@cat-factory/gitlab 0.1.2 → 0.1.3

package/dist/webhook.js

@@ -0,0 +1,183 @@
+import { checkState, mrState } from './projection.js';
+// ---------------------------------------------------------------------------
+// GitLab webhook ingest: verification + normalisation.
+//
+// GitLab does NOT sign the body (no HMAC like GitHub). Instead each webhook carries a
+// caller-chosen secret token in the `X-Gitlab-Token` header, compared constant-time
+// against the configured secret. The mapper then turns a verified delivery (keyed by the
+// `X-Gitlab-Event` name) into a neutral {@link VcsWebhookEvent}.
+// ---------------------------------------------------------------------------
+/**
+ * Verifies the `X-Gitlab-Token` header against the configured secret in constant time.
+ * The `WebhookVerifier` port's `verify(rawBody, signatureHeader)` is reused: GitLab passes
+ * the token header as `signatureHeader` (the body is irrelevant to GitLab verification).
+ */
+export class GitLabWebhookVerifier {
+    secret;
+    constructor(secret) {
+        this.secret = secret;
+    }
+    async verify(_rawBody, signatureHeader) {
+        if (!signatureHeader || !this.secret)
+            return false;
+        return constantTimeEqual(signatureHeader, this.secret);
+    }
+}
+function asObject(value) {
+    return typeof value === 'object' && value !== null ? value : null;
+}
+/** Build the neutral repo ref from a GitLab webhook `project` object. */
+function repoRefOf(root) {
+    const project = asObject(root.project);
+    if (!project)
+        return null;
+    const id = project.id;
+    const pathWithNs = typeof project.path_with_namespace === 'string' ? project.path_with_namespace : '';
+    const name = pathWithNs.includes('/')
+        ? pathWithNs.slice(pathWithNs.lastIndexOf('/') + 1)
+        : pathWithNs;
+    const owner = pathWithNs.includes('/') ? pathWithNs.slice(0, pathWithNs.lastIndexOf('/')) : '';
+    return { repoId: id === undefined ? '' : String(id), owner, repo: name };
+}
+function numericRepoId(repo) {
+    const n = Number(repo.repoId);
+    return Number.isInteger(n) ? n : 0;
+}
+export class GitLabWebhookMapper {
+    clock;
+    // The clock is injected (rather than `Date.now()`) so projected `updatedAt`/`syncedAt`
+    // timestamps are deterministic in tests and consistent with the client's clock.
+    constructor(clock) {
+        this.clock = clock;
+    }
+    map(connection, delivery) {
+        const root = asObject(delivery.payload);
+        if (!root)
+            return null;
+        const repo = repoRefOf(root);
+        if (!repo)
+            return null;
+        const now = this.clock.now();
+        const repoId = numericRepoId(repo);
+        switch (delivery.eventName) {
+            case 'Merge Request Hook': {
+                const attrs = asObject(root.object_attributes);
+                if (!attrs)
+                    return null;
+                const { state, merged } = mrState(typeof attrs.state === 'string' ? attrs.state : undefined);
+                const lastCommit = asObject(attrs.last_commit);
+                const author = asObject(asObject(root.user) ? root.user : attrs.author);
+                return {
+                    kind: 'pull-request',
+                    connection,
+                    repo,
+                    pullRequest: {
+                        repoGithubId: repoId,
+                        number: num(attrs.iid),
+                        githubId: num(attrs.id),
+                        title: str(attrs.title),
+                        state,
+                        headRef: str(attrs.source_branch) || null,
+                        baseRef: str(attrs.target_branch) || null,
+                        headSha: lastCommit ? str(lastCommit.id) || null : null,
+                        merged,
+                        author: author ? str(author.username) || null : null,
+                        updatedAt: now,
+                        syncedAt: now,
+                    },
+                };
+            }
+            case 'Issue Hook': {
+                const attrs = asObject(root.object_attributes);
+                if (!attrs)
+                    return null;
+                const labels = Array.isArray(root.labels)
+                    ? root.labels.map((l) => l.title ?? '').filter(Boolean)
+                    : [];
+                const issueAuthor = asObject(root.user);
+                return {
+                    kind: 'issue',
+                    connection,
+                    repo,
+                    issue: {
+                        repoGithubId: repoId,
+                        number: num(attrs.iid),
+                        githubId: num(attrs.id),
+                        title: str(attrs.title),
+                        state: str(attrs.state) === 'opened' ? 'open' : 'closed',
+                        author: issueAuthor ? str(issueAuthor.username) || null : null,
+                        labels,
+                        updatedAt: now,
+                        syncedAt: now,
+                    },
+                };
+            }
+            case 'Push Hook': {
+                const ref = str(root.ref);
+                const after = str(root.after);
+                const rawCommits = Array.isArray(root.commits) ? root.commits : [];
+                return {
+                    kind: 'push',
+                    connection,
+                    repo,
+                    branch: ref.startsWith('refs/heads/') && after
+                        ? { name: ref.slice('refs/heads/'.length), headSha: after }
+                        : undefined,
+                    commits: rawCommits.map((c) => ({
+                        repoGithubId: repoId,
+                        sha: str(c.id),
+                        message: str(c.message),
+                        author: (() => {
+                            const a = asObject(c.author);
+                            return a ? str(a.name) || null : null;
+                        })(),
+                        authoredAt: (() => {
+                            const ts = Date.parse(str(c.timestamp));
+                            return Number.isFinite(ts) ? ts : null;
+                        })(),
+                        syncedAt: now,
+                    })),
+                };
+            }
+            case 'Pipeline Hook': {
+                const attrs = asObject(root.object_attributes);
+                if (!attrs)
+                    return null;
+                const { status, conclusion } = checkState(str(attrs.status));
+                return {
+                    kind: 'ci-status',
+                    connection,
+                    repo,
+                    checkRun: {
+                        repoGithubId: repoId,
+                        githubId: num(attrs.id),
+                        headSha: str(attrs.sha),
+                        name: 'pipeline',
+                        status,
+                        conclusion,
+                        htmlUrl: str(attrs.url) || null,
+                        syncedAt: now,
+                    },
+                };
+            }
+            default:
+                return null;
+        }
+    }
+}
+function str(value) {
+    return typeof value === 'string' ? value : '';
+}
+function num(value) {
+    return typeof value === 'number' ? value : 0;
+}
+/** Length-aware constant-time string compare (avoids early-exit timing leaks). */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+//# sourceMappingURL=webhook.js.map

package/dist/webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.js","sourceRoot":"","sources":["../src/webhook.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAErD,8EAA8E;AAC9E,uDAAuD;AACvD,EAAE;AACF,sFAAsF;AACtF,oFAAoF;AACpF,yFAAyF;AACzF,iEAAiE;AACjE,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,OAAO,qBAAqB;IACH,MAAM;IAAnC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,KAAK,CAAC,MAAM,CAAC,QAAqB,EAAE,eAA8B;QAChE,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAA;QAClD,OAAO,iBAAiB,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;CACF;AAID,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAc,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7E,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,IAAU;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAA;IACrB,MAAM,UAAU,GACd,OAAO,OAAO,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAA;IACpF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QACnC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC,CAAC,UAAU,CAAA;IACd,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9F,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7B,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,OAAO,mBAAmB;IAGD,KAAK;IAFlC,uFAAuF;IACvF,gFAAgF;IAChF,YAA6B,KAAY;qBAAZ,KAAK;IAAU,CAAC;IAE7C,GAAG,CAAC,UAA4B,EAAE,QAA4B;QAC5D,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;QAC5B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QAElC,QAAQ,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC3B,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBAC9C,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAA;gBACvB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;gBAC5F,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;gBAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;gBACvE,OAAO;oBACL,IAAI,EAAE,cAAc;oBACpB,UAAU;oBACV,IAAI;oBACJ,WAAW,EAAE;wBACX,YAAY,EAAE,MAAM;wBACpB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;wBACtB,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;wBACvB,KAAK;wBACL,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI;wBACzC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,IAAI;wBACzC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;wBACvD,MAAM;wBACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;wBACpD,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,GAAG;qBACd;iBACF,CAAA;YACH,CAAC;YACD,KAAK,YAAY,EAAE,CAAC;gBAClB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBAC9C,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAA;gBACvB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;oBACvC,CAAC,CAAE,IAAI,CAAC,MAAoC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACtF,CAAC,CAAC,EAAE,CAAA;gBACN,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACvC,OAAO;oBACL,IAAI,EAAE,OAAO;oBACb,UAAU;oBACV,IAAI;oBACJ,KAAK,EAAE;wBACL,YAAY,EAAE,MAAM;wBACpB,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;wBACtB,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;wBACvB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;wBACxD,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;wBAC9D,MAAM;wBACN,SAAS,EAAE,GAAG;wBACd,QAAQ,EAAE,GAAG;qBACd;iBACF,CAAA;YACH,CAAC;YACD,KAAK,WAAW,EAAE,CAAC;gBACjB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;gBAC7B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,OAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC9E,OAAO;oBACL,IAAI,EAAE,MAAM;oBACZ,UAAU;oBACV,IAAI;oBACJ,MAAM,EACJ,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK;wBACpC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;wBAC3D,CAAC,CAAC,SAAS;oBACf,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC9B,YAAY,EAAE,MAAM;wBACpB,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;wBACd,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;wBACvB,MAAM,EAAE,CAAC,GAAG,EAAE;4BACZ,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;4BAC5B,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;wBACvC,CAAC,CAAC,EAAE;wBACJ,UAAU,EAAE,CAAC,GAAG,EAAE;4BAChB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;4BACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;wBACxC,CAAC,CAAC,EAAE;wBACJ,QAAQ,EAAE,GAAG;qBACd,CAAC,CAAC;iBACJ,CAAA;YACH,CAAC;YACD,KAAK,eAAe,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBAC9C,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAA;gBACvB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC5D,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,UAAU;oBACV,IAAI;oBACJ,QAAQ,EAAE;wBACR,YAAY,EAAE,MAAM;wBACpB,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC;wBACvB,IAAI,EAAE,UAAU;wBAChB,MAAM;wBACN,UAAU;wBACV,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI;wBAC/B,QAAQ,EAAE,GAAG;qBACd;iBACF,CAAA;YACH,CAAC;YACD;gBACE,OAAO,IAAI,CAAA;QACf,CAAC;IACH,CAAC;CACF;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC/C,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC5E,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/gitlab",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Opt-in GitLab VCS provider for cat-factory. Implements the provider-neutral VcsClient / webhook / provisioning ports against the GitLab REST v4 API and registers itself via registerVcsProvider('gitlab'). Depends only on @cat-factory/kernel + @cat-factory/contracts.",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
   },
   "dependencies": {
     "@cat-factory/contracts": "0.43.0",
-    "@cat-factory/kernel": "0.45.0"
+    "@cat-factory/kernel": "0.45.1"
   },
   "devDependencies": {
     "typescript": "7.0.1-rc",