@magland/mochi 0.3.1

package/dist/web.js

@@ -0,0 +1,182 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ah = ah;
+exports.wildcard = wildcard;
+exports.send404 = send404;
+exports.sendBusy = sendBusy;
+exports.urlencodedForm = urlencodedForm;
+exports.field = field;
+exports.fail = fail;
+exports.requireViewerPage = requireViewerPage;
+exports.requireViewerPost = requireViewerPost;
+exports.loadRepo = loadRepo;
+exports.makeCtx = makeCtx;
+exports.baseUrlOf = baseUrlOf;
+const express_1 = __importDefault(require("express"));
+const present_1 = require("./ci/present");
+const forms = __importStar(require("./forms"));
+const issues_1 = require("./issues");
+const limit_1 = require("./limit");
+const pulls_1 = require("./pulls");
+const releases_1 = require("./releases");
+const perms_1 = require("./perms");
+const scan_1 = require("./scan");
+const session_1 = require("./session");
+const site_1 = require("./site");
+const views = __importStar(require("./views"));
+// Helpers shared by the HTML route modules.
+function ah(fn) {
+    return (req, res, next) => {
+        fn(req, res).catch(next);
+    };
+}
+function wildcard(req) {
+    return req.params['0'] ?? '';
+}
+function send404(res, message = 'Not found', viewer = null) {
+    res.status(404).type('html').send(views.errorPage(404, message, { viewer }));
+}
+/**
+ * How a web route refuses when a concurrency gate is full. 503 rather than 429:
+ * the condition is server capacity rather than a client quota, and nothing about
+ * this request was wrong.
+ */
+function sendBusy(res, viewer = null) {
+    res.status(503).setHeader('Retry-After', String(limit_1.BUSY_RETRY_SECONDS));
+    res
+        .type('html')
+        .send(views.errorPage(503, 'The server is busy with other git work. Try again in a moment.', { viewer }));
+}
+// Form posts are read as urlencoded bodies with express's simple parser: the
+// forms here are flat, so the extended syntax would only widen what a body may
+// say. The limit is left to the caller, because what one page may reasonably
+// carry (a file being edited) is not what another should (a release note).
+function urlencodedForm(limit) {
+    return express_1.default.urlencoded({ extended: false, limit });
+}
+// A form field as a string. Anything the parser did not give us as a string
+// (a missing field, or a repeated one arriving as an array) reads as empty
+// rather than being passed on as something a handler did not expect.
+function field(req, name) {
+    const v = req.body?.[name];
+    return typeof v === 'string' ? v : '';
+}
+// How an operation refuses. backUrl, when given, is where the page offers to
+// send the reader back to, which is usually the form they came from.
+function fail(res, status, message, viewer, backUrl) {
+    res.status(status).type('html').send(forms.opErrorPage(message, { viewer, backUrl }));
+}
+// For GET form pages: an anonymous visitor is sent to sign in and come back.
+function requireViewerPage(root, req, res) {
+    const viewer = (0, session_1.getViewer)(req, root);
+    if (!viewer) {
+        res.redirect(`/login?next=${encodeURIComponent(req.originalUrl)}`);
+        return null;
+    }
+    return viewer;
+}
+// For POSTs: a missing session or a bad CSRF value is a hard 403.
+function requireViewerPost(root, req, res) {
+    const viewer = (0, session_1.getViewer)(req, root);
+    if (!viewer) {
+        fail(res, 403, 'You must be signed in to do that.', null, '/login');
+        return null;
+    }
+    if (!(0, session_1.checkCsrf)(req, viewer)) {
+        fail(res, 403, 'The form has expired; go back, reload the page, and try again.', viewer);
+        return null;
+    }
+    return viewer;
+}
+/**
+ * The repository named by the route, for a viewer allowed to read it. Every
+ * HTML page about a repository is loaded through here, so this is where a
+ * private repository disappears: a viewer with no role gets the same 404 an
+ * absent repository gets, and a private name proves nothing by existing.
+ */
+async function loadRepo(root, req, res, viewer) {
+    const repo = (0, scan_1.findRepo)(root, req.params.collection, req.params.repo);
+    const role = repo ? (0, perms_1.repoRole)(root, viewer?.auth ?? null, repo) : null;
+    if (!repo || role === null) {
+        send404(res, `Repository ${req.params.collection}/${req.params.repo} not found`, viewer);
+        return null;
+    }
+    const [branches, tags] = await Promise.all([repo.listRefs('heads'), repo.listRefs('tags')]);
+    const defaultBranch = await repo.defaultBranch(branches);
+    return {
+        repo,
+        branches,
+        tags,
+        defaultBranch,
+        refNames: [...branches.map((b) => b.name), ...tags.map((t) => t.name)],
+        role,
+    };
+}
+async function makeCtx(root, req, loaded, ref, viewer) {
+    const cloneUrl = `${req.protocol}://${req.get('host')}/${encodeURIComponent(loaded.repo.collection)}/${encodeURIComponent(loaded.repo.name)}`;
+    // Where the Site tab points. A site with an origin of its own is linked there
+    // directly rather than through the forge path that would only redirect.
+    const siteOrigin = (0, site_1.siteHostUrl)(root, req, loaded.repo.collection, loaded.repo.name);
+    return {
+        collection: loaded.repo.collection,
+        repo: loaded.repo.name,
+        ref,
+        refIsBranch: loaded.branches.some((b) => b.name === ref),
+        defaultBranch: loaded.defaultBranch ?? '',
+        branches: loaded.branches,
+        tags: loaded.tags,
+        cloneUrl,
+        hasSite: (0, scan_1.siteDir)(root, loaded.repo.collection, loaded.repo.name) !== null,
+        siteUrl: siteOrigin
+            ? `${siteOrigin}/`
+            : `/${encodeURIComponent(loaded.repo.collection)}/${encodeURIComponent(loaded.repo.name)}/site/`,
+        releases: (0, releases_1.releaseTags)(root, loaded.repo.collection, loaded.repo.name),
+        hasCi: await (0, present_1.hasCiState)(root, loaded.repo, loaded.defaultBranch, loaded.branches),
+        openIssues: (0, issues_1.issueCounts)(root, loaded.repo.collection, loaded.repo.name).open,
+        openPulls: (0, pulls_1.pullCounts)(root, loaded.repo.collection, loaded.repo.name).open,
+        forkedFrom: (0, scan_1.forkParent)(loaded.repo.dir),
+        viewer,
+        isPrivate: (0, perms_1.repoIsPrivate)(loaded.repo.dir),
+        canPush: (0, perms_1.atLeast)(loaded.role, 'write'),
+        canAdmin: (0, perms_1.atLeast)(loaded.role, 'admin'),
+    };
+}
+function baseUrlOf(req) {
+    return `${req.protocol}://${req.get('host')}`;
+}