@magland/mochi 0.3.1

package/dist/session.js

@@ -0,0 +1,267 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSecret = getSecret;
+exports.setSessionCookie = setSessionCookie;
+exports.clearSessionCookie = clearSessionCookie;
+exports.getViewer = getViewer;
+exports.viewerIsAdmin = viewerIsAdmin;
+exports.checkCsrf = checkCsrf;
+exports.csrfMatches = csrfMatches;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("./config");
+const filecache_1 = require("./filecache");
+const siteshost_1 = require("./siteshost");
+const perms_1 = require("./perms");
+const vault_1 = require("./vault");
+// Stateless signed-cookie sessions on top of the token model. The payload is
+// base64url JSON plus an HMAC keyed by <vault>/.secret. There is no server-side
+// session store: permissions are re-derived from live vault.json on every
+// request, so deleting a user's tokens cuts them off, and rotating .secret
+// invalidates every session at once.
+//
+// A session is bound to the single token it was minted from, by recording that
+// token's SHA-256 hash (the same value vault.json stores, so no new secret is
+// put in the cookie, and the hash is useless as a credential). Resolving a
+// session looks that token up in live vault.json, so deleting one token ends
+// the sessions it started and leaves the user's other sessions alone. The
+// token record found this way is the real one, which is why the session carries
+// no copy of the token's scope: the role checks in src/perms.ts read it from
+// the vault.
+// Cookies are not scoped by origin, so any document on any host under a shared
+// parent domain can set a cookie named mochi_session with
+// Domain=<parent>, which the browser then also sends here. With several vaults
+// on sibling subdomains of one domain, that lets one of them shadow another's
+// session. Browsers refuse a __Host--prefixed cookie that carries a Domain
+// attribute at all, which closes it.
+//
+// The prefix also requires Secure and Path=/, so the name is conditional on
+// exactly when the prefix is legal: setSessionCookie already sets path '/' and
+// sets secure from req.protocol, and a plain-http vault keeps the bare name.
+const HOST_COOKIE_NAME = '__Host-mochi_session';
+const COOKIE_NAME = 'mochi_session';
+const cookieName = (req) => (req.protocol === 'https' ? HOST_COOKIE_NAME : COOKIE_NAME);
+const SESSION_MS = 30 * 24 * 60 * 60 * 1000;
+/** Write a fresh signing key where one is missing or unusable. */
+function mintSecret(file) {
+    const secret = crypto.randomBytes(32);
+    fs.writeFileSync(file, secret, { mode: 0o600 });
+    return secret;
+}
+// Stat-cached rather than held forever, so that rotating the file does what
+// the documentation says it does -- ends every session at once -- on the
+// running server, not on the next restart. The stat per check is the same
+// price every other state file pays.
+const secretCache = (0, filecache_1.fileCache)({
+    read: (file) => {
+        try {
+            const secret = fs.readFileSync(file);
+            if (secret.length >= 32)
+                return secret;
+        }
+        catch {
+            // unreadable; replaced below
+        }
+        return mintSecret(file);
+    },
+    missing: (file) => mintSecret(file),
+});
+function getSecret(root) {
+    return secretCache.get(path.join(root, '.secret'));
+}
+function b64url(buf) {
+    return buf.toString('base64url');
+}
+function sign(root, data) {
+    return b64url(crypto.createHmac('sha256', getSecret(root)).update(data).digest());
+}
+/**
+ * Whether this request arrived on a hostname that serves sites. No session is
+ * resolved and none is minted there. The sites middleware never asks for a
+ * viewer, so this is defence in depth: it makes structurally true what would
+ * otherwise be true only by inspection.
+ */
+function onSitesHost(req, root) {
+    return (0, siteshost_1.isUnderSitesHost)((0, config_1.loadConfig)(root).sites.host, req.hostname);
+}
+function setSessionCookie(req, res, root, auth) {
+    if (onSitesHost(req, root))
+        return;
+    const payload = {
+        u: auth.username,
+        exp: Date.now() + SESSION_MS,
+        csrf: crypto.randomBytes(16).toString('hex'),
+        t: auth.token.hash,
+    };
+    const body = b64url(Buffer.from(JSON.stringify(payload), 'utf8'));
+    res.cookie(cookieName(req), `${body}.${sign(root, body)}`, {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: req.protocol === 'https',
+        maxAge: SESSION_MS,
+        path: '/',
+    });
+}
+// Both names, since a session minted before the prefix existed, or over http
+// on a vault that has since gained TLS, is still a session to clear.
+function clearSessionCookie(res) {
+    res.clearCookie(HOST_COOKIE_NAME, { path: '/' });
+    res.clearCookie(COOKIE_NAME, { path: '/' });
+}
+function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const i = part.indexOf('=');
+        if (i === -1)
+            continue;
+        try {
+            out[part.slice(0, i).trim()] = decodeURIComponent(part.slice(i + 1).trim());
+        }
+        catch {
+            // malformed cookie value; skip
+        }
+    }
+    return out;
+}
+function readSession(req, root) {
+    // The prefixed name first, then the bare one, so a session minted before this
+    // existed survives. A sibling subdomain can still set the bare name, which is
+    // why the prefixed one wins when both arrive.
+    const cookies = parseCookies(req.headers.cookie);
+    const raw = cookies[HOST_COOKIE_NAME] ?? cookies[COOKIE_NAME];
+    if (!raw)
+        return null;
+    const dot = raw.lastIndexOf('.');
+    if (dot === -1)
+        return null;
+    const body = raw.slice(0, dot);
+    const sig = raw.slice(dot + 1);
+    const expected = sign(root, body);
+    const a = Buffer.from(sig);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !crypto.timingSafeEqual(a, b))
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (typeof payload !== 'object' || payload === null)
+        return null;
+    const p = payload;
+    if (typeof p.u !== 'string' || typeof p.exp !== 'number' || typeof p.csrf !== 'string')
+        return null;
+    if (p.exp < Date.now())
+        return null;
+    // A cookie from before sessions were bound to a token has no `t`, and is
+    // rejected rather than accepted unbound: the holder is simply signed out and
+    // signs in again, which is a smaller cost than leaving unrevocable sessions
+    // alive for the rest of their thirty days.
+    if (typeof p.t !== 'string' || p.t === '')
+        return null;
+    return { u: p.u, exp: p.exp, csrf: p.csrf, t: p.t };
+}
+function getViewer(req, root) {
+    if (onSitesHost(req, root))
+        return null;
+    const session = readSession(req, root);
+    if (!session)
+        return null;
+    const state = (0, vault_1.loadVault)(root);
+    if (state.status !== 'ok')
+        return null;
+    const user = state.vault.users[session.u];
+    if (!user)
+        return null;
+    const token = user.tokens.find((t) => t.hash === session.t);
+    if (!token)
+        return null;
+    return { auth: { username: session.u, user, token }, csrf: session.csrf };
+}
+function viewerIsAdmin(viewer) {
+    return viewer !== null && (0, perms_1.isSiteAdmin)(viewer.auth);
+}
+function checkCsrf(req, viewer) {
+    const presented = req.body?.csrf;
+    return typeof presented === 'string' && csrfMatches(req, presented, viewer);
+}
+/**
+ * A state-changing request whose Origin names somewhere else is refused. This
+ * does nothing against same-origin script, which is what the site sandbox in
+ * src/site.ts closes; it is a few lines that catch a misconfigured proxy, and it
+ * belongs next to the CSRF check so the two are read together. An absent Origin
+ * is not a failure: plenty of legitimate clients send none.
+ */
+function originOk(req) {
+    const origin = req.get('origin');
+    // Absent is allowed. Literal "null" is not: that is an opaque origin, which
+    // is what a sandboxed document has, and nothing in the forge's own interface
+    // sends it.
+    if (!origin)
+        return true;
+    if (origin === 'null')
+        return false;
+    let u;
+    try {
+        u = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    // The hostname only, and not the scheme or the port. req.hostname honours
+    // X-Forwarded-Host, so it is the name the browser used; req.protocol is
+    // http on a vault behind a TLS proxy that is not trusted, and comparing it
+    // would then refuse every legitimate form on a merely misconfigured vault.
+    // An attacker who can answer for our hostname over plain http is already
+    // between the browser and the server.
+    return u.hostname.toLowerCase() === req.hostname.toLowerCase();
+}
+/**
+ * The comparison behind checkCsrf, for a handler that has the value in hand
+ * rather than in req.body - a multipart form, which express does not parse.
+ */
+function csrfMatches(req, presented, viewer) {
+    if (!originOk(req))
+        return false;
+    const a = Buffer.from(presented);
+    const b = Buffer.from(viewer.csrf);
+    return a.length === b.length && crypto.timingSafeEqual(a, b);
+}

package/dist/site.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setSiteHeaders = setSiteHeaders;
+exports.serveSite = serveSite;
+exports.siteHostUrl = siteHostUrl;
+exports.registerSiteHost = registerSiteHost;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("./config");
+const ops_1 = require("./ops");
+const redirects_1 = require("./redirects");
+const render_1 = require("./render");
+const scan_1 = require("./scan");
+const siteshost_1 = require("./siteshost");
+const web_1 = require("./web");
+/**
+ * The headers a site response carries. Set immediately before the body is sent,
+ * on every path that sends one, the site's own 404.html included: a response
+ * that escapes this is a response running with the forge's authority.
+ */
+function setSiteHeaders(res, mode) {
+    // nosniff in both modes. A file whose declared type is wrong is not licence
+    // to guess something more dangerous.
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    if (mode === 'host')
+        return;
+    // Deliberately without allow-same-origin, which is what puts the document in
+    // an opaque origin: no cookie jar, no document.cookie, no localStorage or
+    // IndexedDB, no service worker registration, and every request it makes to
+    // the vault is cross-origin and credential-less. Script still runs, so the
+    // feature survives.
+    res.setHeader('Content-Security-Policy', 'sandbox allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox allow-downloads');
+    // Load-bearing, not redundant. A page in an opaque origin cannot fetch its
+    // own sibling files without it, which breaks any single-page app, wasm
+    // loader, or data-driven site. Those fetches still carry no credentials, so
+    // nothing is returned to an attacker. Site responses only: never on a forge
+    // page and never on an API route.
+    res.setHeader('Access-Control-Allow-Origin', '*');
+}
+/**
+ * How a site request refuses.
+ *
+ * On a site's own hostname the forge's error page is the wrong answer for the
+ * same reason it is wrong for the sites host's other responses: it renders forge
+ * chrome and links a stylesheet this origin does not serve, so it arrives
+ * unstyled and points the visitor at a vault the site knows nothing about. A
+ * repository with no site directory at all is the ordinary way to reach this,
+ * so it is worth answering plainly.
+ */
+function sendSite404(res, mode, message = 'Not found') {
+    if (mode !== 'host') {
+        (0, web_1.send404)(res, message);
+        return;
+    }
+    setSiteHeaders(res, mode);
+    res.status(404).type('html').send(minimalPage(404, 'Not found', (0, render_1.esc)(message)));
+}
+/**
+ * Serve one path out of a repository's site directory.
+ *
+ * The site-relative path depends on the mode, because the two surfaces disagree
+ * about where the site starts: under /:collection/:repo/site/ it is the
+ * wildcard, and on a site's own hostname the repository is the origin root, so
+ * it is the whole of req.path.
+ */
+function serveSite(root, collection, repo, req, res, mode) {
+    const found = (0, scan_1.findRepo)(root, collection, repo);
+    if (!found) {
+        sendSite404(res, mode, `Repository ${collection}/${repo} not found`);
+        return;
+    }
+    const dir = (0, scan_1.siteDir)(root, found.collection, found.name);
+    if (!dir) {
+        sendSite404(res, mode, `No site for ${found.collection}/${found.name}. Create a ${found.name}.site directory next to the repository, with an index.html at its root.`);
+        return;
+    }
+    // The real path of the site directory, which every path we serve has to
+    // sit under. It is resolved once here so that a vault reached through a
+    // symlinked root still compares equal.
+    let dirReal;
+    try {
+        dirReal = fs.realpathSync(dir);
+    }
+    catch {
+        sendSite404(res, mode);
+        return;
+    }
+    const relative = mode === 'host' ? req.path : (0, web_1.wildcard)(req);
+    const segs = relative.split('/').filter((s) => s !== '' && s !== '.');
+    if (segs.some((s) => s === '..' || s.includes('\0'))) {
+        sendSite404(res, mode);
+        return;
+    }
+    // Site content is written by whatever published it, which may be a
+    // workflow unpacking a tar, so it can contain symlinks. Refusing `..`
+    // segments stops a traversal spelled in the URL but not a link on disk
+    // pointing at /etc/passwd, at the vault's own files, or into another
+    // repository's site, which has a different owner. Every path we are
+    // about to read is therefore resolved and required to land strictly
+    // under dirReal; containedIn refuses the directory itself as well as
+    // anything outside it, so only files below the site root are servable.
+    //
+    // Resolving and then opening is two syscalls, so a link swapped in
+    // between them would still be followed. Closing that window means
+    // holding an open handle and checking what we hold, which is more
+    // machinery than this is worth; the interesting case is content that
+    // was already on disk when the request arrived.
+    const statInside = (p) => {
+        if (!(0, ops_1.containedIn)(dirReal, p))
+            return null;
+        try {
+            return fs.statSync(p);
+        }
+        catch {
+            return null;
+        }
+    };
+    const requested = path.join(dir, ...segs);
+    // The site root is the directory itself, which statInside refuses; it is
+    // still a directory request, and resolves to the index.html below it.
+    const isDir = segs.length === 0 || statInside(requested)?.isDirectory() === true;
+    let target = requested;
+    if (isDir) {
+        if (!req.path.endsWith('/')) {
+            res.redirect(`${req.path}/`);
+            return;
+        }
+        target = path.join(requested, 'index.html');
+    }
+    // A refused path answers exactly as a missing one does, so a prober
+    // learns nothing about what is really there from the difference.
+    const stat = statInside(target);
+    if (!stat || !stat.isFile()) {
+        const notFound = path.join(dir, '404.html');
+        const notFoundStat = statInside(notFound);
+        if (notFoundStat && notFoundStat.isFile()) {
+            setSiteHeaders(res, mode);
+            res.status(404).sendFile(notFound);
+        }
+        else {
+            sendSite404(res, mode, 'Page not found in this site');
+        }
+        return;
+    }
+    setSiteHeaders(res, mode);
+    res.sendFile(target);
+}
+// ---- serving a site from its own hostname ----
+/**
+ * A self-contained page, for the responses a sites hostname gives that are not
+ * site content. views.errorPage is wrong here: it renders forge chrome and links
+ * a stylesheet that is not reachable on this hostname, so it would arrive
+ * unstyled and mention a vault this origin knows nothing about.
+ */
+function minimalPage(status, title, body) {
+    return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${status} ${title}</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;margin:4rem auto;max-width:34rem;padding:0 1rem}</style>
+</head><body><h1>${status} ${title}</h1><p>${body}</p></body></html>
+`;
+}
+/**
+ * The site's own URL for a repository, when it has an origin of its own, or null
+ * when it is served on the forge host. The scheme mirrors the request, so a
+ * local http vault redirects to http and stays usable.
+ */
+function siteHostUrl(root, req, collection, repo) {
+    const sitesHost = (0, config_1.loadConfig)(root).sites.host;
+    const host = (0, siteshost_1.siteHostFor)(sitesHost, collection, repo);
+    return host ? `${req.protocol}://${host}` : null;
+}
+/**
+ * The site handler for requests that arrive on a sites hostname. It must run
+ * before every other route, the /assets/* and /favicon.svg routes included, or
+ * the forge's stylesheet would shadow a site's own assets/style.css and the
+ * favicon route would shadow a site's icon.
+ *
+ * Host-based gating is safe in this direction. A request arriving with a forged
+ * Host reaches only the less privileged surface, and forging the forge's own
+ * hostname gains an attacker nothing they would not get by visiting it, because
+ * the session is resolved only there and only from a cookie the browser sends to
+ * the real host.
+ */
+function registerSiteHost(app, root) {
+    app.use((req, res, next) => {
+        const sitesHost = (0, config_1.loadConfig)(root).sites.host;
+        if (!sitesHost)
+            return next();
+        if (!(0, siteshost_1.isUnderSitesHost)(sitesHost, req.hostname))
+            return next();
+        // Sites are files. Nothing on this hostname writes anything, so nothing
+        // needs a method that would.
+        if (req.method !== 'GET' && req.method !== 'HEAD') {
+            res.status(405).set('Allow', 'GET, HEAD').type('html').send(minimalPage(405, 'Method not allowed', 'This hostname serves static files, so it answers only GET and HEAD.'));
+            return;
+        }
+        const named = (0, siteshost_1.parseSiteHost)(sitesHost, req.hostname);
+        if (!named) {
+            // A request to the bare sites host, or to a deeper name under it, gets a
+            // minimal 404 rather than falling through to the forge, so the forge is
+            // reachable only on its own hostname.
+            setSiteHeaders(res, 'sandbox');
+            res.status(404).type('html').send(minimalPage(404, 'No site here', 'This hostname does not name a repository site in this vault.'));
+            return;
+        }
+        // A site has a hostname of its own, built from the repository's name, so a
+        // rename moves the site to a different hostname and every published link
+        // to it stops resolving to anything. The redirect the forge host does for
+        // paths is done here for hostnames, on the same terms: only when no
+        // repository answers to the name in this one.
+        if (!(0, scan_1.findRepo)(root, named.collection, named.repo)) {
+            const moved = (0, redirects_1.resolveRepoRedirect)(root, named.collection, named.repo);
+            const host = moved && (0, siteshost_1.siteHostFor)(sitesHost, moved.collection, moved.repo);
+            if (host) {
+                res
+                    .status(301)
+                    .set('Cache-Control', 'no-store')
+                    .set('Location', `${req.protocol}://${host}${req.originalUrl}`)
+                    .end();
+                return;
+            }
+        }
+        serveSite(root, named.collection, named.repo, req, res, 'host');
+    });
+}

package/dist/siteshost.js

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSiteLabelSafe = isSiteLabelSafe;
+exports.normalizeHostname = normalizeHostname;
+exports.siteHostFor = siteHostFor;
+exports.parseSiteHost = parseSiteHost;
+exports.isUnderSitesHost = isUnderSitesHost;
+const scan_1 = require("./scan");
+// The grammar of a per-site hostname, in both directions, so that the parser
+// and the link builder cannot drift apart. A site served from
+// <repo>--<collection>.<sitesHost> has an origin of its own, which is what gives
+// it back the cookies, storage, and service workers that the sandbox on the
+// forge host takes away.
+/**
+ * Whether a collection or repository name may appear in a site hostname. The
+ * regex is the whole definition: lowercase letters, digits, and single interior
+ * hyphens, which by construction rejects uppercase, '.', '_', a leading or
+ * trailing hyphen, a doubled hyphen anywhere, and the empty string.
+ */
+function isSiteLabelSafe(name) {
+    return /^[a-z0-9]+(-[a-z0-9]+)*$/.test(name);
+}
+/** The DNS limit on one label, which <repo>--<collection> has to fit inside. */
+const MAX_LABEL = 63;
+/**
+ * The one normalization a hostname gets, wherever one is read. Exported because
+ * the configured sites host and the request's own hostname are compared against
+ * each other: if the two were normalized differently, a trailing dot or a
+ * capital letter on one side would stop every site being found.
+ */
+function normalizeHostname(hostname) {
+    return hostname.trim().toLowerCase().replace(/\.$/, '');
+}
+/**
+ * The full hostname for a repository's site, or null if it is not eligible.
+ *
+ * Repository and collection names are more permissive than a hostname label
+ * (isValidName allows '.', '_', and uppercase), so not every repository is
+ * eligible, and an ineligible one keeps being served on the forge host. Refusing
+ * rather than mangling is deliberate: lowercasing `Webapp1` would collide with a
+ * `webapp1` beside it, since hostnames are case-insensitive and both names are
+ * legal on disk.
+ */
+function siteHostFor(sitesHost, collection, repo) {
+    if (!sitesHost)
+        return null;
+    const name = (0, scan_1.displayName)(repo);
+    if (!isSiteLabelSafe(name) || !isSiteLabelSafe(collection))
+        return null;
+    const label = `${name}--${collection}`;
+    if (label.length > MAX_LABEL)
+        return null;
+    return `${label}.${sitesHost}`;
+}
+/**
+ * The collection and repository a request's hostname names, or null.
+ *
+ * The double hyphen is an unambiguous separator precisely because neither half
+ * may contain one, so `a--b` in collection `c` cannot be confused with `a` in
+ * collection `b--c`. It also means no label can begin `xn--`, which a browser
+ * would read as punycode. No filesystem access happens here; the caller resolves
+ * the names with findRepo as usual.
+ */
+function parseSiteHost(sitesHost, hostname) {
+    if (!sitesHost)
+        return null;
+    const host = normalizeHostname(hostname);
+    const suffix = `.${sitesHost}`;
+    if (!host.endsWith(suffix))
+        return null;
+    const label = host.slice(0, -suffix.length);
+    // Exactly one remaining label. A deeper name such as a.b.<sitesHost> is
+    // refused, and is not covered by a single wildcard certificate anyway.
+    if (label === '' || label.includes('.'))
+        return null;
+    const parts = label.split('--');
+    if (parts.length !== 2)
+        return null;
+    const [repo, collection] = parts;
+    if (!isSiteLabelSafe(repo) || !isSiteLabelSafe(collection))
+        return null;
+    return { collection, repo };
+}
+/**
+ * Whether a hostname belongs to the sites host at all, including the bare name
+ * and names too deep to be a site. The forge must not answer on any of them, so
+ * this is what the middleware checks before falling through.
+ */
+function isUnderSitesHost(sitesHost, hostname) {
+    if (!sitesHost)
+        return false;
+    const host = normalizeHostname(hostname);
+    return host === sitesHost || host.endsWith(`.${sitesHost}`);
+}