verdaccio/lib/utils.js

'use strict';

const assert = require('assert');
const Semver = require('semver');
const URL = require('url');
const Logger = require('./logger');

/**
 * Validate a package.
 * @param {*} name
 * @return {Boolean} whether the package is valid or not
 */
function validate_package(name) {
	name = name.split('/', 2);
	if (name.length === 1) {
		// normal package
		return module.exports.validate_name(name[0]);
	} else {
		// scoped package
		return name[0][0] === '@'
				&& module.exports.validate_name(name[0].slice(1))
				&& module.exports.validate_name(name[1]);
	}
}

/**
 * From normalize-package-data/lib/fixer.js
 * @param {*} name  the package name
 * @return {Boolean} whether is valid or not
 */
function validate_name(name) {
	if (typeof(name) !== 'string') {
		return false;
	}
	name = name.toLowerCase();

	// all URL-safe characters and "@" for issue #75
	if (!name.match(/^[-a-zA-Z0-9_.!~*'()@]+$/)
	 || name.charAt(0) === '.' // ".bin", etc.
	 || name.charAt(0) === '-' // "-" is reserved by couchdb
	 || name === 'node_modules'
	 || name === '__proto__'
	 || name === 'package.json'
	 || name === 'favicon.ico'
	) {
		return false;
	} else {
		return true;
	}
}

/**
 * Check whether an element is an Object
 * @param {*} obj the element
 * @return {Boolean}
 */
function is_object(obj) {
	return typeof(obj) === 'object' && obj !== null && !Array.isArray(obj);
}

/**
 * Validate the package metadata, add additional properties whether are missing within
 * the metadata properties.
 * @param {*} object
 * @param {*} name
 * @return {Object} the object with additional properties as dist-tags ad versions
 */
function validate_metadata(object, name) {
	assert(module.exports.is_object(object), 'not a json object');
	assert.equal(object.name, name);

	if (!module.exports.is_object(object['dist-tags'])) {
		object['dist-tags'] = {};
	}

	if (!module.exports.is_object(object['versions'])) {
		object['versions'] = {};
	}

	return object;
}

/**
 * Iterate a packages's versions and filter each original tarbal url.
 * @param {*} pkg
 * @param {*} req
 * @param {*} config
 * @return {String} a filtered package
 */
function filter_tarball_urls(pkg, req, config) {
	/**
	 * Filter a tarball url.
	 * @param {*} _url
	 * @return {String} a parsed url
	 */
	const filter = function(_url) {
		if (!req.headers.host) {
			return _url;
		}
		const filename = URL.parse(_url).pathname.replace(/^.*\//, '');
		let result;
		if (config.url_prefix != null) {
			result = config.url_prefix.replace(/\/$/, '');
		} else {
			result = `${req.protocol}://${req.headers.host}`;
		}
		return `${result}/${pkg.name.replace(/\//g, '%2f')}/-/${filename}`;
	};

	for (let ver in pkg.versions) {
		if (Object.prototype.hasOwnProperty.call(pkg.versions, ver)) {
			const dist = pkg.versions[ver].dist;
			if (dist != null && dist.tarball != null) {
				// dist.__verdaccio_orig_tarball = dist.tarball
				dist.tarball = filter(dist.tarball);
			}
		}
	}
	return pkg;
}

/**
 * Create a tag for a package
 * @param {*} data
 * @param {*} version
 * @param {*} tag
 * @return {Boolean} whether a package has been tagged
 */
function tag_version(data, version, tag) {
	if (tag) {
		if (data['dist-tags'][tag] !== version) {
			if (Semver.parse(version, true)) {
				// valid version - store
				data['dist-tags'][tag] = version;
				return true;
			}
		}
		Logger.logger.warn({ver: version, tag: tag}, 'ignoring bad version @{ver} in @{tag}');
		if (tag && data['dist-tags'][tag]) {
			delete data['dist-tags'][tag];
		}
	}
	return false;
}

/**
 * Gets version from a package object taking into account semver weirdness.
 * @param {*} object
 * @param {*} version
 * @return {String} return the semantic version of a package
 */
function get_version(object, version) {
	// this condition must allow cast
	if (object.versions[version] != null) {
		return object.versions[version];
	}
	try {
		version = Semver.parse(version, true);
		for (let k in object.versions) {
			if (version.compare(Semver.parse(k, true)) === 0) {
				return object.versions[k];
			}
		}
	} catch (err) {
		return undefined;
	}
}

/**
 * Parse an internet address
 * Allow:
		- https:localhost:1234        - protocol + host + port
		- localhost:1234              - host + port
		- 1234                        - port
		- http::1234                  - protocol + port
		- https://localhost:443/      - full url + https
		- http://[::1]:443/           - ipv6
		- unix:/tmp/http.sock         - unix sockets
		- https://unix:/tmp/http.sock - unix sockets (https)
 * @param {*} addr the internet address definition
 * @return {Object|Null} literal object that represent the address parsed
 */
function parse_address(addr) {
	//
	// TODO: refactor it to something more reasonable?
	//
	//        protocol :  //      (  host  )|(    ipv6     ):  port  /
	let m = /^((https?):(\/\/)?)?((([^\/:]*)|\[([^\[\]]+)\]):)?(\d+)\/?$/.exec(addr);

	if (m) return {
		proto: m[2] || 'http',
		host: m[6] || m[7] || 'localhost',
		port: m[8] || '4873',
	};

	m = /^((https?):(\/\/)?)?unix:(.*)$/.exec(addr);

	if (m) {
		return {
			proto: m[2] || 'http',
			path: m[4],
		};
	}

	return null;
}

/**
 * Function filters out bad semver versions and sorts the array.
 * @param {*} array
 * @return {Array} sorted Array
 */
function semver_sort(array) {
	return array
		.filter(function(x) {
			if (!Semver.parse(x, true)) {
				Logger.logger.warn( {ver: x}, 'ignoring bad version @{ver}' );
				return false;
			}
			return true;
		})
		.sort(Semver.compareLoose)
		.map(String);
}

/**
 * Flatten arrays of tags.
 * @param {*} data
 */
function normalize_dist_tags(data) {
	let sorted;
	if (!data['dist-tags'].latest) {
		// overwrite latest with highest known version based on semver sort
		sorted = module.exports.semver_sort(Object.keys(data.versions));
		if (sorted && sorted.length) {
				data['dist-tags'].latest = sorted.pop();
		}
	}

	for (let tag in data['dist-tags']) {
		if (Array.isArray(data['dist-tags'][tag])) {
			if (data['dist-tags'][tag].length) {
				// sort array
				sorted = module.exports.semver_sort(data['dist-tags'][tag]);
				if (sorted.length) {
						// use highest version based on semver sort
						data['dist-tags'][tag] = sorted.pop();
				}
			} else {
				delete data['dist-tags'][tag];
			}
		} else if (typeof data['dist-tags'][tag] === 'string') {
			if (!Semver.parse(data['dist-tags'][tag], true)) {
				// if the version is invalid, delete the dist-tag entry
				delete data['dist-tags'][tag];
			}
		}
	}
}

module.exports.semver_sort = semver_sort;
module.exports.parse_address = parse_address;
module.exports.get_version = get_version;
module.exports.normalize_dist_tags = normalize_dist_tags;
module.exports.tag_version = tag_version;
module.exports.filter_tarball_urls = filter_tarball_urls;
module.exports.validate_metadata = validate_metadata;
module.exports.is_object = is_object;
module.exports.validate_name = validate_name;
module.exports.validate_package = validate_package;