authorization', utils.adminAuth)
         .expect(200, function (err, res) {
           should.not.exist(err);
           should.not.exist(res.headers['set-cookie']);
-          done();
+          mysql.query('SELECT * FROM module_maintainer WHERE name=?', ['remove-all-module'],
+          function (err, rows) {
+            should.not.exist(err);
+            rows.should.length(0);
+            done();
+          });
         });
       });
     });

test/controllers/registry/module/config_private_packages.test.js

@@ -0,0 +1,105 @@
+/*!
+ * cnpmjs.org - test/controllers/registry/module/public_mode.test.js
+ * Copyright(c) 2014 dead_horse <dead_horse@qq.com>
+ * MIT Licensed
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var should = require('should');
+var request = require('supertest');
+var mm = require('mm');
+var config = require('../../../../config');
+var app = require('../../../../servers/registry');
+var utils = require('../../../utils');
+
+describe('controllers/registry/module/config_private_packages.test.js', function () {
+  beforeEach(function () {
+    mm(config, 'enablePrivate', false);
+    mm(config, 'forcePublishWithScope', true);
+    mm(config, 'privatePackages', ['private-package']);
+  });
+
+  after(mm.restore);
+  it('should publish with tgz base64, addPackageAndDist()', function (done) {
+    var pkg = utils.getPackage('private-package', '0.0.1', utils.otherUser);
+    request(app)
+    .put('/' + pkg.name)
+    .set('authorization', utils.otherUserAuth)
+    .send(pkg)
+    .expect(201, function (err, res) {
+      should.not.exist(err);
+      res.body.should.have.keys('ok', 'rev');
+      res.body.ok.should.equal(true);
+      pkg = utils.getPackage('private-package', '0.0.1', utils.otherUser);
+      // upload again should 403
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .expect(403, function (err, res) {
+        should.not.exist(err);
+        res.body.should.eql({
+          error: 'forbidden',
+          reason: 'cannot modify pre-existing version: 0.0.1'
+        });
+        done();
+      });
+    });
+  });
+
+  it('should other user publish 403', function (done) {
+    var pkg = utils.getPackage('private-package', '0.0.2', utils.secondUser);
+    request(app)
+    .put('/' + pkg.name)
+    .set('authorization', utils.secondUserAuth)
+    .send(pkg)
+    .expect(/forbidden user/)
+    .expect(403, done);
+  });
+
+  it('should admin publish 403', function (done) {
+    var pkg = utils.getPackage('private-package', '0.0.2', utils.admin);
+    request(app)
+    .put('/' + pkg.name)
+    .set('authorization', utils.adminAuth)
+    .send(pkg)
+    .expect(/forbidden user/)
+    .expect(403, done);
+  });
+
+  it('should add again new maintainers', function (done) {
+    request(app)
+    .put('/private-package/-rev/1')
+    .send({
+      maintainers: [{
+        name: 'cnpmjstest101',
+        email: 'cnpmjstest101@cnpmjs.org'
+      }, {
+        name: 'fengmk2',
+        email: 'fengmk2@cnpmjs.org'
+      }]
+    })
+    .set('authorization', utils.otherUserAuth)
+    .expect(201)
+    .expect('content-type', 'application/json; charset=utf-8', done);
+  });
+
+  it('should remove maintainers', function (done) {
+    request(app)
+    .put('/private-package/-rev/1')
+    .send({
+      maintainers: [{
+        name: 'cnpmjstest101',
+        email: 'cnpmjstest101@cnpmjs.org'
+      }]
+    })
+    .set('authorization', utils.otherUserAuth)
+    .expect(201)
+    .expect('content-type', 'application/json; charset=utf-8', done);
+  });
+});

test/controllers/registry/module/maintainer.test.js

@@ -0,0 +1,100 @@
+/**!
+ * cnpmjs.org - test/controllers/registry/module/maintainer.test.js
+ *
+ * Copyright(c) fengmk2 and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *   fengmk2 <fengmk2@gmail.com> (http://fengmk2.github.com)
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var should = require('should');
+var request = require('supertest');
+var mm = require('mm');
+var config = require('../../../../config');
+var app = require('../../../../servers/registry');
+var utils = require('../../../utils');
+
+describe('controllers/registry/module/maintainer.test.js', function () {
+  var pkgname = '@cnpm/test-package-maintainer';
+  var pkgURL = '/@' + encodeURIComponent(pkgname.substring(1));
+  before(function (done) {
+    app = app.listen(0, function () {
+      // add scope package
+      var pkg = utils.getPackage(pkgname, '0.0.1', utils.admin);
+
+      request(app)
+      .put(pkgURL)
+      .set('authorization', utils.adminAuth)
+      .send(pkg)
+      .expect(201, done);
+    });
+  });
+
+  beforeEach(function () {
+    mm(config, 'scopes', ['@cnpm', '@cnpmtest']);
+  });
+
+  afterEach(mm.restore);
+
+  it('should add new maintainer without custom user service', function (done) {
+    mm(config, 'customUserService', false);
+    request(app)
+    .put('/@cnpm/test-package-maintainer/-rev/1')
+    .set('authorization', utils.adminAuth)
+    .send({
+      maintainers: [
+        { name: 'new-maintainer', email: 'new-maintainer@cnpmjs.org' },
+        { name: utils.admin, email: utils.admin + '@cnpmjs.org' },
+      ]
+    })
+    .expect(201, done);
+  });
+
+  describe('config.customUserService = true', function () {
+    it('should add new maintainer fail when user not exists', function (done) {
+      mm(config, 'customUserService', true);
+      request(app)
+      .put('/@cnpm/test-package-maintainer/-rev/1')
+      .set('authorization', utils.adminAuth)
+      .send({
+        maintainers: [
+          { name: 'new-maintainer-not-exists', email: 'new-maintainer@cnpmjs.org' },
+          { name: 'new-maintainer-not-exists2', email: 'new-maintainer@cnpmjs.org' },
+          { name: utils.admin, email: utils.admin + '@cnpmjs.org' },
+        ]
+      })
+      .expect({
+        error: 'invalid user name',
+        reason: 'User: new-maintainer-not-exists, new-maintainer-not-exists2 not exists'
+      })
+      .expect(403, done);
+    });
+
+    it('should add new maintainer success when user all exists', function (done) {
+      mm(config, 'customUserService', true);
+      request(app)
+      .put('/@cnpm/test-package-maintainer/-rev/1')
+      .set('authorization', utils.adminAuth)
+      .send({
+        maintainers: [
+          { name: 'cnpmjstest101', email: 'cnpmjstest101@cnpmjs.org' },
+          { name: 'cnpmjstest102', email: 'cnpmjstest102@cnpmjs.org' },
+          { name: utils.admin, email: utils.admin + '@cnpmjs.org' },
+        ]
+      })
+      .expect({
+        ok: true,
+        id: '@cnpm/test-package-maintainer',
+        rev: '1'
+      })
+      .expect(201, done);
+    });
+  });
+});

test/controllers/registry/module/public_mode.test.js

@@ -0,0 +1,804 @@
+/*!
+ * cnpmjs.org - test/controllers/registry/module/public_mode.test.js
+ * Copyright(c) 2014 dead_horse <dead_horse@qq.com>
+ * MIT Licensed
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var should = require('should');
+var request = require('supertest');
+var path = require('path');
+var mm = require('mm');
+var pedding = require('pedding');
+var config = require('../../../../config');
+var app = require('../../../../servers/registry');
+var utils = require('../../../utils');
+var Module = require('../../../../proxy/module');
+
+var fixtures = path.join(__dirname, '..', '..', '..', 'fixtures');
+
+describe('controllers/registry/module/public_module.test.js', function () {
+  beforeEach(function () {
+    mm(config, 'enablePrivate', false);
+  });
+  before(function (done) {
+    mm(config, 'enablePrivate', false);
+    mm(config, 'forcePublishWithScope', false);
+    app = app.listen(0, function () {
+      done = pedding(2, done);
+      // name: publictestmodule
+      var pkg = utils.getPackage('publictestmodule', '0.0.1', utils.otherUser);
+
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .expect(201, function (err) {
+        should.not.exist(err);
+        pkg = utils.getPackage('publictestmodule', '0.0.2', utils.otherUser);
+        // publish 0.0.2
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(201, done);
+      });
+
+      // publicputmodule@0.1.9
+      var testpkg = utils.getPackage('publicputmodule', '0.1.9', utils.otherUser);
+
+      request(app)
+      .put('/' + testpkg.name)
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .expect(201, done);
+    });
+  });
+  afterEach(mm.restore);
+
+  describe('PUT /:name/-rev/id updateMaintainers() in public mode', function () {
+    beforeEach(function () {
+      mm(config, 'forcePublishWithScope', false);
+    });
+
+    before(function (done) {
+      mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest101',
+          email: 'fengmk2@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.otherUserAuth)
+      .expect({"ok":true,"id":"publictestmodule","rev":"1"}, done);
+    });
+
+    it('should add new maintainers', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest10',
+          email: 'fengmk2@cnpmjs.org'
+        }, {
+          name: 'cnpmjstest101',
+          email: 'fengmk2@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.otherUserAuth)
+      .expect(201)
+      .expect({
+        ok: true, id: 'publictestmodule', rev: '1'
+      }, function (err) {
+        should.not.exist(err);
+        done = pedding(2, done);
+        // check maintainers update
+        request(app)
+        .get('/publictestmodule')
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          var pkg = res.body;
+          pkg.maintainers.should.length(2);
+          pkg.maintainers.should.eql(pkg.versions['0.0.1'].maintainers);
+          pkg.maintainers.sort(function (a, b) {
+            return a.name > b.name ? 1 : -1;
+          });
+          pkg.maintainers.should.eql([
+            { name: 'cnpmjstest10', email: 'fengmk2@gmail.com' },
+            { name: 'cnpmjstest101', email: 'fengmk2@gmail.com' },
+          ]);
+          done();
+        });
+
+        // /pkg/0.0.1
+        request(app)
+        .get('/publictestmodule/0.0.1')
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          var pkg = res.body;
+          pkg.maintainers.should.length(2);
+          pkg.maintainers.sort(function (a, b) {
+            return a.name > b.name ? 1 : -1;
+          });
+          pkg.maintainers.should.eql([
+            { name: 'cnpmjstest10', email: 'fengmk2@gmail.com' },
+            { name: 'cnpmjstest101', email: 'fengmk2@gmail.com' },
+          ]);
+          done();
+        });
+      });
+    });
+
+    it('should add again new maintainers', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest101',
+          email: 'cnpmjstest101@cnpmjs.org'
+        }, {
+          name: 'fengmk2',
+          email: 'fengmk2@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.otherUserAuth)
+      .expect(201)
+      .expect('content-type', 'application/json; charset=utf-8', done);
+    });
+
+    it('should add new maintainers by admin', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest101',
+          email: 'cnpmjstest101@cnpmjs.org'
+        }, {
+          name: 'fengmk2',
+          email: 'fengmk2@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.adminAuth)
+      .expect(201)
+      .expect('content-type', 'application/json; charset=utf-8', done);
+    });
+
+    it('should rm maintainers', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest101',
+          email: 'cnpmjstest101@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.otherUserAuth)
+      .expect(201)
+      .expect('content-type', 'application/json; charset=utf-8', done);
+    });
+
+    it('should rm again maintainers', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest101',
+          email: 'cnpmjstest101@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.otherUserAuth)
+      .expect(201)
+      .expect({
+        id: 'publictestmodule',
+        rev: '1',
+        ok: true
+      }, done);
+    });
+
+    it('should rm all maintainers forbidden 403', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: []
+      })
+      .set('authorization', utils.otherUserAuth)
+      .expect(403)
+      .expect({error: 'invalid operation', reason: 'Can not remove all maintainers'})
+      .expect('content-type', 'application/json; charset=utf-8', done);
+    });
+
+    it('should 403 when not maintainer update', function (done) {
+      request(app)
+      .put('/publictestmodule/-rev/1')
+      .send({
+        maintainers: [{
+          name: 'cnpmjstest10',
+          email: 'cnpmjstest10@cnpmjs.org'
+        }]
+      })
+      .set('authorization', utils.secondUserAuth)
+      .expect(403)
+      .expect({
+        error: 'forbidden user',
+        reason: 'cnpmjstest102 not authorized to modify publictestmodule'
+      }, done);
+    });
+
+    describe('forcePublishWithScope = true', function () {
+      beforeEach(function () {
+        mm(config, 'forcePublishWithScope', true);
+      });
+
+      before(function (done) {
+        mm(config, 'forcePublishWithScope', true);
+        mm(config, 'enablePrivate', false);
+        var pkg = utils.getPackage('@cnpm/publictestmodule', '0.0.1', utils.otherUser);
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(201, function (err, res) {
+          should.not.exist(err);
+          pkg = utils.getPackage(pkg.name, '0.0.2', utils.otherUser);
+          // publish 0.0.2
+          request(app)
+          .put('/' + pkg.name)
+          .set('authorization', utils.otherUserAuth)
+          .send(pkg)
+          .expect(201, done);
+        });
+      });
+
+      it('should 403 add maintainers without scope', function (done) {
+        request(app)
+        .put('/publictestmodule/-rev/1')
+        .send({
+          maintainers: [{
+            name: 'cnpmjstest101',
+            email: 'cnpmjstest101@cnpmjs.org'
+          }, {
+            name: 'fengmk2',
+            email: 'fengmk2@cnpmjs.org'
+          }]
+        })
+        .set('authorization', utils.otherUserAuth)
+        .expect(403, done);
+      });
+
+      it('should add maintainers ok with scope', function (done) {
+        request(app)
+        .put('/@cnpm/publictestmodule/-rev/1')
+        .send({
+          maintainers: [{
+            name: 'cnpmjstest101',
+            email: 'cnpmjstest101@cnpmjs.org'
+          }, {
+            name: 'fengmk2',
+            email: 'fengmk2@cnpmjs.org'
+          }]
+        })
+        .set('authorization', utils.otherUserAuth)
+        .expect( { ok: true, id: '@cnpm/publictestmodule', rev: '1' })
+        .expect(201, done);
+      });
+    });
+  });
+
+  describe('PUT /:name publish new flow addPackageAndDist()', function () {
+    beforeEach(function () {
+      mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
+    });
+
+    it('should publish with tgz base64, addPackageAndDist()', function (done) {
+      var pkg = utils.getPackage('publicpublishmodule', '0.0.2', utils.otherUser);
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .expect(201, function (err, res) {
+        should.not.exist(err);
+        res.body.should.have.keys('ok', 'rev');
+        res.body.ok.should.equal(true);
+        pkg = utils.getPackage('publicpublishmodule', '0.0.2', utils.otherUser);
+        // upload again should 403
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(403, function (err, res) {
+          should.not.exist(err);
+          res.body.should.eql({
+            error: 'forbidden',
+            reason: 'cannot modify pre-existing version: 0.0.2'
+          });
+          done();
+        });
+      });
+    });
+
+    it('should other user pulbish 403', function (done) {
+      var pkg = utils.getPackage('publicpublishmodule', '0.0.3', utils.secondUser);
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.secondUserAuth)
+      .send(pkg)
+      .expect(403, done);
+    });
+
+    it('should admin pulbish 403', function (done) {
+      var pkg = utils.getPackage('publicpublishmodule', '0.0.3', utils.admin);
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.adminAuth)
+      .send(pkg)
+      .expect(403, done);
+    });
+
+    it('should publish with scope, addPackageAndDist()', function (done) {
+      mm(config, 'forcePublishWithScope', false);
+      var pkg = utils.getPackage('@cnpm/publicpublishmodule', '0.0.2', utils.otherUser);
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .expect(201, function (err, res) {
+        should.not.exist(err);
+        res.body.should.have.keys('ok', 'rev');
+        res.body.ok.should.equal(true);
+
+        // upload again should 403
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(403, function (err, res) {
+          should.not.exist(err);
+          res.body.should.eql({
+            error: 'forbidden',
+            reason: 'cannot modify pre-existing version: 0.0.2'
+          });
+          done();
+        });
+      });
+    });
+
+    describe('forcePublishWithScope = true', function () {
+      it('should publish without scope 403, addPackageAndDist()', function (done) {
+        mm(config, 'forcePublishWithScope', false);
+        var pkg = utils.getPackage('publicpublishmodule', '0.0.2');
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(403, done);
+      });
+
+      it('should admin publish without scope ok, addPackageAndDist()', function (done) {
+        mm(config, 'forcePublishWithScope', false);
+        var pkg = utils.getPackage('publicpublishmodule1', '0.0.4', utils.admin);
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.adminAuth)
+        .send(pkg)
+        .expect(201, done);
+      });
+    });
+  });
+
+  describe('PUT /:name/-rev/:rev removeWithVersions', function () {
+    var withoutScopeRev;
+    before(function (done) {
+      mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
+      var pkg = utils.getPackage('publicremovemodule', '0.0.1', utils.otherUser);
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .expect(201, function (err, res) {
+        should.not.exist(err);
+        res.body.should.have.keys('ok', 'rev');
+        res.body.ok.should.equal(true);
+
+        pkg = utils.getPackage('publicremovemodule', '0.0.2', utils.otherUser);
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(201, function (err, res) {
+          should.not.exist(err);
+          withoutScopeRev = res.body.rev;
+          done();
+        });
+      });
+    });
+
+    it('should remove with version ok', function (done) {
+      mm.empty(Module, 'removeByNameAndVersions');
+      mm.empty(Module, 'removeTagsByIds');
+      request(app)
+      .put('/publicremovemodule/-rev/' + withoutScopeRev)
+      .set('authorization', utils.otherUserAuth)
+      .send({
+        versions: {
+          '0.0.1': {}
+        }
+      })
+      .expect(201, done);
+    });
+
+    it('should no auth user remove 403', function (done) {
+      mm.empty(Module, 'removeByNameAndVersions');
+      mm.empty(Module, 'removeTagsByIds');
+      request(app)
+      .put('/publicremovemodule/-rev/' + withoutScopeRev)
+      .set('authorization', utils.secondUserAuth)
+      .send({
+        versions: {
+          '0.0.1': {}
+        }
+      })
+      .expect(403, done);
+    });
+
+    it('should admin remove ok', function (done) {
+      mm.empty(Module, 'removeByNameAndVersions');
+      mm.empty(Module, 'removeTagsByIds');
+      request(app)
+      .put('/publicremovemodule/-rev/' + withoutScopeRev)
+      .set('authorization', utils.adminAuth)
+      .send({
+        versions: {
+          '0.0.1': {}
+        }
+      })
+      .expect(201, done);
+    });
+
+    describe('forcePublishWithScope = true', function () {
+      var withScopeRev;
+      before(function (done) {
+        mm(config, 'enablePrivate', false);
+        mm(config, 'forcePublishWithScope', true);
+        var pkg = utils.getPackage('@cnpm/publicremovemodule', '0.0.1', utils.otherUser);
+        request(app)
+        .put('/' + pkg.name)
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(201, function (err, res) {
+          should.not.exist(err);
+          res.body.should.have.keys('ok', 'rev');
+          res.body.ok.should.equal(true);
+
+          pkg = utils.getPackage('@cnpm/publicremovemodule', '0.0.2', utils.otherUser);
+          request(app)
+          .put('/' + pkg.name)
+          .set('authorization', utils.otherUserAuth)
+          .send(pkg)
+          .expect(201, function (err, res) {
+            should.not.exist(err);
+            withScopeRev = res.body.rev;
+            done();
+          });
+        });
+      });
+
+      it('should remove without scope 403', function (done) {
+        mm(config, 'forcePublishWithScope', true);
+        mm.empty(Module, 'removeByNameAndVersions');
+        mm.empty(Module, 'removeTagsByIds');
+        request(app)
+        .put('/publicremovemodule/-rev/' + withoutScopeRev)
+        .set('authorization', utils.otherUserAuth)
+        .send({
+          versions: {
+            '0.0.1': {}
+          }
+        })
+        .expect(403, done);
+      });
+
+      it('should admin remove without scope ok', function (done) {
+        mm(config, 'forcePublishWithScope', true);
+        mm.empty(Module, 'removeByNameAndVersions');
+        mm.empty(Module, 'removeTagsByIds');
+        request(app)
+        .put('/publicremovemodule/-rev/' + withoutScopeRev)
+        .set('authorization', utils.adminAuth)
+        .send({
+          versions: {
+            '0.0.1': {}
+          }
+        })
+        .expect(201, done);
+      });
+
+      it('should remove with scope ok', function (done) {
+        mm(config, 'forcePublishWithScope', true);
+        mm.empty(Module, 'removeByNameAndVersions');
+        mm.empty(Module, 'removeTagsByIds');
+        request(app)
+        .put('/@cnpm/publicremovemodule/-rev/' + withScopeRev)
+        .set('authorization', utils.otherUserAuth)
+        .send({
+          versions: {
+            '0.0.1': {}
+          }
+        })
+        .expect(201, done);
+      });
+
+      it('should admin remove with scope ok', function (done) {
+        mm(config, 'forcePublishWithScope', true);
+        mm.empty(Module, 'removeByNameAndVersions');
+        mm.empty(Module, 'removeTagsByIds');
+        request(app)
+        .put('/@cnpm/publicremovemodule/-rev/' + withScopeRev)
+        .set('authorization', utils.adminAuth)
+        .send({
+          versions: {
+            '0.0.1': {}
+          }
+        })
+        .expect(201, done);
+      });
+    });
+  });
+
+  describe('DELETE /:name/download/:filename/-rev/:rev', function () {
+    var withoutScopeRev;
+    beforeEach(function () {
+      mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
+    });
+    beforeEach(function (done) {
+      mm(config, 'enablePrivate', false);
+      mm(config, 'forcePublishWithScope', false);
+      var pkg = utils.getPackage('public-test-delete-download-module', '0.1.9', utils.otherUser);
+      request(app)
+      .put('/' + pkg.name)
+      .set('content-type', 'application/json')
+      .set('authorization', utils.otherUserAuth)
+      .send(pkg)
+      .end(function (err, res) {
+        should.not.exist(err);
+        if (res.body.rev) {
+          withoutScopeRev = res.body.rev;
+        }
+        done();
+      });
+    });
+
+    it('should delete 403 when auth error', function (done) {
+      request(app)
+      .del('/public-test-delete-download-module/download/public-test-delete-download-module-0.1.9.tgz/-rev/' + withoutScopeRev)
+      .set('authorization', utils.secondUserAuth)
+      .expect(403, done);
+    });
+
+    it('should delete file ok', function (done) {
+      request(app)
+      .del('/public-test-delete-download-module/download/public-test-delete-download-module-0.1.9.tgz/-rev/' + withoutScopeRev)
+      .set('authorization', utils.otherUserAuth)
+      .expect(200, done);
+    });
+
+    it('should admin delete file ok', function (done) {
+      request(app)
+      .del('/public-test-delete-download-module/download/public-test-delete-download-module-0.1.9.tgz/-rev/' + withoutScopeRev)
+      .set('authorization', utils.adminAuth)
+      .expect(200, done);
+    });
+
+    describe('forcePublishWithScope = true', function () {
+      var withScopeRev;
+      beforeEach(function () {
+        mm(config, 'enablePrivate', false);
+        mm(config, 'forcePublishWithScope', true);
+      });
+      beforeEach(function (done) {
+        mm(config, 'enablePrivate', false);
+        mm(config, 'forcePublishWithScope', true);
+        var pkg = utils.getPackage('@cnpm/public-test-delete-download-module', '0.1.9', utils.otherUser);
+        request(app)
+        .put('/' + pkg.name)
+        .set('content-type', 'application/json')
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .end(function (err, res) {
+          should.not.exist(err);
+          if (res.body.rev) {
+            withScopeRev = res.body.rev;
+          }
+          done();
+        });
+      });
+
+      it('should delete file without scope 403', function (done) {
+        request(app)
+        .del('/public-test-delete-download-module/download/public-test-delete-download-module-0.1.9.tgz/-rev/' + withoutScopeRev)
+        .set('authorization', utils.otherUserAuth)
+        .expect(403, done);
+      });
+
+      it('should admin delete file without scope ok', function (done) {
+        request(app)
+        .del('/public-test-delete-download-module/download/public-test-delete-download-module-0.1.9.tgz/-rev/' + withoutScopeRev)
+        .set('authorization', utils.adminAuth)
+        .expect(200, done);
+      });
+      it('should delete file with scope ok', function (done) {
+        request(app)
+        .del('/@cnpm/public-test-delete-download-module/download/@cnpm/public-test-delete-download-module-0.1.9.tgz/-rev/' + withScopeRev)
+        .set('authorization', utils.otherUserAuth)
+        .expect(200, done);
+      });
+
+      it('should admin delete file with scope ok', function (done) {
+        request(app)
+        .del('/@cnpm/public-test-delete-download-module/download/@cnpm/public-test-delete-download-module-0.1.9.tgz/-rev/' + withScopeRev)
+        .set('authorization', utils.adminAuth)
+        .expect(200, done);
+      });
+    });
+  });
+
+  describe('PUT /:name/:tag updateTag()', function () {
+    it('should create new tag ok', function (done) {
+      request(app)
+      .put('/publictestmodule/newtag')
+      .set('content-type', 'application/json')
+      .set('authorization', utils.otherUserAuth)
+      .send('"0.0.1"')
+      .expect(201)
+      .expect({"ok":true}, done);
+    });
+
+    it('shold update tag not maintainer 403', function (done) {
+      request(app)
+      .put('/publictestmodule/newtag')
+      .set('content-type', 'application/json')
+      .set('authorization', utils.secondUserAuth)
+      .send('"0.0.1"')
+      .expect(403, done);
+    });
+
+    it('should admin update tag ok', function (done) {
+      request(app)
+      .put('/publictestmodule/newtag')
+      .set('content-type', 'application/json')
+      .set('authorization', utils.adminAuth)
+      .send('"0.0.1"')
+      .expect(201, done);
+    });
+  });
+
+  describe('DELETE /:name/-rev/:rev', function () {
+    describe('remove all modules by name', function () {
+      beforeEach(function () {
+        mm(config, 'enablePrivate', false);
+        mm(config, 'forcePublishWithScope', false);
+      });
+      before(function (done) {
+        mm(config, 'enablePrivate', false);
+        mm(config, 'forcePublishWithScope', false);
+        var pkg = utils.getPackage('public-remove-all-module', '0.0.1', utils.otherUser);
+        request(app)
+        .put('/public-remove-all-module')
+        .set('content-type', 'application/json')
+        .set('authorization', utils.otherUserAuth)
+        .send(pkg)
+        .expect(201, done);
+      });
+
+      it('shold fail when user not maintainer', function (done) {
+        request(app)
+        .del('/public-remove-all-module/-rev/1')
+        .set('authorization', utils.secondUserAuth)
+        .expect(403, function (err, res) {
+          should.not.exist(err);
+          res.body.should.eql({
+            error: 'forbidden user',
+            reason: 'cnpmjstest102 not authorized to modify public-remove-all-module'
+          });
+          done();
+        });
+      });
+
+      it('shold maintainer remove ok', function (done) {
+        mm.empty(Module, 'removeByName');
+        mm.empty(Module, 'removeTags');
+        request(app)
+        .del('/public-remove-all-module/-rev/1')
+        .set('authorization', utils.otherUserAuth)
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          should.not.exist(res.headers['set-cookie']);
+          done();
+        });
+      });
+
+      it('shold admin remove ok', function (done) {
+        mm.empty(Module, 'removeByName');
+        mm.empty(Module, 'removeTags');
+        request(app)
+        .del('/public-remove-all-module/-rev/1')
+        .set('authorization', utils.adminAuth)
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          should.not.exist(res.headers['set-cookie']);
+          done();
+        });
+      });
+
+      describe('forcePublishWithScope = true', function () {
+        before(function (done) {
+          mm(config, 'enablePrivate', false);
+          mm(config, 'forcePublishWithScope', true);
+          var pkg = utils.getPackage('@cnpm/public-remove-all-module', '0.0.1', utils.otherUser);
+          request(app)
+          .put('/@cnpm/public-remove-all-module')
+          .set('content-type', 'application/json')
+          .set('authorization', utils.otherUserAuth)
+          .send(pkg)
+          .expect(201, done);
+        });
+
+        it('should fail when user remove module without scope', function (done) {
+          mm(config, 'forcePublishWithScope', true);
+          request(app)
+          .del('/public-remove-all-module/-rev/1')
+          .set('authorization', utils.otherUserAuth)
+          .expect(403, done);
+        });
+
+        it('shold admin remove module without scope ok', function (done) {
+          mm(config, 'forcePublishWithScope', true);
+          mm.empty(Module, 'removeByName');
+          mm.empty(Module, 'removeTags');
+          request(app)
+          .del('/public-remove-all-module/-rev/1')
+          .set('authorization', utils.adminAuth)
+          .expect(200, done);
+        });
+
+        it('shold maintainer remove ok', function (done) {
+          mm(config, 'forcePublishWithScope', true);
+          mm.empty(Module, 'removeByName');
+          mm.empty(Module, 'removeTags');
+          request(app)
+          .del('/@cnpm/public-remove-all-module/-rev/1')
+          .set('authorization', utils.otherUserAuth)
+          .expect(200, function (err, res) {
+            should.not.exist(err);
+            should.not.exist(res.headers['set-cookie']);
+            done();
+          });
+        });
+
+        it('shold admin remove ok', function (done) {
+          mm(config, 'forcePublishWithScope', true);
+          mm.empty(Module, 'removeByName');
+          mm.empty(Module, 'removeTags');
+          request(app)
+          .del('/@cnpm/public-remove-all-module/-rev/1')
+          .set('authorization', utils.adminAuth)
+          .expect(200, function (err, res) {
+            should.not.exist(err);
+            should.not.exist(res.headers['set-cookie']);
+            done();
+          });
+        });
+      });
+    });
+  });
+});

test/controllers/registry/module/scope_package.test.js

@@ -16,34 +16,58 @@
 
 var should = require('should');
 var request = require('supertest');
+var mm = require('mm');
+var config = require('../../../../config');
 var app = require('../../../../servers/registry');
 var utils = require('../../../utils');
+var Module = require('../../../../proxy/module');
 
 describe('controllers/registry/module/scope_package.test.js', function () {
   var pkgname = '@cnpm/test-scope-package';
   var pkgURL = '/@' + encodeURIComponent(pkgname.substring(1));
   before(function (done) {
-    // add scope package
-    var pkg = utils.getPackage(pkgname, '0.0.1', utils.admin);
+    app = app.listen(0, function () {
+      // add scope package
+      var pkg = utils.getPackage(pkgname, '0.0.1', utils.admin);
 
-    request(app.listen())
-    .put(pkgURL)
-    .set('authorization', utils.adminAuth)
-    .send(pkg)
-    .expect(201, function (err) {
-      should.not.exist(err);
-      pkg = utils.getPackage(pkgname, '0.0.2', utils.admin);
-      // publish 0.0.2
-      request(app.listen())
+      request(app)
       .put(pkgURL)
       .set('authorization', utils.adminAuth)
       .send(pkg)
-      .expect(201, done);
+      .expect(201, function (err) {
+        should.not.exist(err);
+        pkg = utils.getPackage(pkgname, '0.0.2', utils.admin);
+        // publish 0.0.2
+        request(app.listen())
+        .put(pkgURL)
+        .set('authorization', utils.adminAuth)
+        .send(pkg)
+        .expect(201, done);
+      });
     });
   });
 
+  beforeEach(function () {
+    mm(config, 'scopes', ['@cnpm', '@cnpmtest']);
+  });
+
+  afterEach(mm.restore);
+
+  it('should get 404 when do not support scope', function (done) {
+    mm(config, 'scopes', []);
+    request(app)
+    .get('/@invalid/test')
+    .expect(404, done);
+  });
+
+  it('should get 400 when scope not match', function (done) {
+    request(app)
+    .get('/@invalid/test')
+    .expect(404, done);
+  });
+
   it('should get scope package info: /@scope%2Fname', function (done) {
-    request(app.listen())
+    request(app)
     .get(pkgURL)
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -75,7 +99,7 @@ describe('controllers/registry/module/scope_package.test.js', function () {
   });
 
   it('should get scope package info: /%40scope%2Fname', function (done) {
-    request(app.listen())
+    request(app)
     .get('/' + encodeURIComponent(pkgname))
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -91,7 +115,7 @@ describe('controllers/registry/module/scope_package.test.js', function () {
   });
 
   it('should get scope package with version', function (done) {
-    request(app.listen())
+    request(app)
     .get('/' + pkgname + '/0.0.1')
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -105,7 +129,7 @@ describe('controllers/registry/module/scope_package.test.js', function () {
   });
 
   it('should get scope package with tag', function (done) {
-    request(app.listen())
+    request(app)
     .get('/' + pkgname + '/latest')
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -117,4 +141,139 @@ describe('controllers/registry/module/scope_package.test.js', function () {
       done();
     });
   });
+
+  it('should download work', function (done) {
+    request(app)
+    .get('/@cnpm/test-scope-package/download/@cnpm/test-scope-package-0.0.2.tgz')
+    .expect('Location', /\.tgz$/)
+    .expect(302, done);
+  });
+
+  describe('support adaptScope', function () {
+    before(function (done) {
+      var pkg = utils.getPackage('test-default-scope-package', '0.0.1', utils.admin);
+      request(app)
+      .put('/' + pkg.name)
+      .set('authorization', utils.adminAuth)
+      .send(pkg)
+      .expect(201, done);
+    });
+    describe('/@:scope/:name', function () {
+      it('should adapt /@cnpm/test-default-scope-package => /test-default-scope-package', function (done) {
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package')
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          var pkg = res.body;
+          pkg._id.should.equal('@cnpm/test-default-scope-package');
+          pkg.name.should.equal('@cnpm/test-default-scope-package');
+          pkg.versions.should.have.keys('0.0.1');
+          pkg['dist-tags'].latest.should.equal('0.0.1');
+          pkg.versions['0.0.1'].name.should.equal('@cnpm/test-default-scope-package');
+          pkg.versions['0.0.1']._id.should.equal('@cnpm/test-default-scope-package@0.0.1');
+          pkg.versions['0.0.1'].dist.tarball
+            .should.containEql('/test-default-scope-package/download/test-default-scope-package-0.0.1.tgz');
+          done();
+        });
+      });
+
+      it('should adapt /@cnpmtest/test-default-scope-package => /test-default-scope-package', function (done) {
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpmtest/test-default-scope-package')
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          var pkg = res.body;
+          pkg._id.should.equal('@cnpmtest/test-default-scope-package');
+          pkg.name.should.equal('@cnpmtest/test-default-scope-package');
+          pkg.versions.should.have.keys('0.0.1');
+          pkg['dist-tags'].latest.should.equal('0.0.1');
+          pkg.versions['0.0.1'].name.should.equal('@cnpmtest/test-default-scope-package');
+          pkg.versions['0.0.1']._id.should.equal('@cnpmtest/test-default-scope-package@0.0.1');
+          pkg.versions['0.0.1'].dist.tarball
+            .should.containEql('/test-default-scope-package/download/test-default-scope-package-0.0.1.tgz');
+          done();
+        });
+      });
+
+      it('should not adapt when adaptScope is false', function (done) {
+        mm(config, 'adaptScope', false);
+        request(app)
+        .get('/@cnpm/test-default-scope-package')
+        .expect(404, done);
+      });
+
+      it('should 404 when pkg not exists', function (done) {
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package-not-exists')
+        .expect(404, done);
+      });
+
+      it('should show() 404 when adapt package is not private package', function (done) {
+        var getByTag = Module.getByTag;
+        mm(Module, 'getByTag', function* (name, tag) {
+          var pkg = yield getByTag.call(Module, name, tag);
+          pkg && delete pkg.package._publish_on_cnpm;
+          return pkg;
+        });
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package')
+        .expect(404, done);
+      });
+    });
+
+    describe('/@:scope/:name/:tag', function () {
+      it('should adapt /@cnpm/test-default-scope-package/latest => /test-default-scope-package/latest', function (done) {
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package/latest')
+        .expect(200, function (err, res) {
+          should.not.exist(err);
+          var pkg = res.body;
+          pkg.version.should.have.equal('0.0.1');
+          pkg.name.should.equal('@cnpm/test-default-scope-package');
+          pkg._id.should.equal('@cnpm/test-default-scope-package@0.0.1');
+          pkg.dist.tarball.should.containEql('/test-default-scope-package/download/test-default-scope-package-0.0.1.tgz');
+          done();
+        });
+      });
+
+      it('should not adapt when adaptScope is false', function (done) {
+        mm(config, 'adaptScope', false);
+        request(app)
+        .get('/@cnpm/test-default-scope-package/latest')
+        .expect(404, done);
+      });
+
+      it('should 404 when pkg not exists', function (done) {
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package-not-exists/latest')
+        .expect(404, done);
+      });
+
+      it('should 404 when pkg version not exists', function (done) {
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package-not-exists/1.0.0')
+        .expect(404, done);
+      });
+
+      it('should get() 404 when adapt package is not private package', function (done) {
+        var getByTag = Module.getByTag;
+        mm(Module, 'getByTag', function* (name, tag) {
+          var pkg = yield getByTag.call(Module, name, tag);
+          pkg && delete pkg.package._publish_on_cnpm;
+          return pkg;
+        });
+        mm(config, 'adaptScope', true);
+        request(app)
+        .get('/@cnpm/test-default-scope-package/latest')
+        .expect(404, done);
+      });
+    });
+  });
 });

test/controllers/registry/user.test.js

@@ -20,14 +20,12 @@ var mm = require('mm');
 var app = require('../../../servers/registry');
 var user = require('../../../proxy/user');
 var mysql = require('../../../common/mysql');
+var config = require('../../../config');
+var UserService = require('../../../services/user');
 
 describe('controllers/registry/user.test.js', function () {
   before(function (done) {
-    app.listen(0, done);
-  });
-
-  after(function (done) {
-    app.close(done);
+    app = app.listen(0, done);
   });
 
   afterEach(mm.restore);
@@ -88,91 +86,51 @@ describe('controllers/registry/user.test.js', function () {
     });
 
     it('should 409 when already exist', function (done) {
-      mm.data(user, 'get', {name: 'name'});
+      mm(user, 'get', function* () {
+        return {name: 'name'};
+      });
       request(app)
       .put('/-/user/org.couchdb.user:name')
       .send({
         name: 'name',
-        salt: 'salt',
-        password_sha: 'password_sha',
+        password: 'password',
         email: 'email'
       })
       .expect(409, done);
     });
 
     it('should 500 when user.get error', function (done) {
-      mm.error(user, 'get', 'mock error');
+      mm(user, 'get', function* () {
+        throw new Error('mock User.get error');
+      });
       request(app)
       .put('/-/user/org.couchdb.user:name')
       .send({
         name: 'name',
-        salt: 'salt',
-        password_sha: 'password_sha',
+        password: 'password',
         email: 'email'
       })
       .expect(500, done);
     });
 
     it('should 201 when user.add ok', function (done) {
-      mm.empty(user, 'get');
-      mm.data(user, 'add', {rev: '1-123'});
+      mm(user, 'get', function* () {
+        return null;
+      });
+      mm(user, 'add', function* () {
+        return {rev: '1-123'};
+      });
       request(app)
       .put('/-/user/org.couchdb.user:name')
       .send({
         name: 'name',
-        salt: 'salt',
-        password_sha: 'password_sha',
+        password: 'password',
         email: 'email'
       })
       .expect(201, done);
     });
   });
 
-  describe('POST /_session', function () {
-    it('should 500 auth error by user.auth', function (done) {
-      mm.error(user, 'auth', 'mock error');
-      request(app)
-      .post('/_session')
-      .send({
-        name: 'name',
-        password: '123'
-      })
-      .expect(500, done);
-    });
-
-    it('should 401 auth fail by user.auth', function (done) {
-      mm.empty(user, 'auth');
-      request(app)
-      .post('/_session')
-      .send({
-        name: 'name',
-        password: '123'
-      })
-      .expect(401, done);
-    });
-
-    it('should 200 auth pass by user.auth', function (done) {
-      mm.data(user, 'auth', {name: 'name'});
-      request(app)
-      .post('/_session')
-      .send({
-        name: 'name',
-        password: '123'
-      })
-      .expect(200)
-      .expect({
-        ok: true,
-        name: 'name',
-        roles: []
-      }, function (err, res) {
-        should.not.exist(err);
-        should.exist(res.headers['set-cookie']);
-        res.headers['set-cookie'].join(';').should.containEql('AuthSession=');
-        done();
-      });
-    });
-  });
-
   describe('PUT /-/user/:name/-rev/:rev', function () {
     it('should 404 when without a name', function (done) {
       request(app)
@@ -227,4 +185,184 @@ describe('controllers/registry/user.test.js', function () {
       .expect(201, done);
     });
   });
+
+  describe('config.customUserSerivce = true', function () {
+    beforeEach(function () {
+      mm(config, 'customUserService', true);
+    });
+
+    it('should 422 when password missing', function (done) {
+      request(app)
+      .put('/-/user/org.couchdb.user:cnpmjstest10-not-exists')
+      .send({
+        name: 'cnpmjstest10-not-exists',
+        password: '',
+        email: 'cnpmjstest10@cnpmjs.org'
+      })
+      .expect({
+        error: 'paramError',
+        reason: 'params missing, name, email or password missing.'
+      })
+      .expect(422, done);
+    });
+
+    it('should 201 login success', function (done) {
+      request(app)
+      .put('/-/user/org.couchdb.user:cnpmjstest10')
+      .send({
+        name: 'cnpmjstest10',
+        password: 'cnpmjstest10',
+        email: 'cnpmjstest10@cnpmjs.org'
+      })
+      .expect(201, function (err, res) {
+        should.not.exist(err);
+        res.body.should.have.keys('ok', 'id', 'rev');
+        res.body.id.should.equal('org.couchdb.user:cnpmjstest10');
+        res.body.rev.should.match(/\d+\-cnpmjstest10/);
+        res.body.ok.should.equal(true);
+        done();
+      });
+    });
+
+    it('should 401 login fail', function (done) {
+      request(app)
+      .put('/-/user/org.couchdb.user:cnpmjstest10-not-exists')
+      .send({
+        name: 'cnpmjstest10-not-exists',
+        password: 'cnpmjstest10',
+        email: 'cnpmjstest10@cnpmjs.org'
+      })
+      .expect({
+        error: 'unauthorized',
+        reason: 'Login fail, please check your login name and password'
+      })
+      .expect(401, done);
+    });
+  });
+
+  describe('config.customUserService = true', function () {
+    beforeEach(function () {
+      mm(config, 'customUserService', true);
+    });
+
+    afterEach(mm.restore);
+
+    it('should show custom user info: admin', function (done) {
+      mm(UserService, 'get', function* () {
+        return {
+          login: 'mock_custom_user',
+          email: 'mock_custom_user@cnpmjs.org',
+          name: 'mock_custom_user fullname',
+          avatar_url: 'avatar_url',
+          html_url: 'html_url',
+          im_url: '',
+          site_admin: true,
+          scopes: ['@test-user-scope']
+        };
+      });
+      request(app)
+      .get('/-/user/org.couchdb.user:mock_custom_user')
+      .expect(200, function (err, res) {
+        should.not.exist(err);
+        var user = res.body;
+        delete user._cnpm_meta.gmt_create;
+        delete user._cnpm_meta.gmt_modified;
+        delete user._cnpm_meta.id;
+        delete user.date;
+
+        user.should.eql({
+          _id: 'org.couchdb.user:mock_custom_user',
+          _rev: '1-mock_custom_user',
+          name: 'mock_custom_user',
+          email: 'mock_custom_user@cnpmjs.org',
+          type: 'user',
+          roles: [],
+          // date: '2014-07-28T16:46:36.000Z',
+          avatar: 'avatar_url',
+          fullname: 'mock_custom_user fullname',
+          homepage: 'html_url',
+          _cnpm_meta:
+           {
+            //  id: 4,
+             npm_user: false,
+             custom_user: true,
+            //  gmt_create: '2014-07-28T16:46:36.000Z',
+            //  gmt_modified: '2014-07-28T16:46:36.000Z',
+             admin: true,
+             scopes: [ '@test-user-scope' ] }
+        });
+        done();
+      });
+    });
+
+    it('should show custom user info: not admin', function (done) {
+      mm(UserService, 'get', function* () {
+        return {
+          login: 'mock_custom_not_admin_user',
+          email: 'mock_custom_not_admin_user@cnpmjs.org',
+          name: 'mock_custom_not_admin_user fullname',
+          avatar_url: 'avatar_url',
+          html_url: 'html_url',
+          im_url: '',
+          site_admin: false,
+          scopes: ['@test-user-scope']
+        };
+      });
+      request(app)
+      .get('/-/user/org.couchdb.user:mock_custom_not_admin_user')
+      .expect(200, function (err, res) {
+        should.not.exist(err);
+        var user = res.body;
+        delete user._cnpm_meta.gmt_create;
+        delete user._cnpm_meta.gmt_modified;
+        delete user._cnpm_meta.id;
+        delete user.date;
+
+        user.should.eql({
+          _id: 'org.couchdb.user:mock_custom_not_admin_user',
+          _rev: '1-mock_custom_not_admin_user',
+          name: 'mock_custom_not_admin_user',
+          email: 'mock_custom_not_admin_user@cnpmjs.org',
+          type: 'user',
+          roles: [],
+          // date: '2014-07-28T16:46:36.000Z',
+          avatar: 'avatar_url',
+          fullname: 'mock_custom_not_admin_user fullname',
+          homepage: 'html_url',
+          _cnpm_meta:
+           {
+            //  id: 5,
+             npm_user: false,
+             custom_user: true,
+            //  gmt_create: '2014-07-28T16:46:36.000Z',
+            //  gmt_modified: '2014-07-28T16:46:36.000Z',
+             admin: false,
+             scopes: [ '@test-user-scope' ] }
+        });
+        done();
+      });
+    });
+
+    it('should show error json when userSerive.auth throw error', function (done) {
+      mm(UserService, 'auth', function* () {
+        var err = new Error('mock user service auth error, please visit http://ooxx.net/user to sigup first');
+        err.name = 'UserSeriveAuthError';
+        err.status = 401;
+        throw err;
+      });
+
+      request(app)
+      .put('/-/user/org.couchdb.user:cnpmjstest10')
+      .send({
+        name: 'cnpmjstest10',
+        password: 'cnpmjstest10',
+        email: 'cnpmjstest10@cnpmjs.org'
+      })
+      .expect({
+        error: 'UserSeriveAuthError',
+        reason: 'mock user service auth error, please visit http://ooxx.net/user to sigup first'
+      })
+      .expect(401, done);
+    });
+  });
 });

test/controllers/sync.test.js

@@ -43,14 +43,14 @@ describe('controllers/sync.test.js', function () {
 
     it('should sync as publish success', function (done) {
       request(registryApp)
-      .del('/utility/-rev/123')
+      .del('/pedding/-rev/123')
       .set('authorization', baseauth)
       .end(function (err, res) {
         should.not.exist(err);
 
         mm.data(Npm, 'get', require(path.join(fixtures, 'utility.json')));
         request(registryApp)
-        .put('/utility/sync?publish=true&nodeps=true')
+        .put('/pedding/sync?publish=true&nodeps=true')
         .set('authorization', baseauth)
         .end(function (err, res) {
           should.not.exist(err);
@@ -75,7 +75,7 @@ describe('controllers/sync.test.js', function () {
     it('should sync through web success', function (done) {
       mm.data(Npm, 'get', require(path.join(fixtures, 'utility.json')));
       request(webApp)
-      .put('/sync/utility')
+      .put('/sync/pedding')
       .end(function (err, res) {
         should.not.exist(err);
         res.body.should.have.keys('ok', 'logId');
@@ -87,7 +87,7 @@ describe('controllers/sync.test.js', function () {
     it('should sync through registry success', function (done) {
       mm.data(Npm, 'get', require(path.join(fixtures, 'utility.json')));
       request(registryApp)
-      .put('/utility/sync')
+      .put('/pedding/sync')
       .set('authorization', baseauth)
       .end(function (err, res) {
         should.not.exist(err);
@@ -100,7 +100,7 @@ describe('controllers/sync.test.js', function () {
     it('should get sync log', function (done) {
       done = pedding(2, done);
       request(registryApp)
-      .get('/utility/sync/log/' + logIdRegistry)
+      .get('/pedding/sync/log/' + logIdRegistry)
       .end(function (err, res) {
         should.not.exist(err);
         res.body.should.have.keys('ok', 'log');
@@ -108,7 +108,7 @@ describe('controllers/sync.test.js', function () {
       });
 
       request(webApp)
-      .get('/sync/utility/log/' + logIdWeb)
+      .get('/sync/pedding/log/' + logIdWeb)
       .end(function (err, res) {
         should.not.exist(err);
         res.body.should.have.keys('ok', 'log');
@@ -121,10 +121,6 @@ describe('controllers/sync.test.js', function () {
     it('should sync scope package not found', function (done) {
       request(webApp)
       .put('/sync/@cnpm/not-exists-package')
-      .expect({
-        "ok":false,
-        "reason":"can not found @cnpm/not-exists-package in the source registry"
-      })
       .expect(404, done);
     });
   });

test/controllers/total.test.js

@@ -27,11 +27,6 @@ describe('controllers/total.test.js', function () {
     registryApp.listen(0, done);
     webApp.listen(0, done);
   });
-  after(function (done) {
-    done = pedding(2, done);
-    registryApp.close(done);
-    webApp.close(done);
-  });
 
   describe('GET / in registry', function () {
     it('should return total info', function (done) {

test/controllers/web/dist.test.js

@@ -23,11 +23,7 @@ var Dist = require('../../../proxy/dist');
 
 describe('controllers/web/dist.test.js', function () {
   before(function (done) {
-    app.listen(0, done);
-  });
-
-  after(function (done) {
-    app.close(done);
+    app = app.listen(0, done);
   });
 
   afterEach(mm.restore);

test/controllers/web/package.test.js

@@ -18,31 +18,31 @@ var should = require('should');
 var request = require('supertest');
 var mm = require('mm');
 var path = require('path');
+var pedding = require('pedding');
 var mysql = require('../../../common/mysql');
 var app = require('../../../servers/web');
 var registry = require('../../../servers/registry');
 var pkg = require('../../../controllers/web/package');
+var SyncModuleWorker = require('../../../proxy/sync_module_worker');
+var utils = require('../../utils');
+var config = require('../../../config');
 
 var fixtures = path.join(path.dirname(path.dirname(__dirname)), 'fixtures');
 
 describe('controllers/web/package.test.js', function () {
-  var baseauth = 'Basic ' + new Buffer('cnpmjstest10:cnpmjstest10').toString('base64');
-
   before(function (done) {
-    registry.listen(0, function () {
-      var pkg = require(path.join(fixtures, 'package_and_tgz.json'));
+    done = pedding(2, done);
+    registry = registry.listen(0, function () {
+      // name: mk2testmodule
+      var pkg = utils.getPackage('mk2testmodule', '0.0.1', utils.admin);
       request(registry)
       .put('/' + pkg.name)
-      .set('authorization', baseauth)
+      .set('authorization', utils.adminAuth)
       .send(pkg)
-      .expect(201, function () {
-        app.listen(0, done);
-      });
+      .end(done);
     });
-  });
 
-  after(function (done) {
-    app.close(done);
+    app = app.listen(0, done);
   });
 
   afterEach(mm.restore);
@@ -214,4 +214,45 @@ describe('controllers/web/package.test.js', function () {
       .expect(/Log/, done);
     });
   });
+
+  describe('unpublished package', function () {
+    before(function (done) {
+      var worker = new SyncModuleWorker({
+        name: ['tnpm'],
+        username: 'fengmk2'
+      });
+
+      worker.start();
+      worker.on('end', function () {
+        var names = worker.successes.concat(worker.fails);
+        names.sort();
+        names.should.eql(['tnpm']);
+        done();
+      });
+    });
+
+    it('should display unpublished info', function (done) {
+      request(app)
+      .get('/package/tnpm')
+      .expect(200)
+      .expect(/This package has been unpublished\./, done);
+    });
+  });
+
+  describe('GET /privates', function () {
+    it('should response no private packages', function (done) {
+      mm(config, 'scopes', []);
+      request(app)
+      .get('/privates')
+      .expect(/Can not found private package/)
+      .expect(200, done);
+    });
+
+    it('should response no private packages', function (done) {
+      request(app)
+      .get('/privates')
+      .expect(/Private packages in this registry/)
+      .expect(200, done);
+    });
+  });
 });

test/controllers/web/package/scope_package.test.js

@@ -16,35 +16,48 @@
 
 var should = require('should');
 var request = require('supertest');
+var pedding = require('pedding');
+var mm = require('mm');
+var config = require('../../../../config');
 var registry = require('../../../../servers/registry');
 var web = require('../../../../servers/web');
 var utils = require('../../../utils');
+var Module = require('../../../../proxy/module');
 
 describe('controllers/web/package/scope_package.test.js', function () {
   var pkgname = '@cnpm/test-web-scope-package';
   var pkgURL = '/@' + encodeURIComponent(pkgname.substring(1));
   before(function (done) {
-    // add scope package
-    var pkg = utils.getPackage(pkgname, '0.0.1', utils.admin);
-
-    request(registry.listen())
-    .put(pkgURL)
-    .set('authorization', utils.adminAuth)
-    .send(pkg)
-    .expect(201, function (err) {
-      should.not.exist(err);
-      pkg = utils.getPackage(pkgname, '0.0.2', utils.admin);
-      // publish 0.0.2
-      request(registry.listen())
+    done = pedding(2, done);
+    registry = registry.listen(0, function () {
+      // add scope package
+      var pkg = utils.getPackage(pkgname, '0.0.1', utils.admin);
+      request(registry)
       .put(pkgURL)
       .set('authorization', utils.adminAuth)
       .send(pkg)
-      .expect(201, done);
+      .expect(201, function (err) {
+        should.not.exist(err);
+        pkg = utils.getPackage(pkgname, '0.0.2', utils.admin);
+        // publish 0.0.2
+        request(registry)
+        .put(pkgURL)
+        .set('authorization', utils.adminAuth)
+        .send(pkg)
+        .expect(201, done);
+      });
     });
+    web = web.listen(0, done);
   });
 
+  beforeEach(function () {
+    mm(config, 'scopes', ['@cnpm', '@cnpmtest']);
+  });
+
+  afterEach(mm.restore);
+
   it('should show scope package info page: /@scope%2Fname', function (done) {
-    request(web.listen())
+    request(web)
     .get('/package' + pkgURL)
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -56,7 +69,7 @@ describe('controllers/web/package/scope_package.test.js', function () {
   });
 
   it('should show scope package info page: encodeURIComponent("/@scope/name")', function (done) {
-    request(web.listen())
+    request(web)
     .get('/package/' + encodeURIComponent(pkgname))
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -68,7 +81,7 @@ describe('controllers/web/package/scope_package.test.js', function () {
   });
 
   it('should show scope package info page: /@scope/name', function (done) {
-    request(web.listen())
+    request(web)
     .get('/package/' + pkgname)
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -79,14 +92,14 @@ describe('controllers/web/package/scope_package.test.js', function () {
     });
   });
 
-  it('should /@scope/name/ 404', function (done) {
-    request(web.listen())
+  it('should /package/@scope/name/ 404', function (done) {
+    request(web)
     .get('/package/' + pkgname + '/')
     .expect(404, done);
   });
 
   it('should show scope package with version: /@scope/name/0.0.2', function (done) {
-    request(web.listen())
+    request(web)
     .get('/package/' + pkgname + '/0.0.2')
     .expect(200, function (err, res) {
       should.not.exist(err);
@@ -96,4 +109,69 @@ describe('controllers/web/package/scope_package.test.js', function () {
       done();
     });
   });
+
+  it('should /@scope/name redirect to /package/@scope/name', function (done) {
+    request(web)
+    .get('/' + pkgname)
+    .expect('Location', '/package/' + pkgname)
+    .expect(302, done);
+  });
+
+  describe('support adapt scope', function () {
+    before(function (done) {
+      var pkg = utils.getPackage('test-default-web-scope-package', '0.0.1', utils.admin);
+      request(registry)
+      .put('/' + pkg.name)
+      .set('authorization', utils.adminAuth)
+      .send(pkg)
+      .expect(201, done);
+    });
+
+    it('should adapt /@cnpm/test-default-web-scope-package => /test-default-web-scope-package', function (done) {
+      mm(config, 'adaptScope', true);
+      request(web)
+      .get('/package/@cnpm/test-default-web-scope-package')
+      .expect(200, function (err, res) {
+        should.not.exist(err);
+        var body = res.text;
+        body.should.containEql('@cnpm/test-default-web-scope-package');
+        body.should.containEql('/test-default-web-scope-package/download/test-default-web-scope-package-0.0.1.tgz');
+        done();
+      });
+    });
+
+    it('should not adapt /@cnpm123/test-default-web-scope-package', function (done) {
+      mm(config, 'adaptScope', true);
+      request(web)
+      .get('/package/@cnpm123/test-default-web-scope-package')
+      .expect(404, done);
+    });
+
+    it('should not adapt', function (done) {
+      mm(config, 'adaptScope', false);
+      request(web)
+      .get('/package/@cnpm/test-default-web-scope-package')
+      .expect(404, done);
+    });
+
+    it('should 404 when pkg not exists', function (done) {
+      mm(config, 'adaptScope', true);
+      request(web)
+      .get('/package/@cnpm/test-default-web-scope-package-not-exists')
+      .expect(404, done);
+    });
+
+    it('should 404 when pkg is not private package', function (done) {
+      var getByTag = Module.getByTag;
+      mm(Module, 'getByTag', function* (name, tag) {
+        var pkg = yield getByTag.call(Module, name, tag);
+        pkg && delete pkg.package._publish_on_cnpm;
+        return pkg;
+      });
+      mm(config, 'adaptScope', true);
+      request(web)
+      .get('/package/@cnpm/test-default-web-scope-package')
+      .expect(404, done);
+    });
+  });
 });

test/controllers/web/user.test.js

@@ -20,10 +20,7 @@ var app = require('../../../servers/web');
 
 describe('controllers/web/user.test.js', function () {
   before(function (done) {
-    app.listen(0, done);
-  });
-  after(function (done) {
-    app.close(done);
+    app = app.listen(0, done);
   });
 
   describe('GET /~:name', function (done) {
@@ -33,7 +30,7 @@ describe('controllers/web/user.test.js', function () {
       .expect(200)
       .expect('content-type', 'text/html; charset=utf-8')
       .expect(/<div id="profile">/)
-      .expect(/Packages by /, done);
+      .expect(/Packages by/, done);
     });
 
     it('should get 404', function (done) {

test/fixtures/scope-package/lib/scope-package.js

@@ -14,4 +14,4 @@
  * Module dependencies.
  */
 
-var varname = require('modulename');
+var koa = require('koa');

test/init.js

@@ -20,6 +20,7 @@ var User = require('../proxy/user');
 
 var usernames = [
   'cnpmjstest101',
+  'cnpmjstest102',
   'cnpmjstest10'
 ];
 

test/middleware/auth.test.js

@@ -20,6 +20,8 @@ var request = require('supertest');
 var app = require('../../servers/registry');
 var mm = require('mm');
 var mysql = require('../../common/mysql');
+var config = require('../../config');
+var UserService = require('../../services/user');
 
 describe('middleware/auth.test.js', function () {
   before(function (done) {
@@ -60,5 +62,29 @@ describe('middleware/auth.test.js', function () {
       .set('authorization', 'basic ' + new Buffer('cnpmjstest10:cnpmjstest10').toString('base64'))
       .expect(500, done);
     });
+
+    describe('config.customUserService = true', function () {
+      beforeEach(function () {
+        mm(config, 'customUserService', true);
+      });
+
+      it('should 401 when user service auth throw error', function (done) {
+        mm(UserService, 'auth', function* () {
+          var err = new Error('mock user service auth error, please visit http://ooxx.net/user to sigup first');
+          err.name = 'UserSeriveAuthError';
+          err.status = 401;
+          throw err;
+        });
+
+        request(app)
+        .put('/-/user/org.couchdb.user:cnpmjstest10/-rev/1')
+        .set('authorization', 'basic ' + new Buffer('cnpmjstest10:cnpmjstest10').toString('base64'))
+        .expect({
+          error: 'UserSeriveAuthError',
+          reason: 'mock user service auth error, please visit http://ooxx.net/user to sigup first'
+        })
+        .expect(401, done);
+      });
+    });
   });
 });

test/proxy/module.test.js

@@ -20,6 +20,7 @@ var fs = require('fs');
 var path = require('path');
 var mysql = require('../../common/mysql');
 var Module = require('../../proxy/module');
+var config = require('../../config');
 
 var fixtures = path.join(path.dirname(__dirname), 'fixtures');
 
@@ -144,13 +145,10 @@ describe('proxy/module.test.js', function () {
   });
 
   describe('listByAuthor()', function () {
-    it('should return author recent modules', function (done) {
-      Module.listByAuthor('fengmk2', function (err, rows) {
-        should.not.exist(err);
-        rows.forEach(function (r) {
-          r.should.have.keys('name', 'description');
-        });
-        done();
+    it('should return author recent modules', function* () {
+      var rows = yield Module.listByAuthor('fengmk2');
+      rows.forEach(function (r) {
+        r.should.have.keys('name', 'description');
       });
     });
   });
@@ -173,4 +171,26 @@ describe('proxy/module.test.js', function () {
       yield* Module.removeTagsByNames('foo', ['latest', '1.0']);
     });
   });
+
+  describe('listPrivates()', function () {
+    it('should response [] if scopes not present', function* () {
+      mm(config, 'scopes', []);
+      var modules = yield Module.listPrivates();
+      modules.should.eql([]);
+    });
+
+    it('should response [] if private modules not present', function* () {
+      mm(config, 'privatePackages', []);
+      mm(config, 'scopes', ['@not-exist']);
+      var modules = yield Module.listPrivates();
+      modules.should.eql([]);
+    });
+
+    it('should work', function* () {
+      var modules = yield Module.listPrivates();
+      modules.forEach(function (m) {
+        m.should.have.keys(['name', 'description']);
+      })
+    });
+  });
 });

test/proxy/user.test.js

@@ -51,59 +51,51 @@ describe('proxy/user.test.js', function () {
 
   describe('get()', function () {
     before(initUser);
-    it('should get user ok', function (done) {
-      user.get('mockuser', function (err, data) {
-        should.not.exist(err);
-        data.should.have.keys('id', 'rev', 'name', 'email', 'salt',
-          'json', 'npm_user',
-          'password_sha', 'ip', 'roles', 'gmt_create', 'gmt_modified');
-        done();
-      });
+    it('should get user ok', function* () {
+      var data = yield* user.get('mockuser');
+      data.should.have.keys('id', 'rev', 'name', 'email', 'salt',
+        'json', 'npm_user',
+        'password_sha', 'ip', 'roles', 'gmt_create', 'gmt_modified');
     });
 
-    it('should get error when mysql error', function (done) {
+    it('should get error when mysql error', function* () {
       mm.error(mysql, 'query', 'mock error');
-      user.get('mockuser', function (err) {
+      try {
+        yield* user.get('mockuser');
+        new Error('should not run this');
+      } catch (err) {
         err.message.should.equal('mock error');
-        done();
-      });
+      }
     });
   });
 
   describe('auth()', function () {
     before(initUser);
-    it('should auth user ok', function (done) {
-      user.auth(mockUser.name, mockUser.password, function (err, data) {
-        should.not.exist(err);
-        data.should.have.keys('id', 'rev', 'name', 'email', 'salt',
-          'json', 'npm_user',
-          'password_sha', 'ip', 'roles', 'gmt_create', 'gmt_modified');
-        done();
-      });
+    it('should auth user ok', function* () {
+      var data = yield* user.auth(mockUser.name, mockUser.password);
+      data.should.have.keys('id', 'rev', 'name', 'email', 'salt',
+        'json', 'npm_user',
+        'password_sha', 'ip', 'roles', 'gmt_create', 'gmt_modified');
     });
 
-    it('should auth user fail when user not exist', function (done) {
-      user.auth('notexistmockuser', '123', function (err, data) {
-        should.not.exist(err);
-        should.not.exist(data);
-        done();
-      });
+    it('should auth user fail when user not exist', function* () {
+      var data = yield* user.auth('notexistmockuser', '123');
+      should.not.exist(data);
     });
 
-    it('should auth fail when password error', function (done) {
-      user.auth(mockUser.name, '123', function (err, data) {
-        should.not.exist(err);
-        should.not.exist(data);
-        done();
-      });
+    it('should auth fail when password error', function* () {
+      var data = yield* user.auth(mockUser.name, '123');
+      should.not.exist(data);
     });
 
-    it('should auth error when mysql error', function (done) {
+    it('should auth error when mysql error', function* () {
       mm.error(mysql, 'query', 'mock error');
-      user.auth(mockUser.name, '123', function (err, data) {
+      try {
+        yield* user.auth(mockUser.name, '123');
+        new Error('should not run this');
+      } catch (err) {
         err.message.should.equal('mock error');
-        done();
-      });
+      }
     });
   });
 

test/services/default_user_service.test.js

@@ -0,0 +1,151 @@
+/**!
+ * cnpmjs.org - test/services/default_user_service.test.js
+ *
+ * Copyright(c) fengmk2 and other contributors.
+ * MIT Licensed
+ *
+ * Authors:
+ *   fengmk2 <fengmk2@gmail.com> (http://fengmk2.github.com)
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var should = require('should');
+var mm = require('mm');
+var npm = require('../../proxy/npm');
+var User = require('../../proxy/user');
+var DefaultUserService = require('../../services/default_user_service');
+var config = require('../../config');
+
+describe('services/default_user_service.test.js', function () {
+  var userService = new DefaultUserService();
+
+  before(function* () {
+    var user = yield* npm.getUser('fengmk2');
+    if (!user) {
+      return;
+    }
+    user.fullname = 'Yuan Feng';
+    yield* User.saveNpmUser(user);
+  });
+
+  beforeEach(function () {
+    mm(config, 'scopes', ['@cnpm', '@cnpmtest']);
+  });
+  afterEach(mm.restore);
+
+  describe('auth()', function () {
+    it('should return user when auth success', function* () {
+      var user = yield* userService.auth('cnpmjstest10', 'cnpmjstest10');
+      should.exist(user);
+      user.should.eql({
+        login: 'cnpmjstest10',
+        email: 'fengmk2@gmail.com',
+        name: 'cnpmjstest10',
+        html_url: 'http://cnpmjs.org/~cnpmjstest10',
+        avatar_url: 'https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=50&d=retro',
+        im_url: '',
+        site_admin: true,
+        scopes: ['@cnpm', '@cnpmtest'],
+      });
+    });
+
+    it('should return null when auth fail', function* () {
+      var user = yield* userService.auth('cnpmjstest10', 'wrong');
+      should.not.exist(user);
+    });
+  });
+
+  describe('get()', function () {
+    it('should get a cnpm admin user by login name', function* () {
+      var user = yield* userService.get('cnpmjstest10');
+      should.exist(user);
+      user.should.eql({
+        login: 'cnpmjstest10',
+        email: 'fengmk2@gmail.com',
+        name: 'cnpmjstest10',
+        html_url: 'http://cnpmjs.org/~cnpmjstest10',
+        avatar_url: 'https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=50&d=retro',
+        im_url: '',
+        site_admin: true,
+        scopes: ['@cnpm', '@cnpmtest'],
+      });
+    });
+
+    it('should get a cnpm normal user by login name', function* () {
+      var user = yield* userService.get('cnpmjstest101');
+      should.exist(user);
+      user.should.eql({
+        login: 'cnpmjstest101',
+        email: 'fengmk2@gmail.com',
+        name: 'cnpmjstest101',
+        html_url: 'http://cnpmjs.org/~cnpmjstest101',
+        avatar_url: 'https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=50&d=retro',
+        im_url: '',
+        site_admin: false,
+        scopes: ['@cnpm', '@cnpmtest'],
+      });
+    });
+
+    it('should get a npm sync user by login name', function* () {
+      var user = yield* userService.get('fengmk2');
+      should.exist(user);
+      user.should.eql({
+        login: 'fengmk2',
+        email: 'fengmk2@gmail.com',
+        name: 'Yuan Feng',
+        html_url: 'http://fengmk2.github.com',
+        avatar_url: 'https://secure.gravatar.com/avatar/95b9d41231617a05ced5604d242c9670?s=50&d=retro',
+        im_url: 'https://twitter.com/fengmk2',
+        site_admin: true,
+        scopes: ['@cnpm', '@cnpmtest'],
+      });
+    });
+
+    it('should get null when user not exists', function* () {
+      var user = yield* userService.get('not-exists');
+      should.not.exist(user);
+    });
+  });
+
+  describe('list()', function () {
+    it('should return all exists users', function* () {
+      var users = yield* userService.list(['cnpmjstest10', 'fengmk2', 'cnpmjstest101']);
+      users.should.length(3);
+    });
+
+    it('should return some exists users', function* () {
+      var users = yield* userService.list(['cnpmjstest10', 'fengmk2123', 'cnpmjstest101']);
+      users.should.length(2);
+    });
+
+    it('should return []', function* () {
+      var users = yield* userService.list([]);
+      users.should.length(0);
+
+      var users = yield* userService.list(['not1', 'not2']);
+      users.should.length(0);
+    });
+  });
+
+  describe('search()', function () {
+    it('should return login name matched users', function* () {
+      var users = yield* userService.search('cnpm');
+      users.length.should.above(2);
+    });
+
+    it('should return limit 1 user', function* () {
+      var users = yield* userService.search('cnpm', {limit: 1});
+      users.should.length(1);
+    });
+
+    it('should return []', function* () {
+      var users = yield* userService.search('not-cnpm');
+      users.should.length(0);
+    });
+  });
+});

test/utils.js

@@ -25,6 +25,9 @@ exports.adminAuth = 'Basic ' + new Buffer(admin + ':' + admin).toString('base64'
 var otherUser = exports.otherUser = 'cnpmjstest101';
 exports.otherUserAuth = 'Basic ' + new Buffer(otherUser + ':' + otherUser).toString('base64');
 
+var secondUser = exports.secondUser = 'cnpmjstest102';
+exports.secondUserAuth = 'Basic ' + new Buffer(secondUser + ':' + secondUser).toString('base64');
+
 var _pkg = fs.readFileSync(path.join(fixtures, 'package_and_tgz.json'));
 
 exports.getPackage = function (name, version, user) {

view/web/package_unpublished.html

@@ -0,0 +1,71 @@
+<div id="package">
+  <h1>
+    <%= package.name %>
+    <small>
+    (<a href="/sync/<%= package.name %>" target="_blank">SYNC</a> again from source npm registry)
+    </small>
+  </h1>
+
+  <p class="description">This package has been unpublished.</p>
+
+  <ul class="nav nav-tabs">
+    <li class="active"><a href="#meta">package.json</a></li>
+  </ul>
+
+  <table class="metadata active">
+    <% if (package.unpublished.description) { %>
+    <tr>
+      <th>Description</th>
+      <td>
+        <%= package.unpublished.description %>
+      </td>
+    </tr>
+    <% } %>
+
+    <tr>
+      <th>Unpublished By</th>
+      <td>
+        <span class="user">
+          <a class="username" href="/~<%= package.unpublished.name %>">
+            <%= package.unpublished.name %>
+          </a>
+        </span>
+      </td>
+    </tr>
+
+    <tr>
+      <th>Unpublished On</th>
+      <td>
+        <%- package.unpublished.time %>
+      </td>
+    </tr>
+
+    <% if (package.unpublished.maintainers) { %>
+    <tr>
+      <th>Maintainers</th>
+      <td>
+      <% package.unpublished.maintainers.forEach(function (m) { %>
+        <span class="user">
+          <a class="username" href="/~<%= m.name %>">
+            <% if (m.gravatar) { %>
+            <img src="<%- m.gravatar %>" class="avatar">
+            <% } %>
+            <%= m.name %>
+          </a>
+        </span>
+      <% }) %>
+      </td>
+    </tr>
+    <% } %>
+
+    <% if (package.unpublished.versions) { %>
+    <tr>
+      <th>Versions (<%- package.unpublished.versions.length %>)</th>
+      <td>
+      <%- package.unpublished.versions.reverse().slice(0, 20).join(', ') %> ...
+      </td>
+    </tr>
+    <% } %>
+
+  </table>
+</div>

view/web/private.html

@@ -0,0 +1,33 @@
+<style>
+#private .package {
+  padding: 10px;
+  font-size: 18px;
+  border-bottom: 1px solid #ddd;
+}
+
+#private .alert a {
+  font-size: 20px;
+}
+
+</style>
+<div id="private">
+  <% if (!packages.length) { %>
+    <div class="alert alert-warning">
+      Can not found private package
+    </div>
+  <% } else {%>
+    <h1>
+      Private packages in this registry
+    </h1>
+    <hr />
+
+    <% for (var i = 0; i < packages.length; i++) {
+      var item = packages[i];
+    %>
+      <div class="package">
+        <a href="/package/<%= item.name %>" class="package-name"><%= item.name %></a>
+        <span class="package-description"><%= item.description %></span>
+      </div>
+    <% } %>
+  <% } %>
+</div>

view/web/profile.html

@@ -7,14 +7,49 @@
 </style>
 <div id="profile">
   <h1>
-    Packages by <span style="color:#09f;"><%= user.name %></span>
+    Packages by
+      <% if (user.json.homepage) { %>
+        <span class="user">
+          <a class="username" target="_blank" href="<%= user.json.homepage %>">
+            <% if (user.json.avatar) { %>
+            <img src="<%= user.json.avatar %>" class="avatar">
+            <% } %>
+            <%= user.name %>
+          </a>
+        </span>
+      <% } else { %>
+        <span style="color:#09f;"><%= user.name %></span>
+      <% } %>
+    <% if (user.json.fullname) { %>
+      <small>(<%= user.json.fullname %>)</small>
+    <% } %>
     <% if (user.email) { %>
       <small>(<a href="mailto:<%= user.email %>"><%= user.email %></a>)</small>
     <% } %>
   </h1>
+  <table class="downloads">
+    <tbody>
+      <tr>
+        <th>Name</th>
+        <th>Last modified</th>
+        <th>Is admin</th>
+        <th>Publish scopes</th>
+      </tr>
+      <tr>
+        <td>@<%= user.json.fullname || user.name %></td>
+        <td><%- lastModified %></td>
+        <td><%- isAdmin %></td>
+        <td>
+          <%- scopes.map(function (scope) {
+            return '<a href="/browse/keyword/' + scope + '" target="_blank">' + scope +  '</a>';
+          }).join(' , ') %>
+        </td>
+      </tr>
+    </tbody>
+  </table>
   <hr />
   <% if (!packages.length) { %>
-    <div class="alert alert-warning">Can not found package by <%= user.name %>.</div>
+    <div class="alert alert-warning">Can not found any package by <%= user.name %>.</div>
   <% } %>
   <% for (var i = 0; i < packages.length; i++) { %>
     <div class="package">