@bevel-software/platform-core-backend 0.21.0 → 0.22.0

package/dist/modules/github-app/github-app.connection.js

@@ -0,0 +1,185 @@
+import { logger } from '../../shared/logging.js';
+import { GitHubAppClient, } from './github-app.client.js';
+/** Renewed this long before it would expire, so no git call starts on a token with minutes to live. */
+const RENEW_AHEAD_MS = 10 * 60_000;
+/** How long a failed renewal is remembered the first time, and the most it grows to. */
+const FIRST_WAIT_MS = 5_000;
+const LONGEST_WAIT_MS = 5 * 60_000;
+/** The repositories a person may connect, as a setting holds them: one `owner/name` a line. */
+export function repositoriesAsSetting(names) {
+    return [...new Set(names.map((name) => name.trim()).filter(Boolean))].join('\n');
+}
+/**
+ * The deployment's connection to GitHub through a GitHub App: the app it
+ * acts as, the installation it was given, the repositories it may be
+ * pointed at, and the token that stands for the first two when git runs.
+ *
+ * THE TOKEN EXPIRES. An installation token is good for an hour, which is
+ * the point of it: nothing long-lived is stored that reaches the
+ * repository. It is kept in memory, renewed before it runs out, and never
+ * written anywhere. A deployment that restarts asks for a new one.
+ *
+ * What is stored is what cannot be asked for again: the app's private key,
+ * encrypted like every secret, the number of the installation, and the
+ * repositories the person who connected it could push to.
+ *
+ * WHAT THE INSTALLATION REACHES IS NOT WHAT THE DEPLOYMENT MAY USE. An
+ * installation's token reads and writes every repository the installation
+ * covers. The person who connected it may hold far less: being able to
+ * read ONE of those repositories is enough for GitHub to count the
+ * installation among theirs. So the deployment is limited to what that
+ * person could push to with their own account, recorded when they
+ * connected (see {@link permits}); the installation's reach is what git
+ * works through, never what is offered.
+ */
+export class GitHubAppConnection {
+    opts;
+    client;
+    now;
+    log = () => logger('github-app');
+    /** The token in hand and what it is a token FOR: another app or installation is another token. */
+    held = null;
+    /** One renewal at a time, shared by every git call that arrives during it. */
+    renewing = null;
+    /** The last renewal failed: how many in a row have, and until when GitHub is not asked again. */
+    failed = null;
+    constructor(opts) {
+        this.opts = opts;
+        this.client = opts.client ?? new GitHubAppClient();
+        this.now = opts.now ?? Date.now;
+    }
+    /** The app the deployment acts as, or null while any part of it is missing. */
+    credentials(read = this.opts.read) {
+        const credentials = {
+            appId: read('githubAppId'),
+            slug: read('githubAppSlug'),
+            privateKey: read('githubAppPrivateKey'),
+            clientId: read('githubAppClientId'),
+            clientSecret: read('githubAppClientSecret'),
+        };
+        return Object.values(credentials).every(Boolean) ? credentials : null;
+    }
+    /** Who supplied the app: whoever operates the deployment, or the setup screen. Null: there is none. */
+    registeredBy() {
+        if (!this.credentials())
+            return null;
+        return this.opts.sourceOf('githubAppId') === 'env' ? 'environment' : 'setup';
+    }
+    installationId(read = this.opts.read) {
+        return read('githubInstallationId');
+    }
+    url(read = this.opts.read) {
+        const repository = read('githubRepository');
+        return repository ? `https://github.com/${repository}.git` : '';
+    }
+    answered(read = this.opts.read) {
+        return Boolean(this.credentials(read) && this.installationId(read) && read('githubRepository'));
+    }
+    /**
+     * Whether the deployment may be pointed at `repository`: it is one the
+     * person who connected the installation could push to.
+     *
+     * An installation the OPERATOR supplied, through the environment, has no
+     * such person. It is the operator's statement about their own
+     * deployment, and everything it reaches is permitted, as everything an
+     * access token reaches is.
+     */
+    permits(repository, read = this.opts.read) {
+        if (this.opts.sourceOf('githubInstallationId') === 'env')
+            return true;
+        const wanted = repository.trim().toLowerCase();
+        if (!wanted)
+            return false;
+        // GitHub's names do not tell case apart.
+        return read('githubRepositoriesPermitted')
+            .split('\n')
+            .some((name) => name.trim().toLowerCase() === wanted);
+    }
+    token() {
+        const held = this.held;
+        if (!held || held.for !== this.holder() || held.expiresAt <= this.now())
+            return null;
+        return held.token;
+    }
+    /**
+     * Have a token for the call about to be made, WITHOUT MAKING THE CALL
+     * WAIT ON GITHUB UNLESS IT HAS TO. This runs before every git call the
+     * deployment makes, the ones that never leave the disk included.
+     *
+     *  - A token with time to spare: nothing is asked.
+     *  - A token that is good but close to running out: a renewal is started
+     *    and the call goes ahead with the token in hand.
+     *  - No token that is good: the call waits for one, and gets what GitHub
+     *    says, unless GitHub has just failed to give one. A failure is
+     *    remembered for a short while that grows with each one in a row, and
+     *    inside it nothing is asked: git runs with no token, and a call that
+     *    needed one is told so by the host, at once.
+     *
+     * `asked` is for an admin waiting on the answer itself (the setup screen
+     * listing repositories, proving a connection): GitHub is asked whatever
+     * is remembered, and the failure is thrown.
+     */
+    async prepare(opts = {}) {
+        const credentials = this.credentials();
+        const installationId = this.installationId();
+        if (!credentials || !installationId)
+            return;
+        const held = this.held?.for === this.holder() ? this.held : null;
+        const good = held !== null && held.expiresAt > this.now();
+        if (good && held.expiresAt - this.now() > RENEW_AHEAD_MS)
+            return;
+        if (!opts.asked && this.failed && this.now() < this.failed.until)
+            return;
+        this.renewing ??= this.renew(credentials, installationId).finally(() => {
+            this.renewing = null;
+        });
+        if (good && !opts.asked) {
+            // Not waited on, so not thrown to anyone: the renewal has logged it.
+            this.renewing.catch(() => undefined);
+            return;
+        }
+        await this.renewing;
+    }
+    /**
+     * The repositories the deployment may be pointed at: those the
+     * installation reaches AND the person who connected it could push to.
+     * Asked of GitHub each time, so a repository taken out of the
+     * installation since is not offered.
+     */
+    async repositories() {
+        await this.prepare({ asked: true });
+        const token = this.token();
+        if (!token)
+            return { repositories: [], more: false };
+        const reached = await this.client.repositories(token);
+        return { repositories: reached.repositories.filter((r) => this.permits(r.fullName)), more: reached.more };
+    }
+    /** Drop the token in hand: the installation it was for is no longer the deployment's. */
+    forget() {
+        this.held = null;
+        this.failed = null;
+    }
+    async renew(credentials, installationId) {
+        const holder = this.holder();
+        try {
+            const issued = await this.client.installationToken(credentials, installationId);
+            this.held = { for: holder, token: issued.token, expiresAt: issued.expiresAt };
+            this.failed = null;
+        }
+        catch (err) {
+            const times = (this.failed?.times ?? 0) + 1;
+            const wait = Math.min(FIRST_WAIT_MS * 2 ** (times - 1), LONGEST_WAIT_MS);
+            this.failed = { times, until: this.now() + wait };
+            // Once per failure, and a failure is once per wait.
+            this.log().error(`GitHub gave no token for the installation; not asked again for ${Math.round(wait / 1000)} s:`, {
+                detail: err instanceof Error ? err.message : String(err),
+                failuresInARow: times,
+            });
+            throw err;
+        }
+    }
+    holder() {
+        return `${this.opts.read('githubAppId')}:${this.installationId()}`;
+    }
+}
+//# sourceMappingURL=github-app.connection.js.map

package/dist/modules/github-app/github-app.connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.connection.js","sourceRoot":"","sources":["../../../src/modules/github-app/github-app.connection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EACL,eAAe,GAGhB,MAAM,wBAAwB,CAAC;AAEhC,uGAAuG;AACvG,MAAM,cAAc,GAAG,EAAE,GAAG,MAAM,CAAC;AACnC,wFAAwF;AACxF,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AAEnC,+FAA+F;AAC/F,MAAM,UAAU,qBAAqB,CAAC,KAAe;IACnD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnF,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,mBAAmB;IAWD;IAVZ,MAAM,CAAkB;IACxB,GAAG,CAAe;IAClB,GAAG,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAClD,kGAAkG;IAC1F,IAAI,GAA6D,IAAI,CAAC;IAC9E,8EAA8E;IACtE,QAAQ,GAAyB,IAAI,CAAC;IAC9C,iGAAiG;IACzF,MAAM,GAA4C,IAAI,CAAC;IAE/D,YAA6B,IAAgC;QAAhC,SAAI,GAAJ,IAAI,CAA4B;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,OAAsB,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9C,MAAM,WAAW,GAAG;YAClB,KAAK,EAAE,IAAI,CAAC,aAAa,CAAC;YAC1B,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC;YAC3B,UAAU,EAAE,IAAI,CAAC,qBAAqB,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC;YACnC,YAAY,EAAE,IAAI,CAAC,uBAAuB,CAAC;SAC5C,CAAC;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC;IAED,uGAAuG;IACvG,YAAY;QACV,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/E,CAAC;IAED,cAAc,CAAC,OAAsB,IAAI,CAAC,IAAI,CAAC,IAAI;QACjD,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;IAED,GAAG,CAAC,OAAsB,IAAI,CAAC,IAAI,CAAC,IAAI;QACtC,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5C,OAAO,UAAU,CAAC,CAAC,CAAC,sBAAsB,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,QAAQ,CAAC,OAAsB,IAAI,CAAC,IAAI,CAAC,IAAI;QAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;;OAQG;IACH,OAAO,CAAC,UAAkB,EAAE,OAAsB,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9D,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,yCAAyC;QACzC,OAAO,IAAI,CAAC,6BAA6B,CAAC;aACvC,KAAK,CAAC,IAAI,CAAC;aACX,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACrF,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,OAAO,CAAC,OAA4B,EAAE;QAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc;YAAE,OAAO;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,MAAM,IAAI,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1D,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;YAAE,OAAO;QACjE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO;QAEzE,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACrE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxB,qEAAqE;YACrE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5G,CAAC;IAED,yFAAyF;IACzF,MAAM;QACJ,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,WAAiC,EAAE,cAAsB;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;YAChF,IAAI,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;YACzE,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;YAClD,oDAAoD;YACpD,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,kEAAkE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE;gBAC/G,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACxD,cAAc,EAAE,KAAK;aACtB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,MAAM;QACZ,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;IACrE,CAAC;CACF"}

package/dist/modules/github-app/github-app.routes.d.ts

@@ -0,0 +1,59 @@
+import express from 'express';
+import type { IAdminAccessService } from '../admin/admin.interface.js';
+import type { DeploymentSettingsService } from '../settings/deployment-settings.service.js';
+import { GitHubAppClient } from './github-app.client.js';
+import { type GitHubAppConnection } from './github-app.connection.js';
+import '../auth/auth.middleware.js';
+export interface GitHubAppRoutesDeps {
+    settings: Pick<DeploymentSettingsService, 'resolve' | 'record'>;
+    connection: GitHubAppConnection;
+    adminAccess: IAdminAccessService;
+    /** Where GitHub sends the browser back to: this deployment's own address. */
+    publicBackendUrl: string;
+    publicFrontendUrl: string;
+    /** Whether the deployment is set up: decides which page a round trip ends on. */
+    isComplete(): boolean;
+    client?: GitHubAppClient;
+}
+/** The address GitHub is told to send the browser back to once the app is installed. */
+export declare function githubAppCallbackUrl(publicBackendUrl: string): string;
+/**
+ * The manifest a deployment's own GitHub App is created from. It asks for
+ * what the deployment does and nothing else: read and write the contents of
+ * the repositories it is installed on. No webhook, no events, not public:
+ * the app is this deployment's, installed by its owner on the one
+ * repository the knowledge base lives in.
+ */
+export declare function githubAppManifest(publicBackendUrl: string, publicFrontendUrl: string): Record<string, unknown>;
+/**
+ * Connecting a repository on GitHub through a GitHub App, from the setup
+ * screen. Mounted behind the deployment's sign-in; every route is an
+ * admin's.
+ *
+ *   GET  /setup/github-app               where the connection stands
+ *   POST /setup/github-app/manifest      start registering this deployment's own app
+ *   GET  /setup/github-app/registered    GitHub sends the browser back: the app exists
+ *   POST /setup/github-app/install       where on GitHub the app is installed
+ *   POST /setup/github-app/refresh       where to sign in, to read again what may be connected
+ *   GET  /setup/github-app/callback      GitHub sends the browser back: the app is installed
+ *   GET  /setup/github-app/repositories  what the deployment may be pointed at
+ *
+ * A ROUND TRIP IS STARTED BY A POST AND ENDED BY A GET. The two routes
+ * GitHub sends the browser to are ordinary navigations, authenticated by
+ * the session cookie; each checks a state this browser was given when the
+ * round trip started, and spends it. Nothing that starts one is a link, so
+ * a link somebody was sent starts nothing.
+ *
+ * WHAT THE DEPLOYMENT MAY REACH is never taken from the address the browser
+ * came back on. GitHub puts an installation's number there and anyone can
+ * write another: with one app serving many deployments, that number is the
+ * only thing between a deployment and another organisation's repositories.
+ * GitHub sends the person back signed in, and the deployment asks GitHub
+ * two things about THAT PERSON: which installations they reach, and which
+ * repositories of the one they named they can push to with their own
+ * account. The first alone is not enough, since read access to one
+ * repository puts an installation on that list. Only the second is what
+ * the deployment may be pointed at.
+ */
+export declare function createGitHubAppRoutes(deps: GitHubAppRoutesDeps): express.Router;
+//# sourceMappingURL=github-app.routes.d.ts.map

package/dist/modules/github-app/github-app.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.routes.d.ts","sourceRoot":"","sources":["../../../src/modules/github-app/github-app.routes.ts"],"names":[],"mappings":"AACA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAyB,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC7F,OAAO,4BAA4B,CAAC;AAWpC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,IAAI,CAAC,yBAAyB,EAAE,SAAS,GAAG,QAAQ,CAAC,CAAC;IAChE,UAAU,EAAE,mBAAmB,CAAC;IAChC,WAAW,EAAE,mBAAmB,CAAC;IACjC,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iFAAiF;IACjF,UAAU,IAAI,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe9G;AAqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CA0P/E"}

package/dist/modules/github-app/github-app.routes.js

@@ -0,0 +1,323 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import express from 'express';
+import { logger } from '../../shared/logging.js';
+import { GitHubAppClient, GitHubAppError } from './github-app.client.js';
+import { repositoriesAsSetting } from './github-app.connection.js';
+import '../auth/auth.middleware.js'; // Express Request augmentation
+const log = logger('github-app');
+const STATE_COOKIE = 'hexis_github_state';
+const STATE_MAX_AGE_S = 15 * 60;
+/** A GitHub organisation's name, as it appears in an address. */
+const ORGANIZATION_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/;
+/** GitHub refuses an app name longer than this. */
+const MAX_APP_NAME = 34;
+/** The address GitHub is told to send the browser back to once the app is installed. */
+export function githubAppCallbackUrl(publicBackendUrl) {
+    return `${publicBackendUrl}/api/setup/github-app/callback`;
+}
+/**
+ * The manifest a deployment's own GitHub App is created from. It asks for
+ * what the deployment does and nothing else: read and write the contents of
+ * the repositories it is installed on. No webhook, no events, not public:
+ * the app is this deployment's, installed by its owner on the one
+ * repository the knowledge base lives in.
+ */
+export function githubAppManifest(publicBackendUrl, publicFrontendUrl) {
+    const host = new URL(publicFrontendUrl).host;
+    return {
+        name: `Hexis ${host}`.slice(0, MAX_APP_NAME),
+        url: publicFrontendUrl,
+        description: `Lets the Hexis deployment at ${host} read and write the repository its knowledge base lives in.`,
+        redirect_url: `${publicBackendUrl}/api/setup/github-app/registered`,
+        callback_urls: [githubAppCallbackUrl(publicBackendUrl)],
+        // GitHub then sends the person back signed in, which is what lets the
+        // deployment check that the installation they name is one they hold.
+        request_oauth_on_install: true,
+        public: false,
+        default_permissions: { contents: 'write', metadata: 'read' },
+        default_events: [],
+    };
+}
+function readCookie(req, name) {
+    for (const segment of (req.headers.cookie ?? '').split(';')) {
+        const trimmed = segment.trim();
+        if (!trimmed.startsWith(`${name}=`))
+            continue;
+        try {
+            return decodeURIComponent(trimmed.slice(name.length + 1)) || null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function same(a, b) {
+    const left = Buffer.from(a, 'utf8');
+    const right = Buffer.from(b, 'utf8');
+    return left.length === right.length && timingSafeEqual(left, right);
+}
+/**
+ * Connecting a repository on GitHub through a GitHub App, from the setup
+ * screen. Mounted behind the deployment's sign-in; every route is an
+ * admin's.
+ *
+ *   GET  /setup/github-app               where the connection stands
+ *   POST /setup/github-app/manifest      start registering this deployment's own app
+ *   GET  /setup/github-app/registered    GitHub sends the browser back: the app exists
+ *   POST /setup/github-app/install       where on GitHub the app is installed
+ *   POST /setup/github-app/refresh       where to sign in, to read again what may be connected
+ *   GET  /setup/github-app/callback      GitHub sends the browser back: the app is installed
+ *   GET  /setup/github-app/repositories  what the deployment may be pointed at
+ *
+ * A ROUND TRIP IS STARTED BY A POST AND ENDED BY A GET. The two routes
+ * GitHub sends the browser to are ordinary navigations, authenticated by
+ * the session cookie; each checks a state this browser was given when the
+ * round trip started, and spends it. Nothing that starts one is a link, so
+ * a link somebody was sent starts nothing.
+ *
+ * WHAT THE DEPLOYMENT MAY REACH is never taken from the address the browser
+ * came back on. GitHub puts an installation's number there and anyone can
+ * write another: with one app serving many deployments, that number is the
+ * only thing between a deployment and another organisation's repositories.
+ * GitHub sends the person back signed in, and the deployment asks GitHub
+ * two things about THAT PERSON: which installations they reach, and which
+ * repositories of the one they named they can push to with their own
+ * account. The first alone is not enough, since read access to one
+ * repository puts an installation on that list. Only the second is what
+ * the deployment may be pointed at.
+ */
+export function createGitHubAppRoutes(deps) {
+    const router = express.Router();
+    const client = deps.client ?? new GitHubAppClient();
+    const { settings, connection } = deps;
+    const secure = deps.publicBackendUrl.startsWith('https');
+    const requireAdmin = async (req, res, next) => {
+        if (!(await deps.adminAccess.isAdmin(req.userEmail))) {
+            res.status(403).json({ error: 'Admins only' });
+            return;
+        }
+        next();
+    };
+    /** A state for one round trip, kept in this browser until it comes back. */
+    const beginRoundTrip = (res) => {
+        const tag = settings.resolve('githubAppStateTag');
+        const state = `${tag ? `${tag}.` : ''}${randomBytes(24).toString('base64url')}`;
+        res.cookie(STATE_COOKIE, state, { httpOnly: true, sameSite: 'lax', secure, maxAge: STATE_MAX_AGE_S * 1000, path: '/' });
+        return state;
+    };
+    /** Whether the browser that came back is the one that was sent. */
+    const cameBack = (req) => {
+        const kept = readCookie(req, STATE_COOKIE);
+        const given = typeof req.query.state === 'string' ? req.query.state : '';
+        return Boolean(kept && given && same(kept, given));
+    };
+    /** Back to the setup screen, saying how the round trip ended. */
+    const finish = (res, outcome) => {
+        const page = deps.isComplete() ? '/deployment' : '/';
+        res.redirect(`${deps.publicFrontendUrl}${page}?github=${encodeURIComponent(outcome)}`);
+    };
+    const installUrl = (slug, state) => `https://github.com/apps/${encodeURIComponent(slug)}/installations/new?state=${encodeURIComponent(state)}`;
+    const outcomeOf = (err) => err instanceof GitHubAppError && err.kind === 'unreachable' ? 'unreachable' : 'refused';
+    router.get('/setup/github-app', requireAdmin, (_req, res) => {
+        const credentials = connection.credentials();
+        res.json({
+            // Who supplied the app. Null: this deployment has none yet, and can register its own.
+            registeredBy: connection.registeredBy(),
+            app: credentials ? { slug: credentials.slug, url: `https://github.com/apps/${credentials.slug}` } : null,
+            installation: connection.installationId()
+                ? { id: connection.installationId(), account: settings.resolve('githubInstallationAccount') }
+                : null,
+            repository: settings.resolve('githubRepository') || null,
+        });
+    });
+    router.post('/setup/github-app/manifest', requireAdmin, (req, res) => {
+        if (connection.credentials()) {
+            res.status(409).json({ error: 'This deployment already has a GitHub App.' });
+            return;
+        }
+        const organization = req.body?.organization;
+        const org = typeof organization === 'string' ? organization.trim() : '';
+        if (org && !ORGANIZATION_PATTERN.test(org)) {
+            res.status(400).json({ error: 'Enter the organisation’s name as it appears in its GitHub address.' });
+            return;
+        }
+        const state = beginRoundTrip(res);
+        const base = org ? `https://github.com/organizations/${org}/settings/apps/new` : 'https://github.com/settings/apps/new';
+        // The browser posts the manifest to GitHub itself: a form, not a request of ours.
+        res.json({
+            action: `${base}?state=${encodeURIComponent(state)}`,
+            manifest: githubAppManifest(deps.publicBackendUrl, deps.publicFrontendUrl),
+        });
+    });
+    router.get('/setup/github-app/registered', requireAdmin, async (req, res) => {
+        // Spent on return, however the return ends.
+        const returned = cameBack(req);
+        res.clearCookie(STATE_COOKIE, { path: '/' });
+        if (!returned) {
+            finish(res, 'state');
+            return;
+        }
+        const code = typeof req.query.code === 'string' ? req.query.code : '';
+        if (!code || connection.credentials()) {
+            finish(res, code ? 'already-registered' : 'refused');
+            return;
+        }
+        try {
+            const app = await client.convertManifest(code);
+            await settings.record({
+                githubAppId: app.appId,
+                githubAppSlug: app.slug,
+                githubAppPrivateKey: app.privateKey,
+                githubAppClientId: app.clientId,
+                githubAppClientSecret: app.clientSecret,
+            }, req.userId ?? null);
+            log.info(`GitHub App "${app.slug}" registered for this deployment`, { slug: app.slug, owner: app.owner });
+            // Straight on to installing it: the same round trip, the same state.
+            res.redirect(installUrl(app.slug, beginRoundTrip(res)));
+        }
+        catch (err) {
+            log.error('the GitHub App could not be registered:', { detail: err instanceof Error ? err.message : String(err) });
+            finish(res, outcomeOf(err));
+        }
+    });
+    /**
+     * A POST that answers with the address, and the page sends the browser
+     * there. As a link it was a round trip anyone could start in an admin's
+     * browser by getting them to follow it: the state would be set, and
+     * whatever they then installed would come back with a state that matched.
+     */
+    router.post('/setup/github-app/install', requireAdmin, (_req, res) => {
+        const credentials = connection.credentials();
+        if (!credentials) {
+            res.status(409).json({ error: 'This deployment has no GitHub App yet. Create it first.' });
+            return;
+        }
+        res.json({ url: installUrl(credentials.slug, beginRoundTrip(res)) });
+    });
+    /**
+     * Ask GitHub again what the person may connect, WITHOUT installing
+     * anything: a sign-in with the app and nothing more, which comes back on
+     * the same callback with a code and no installation named.
+     *
+     * It exists because installing comes back only the first time. Once the
+     * app is installed, the address that installs it opens the installation's
+     * settings on GitHub, and GitHub sends nobody back from there: a
+     * repository added on that page was reached by the app and never offered
+     * here, since what is offered is what was recorded when the person
+     * connected. The same goes for an installation an organisation's owner
+     * approved later, in a browser of their own.
+     */
+    router.post('/setup/github-app/refresh', requireAdmin, (_req, res) => {
+        const credentials = connection.credentials();
+        if (!credentials) {
+            res.status(409).json({ error: 'This deployment has no GitHub App yet. Create it first.' });
+            return;
+        }
+        const state = beginRoundTrip(res);
+        res.json({
+            url: `https://github.com/login/oauth/authorize?client_id=${encodeURIComponent(credentials.clientId)}&state=${encodeURIComponent(state)}`,
+        });
+    });
+    router.get('/setup/github-app/callback', requireAdmin, async (req, res) => {
+        const returned = cameBack(req);
+        res.clearCookie(STATE_COOKIE, { path: '/' });
+        if (!returned) {
+            finish(res, 'state');
+            return;
+        }
+        const credentials = connection.credentials();
+        if (!credentials) {
+            finish(res, 'not-registered');
+            return;
+        }
+        // Someone without the right to install asked their organisation's owner
+        // to: nothing is installed yet, and there is nothing to record.
+        if (req.query.setup_action === 'request') {
+            finish(res, 'requested');
+            return;
+        }
+        const code = typeof req.query.code === 'string' ? req.query.code : '';
+        const given = typeof req.query.installation_id === 'string' ? req.query.installation_id : '';
+        if (!code || (given !== '' && !/^\d+$/.test(given))) {
+            finish(res, 'refused');
+            return;
+        }
+        // Back from installing, GitHub names the installation. Back from a
+        // sign-in alone (see `refresh`) it names none, and the one in question
+        // is the one this deployment has. Either way it is only a name: what
+        // decides is what GitHub says the person reaches, below.
+        const refreshing = given === '';
+        const named = given || connection.installationId();
+        try {
+            const userToken = await client.exchangeUserCode(credentials, code);
+            const reached = await client.installationsOf(userToken);
+            let held = named ? reached.find((installation) => installation.id === named) : undefined;
+            if (!named) {
+                // No installation on record and none named: the app was installed
+                // where this browser never came back from (an owner approved it
+                // later). One the person reaches is the one; several are a choice
+                // only installing from here can make.
+                if (reached.length === 0) {
+                    finish(res, 'not-installed');
+                    return;
+                }
+                if (reached.length > 1) {
+                    finish(res, 'several');
+                    return;
+                }
+                held = reached[0];
+            }
+            if (!held) {
+                log.warn('an installation was named that the person who came back cannot reach', { installation: named });
+                finish(res, 'not-yours');
+                return;
+            }
+            // Reaching the installation is not holding it: read access to one
+            // repository it covers is enough for GitHub to list it. What the
+            // deployment may be pointed at is what THIS PERSON can push to.
+            const theirs = await client.repositoriesOf(userToken, held.id);
+            const writable = theirs.repositories.filter((repository) => repository.writable).map((r) => r.fullName);
+            if (writable.length === 0) {
+                log.warn('the person who came back can push to nothing the installation covers', { installation: held.id });
+                finish(res, 'nothing-to-write');
+                return;
+            }
+            await settings.record({
+                githubInstallationId: held.id,
+                githubRepositoriesPermitted: repositoriesAsSetting(writable),
+                ...(held.account ? { githubInstallationAccount: held.account } : {}),
+            }, req.userId ?? null);
+            // A token in hand was another installation's.
+            connection.forget();
+            log.info(refreshing
+                ? `what may be connected through the GitHub App on "${held.account}" was read again`
+                : `GitHub App installed on "${held.account}"`, { installation: held.id, account: held.account, repositories: writable.length });
+            finish(res, refreshing ? 'refreshed' : 'connected');
+        }
+        catch (err) {
+            log.error('the installation could not be confirmed:', { detail: err instanceof Error ? err.message : String(err) });
+            finish(res, outcomeOf(err));
+        }
+    });
+    router.get('/setup/github-app/repositories', requireAdmin, async (_req, res) => {
+        if (!connection.credentials() || !connection.installationId()) {
+            res.status(409).json({ error: 'Connect GitHub first.' });
+            return;
+        }
+        try {
+            res.json(await connection.repositories());
+        }
+        catch (err) {
+            log.error('the repositories could not be listed:', { detail: err instanceof Error ? err.message : String(err) });
+            const unreachable = err instanceof GitHubAppError && err.kind === 'unreachable';
+            res.status(502).json({
+                error: unreachable
+                    ? 'GitHub could not be reached. Try again shortly.'
+                    : 'GitHub would not list the repositories. The app may have been uninstalled: connect it again.',
+            });
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=github-app.routes.js.map

package/dist/modules/github-app/github-app.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-app.routes.js","sourceRoot":"","sources":["../../../src/modules/github-app/github-app.routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAA4B,MAAM,4BAA4B,CAAC;AAC7F,OAAO,4BAA4B,CAAC,CAAC,+BAA+B;AAEpE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;AAEjC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,CAAC;AAChC,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,iDAAiD,CAAC;AAC/E,mDAAmD;AACnD,MAAM,YAAY,GAAG,EAAE,CAAC;AAcxB,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,gBAAwB;IAC3D,OAAO,GAAG,gBAAgB,gCAAgC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,gBAAwB,EAAE,iBAAyB;IACnF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC;IAC7C,OAAO;QACL,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;QAC5C,GAAG,EAAE,iBAAiB;QACtB,WAAW,EAAE,gCAAgC,IAAI,6DAA6D;QAC9G,YAAY,EAAE,GAAG,gBAAgB,kCAAkC;QACnE,aAAa,EAAE,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACvD,sEAAsE;QACtE,qEAAqE;QACrE,wBAAwB,EAAE,IAAI;QAC9B,MAAM,EAAE,KAAK;QACb,mBAAmB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC5D,cAAc,EAAE,EAAE;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,IAAY;IACpD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,SAAS;QAC9C,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAyB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;IACpD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAEzD,MAAM,YAAY,GAA2B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACpE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,4EAA4E;IAC5E,MAAM,cAAc,GAAG,CAAC,GAAqB,EAAU,EAAE;QACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACxH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,mEAAmE;IACnE,MAAM,QAAQ,GAAG,CAAC,GAAoB,EAAW,EAAE;QACjD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;IACF,iEAAiE;IACjE,MAAM,MAAM,GAAG,CAAC,GAAqB,EAAE,OAAe,EAAQ,EAAE;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,iBAAiB,GAAG,IAAI,WAAW,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CACzD,2BAA2B,kBAAkB,CAAC,IAAI,CAAC,4BAA4B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7G,MAAM,SAAS,GAAG,CAAC,GAAY,EAAU,EAAE,CACzC,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,MAAM,CAAC,GAAG,CAAC,mBAAmB,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC1D,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7C,GAAG,CAAC,IAAI,CAAC;YACP,sFAAsF;YACtF,YAAY,EAAE,UAAU,CAAC,YAAY,EAAE;YACvC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,2BAA2B,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;YACxG,YAAY,EAAE,UAAU,CAAC,cAAc,EAAE;gBACvC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE;gBAC7F,CAAC,CAAC,IAAI;YACR,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,IAAI;SACzD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnE,IAAI,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QACD,MAAM,YAAY,GAAI,GAAG,CAAC,IAA+C,EAAE,YAAY,CAAC;QACxF,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,IAAI,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oEAAoE,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,oCAAoC,GAAG,oBAAoB,CAAC,CAAC,CAAC,sCAAsC,CAAC;QACxH,kFAAkF;QAClF,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE,GAAG,IAAI,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE;YACpD,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,8BAA8B,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1E,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,CAAC,MAAM,CACnB;gBACE,WAAW,EAAE,GAAG,CAAC,KAAK;gBACtB,aAAa,EAAE,GAAG,CAAC,IAAI;gBACvB,mBAAmB,EAAE,GAAG,CAAC,UAAU;gBACnC,iBAAiB,EAAE,GAAG,CAAC,QAAQ;gBAC/B,qBAAqB,EAAE,GAAG,CAAC,YAAY;aACxC,EACD,GAAG,CAAC,MAAM,IAAI,IAAI,CACnB,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,IAAI,kCAAkC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1G,qEAAqE;YACrE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,yCAAyC,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnH,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,sDAAsD,kBAAkB,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,EAAE;SACzI,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,4BAA4B,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/B,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,wEAAwE;QACxE,gEAAgE;QAChE,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YACvB,OAAO;QACT,CAAC;QACD,mEAAmE;QACnE,uEAAuE;QACvE,qEAAqE;QACrE,yDAAyD;QACzD,MAAM,UAAU,GAAG,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,KAAK,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACzF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,kEAAkE;gBAClE,gEAAgE;gBAChE,kEAAkE;gBAClE,sCAAsC;gBACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;oBACvB,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,GAAG,CAAC,IAAI,CAAC,sEAAsE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC1G,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,kEAAkE;YAClE,iEAAiE;YACjE,gEAAgE;YAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACxG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,sEAAsE,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5G,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBAChC,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,CAAC,MAAM,CACnB;gBACE,oBAAoB,EAAE,IAAI,CAAC,EAAE;gBAC7B,2BAA2B,EAAE,qBAAqB,CAAC,QAAQ,CAAC;gBAC5D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,EACD,GAAG,CAAC,MAAM,IAAI,IAAI,CACnB,CAAC;YACF,8CAA8C;YAC9C,UAAU,CAAC,MAAM,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CACN,UAAU;gBACR,CAAC,CAAC,oDAAoD,IAAI,CAAC,OAAO,kBAAkB;gBACpF,CAAC,CAAC,4BAA4B,IAAI,CAAC,OAAO,GAAG,EAC/C,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAChF,CAAC;YACF,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpH,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,gCAAgC,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7E,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,YAAY,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjH,MAAM,WAAW,GAAG,GAAG,YAAY,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,WAAW;oBAChB,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,8FAA8F;aACnG,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/modules/github-app/index.d.ts

@@ -0,0 +1,4 @@
+export { GitHubAppClient, GitHubAppError, appJwt, normalizePrivateKey, type GitHubAppCredentials, type GitHubFailureKind, type Installation, type InstallationRepository, type InstallationToken, type RegisteredApp, } from './github-app.client.js';
+export { GitHubAppConnection, repositoriesAsSetting, type GitHubAppConnectionOptions } from './github-app.connection.js';
+export { createGitHubAppRoutes, githubAppCallbackUrl, githubAppManifest, type GitHubAppRoutesDeps, } from './github-app.routes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/github-app/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/github-app/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,cAAc,EACd,MAAM,EACN,mBAAmB,EACnB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,KAAK,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACzH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC"}

package/dist/modules/github-app/index.js

@@ -0,0 +1,4 @@
+export { GitHubAppClient, GitHubAppError, appJwt, normalizePrivateKey, } from './github-app.client.js';
+export { GitHubAppConnection, repositoriesAsSetting } from './github-app.connection.js';
+export { createGitHubAppRoutes, githubAppCallbackUrl, githubAppManifest, } from './github-app.routes.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/github-app/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/github-app/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,cAAc,EACd,MAAM,EACN,mBAAmB,GAOpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAmC,MAAM,4BAA4B,CAAC;AACzH,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,GAElB,MAAM,wBAAwB,CAAC"}

package/dist/modules/kb-fs/remote-url.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Whether two repository addresses name the same repository.
+ *
+ * The answer decides whether a working copy on disk is KEPT or DELETED, so it
+ * errs towards "same": only differences that cannot change which repository
+ * is meant are ignored, and they are ignored on both sides.
+ *
+ *  - a trailing slash, and a `.git` suffix — hosts serve both spellings;
+ *  - the letter case of the scheme and the host — DNS does not distinguish;
+ *  - userinfo (`user:token@`) — who asks does not change what is asked for,
+ *    and a credential must never decide, or appear in, a comparison.
+ *
+ * The PATH keeps its case: hosts that fold it and hosts that do not both
+ * exist, and treating `Org/Repo` and `org/repo` as one would keep a clone of
+ * the wrong repository on a host that tells them apart — but deleting a clone
+ * of the right one is the worse error, and an operator who only changed the
+ * case gets a re-clone, not a loss: the work on that clone was pushed to the
+ * same place.
+ */
+export declare function normalizeRepositoryAddress(address: string): string;
+export declare function sameRepository(a: string, b: string): boolean;
+//# sourceMappingURL=remote-url.d.ts.map