@goodfellow-cms/github 0.2.0 → 0.4.0

package/dist/deploy-keys-DAj2oX-N.js

@@ -0,0 +1,108 @@
+import { encodeBase64Bytes } from "@goodfellow-cms/core";
+import { hsalsa, xsalsa20poly1305 } from "@noble/ciphers/salsa.js";
+import { blake2b } from "@noble/hashes/blake2.js";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/deploy-keys.ts
+/**
+* Deploy keys and Actions secrets, for connecting a site's private code and
+* content repositories: each workflow reads the other repository with a
+* deploy key, whose private half is a secret of the repository it runs in.
+* Loaded only by the setup page, when it connects them.
+*/
+var deploy_keys_exports = /* @__PURE__ */ __exportAll({
+	newDeployKey: () => newDeployKey,
+	openSealedSecret: () => openSealedSecret,
+	sealSecret: () => sealSecret
+});
+function concat(...parts) {
+	const result = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+	let at = 0;
+	for (const part of parts) {
+		result.set(part, at);
+		at += part.length;
+	}
+	return result;
+}
+/** SSH's encoding of a number: four bytes, most significant first. */
+function uint32(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value);
+	return bytes;
+}
+/** SSH's encoding of a string of bytes: its length, then the bytes. */
+function sshString(value) {
+	const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+	return concat(uint32(bytes.length), bytes);
+}
+/** A new Ed25519 key pair, made with the browser's own Web Crypto, as `ssh-keygen -t ed25519 -N ""` would make it. */
+async function newDeployKey(comment) {
+	const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
+	const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const seed = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey)).slice(-32);
+	const publicBlob = concat(sshString("ssh-ed25519"), sshString(publicKey));
+	const check = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4));
+	let secret = concat(check, check, sshString("ssh-ed25519"), sshString(publicKey), sshString(concat(seed, publicKey)), sshString(comment));
+	const padding = Array.from({ length: (8 - secret.length % 8) % 8 }, (_, index) => index + 1);
+	secret = concat(secret, new Uint8Array(padding));
+	const body = concat(new TextEncoder().encode("openssh-key-v1\0"), sshString("none"), sshString("none"), sshString(""), uint32(1), sshString(publicBlob), sshString(secret));
+	const lines = encodeBase64Bytes(body).match(/.{1,70}/g) ?? [];
+	seed.fill(0);
+	secret.fill(0);
+	return {
+		publicKey: `ssh-ed25519 ${encodeBase64Bytes(publicBlob)} ${comment}`,
+		privateKey: `-----BEGIN OPENSSH PRIVATE KEY-----\n${lines.join("\n")}\n-----END OPENSSH PRIVATE KEY-----\n`
+	};
+}
+const SIGMA = new TextEncoder().encode("expand 32-byte k");
+function words(bytes) {
+	return new Uint32Array(bytes.slice().buffer);
+}
+/**
+* Encrypts a value for an Actions secret, as libsodium's `crypto_box_seal`
+* does, which is what GitHub expects: an X25519 key of its own, the Web
+* Crypto key agreement with the repository's public key, and XSalsa20-Poly1305.
+*/
+async function sealSecret(value, recipient) {
+	const ephemeral = await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]);
+	const ephemeralPublic = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	const recipientKey = await crypto.subtle.importKey("raw", recipient.slice(), { name: "X25519" }, false, []);
+	const shared = new Uint8Array(await crypto.subtle.deriveBits({
+		name: "X25519",
+		public: recipientKey
+	}, ephemeral.privateKey, 256));
+	const key = /* @__PURE__ */ new Uint32Array(8);
+	hsalsa(words(SIGMA), words(shared), /* @__PURE__ */ new Uint32Array(4), key);
+	const nonce = blake2b(concat(ephemeralPublic, recipient), { dkLen: 24 });
+	const keyBytes = new Uint8Array(key.buffer);
+	const sealed = xsalsa20poly1305(keyBytes, nonce).encrypt(new TextEncoder().encode(value));
+	shared.fill(0);
+	keyBytes.fill(0);
+	return concat(ephemeralPublic, sealed);
+}
+/** Opens a sealed value with the recipient's X25519 key pair, as GitHub does with a secret. For the fake. */
+async function openSealedSecret(sealed, recipient) {
+	const ephemeralPublic = sealed.slice(0, 32);
+	const recipientPublic = new Uint8Array(await crypto.subtle.exportKey("raw", recipient.publicKey));
+	const ephemeralKey = await crypto.subtle.importKey("raw", ephemeralPublic, { name: "X25519" }, false, []);
+	const shared = new Uint8Array(await crypto.subtle.deriveBits({
+		name: "X25519",
+		public: ephemeralKey
+	}, recipient.privateKey, 256));
+	const key = /* @__PURE__ */ new Uint32Array(8);
+	hsalsa(words(SIGMA), words(shared), /* @__PURE__ */ new Uint32Array(4), key);
+	const nonce = blake2b(concat(ephemeralPublic, recipientPublic), { dkLen: 24 });
+	return new TextDecoder().decode(xsalsa20poly1305(new Uint8Array(key.buffer), nonce).decrypt(sealed.slice(32)));
+}
+//#endregion
+export { openSealedSecret as n, deploy_keys_exports as t };

package/dist/index.d.ts

@@ -1,8 +1,22 @@
-import { ConnectDomainOptions, DeployStatus, DnsRecord, FileChange, FileVersion, GitBackend, GitHost, GitUser, HistoryOptions, OwnerAccess, PagesDomains, SetupHost, SiteEditors, SiteUpdates, StorageLike, TokenLink, WriteOptions } from "@goodfellow-cms/core";
+import { ConnectDomainOptions, DeployStatus, DnsRecord, FileChange, FileVersion, GitBackend, GitHost, GitUser, HistoryOptions, OwnerAccess, PagesDomains, RedirectOptions, SetupHost, SignInError, SiteDrafts, SiteEditors, SiteUpdates, StorageLike, TokenLink, WriteOptions } from "@goodfellow-cms/core";
+//#region src/sign-in.d.ts
+/** The page's address and how to change it. Replaceable in tests. */
+interface BrowserLocation {
+  href(): string;
+  /** Navigates away, for example to GitHub's sign-in page. */
+  assign(url: string): void;
+  /** Changes the address without reloading, for example to remove the sign-in's details after coming back. */
+  replace(url: string): void;
+}
+//#endregion
 //#region src/api.d.ts
+/** A token that renews itself, such as one from the sign-in worker. `refresh` asks for a new one even if it hasn't expired. */
+type TokenSource = (options?: {
+  refresh?: boolean;
+}) => Promise<string>;
 interface ApiOptions {
   apiUrl: string;
-  token: string;
+  token: string | TokenSource;
   fetch: typeof fetch;
 }
 //#endregion
@@ -15,6 +29,30 @@ interface GitHubBackendOptions {
   onSignOut: () => void;
   /** Where to create the owner token, which can change editors and GitHub Pages settings. */
   ownerTokenLink: TokenLink;
+  /** Signs in as an owner through the sign-in worker instead of with a token, where it's available. */
+  ownerRedirect?: (options?: RedirectOptions) => Promise<void>;
+  /**
+   * Who commits name as their author. Set when the token is an app's
+   * installation token from the sign-in worker, whose commits would otherwise
+   * name the app. Commits are then made with Git's data API, which can name them.
+   */
+  author?: {
+    name: string;
+    email: string;
+  };
+  /** The commit reads see until `revision()` is next called, as a full-stack site's server reads what a browser loaded. */
+  revision?: string;
+  /** The repository holds only the site's content, with its code in a repository of its own (`GitBackend.contentOnly`). */
+  contentOnly?: boolean;
+  /**
+   * The code repository, for a repository that holds only content, where the
+   * site's updates run: `api` reads it, absent where the sign-in can't.
+   */
+  code?: {
+    repo: string;
+    webUrl: string;
+    api?: ApiOptions;
+  };
 }
 /**
  * The site's files on GitHub. Reads come from the commit `revision()` last
@@ -26,26 +64,50 @@ export declare class GitHubBackend implements GitBackend {
   readonly pages: PagesDomains;
   readonly editors: SiteEditors;
   readonly ownerAccess: OwnerAccess;
-  readonly updates: SiteUpdates;
+  /** Absent where the repository holds only content: the update job runs where the code is. */
+  readonly updates?: SiteUpdates;
+  readonly drafts: SiteDrafts;
+  readonly contentOnly: boolean;
+  private readonly options;
   private readonly api;
   private readonly repo;
   private readonly branch;
   private readonly onSignOut;
+  private readonly author?;
+  private readonly owner;
   private pinned?;
   private readonly trees;
+  /** Each file's size in bytes at a commit, which GitHub lists with its tree. */
+  private readonly treeSizes;
   private readonly blobs;
   constructor(options: GitHubBackendOptions);
+  /** Drafts on branches of the repository, with pull requests for review. */
+  private draftHost;
   revision(): Promise<string>;
   /** Path → blob id for every file at a commit. Commits never change, so this is cached. */
   private tree;
   private currentTree;
   read(path: string): Promise<string | undefined>;
   private readFrom;
+  /** Reads many text files in a few GraphQL requests rather than one request each. */
+  readFiles(paths: string[]): Promise<Map<string, string>>;
   readBytes(path: string): Promise<Uint8Array | undefined>;
   list(dir: string): Promise<string[]>;
-  write(changes: FileChange[], { message, expectedRevision }: WriteOptions): Promise<{
+  fileSizes(dir: string): Promise<Map<string, number>>;
+  /** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
+  useOwnerSignIn(token: TokenSource, end: () => void, codeToken?: TokenSource): void;
+  /** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
+  ownerSignInFailed(error: unknown): void;
+  write(changes: FileChange[], options: WriteOptions): Promise<{
     revision: string;
   }>;
+  /**
+   * Saves with Git's data API, naming the editor as the commit's author:
+   * GitHub refuses to move the branch unless the commit follows on from it, so
+   * nothing is overwritten.
+   */
+  private writeCommit;
+  private writeGraphQL;
   history(path: string, { page, perPage }?: HistoryOptions): Promise<FileVersion[]>;
   readAt(path: string, revision: string): Promise<string | undefined>;
   changedPaths(from: string, to: string): Promise<string[]>;
@@ -73,13 +135,23 @@ interface GitHubSetupOptions {
   apiUrl?: string;
   /** For GitHub Enterprise. Defaults to `https://github.com`. */
   webUrl?: string;
+  /** The address of a sign-in worker, for "Sign in with GitHub". Without one, people sign in with a token. */
+  signIn?: string | false;
   /** For tests. */
   fetch?: typeof fetch;
+  /** For tests. */
+  storage?: {
+    local?: StorageLike;
+    session?: StorageLike;
+  };
+  /** For tests. */
+  location?: BrowserLocation;
 }
 /**
  * Links to GitHub's token pages with what creating a site needs: creating the
- * repository (administration), writing its files and its build setup
- * (contents and workflows), and turning on GitHub Pages (pages).
+ * repository and adding deploy keys (administration), writing its files and
+ * its build setup (contents and workflows), turning on GitHub Pages (pages),
+ * and giving a workflow the key to another of the site's repositories (secrets).
  */
 export declare function githubSetupTokenLinks(webUrl?: string): {
   fineGrained: string;
@@ -98,6 +170,23 @@ export interface GitHubOptions {
   apiUrl?: string;
   /** For GitHub Enterprise. Defaults to `https://github.com`. */
   webUrl?: string;
+  /**
+   * The address of a sign-in worker, which lets editors sign in with GitHub
+   * instead of pasting a token. Without one, editors sign in with a token.
+   */
+  signIn?: string | false;
+  /**
+   * The repository holds only the site's content (`content/` and
+   * `public/media/`), and its code is in a repository of its own. The admin
+   * panel then leaves adding blocks, which changes code, to a developer.
+   */
+  contentOnly?: boolean;
+  /**
+   * With `contentOnly`, the repository the site's code is kept in, as
+   * `owner/name`, where its updates run: the Updates screen follows them.
+   * Editors' tokens need to reach it too: a sign-in worker's app installed on it, or tokens made for both.
+   */
+  code?: string;
   /** For tests. */
   fetch?: typeof fetch;
   /** For tests. */
@@ -105,6 +194,8 @@ export interface GitHubOptions {
     local?: StorageLike;
     session?: StorageLike;
   };
+  /** For tests. */
+  location?: BrowserLocation;
 }
 /**
  * Links to GitHub's token page with everything filled in except the
@@ -118,4 +209,4 @@ export declare function githubTokenLinks(repo: string, webUrl?: string): {
 /** Sign-in and storage for a site whose repository is on GitHub. */
 export declare function github(options: GitHubOptions): GitHost;
 //#endregion
-export type { GitHubSetupOptions };
+export type { BrowserLocation, GitHubSetupOptions };