@magland/mochi 0.3.1 → 0.4.0

package/dist/runner-cli.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runnerListCommand = void 0;
 exports.runnerAddCmd = runnerAddCmd;
+exports.runnerEditCmd = runnerEditCmd;
 exports.runnerWakeCmd = runnerWakeCmd;
 exports.runnerRemoveCmd = runnerRemoveCmd;
 exports.runnerRunCmd = runnerRunCmd;
@@ -31,6 +32,23 @@ function parseDuration(text) {
     const unit = (m[2] ?? 's').toLowerCase();
     return unit === 'h' ? n * 3600 : unit === 'm' ? n * 60 : n;
 }
+/**
+ * "20", "45m", "2h" -> minutes, for the job timeout.
+ *
+ * Separate from parseDuration above, and in a different unit, because a bare
+ * number means different things in the two places: seconds is the natural
+ * reading of --idle and the wrong reading of a job timeout, which an operator
+ * states in minutes.
+ */
+function parseTimeoutMinutes(text) {
+    const m = /^(\d+)\s*(m|h)?$/i.exec(text.trim());
+    if (!m) {
+        console.error(`--job-timeout takes minutes, or a duration like 45m or 2h, got: ${text}`);
+        process.exit(1);
+    }
+    const n = parseInt(m[1], 10);
+    return (m[2] ?? 'm').toLowerCase() === 'h' ? n * 60 : n;
+}
 function parseArgs(args, usage) {
     const out = {
         name: null,
@@ -42,6 +60,9 @@ function parseArgs(args, usage) {
         images: {},
         workDir: null,
         network: null,
+        jobMemory: null,
+        jobCpus: null,
+        jobPids: null,
         cacheDir: null,
         actionsUrl: null,
         actionCache: true,
@@ -51,6 +72,7 @@ function parseArgs(args, usage) {
         wakeSecret: null,
         wakeUrl: null,
         clear: false,
+        jobTimeout: null,
         engine: null,
     };
     const list = (v) => v.split(/[\s,]+/).filter((s) => s.length > 0);
@@ -78,6 +100,27 @@ function parseArgs(args, usage) {
             out.actionCache = false;
         else if (a === '--network')
             out.network = args[++i];
+        else if (a === '--job-memory' || a === '--job-cpus') {
+            // Passed through to the engine as written, which is the authority on
+            // what "2g" or "1.5" means; only an empty value is refused here.
+            const v = (args[++i] ?? '').trim();
+            if (!/^[0-9][0-9.]*[bkmgBKMG]?$/.test(v)) {
+                console.error(`${a} takes a number, as docker run does (${a === '--job-memory' ? '2g, 512m' : '2, 0.5'}), got: ${v}`);
+                process.exit(1);
+            }
+            if (a === '--job-memory')
+                out.jobMemory = v;
+            else
+                out.jobCpus = v;
+        }
+        else if (a === '--job-pids') {
+            const n = parseInt(args[++i] ?? '', 10);
+            if (!Number.isInteger(n) || n < 0) {
+                console.error('--job-pids takes a number of processes, or 0 for no limit');
+                process.exit(1);
+            }
+            out.jobPids = n;
+        }
         else if (a === '--idle')
             out.idleSeconds = parseDuration(args[++i] ?? '');
         else if (a === '--wake-port') {
@@ -94,6 +137,13 @@ function parseArgs(args, usage) {
             out.wakeUrl = args[++i];
         else if (a === '--clear')
             out.clear = true;
+        else if (a === '--job-timeout') {
+            // Empty (or the word 'default') puts the runner back on the vault's
+            // default, which is a real answer and not a missing one; anything else
+            // is minutes, or a duration for an operator who thinks in hours.
+            const raw = (args[++i] ?? '').trim();
+            out.jobTimeout = raw === '' || raw === 'default' ? 'default' : parseTimeoutMinutes(raw);
+        }
         else if (a === '--save')
             out.save = true;
         else if (a === '--engine') {
@@ -150,11 +200,16 @@ async function runnerAddCmd(args, usage) {
         name: a.name,
         labels,
         allow: a.allow,
+        ...(typeof a.jobTimeout === 'number' ? { jobTimeoutMinutes: a.jobTimeout } : {}),
         ...(wake ? { wakeUrl: wake.url, wakeSecret: wake.secret } : {}),
     });
     console.log(`Registered runner ${data.name}`);
     console.log(`  labels:  ${data.labels.join(', ')}`);
     console.log(`  serving: ${data.allow.join(', ')}`);
+    // A vault older than the setting reports no timeout, and saying nothing is
+    // better than reporting a default this CLI only assumes it has.
+    if (data.jobTimeout !== undefined)
+        console.log(`  timeout: ${String(data.jobTimeout)} minutes per job`);
     if (wake)
         console.log(`  wake:    ${wake.url}`);
     console.log('');
@@ -191,6 +246,34 @@ async function runnerAddCmd(args, usage) {
     }
     console.log('');
 }
+/**
+ * `mochi runner edit <name> --job-timeout <d>`: change what a registered runner
+ * is allowed to do, which for now is how long a job may run on it.
+ *
+ * Its labels and allow list are deliberately not here: both decide which jobs
+ * a machine may take, and changing them under a runner that is already trusted
+ * with a set of repositories is a re-registration rather than an edit.
+ */
+async function runnerEditCmd(args, usage) {
+    const a = parseArgs(args, usage);
+    if (!a.name) {
+        console.error('Which runner? Usage: mochi runner edit <name> --job-timeout <minutes>');
+        process.exit(1);
+    }
+    if (a.jobTimeout === null) {
+        console.error("Nothing to change. Pass --job-timeout <minutes>, or --job-timeout '' for the default.");
+        process.exit(1);
+    }
+    const target = await (0, cli_api_1.remoteTarget)(a);
+    const data = await (0, cli_api_1.api)(target, 'PATCH', `/api/runners/${encodeURIComponent(a.name)}`, {
+        jobTimeoutMinutes: a.jobTimeout === 'default' ? null : a.jobTimeout,
+    });
+    const minutes = Number(data.jobTimeout);
+    console.log(data.jobTimeoutMinutes === null
+        ? `Runner ${a.name} is back on the vault's default job timeout of ${minutes} minutes.`
+        : `Jobs on ${a.name} now stop after ${minutes} minute${minutes === 1 ? '' : 's'}.`);
+    console.log('Applies to the next job it takes; one already running keeps the timeout it started with.');
+}
 /**
  * `mochi runner wake <name>`: send the wake request, or change where it goes.
  *
@@ -292,6 +375,7 @@ is the usual reason a run sits at queued forever.`,
                 r.name,
                 `labels: ${r.labels.join(', ') || '(none)'}`,
                 `serving: ${r.allow.join(', ') || '(none)'}`,
+                r.jobTimeout === undefined ? '' : `timeout: ${r.jobTimeout}m`,
                 // A vault older than liveness reporting leaves both out, and saying
                 // "seen never" of a runner that may be perfectly healthy would be
                 // worse than saying nothing.
@@ -360,6 +444,11 @@ async function runnerRunCmd(args, usage) {
         images: { ...client_1.DEFAULT_IMAGES, ...(saved?.images ?? {}), ...a.images },
         workDir: a.workDir ?? saved?.workDir,
         network: a.network ?? saved?.network,
+        limits: {
+            memory: a.jobMemory ?? saved?.limits?.memory,
+            cpus: a.jobCpus ?? saved?.limits?.cpus,
+            pids: a.jobPids ?? saved?.limits?.pids,
+        },
         cacheDir: a.cacheDir ?? saved?.cacheDir,
         actionsUrl: a.actionsUrl ?? saved?.actionsUrl,
         actionCache: a.actionCache && (saved?.actionCache ?? true),

package/dist/scan.js

@@ -33,10 +33,12 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.repoSiblingSuffixes = void 0;
+exports.repoSiblingSuffixes = exports.MAX_NAME_LENGTH = void 0;
 exports.isValidName = isValidName;
 exports.isDotName = isDotName;
 exports.isValidUserName = isValidUserName;
+exports.collectionCaseClash = collectionCaseClash;
+exports.repoCaseClash = repoCaseClash;
 exports.reservedRepoSuffix = reservedRepoSuffix;
 exports.isBareRepo = isBareRepo;
 exports.displayName = displayName;
@@ -45,11 +47,13 @@ exports.listCollections = listCollections;
 exports.findRepo = findRepo;
 exports.siteDir = siteDir;
 exports.forkParent = forkParent;
+exports.upstreamOf = upstreamOf;
 exports.repoDescription = repoDescription;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const git_1 = require("./git");
 const layout_1 = require("./layout");
+const source_1 = require("./source");
 // Names the UI owns as top-level path segments. None of these may ever be a
 // collection or repo name, since a collection is reached at /<collection> and
 // a repository at /<collection>/<repo>. The vault's own files are not among
@@ -67,6 +71,7 @@ const RESERVED_NAMES = new Set([
     'import',
     'admin',
     'settings',
+    'topics',
 ]);
 function isValidName(name) {
     if (RESERVED_NAMES.has(name))
@@ -96,7 +101,41 @@ function isDotName(name) {
  * created, since only a repository may carry one.
  */
 function isValidUserName(name) {
-    return isValidName(name) && !isDotName(name);
+    return isValidName(name) && !isDotName(name) && name.length <= exports.MAX_NAME_LENGTH;
+}
+/**
+ * The longest name a collection, repository, or user may be created under.
+ * Far below any filesystem limit on purpose: the interface has to render
+ * these, and the on-disk form carries suffixes (`<name>.git`, `<name>.issues`)
+ * that a name near the 255-byte filename limit would push over it. Enforced
+ * only where a name comes into being; reading stays permissive, so a vault
+ * that somehow holds a longer one still serves it.
+ */
+exports.MAX_NAME_LENGTH = 100;
+/**
+ * The existing collection whose name matches `name` apart from letter case, or
+ * null when none does (an exact match does not count). Creation refuses such a
+ * near-duplicate: two collections telling apart only by case are confusing in
+ * every listing and cannot coexist on a case-insensitive filesystem, which is
+ * where a vault copied to macOS or Windows would find itself.
+ */
+function collectionCaseClash(root, name) {
+    const lower = name.toLowerCase();
+    for (const c of listCollections(root)) {
+        if (c.name !== name && c.name.toLowerCase() === lower)
+            return c.name;
+    }
+    return null;
+}
+/** As collectionCaseClash, for a repository name within one collection. */
+function repoCaseClash(root, collection, name) {
+    const lower = name.toLowerCase();
+    for (const d of listRepoDirs(root, collection)) {
+        const existing = displayName(d);
+        if (existing !== name && existing.toLowerCase() === lower)
+            return existing;
+    }
+    return null;
 }
 // The directories a repository accumulates beside its bare repository, by the
 // suffix each one carries. Every feature has its own helper for the directory
@@ -218,6 +257,23 @@ function forkParent(dir) {
         return null;
     return { collection, repo };
 }
+/**
+ * The URL outside this vault the repository was forked from, or null. Written
+ * by `mochi fork` as `mochi.upstream` and read the same way forkParent is:
+ * out of the config file directly, since this too is asked on page renders.
+ * A stored value that parseUpstream rejects reads as no upstream.
+ */
+function upstreamOf(dir) {
+    let text;
+    try {
+        text = fs.readFileSync(path.join(dir, 'config'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const m = text.match(/^\s*upstream\s*=\s*(\S+)\s*$/m);
+    return m ? (0, source_1.parseUpstream)(m[1]) : null;
+}
 function repoDescription(dir) {
     try {
         const t = fs.readFileSync(path.join(dir, 'description'), 'utf8').trim();

package/dist/server.js

@@ -60,15 +60,18 @@ const releases_1 = require("./releases");
 const lfsstore_1 = require("./lfsstore");
 const layout_1 = require("./layout");
 const logo_1 = require("./logo");
+const maintenance_1 = require("./maintenance");
 const migrate_1 = require("./migrate");
 const perms_1 = require("./perms");
 const redirects_1 = require("./redirects");
 const scan_1 = require("./scan");
+const topics_1 = require("./topics");
 const session_1 = require("./session");
 const site_1 = require("./site");
-const siteshost_1 = require("./siteshost");
+const domains_1 = require("./domains");
 const assets_1 = require("./assets");
 const pagescript_1 = require("./pagescript");
+const agescript_1 = require("./agescript");
 const themes_1 = require("./themes");
 const views = __importStar(require("./views"));
 const webops_1 = require("./webops");
@@ -130,6 +133,14 @@ function isCompressible(req, res) {
  * obtained from a signed-in reader who thought they were clicking something of
  * the framing page's. base-uri and form-action close the two ways injected
  * markup could redirect a relative URL or a form post without running script.
+ *
+ * form-action names github.com beside 'self' because browsers apply the
+ * directive to a redirect that follows a form submission, not only to the
+ * form's own target: the account page's "Link a GitHub account" form posts to
+ * this vault, whose answer is a redirect to GitHub's authorize page (see
+ * src/webops.ts), and without the entry the browser blocks that redirect. An
+ * injected form is not helped by it: posting to github.com carries nothing of
+ * the vault's, and the sign-in cookie in particular never leaves 'self'.
  */
 const FORGE_CSP = [
     "default-src 'self'",
@@ -140,13 +151,13 @@ const FORGE_CSP = [
     "connect-src 'self'",
     "object-src 'none'",
     "base-uri 'none'",
-    "form-action 'self'",
+    "form-action 'self' https://github.com",
     "frame-ancestors 'self'",
 ].join('; ');
 function isRateExempt(root, req) {
     if (req.path.startsWith('/api/runner/'))
         return true;
-    if ((0, siteshost_1.isUnderSitesHost)((0, config_1.loadConfig)(root).sites.host, req.hostname))
+    if ((0, domains_1.isSiteRequest)(root, req.hostname))
         return false;
     return req.path.startsWith('/assets/') || req.path === '/favicon.svg' || req.path === '/favicon.ico';
 }
@@ -167,8 +178,19 @@ function createApp(root) {
         for (const note of permNotes)
             console.log(`permissions: ${note}`);
     }
+    // And a vault from before force pushes were allowed, whose repositories
+    // would otherwise go on refusing them while every new one accepted them.
+    const unfrozen = (0, migrate_1.migratePushPolicy)(root);
+    if (unfrozen.length > 0) {
+        console.log(`push policy: force pushes now allowed on ${unfrozen.join(', ')}`);
+    }
     const app = (0, express_1.default)();
     app.disable('x-powered-by');
+    // Node's own querystring rather than the qs package express 4 defaults to.
+    // Nothing here reads a nested query (?a[b]=c), and qs is where express 4's
+    // open advisories live: the parser runs on every anonymous request, so the
+    // package is better not run at all than trusted to be patched in time.
+    app.set('query parser', 'simple');
     const config = (0, config_1.loadConfig)(root);
     // Behind a TLS proxy (Caddy, Fly, etc.) X-Forwarded-Proto/Host must win, or
     // clone URLs and Secure cookies would use the internal address. On a vault
@@ -182,7 +204,14 @@ function createApp(root) {
     // internet is trusted is a restart-worthy event in a way that changing a
     // colour scheme is not. The same goes for the limits below, which hold live
     // counts that cannot be rebuilt per request without discarding them.
-    app.set('trust proxy', config.network.trustProxy);
+    //
+    // One hop, not `true`: with `true`, req.ip is the leftmost address in
+    // X-Forwarded-For, which is whatever the client wrote there when the proxy
+    // appends to the header rather than replacing it (Fly's and nginx's do),
+    // and every per-address limit would be the client's to choose again. One
+    // hop is the address the proxy itself saw, the last in the list, which is
+    // right both for a proxy that appends and for one that replaces (Caddy's).
+    app.set('trust proxy', config.network.trustProxy ? 1 : false);
     // Outgoing bytes, counted per repository and capped per day. The cap is read
     // through loadConfig on every call rather than captured here, unlike the rest
     // of the limits block: it is the one limit whose value an operator needs to
@@ -252,7 +281,8 @@ function createApp(root) {
     // Sites served from their own hostname are answered before every other route,
     // the asset routes included: otherwise /assets/style.css would give a site the
     // forge's stylesheet instead of its own, and /favicon.svg the forge's icon.
-    // Nothing here runs unless a sites host is configured.
+    // Nothing here runs unless a sites host is configured or a custom domain is
+    // mapped in domains.json.
     (0, site_1.registerSiteHost)(app, root);
     // The forge's own pages may only be framed by the forge. A CSRF token and the
     // Origin check in src/session.ts refuse a request forged from somewhere else,
@@ -269,6 +299,14 @@ function createApp(root) {
     // ordinary for a static site and no business of the forge's.
     app.use((_req, res, next) => {
         res.setHeader('Content-Security-Policy', FORGE_CSP);
+        // On every response, not only the raw file routes that already carried it:
+        // nothing the forge serves relies on type sniffing, so there is no reason
+        // to leave any response open to it.
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        // The browser's own default, stated explicitly so a link out of a private
+        // vault never carries a path in its referrer whatever the browser's
+        // settings say.
+        res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
         next();
     });
     // Then, before any route that resolves a name: an address a rename left
@@ -303,6 +341,19 @@ function createApp(root) {
             .set('X-Content-Type-Options', 'nosniff')
             .send(script.body);
     });
+    // The encrypted-file script, on the same terms again. It is ~300 KB of
+    // vendored cryptography plus its glue, which is why only the pages that
+    // need it link it (see PageOpts.ageScript) and why the immutable caching
+    // matters more here than anywhere.
+    app.get('/assets/age.js', (req, res) => {
+        const script = (0, agescript_1.ageScript)();
+        const fresh = String(req.query.v ?? '') === script.tag;
+        res
+            .type('text/javascript')
+            .set('Cache-Control', fresh ? 'public, max-age=31536000, immutable' : 'no-cache')
+            .set('X-Content-Type-Options', 'nosniff')
+            .send(script.body);
+    });
     app.get('/assets/hl.css', (req, res) => {
         // Code colours are a whole stylesheet rather than a set of tokens, so the
         // reader's theme picks a file instead of an attribute. The name still
@@ -321,23 +372,26 @@ function createApp(root) {
         }
         res.type('text/css').set('Cache-Control', 'public, max-age=86400').send(css);
     });
-    // Every repository the interface would show this viewer anyway, as a list
-    // of names, for the jump box to search without a round trip per keystroke.
-    // It says no more than the front page already does to the same eyes: a
-    // private repository is listed only for a viewer with a role there, which
-    // is also why the answer is marked private to shared caches. It is not
-    // /api/repos, which is the authenticated interface for programs and carries
-    // much more per repository than a name.
+    // Every repository the interface would show this viewer anyway, as names
+    // and topics, for the jump box to search without a round trip per
+    // keystroke. It says no more than the front page already does to the same
+    // eyes: a private repository is listed only for a viewer with a role there,
+    // which is also why the answer is marked private to shared caches. It is
+    // not /api/repos, which is the authenticated interface for programs and
+    // carries much more per repository. Topics ride along only where a
+    // repository has them, so the common entry stays one name.
     app.get('/assets/repos.json', (req, res) => {
         const viewer = (0, session_1.getViewer)(req, root);
         const repos = [];
         for (const c of (0, scan_1.listCollections)(root)) {
             for (const d of (0, scan_1.listRepoDirs)(root, c.name)) {
                 const name = (0, scan_1.displayName)(d);
-                if ((0, perms_1.repoRole)(root, viewer?.auth ?? null, { collection: c.name, name, dir: (0, layout_1.repoPath)(root, c.name, d) }) === null) {
+                const dir = (0, layout_1.repoPath)(root, c.name, d);
+                if ((0, perms_1.repoRole)(root, viewer?.auth ?? null, { collection: c.name, name, dir }) === null) {
                     continue;
                 }
-                repos.push(`${c.name}/${name}`);
+                const topics = (0, topics_1.repoTopics)(dir);
+                repos.push(topics.length ? { name: `${c.name}/${name}`, topics } : { name: `${c.name}/${name}` });
             }
         }
         res.set('Cache-Control', 'private, no-cache').json(repos);
@@ -378,11 +432,24 @@ function createApp(root) {
     // The CI engine plans and schedules workflow runs; jobs execute on runners
     // elsewhere (mochi runner run), never in this process.
     const engine = new engine_1.CiEngine(root, () => (0, config_1.loadConfig)(root).ci);
+    // Unreachable objects, from a force push or a branch deleted or a history
+    // rewritten, are collected on a slow timer with a generous grace period. See
+    // src/maintenance.ts for why it is safe to run beside live traffic.
+    (0, maintenance_1.startMaintenance)(root);
     // A runner that stops when it has nothing to do cannot be told that it has
     // something to do, so the vault starts it: this watches for a queued job
     // whose runner is not connected and pokes that runner's wake address.
     // Runners without one are unaffected, which is all of them by default.
     (0, wake_1.startWakeDispatcher)(root, engine);
+    // Sliding sessions: a session cookie seen in the second half of its life is
+    // re-issued with a fresh expiry, so regular use never runs into a sign-out.
+    // Registered after the asset routes above on purpose -- several of them are
+    // publicly cacheable, and a Set-Cookie must never ride on a response a
+    // shared cache may store and replay to someone else.
+    app.use((req, res, next) => {
+        (0, session_1.renewSession)(req, res, root);
+        next();
+    });
     // Registration order matters: the API and the UI-owned top-level paths
     // (/login, /new, /admin, ...) come before the generic /:collection and /:collection/:repo
     // browse routes, and more-specific wildcard routes before their prefixes.
@@ -405,20 +472,34 @@ function createApp(root) {
         res.status(404).type('html').send(views.errorPage(404, 'Page not found', { viewer: (0, session_1.getViewer)(req, root) }));
     });
     app.use((err, req, res, _next) => {
-        console.error(err);
-        if (!res.headersSent) {
-            let viewer = null;
-            try {
-                viewer = (0, session_1.getViewer)(req, root);
-            }
-            catch {
-                viewer = null;
-            }
-            res.status(500).type('html').send(views.errorPage(500, 'Internal server error', { viewer }));
-        }
-        else {
+        if (res.headersSent) {
+            console.error(err);
             res.end();
+            return;
+        }
+        let viewer = null;
+        try {
+            viewer = (0, session_1.getViewer)(req, root);
+        }
+        catch {
+            viewer = null;
         }
+        // The body parsers throw typed errors carrying the status they deserve --
+        // a body over the route's limit, a malformed encoding, an aborted upload.
+        // Those are refusals of the request, not failures of the server, so they
+        // get their status and a sentence a person can act on rather than the bare
+        // 500 below.
+        const status = err.statusCode ?? err.status;
+        const type = err.type;
+        if (typeof status === 'number' && status >= 400 && status < 500) {
+            const message = type === 'entity.too.large'
+                ? 'What you submitted is larger than this form accepts. Files this size can go through the Upload files form, or a git push.'
+                : 'The request could not be read; go back and try again.';
+            res.status(status).type('html').send(views.errorPage(status, message, { viewer }));
+            return;
+        }
+        console.error(err);
+        res.status(500).type('html').send(views.errorPage(500, 'Internal server error', { viewer }));
     });
     return app;
 }