@ai-projector/ide 0.0.0-stage → 0.11.0

package/packages/server/modules/gitlab/oauth.js

@@ -0,0 +1,250 @@
+import { randomUUID } from "node:crypto";
+import { HttpError } from "../http/index.js";
+import { fieldText as text, integrationConfig, updateIntegration, } from "../integration-store/index.js";
+import { gitlabBaseUrl } from "./base.js";
+const DEVICE_SCOPE = "read_api read_repository read_user";
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+const REFRESH_MARGIN = 60_000;
+const SESSION_EXPIRED = "Сессия GitLab истекла. Войдите снова";
+const sessions = new Map();
+const refreshes = new Map();
+/** Form-urlencoded OAuth request; the body and redirects never leave the configured instance. */
+async function oauthRequest(base, path, form) {
+    let response;
+    try {
+        response = await fetch(`${base}${path}`, {
+            method: "POST",
+            headers: {
+                Accept: "application/json",
+                "Content-Type": "application/x-www-form-urlencoded",
+                "User-Agent": "Projector",
+            },
+            body: new URLSearchParams(form),
+            signal: AbortSignal.timeout(30_000),
+            redirect: "error",
+        });
+    }
+    catch (error) {
+        if (error instanceof HttpError)
+            throw error;
+        throw new HttpError(400, "GitLab недоступен. Проверьте адрес и сеть");
+    }
+    let data = {};
+    try {
+        const parsed = (await response.json());
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed))
+            data = parsed;
+    }
+    catch {
+        // An empty or non-JSON body is reported by the caller with the status.
+    }
+    return { ok: response.ok, status: response.status, data };
+}
+function stringField(data, name) {
+    const value = data[name];
+    return typeof value === "string" ? value : "";
+}
+async function oauthUser(base, token) {
+    let response;
+    try {
+        response = await fetch(`${base}/api/v4/user`, {
+            headers: {
+                Authorization: `Bearer ${token}`,
+                Accept: "application/json",
+                "User-Agent": "Projector",
+            },
+            signal: AbortSignal.timeout(30_000),
+            redirect: "error",
+        });
+    }
+    catch {
+        throw new HttpError(400, "GitLab недоступен. Проверьте адрес и сеть");
+    }
+    if (!response.ok)
+        throw new HttpError(401, "Авторизация GitLab истекла или недействительна. Войдите снова");
+    const user = (await response.json());
+    if (typeof user.username !== "string" || !user.username)
+        throw new HttpError(400, "GitLab не подтвердил вход. Попробуйте снова");
+    return user.username;
+}
+function sameSettings(config, session) {
+    return (config.enabled &&
+        text(config.settings.clientId) === session.clientId &&
+        gitlabBaseUrl(config.settings.url) === session.base);
+}
+export async function beginGitlabDeviceLogin() {
+    const config = await integrationConfig("gitlab");
+    const clientId = text(config.settings.clientId);
+    if (!config.enabled || !clientId)
+        throw new HttpError(400, "Включите GitLab и сохраните Client ID OAuth-приложения с Device Flow");
+    const base = gitlabBaseUrl(config.settings.url);
+    const response = await oauthRequest(base, "/oauth/authorize_device", {
+        client_id: clientId,
+        scope: DEVICE_SCOPE,
+    });
+    const deviceCode = stringField(response.data, "device_code");
+    const userCode = stringField(response.data, "user_code");
+    const verificationUri = stringField(response.data, "verification_uri");
+    if (!response.ok || response.data.error || !deviceCode || !userCode || !verificationUri)
+        throw new HttpError(400, "Не удалось начать вход. Проверьте Client ID и Device Flow (GitLab 17.1+)");
+    sessions.clear();
+    const session = {
+        id: randomUUID(),
+        base,
+        clientId,
+        deviceCode,
+        expiresAt: Date.now() + (Number(response.data.expires_in) || 300) * 1000,
+        interval: Math.max(1, Number(response.data.interval) || 5),
+        nextPoll: 0,
+    };
+    session.nextPoll = Date.now() + session.interval * 1000;
+    sessions.set(session.id, session);
+    return {
+        id: session.id,
+        userCode,
+        verificationUri,
+        expiresAt: session.expiresAt,
+        interval: session.interval,
+    };
+}
+/** One poll step; the status wrapper in `api.ts` adds the public integration state. */
+export async function pollGitlabDevice(body) {
+    const session = sessions.get(text(body.id));
+    if (!session || session.expiresAt <= Date.now()) {
+        if (session)
+            sessions.delete(session.id);
+        throw new HttpError(400, "Код входа истёк. Начните авторизацию заново");
+    }
+    if (Date.now() < session.nextPoll)
+        return {
+            pending: true,
+            interval: Math.max(1, Math.ceil((session.nextPoll - Date.now()) / 1000)),
+        };
+    const config = await integrationConfig("gitlab");
+    if (!sameSettings(config, session)) {
+        sessions.delete(session.id);
+        throw new HttpError(400, "Настройки изменились. Начните авторизацию заново");
+    }
+    // Hold the slot while the request is in flight so double clicks cannot race.
+    session.nextPoll = Date.now() + 30_000;
+    const response = await oauthRequest(session.base, "/oauth/token", {
+        client_id: session.clientId,
+        device_code: session.deviceCode,
+        grant_type: DEVICE_GRANT,
+    });
+    if (sessions.get(session.id) !== session)
+        throw new HttpError(400, "Авторизация отменена");
+    const error = stringField(response.data, "error");
+    if (error === "authorization_pending" || error === "slow_down") {
+        if (error === "slow_down")
+            session.interval += 5;
+        session.nextPoll = Date.now() + session.interval * 1000;
+        return { pending: true, interval: session.interval };
+    }
+    const token = stringField(response.data, "access_token");
+    if (!response.ok || error || !token) {
+        sessions.delete(session.id);
+        if (error === "expired_token")
+            throw new HttpError(400, "Код входа истёк. Начните авторизацию заново");
+        if (error === "access_denied")
+            throw new HttpError(400, "Вход отменён в GitLab");
+        throw new HttpError(400, "Не удалось завершить вход. Попробуйте снова");
+    }
+    const login = await oauthUser(session.base, token);
+    if (sessions.get(session.id) !== session)
+        throw new HttpError(400, "Авторизация отменена");
+    const refreshToken = stringField(response.data, "refresh_token");
+    const expiresAt = Date.now() + (Number(response.data.expires_in) || 7200) * 1000;
+    await updateIntegration("gitlab", (current) => {
+        if (!sameSettings(current, session) || sessions.get(session.id) !== session)
+            throw new HttpError(400, "Настройки изменились. Начните авторизацию заново");
+        return {
+            ...current,
+            credentials: {
+                kind: "oauth",
+                token,
+                refreshToken,
+                expiresAt: String(expiresAt),
+                login,
+            },
+        };
+    });
+    sessions.clear();
+    return { pending: false };
+}
+/** Drops pending device sessions; called when settings change or the integration is disconnected. */
+export function clearGitlabSessions() {
+    sessions.clear();
+}
+/** Refresh as soon as the access token is within a minute of expiry. */
+export function gitlabTokenExpiring(credentials) {
+    if (credentials.kind !== "oauth" || !credentials.token)
+        return false;
+    const expiresAt = Number(credentials.expiresAt);
+    return !Number.isFinite(expiresAt) || expiresAt - Date.now() < REFRESH_MARGIN;
+}
+/**
+ * One refresh per instance: parallel tabs and requests share the same promise, so a rotated refresh
+ * token is never used twice. A temporary network failure leaves the stored credentials intact.
+ */
+export function refreshGitlabToken(base, force = false) {
+    const running = refreshes.get(base);
+    if (running)
+        return running;
+    let task;
+    task = refreshGitlabTokenOnce(base, force).finally(() => {
+        if (refreshes.get(base) === task)
+            refreshes.delete(base);
+    });
+    refreshes.set(base, task);
+    return task;
+}
+async function refreshGitlabTokenOnce(base, force) {
+    const sessionExpired = () => new HttpError(401, SESSION_EXPIRED);
+    const config = await integrationConfig("gitlab");
+    if (!config.enabled ||
+        gitlabBaseUrl(config.settings.url) !== base ||
+        config.credentials.kind !== "oauth" ||
+        !config.credentials.refreshToken)
+        throw sessionExpired();
+    // Another request may have refreshed it before this task started.
+    if (!force && !gitlabTokenExpiring(config.credentials))
+        return config.credentials.token;
+    const clientId = text(config.settings.clientId);
+    if (!clientId)
+        throw sessionExpired();
+    let response;
+    try {
+        response = await oauthRequest(base, "/oauth/token", {
+            grant_type: "refresh_token",
+            refresh_token: config.credentials.refreshToken,
+            client_id: clientId,
+        });
+    }
+    catch {
+        throw sessionExpired();
+    }
+    const token = stringField(response.data, "access_token");
+    if (!response.ok || response.data.error || !token)
+        throw sessionExpired();
+    const refreshToken = stringField(response.data, "refresh_token") || config.credentials.refreshToken;
+    const expiresAt = Date.now() + (Number(response.data.expires_in) || 7200) * 1000;
+    await updateIntegration("gitlab", (current) => {
+        if (!current.enabled ||
+            gitlabBaseUrl(current.settings.url) !== base ||
+            current.credentials.kind !== "oauth" ||
+            current.credentials.refreshToken !== config.credentials.refreshToken)
+            throw sessionExpired();
+        return {
+            ...current,
+            credentials: {
+                ...current.credentials,
+                kind: "oauth",
+                token,
+                refreshToken,
+                expiresAt: String(expiresAt),
+            },
+        };
+    });
+    return token;
+}

package/packages/server/modules/gitlab/pipelines.js

@@ -0,0 +1,240 @@
+import { HttpError } from "../http/index.js";
+import { gitlabReader } from "./api.js";
+import { nextPage, projectId } from "./browser.js";
+import { gitlabUser, trackerPage } from "./trackers.js";
+const PIPELINE_PAGE = 30;
+const JOB_PAGE = 100;
+const JOB_LIMIT = 300;
+const TRACE_LIMIT = 2 * 1024 * 1024;
+const ANSI = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
+/** GitLab prefixes every trace line with an ISO time and a stream marker (`00O`, `00E`, `00O+`). */
+const TRACE_PREFIX = /^\uFEFF?\d{4}-\d{2}-\d{2}T\S+ \d\d[OE][+-]? ?/;
+const SECTION_START = /section_start:\d+:([^\r\n]*?)\r?$/;
+const SECTION_END = /section_end:\d+:[^\r\n]*\r?$/;
+/** GitLab pipeline states that the list endpoint accepts as a filter. */
+const FILTER_STATUSES = new Set([
+    "created",
+    "waiting_for_resource",
+    "preparing",
+    "pending",
+    "running",
+    "success",
+    "failed",
+    "canceled",
+    "skipped",
+    "manual",
+    "scheduled",
+]);
+const STATUS = {
+    created: "queued",
+    waiting_for_resource: "queued",
+    preparing: "queued",
+    pending: "queued",
+    scheduled: "queued",
+    blocked: "queued",
+    running: "running",
+    success: "success",
+    failed: "failed",
+    canceled: "canceled",
+    skipped: "skipped",
+    manual: "manual",
+};
+function pipelineStatus(value) {
+    return STATUS[value || ""] ?? "unknown";
+}
+export function pipeline(raw) {
+    return {
+        id: raw.id,
+        name: raw.name || "",
+        status: pipelineStatus(raw.status),
+        source: raw.source || "",
+        ref: raw.ref || "",
+        sha: raw.sha || "",
+        author: gitlabUser(raw.user),
+        webUrl: raw.web_url || "",
+        createdAt: raw.created_at || "",
+        updatedAt: raw.updated_at || "",
+        duration: typeof raw.duration === "number" ? raw.duration : null,
+    };
+}
+function job(raw, fallbackPipelineId) {
+    return {
+        id: raw.id,
+        pipelineId: raw.pipeline?.id ?? fallbackPipelineId,
+        name: raw.name || "",
+        stage: raw.stage || "",
+        status: pipelineStatus(raw.status),
+        ref: raw.ref || "",
+        webUrl: raw.web_url || "",
+        createdAt: raw.created_at || "",
+        startedAt: raw.started_at || "",
+        finishedAt: raw.finished_at || "",
+        duration: typeof raw.duration === "number" ? raw.duration : null,
+        allowFailure: raw.allow_failure === true,
+        failureReason: raw.failure_reason || "",
+    };
+}
+function pipelineId(value) {
+    const id = Number(value);
+    if (!Number.isSafeInteger(id) || id <= 0)
+        throw new HttpError(400, "Укажите номер пайплайна");
+    return id;
+}
+function jobId(value) {
+    const id = Number(value);
+    if (!Number.isSafeInteger(id) || id <= 0)
+        throw new HttpError(400, "Укажите номер джоба");
+    return id;
+}
+function statusFilter(params) {
+    const value = (params.status || "").trim();
+    if (!value || value === "all")
+        return "";
+    if (!FILTER_STATUSES.has(value))
+        throw new HttpError(400, "Неизвестный статус пайплайна");
+    return value;
+}
+/** One page of project pipelines, newest id first. */
+export async function browseGitlabPipelines(repository, params = {}) {
+    const page = trackerPage(params.page);
+    const reader = await gitlabReader(repository);
+    const query = new URLSearchParams({
+        per_page: String(PIPELINE_PAGE),
+        page: String(page),
+        order_by: "id",
+        sort: "desc",
+    });
+    const status = statusFilter(params);
+    if (status)
+        query.set("status", status);
+    if (params.ref)
+        query.set("ref", params.ref);
+    const response = await reader.request(`/projects/${projectId(reader.target.path)}/pipelines?${query}`);
+    const rows = Array.isArray(response.data) ? response.data : [];
+    return {
+        pipelines: rows.map(pipeline),
+        next: nextPage(response.headers, page, rows.length, PIPELINE_PAGE),
+    };
+}
+async function pipelineJobs(reader, id, pipeline) {
+    const jobs = [];
+    let page = 1;
+    for (;;) {
+        const query = new URLSearchParams({ per_page: String(JOB_PAGE), page: String(page) });
+        const response = await reader.request(`/projects/${id}/pipelines/${pipeline}/jobs?${query}`);
+        const rows = Array.isArray(response.data) ? response.data : [];
+        for (const row of rows) {
+            if (jobs.length >= JOB_LIMIT)
+                return { jobs, truncated: true };
+            jobs.push(job(row, pipeline));
+        }
+        const next = nextPage(response.headers, page, rows.length, JOB_PAGE);
+        if (!next)
+            return { jobs, truncated: false };
+        if (jobs.length >= JOB_LIMIT)
+            return { jobs, truncated: true };
+        page = next;
+    }
+}
+/** Pipeline metadata and every job of the run, up to the reader bound. */
+export async function browseGitlabPipeline(repository, value) {
+    const number = pipelineId(value);
+    const reader = await gitlabReader(repository);
+    const id = projectId(reader.target.path);
+    const [raw, jobs] = await Promise.all([
+        reader.get(`/projects/${id}/pipelines/${number}`),
+        pipelineJobs(reader, id, number),
+    ]);
+    return { pipeline: pipeline(raw), jobs: jobs.jobs, jobsTruncated: jobs.truncated };
+}
+function cleanTrace(value) {
+    // GitLab prefixes lines with a timestamp and stream marker, and wraps groups of lines in
+    // section markers; show the section name as a plain heading.
+    const lines = value.replace(ANSI, "").split("\n");
+    const clean = [];
+    for (const raw of lines) {
+        const line = raw.replace(TRACE_PREFIX, "").replace(/\r$/, "");
+        const start = SECTION_START.exec(line);
+        if (start) {
+            clean.push(`▶ ${start[1]}`);
+            continue;
+        }
+        if (SECTION_END.test(line))
+            continue;
+        clean.push(line);
+    }
+    return clean.join("\n");
+}
+async function traceText(response) {
+    const body = response.body;
+    if (!body) {
+        const bytes = Buffer.from(await response.arrayBuffer());
+        const truncated = bytes.length > TRACE_LIMIT;
+        return {
+            log: cleanTrace(bytes.subarray(0, TRACE_LIMIT).toString("utf8")),
+            truncated,
+        };
+    }
+    const chunks = [];
+    let size = 0;
+    let truncated = false;
+    const reader = body.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        const chunk = Buffer.from(value);
+        if (size + chunk.length > TRACE_LIMIT) {
+            chunks.push(chunk.subarray(0, TRACE_LIMIT - size));
+            size = TRACE_LIMIT;
+            truncated = true;
+            await reader.cancel();
+            break;
+        }
+        chunks.push(chunk);
+        size += chunk.length;
+    }
+    return { log: cleanTrace(Buffer.concat(chunks).toString("utf8")), truncated };
+}
+/** A job without a trace (old, erased or forbidden) still opens with an empty log. */
+async function jobTrace(reader, id, traceOf) {
+    try {
+        const response = await reader.fetch(`/projects/${id}/jobs/${traceOf}/trace`, {
+            headers: { Accept: "text/plain" },
+        });
+        return await traceText(response);
+    }
+    catch (error) {
+        const anonymous = !reader.target.token;
+        if (error instanceof HttpError &&
+            ([403, 404].includes(error.status) || (anonymous && error.status === 401)))
+            return { log: "", truncated: false };
+        throw error;
+    }
+}
+async function jobMetadata(reader, id, number) {
+    try {
+        return await reader.get(`/projects/${id}/jobs/${number}`);
+    }
+    catch (error) {
+        // Public projects expose pipelines anonymously, but GitLab hides single jobs behind a login.
+        if (!reader.target.token && error instanceof HttpError && error.status === 401)
+            throw new HttpError(401, "Джоб GitLab доступен только после входа в интеграцию");
+        throw error;
+    }
+}
+/** Job metadata and readonly trace, capped by both bytes and host availability. */
+export async function browseGitlabJob(repository, value) {
+    const number = jobId(value);
+    const reader = await gitlabReader(repository);
+    const id = projectId(reader.target.path);
+    const [raw, trace] = await Promise.all([
+        jobMetadata(reader, id, number),
+        jobTrace(reader, id, number),
+    ]);
+    return {
+        job: job(raw, raw.pipeline?.id ?? 0),
+        log: trace.log,
+        logTruncated: trace.truncated,
+    };
+}