@0xordek/git-me 0.3.0 → 0.4.0

package/dist/worker.js

@@ -0,0 +1,635 @@
+// src/config.ts
+var ConfigError = class extends Error {
+  constructor(message = "configuration error") {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+function loadConfig(env) {
+  if (!env.GITME_AUTH_TOKEN) throw new ConfigError();
+  const transferMode = env.GITME_TRANSFER_MODE ?? "proxy";
+  if (transferMode !== "proxy" && transferMode !== "direct") throw new ConfigError();
+  const signedUrlTtlSeconds = parseSignedUrlTtl(env.GITME_SIGNED_URL_TTL_SECONDS);
+  const config = { authToken: env.GITME_AUTH_TOKEN, transferMode, signedUrlTtlSeconds };
+  if (transferMode === "direct") {
+    const { GITME_R2_ACCOUNT_ID, GITME_R2_ACCESS_KEY_ID, GITME_R2_SECRET_ACCESS_KEY, GITME_R2_BUCKET_NAME } = env;
+    if (!GITME_R2_ACCOUNT_ID || !GITME_R2_ACCESS_KEY_ID || !GITME_R2_SECRET_ACCESS_KEY || !GITME_R2_BUCKET_NAME) {
+      throw new ConfigError();
+    }
+    config.r2Signing = {
+      accountId: GITME_R2_ACCOUNT_ID,
+      accessKeyId: GITME_R2_ACCESS_KEY_ID,
+      secretAccessKey: GITME_R2_SECRET_ACCESS_KEY,
+      bucketName: GITME_R2_BUCKET_NAME
+    };
+  }
+  return config;
+}
+function healthResponse(env) {
+  try {
+    const config = loadConfig(env);
+    return appJson(200, { ok: true, transfer_mode: config.transferMode });
+  } catch {
+    return appJson(500, { ok: false });
+  }
+}
+function parseSignedUrlTtl(raw) {
+  if (raw === void 0) return 900;
+  const value = Number(raw);
+  if (!Number.isInteger(value) || value < 60 || value > 3600) throw new ConfigError();
+  return value;
+}
+function appJson(status, body) {
+  return new Response(JSON.stringify(body) + "\n", { status, headers: { "Content-Type": "application/json" } });
+}
+
+// src/signing.ts
+var ALGORITHM = "AWS4-HMAC-SHA256";
+var REGION = "auto";
+var SERVICE = "s3";
+var TERMINATOR = "aws4_request";
+var PAYLOAD_HASH = "UNSIGNED-PAYLOAD";
+async function presignR2Url(input) {
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  const amzDate = formatAmzDate(now);
+  const dateStamp = amzDate.slice(0, 8);
+  const credentialScope = `${dateStamp}/${REGION}/${SERVICE}/${TERMINATOR}`;
+  const host = `${input.signing.accountId}.r2.cloudflarestorage.com`;
+  const canonicalUri = `/${encodePathSegment(input.signing.bucketName)}/${encodePath(input.key)}`;
+  const query = [
+    ["X-Amz-Algorithm", ALGORITHM],
+    ["X-Amz-Content-Sha256", PAYLOAD_HASH],
+    ["X-Amz-Credential", `${input.signing.accessKeyId}/${credentialScope}`],
+    ["X-Amz-Date", amzDate],
+    ["X-Amz-Expires", String(input.expiresSeconds)],
+    ["X-Amz-SignedHeaders", "host"]
+  ];
+  const canonicalQuery = canonicalQueryString(query);
+  const canonicalRequest = [
+    input.method,
+    canonicalUri,
+    canonicalQuery,
+    `host:${host}
+`,
+    "host",
+    PAYLOAD_HASH
+  ].join("\n");
+  const stringToSign = [ALGORITHM, amzDate, credentialScope, await sha256Hex(canonicalRequest)].join("\n");
+  const signingKey = await deriveSigningKey(input.signing.secretAccessKey, dateStamp);
+  const signature = await hmacHex(signingKey, stringToSign);
+  return `https://${host}${canonicalUri}?${canonicalQueryString([...query, ["X-Amz-Signature", signature]])}`;
+}
+function canonicalQueryString(query) {
+  return query.map(([key, value]) => [encodeQueryPart(key), encodeQueryPart(value)]).sort(([ak, av], [bk, bv]) => compareAscii(ak, bk) || compareAscii(av, bv)).map(([key, value]) => `${key}=${value}`).join("&");
+}
+function compareAscii(a, b) {
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}
+function encodePath(path) {
+  return path.split("/").map(encodePathSegment).join("/");
+}
+function encodePathSegment(segment) {
+  return encodeQueryPart(segment);
+}
+function encodeQueryPart(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (char) => "%" + char.charCodeAt(0).toString(16).toUpperCase());
+}
+function formatAmzDate(date) {
+  return date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+}
+async function deriveSigningKey(secretAccessKey, dateStamp) {
+  const dateKey = await hmacBytes(textBytes("AWS4" + secretAccessKey), dateStamp);
+  const regionKey = await hmacBytes(dateKey, REGION);
+  const serviceKey = await hmacBytes(regionKey, SERVICE);
+  const signingKeyBytes = await hmacBytes(serviceKey, TERMINATOR);
+  return importHmacKey(signingKeyBytes);
+}
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest("SHA-256", toArrayBuffer(textBytes(value)));
+  return bytesToHex(new Uint8Array(digest));
+}
+async function hmacBytes(keyBytes, value) {
+  const key = await importHmacKey(keyBytes);
+  const signature = await crypto.subtle.sign("HMAC", key, toArrayBuffer(textBytes(value)));
+  return new Uint8Array(signature);
+}
+async function hmacHex(key, value) {
+  const signature = await crypto.subtle.sign("HMAC", key, toArrayBuffer(textBytes(value)));
+  return bytesToHex(new Uint8Array(signature));
+}
+function importHmacKey(keyBytes) {
+  return crypto.subtle.importKey("raw", toArrayBuffer(keyBytes), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+}
+function textBytes(value) {
+  return new TextEncoder().encode(value);
+}
+function toArrayBuffer(bytes) {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy.buffer;
+}
+function bytesToHex(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
+// src/auth.ts
+var USER_REGISTRY = "admin:users";
+async function createUser(env, username, password, access) {
+  await requestAuth(env, username, { action: "create", username, password, access });
+}
+async function deleteUser(env, username) {
+  await requestAuth(env, username, { action: "delete", username });
+}
+async function authenticateUser(env, username, password, source) {
+  return await requestAuth(env, username, { action: "authenticate", username, password, source });
+}
+async function updateUserIndex(env, username, access) {
+  await requestAuth(env, USER_REGISTRY, access ? { action: "upsert", username, access } : { action: "remove", username });
+}
+async function listUsers(env) {
+  return (await requestAuth(env, USER_REGISTRY, { action: "list" })).users;
+}
+async function requestAuth(env, username, body) {
+  const request = new Request("https://git-me.internal/auth", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const response2 = await env.GITME_AUTH.getByName(username).fetch(request);
+  if (!response2.ok) throw new Error("authentication service error");
+  return await response2.json();
+}
+
+// src/auth-do.ts
+var RECORD_KEY = "record";
+var USERS_KEY = "users";
+var ATTEMPTS_PREFIX = "attempts:";
+var PBKDF2_ITERATIONS = 6e5;
+var MAX_FAILURES = 5;
+var FAILURE_WINDOW_MS = 6e4;
+var LOCKOUT_MS = 6e4;
+var AuthUser = class {
+  constructor(state, env) {
+    this.state = state;
+    this.env = env;
+  }
+  state;
+  env;
+  async fetch(request) {
+    return await this.state.blockConcurrencyWhile(async () => await this.handle(request));
+  }
+  async handle(request) {
+    if (request.method !== "POST") return response(405, { ok: false });
+    let input;
+    try {
+      input = await request.json();
+    } catch {
+      return response(400, { ok: false });
+    }
+    if (!isAuthRequest(input)) return response(400, { ok: false });
+    if (input.action === "list") return response(200, { ok: true, users: await this.readUsers() });
+    if (input.action === "upsert" || input.action === "remove") return await this.updateUsers(input);
+    if (input.action === "create") return await this.create(input);
+    if (input.action === "delete") return await this.remove(input);
+    return await this.authenticate(input);
+  }
+  async create(input) {
+    if (input.password.length < 12 || input.password.length > 1024) return response(400, { ok: false });
+    const record = await createRecord(input.password, input.access);
+    await this.state.storage.put(RECORD_KEY, record);
+    await this.env.GITME_KV.delete(`user:${input.username}`);
+    await updateUserIndex(this.env, input.username, input.access);
+    await this.state.storage.put(RECORD_KEY, { ...record, indexed: true });
+    return response(200, { ok: true, access: input.access });
+  }
+  async remove(input) {
+    await this.state.storage.put(RECORD_KEY, { version: 1, deleted: true });
+    await this.env.GITME_KV.delete(`user:${input.username}`);
+    await updateUserIndex(this.env, input.username);
+    return response(200, { ok: true });
+  }
+  async authenticate(input) {
+    if (await this.isLocked(input.source)) return response(200, { ok: false });
+    const stored = await this.state.storage.get(RECORD_KEY);
+    if (stored && !("deleted" in stored)) {
+      if (await verifyPassword(input.password, stored)) {
+        await this.state.storage.delete(attemptKey(input.source));
+        if (!stored.indexed) {
+          await updateUserIndex(this.env, input.username, stored.access);
+          await this.state.storage.put(RECORD_KEY, { ...stored, indexed: true });
+        }
+        return response(200, { ok: true, access: stored.access });
+      }
+      await this.recordFailure(input.source);
+      return response(200, { ok: false });
+    }
+    if (stored) return response(200, { ok: false });
+    const legacy = await this.legacyRecord(input.username);
+    if (legacy && await legacyPasswordMatches(input.password, legacy.password_sha256)) {
+      const access = legacy.access === "write" ? "write" : legacy.access === "read" ? "read" : null;
+      if (access) {
+        const record = await createRecord(input.password, access);
+        await this.state.storage.put(RECORD_KEY, record);
+        await this.state.storage.delete(attemptKey(input.source));
+        await this.env.GITME_KV.delete(`user:${input.username}`);
+        await updateUserIndex(this.env, input.username, access);
+        await this.state.storage.put(RECORD_KEY, { ...record, indexed: true });
+        return response(200, { ok: true, access });
+      }
+    }
+    if (legacy) await this.recordFailure(input.source);
+    return response(200, { ok: false });
+  }
+  async updateUsers(input) {
+    const users = await this.readUsers();
+    const existing = users.findIndex((user) => user.username === input.username);
+    if (input.action === "remove") {
+      if (existing >= 0) users.splice(existing, 1);
+    } else if (existing >= 0) {
+      users[existing] = { username: input.username, access: input.access };
+    } else {
+      users.push({ username: input.username, access: input.access });
+    }
+    users.sort((left, right) => left.username.localeCompare(right.username));
+    await this.state.storage.put(USERS_KEY, users);
+    return response(200, { ok: true });
+  }
+  async readUsers() {
+    const users = await this.state.storage.get(USERS_KEY);
+    return Array.isArray(users) ? users.filter(isIndexedUser).sort((left, right) => left.username.localeCompare(right.username)) : [];
+  }
+  async legacyRecord(username) {
+    const raw = await this.env.GITME_KV.get(`user:${username}`);
+    if (!raw) return null;
+    try {
+      const value = JSON.parse(raw);
+      return typeof value === "object" && value ? value : null;
+    } catch {
+      return null;
+    }
+  }
+  async isLocked(source) {
+    const attempts = await this.state.storage.get(attemptKey(source));
+    return Boolean(attempts && attempts.lockedUntil > Date.now());
+  }
+  async recordFailure(source) {
+    const now = Date.now();
+    const key = attemptKey(source);
+    const previous = await this.state.storage.get(key);
+    const attempts = !previous || previous.windowStartedAt + FAILURE_WINDOW_MS <= now ? { count: 1, windowStartedAt: now, lockedUntil: 0 } : { ...previous, count: previous.count + 1 };
+    if (attempts.count >= MAX_FAILURES) attempts.lockedUntil = now + LOCKOUT_MS;
+    await this.state.storage.put(key, attempts);
+  }
+};
+function isAuthRequest(value) {
+  if (!isRecord(value) || typeof value.action !== "string") return false;
+  if (value.action === "list") return true;
+  if (typeof value.username !== "string") return false;
+  if (value.action === "remove") return true;
+  if (value.action === "upsert") return value.access === "read" || value.access === "write";
+  if (value.action === "delete") return true;
+  if (value.action === "authenticate") return typeof value.password === "string" && typeof value.source === "string" && value.source.length > 0 && value.source.length <= 64;
+  return value.action === "create" && typeof value.password === "string" && (value.access === "read" || value.access === "write");
+}
+function isIndexedUser(value) {
+  return isRecord(value) && typeof value.username === "string" && (value.access === "read" || value.access === "write");
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function attemptKey(source) {
+  return ATTEMPTS_PREFIX + source;
+}
+async function createRecord(password, access) {
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  return { version: 1, access, salt: bytesToBase64(salt), hash: await passwordHash(password, salt) };
+}
+async function verifyPassword(password, record) {
+  try {
+    return constantTimeEqual(await passwordHash(password, base64ToBytes(record.salt)), record.hash);
+  } catch {
+    return false;
+  }
+}
+async function passwordHash(password, salt) {
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", hash: "SHA-256", salt: toArrayBuffer2(salt), iterations: PBKDF2_ITERATIONS }, key, 256);
+  return bytesToBase64(new Uint8Array(bits));
+}
+async function legacyPasswordMatches(password, hash) {
+  if (typeof hash !== "string" || !/^[0-9a-f]{64}$/i.test(hash)) return false;
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(password));
+  return constantTimeEqual(bytesToHex2(new Uint8Array(digest)), hash.toLowerCase());
+}
+function constantTimeEqual(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  return difference === 0;
+}
+function bytesToBase64(bytes) {
+  return btoa(String.fromCharCode(...bytes));
+}
+function base64ToBytes(value) {
+  return Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+}
+function bytesToHex2(bytes) {
+  return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function toArrayBuffer2(bytes) {
+  const copy = new Uint8Array(bytes.byteLength);
+  copy.set(bytes);
+  return copy.buffer;
+}
+function response(status, body) {
+  return new Response(JSON.stringify(body), { status, headers: { "Content-Type": "application/json" } });
+}
+
+// src/worker.ts
+var LFS_CONTENT_TYPE = "application/vnd.git-lfs+json";
+var OBJECT_PREFIX = "objects/";
+var OID_RE = /^[0-9a-fA-F]{64}$/;
+var USERNAME_RE = /^[a-z0-9][a-z0-9_.-]{0,62}$/;
+var worker_default = {
+  async fetch(request, env, _ctx) {
+    const requestId = crypto.randomUUID();
+    let path = "";
+    try {
+      const url = new URL(request.url);
+      path = url.pathname;
+      if (request.method === "GET" && url.pathname === "/health") {
+        return healthResponse(env);
+      }
+      let config;
+      try {
+        config = loadConfig(env);
+      } catch (error) {
+        if (error instanceof ConfigError) return lfsError(500, "configuration error");
+        throw error;
+      }
+      if (url.pathname === "/admin/users") return handleAdminUsers(request, env, config);
+      if (url.pathname.startsWith("/admin/users/")) return handleAdminUser(request, env, config, url.pathname.slice("/admin/users/".length));
+      if (url.pathname === "/objects/batch") {
+        return handleBatch(request, env, config);
+      }
+      if (url.pathname.startsWith("/objects/")) {
+        const oid = url.pathname.slice("/objects/".length);
+        if (request.method === "PUT") {
+          const auth = await requireLfsAccess(request, env, config, "write");
+          if (auth) return auth;
+          return handleUpload(request, env, oid);
+        }
+        if (request.method === "GET") {
+          const auth = await requireLfsAccess(request, env, config, "read");
+          if (auth) return auth;
+          return handleDownload(env, oid);
+        }
+        return lfsError(405, "method not allowed");
+      }
+      return new Response("not found\n", { status: 404 });
+    } catch (error) {
+      console.error("git-me request failed", {
+        requestId,
+        method: request.method,
+        path,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      const response2 = lfsError(500, "internal server error");
+      response2.headers.set("X-Request-Id", requestId);
+      return response2;
+    }
+  }
+};
+async function handleBatch(request, env, config) {
+  if (request.method !== "POST") return lfsError(405, "method not allowed");
+  const auth = await authenticateLfs(request, env, config);
+  if ("response" in auth) return auth.response;
+  if (!isLfsContentType(request.headers.get("Content-Type"))) {
+    return lfsError(415, "content type must be " + LFS_CONTENT_TYPE);
+  }
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return lfsError(400, "invalid JSON");
+  }
+  const transfer = selectTransfer(body.transfers);
+  if (!transfer) return lfsError(400, "unsupported transfer adapter");
+  if (!isLfsOperation(body.operation)) {
+    return lfsError(400, "lfs: unknown batch operation: " + body.operation);
+  }
+  if (!canAccess(auth.access, body.operation === "upload" ? "write" : "read")) return lfsError(403, "forbidden");
+  if (!Array.isArray(body.objects)) return lfsError(400, "objects must be an array");
+  const objects = [];
+  for (const obj of body.objects) {
+    const validation = validateObject(obj);
+    if (validation) return lfsError(400, validation);
+    objects.push(obj);
+  }
+  const responseObjects = [];
+  for (const obj of objects) {
+    const href = new URL(`/objects/${obj.oid}`, request.url).href;
+    if (body.operation === "upload") {
+      const existing = await env.GITME_R2.head(OBJECT_PREFIX + obj.oid);
+      if (existing?.customMetadata?.sha256 === obj.oid.toLowerCase()) {
+        responseObjects.push(existing.size === obj.size ? { oid: obj.oid, size: obj.size } : objectConflict(obj));
+        continue;
+      }
+      responseObjects.push({ oid: obj.oid, size: obj.size, actions: { upload: { href } } });
+      continue;
+    }
+    const head = await env.GITME_R2.head(OBJECT_PREFIX + obj.oid);
+    if (!head || head.size !== obj.size) {
+      responseObjects.push(objectNotFound(obj));
+      continue;
+    }
+    if (config.transferMode === "direct" && config.r2Signing) {
+      if (head.customMetadata?.sha256 !== obj.oid.toLowerCase()) {
+        responseObjects.push({ oid: obj.oid, size: head.size, actions: { download: { href } } });
+        continue;
+      }
+      responseObjects.push({
+        oid: obj.oid,
+        size: head.size,
+        actions: {
+          download: {
+            href: await presignR2Url({
+              method: "GET",
+              key: OBJECT_PREFIX + obj.oid,
+              expiresSeconds: config.signedUrlTtlSeconds,
+              signing: config.r2Signing
+            }),
+            expires_in: config.signedUrlTtlSeconds
+          }
+        }
+      });
+      continue;
+    }
+    responseObjects.push({ oid: obj.oid, size: head.size, actions: { download: { href } } });
+  }
+  return json(200, { transfer, objects: responseObjects });
+}
+async function handleUpload(request, env, oid) {
+  if (!OID_RE.test(oid)) return lfsError(400, "invalid oid");
+  if (!request.body) return lfsError(400, "missing request body");
+  const objectKey = OBJECT_PREFIX + oid;
+  const tempKey = OBJECT_PREFIX + ".tmp/" + crypto.randomUUID();
+  const [storeStream, digestStream] = request.body.tee();
+  const putPromise = env.GITME_R2.put(tempKey, storeStream);
+  const digest = await digestAndCount(digestStream);
+  await putPromise;
+  if (digest.hex.toLowerCase() !== oid.toLowerCase()) {
+    await env.GITME_R2.delete(tempKey);
+    return lfsError(400, "upload hash mismatch");
+  }
+  const tempObject = await env.GITME_R2.get(tempKey);
+  if (!tempObject?.body) return lfsError(500, "internal server error");
+  await env.GITME_R2.put(objectKey, tempObject.body, { customMetadata: { sha256: oid.toLowerCase() } });
+  await env.GITME_R2.delete(tempKey);
+  return new Response(null, { status: 200 });
+}
+async function handleAdminUser(request, env, config, rawUsername) {
+  if (request.headers.get("Authorization") !== `Bearer ${config.authToken}`) return appJson2(401, { message: "authentication required" });
+  const username = normalizeUsername(decodeURIComponent(rawUsername));
+  if (!username) return appJson2(400, { message: "invalid username" });
+  if (request.method === "PUT") {
+    let body;
+    try {
+      body = await request.json();
+    } catch {
+      return appJson2(400, { message: "invalid JSON" });
+    }
+    if (typeof body.password !== "string" || body.password.length < 12) return appJson2(400, { message: "password must be at least 12 characters" });
+    const access = body.access === "read" || body.access === "write" ? body.access : "";
+    if (!access) return appJson2(400, { message: "access must be read or write" });
+    await createUser(env, username, body.password, access);
+    return appJson2(200, { username, access });
+  }
+  if (request.method === "DELETE") {
+    await deleteUser(env, username);
+    return appJson2(200, { username, deleted: true });
+  }
+  return appJson2(405, { message: "method not allowed" });
+}
+async function handleAdminUsers(request, env, config) {
+  if (request.headers.get("Authorization") !== `Bearer ${config.authToken}`) return appJson2(401, { message: "authentication required" });
+  if (request.method !== "GET") return appJson2(405, { message: "method not allowed" });
+  return appJson2(200, { users: await listUsers(env) });
+}
+async function handleDownload(env, oid) {
+  if (!OID_RE.test(oid)) return lfsError(400, "invalid oid");
+  const object = await env.GITME_R2.get(OBJECT_PREFIX + oid);
+  if (!object) return lfsError(404, "object not found");
+  return new Response(object.body, {
+    status: 200,
+    headers: {
+      "Content-Type": "application/octet-stream",
+      "Content-Length": String(object.size)
+    }
+  });
+}
+function isLfsOperation(operation) {
+  return operation === "upload" || operation === "download";
+}
+function isLfsContentType(contentType) {
+  return (contentType || "").split(";", 1)[0].trim().toLowerCase() === LFS_CONTENT_TYPE;
+}
+function selectTransfer(transfers) {
+  if (transfers == null) return "basic";
+  if (!Array.isArray(transfers)) return "";
+  if (transfers.length === 0) return "basic";
+  return transfers.includes("basic") ? "basic" : "";
+}
+function validateObject(obj) {
+  if (!isObjectRecord(obj) || !OID_RE.test(String(obj.oid || ""))) return "invalid oid";
+  if (!Number.isInteger(obj.size) || obj.size < 0) return "object size must not be negative";
+  return "";
+}
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && "oid" in value && "size" in value;
+}
+function objectNotFound(obj) {
+  return { oid: obj.oid, size: obj.size, error: { code: 404, message: "object not found" } };
+}
+function objectConflict(obj) {
+  return { oid: obj.oid, size: obj.size, error: { code: 409, message: "object size mismatch" } };
+}
+function json(status, body) {
+  return new Response(JSON.stringify(body) + "\n", { status, headers: { "Content-Type": LFS_CONTENT_TYPE } });
+}
+function lfsError(status, message) {
+  return json(status, { message });
+}
+function lfsAuthError() {
+  const res = lfsError(401, "authentication required");
+  res.headers.set("WWW-Authenticate", 'Basic realm="git-me"');
+  return res;
+}
+function appJson2(status, body) {
+  return new Response(JSON.stringify(body) + "\n", { status, headers: { "Content-Type": "application/json" } });
+}
+async function requireLfsAccess(request, env, config, needed) {
+  const auth = await authenticateLfs(request, env, config);
+  if ("response" in auth) return auth.response;
+  return canAccess(auth.access, needed) ? null : lfsError(403, "forbidden");
+}
+async function authenticateLfs(request, env, config) {
+  const auth = request.headers.get("Authorization") || "";
+  if (auth === `Bearer ${config.authToken}`) return { access: "write" };
+  if (!auth.startsWith("Basic ")) return { response: lfsAuthError() };
+  const credentials = decodeBasicAuth(auth.slice("Basic ".length));
+  if (!credentials) return { response: lfsAuthError() };
+  const username = normalizeUsername(credentials.username);
+  if (!username) return { response: lfsAuthError() };
+  const result = await authenticateUser(env, username, credentials.password, clientSource(request));
+  if (!result.ok || !result.access) return { response: lfsAuthError() };
+  return { access: result.access };
+}
+function decodeBasicAuth(encoded) {
+  try {
+    const decoded = atob(encoded);
+    const separator = decoded.indexOf(":");
+    if (separator < 1) return null;
+    return { username: decoded.slice(0, separator), password: decoded.slice(separator + 1) };
+  } catch {
+    return null;
+  }
+}
+function normalizeUsername(username) {
+  const normalized = username.trim().toLowerCase();
+  return USERNAME_RE.test(normalized) ? normalized : "";
+}
+function clientSource(request) {
+  const source = request.headers.get("CF-Connecting-IP") || "unknown";
+  return /^[0-9a-fA-F:.]{1,45}$/.test(source) ? source : "unknown";
+}
+function canAccess(actual, needed) {
+  return actual === "write" || needed === "read";
+}
+async function digestAndCount(stream) {
+  if (typeof DigestStream === "function") {
+    let size = 0;
+    const counter = new TransformStream({
+      transform(chunk, controller) {
+        size += chunk.byteLength;
+        controller.enqueue(chunk);
+      }
+    });
+    const digester = new DigestStream("SHA-256");
+    await stream.pipeThrough(counter).pipeTo(digester);
+    const digest2 = await digester.digest;
+    return { hex: bytesToHex3(new Uint8Array(digest2)), size };
+  }
+  const buffer = await new Response(stream).arrayBuffer();
+  const digest = await crypto.subtle.digest("SHA-256", buffer);
+  return { hex: bytesToHex3(new Uint8Array(digest)), size: buffer.byteLength };
+}
+function bytesToHex3(bytes) {
+  return [...bytes].map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+export {
+  AuthUser,
+  worker_default as default
+};