@goodfellow-cms/gitlab 0.7.0 → 0.8.0

package/dist/index.d.ts

@@ -3,9 +3,14 @@ import { ConnectDomainOptions, DeployStatus, DnsRecord, FileChange, FileVersion,
 interface ApiOptions {
   /** The API root, such as `https://gitlab.com/api/v4`. */
   apiUrl: string;
-  /** Returns a current access token, refreshing it if needed. */
+  /**
+   * Returns a current access token, refreshing it if needed. `refresh` asks
+   * for a new one after GitLab refused `stale`, which another request may
+   * already have replaced.
+   */
   token: (options?: {
     refresh?: boolean;
+    stale?: string;
   }) => Promise<string>;
   /** Whether the token can be refreshed after a 401. */
   canRefresh: boolean;
@@ -84,6 +89,8 @@ export declare class GitLabBackend implements GitBackend {
   revision(): Promise<string>;
   /** The branch's latest commit, without moving the revision reads are pinned to. */
   private head;
+  /** Every item of one of GitLab's lists, page by page, up to `REVIEW_PAGES` pages. */
+  private everyPage;
   /** Every file in one folder at a commit, page by page. */
   private listFolder;
   /** Path → blob id for the editable files at a commit. Commits never change, so this is cached. */

package/dist/index.js

@@ -2,15 +2,22 @@ import { ConflictError, DomainError, DraftError, EDITABLE_FOLDERS, EditorsError,
 //#region src/api.ts
 /** Calls the GitLab API. A 401 refreshes the token once; after that it means the sign-in has expired. */
 async function gitlabRequest(api, path, init = {}) {
-	const send = async (refresh) => api.fetch(`${api.apiUrl}${path}`, {
-		method: init.method ?? "GET",
-		headers: {
-			authorization: `Bearer ${await api.token({ refresh })}`,
-			...init.body !== void 0 && { "content-type": "application/json" }
-		},
-		body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
-		cache: "no-store"
-	});
+	let sent;
+	const send = async (refresh) => {
+		sent = await api.token(refresh ? {
+			refresh,
+			...sent !== void 0 && { stale: sent }
+		} : {});
+		return api.fetch(`${api.apiUrl}${path}`, {
+			method: init.method ?? "GET",
+			headers: {
+				authorization: `Bearer ${sent}`,
+				...init.body !== void 0 && { "content-type": "application/json" }
+			},
+			body: init.body === void 0 ? void 0 : JSON.stringify(init.body),
+			cache: "no-store"
+		});
+	};
 	let response = await send(false);
 	if (response.status === 401 && api.canRefresh) response = await send(true);
 	if (response.status === 401) throw new SignInError("invalid", "GitLab didn't accept the sign-in. It may have expired.");
@@ -346,7 +353,11 @@ function notAllowed$1(error) {
 	if (error instanceof GitApiError && (error.status === 401 || error.status === 403)) throw new ScheduledBuildsError("not-allowed", "Adding pipeline schedules on GitLab needs the Developer role, with permission to merge to the main branch.");
 	throw error;
 }
-/** A cron line for one instant, in UTC: it comes once a year, and `sync()` removes it once it has passed. */
+/**
+* A cron line for one instant, in UTC. GitLab's crons have no year, so it
+* comes again a year later unless `sync()` has removed it since, which only
+* builds the site again, since the schedule's variable skips the update.
+*/
 function cronAt(at) {
 	return `${at.getUTCMinutes()} ${at.getUTCHours()} ${at.getUTCDate()} ${at.getUTCMonth() + 1} *`;
 }
@@ -373,7 +384,12 @@ function gitlabScheduledBuilds(api, project, branch, readCi, now = () => /* @__P
 				if (wanted.size >= 50) break;
 				wanted.set(minute(at), at);
 			}
-			const found = await gitlabJson(api, `${base}?per_page=100`).catch(notAllowed$1);
+			const found = [];
+			for (let page = 1; page <= 10; page++) {
+				const listed = await gitlabJson(api, `${base}?per_page=100&page=${page}`).catch(notAllowed$1);
+				found.push(...listed);
+				if (listed.length < 100) break;
+			}
 			const ours = /* @__PURE__ */ new Map();
 			for (const schedule of found) {
 				if (!schedule.description?.startsWith("Goodfellow: build the site for a scheduled change at ")) continue;
@@ -398,14 +414,22 @@ function gitlabScheduledBuilds(api, project, branch, readCi, now = () => /* @__P
 						active: true
 					}
 				}).catch(notAllowed$1);
-				await gitlabRequest(api, `${base}/${created.id}/variables`, {
-					method: "POST",
-					body: {
-						key: SCHEDULED_CHANGE_VARIABLE,
-						value: time,
-						variable_type: "env_var"
-					}
-				}).catch(notAllowed$1);
+				try {
+					await gitlabRequest(api, `${base}/${created.id}/variables`, {
+						method: "POST",
+						body: {
+							key: SCHEDULED_CHANGE_VARIABLE,
+							value: time,
+							variable_type: "env_var"
+						}
+					});
+				} catch (error) {
+					await gitlabRequest(api, `${base}/${created.id}`, {
+						method: "DELETE",
+						allow: [403, 404]
+					}).catch(() => {});
+					notAllowed$1(error);
+				}
 			}
 		}
 	};
@@ -695,6 +719,10 @@ function gitlabCodeUpdates(options) {
 //#endregion
 //#region src/backend.ts
 const PAGE_SIZE = 100;
+/** The most files GitLab's compare lists, by default. */
+const COMPARE_FILES_LIMIT = 1e3;
+/** How many pages of drafts' branches and merge requests are read: a thousand of each. */
+const REVIEW_PAGES = 10;
 /** How many files one GraphQL request reads. */
 const GRAPHQL_BATCH = 50;
 /** The color and section codes in GitLab's job logs. */
@@ -847,11 +875,8 @@ var GitLabBackend = class GitLabBackend {
 				return (await response.json()).id;
 			},
 			listBranches: async (prefix) => {
-				const query = new URLSearchParams({
-					search: `^${prefix}`,
-					per_page: "100"
-				});
-				return (await gitlabJson(this.api, this.repo(`/branches?${query}`))).map((found) => found.name).filter((name) => name.startsWith(prefix));
+				const query = new URLSearchParams({ search: `^${prefix}` });
+				return (await this.everyPage(this.repo(`/branches?${query}`))).map((found) => found.name).filter((name) => name.startsWith(prefix));
 			},
 			openReview: async ({ branch, title, description, reviewers = [] }) => {
 				const response = await gitlabRequest(this.api, `${project}/merge_requests`, {
@@ -880,11 +905,7 @@ var GitLabBackend = class GitLabBackend {
 				return { url: review.web_url };
 			},
 			listReviews: async (prefix) => {
-				const query = new URLSearchParams({
-					state: "opened",
-					per_page: "100"
-				});
-				return (await gitlabJson(this.api, `${project}/merge_requests?${query}`)).filter((request) => request.source_branch.startsWith(prefix)).map((request) => ({
+				return (await this.everyPage(`${project}/merge_requests?state=opened`)).filter((request) => request.source_branch.startsWith(prefix)).map((request) => ({
 					branch: request.source_branch,
 					url: request.web_url,
 					title: request.title
@@ -910,6 +931,16 @@ var GitLabBackend = class GitLabBackend {
 	async head() {
 		return (await gitlabJson(this.api, this.repo(`/branches/${encodeURIComponent(this.branch)}`))).commit.id;
 	}
+	/** Every item of one of GitLab's lists, page by page, up to `REVIEW_PAGES` pages. */
+	async everyPage(path) {
+		const items = [];
+		for (let page = 1; page <= REVIEW_PAGES; page++) {
+			const found = await gitlabJson(this.api, `${path}&per_page=${PAGE_SIZE}&page=${page}`);
+			items.push(...found);
+			if (found.length < PAGE_SIZE) break;
+		}
+		return items;
+	}
 	/** Every file in one folder at a commit, page by page. */
 	async listFolder(sha, dir) {
 		const files = [];
@@ -1132,12 +1163,13 @@ var GitLabBackend = class GitLabBackend {
 		return response.ok ? response.text() : void 0;
 	}
 	async changedPaths(from, to) {
-		const comparison = await gitlabJson(this.api, this.repo(`/compare?${new URLSearchParams({
+		const diffs = (await gitlabJson(this.api, this.repo(`/compare?${new URLSearchParams({
 			from,
 			to,
 			straight: "true"
-		})}`));
-		return [...new Set((comparison.diffs ?? []).flatMap((diff) => [diff.old_path, diff.new_path]))];
+		})}`))).diffs ?? [];
+		if (diffs.length >= COMPARE_FILES_LIMIT) throw new GitApiError(0, `More files changed between ${from} and ${to} than GitLab lists.`);
+		return [...new Set(diffs.flatMap((diff) => [diff.old_path, diff.new_path]))];
 	}
 	/**
 	* Reads the commit's pipeline and external statuses (GitLab Pages jobs, or
@@ -1529,19 +1561,25 @@ function gitlab(options) {
 	}
 	async function connect(initial, remember) {
 		let credentials = initial;
-		const token = async ({ refresh } = {}) => {
+		let renewing;
+		const renew = (current) => renewing ??= (async () => {
+			credentials = toTokens(await requestTokens({
+				client_id: options.clientId ?? "",
+				refresh_token: current.refresh,
+				grant_type: "refresh_token",
+				redirect_uri: redirectUri(location().href()),
+				code_verifier: current.verifier
+			}), current.verifier);
+			storage.save(JSON.stringify(credentials), remember);
+			return credentials.access;
+		})().finally(() => {
+			renewing = void 0;
+		});
+		const token = async ({ refresh, stale } = {}) => {
 			if (credentials.type === "token") return credentials.token;
-			if (refresh || credentials.expiresAt - 6e4 < Date.now()) {
-				const { verifier } = credentials;
-				credentials = toTokens(await requestTokens({
-					client_id: options.clientId ?? "",
-					refresh_token: credentials.refresh,
-					grant_type: "refresh_token",
-					redirect_uri: redirectUri(location().href()),
-					code_verifier: verifier
-				}), verifier);
-				storage.save(JSON.stringify(credentials), remember);
-			}
+			if (renewing) return renewing;
+			if (refresh && stale !== void 0 && stale !== credentials.access) return credentials.access;
+			if (refresh || credentials.expiresAt - 6e4 < Date.now()) return renew(credentials);
 			return credentials.access;
 		};
 		const api = {
@@ -1584,18 +1622,18 @@ function gitlab(options) {
 		const returnedState = url.searchParams.get("state");
 		const error = url.searchParams.get("error");
 		if (!code && !error) return null;
-		const saved = pending.load();
-		if (!saved) return null;
-		pending.clear();
-		const redirect = JSON.parse(saved);
 		for (const key of [
 			"code",
 			"state",
 			"error",
 			"error_description"
 		]) url.searchParams.delete(key);
-		url.hash = redirect.hash;
+		const saved = pending.load();
+		if (saved) url.hash = JSON.parse(saved).hash;
 		location().replace(url.toString());
+		if (!saved) return null;
+		pending.clear();
+		const redirect = JSON.parse(saved);
 		if (error || !code || returnedState !== redirect.state) throw new SignInError("redirect-failed", "Signing in with GitLab was cancelled or didn't finish.");
 		return connect(toTokens(await requestTokens({
 			client_id: options.clientId ?? "",

package/dist/testing.d.ts

@@ -172,6 +172,8 @@ export declare function fakeGitLab(options: FakeGitLabOptions): {
   requests: Request[];
   commit: (changes: FileChange[], message: string, author?: string, branch?: string) => string;
   authorize: (authorizeUrl: string) => string;
+  /** Ends every OAuth access token GitLab has given, as their two hours running out does; refresh tokens still work. */
+  expireAccessTokens: () => void;
   handle: (request: Request) => Promise<Response>;
   fetch: typeof fetch;
 };

package/dist/testing.js

@@ -17,6 +17,12 @@ async function sha256Base64Url(text) {
 	for (const byte of digest) binary += String.fromCharCode(byte);
 	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
+/** One page of a list, as GitLab answers with `per_page` and `page`. */
+function onePage(url, items) {
+	const perPage = Number(url.searchParams.get("per_page") ?? 20);
+	const page = Number(url.searchParams.get("page") ?? 1);
+	return items.slice((page - 1) * perPage, page * perPage);
+}
 function fakeGitLab(options) {
 	const webUrl = options.url ?? "https://gitlab.com";
 	const repo = new FakeRepo(options.files);
@@ -515,7 +521,7 @@ function fakeGitLab(options) {
 		if (rest === "/repository/branches" && request.method === "GET") {
 			const search = url.searchParams.get("search") ?? "";
 			const matches = (name) => search.startsWith("^") ? name.startsWith(search.slice(1)) : name.includes(search);
-			return json([...repo.branches].filter(([name]) => matches(name)).map(([name, sha]) => ({
+			return json(onePage(url, [...repo.branches].filter(([name]) => matches(name))).map(([name, sha]) => ({
 				name,
 				commit: { id: sha }
 			})));
@@ -564,7 +570,7 @@ function fakeGitLab(options) {
 		}
 		if (rest === "/merge_requests" && request.method === "GET") {
 			const source = url.searchParams.get("source_branch");
-			return json(repo.reviews.filter((review) => review.state === "open" && (!source || review.branch === source)).map((review) => ({
+			return json(onePage(url, repo.reviews.filter((review) => review.state === "open" && (!source || review.branch === source))).map((review) => ({
 				iid: review.number,
 				title: review.title,
 				source_branch: review.branch,
@@ -908,6 +914,10 @@ function fakeGitLab(options) {
 		requests,
 		commit,
 		authorize,
+		/** Ends every OAuth access token GitLab has given, as their two hours running out does; refresh tokens still work. */
+		expireAccessTokens: () => {
+			for (const [token] of tokens) if (token.startsWith("oauth-access-")) tokens.delete(token);
+		},
 		handle,
 		fetch: ((input, init) => handle(new Request(input, init)))
 	};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodfellow-cms/gitlab",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Edit a Goodfellow site stored on GitLab, straight from the browser.",
   "keywords": [
     "goodfellow",
@@ -35,7 +35,7 @@
     "dist"
   ],
   "dependencies": {
-    "@goodfellow-cms/core": "0.7.0"
+    "@goodfellow-cms/core": "0.8.0"
   },
   "devDependencies": {
     "@puckeditor/core": "0.23.0"