@devrouter/cli 0.5.5 → 0.6.0

package/dist/devrouter-preview-gitlab-ingress.js

@@ -0,0 +1,182 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/preview/ingress/gitlab.ts
+var gitlab_exports = {};
+__export(gitlab_exports, {
+  createGitLabPreviewIngress: () => createGitLabPreviewIngress
+});
+module.exports = __toCommonJS(gitlab_exports);
+var import_node_crypto = require("crypto");
+
+// src/core/preview/command.ts
+var MAX_COMMAND_BYTES = 512;
+var MAX_ALIAS_LENGTH = 63;
+var ALIAS_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function parsePreviewCommand(text) {
+  if (Buffer.byteLength(text, "utf8") > MAX_COMMAND_BYTES || /[\r\n]/u.test(text)) {
+    return null;
+  }
+  const command = text.trim();
+  if (command === "/preview start") {
+    return { kind: "start", aliases: [] };
+  }
+  if (command.startsWith("/preview start ")) {
+    return parseStart(command.slice("/preview start ".length));
+  }
+  if (command === "/preview extend" || command === "/preview extend 1h") {
+    return { kind: "extend" };
+  }
+  if (command === "/preview stop") return { kind: "stop" };
+  if (command === "/preview status") return { kind: "status" };
+  if (command === "/preview profiles") return { kind: "profiles" };
+  return null;
+}
+function isPreviewAlias(alias) {
+  return typeof alias === "string" && alias.length <= MAX_ALIAS_LENGTH && ALIAS_PATTERN.test(alias);
+}
+function parseStart(rawAliases) {
+  const aliases = rawAliases.split(",");
+  if (aliases.some((alias) => !isPreviewAlias(alias)) || new Set(aliases).size !== aliases.length) {
+    return null;
+  }
+  return { kind: "start", aliases };
+}
+
+// src/core/preview/http.ts
+var MAX_STATE_BYTES = 1024 * 1024;
+async function readPreviewResponse(response, label, maxBytes = MAX_STATE_BYTES) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1 || maxBytes > 16 * MAX_STATE_BYTES)
+    throw new Error("Invalid response size bound.");
+  const length = response.headers.get("content-length");
+  if (length !== null && (!/^\d+$/.test(length) || Number(length) > maxBytes)) {
+    await response.body?.cancel();
+    throw new Error(`${label} response exceeds its size bound.`);
+  }
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error(`${label} response is empty.`);
+  const chunks = [];
+  let size = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > maxBytes) throw new Error(`${label} response exceeds its size bound.`);
+      chunks.push(value);
+    }
+  } finally {
+    await reader.cancel();
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// src/core/preview/forge/status.ts
+function forgeObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Invalid forge object.");
+  return value;
+}
+function forgeId(value) {
+  const id = typeof value === "number" && Number.isSafeInteger(value) ? String(value) : value;
+  if (typeof id !== "string" || !/^[1-9][0-9]{0,19}$/.test(id))
+    throw new Error("Invalid forge numeric identity.");
+  return id;
+}
+
+// src/core/preview/ingress/gitlab.ts
+function createGitLabPreviewIngress(options) {
+  const base = new URL(options.apiUrl);
+  if (base.protocol !== "https:" || base.username || base.password || base.search || base.hash || base.port || base.pathname !== "/api/v4/" || !/^[A-Za-z0-9_./-]{1,128}$/.test(options.controllerRef) || options.controllerRef.includes("..") || !/^[a-z][a-z0-9-]{0,62}$/.test(options.installedProjectKey))
+    throw new Error("Invalid registered GitLab ingress policy.");
+  forgeId(options.controllerProjectId);
+  forgeId(options.candidateProjectId);
+  return async (request) => {
+    if (request.method !== "POST") return new Response(null, { status: 405 });
+    let secret;
+    try {
+      secret = await options.hookSecret();
+    } catch {
+      return new Response(null, { status: 503 });
+    }
+    const presented = request.headers.get("x-gitlab-token") ?? "";
+    if (secret.length < 32 || secret.length > 256 || presented.length > 256 || Buffer.byteLength(secret) !== Buffer.byteLength(presented) || !(0, import_node_crypto.timingSafeEqual)(Buffer.from(secret), Buffer.from(presented)))
+      return new Response(null, { status: 401 });
+    if (request.headers.get("content-type")?.split(";")[0] !== "application/json")
+      return new Response(null, { status: 415 });
+    if (request.headers.get("x-gitlab-event") !== "Note Hook" || !/^[a-f0-9-]{36}$/i.test(request.headers.get("x-gitlab-event-uuid") ?? ""))
+      return new Response(null, { status: 400 });
+    let payload;
+    try {
+      payload = forgeObject(
+        JSON.parse(await readPreviewResponse(new Response(request.body), "GitLab hook", 64 * 1024))
+      );
+    } catch {
+      return new Response(null, { status: 400 });
+    }
+    try {
+      if (payload.object_kind !== "note") return new Response(null, { status: 204 });
+      const note = forgeObject(payload.object_attributes);
+      if (note.noteable_type !== "MergeRequest") return new Response(null, { status: 204 });
+      const merge = forgeObject(payload.merge_request), project = forgeObject(payload.project);
+      if (forgeId(project.id) !== options.candidateProjectId || forgeId(note.project_id) !== options.candidateProjectId || note.action !== "create" || note.system !== false || note.created_at !== note.updated_at || note.line_code || typeof note.note !== "string" || !parsePreviewCommand(note.note) || merge.target_project_id !== Number(options.candidateProjectId) || merge.source_project_id !== Number(options.candidateProjectId))
+        return new Response(null, { status: 204 });
+      const change = forgeId(merge.iid);
+      forgeId(note.id);
+      let token;
+      try {
+        token = await options.triggerToken();
+      } catch {
+        return new Response(null, { status: 503 });
+      }
+      if (!token || /\s/.test(token)) return new Response(null, { status: 503 });
+      let response;
+      try {
+        response = await (options.fetch ?? fetch)(
+          new URL(`projects/${options.controllerProjectId}/trigger/pipeline`, base),
+          {
+            method: "POST",
+            redirect: "error",
+            signal: AbortSignal.timeout(1e4),
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+              token,
+              ref: options.controllerRef,
+              inputs: {
+                preview_mode: "handle-event",
+                preview_project: options.installedProjectKey,
+                preview_change: change
+              }
+            })
+          }
+        );
+      } catch {
+        return new Response(null, { status: 503 });
+      }
+      await response.body?.cancel();
+      return new Response(null, { status: response.ok ? 202 : 503 });
+    } catch {
+      return new Response(null, { status: 400 });
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createGitLabPreviewIngress
+});