ohpm Repository Interface Protocol

Overview

The ohpm client interacts with ohpm-repo through REST APIs, including:

Fetch Metadata: obtains the metadata of a third-party library. The download address of the third-party library is also part of the metadata. A specific download operation may be implemented by ohpm-repo, or may be implemented by using a storage plugin via another file service. Regardless of the implementation used, when the ohpm client sends a request to the returned download URL, the client must be configured with read-only or read-write authentication to enable successful downloading if any of the following conditions are met: anonymous access is disabled on ohpm-repo; the requested repository requires authorization for read access; the requested third-party package requires authorization for read access. The corresponding access token must be carried in the Authorization field of the HTTP request header. To pull simplified metadata, the client must include the x-ohpm-metadata-type field in the HTTP request header with the value "install+v1".
Login (optional): logs in on the client. When public and private key authentication is used, the ohpm client obtains a token from ohpm-repo through the Login API. This token is then included in the Authorization field of the HTTP header when APIs such as publish, unpublish, and dist-tags are called. If the access token authentication mode is used instead, the Login API does not need to be implemented.
Login_pss (optional): functions the same as the Login API. Compared with the Login API, it has upgraded its signature algorithm, changing from the traditional RSA-SHA256 to the RSA-PSS (Probabilistic Signature Scheme) padding mode.
Publish: publishes a third-party library to ohpm-repo. This operation requires read-write authentication.
Unpublish: removes a third-party library (either a specific version or the entire package) from ohpm-repo. This operation requires read-write authentication.
Ping: checks the network connectivity with ohpm-repo. No authentication is required.
DistTags: manages tags, including adding, updating, and deleting tags. The read-write authentication is required before operation. To query all tags of a package, reuse the Fetch Metadata API. If anonymous access is disabled on ohpm-repo, authentication with a read-only or read-write access token is required. If anonymous access is enabled by default, no authentication is required.
Versions: returns a paginated list of third-party library versions, sorted by release time in ascending order. The page number and number of items per page can be set via the pageNum and pageSize options. If anonymous access is disabled in the ohpm-repo configuration, or if the requested repository or third-party package requires authorization for read access, the ohpm client must be configured with read-only or read-write authentication. The request will succeed only when the corresponding access token is carried in the Authorization field of the HTTP request header.
CheckUpdate: checks whether updates are available for currently imported third-party libraries. The query results are displayed in a list format, with a maximum of 50 libraries per query. If anonymous access is disabled in the ohpm-repo configuration, or if the requested repository or third-party package requires authorization for read access, the ohpm client must be configured with read-only or read-write authentication. The request will succeed only when the corresponding access token is carried in the Authorization field of the HTTP request header.

When the ohpm client accesses ohpm-repo, two authentication modes are supported: public and private key and access token.

When public and private key authentication is used, the ohpm client obtains a token from ohpm-repo through the Login API (for details about how to generate a token, see the definition of the Login API). This token is then included in the Authorization field of the HTTP header when APIs such as publish, unpublish, and dist-tags are called. The token has the read and write permissions.
When using access token authentication, you need to configure AccessToken on the ohpm client. Access tokens are classified into read-only access tokens and read-write access tokens by permission scope. When the ohpm client accesses ohpm-repo, the Authorization field in the HTTP header carries the corresponding access token. When Fetch Metadata is called with anonymous access disabled, the system prioritizes the read-only access token for authentication, falling back to the read-write access token if none is found. For all other APIs requiring read and write permissions, only a read-write access token is recognized. Access tokens are typically generated on the ohpm-repo management page. Alternatively, they can be issued by a custom authentication plugin, where a dedicated authentication service generates the token, and its API is used to perform the authentication process.

Since ohpm-repo 5.4.3 Beta, the simplified metadata of third-party libraries can be obtained using Fetch Metadata.

Since ohpm-repo 5.4.5 Beta, the CheckUpdate API has been added to check for updates to currently imported third-party libraries.

Fetch Metadata

Returns the metadata of a specified package.

GET <router-prefix>/:group?/:package_name

Attribute	Type	Mandatory	Description
group	String	No	Organization name, which starts with @, for example, @ohos.
package_name	String	Yes	Package name (excluding the organization part).

Request example (requesting an in-app HAR package @test/package1):

Request method: GET
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/@test/package1
Request header:
authorization: NjJmNjFhODI3N2ZlNDUwMzlhYmUwNjQxZjQ3ZTNhZDU=

The request header contains the following fields.

Attribute	Type	Mandatory	Description
authorization	String	Yes	Read-only or read-write access token. This is an optional field, but must be provided if ohpm-repo is configured to disallow anonymous access.
x-ohpm-metadata-type	String	No	Type of the metadata to be returned. If the value is set to "install+v1", all simplified metadata is returned.
x-ohpm-metadata-special-version	String	No	(Added in ohpm-repo 5.5.1) Special version for metadata retrieval. The value can be a specific version, the latest version, or a tag version. The following are examples: Specific version: "3.0.0" Latest version: "latest" Tag version: "tag:t310" If this parameter is not set or is set to a value other than the preceding three types, all metadata is returned.

Attribute

Type

Mandatory

Description

authorization

String

Yes

Read-only or read-write access token. This is an optional field, but must be provided if ohpm-repo is configured to disallow anonymous access.

x-ohpm-metadata-type

String

Type of the metadata to be returned. If the value is set to "install+v1", all simplified metadata is returned.

x-ohpm-metadata-special-version

String

(Added in ohpm-repo 5.5.1)

Special version for metadata retrieval. The value can be a specific version, the latest version, or a tag version. The following are examples:

Specific version: "3.0.0"
Latest version: "latest"
Tag version: "tag:t310"

If this parameter is not set or is set to a value other than the preceding three types, all metadata is returned.

Failed response example (requesting the in-app HAR package @test/package1):

{
    "code": 1018,
    "message": "package not found: @test/package1"
}

The failed response body contains two fields, as described in the following table.

Attribute	Type	Mandatory	Description
code	number	Yes	Error code for the response failure.
message	String	Yes	Error message for the response failure.

Successful response example (requesting the in-app HAR package @test/package1):

{
  "_id": "@test/package1",
  "name": "@test/package1",
  "description": "Please describe the basic information.",
  "dist-tags": {
    "latest": "2.0.0"
  },
  "versions": {
    "1.0.0": {
      "name": "@test/package1",
      "version": "1.0.0",
      "description": "Please describe the basic information.",
      "main": "Index.ets",
      "author": {
        "name": "apple11",
        "url": "",
        "email": ""
      },
      "license": "Apache-2.0",
      "dependencies": {
      },
      "artifactType": "original",
      "_nodeVersion": "20.14.0",
      "_ohpmVersion": "ohpm-repo-5.0.3",
      "_id": "@test/package1@1.0.0",
      "dist": {
        "integrity": "sha512-UAPn6H3lsqQvwmevJSbWWv52PA8Ii6rgutLeJnVAHkNrUX2isytQ2pkzjodHuroYb64XKcwg+E6I8tUcFxwF3A==",
        "tarball": "https://myohpmrepo.com/repos/ohpm/@test/package1/-/@test/package1-1.0.0.har"
      }
    },
    "2.0.0": {
      "name": "@test/package1",
      "version": "2.0.0",
      "description": "Please describe the basic information.",
      "main": "Index.ets",
      "author": {
        "name": "apple11",
        "url": "",
        "email": ""
      },
      "license": "Apache-2.0",
      "dependencies": {
      },
      "artifactType": "original",
      "_nodeVersion": "20.14.0",
      "_ohpmVersion": "ohpm-repo-5.0.3-rc.2",
      "_id": "@test/package1@2.0.0",
      "dist": {
        "integrity": "sha512-6C47XiyVfUAljbS2d08LWEJE2dZHPFi6SNYEsR0REQVKUwlNKf6hNI8wKaI0dHCmDPhQPymOdGeTF+2E3fZWgQ==",
        "tarball": "https://10.70.95.74:8077/ohpm/@test/package1/-/@test/package1-2.0.0.har"
      }
    }
  },
  "_rev": "2",
  "time": {
    "1.0.0": "2024-06-26T14:48:17.302+08:00",
    "created": "2024-06-26T14:48:17.302+08:00",
    "modified": "2024-06-26T14:48:27.785+08:00",
    "2.0.0": "2024-06-26T14:48:27.785+08:00"
  }
}

To retrieve simplified metadata, include x-ohpm-metadata-type with its value "install+v1" in the request header. The top-level response object retains only four fields: name, packageType, versions, and dist-tags. Within each object in the versions array, only name, version, dependencies, dynamicDependencies, dist, packageType, debug, and _ohpmVersion fields are retained. Successful response example:

{
  "name": "@test/package1",
  "dist-tags": {
    "latest": "2.0.0"
  },
  "versions": {
    "1.0.0": {
      "name": "@test/package1",
      "version": "1.0.0",
      "dependencies": {
      },
      "_ohpmVersion": "ohpm-repo-5.0.3",
      "dist": {
        "integrity": "sha512-UAPn6H3lsqQvwmevJSbWWv52PA8Ii6rgutLeJnVAHkNrUX2isytQ2pkzjodHuroYb64XKcwg+E6I8tUcFxwF3A==",
        "tarball": "https://myohpmrepo.com/repos/ohpm/@test/package1/-/@test/package1-1.0.0.har"
      }
    },
    "2.0.0": {
      "name": "@test/package1",
      "version": "2.0.0",
      "dependencies": {
      },
      "_ohpmVersion": "ohpm-repo-5.0.3-rc.2",
      "dist": {
        "integrity": "sha512-6C47XiyVfUAljbS2d08LWEJE2dZHPFi6SNYEsR0REQVKUwlNKf6hNI8wKaI0dHCmDPhQPymOdGeTF+2E3fZWgQ==",
        "tarball": "https://10.70.95.74:8077/ohpm/@test/package1/-/@test/package1-2.0.0.har"
      }
    }
  }
}

[h2]Metadata Response Data Description

The response data contains eight first-level fields, which are described as follows:

Attribute	Type	Description
_id	String	Package name, which is used as the primary key ID of the database.
_rev	number	Package versions.
name	String	Package name.
description	String	Package description.
dist-tags	json	All tags of the package.
versions	json	All version data of the package.
packageType	String	Package type. For details, see the description.
time	json	Package release time.

name: package name, which can contain the organization name, for example, @myscop/myhsplib.
dist-tags: the mapping between package tags and package versions. Each package has a latest tag to maintain the latest version.
packageType (optional): the type of the package. The packageType field exists in the metadata only when the requested package is an HSP package, and the value must be InterfaceHar.
time: release time of all versions of the maintenance package. created indicates the release time of the first version of the package, and modified indicates the release time of the last version of the package.

The versions field in the first-level fields contains all version data of the package, which is described as follows.

Attribute	Type	Description
_id	String	**Package name@Package version, for example, @myscope/myhsplib@1.0.0**.
_nodeVersion	String	Node.js version for publishing.
_ohpmVersion	String	Version of the ohpm client for publishing.
name	String	Package name.
version	String	Package version.
description	String	Package description.
author	json	Package author information.
repository	String	Source code repository address of the package.
license	String	Project open-source license of the package. For details, see the description below.
packageType	String	Package type. For details, see the description.
dependencies	json	Package runtime dependency.
devDependencies	json	Package development dependency.
dynamicDependencies	json	Package dynamic dependency (only for HSP packages).
types	String	Package type declaration file.
main	String	Entry file of the package.
dist	json	SSRI value and download address of the maintenance package. For details, see the description.
hspType	String	HSP Package type. For details, see the description.
compatibleSdkVersion	String	SDK version.
compatibleSdkType	String	SDK type.
nativeComponents	array	Native .so dependencies.
size	num	Package size.
fileNum	num	Number of package files.
userName	String	User name for obtaining metadata.
userRole	String	User role for obtaining metadata.

author: describes the author of the package. Specifically:
- name (mandatory): author name.
- url (optional): home page address of the author.
- email (optional): email address of the author.
license: open-source license of the current project. It follows the SPDX license specification. If the license is GPL, it is recommended that repository be specified.
packageType: describes the type of the package. The packageType field exists in the metadata only when the requested package is an HSP package, and the value must be InterfaceHar.
hspType: type of the HSP package. When packageType is set to InterfaceHar, the hspType field must exist. Currently, only in-app HSP(bundle_app) is supported.
types: specifies the file name of the package type definition. If you use ArkTS to define a new type and provide it to other developers, you have to specify the declaration file, which is usually a .d.ts or .d.ets file. If the package is an HSP package, the file must exist.
main: specifies the entry file to be loaded. If types does not exist, main must exist.
dist: SSRI value and download address of the maintenance package. The specific fields are as follows:
- integrity: indicates the SSRI value of the .har file, which is used for integrity check.
- tarball: URL for downloading the .har file.
- integrity_hsp: when hspType of the package is bundle_app, the .hsp file exists. This field is the SSRI value of the .hsp file.
- resolved_hsp: URL for downloading the .hsp file.

Login

POST <router-prefix>/login

Attribute	Type	Mandatory	Description
ohpm-repo repository address	String	Yes	Domain name or IP address of the ohpm-repo repository that is set up.
repo_name	String	Yes	Name of the repository to be accessed.

Request example:

Request method: POST
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/login
Request header:
command: login;
Request body (JSON format):
{
  "publishId": "95115BAFDE",
  "timestamp": 1702088629606,
  "nonce": "e3b3d53f91d0488f9838c86e306ca9f5",
  "signature": "qXYUnUK8Quy95a...",
  "version": "v1"
}

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.

The request body contains the following five fields:

Attribute	Type	Description
version	String	(Mandatory) Protocol version.
publishId	String	(Mandatory) Publish ID.
timestamp	number	(Mandatory) Publish timestamp.
nonce	String	(Mandatory) Random number.
signature	String	(Mandatory) Signature value. For details, see the description.

1. publishId: publish ID generated by ohpm-repo. The publish ID is bound to a user. The publish ID of each user is unique and is configured by publish_id in the .ohpmrc file on the client.

2. timestamp: timestamp, in milliseconds.

3. nonce: uuidv4 random number that is dynamically generated when the client logs in.

4. signature: When a user logs in to the client, the signature is generated by combining the protocol version, publish ID, publish timestamp, and random number in the v{version}-{publishId}-{timestamp}-{nonce} format using a private key and the RSA-SHA-256 algorithm.

Successful response example:

{
  "success": true,
  "token": "7100c3f38dddf3cf8234...."
}

The successful response body contains two fields, as described in the following table.

Attribute	Type	Description
success	boolean	Whether the response is successful. The value is true.
token	String	Token returned after the successful authentication.

Failed response example:

{
    "success": false,
    "error": "The timestamp is expired"
}

The failed response body contains two fields, as described in the following table.

Attribute	Type	Description
success	boolean	Whether the response is successful. The value is false.
error	String	Returned error cause of the authentication failure.

token: authentication information generated by ohpm-repo when public and private key authentication is used. You can upload and remove packages and edit tags only after the authentication information is checked to be valid.

Publish

[h2]Uploading a HAR/HSP Package to ohpm-repo

PUT <router-prefix>/:package_name

Attribute	Type	Mandatory	Description
package_name	String	Yes	Package name.

If the package name contains an organization name, the value of package_name is the URL-encoded package name. For example, if the package name is @myscope/mypkg, the value of package_name is @myscope%2fmypkg.

Request example (for example, uploading an in-app HSP @myscope/myhsppkg):

Request method: PUT
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/@myscope%2fmypkg
Request header:
command: publish
Authorization:<token>
Request body (metadata of the package, generated by the ohpm client):
{
  "_id": "@myscope/myhsppkg",
  "name": "@myscope/myhsppkg",
  "packageType": "InterfaceHar",
  "description": "Please describe the basic information.",
  "dist-tags": {
    "latest": "1.0.4"
  },
  "versions": {
    "1.0.4": {
      "name": "@myscope/myhsppkg",
      "version": "1.0.4",
      "description": "Please describe the basic information.",
      "author": {
        "name": "fsq",
        "url": "",
        "email": ""
      },
      "license": "Apache-2.0",
      "packageType": "InterfaceHar",
      "dependencies": {
        "pkga": "1.0.0",
        "pkgb": "1.0.0"
      },
      "types": "Index.d.ets",
      "_nodeVersion": "16.20.1",
      "_ohpmVersion": "1.4.0",
      "_id": "@myscope/myhsppkg@1.0.4",
      "dist": {
        "integrity": "sha512-0bHCBS2JtlyX7Gq5q6tbO2eRRbj0RO2cAAagC/K6/zmDZHPGrnIScDkD3Yjip8I/YWq7VbY7HYlHXtcLApILVg==",
        "tarball": "https://localhost:8081/repos/ohpm/@myscope/myhsppkg/-/@myscope/myhsppkg-1.0.4.har",
        "integrity_hsp": "sha512-3B7KlJFEHuQ9X+Zxl+oRVIL8CCczaPu2nEGQvXrULrViXuY80Ld2CnkQEVFfd/eZK6DNAFTS1wBhqOTLYtOqow=="
      }
    }
  },
  "_attachments": {
    "@test/ohpmhsplib-1.0.4.har": {
      "content_type": "application/octet-stream",
      "data": "H4sIAAAAAAAACu1ZUU...",
      "length": 858
    },
    "@test/ohpmhsplib-1.0.4.hsp": {
      "content_type": "application/octet-stream",
      "data": "UEsDBAoAAAgAAAAAIU5v...",
      "length": 29185
    }
  },
  "hspType": "bundle_app"
}

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.
Authorization	String	(Mandatory) Authentication information, which is the value of AccessToken or the token for calling the Login API.

The request body data contains eight first-level fields, which are described as follows.

Attribute	Type	Description
_id	String	Package name, which is used as the primary key ID of the database.
name	String	Package name.
description	String	Package description.
dist-tags	json	All tags of the package.
versions	json	All version data of the package.
packageType	String	Package type. For details, see the description.
_attachments	json	Data of the package to be published.
hspType	json	Type of the HSP.

If the package to be uploaded is an in-app HSP package, the package is in .tgz format and contains .har and .hsp files. The _attachments part of the metadata contains the two files.
When the package to be uploaded is a HAR package, the package format must be .har.
When an HSP package is uploaded, the submitted metadata contains the packageType field and the value is InterfaceHar.
If the uploaded package is an in-app HSP package, the integrity_hsp field exists in the dist field of version in the submitted metadata, indicating the SSRI value of the HSP.

Successful response body example:

{
    "code": 200,
    "message": "success",
}

Failed response body example:

{
    "success": false,
    "error": "<error message>",
 }

[h2]Streaming Uploading a HAR/HSP to ohpm-repo

The ohpm client (5.0.1 and later versions) and ohpm-repo (5.0.1 and later versions) support streaming upload. When the size of the uploaded third-party package exceeds the threshold (5 MB by default, which can be customized in .ohpmrc), ohpm preferentially calls the streaming upload API to upload the package.

POST <router-prefix>/stream/:package_name

Attribute	Type	Mandatory	Description
package_name	String	Yes	Package name. If the package name contains an organization name, the value of *package_name* is the URL-encoded package name. For example, if the package name is @myscope/mypkg, the value of *package_name* is @myscope%2fmypkg.

Request example (uploading an in-app HSP @myscope/myhsppkg):

Request method: POST
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/stream/@myscope%2fmypkg
Request header:
command: publish
Authorization:<token>
Request body: in the formData format and consisting of the following parts:
(1) metadata=<file.json>: package metadata
(2) pkg_stream=<@hsp.tgz;application/octet-stream>: file stream data of the package to be uploaded

The metadata of the request body package in the request example is as follows:

{
  "_id": "@myscope/myhsppkg",
  "name": "@myscope/myhsppkg",
  "packageType": "InterfaceHar",
  "description": "Please describe the basic information.",
  "dist-tags": {
    "latest": "1.0.4"
  },
  "versions": {
    "1.0.4": {
      "name": "@myscope/myhsppkg",
      "version": "1.0.4",
      "description": "Please describe the basic information.",
      "author": {
        "name": "fsq",
        "url": "",
        "email": ""
      },
      "license": "Apache-2.0",
      "packageType": "InterfaceHar",
      "dependencies": {
        "pkga": "1.0.0",
        "pkgb": "1.0.0"
      },
      "types": "Index.d.ets",
      "_nodeVersion": "16.20.1",
      "_ohpmVersion": "1.4.0",
      "_id": "@myscope/myhsppkg@1.0.4",
      "dist": {
        "integrity": "sha512-0bHCBS2JtlyX7Gq5q6tbO2eRRbj0RO2cAAagC/K6/zmDZHPGrnIScDkD3Yjip8I/YWq7VbY7HYlHXtcLApILVg==",
        "tarball": "https://localhost:8081/repos/ohpm/@myscope/myhsppkg/-/@myscope/myhsppkg-1.0.4.har",
        "integrity_hsp": "sha512-3B7KlJFEHuQ9X+Zxl+oRVIL8CCczaPu2nEGQvXrULrViXuY80Ld2CnkQEVFfd/eZK6DNAFTS1wBhqOTLYtOqow=="
      }
    }
  },
  "hspType": "bundle_app"
   "pkg": "D:\\basicData\\har\\package.tgz",
   "isTgz": true
}

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.
Authorization	String	(Mandatory) Authentication information, which is the value of AccessToken or the token for calling the Login API.

The request body metadata contains nine first-level fields, which are described as follows.

Attribute	Type	Description
_id	String	Package name, which is used as the primary key ID of the database.
name	String	Package name.
description	String	Package description.
dist-tags	json	All tags of the package.
versions	json	All version data of the package.
packageType	String	Package type. For details, see the description.
hspType	json	Type of the HSP.
pkg	String	Path of the uploaded package.
isTgz	boolean	Whether the package is a TGZ package.

If the package to be uploaded is an in-app HSP package, the package is in .tgz format and contains .har and .hsp files.
When the package to be uploaded is a HAR package, the package format must be .har.
When an HSP package is uploaded, the submitted metadata contains the packageType field and the value is InterfaceHar.
If the uploaded package is an in-app HSP package, the integrity_hsp field exists in the dist field of version in the submitted metadata, indicating the SSRI value of the HSP.

Successful response body example:

{
    "code": 200,
    "message": "success"
}

Failed response body example:

{
    "success": false,
    "error": "<error message>"
 }

Unpublish

Removes a HAR/HSP package (a version or the entire package) from ohpm-repo.

DELETE <router-prefix>/:package_name

Attribute	Type	Mandatory	Description
package_name	String	Yes	Package name.

If the package name contains an organization name, the value of package_name is the URL-encoded package name. For example, if the package name is @myscope/myhsppkg, the value of package_name is @myscope%2fmyhsppkg.
If a version is specified, add <version> to the request body, for example, {"version":"1.0.0"}.
If no version is specified, all versions of the package will be removed.

Request example:

Request method: DELETE
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/@myscope%2fmyhsppkg
Request header:
command: unpublish
Authorization:<token>
Request body:
{"version":"1.0.0"}

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.
Authorization	String	(Mandatory) Authentication information, which is the value of AccessToken or the token for calling the Login API.

Successful response body example:

{
    "code": 200,
    "message": "success"
}

Failed response body example:

{
    "success": false,
    "error": "<error message>"
 }

Ping

Check the network connectivity with ohpm-repo.

GET <router-prefix>/-/ping

Request example:

Request method: GET
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/-/ping

Successful response example:

{
    "code": 200,
    "message": "success"
}

Failed response body example:

{
    "success": false,
    "error": "<error message>"
 }

DistTags

[h2]Adding a Tag

Adds a tag to the package.

POST <router-prefix>/-/package/:package_name/dist-tags/:tag

Attribute	Type	Mandatory	Description
package_name	String	Yes	Package name.
tag	String	Yes	Tag name.

Request example (adding the tag test to package @myscope/myhsppkg@1.0.0):

Request method: POST
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/-/package/@myscope%2fmypkg/dist-tags/test
Request header:
command: dist-tags
Authorization:<token>
Request body:
{"version":"1.0.0"}

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.
Authorization	String	(Mandatory) Authentication information, which is the value of AccessToken or the token for calling the Login API.

Successful response example:

{
    "code": 200,
    "message": "success"
}

Failed response body example:

{
    "success": false,
    "error": "<error message>"
 }

[h2]Updating a Tag

Changes the version number corresponding to the package tag.

PUT <router-prefix>/-/package/:package_name/dist-tags/:tag

Attribute	Type	Mandatory	Description
package_name	String	Yes	Package name.
tag	String	Yes	Tag name.

Request example (changing the tag test of package @myscope/myhsppkg to version 2.0.0):

Request method: PUT
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/-/package/@myscope%2fmypkg/dist-tags/test
Request header:
command: dist-tags
Authorization:<token>
Request body:
{"version":"2.0.0"}

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.
Authorization	String	(Mandatory) Authentication information, which is the value of AccessToken or the token for calling the Login API.

Successful response example:

{
    "code": 200,
    "message": "success"
}

Failed response body example:

{
    "success": false,
    "error": "<error message>"
 }

[h2]Deleting a Tag

Deletes the tag of the package.

DELETE <router-prefix>/-/package/:package_name/dist-tags/:tag

Attribute	Type	Mandatory	Description
package_name	String	Yes	Package name.
tag	String	Yes	Tag name.

Request example (deleting the tag test of the package @myscope/myhsppkg):

Request method: DELETE
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/-/package/@myscope%2fmypkg/dist-tags/test
Request header:
command: dist-tags
Authorization:<token>

The request header contains the following fields.

Attribute	Type	Description
command	String	(Optional) Name of the command.
Authorization	String	(Mandatory) Authentication information, which is the value of AccessToken or the token for calling the Login API.

Successful response example:

{
    "code": 200,
    "message": "success"
}

Failed response body example:

{
    "success": false,
    "error": "<error message>"
 }

Versions

Displays the version list of third-party libraries. Query results are sorted by release time in ascending order and presented in paginated lists.

GET <router-prefix>/:group?/:package_name/versions?pageNum=1&pageSize=10

Attribute	Type	Mandatory	Description
group	String	No	Organization name, which starts with @, for example, @ohos.
package_name	String	Yes	Package name (excluding the organization part).
pageNum	number	No	Page number. The value ranges from 1 to 10000.
pageSize	number	No	Number of versions displayed on a page. The value ranges from 1 to 500.

Request example (viewing versions in the @myscope/myhsppkg package):

Request method: GET
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
Request URL: http://myohpmrepo.com/repos/ohpm/@myscope%2fmypkg/versions?pageNum=1&pageSize=10
Request header:
authorization: NjJmNjFhODI3N2ZlNDUwMzlhYmUwNjQxZjQ3ZTNhZDU=

The request header contains the following field.

Attribute	Type	Description
authorization	String	Read-only or read-write access token. This is an optional field, but must be provided if ohpm-repo is configured to disallow anonymous access.

Failed response example (requesting the in-app HAR package @test/package1):

{
    "code": 1018,
    "message": "package not found: @test/package1"
}

The failed response body contains two fields, as described in the following table.

Attribute	Type	Mandatory	Description
code	number	Yes	Error code for the response failure.
message	String	Yes	Error message for the response failure.

Successful response example:

{
    "code": 200,
    "body": {
        "total": 2,
        "pageNum": 1,
        "pageSize": 10,
        "rows": ["1.0.1","1.0.2"],
        "pages": 1
    } 
}

Failed response body example:

{
    "code": 404,
    "error": "<error message>"
 }

CheckUpdate

Checks whether updates are available for currently imported third-party libraries. Non-existent packages are filtered out, and the results are displayed in a list, with a maximum of 50 libraries per query.

POST <router-prefix>/checkUpdate

The request body is an array with a maximum length of 50. Each item in the body is a JSON object containing five fields.

Attribute	Type	Mandatory	Description
packageName	String	Yes	Package name (including the organization part).
moduleName	String	Yes	Module name, which identifies the module from which the package name in the current request body originates.
dependencyConfig	String	Yes	Dependency version configured in the module. Only remote dependencies are supported. Length range: (0, 128]. Remote dependency formats: Exact version: x.x.x Patch version: ~x.x.x or ~x.x Minor version: ^x.x.x Wildcard: * or x.x.* Version range: >1.0.0, ≤2.0.0, or 1.2.0 to 2.0.0 Latest version: latest Tag version: tag:beta
installedVersion	String	No	Version of the dependency that has been installed. If the dependency has not been installed, this parameter can be left empty.
depth	number	Yes	Whether the package is a direct dependency. Currently, only direct dependencies are supported. The value is fixed at 0.

Request example (checking updates for @myscope/myhsppkg):

Request method: POST
// http://myohpmrepo.com: ohpm-repo repository address. Replace it with the domain name or IP address of the ohpm-repo repository you have set up.
// repos: fixed field.
// ohpm: name of the repository to be accessed. Replace it with the actual repository name.
// checkUpdate: fixed field.
Request URL: http://myohpmrepo.com/repos/ohpm/checkUpdate
Request header:
Authorization: NjJmNjFhODI3N2ZlNDUwMzlhYmUwNjQxZjQ3ZTNhZDU=
Request body:
[
    {
        "packageName":"@myscope/myhsppkg",
        "moduleName":"modulea",
        "dependencyConfig":"*",
        "installedVersion":"1.0.0",
        "depth":0
    }
]

The request header contains the following field.

Attribute	Type	Description
Authorization	String	(Optional) Read-only or read-write access token. This field is mandatory when ohpm-repo does not support anonymous access.

Attribute

Type

Description

Authorization

String

(Optional) Read-only or read-write access token.

This field is mandatory when ohpm-repo does not support anonymous access.

Successful response example:

{
    "code": 200,
    "body": [
        {
            "packageName": "@myscope/myhsppkg",
            "depth": 0,
            "moduleName": "modulea",
            "installedVersion": "1.0.0",
            "wantedVersion": "2.0.0",
            "latestVersion": "2.0.0",
            "updateType": "major",
            "description": "major update",
            "dependentPackageName": "",
            "homePage": "",
            "recommend": [],
            "security": []
        }
    ]
}

The response body contains two fields.

Attribute	Type	Description
code	String	Status code.
body	array	List of package version update information.

Each item in the body is a JSON object containing the following fields.

Attribute	Type	Description
packageName	String	Package name (including the organization part).
depth	String	Whether the package is a direct dependency. Currently, only direct dependencies are supported. The value is fixed at 0.
moduleName	String	Module name, which identifies the module from which the package name in the current request body originates.
installedVersion	String	Version of the installed dependency.
wantedVersion	String	Version matched based on the dependency configuration.
latestVersion	String	Latest version of the current package.
updateType	String	Update type.
description	String	Update description.
dependentPackageName	String	Reserved field, which is left empty by default.
homePage	String	Package repository address. This field is not applicable for private repositories and is fixed at "".
recommend	array	Preferred recommended packages. This field is not applicable for private repositories and is fixed at [].
security	array	Security risk information of the current version (installVersion) of the package. This field is not applicable for private repositories and is fixed at [].

Failed response example:

{
    "code": 1001,
    "error": "ModuleName verification failed"
}

Repository Response Codes

Response code	Scope	Description
200	All interfaces of the repository	Success.
400	All interfaces of the repository	Login failure or unknown error.
401	Fetch Metadata, Publish, Unpublish, DistTags, Versions, and CheckUpdate	Verification failure of parameters input by the client or authentication failure.
404	Accessing the interface that does not exist in the repository	API not found.
500	All interfaces of the repository	Internal server error.
598	Publish	When the response status code returned by the repository upload interface is 598, ohpm 5.0.1 or later attempts to upload the file again.

The streaming upload API is supported in ohpm 5.0.1 and later versions. When ohpm calls this API, if the returned response status code is 404, the ohpm client calls the upload API again to upload data. To ensure compatibility with the ohpm client, ensure that the response status code 404 is returned when an interface that does not exist in the repository is accessed.

目录

ohpm Repository Interface Protocol

Overview

Fetch Metadata

[h2]Metadata Response Data Description

Login

Publish

[h2]Uploading a HAR/HSP Package to ohpm-repo

[h2]Streaming Uploading a HAR/HSP to ohpm-repo

Unpublish

Ping

DistTags

[h2]Adding a Tag

[h2]Updating a Tag

[h2]Deleting a Tag

Versions

CheckUpdate

Repository Response Codes