@magland/mochi 0.3.1 → 0.4.0

package/dist/git.js

@@ -4,7 +4,9 @@ exports.GitRepo = exports.GitError = void 0;
 exports.execGit = execGit;
 exports.execGitStatus = execGitStatus;
 exports.isValidRefName = isValidRefName;
+exports.isValidNewRefName = isValidNewRefName;
 exports.isValidRepoPath = isValidRepoPath;
+exports.isValidNewRepoPath = isValidNewRepoPath;
 exports.isValidSha = isValidSha;
 const child_process_1 = require("child_process");
 const MAX_BUFFER = 256 * 1024 * 1024;
@@ -55,6 +57,32 @@ function isValidRefName(ref) {
         return false;
     return true;
 }
+/**
+ * Whether a name may become a new branch or tag. Stricter than isValidRefName,
+ * which stays permissive because it also vets names being looked up:
+ *
+ *   - `HEAD` and git's other pseudo-refs (FETCH_HEAD, MERGE_HEAD, ...) resolve
+ *     ahead of any branch or tag of the same name, so a ref that could be
+ *     created under one would be ambiguous everywhere it is typed and warned
+ *     about on every clone.
+ *   - A `refs/` prefix means the caller pasted a full ref name; creating it
+ *     verbatim would silently nest (refs/heads/refs/heads/x).
+ *   - 200 characters keeps the loose-ref file under every common filesystem's
+ *     255-byte name limit, so a too-long name is refused here with a clear
+ *     message rather than failing inside git.
+ *   - A leading dash could read as an option to a git command.
+ */
+function isValidNewRefName(name) {
+    if (!isValidRefName(name) || name.startsWith('-'))
+        return false;
+    if (name.length > 200)
+        return false;
+    if (name === 'HEAD' || /^[A-Z_]+_HEAD$/.test(name))
+        return false;
+    if (name === 'refs' || name.startsWith('refs/'))
+        return false;
+    return true;
+}
 function isValidRepoPath(p) {
     if (p === '')
         return true;
@@ -64,6 +92,24 @@ function isValidRepoPath(p) {
         return false;
     return p.split('/').every((seg) => seg !== '' && seg !== '.' && seg !== '..');
 }
+/**
+ * Whether a path may be written into a repository. Stricter than
+ * isValidRepoPath, which also vets paths being read and so must keep serving
+ * whatever a repository already holds:
+ *
+ *   - a `.git` component (in any case) is refused, because git itself will
+ *     not take it in a tree and the failure would otherwise surface deep in
+ *     the plumbing rather than as a validation error;
+ *   - a backslash is refused, because a path carrying one cannot be checked
+ *     out on Windows and is almost always a Windows separator pasted whole.
+ */
+function isValidNewRepoPath(p) {
+    if (!isValidRepoPath(p))
+        return false;
+    if (p.includes('\\'))
+        return false;
+    return p.split('/').every((seg) => seg.toLowerCase() !== '.git');
+}
 function isValidSha(s) {
     return /^[0-9a-f]{40}$/i.test(s);
 }
@@ -146,8 +192,65 @@ class GitRepo {
     async catBlob(ref, path) {
         return execGit(this.dir, ['cat-file', 'blob', `${ref}:${path}`]);
     }
+    /**
+     * The blob at a path: its object id and size, or null if there is no blob
+     * there. Asked before catBlob wherever the answer decides whether to read at
+     * all, since catBlob holds the whole object in memory and a repository may
+     * hold objects the size of the machine.
+     */
+    async blobInfo(ref, path) {
+        let out;
+        try {
+            out = (await execGit(this.dir, ['ls-tree', '-z', '-l', ref, '--', path])).toString('utf8');
+        }
+        catch {
+            return null;
+        }
+        // ls-tree lists what the path names; a directory lists its own entry,
+        // typed tree, and is not a blob.
+        const m = out.split('\0')[0]?.match(/^(\S+) (\S+) (\S+) +(\S+)\t/);
+        if (!m || m[2] !== 'blob')
+            return null;
+        const size = parseInt(m[4], 10);
+        return Number.isFinite(size) ? { sha: m[3], size } : null;
+    }
+    /**
+     * Write a blob's bytes to a stream without holding them. Resolves when git
+     * has finished or the destination has gone; rejects only if git could not
+     * start or exited in error before writing anything. A destination that
+     * closes early has git killed rather than left blocked on a full pipe.
+     */
+    streamBlob(ref, path, out) {
+        return new Promise((resolve, reject) => {
+            const child = (0, child_process_1.spawn)('git', ['-C', this.dir, 'cat-file', 'blob', `${ref}:${path}`], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+            });
+            let stderr = '';
+            let wrote = false;
+            child.stderr.on('data', (d) => {
+                if (stderr.length < 4096)
+                    stderr += d.toString();
+            });
+            child.stdout.once('data', () => {
+                wrote = true;
+            });
+            child.stdout.pipe(out, { end: true });
+            out.on('close', () => {
+                if (child.exitCode === null)
+                    child.kill();
+                resolve();
+            });
+            child.on('error', (e) => reject(new GitError(`git cat-file failed: ${e.message}`)));
+            child.on('close', (code) => {
+                if (code === 0 || wrote)
+                    resolve();
+                else
+                    reject(new GitError(`git cat-file failed: ${stderr.trim() || `exit ${code}`}`));
+            });
+        });
+    }
     async log(ref, skip, limit, path, author) {
-        const fmt = '%H%x00%an%x00%aI%x00%s';
+        const fmt = '%H%x00%an%x00%ae%x00%aI%x00%s';
         const args = ['log', `--format=${fmt}`, '-n', String(limit), `--skip=${skip}`];
         // -F makes --author a literal string rather than a pattern, so a name
         // with a dot or a plus in it means itself.
@@ -164,8 +267,8 @@ class GitRepo {
             return [];
         }
         return ls.map((l) => {
-            const [sha, author, date, subject] = l.split('\0');
-            return { sha, author, date, subject: subject ?? '' };
+            const [sha, author, email, date, subject] = l.split('\0');
+            return { sha, author, email, date, subject: subject ?? '' };
         });
     }
     /**
@@ -220,7 +323,7 @@ class GitRepo {
             // Renames are wanted as renames rather than as an add and a delete, so
             // that both names date from the same commit.
             '--find-renames',
-            '--format=%x01%H%x00%an%x00%aI%x00%s',
+            '--format=%x01%H%x00%an%x00%ae%x00%aI%x00%s',
             ref,
             '--',
         ];
@@ -274,13 +377,13 @@ class GitRepo {
             if (!record)
                 continue;
             const parts = record.split('\0');
-            const [sha, author, date, subject] = parts;
+            const [sha, author, email, date, subject] = parts;
             if (!sha)
                 continue;
-            const commit = { sha, author, date, subject: subject ?? '' };
-            // parts[4] onwards is the diff: a status, then the one path it renames
+            const commit = { sha, author, email, date, subject: subject ?? '' };
+            // parts[5] onwards is the diff: a status, then the one path it renames
             // from and to, or the one path it touches.
-            for (let i = 4; i < parts.length; i++) {
+            for (let i = 5; i < parts.length; i++) {
                 const status = parts[i].replace(/^\n/, '');
                 if (!status)
                     continue;
@@ -316,7 +419,10 @@ class GitRepo {
         const fmt = '%H%x00%an%x00%ae%x00%aI%x00%P%x00%B';
         let out;
         try {
-            out = (await execGit(this.dir, ['log', '-1', `--format=${fmt}`, sha, '--'])).toString('utf8');
+            // --end-of-options, so that a revision beginning with a dash is a
+            // revision git fails to find rather than an option it obeys: `--output`
+            // would otherwise write this listing wherever the caller said.
+            out = (await execGit(this.dir, ['log', '-1', `--format=${fmt}`, '--end-of-options', sha, '--'])).toString('utf8');
         }
         catch {
             return null;
@@ -394,6 +500,7 @@ class GitRepo {
                 lines.push({
                     sha: cur.sha ?? '',
                     author: cur.author ?? '',
+                    email: cur.email ?? '',
                     date: cur.time ? new Date(cur.time * 1000).toISOString() : '',
                     summary: cur.summary ?? '',
                     previous: cur.previous ?? null,
@@ -412,6 +519,10 @@ class GitRepo {
             const value = sp === -1 ? '' : line.slice(sp + 1);
             if (key === 'author')
                 cur.author = value;
+            // The porcelain wraps the address in angle brackets; the brackets are
+            // its framing, not part of the address.
+            else if (key === 'author-mail')
+                cur.email = value.replace(/^<|>$/g, '');
             else if (key === 'author-time')
                 cur.time = parseInt(value, 10);
             else if (key === 'summary')
@@ -433,7 +544,7 @@ class GitRepo {
      * a reader almost always means.
      */
     async compare(base, head, limit = 250) {
-        const fmt = '%H%x00%an%x00%aI%x00%s';
+        const fmt = '%H%x00%an%x00%ae%x00%aI%x00%s';
         const [counts, log, patch, mergeBase] = await Promise.all([
             execGit(this.dir, ['rev-list', '--left-right', '--count', `${base}...${head}`])
                 .then((b) => b.toString('utf8').trim().split(/\s+/))
@@ -452,8 +563,8 @@ class GitRepo {
             .split('\n')
             .filter((l) => l !== '')
             .map((l) => {
-            const [sha, author, date, subject] = l.split('\0');
-            return { sha, author, date, subject: subject ?? '' };
+            const [sha, author, email, date, subject] = l.split('\0');
+            return { sha, author, email, date, subject: subject ?? '' };
         });
         return {
             behind: parseInt(counts[0], 10) || 0,
@@ -485,7 +596,7 @@ class GitRepo {
         return people;
     }
     async commitPatch(sha) {
-        return (await execGit(this.dir, ['show', '--format=', '--patch', '--no-color', sha, '--'])).toString('utf8');
+        return (await execGit(this.dir, ['show', '--format=', '--patch', '--no-color', '--end-of-options', sha, '--'])).toString('utf8');
     }
     /**
      * Stream `git archive` for `ref` into `out`, as GitHub's source downloads

package/dist/githttp.js

@@ -38,12 +38,14 @@ exports.checkReadAuth = checkReadAuth;
 exports.checkPushAuth = checkPushAuth;
 exports.registerGitHttp = registerGitHttp;
 const child_process_1 = require("child_process");
+const stream = __importStar(require("stream"));
 const zlib = __importStar(require("zlib"));
 const git_1 = require("./git");
 const jobtoken_1 = require("./jobtoken");
 const ops_1 = require("./ops");
 const perms_1 = require("./perms");
 const scan_1 = require("./scan");
+const sitepublish_1 = require("./sitepublish");
 const limit_1 = require("./limit");
 const vault_1 = require("./vault");
 const web_1 = require("./web");
@@ -168,10 +170,23 @@ function checkPushAuth(root, limiter, req, collection, repoName, repo) {
     if ('ok' in checked)
         return checked;
     const auth = checked.auth;
+    // One refusal, in one wording, for a private repository the credential has
+    // no role in and for a name that does not exist in a collection it may not
+    // create in. The two used to differ -- 404 for the first, 403 naming the
+    // user for the second -- which let any signed-in user list a collection's
+    // private repositories by pushing at guessed names and reading which code
+    // came back. The sentence is true of both: whoever may create in a
+    // collection owns it, and an owner has the admin role on every repository
+    // in it, so nobody who could create here is ever refused a private one.
+    const notFound = {
+        ok: false,
+        status: 404,
+        message: 'repository not found (a push to a name that does not exist creates it only in a collection you own)',
+    };
     if (repo) {
         const role = (0, perms_1.repoRole)(root, auth, repo);
         if (role === null)
-            return { ok: false, status: 404, message: 'repository not found' };
+            return notFound;
         if (!(0, perms_1.atLeast)(role, 'write')) {
             return {
                 ok: false,
@@ -181,13 +196,8 @@ function checkPushAuth(root, limiter, req, collection, repoName, repo) {
         }
         return { ok: true, auth };
     }
-    if (!(0, perms_1.canCreateRepo)(root, auth, collection, repoName)) {
-        return {
-            ok: false,
-            status: 403,
-            message: `user ${auth.username} is not allowed to create ${collection}/${repoName}`,
-        };
-    }
+    if (!(0, perms_1.canCreateRepo)(root, auth, collection, repoName))
+        return notFound;
     return { ok: true, auth };
 }
 // The refs a push may have changed, read before and after receive-pack. A
@@ -305,15 +315,35 @@ function registerGitHttp(app, root, gates, authLimiter, engine) {
         res.setHeader('Content-Type', `application/x-${service}-result`);
         res.setHeader('Cache-Control', 'no-cache');
         const child = (0, child_process_1.spawn)('git', [service.slice(4), '--stateless-rpc', dir], { env: gitEnv(req) });
-        let body = req;
-        if (req.headers['content-encoding'] === 'gzip') {
-            body = req.pipe(zlib.createGunzip());
-        }
-        body.pipe(child.stdin);
+        // The request body reaches git through a pipeline rather than a chain of
+        // pipe() calls, because pipe() leaves an error on the destination with no
+        // listener, and an 'error' nobody listens for ends the process. A body
+        // declared gzip that is not gzip is the case that reaches here from the
+        // network: it is a bad request, and what should die is the request.
+        // Likewise git exiting early, which turns its stdin into an EPIPE for the
+        // writer: the exit code is the answer, and the pipe error is noise.
+        const stages = [req];
+        if (req.headers['content-encoding'] === 'gzip')
+            stages.push(zlib.createGunzip());
+        stream.pipeline([...stages, child.stdin], (err) => {
+            if (err)
+                child.kill();
+        });
         child.stdout.pipe(res);
+        // A client that goes away mid-transfer leaves git writing into a pipe
+        // nobody drains. Node unpipes and pauses the source, which is a git
+        // process blocked forever, holding its packfile in memory, one per
+        // abandoned clone. A response closed without finishing is that case;
+        // one that finished has a git that is already exiting.
+        res.on('close', () => {
+            if (!res.writableFinished)
+                child.kill();
+        });
         child.on('error', () => {
             release();
-            res.status(500).end();
+            if (!res.headersSent)
+                res.status(500);
+            res.end();
         });
         child.on('close', (code) => {
             release();
@@ -359,7 +389,19 @@ function registerGitHttp(app, root, gates, authLimiter, engine) {
                     res.status(400).type('text/plain').send('collection names may not begin with a dot\n');
                     return;
                 }
-                repo = await (0, ops_1.createRepo)(root, collectionName, repoName);
+                // The ops layer applies the rest of what a new name must satisfy
+                // (length, case collisions with existing names); its refusal is an
+                // answer for the pusher, not a failure of the server.
+                try {
+                    repo = await (0, ops_1.createRepo)(root, collectionName, repoName);
+                }
+                catch (e) {
+                    if (e instanceof ops_1.OpError) {
+                        res.status((0, ops_1.opErrorStatus)(e.kind)).type('text/plain').send(`${e.message}\n`);
+                        return;
+                    }
+                    throw e;
+                }
             }
             await advertise(req, res, 'git-receive-pack', repo.dir);
             return;
@@ -397,7 +439,18 @@ function registerGitHttp(app, root, gates, authLimiter, engine) {
                 res.status(400).type('text/plain').send('collection names may not begin with a dot\n');
                 return;
             }
-            repo = await (0, ops_1.createRepo)(root, collectionName, repoName);
+            // As in the advertisement above: the ops layer's refusal of a new
+            // name is an answer for the pusher.
+            try {
+                repo = await (0, ops_1.createRepo)(root, collectionName, repoName);
+            }
+            catch (e) {
+                if (e instanceof ops_1.OpError) {
+                    res.status((0, ops_1.opErrorStatus)(e.kind)).type('text/plain').send(`${e.message}\n`);
+                    return;
+                }
+                throw e;
+            }
         }
         const target = repo;
         const actor = auth.username;
@@ -409,20 +462,24 @@ function registerGitHttp(app, root, gates, authLimiter, engine) {
             if (code !== 0)
                 return;
             ensureHead(target)
-                .then(() => (engine ? firePushEvents(engine, target, before, actor) : undefined))
+                .then(() => firePushEvents(root, engine, target, before, actor))
                 .catch((e) => console.error(`post-receive handling failed: ${e instanceof Error ? e.message : e}`));
         });
     }));
 }
-// Turn a before/after ref snapshot into push events for the CI engine. Ref
-// deletions are reported (with an all-zero "after") and ignored downstream;
-// a workflow file that fails to parse still produces a visible failed run,
-// which is why nothing here filters on content.
-async function firePushEvents(engine, repo, before, actor) {
+// Turn a before/after ref snapshot into push events: a site published from the
+// repository is rewritten when its branch moved, and the CI engine, when there
+// is one, is told about every moved ref. Ref deletions are reported (with an
+// all-zero "after") and ignored downstream; a workflow file that fails to
+// parse still produces a visible failed run, which is why nothing here
+// filters on content.
+async function firePushEvents(root, engine, repo, before, actor) {
     const after = await refSnapshot(repo);
     for (const [ref, sha] of after) {
         if (before.get(ref) === sha)
             continue;
-        await engine.handlePush(repo, { ref, before: before.get(ref) ?? ZERO, after: sha, actor });
+        await (0, sitepublish_1.publishSiteAfterPush)(root, repo, ref);
+        if (engine)
+            await engine.handlePush(repo, { ref, before: before.get(ref) ?? ZERO, after: sha, actor });
     }
 }

package/dist/githubauth.js

@@ -0,0 +1,185 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_SECRET_FILE = void 0;
+exports.overrideGithubEndpointsForTests = overrideGithubEndpointsForTests;
+exports.readGithubSecret = readGithubSecret;
+exports.writeGithubSecret = writeGithubSecret;
+exports.clearGithubSecret = clearGithubSecret;
+exports.githubConfigured = githubConfigured;
+exports.githubAuthorizeUrl = githubAuthorizeUrl;
+exports.exchangeGithubCode = exchangeGithubCode;
+exports.fetchGithubUser = fetchGithubUser;
+exports.isPlausibleGithubLogin = isPlausibleGithubLogin;
+exports.lookupGithubLogin = lookupGithubLogin;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("./config");
+// Sign-in with GitHub: the OAuth code flow against github.com, and the small
+// outbound calls it needs. These are the only requests this server makes to
+// another host, they happen only when an administrator has configured the
+// feature, and nothing GitHub returns is stored: the access token is used for
+// one request -- who signed in -- and dropped, so the vault holds no GitHub
+// token. Who may sign in, and the gh:<id> session binding the callback mints,
+// live in src/vault.ts beside the other credentials; the routes are in
+// src/webops.ts with the other sign-in flows.
+/**
+ * Where the OAuth App's client secret is kept: a mode-600 file beside
+ * `.secret`, because config.json is ordinary vault state and the secret is
+ * not. The client id, which is public, does live in config.json.
+ */
+exports.GITHUB_SECRET_FILE = '.github-secret';
+// The three places the flow talks to, overridable so the tests can stand a
+// local stub in for github.com. Nothing else writes this.
+let endpoints = {
+    authorize: 'https://github.com/login/oauth/authorize',
+    token: 'https://github.com/login/oauth/access_token',
+    api: 'https://api.github.com',
+};
+function overrideGithubEndpointsForTests(next) {
+    endpoints = next;
+}
+function readGithubSecret(root) {
+    try {
+        const secret = fs.readFileSync(path.join(root, exports.GITHUB_SECRET_FILE), 'utf8').trim();
+        return secret === '' ? null : secret;
+    }
+    catch {
+        return null;
+    }
+}
+function writeGithubSecret(root, secret) {
+    fs.writeFileSync(path.join(root, exports.GITHUB_SECRET_FILE), secret.trim() + '\n', { mode: 0o600 });
+}
+function clearGithubSecret(root) {
+    fs.rmSync(path.join(root, exports.GITHUB_SECRET_FILE), { force: true });
+}
+/** Whether sign-in with GitHub can work here: a client id and a stored secret. */
+function githubConfigured(root) {
+    return (0, config_1.loadConfig)(root).auth.githubClientId !== '' && readGithubSecret(root) !== null;
+}
+/** Where the sign-in redirect sends the browser. No scopes are requested: the
+ * callback asks /user for the id and login, which a scopeless token can read. */
+function githubAuthorizeUrl(clientId, redirectUri, state) {
+    const u = new URL(endpoints.authorize);
+    u.searchParams.set('client_id', clientId);
+    u.searchParams.set('redirect_uri', redirectUri);
+    u.searchParams.set('state', state);
+    return u.toString();
+}
+const FETCH_TIMEOUT_MS = 10000;
+// GitHub's API refuses requests that carry no User-Agent.
+const USER_AGENT = 'mochi-forge';
+/** Trade the callback's code for an access token. Null on any refusal or
+ * network failure; the caller has one message for all of them, since the
+ * person at the browser can do the same thing about each: try again. */
+async function exchangeGithubCode(opts) {
+    try {
+        const res = await fetch(endpoints.token, {
+            method: 'POST',
+            headers: {
+                accept: 'application/json',
+                'content-type': 'application/x-www-form-urlencoded',
+                'user-agent': USER_AGENT,
+            },
+            body: new URLSearchParams({
+                client_id: opts.clientId,
+                client_secret: opts.clientSecret,
+                code: opts.code,
+                redirect_uri: opts.redirectUri,
+            }),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        return typeof body.access_token === 'string' && body.access_token !== '' ? body.access_token : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Who the access token belongs to. The token's only use; it is not kept. */
+async function fetchGithubUser(accessToken) {
+    try {
+        const res = await fetch(`${endpoints.api}/user`, {
+            headers: {
+                accept: 'application/vnd.github+json',
+                authorization: `Bearer ${accessToken}`,
+                'user-agent': USER_AGENT,
+            },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        return asGithubUser(await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+/** A GitHub login: alphanumeric with interior hyphens, at most 39 characters.
+ * Checked before a lookup so a stray path or an @handle is refused with a
+ * message rather than sent to the API inside a URL. */
+function isPlausibleGithubLogin(login) {
+    return /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(login);
+}
+/**
+ * Resolve a login to its stable numeric id, over GitHub's public,
+ * unauthenticated API. Called once per approval an administrator adds, which
+ * sits far under that API's rate limit.
+ */
+async function lookupGithubLogin(login) {
+    try {
+        const res = await fetch(`${endpoints.api}/users/${encodeURIComponent(login)}`, {
+            headers: { accept: 'application/vnd.github+json', 'user-agent': USER_AGENT },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        return asGithubUser(await res.json());
+    }
+    catch {
+        return null;
+    }
+}
+function asGithubUser(body) {
+    if (typeof body !== 'object' || body === null)
+        return null;
+    const rec = body;
+    if (typeof rec.id !== 'number' || typeof rec.login !== 'string')
+        return null;
+    return { id: Math.floor(rec.id), login: rec.login };
+}

package/dist/icons.js

@@ -43,6 +43,7 @@ const PATHS = {
     clock: '<circle cx="12" cy="12" r="9"/><path d="M12 6.8V12L15.6 14.1"/>',
     sync: '<path d="M12 3.5a8.5 8.5 0 1 1-8.5 8.5"/><path d="M1.9 14.6 3.5 12 5.1 14.6"/>',
     kebab: `${DOT(5, 12)}${DOT(12, 12)}${DOT(19, 12)}`,
+    info: `<circle cx="12" cy="12" r="9"/>${DOT(12, 7.8, 1.2)}<path d="M12 11.2V16.6"/>`,
     // Repositories and their contents.
     repo: '<rect x="4" y="3" width="16" height="18" rx="2.5"/><path d="M8.5 3V21"/>',
     'repo-forked': '<circle cx="6" cy="5" r="2.5"/><circle cx="18" cy="5" r="2.5"/><circle cx="12" cy="19" r="2.5"/><path d="M6 7.5v1.5a3 3 0 0 0 3 3h6a3 3 0 0 0 3-3V7.5M12 12v4.5"/>',
@@ -55,6 +56,9 @@ const PATHS = {
     package: '<path d="M3.2 7.2 12 2.4l8.8 4.8v9.6L12 21.6l-8.8-4.8Z"/><path d="M3.2 7.2 12 12l8.8-4.8M12 12v9.6"/>',
     tag: '<path d="M13.6 3.6A2 2 0 0 0 12.2 3H5a2 2 0 0 0-2 2v7.2a2 2 0 0 0 .6 1.4l7.2 7.2a2 2 0 0 0 2.8 0l7.2-7.2a2 2 0 0 0 0-2.8Z"/><circle cx="7.6" cy="7.6" r="1.4"/>',
     law: '<path d="M12 4V21M8 21h8M4.5 7.5 12 6l7.5 1.5"/><path d="M4.5 7.5 2 13a2.5 2.5 0 0 0 5 0Z"/><path d="M19.5 7.5 17 13a2.5 2.5 0 0 0 5 0Z"/>',
+    lock: `<rect x="5" y="11" width="14" height="9" rx="2"/><path d="M8.5 11V7.5a3.5 3.5 0 0 1 7 0V11"/>${DOT(12, 15.5)}`,
+    eye: '<path d="M2.5 12S6 5.5 12 5.5 21.5 12 21.5 12 18 18.5 12 18.5 2.5 12 2.5 12Z"/><circle cx="12" cy="12" r="2.8"/>',
+    'eye-off': '<path d="M2.5 12S6 5.5 12 5.5c1.6 0 3 .4 4.3 1.1M20 8.5c.9 1.9 1.5 3.5 1.5 3.5S18 18.5 12 18.5c-1.6 0-3-.4-4.3-1.1"/><path d="M9.9 14.1a2.8 2.8 0 0 1 4-4"/><path d="M4 20 20 4"/>',
     // The git graph.
     'git-commit': '<circle cx="12" cy="12" r="3.6"/><path d="M2.5 12h5.9M15.6 12h5.9"/>',
     'git-branch': '<circle cx="6" cy="18.5" r="2.5"/><circle cx="18" cy="6" r="2.5"/><path d="M6 16V3M18 8.5a9.5 9.5 0 0 1-9.5 9.5H8"/>',
@@ -70,6 +74,16 @@ const PATHS = {
     filter: '<path d="M3.5 6.5h17M6.5 12h11M10 17.5h4"/>',
     search: '<circle cx="10.5" cy="10.5" r="6.5"/><path d="M15.2 15.2 20.5 20.5"/>',
     link: '<path d="M9.5 14.5 14.5 9.5"/><path d="M10.5 6.6 12.3 4.8a4.5 4.5 0 0 1 6.4 6.4l-1.8 1.8"/><path d="M13.5 17.4 11.7 19.2a4.5 4.5 0 0 1-6.4-6.4l1.8-1.8"/>',
+    // The markdown toolbar. Letterforms and list marks, drawn in the same
+    // monoline stroke as everything else rather than borrowed from a text face.
+    heading: '<path d="M5.5 5v14M18.5 5v14M5.5 12h13"/>',
+    bold: '<path d="M7.5 5.5V18.5"/><path d="M7.5 5.5h5.2a3.25 3.25 0 0 1 0 6.5H7.5"/><path d="M7.5 12h6.2a3.25 3.25 0 0 1 0 6.5H7.5"/>',
+    italic: '<path d="M10.5 5.5h7M6.5 18.5h7M14 5.5 10 18.5"/>',
+    strikethrough: '<path d="M4 12h16"/><path d="M16.6 7.4C16 6 14.2 5 12 5 9.5 5 7.6 6.3 7.6 8.2c0 1.4 1 2.3 2.9 2.9"/><path d="M7.4 16.6C8 18 9.8 19 12 19c2.5 0 4.4-1.3 4.4-3.2 0-.6-.2-1.1-.5-1.5"/>',
+    quote: '<path d="M4.5 5.5v13"/><path d="M9.5 7.5h11M9.5 12h8M9.5 16.5h11"/>',
+    'list-unordered': `${DOT(4.5, 6)}${DOT(4.5, 12)}${DOT(4.5, 18)}<path d="M9.5 6h11M9.5 12h11M9.5 18h11"/>`,
+    'list-ordered': '<path d="M4.2 5.6 6.1 4.2V9.5"/><path d="M4.2 15.2a1.9 1.9 0 0 1 3.7.6c0 1.4-3.7 2.2-3.7 4h3.9"/><path d="M11 6.5h9.5M11 17.5h9.5"/>',
+    tasklist: '<rect x="3.5" y="3.5" width="7" height="7" rx="1.8"/><path d="M5.7 7.2 6.9 8.4 8.8 6"/><path d="M14 7h6.5"/><rect x="3.5" y="13.5" width="7" height="7" rx="1.8"/><path d="M14 17h6.5"/>',
     // People.
     person: '<circle cx="12" cy="8" r="3.6"/><path d="M4.5 20.5a7.5 7.5 0 0 1 15 0"/>',
     people: '<circle cx="8.6" cy="8" r="3.2"/><circle cx="17" cy="8.8" r="2.4"/><path d="M2.6 19.5a6 6 0 0 1 12 0"/><path d="M16.2 14.2a5.6 5.6 0 0 1 5.2 5.3"/>',