@ai-projector/ide 0.0.0-stage → 0.11.0

package/packages/server/modules/gitlab/releases.js

@@ -0,0 +1,226 @@
+import { HttpError, downloadFilename } from "../http/index.js";
+import { gitlabReader } from "./api.js";
+import { nextPage, projectId } from "./browser.js";
+import { gitlabUser } from "./trackers.js";
+const RELEASE_PAGE = 30;
+const GITLAB_SOURCES = new Set(["zip", "tar.gz", "tar.bz2", "tar"]);
+const CONTENT_TYPES = {
+    zip: "application/zip",
+    "tar.gz": "application/gzip",
+    "tar.bz2": "application/x-bzip2",
+    tar: "application/x-tar",
+};
+function hasControl(value) {
+    for (const character of value) {
+        const code = character.codePointAt(0) ?? 0;
+        if (code < 0x20 || code === 0x7f)
+            return true;
+    }
+    return false;
+}
+function releaseTag(value) {
+    const tag = typeof value === "string" ? value.trim() : "";
+    if (!tag || tag.length > 256 || hasControl(tag))
+        throw new HttpError(400, "Укажите тег релиза");
+    return tag;
+}
+function pageNumber(value) {
+    const page = Number(value || 1);
+    if (!Number.isSafeInteger(page) || page < 1 || page > 1000)
+        throw new HttpError(400, "Неверная страница");
+    return page;
+}
+function sourceFormat(value) {
+    const format = typeof value === "string" ? value : "";
+    if (!GITLAB_SOURCES.has(format))
+        throw new HttpError(400, "Неизвестный формат исходников");
+    return format;
+}
+function release(raw, target) {
+    const tag = raw.tag_name || "";
+    const links = Array.isArray(raw.assets?.links) ? raw.assets.links : [];
+    const path = target.path
+        .split("/")
+        .map((part) => encodeURIComponent(part))
+        .join("/");
+    return {
+        id: tag,
+        tag,
+        name: raw.name || "",
+        draft: false,
+        prerelease: false,
+        upcoming: raw.upcoming_release === true,
+        author: gitlabUser(raw.author),
+        createdAt: raw.created_at || "",
+        releasedAt: raw.released_at || raw.created_at || "",
+        htmlUrl: tag
+            ? `${target.base.replace(/\/$/, "")}/${path}/-/releases/${encodeURIComponent(tag)}`
+            : "",
+        assetCount: links.length,
+        downloads: null,
+    };
+}
+function sourceUrl(repository, tag, format) {
+    return `/api/integrations/gitlab/browse/release-source?${new URLSearchParams({
+        repository,
+        tag,
+        format,
+    })}`;
+}
+function assets(repository, raw, tag) {
+    const links = (Array.isArray(raw.assets?.links) ? raw.assets.links : []).flatMap((link, index) => {
+        const url = link.direct_asset_url || link.url || "";
+        if (!/^https?:\/\//i.test(url))
+            return [];
+        return [
+            {
+                id: `link:${link.id ?? index}`,
+                name: link.name || "Ссылка",
+                size: null,
+                downloads: null,
+                contentType: "",
+                url,
+                external: true,
+                uploading: false,
+                source: false,
+                digest: "",
+            },
+        ];
+    });
+    const sources = (Array.isArray(raw.assets?.sources) ? raw.assets.sources : []).flatMap((source) => {
+        const format = source.format || "";
+        if (!GITLAB_SOURCES.has(format))
+            return [];
+        return [
+            {
+                id: `source:${format}`,
+                name: `Исходный код (${format})`,
+                size: null,
+                downloads: null,
+                contentType: CONTENT_TYPES[format] || "application/octet-stream",
+                url: sourceUrl(repository, tag, format),
+                external: false,
+                uploading: false,
+                source: true,
+                digest: "",
+            },
+        ];
+    });
+    return [...links, ...sources];
+}
+/** One page of releases, newest first. GitLab has no explicit latest mark. */
+export async function browseGitlabReleases(repository, params = {}) {
+    const page = pageNumber(params.page);
+    const reader = await gitlabReader(repository);
+    const query = new URLSearchParams({ per_page: String(RELEASE_PAGE), page: String(page) });
+    const response = await reader.request(`/projects/${projectId(reader.target.path)}/releases?${query}`);
+    const rows = Array.isArray(response.data) ? response.data : [];
+    const releases = rows.map((item) => release(item, reader.target));
+    return {
+        releases,
+        next: nextPage(response.headers, page, rows.length, RELEASE_PAGE),
+        latestTag: releases.find((item) => !item.upcoming)?.tag || "",
+    };
+}
+/** One release with its Markdown description and downloadable entries. */
+export async function browseGitlabRelease(repository, value) {
+    const tag = releaseTag(value);
+    const reader = await gitlabReader(repository);
+    let raw;
+    try {
+        raw = await reader.get(`/projects/${projectId(reader.target.path)}/releases/${encodeURIComponent(tag)}`);
+    }
+    catch (error) {
+        if (error instanceof HttpError && error.status === 404)
+            throw new HttpError(404, "Релиз не найден или нет доступа");
+        throw error;
+    }
+    const item = release(raw, reader.target);
+    return {
+        release: item,
+        body: raw.description || "",
+        assets: assets(repository, raw, item.tag || tag),
+    };
+}
+function failure(status) {
+    if (status === 401)
+        return new HttpError(401, "Авторизация GitLab истекла. Подключитесь снова");
+    if (status === 403)
+        return new HttpError(403, "GitLab ограничил доступ. Проверьте права и лимит API");
+    if (status === 404)
+        return new HttpError(404, "Файл не найден или нет доступа");
+    return new HttpError(400, `GitLab вернул ${status}. Проверьте права доступа`);
+}
+function headers(target) {
+    return {
+        ...(target.token
+            ? target.tokenType === "oauth"
+                ? { Authorization: `Bearer ${target.token}` }
+                : { "PRIVATE-TOKEN": target.token }
+            : {}),
+        Accept: "application/octet-stream",
+        "User-Agent": "Projector",
+    };
+}
+async function timedFetch(input, init) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 30_000);
+    try {
+        return await fetch(input, { ...init, signal: controller.signal });
+    }
+    catch {
+        throw new HttpError(400, "GitLab не ответил вовремя");
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** The token stays on the configured instance; a signed redirect is fetched without it. */
+async function download(target, address) {
+    const base = new URL(target.base);
+    const first = new URL(address, target.base);
+    if (first.protocol !== "https:" && first.protocol !== base.protocol)
+        throw new HttpError(400, "GitLab вернул небезопасную ссылку");
+    if (first.origin !== base.origin)
+        throw new HttpError(400, "GitLab вернул ссылку на другой хост");
+    const response = await timedFetch(first, {
+        headers: headers(target),
+        redirect: "manual",
+    });
+    if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get("location");
+        if (!location)
+            throw new HttpError(400, "GitLab не вернул ссылку на файл");
+        const next = new URL(location, first);
+        if (next.protocol !== "https:" && next.protocol !== base.protocol)
+            throw new HttpError(400, "GitLab вернул небезопасную ссылку");
+        const followed = await timedFetch(next, {
+            headers: next.origin === base.origin ? headers(target) : { "User-Agent": "Projector" },
+            redirect: "follow",
+        });
+        if (!followed.ok)
+            throw failure(followed.status);
+        return followed;
+    }
+    if (!response.ok)
+        throw failure(response.status);
+    return response;
+}
+export async function downloadGitlabReleaseSource(repository, value, rawFormat) {
+    const tag = releaseTag(value);
+    const format = sourceFormat(rawFormat);
+    const reader = await gitlabReader(repository);
+    const raw = await reader.get(`/projects/${projectId(reader.target.path)}/releases/${encodeURIComponent(tag)}`);
+    const source = (raw.assets?.sources ?? []).find((item) => item.format === format);
+    if (!source?.url)
+        throw new HttpError(404, "Исходный код релиза не найден");
+    const response = await download(reader.target, source.url);
+    if ((response.headers.get("content-type") || "").startsWith("text/html"))
+        throw new HttpError(401, "GitLab требует вход. Подключитесь в настройках интеграции");
+    const name = reader.target.path.split("/").filter(Boolean).at(-1) || "release";
+    return {
+        response,
+        name: downloadFilename(`${name}-${tag}.${format}`, `${name}.${format}`),
+        contentType: CONTENT_TYPES[format] || "application/octet-stream",
+    };
+}

package/packages/server/modules/gitlab/search.js

@@ -0,0 +1,75 @@
+import { HttpError } from "../http/index.js";
+import { integrationConfig } from "../integration-store/index.js";
+import { normalizeGitlabInstance } from "../../../core/modules/gitlab/index.js";
+import { gitlab, gitlabAccessToken, gitlabBaseUrl, gitlabCredentialsTokenType } from "./api.js";
+const mapProject = (project) => ({
+    fullName: project.path_with_namespace,
+    description: project.description ?? "",
+    private: project.visibility !== "public",
+    url: project.web_url,
+});
+/**
+ * Launcher search. The account's own projects (first 100 by activity) are matched locally by full
+ * path, so `group/`, `group/part` and short words work; GitLab's own search needs 3+ characters
+ * and no namespace, so it only adds other (public) projects for the last path segment.
+ */
+export async function searchGitlabProjects(query) {
+    const config = await integrationConfig("gitlab");
+    const base = gitlabBaseUrl(config.settings.url);
+    const instance = normalizeGitlabInstance(new URL(base).origin);
+    const tokenType = gitlabCredentialsTokenType(config.credentials);
+    const token = config.enabled ? await gitlabAccessToken(base, config.credentials) : "";
+    const rawNeedle = query.trim().replace(/^\/+/, "");
+    const needle = rawNeedle.toLowerCase();
+    if (!needle && !token)
+        throw new HttpError(401, "Подключите GitLab в настройках интеграции");
+    const found = new Map();
+    // An exact `group/project` or a pasted link is a direct project lookup. GitLab's search
+    // endpoint only accepts a bare term, so it cannot find a big public project by full path.
+    if (rawNeedle.split("/").filter(Boolean).length >= 2 && !rawNeedle.endsWith("/")) {
+        try {
+            const exact = await gitlab(base, `/projects/${encodeURIComponent(rawNeedle)}`, token, { tokenType });
+            if (exact?.path_with_namespace)
+                found.set(exact.path_with_namespace, exact);
+        }
+        catch (error) {
+            if (!(error instanceof HttpError) || ![401, 403, 404].includes(error.status))
+                throw error;
+        }
+    }
+    // A group path (`group/`, `group/sub`) lists its projects instead of relying on the
+    // term-based project search, which only sees the first page of public matches.
+    const groupNeedle = rawNeedle.replace(/\/+$/, "");
+    if (found.size < 10 && groupNeedle) {
+        try {
+            const group = await gitlab(base, `/groups/${encodeURIComponent(groupNeedle)}`, token, { tokenType });
+            if (group?.id) {
+                const projects = await gitlab(base, `/groups/${group.id}/projects?simple=true&per_page=10&order_by=last_activity_at`, token, { tokenType });
+                for (const project of projects)
+                    found.set(project.path_with_namespace, project);
+            }
+        }
+        catch (error) {
+            if (!(error instanceof HttpError) || ![401, 403, 404].includes(error.status))
+                throw error;
+        }
+    }
+    if (token) {
+        const own = await gitlab(base, "/projects?membership=true&simple=true&order_by=last_activity_at&per_page=100", token, { tokenType });
+        for (const project of own)
+            if (project.path_with_namespace.toLowerCase().includes(needle))
+                found.set(project.path_with_namespace, project);
+    }
+    const name = needle
+        .split("/")
+        .pop()
+        .replace(/[^\w.-]/g, "");
+    if (found.size < 10 && name.length >= 3) {
+        const params = new URLSearchParams({ simple: "true", per_page: "10", search: name });
+        const others = await gitlab(base, `/projects?${params}`, token, { tokenType });
+        for (const project of others)
+            if (project.path_with_namespace.toLowerCase().includes(needle))
+                found.set(project.path_with_namespace, project);
+    }
+    return [...found.values()].slice(0, 10).map((project) => ({ ...mapProject(project), instance }));
+}

package/packages/server/modules/gitlab/trackers.js

@@ -0,0 +1,96 @@
+import { HttpError } from "../http/index.js";
+import { nextPage } from "./browser.js";
+export const TRACKER_PAGE = 30;
+export const NOTE_PAGE = 100;
+export const NOTE_PAGES = 5;
+const REACTION_ORDER = [
+    "+1",
+    "-1",
+    "laugh",
+    "hooray",
+    "confused",
+    "heart",
+    "rocket",
+    "eyes",
+];
+/** GitLab award names are words, GitHub reaction names are the contract: `thumbsup` is `+1`. */
+const AWARDS = {
+    thumbsup: "+1",
+    thumbsdown: "-1",
+    laughing: "laugh",
+    hooray: "hooray",
+    confused: "confused",
+    heart: "heart",
+    rocket: "rocket",
+    eyes: "eyes",
+};
+export function gitlabUser(raw) {
+    return { login: raw?.username || "", avatarUrl: raw?.avatar_url || "" };
+}
+export function gitlabLabels(raw) {
+    return (raw ?? []).map((label) => typeof label === "string"
+        ? { name: label, color: "" }
+        : { name: label.name || "", color: (label.color || "").replace(/^#/, "") });
+}
+export function trackerPage(value) {
+    const page = Number(value || 1);
+    if (!Number.isSafeInteger(page) || page < 1)
+        throw new HttpError(400, "Неверная страница");
+    return page;
+}
+/** Awards arrive one row per voter, so equal names are counted into a single reaction. */
+export function awardReactions(raw) {
+    const counts = new Map();
+    for (const award of raw ?? []) {
+        const kind = AWARDS[award.name || ""];
+        if (kind)
+            counts.set(kind, (counts.get(kind) ?? 0) + 1);
+    }
+    return REACTION_ORDER.flatMap((content) => counts.has(content) ? [{ content, count: counts.get(content) }] : []);
+}
+/**
+ * Reactions live on the award emoji endpoint only, so every mapped note keeps empty reactions:
+ * loading them would cost one request per comment (N+1) on a page of up to 500 notes.
+ */
+export function gitlabComment(raw) {
+    return {
+        id: raw.id,
+        author: gitlabUser(raw.author),
+        body: raw.body || "",
+        reactions: [],
+        htmlUrl: "",
+        createdAt: raw.created_at || "",
+    };
+}
+/** Optional extras of a card (award emoji, approvals) are missing on old or unlicensed instances. */
+export async function optional(request, fallback, statuses = [403, 404]) {
+    try {
+        return await request;
+    }
+    catch (error) {
+        if (error instanceof HttpError && statuses.includes(error.status))
+            return fallback;
+        throw error;
+    }
+}
+/** Notes of an issue or merge request, oldest first, without `system: true` service records. */
+export async function gitlabNotes(reader, path) {
+    const comments = [];
+    for (let page = 1; page <= NOTE_PAGES; page++) {
+        const query = new URLSearchParams({
+            sort: "asc",
+            order_by: "created_at",
+            per_page: String(NOTE_PAGE),
+            page: String(page),
+        });
+        const response = await reader.request(`${path}?${query}`);
+        const rows = Array.isArray(response.data) ? response.data : [];
+        comments.push(...rows.filter((note) => note.system !== true).map(gitlabComment));
+        const next = nextPage(response.headers, page, rows.length, NOTE_PAGE);
+        if (!next)
+            return { comments, truncated: false };
+        if (page === NOTE_PAGES)
+            return { comments, truncated: true };
+    }
+    return { comments, truncated: false };
+}

package/packages/server/modules/http/download.js

@@ -0,0 +1,50 @@
+import { Readable } from "node:stream";
+/** A safe attachment name: no controls, separators or quotes; long names are cut. */
+export function downloadFilename(value, fallback = "download") {
+    let clean = "";
+    for (const character of value) {
+        const code = character.codePointAt(0) ?? 0;
+        clean +=
+            code < 0x20 || code === 0x7f || character === "/" || character === "\\" || character === '"'
+                ? "_"
+                : character;
+    }
+    clean = Array.from(clean.trim()).slice(0, 180).join("");
+    return clean || fallback;
+}
+/** RFC 5987 disposition: an ASCII fallback plus the exact UTF-8 name. */
+export function contentDisposition(value, fallback = "download") {
+    const name = downloadFilename(value, fallback);
+    const ascii = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+    const encoded = encodeURIComponent(name).replace(/['()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+    return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
+function responseType(value, fallback) {
+    const candidate = (value || fallback).split(";")[0].trim();
+    return /^[a-z0-9.+-]+\/[a-z0-9.+-]+$/i.test(candidate) && !/^text\/html$/i.test(candidate)
+        ? candidate
+        : "application/octet-stream";
+}
+/**
+ * Streams an upstream download to the browser. The body is never buffered, a closed page
+ * destroys the upstream stream, and the filename is reduced to a safe attachment header.
+ */
+export function sendDownload(res, response, name, contentType = "application/octet-stream") {
+    const length = response.headers.get("content-length");
+    res.statusCode = 200;
+    res.setHeader("Content-Type", responseType(response.headers.get("content-type"), contentType));
+    res.setHeader("Content-Disposition", contentDisposition(name));
+    res.setHeader("X-Content-Type-Options", "nosniff");
+    res.setHeader("Content-Security-Policy", "default-src 'none'; sandbox");
+    res.setHeader("Cache-Control", "private, no-store");
+    if (length && /^\d+$/.test(length))
+        res.setHeader("Content-Length", length);
+    if (!response.body) {
+        res.end();
+        return;
+    }
+    const stream = Readable.fromWeb(response.body);
+    stream.on("error", () => res.destroy());
+    res.on("close", () => stream.destroy());
+    stream.pipe(res);
+}

package/packages/server/modules/http/http.js

@@ -0,0 +1,8 @@
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.name = "HttpError";
+        this.status = status;
+    }
+}

package/packages/server/modules/http/index.js

@@ -0,0 +1,2 @@
+export { HttpError } from "./http.js";
+export { contentDisposition, downloadFilename, sendDownload } from "./download.js";

package/packages/server/modules/hub/connector.js

@@ -0,0 +1,114 @@
+import { createServer } from "node:http";
+import { WebSocket, createWebSocketStream } from "ws";
+import { HUB_PROTOCOL } from "../../../core/modules/hub/index.js";
+import { markHubSocket } from "../access/index.js";
+export function connectHub(config, handlers, status) {
+    const ingress = createServer((req, res) => handlers.handle(req, res));
+    const detach = handlers.attach(ingress);
+    const peers = new Set();
+    let disposed = false;
+    let retry;
+    let control;
+    let heartbeat;
+    let delay = 1000;
+    const origin = new URL(config.url).origin;
+    const endpoint = (stream) => {
+        const url = new URL("/api/hub/connect", config.url);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        if (stream)
+            url.searchParams.set("stream", stream);
+        else {
+            url.searchParams.set("device", config.deviceId);
+            url.searchParams.set("protocol", String(HUB_PROTOCOL));
+        }
+        return url;
+    };
+    const options = {
+        headers: { Authorization: `Bearer ${config.token}` },
+        handshakeTimeout: 10000,
+        maxPayload: 256 * 1024,
+        perMessageDeflate: false,
+    };
+    const open = () => {
+        if (disposed)
+            return;
+        const ws = (control = new WebSocket(endpoint(), options));
+        const arm = () => {
+            clearTimeout(heartbeat);
+            heartbeat = setTimeout(() => ws.terminate(), 45000);
+            heartbeat.unref();
+        };
+        ws.on("open", arm);
+        ws.on("ping", arm);
+        let failure;
+        ws.on("unexpected-response", (_req, res) => {
+            failure =
+                res.statusCode === 401
+                    ? "Hub отклонил токен подключения"
+                    : res.statusCode === 409
+                        ? "ID устройства занят или версия протокола несовместима"
+                        : "Hub отклонил подключение";
+            res.resume();
+            ws.terminate();
+        });
+        ws.on("error", () => {
+            failure ??= "Не удалось соединиться с Hub";
+            ws.terminate();
+        });
+        ws.on("message", (data) => {
+            if (!Buffer.isBuffer(data)) {
+                ws.terminate();
+                return;
+            }
+            try {
+                const message = JSON.parse(data.toString());
+                if (message.type === "ready" && message.protocol === HUB_PROTOCOL) {
+                    delay = 1000;
+                    status(true);
+                    return;
+                }
+                if (message.type !== "open" ||
+                    typeof message.id !== "string" ||
+                    !/^[a-f0-9]{64}$/.test(message.id) ||
+                    peers.size >= 128)
+                    return;
+                const peer = new WebSocket(endpoint(message.id), options);
+                peers.add(peer);
+                peer.on("error", () => peer.terminate());
+                peer.once("close", () => peers.delete(peer));
+                peer.once("open", () => {
+                    const stream = createWebSocketStream(peer);
+                    stream.on("error", () => stream.destroy());
+                    markHubSocket(stream, origin);
+                    ingress.emit("connection", stream);
+                });
+            }
+            catch {
+                ws.terminate();
+            }
+        });
+        ws.once("close", () => {
+            clearTimeout(heartbeat);
+            status(false, disposed ? undefined : (failure ?? "Соединение с Hub потеряно, повторяем подключение"));
+            for (const peer of peers)
+                peer.terminate();
+            if (!disposed) {
+                retry = setTimeout(open, delay + Math.random() * 500);
+                retry.unref();
+                delay = Math.min(delay * 2, 30000);
+            }
+        });
+    };
+    open();
+    return () => {
+        disposed = true;
+        clearTimeout(retry);
+        clearTimeout(heartbeat);
+        control?.terminate();
+        for (const peer of peers)
+            peer.terminate();
+        detach();
+        ingress.close();
+        status(false);
+    };
+}