@magland/mochi 0.3.1

package/dist/perms.js

@@ -0,0 +1,370 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COLLECTION_FILE = exports.REPO_ACCESS_FILE = void 0;
+exports.atLeast = atLeast;
+exports.repoAccess = repoAccess;
+exports.repoIsPrivate = repoIsPrivate;
+exports.setRepoPrivate = setRepoPrivate;
+exports.setCollaborator = setCollaborator;
+exports.removeCollaborator = removeCollaborator;
+exports.collectionOwners = collectionOwners;
+exports.isCollectionOwner = isCollectionOwner;
+exports.addCollectionOwner = addCollectionOwner;
+exports.removeCollectionOwner = removeCollectionOwner;
+exports.isSiteAdmin = isSiteAdmin;
+exports.repoRole = repoRole;
+exports.canReadRepo = canReadRepo;
+exports.canWriteRepo = canWriteRepo;
+exports.canAdminRepo = canAdminRepo;
+exports.canCreateRepo = canCreateRepo;
+exports.canCreateSomeRepo = canCreateSomeRepo;
+exports.canCreateCollection = canCreateCollection;
+exports.canAdminCollection = canAdminCollection;
+exports.repoRenameBlocker = repoRenameBlocker;
+exports.collectionMoveBlocker = collectionMoveBlocker;
+exports.removeUserGrants = removeUserGrants;
+exports.canAdminRunnerGlobs = canAdminRunnerGlobs;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const atomic_1 = require("./atomic");
+const filecache_1 = require("./filecache");
+const layout_1 = require("./layout");
+const scan_1 = require("./scan");
+const vault_1 = require("./vault");
+const RANK = { read: 1, write: 2, admin: 3 };
+function atLeast(role, min) {
+    return role !== null && RANK[role] >= RANK[min];
+}
+/** The strongest of two, where null is weakest of all. */
+function stronger(a, b) {
+    if (a === null)
+        return b;
+    if (b === null)
+        return a;
+    return RANK[a] >= RANK[b] ? a : b;
+}
+function isRole(v) {
+    return v === 'read' || v === 'write' || v === 'admin';
+}
+exports.REPO_ACCESS_FILE = 'mochi.json';
+function normalizeRepoAccess(parsed) {
+    const out = { private: false, collaborators: {} };
+    if (typeof parsed !== 'object' || parsed === null)
+        return out;
+    const rec = parsed;
+    if (rec.private === true)
+        out.private = true;
+    if (typeof rec.collaborators === 'object' && rec.collaborators !== null) {
+        for (const [user, role] of Object.entries(rec.collaborators)) {
+            if (isRole(role))
+                out.collaborators[user] = role;
+        }
+    }
+    return out;
+}
+const accessCache = (0, filecache_1.fileCache)({
+    read: (file) => {
+        try {
+            return normalizeRepoAccess(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        catch {
+            // An unreadable file grants nothing it cannot prove: the repository is
+            // treated as private with no collaborators, so a corrupted access file
+            // fails closed rather than publishing what it was protecting.
+            return { private: true, collaborators: {} };
+        }
+    },
+    missing: () => ({ private: false, collaborators: {} }),
+});
+/** The access state of the repository whose bare directory this is. */
+function repoAccess(repoDir) {
+    return accessCache.get(path.join(repoDir, exports.REPO_ACCESS_FILE));
+}
+function repoIsPrivate(repoDir) {
+    return repoAccess(repoDir).private;
+}
+/**
+ * Read-modify-write on a repository's access file, under a lock, the same
+ * arrangement vault.json edits use. The cache is invalidated explicitly
+ * because a write landing within the mtime granularity would otherwise be
+ * invisible to it.
+ */
+function editRepoAccess(repoDir, fn) {
+    const file = path.join(repoDir, exports.REPO_ACCESS_FILE);
+    return (0, atomic_1.withFileLock)(`${file}.lock`, () => {
+        let access = { private: false, collaborators: {} };
+        if (fs.existsSync(file)) {
+            access = normalizeRepoAccess(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        fn(access);
+        (0, atomic_1.writeFileAtomic)(file, JSON.stringify(access, null, 2) + '\n');
+        accessCache.invalidate(file);
+        return access;
+    });
+}
+function setRepoPrivate(repoDir, priv) {
+    return editRepoAccess(repoDir, (a) => {
+        a.private = priv;
+    });
+}
+function setCollaborator(repoDir, username, role) {
+    return editRepoAccess(repoDir, (a) => {
+        a.collaborators[username] = role;
+    });
+}
+function removeCollaborator(repoDir, username) {
+    return editRepoAccess(repoDir, (a) => {
+        delete a.collaborators[username];
+    });
+}
+// ---- per-collection state: collections/<name>/collection.json ----
+exports.COLLECTION_FILE = 'collection.json';
+function collectionFilePath(root, collection) {
+    return path.join((0, layout_1.collectionDir)(root, collection), exports.COLLECTION_FILE);
+}
+function normalizeOwners(parsed) {
+    if (typeof parsed !== 'object' || parsed === null)
+        return [];
+    const owners = parsed.owners;
+    if (!Array.isArray(owners))
+        return [];
+    return owners.filter((o) => typeof o === 'string');
+}
+const ownersCache = (0, filecache_1.fileCache)({
+    read: (file) => {
+        try {
+            return normalizeOwners(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        catch {
+            return [];
+        }
+    },
+    missing: () => [],
+});
+/** The explicit owners of a collection. The implicit one is not listed here. */
+function collectionOwners(root, collection) {
+    return ownersCache.get(collectionFilePath(root, collection));
+}
+/** Owner by the explicit list or by bearing the collection's own name. */
+function isCollectionOwner(root, collection, username) {
+    return username === collection || collectionOwners(root, collection).includes(username);
+}
+function editOwners(root, collection, fn) {
+    const file = collectionFilePath(root, collection);
+    // The collection directory exists whenever a collection does; a caller
+    // adding an owner to a collection that is yet to exist creates it. Before
+    // the lock, because the lock file lives in the same directory.
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    return (0, atomic_1.withFileLock)(`${file}.lock`, () => {
+        let owners = [];
+        if (fs.existsSync(file)) {
+            owners = normalizeOwners(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        owners = fn(owners);
+        (0, atomic_1.writeFileAtomic)(file, JSON.stringify({ owners }, null, 2) + '\n');
+        ownersCache.invalidate(file);
+        return owners;
+    });
+}
+function addCollectionOwner(root, collection, username) {
+    return editOwners(root, collection, (owners) => (owners.includes(username) ? owners : [...owners, username]));
+}
+function removeCollectionOwner(root, collection, username) {
+    return editOwners(root, collection, (owners) => owners.filter((o) => o !== username));
+}
+function tokenCovers(auth, target) {
+    return auth.token.scope === undefined || auth.token.scope.some((g) => (0, vault_1.globMatch)(g, target));
+}
+function tokenIsScoped(auth) {
+    return auth.token.scope !== undefined;
+}
+/** Site admin, acting through a token that has not been narrowed. */
+function isSiteAdmin(auth) {
+    return auth !== null && auth.user.siteAdmin === true && !tokenIsScoped(auth);
+}
+/**
+ * The strongest role the caller holds on this repository, or null for none.
+ * null on a private repository is "you cannot see it", and the surfaces
+ * answer it with the same 404 an absent repository gets.
+ */
+function repoRole(root, auth, repo) {
+    const access = repoAccess(repo.dir);
+    const anonymous = access.private ? null : 'read';
+    if (!auth)
+        return anonymous;
+    let role = auth.user.siteAdmin === true || isCollectionOwner(root, repo.collection, auth.username)
+        ? 'admin'
+        : stronger(anonymous, access.collaborators[auth.username] ?? null);
+    if (tokenIsScoped(auth)) {
+        if (!tokenCovers(auth, `${repo.collection}/${repo.name}`))
+            return anonymous;
+        if (role === 'admin')
+            role = 'write';
+    }
+    return role;
+}
+function canReadRepo(root, auth, repo) {
+    return atLeast(repoRole(root, auth, repo), 'read');
+}
+function canWriteRepo(root, auth, repo) {
+    return atLeast(repoRole(root, auth, repo), 'write');
+}
+function canAdminRepo(root, auth, repo) {
+    return atLeast(repoRole(root, auth, repo), 'admin');
+}
+/**
+ * Whether a user may bring the repository collection/name into being, which
+ * push-to-create, the new-repository form, forks, and repository moves all
+ * ask. Owners create in their collections; site admins anywhere. A narrowed
+ * token must additionally cover the name being created, as it always had to.
+ */
+function canCreateRepo(root, auth, collection, name) {
+    if (!tokenCovers(auth, `${collection}/${name}`))
+        return false;
+    return auth.user.siteAdmin === true || isCollectionOwner(root, collection, auth.username);
+}
+/**
+ * The same question with no repository name yet: whether the user could
+ * create anything at all in the collection. The import page asks this before
+ * writing a push command it knows would be refused.
+ */
+function canCreateSomeRepo(root, auth, collection) {
+    if (!(auth.user.siteAdmin === true || isCollectionOwner(root, collection, auth.username)))
+        return false;
+    if (auth.token.scope === undefined)
+        return true;
+    const collectionOf = (glob) => (glob.includes('/') ? glob.slice(0, glob.indexOf('/')) : glob);
+    return auth.token.scope.some((g) => (0, vault_1.globMatch)(collectionOf(g), collection));
+}
+/**
+ * Whether a user may create the collection named. A user's own namespace is
+ * theirs the way a GitHub account's is; every other name takes a site admin.
+ * The empty-collection form and repository moves into a fresh collection ask
+ * this; push-to-create asks canCreateRepo, which folds the same rule in
+ * through ownership.
+ */
+function canCreateCollection(_root, auth, collection) {
+    if (auth.user.siteAdmin === true && !tokenIsScoped(auth))
+        return true;
+    if (auth.username !== collection)
+        return false;
+    // A narrowed token may create its holder's namespace only if some glob's
+    // collection part reaches into it.
+    if (auth.token.scope === undefined)
+        return true;
+    const collectionOf = (glob) => (glob.includes('/') ? glob.slice(0, glob.indexOf('/')) : glob);
+    return auth.token.scope.some((g) => (0, vault_1.globMatch)(collectionOf(g), collection));
+}
+/**
+ * Whether a user may administer the collection as a whole: its settings, its
+ * owners, its name. Owners and site admins may; a narrowed token may not
+ * administer anything, as before.
+ */
+function canAdminCollection(root, auth, collection) {
+    if (tokenIsScoped(auth))
+        return false;
+    return auth.user.siteAdmin === true || isCollectionOwner(root, collection, auth.username);
+}
+// The composite rules below are each asked by the web interface and by the
+// JSON API. They live here, once, so the two surfaces cannot drift; the
+// blockers return the missing ability as a phrase rather than answering
+// false, so each surface words its own refusal around the same rule.
+/**
+ * The ability a repository rename or move is missing, or null when none is.
+ * Renaming in place is the repository's own business, so the admin role there
+ * decides it; moving to another collection is also a creation over there, so
+ * that half asks canCreateRepo, exactly as a transfer does on GitHub.
+ */
+function repoRenameBlocker(root, auth, repo, toCollection, toName) {
+    if (!canAdminRepo(root, auth, repo))
+        return `the admin role on ${repo.collection}/${repo.name}`;
+    if (toCollection !== repo.collection && !canCreateRepo(root, auth, toCollection, toName)) {
+        return `permission to create repositories in ${toCollection}`;
+    }
+    return null;
+}
+/**
+ * The ability a collection rename is missing, or null when none is. Owners
+ * rename their collection to any free name, and the owners file moves with
+ * it; whether the destination name is free is the operation's own check, not
+ * a permission.
+ */
+function collectionMoveBlocker(root, auth, collection) {
+    if (!canAdminCollection(root, auth, collection))
+        return `ownership of ${collection}`;
+    return null;
+}
+/**
+ * Remove every grant a username holds, across the vault: its entries in
+ * owners lists and its collaborator roles. Called when the user is deleted,
+ * because a grant is keyed by name alone: left behind, it would belong to
+ * whoever is given the name next, silently. The user's implicit namespace
+ * needs no sweeping, since a future user of the same name is meant to own
+ * the collection named after them.
+ */
+function removeUserGrants(root, username) {
+    for (const { name: collection } of (0, scan_1.listCollections)(root)) {
+        if (collectionOwners(root, collection).includes(username)) {
+            removeCollectionOwner(root, collection, username);
+        }
+        for (const dirName of (0, scan_1.listRepoDirs)(root, collection)) {
+            const dir = (0, layout_1.repoPath)(root, collection, dirName);
+            if (repoAccess(dir).collaborators[username] !== undefined) {
+                removeCollaborator(dir, username);
+            }
+        }
+    }
+}
+/**
+ * Whether a user may administer a runner whose allow list this is. Runners
+ * are vault infrastructure, so site admins always may; short of that, a
+ * runner confined to collections the caller owns is the caller's to manage.
+ * An allow glob whose collection part is itself a pattern reaches
+ * collections nobody in particular owns, so only a site admin covers it.
+ */
+function canAdminRunnerGlobs(root, auth, globs) {
+    if (tokenIsScoped(auth))
+        return false;
+    if (auth.user.siteAdmin === true)
+        return true;
+    if (globs.length === 0)
+        return false;
+    const collectionOf = (glob) => (glob.includes('/') ? glob.slice(0, glob.indexOf('/')) : glob);
+    return globs.every((g) => {
+        const c = collectionOf(g);
+        return !/[*?]/.test(c) && isCollectionOwner(root, c, auth.username);
+    });
+}

package/dist/pointer.js

@@ -0,0 +1,55 @@
+"use strict";
+// Strict parser for Git LFS pointer files. A pointer is exactly the version
+// line, an oid line, and a size line, LF-terminated, in that order. Strictness
+// matters: this parser decides whether a blob renders as a download card
+// instead of as its contents, and a false positive would hide a legitimate
+// text file.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikePointer = looksLikePointer;
+exports.parsePointer = parsePointer;
+const VERSION_LINE = 'version https://git-lfs.github.com/spec/v1';
+const MAX_POINTER_SIZE = 200;
+// The loose check below reads only the first line, so it can afford a larger
+// bound than the strict parser: a pointer carrying extension lines runs past
+// 200 bytes, and refusing to edit it is the whole point of that check.
+const MAX_LOOSE_POINTER_SIZE = 4096;
+// A deliberately looser test than parsePointer, used only to decide whether
+// the browser editor must refuse a file. Committing text over a pointer
+// corrupts the repository's LFS state, so the refusal must also cover pointers
+// this module will not fully parse: the real format permits extension lines
+// (`ext-0-<name> …`) between the version and the oid, which parsePointer
+// rejects because rendering has to stay strict. Erring toward refusing an edit
+// costs a user one git command; erring the other way silently breaks a file.
+function looksLikePointer(buf) {
+    if (buf.length > MAX_LOOSE_POINTER_SIZE)
+        return false;
+    return buf.toString('utf8', 0, VERSION_LINE.length + 1) === `${VERSION_LINE}\n`;
+}
+function parsePointer(buf) {
+    if (buf.length > MAX_POINTER_SIZE)
+        return null;
+    let text;
+    try {
+        text = buf.toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    if (!text.endsWith('\n'))
+        return null;
+    const lines = text.slice(0, -1).split('\n');
+    if (lines.length !== 3)
+        return null;
+    if (lines[0] !== VERSION_LINE)
+        return null;
+    const oidMatch = lines[1].match(/^oid sha256:([0-9a-f]{64})$/);
+    if (!oidMatch)
+        return null;
+    const sizeMatch = lines[2].match(/^size ([0-9]+)$/);
+    if (!sizeMatch)
+        return null;
+    const size = parseInt(sizeMatch[1], 10);
+    if (!Number.isSafeInteger(size))
+        return null;
+    return { oid: oidMatch[1], size };
+}

package/dist/profile.js

@@ -0,0 +1,106 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROFILE_DIR = exports.PROFILE_REPO = void 0;
+exports.collectionProfile = collectionProfile;
+const markdown_1 = require("./markdown");
+const render_1 = require("./render");
+const scan_1 = require("./scan");
+const views_1 = require("./views");
+/**
+ * A collection's profile README: the page a collection shows above its
+ * repository listing, so that a collection can say what it is rather than
+ * leaving a visitor to infer it from the names in the list.
+ *
+ * Where it comes from is a convention rather than a new place in the vault. A
+ * repository named `.mochi` in the collection holds it at
+ * `profile/README.md`, on the repository's default branch. GitHub reads an
+ * organization's profile out of a `.github` repository the same way, and the
+ * borrowed shape carries a real advantage: the file is edited, reviewed,
+ * diffed, and reverted by everything the forge already does to a file in a
+ * repository, and the collection page only reads it.
+ *
+ * The repository is otherwise ordinary. It appears in the collection's listing
+ * like any other, its own README shows on its own page, and the write role on it
+ * is what decides who may change the profile.
+ */
+exports.PROFILE_REPO = '.mochi';
+/** The directory inside PROFILE_REPO the README is read from. */
+exports.PROFILE_DIR = 'profile';
+/** The README names accepted in PROFILE_DIR; the first one in the tree wins. */
+const README_RE = /^readme(\.(md|markdown|txt))?$/i;
+const MAX_PROFILE_SIZE = 1024 * 1024;
+/**
+ * Read and render a collection's profile README. Never throws: a collection
+ * without the repository, without the file, or with a file that is not text
+ * reads as no profile at all, since the collection page is worth serving
+ * either way.
+ */
+async function collectionProfile(root, collection) {
+    const enc = encodeURIComponent(collection);
+    const newRepoUrl = `/new?collection=${enc}&name=${encodeURIComponent(exports.PROFILE_REPO)}`;
+    const repo = (0, scan_1.findRepo)(root, collection, exports.PROFILE_REPO);
+    if (!repo)
+        return { readme: null, addUrl: newRepoUrl };
+    const base = `/${enc}/${encodeURIComponent(exports.PROFILE_REPO)}`;
+    let branch = null;
+    try {
+        branch = await repo.defaultBranch(await repo.listRefs('heads'));
+    }
+    catch {
+        branch = null;
+    }
+    // An empty repository has no branch to read and none to edit on; the editor
+    // creates one, and the form's own default is main.
+    if (branch === null)
+        return { readme: null, addUrl: `${base}/new/main/${exports.PROFILE_DIR}` };
+    const addUrl = `${base}/new/${(0, views_1.encPath)(branch)}/${exports.PROFILE_DIR}`;
+    const readme = await readProfileReadme(repo, branch);
+    if (!readme)
+        return { readme: null, addUrl };
+    const html = /\.(md|markdown)$/i.test(readme.name) || !readme.name.includes('.')
+        ? (0, markdown_1.renderMarkdown)(readme.text, {
+            rawBase: `${base}/raw/${(0, views_1.encPath)(branch)}/${exports.PROFILE_DIR}`,
+            blobBase: `${base}/blob/${(0, views_1.encPath)(branch)}/${exports.PROFILE_DIR}`,
+            issueBase: `${base}/issues`,
+            commitBase: `${base}/commit`,
+        })
+        : `<pre>${(0, render_1.esc)(readme.text)}</pre>`;
+    return {
+        readme: {
+            html,
+            name: `${exports.PROFILE_DIR}/${readme.name}`,
+            url: `${base}/blob/${(0, views_1.encPath)(branch)}/${exports.PROFILE_DIR}/${(0, views_1.encPath)(readme.name)}`,
+        },
+        addUrl,
+    };
+}
+async function readProfileReadme(repo, branch) {
+    let entries;
+    try {
+        entries = await repo.listTree(branch, exports.PROFILE_DIR);
+    }
+    catch {
+        return null;
+    }
+    // The name is matched the way a repository's own README is, so that a
+    // profile written as README.markdown or readme.txt is not silently ignored.
+    const entry = entries.find((e) => e.type === 'blob' && README_RE.test(e.name));
+    if (!entry || (entry.size ?? 0) > MAX_PROFILE_SIZE)
+        return null;
+    let buf;
+    try {
+        buf = await repo.catBlob(branch, `${exports.PROFILE_DIR}/${entry.name}`);
+    }
+    catch {
+        return null;
+    }
+    if ((0, render_1.isBinary)(buf))
+        return null;
+    const text = buf.toString('utf8');
+    // A file with nothing in it is no profile: an empty box above the listing
+    // would say less than the listing alone, and the prompt to write one is
+    // still worth offering.
+    if (text.trim() === '')
+        return null;
+    return { name: entry.name, text };
+}