@goodfellow-cms/github 0.3.0 → 0.5.0

package/dist/deploy-keys-DAj2oX-N.js

@@ -0,0 +1,108 @@
+import { encodeBase64Bytes } from "@goodfellow-cms/core";
+import { hsalsa, xsalsa20poly1305 } from "@noble/ciphers/salsa.js";
+import { blake2b } from "@noble/hashes/blake2.js";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/deploy-keys.ts
+/**
+* Deploy keys and Actions secrets, for connecting a site's private code and
+* content repositories: each workflow reads the other repository with a
+* deploy key, whose private half is a secret of the repository it runs in.
+* Loaded only by the setup page, when it connects them.
+*/
+var deploy_keys_exports = /* @__PURE__ */ __exportAll({
+	newDeployKey: () => newDeployKey,
+	openSealedSecret: () => openSealedSecret,
+	sealSecret: () => sealSecret
+});
+function concat(...parts) {
+	const result = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+	let at = 0;
+	for (const part of parts) {
+		result.set(part, at);
+		at += part.length;
+	}
+	return result;
+}
+/** SSH's encoding of a number: four bytes, most significant first. */
+function uint32(value) {
+	const bytes = /* @__PURE__ */ new Uint8Array(4);
+	new DataView(bytes.buffer).setUint32(0, value);
+	return bytes;
+}
+/** SSH's encoding of a string of bytes: its length, then the bytes. */
+function sshString(value) {
+	const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+	return concat(uint32(bytes.length), bytes);
+}
+/** A new Ed25519 key pair, made with the browser's own Web Crypto, as `ssh-keygen -t ed25519 -N ""` would make it. */
+async function newDeployKey(comment) {
+	const pair = await crypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
+	const publicKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const seed = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey)).slice(-32);
+	const publicBlob = concat(sshString("ssh-ed25519"), sshString(publicKey));
+	const check = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(4));
+	let secret = concat(check, check, sshString("ssh-ed25519"), sshString(publicKey), sshString(concat(seed, publicKey)), sshString(comment));
+	const padding = Array.from({ length: (8 - secret.length % 8) % 8 }, (_, index) => index + 1);
+	secret = concat(secret, new Uint8Array(padding));
+	const body = concat(new TextEncoder().encode("openssh-key-v1\0"), sshString("none"), sshString("none"), sshString(""), uint32(1), sshString(publicBlob), sshString(secret));
+	const lines = encodeBase64Bytes(body).match(/.{1,70}/g) ?? [];
+	seed.fill(0);
+	secret.fill(0);
+	return {
+		publicKey: `ssh-ed25519 ${encodeBase64Bytes(publicBlob)} ${comment}`,
+		privateKey: `-----BEGIN OPENSSH PRIVATE KEY-----\n${lines.join("\n")}\n-----END OPENSSH PRIVATE KEY-----\n`
+	};
+}
+const SIGMA = new TextEncoder().encode("expand 32-byte k");
+function words(bytes) {
+	return new Uint32Array(bytes.slice().buffer);
+}
+/**
+* Encrypts a value for an Actions secret, as libsodium's `crypto_box_seal`
+* does, which is what GitHub expects: an X25519 key of its own, the Web
+* Crypto key agreement with the repository's public key, and XSalsa20-Poly1305.
+*/
+async function sealSecret(value, recipient) {
+	const ephemeral = await crypto.subtle.generateKey({ name: "X25519" }, true, ["deriveBits"]);
+	const ephemeralPublic = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+	const recipientKey = await crypto.subtle.importKey("raw", recipient.slice(), { name: "X25519" }, false, []);
+	const shared = new Uint8Array(await crypto.subtle.deriveBits({
+		name: "X25519",
+		public: recipientKey
+	}, ephemeral.privateKey, 256));
+	const key = /* @__PURE__ */ new Uint32Array(8);
+	hsalsa(words(SIGMA), words(shared), /* @__PURE__ */ new Uint32Array(4), key);
+	const nonce = blake2b(concat(ephemeralPublic, recipient), { dkLen: 24 });
+	const keyBytes = new Uint8Array(key.buffer);
+	const sealed = xsalsa20poly1305(keyBytes, nonce).encrypt(new TextEncoder().encode(value));
+	shared.fill(0);
+	keyBytes.fill(0);
+	return concat(ephemeralPublic, sealed);
+}
+/** Opens a sealed value with the recipient's X25519 key pair, as GitHub does with a secret. For the fake. */
+async function openSealedSecret(sealed, recipient) {
+	const ephemeralPublic = sealed.slice(0, 32);
+	const recipientPublic = new Uint8Array(await crypto.subtle.exportKey("raw", recipient.publicKey));
+	const ephemeralKey = await crypto.subtle.importKey("raw", ephemeralPublic, { name: "X25519" }, false, []);
+	const shared = new Uint8Array(await crypto.subtle.deriveBits({
+		name: "X25519",
+		public: ephemeralKey
+	}, recipient.privateKey, 256));
+	const key = /* @__PURE__ */ new Uint32Array(8);
+	hsalsa(words(SIGMA), words(shared), /* @__PURE__ */ new Uint32Array(4), key);
+	const nonce = blake2b(concat(ephemeralPublic, recipientPublic), { dkLen: 24 });
+	return new TextDecoder().decode(xsalsa20poly1305(new Uint8Array(key.buffer), nonce).decrypt(sealed.slice(32)));
+}
+//#endregion
+export { openSealedSecret as n, deploy_keys_exports as t };

package/dist/index.d.ts

@@ -1,7 +1,5 @@
-import { ConnectDomainOptions, DeployStatus, DnsRecord, FileChange, FileVersion, GitBackend, GitHost, GitUser, HistoryOptions, OwnerAccess, PagesDomains, RedirectOptions, SetupHost, SignInError, SiteDrafts, SiteEditors, SiteUpdates, StorageLike, TokenLink, WriteOptions } from "@goodfellow-cms/core";
+import { ConnectDomainOptions, DeployStatus, DnsRecord, FileChange, FileVersion, GitBackend, GitHost, GitUser, HistoryOptions, OwnerAccess, PagesDomains, RedirectOptions, RepositoryVisibility, RevisionFiles, ScheduledBuilds, SetupHost, SignInError, SiteDrafts, SiteEditors, SiteUpdates, StorageLike, TokenLink, WriteOptions } from "@goodfellow-cms/core";
 //#region src/sign-in.d.ts
-/** The sign-in worker Goodfellow runs for every site. Sites can run their own and name it in `github({ signIn })`. */
-export declare const GOODFELLOW_SIGN_IN = "https://sign-in.goodfellow-cms.workers.dev";
 /** The page's address and how to change it. Replaceable in tests. */
 interface BrowserLocation {
   href(): string;
@@ -42,6 +40,19 @@ interface GitHubBackendOptions {
     name: string;
     email: string;
   };
+  /** The commit reads see until `revision()` is next called, as a full-stack site's server reads what a browser loaded. */
+  revision?: string;
+  /** The repository holds only the site's content, with its code in a repository of its own (`GitBackend.contentOnly`). */
+  contentOnly?: boolean;
+  /**
+   * The code repository, for a repository that holds only content, where the
+   * site's updates run: `api` reads it, absent where the sign-in can't.
+   */
+  code?: {
+    repo: string;
+    webUrl: string;
+    api?: ApiOptions;
+  };
 }
 /**
  * The site's files on GitHub. Reads come from the commit `revision()` last
@@ -53,8 +64,11 @@ export declare class GitHubBackend implements GitBackend {
   readonly pages: PagesDomains;
   readonly editors: SiteEditors;
   readonly ownerAccess: OwnerAccess;
-  readonly updates: SiteUpdates;
+  /** Absent where the repository holds only content: the update job runs where the code is. */
+  readonly updates?: SiteUpdates;
   readonly drafts: SiteDrafts;
+  readonly scheduledBuilds: ScheduledBuilds;
+  readonly contentOnly: boolean;
   private readonly options;
   private readonly api;
   private readonly repo;
@@ -68,9 +82,12 @@ export declare class GitHubBackend implements GitBackend {
   private readonly treeSizes;
   private readonly blobs;
   constructor(options: GitHubBackendOptions);
+  repositoryVisibility(): Promise<RepositoryVisibility>;
   /** Drafts on branches of the repository, with pull requests for review. */
   private draftHost;
   revision(): Promise<string>;
+  /** The branch's latest commit, without moving the revision reads are pinned to. */
+  private head;
   /** Path → blob id for every file at a commit. Commits never change, so this is cached. */
   private tree;
   private currentTree;
@@ -78,11 +95,14 @@ export declare class GitHubBackend implements GitBackend {
   private readFrom;
   /** Reads many text files in a few GraphQL requests rather than one request each. */
   readFiles(paths: string[]): Promise<Map<string, string>>;
+  private readFilesFrom;
   readBytes(path: string): Promise<Uint8Array | undefined>;
+  private bytesFrom;
   list(dir: string): Promise<string[]>;
+  filesAt(revision: string): RevisionFiles;
   fileSizes(dir: string): Promise<Map<string, number>>;
   /** Uses an owner's sign-in through the worker for editors and GitHub Pages settings, until it's forgotten. */
-  useOwnerSignIn(token: TokenSource, end: () => void): void;
+  useOwnerSignIn(token: TokenSource, end: () => void, codeToken?: TokenSource): void;
   /** Remembers why an owner's sign-in through the worker didn't work, which the Editors and Domain screens show. */
   ownerSignInFailed(error: unknown): void;
   write(changes: FileChange[], options: WriteOptions): Promise<{
@@ -99,12 +119,21 @@ export declare class GitHubBackend implements GitBackend {
   readAt(path: string, revision: string): Promise<string | undefined>;
   changedPaths(from: string, to: string): Promise<string[]>;
   /**
-   * Reads the deployment GitHub Pages or Vercel created for a commit, and for
-   * GitHub Actions, the workflow run that builds it: a build that fails never
-   * creates a deployment. Before either exists, the site counts as building
-   * if it has ever been deployed.
+   * Reads the deployment GitHub Pages or Vercel created for a commit, or what
+   * Cloudflare Pages reports on it, and for GitHub Actions, the workflow run
+   * that builds it: a build that fails never creates a deployment. Before any
+   * exists, the site counts as building if it has ever been deployed, or if
+   * Cloudflare reported on the commit before.
    */
   deployStatus(revision: string): Promise<DeployStatus>;
+  /**
+   * What Cloudflare Pages reports on a commit: a check run of its GitHub App,
+   * or a commit status, which fine-grained tokens can read where check runs
+   * need a GitHub App's permission. `undefined` if it reported nothing.
+   */
+  private cloudflareBuild;
+  /** The commit a commit was made on top of, if the token can see it. */
+  private parentOf;
   /** The site's deploy workflow run for a commit, or `undefined` if there's none or the token can't see Actions. */
   private workflowRun;
   /** Which step of a failed run failed. */
@@ -122,7 +151,7 @@ interface GitHubSetupOptions {
   apiUrl?: string;
   /** For GitHub Enterprise. Defaults to `https://github.com`. */
   webUrl?: string;
-  /** The sign-in worker, for "Sign in with GitHub". Defaults to Goodfellow's; `false` for token sign-in only. */
+  /** The address of a sign-in worker, for "Sign in with GitHub". Without one, people sign in with a token. */
   signIn?: string | false;
   /** For tests. */
   fetch?: typeof fetch;
@@ -136,8 +165,9 @@ interface GitHubSetupOptions {
 }
 /**
  * Links to GitHub's token pages with what creating a site needs: creating the
- * repository (administration), writing its files and its build setup
- * (contents and workflows), and turning on GitHub Pages (pages).
+ * repository and adding deploy keys (administration), writing its files and
+ * its build setup (contents and workflows), turning on GitHub Pages (pages),
+ * and giving a workflow the key to another of the site's repositories (secrets).
  */
 export declare function githubSetupTokenLinks(webUrl?: string): {
   fineGrained: string;
@@ -157,11 +187,22 @@ export interface GitHubOptions {
   /** For GitHub Enterprise. Defaults to `https://github.com`. */
   webUrl?: string;
   /**
-   * The sign-in worker, which lets editors sign in with GitHub instead of
-   * pasting a token. Defaults to Goodfellow's (`GOODFELLOW_SIGN_IN`); give the
-   * address of your own copy, or `false` for token sign-in only.
+   * The address of a sign-in worker, which lets editors sign in with GitHub
+   * instead of pasting a token. Without one, editors sign in with a token.
    */
   signIn?: string | false;
+  /**
+   * The repository holds only the site's content (`content/` and
+   * `public/media/`), and its code is in a repository of its own. The admin
+   * panel then leaves adding blocks, which changes code, to a developer.
+   */
+  contentOnly?: boolean;
+  /**
+   * With `contentOnly`, the repository the site's code is kept in, as
+   * `owner/name`, where its updates run: the Updates screen follows them.
+   * Editors' tokens need to reach it too: a sign-in worker's app installed on it, or tokens made for both.
+   */
+  code?: string;
   /** For tests. */
   fetch?: typeof fetch;
   /** For tests. */