@magland/mochi 0.3.1 → 0.4.1

package/README.md

@@ -4,7 +4,7 @@ A self-hosted git forge, GitHub-shaped: repository browsing, in-browser editing,
 
 Mochi Forge is usually shortened to *mochi*, which is how the command, the npm package, and the vault's own files are spelled.
 
-Reading is anonymous, unless a repository is made private, in which case it is visible only to its collaborators, its collection's owners, and site admins. Every write is authorized by a token, and users are created by an administrator rather than registering themselves. Permissions are GitHub-shaped: a user owns the collection named after them, repositories take collaborators with read, write, or admin roles, and one site-admin bit runs the vault.
+Reading is anonymous, unless a repository is made private, in which case it is visible only to its collaborators, its collection's owners, and site admins. Every write is authorized by a token, and users are created by an administrator rather than registering themselves. Permissions are GitHub-shaped: a user owns the collection named after them, repositories take collaborators with read, write, or admin roles, and one site-admin bit runs the vault. Signing in on the web takes the token once; after that a passkey signs in with a touch, a short code carries a session to another device, and `mochi web` opens a signed-in browser from the terminal.
 
 ## Try it locally
 
@@ -39,8 +39,9 @@ The same command deploys updates. See [Deploying a vault](docs/deploying.md) for
 - **Editing in the browser:** files, uploads, branches, tags, repositories, collections, forks, users. Controls a token cannot use are not shown.
 - **Issues and pull requests,** stored as markdown in the vault. Merge or squash, refused on conflicts.
 - **Releases** tied to a tag, with Atom feeds.
+- **Forking from GitHub:** `mochi fork` imports a repository and records its upstream, `mochi sync` fast-forwards from it, and `mochi pr export` sends a pull request made here on to GitHub as one of yours. All three run on your machine, through your own git and `gh` credentials; the vault holds no GitHub token.
 - **Workflows:** GitHub Actions workflows, planned by the server and run by a Docker runner you start elsewhere, including one deployed to Fly.io with a command, which stops when idle and is woken by the vault when a job is queued. A job marked `runs-on: manual` instead waits for a command you paste on a machine of your choosing, which shows the steps and asks before executing them.
-- **Sites:** a static site per repository, sandboxed by default, optionally on its own hostname.
+- **Sites:** an opt-in static site per repository, sandboxed by default, optionally on its own hostname or a custom domain.
 - **Git:** anonymous clone over smart HTTP for public repositories and authenticated clone for private ones, token-authenticated push including push-to-create, and LFS to S3 or to the vault.
 - **CLI and JSON API** covering everything the web UI does, plus a generic `mochi api`. Built for scripts: `--json` everywhere, distinct exit codes, no prompts.
 
@@ -70,17 +71,17 @@ No database, no state outside the directory. Backup is `cp -a`, migration is `rs
 - [The command line](docs/cli.md) - the `mochi` command and its subcommands
 - [The vault](docs/vault.md) - the on-disk layout, tokens, and sessions
 - [Deploying a vault](docs/deploying.md) | [Backing up a vault](docs/backup.md)
-- [Workflows](docs/workflows.md) | [Sites](docs/sites.md) | [Git LFS](docs/lfs.md) | [Themes](docs/themes.md) | [Issues and pull requests](docs/issues-and-pull-requests.md)
+- [Workflows](docs/workflows.md) | [Sites](docs/sites.md) | [Git LFS](docs/lfs.md) | [Themes](docs/themes.md) | [Issues and pull requests](docs/issues-and-pull-requests.md) | [Encrypted files](docs/encrypted-files.md)
 - [The JSON API](docs/api.md) - every route, body, and response
 - [Mochi Forge for an agent](docs/agents.md) - short enough to paste into a context window
 
 ## Using a vault from Claude Code
 
-[mochi-skill](https://github.com/magland/mochi-skill) teaches an agent this CLI the way it already knows `gh`.
+[mochiforge-skill](https://github.com/magland/mochiforge-skill) teaches an agent this CLI the way it already knows `gh`.
 
 ```
-/plugin marketplace add magland/mochi-skill
-/plugin install mochi@mochi-skill
+/plugin marketplace add magland/mochiforge-skill
+/plugin install mochi@mochiforge-skill
 ```
 
 The agent needs `mochi` on its PATH and either `MOCHI_HOST`/`MOCHI_TOKEN` or a completed `mochi login`.

package/dist/agefile.js

@@ -0,0 +1,47 @@
+"use strict";
+// Age-encrypted files, as the web interface understands them.
+//
+// A file named `*.age` is treated as an age encryption (age-encryption.org)
+// ciphertext: the blob page offers to decrypt it in the browser, and the web
+// editor encrypts before committing, so the plaintext and the passphrase
+// never reach the server. The extension is the whole contract, the way `.md`
+// is: the vault stores and serves bytes it cannot read, and the same file
+// decrypts with the standard `age` CLI anywhere else.
+//
+// The two spellings of the format are both honoured when reading: the binary
+// framing, which begins with the version line, and the ASCII armor the spec
+// defines (and the browser editor always writes, so its commits diff as
+// text). What this module decides is only naming and framing; the cryptography
+// itself happens in the reader's browser, in the vendored typage bundle (see
+// src/vendor-age.ts), or in whatever age client the user prefers.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAgeFile = isAgeFile;
+exports.ageInnerName = ageInnerName;
+exports.looksLikeAge = looksLikeAge;
+/** Whether this path names an age ciphertext, by its extension. */
+function isAgeFile(path) {
+    return /\.age$/i.test(path);
+}
+/**
+ * The name inside the encryption: `secrets.md.age` is a markdown file, and
+ * the viewer renders the decrypted text accordingly. A bare `x.age` has no
+ * inner extension and is shown as plain text.
+ */
+function ageInnerName(path) {
+    return path.replace(/\.age$/i, '');
+}
+const BINARY_HEADER = Buffer.from('age-encryption.org/v1\n');
+const ARMOR_HEADER = Buffer.from('-----BEGIN AGE ENCRYPTED FILE-----');
+/**
+ * Whether these bytes begin the way an age ciphertext does, in either
+ * framing. This is what stands between a failed script and a plaintext
+ * commit: the web forms refuse to write a `*.age` path whose content is not
+ * age-shaped, because the likeliest way to produce one is a browser that
+ * never ran the encryption. It is a framing check, not a validation; a
+ * truncated or corrupted ciphertext still passes and fails at decryption,
+ * where it can be reported honestly.
+ */
+function looksLikeAge(buf) {
+    return (buf.subarray(0, BINARY_HEADER.length).equals(BINARY_HEADER) ||
+        buf.subarray(0, ARMOR_HEADER.length).equals(ARMOR_HEADER));
+}

package/dist/agescript.js

@@ -0,0 +1,343 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ageScript = ageScript;
+const crypto_1 = require("crypto");
+const vendor_age_1 = require("./vendor-age");
+// The script for pages that touch age-encrypted files: the blob view of a
+// `*.age` file, the editor for one, and the new-file form (which may be given
+// a `*.age` name). Served as /assets/age.js and loaded only by those pages,
+// so the 300 KB of vendored cryptography is never fetched by a page that
+// cannot need it; ordinary pages carry /assets/page.js alone.
+//
+// Everything here runs on the reader's side of the trust line. The server
+// hands out ciphertext and receives ciphertext; the passphrase lives in a
+// closure for exactly as long as the page needs it, is never written to
+// storage of any kind, and the plaintext exists only in the DOM of this open
+// page. That is the entire point of the feature, so nothing below may relax
+// it. See docs/encrypted-files.md for the contract as the user sees it.
+//
+// Like page.js, everything page-specific arrives through data attributes
+// (data-age-view, data-age-edit, data-age-new and their companions), so this
+// file is one cacheable body for every vault. Unlike page.js it may assume a
+// modern browser: WebCrypto is required by the cryptography itself, so there
+// is nobody older to degrade for. The vendored bundle (src/vendor-age.ts)
+// provides window.MochiAge (typage) and window.MochiMarkdownIt.
+const GLUE_JS = `
+(function () {
+  'use strict';
+
+  var ARMOR_HEAD = '-----BEGIN AGE ENCRYPTED FILE-----';
+
+  function fetchCiphertext(url) {
+    return fetch(url).then(function (resp) {
+      if (!resp.ok) throw new Error('Could not fetch the file (HTTP ' + resp.status + ').');
+      return resp.arrayBuffer();
+    }).then(function (buf) { return new Uint8Array(buf); });
+  }
+
+  // Both framings are read: the armor the browser editor writes, and the
+  // binary framing an age CLI writes by default.
+  function decodeFramed(bytes) {
+    var head = '';
+    for (var i = 0; i < Math.min(bytes.length, ARMOR_HEAD.length); i++) head += String.fromCharCode(bytes[i]);
+    if (head === ARMOR_HEAD) return window.MochiAge.armor.decode(new TextDecoder().decode(bytes));
+    return bytes;
+  }
+
+  function decryptText(bytes, pass) {
+    var d = new window.MochiAge.Decrypter();
+    d.addPassphrase(pass);
+    return d.decrypt(decodeFramed(bytes), 'text');
+  }
+
+  // Armored output on purpose: it commits as text, so the vault's diffs,
+  // blame, and text-shaped write path all keep working over the ciphertext.
+  function encryptArmored(text, pass) {
+    var e = new window.MochiAge.Encrypter();
+    e.setPassphrase(pass);
+    return e.encrypt(text).then(function (bytes) { return window.MochiAge.armor.encode(bytes) + '\\n'; });
+  }
+
+  // Passphrase failures all look alike from the outside, and honesty about
+  // which it was is not available: age reports only that no recipient matched.
+  function explain(err) {
+    var msg = err && err.message ? String(err.message) : String(err);
+    if (msg.indexOf('no identity matched') !== -1) {
+      return 'That passphrase does not open this file. (A corrupted file reports the same way.)';
+    }
+    if (msg.indexOf('invalid header') !== -1 || msg.indexOf('parsing header') !== -1) {
+      return 'This is not a readable age file: ' + msg;
+    }
+    return msg;
+  }
+
+  function setError(box, msg) {
+    var el = box.querySelector('.age-error');
+    if (!el) return;
+    if (msg) { el.textContent = msg; el.hidden = false; } else { el.hidden = true; }
+  }
+
+  // A working button says so. The scrypt derivation takes long enough to feel,
+  // so while it runs the button shows the busy label the server put on it
+  // ('Decrypting...', 'Encrypting...') rather than reading as a dead click.
+  function setBtnBusy(btn, busy) {
+    if (!btn) return;
+    btn.disabled = busy;
+    var label = btn.getAttribute('data-busy-label');
+    if (!label) return;
+    if (busy) {
+      if (!btn.getAttribute('data-idle-label')) btn.setAttribute('data-idle-label', btn.textContent);
+      btn.textContent = label;
+    } else if (btn.getAttribute('data-idle-label')) {
+      btn.textContent = btn.getAttribute('data-idle-label');
+    }
+  }
+
+  function setBusy(box, busy) {
+    setBtnBusy(box.querySelector('.age-unlock button[type=submit]'), busy);
+  }
+
+  // A failed passphrase leaves the input focused and selected, so the retry
+  // is a retype rather than a clear-then-retype.
+  function failedPass(input) { input.focus(); input.select(); }
+
+  // Every passphrase input arrives wrapped with a show/hide toggle (the
+  // .age-eye button the server renders beside it). Only the input's type
+  // flips; the value still never carries a name, so it still cannot post.
+  function wireEyes() {
+    var wraps = document.querySelectorAll('.age-pass-wrap');
+    for (var i = 0; i < wraps.length; i++) (function (wrap) {
+      var input = wrap.querySelector('input');
+      var btn = wrap.querySelector('.age-eye');
+      if (!input || !btn) return;
+      btn.addEventListener('click', function () {
+        var show = input.type === 'password';
+        input.type = show ? 'text' : 'password';
+        wrap.classList.toggle('showing', show);
+        btn.setAttribute('aria-pressed', show ? 'true' : 'false');
+        btn.setAttribute('aria-label', show ? 'Hide the passphrase' : 'Show the passphrase');
+        input.focus();
+      });
+    })(wraps[i]);
+  }
+
+  // The plaintext to copy comes from the closure, not from the DOM, so it is
+  // exact bytes even where the output was rendered as a markdown document.
+  function copyPlain(btn, text) {
+    if (!navigator.clipboard || !navigator.clipboard.writeText) return;
+    navigator.clipboard.writeText(text).then(function () {
+      btn.classList.add('copied');
+      setTimeout(function () { btn.classList.remove('copied'); }, 1400);
+    }, function () {});
+  }
+
+  // ---- the blob page ----
+
+  // The decrypted file is rendered the way its inner name asks: markdown as a
+  // document, anything else as preformatted text. Rendering happens here
+  // rather than on the server for the same reason decryption does.
+  function renderPlain(out, inner, text) {
+    out.textContent = '';
+    if (inner === 'markdown') {
+      var md = window.MochiMarkdownIt({ html: false, linkify: true });
+      var doc = document.createElement('div');
+      doc.className = 'rendered markdown-body';
+      doc.innerHTML = md.render(text);
+      out.appendChild(doc);
+    } else {
+      var pre = document.createElement('pre');
+      pre.className = 'age-plain';
+      pre.textContent = text;
+      out.appendChild(pre);
+    }
+    out.hidden = false;
+  }
+
+  // On unlock the explanatory card gives way to a slim bar over the output:
+  // a note that the decryption stayed in the page, a copy of the exact
+  // plaintext, and the lock that puts the card back. Locking drops the
+  // plaintext from the closure as well as from the DOM.
+  function wireView(box) {
+    var form = box.querySelector('form.age-unlock');
+    var pass = form ? form.querySelector('input') : null;
+    var out = box.querySelector('.age-output');
+    var card = box.querySelector('.age-card');
+    var bar = box.querySelector('[data-age-bar]');
+    var lock = box.querySelector('[data-age-lock]');
+    var copy = box.querySelector('[data-age-copy]');
+    if (!form || !pass || !out || !card) return;
+    var plain = null;
+    form.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      setError(card, null);
+      setBusy(card, true);
+      fetchCiphertext(box.getAttribute('data-age-raw'))
+        .then(function (bytes) { return decryptText(bytes, pass.value); })
+        .then(function (text) {
+          plain = text;
+          pass.value = '';
+          renderPlain(out, box.getAttribute('data-age-inner'), text);
+          card.hidden = true;
+          if (bar) bar.hidden = false;
+        })
+        .catch(function (err) { setError(card, explain(err)); failedPass(pass); })
+        .then(function () { setBusy(card, false); });
+    });
+    if (lock) lock.addEventListener('click', function () {
+      plain = null;
+      out.textContent = '';
+      out.hidden = true;
+      if (bar) bar.hidden = true;
+      card.hidden = false;
+      pass.focus();
+    });
+    if (copy) copy.addEventListener('click', function () {
+      if (plain !== null) copyPlain(copy, plain);
+    });
+    pass.focus();
+  }
+
+  // ---- the editor ----
+
+  // The server cannot fill the textarea, so the page starts locked: the same
+  // unlock form as the blob view, and on success the plaintext lands in the
+  // editor and the passphrase stays in this closure for the re-encryption at
+  // commit time. The textarea carries no name; what the form posts is the
+  // hidden content field, written at the last moment with fresh ciphertext.
+  // An optional pair of new-passphrase inputs (also nameless) re-keys the
+  // file: filled and matching, the commit encrypts with the new passphrase.
+  function wireEdit(form) {
+    var passForm = document.querySelector('form.age-unlock[data-age-for-edit]');
+    var passInput = passForm ? passForm.querySelector('input') : null;
+    var card = passForm ? passForm.closest('.age-card') : null;
+    var editor = form.querySelector('textarea.code-editor');
+    var content = form.querySelector('input[name=content]');
+    var commitBtn = form.querySelector('button[type=submit]');
+    var path = form.querySelector('input[name=path]');
+    var renameWarn = form.querySelector('[data-age-rename-warn]');
+    var newPass = form.querySelectorAll('.age-newpass input');
+    if (!passForm || !passInput || !card || !editor || !content || !commitBtn) return;
+    var passphrase = null;
+    var readyToPost = false;
+    passForm.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      setError(card, null);
+      setBusy(card, true);
+      var pass = passInput.value;
+      fetchCiphertext(form.getAttribute('data-age-raw'))
+        .then(function (bytes) { return decryptText(bytes, pass); })
+        .then(function (text) {
+          passphrase = pass;
+          passInput.value = '';
+          editor.value = text;
+          editor.disabled = false;
+          commitBtn.disabled = false;
+          card.hidden = true;
+          form.hidden = false;
+          editor.focus();
+        })
+        .catch(function (err) { setError(card, explain(err)); failedPass(passInput); })
+        .then(function () { setBusy(card, false); });
+    });
+    // Renaming away from .age is legal but almost never meant: the commit
+    // would still be ciphertext, under a name the vault reads as plain text.
+    // The warning appears as the name changes, not as a surprise afterwards.
+    if (path && renameWarn) path.addEventListener('input', function () {
+      renameWarn.hidden = /\\.age$/i.test(path.value.trim());
+    });
+    form.addEventListener('submit', function (ev) {
+      if (readyToPost) return;
+      ev.preventDefault();
+      if (passphrase === null) return;
+      var usePass = passphrase;
+      if (newPass.length === 2 && (newPass[0].value !== '' || newPass[1].value !== '')) {
+        if (newPass[0].value !== newPass[1].value) {
+          setError(form, 'The new passphrases do not match.');
+          failedPass(newPass[1]);
+          return;
+        }
+        usePass = newPass[0].value;
+      }
+      setError(form, null);
+      setBtnBusy(commitBtn, true);
+      encryptArmored(editor.value, usePass)
+        .then(function (armored) {
+          content.value = armored;
+          readyToPost = true;
+          form.submit();
+        })
+        .catch(function (err) {
+          setBtnBusy(commitBtn, false);
+          setError(form, explain(err));
+        });
+    });
+    passInput.focus();
+  }
+
+  // ---- the new-file form ----
+
+  // The form is the ordinary one; a file name ending in .age reveals the
+  // passphrase pair (and retires the hint that said so) and switches the
+  // commit to encrypt-then-post. The passphrase inputs carry no name, so
+  // they can never be posted, and the server refuses a .age path whose
+  // content is not age-shaped, so a page where this script failed cannot
+  // commit plaintext under the name.
+  function wireNew(form) {
+    var filename = form.querySelector('input[name=filename]');
+    var fields = form.querySelector('.age-pass-fields');
+    var hint = form.querySelector('[data-age-hint]');
+    var editor = form.querySelector('textarea[name=content]');
+    var commitBtn = form.querySelector('button[type=submit]');
+    if (!filename || !fields || !editor) return;
+    var inputs = fields.querySelectorAll('.age-pass-wrap input');
+    if (inputs.length !== 2) return;
+    var readyToPost = false;
+    function wantsAge() { return /\\.age$/i.test(filename.value.trim()); }
+    function toggle() {
+      fields.hidden = !wantsAge();
+      if (hint) hint.hidden = wantsAge();
+    }
+    filename.addEventListener('input', toggle);
+    toggle();
+    form.addEventListener('submit', function (ev) {
+      if (readyToPost || !wantsAge()) return;
+      ev.preventDefault();
+      setError(fields, null);
+      if (inputs[0].value === '') { setError(fields, 'Choose a passphrase for this file.'); failedPass(inputs[0]); return; }
+      if (inputs[0].value !== inputs[1].value) { setError(fields, 'The passphrases do not match.'); failedPass(inputs[1]); return; }
+      setBtnBusy(commitBtn, true);
+      encryptArmored(editor.value, inputs[0].value)
+        .then(function (armored) {
+          inputs[0].value = '';
+          inputs[1].value = '';
+          editor.removeAttribute('name');
+          var hidden = document.createElement('input');
+          hidden.type = 'hidden';
+          hidden.name = 'content';
+          hidden.value = armored;
+          form.appendChild(hidden);
+          readyToPost = true;
+          form.submit();
+        })
+        .catch(function (err) { setBtnBusy(commitBtn, false); setError(fields, explain(err)); });
+    });
+  }
+
+  wireEyes();
+  var view = document.querySelector('[data-age-view]');
+  if (view) wireView(view);
+  var edit = document.querySelector('form[data-age-edit]');
+  if (edit) wireEdit(edit);
+  var fresh = document.querySelector('form[data-age-new]');
+  if (fresh) wireNew(fresh);
+})();
+`;
+let made = null;
+/** The served asset: the vendored bundle and the glue above, one body, one tag. */
+function ageScript() {
+    if (made)
+        return made;
+    const body = vendor_age_1.VENDOR_AGE_JS + '\n' + GLUE_JS;
+    made = { body, tag: (0, crypto_1.createHash)('sha256').update(body).digest('hex').slice(0, 12) };
+    return made;
+}

package/dist/api/admin.js

@@ -38,9 +38,9 @@ const fs = __importStar(require("fs"));
 const config_1 = require("../config");
 const layout_1 = require("../layout");
 const ops_1 = require("../ops");
-const redirects_1 = require("../redirects");
 const scan_1 = require("../scan");
 const siteshost_1 = require("../siteshost");
+const sitesettings_1 = require("../sitesettings");
 const themes_1 = require("../themes");
 const perms_1 = require("../perms");
 const vault_1 = require("../vault");
@@ -119,58 +119,90 @@ function registerAdminApi(app, root, limiter, lfs = null, engine, egress) {
             (0, auth_1.sendOpError)(res, e, 'could not rename the collection');
         }
     });
-    // Only an empty one, and only a directory: a collection is a directory, so
-    // removing it is an rmdir and refusing a non-empty one is the filesystem's own
-    // rule rather than a policy invented here.
-    app.delete('/api/collections/:name', (req, res) => {
+    /**
+     * A collection's site alias: the label standing in for its name in each of
+     * its repositories' derived site hostnames. Ownership of the collection, as
+     * the rename above takes, since it decides those hostnames and nothing else.
+     *
+     * `siteAlias` is the only field, `""` clearing it and falling back to the
+     * collection's own name where that is usable as a hostname label and its name
+     * rewritten as one otherwise. An alias another collection is already reached
+     * by is refused with 409, naming it, the same answer a claimed repository
+     * label gets.
+     */
+    app.patch('/api/collections/:name', (req, res) => {
         const auth = (0, auth_1.requireApiAuth)(root, limiter, req, res);
         if (!auth)
             return;
         const name = req.params.name;
+        if (!(0, scan_1.isValidName)(name) || !isCollection(name)) {
+            (0, auth_1.apiError)(res, 404, `no collection ${name} in this vault`);
+            return;
+        }
         if (!(0, perms_1.canAdminCollection)(root, auth, name)) {
             (0, auth_1.apiError)(res, 403, `you are not an owner of ${name}`);
             return;
         }
-        if (!(0, scan_1.isValidName)(name)) {
-            (0, auth_1.apiError)(res, 400, 'that is not a usable collection name');
+        const alias = (0, auth_1.stringField)((0, auth_1.bodyOf)(req), 'siteAlias');
+        if (alias === null) {
+            (0, auth_1.apiError)(res, 400, 'nothing to change; provide "siteAlias"');
             return;
         }
-        const dir = (0, layout_1.collectionDir)(root, name);
-        let isDir = false;
+        if (alias !== '' && !(0, sitesettings_1.isUsableCollectionAlias)(alias)) {
+            (0, auth_1.apiError)(res, 400, '"siteAlias" is lowercase letters, digits, and single interior hyphens, with no doubled hyphen, at most 63 characters');
+            return;
+        }
+        if (alias !== '') {
+            const holder = (0, sitesettings_1.collectionAliasConflict)(root, alias, name);
+            if (holder) {
+                (0, auth_1.apiError)(res, 409, `the alias ${alias} is already how the collection ${holder} is reached`);
+                return;
+            }
+        }
+        (0, sitesettings_1.setCollectionAlias)(root, name, alias);
+        res.json({ name, siteAlias: (0, sitesettings_1.storedCollectionAlias)(root, name), alias: (0, sitesettings_1.collectionSiteAlias)(root, name) });
+    });
+    /** Whether the vault holds a collection of this name; the rename's own check. */
+    function isCollection(name) {
         try {
-            isDir = fs.statSync(dir).isDirectory();
+            return fs.statSync((0, layout_1.collectionDir)(root, name)).isDirectory();
         }
         catch {
-            isDir = false;
+            return false;
         }
-        if (!isDir) {
-            (0, auth_1.apiError)(res, 404, `no collection ${name} in this vault`);
+    }
+    // Only an empty one: what "empty" means, and what goes with the directory,
+    // is deleteCollection's business, shared with the web route.
+    app.delete('/api/collections/:name', (req, res) => {
+        const auth = (0, auth_1.requireApiAuth)(root, limiter, req, res);
+        if (!auth)
             return;
-        }
-        // Empty means the collection holds nothing but its own empty repos
-        // directory: no repository, nothing beside one, and nothing of the
-        // collection's own.
-        const repos = (0, layout_1.reposDir)(root, name);
-        const own = fs.readdirSync(dir).filter((n) => n !== layout_1.REPOS_DIR);
-        const inRepos = fs.existsSync(repos) ? fs.readdirSync(repos) : [];
-        if (own.length > 0 || inRepos.length > 0) {
-            (0, auth_1.apiError)(res, 409, `collection ${name} is not empty`);
+        const name = req.params.name;
+        if (!(0, perms_1.canAdminCollection)(root, auth, name)) {
+            (0, auth_1.apiError)(res, 403, `you are not an owner of ${name}`);
             return;
         }
         try {
-            fs.rmSync(dir, { recursive: true });
+            (0, ops_1.deleteCollection)(root, name);
         }
         catch (e) {
-            (0, auth_1.apiError)(res, 409, `could not remove ${name}: ${e instanceof Error ? e.message : String(e)}`);
+            (0, auth_1.sendOpError)(res, e, 'could not remove the collection');
             return;
         }
-        // Any redirect that led here goes with it. A collection created later
-        // under this name would otherwise inherit the traffic a former name of
-        // this one still sends.
-        (0, redirects_1.forgetCollectionRedirects)(root, name);
         res.json({ deleted: name });
     });
     // ---- users and their tokens ----
+    // A token-scoped token reaches its globs and nothing else, and in
+    // particular administers nothing (src/perms.ts). Its own user's token list
+    // is something to administer: a scoped token handed to a script could
+    // otherwise list and revoke the unrestricted tokens beside it, locking the
+    // user out of git and the CLI.
+    function requireUnscoped(auth, res) {
+        if (!(0, perms_1.tokenIsScoped)(auth))
+            return true;
+        (0, auth_1.apiError)(res, 403, 'a token-scoped token may not list or revoke tokens');
+        return false;
+    }
     app.get('/api/users/:name', (req, res) => {
         const auth = (0, auth_1.requireApiAuth)(root, limiter, req, res);
         if (!auth)
@@ -191,6 +223,8 @@ function registerAdminApi(app, root, limiter, lfs = null, engine, egress) {
             (0, auth_1.apiError)(res, 403, 'site admin required to touch another user');
             return;
         }
+        if (!requireUnscoped(auth, res))
+            return;
         res.json({
             name: req.params.name,
             siteAdmin: user.siteAdmin === true,
@@ -215,6 +249,8 @@ function registerAdminApi(app, root, limiter, lfs = null, engine, egress) {
             (0, auth_1.apiError)(res, 403, 'site admin required to touch another user');
             return;
         }
+        if (!requireUnscoped(auth, res))
+            return;
         // Never the token, and never the hash either: an id is what revocation
         // takes, and the hash is a credential-shaped thing with no reason to travel.
         res.json({
@@ -240,6 +276,8 @@ function registerAdminApi(app, root, limiter, lfs = null, engine, egress) {
             (0, auth_1.apiError)(res, 403, 'site admin required to touch another user');
             return;
         }
+        if (!requireUnscoped(auth, res))
+            return;
         let result;
         try {
             result = (0, vault_1.revokeToken)(root, req.params.name, req.params.id);

package/dist/api/auth.js

@@ -10,6 +10,7 @@ exports.bodyOf = bodyOf;
 exports.stringField = stringField;
 exports.stringsField = stringsField;
 exports.limitParam = limitParam;
+const naming_1 = require("../naming");
 const ops_1 = require("../ops");
 const perms_1 = require("../perms");
 const scan_1 = require("../scan");
@@ -38,11 +39,11 @@ function apiError(res, status, message) {
 function requireApiAuth(root, limiter, req, res) {
     const state = (0, vault_1.loadVault)(root);
     if (state.status === 'missing') {
-        apiError(res, 401, 'no vault.json in this vault; restart the server to initialize one');
+        apiError(res, 401, `no ${naming_1.naming.stateFile} in this ${naming_1.naming.rootNoun}; restart the server to initialize one`);
         return null;
     }
     if (state.status === 'error') {
-        apiError(res, 500, `vault.json could not be read: ${state.message}`);
+        apiError(res, 500, `${naming_1.naming.stateFile} could not be read: ${state.message}`);
         return null;
     }
     const m = (req.get('authorization') ?? '').match(/^bearer\s+(.+)$/i);