@magland/mochi 0.3.1

package/dist/redirects.js

@@ -0,0 +1,455 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDIRECTS_FILE = void 0;
+exports.redirectsFilePath = redirectsFilePath;
+exports.loadRedirects = loadRedirects;
+exports.hasRedirects = hasRedirects;
+exports.resolveRepoRedirect = resolveRepoRedirect;
+exports.resolveCollectionRedirect = resolveCollectionRedirect;
+exports.recordRepoRename = recordRepoRename;
+exports.recordCollectionRename = recordCollectionRename;
+exports.forgetRepoRedirects = forgetRepoRedirects;
+exports.forgetCollectionRedirects = forgetCollectionRedirects;
+exports.redirectTargetPath = redirectTargetPath;
+exports.redirectTarget = redirectTarget;
+exports.registerRedirects = registerRedirects;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const atomic_1 = require("./atomic");
+const filecache_1 = require("./filecache");
+const layout_1 = require("./layout");
+const perms_1 = require("./perms");
+const scan_1 = require("./scan");
+const session_1 = require("./session");
+// Where a renamed thing used to be, in <vault>/redirects.json.
+//
+// A rename moves directories, so every address anyone already holds stops
+// working: a clone's remote, a link in an issue, a bookmark, a workflow that
+// fetches a file over HTTP. The alternative to remembering the old address is
+// asking everyone who held one to notice and fix it, which for a clone means
+// the failure arrives as an authentication prompt or a 404 in the middle of
+// someone's day.
+//
+// So a rename records where it went, and a request for a name nothing answers
+// to any more is redirected to wherever that name ended up. This is the
+// behaviour GitHub has, and the important half of it is the limit: the
+// redirect is consulted only when the old name is free. A repository created
+// later under the old name owns it outright, and the redirect for it goes
+// quiet from that moment, with nothing to undo and no state to clear. The same
+// holds for a collection.
+//
+// The map is keyed by name and not by any identity a repository carries, which
+// is the honest limit of this approach. A repository deleted and re-created
+// under the same name is a different repository wearing an answered-for name,
+// so deleteRepo drops the entries that point at what it removed rather than
+// letting them land somewhere unrelated.
+exports.REDIRECTS_FILE = 'redirects.json';
+/**
+ * How far a lookup will follow the map before giving up. A name renamed, and
+ * then renamed again, is two hops, and a vault where something has been
+ * renamed a dozen times in sequence is real; a cycle is not reachable through
+ * the recording path, but a hand-edited file can hold one, and this is what
+ * keeps that from being a hang.
+ */
+const MAX_HOPS = 16;
+function redirectsFilePath(root) {
+    return path.join(root, exports.REDIRECTS_FILE);
+}
+function stringMap(raw, field) {
+    if (raw === undefined)
+        return {};
+    if (typeof raw !== 'object' || raw === null)
+        throw new Error(`redirects.json: "${field}" must be an object`);
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (typeof v !== 'string')
+            throw new Error(`redirects.json: "${field}.${k}" must be a string`);
+        out[k] = v;
+    }
+    return out;
+}
+function normalize(parsed) {
+    if (typeof parsed !== 'object' || parsed === null)
+        throw new Error('redirects.json must be a JSON object');
+    const raw = parsed;
+    return { repos: stringMap(raw.repos, 'repos'), collections: stringMap(raw.collections, 'collections') };
+}
+const EMPTY = { repos: {}, collections: {} };
+const cache = (0, filecache_1.fileCache)({
+    read: (file) => {
+        try {
+            return normalize(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        catch (e) {
+            console.error(`redirects.json could not be read: ${e instanceof Error ? e.message : e}`);
+            return EMPTY;
+        }
+    },
+    missing: () => EMPTY,
+});
+/**
+ * The map as it is on disk, or an empty one if there is no file yet.
+ *
+ * Stat-cached like the runner registry and for the same reason: this is read
+ * on the way in to every request, and a vault that has never renamed anything
+ * should pay one stat for the feature and nothing else.
+ */
+function loadRedirects(root) {
+    return cache.get(redirectsFilePath(root));
+}
+/** Whether the vault has any redirect at all, which is the fast path's question. */
+function hasRedirects(root) {
+    const map = loadRedirects(root);
+    return Object.keys(map.repos).length > 0 || Object.keys(map.collections).length > 0;
+}
+function collectionExists(root, collection) {
+    if (!(0, scan_1.isValidName)(collection))
+        return false;
+    try {
+        return fs.statSync((0, layout_1.collectionDir)(root, collection)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function splitFull(full) {
+    const i = full.indexOf('/');
+    if (i <= 0)
+        return null;
+    const collection = full.slice(0, i);
+    const repo = full.slice(i + 1);
+    if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo))
+        return null;
+    return { collection, repo };
+}
+/**
+ * Where a repository asked for by an address it no longer has can be found, or
+ * null if that address needs no redirect.
+ *
+ * Null covers two cases deliberately, since neither is a redirect: the name is
+ * a repository that exists, and the name leads nowhere. A caller that gets
+ * null carries on and answers the request, or 404s it, exactly as it did
+ * before this existed.
+ *
+ * A repository entry is preferred over a collection one at each hop, being the
+ * more specific of the two: a repository moved out of a collection that was
+ * then renamed should follow the repository.
+ */
+function resolveRepoRedirect(root, collection, repo, map = loadRedirects(root)) {
+    let c = collection;
+    let r = repo;
+    let moved = false;
+    for (let hop = 0; hop < MAX_HOPS; hop++) {
+        if ((0, scan_1.findRepo)(root, c, r))
+            return moved ? { collection: c, repo: r } : null;
+        const target = map.repos[`${c}/${r}`];
+        if (target !== undefined) {
+            const next = splitFull(target);
+            if (!next)
+                return null;
+            c = next.collection;
+            r = next.repo;
+            moved = true;
+            continue;
+        }
+        const renamed = map.collections[c];
+        if (renamed !== undefined && (0, scan_1.isValidName)(renamed)) {
+            c = renamed;
+            moved = true;
+            continue;
+        }
+        return null;
+    }
+    return null;
+}
+/**
+ * The collection a former collection name now points at, or null if that name
+ * needs no redirect. As above, null means both "it is there" and "it leads
+ * nowhere".
+ */
+function resolveCollectionRedirect(root, collection, map = loadRedirects(root)) {
+    let c = collection;
+    let moved = false;
+    for (let hop = 0; hop < MAX_HOPS; hop++) {
+        if (collectionExists(root, c))
+            return moved ? c : null;
+        const renamed = map.collections[c];
+        if (renamed === undefined || !(0, scan_1.isValidName)(renamed))
+            return null;
+        c = renamed;
+        moved = true;
+    }
+    return null;
+}
+function write(root, map) {
+    const empty = Object.keys(map.repos).length === 0 && Object.keys(map.collections).length === 0;
+    if (empty) {
+        // Nothing to remember, so nothing on disk. A vault whose only rename was
+        // undone looks like one that never renamed anything, which is what it is.
+        fs.rmSync(redirectsFilePath(root), { force: true });
+    }
+    else {
+        (0, atomic_1.writeFileAtomic)(redirectsFilePath(root), JSON.stringify(map, null, 2) + '\n');
+    }
+    cache.invalidate(redirectsFilePath(root));
+}
+/**
+ * Drop every entry that no longer redirects anything: one whose own name is a
+ * repository or collection that exists again, and one whose chain leads
+ * nowhere. Both are entries a lookup already ignores, so this changes no
+ * answer; it keeps the file from accumulating a line per rename forever, and
+ * keeps it readable as a statement of what is actually being redirected.
+ *
+ * Run on the way out of every edit, under the lock, since that is the only
+ * time the file is written and the map is small enough for the pass to cost
+ * nothing worth measuring.
+ */
+function prune(root, map) {
+    for (const key of Object.keys(map.repos)) {
+        const from = splitFull(key);
+        if (!from || !resolveRepoRedirect(root, from.collection, from.repo, map))
+            delete map.repos[key];
+    }
+    for (const key of Object.keys(map.collections)) {
+        if (!resolveCollectionRedirect(root, key, map))
+            delete map.collections[key];
+    }
+}
+/**
+ * Hold the lock across a read, an edit, and the write back, as the runner
+ * registry does: two renames at once through two processes would otherwise
+ * lose one of the two redirects. The cache is dropped on the way in because
+ * the copy about to be edited has to be the one on disk.
+ */
+function edit(root, fn) {
+    (0, atomic_1.withFileLock)(`${redirectsFilePath(root)}.lock`, () => {
+        cache.invalidate(redirectsFilePath(root));
+        const current = loadRedirects(root);
+        const map = { repos: { ...current.repos }, collections: { ...current.collections } };
+        fn(map);
+        prune(root, map);
+        write(root, map);
+    });
+}
+/**
+ * Remember that a repository moved. Called after the directories have moved,
+ * so that a rename which failed halfway leaves no redirect claiming otherwise.
+ *
+ * An entry for the destination name is dropped: the name now belongs to this
+ * repository, so whatever it used to redirect to is not where a request for it
+ * should go.
+ */
+function recordRepoRename(root, collection, name, toCollection, toName) {
+    edit(root, (map) => {
+        delete map.repos[`${toCollection}/${toName}`];
+        map.repos[`${collection}/${name}`] = `${toCollection}/${toName}`;
+    });
+}
+/** Remember that a collection was renamed, as above. */
+function recordCollectionRename(root, name, toName) {
+    edit(root, (map) => {
+        delete map.collections[toName];
+        map.collections[name] = toName;
+    });
+}
+/**
+ * Forget a repository that has been deleted: both the redirect out of its own
+ * name and every redirect that pointed at it.
+ *
+ * The second half is the one that matters. Without it, a repository deleted
+ * and a new one created under the same name would inherit the old one's
+ * redirects, so an address that used to reach the deleted repository would
+ * quietly start reaching someone else's.
+ */
+function forgetRepoRedirects(root, collection, name) {
+    const full = `${collection}/${name}`;
+    const map = loadRedirects(root);
+    if (map.repos[full] === undefined && !Object.values(map.repos).includes(full))
+        return;
+    edit(root, (m) => {
+        delete m.repos[full];
+        for (const [key, target] of Object.entries(m.repos)) {
+            if (target === full)
+                delete m.repos[key];
+        }
+    });
+}
+/**
+ * Forget a collection that has been removed, on the same terms: both the
+ * redirect out of its own name and every redirect that led to it, so that a
+ * collection created later under that name does not inherit traffic meant for
+ * the one that is gone.
+ */
+function forgetCollectionRedirects(root, name) {
+    const map = loadRedirects(root);
+    if (map.collections[name] === undefined && !Object.values(map.collections).includes(name))
+        return;
+    edit(root, (m) => {
+        delete m.collections[name];
+        for (const [key, target] of Object.entries(m.collections)) {
+            if (target === name)
+                delete m.collections[key];
+        }
+    });
+}
+// ---- serving the redirect ----
+function decodeSegment(segment) {
+    if (!segment.includes('%'))
+        return segment;
+    try {
+        return decodeURIComponent(segment);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The path a request should be sent to instead, or null if it should be
+ * answered where it is.
+ *
+ * Three shapes of address name a collection or a repository, and all three are
+ * rewritten the same way, since a redirect covering only the web pages would
+ * leave a clone, an LFS fetch, and a program using the API failing on an
+ * address a browser follows happily:
+ *
+ *   /<collection>[/<repo>][/...]                the web, git over HTTP, LFS
+ *   /api/repos/<collection>/<repo>[/...]        the repository API
+ *   /api/collections/<collection>[/...]         the collection API
+ *
+ * The tail of the path is carried across untouched. It names something inside
+ * the repository - a branch, a file, an issue number, a git service - and a
+ * rename changes none of that.
+ */
+function redirectTargetPath(root, pathname) {
+    return redirectTarget(root, pathname)?.path ?? null;
+}
+/**
+ * The redirect for a path, along with the repository the new address names
+ * when it names one, so the middleware below can ask whether the requester
+ * may be told where it went.
+ */
+function redirectTarget(root, pathname) {
+    const segs = pathname.split('/');
+    let offset = 1;
+    let repoSegment = true;
+    if (segs[1] === 'api') {
+        if (segs[2] === 'repos')
+            offset = 3;
+        else if (segs[2] === 'collections') {
+            offset = 3;
+            repoSegment = false;
+        }
+        else
+            return null;
+    }
+    const rawCollection = segs[offset];
+    if (!rawCollection)
+        return null;
+    const collection = decodeSegment(rawCollection);
+    if (collection === null || !(0, scan_1.isValidName)(collection))
+        return null;
+    const rawRepo = repoSegment ? segs[offset + 1] : undefined;
+    if (rawRepo) {
+        const repo = decodeSegment(rawRepo);
+        if (repo !== null && (0, scan_1.isValidName)(repo)) {
+            // `.git` is optional in a git URL and is kept as the request wrote it, so
+            // a clone that follows a redirect keeps asking for the same spelling it
+            // started with.
+            const base = (0, scan_1.displayName)(repo);
+            const suffix = repo === base ? '' : '.git';
+            const to = resolveRepoRedirect(root, collection, base);
+            if (to) {
+                segs[offset] = encodeURIComponent(to.collection);
+                segs[offset + 1] = encodeURIComponent(to.repo) + suffix;
+                return { path: segs.join('/'), repo: to };
+            }
+        }
+    }
+    // No repository answered for it, so the collection may still have moved.
+    // Every address under a renamed collection follows it, including one naming
+    // a repository that is not in it, which then 404s at the address the
+    // collection has now rather than the one it used to have.
+    const toCollection = resolveCollectionRedirect(root, collection);
+    if (toCollection === null)
+        return null;
+    segs[offset] = encodeURIComponent(toCollection);
+    return { path: segs.join('/'), repo: null };
+}
+/**
+ * Send a request to where the thing it names now lives.
+ *
+ * Registered ahead of every route that resolves a collection or a repository,
+ * which is safe because a redirect is only ever found for a name nothing
+ * answers to: a request for something that is there passes straight through,
+ * having cost the stat that found it, and a vault that has never renamed
+ * anything costs one stat of a file that is not there.
+ *
+ * 301 for a GET or a HEAD, and 308 for anything else. The difference is the
+ * method: a client following a 301 may turn a POST into a GET, which would
+ * turn an API call or a git push into a request for a page, while a 308 keeps
+ * the method and the body. Both say the move is permanent, which is what has
+ * git record the new address rather than following a redirect on every fetch.
+ *
+ * Permanent, but not cacheable. A redirect here is conditional on the old name
+ * being free, so a browser holding a 301 for a year would keep following it
+ * past the day someone creates a repository under that name, which is the one
+ * case where the redirect has to stop. no-store costs a round trip that the
+ * rename made necessary anyway.
+ */
+function registerRedirects(app, root) {
+    app.use((req, res, next) => {
+        if (!hasRedirects(root))
+            return next();
+        const to = redirectTarget(root, req.path);
+        if (to === null)
+            return next();
+        // A redirect that lands on a private repository would tell whoever probes
+        // the old name that the repository exists and where it went, so it is
+        // answered only for a viewer who could read the destination; everyone
+        // else falls through to the 404 the old name would give anyway. Only the
+        // browser session is consulted: a git client following an old remote of a
+        // private repository gets the 404 and updates its remote by hand.
+        if (to.repo) {
+            const target = (0, scan_1.findRepo)(root, to.repo.collection, to.repo.repo);
+            if (target && !(0, perms_1.canReadRepo)(root, (0, session_1.getViewer)(req, root)?.auth ?? null, target))
+                return next();
+        }
+        const q = req.originalUrl.indexOf('?');
+        const query = q === -1 ? '' : req.originalUrl.slice(q);
+        const permanent = req.method === 'GET' || req.method === 'HEAD' ? 301 : 308;
+        res.set('Cache-Control', 'no-store').redirect(permanent, to.path + query);
+    });
+}