@magland/mochi 0.3.1

package/dist/migrate.js

@@ -0,0 +1,334 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrateLayout = migrateLayout;
+exports.migratePermissions = migratePermissions;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const layout_1 = require("./layout");
+const perms_1 = require("./perms");
+const scan_1 = require("./scan");
+const vault_1 = require("./vault");
+/**
+ * Moving a vault from the older layout, where collections sat directly in the
+ * vault directory and repositories directly in a collection, to the current
+ * one, where both sit one level down (see src/layout.ts).
+ *
+ * This runs on startup, before anything is served, and is renames only: no
+ * file is read, written, or copied, so the cost does not depend on how large
+ * the repositories are, and a vault on a full disk migrates as well as one on
+ * an empty disk. The server refuses to serve a vault it could not migrate,
+ * rather than serving what would look like an empty vault.
+ */
+/** Where a collection is parked while its own contents are being rearranged. */
+const STAGING_DIR = '.collections-migrating';
+/**
+ * Whether a directory is a collection under the old layout: it holds a bare
+ * repository, or one of the directories a repository keeps beside it. An empty
+ * collection matches neither, and is decided by its company - see oldCollections.
+ */
+function looksLikeOldCollection(dir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return false;
+    }
+    return entries.some((e) => {
+        if (!e.isDirectory())
+            return false;
+        const lower = e.name.toLowerCase();
+        if (scan_1.repoSiblingSuffixes.some((s) => lower.endsWith(s)) || lower.endsWith('.lfs'))
+            return true;
+        return (0, scan_1.isBareRepo)(path.join(dir, e.name));
+    });
+}
+/**
+ * Whether a `collections` directory in the vault root is this layout's
+ * container rather than a collection that happens to be named that. It is the
+ * container when it is empty, or when something in it has a `repos` directory,
+ * which is the shape only the current layout produces.
+ */
+function isCollectionsContainer(dir) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return false;
+    }
+    if (entries.length === 0)
+        return true;
+    return entries.some((e) => e.isDirectory() && fs.existsSync(path.join(dir, e.name, layout_1.REPOS_DIR)));
+}
+/**
+ * The collections to move, or an empty list if the vault is already laid out
+ * the current way.
+ *
+ * A directory in the vault root is a collection to move when it holds
+ * something a repository would put there. An empty directory holds nothing to
+ * judge by, so it is taken as a collection only when some other directory
+ * proves the vault is on the old layout; in a vault already migrated, an empty
+ * stray directory is left where it is rather than being adopted as a
+ * collection nobody made.
+ *
+ * `collections` is the one ambiguous name, since a vault on the old layout may
+ * have a collection called that. Asked of it is the narrower question above:
+ * a `collections` directory holding this layout is the container and is left
+ * alone, and one holding repositories is an ordinary collection and is moved,
+ * ending up at `collections/collections`.
+ */
+function oldCollections(root) {
+    let entries;
+    try {
+        entries = fs.readdirSync(root, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const candidates = entries
+        .filter((e) => e.isDirectory() && !e.isSymbolicLink() && (0, scan_1.isValidName)(e.name))
+        .map((e) => e.name)
+        .filter((name) => name !== layout_1.COLLECTIONS_DIR || !isCollectionsContainer(path.join(root, name)))
+        .sort();
+    const definite = candidates.filter((name) => looksLikeOldCollection(path.join(root, name)));
+    if (definite.length === 0)
+        return [];
+    return candidates;
+}
+/** Move everything in a collection's directory into its `repos` subdirectory. */
+function nestRepos(dir) {
+    const repos = path.join(dir, layout_1.REPOS_DIR);
+    const entries = fs.readdirSync(dir);
+    // Already nested, by an earlier run that was interrupted after this
+    // collection and before the last step. A collection may hold a repository
+    // named `repos`, so this asks what the directory is rather than assuming
+    // from its name: a bare repository there is a repository to move, not a
+    // collection already done.
+    if (entries.length === 1 && entries[0] === layout_1.REPOS_DIR && !(0, scan_1.isBareRepo)(repos))
+        return;
+    // Everything moves into a directory under a temporary name, which is renamed
+    // into place at the end. A collection is therefore never left holding a
+    // half-filled repos directory beside the repositories still to go, and a
+    // repository that is itself called `repos` moves like any other.
+    //
+    // A scratch directory from an interrupted run is filled the rest of the way
+    // rather than cleared: what is in it are repositories that were moved and
+    // not yet renamed into place, and nothing in this file deletes those.
+    const scratchName = `.${layout_1.REPOS_DIR}-incoming`;
+    const scratch = path.join(dir, scratchName);
+    if (!fs.existsSync(scratch))
+        fs.mkdirSync(scratch);
+    for (const name of entries) {
+        if (name === scratchName)
+            continue;
+        fs.renameSync(path.join(dir, name), path.join(scratch, name));
+    }
+    fs.renameSync(scratch, repos);
+}
+/** Move each entry of `from` into `to`, refusing rather than overwriting. */
+function drain(from, to) {
+    const moved = [];
+    for (const name of fs.readdirSync(from).sort()) {
+        const dest = path.join(to, name);
+        if (fs.existsSync(dest)) {
+            throw new Error(`cannot move ${name} into ${layout_1.COLLECTIONS_DIR}/: a collection of that name is already there`);
+        }
+        fs.renameSync(path.join(from, name), dest);
+        moved.push(name);
+    }
+    return moved;
+}
+/**
+ * Bring a vault up to the current layout, returning what was moved, or null if
+ * there was nothing to move. Safe to call on every start: a vault already laid
+ * out this way is read once and left alone.
+ *
+ * The order is what makes an interrupted run recoverable. Each collection is
+ * moved into a staging directory and rearranged there, so a collection is
+ * either where it was or finished, never half-nested in place; the staging
+ * directory then becomes `collections/` in a single rename, or is drained into
+ * it if one already exists. A run interrupted before that last step leaves the
+ * staging directory behind, and the next start finds it and finishes.
+ */
+function migrateLayout(root) {
+    const staging = path.join(root, STAGING_DIR);
+    const collections = (0, layout_1.collectionsDir)(root);
+    const stale = fs.existsSync(staging);
+    const names = oldCollections(root);
+    if (names.length === 0 && !stale)
+        return null;
+    try {
+        if (!stale)
+            fs.mkdirSync(staging);
+        for (const name of names) {
+            fs.renameSync(path.join(root, name), path.join(staging, name));
+        }
+        for (const name of fs.readdirSync(staging)) {
+            nestRepos(path.join(staging, name));
+        }
+        let moved;
+        if (fs.existsSync(collections)) {
+            moved = drain(staging, collections);
+            fs.rmdirSync(staging);
+        }
+        else {
+            moved = fs.readdirSync(staging).sort();
+            fs.renameSync(staging, collections);
+        }
+        return { collections: moved };
+    }
+    catch (e) {
+        // Said in full, because this is printed instead of a vault starting, and
+        // the next thing the reader does depends on which of its parts is true.
+        throw new Error(`This vault is laid out the older way, with its collections in ${root} rather than ` +
+            `in ${layout_1.COLLECTIONS_DIR}/, and moving them failed: ${e instanceof Error ? e.message : String(e)}. ` +
+            'Nothing was deleted, and what was moved is under ' +
+            `${STAGING_DIR}/ or ${layout_1.COLLECTIONS_DIR}/; starting again finishes the move once the ` +
+            'cause is fixed. The vault is not served meanwhile, since serving it would show an ' +
+            'empty vault while every repository is still on disk.');
+    }
+}
+// ---- glob scopes to roles ----
+/**
+ * Translating a pre-roles vault.json into the role model: glob scopes on
+ * users become the site-admin bit, collection owners, and repository
+ * collaborators. This runs on startup, like the layout migration above, and
+ * the original file is copied to vault.json.pre-roles first, so the
+ * translation can be audited or undone by hand.
+ *
+ * The two models do not line up exactly, and where they differ the
+ * translation rounds up to the nearest role rather than dropping access:
+ *
+ *  - Push scope over a whole collection (`alice/*`) becomes ownership of the
+ *    collection, which also carries the admin role there. There is no
+ *    collection-wide write role to round down to.
+ *  - Admin scope whose collection part is itself a pattern (`*`) becomes the
+ *    site-admin bit.
+ *  - Push scope whose collection part is a pattern becomes ownership of every
+ *    collection the pattern matches today; a collection created later is not
+ *    covered, where the glob would have covered it.
+ *
+ * Each rounding is reported in the returned notes, which the server prints on
+ * the migration run. Scope over a single repository (`alice/webapp`) has an
+ * exact counterpart and is translated silently: write for push scope, admin
+ * for admin scope. A glob naming a repository that does not exist is dropped
+ * with a note, since collaborators are recorded in the repository itself.
+ */
+function migratePermissions(root) {
+    const state = (0, vault_1.loadVault)(root);
+    if (state.status !== 'ok' || !state.vault.legacy)
+        return null;
+    const file = (0, vault_1.vaultFilePath)(root);
+    const backup = `${file}.pre-roles`;
+    if (!fs.existsSync(backup))
+        fs.copyFileSync(file, backup);
+    const notes = [`translated glob scopes to roles; the old file is kept at ${path.basename(backup)}`];
+    const siteAdmins = [];
+    const collections = (0, scan_1.listCollections)(root).map((c) => c.name);
+    const collectionOf = (glob) => (glob.includes('/') ? glob.slice(0, glob.indexOf('/')) : glob);
+    const repoOf = (glob) => (glob.includes('/') ? glob.slice(glob.indexOf('/') + 1) : '*');
+    const isPattern = (s) => /[*?]/.test(s);
+    const makeOwner = (username, collection) => {
+        if (collection === username)
+            return; // implicit
+        (0, perms_1.addCollectionOwner)(root, collection, username);
+        notes.push(`${username}: now an owner of ${collection}`);
+    };
+    const makeCollaborator = (username, collection, repoName, role) => {
+        const repo = (0, scan_1.findRepo)(root, collection, repoName);
+        if (!repo) {
+            notes.push(`${username}: scope over ${collection}/${repoName} dropped; no such repository`);
+            return;
+        }
+        (0, perms_1.setCollaborator)(repo.dir, username, role);
+    };
+    for (const [username, user] of Object.entries(state.vault.users)) {
+        const legacy = user.legacy ?? { scope: [], admin: [] };
+        for (const kind of ['admin', 'scope']) {
+            // A site admin holds the admin role everywhere, so once the admin pass
+            // has granted the bit there is nothing the push globs could add.
+            if (siteAdmins.includes(username))
+                break;
+            const role = kind === 'admin' ? 'admin' : 'write';
+            for (const glob of legacy[kind]) {
+                const c = collectionOf(glob);
+                const r = repoOf(glob);
+                if (isPattern(c)) {
+                    if (kind === 'admin') {
+                        if (!siteAdmins.includes(username)) {
+                            siteAdmins.push(username);
+                            notes.push(`${username}: admin scope ${glob} becomes site admin`);
+                        }
+                    }
+                    else {
+                        for (const name of collections.filter((n) => (0, vault_1.globMatch)(c, n))) {
+                            if (r === '*')
+                                makeOwner(username, name);
+                            else
+                                for (const d of (0, scan_1.listRepoDirs)(root, name)
+                                    .map(scan_1.displayName)
+                                    .filter((n) => (0, vault_1.globMatch)(r, n))) {
+                                    makeCollaborator(username, name, d, role);
+                                }
+                        }
+                        notes.push(`${username}: push scope ${glob} covers only what exists today, as ownership or write`);
+                    }
+                    continue;
+                }
+                if (r === '*') {
+                    makeOwner(username, c);
+                    if (kind === 'scope' && c !== username) {
+                        notes.push(`${username}: push scope ${glob} rounds up to ownership of ${c}`);
+                    }
+                    continue;
+                }
+                if (isPattern(r)) {
+                    for (const d of (0, scan_1.listRepoDirs)(root, c)
+                        .map(scan_1.displayName)
+                        .filter((n) => (0, vault_1.globMatch)(r, n))) {
+                        makeCollaborator(username, c, d, role);
+                    }
+                    notes.push(`${username}: scope ${glob} covers only the repositories that exist today`);
+                    continue;
+                }
+                makeCollaborator(username, c, r, role);
+            }
+        }
+    }
+    (0, vault_1.finishPermsMigration)(root, siteAdmins);
+    return notes;
+}

package/dist/multipart.js

@@ -0,0 +1,90 @@
+"use strict";
+// Parsing multipart/form-data, which is how a browser sends files.
+//
+// mochi parses this itself rather than taking a dependency, for the same
+// reason it renders its own HTML: the format is small, the surface it is
+// exposed to is one form, and a parser in the tree is one that can be read.
+// The body arrives whole (express.raw with a cap) rather than as a stream,
+// which is what lets the parser be forty lines: an upload here is bounded by
+// the same cap either way, and streaming would buy nothing but complexity.
+//
+// The grammar, from RFC 7578 and RFC 2046: parts are separated by a line
+// `--<boundary>`, each part has headers, then a blank line, then its bytes,
+// and the epilogue begins at `--<boundary>--`. Every separator is preceded by
+// CRLF that belongs to the separator, not to the part's content.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.boundaryOf = boundaryOf;
+exports.parseMultipart = parseMultipart;
+exports.partField = partField;
+exports.partFiles = partFiles;
+/** The boundary out of a Content-Type header, or null if there is not one. */
+function boundaryOf(contentType) {
+    if (!contentType)
+        return null;
+    const m = contentType.match(/^\s*multipart\/form-data\s*;(.*)$/i);
+    if (!m)
+        return null;
+    const b = m[1].match(/boundary=(?:"([^"]+)"|([^;\s]+))/i);
+    if (!b)
+        return null;
+    return b[1] ?? b[2] ?? null;
+}
+function headerValue(headers, name) {
+    const m = headers.match(new RegExp(`^${name}:\\s*(.*)$`, 'im'));
+    return m ? m[1].trim() : undefined;
+}
+// Content-Disposition parameters. A filename may be quoted and may contain
+// escaped quotes; anything else is taken up to the next semicolon.
+function dispositionParam(disposition, key) {
+    const m = disposition.match(new RegExp(`${key}=(?:"((?:[^"\\\\]|\\\\.)*)"|([^;]*))`, 'i'));
+    if (!m)
+        return undefined;
+    return (m[1] !== undefined ? m[1].replace(/\\(.)/g, '$1') : (m[2] ?? '')).trim();
+}
+/**
+ * Split a body into its parts. Anything malformed yields the parts that were
+ * well formed rather than an exception: a caller checks for what it needs.
+ */
+function parseMultipart(body, boundary) {
+    const parts = [];
+    const sep = Buffer.from(`--${boundary}`);
+    let index = body.indexOf(sep);
+    if (index === -1)
+        return parts;
+    while (index !== -1) {
+        const after = index + sep.length;
+        // `--` here closes the whole body; anything else is a CRLF and a part.
+        if (body.length >= after + 2 && body[after] === 0x2d && body[after + 1] === 0x2d)
+            break;
+        const headerStart = after + 2;
+        const blank = body.indexOf('\r\n\r\n', headerStart);
+        const next = body.indexOf(sep, headerStart);
+        if (blank === -1 || next === -1 || blank > next)
+            break;
+        const headers = body.subarray(headerStart, blank).toString('utf8');
+        // The CRLF before the next separator belongs to the separator.
+        const data = body.subarray(blank + 4, Math.max(blank + 4, next - 2));
+        const disposition = headerValue(headers, 'content-disposition') ?? '';
+        const name = dispositionParam(disposition, 'name');
+        if (name !== undefined) {
+            const filename = dispositionParam(disposition, 'filename');
+            parts.push({
+                name,
+                filename: filename === undefined || filename === '' ? undefined : filename,
+                contentType: headerValue(headers, 'content-type'),
+                data: Buffer.from(data),
+            });
+        }
+        index = next;
+    }
+    return parts;
+}
+/** The value of a plain (non-file) field. */
+function partField(parts, name) {
+    const part = parts.find((p) => p.name === name && p.filename === undefined);
+    return part ? part.data.toString('utf8') : '';
+}
+/** Every part that carries a file, in the order the browser sent them. */
+function partFiles(parts, name) {
+    return parts.filter((p) => p.name === name && p.filename !== undefined && p.data.length > 0);
+}