index.js

const axios = require("axios");
const {getForbidden} = require("@verdaccio/commons-api");

class AuthCustomPlugin {
	constructor(config) {
		this.url = config.url;
		this.secret = config.secret;
		return this;
	}

	authenticate(username, password, cb) {
		axios
			.post(
				`${this.url}/authenticate`,
				{
					username,
					password
				},
				{
					headers: {
						authorization: this.secret
					}
				}
			)
			.then(res => cb(null, res.data))
			.catch(() => cb(null, false));
	}

	allow_access(user, pkg, cb) {
		axios
			.post(
				`${this.url}/allow_access`,
				{
					user,
					package: pkg
				},
				{
					headers: {
						authorization: this.secret
					}
				}
			)
			.then(res =>
				res.data
					? cb(null, true)
					: cb(getForbidden("not allowed to access package"))
			)
			.catch(() => cb(getForbidden("not allowed to access package")));
	}

	allow_publish(user, pkg, cb) {
		axios
			.post(
				`${this.url}/allow_publish`,
				{
					user,
					package: pkg
				},
				{
					headers: {
						authorization: this.secret
					}
				}
			)
			.then(res =>
				res.data
					? cb(null, true)
					: cb(getForbidden("not allowed to publish package"))
			)
			.catch(() => cb(getForbidden("not allowed to publish package")));
	}

	allow_unpublish(user, pkg, cb) {
		axios
			.post(
				`${this.url}/allow_unpublish`,
				{
					user,
					package: pkg
				},
				{
					headers: {
						authorization: this.secret
					}
				}
			)
			.then(res =>
				res.data
					? cb(null, true)
					: cb(getForbidden("not allowed to unpublish package"))
			)
			.catch(() => cb(getForbidden("not allowed to unpublish package")));
	}
}

module.exports = config => new AuthCustomPlugin(config);