mirror of
https://github.com/verdaccio/verdaccio.git
synced 2024-12-23 22:27:34 -05:00
280 lines
7.4 KiB
JavaScript
280 lines
7.4 KiB
JavaScript
var express = require('express');
|
|
var cookies = require('cookies');
|
|
var utils = require('./utils');
|
|
var Storage = require('./storage');
|
|
var Config = require('./config');
|
|
var UError = require('./error').UserError;
|
|
var Middleware = require('./middleware');
|
|
var basic_auth = Middleware.basic_auth;
|
|
var validate_name = Middleware.validate_name;
|
|
var media = Middleware.media;
|
|
var expect_json = Middleware.expect_json;
|
|
|
|
module.exports = function(config_hash) {
|
|
var config = new Config(config_hash);
|
|
var storage = new Storage(config);
|
|
|
|
var can = function(action) {
|
|
return function(req, res, next) {
|
|
if (config['allow_'+action](req.params.package, req.remoteUser)) {
|
|
next();
|
|
} else {
|
|
if (!req.remoteUser) {
|
|
next(new UError({
|
|
status: 403,
|
|
msg: "can't "+action+" restricted package without auth, did you forget 'npm set always-auth true'?",
|
|
}));
|
|
} else {
|
|
next(new UError({
|
|
status: 403,
|
|
msg: 'user '+req.remoteUser+' not allowed to '+action+' it'
|
|
}));
|
|
}
|
|
}
|
|
};
|
|
};
|
|
|
|
var app = express();
|
|
|
|
app.use(function(req, res, next) {
|
|
var calls = 0;
|
|
res.report_error = function(err) {
|
|
calls++;
|
|
if (err.status && err.status >= 400 && err.status < 600) {
|
|
if (calls == 1) {
|
|
res.status(err.status);
|
|
res.send({error: err.msg || err.message || 'unknown error'});
|
|
}
|
|
} else {
|
|
console.log(err);
|
|
console.log(err.stack);
|
|
if (calls == 1) {
|
|
res.status(500);
|
|
res.send({error: 'internal server error'});
|
|
}
|
|
}
|
|
}
|
|
next();
|
|
});
|
|
|
|
app.use(Middleware.log_and_etagify);
|
|
app.use(basic_auth(function(user, pass) {
|
|
return config.authenticate(user, pass);
|
|
}));
|
|
app.use(express.json({strict: false}));
|
|
|
|
// TODO: npm DO NOT support compression :(
|
|
app.use(express.compress());
|
|
|
|
app.param('package', validate_name);
|
|
app.param('filename', validate_name);
|
|
|
|
/* app.get('/', function(req, res) {
|
|
res.send({
|
|
error: 'unimplemented'
|
|
});
|
|
});*/
|
|
|
|
/* app.get('/-/all', function(req, res) {
|
|
var https = require('https');
|
|
var JSONStream = require('JSONStream');
|
|
var request = require('request')({
|
|
url: 'https://registry.npmjs.org/-/all',
|
|
ca: require('./npmsslkeys'),
|
|
})
|
|
.pipe(JSONStream.parse('*'))
|
|
.on('data', function(d) {
|
|
console.log(d);
|
|
});
|
|
});*/
|
|
|
|
// TODO: anonymous user?
|
|
app.get('/:package/:version?', can('access'), function(req, res, next) {
|
|
storage.get_package(req.params.package, function(err, info) {
|
|
if (err) return next(err);
|
|
info = utils.filter_tarball_urls(info, req, config);
|
|
|
|
var version = req.params.version;
|
|
if (!version) {
|
|
return res.send(info);
|
|
}
|
|
|
|
if (info.versions[version] != null) {
|
|
return res.send(info.versions[version]);
|
|
}
|
|
|
|
if (info['dist-tags'] != null) {
|
|
if (info['dist-tags'][version] != null) {
|
|
version = info['dist-tags'][version];
|
|
if (info.versions[version] != null) {
|
|
return res.send(info.versions[version]);
|
|
}
|
|
}
|
|
}
|
|
|
|
return next(new UError({
|
|
status: 404,
|
|
msg: 'version not found: ' + req.params.version
|
|
}));
|
|
});
|
|
});
|
|
|
|
app.get('/:package/-/:filename', can('access'), function(req, res, next) {
|
|
var stream = storage.get_tarball(req.params.package, req.params.filename);
|
|
stream.on('error', function(err) {
|
|
return res.report_error(err);
|
|
});
|
|
res.header('content-type', 'application/octet-stream');
|
|
stream.pipe(res);
|
|
});
|
|
|
|
//app.get('/*', function(req, res) {
|
|
// proxy.request(req, res);
|
|
//});
|
|
|
|
// placeholder 'cause npm require to be authenticated to publish
|
|
// we do not do any real authentication yet
|
|
app.post('/_session', cookies.express(), function(req, res) {
|
|
res.cookies.set('AuthSession', String(Math.random()), {
|
|
// npmjs.org sets 10h expire
|
|
expires: new Date(Date.now() + 10*60*60*1000)
|
|
});
|
|
res.send({"ok":true,"name":"somebody","roles":[]});
|
|
});
|
|
|
|
app.get('/-/user/:argument', function(req, res, next) {
|
|
// can't put 'org.couchdb.user' in route address for some reason
|
|
if (req.params.argument.split(':')[0] !== 'org.couchdb.user') return next('route');
|
|
res.status(200);
|
|
return res.send({
|
|
ok: 'you are authenticated as "' + req.user + '"',
|
|
});
|
|
});
|
|
|
|
app.put('/-/user/:argument', function(req, res, next) {
|
|
// can't put 'org.couchdb.user' in route address for some reason
|
|
if (req.params.argument.split(':')[0] !== 'org.couchdb.user') return next('route');
|
|
res.status(409);
|
|
return res.send({
|
|
error: 'registration is not implemented',
|
|
});
|
|
});
|
|
|
|
app.put('/-/user/:argument/-rev/*', function(req, res, next) {
|
|
// can't put 'org.couchdb.user' in route address for some reason
|
|
if (req.params.argument.split(':')[0] !== 'org.couchdb.user') return next('route');
|
|
res.status(201);
|
|
return res.send({
|
|
ok: 'you are authenticated as "' + req.user + '"',
|
|
});
|
|
});
|
|
|
|
// publishing a package
|
|
app.put('/:package/:_rev?/:revision?', can('publish'), media('application/json'), expect_json, function(req, res, next) {
|
|
if (req.params._rev != null && req.params._rev != '-rev') return next('route');
|
|
var name = req.params.package;
|
|
|
|
if (Object.keys(req.body).length == 1 && typeof(req.body.users) === 'object') {
|
|
return next(new UError({
|
|
// 501 status is more meaningful, but npm doesn't show error message for 5xx
|
|
status: 404,
|
|
msg: 'npm star|unstar calls are not implemented',
|
|
}));
|
|
}
|
|
|
|
try {
|
|
var metadata = utils.validate_metadata(req.body, name);
|
|
} catch(err) {
|
|
return next(new UError({
|
|
status: 422,
|
|
msg: 'bad incoming package data',
|
|
}));
|
|
}
|
|
|
|
if (req.params._rev) {
|
|
return next(new UError({
|
|
status: 404,
|
|
msg: 'unimplemented yet, work in progress',
|
|
}));
|
|
/* storage.change_package(name, metadata, req.params.revision, function(err) {
|
|
if (err) return next(err);
|
|
res.status(201);
|
|
return res.send({
|
|
ok: 'package changed'
|
|
});
|
|
});*/
|
|
} else {
|
|
storage.add_package(name, metadata, function(err) {
|
|
if (err) return next(err);
|
|
res.status(201);
|
|
return res.send({
|
|
ok: 'created new package'
|
|
});
|
|
});
|
|
}
|
|
});
|
|
|
|
// unpublishing an entire package
|
|
app.delete('/:package/-rev/*', can('publish'), function(req, res, next) {
|
|
storage.remove_package(req.params.package, function(err) {
|
|
if (err) return next(err);
|
|
res.status(201);
|
|
return res.send({
|
|
ok: 'package removed'
|
|
});
|
|
});
|
|
});
|
|
|
|
// uploading package tarball
|
|
app.put('/:package/-/:filename/*', can('publish'), media('application/octet-stream'), function(req, res, next) {
|
|
var name = req.params.package;
|
|
|
|
var stream = storage.add_tarball(name, req.params.filename);
|
|
req.pipe(stream);
|
|
|
|
// checking if end event came before closing
|
|
var complete = false;
|
|
req.on('end', function() {
|
|
complete = true;
|
|
stream.done();
|
|
});
|
|
req.on('close', function() {
|
|
if (!complete) {
|
|
stream.abort();
|
|
}
|
|
});
|
|
|
|
stream.on('error', function(err) {
|
|
return res.report_error(err);
|
|
});
|
|
stream.on('success', function() {
|
|
res.status(201);
|
|
return res.send({
|
|
ok: 'tarball uploaded successfully'
|
|
});
|
|
});
|
|
});
|
|
|
|
// adding a version
|
|
app.put('/:package/:version/-tag/:tag', can('publish'), media('application/json'), expect_json, function(req, res, next) {
|
|
var name = req.params.package;
|
|
var version = req.params.version;
|
|
var tag = req.params.tag;
|
|
|
|
storage.add_version(name, version, req.body, tag, function(err) {
|
|
if (err) return next(err);
|
|
res.status(201);
|
|
return res.send({
|
|
ok: 'package published'
|
|
});
|
|
});
|
|
});
|
|
|
|
app.use(app.router);
|
|
app.use(function(err, req, res, next) {
|
|
res.report_error(err);
|
|
});
|
|
|
|
return app;
|
|
};
|
|
|