@dotobokuri/fleet-console 1.15.0 → 1.16.0

package/dist/fleet-plugins/diff/routes.mjs

@@ -0,0 +1,304 @@
+#!/usr/bin/env node
+import fs from 'fs/promises';
+import path from 'path';
+import { spawn } from 'child_process';
+
+// sdk/plugin/node.ts
+function definePlugin(definition) {
+  return definition;
+}
+function registerRouter(ctx, path2, handler) {
+  ctx.registerRouter(normalizePath(path2), handler);
+}
+function normalizePath(path2) {
+  if (path2.length === 0 || path2 === "/") return "/";
+  return path2;
+}
+var GitExecutorError = class extends Error {
+  code;
+  exitCode;
+  stderr;
+  constructor(code, stderr = "", exitCode) {
+    super(code);
+    this.name = "GitExecutorError";
+    this.code = code;
+    this.stderr = stderr;
+    this.exitCode = exitCode;
+  }
+};
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_BUFFER = 8 * 1024 * 1024;
+function runGit(args, opts) {
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
+  return new Promise((resolve, reject) => {
+    let child;
+    try {
+      child = spawn("git", args, { cwd: opts.cwd, shell: false, windowsHide: true });
+    } catch (error) {
+      const code = error.code === "ENOENT" ? "git_unavailable" : "spawn_failed";
+      reject(new GitExecutorError(code, String(error)));
+      return;
+    }
+    const stdoutChunks = [];
+    const stderrChunks = [];
+    let stdoutLen = 0;
+    let truncated = false;
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      reject(new GitExecutorError("timeout"));
+    }, timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      if (truncated) return;
+      const remaining = maxBuffer - stdoutLen;
+      if (chunk.length >= remaining) {
+        stdoutChunks.push(chunk.subarray(0, remaining));
+        stdoutLen += remaining;
+        truncated = true;
+      } else {
+        stdoutChunks.push(chunk);
+        stdoutLen += chunk.length;
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      stderrChunks.push(chunk);
+    });
+    child.on("error", (error) => {
+      clearTimeout(timer);
+      const code = error.code === "ENOENT" ? "git_unavailable" : "spawn_failed";
+      reject(new GitExecutorError(code, error.message));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (timedOut) return;
+      const stderr = Buffer.concat(stderrChunks).toString("utf8");
+      if (code !== 0) {
+        if (code !== null && (opts.allowExitCodes?.includes(code) ?? false)) {
+          const stdout2 = Buffer.concat(stdoutChunks).toString("utf8");
+          resolve({ stdout: stdout2, truncated });
+          return;
+        }
+        const isNoRepo = stderr.toLowerCase().includes("not a git repository");
+        reject(new GitExecutorError(isNoRepo ? "no_git_repo" : "non_zero_exit", stderr, code ?? void 0));
+        return;
+      }
+      const stdout = Buffer.concat(stdoutChunks).toString("utf8");
+      resolve({ stdout, truncated });
+    });
+  });
+}
+
+// ../fleet-plugins/diff/server/diff.ts
+var REF_SAFE_RE = /^(?:[a-f0-9]{7,40}|[A-Za-z0-9][A-Za-z0-9/_.~^-]{0,250})$/;
+function isSafeGitRef(ref) {
+  return REF_SAFE_RE.test(ref);
+}
+function buildDiffArgs(mode, ref) {
+  if (mode === "staged") return ["diff", "--cached"];
+  if (mode === "commit" && ref) return ["diff", `${ref}^`, ref];
+  return ["diff"];
+}
+function parseDiffFileList(nameStatusOutput, numstatOutput) {
+  const numstatMap = /* @__PURE__ */ new Map();
+  for (const line of numstatOutput.split("\n")) {
+    const parts = line.split("	");
+    if (parts.length < 3) continue;
+    const [adds, dels, filePath] = parts;
+    if (!filePath) continue;
+    numstatMap.set(filePath, {
+      additions: parseInt(adds ?? "0", 10) || 0,
+      deletions: parseInt(dels ?? "0", 10) || 0
+    });
+  }
+  const files = [];
+  for (const line of nameStatusOutput.split("\n")) {
+    if (!line.trim()) continue;
+    const [rawStatus, ...pathParts] = line.split("	");
+    if (!rawStatus || pathParts.length === 0) continue;
+    const statusChar = rawStatus.charAt(0).toUpperCase();
+    if (statusChar !== "M" && statusChar !== "A" && statusChar !== "D" && statusChar !== "R") continue;
+    const filePath = statusChar === "R" ? pathParts[1] ?? pathParts[0] ?? "" : pathParts[0] ?? "";
+    if (!filePath) continue;
+    const nums = numstatMap.get(filePath) ?? { additions: 0, deletions: 0 };
+    files.push({ path: filePath, status: statusChar, ...nums });
+  }
+  return files;
+}
+async function fetchUntrackedFiles(cwd) {
+  const result = await runGit(["ls-files", "--others", "--exclude-standard"], { cwd });
+  return result.stdout.split("\n").filter((p) => p.trim()).map((p) => ({
+    path: p,
+    status: "U",
+    additions: 0,
+    deletions: 0
+  }));
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function handleDiffChanged(req, res, ctx) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body)) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const mode = body.mode;
+  if (mode !== "workdir" && mode !== "staged" && mode !== "commit") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_mode" });
+    return;
+  }
+  const theaterId = body.theaterId;
+  if (typeof theaterId !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const rawRef = typeof body.ref === "string" ? body.ref : void 0;
+  if (rawRef !== void 0 && !isSafeGitRef(rawRef)) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_ref" });
+    return;
+  }
+  const theaterPath = ctx.host.paths.resolveTheaterPath(theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  try {
+    const diffArgs = buildDiffArgs(mode, rawRef);
+    const nameStatusArgs = [...diffArgs, "--name-status", "--diff-filter=MADR"];
+    const numstatArgs = [...diffArgs, "--numstat", "--diff-filter=MADR"];
+    const [nameStatusResult, numstatResult] = await Promise.all([
+      runGit(nameStatusArgs, { cwd: theaterPath }),
+      runGit(numstatArgs, { cwd: theaterPath })
+    ]);
+    const files = parseDiffFileList(nameStatusResult.stdout, numstatResult.stdout);
+    if (mode === "workdir") {
+      try {
+        const untrackedFiles = await fetchUntrackedFiles(theaterPath);
+        files.push(...untrackedFiles);
+      } catch {
+      }
+    }
+    ctx.host.http.writeJson(res, 200, { files, truncated: nameStatusResult.truncated || numstatResult.truncated });
+  } catch (error) {
+    if (error instanceof GitExecutorError) {
+      if (error.code === "no_git_repo" || error.code === "git_unavailable") {
+        ctx.host.http.writeJson(res, 422, { error: error.code });
+        return;
+      }
+      ctx.host.http.writeJson(res, 500, { error: "git_failed" });
+      return;
+    }
+    throw error;
+  }
+}
+async function handleDiffFile(req, res, ctx) {
+  if (req.method !== "POST") {
+    ctx.host.http.writeJson(res, 405, { error: "Method not allowed" });
+    return;
+  }
+  if (!ctx.host.security.isTerminalAuthorized(req)) {
+    ctx.host.http.writeJson(res, 401, { error: "unauthorized" });
+    return;
+  }
+  const body = await ctx.host.http.readJsonBody(req);
+  if (!isPlainObject(body) || typeof body.filePath !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const mode = body.mode;
+  if (mode !== "workdir" && mode !== "staged" && mode !== "commit" && mode !== "untracked") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_mode" });
+    return;
+  }
+  const theaterId = body.theaterId;
+  if (typeof theaterId !== "string") {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_request" });
+    return;
+  }
+  const rawFilePath = body.filePath;
+  const theaterPath = ctx.host.paths.resolveTheaterPath(theaterId);
+  if (!theaterPath) {
+    ctx.host.http.writeJson(res, 404, { error: "theater_not_found" });
+    return;
+  }
+  const resolvedPath = path.resolve(theaterPath, rawFilePath);
+  if (!resolvedPath.startsWith(theaterPath + path.sep) && resolvedPath !== theaterPath) {
+    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
+    return;
+  }
+  const relativePath = path.normalize(rawFilePath);
+  if (relativePath.startsWith("..")) {
+    ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
+    return;
+  }
+  const rawRef = typeof body.ref === "string" ? body.ref : void 0;
+  if (rawRef !== void 0 && !isSafeGitRef(rawRef)) {
+    ctx.host.http.writeJson(res, 400, { error: "invalid_ref" });
+    return;
+  }
+  try {
+    if (mode === "untracked") {
+      let realTheater;
+      let realFile;
+      try {
+        [realTheater, realFile] = await Promise.all([
+          fs.realpath(theaterPath),
+          fs.realpath(resolvedPath)
+        ]);
+      } catch {
+        ctx.host.http.writeJson(res, 404, { error: "file_not_found" });
+        return;
+      }
+      if (realFile !== realTheater && !realFile.startsWith(realTheater + path.sep)) {
+        ctx.host.http.writeJson(res, 403, { error: "path_outside_theater" });
+        return;
+      }
+      const result2 = await runGit(
+        ["diff", "--no-index", "--unified=3", "--", "/dev/null", relativePath],
+        { cwd: theaterPath, allowExitCodes: [1] }
+      );
+      ctx.host.http.writeJson(res, 200, { content: result2.stdout, truncated: result2.truncated });
+      return;
+    }
+    const diffArgs = [...buildDiffArgs(mode, rawRef), "--unified=3", "--", relativePath];
+    const result = await runGit(diffArgs, { cwd: theaterPath });
+    ctx.host.http.writeJson(res, 200, { content: result.stdout, truncated: result.truncated });
+  } catch (error) {
+    if (error instanceof GitExecutorError) {
+      if (error.code === "no_git_repo" || error.code === "git_unavailable") {
+        ctx.host.http.writeJson(res, 422, { error: error.code });
+        return;
+      }
+      ctx.host.http.writeJson(res, 500, { error: "git_failed" });
+      return;
+    }
+    throw error;
+  }
+}
+
+// ../fleet-plugins/diff/routes.ts
+var routes_default = definePlugin({
+  id: "diff",
+  register(ctx) {
+    registerRouter(ctx, "changed", async ({ req, res }) => {
+      await handleDiffChanged(req, res, ctx);
+      return true;
+    });
+    registerRouter(ctx, "file", async ({ req, res }) => {
+      await handleDiffFile(req, res, ctx);
+      return true;
+    });
+  }
+});
+
+export { routes_default as default };