33
44import { Callback , IPluginAuth , Logger , PluginOptions , RemoteUser , PackageAccess } from '@verdaccio/types' ;
55import { getInternalError , getUnauthorized , getForbidden } from '@verdaccio/commons-api' ;
6- import { UserDataGroups } from './authcache' ;
7-
86import Gitlab from 'gitlab' ;
7+
8+ import { UserDataGroups } from './authcache' ;
99import { AuthCache , UserData } from './authcache' ;
1010
11- export type VerdaccioGitlabAccessLevel =
12- '$guest' |
13- '$reporter' |
14- '$developer' |
15- '$maintainer' |
16- '$owner' ;
11+ export type VerdaccioGitlabAccessLevel = '$guest' | '$reporter' | '$developer' | '$maintainer' | '$owner' ;
1712
1813export type VerdaccioGitlabConfig = {
19- url : string ,
14+ url : string ;
2015 authCache ?: {
21- enabled ?: boolean ,
22- ttl ?: number
23- } ,
24- legacy_mode ?: boolean ,
25- publish ?: VerdaccioGitlabAccessLevel
16+ enabled ?: boolean ;
17+ ttl ?: number ;
18+ } ;
19+ legacy_mode ?: boolean ;
20+ publish ?: VerdaccioGitlabAccessLevel ;
2621} ;
2722
2823export interface VerdaccioGitlabPackageAccess extends PackageAccess {
29- name ?: string ,
30- gitlab ?: boolean
31- } ;
24+ name ?: string ;
25+ gitlab ?: boolean ;
26+ }
3227
3328const ACCESS_LEVEL_MAPPING = {
3429 $guest : 10 ,
3530 $reporter : 20 ,
3631 $developer : 30 ,
3732 $maintainer : 40 ,
38- $owner : 50
33+ $owner : 50 ,
3934} ;
4035
4136// List of verdaccio builtin levels that map to anonymous access
42- const BUILTIN_ACCESS_LEVEL_ANONYMOUS = [ '$anonymous' , '$all' ] ;
37+ const BUILTIN_ACCESS_LEVEL_ANONYMOUS = [ '$anonymous' , '$all' ] ;
4338
4439// Level to apply on 'allow_access' calls when a package definition does not define one
45- const DEFAULT_ALLOW_ACCESS_LEVEL = [ '$all' ] ;
46-
40+ const DEFAULT_ALLOW_ACCESS_LEVEL = [ '$all' ] ;
4741
4842export interface VerdaccioGitLabPlugin extends IPluginAuth < VerdaccioGitlabConfig > {
4943 authCache : AuthCache ;
5044}
5145
52-
5346export default class VerdaccioGitLab implements VerdaccioGitLabPlugin {
5447 options : PluginOptions < VerdaccioGitlabConfig > ;
5548 config : VerdaccioGitlabConfig ;
@@ -104,53 +97,58 @@ export default class VerdaccioGitLab implements VerdaccioGitLabPlugin {
10497
10598 const GitlabAPI = new Gitlab ( {
10699 url : this . config . url ,
107- token : password
100+ token : password ,
108101 } ) ;
109102
110- GitlabAPI . Users . current ( ) . then ( response => {
111- if ( user !== response . username ) {
112- return cb ( getForbidden ( 'wrong gitlab username' ) ) ;
113- }
114-
115- const publishLevelId = ACCESS_LEVEL_MAPPING [ this . publishLevel ] ;
116-
117- // Set the groups of an authenticated user, in normal mode:
118- // - for access, depending on the package settings in verdaccio
119- // - for publish, the logged in user id and all the groups they can reach as configured with access level `$auth.gitlab.publish`
120- //
121- // In legacy mode, the groups are:
122- // - for access, depending on the package settings in verdaccio
123- // - for publish, the logged in user id and all the groups they can reach as fixed `$auth.gitlab.publish` = `$owner`
124- const gitlabPublishQueryParams = this . config . legacy_mode ? { owned : true } : { min_access_level : publishLevelId } ;
125- // @ts -ignore
126- this . logger . trace ( '[gitlab] querying gitlab user groups with params:' , gitlabPublishQueryParams ) ;
127-
128- const groupsPromise = GitlabAPI . Groups . all ( gitlabPublishQueryParams ) . then ( groups => {
129- return groups . filter ( group => group . path === group . full_path ) . map ( group => group . path ) ;
130- } ) ;
131-
132- const projectsPromise = GitlabAPI . Projects . all ( gitlabPublishQueryParams ) . then ( projects => {
133- return projects . map ( project => project . path_with_namespace ) ;
134- } ) ;
135-
136- Promise . all ( [ groupsPromise , projectsPromise ] ) . then ( ( [ groups , projectGroups ] ) => {
137- const realGroups = [ user , ...groups , ...projectGroups ] ;
138- this . _setCachedUserGroups ( user , password , { publish : realGroups } ) ;
103+ GitlabAPI . Users . current ( )
104+ . then ( response => {
105+ if ( user !== response . username ) {
106+ return cb ( getForbidden ( 'wrong gitlab username' ) ) ;
107+ }
139108
140- this . logger . info ( `[gitlab] user: ${ user } successfully authenticated` ) ;
109+ const publishLevelId = ACCESS_LEVEL_MAPPING [ this . publishLevel ] ;
110+
111+ // Set the groups of an authenticated user, in normal mode:
112+ // - for access, depending on the package settings in verdaccio
113+ // - for publish, the logged in user id and all the groups they can reach as configured with access level `$auth.gitlab.publish`
114+ //
115+ // In legacy mode, the groups are:
116+ // - for access, depending on the package settings in verdaccio
117+ // - for publish, the logged in user id and all the groups they can reach as fixed `$auth.gitlab.publish` = `$owner`
118+ const gitlabPublishQueryParams = this . config . legacy_mode
119+ ? { owned : true }
120+ : { min_access_level : publishLevelId } ;
141121 // @ts -ignore
142- this . logger . debug ( `[gitlab] user: ${ user } , with groups:` , realGroups ) ;
143-
144- return cb ( null , realGroups ) ;
145- } ) . catch ( error => {
146- this . logger . error ( `[gitlab] user: ${ user } error querying gitlab: ${ error } ` ) ;
122+ this . logger . trace ( '[gitlab] querying gitlab user groups with params:' , gitlabPublishQueryParams ) ;
123+
124+ const groupsPromise = GitlabAPI . Groups . all ( gitlabPublishQueryParams ) . then ( groups => {
125+ return groups . filter ( group => group . path === group . full_path ) . map ( group => group . path ) ;
126+ } ) ;
127+
128+ const projectsPromise = GitlabAPI . Projects . all ( gitlabPublishQueryParams ) . then ( projects => {
129+ return projects . map ( project => project . path_with_namespace ) ;
130+ } ) ;
131+
132+ Promise . all ( [ groupsPromise , projectsPromise ] )
133+ . then ( ( [ groups , projectGroups ] ) => {
134+ const realGroups = [ user , ...groups , ...projectGroups ] ;
135+ this . _setCachedUserGroups ( user , password , { publish : realGroups } ) ;
136+
137+ this . logger . info ( `[gitlab] user: ${ user } successfully authenticated` ) ;
138+ // @ts -ignore
139+ this . logger . debug ( `[gitlab] user: ${ user } , with groups:` , realGroups ) ;
140+
141+ return cb ( null , realGroups ) ;
142+ } )
143+ . catch ( error => {
144+ this . logger . error ( `[gitlab] user: ${ user } error querying gitlab: ${ error } ` ) ;
145+ return cb ( getUnauthorized ( 'error authenticating user' ) ) ;
146+ } ) ;
147+ } )
148+ . catch ( error => {
149+ this . logger . error ( `[gitlab] user: ${ user } error querying gitlab user data: ${ error . message || { } } ` ) ;
147150 return cb ( getUnauthorized ( 'error authenticating user' ) ) ;
148151 } ) ;
149-
150- } ) . catch ( error => {
151- this . logger . error ( `[gitlab] user: ${ user } error querying gitlab user data: ${ error . message || { } } ` ) ;
152- return cb ( getUnauthorized ( 'error authenticating user' ) ) ;
153- } ) ;
154152 }
155153
156154 adduser ( user : string , password : string , cb : Callback ) {
@@ -166,12 +164,14 @@ export default class VerdaccioGitLab implements VerdaccioGitLabPlugin {
166164 allow_access ( user : RemoteUser , _package : VerdaccioGitlabPackageAccess & PackageAccess , cb : Callback ) {
167165 if ( ! _package . gitlab ) return cb ( null , false ) ;
168166
169- const packageAccess = ( _package . access && _package . access . length > 0 ) ? _package . access : DEFAULT_ALLOW_ACCESS_LEVEL ;
167+ const packageAccess = _package . access && _package . access . length > 0 ? _package . access : DEFAULT_ALLOW_ACCESS_LEVEL ;
170168
171- if ( user . name !== undefined ) { // successfully authenticated
169+ if ( user . name !== undefined ) {
170+ // successfully authenticated
172171 this . logger . debug ( `[gitlab] allow user: ${ user . name } authenticated access to package: ${ _package . name } ` ) ;
173172 return cb ( null , true ) ;
174- } else { // unauthenticated
173+ } else {
174+ // unauthenticated
175175 if ( BUILTIN_ACCESS_LEVEL_ANONYMOUS . some ( level => packageAccess . includes ( level ) ) ) {
176176 this . logger . debug ( `[gitlab] allow anonymous access to package: ${ _package . name } ` ) ;
177177 return cb ( null , true ) ;
@@ -185,13 +185,16 @@ export default class VerdaccioGitLab implements VerdaccioGitLabPlugin {
185185 allow_publish ( user : RemoteUser , _package : VerdaccioGitlabPackageAccess & PackageAccess , cb : Callback ) {
186186 if ( ! _package . gitlab ) return cb ( null , false ) ;
187187
188- let packageScopePermit = false ;
188+ const packageScopePermit = false ;
189189 let packagePermit = false ;
190190 // Only allow to publish packages when:
191191 // - the package has exactly the same name as one of the user groups, or
192192 // - the package scope is the same as one of the user groups
193- for ( let real_group of user . real_groups ) { // jscs:ignore requireCamelCaseOrUpperCaseIdentifiers
194- this . logger . trace ( `[gitlab] publish: checking group: ${ real_group } for user: ${ user . name || '' } and package: ${ _package . name } ` ) ;
193+ for ( const real_group of user . real_groups ) {
194+ // jscs:ignore requireCamelCaseOrUpperCaseIdentifiers
195+ this . logger . trace (
196+ `[gitlab] publish: checking group: ${ real_group } for user: ${ user . name || '' } and package: ${ _package . name } `
197+ ) ;
195198
196199 if ( this . _matchGroupWithPackage ( real_group , _package . name as string ) ) {
197200 packagePermit = true ;
@@ -201,7 +204,9 @@ export default class VerdaccioGitLab implements VerdaccioGitLabPlugin {
201204
202205 if ( packagePermit || packageScopePermit ) {
203206 const perm = packagePermit ? 'package-name' : 'package-scope' ;
204- this . logger . debug ( `[gitlab] user: ${ user . name || '' } allowed to publish package: ${ _package . name } based on ${ perm } ` ) ;
207+ this . logger . debug (
208+ `[gitlab] user: ${ user . name || '' } allowed to publish package: ${ _package . name } based on ${ perm } `
209+ ) ;
205210 return cb ( null , true ) ;
206211 } else {
207212 this . logger . debug ( `[gitlab] user: ${ user . name || '' } denied from publishing package: ${ _package . name } ` ) ;
@@ -213,7 +218,7 @@ export default class VerdaccioGitLab implements VerdaccioGitLabPlugin {
213218
214219 _matchGroupWithPackage ( real_group : string , package_name : string ) : boolean {
215220 if ( real_group === package_name ) {
216- return true
221+ return true ;
217222 }
218223
219224 if ( package_name . indexOf ( '@' ) === 0 ) {
0 commit comments