chore: update versions (next) (#4351)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.changeset/pre.json

@@ -66,6 +66,7 @@
     "old-turkeys-heal",
     "perfect-chairs-act",
     "shiny-worms-retire",
+    "shy-carrots-compare",
     "shy-garlics-cry",
     "weak-fans-explain"
   ]

.changeset/shy-carrots-compare.md

@@ -0,0 +1,14 @@
+---
+'@verdaccio/server': minor
+'@verdaccio/test-helper': minor
+'@verdaccio/types': minor
+'@verdaccio/middleware': minor
+'@verdaccio/core': minor
+'@verdaccio/signature': minor
+'@verdaccio/url': minor
+'@verdaccio/config': minor
+'@verdaccio/auth': minor
+'@verdaccio/api': minor
+---
+
+refactor: auth with legacy sign support

.github/workflows/changesets.yml

@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0
 
       - name: setup node.js
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
         env:

.github/workflows/ci-windows.yml

@@ -20,7 +20,7 @@ jobs:
     steps:
     - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Node
-      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+      uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
       with:
         node-version-file: '.nvmrc'
     - name: Install pnpm
@@ -49,7 +49,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
@@ -73,7 +73,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
@@ -102,7 +102,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version: ${{ matrix.node_version }}
       - name: Install pnpm
@@ -127,7 +127,7 @@ jobs:
     name: UI Test E2E
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm

.github/workflows/ci.yml

@@ -29,7 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
@@ -56,7 +56,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
@@ -81,7 +81,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
@@ -100,24 +100,24 @@ jobs:
       - name: Lint
         run: pnpm format:check
   test:
-    needs: [format, lint]
+    needs: [prepare]
     strategy:
       fail-fast: true
       matrix:
         os: [ubuntu-latest]
-        node_version: [18, 20]
+        node_version: [18, 20, 21]
     name: ${{ matrix.os }} / Node ${{ matrix.node_version }}
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node ${{ matrix.node_version }}
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version: ${{ matrix.node_version }}
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare --activate pnpm@8.9.0
+          corepack prepare
       - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ~/.pnpm-store
@@ -138,7 +138,7 @@ jobs:
     if: (github.event_name == 'push' && github.ref == 'refs/heads/master') || github.event_name == 'workflow_dispatch'
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm

.github/workflows/codeql-analysis.yml

@@ -34,7 +34,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2
+        uses: github/codeql-action/init@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2
 
       # Override language selection by uncommenting this and choosing your languages
       # with:
@@ -42,7 +42,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2
+        uses: github/codeql-action/autobuild@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -56,4 +56,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2
+        uses: github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2

.github/workflows/docker-proxy-apache-e2e.yml

@@ -12,7 +12,8 @@ jobs:
   docker:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-
+    env:
+      NODE_OPTIONS: --max_old_space_size=4096
     steps:
     - name: Checkout
       uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
@@ -21,15 +22,21 @@ jobs:
       run: docker-compose -f "./e2e/docker/apache-verdaccio/docker-compose.yaml" up -d --build
 
     - name: Install node
-      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
+      uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
       with:
-        node-version: 18
+        node-version-file: '.nvmrc'
+    - name: npm setup
+      run: |
+        npm config set fetch-retries="10"
+        npm config set fetch-retry-factor="50"
+        npm config set fetch-retry-mintimeout="20000"
+        npm config set fetch-retry-maxtimeout="80000"          
     - name: verdaccio cli
       run: npm install -g verdaccio --registry http://localhost
     - name: gastby cli 
       run:  npm install -g gatsby-cli --registry http://localhost
-    - name: netlify cli 
+    # - name: netlify cli 
-      run:  npm install -g netlify-cli --registry http://localhost
+    #   run:  npm install -g netlify-cli --registry http://localhost
     - name: angular cli 
       run:  npm install -g @angular/cli --registry http://localhost
 

.github/workflows/docker-proxy-nginx-e2e.yml

@@ -9,7 +9,8 @@ jobs:
   docker:
     timeout-minutes: 10
     runs-on: ubuntu-latest
-
+    env:
+      NODE_OPTIONS: --max_old_space_size=4096
     steps:
     - name: Checkout
       uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
@@ -18,12 +19,12 @@ jobs:
       run: docker-compose -f "./e2e/docker/proxy-nginx/docker-compose.yaml" up -d --build
 
     - name: Install node
-      uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3
+      uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
       with:
-        node-version: 18
+        node-version-file: '.nvmrc'
     - name: npm setup
       run: |
-        npm config set fetch-retries="5"
+        npm config set fetch-retries="10"
         npm config set fetch-retry-factor="50"
         npm config set fetch-retry-mintimeout="20000"
         npm config set fetch-retry-maxtimeout="80000"      
@@ -31,8 +32,8 @@ jobs:
       run: npm install -g verdaccio --registry http://localhost
     - name: gastby cli 
       run:  npm install -g gatsby-cli --registry http://localhost
-    - name: netlify cli 
+    #- name: netlify cli 
-      run:  npm install -g netlify-cli --registry http://localhost
+    #  run:  npm install -g netlify-cli --registry http://localhost
     - name: angular cli 
       run:  npm install -g @angular/cli --registry http://localhost
 

.github/workflows/e2e-ci.yml

@@ -17,13 +17,13 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare --activate pnpm@8.9.0
+          corepack prepare 
       - name: set store
         run: |
           mkdir ~/.pnpm-store
@@ -43,13 +43,13 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node 16
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare --activate pnpm@8.9.0
+          corepack prepare 
       - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ~/.pnpm-store
@@ -77,7 +77,7 @@ jobs:
       #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
       #     restore-keys: |
       #       test-
-  e2e-cli:
+  e2e-cli-npm:
     needs: [prepare, build]
     strategy:
       fail-fast: false
@@ -88,27 +88,20 @@ jobs:
             npm7,
             npm8,
             npm9,
-            npm10,
+            npm10
-            pnpm6,
-            pnpm7,
-            pnpm8,
-            yarn1,
-            yarn2,
-            yarn3,
-            yarn4,
           ]
-        node: [16, 18, 19]
+        node: [20, 21]
     name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version: ${{ matrix.node }}
       - name: Install pnpm
         run: |
           corepack enable
-          corepack prepare --activate pnpm@8.9.0
+          corepack prepare 
       - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
         with:
           path: ~/.pnpm-store
@@ -130,3 +123,94 @@ jobs:
         run: pnpm --filter @verdaccio/test-cli-commons build
       - name: Test CLI
         run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
+  # TODO: fix pnpm setup
+  # e2e-cli-pnpm:
+  #   needs: [prepare, build]
+  #   strategy:
+  #     fail-fast: true
+  #     matrix:
+  #       pkg:
+  #         [          
+  #           pnpm6,
+  #           pnpm7,
+  #           pnpm8          
+  #         ]
+  #       node: [20, 21]
+  #   name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
+  #   runs-on: ubuntu-latest
+  #   steps:
+  #     - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+  #     - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+  #       with:
+  #         node-version: ${{ matrix.node }}
+  #     - name: Install pnpm
+  #       run: |
+  #         corepack enable
+  #         corepack prepare
+  #     - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
+  #       with:
+  #         path: ~/.pnpm-store
+  #         key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
+  #     - name: set store
+  #       run: |
+  #         pnpm config set store-dir ~/.pnpm-store
+  #     - name: Install
+  #       run: pnpm install --loglevel debug --ignore-scripts --registry http://localhost:4873
+  #     - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
+  #       with:
+  #         path: ./packages/
+  #         key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
+  #     # - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
+  #     #   with:
+  #     #     path: ./e2e/
+  #     #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
+  #     - name: build e2e
+  #       run: pnpm --filter @verdaccio/test-cli-commons build
+  #     - name: Test CLI
+  #       run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
+  e2e-cli-yarn:
+    needs: [prepare, build]
+    strategy:
+      fail-fast: false
+      matrix:
+        pkg:
+          [           
+            yarn1,
+            yarn2,
+            yarn3,
+            yarn4
+          ]
+        node: [20, 21]
+    name: ${{ matrix.pkg }}/ ubuntu-latest / ${{ matrix.node }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7 # v3
+        with:
+          node-version: ${{ matrix.node }}
+      - name: Install pnpm
+        run: |
+          corepack enable
+          corepack prepare 
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
+        with:
+          path: ~/.pnpm-store
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
+      - name: set store
+        run: |
+          pnpm config set store-dir ~/.pnpm-store
+      - name: Install
+        run: pnpm install --offline --reporter=silence --ignore-scripts --registry http://localhost:4873
+      - uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
+        with:
+          path: ./packages/
+          key: pkg-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
+      # - uses: actions/cache@9b0c1fce7a93df8e3bb8926b0d6e9d89e92f20a7 # tag=v3
+      #   with:
+      #     path: ./e2e/
+      #     key: test-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.run_id }}-${{ github.sha }}
+      - name: build e2e
+        run: pnpm --filter @verdaccio/test-cli-commons build
+      - name: Test CLI
+        run: NODE_ENV=production pnpm test --filter ...@verdaccio/e2e-cli-${{matrix.pkg}}
+      

.github/workflows/e2e-ui.yml

@@ -17,13 +17,13 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       - name: Use Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
       - name: Install pnpm
         run: |
           corepack enable
-          corepack install
+          corepack prepare
       - name: Install
         run: pnpm install --reporter=silence --registry http://localhost:4873
       - name: build

.github/workflows/static-data.yml

@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version: 18.x
       - name: install pnpm

.github/workflows/ui-components.yml

@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
       - name: Use Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
           node-version-file: '.nvmrc'
 

.github/workflows/website.yml

@@ -20,32 +20,40 @@ jobs:
       pull-requests: write  #  to comment on pull-requests
 
     runs-on: ubuntu-latest
+    name: setup verdaccio
+    services:
+      verdaccio:
+        image: verdaccio/verdaccio:5
+        ports:
+          - 4873:4873
+        env:
+          NODE_ENV: production    
     env:
       NODE_OPTIONS: --max_old_space_size=4096
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
 
-      - name: Use Node 16
+      - name: Node
-        uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # tag=v3
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v3
         with:
-          node-version: 16
+          node-version-file: '.nvmrc'
-
+      - name: Install pnpm
-      - name: Cache pnpm modules
+        run: |
+          corepack enable
+          corepack install
+      - name: set store
+        run: |
+          mkdir ~/.pnpm-store
+          pnpm config set store-dir ~/.pnpm-store
+      - name: Install
+        run: pnpm install  --registry http://localhost:4873
+      - name: Cache .pnpm-store
         uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
-        env:
-          cache-name: cache-pnpm-modules
         with:
           path: ~/.pnpm-store
-          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-${{ hashFiles('**/pnpm-lock.yaml') }}
+          key: pnpm-${{ hashFiles('pnpm-lock.yaml') }}
           restore-keys: |
-            ${{ runner.os }}-build-${{ env.cache-name }}-${{ matrix.node-version }}-
+            pnpm-          
-
-      - uses: pnpm/action-setup@d882d12c64e032187b2edb46d3a0d003b7a43598 # tag=v2.4.0
-        with:
-          version: latest-8
-          run_install: |
-            - recursive: true
-              args: [--frozen-lockfile]
       - name: Build 
         run: pnpm build
       - name: Build Translations percentage
@@ -109,7 +117,7 @@ jobs:
 
       - name: Format lighthouse score
         id: format_lighthouse_score
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # tag=v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
         with:
           github-token: ${{secrets.GITHUB_TOKEN}}
           script: |

.npmrc

@@ -1,3 +1,2 @@
 always-auth = true
-loglevel=info
 fetch-retries="10"

.prettierrc

@@ -0,0 +1,15 @@
+{
+  "endOfLine": "lf",
+  "useTabs": false,
+  "printWidth": 100,
+  "tabWidth": 2,
+  "singleQuote": true,
+  "bracketSpacing": true,
+  "trailingComma": "es5",
+  "semi": true,
+  "plugins": ["@trivago/prettier-plugin-sort-imports"],
+  "importOrder": ["^@verdaccio/(.*)$", "^[./]"],
+  "importOrderSeparation": true,
+  "importOrderParserPlugins": ["typescript", "classProperties", "jsx"],
+  "importOrderSortSpecifiers": true
+}

.vscode/settings.json

@@ -1,13 +1,10 @@
 // Place your settings in this file to overwrite default and user settings.
 {
   "files.exclude": {
-    "**/.nyc_output": true,
     "**/build": false,
     "**/coverage": true,
     ".idea": true,
-    "storage_default_storage": true,
-    ".yarn": true
   },
-  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
-  "typescript.tsdk": "node_modules/typescript/lib"
+  "editor.formatOnSave": true
 }

CONTRIBUTING.md

@@ -29,6 +29,8 @@ The Verdaccio project is split into several areas, the first three hosted in the
 
 ## Prepare local setup {#local-setup}
 
+**Note**: The size of the Verdaccio project is quite significant. Unzipped it is about 33 MB. However, a full build with all node_modules installed takes about **2.8 GB** of disk space (~190k files)!
+
 Verdaccio uses [pnpm](https://pnpm.io) as the package manager for development in this repository.
 
 If you are using pnpm for the first time the [pnpm configuration documentation](https://pnpm.io/configuring) may be useful to avoid any potential problems with the following steps.
@@ -46,16 +48,15 @@ We use [corepack](https://github.com/nodejs/corepack) to install and use a speci
 ```shell
 nvm install
 corepack enable
-corepack install
 ```
 
 `pnpm` version will be updated mainly by the maintainers but if you would like to set it to a specific version, you can do so by running the following command:
 
-```shell
+> `packageManager` at the `package.json` defines the default version to be used.
-corepack use pnpm@8.9.1
-```
 
-It will update the `package.json` file with the new version of pnpm in the `packageManager` field.
+```shell
+corepack prepare
+```
 
 With pnpm installed, the first step is installing all dependencies:
 

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=${BUILDPLATFORM:-linux/amd64} node:18-alpine as builder
+FROM --platform=${BUILDPLATFORM:-linux/amd64} node:21-alpine as builder
 
 ENV NODE_ENV=development \
     VERDACCIO_BUILD_REGISTRY=https://registry.npmjs.org
@@ -20,7 +20,7 @@ RUN npm -g i pnpm@8.9.0 && \
 # NODE_ENV=production pnpm install --frozen-lockfile --ignore-scripts
 # RUN pnpm install --prod --ignore-scripts
 
-FROM node:18-alpine
+FROM node:21-alpine
 LABEL maintainer="https://github.com/verdaccio/verdaccio"
 
 ENV VERDACCIO_APPDIR=/opt/verdaccio \

README.md

@@ -33,7 +33,6 @@ Google Cloud Storage** or create your own plugin.
 [![MIT](https://img.shields.io/github/license/mashape/apistatus.svg)](https://github.com/verdaccio/verdaccio/blob/master/LICENSE)
 [![Crowdin](https://d322cqt584bo4o.cloudfront.net/verdaccio/localized.svg)](https://crowdin.com/project/verdaccio)
 
-[![Twitter followers](https://img.shields.io/twitter/follow/verdaccio_npm.svg?style=social&label=Follow)](https://twitter.com/verdaccio_npm)
 [![Github](https://img.shields.io/github/stars/verdaccio/verdaccio.svg?style=social&label=Stars)](https://github.com/verdaccio/verdaccio/stargazers)
 [![StandWithUkraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://github.com/vshymanskyy/StandWithUkraine/blob/main/docs/README.md)
 

docker-examples/v6/plugins/docker-local-plugin/plugins/verdaccio-docker-memory/lib/local-memory.js

@@ -91,8 +91,8 @@ class LocalMemory {
       (_this$data = this.data) === null || _this$data === void 0
         ? void 0
         : (_this$data$list = _this$data.list) === null || _this$data$list === void 0
-        ? void 0
+          ? void 0
-        : _this$data$list.length
+          : _this$data$list.length
     );
     return Promise.resolve(
       (_this$data2 = this.data) === null || _this$data2 === void 0 ? void 0 : _this$data2.list

e2e/cli/cli-commons/package.json

@@ -5,16 +5,16 @@
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
   "devDependencies": {
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
     "debug": "4.3.4",
-    "fs-extra": "10.1.0",
+    "fs-extra": "11.2.0",
+    "get-port": "5.1.1",
     "got": "11.8.6",
     "js-yaml": "4.1.0",
-    "get-port": "5.1.1",
     "lodash": "4.17.21",
-    "verdaccio": "workspace:7.0.0-next.4"
+    "verdaccio": "workspace:7.0.0-next.5"
   },
   "scripts": {
     "test": "jest",

e2e/cli/e2e-npm10/package.json

@@ -4,7 +4,7 @@
   "version": "1.0.1",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:1.1.0",
-    "npm": "10.1.0"
+    "npm": "10.2.5"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm6/package.json

@@ -4,7 +4,7 @@
   "version": "1.0.1",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:1.1.0",
-    "npm": "9.7.1"
+    "npm": "9.9.2"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm7/package.json

@@ -4,7 +4,7 @@
   "version": "1.0.1",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:1.1.0",
-    "npm": "9.7.1"
+    "npm": "9.9.2"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm8/package.json

@@ -4,7 +4,7 @@
   "version": "1.0.1",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:1.1.0",
-    "npm": "9.7.1"
+    "npm": "9.9.2"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-npm9/package.json

@@ -4,7 +4,7 @@
   "version": "1.0.1",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:1.1.0",
-    "npm": "9.7.1"
+    "npm": "9.9.2"
   },
   "scripts": {
     "test": "jest"

e2e/cli/e2e-yarn1/package.json

@@ -4,7 +4,7 @@
   "version": "1.0.1",
   "dependencies": {
     "@verdaccio/test-cli-commons": "workspace:1.1.0",
-    "yarn": "1.22.19"
+    "yarn": "1.22.21"
   },
   "scripts": {
     "test": "jest"

e2e/ui/cypress.config.ts

@@ -9,6 +9,10 @@ import { generatePackageMetadata } from '@verdaccio/test-helper';
 
 let registry1;
 export default defineConfig({
+  retries: {
+    runMode: 5,
+    openMode: 0,
+  },
   e2e: {
     setupNodeEvents(on) {
       on('before:run', async () => {

e2e/ui/package.json

@@ -3,12 +3,12 @@
   "name": "@verdaccio/e2e-ui",
   "version": "2.0.0",
   "devDependencies": {
-    "verdaccio": "workspace:7.0.0-next.4",
+    "verdaccio": "workspace:7.0.0-next.5",
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/test-helper": "workspace:3.0.0-next.0",
+    "@verdaccio/test-helper": "workspace:3.0.0-next.1",
     "debug": "4.3.4",
-    "cypress": "^11.2.0",
+    "cypress": "^13.6.0",
     "get-port": "5.1.1"
   },
   "scripts": {

netlify.toml

@@ -17,3 +17,11 @@
 
 [[plugins]]
 package = "../.netlify/netlify-plugin-pnpm"
+
+[[headers]]
+for = "/*"
+[headers.values]
+X-Frame-Options = "DENY"
+X-XSS-Protection = "1; mode=block"
+X-Content-Type-Options = "nosniff"
+Referrer-Policy = "no-referrer"

package.json

@@ -15,92 +15,90 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@babel/cli": "7.23.0",
+    "@babel/cli": "7.23.4",
-    "@babel/core": "7.23.2",
+    "@babel/core": "7.23.7",
-    "@babel/eslint-parser": "7.22.15",
+    "@babel/eslint-parser": "7.23.3",
     "@babel/node": "7.22.19",
     "@babel/plugin-proposal-class-properties": "7.18.6",
-    "@babel/plugin-proposal-decorators": "7.23.2",
+    "@babel/plugin-proposal-decorators": "7.23.7",
     "@babel/plugin-proposal-export-namespace-from": "7.18.9",
-    "@babel/plugin-proposal-function-sent": "7.22.5",
+    "@babel/plugin-proposal-function-sent": "7.23.3",
     "@babel/plugin-proposal-json-strings": "7.18.6",
     "@babel/plugin-proposal-nullish-coalescing-operator": "7.18.6",
     "@babel/plugin-proposal-numeric-separator": "7.18.6",
     "@babel/plugin-proposal-object-rest-spread": "7.20.7",
     "@babel/plugin-proposal-optional-chaining": "7.21.0",
-    "@babel/plugin-proposal-throw-expressions": "7.22.5",
+    "@babel/plugin-proposal-throw-expressions": "7.23.3",
     "@babel/plugin-syntax-dynamic-import": "7.8.3",
     "@babel/plugin-syntax-import-meta": "7.10.4",
-    "@babel/plugin-transform-async-to-generator": "7.22.5",
+    "@babel/plugin-transform-async-to-generator": "7.23.3",
-    "@babel/plugin-transform-classes": "7.22.15",
+    "@babel/plugin-transform-classes": "7.23.5",
-    "@babel/plugin-transform-runtime": "7.23.2",
+    "@babel/plugin-transform-runtime": "7.23.7",
-    "@babel/preset-env": "7.23.2",
+    "@babel/preset-env": "7.23.7",
-    "@babel/preset-react": "7.22.15",
+    "@babel/preset-react": "7.23.3",
-    "@babel/preset-typescript": "7.23.2",
+    "@babel/preset-typescript": "7.23.3",
-    "@babel/register": "7.22.15",
+    "@babel/register": "7.23.7",
-    "@babel/runtime": "7.23.2",
+    "@babel/runtime": "7.23.7",
-    "@changesets/changelog-github": "0.4.8",
+    "@changesets/changelog-github": "0.5.0",
-    "@changesets/cli": "2.24.4",
+    "@changesets/cli": "2.27.1",
     "@changesets/get-dependents-graph": "1.3.6",
-    "@crowdin/cli": "3.14.0",
+    "@crowdin/cli": "3.15.0",
     "@dianmora/contributors": "5.0.0",
     "@emotion/react": "11.10.6",
     "@emotion/styled": "11.10.6",
     "@testing-library/dom": "9.3.3",
-    "@testing-library/jest-dom": "6.1.4",
+    "@testing-library/jest-dom": "6.1.6",
-    "@testing-library/react": "14.0.0",
+    "@testing-library/react": "14.1.2",
-    "@trivago/prettier-plugin-sort-imports": "^4.2.0",
+    "@trivago/prettier-plugin-sort-imports": "4.3.0",
-    "@types/async": "3.2.21",
+    "@types/body-parser": "1.19.5",
-    "@types/body-parser": "1.19.2",
+    "@types/connect": "3.4.38",
-    "@types/connect": "3.4.36",
+    "@types/cookiejar": "2.1.5",
-    "@types/cookiejar": "2.1.2",
+    "@types/debug": "4.1.12",
-    "@types/debug": "^4.1.9",
+    "@types/express": "4.17.21",
-    "@types/express": "4.17.18",
+    "@types/express-serve-static-core": "4.17.41",
-    "@types/express-serve-static-core": "4.17.37",
+    "@types/http-errors": "2.0.4",
-    "@types/http-errors": "2.0.2",
+    "@types/jest": "29.5.11",
-    "@types/jest": "29.5.5",
+    "@types/jsonwebtoken": "9.0.5",
-    "@types/jsonwebtoken": "9.0.3",
+    "@types/lodash": "4.14.202",
-    "@types/lodash": "4.14.199",
+    "@types/mime": "3.0.4",
-    "@types/mime": "3.0.2",
     "@types/minimatch": "5.1.2",
-    "@types/node": "20.8.3",
+    "@types/node": "20.10.6",
-    "@types/node-fetch": "2.6.6",
+    "@types/node-fetch": "2.6.10",
-    "@types/qs": "6.9.8",
+    "@types/qs": "6.9.11",
-    "@types/range-parser": "1.2.5",
+    "@types/range-parser": "1.2.7",
-    "@types/react": "18.2.25",
+    "@types/react": "18.2.46",
-    "@types/react-dom": "18.2.11",
+    "@types/react-dom": "18.2.18",
     "@types/react-router-dom": "5.3.3",
-    "@types/react-virtualized": "9.21.23",
+    "@types/react-virtualized": "9.21.29",
     "@types/redux": "3.6.0",
-    "@types/request": "2.48.9",
+    "@types/semver": "7.5.6",
-    "@types/semver": "7.5.3",
+    "@types/send": "0.17.4",
-    "@types/send": "0.17.2",
+    "@types/serve-static": "1.15.5",
-    "@types/serve-static": "1.15.3",
+    "@types/superagent": "4.1.24",
-    "@types/superagent": "4.1.19",
+    "@types/supertest": "2.0.16",
-    "@types/supertest": "2.0.14",
     "@types/testing-library__jest-dom": "6.0.0",
-    "@types/validator": "13.11.2",
+    "@types/validator": "13.11.7",
-    "@types/webpack": "5.28.3",
+    "@types/webpack": "5.28.5",
-    "@types/webpack-env": "1.18.2",
+    "@types/webpack-env": "1.18.4",
-    "@typescript-eslint/eslint-plugin": "6.9.0",
+    "@typescript-eslint/eslint-plugin": "6.16.0",
-    "@typescript-eslint/parser": "6.9.0",
+    "@typescript-eslint/parser": "6.16.0",
     "@verdaccio/crowdin-translations": "workspace:*",
     "@verdaccio/eslint-config": "workspace:*",
     "@verdaccio/types": "workspace:*",
     "@verdaccio/ui-theme": "workspace:*",
-    "@vitest/coverage-v8": "^0.34.6",
+    "@vitest/coverage-v8": "0.34.6",
     "babel-core": "7.0.0-bridge.0",
     "babel-jest": "29.7.0",
     "babel-plugin-dynamic-import-node": "2.3.3",
     "babel-plugin-emotion": "11.0.0",
-    "concurrently": "6.5.1",
+    "concurrently": "8.2.2",
     "cross-env": "7.0.3",
     "debug": "4.3.4",
     "detect-secrets": "1.0.6",
-    "eslint": "8.52.0",
+    "eslint": "8.56.0",
-    "fs-extra": "10.1.0",
+    "fs-extra": "11.2.0",
     "got": "11.8.6",
-    "husky": "7.0.4",
+    "husky": "8.0.3",
     "in-publish": "2.0.1",
     "jest": "29.7.0",
     "jest-diff": "29.7.0",
@@ -110,23 +108,24 @@
     "jest-junit": "16.0.0",
     "kleur": "4.1.5",
     "lint-staged": "11.2.6",
-    "nock": "13.3.3",
+    "nock": "13.4.0",
-    "nodemon": "2.0.22",
+    "nodemon": "3.0.2",
     "npm-run-all": "4.1.5",
-    "prettier": "2.8.8",
+    "prettier": "3.1.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
-    "rimraf": "3.0.2",
+    "rimraf": "5.0.5",
-    "selfsigned": "1.10.14",
+    "selfsigned": "2.4.1",
     "supertest": "6.3.3",
-    "ts-node": "10.9.1",
+    "ts-node": "10.9.2",
     "typescript": "5.2.2",
-    "update-ts-references": "2.6.1",
+    "undici-types": "5.28.2",
+    "update-ts-references": "3.2.1",
     "verdaccio-audit": "workspace:*",
     "verdaccio-auth-memory": "workspace:*",
     "verdaccio-htpasswd": "workspace:*",
     "verdaccio-memory": "workspace:*",
-    "vitest": "^0.34.3"
+    "vitest": "0.34.6"
   },
   "scripts": {
     "prepare": "husky install",
@@ -172,12 +171,6 @@
     "local:publish": "cross-env npm_config_registry=http://localhost:4873 changeset publish --no-git-tag",
     "local:publish:release": "concurrently \"pnpm local:registry\" \"pnpm local:publish\""
   },
-  "pnpm": {
-    "overrides": {
-      "got": "11.8.5",
-      "p-cancelable": "2.1.1"
-    }
-  },
   "engines": {
     "node": ">=18"
   },

packages/api/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @verdaccio/api
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/middleware@7.0.0-next.5
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/config@7.0.0-next.5
+  - @verdaccio/auth@7.0.0-next.5
+  - @verdaccio/store@7.0.0-next.5
+  - @verdaccio/logger@7.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/api",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -38,16 +38,16 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/auth": "workspace:7.0.0-next.4",
+    "@verdaccio/auth": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "@verdaccio/middleware": "workspace:7.0.0-next.4",
+    "@verdaccio/middleware": "workspace:7.0.0-next.5",
-    "@verdaccio/store": "workspace:7.0.0-next.4",
+    "@verdaccio/store": "workspace:7.0.0-next.5",
-    "@verdaccio/utils": "workspace:7.0.0-next.4",
+    "@verdaccio/utils": "workspace:7.0.0-next.5",
     "abortcontroller-polyfill": "1.7.5",
     "body-parser": "1.20.2",
-    "cookies": "0.8.0",
+    "cookies": "0.9.0",
     "debug": "4.3.4",
     "express": "4.18.2",
     "lodash": "4.17.21",
@@ -55,11 +55,10 @@
     "semver": "7.5.4"
   },
   "devDependencies": {
-    "@verdaccio/server": "workspace:7.0.0-next.4",
+    "@verdaccio/test-helper": "workspace:3.0.0-next.1",
-    "@verdaccio/test-helper": "workspace:3.0.0-next.0",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
     "mockdate": "3.0.5",
-    "nock": "13.3.3",
+    "nock": "13.4.0",
     "supertest": "6.3.3"
   },
   "funding": {

packages/auth/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @verdaccio/auth
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/signature@7.0.0-next.3
+  - @verdaccio/config@7.0.0-next.5
+  - @verdaccio/loaders@7.0.0-next.5
+  - @verdaccio/logger@7.0.0-next.5
+  - verdaccio-htpasswd@12.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/auth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/auth",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -38,19 +38,21 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/loaders": "workspace:7.0.0-next.4",
+    "@verdaccio/loaders": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "@verdaccio/signature": "workspace:7.0.0-next.2",
+    "@verdaccio/signature": "workspace:7.0.0-next.3",
-    "@verdaccio/utils": "workspace:7.0.0-next.4",
+    "@verdaccio/utils": "workspace:7.0.0-next.5",
     "debug": "4.3.4",
-    "express": "4.18.2",
     "lodash": "4.17.21",
-    "verdaccio-htpasswd": "workspace:12.0.0-next.4"
+    "verdaccio-htpasswd": "workspace:12.0.0-next.5"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "express": "4.18.2",
+    "supertest": "6.3.3",
+    "@verdaccio/middleware": "workspace:7.0.0-next.5",
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "funding": {
     "type": "opencollective",

packages/auth/src/auth.ts

@@ -1,5 +1,4 @@
 import buildDebug from 'debug';
-import { NextFunction, Request, Response } from 'express';
 import _ from 'lodash';
 import { HTPasswd } from 'verdaccio-htpasswd';
 
@@ -12,22 +11,36 @@ import {
   VerdaccioError,
   errorUtils,
   pluginUtils,
+  warningUtils,
 } from '@verdaccio/core';
+import '@verdaccio/core';
 import { asyncLoadPlugin } from '@verdaccio/loaders';
 import { logger } from '@verdaccio/logger';
-import { aesEncrypt, parseBasicPayload, signPayload } from '@verdaccio/signature';
+import {
+  aesEncrypt,
+  aesEncryptDeprecated,
+  parseBasicPayload,
+  signPayload,
+} from '@verdaccio/signature';
 import {
   AllowAccess,
   Callback,
   Config,
   JWTSignOptions,
-  Logger,
   PackageAccess,
   RemoteUser,
   Security,
 } from '@verdaccio/types';
 import { getMatchedPackagesSpec, isFunction, isNil } from '@verdaccio/utils';
 
+import {
+  $RequestExtend,
+  $ResponseExtend,
+  AESPayload,
+  IAuthMiddleware,
+  NextFunction,
+  TokenEncryption,
+} from './types';
 import {
   convertPayloadToBase64,
   getDefaultPlugins,
@@ -40,25 +53,6 @@ import {
 
 const debug = buildDebug('verdaccio:auth');
 
-export interface TokenEncryption {
-  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
-  aesEncrypt(buf: string): string | void;
-}
-
-// remove
-export interface AESPayload {
-  user: string;
-  password: string;
-}
-export interface IAuthMiddleware {
-  apiJWTmiddleware(): $NextFunctionVer;
-  webUIJWTmiddleware(): $NextFunctionVer;
-}
-
-export type $RequestExtend = Request & { remote_user?: any; log: Logger };
-export type $ResponseExtend = Response & { cookies?: any };
-export type $NextFunctionVer = NextFunction & any;
-
 class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   public config: Config;
   public secret: string;
@@ -75,6 +69,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
   public async init() {
     let plugins = (await this.loadPlugin()) as pluginUtils.Auth<unknown>[];
+
     debug('auth plugins found %s', plugins.length);
     if (!plugins || plugins.length === 0) {
       plugins = this.loadDefaultPlugin();
@@ -226,29 +221,32 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     debug('add user %o', user);
 
     (function next(): void {
+      let method = 'adduser';
       const plugin = plugins.shift() as pluginUtils.Auth<Config>;
-      if (typeof plugin.adduser !== 'function') {
+      // @ts-expect-error future major (7.x) should remove this section
+      if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
+        method = 'add_user';
+        warningUtils.emit(warningUtils.Codes.VERWAR006);
+      }
+      // @ts-ignore
+      if (typeof plugin[method] !== 'function') {
         next();
       } else {
-        // @ts-expect-error future major (7.x) should remove this section
+        // TODO: replace by adduser whenever add_user deprecation method has been removed
-        if (typeof plugin.adduser === 'undefined' && typeof plugin.add_user === 'function') {
+        // @ts-ignore
-          throw errorUtils.getInternalError(
+        plugin[method](
-            'add_user method not longer supported, rename to adduser'
-          );
-        }
-
-        plugin.adduser(
           user,
           password,
           function (err: VerdaccioError | null, ok?: boolean | string): void {
             if (err) {
-              debug('the user  %o could not being added. Error: %o', user, err?.message);
+              debug('the user %o could not being added. Error: %o', user, err?.message);
               return cb(err);
             }
             if (ok) {
               debug('the user %o has been added', user);
               return self.authenticate(user, password, cb);
             }
+            debug('user could not be added, skip to next auth plugin');
             next();
           }
         );
@@ -375,7 +373,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     })();
   }
 
-  public apiJWTmiddleware() {
+  public apiJWTmiddleware(): any {
     debug('jwt middleware');
     const plugins = this.plugins.slice(0);
     const helpers = { createAnonymousRemoteUser, createRemoteUser };
@@ -387,8 +385,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
     return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction) => {
       req.pause();
-
+      const next = function (err?: VerdaccioError): NextFunction {
-      const next = function (err?: VerdaccioError): any {
         req.resume();
         // uncomment this to reject users with bad auth headers
         // return _next.apply(null, arguments)
@@ -398,13 +395,14 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
           req.remote_user.error = err.message;
         }
 
-        return _next();
+        return _next() as unknown as NextFunction;
       };
 
-      if (this._isRemoteUserValid(req.remote_user)) {
+      // FUTURE: disabled, not removed yet but seems unreacable code
-        debug('jwt has a valid authentication header');
+      // if (this._isRemoteUserValid(req.remote_user)) {
-        return next();
+      //   debug('jwt has a valid authentication header');
-      }
+      //   return next();
+      // }
 
       // in case auth header does not exist we return anonymous function
       const remoteUser = createAnonymousRemoteUser();
@@ -425,20 +423,20 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
 
       if (isAESLegacy(security)) {
         debug('api middleware using legacy auth token');
-        this._handleAESMiddleware(req, security, secret, authorization, next);
+        this.handleAESMiddleware(req, security, secret, authorization, next);
       } else {
         debug('api middleware using JWT auth token');
-        this._handleJWTAPIMiddleware(req, security, secret, authorization, next);
+        this.handleJWTAPIMiddleware(req, security, secret, authorization, next);
       }
     };
   }
 
-  private _handleJWTAPIMiddleware(
+  private handleJWTAPIMiddleware(
     req: $RequestExtend,
     security: Security,
     secret: string,
     authorization: string,
-    next: Function
+    next: any
   ): void {
     debug('handle JWT api middleware');
     const { scheme, token } = parseAuthTokenHeader(authorization);
@@ -475,7 +473,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     }
   }
 
-  private _handleAESMiddleware(
+  private handleAESMiddleware(
     req: $RequestExtend,
     security: Security,
     secret: string,
@@ -485,7 +483,12 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
     debug('handle legacy api middleware');
     debug('api middleware secret %o', typeof secret === 'string');
     debug('api middleware authorization %o', typeof authorization === 'string');
-    const credentials: any = getMiddlewareCredentials(security, secret, authorization);
+    const credentials: any = getMiddlewareCredentials(
+      security,
+      secret,
+      authorization,
+      this.config?.getEnhancedLegacySignature()
+    );
     debug('api middleware credentials %o', credentials?.name);
     if (credentials) {
       const { user, password } = credentials;
@@ -515,7 +518,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
   /**
    * JWT middleware for WebUI
    */
-  public webUIJWTmiddleware(): $NextFunctionVer {
+  public webUIJWTmiddleware() {
     return (req: $RequestExtend, res: $ResponseExtend, _next: NextFunction): void => {
       if (this._isRemoteUserValid(req.remote_user)) {
         return _next();
@@ -525,7 +528,7 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
       const next = (err: VerdaccioError | void): void => {
         req.resume();
         if (err) {
-          // req.remote_user.error = err.message;
+          req.remote_user.error = err.message;
           res.status(err.statusCode).send(err.message);
         }
 
@@ -576,7 +579,6 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
       name,
       groups: groupedGroups,
     };
-
     const token: string = await signPayload(payload, this.secret, signOptions);
 
     return token;
@@ -586,7 +588,17 @@ class Auth implements IAuthMiddleware, TokenEncryption, pluginUtils.IBasicAuth {
    * Encrypt a string.
    */
   public aesEncrypt(value: string): string | void {
-    return aesEncrypt(value, this.secret);
+    // enhancedLegacySignature enables modern aes192 algorithm signature
+    if (this.config?.getEnhancedLegacySignature()) {
+      debug('signing with enhaced aes legacy');
+      const token = aesEncrypt(value, this.secret);
+      return token;
+    } else {
+      debug('signing with enhaced aes deprecated legacy');
+      // deprecated aes (legacy) signature, only must be used for legacy version
+      const token = aesEncryptDeprecated(Buffer.from(value), this.secret).toString('base64');
+      return token;
+    }
   }
 }
 

packages/auth/src/index.ts

@@ -1,2 +1,3 @@
 export { Auth } from './auth';
 export * from './utils';
+export * from './types';

packages/auth/src/signature-legacy.ts

@@ -0,0 +1,66 @@
+import buildDebug from 'debug';
+import _ from 'lodash';
+
+import { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
+import { aesDecryptDeprecated as aesDecrypt, parseBasicPayload } from '@verdaccio/signature';
+import { Security } from '@verdaccio/types';
+
+import { AuthMiddlewarePayload } from './types';
+import {
+  convertPayloadToBase64,
+  isAESLegacy,
+  parseAuthTokenHeader,
+  verifyJWTPayload,
+} from './utils';
+
+const debug = buildDebug('verdaccio:auth:utils');
+
+export function parseAESCredentials(authorizationHeader: string, secret: string) {
+  debug('parseAESCredentials');
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  // basic is deprecated and should not be enforced
+  // basic is currently being used for functional test
+  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
+    debug('legacy header basic');
+    const credentials = convertPayloadToBase64(token).toString();
+
+    return credentials;
+  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    debug('legacy header bearer');
+    const credentials = aesDecrypt(Buffer.from(token), secret);
+
+    return credentials;
+  }
+}
+
+export function getMiddlewareCredentials(
+  security: Security,
+  secretKey: string,
+  authorizationHeader: string
+): AuthMiddlewarePayload {
+  debug('getMiddlewareCredentials');
+  // comment out for debugging purposes
+  if (isAESLegacy(security)) {
+    debug('is legacy');
+    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    if (typeof credentials !== 'string') {
+      debug('parse legacy credentials failed');
+      return;
+    }
+
+    const parsedCredentials = parseBasicPayload(credentials);
+    if (!parsedCredentials) {
+      debug('parse legacy basic payload credentials failed');
+      return;
+    }
+
+    return parsedCredentials;
+  }
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  debug('is jwt');
+  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    return verifyJWTPayload(token, secretKey);
+  }
+}

packages/auth/src/signature.ts

@@ -0,0 +1,66 @@
+import buildDebug from 'debug';
+import _ from 'lodash';
+
+import { TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
+import { aesDecrypt, parseBasicPayload } from '@verdaccio/signature';
+import { Security } from '@verdaccio/types';
+
+import { AuthMiddlewarePayload } from './types';
+import {
+  convertPayloadToBase64,
+  isAESLegacy,
+  parseAuthTokenHeader,
+  verifyJWTPayload,
+} from './utils';
+
+const debug = buildDebug('verdaccio:auth:utils');
+
+export function parseAESCredentials(authorizationHeader: string, secret: string) {
+  debug('parseAESCredentials');
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  // basic is deprecated and should not be enforced
+  // basic is currently being used for functional test
+  if (scheme.toUpperCase() === TOKEN_BASIC.toUpperCase()) {
+    debug('legacy header basic');
+    const credentials = convertPayloadToBase64(token).toString();
+
+    return credentials;
+  } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    debug('legacy header bearer');
+    const credentials = aesDecrypt(token, secret);
+
+    return credentials;
+  }
+}
+
+export function getMiddlewareCredentials(
+  security: Security,
+  secretKey: string,
+  authorizationHeader: string
+): AuthMiddlewarePayload {
+  debug('getMiddlewareCredentials');
+  // comment out for debugging purposes
+  if (isAESLegacy(security)) {
+    debug('is legacy');
+    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    if (!credentials) {
+      debug('parse legacy credentials failed');
+      return;
+    }
+
+    const parsedCredentials = parseBasicPayload(credentials);
+    if (!parsedCredentials) {
+      debug('parse legacy basic payload credentials failed');
+      return;
+    }
+
+    return parsedCredentials;
+  }
+  const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
+
+  debug('is jwt');
+  if (_.isString(token) && scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
+    return verifyJWTPayload(token, secretKey);
+  }
+}

packages/auth/src/types.ts

@@ -0,0 +1,46 @@
+import { NextFunction, Request, Response } from 'express';
+
+import { VerdaccioError } from '@verdaccio/core';
+import { AuthPackageAllow, JWTSignOptions, Logger, RemoteUser } from '@verdaccio/types';
+
+export interface AESPayload {
+  user: string;
+  password: string;
+}
+
+export type BasicPayload = AESPayload | void;
+export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
+
+export interface AuthTokenHeader {
+  scheme: string;
+  token: string;
+}
+export type AllowActionCallbackResponse = boolean | undefined;
+export type AllowActionCallback = (
+  error: VerdaccioError | null,
+  allowed?: AllowActionCallbackResponse
+) => void;
+
+export type AllowAction = (
+  user: RemoteUser,
+  pkg: AuthPackageAllow,
+  callback: AllowActionCallback
+) => void;
+
+export interface TokenEncryption {
+  jwtEncrypt(user: RemoteUser, signOptions: JWTSignOptions): Promise<string>;
+  aesEncrypt(buf: string): string | void;
+}
+
+export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
+
+// remove
+export interface IAuthMiddleware {
+  apiJWTmiddleware(): $NextFunctionVer;
+  webUIJWTmiddleware(): $NextFunctionVer;
+}
+
+export type $RequestExtend = Request & { remote_user?: any; log: Logger };
+export type $ResponseExtend = Response & { cookies?: any };
+export type $NextFunctionVer = NextFunction & any;
+export { NextFunction };

packages/auth/src/utils.ts

@@ -7,36 +7,28 @@ import {
   HTTP_STATUS,
   TOKEN_BASIC,
   TOKEN_BEARER,
-  VerdaccioError,
   errorUtils,
   pluginUtils,
 } from '@verdaccio/core';
-import { aesDecrypt, parseBasicPayload, verifyPayload } from '@verdaccio/signature';
+import {
+  aesDecrypt,
+  aesDecryptDeprecated,
+  parseBasicPayload,
+  verifyPayload,
+} from '@verdaccio/signature';
 import { AuthPackageAllow, Config, Logger, RemoteUser, Security } from '@verdaccio/types';
 
-import { AESPayload, TokenEncryption } from './auth';
+import {
+  ActionsAllowed,
+  AllowAction,
+  AllowActionCallback,
+  AuthMiddlewarePayload,
+  AuthTokenHeader,
+  TokenEncryption,
+} from './types';
 
 const debug = buildDebug('verdaccio:auth:utils');
 
-export type BasicPayload = AESPayload | void;
-export type AuthMiddlewarePayload = RemoteUser | BasicPayload;
-
-export interface AuthTokenHeader {
-  scheme: string;
-  token: string;
-}
-export type AllowActionCallbackResponse = boolean | undefined;
-export type AllowActionCallback = (
-  error: VerdaccioError | null,
-  allowed?: AllowActionCallbackResponse
-) => void;
-
-export type AllowAction = (
-  user: RemoteUser,
-  pkg: AuthPackageAllow,
-  callback: AllowActionCallback
-) => void;
-
 /**
  * Split authentication header eg: Bearer [secret_token]
  * @param authorizationHeader auth token
@@ -48,7 +40,11 @@ export function parseAuthTokenHeader(authorizationHeader: string): AuthTokenHead
   return { scheme, token };
 }
 
-export function parseAESCredentials(authorizationHeader: string, secret: string) {
+export function parseAESCredentials(
+  authorizationHeader: string,
+  secret: string,
+  enhanced: boolean
+) {
   debug('parseAESCredentials');
   const { scheme, token } = parseAuthTokenHeader(authorizationHeader);
 
@@ -61,7 +57,11 @@ export function parseAESCredentials(authorizationHeader: string, secret: string)
     return credentials;
   } else if (scheme.toUpperCase() === TOKEN_BEARER.toUpperCase()) {
     debug('legacy header bearer');
-    const credentials = aesDecrypt(token, secret);
+    debug('legacy header enhanced?', enhanced);
+    const credentials = enhanced
+      ? aesDecrypt(token.toString(), secret)
+      : // FUTURE: once deprecated legacy is removed this logic won't be longer need it
+        aesDecryptDeprecated(convertPayloadToBase64(token), secret).toString('utf-8');
 
     return credentials;
   }
@@ -70,13 +70,14 @@ export function parseAESCredentials(authorizationHeader: string, secret: string)
 export function getMiddlewareCredentials(
   security: Security,
   secretKey: string,
-  authorizationHeader: string
+  authorizationHeader: string,
+  enhanced: boolean = true
 ): AuthMiddlewarePayload {
   debug('getMiddlewareCredentials');
   // comment out for debugging purposes
   if (isAESLegacy(security)) {
     debug('is legacy');
-    const credentials = parseAESCredentials(authorizationHeader, secretKey);
+    const credentials = parseAESCredentials(authorizationHeader, secretKey, enhanced);
     if (!credentials) {
       debug('parse legacy credentials failed');
       return;
@@ -161,14 +162,15 @@ export function isAuthHeaderValid(authorization: string): boolean {
 export function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {
   return {
     authenticate(_user: string, _password: string, cb: pluginUtils.AuthCallback): void {
+      debug('triggered default authenticate method');
       cb(errorUtils.getForbidden(API_ERROR.BAD_USERNAME_PASSWORD));
     },
 
     adduser(_user: string, _password: string, cb: pluginUtils.AuthUserCallback): void {
+      debug('triggered default adduser method');
       return cb(errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD));
     },
 
-    // FIXME: allow_action and allow_publish should be in the @verdaccio/types
     // @ts-ignore
     allow_access: allow_action('access', logger),
     // @ts-ignore
@@ -177,8 +179,6 @@ export function getDefaultPlugins(logger: Logger): pluginUtils.Auth<Config> {
   };
 }
 
-export type ActionsAllowed = 'publish' | 'unpublish' | 'access';
-
 export function allow_action(action: ActionsAllowed, logger: Logger): AllowAction {
   return function allowActionCallback(
     user: RemoteUser,
@@ -187,8 +187,13 @@ export function allow_action(action: ActionsAllowed, logger: Logger): AllowActio
   ): void {
     logger.trace({ remote: user.name }, `[auth/allow_action]: user: @{remote}`);
     const { name, groups } = user;
+    debug('allow_action "%s": groups %s', action, groups);
     const groupAccess = pkg[action] as string[];
-    const hasPermission = groupAccess.some((group) => name === group || groups.includes(group));
+    debug('allow_action "%s": groupAccess %s', action, groupAccess);
+    const hasPermission = groupAccess.some((group) => {
+      return name === group || groups.includes(group);
+    });
+    debug('package "%s" has permission "%s"', name, hasPermission);
     logger.trace(
       { pkgName: pkg.name, hasPermission, remote: user.name, groupAccess },
       `[auth/allow_action]: hasPermission? @{hasPermission} for user: @{remote}, package: @{pkgName}`
@@ -218,7 +223,8 @@ export function handleSpecialUnpublish(logger: Logger): any {
   return function (user: RemoteUser, pkg: AuthPackageAllow, callback: AllowActionCallback): void {
     const action = 'unpublish';
     // verify whether the unpublish prop has been defined
-    const isUnpublishMissing: boolean = _.isNil(pkg[action]);
+    const isUnpublishMissing: boolean = !pkg[action];
+    debug('is unpublish method missing ? %s', isUnpublishMissing);
     const hasGroups: boolean = isUnpublishMissing ? false : (pkg[action] as string[]).length > 0;
     logger.trace(
       { user: user.name, name: pkg.name, hasGroups },

packages/auth/test/auth.spec.ts

@@ -1,47 +1,79 @@
+import express from 'express';
 import path from 'path';
+import supertest from 'supertest';
 
-import { Config as AppConfig, ROLES, getDefaultConfig } from '@verdaccio/config';
+import { Config as AppConfig, ROLES, createRemoteUser, getDefaultConfig } from '@verdaccio/config';
-import { errorUtils } from '@verdaccio/core';
+import {
-import { setup } from '@verdaccio/logger';
+  API_ERROR,
+  HEADERS,
+  HTTP_STATUS,
+  SUPPORT_ERRORS,
+  TOKEN_BEARER,
+  errorUtils,
+} from '@verdaccio/core';
+import { logger, setup } from '@verdaccio/logger';
+import { errorReportingMiddleware, final, handleError } from '@verdaccio/middleware';
 import { Config } from '@verdaccio/types';
+import { buildToken } from '@verdaccio/utils';
 
-import { Auth } from '../src';
+import { $RequestExtend, Auth } from '../src';
-import { authPluginFailureConf, authPluginPassThrougConf, authProfileConf } from './helper/plugin';
+import {
+  authChangePasswordConf,
+  authPluginFailureConf,
+  authPluginPassThrougConf,
+  authProfileConf,
+} from './helper/plugin';
 
-setup({ level: 'debug', type: 'stdout' });
+setup({});
+
+// to avoid flaky test generate same ramdom key
+jest.mock('@verdaccio/utils', () => {
+  return {
+    ...jest.requireActual('@verdaccio/utils'),
+    // used by enhanced legacy aes signature (minimum 32 characters)
+    generateRandomSecretKey: () => 'GCYW/3IJzQI6GvPmy9sbMkFoiL7QLVw',
+    // used by legacy aes signature
+    generateRandomHexString: () =>
+      'ff065fcf7a8330ae37d3ea116328852f387ad7aa6defbe47fb68b1ea25f97446',
+  };
+});
 
 describe('AuthTest', () => {
-  test('should init correctly', async () => {
+  describe('default', () => {
-    const config: Config = new AppConfig({ ...authProfileConf });
+    test('should init correctly', async () => {
-    config.checkSecretKey('12345');
+      const config: Config = new AppConfig({ ...authProfileConf });
+      config.checkSecretKey('12345');
 
-    const auth: Auth = new Auth(config);
+      const auth: Auth = new Auth(config);
-    await auth.init();
+      await auth.init();
-    expect(auth).toBeDefined();
+      expect(auth).toBeDefined();
-  });
-
-  test('should load default auth plugin', async () => {
-    const config: Config = new AppConfig({ ...authProfileConf, auth: undefined });
-    config.checkSecretKey('12345');
-
-    const auth: Auth = new Auth(config);
-    await auth.init();
-    expect(auth).toBeDefined();
-  });
-
-  test('should load custom algorithm', async () => {
-    const config: Config = new AppConfig({
-      ...authProfileConf,
-      auth: { htpasswd: { algorithm: 'sha1', file: './foo' } },
     });
-    config.checkSecretKey('12345');
 
-    const auth: Auth = new Auth(config);
+    test('should load default auth plugin', async () => {
-    await auth.init();
+      const config: Config = new AppConfig({ ...authProfileConf, auth: undefined });
-    expect(auth).toBeDefined();
+      config.checkSecretKey('12345');
+
+      const auth: Auth = new Auth(config);
+      await auth.init();
+      expect(auth).toBeDefined();
+    });
   });
 
-  describe('test authenticate method', () => {
+  describe('utils', () => {
+    test('should load custom algorithm', async () => {
+      const config: Config = new AppConfig({
+        ...authProfileConf,
+        auth: { htpasswd: { algorithm: 'sha1', file: './foo' } },
+      });
+      config.checkSecretKey('12345');
+
+      const auth: Auth = new Auth(config);
+      await auth.init();
+      expect(auth).toBeDefined();
+    });
+  });
+
+  describe('authenticate', () => {
     describe('test authenticate states', () => {
       test('should be a success login', async () => {
         const config: Config = new AppConfig({ ...authProfileConf });
@@ -163,30 +195,519 @@ describe('AuthTest', () => {
         }
       });
     });
+
+    describe('test multiple authenticate methods', () => {
+      test('should skip falsy values', async () => {
+        const config: Config = new AppConfig({
+          ...getDefaultConfig(),
+          plugins: path.join(__dirname, './partials/plugin'),
+          auth: {
+            success: {},
+            'fail-invalid-method': {},
+          },
+        });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+
+        return new Promise((resolve) => {
+          auth.authenticate('foo', 'bar', (err, value) => {
+            expect(value).toEqual({
+              name: 'foo',
+              groups: ['test', ROLES.$ALL, '$authenticated', '@all', '@authenticated', 'all'],
+              real_groups: ['test'],
+            });
+            resolve(value);
+          });
+        });
+      });
+    });
   });
 
-  describe('test multiple authenticate methods', () => {
+  describe('changePassword', () => {
-    test('should skip falsy values', async () => {
+    test('should fail if the plugin does not provide implementation', async () => {
+      const config: Config = new AppConfig({ ...authProfileConf });
+      config.checkSecretKey('12345');
+      const auth: Auth = new Auth(config);
+      await auth.init();
+      expect(auth).toBeDefined();
+      const callback = jest.fn();
+
+      auth.changePassword('foo', 'bar', 'newFoo', callback);
+
+      expect(callback).toHaveBeenCalledTimes(1);
+      expect(callback).toHaveBeenCalledWith(
+        errorUtils.getInternalError(SUPPORT_ERRORS.PLUGIN_MISSING_INTERFACE)
+      );
+    });
+    test('should handle plugin does provide implementation', async () => {
+      const config: Config = new AppConfig({ ...authChangePasswordConf });
+      config.checkSecretKey('12345');
+      const auth: Auth = new Auth(config);
+      await auth.init();
+      expect(auth).toBeDefined();
+      const callback = jest.fn();
+      auth.add_user('foo', 'bar', jest.fn());
+      auth.changePassword('foo', 'bar', 'newFoo', callback);
+      expect(callback).toHaveBeenCalledTimes(1);
+      expect(callback).toHaveBeenCalledWith(null, true);
+    });
+  });
+
+  describe('allow_access', () => {
+    describe('no custom allow_access implementation provided', () => {
+      // when allow_access is not implemented, the groups must match
+      // exactly with the packages access group
+      test('should fails if groups do not match exactly', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        const groups = ['test'];
+
+        auth.allow_access(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(
+          errorUtils.getForbidden('user foo is not allowed to access package foo')
+        );
+      });
+
+      test('should success if groups do not match exactly', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        // $all comes from configuration file
+        const groups = [ROLES.$ALL];
+
+        auth.allow_access(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(null, true);
+      });
+    });
+  });
+
+  describe('allow_publish', () => {
+    describe('no custom allow_publish implementation provided', () => {
+      // when allow_access is not implemented, the groups must match
+      // exactly with the packages access group
+      test('should fails if groups do not match exactly', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        const groups = ['test'];
+
+        auth.allow_publish(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(
+          errorUtils.getForbidden('user foo is not allowed to publish package foo')
+        );
+      });
+
+      test('should success if groups do match exactly', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        // $all comes from configuration file
+        const groups = [ROLES.$AUTH];
+
+        auth.allow_publish(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(null, true);
+      });
+    });
+  });
+  describe('allow_unpublish', () => {
+    describe('no custom allow_unpublish implementation provided', () => {
+      test('should fails if groups do not match exactly', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+        config.checkSecretKey('12345');
+
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        const groups = ['test'];
+
+        auth.allow_unpublish(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(
+          errorUtils.getForbidden('user foo is not allowed to unpublish package foo')
+        );
+      });
+
+      test('should handle missing unpublish method (special case to handle legacy configurations)', async () => {
+        const config: Config = new AppConfig({
+          ...authProfileConf,
+          packages: {
+            ...authProfileConf.packages,
+            '**': {
+              access: ['$all'],
+              publish: ['$authenticated'],
+              // it forces publish handle the access
+              unpublish: undefined,
+              proxy: ['npmjs'],
+            },
+          },
+        });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        const groups = ['test'];
+
+        auth.allow_unpublish(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(
+          errorUtils.getForbidden('user foo is not allowed to publish package foo')
+        );
+      });
+
+      test('should success if groups do match exactly', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+        // $all comes from configuration file
+        const groups = [ROLES.$AUTH];
+
+        auth.allow_unpublish(
+          { packageName: 'foo' },
+          { name: 'foo', groups, real_groups: groups },
+          callback
+        );
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(null, true);
+      });
+    });
+  });
+
+  describe('add_user', () => {
+    describe('error handling', () => {
+      // when allow_access is not implemented, the groups must match
+      // exactly with the packages access group
+      test('should fails with bad password if adduser is not implemented', async () => {
+        const config: Config = new AppConfig({ ...authProfileConf });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+
+        auth.add_user('juan', 'password', callback);
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(
+          errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD)
+        );
+      });
+
+      test('should fails if adduser fails internally (exception)', async () => {
+        const config: Config = new AppConfig({
+          ...getDefaultConfig(),
+          plugins: path.join(__dirname, './partials/plugin'),
+          auth: {
+            adduser: {},
+          },
+        });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+
+        // note: fail uas username make plugin fails
+        auth.add_user('fail', 'password', callback);
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(new Error('bad username'));
+      });
+
+      test('should skip to the next plugin and fails', async () => {
+        const config: Config = new AppConfig({
+          ...getDefaultConfig(),
+          plugins: path.join(__dirname, './partials/plugin'),
+          auth: {
+            adduser: {},
+            // plugin implement adduser with fail auth
+            fail: {},
+          },
+        });
+        config.checkSecretKey('12345');
+        const auth: Auth = new Auth(config);
+        await auth.init();
+        expect(auth).toBeDefined();
+
+        const callback = jest.fn();
+
+        // note: fail uas username make plugin fails
+        auth.add_user('skip', 'password', callback);
+
+        expect(callback).toHaveBeenCalledTimes(1);
+        expect(callback).toHaveBeenCalledWith(
+          errorUtils.getConflict(API_ERROR.BAD_USERNAME_PASSWORD)
+        );
+      });
+    });
+    test('should success if adduser', async () => {
       const config: Config = new AppConfig({
         ...getDefaultConfig(),
         plugins: path.join(__dirname, './partials/plugin'),
         auth: {
-          success: {},
+          adduser: {},
-          'fail-invalid-method': {},
         },
       });
       config.checkSecretKey('12345');
       const auth: Auth = new Auth(config);
       await auth.init();
+      expect(auth).toBeDefined();
 
-      return new Promise((resolve) => {
+      const callback = jest.fn();
-        auth.authenticate('foo', 'bar', (err, value) => {
+
-          expect(value).toEqual({
+      auth.add_user('something', 'password', callback);
-            name: 'foo',
+
-            groups: ['test', '$all', '$authenticated', '@all', '@authenticated', 'all'],
+      expect(callback).toHaveBeenCalledTimes(1);
-            real_groups: ['test'],
+      expect(callback).toHaveBeenCalledWith(null, {
+        groups: ['test', '$all', '$authenticated', '@all', '@authenticated', 'all'],
+        name: 'something',
+        real_groups: ['test'],
+      });
+    });
+    test('should handle legacy add_user method', async () => {
+      const config: Config = new AppConfig({
+        ...getDefaultConfig(),
+        plugins: path.join(__dirname, './partials/plugin'),
+        auth: {
+          'adduser-legacy': {},
+        },
+      });
+      config.checkSecretKey('12345');
+      const auth: Auth = new Auth(config);
+      await auth.init();
+      expect(auth).toBeDefined();
+
+      const callback = jest.fn();
+
+      auth.add_user('something', 'password', callback);
+
+      expect(callback).toHaveBeenCalledTimes(1);
+      expect(callback).toHaveBeenCalledWith(null, {
+        groups: ['test', '$all', '$authenticated', '@all', '@authenticated', 'all'],
+        name: 'something',
+        real_groups: ['test'],
+      });
+    });
+  });
+  describe('middlewares', () => {
+    describe('apiJWTmiddleware', () => {
+      const secret = '12345';
+      const getServer = async function (auth) {
+        const app = express();
+        app.use(express.json({ strict: false, limit: '10mb' }));
+        // @ts-expect-error
+        app.use(errorReportingMiddleware(logger));
+        app.use(auth.apiJWTmiddleware());
+        app.get('/*', (req, res, next) => {
+          if ((req as $RequestExtend).remote_user.error) {
+            next(new Error((req as $RequestExtend).remote_user.error));
+          } else {
+            // @ts-expect-error
+            next({ user: req?.remote_user });
+          }
+        });
+        // @ts-expect-error
+        app.use(handleError(logger));
+        // @ts-expect-error
+        app.use(final);
+        return app;
+      };
+      describe('legacy signature', () => {
+        describe('error cases', () => {
+          test('should handle invalid auth token', async () => {
+            const config: Config = new AppConfig({ ...authProfileConf });
+            config.checkSecretKey(secret);
+            const auth = new Auth(config);
+            await auth.init();
+            const app = await getServer(auth);
+            return supertest(app)
+              .get(`/`)
+              .set(HEADERS.AUTHORIZATION, 'Bearer foo')
+              .expect(HTTP_STATUS.INTERNAL_ERROR);
+          });
+
+          test('should handle missing auth header', async () => {
+            const config: Config = new AppConfig({ ...authProfileConf });
+            config.checkSecretKey(secret);
+            const auth = new Auth(config);
+            await auth.init();
+            const app = await getServer(auth);
+            return supertest(app).get(`/`).expect(HTTP_STATUS.OK);
+          });
+        });
+
+        describe('deprecated legacy handling forceEnhancedLegacySignature=false', () => {
+          test('should handle valid auth token', async () => {
+            const payload = 'juan:password';
+            // const token = await signPayload(remoteUser, '12345');
+            const config: Config = new AppConfig(
+              { ...authProfileConf },
+              { forceEnhancedLegacySignature: false }
+            );
+            // intended to force key generator (associated with mocks above)
+            config.checkSecretKey(undefined);
+            const auth = new Auth(config);
+            await auth.init();
+            const token = auth.aesEncrypt(payload) as string;
+            const app = await getServer(auth);
+            const res = await supertest(app)
+              .get(`/`)
+              .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+              .expect(HTTP_STATUS.OK);
+            expect(res.body.user.name).toEqual('juan');
+          });
+
+          test('should handle invalid auth token', async () => {
+            const payload = 'juan:password';
+            const config: Config = new AppConfig(
+              { ...authPluginFailureConf },
+              { forceEnhancedLegacySignature: false }
+            );
+            // intended to force key generator (associated with mocks above)
+            config.checkSecretKey(undefined);
+            const auth = new Auth(config);
+            await auth.init();
+            const token = auth.aesEncrypt(payload) as string;
+            const app = await getServer(auth);
+            return await supertest(app)
+              .get(`/`)
+              .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+              .expect(HTTP_STATUS.INTERNAL_ERROR);
+          });
+        });
+      });
+      describe('jwt signature', () => {
+        describe('error cases', () => {
+          test('should handle invalid auth token and return anonymous', async () => {
+            // @ts-expect-error
+            const config: Config = new AppConfig({
+              ...authProfileConf,
+              ...{ security: { api: { jwt: { sign: { expiresIn: '29d' } } } } },
+            });
+            config.checkSecretKey(secret);
+            const auth = new Auth(config);
+            await auth.init();
+            const app = await getServer(auth);
+            const res = await supertest(app)
+              .get(`/`)
+              .set(HEADERS.AUTHORIZATION, 'Bearer foo')
+              .expect(HTTP_STATUS.OK);
+            expect(res.body.user.groups).toEqual([
+              ROLES.$ALL,
+              ROLES.$ANONYMOUS,
+              ROLES.DEPRECATED_ALL,
+              ROLES.DEPRECATED_ANONYMOUS,
+            ]);
+          });
+
+          test('should handle missing auth header', async () => {
+            // @ts-expect-error
+            const config: Config = new AppConfig({
+              ...authProfileConf,
+              ...{ security: { api: { jwt: { sign: { expiresIn: '29d' } } } } },
+            });
+            config.checkSecretKey(secret);
+            const auth = new Auth(config);
+            await auth.init();
+            const app = await getServer(auth);
+            const res = await supertest(app).get(`/`).expect(HTTP_STATUS.OK);
+            expect(res.body.user.groups).toEqual([
+              ROLES.$ALL,
+              ROLES.$ANONYMOUS,
+              ROLES.DEPRECATED_ALL,
+              ROLES.DEPRECATED_ANONYMOUS,
+            ]);
+          });
+        });
+        describe('valid signature handlers', () => {
+          test('should handle valid auth token', async () => {
+            const config: Config = new AppConfig(
+              // @ts-expect-error
+              {
+                ...authProfileConf,
+                ...{ security: { api: { jwt: { sign: { expiresIn: '29d' } } } } },
+              },
+              { forceEnhancedLegacySignature: false }
+            );
+            // intended to force key generator (associated with mocks above)
+            config.checkSecretKey(undefined);
+            const auth = new Auth(config);
+            await auth.init();
+            const token = (await auth.jwtEncrypt(
+              createRemoteUser('jwt_user', [ROLES.ALL]),
+              // @ts-expect-error
+              config.security.api.jwt.sign
+            )) as string;
+            const app = await getServer(auth);
+            const res = await supertest(app)
+              .get(`/`)
+              .set(HEADERS.AUTHORIZATION, buildToken(TOKEN_BEARER, token))
+              .expect(HTTP_STATUS.OK);
+            expect(res.body.user.name).toEqual('jwt_user');
           });
-          resolve(value);
         });
       });
     });

packages/auth/test/helper/plugin.ts

@@ -10,6 +10,14 @@ export const authProfileConf = {
   },
 };
 
+export const authChangePasswordConf = {
+  ...getDefaultConfig(),
+  plugins: path.join(__dirname, '../partials/plugin'),
+  auth: {
+    'change-password': {},
+  },
+};
+
 export const authPluginFailureConf = {
   ...getDefaultConfig(),
   plugins: path.join(__dirname, '../partials/plugin'),

packages/auth/test/partials/plugin/verdaccio-access-ok/access.js

@@ -0,0 +1,9 @@
+module.exports = function () {
+  return {
+    authenticate(user, pass, callback) {
+      // https://verdaccio.org/docs/en/dev-plugins#onsuccess
+      // this is a successful login and return a simple group
+      callback(null, ['test']);
+    },
+  };
+};

packages/auth/test/partials/plugin/verdaccio-access-ok/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-access-ok",
+  "main": "access.js",
+  "version": "1.0.0"
+}

packages/auth/test/partials/plugin/verdaccio-adduser-legacy/adduser.js

@@ -0,0 +1,25 @@
+module.exports = function () {
+  return {
+    authenticate(user, pass, callback) {
+      // https://verdaccio.org/docs/en/dev-plugins#onsuccess
+      // this is a successful login and return a simple group
+      callback(null, ['test']);
+    },
+    add_user(user, password, cb) {
+      if (user === 'fail') {
+        return cb(Error('bad username'));
+      }
+
+      if (user === 'password') {
+        return cb(Error('bad password'));
+      }
+
+      if (user === 'skip') {
+        // if wants to the next plugin
+        return cb(null, false);
+      }
+
+      cb(null, true);
+    },
+  };
+};

packages/auth/test/partials/plugin/verdaccio-adduser-legacy/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-adduser-legacy",
+  "main": "adduser.js",
+  "version": "1.0.0"
+}

packages/auth/test/partials/plugin/verdaccio-adduser/adduser.js

@@ -0,0 +1,25 @@
+module.exports = function () {
+  return {
+    authenticate(user, pass, callback) {
+      // https://verdaccio.org/docs/en/dev-plugins#onsuccess
+      // this is a successful login and return a simple group
+      callback(null, ['test']);
+    },
+    adduser(user, password, cb) {
+      if (user === 'fail') {
+        return cb(Error('bad username'));
+      }
+
+      if (user === 'password') {
+        return cb(Error('bad password'));
+      }
+
+      if (user === 'skip') {
+        // if wants to the next plugin
+        return cb(null, false);
+      }
+
+      cb(null, true);
+    },
+  };
+};

packages/auth/test/partials/plugin/verdaccio-adduser/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-adduser",
+  "main": "adduser.js",
+  "version": "1.0.0"
+}

packages/auth/test/partials/plugin/verdaccio-change-password/change.js

@@ -0,0 +1,32 @@
+module.exports = function () {
+  return {
+    users: [],
+    authenticate(user, pass, callback) {
+      // https://verdaccio.org/docs/en/dev-plugins#onsuccess
+      // this is a successful login and return a simple group
+      callback(null, ['test']);
+    },
+    changePassword(user, password, newPassword, cb) {
+      if (password === newPassword) {
+        return cb(Error('error password equal'));
+      }
+      return cb(null, true);
+    },
+    adduser(user, password, cb) {
+      if (user === 'fail') {
+        return cb(Error('bad username'));
+      }
+
+      if (user === 'password') {
+        return cb(Error('bad password'));
+      }
+
+      if (user === 'skip') {
+        // if wants to the next plugin
+        return cb(null, false);
+      }
+
+      cb(null, true);
+    },
+  };
+};

packages/auth/test/partials/plugin/verdaccio-change-password/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "verdaccio-change-password",
+  "main": "change.js",
+  "version": "1.0.0"
+}

packages/auth/test/partials/plugin/verdaccio-fail/fail.js

@@ -7,5 +7,8 @@ module.exports = function () {
       and success types respectively for testing purposes */
       callback(errorUtils.getInternalError(), false);
     },
+    adduser(user, password, cb) {
+      return cb(null, false);
+    },
   };
 };

packages/cli/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @verdaccio/cli
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/config@7.0.0-next.5
+  - @verdaccio/node-api@7.0.0-next.5
+  - @verdaccio/logger@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes
@@ -178,12 +188,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -1029,14 +1039,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/cli",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "author": {
     "name": "Juan Picado",
     "email": "juanpicado19@gmail.com"
@@ -43,17 +43,17 @@
     "start": "ts-node src/index.ts"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "@verdaccio/node-api": "workspace:7.0.0-next.4",
+    "@verdaccio/node-api": "workspace:7.0.0-next.5",
     "clipanion": "3.2.1",
-    "envinfo": "7.8.1",
+    "envinfo": "7.11.0",
     "kleur": "4.1.5",
     "semver": "7.5.4"
   },
   "devDependencies": {
-    "ts-node": "10.9.1"
+    "ts-node": "10.9.2"
   },
   "funding": {
     "type": "opencollective",

packages/config/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @verdaccio/config
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes
@@ -225,12 +237,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -1000,14 +1012,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

packages/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/config",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -38,8 +38,8 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/utils": "workspace:7.0.0-next.4",
+    "@verdaccio/utils": "workspace:7.0.0-next.5",
     "debug": "4.3.4",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
@@ -48,7 +48,7 @@
   },
   "devDependencies": {
     "@types/minimatch": "5.1.2",
-    "@types/yup": "0.29.14"
+    "@types/yup": "0.32.0"
   },
   "funding": {
     "type": "opencollective",

packages/config/src/config.ts

@@ -63,6 +63,10 @@ class Config implements AppConfig {
   private configOptions: { forceEnhancedLegacySignature: boolean };
   public constructor(
     config: ConfigYaml & { config_path: string },
+    // forceEnhancedLegacySignature is a property that
+    // allows switch a new legacy aes signature token signature
+    // for older versions do not want to have this new signature model
+    // this property must be false
     configOptions = { forceEnhancedLegacySignature: true }
   ) {
     const self = this;
@@ -131,6 +135,16 @@ class Config implements AppConfig {
     }
   }
 
+  public getEnhancedLegacySignature() {
+    if (typeof this?.security.enhancedLegacySignature !== 'undefined') {
+      if (this.security.enhancedLegacySignature === true) {
+        return true;
+      }
+      return false;
+    }
+    return this.configOptions.forceEnhancedLegacySignature;
+  }
+
   public getConfigPath() {
     return this.configPath;
   }
@@ -156,24 +170,23 @@ class Config implements AppConfig {
     }
     // generate a new a secret key
     // FUTURE: this might be an external secret key, perhaps within config file?
-    debug('generate a new key');
+    debug('generating a new secret key');
-    //
+
-    if (this.configOptions.forceEnhancedLegacySignature) {
+    if (this.getEnhancedLegacySignature()) {
+      debug('key generated with "enhanced" legacy signature user config');
       this.secret = generateRandomSecretKey();
     } else {
-      this.secret =
+      debug('key generated with legacy signature user config');
-        this.security.enhancedLegacySignature === true
+      this.secret = generateRandomHexString(32);
-          ? generateRandomSecretKey()
+    }
-          : generateRandomHexString(32);
+    // set this to false allow use old token signature and is not recommended
-      // set this to false allow use old token signature and is not recommended
+    // only use for migration reasons, major release will remove this property and
-      // only use for migration reasons, major release will remove this property and
+    // set it by default
-      // set it by default
+    if (this.security?.enhancedLegacySignature === false) {
-      if (this.security.enhancedLegacySignature === false) {
+      warningUtils.emit(Codes.VERWAR005);
-        warningUtils.emit(Codes.VERWAR005);
-      }
     }
 
-    debug('generated a new secret key %s', this.secret?.length);
+    debug('generated a new secret key length %s', this.secret?.length);
     return this.secret;
   }
 }

packages/core/core/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/core
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
 ## 7.0.0-next.4
 
 ## 7.0.0-next.3

packages/core/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/core",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "core utilities",
   "keywords": [
     "private",
@@ -34,17 +34,17 @@
   },
   "dependencies": {
     "http-errors": "2.0.0",
-    "http-status-codes": "2.2.0",
+    "http-status-codes": "2.3.0",
     "semver": "7.5.4",
     "ajv": "8.12.0",
     "process-warning": "1.0.0",
-    "core-js": "3.30.2"
+    "core-js": "3.35.0"
   },
   "devDependencies": {
     "lodash": "4.17.21",
     "typedoc": "0.23.25",
     "typedoc-plugin-missing-exports": "latest",
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/core/core/src/warning-utils.ts

@@ -12,6 +12,7 @@ export enum Codes {
   VERWAR005 = 'VERWAR005',
   // deprecation warnings
   VERDEP003 = 'VERDEP003',
+  VERWAR006 = 'VERWAR006',
 }
 
 warningInstance.create(
@@ -52,6 +53,12 @@ warningInstance.create(
   'multiple addresses will be deprecated in the next major, only use one'
 );
 
+warningInstance.create(
+  verdaccioDeprecation,
+  Codes.VERWAR006,
+  'the auth plugin method "add_user" in the auth plugin is deprecated and will be removed in next major release, rename to "adduser"'
+);
+
 export function emit(code: string, a?: string, b?: string, c?: string) {
   warningInstance.emit(code, a, b, c);
 }

packages/core/file-locking/package.json

@@ -39,7 +39,7 @@
     "lockfile": "1.0.4"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/core/tarball/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/url@12.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/core/tarball/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/tarball",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "tarball utilities resolver",
   "keywords": [
     "private",
@@ -34,14 +34,14 @@
   },
   "dependencies": {
     "debug": "4.3.4",
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/url": "workspace:12.0.0-next.4",
+    "@verdaccio/url": "workspace:12.0.0-next.5",
-    "@verdaccio/utils": "workspace:7.0.0-next.4",
+    "@verdaccio/utils": "workspace:7.0.0-next.5",
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "node-mocks-http": "1.13.0"
+    "node-mocks-http": "1.14.0"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/core/types/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Change Log
 
+## 12.0.0-next.2
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
 ## 12.0.0-next.1
 
 ### Major Changes
@@ -211,12 +217,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -808,14 +814,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

packages/core/types/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/types",
-  "version": "12.0.0-next.1",
+  "version": "12.0.0-next.2",
   "description": "verdaccio types definitions",
   "keywords": [
     "private",

packages/core/types/src/configuration.ts

@@ -296,7 +296,7 @@ export interface Config extends Omit<ConfigYaml, 'packages' | 'security' | 'conf
   // security object defaults is added by the config file but optional in the yaml file
   security: Security;
   // @deprecated (pending adding the replacement)
-  checkSecretKey(token: string): string;
+  checkSecretKey(token: string | void): string;
   getMatchedPackagesSpec(storage: string): PackageAccess | void;
   // TODO: verify how to handle this in the future
   [key: string]: any;

packages/core/url/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/core/url/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/url",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "url utilities resolver",
   "keywords": [
     "private",
@@ -33,14 +33,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "debug": "4.3.4",
     "lodash": "4.17.21",
-    "validator": "13.9.0"
+    "validator": "13.11.0"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "node-mocks-http": "1.13.0"
+    "node-mocks-http": "1.14.0"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/core/url/src/index.ts

@@ -1,6 +1,6 @@
 import buildDebug from 'debug';
 import { URL } from 'url';
-import isURLValidator from 'validator/lib/isURL';
+import validator from 'validator';
 
 import { HEADERS } from '@verdaccio/core';
 
@@ -17,7 +17,7 @@ export function isURLhasValidProtocol(uri: string): boolean {
 }
 
 export function isHost(url: string = '', options = {}): boolean {
-  return isURLValidator(url, {
+  return validator.isURL(url, {
     require_host: true,
     allow_trailing_dot: false,
     require_valid_protocol: false,
@@ -130,3 +130,5 @@ export function getPublicUrl(url_prefix: string = '', requestOptions: RequestOpt
     return '/';
   }
 }
+
+export const isURL = validator.isURL;

packages/hooks/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @verdaccio/hooks
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/logger@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/hooks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/hooks",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -29,18 +29,18 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "core-js": "3.30.2",
+    "core-js": "3.35.0",
     "debug": "4.3.4",
     "got-cjs": "12.5.4",
-    "handlebars": "4.7.7"
+    "handlebars": "4.7.8"
   },
   "devDependencies": {
-    "@verdaccio/auth": "workspace:7.0.0-next.4",
+    "@verdaccio/auth": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "nock": "13.3.3"
+    "nock": "13.4.0"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/loaders/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/loaders
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- @verdaccio/logger@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/loaders/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/loaders",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "loaders logic",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -13,14 +13,14 @@
     "url": "https://github.com/verdaccio/verdaccio"
   },
   "dependencies": {
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
     "debug": "4.3.4",
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
     "@verdaccio-scope/verdaccio-auth-foo": "0.0.2",
     "verdaccio-auth-memory": "workspace:*",
     "customprefix-auth": "2.0.0-next.0"

packages/logger/logger-7/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/logger-7
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- @verdaccio/logger-commons@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/logger/logger-7/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/logger-7",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger for verdaccio 5.x version",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -38,11 +38,11 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/logger-commons": "workspace:7.0.0-next.4",
+    "@verdaccio/logger-commons": "workspace:7.0.0-next.5",
     "pino": "7.11.0"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "funding": {
     "type": "opencollective",

packages/logger/logger-commons/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @verdaccio/logger-commons
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/logger/logger-commons/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/logger-commons",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -38,14 +38,14 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "@verdaccio/logger-prettify": "workspace:7.0.0-next.1",
     "debug": "4.3.4",
     "colorette": "2.0.20"
   },
   "devDependencies": {
     "pino": "7.11.0",
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "funding": {
     "type": "opencollective",

packages/logger/logger-prettify/package.json

@@ -38,14 +38,14 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "dayjs": "1.11.7",
+    "dayjs": "1.11.10",
-    "pino-abstract-transport": "1.0.0",
+    "pino-abstract-transport": "1.1.0",
     "colorette": "2.0.20",
     "lodash": "4.17.21",
-    "sonic-boom": "3.3.0"
+    "sonic-boom": "3.7.0"
   },
   "devDependencies": {
-    "pino": "8.12.1"
+    "pino": "8.17.2"
   },
   "funding": {
     "type": "opencollective",

packages/logger/logger/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @verdaccio/logger
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- @verdaccio/logger-commons@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes
@@ -135,12 +141,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -552,14 +558,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

packages/logger/logger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/logger",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "logger",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -38,11 +38,11 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/logger-commons": "workspace:7.0.0-next.4",
+    "@verdaccio/logger-commons": "workspace:7.0.0-next.5",
-    "pino": "8.14.1"
+    "pino": "8.17.2"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "funding": {
     "type": "opencollective",

packages/middleware/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @verdaccio/middleware
 
+## 7.0.0-next.5
+
+### Minor Changes
+
+- f047cc8: refactor: auth with legacy sign support
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/url@12.0.0-next.5
+  - @verdaccio/config@7.0.0-next.5
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes

packages/middleware/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/middleware",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "express middleware utils",
   "main": "./build/index.js",
   "types": "build/index.d.ts",
@@ -38,10 +38,10 @@
     "build": "pnpm run build:js && pnpm run build:types"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/utils": "workspace:7.0.0-next.4",
+    "@verdaccio/utils": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/url": "workspace:12.0.0-next.4",
+    "@verdaccio/url": "workspace:12.0.0-next.5",
     "debug": "4.3.4",
     "lru-cache": "7.18.3",
     "express": "4.18.2",
@@ -54,7 +54,7 @@
     "url": "https://opencollective.com/verdaccio"
   },
   "devDependencies": {
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
     "body-parser": "1.20.2",
     "supertest": "6.3.3"
   }

packages/middleware/src/middlewares/error.ts

@@ -43,7 +43,7 @@ export const errorReportingMiddleware = (logger) =>
     res: $ResponseExtend,
     next: $NextFunctionVer
   ): void {
-    debug('error report middleware');
+    debug('error report middleware start');
     res.locals.report_error =
       res.locals.report_error ||
       function (err: VerdaccioError): void {
@@ -64,7 +64,7 @@ export const errorReportingMiddleware = (logger) =>
             debug('this is an error in express.js, please report this, destroy response %o', err);
             res.destroy();
           } else if (!res.headersSent) {
-            debug('report internal error %o', err);
+            debug('send internal error %o', err);
             res.status(HTTP_STATUS.INTERNAL_ERROR);
             next({ error: API_ERROR.INTERNAL_SERVER_ERROR });
           } else {
@@ -74,6 +74,6 @@ export const errorReportingMiddleware = (logger) =>
         }
       };
 
-    debug('error report middleware next()');
+    debug('error report middleware end (skip next layer) next()');
     next();
   };

packages/middleware/src/middlewares/final.ts

@@ -1,3 +1,4 @@
+import buildDebug from 'debug';
 import _ from 'lodash';
 
 import { HEADERS, HTTP_STATUS, TOKEN_BASIC, TOKEN_BEARER } from '@verdaccio/core';
@@ -8,6 +9,8 @@ import { $NextFunctionVer, $RequestExtend, $ResponseExtend, MiddlewareError } fr
 
 export type FinalBody = Manifest | MiddlewareError | string;
 
+const debug = buildDebug('verdaccio:middleware:final');
+
 export function final(
   body: FinalBody,
   req: $RequestExtend,
@@ -17,17 +20,20 @@ export function final(
   next: $NextFunctionVer
 ): void {
   if (res.statusCode === HTTP_STATUS.UNAUTHORIZED && !res.getHeader(HEADERS.WWW_AUTH)) {
+    debug('set auth header support');
     res.header(HEADERS.WWW_AUTH, `${TOKEN_BASIC}, ${TOKEN_BEARER}`);
   }
 
   try {
     if (_.isString(body) || _.isObject(body)) {
       if (!res.get(HEADERS.CONTENT_TYPE)) {
+        debug('set json type header support');
         res.header(HEADERS.CONTENT_TYPE, HEADERS.JSON);
       }
 
       if (typeof body === 'object' && _.isNil(body) === false) {
         if (typeof (body as MiddlewareError).error === 'string') {
+          debug('set verdaccio_error method');
           res.locals._verdaccio_error = (body as MiddlewareError).error;
         }
         body = JSON.stringify(body, undefined, '  ') + '\n';
@@ -38,9 +44,12 @@ export function final(
         !res.statusCode ||
         (res.statusCode >= HTTP_STATUS.OK && res.statusCode < HTTP_STATUS.MULTIPLE_CHOICES)
       ) {
-        res.header(HEADERS.ETAG, '"' + stringToMD5(body as string) + '"');
+        const etag = stringToMD5(body as string);
+        debug('set etag header %s', etag);
+        res.header(HEADERS.ETAG, '"' + etag + '"');
       }
     } else {
+      debug('this line should never be visible, if does report');
       // send(null), send(204), etc.
     }
   } catch (err: any) {
@@ -48,7 +57,9 @@ export function final(
     // as an error handler, we can't report error properly,
     // and should just close socket
     if (err.message.match(/set headers after they are sent/)) {
+      debug('set headers after they are sent');
       if (_.isNil(res.socket) === false) {
+        debug('force destroy socket');
         res.socket?.destroy();
       }
       return;

packages/middleware/src/middlewares/web/utils/manifest.ts

@@ -7,7 +7,7 @@ export type Manifest = {
   js: string[];
 };
 
-const debug = buildDebug('verdaccio:web:render:manifest');
+const debug = buildDebug('verdaccio:middleware:web:render:manifest');
 
 export function getManifestValue(
   manifestItems: string[],

packages/node-api/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @verdaccio/node-api
 
+## 7.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/server@7.0.0-next.5
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/config@7.0.0-next.5
+  - @verdaccio/logger@7.0.0-next.5
+  - @verdaccio/server-fastify@7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ### Patch Changes
@@ -204,12 +215,12 @@
 - 8f43bf17d: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
   app.listen(4000, (event) => {
     // do something
@@ -1087,14 +1098,14 @@
 - 5c5057fc: feat: node api new structure based on promise
 
   ```js
-  import { runServer } from '@verdaccio/node-api';
+  import { runServer } from "@verdaccio/node-api";
   // or
-  import { runServer } from 'verdaccio';
+  import { runServer } from "verdaccio";
 
   const app = await runServer(); // default configuration
-  const app = await runServer('./config/config.yaml');
+  const app = await runServer("./config/config.yaml");
   const app = await runServer({ configuration });
-  app.listen(4000, event => {
+  app.listen(4000, (event) => {
     // do something
   });
   ```

packages/node-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/node-api",
-  "version": "7.0.0-next.4",
+  "version": "7.0.0-next.5",
   "description": "node API",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -38,20 +38,20 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "@verdaccio/server": "workspace:7.0.0-next.4",
+    "@verdaccio/server": "workspace:7.0.0-next.5",
-    "@verdaccio/server-fastify": "workspace:7.0.0-next.4",
+    "@verdaccio/server-fastify": "workspace:7.0.0-next.5",
-    "core-js": "3.30.2",
+    "core-js": "3.35.0",
     "debug": "4.3.4",
     "lodash": "4.17.21"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "selfsigned": "1.10.14",
+    "jest": "29.7.0",
-    "supertest": "6.3.3",
+    "selfsigned": "2.4.1",
-    "jest": "29.7.0"
+    "supertest": "6.3.3"
   },
   "publishConfig": {
     "access": "public"

packages/plugins/active-directory/package.json

@@ -34,10 +34,10 @@
   },
   "dependencies": {
     "@verdaccio/core": "workspace:6.0.0-6-next.5",
-    "activedirectory2": "2.1.0"
+    "activedirectory2": "2.2.0"
   },
   "devDependencies": {
-    "@types/activedirectory2": "1.2.4",
+    "@types/activedirectory2": "1.2.6",
     "@verdaccio/types": "workspace:11.0.0-6-next.12"
   },
   "scripts": {

packages/plugins/audit/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/config@7.0.0-next.5
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/plugins/audit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-audit",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "Verdaccio Middleware plugin to bypass npmjs audit",
   "keywords": [
     "private",
@@ -30,17 +30,17 @@
     "node": ">=12"
   },
   "dependencies": {
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "express": "4.18.2",
     "https-proxy-agent": "5.0.1",
     "node-fetch": "cjs"
   },
   "devDependencies": {
-    "@verdaccio/auth": "workspace:7.0.0-next.4",
+    "@verdaccio/auth": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "nock": "13.3.3",
+    "nock": "13.4.0",
     "supertest": "6.3.3"
   },
   "scripts": {

packages/plugins/auth-memory/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/plugins/auth-memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-auth-memory",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "Auth plugin for Verdaccio that keeps users in memory",
   "keywords": [
     "private",
@@ -30,13 +30,13 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "debug": "4.3.4"
   },
   "devDependencies": {
-    "@types/debug": "^4.1.9",
+    "@types/debug": "^4.1.12",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/types": "workspace:12.0.0-next.1"
+    "@verdaccio/types": "workspace:12.0.0-next.2"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/plugins/htpasswd/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/file-locking@12.0.0-next.1
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/plugins/htpasswd/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-htpasswd",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "htpasswd auth plugin for Verdaccio",
   "keywords": [
     "private",
@@ -33,20 +33,20 @@
     "node": ">=12"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "@verdaccio/file-locking": "workspace:12.0.0-next.1",
     "apache-md5": "1.1.8",
     "bcryptjs": "2.4.3",
-    "core-js": "3.30.2",
+    "core-js": "3.35.0",
     "http-errors": "2.0.0",
     "debug": "4.3.4",
     "unix-crypt-td-js": "1.1.4"
   },
   "devDependencies": {
-    "@types/bcryptjs": "2.4.4",
+    "@types/bcryptjs": "2.4.6",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
     "mockdate": "3.0.5"
   },
   "scripts": {

packages/plugins/local-storage/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+  - @verdaccio/file-locking@12.0.0-next.1
+  - @verdaccio/utils@7.0.0-next.5
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/plugins/local-storage/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdaccio/local-storage",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "Local storage implementation",
   "keywords": [
     "private",
@@ -36,10 +36,10 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "@verdaccio/file-locking": "workspace:12.0.0-next.1",
-    "@verdaccio/utils": "workspace:7.0.0-next.4",
+    "@verdaccio/utils": "workspace:7.0.0-next.5",
-    "core-js": "3.30.2",
+    "core-js": "3.35.0",
     "debug": "4.3.4",
     "globby": "11.1.0",
     "lockfile": "1.0.4",
@@ -50,10 +50,10 @@
   },
   "devDependencies": {
     "@types/minimatch": "5.1.2",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4",
+    "@verdaccio/logger": "workspace:7.0.0-next.5",
-    "@verdaccio/test-helper": "workspace:3.0.0-next.0",
+    "@verdaccio/test-helper": "workspace:3.0.0-next.1",
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
     "minimatch": "9.0.3"
   },
   "scripts": {

packages/plugins/memory/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Change Log
 
+## 12.0.0-next.5
+
+### Patch Changes
+
+- Updated dependencies [f047cc8]
+  - @verdaccio/core@7.0.0-next.5
+
 ## 12.0.0-next.4
 
 ### Patch Changes

packages/plugins/memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "verdaccio-memory",
-  "version": "12.0.0-next.4",
+  "version": "12.0.0-next.5",
   "description": "Storage implementation in memory",
   "keywords": [
     "private",
@@ -30,15 +30,15 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@verdaccio/core": "workspace:7.0.0-next.4",
+    "@verdaccio/core": "workspace:7.0.0-next.5",
     "memory-fs": "0.5.0",
     "debug": "4.3.4",
-    "memfs": "3.5.1"
+    "memfs": "3.5.3"
   },
   "devDependencies": {
-    "@verdaccio/types": "workspace:12.0.0-next.1",
+    "@verdaccio/types": "workspace:12.0.0-next.2",
-    "@verdaccio/config": "workspace:7.0.0-next.4",
+    "@verdaccio/config": "workspace:7.0.0-next.5",
-    "@verdaccio/logger": "workspace:7.0.0-next.4"
+    "@verdaccio/logger": "workspace:7.0.0-next.5"
   },
   "scripts": {
     "clean": "rimraf ./build",

packages/plugins/ui-theme/CHANGELOG.md

@@ -1,5 +1,7 @@
 # @verdaccio/ui-theme
 
+## 7.0.0-next.5
+
 ## 7.0.0-next.4
 
 ## 7.0.0-next.3

packages/plugins/ui-theme/jest/jest.config.js

@@ -31,7 +31,6 @@ module.exports = Object.assign({}, config, {
     '\\.(svg)$': '<rootDir>/jest/unit/empty.ts',
     '\\.(jpg)$': '<rootDir>/jest/unit/empty.ts',
     '\\.(md)$': '<rootDir>/jest/unit/empty-string.ts',
-    'github-markdown-css': '<rootDir>/jest/identity.js',
     // note: this section has to be on sync with webpack configuration
     'verdaccio-ui/components/(.*)': '<rootDir>/src/components/$1',
     'verdaccio-ui/utils/(.*)': '<rootDir>/src/utils/$1',