npm dist-tag api call is not working for scoped packages with url_prefix behind ingress controller

[stgbmpi]

I have installed verdaccio on k8s cluster using url_prefix.
Works perfect, except managing tags for scoped packages (npm dist-tag) will fail. The reason is the substitution of %2f to / during rewrite in the ingress controller. Verdaccio backend receives e.g. /-/package/@sample/package/dist-tags instead of /-/package/@sample%2fpackage/dist-tags which causes an error { "error": "File not found" }

I found a function in encodeScopePackage middleware and wonder if it would be possible to add handling of /-/packages/@ similar to /@.
e.g. by enhancing following regex in encode-pkg.ts
req.url = req.url.replace(/^\/%40/, '/@').replace(/^(\/-\/package)?(\/@[^\/%]+)\/(?!$)/, '$1$2%2F');

[stgbmpi]

As temporary workaround, i created a middleware plugin, which does the job;

function ingressScopePackageFix(req, res, next) {
  req.url = req.url.replace(/^(\/(?:-\/package\/)?)(?:@|%40)([^\/%]+)(?:\/|%2[fF])(?!$)/, '$1@$2%2F')
  next();
}

module.exports = function (config, options) {
  return {
    register_middlewares: function (app, auth, storage) {
      app.use(ingressScopePackageFix);
    }
  };
};

[mbtools]

Looks like a bug, indeed. There are similar routes like /-/package/:package/access or /-/package/:package/collaborators (neither are used yet but relevant for future enhancements) which will have the same problem.

Feel free to create a PR for the fix in encodeScopePackage. Add a test to https://github.com/verdaccio/verdaccio/blob/master/packages/middleware/test/encode.spec.ts.

[mbtools]

Fixed in #5495. In the end, an easy fix just removing the ^ from the regexs 😃

[stgbmpi]

Thanks! You were faster than me 😉. Already prepared a fix, but not yet ready for PR.
https://github.com/stgbmpi/verdaccio/tree/fix/encodeScopePackage

[juanpicado]

https://github.com/verdaccio/verdaccio/releases/tag/v6.2.3