@goodfellow-cms/gitlab 0.3.0 → 0.4.0

package/dist/index.d.ts

@@ -19,6 +19,20 @@ interface GitLabBackendOptions {
   branch: string;
   user: GitUser;
   onSignOut: () => void;
+  /** Who commits name as their author, where that isn't the token's owner, as on a full-stack site's server. */
+  author?: {
+    name: string;
+    email: string;
+  };
+  /** The commit reads see until `revision()` is next called, as a full-stack site's server reads what a browser loaded. */
+  revision?: string;
+  /** The project holds only the site's content, with its code in a project of its own (`GitBackend.contentOnly`). */
+  contentOnly?: boolean;
+  /** The code project, for a project that holds only content, where the site's updates run. */
+  code?: {
+    project: string;
+    webUrl: string;
+  };
 }
 /**
  * The site's files on GitLab. Reads come from the commit `revision()` last
@@ -29,8 +43,10 @@ export declare class GitLabBackend implements GitBackend {
   readonly user: GitUser;
   readonly pages: PagesDomains;
   readonly editors: SiteEditors;
-  readonly updates: SiteUpdates;
+  /** Absent where the project holds only content: the update job runs where the code is. */
+  readonly updates?: SiteUpdates;
   readonly drafts: SiteDrafts;
+  readonly contentOnly: boolean;
   private readonly options;
   private readonly api;
   private readonly project;
@@ -130,6 +146,17 @@ export interface GitLabOptions {
    * one-click "Sign in with GitLab". Without it, people sign in with a token.
    */
   clientId?: string;
+  /**
+   * The project holds only the site's content (`content/` and
+   * `public/media/`), and its code is in a project of its own. The admin
+   * panel then leaves adding blocks, which changes code, to a developer.
+   */
+  contentOnly?: boolean;
+  /**
+   * With `contentOnly`, the project the site's code is kept in, where its
+   * updates run: the Updates screen follows them, for people who can see it.
+   */
+  code?: string;
   /** For tests. */
   fetch?: typeof fetch;
   /** For tests. */

package/dist/index.js

@@ -1,4 +1,4 @@
-import { ConflictError, DomainError, DraftError, EDITABLE_FOLDERS, EditorsError, GitApiError, SetupError, SignInError, UpdatesError, branchDrafts, buildStepFor, credentialStorage, encodeBase64Bytes, findBuildCause, findUpdateResult } from "@goodfellow-cms/core";
+import { ConflictError, DomainError, DraftError, EDITABLE_FOLDERS, EditorsError, GitApiError, REBUILD_JOB, SetupError, SignInError, UpdatesError, assertContentChanges, branchDrafts, buildStepFor, credentialStorage, encodeBase64Bytes, findBuildCause, findUpdateResult } from "@goodfellow-cms/core";
 //#region src/api.ts
 /** Calls the GitLab API. A 401 refreshes the token once; after that it means the sign-in has expired. */
 async function gitlabRequest(api, path, init = {}) {
@@ -343,7 +343,7 @@ function notAllowed(error) {
 * It publishes with the job's own token, which GitLab only allows once the
 * project lets job tokens push.
 */
-function gitlabUpdates(api, project, branch, readAt) {
+function gitlabUpdates(api, project, branch, readAt, jobName = "pages") {
 	const base = `/projects/${encodeURIComponent(project)}`;
 	async function schedules() {
 		return gitlabJson(api, `${base}/pipeline_schedules`);
@@ -397,7 +397,7 @@ function gitlabUpdates(api, project, branch, readAt) {
 					state: "running",
 					...run
 				};
-				const job = (await gitlabJson(api, `${base}/pipelines/${pipeline.id}/jobs?per_page=100`)).find((candidate) => candidate.name === "pages");
+				const job = (await gitlabJson(api, `${base}/pipelines/${pipeline.id}/jobs?per_page=100`)).find((candidate) => candidate.name === jobName);
 				if (!job) continue;
 				const response = await gitlabRequest(api, `${base}/jobs/${job.id}/trace`, { allow: [403, 404] });
 				const result = response.ok ? findUpdateResult(await response.text()) : void 0;
@@ -424,6 +424,64 @@ function gitlabUpdates(api, project, branch, readAt) {
 		}
 	};
 }
+function noAccess(error) {
+	return error instanceof GitApiError && (error.status === 403 || error.status === 404);
+}
+/**
+* The nightly update of a site whose content is kept in a project of its own,
+* which runs in the code project's `update` job. The sign-in needs to see the
+* code project too; where it can't, `setup()` says `no-access`.
+*/
+function gitlabCodeUpdates(options) {
+	const { api, project } = options;
+	let branch;
+	const liveBranch = () => {
+		branch ??= gitlabJson(api, `/projects/${encodeURIComponent(project)}`).then((found) => found.default_branch);
+		branch.catch(() => {
+			branch = void 0;
+		});
+		return branch;
+	};
+	/** The code project at its newest commit, read again each time, since updates change it. */
+	const files = async () => options.open(await liveBranch());
+	/** A file as it is now: its setup files are outside the folders backends list, so they're read at the newest commit. */
+	const readNow = async (path) => {
+		const backend = await files();
+		return backend.readAt(path, await backend.revision());
+	};
+	const updates = async () => gitlabUpdates(api, project, await liveBranch(), readNow, "update");
+	return {
+		code: {
+			repo: project,
+			webUrl: `${options.webUrl}/${project}`,
+			read: readNow,
+			history: async (path, history) => (await files()).history(path, history),
+			readAt: async (path, revision) => (await files()).readAt(path, revision)
+		},
+		async setup() {
+			try {
+				return await (await updates()).setup();
+			} catch (error) {
+				if (noAccess(error)) return "no-access";
+				throw error;
+			}
+		},
+		async enable() {
+			await (await updates()).enable?.();
+		},
+		async lastRun() {
+			try {
+				return await (await updates()).lastRun();
+			} catch (error) {
+				if (noAccess(error)) return void 0;
+				throw error;
+			}
+		},
+		async start(target) {
+			await (await updates()).start(target);
+		}
+	};
+}
 //#endregion
 //#region src/backend.ts
 const PAGE_SIZE = 100;
@@ -440,8 +498,10 @@ var GitLabBackend = class GitLabBackend {
 	user;
 	pages;
 	editors;
+	/** Absent where the project holds only content: the update job runs where the code is. */
 	updates;
 	drafts;
+	contentOnly;
 	options;
 	api;
 	project;
@@ -457,9 +517,26 @@ var GitLabBackend = class GitLabBackend {
 		this.branch = options.branch;
 		this.user = options.user;
 		this.onSignOut = options.onSignOut;
+		this.pinned = options.revision;
 		this.pages = gitlabPages(this.api, options.project);
 		this.editors = gitlabEditors(this.api, options.project, this.branch, this.user.login);
-		this.updates = gitlabUpdates(this.api, options.project, this.branch, async (path) => this.readAt(path, this.pinned ?? await this.revision()));
+		this.contentOnly = options.contentOnly === true;
+		if (!this.contentOnly) this.updates = gitlabUpdates(this.api, options.project, this.branch, async (path) => this.readAt(path, this.pinned ?? await this.revision()));
+		else if (options.code) {
+			const code = options.code;
+			this.updates = gitlabCodeUpdates({
+				api: this.api,
+				project: code.project,
+				webUrl: code.webUrl,
+				open: (branch) => new GitLabBackend({
+					api: this.api,
+					project: code.project,
+					branch,
+					user: this.user,
+					onSignOut: () => {}
+				})
+			});
+		}
 		this.drafts = branchDrafts(this, this.draftHost());
 	}
 	/** Drafts on branches of the project, with merge requests for review. */
@@ -645,6 +722,7 @@ var GitLabBackend = class GitLabBackend {
 		return (await gitlabJson(this.api, this.repo(`/files/${encodeURIComponent(path)}?ref=${ref}`))).last_commit_id;
 	}
 	async write(changes, { message, expectedRevision }) {
+		if (this.contentOnly) assertContentChanges(changes);
 		if (await this.revision() !== expectedRevision) throw new ConflictError();
 		const existing = await this.tree(expectedRevision);
 		const toApply = (await Promise.all(changes.map(async (change) => {
@@ -676,7 +754,11 @@ var GitLabBackend = class GitLabBackend {
 				body: {
 					branch: this.branch,
 					commit_message: message,
-					actions: toApply
+					actions: toApply,
+					...this.options.author && {
+						author_name: this.options.author.name,
+						author_email: this.options.author.email
+					}
 				}
 			});
 			this.pinned = commit.id;
@@ -720,7 +802,9 @@ var GitLabBackend = class GitLabBackend {
 	*/
 	async deployStatus(revision) {
 		try {
-			const statuses = await gitlabJson(this.api, this.repo(`/commits/${revision}/statuses`));
+			const all = await gitlabJson(this.api, this.repo(`/commits/${revision}/statuses`));
+			const statuses = all.filter((status) => status.name !== REBUILD_JOB);
+			if (all.length > 0 && statuses.length === 0) return { state: "unknown" };
 			if (statuses.length === 0) return { state: (await gitlabJson(this.api, `/projects/${this.project}/pipelines?per_page=1`)).length > 0 ? "building" : "unknown" };
 			const failed = statuses.find((status) => status.status === "failed" || status.status === "canceled");
 			if (failed) {
@@ -863,6 +947,46 @@ function gitlabSetup(options = {}) {
 		async function isAvailable(owner, name) {
 			return (await gitlabRequest(api, `/projects/${encodeURIComponent(`${owner.path}/${name}`)}`, { allow: [404] })).status === 404;
 		}
+		/**
+		* Lets each project's pipelines reach the other, as their setup files say:
+		* a job token is refused by a project whose job token allowlist doesn't
+		* name its project, even a public one. Also lets the code project's job
+		* token publish updates, and runs pipelines each night where they need it.
+		* Returns whether it worked.
+		*/
+		async function connectProjects(link) {
+			const project = (path) => `/projects/${encodeURIComponent(path)}`;
+			try {
+				const ids = /* @__PURE__ */ new Map();
+				for (const which of ["code", "content"]) ids.set(which, (await gitlabJson(api, project(link[which]))).id);
+				for (const { reader, read } of link.links.reads) await gitlabRequest(api, `${project(link[read])}/job_token_scope/allowlist`, {
+					method: "POST",
+					body: { target_project_id: ids.get(reader) }
+				});
+				if (link.links.updates) await gitlabRequest(api, project(link[link.links.updates]), {
+					method: "PUT",
+					body: { ci_push_repository_for_job_token_allowed: true }
+				});
+				for (const which of link.links.nightly) await gitlabRequest(api, `${project(link[which])}/pipeline_schedules`, {
+					method: "POST",
+					body: {
+						description: which === link.links.updates ? "Rebuild the site and install Goodfellow's fixes each night" : "Rebuild the site each night",
+						ref: MAIN,
+						cron: NIGHTLY,
+						cron_timezone: "UTC",
+						active: true
+					}
+				});
+				return true;
+			} catch (error) {
+				if (error instanceof GitApiError && [
+					400,
+					403,
+					404
+				].includes(error.status)) return false;
+				throw error;
+			}
+		}
 		return {
 			user: {
 				login: user.username,
@@ -900,6 +1024,11 @@ function gitlabSetup(options = {}) {
 					if (error instanceof GitApiError && (error.status === 403 || error.status === 404)) throw new SetupError("not-allowed", `This sign-in can't create projects in ${site.owner.path}.`);
 					throw error;
 				}
+				const warnings = [];
+				if (site.link) {
+					onStep?.("connect");
+					if (!await connectProjects(site.link)) warnings.push("connect-unavailable");
+				}
 				onStep?.("files");
 				await gitlabRequest(api, `/projects/${project.id}/repository/commits`, {
 					method: "POST",
@@ -923,7 +1052,7 @@ function gitlabSetup(options = {}) {
 					webUrl: project.web_url,
 					buildsUrl: `${project.web_url}/-/pipelines`,
 					pagesUrl: site.pages ? `${project.web_url}/pages` : void 0,
-					warnings: []
+					warnings
 				};
 			}
 		};
@@ -1056,6 +1185,11 @@ function gitlab(options) {
 			api,
 			project: options.project,
 			branch: options.branch ?? project.default_branch,
+			...options.contentOnly && { contentOnly: true },
+			...options.contentOnly && options.code && { code: {
+				project: options.code,
+				webUrl
+			} },
 			user: {
 				login: user.username,
 				name: user.name,
@@ -1092,6 +1226,43 @@ function gitlab(options) {
 			code_verifier: redirect.verifier
 		}), redirect.verifier), redirect.remember);
 	}
+	/** The project through a token of the site's own, such as a project access token, on a full-stack site's server. */
+	function server({ token }) {
+		const api = {
+			apiUrl,
+			token: async () => typeof token === "string" ? token : token(),
+			canRefresh: false,
+			fetch: fetcher
+		};
+		let branch;
+		const liveBranch = () => {
+			branch ??= options.branch ? Promise.resolve(options.branch) : gitlabJson(api, `/projects/${encodeURIComponent(options.project)}`).then((project) => project.default_branch);
+			branch.catch(() => {
+				branch = void 0;
+			});
+			return branch;
+		};
+		const backend = async (revision, author) => new GitLabBackend({
+			api,
+			project: options.project,
+			branch: await liveBranch(),
+			...options.contentOnly && { contentOnly: true },
+			user: {
+				login: author?.name ?? options.project,
+				...author && { name: author.name }
+			},
+			onSignOut: () => {},
+			...revision && { revision },
+			...author && { author }
+		});
+		return {
+			...options.contentOnly && { contentOnly: true },
+			async revision() {
+				return (await backend()).revision();
+			},
+			at: backend
+		};
+	}
 	return {
 		name: "GitLab",
 		canRedirect: Boolean(options.clientId),
@@ -1145,7 +1316,8 @@ function gitlab(options) {
 				code_challenge_method: "S256"
 			});
 			location().assign(`${webUrl}/oauth/authorize?${query}`);
-		}
+		},
+		server
 	};
 }
 //#endregion

package/dist/testing.d.ts

@@ -21,6 +21,10 @@ export interface FakeGitLabOptions {
   };
   /** Simulates a GitLab Pages pipeline that succeeds after being checked this many times. Off by default. */
   deployAfterChecks?: number;
+  /** The job each published commit's pipeline runs: `pages` by default. */
+  deployJob?: string;
+  /** The job the update runs in, which `addUpdateRun()` logs: `pages` by default, as in the starters, or a code project's `update`. */
+  updateJob?: string;
   /** Groups the users belong to, which new projects can be created in. */
   groups?: string[];
   /** Publishes the site with GitLab Pages. Off by default. */
@@ -63,6 +67,16 @@ export interface FakeCreatedProject {
   description?: string;
   pagesAccessLevel?: string;
   repo: FakeRepo;
+  /** The projects whose job tokens may reach this one (its job token allowlist), by id. */
+  jobTokenAllowlist: number[];
+  /** Whether its pipelines' job tokens may push to it. */
+  jobTokenPush: boolean;
+  schedules: Array<{
+    description: string;
+    ref: string;
+    cron: string;
+    active: boolean;
+  }>;
 }
 export declare function fakeGitLab(options: FakeGitLabOptions): {
   /** How many GraphQL requests read files, as `readFiles()` makes. */
@@ -123,6 +137,11 @@ export declare function fakeGitLab(options: FakeGitLabOptions): {
   created: Map<string, FakeCreatedProject>;
   /** The site's GitLab Pages, if it has them, which tests can change. */
   pages: FakeGitLabPages | undefined;
+  /** Who commits that named their author did name, by commit. */
+  commitAuthors: Map<string, {
+    name: string;
+    email: string;
+  }>;
   requests: Request[];
   commit: (changes: FileChange[], message: string, author?: string, branch?: string) => string;
   authorize: (authorizeUrl: string) => string;

package/dist/testing.js

@@ -20,6 +20,8 @@ async function sha256Base64Url(text) {
 function fakeGitLab(options) {
 	const webUrl = options.url ?? "https://gitlab.com";
 	const repo = new FakeRepo(options.files);
+	/** Who each commit that named its author did name, by commit. */
+	const commitAuthors = /* @__PURE__ */ new Map();
 	const tokens = new Map(Object.entries(options.tokens ?? { "test-token": {
 		username: "editor",
 		name: "Test Editor"
@@ -297,7 +299,10 @@ function fakeGitLab(options) {
 				visibility: body.visibility,
 				description: body.description,
 				pagesAccessLevel: body.pages_access_level,
-				repo: new FakeRepo({})
+				repo: new FakeRepo({}),
+				jobTokenAllowlist: [],
+				jobTokenPush: false,
+				schedules: []
 			};
 			created.set(fullPath, project);
 			return json({
@@ -311,11 +316,40 @@ function fakeGitLab(options) {
 		const project = created.get(key) ?? [...created.values()].find((candidate) => String(candidate.id) === key);
 		if (!match || !project) return void 0;
 		const rest = match[2] ?? "";
-		if (rest === "") return json({
+		if (rest === "" && request.method === "GET") return json({
 			id: project.id,
 			path_with_namespace: project.path,
-			default_branch: "main"
+			default_branch: "main",
+			ci_push_repository_for_job_token_allowed: project.jobTokenPush
 		});
+		if (rest === "" && request.method === "PUT") {
+			const body = await request.json();
+			if (body.ci_push_repository_for_job_token_allowed !== void 0) project.jobTokenPush = body.ci_push_repository_for_job_token_allowed;
+			return json({
+				id: project.id,
+				ci_push_repository_for_job_token_allowed: project.jobTokenPush
+			});
+		}
+		if (rest === "/job_token_scope/allowlist" && request.method === "POST") {
+			const body = await request.json();
+			if (![...created.values()].some((candidate) => candidate.id === body.target_project_id)) return json({ message: "404 Project Not Found" }, 404);
+			if (!project.jobTokenAllowlist.includes(body.target_project_id)) project.jobTokenAllowlist.push(body.target_project_id);
+			return json({
+				source_project_id: project.id,
+				target_project_id: body.target_project_id
+			}, 201);
+		}
+		if (rest === "/pipeline_schedules" && request.method === "POST") {
+			const body = await request.json();
+			project.schedules.push({
+				...body,
+				active: body.active !== false
+			});
+			return json({
+				id: project.schedules.length,
+				...body
+			}, 201);
+		}
 		if (rest === "/repository/commits" && request.method === "POST") {
 			const body = await request.json();
 			return json({
@@ -549,17 +583,22 @@ function fakeGitLab(options) {
 				if ((action.action === "update" || action.action === "delete") && !files.has(action.file_path)) return json({ message: "A file with this name doesn't exist" }, 400);
 				if (action.last_commit_id && repo.lastCommitFor(action.file_path, body.branch) !== action.last_commit_id) return json({ message: "You are attempting to update a file that has changed since you started editing it." }, 400);
 			}
+			const sha = commit(body.actions.map((action) => action.action === "delete" ? {
+				path: action.file_path,
+				delete: true
+			} : action.encoding === "base64" ? {
+				path: action.file_path,
+				bytes: decodeBase64(action.content ?? "")
+			} : {
+				path: action.file_path,
+				content: action.content ?? ""
+			}), body.commit_message, body.author_name ?? user.name ?? user.username, body.branch);
+			if (body.author_name && body.author_email) commitAuthors.set(sha, {
+				name: body.author_name,
+				email: body.author_email
+			});
 			return json({
-				id: commit(body.actions.map((action) => action.action === "delete" ? {
-					path: action.file_path,
-					delete: true
-				} : action.encoding === "base64" ? {
-					path: action.file_path,
-					bytes: decodeBase64(action.content ?? "")
-				} : {
-					path: action.file_path,
-					content: action.content ?? ""
-				}), body.commit_message, user.name ?? user.username, body.branch),
+				id: sha,
 				message: body.commit_message
 			}, 201);
 		}
@@ -596,9 +635,10 @@ function fakeGitLab(options) {
 				}]);
 			}
 			pipeline.checks += 1;
+			const done = pipeline.checks > (options.deployAfterChecks ?? 0);
 			return json([{
-				name: "pages",
-				status: pipeline.checks > (options.deployAfterChecks ?? 0) ? "success" : "running",
+				name: options.deployJob ?? "pages",
+				status: done ? "success" : "running",
 				target_url: `${webUrl}/${options.project}/-/jobs/1`
 			}]);
 		}
@@ -647,7 +687,7 @@ function fakeGitLab(options) {
 			const run = updateRuns.find((candidate) => candidate.id === Number(updateJobs[1]));
 			return run ? json([{
 				id: run.id,
-				name: "pages",
+				name: options.updateJob ?? "pages",
 				status: run.status
 			}]) : json({ message: "404 Not Found" }, 404);
 		}
@@ -707,6 +747,8 @@ function fakeGitLab(options) {
 		created,
 		/** The site's GitLab Pages, if it has them, which tests can change. */
 		pages,
+		/** Who commits that named their author did name, by commit. */
+		commitAuthors,
 		requests,
 		commit,
 		authorize,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodfellow-cms/gitlab",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Edit a Goodfellow site stored on GitLab, straight from the browser.",
   "keywords": [
     "goodfellow",
@@ -35,7 +35,7 @@
     "dist"
   ],
   "dependencies": {
-    "@goodfellow-cms/core": "0.3.0"
+    "@goodfellow-cms/core": "0.4.0"
   },
   "devDependencies": {
     "@puckeditor/core": "0.23.0"