Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (!_package.gitlab) return cb(null, false);
const packageAccess = _package.access && _package.access.length > 0 ? _package.access : DEFAULT_ALLOW_ACCESS_LEVEL;
if (user.name !== undefined) {
// successfully authenticated
this.logger.debug(`[gitlab] allow user: ${user.name} authenticated access to package: ${_package.name}`);
return cb(null, true);
} else {
// unauthenticated
if (BUILTIN_ACCESS_LEVEL_ANONYMOUS.some(level => packageAccess.includes(level))) {
this.logger.debug(`[gitlab] allow anonymous access to package: ${_package.name}`);
return cb(null, true);
} else {
this.logger.debug(`[gitlab] deny access to package: ${_package.name}`);
return cb(getUnauthorized('access denied, user not authenticated and anonymous access disabled'));
}
}
}
.then(response => {
if (user.toLowerCase() !== response.username.toLowerCase()) {
return cb(getUnauthorized('wrong gitlab username'));
}
const publishLevelId = ACCESS_LEVEL_MAPPING[this.publishLevel];
// Set the groups of an authenticated user, in normal mode:
// - for access, depending on the package settings in verdaccio
// - for publish, the logged in user id and all the groups they can reach as configured with access level `$auth.gitlab.publish`
const gitlabPublishQueryParams = { min_access_level: publishLevelId };
// @ts-ignore
this.logger.trace('[gitlab] querying gitlab user groups with params:', gitlabPublishQueryParams);
const groupsPromise = GitlabAPI.Groups.all(gitlabPublishQueryParams).then(groups => {
return groups.filter(group => group.path === group.full_path).map(group => group.path);
});
export const fSError = function(message: string, code: number = 409): VerdaccioError {
const err: VerdaccioError = getCode(code, message);
// FIXME: we should return http-status codes here instead, future improvement
// @ts-ignore
err.code = message;
return err;
};
packagePermit = true;
break;
}
}
if (packagePermit || packageScopePermit) {
const perm = packagePermit ? 'package-name' : 'package-scope';
this.logger.debug(
`[gitlab] user: ${user.name || ''} allowed to publish package: ${_package.name} based on ${perm}`
);
return cb(null, true);
} else {
this.logger.debug(`[gitlab] user: ${user.name || ''} denied from publishing package: ${_package.name}`);
// @ts-ignore
const missingPerm = _package.name.indexOf('@') === 0 ? 'package-scope' : 'package-name';
return cb(getForbidden(`must have required permissions: ${this.publishLevel || ''} at ${missingPerm}`));
}
}
test('should be a fail on login', () => {
const config: Config = new AppConfig(_.cloneDeep(authPluginFailureConf));
const auth: IAuth = new Auth(config);
expect(auth).toBeDefined();
const callback = jest.fn();
auth.authenticate('foo', 'bar', callback);
expect(callback).toHaveBeenCalledTimes(1);
expect(callback).toHaveBeenCalledWith(getInternalError());
});
});
describe('test errors log', () => {
const middlewareObject = { name: 'verdaccio',
request: {
method: 'POST',
url: '/-/npm/v1/user'
},
user: 'userTest2001',
remoteIP: '::ffff:127.0.0.1',
status: HTTP_STATUS.UNAUTHORIZED,
error: 'some error',
msg: '@{status}, user: @{user}(@{remoteIP}), req: \'@{request.method} @{request.url}\', error: @{!error}'
};
test('should display error log', () => {
const expectedErrorMessage = `401, user: userTest2001(::ffff:127.0.0.1), req: 'POST /-/npm/v1/user', error: some error`;
expect(fillInMsgTemplate(LOG_VERDACCIO_ERROR, middlewareObject, false))
.toEqual(expectedErrorMessage);
});
test('should display error log with colors', () => {
const expectedErrorMessage = `401, user: g[userTest2001](g[::ffff:127.0.0.1]), req: 'g[POST] g[/-/npm/v1/user]', error: r[some error]`;
expect(fillInMsgTemplate(LOG_VERDACCIO_ERROR, middlewareObject, true))
.toEqual(expectedErrorMessage);
});
});
.catch(error => {
this.logger.error(`[gitlab] user: ${user} error querying gitlab: ${error}`);
return cb(getUnauthorized('error authenticating user'));
});
})
changePassword(user: string, password: string, newPassword: string, cb: Callback) {
this.logger.trace(`[gitlab] changePassword called for user: ${user}`);
return cb(getInternalError('You are using verdaccio-gitlab integration. Please change your password in gitlab'));
}
}
};
if (!err) {
locked = true;
this.logger.trace(
{
name
},
'[local-storage/updatePackage] file: @{name} has been locked'
);
}
if (_.isNil(err) === false) {
if (err.code === resourceNotAvailable) {
return unLockCallback(getInternalError('resource temporarily unavailable'));
} else if (err.code === noSuchFile) {
return unLockCallback(getNotFound());
} else {
return unLockCallback(err);
}
}
updateHandler(json, err => {
if (err) {
return unLockCallback(err);
}
onWrite(name, transformPackage(json), unLockCallback);
});
});
}
this.get((err, data) => {
if (err) {
cb(getInternalError('error remove private package'));
this.logger.error({ err }, '[local-storage/remove]: remove the private package has failed @{err}');
}
const pkgName = data.indexOf(name);
if (pkgName !== -1) {
this.data.list.splice(pkgName, 1);
this.logger.trace({ name }, 'local-storage: [remove] package @{name} has been removed');
}
cb(this._sync());
});
}