Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (!_package.gitlab) return cb(null, false);
const packageAccess = _package.access && _package.access.length > 0 ? _package.access : DEFAULT_ALLOW_ACCESS_LEVEL;
if (user.name !== undefined) {
// successfully authenticated
this.logger.debug(`[gitlab] allow user: ${user.name} authenticated access to package: ${_package.name}`);
return cb(null, true);
} else {
// unauthenticated
if (BUILTIN_ACCESS_LEVEL_ANONYMOUS.some(level => packageAccess.includes(level))) {
this.logger.debug(`[gitlab] allow anonymous access to package: ${_package.name}`);
return cb(null, true);
} else {
this.logger.debug(`[gitlab] deny access to package: ${_package.name}`);
return cb(getUnauthorized('access denied, user not authenticated and anonymous access disabled'));
}
}
}
.then(response => {
if (user.toLowerCase() !== response.username.toLowerCase()) {
return cb(getUnauthorized('wrong gitlab username'));
}
const publishLevelId = ACCESS_LEVEL_MAPPING[this.publishLevel];
// Set the groups of an authenticated user, in normal mode:
// - for access, depending on the package settings in verdaccio
// - for publish, the logged in user id and all the groups they can reach as configured with access level `$auth.gitlab.publish`
const gitlabPublishQueryParams = { min_access_level: publishLevelId };
// @ts-ignore
this.logger.trace('[gitlab] querying gitlab user groups with params:', gitlabPublishQueryParams);
const groupsPromise = GitlabAPI.Groups.all(gitlabPublishQueryParams).then(groups => {
return groups.filter(group => group.path === group.full_path).map(group => group.path);
});
.catch(error => {
this.logger.error(`[gitlab] user: ${user} error querying gitlab: ${error}`);
return cb(getUnauthorized('error authenticating user'));
});
})