@goodfellow-cms/gitlab 0.8.0 → 0.10.0

package/dist/index.js

@@ -143,6 +143,11 @@ function gitlabEditors(api, project, branch, username) {
 			await gitlabRequest(api, editor.id.startsWith(INVITATION) ? `${base}/invitations/${encodeURIComponent(editor.id.slice(11))}` : `${base}/members/${editor.id.slice(7)}`, { method: "DELETE" }).catch(notAllowed$2);
 		},
 		async letEditorsPublish() {
+			const read = async () => {
+				const answer = await gitlabRequest(api, protectedPath, { allow: [404] }).catch(notAllowed$2);
+				return answer.ok ? await answer.json() : void 0;
+			};
+			const developersMay = (protection) => !protection || ["push_access_levels", "merge_access_levels"].every((kind) => (protection[kind] ?? []).some((level) => level.access_level !== null && level.access_level <= DEVELOPER));
 			const protect = (level) => gitlabRequest(api, `${base}/protected_branches`, {
 				method: "POST",
 				body: {
@@ -152,6 +157,30 @@ function gitlabEditors(api, project, branch, username) {
 					allow_force_push: false
 				}
 			});
+			const current = await read();
+			if (!current) {
+				await protect(DEVELOPER).catch(notAllowed$2);
+				return;
+			}
+			if (developersMay(current)) return;
+			const swap = (levels = []) => [{ access_level: DEVELOPER }, ...levels.flatMap((level) => level.id === void 0 ? [] : [{
+				id: level.id,
+				_destroy: true
+			}])];
+			if ((await gitlabRequest(api, protectedPath, {
+				method: "PATCH",
+				body: {
+					allow_force_push: false,
+					allowed_to_push: swap(current.push_access_levels),
+					allowed_to_merge: swap(current.merge_access_levels)
+				},
+				allow: [
+					400,
+					404,
+					405,
+					422
+				]
+			}).catch(notAllowed$2)).ok && developersMay(await read())) return;
 			await gitlabRequest(api, protectedPath, {
 				method: "DELETE",
 				allow: [404]
@@ -162,6 +191,11 @@ function gitlabEditors(api, project, branch, username) {
 				await protect(MAINTAINER).catch(() => void 0);
 				notAllowed$2(error);
 			}
+			const after = await read();
+			if (!after || !developersMay(after)) {
+				if (!after) await protect(MAINTAINER).catch(() => void 0);
+				throw new Error("GitLab didn't keep the main branch's new protection. Try again.");
+			}
 		}
 	};
 }
@@ -1334,27 +1368,77 @@ function gitlabSetup(options = {}) {
 		async function isAvailable(owner, name) {
 			return (await gitlabRequest(api, `/projects/${encodeURIComponent(`${owner.path}/${name}`)}`, { allow: [404] })).status === 404;
 		}
+		const projectPath = (path) => `/projects/${encodeURIComponent(path)}`;
+		/**
+		* Makes one connection between a site's projects, giving what's left to do
+		* by hand where GitLab refuses it, with what it answered.
+		*/
+		async function attempt(unmade, request, left) {
+			try {
+				await request();
+			} catch (error) {
+				if (!(error instanceof GitApiError)) throw error;
+				left.push({
+					...unmade,
+					reason: error.message
+				});
+			}
+		}
 		/**
 		* Lets each project's pipelines reach the other, as their setup files say:
 		* a job token is refused by a project whose job token allowlist doesn't
 		* name its project, even a public one. Also lets the code project's job
-		* token publish updates, and runs pipelines each night where they need it.
-		* Returns whether it worked.
+		* token publish updates. Runs before the project's files are written,
+		* since their first pipeline reads the other project. Each is tried on its
+		* own, so one GitLab refuses doesn't keep the others from being made.
 		*/
-		async function connectProjects(link) {
-			const project = (path) => `/projects/${encodeURIComponent(path)}`;
-			try {
-				const ids = /* @__PURE__ */ new Map();
-				for (const which of ["code", "content"]) ids.set(which, (await gitlabJson(api, project(link[which]))).id);
-				for (const { reader, read } of link.links.reads) await gitlabRequest(api, `${project(link[read])}/job_token_scope/allowlist`, {
-					method: "POST",
-					body: { target_project_id: ids.get(reader) }
-				});
-				if (link.links.updates) await gitlabRequest(api, project(link[link.links.updates]), {
+		async function connectProjects(link, left) {
+			const ids = /* @__PURE__ */ new Map();
+			for (const which of ["code", "content"]) try {
+				ids.set(which, (await gitlabJson(api, projectPath(link[which]))).id);
+			} catch (error) {
+				if (!(error instanceof GitApiError)) throw error;
+			}
+			for (const { reader, read } of link.links.reads) {
+				const target = ids.get(reader);
+				await attempt({
+					kind: "read",
+					reader: link[reader],
+					read: link[read],
+					reason: ""
+				}, async () => {
+					if (target === void 0) throw new GitApiError(404, `GitLab couldn't find ${link[reader]}.`);
+					await gitlabRequest(api, `${projectPath(link[read])}/job_token_scope/allowlist`, {
+						method: "POST",
+						body: { target_project_id: target }
+					});
+				}, left);
+			}
+			if (link.links.updates) {
+				const repo = link[link.links.updates];
+				await attempt({
+					kind: "push",
+					repo,
+					reason: ""
+				}, () => gitlabRequest(api, projectPath(repo), {
 					method: "PUT",
 					body: { ci_push_repository_for_job_token_allowed: true }
-				});
-				for (const which of link.links.nightly) await gitlabRequest(api, `${project(link[which])}/pipeline_schedules`, {
+				}), left);
+			}
+		}
+		/**
+		* Runs the pipelines that need it each night. After the project's files
+		* are written, since a schedule names the main branch, which an empty
+		* project doesn't have yet.
+		*/
+		async function scheduleNightly(link, left) {
+			for (const which of link.links.nightly) {
+				const repo = link[which];
+				await attempt({
+					kind: "nightly",
+					repo,
+					reason: ""
+				}, () => gitlabRequest(api, `${projectPath(repo)}/pipeline_schedules`, {
 					method: "POST",
 					body: {
 						description: which === link.links.updates ? "Rebuild the site and install Goodfellow's fixes each night" : "Rebuild the site each night",
@@ -1363,15 +1447,7 @@ function gitlabSetup(options = {}) {
 						cron_timezone: "UTC",
 						active: true
 					}
-				});
-				return true;
-			} catch (error) {
-				if (error instanceof GitApiError && [
-					400,
-					403,
-					404
-				].includes(error.status)) return false;
-				throw error;
+				}), left);
 			}
 		}
 		return {
@@ -1412,9 +1488,10 @@ function gitlabSetup(options = {}) {
 					throw error;
 				}
 				const warnings = [];
+				const unconnected = [];
 				if (site.link) {
 					onStep?.("connect");
-					if (!await connectProjects(site.link)) warnings.push("connect-unavailable");
+					await connectProjects(site.link, unconnected);
 				}
 				let siteUrl;
 				if (site.pages && site.domain) {
@@ -1457,13 +1534,16 @@ function gitlabSetup(options = {}) {
 						}])
 					}
 				});
+				if (site.link) await scheduleNightly(site.link, unconnected);
+				if (unconnected.length) warnings.push("connect-unavailable");
 				return {
 					repo: project.path_with_namespace,
 					webUrl: project.web_url,
 					...siteUrl && { siteUrl },
 					buildsUrl: `${project.web_url}/-/pipelines`,
 					pagesUrl: site.pages ? `${project.web_url}/pages` : void 0,
-					warnings
+					warnings,
+					...unconnected.length && { unconnected }
 				};
 			}
 		};

package/dist/testing.d.ts

@@ -40,6 +40,8 @@ export interface FakeGitLabOptions {
   };
   /** Domains another GitLab Pages site already uses. */
   takenDomains?: string[];
+  /** What connecting created projects GitLab refuses, as a plan or a sign-in might: job token allowlists, job token pushes or pipeline schedules. */
+  refuseConnections?: Array<"allowlist" | "push" | "schedule">;
   /** Other GitLab accounts that exist, which can be added to the project. Every token's user exists and is a member. */
   accounts?: string[];
   /** Who can see the project. Private by default. */
@@ -50,6 +52,8 @@ export interface FakeGitLabOptions {
    * artifact, or nothing for a job that fails. Without it, task pipelines fail.
    */
   tasks?: (variables: Record<string, string>) => string | undefined | Promise<string | undefined>;
+  /** GitLab before 15.6, which can't change a protected branch's access levels, only remove and add it. */
+  noProtectionChanges?: boolean;
 }
 /** A pipeline schedule, such as the nightly one or one the admin panel adds for a scheduled change. */
 export interface FakeSchedule {
@@ -120,6 +124,7 @@ export declare function fakeGitLab(options: FakeGitLabOptions): {
     merge: number;
     forcePush: boolean;
   }>;
+  protectionChanges: string[];
   failBuild: (sha: string, failure?: {
     job?: string;
     failureReason?: string;

package/dist/testing.js

@@ -53,6 +53,8 @@ function fakeGitLab(options) {
 		merge: 40,
 		forcePush: false
 	}]]);
+	/** Each change to a protected branch, in order: `DELETE main`, `POST main`, `PATCH main`. */
+	const protectionChanges = [];
 	/** The project's members and invitations, and its protected branches. */
 	async function handleMembers(request, url, rest, accessLevel) {
 		const forbidden = () => json({ message: "403 Forbidden" }, 403);
@@ -134,20 +136,48 @@ function fakeGitLab(options) {
 			if (!found) return json({ message: "404 Not found" }, 404);
 			if (request.method === "GET") return json({
 				name,
-				push_access_levels: [{ access_level: found.push }],
-				merge_access_levels: [{ access_level: found.merge }],
+				push_access_levels: [{
+					id: 1,
+					access_level: found.push
+				}],
+				merge_access_levels: [{
+					id: 2,
+					access_level: found.merge
+				}],
 				allow_force_push: found.forcePush
 			});
 			if (request.method === "DELETE") {
 				if (accessLevel < 40) return forbidden();
 				protectedBranches.delete(name);
+				protectionChanges.push(`DELETE ${name}`);
 				return new Response(null, { status: 204 });
 			}
+			if (request.method === "PATCH" && !options.noProtectionChanges) {
+				if (accessLevel < 40) return forbidden();
+				const body = await request.json();
+				const levelFrom = (levels, id, now) => {
+					if (!levels) return now;
+					const kept = levels.some((level) => level.id === id && level._destroy) ? [] : [now];
+					const added = levels.flatMap((level) => level.access_level === void 0 ? [] : [level.access_level]);
+					return kept.length + added.length === 1 ? kept[0] ?? added[0] ?? now : void 0;
+				};
+				const push = levelFrom(body.allowed_to_push, 1, found.push);
+				const merge = levelFrom(body.allowed_to_merge, 2, found.merge);
+				if (push === void 0 || merge === void 0) return json({ message: "Only one access level allowed" }, 422);
+				protectedBranches.set(name, {
+					push,
+					merge,
+					forcePush: body.allow_force_push ?? found.forcePush
+				});
+				protectionChanges.push(`PATCH ${name}`);
+				return json({ name });
+			}
 		}
 		if (rest === "/protected_branches" && request.method === "POST") {
 			if (accessLevel < 40) return forbidden();
 			const body = await request.json();
 			if (protectedBranches.has(body.name)) return json({ message: "Protected branch already exists" }, 409);
+			protectionChanges.push(`POST ${body.name}`);
 			protectedBranches.set(body.name, {
 				push: body.push_access_level ?? 40,
 				merge: body.merge_access_level ?? 40,
@@ -345,6 +375,7 @@ function fakeGitLab(options) {
 		});
 		if (rest === "" && request.method === "PUT") {
 			const body = await request.json();
+			if (options.refuseConnections?.includes("push")) return json({ message: "403 Forbidden" }, 403);
 			if (body.ci_push_repository_for_job_token_allowed !== void 0) project.jobTokenPush = body.ci_push_repository_for_job_token_allowed;
 			return json({
 				id: project.id,
@@ -353,6 +384,7 @@ function fakeGitLab(options) {
 		}
 		if (rest === "/job_token_scope/allowlist" && request.method === "POST") {
 			const body = await request.json();
+			if (options.refuseConnections?.includes("allowlist")) return json({ message: "403 Forbidden" }, 403);
 			if (![...created.values()].some((candidate) => candidate.id === body.target_project_id)) return json({ message: "404 Project Not Found" }, 404);
 			if (!project.jobTokenAllowlist.includes(body.target_project_id)) project.jobTokenAllowlist.push(body.target_project_id);
 			return json({
@@ -371,6 +403,8 @@ function fakeGitLab(options) {
 		}
 		if (rest === "/pipeline_schedules" && request.method === "POST") {
 			const body = await request.json();
+			if (options.refuseConnections?.includes("schedule")) return json({ message: { ref: ["is ambiguous"] } }, 400);
+			if (project.repo.files().size === 0) return json({ message: { ref: ["is ambiguous"] } }, 400);
 			project.schedules.push({
 				...body,
 				active: body.active !== false
@@ -898,6 +932,7 @@ function fakeGitLab(options) {
 		members,
 		invitations,
 		protectedBranches,
+		protectionChanges,
 		failBuild,
 		cancelBuild,
 		/** The project's update settings, and the pipelines the update ran in, which tests add with `addUpdateRun()`. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@goodfellow-cms/gitlab",
-  "version": "0.8.0",
-  "description": "Edit a Goodfellow site stored on GitLab, straight from the browser.",
+  "version": "0.10.0",
+  "description": "Edit a Goodfellow CMS site stored on GitLab, straight from the browser.",
   "keywords": [
     "goodfellow",
     "cms",
@@ -12,6 +12,10 @@
   ],
   "homepage": "https://goodfellow-cms.github.io/goodfellow-cms/docs/hosts",
   "bugs": "https://github.com/goodfellow-cms/goodfellow-cms/issues",
+  "funding": {
+    "type": "github",
+    "url": "https://github.com/sponsors/goodfellow-cms"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -35,7 +39,7 @@
     "dist"
   ],
   "dependencies": {
-    "@goodfellow-cms/core": "0.8.0"
+    "@goodfellow-cms/core": "0.10.0"
   },
   "devDependencies": {
     "@puckeditor/core": "0.23.0"