@magland/mochi 0.3.1

package/dist/server.js

@@ -0,0 +1,424 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApp = createApp;
+const compression_1 = __importDefault(require("compression"));
+const express_1 = __importDefault(require("express"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const api_1 = require("./api");
+const browse_1 = require("./browse");
+const api_2 = require("./ci/api");
+const engine_1 = require("./ci/engine");
+const wake_1 = require("./ci/wake");
+const web_1 = require("./ci/web");
+const config_1 = require("./config");
+const egress_1 = require("./egress");
+const limit_1 = require("./limit");
+const compare_1 = require("./compare");
+const find_1 = require("./find");
+const issueweb_1 = require("./issueweb");
+const githttp_1 = require("./githttp");
+const lfs_1 = require("./lfs");
+const pullweb_1 = require("./pullweb");
+const releases_1 = require("./releases");
+const lfsstore_1 = require("./lfsstore");
+const layout_1 = require("./layout");
+const logo_1 = require("./logo");
+const migrate_1 = require("./migrate");
+const perms_1 = require("./perms");
+const redirects_1 = require("./redirects");
+const scan_1 = require("./scan");
+const session_1 = require("./session");
+const site_1 = require("./site");
+const siteshost_1 = require("./siteshost");
+const assets_1 = require("./assets");
+const pagescript_1 = require("./pagescript");
+const themes_1 = require("./themes");
+const views = __importStar(require("./views"));
+const webops_1 = require("./webops");
+// Exempt from the coarse ceiling, checked before anything is charged.
+//
+// /api/runner/* because the runner's long poll and its log posts are
+// legitimately high-volume from one address, and a runner sharing an address
+// with a person must not throttle either. The assets because they are served
+// from memory or a package directory and are cheaper to answer than to count.
+//
+// The asset prefixes are exempt on the forge's own hostname only: on a sites
+// hostname those paths belong to the site being served, and are ordinary traffic.
+// Responses that must reach the client exactly as written, so compression is
+// not offered on them.
+//
+// The git wire protocol and LFS carry their own compression -- a packfile is
+// already deflated -- and both stream, so wrapping them costs CPU to make the
+// body no smaller and delays the first bytes of a clone. The backup stream is
+// the same bargain over a much bigger body.
+//
+// Everything else is HTML, CSS, JSON or plain text, where the saving is large:
+// a repository page goes from 133 KB to 11 KB.
+const UNCOMPRESSED = /^\/[^/]+\/[^/]+\/(info\/refs|git-upload-pack|git-receive-pack|info\/lfs\/)|^\/api\/backup\//;
+function isCompressible(req, res) {
+    if (UNCOMPRESSED.test(req.path))
+        return false;
+    return compression_1.default.filter(req, res);
+}
+/**
+ * What a forge page may load, and from where.
+ *
+ * The interface serves untrusted content from its own origin -- a repository's
+ * files, an issue somebody wrote, a rendered README -- so escaping and
+ * sanitizing are not the only line worth having. This one is the browser's:
+ * even a page that somehow carried injected markup could not run it.
+ *
+ * script-src 'self' is the directive that does the work, and it is why the
+ * pages carry no inline script at all: the one script they load is
+ * /assets/page.js, and everything page-specific reaches it through a data
+ * attribute (see src/pagescript.ts). A policy that allowed inline script would
+ * allow an injected one too, since the browser cannot tell them apart.
+ *
+ * Two directives are looser than the rest, both deliberately:
+ *
+ *   style-src allows inline style, because the interface paints with values it
+ *   computes -- a language bar's widths, a theme swatch's palette, an egress
+ *   meter's fill. An inline style cannot execute anything, so this buys much
+ *   less than script-src and costs nothing to keep.
+ *
+ *   img-src allows any host, because markdown may already reference an
+ *   external image and does today; narrowing it would silently stop READMEs
+ *   rendering and needs an image proxy first, which is what GitHub built for
+ *   the same reason.
+ *
+ * frame-ancestors keeps the forge's own pages out of somebody else's frame: a
+ * CSRF token and the Origin check in src/session.ts refuse a request forged
+ * from elsewhere, but neither refuses a real click on a real page inside a
+ * frame, which is what would let a merge, a close, or a branch deletion be
+ * obtained from a signed-in reader who thought they were clicking something of
+ * the framing page's. base-uri and form-action close the two ways injected
+ * markup could redirect a relative URL or a form post without running script.
+ */
+const FORGE_CSP = [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    'img-src * data:',
+    "font-src 'self'",
+    "connect-src 'self'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'self'",
+    "frame-ancestors 'self'",
+].join('; ');
+function isRateExempt(root, req) {
+    if (req.path.startsWith('/api/runner/'))
+        return true;
+    if ((0, siteshost_1.isUnderSitesHost)((0, config_1.loadConfig)(root).sites.host, req.hostname))
+        return false;
+    return req.path.startsWith('/assets/') || req.path === '/favicon.svg' || req.path === '/favicon.ico';
+}
+function createApp(root) {
+    // Before anything is served: a vault written under the older layout, with
+    // its collections directly in the root, is moved to the current one. Renames
+    // only, and a no-op on a vault already laid out this way. A vault that could
+    // not be migrated is not served, since serving it would show an empty vault
+    // to someone whose repositories are all still there.
+    const migration = (0, migrate_1.migrateLayout)(root);
+    if (migration) {
+        console.log(`Migrated ${migration.collections.length} collection(s) to ${layout_1.COLLECTIONS_DIR}/<collection>/${layout_1.REPOS_DIR}/: ${migration.collections.join(', ')}`);
+    }
+    // Likewise a vault.json from before roles: its glob scopes become owners,
+    // collaborators, and the site-admin bit, and each rounding is said aloud.
+    const permNotes = (0, migrate_1.migratePermissions)(root);
+    if (permNotes) {
+        for (const note of permNotes)
+            console.log(`permissions: ${note}`);
+    }
+    const app = (0, express_1.default)();
+    app.disable('x-powered-by');
+    const config = (0, config_1.loadConfig)(root);
+    // Behind a TLS proxy (Caddy, Fly, etc.) X-Forwarded-Proto/Host must win, or
+    // clone URLs and Secure cookies would use the internal address. On a vault
+    // exposed directly they must not: req.ip would then be read from a
+    // client-supplied X-Forwarded-For, which defeats every per-address limit and
+    // makes the limiter's own key space unbounded.
+    //
+    // Read once at startup rather than per request, unlike the theme and the CI
+    // settings. Express resolves 'trust proxy' when the Request prototype is
+    // built, so it is not a per-request decision to make, and changing whether the
+    // internet is trusted is a restart-worthy event in a way that changing a
+    // colour scheme is not. The same goes for the limits below, which hold live
+    // counts that cannot be rebuilt per request without discarding them.
+    app.set('trust proxy', config.network.trustProxy);
+    // Outgoing bytes, counted per repository and capped per day. The cap is read
+    // through loadConfig on every call rather than captured here, unlike the rest
+    // of the limits block: it is the one limit whose value an operator needs to
+    // change while the vault is refusing to answer.
+    const egress = (0, egress_1.createEgress)(root, () => (0, config_1.loadConfig)(root).limits.egressGbPerDay);
+    // First of all, because it has to attach its listeners before anything can
+    // end the response. What it counts is what reaches the socket, so it is
+    // indifferent to what wraps the body after this point: whatever answers the
+    // request, and in whatever encoding, those bytes are charged to somebody.
+    app.use((req, res, next) => {
+        egress.watch(req, res);
+        next();
+    });
+    // Ahead of every route and every other middleware, because it works by
+    // wrapping the response: anything mounted earlier would answer uncompressed.
+    // That includes the sites served from this process and the error pages.
+    app.use((0, compression_1.default)({ filter: isCompressible }));
+    const gates = (0, limit_1.createGates)(config.limits);
+    const authLimiter = (0, limit_1.createAuthLimiter)(config.limits.authFailures);
+    const requestLimiter = (0, limit_1.createLimiter)({
+        limit: config.limits.requestsPerMinute,
+        windowMs: 60000,
+        maxKeys: 20000,
+    });
+    // The theme is vault state, so it is re-read (stat-cached) per request:
+    // hand-editing config.json takes effect without a restart.
+    app.use((_req, _res, next) => {
+        (0, themes_1.setActiveTheme)((0, config_1.loadConfig)(root).theme);
+        next();
+    });
+    // The bluntest of the three limits: a ceiling on ordinary traffic, so that one
+    // misbehaving crawler cannot saturate the process with cheap page renders. It
+    // is high on purpose. One page load of a static site can be dozens of requests,
+    // and a limit that makes a site feel broken will be turned off and take the
+    // useful limits with it.
+    //
+    // Registered before the sites middleware, so that traffic to a site's own
+    // hostname is counted too, which is exactly where a burst of requests per page
+    // comes from.
+    app.use((req, res, next) => {
+        if (isRateExempt(root, req))
+            return next();
+        const decision = requestLimiter.hit((0, limit_1.clientKey)(req));
+        if (decision.ok)
+            return next();
+        res.status(429).setHeader('Retry-After', String(decision.retryAfter));
+        res
+            .type('html')
+            .send(views.errorPage(429, 'Too many requests from this address. Try again in a moment.', { viewer: null }));
+    });
+    // The daily egress budget, checked before any route can produce a body.
+    //
+    // Registered after the counter and before the sites middleware, for the same
+    // reason the request limiter is: a site's own hostname is where the bytes
+    // mostly go, so it has to be inside the budget rather than in front of it.
+    //
+    // The refusal is HTML for every client, as the 429 above is. A git client
+    // shows the body it did not expect, which reads worse than a plain line but
+    // says the same thing, and one shape of refusal is one place to change it.
+    app.use((req, res, next) => {
+        const decision = egress.allow(req);
+        if (!decision)
+            return next();
+        res.status(503).setHeader('Retry-After', String(decision.retryAfter));
+        res.type('html').send(views.errorPage(503, (0, egress_1.egressMessage)(decision), { viewer: null }));
+    });
+    // Sites served from their own hostname are answered before every other route,
+    // the asset routes included: otherwise /assets/style.css would give a site the
+    // forge's stylesheet instead of its own, and /favicon.svg the forge's icon.
+    // Nothing here runs unless a sites host is configured.
+    (0, site_1.registerSiteHost)(app, root);
+    // The forge's own pages may only be framed by the forge. A CSRF token and the
+    // Origin check in src/session.ts refuse a request forged from somewhere else,
+    // but neither refuses a real click on a real page inside somebody else's
+    // frame, which is what would let a merge, a close, or a branch deletion be
+    // obtained from a signed-in reader who thought they were clicking something
+    // of the framing page's. Registered after the sites middleware, so a request
+    // on a sites hostname never reaches it.
+    //
+    // A Content-Security-Policy and not X-Frame-Options: site content served on
+    // the forge host replaces this header with its own sandbox policy (see
+    // setSiteHeaders in src/site.ts), and an X-Frame-Options it could not
+    // replace would stop a published site being embedded anywhere, which is
+    // ordinary for a static site and no business of the forge's.
+    app.use((_req, res, next) => {
+        res.setHeader('Content-Security-Policy', FORGE_CSP);
+        next();
+    });
+    // Then, before any route that resolves a name: an address a rename left
+    // behind is sent to where that name went. Only ever a name nothing answers
+    // to, so nothing that exists is affected; see src/redirects.ts. After the
+    // sites middleware, because a path on a sites hostname is a path inside a
+    // site and means nothing to the forge's own routes.
+    (0, redirects_1.registerRedirects)(app, root);
+    // ---- static assets ----
+    const hlCache = new Map();
+    app.get('/assets/style.css', (req, res) => {
+        const sheet = (0, assets_1.styleSheet)((0, themes_1.activeTheme)());
+        // A request that names the body it wants may keep it forever, because a
+        // different body would be a different tag and so a different URL. One that
+        // does not -- an old page still in a tab, or someone typing the path --
+        // gets the current sheet and no licence to hold on to it.
+        const fresh = String(req.query.v ?? '') === sheet.tag;
+        res
+            .type('text/css')
+            .set('Cache-Control', fresh ? 'public, max-age=31536000, immutable' : 'no-cache')
+            .send(sheet.body);
+    });
+    // The page script, on the same terms as the stylesheet above: a request that
+    // names the body it wants may keep it forever, since a different body would
+    // be a different tag and so a different URL.
+    app.get('/assets/page.js', (req, res) => {
+        const script = (0, pagescript_1.pageScript)();
+        const fresh = String(req.query.v ?? '') === script.tag;
+        res
+            .type('text/javascript')
+            .set('Cache-Control', fresh ? 'public, max-age=31536000, immutable' : 'no-cache')
+            .set('X-Content-Type-Options', 'nosniff')
+            .send(script.body);
+    });
+    app.get('/assets/hl.css', (req, res) => {
+        // Code colours are a whole stylesheet rather than a set of tokens, so the
+        // reader's theme picks a file instead of an attribute. The name still
+        // comes from the theme table and never from the request: ?t= selects a
+        // theme by name, and an unknown one falls back to the vault's.
+        const name = ((0, themes_1.findTheme)(String(req.query.t ?? '')) ?? (0, themes_1.activeTheme)()).hljs;
+        let css = hlCache.get(name);
+        if (css === undefined) {
+            try {
+                css = fs.readFileSync(require.resolve(`highlight.js/styles/${name}.css`), 'utf8');
+            }
+            catch {
+                css = '';
+            }
+            hlCache.set(name, css);
+        }
+        res.type('text/css').set('Cache-Control', 'public, max-age=86400').send(css);
+    });
+    // Every repository the interface would show this viewer anyway, as a list
+    // of names, for the jump box to search without a round trip per keystroke.
+    // It says no more than the front page already does to the same eyes: a
+    // private repository is listed only for a viewer with a role there, which
+    // is also why the answer is marked private to shared caches. It is not
+    // /api/repos, which is the authenticated interface for programs and carries
+    // much more per repository than a name.
+    app.get('/assets/repos.json', (req, res) => {
+        const viewer = (0, session_1.getViewer)(req, root);
+        const repos = [];
+        for (const c of (0, scan_1.listCollections)(root)) {
+            for (const d of (0, scan_1.listRepoDirs)(root, c.name)) {
+                const name = (0, scan_1.displayName)(d);
+                if ((0, perms_1.repoRole)(root, viewer?.auth ?? null, { collection: c.name, name, dir: (0, layout_1.repoPath)(root, c.name, d) }) === null) {
+                    continue;
+                }
+                repos.push(`${c.name}/${name}`);
+            }
+        }
+        res.set('Cache-Control', 'private, no-cache').json(repos);
+    });
+    // KaTeX ships the stylesheet and fonts its output needs; serving them from
+    // the installed package keeps rendered math working with no external
+    // requests, which matters for vaults on closed networks.
+    const katexDir = path.dirname(require.resolve('katex/dist/katex.min.css'));
+    let katexCss = null;
+    app.get('/assets/katex/katex.css', (_req, res) => {
+        if (katexCss === null)
+            katexCss = fs.readFileSync(path.join(katexDir, 'katex.min.css'), 'utf8');
+        res.type('text/css').set('Cache-Control', 'public, max-age=86400').send(katexCss);
+    });
+    app.get('/assets/katex/fonts/:file', (req, res) => {
+        // The request never reaches the filesystem unless it names a KaTeX font.
+        if (!/^KaTeX_[A-Za-z0-9]+-[A-Za-z]+\.(woff2|woff|ttf)$/.test(req.params.file)) {
+            res.status(404).end();
+            return;
+        }
+        res.set('Cache-Control', 'public, max-age=31536000, immutable');
+        res.sendFile(path.join(katexDir, 'fonts', req.params.file));
+    });
+    // The favicon is the logo mark on a tile coloured from the active theme, so
+    // it changes with the vault's appearance. Browsers that will not take an SVG
+    // icon fall back to /favicon.ico, which stays empty.
+    app.get('/favicon.svg', (_req, res) => {
+        res.type('image/svg+xml').set('Cache-Control', 'public, max-age=86400').send((0, logo_1.faviconSvg)());
+    });
+    app.get('/favicon.ico', (_req, res) => {
+        res.status(204).end();
+    });
+    // The LFS store is built from the environment once at startup; a partial
+    // bucket configuration throws here, which the CLI turns into a non-zero
+    // exit naming the missing variables.
+    const lfs = (0, lfsstore_1.createLfsStore)(root);
+    console.log(`Git LFS storage backend: ${lfs.label}`);
+    // The CI engine plans and schedules workflow runs; jobs execute on runners
+    // elsewhere (mochi runner run), never in this process.
+    const engine = new engine_1.CiEngine(root, () => (0, config_1.loadConfig)(root).ci);
+    // A runner that stops when it has nothing to do cannot be told that it has
+    // something to do, so the vault starts it: this watches for a queued job
+    // whose runner is not connected and pokes that runner's wake address.
+    // Runners without one are unaffected, which is all of them by default.
+    (0, wake_1.startWakeDispatcher)(root, engine);
+    // Registration order matters: the API and the UI-owned top-level paths
+    // (/login, /new, /admin, ...) come before the generic /:collection and /:collection/:repo
+    // browse routes, and more-specific wildcard routes before their prefixes.
+    // LFS registers before git HTTP so its /info/lfs/* routes are matched ahead
+    // of any /info/refs handling.
+    (0, api_1.registerApi)(app, root, authLimiter, gates, lfs, engine, egress);
+    (0, api_2.registerCiApi)(app, root, engine, authLimiter);
+    (0, lfs_1.registerLfs)(app, root, lfs, authLimiter);
+    (0, githttp_1.registerGitHttp)(app, root, gates, authLimiter, engine);
+    (0, web_1.registerCiWeb)(app, root, engine);
+    (0, webops_1.registerWebOps)(app, root, authLimiter, lfs, engine, egress);
+    (0, compare_1.registerCompare)(app, root);
+    (0, issueweb_1.registerIssues)(app, root);
+    (0, pullweb_1.registerPulls)(app, root, engine);
+    (0, releases_1.registerReleases)(app, root);
+    (0, find_1.registerFind)(app, root, gates);
+    (0, find_1.registerSearch)(app, root, gates);
+    (0, browse_1.registerBrowse)(app, root, gates, lfs);
+    app.use((req, res) => {
+        res.status(404).type('html').send(views.errorPage(404, 'Page not found', { viewer: (0, session_1.getViewer)(req, root) }));
+    });
+    app.use((err, req, res, _next) => {
+        console.error(err);
+        if (!res.headersSent) {
+            let viewer = null;
+            try {
+                viewer = (0, session_1.getViewer)(req, root);
+            }
+            catch {
+                viewer = null;
+            }
+            res.status(500).type('html').send(views.errorPage(500, 'Internal server error', { viewer }));
+        }
+        else {
+            res.end();
+        }
+    });
+    return app;
+}