@magland/mochi 0.3.1

package/dist/ci/manual.js

@@ -0,0 +1,199 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MINT_TTL_MS = exports.MANUAL_LABEL = void 0;
+exports.isManualJob = isManualJob;
+exports.sessionRunnerName = sessionRunnerName;
+exports.isManualRunnerName = isManualRunnerName;
+exports.loadGrants = loadGrants;
+exports.mintGrant = mintGrant;
+exports.findMintable = findMintable;
+exports.redeemGrant = redeemGrant;
+exports.findSession = findSession;
+exports.looksLikeSessionToken = looksLikeSessionToken;
+exports.looksLikeMintToken = looksLikeMintToken;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const atomic_1 = require("../atomic");
+const runs_1 = require("./runs");
+// Manual jobs: a job whose runs-on names the reserved label `manual` is never
+// handed to a registered runner. It runs when someone with the write role
+// mints a command from the run page and pastes it on a machine of their
+// choosing, which is the arrangement for a machine that should execute
+// repository code only while a person is watching it do so.
+//
+// The pasted command carries a *mint token*: single-use, scoped to one run,
+// and dead fifteen minutes after minting if nobody redeems it. Redeeming it
+// returns a *session token* that lives only in the redeeming process and
+// works until the run completes. The split is the point: a command lands in
+// shell history and terminal scrollback, and a copy found there later must
+// buy nothing. Only hashes of either token are stored, as with every other
+// credential in a vault.
+//
+// Grants live in <run dir>/manual.json, beside run.json rather than inside
+// it, so that the run records served by the API and rendered by the UI never
+// carry them. They are pruned with the run.
+exports.MANUAL_LABEL = 'manual';
+/** Whether a job (by its resolved runs-on labels) runs only by pasted command. */
+function isManualJob(runsOn) {
+    return runsOn.includes(exports.MANUAL_LABEL);
+}
+/** How long a minted command waits to be pasted before it dies. */
+exports.MINT_TTL_MS = 15 * 60 * 1000;
+const MINT_PREFIX = 'mochi_run_';
+const SESSION_PREFIX = 'mochi_manual_';
+/** The runner name a session's leases are held under. */
+function sessionRunnerName(grant) {
+    return `manual:${grant.id}`;
+}
+function isManualRunnerName(name) {
+    return name.startsWith('manual:');
+}
+function grantsPath(root, collection, repo, n) {
+    const base = (0, runs_1.runsDir)(root, collection, repo);
+    return base ? path.join(base, String(n), 'manual.json') : null;
+}
+function loadGrants(root, collection, repo, n) {
+    const file = grantsPath(root, collection, repo, n);
+    if (!file)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    return parsed.filter((g) => typeof g === 'object' &&
+        g !== null &&
+        typeof g.id === 'string' &&
+        typeof g.hash === 'string');
+}
+function saveGrants(root, collection, repo, n, grants) {
+    const file = grantsPath(root, collection, repo, n);
+    if (!file)
+        throw new Error('invalid repository');
+    (0, atomic_1.writeFileAtomic)(file, JSON.stringify(grants, null, 1) + '\n', { mode: 0o600 });
+}
+function hashToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+function sameHash(a, b) {
+    let x;
+    let y;
+    try {
+        x = Buffer.from(a, 'hex');
+        y = Buffer.from(b, 'hex');
+    }
+    catch {
+        return false;
+    }
+    return x.length === y.length && x.length > 0 && crypto.timingSafeEqual(x, y);
+}
+/**
+ * Mint a grant for a run and return the token, which is shown once and only
+ * its hash kept. Expired grants that were never redeemed are dropped on the
+ * way through: they are dead weight, and pruning them here means the file
+ * never accumulates the residue of commands nobody pasted.
+ */
+function mintGrant(root, collection, repo, n, mintedBy) {
+    const now = Date.now();
+    const grants = loadGrants(root, collection, repo, n).filter((g) => g.redeemedAt !== undefined || Date.parse(g.expiresAt) > now);
+    const token = MINT_PREFIX + crypto.randomBytes(24).toString('hex');
+    const grant = {
+        id: crypto.randomBytes(4).toString('hex'),
+        hash: hashToken(token),
+        mintedBy,
+        mintedAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + exports.MINT_TTL_MS).toISOString(),
+    };
+    grants.push(grant);
+    saveGrants(root, collection, repo, n, grants);
+    return { token, grant };
+}
+/** The grant a presented mint token names, if it is unexpired and unredeemed. */
+function findMintable(grants, token) {
+    if (!token.startsWith(MINT_PREFIX))
+        return null;
+    const presented = hashToken(token);
+    for (const g of grants) {
+        if (g.redeemedAt !== undefined)
+            continue;
+        if (Date.parse(g.expiresAt) <= Date.now())
+            continue;
+        if (sameHash(g.hash, presented))
+            return g;
+    }
+    return null;
+}
+/**
+ * Redeem a grant: mark it redeemed, record the reported host, and mint the
+ * session token whose hash it will answer to from now on. The mint token is
+ * spent by this; presenting it again finds nothing.
+ */
+function redeemGrant(root, collection, repo, n, grantId, host) {
+    const grants = loadGrants(root, collection, repo, n);
+    const grant = grants.find((g) => g.id === grantId);
+    if (!grant || grant.redeemedAt !== undefined)
+        return null;
+    const session = SESSION_PREFIX + crypto.randomBytes(32).toString('hex');
+    grant.sessionHash = hashToken(session);
+    grant.redeemedAt = new Date().toISOString();
+    grant.host = host.slice(0, 200);
+    saveGrants(root, collection, repo, n, grants);
+    return session;
+}
+/** The redeemed grant a presented session token belongs to, or null. */
+function findSession(grants, token) {
+    if (!token.startsWith(SESSION_PREFIX))
+        return null;
+    const presented = hashToken(token);
+    for (const g of grants) {
+        if (g.sessionHash === undefined)
+            continue;
+        if (sameHash(g.sessionHash, presented))
+            return g;
+    }
+    return null;
+}
+function looksLikeSessionToken(token) {
+    return token.startsWith(SESSION_PREFIX);
+}
+function looksLikeMintToken(token) {
+    return token.startsWith(MINT_PREFIX);
+}

package/dist/ci/present.js

@@ -0,0 +1,82 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hasCiState = hasCiState;
+const fs = __importStar(require("fs"));
+const runs_1 = require("./runs");
+// Whether to show a repository's Actions tab. Two cheap questions: does the
+// repository have any run history on disk, and does its default branch carry
+// a workflow file? The second needs git, so the answer is memoized against
+// the branch tip: one ls-tree per repository per new commit, not one per page
+// view. A vault with no CI in it never grows the tab.
+const memo = new Map();
+async function hasWorkflowsAt(repo, sha) {
+    const cached = memo.get(repo.dir);
+    if (cached && cached.sha === sha)
+        return cached.has;
+    let has = false;
+    for (const dir of ['.github/workflows', '.mochi/workflows']) {
+        try {
+            const entries = await repo.listTree(sha, dir);
+            if (entries.some((e) => e.type === 'blob' && /\.(yml|yaml)$/i.test(e.name))) {
+                has = true;
+                break;
+            }
+        }
+        catch {
+            // no such directory at this commit
+        }
+    }
+    if (memo.size > 2000)
+        memo.clear();
+    memo.set(repo.dir, { sha, has });
+    return has;
+}
+async function hasCiState(root, repo, defaultBranch, branches) {
+    const dir = (0, runs_1.runsDir)(root, repo.collection, repo.name);
+    if (dir) {
+        try {
+            if (fs.statSync(dir).isDirectory())
+                return true;
+        }
+        catch {
+            // no runs yet
+        }
+    }
+    const tip = branches.find((b) => b.name === defaultBranch);
+    if (!tip)
+        return false;
+    return hasWorkflowsAt(repo, tip.sha);
+}

package/dist/ci/protocol.js

@@ -0,0 +1,6 @@
+"use strict";
+// The wire types of the runner protocol: what the server hands a runner when
+// it acquires a job, and what the runner reports back. Both sides of the
+// protocol live in this package (src/ci for the server, src/runner for the
+// client), so these types are the single definition.
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/ci/runners.js

@@ -0,0 +1,256 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RUNNERS_FILE = void 0;
+exports.runnersFilePath = runnersFilePath;
+exports.loadRunners = loadRunners;
+exports.hashRunnerToken = hashRunnerToken;
+exports.registerRunner = registerRunner;
+exports.regenerateRunnerToken = regenerateRunnerToken;
+exports.setRunnerWake = setRunnerWake;
+exports.removeRunner = removeRunner;
+exports.noteRunnerSeen = noteRunnerSeen;
+exports.runnerLastSeen = runnerLastSeen;
+exports.authenticateRunner = authenticateRunner;
+exports.runnerAllows = runnerAllows;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const atomic_1 = require("../atomic");
+const filecache_1 = require("../filecache");
+const vault_1 = require("../vault");
+// The runner registry, in <vault>/runners.json. A runner is not a user: it
+// reads repositories (which are world-readable anyway) and writes run state
+// for jobs it holds a lease on, and it can never push, edit, or administer.
+// Keeping it out of vault.json keeps the two credential kinds from being
+// confused for each other, and keeps a machine credential out of the file
+// that governs human access.
+//
+// Only a hash of each runner token is stored, as with user tokens.
+exports.RUNNERS_FILE = 'runners.json';
+function runnersFilePath(root) {
+    return path.join(root, exports.RUNNERS_FILE);
+}
+function normalize(parsed) {
+    if (typeof parsed !== 'object' || parsed === null)
+        throw new Error('runners.json must be a JSON object');
+    const raw = parsed.runners;
+    if (raw === undefined)
+        return { runners: {} };
+    if (typeof raw !== 'object' || raw === null)
+        throw new Error('runners.json must have a "runners" object');
+    const runners = {};
+    for (const [name, v] of Object.entries(raw)) {
+        if (typeof v !== 'object' || v === null)
+            throw new Error(`runner ${name} must be an object`);
+        const r = v;
+        if (typeof r.hash !== 'string')
+            throw new Error(`runner ${name} needs a "hash"`);
+        const strings = (x, field) => {
+            if (x === undefined)
+                return [];
+            if (Array.isArray(x) && x.every((s) => typeof s === 'string'))
+                return x;
+            throw new Error(`runner ${name}: "${field}" must be a list of strings`);
+        };
+        runners[name] = {
+            hash: r.hash,
+            labels: strings(r.labels, 'labels'),
+            allow: strings(r.allow, 'allow'),
+            createdBy: typeof r.createdBy === 'string' ? r.createdBy : '',
+            createdAt: typeof r.createdAt === 'string' ? r.createdAt : '',
+            ...(typeof r.tokenUpdatedAt === 'string' ? { tokenUpdatedAt: r.tokenUpdatedAt } : {}),
+            ...(typeof r.wakeUrl === 'string' ? { wakeUrl: r.wakeUrl } : {}),
+            ...(typeof r.wakeSecret === 'string' ? { wakeSecret: r.wakeSecret } : {}),
+        };
+    }
+    return { runners };
+}
+const cache = (0, filecache_1.fileCache)({
+    read: (file) => {
+        try {
+            return normalize(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        catch (e) {
+            console.error(`runners.json could not be read: ${e instanceof Error ? e.message : e}`);
+            return { runners: {} };
+        }
+    },
+    missing: () => ({ runners: {} }),
+});
+function loadRunners(root) {
+    return cache.get(runnersFilePath(root));
+}
+function write(root, registry) {
+    (0, atomic_1.writeFileAtomic)(runnersFilePath(root), JSON.stringify(registry, null, 2) + '\n', { mode: 0o600 });
+    cache.invalidate(runnersFilePath(root));
+}
+/**
+ * Hold the registry's lock across a read, an edit, and the write back.
+ *
+ * `mochi runner add` from a shell and the same call through the API edit
+ * this file the same way, and either one overlapping the other loses a runner
+ * outright. The cache is dropped on the way in because the decision it makes,
+ * that a file with an unchanged mtime and size has unchanged contents, is one
+ * this function cannot afford: another process may have written in the interval
+ * since the last read, and the copy about to be edited must be the one on disk.
+ */
+function editRunners(root, fn) {
+    return (0, atomic_1.withFileLock)(`${runnersFilePath(root)}.lock`, () => {
+        cache.invalidate(runnersFilePath(root));
+        return fn();
+    });
+}
+function hashRunnerToken(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+function newRunnerToken() {
+    return 'mochi_runner_' + crypto.randomBytes(32).toString('hex');
+}
+function registerRunner(root, name, opts) {
+    return editRunners(root, () => {
+        const registry = loadRunners(root);
+        const token = newRunnerToken();
+        const runner = {
+            hash: hashRunnerToken(token),
+            labels: opts.labels,
+            allow: opts.allow,
+            createdBy: opts.createdBy,
+            createdAt: new Date().toISOString(),
+            ...(opts.wake ? { wakeUrl: opts.wake.url, wakeSecret: opts.wake.secret } : {}),
+        };
+        registry.runners[name] = runner;
+        write(root, registry);
+        return { token, runner };
+    });
+}
+/**
+ * Issue a new token for an existing runner, keeping its labels and allow list.
+ *
+ * The old token stops working the moment this returns, so a runner still
+ * polling with it gets a 401 and must be restarted with the new one. Returns
+ * null if no runner by that name is registered.
+ */
+function regenerateRunnerToken(root, name) {
+    return editRunners(root, () => {
+        const registry = loadRunners(root);
+        const existing = registry.runners[name];
+        if (!existing)
+            return null;
+        const token = newRunnerToken();
+        const runner = {
+            ...existing,
+            hash: hashRunnerToken(token),
+            tokenUpdatedAt: new Date().toISOString(),
+        };
+        registry.runners[name] = runner;
+        write(root, registry);
+        return { token, runner };
+    });
+}
+/**
+ * Point a runner's wake address somewhere, or clear it with null.
+ *
+ * Separate from registration because the two are learned at different times:
+ * `mochi deploy fly runner` registers the runner before the app it will
+ * run on exists, and only afterwards knows the URL that starts it. Returns
+ * null if no runner by that name is registered.
+ */
+function setRunnerWake(root, name, wake) {
+    return editRunners(root, () => {
+        const registry = loadRunners(root);
+        const existing = registry.runners[name];
+        if (!existing)
+            return null;
+        const runner = { ...existing };
+        delete runner.wakeUrl;
+        delete runner.wakeSecret;
+        if (wake) {
+            runner.wakeUrl = wake.url;
+            runner.wakeSecret = wake.secret;
+        }
+        registry.runners[name] = runner;
+        write(root, registry);
+        return runner;
+    });
+}
+function removeRunner(root, name) {
+    return editRunners(root, () => {
+        const registry = loadRunners(root);
+        if (!registry.runners[name])
+            return false;
+        delete registry.runners[name];
+        write(root, registry);
+        return true;
+    });
+}
+// When each runner last authenticated, kept in memory rather than in
+// runners.json. A runner long-polls continuously, so recording this on disk
+// would mean a write every few seconds per runner, for a fact that is only
+// interesting while the server is up: after a restart every live runner
+// re-announces itself within one poll, and one that does not is exactly the
+// one worth reporting as absent.
+const lastSeen = new Map();
+function noteRunnerSeen(name) {
+    lastSeen.set(name, Date.now());
+}
+/** When this runner last spoke to the vault, or null if it has not since the server started. */
+function runnerLastSeen(name) {
+    const at = lastSeen.get(name);
+    return at === undefined ? null : new Date(at).toISOString();
+}
+function authenticateRunner(root, token) {
+    const registry = loadRunners(root);
+    const presented = Buffer.from(hashRunnerToken(token), 'hex');
+    for (const [name, runner] of Object.entries(registry.runners)) {
+        let stored;
+        try {
+            stored = Buffer.from(runner.hash, 'hex');
+        }
+        catch {
+            continue;
+        }
+        if (stored.length === presented.length && crypto.timingSafeEqual(stored, presented)) {
+            return { name, runner };
+        }
+    }
+    return null;
+}
+// Whether a runner is allowed to take jobs for a repository. An empty allow
+// list means nothing, not everything: a runner handed out without a scope
+// should sit idle rather than pick up every repository in the vault.
+function runnerAllows(runner, collection, repo) {
+    return runner.allow.some((g) => (0, vault_1.globMatch)(g, `${collection}/${repo}`));
+}