@jant/core 0.7.0 → 0.7.1

package/src/routes/dash/settings.tsx

@@ -95,6 +95,7 @@ import {
   getInstallation,
   listInstallationReposPage,
   searchInstallationRepos,
+  type InstallationAccount,
 } from "../../lib/github-app.js";
 import {
   isSyncPending,
@@ -103,6 +104,7 @@ import {
   triggerGitHubSyncInline,
 } from "../../lib/github-sync-trigger.js";
 import { buildSyncSiteConfig } from "../../lib/github-sync-site-config.js";
+import { suggestSyncRepoName } from "../../lib/github-sync-repo-name.js";
 import { buildConfigEditorFields } from "../../lib/api-settings.js";
 import {
   readGitHubSyncStatus,
@@ -182,6 +184,23 @@ function requireSessionId(c: Context<Env>): string {
   return sessionId;
 }
 
+/**
+ * The user behind the current request.
+ *
+ * Same contract as `requireSessionId`: `requireAuth` has already proven the
+ * session belongs to a member of this site, so an absent user is a wiring
+ * mistake. Used wherever a decision is scoped to the person rather than to
+ * the site — the GitHub App installations they may reuse, most of all.
+ */
+function requireSessionUserId(c: Context<Env>): string {
+  const userId = c.var.session?.user?.id;
+  if (!userId) {
+    throw new UnauthorizedError();
+  }
+
+  return userId;
+}
+
 /**
  * Breadcrumb labels for admin settings pages.
  *
@@ -2080,6 +2099,49 @@ settingsRoutes.post("/github-sync/disconnect", async (c) => {
 // GitHub App install flow
 // ---------------------------------------------------------------------------
 
+/**
+ * Recreate installation bindings for sites that sync through the App
+ * but have no row to prove it.
+ *
+ * GitHub is the only source for the account behind an installation id,
+ * so the repair costs one call per distinct id — bounded by how many
+ * sites the author has, and only ever reached when they would otherwise
+ * be shown a GitHub page that cannot lead anywhere. Ids GitHub no longer
+ * recognizes are skipped: an uninstalled App has nothing to rebuild.
+ */
+async function rebuildInstallationBindings(
+  c: Context<Env>,
+  app: import("../../lib/env.js").GitHubAppEnvConfig,
+  userId: string,
+): Promise<void> {
+  const syncing =
+    await c.var.services.githubAppInstallations.listSyncingInstallationsForUser(
+      userId,
+    );
+  if (syncing.length === 0) return;
+
+  const accounts = new Map<string, InstallationAccount>();
+  for (const { installationId } of syncing) {
+    if (accounts.has(installationId)) continue;
+    try {
+      const installation = await getInstallation(app, installationId);
+      accounts.set(installationId, installation.account);
+    } catch {
+      continue;
+    }
+  }
+
+  for (const { siteId, installationId } of syncing) {
+    const account = accounts.get(installationId);
+    if (!account) continue;
+    await c.var.services.githubAppInstallations.upsertInstallation(
+      installationId,
+      siteId,
+      account,
+    );
+  }
+}
+
 /**
  * Redirect the user to GitHub to install the App on their account/org.
  *
@@ -2092,26 +2154,46 @@ settingsRoutes.get("/github-sync/app/install", async (c) => {
     return c.text("GitHub App is not configured on this deployment.", 404);
   }
 
-  // Reinstall-same-account predicate (§5): when this site already has at
-  // least one authorized installation, skip the GitHub round-trip and
-  // render the picker directly. The GitHub redirect is a dead end when
-  // the App is already installed on the chosen account — GitHub shows
-  // its Configure page and never comes back with installation_id.
+  // Reinstall-same-account predicate: when the signed-in author has
+  // already authorized an installation — on this site or on any other
+  // site they belong to — skip the GitHub round-trip and render the
+  // picker directly. The GitHub redirect is a dead end once the App is
+  // installed on the chosen account: GitHub shows its Configure page
+  // and never comes back with installation_id.
+  //
+  // The scope is the user's sites rather than this one because a GitHub
+  // App installs once per GitHub account. An author connecting their
+  // second blog to the same account has no binding here yet and cannot
+  // create one through GitHub, so site-scoping this check would leave
+  // them with no way in at all.
   //
   // `?force=new` bypasses the predicate so the picker's "Install on
   // another account" action can still reach GitHub to add a fresh
   // install.
   const forceNew = c.req.query("force") === "new";
   if (!forceNew) {
-    const existing =
-      await c.var.services.githubAppInstallations.listInstallationsForSite(
-        c.var.currentSite.id,
+    const userId = requireSessionUserId(c);
+    let existing =
+      await c.var.services.githubAppInstallations.listInstallationsForUser(
+        userId,
       );
+    // An author with nothing to show but a site already syncing through
+    // the App is in the one state the redirect cannot rescue: GitHub
+    // will not install the App a second time on that account. Rebuild
+    // the binding from the sync settings instead of sending them into
+    // the dead end.
+    if (existing.length === 0) {
+      await rebuildInstallationBindings(c, app, userId);
+      existing =
+        await c.var.services.githubAppInstallations.listInstallationsForUser(
+          userId,
+        );
+    }
     if (existing.length > 0) {
       const navData = await getNavigationData(c);
       const base = publicPath(c, "/settings/github-sync");
-      const labels = buildRepoPickerLabels(c);
-      const suggestedRepoName = buildSuggestedRepoName(c);
+      const suggestedRepoName = suggestSyncRepoName(c.var.appConfig.siteUrl);
+      const labels = buildRepoPickerLabels(c, suggestedRepoName);
       return renderPublicPage(c, {
         title: buildPageTitle(
           "GitHub Sync — Pick Repository",
@@ -2209,19 +2291,17 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
     }
   }
 
-  // One-shot: clear the cookie so it can't be replayed.
-  setCookie(c, "jant_gh_app_state", "", {
-    httpOnly: true,
-    sameSite: "Lax",
-    path: "/",
-    maxAge: 0,
-  });
-
   // Fetch the account info for this installation and remember it. The
-  // picker's owner dropdown reads the stored list, so subsequent visits
-  // can switch between accounts without re-running the install flow.
-  // Failures are non-fatal: this callback must still render the picker
-  // so the user isn't locked out right after a successful install.
+  // binding is what every later step reads: the picker's account
+  // dropdown, the endpoints that authorize an installation id, and the
+  // App webhook's fan-out. Rendering the picker without it would show an
+  // empty account list and nothing to pick.
+  //
+  // So a failure here has to stay recoverable, and the only thing that
+  // makes this page replayable is the state cookie — GitHub will not
+  // hand out a second callback for an App that is now installed. Hence
+  // the clearing below sits *after* the binding is written: until then,
+  // reloading this URL is the whole retry.
   try {
     const installation = await getInstallation(app, installationId);
     await c.var.services.githubAppInstallations.upsertInstallation(
@@ -2230,14 +2310,24 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
       installation.account,
     );
   } catch {
-    // Swallow — the legacy inline picker still works with just the
-    // installation_id from the URL, just without the owner list.
+    return c.text(
+      "The App was installed, but GitHub did not answer with the account details. Reload this page to try again.",
+      502,
+    );
   }
 
+  // One-shot: clear the cookie so it can't be replayed.
+  setCookie(c, "jant_gh_app_state", "", {
+    httpOnly: true,
+    sameSite: "Lax",
+    path: "/",
+    maxAge: 0,
+  });
+
   const navData = await getNavigationData(c);
   const base = publicPath(c, "/settings/github-sync");
-  const labels = buildRepoPickerLabels(c);
-  const suggestedRepoName = buildSuggestedRepoName(c);
+  const suggestedRepoName = suggestSyncRepoName(c.var.appConfig.siteUrl);
+  const labels = buildRepoPickerLabels(c, suggestedRepoName);
 
   return renderPublicPage(c, {
     title: buildPageTitle("GitHub Sync — Pick Repository", navData.siteName),
@@ -2253,7 +2343,7 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
           labels={labels}
           api-base={`${base}/app`}
           connect-url={`${base}/app/connect`}
-          install-url={`${base}/app/install`}
+          install-url={`${base}/app/install?force=new`}
           cancel-url={publicPath(c, "/settings")}
           create-repo-name-hint={suggestedRepoName}
         >
@@ -2271,29 +2361,36 @@ settingsRoutes.get("/github-sync/app/callback", async (c) => {
 });
 
 /**
- * Derive a default repository name to prefill on github.com/new.
+ * Values that keep a placeholder literal for the client to fill in.
+ *
+ * `i18n._()` renders a placeholder it has no value for as an empty string, so
+ * a label whose value only exists in the browser — a repo count, the picked
+ * repo — must be formatted with the placeholder's own token as its value.
+ * `{repo}` then survives into the serialized labels and the component's
+ * `.replace("{repo}", …)` finds it.
  *
- * Uses the site's host — the first DNS label is a stable, URL-safe
- * identifier tied to this specific Jant instance. Fallback to
- * "jant-site-sync" when the host parse fails so we never hand GitHub an
- * empty `name=`. The `-jant-sync` suffix disambiguates the sync mirror
- * from a user's own `{slug}-jant` source repo.
+ * @param names - Placeholder names the client interpolates.
+ * @returns A values object mapping each name to its own `{name}` token.
+ * @example
+ * i18n._(msg({ message: "Type {repo} to confirm" }), keepForClient("repo"));
+ * // "Type {repo} to confirm"
  */
-function buildSuggestedRepoName(c: Context<Env>): string {
-  let firstLabel = "";
-  try {
-    firstLabel = new URL(c.var.appConfig.siteUrl).host.split(".")[0] ?? "";
-  } catch {
-    /* fall through */
-  }
-  const slug = firstLabel
-    .toLowerCase()
-    .replace(/[^a-z0-9-_]+/g, "-")
-    .replace(/^-+|-+$/g, "");
-  return slug ? `${slug}-jant-sync` : "jant-site-sync";
+function keepForClient(...names: string[]): Record<string, string> {
+  return Object.fromEntries(names.map((name) => [name, `{${name}}`]));
 }
 
-function buildRepoPickerLabels(c: Context<Env>): string {
+/**
+ * Serialize the picker's strings for the client component.
+ *
+ * @param c - Request context, for the active locale.
+ * @param suggestedRepoName - Repository name prefilled on github.com/new;
+ *   interpolated here because the client cannot format ICU messages.
+ * @returns The labels as a JSON string for the `labels` attribute.
+ */
+function buildRepoPickerLabels(
+  c: Context<Env>,
+  suggestedRepoName: string,
+): string {
   const i18n = getI18n(c);
   return JSON.stringify({
     pageTitle: i18n._(
@@ -2380,6 +2477,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — paginated repo count hint. Placeholders {shown} and {total} are integers.",
       }),
+      keepForClient("shown", "total"),
     ),
     repoSearchHint: i18n._(
       msg({
@@ -2404,10 +2502,12 @@ function buildRepoPickerLabels(c: Context<Env>): string {
     ),
     createOnGitHubHint: i18n._(
       msg({
-        message: "We'll prefill the name {name}. The list refreshes on return.",
+        message:
+          "Name prefilled as {name}. The list refreshes when you return.",
         comment:
           "@context: GitHub sync picker — hint under the create-on-github entry. Placeholder {name} is the suggested repo name.",
       }),
+      { name: suggestedRepoName },
     ),
     classifyLoading: i18n._(
       msg({
@@ -2437,6 +2537,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — blocking message when marker belongs to another site. Placeholder {host} is the other site's host.",
       }),
+      keepForClient("host"),
     ),
     classificationForeign: i18n._(
       msg({
@@ -2459,6 +2560,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — explanatory body for foreign-repo confirmation. Placeholder {repo} is the owner/repo slug.",
       }),
+      keepForClient("repo"),
     ),
     confirmInputLabel: i18n._(
       msg({
@@ -2466,6 +2568,7 @@ function buildRepoPickerLabels(c: Context<Env>): string {
         comment:
           "@context: GitHub sync picker — label above the typed-confirmation input",
       }),
+      keepForClient("repo"),
     ),
     confirmInputPlaceholder: i18n._(
       msg({
@@ -2544,6 +2647,16 @@ settingsRoutes.post("/github-sync/app/connect", async (c) => {
       : c.text("Missing installationId or repo.", 400);
   }
 
+  // The installation has to be one the author already authorized, here
+  // or on another of their sites. The account snapshot also spares us a
+  // GitHub round-trip when recording the binding further down.
+  const installation = await findVisibleInstallation(c, installationId);
+  if (!installation) {
+    return wantsJson
+      ? c.json({ error: "Unknown installation." }, 404)
+      : c.text("Unknown installation.", 404);
+  }
+
   const { parseRepoSlug, createGitHubClient } =
     await import("../../lib/github-api.js");
   const parsed = parseRepoSlug(repo);
@@ -2604,6 +2717,18 @@ settingsRoutes.post("/github-sync/app/connect", async (c) => {
       : c.text(msg, 409);
   }
 
+  // Bind the installation to this site. The callback does this too, but
+  // only for the site that ran the install; connecting a second site to
+  // an installation the author already has is exactly the case that
+  // never passes through there. Without the row, the App-level webhook's
+  // fan-out (uninstall, suspend, repository removed) skips this site
+  // while it happily keeps syncing.
+  await c.var.services.githubAppInstallations.upsertInstallation(
+    installationId,
+    c.var.currentSite.id,
+    installation.account,
+  );
+
   // Persist config before creating webhook so the sync service can load it.
   await c.var.services.settings.set("GITHUB_SYNC_AUTH_MODE", "app");
   await c.var.services.settings.set(
@@ -2688,21 +2813,38 @@ async function getInstallationTokenFromApp(
   return getInstallationToken(app, installationId);
 }
 
-/** List GitHub App installations authorized for this site. */
+/**
+ * List the GitHub App installations the signed-in author may connect
+ * this site to: everything authorized on any site they belong to, this
+ * one included.
+ */
 settingsRoutes.get("/github-sync/app/installations", async (c) => {
   const installations =
-    await c.var.services.githubAppInstallations.listInstallationsForSite(
-      c.var.currentSite.id,
+    await c.var.services.githubAppInstallations.listInstallationsForUser(
+      requireSessionUserId(c),
     );
-  return c.json({
-    installations: installations.map((entry) => ({
-      installationId: entry.installationId,
-      account: entry.account,
-      addedAt: entry.addedAt,
-    })),
-  });
+  return c.json({ installations });
 });
 
+/**
+ * Resolve an `installationId` that arrived in a request into an
+ * installation the caller is allowed to act on.
+ *
+ * Every endpoint below takes the id from the client, and an installation
+ * id is a small integer — without this check a signed-in author on one
+ * site could name another tenant's installation and read their private
+ * repository names, or push this site's content into one of their repos.
+ */
+async function findVisibleInstallation(
+  c: Context<Env>,
+  installationId: string,
+) {
+  return c.var.services.githubAppInstallations.findInstallationForUser(
+    installationId,
+    requireSessionUserId(c),
+  );
+}
+
 /**
  * List (or search) repositories accessible via an installation.
  *
@@ -2727,18 +2869,13 @@ settingsRoutes.get("/github-sync/app/repos", async (c) => {
   const page =
     Number.isFinite(pageParam) && pageParam > 0 ? Math.floor(pageParam) : 1;
 
+  const installation = await findVisibleInstallation(c, installationId);
+  if (!installation) {
+    return c.json({ error: "Unknown installation." }, 404);
+  }
+
   try {
     if (q) {
-      const installations =
-        await c.var.services.githubAppInstallations.listInstallationsForSite(
-          c.var.currentSite.id,
-        );
-      const installation = installations.find(
-        (i) => i.installationId === installationId,
-      );
-      if (!installation) {
-        return c.json({ error: "Unknown installation." }, 404);
-      }
       const result = await searchInstallationRepos(
         app,
         installationId,
@@ -2765,11 +2902,13 @@ settingsRoutes.get("/github-sync/app/repos", async (c) => {
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
     // GitHub returns 401 when an installation was uninstalled on their
-    // side. Clean up our cached entry so the UI stops showing a dead owner.
+    // side. Clean up our cached entries so the UI stops showing a dead
+    // owner — across the user's sites, since the binding that surfaced
+    // this account may well belong to another one of them.
     if (/\b401\b/.test(detail) || /\b404\b/.test(detail)) {
-      await c.var.services.githubAppInstallations.removeInstallation(
+      await c.var.services.githubAppInstallations.removeInstallationForUser(
         installationId,
-        c.var.currentSite.id,
+        requireSessionUserId(c),
       );
       return c.json(
         { error: "Installation is no longer accessible.", removed: true },
@@ -2799,6 +2938,9 @@ settingsRoutes.post("/github-sync/app/classify", async (c) => {
   if (!installationId || !repo) {
     return c.json({ error: "Missing installationId or repo." }, 400);
   }
+  if (!(await findVisibleInstallation(c, installationId))) {
+    return c.json({ error: "Unknown installation." }, 404);
+  }
 
   const { parseRepoSlug, createGitHubClient } =
     await import("../../lib/github-api.js");

package/src/routes/pages/__tests__/post-page-round-trips.test.ts

@@ -0,0 +1,211 @@
+/**
+ * Round-trip budget for the post page.
+ *
+ * On Workers a public page's cost is almost entirely the number of sequential
+ * D1 reads it makes — the same render against local SQLite is about a
+ * millisecond. Serving `/{slug}` used to read `path_registry` twice for one
+ * address and the `post` table four times for one post, and nothing failed
+ * when it did. These tests are that missing failure.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import { createTestApp } from "../../../__tests__/helpers/app.js";
+import { withConfig } from "../../../middleware/config.js";
+import { i18nMiddleware } from "../../../i18n/index.js";
+import { normalizePath, toPublicHref } from "../../../lib/url.js";
+import { pageRoutes } from "../page.js";
+
+/**
+ * Mount the catch-all behind the middleware `createApp()` puts in front of it.
+ *
+ * The stored-redirect middleware is reproduced rather than imported because it
+ * is defined inline in `app.tsx`; what is under test is that it hands its
+ * lookup on and the route takes it, so the stash is the part that must match.
+ */
+function createPostPageApp() {
+  const testApp = createTestApp();
+  const { app } = testApp;
+
+  app.use("*", async (c, next) => {
+    c.set("publicPath", c.req.path);
+    c.set("publicRequestUrl", c.req.url);
+    await next();
+  });
+
+  app.use("*", async (c, next) => {
+    const storedPath = normalizePath(new URL(c.req.url).pathname);
+    const record = await c.var.services.paths.resolve(storedPath);
+    c.set("pathLookup", { path: storedPath, record });
+    if (record?.kind === "redirect" && record.redirectToPath) {
+      return c.redirect(
+        toPublicHref(`/${record.redirectToPath}`),
+        record.redirectType ?? 301,
+      );
+    }
+    await next();
+  });
+  app.use("*", withConfig());
+  app.use("*", i18nMiddleware());
+  app.route("/", pageRoutes);
+
+  return testApp;
+}
+
+/** Every SQL statement prepared while `run` executes. */
+async function captureStatements<T>(
+  sqlite: ReturnType<typeof createTestApp>["sqlite"],
+  run: () => Promise<T>,
+): Promise<[T, string[]]> {
+  const original = sqlite.prepare.bind(sqlite);
+  const statements: string[] = [];
+  const spy = vi.spyOn(sqlite, "prepare").mockImplementation(((
+    source: string,
+  ) => {
+    statements.push(source.replace(/\s+/g, " "));
+    return original(source);
+  }) as typeof sqlite.prepare);
+  try {
+    return [await run(), statements];
+  } finally {
+    spy.mockRestore();
+  }
+}
+
+/** Reads that resolve one address, i.e. filter `path_registry` by `path`. */
+function countAddressLookups(statements: string[]): number {
+  return statements.filter(
+    (sql) =>
+      /from "path_registry"/i.test(sql) &&
+      /"path_registry"\."path" = \?/i.test(sql),
+  ).length;
+}
+
+/** Reads that scan the `post` table. */
+function countPostReads(statements: string[]): number {
+  return statements.filter((sql) => /from "post"/i.test(sql)).length;
+}
+
+describe("post page round trips", () => {
+  it("resolves the requested address once, and keeps its post reads to three", async () => {
+    const { app, services, sqlite } = createPostPageApp();
+    const post = await services.posts.create({
+      format: "note",
+      title: "Budget",
+      bodyMarkdown: "Body",
+      status: "published",
+    });
+
+    const [res, statements] = await captureStatements(sqlite, () =>
+      app.request(`/${post.slug}`),
+    );
+    expect(res.status).toBe(200);
+
+    // The middleware's lookup is the route's lookup.
+    expect(countAddressLookups(statements)).toBe(1);
+
+    // Three reads, and each is for something different: the post with its
+    // canonical alias, its thread, and the thread ids that collection
+    // membership is keyed by. A root post's visibility rides along in its own
+    // row, so nothing goes back for that.
+    expect(countPostReads(statements)).toBe(3);
+  });
+
+  it("redirects a slug to its custom URL without a separate alias lookup", async () => {
+    const { app, services, sqlite } = createPostPageApp();
+    const post = await services.posts.create({
+      format: "note",
+      title: "Renamed",
+      bodyMarkdown: "Body",
+      status: "published",
+    });
+    await services.customUrls.create({
+      path: "renamed-url",
+      targetType: "post",
+      targetId: post.id,
+    });
+
+    const [res, statements] = await captureStatements(sqlite, () =>
+      app.request(`/${post.slug}`),
+    );
+    expect(res.status).toBe(301);
+    expect(res.headers.get("location")).toBe("/renamed-url");
+
+    // The address lookup, and nothing more: the alias came back with the post.
+    expect(countAddressLookups(statements)).toBe(1);
+    expect(countPostReads(statements)).toBe(1);
+  });
+
+  it("takes the newest alias as the canonical address", async () => {
+    const { app, services } = createPostPageApp();
+    const post = await services.posts.create({
+      format: "note",
+      title: "Renamed twice",
+      bodyMarkdown: "Body",
+      status: "published",
+    });
+    await services.customUrls.create({
+      path: "first-name",
+      targetType: "post",
+      targetId: post.id,
+    });
+    await services.customUrls.create({
+      path: "second-name",
+      targetType: "post",
+      targetId: post.id,
+    });
+
+    const res = await app.request(`/${post.slug}`);
+    expect(res.status).toBe(301);
+    expect(res.headers.get("location")).toBe("/second-name");
+  });
+});
+
+describe("post list round trips", () => {
+  it("reads thread-root visibility from the rows it already loaded", async () => {
+    const { services, sqlite } = createTestApp();
+    for (let i = 0; i < 3; i++) {
+      await services.posts.create({
+        format: "note",
+        title: `Post ${i}`,
+        bodyMarkdown: "Body",
+        status: "published",
+      });
+    }
+
+    const [listed, statements] = await captureStatements(sqlite, () =>
+      services.posts.list({ status: "published", excludeReplies: true }),
+    );
+
+    expect(listed).toHaveLength(3);
+    // A list of thread roots carries its own visibility, so the only `post`
+    // read is the list itself.
+    expect(countPostReads(statements)).toBe(1);
+  });
+
+  it("still looks up the root for a reply loaded on its own", async () => {
+    const { services, sqlite } = createTestApp();
+    const root = await services.posts.create({
+      format: "note",
+      title: "Root",
+      bodyMarkdown: "Body",
+      status: "published",
+      visibility: "private",
+    });
+    const reply = await services.posts.create({
+      format: "note",
+      bodyMarkdown: "Reply",
+      replyToId: root.id,
+      status: "published",
+    });
+
+    const [loaded, statements] = await captureStatements(sqlite, () =>
+      services.posts.getById(reply.id),
+    );
+
+    // A reply's own visibility column is null — it inherits the root's — and
+    // the root is not among the rows loaded here, so the second read is what
+    // makes the reply private too.
+    expect(countPostReads(statements)).toBe(2);
+    expect(loaded?.visibility).toBe("private");
+  });
+});