@magland/mochi 0.3.1

package/dist/webops.js

@@ -0,0 +1,1402 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerWebOps = registerWebOps;
+const express_1 = __importDefault(require("express"));
+const fs = __importStar(require("fs"));
+const config_1 = require("./config");
+const git_1 = require("./git");
+const trigger_1 = require("./ci/trigger");
+const layout_1 = require("./layout");
+const pointer_1 = require("./pointer");
+const themes_1 = require("./themes");
+const forms = __importStar(require("./forms"));
+const ops = __importStar(require("./ops"));
+const ops_1 = require("./ops");
+const scan_1 = require("./scan");
+const session_1 = require("./session");
+const perms_1 = require("./perms");
+const vault_1 = require("./vault");
+const views_1 = require("./views");
+const web_1 = require("./web");
+const render_1 = require("./render");
+const multipart_1 = require("./multipart");
+function urlOf(repo) {
+    return (0, views_1.repoUrl)({ collection: repo.collection, repo: repo.name });
+}
+// UI operations: every handler here re-derives the actor's abilities from
+// live vault.json (via the session cookie) and checks the CSRF field before
+// calling into the ops layer. All POSTs follow POST-redirect-GET.
+// The largest body here is a file being edited in the browser, and the editor
+// accepts files up to MAX_EDIT_SIZE, so the limit has to leave room for a
+// megabyte of text after percent-encoding.
+const form = (0, web_1.urlencodedForm)('3mb');
+/**
+ * The commit box posts a summary and an optional extended description; git's
+ * convention joins them with a blank line. An empty summary falls back to the
+ * placeholder the form showed, so a commit is never made with no subject.
+ */
+function commitMessage(req, fallback) {
+    const summary = (0, web_1.field)(req, 'message').trim() || fallback;
+    const description = (0, web_1.field)(req, 'description').trim();
+    return description ? `${summary}\n\n${description}` : summary;
+}
+/**
+ * Where signing in returns to: a path on this vault, or the front page.
+ *
+ * The sign-in page is the one place in the interface that asks for a token, so
+ * it is the one place a redirect elsewhere is worth the most to somebody else.
+ * A leading `//` is refused because the browser reads it as an authority, and a
+ * leading `/\` for the same reason: the URL standard treats a backslash as a
+ * slash for http and https, `Location: /\evil.com` therefore resolves to
+ * http://evil.com, and the header carries the character through unencoded. A
+ * control character is refused too, since a browser strips tab and newline out
+ * of a URL before parsing it, which would turn `/<tab>/evil.com` into the
+ * authority the first two checks just refused.
+ */
+function safeNext(v) {
+    if (!v.startsWith('/'))
+        return '/';
+    if (v[1] === '/' || v[1] === '\\')
+        return '/';
+    if (/[\x00-\x1f\x7f]/.test(v))
+        return '/';
+    return v;
+}
+function normalizeContent(text) {
+    return text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+}
+function globsField(req, name) {
+    const parts = (0, web_1.field)(req, name)
+        .split(/[\s,]+/)
+        .filter((s) => s.length > 0);
+    if (parts.some((s) => s.length >= 200))
+        return null;
+    return parts;
+}
+function registerWebOps(app, root, authLimiter, lfs = null, engine, egress) {
+    // What a repository move or removal has to carry with it, built once here so
+    // that no handler has to remember either half. See RepoContext in ops.ts.
+    const repoCtx = { lfs: lfs?.store, runs: engine };
+    // A commit made in the browser is a push like any other as far as workflows
+    // are concerned, so the same event goes to the CI engine, through the same
+    // function the API write paths use.
+    const fire = (repo, branch, before, after, actor) => (0, trigger_1.firePush)(root, engine, repo, branch, before, after, actor);
+    /**
+     * The branch the form asked to commit to, when "commit to a new branch" was
+     * ticked. Creating it is ops.writeFile's business; reading the form is this
+     * function's, and an empty name means the box was ticked without one.
+     */
+    function newBranchWanted(req) {
+        if ((0, web_1.field)(req, 'newBranchWanted') !== '1')
+            return null;
+        const wanted = (0, web_1.field)(req, 'newBranch').trim();
+        if (wanted === '')
+            throw new ops_1.OpError('Name the new branch, or untick the box to commit to this one.');
+        return wanted;
+    }
+    function authorFor(viewer, req) {
+        const host = (req.get('host') ?? 'localhost').replace(/:\d+$/, '');
+        return { name: viewer.auth.username, email: `${viewer.auth.username}@noreply.${host}` };
+    }
+    // ---- sign in / sign out ----
+    app.get('/login', (req, res) => {
+        const next = safeNext(String(req.query.next ?? '/'));
+        if ((0, session_1.getViewer)(req, root)) {
+            res.redirect(next);
+            return;
+        }
+        res.type('html').send(forms.loginPage(next));
+    });
+    app.post('/login', form, (req, res) => {
+        const next = safeNext((0, web_1.field)(req, 'next'));
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            res.status(500).type('html').send(forms.loginPage(next, 'The vault is not available; try again later.'));
+            return;
+        }
+        const username = (0, web_1.field)(req, 'username');
+        // Throttled per address, and per address and username together, so that one
+        // person mistyping a token does not lock out everyone behind the same
+        // address. Never per account: anyone could then lock an owner out by
+        // presenting wrong tokens for their username.
+        const allowed = authLimiter.allow(req, username);
+        if (!allowed.ok) {
+            const minutes = Math.max(1, Math.ceil(allowed.retryAfter / 60));
+            res.status(429).setHeader('Retry-After', String(allowed.retryAfter));
+            res
+                .type('html')
+                .send(forms.loginPage(next, `Too many failed sign-in attempts from this address. Try again in ${minutes} minute${minutes === 1 ? '' : 's'}.`));
+            return;
+        }
+        const auth = (0, vault_1.authenticate)(state.vault, username, (0, web_1.field)(req, 'token'));
+        if (!auth) {
+            authLimiter.fail(req, username);
+            // One generic message: no username/token distinction. The refusal above
+            // says nothing about whether the username exists either.
+            res.status(401).type('html').send(forms.loginPage(next, 'Invalid username or token.'));
+            return;
+        }
+        (0, session_1.setSessionCookie)(req, res, root, auth);
+        res.redirect(next);
+    });
+    app.post('/logout', form, (req, res) => {
+        const viewer = (0, session_1.getViewer)(req, root);
+        if (viewer && (0, session_1.checkCsrf)(req, viewer))
+            (0, session_1.clearSessionCookie)(res);
+        res.redirect('/');
+    });
+    // ---- new repository, new collection, import ----
+    // Importing is a client-side operation: git copies the repository from its
+    // current home and pushes it here, where push-to-create makes it. The server
+    // never fetches from another host, so it needs no outbound access, no stored
+    // credentials for other services, and no work that outlives a request. What
+    // performs it is `mochi import` on the operator's machine, and this page
+    // only says what to run: no form, since there is nothing here to submit to.
+    app.get('/import', (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const asked = typeof req.query.collection === 'string' ? req.query.collection.trim() : '';
+        const collection = (0, scan_1.isValidName)(asked) ? asked : null;
+        // Nothing here performs the import, but a page that hands someone a command
+        // their token cannot run is worse than a refusal, so the collection they
+        // asked about is checked against their scope before it is written into one.
+        if (collection && !(0, perms_1.canCreateSomeRepo)(root, viewer.auth, collection)) {
+            (0, web_1.fail)(res, 403, `You are not allowed to create repositories in ${collection}, so the push would be refused.`, viewer, `/${encodeURIComponent(collection)}`);
+            return;
+        }
+        const host = req.get('host') ?? '';
+        const vaultUrl = `${req.protocol}://${host}`;
+        // The git fallback ends up on a command line, so it is written only when
+        // the host name and the username carry nothing a shell would read.
+        const plain = /^[A-Za-z0-9.:_-]+$/.test(host) && /^[A-Za-z0-9._-]+$/.test(viewer.auth.username);
+        // The clone is a scratch copy, so it goes to a temporary directory rather
+        // than to whatever directory the command happens to be pasted into. A
+        // fresh one each time means a failed attempt never blocks the next, and
+        // what it leaves behind is under /tmp rather than in someone's work tree.
+        // mktemp is given an explicit template because plain `mktemp -d` is a
+        // usage error on BSD, and `-t prefix` is a usage error on GNU.
+        //
+        // GIT_ASKPASS= on the push keeps the password prompt in the terminal the
+        // command was pasted into. Editors that set GIT_ASKPASS (VS Code does for
+        // its integrated terminal) otherwise redirect it to a dialog elsewhere in
+        // the window, and an unanswered dialog looks exactly like a hang: git
+        // prints nothing after the clone and waits. Credential helpers are
+        // consulted before askpass, so a stored credential still works.
+        const dest = `${req.protocol}://${encodeURIComponent(viewer.auth.username)}@${host}/${encodeURIComponent(collection ?? 'mycollection')}/REPO-NAME`;
+        const gitCommand = plain
+            ? `tmp="$(mktemp -d /tmp/import.XXXXXX)"` +
+                ` && git clone --bare SOURCE-URL "$tmp"` +
+                ` && GIT_ASKPASS= git -C "$tmp" push --mirror ${dest}` +
+                ` && rm -rf "$tmp"`
+            : null;
+        res.type('html').send(forms.importPage(viewer, { collection, vaultUrl, gitCommand }));
+    });
+    // A collection with nothing in it yet. Creating a repository or pushing to a
+    // new path creates its collection on the way, so this is the other order:
+    // the collection first, filled by an import or a push afterwards.
+    app.get('/new/collection', (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        res.type('html').send(forms.newCollectionPage(viewer, {}));
+    });
+    app.post('/new/collection', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const name = (0, web_1.field)(req, 'name').trim();
+        const rerender = (status, error) => {
+            res.status(status).type('html').send(forms.newCollectionPage(viewer, { name }, error));
+        };
+        if (!(0, scan_1.isValidName)(name)) {
+            rerender(400, 'A collection name may use letters, digits, dot, underscore, and dash, and must not be a reserved word.');
+            return;
+        }
+        if (!(0, perms_1.canCreateCollection)(root, viewer.auth, name)) {
+            rerender(403, 'A collection not named after you takes a site admin to create.');
+            return;
+        }
+        try {
+            ops.createCollection(root, name);
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                rerender((0, ops_1.opErrorStatus)(e.kind), e.message);
+                return;
+            }
+            throw e;
+        }
+        res.redirect(`/${encodeURIComponent(name)}`);
+    });
+    // ---- a collection's own settings ----
+    //
+    // These sit at /:collection/settings, one segment shallower than a
+    // repository's, and are registered here rather than in browse.ts so that
+    // they are matched ahead of /:collection/:repo. Nothing is shadowed by
+    // them: `settings` is a reserved name, so no repository can be called it.
+    /**
+     * The collection named in the path, with the repositories it holds, or null
+     * once a response has been sent. Renaming needs the repository names twice
+     * over - to decide the actor's abilities, and to say in the page what moves
+     * with the collection - so both handlers start here.
+     */
+    function loadCollection(req, res, viewer, post) {
+        const name = req.params.collection;
+        let isDir = false;
+        try {
+            isDir = fs.statSync((0, layout_1.collectionDir)(root, name)).isDirectory();
+        }
+        catch {
+            isDir = false;
+        }
+        if (!(0, scan_1.isValidName)(name) || !isDir) {
+            if (post)
+                (0, web_1.fail)(res, 404, `Collection ${name} not found`, viewer, '/');
+            else
+                (0, web_1.send404)(res, `Collection ${name} not found`, viewer);
+            return null;
+        }
+        const repos = (0, scan_1.listRepoDirs)(root, name).map(scan_1.displayName);
+        if (!(0, perms_1.canAdminCollection)(root, viewer.auth, name)) {
+            (0, web_1.fail)(res, 403, `Collection settings are for the owners of ${name}.`, viewer, `/${encodeURIComponent(name)}`);
+            return null;
+        }
+        return { name, repos };
+    }
+    app.get('/:collection/settings', (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = loadCollection(req, res, viewer, false);
+        if (!loaded)
+            return;
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res
+            .type('html')
+            .send(forms.collectionSettingsPage(viewer, loaded.name, loaded.repos.length, (0, perms_1.collectionOwners)(root, loaded.name), msg));
+    });
+    app.post('/:collection/settings/rename', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = loadCollection(req, res, viewer, true);
+        if (!loaded)
+            return;
+        const from = loaded.name;
+        const backUrl = `/${encodeURIComponent(from)}/settings`;
+        const toName = (0, web_1.field)(req, 'name').trim();
+        // Ownership, which loadCollection has already established, is the whole
+        // permission: the owners file moves with the collection, so the owners
+        // after the rename are the owners before it. Whether the new name is
+        // free is the operation's own check.
+        if (!(0, scan_1.isValidName)(toName)) {
+            (0, web_1.fail)(res, 400, 'A collection name may use letters, digits, dot, underscore, and dash, and must not be a reserved word.', viewer, backUrl);
+            return;
+        }
+        try {
+            await ops.renameCollection(root, from, toName, repoCtx);
+        }
+        catch (e) {
+            const message = e instanceof ops_1.OpError ? e.message : 'Could not rename the collection.';
+            (0, web_1.fail)(res, e instanceof ops_1.OpError ? (0, ops_1.opErrorStatus)(e.kind) : 400, message, viewer, backUrl);
+            return;
+        }
+        res.redirect(`/${encodeURIComponent(toName)}/settings?msg=${encodeURIComponent(`Renamed from ${from}.`)}`);
+    }));
+    // Owners manage the owners list, which loadCollection has established. The
+    // implicit owner (the user the collection is named after) is not on the
+    // list and cannot be removed from it.
+    app.post('/:collection/settings/owners', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = loadCollection(req, res, viewer, true);
+        if (!loaded)
+            return;
+        const backUrl = `/${encodeURIComponent(loaded.name)}/settings`;
+        const username = (0, web_1.field)(req, 'username').trim();
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok' || !state.vault.users[username]) {
+            (0, web_1.fail)(res, 404, `No user ${username || '(no name given)'} in this vault.`, viewer, backUrl);
+            return;
+        }
+        if (username === loaded.name) {
+            (0, web_1.fail)(res, 400, `${username} owns ${loaded.name} by bearing its name already.`, viewer, backUrl);
+            return;
+        }
+        (0, perms_1.addCollectionOwner)(root, loaded.name, username);
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(`${username} is now an owner of ${loaded.name}.`)}`);
+    });
+    app.post('/:collection/settings/owners/remove', form, (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = loadCollection(req, res, viewer, true);
+        if (!loaded)
+            return;
+        const backUrl = `/${encodeURIComponent(loaded.name)}/settings`;
+        const username = (0, web_1.field)(req, 'username').trim();
+        if (!(0, perms_1.collectionOwners)(root, loaded.name).includes(username)) {
+            (0, web_1.fail)(res, 404, `${username} is not an explicit owner of ${loaded.name}.`, viewer, backUrl);
+            return;
+        }
+        (0, perms_1.removeCollectionOwner)(root, loaded.name, username);
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(`Removed ${username} from the owners of ${loaded.name}.`)}`);
+    });
+    app.get('/new', (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const collections = (0, scan_1.listCollections)(root).map((o) => o.name);
+        const collection = typeof req.query.collection === 'string' ? req.query.collection : '';
+        // A name may be suggested too, which is how the prompt to write a
+        // collection's profile README arrives here with .mochi already filled
+        // in (see src/profile.ts).
+        const name = typeof req.query.name === 'string' ? req.query.name : '';
+        res.type('html').send(forms.newRepoPage(viewer, collections, { collection, name }));
+    });
+    app.post('/new', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const collection = (0, web_1.field)(req, 'collection').trim();
+        const name = (0, web_1.field)(req, 'name').trim();
+        const description = (0, web_1.field)(req, 'description').trim();
+        const collections = (0, scan_1.listCollections)(root).map((o) => o.name);
+        const rerender = (status, error) => {
+            res
+                .status(status)
+                .type('html')
+                .send(forms.newRepoPage(viewer, collections, { collection, name, description }, error));
+        };
+        if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(name)) {
+            rerender(400, 'Collection and repository names may use letters, digits, dot, underscore, and dash, and must not be reserved words. Only a repository may begin with a dot.');
+            return;
+        }
+        const reserved = (0, scan_1.reservedRepoSuffix)(name);
+        if (reserved) {
+            rerender(400, `A repository name may not end in ${reserved}, which is reserved for the directories a repository keeps beside it.`);
+            return;
+        }
+        if (!(0, perms_1.canCreateRepo)(root, viewer.auth, collection, name)) {
+            rerender(403, `You are not allowed to create repositories in ${collection}.`);
+            return;
+        }
+        if ((0, scan_1.findRepo)(root, collection, name)) {
+            rerender(409, `Repository ${collection}/${name} already exists.`);
+            return;
+        }
+        // The checks above answer every refusal this form can provoke, so the
+        // ops layer's own are a backstop. Rendered rather than thrown all the
+        // same: a backstop that reaches the reader as a 500 is one that says the
+        // server broke when what happened is that it declined.
+        let created;
+        try {
+            created = await ops.createRepoWithReadme(root, collection, name, {
+                description,
+                readme: (0, web_1.field)(req, 'init') === '1',
+                private: (0, web_1.field)(req, 'private') === '1',
+                author: authorFor(viewer, req),
+            });
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                rerender((0, ops_1.opErrorStatus)(e.kind), e.message);
+                return;
+            }
+            throw e;
+        }
+        if (created.sha)
+            fire(created.repo, 'main', null, created.sha, viewer.auth.username);
+        res.redirect(`/${encodeURIComponent(collection)}/${encodeURIComponent(name)}`);
+    }));
+    // Resolves an /:collection/:repo/<verb>/<branch>/<path> URL and enforces what all
+    // file operations share: the ref must be a branch (or the repository must
+    // be empty) and the viewer needs the write role on the repository.
+    async function loadFileTarget(req, res, viewer, opts) {
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return null;
+        const { ref, path: filePath } = loaded.repo.resolveRefAndPath((0, web_1.wildcard)(req), loaded.refNames);
+        if (!(0, git_1.isValidRepoPath)(filePath)) {
+            (0, web_1.send404)(res, 'Not found', viewer);
+            return null;
+        }
+        if (!(0, perms_1.atLeast)(loaded.role, 'write')) {
+            (0, web_1.fail)(res, 403, `You do not have the write role on ${loaded.repo.collection}/${loaded.repo.name}.`, viewer, urlOf(loaded.repo));
+            return null;
+        }
+        const branchInfo = loaded.branches.find((b) => b.name === ref);
+        if (!branchInfo) {
+            if (opts.allowEmptyRepo && loaded.branches.length === 0 && (0, git_1.isValidRefName)(ref) && !ref.startsWith('-')) {
+                return { loaded, branch: ref, filePath, tip: null };
+            }
+            (0, web_1.fail)(res, 400, 'Files can only be changed on a branch. Switch to a branch and try again.', viewer, urlOf(loaded.repo));
+            return null;
+        }
+        return { loaded, branch: ref, filePath, tip: branchInfo.sha };
+    }
+    async function handleOpError(e, req, res, viewer, target, retryUrl) {
+        if (e instanceof ops_1.OpError && e.kind === 'conflict') {
+            const ctx = await (0, web_1.makeCtx)(root, req, target.loaded, target.branch, viewer);
+            res.status(409).type('html').send(forms.conflictPage(ctx, target.branch, retryUrl));
+            return;
+        }
+        // A branch that could not be made is not a file that could not be written:
+        // a name already taken is somebody else's branch, and 409 says so.
+        if (e instanceof ops.NewBranchError) {
+            (0, web_1.fail)(res, (0, ops_1.opErrorStatus)(e.kind), e.message, viewer, retryUrl);
+            return;
+        }
+        if (e instanceof ops_1.OpError) {
+            (0, web_1.fail)(res, (0, ops_1.opErrorStatus)(e.kind), e.message, viewer, retryUrl);
+            return;
+        }
+        throw e;
+    }
+    app.get('/:collection/:repo/edit/*', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: false });
+        if (!target)
+            return;
+        const { loaded, branch, filePath } = target;
+        const type = await loaded.repo.entryType(branch, filePath);
+        if (type !== 'blob') {
+            (0, web_1.send404)(res, `File ${filePath} not found at ${branch}`, viewer);
+            return;
+        }
+        const buf = await loaded.repo.catBlob(branch, filePath);
+        // Editing a pointer as text would silently corrupt the repository's
+        // LFS state, so it is refused outright (deletion remains allowed).
+        if ((0, pointer_1.looksLikePointer)(buf)) {
+            (0, web_1.fail)(res, 400, 'This file is stored with Git LFS; the repository holds only a pointer to it. Change the file with a git client instead.', viewer, urlOf(loaded.repo));
+            return;
+        }
+        if ((0, render_1.isBinary)(buf) || buf.length > ops_1.MAX_EDIT_SIZE) {
+            (0, web_1.fail)(res, 400, 'Only text files up to 1 MB can be edited in the browser.', viewer, urlOf(loaded.repo));
+            return;
+        }
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, branch, viewer);
+        res.type('html').send(forms.editFilePage(ctx, filePath, buf.toString('utf8'), target.tip));
+    }));
+    app.post('/:collection/:repo/edit/*', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: false });
+        if (!target)
+            return;
+        const { loaded, branch, filePath } = target;
+        const expected = (0, web_1.field)(req, 'expected');
+        if (!(0, git_1.isValidSha)(expected)) {
+            (0, web_1.fail)(res, 400, 'The form is missing its base commit; reload and try again.', viewer);
+            return;
+        }
+        const content = normalizeContent((0, web_1.field)(req, 'content'));
+        // A changed path renames or moves the file in the same commit, which is
+        // what the path field on the form is for.
+        const wantedPath = (0, web_1.field)(req, 'path').trim().replace(/^\/+/, '');
+        const toPath = wantedPath === '' || wantedPath === filePath ? undefined : wantedPath;
+        const retryUrl = `${urlOf(loaded.repo)}/edit/${(0, views_1.encPath)(branch)}/${(0, views_1.encPath)(filePath)}`;
+        if (toPath !== undefined && !(0, git_1.isValidRepoPath)(toPath)) {
+            (0, web_1.fail)(res, 400, `${toPath} is not a usable path.`, viewer, retryUrl);
+            return;
+        }
+        const message = commitMessage(req, toPath === undefined ? `Update ${filePath.split('/').pop()}` : `Rename ${filePath} to ${toPath}`);
+        // The branch choice, the pointer refusal, and the guarded commit are one
+        // sequence in ops.writeFile, which the API write path calls too. The GET
+        // form already refuses a pointer file; writeFile re-checks, so the refusal
+        // cannot be bypassed by posting directly.
+        let written;
+        try {
+            written = await ops.writeFile(loaded.repo.dir, {
+                branch,
+                newBranch: newBranchWanted(req),
+                filePath,
+                message,
+                author: authorFor(viewer, req),
+                expectedHead: expected,
+                action: { kind: 'edit', content: Buffer.from(content, 'utf8'), toPath },
+            });
+        }
+        catch (e) {
+            await handleOpError(e, req, res, viewer, target, retryUrl);
+            return;
+        }
+        const onto = written.branch;
+        fire(loaded.repo, onto, expected, written.sha, viewer.auth.username);
+        // A commit on a new branch wants to be seen against the one it left, so
+        // that is where the editor lands.
+        if (onto !== branch) {
+            res.redirect(`${urlOf(loaded.repo)}/compare/${(0, views_1.encPath)(branch)}...${(0, views_1.encPath)(onto)}`);
+            return;
+        }
+        res.redirect(`${urlOf(loaded.repo)}/blob/${(0, views_1.encPath)(onto)}/${(0, views_1.encPath)(toPath ?? filePath)}`);
+    }));
+    // ---- uploading files ----
+    // The body is multipart, which express does not parse, so it arrives raw and
+    // multipart.ts takes it apart. The cap is enforced twice: here, where a
+    // larger body is refused before it is read, and again on the sum of the
+    // parts.
+    const uploadBody = express_1.default.raw({ type: 'multipart/form-data', limit: ops_1.MAX_UPLOAD_SIZE });
+    app.get('/:collection/:repo/upload/*', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: true });
+        if (!target)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, target.loaded, target.branch, viewer);
+        res.type('html').send(forms.uploadPage(ctx, target.branch, target.filePath, target.tip, ops_1.MAX_UPLOAD_SIZE));
+    }));
+    app.post('/:collection/:repo/upload/*', uploadBody, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, session_1.getViewer)(req, root);
+        if (!viewer) {
+            (0, web_1.fail)(res, 403, 'You must be signed in to do that.', null, '/login');
+            return;
+        }
+        const boundary = (0, multipart_1.boundaryOf)(req.get('content-type'));
+        if (!boundary || !Buffer.isBuffer(req.body)) {
+            (0, web_1.fail)(res, 400, 'That upload did not arrive as a form; try again.', viewer);
+            return;
+        }
+        const parts = (0, multipart_1.parseMultipart)(req.body, boundary);
+        // The CSRF value rides in the same form, so it is compared from the
+        // parsed parts: express did not fill in req.body for a multipart post.
+        if (!(0, session_1.csrfMatches)(req, (0, multipart_1.partField)(parts, 'csrf'), viewer)) {
+            (0, web_1.fail)(res, 403, 'The form has expired; go back, reload the page, and try again.', viewer);
+            return;
+        }
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: true });
+        if (!target)
+            return;
+        const { loaded, branch, filePath: dir } = target;
+        const retryUrl = `${urlOf(loaded.repo)}/upload/${(0, views_1.encPath)(branch)}${dir === '' ? '' : `/${(0, views_1.encPath)(dir)}`}`;
+        const expectedField = (0, multipart_1.partField)(parts, 'expected');
+        const expected = expectedField === '' ? null : expectedField;
+        if (expected !== null && !(0, git_1.isValidSha)(expected)) {
+            (0, web_1.fail)(res, 400, 'The form is missing its base commit; reload and try again.', viewer, retryUrl);
+            return;
+        }
+        const uploads = (0, multipart_1.partFiles)(parts, 'files');
+        if (uploads.length === 0) {
+            (0, web_1.fail)(res, 400, 'Choose at least one file to upload.', viewer, retryUrl);
+            return;
+        }
+        const total = uploads.reduce((n, f) => n + f.data.length, 0);
+        if (total > ops_1.MAX_UPLOAD_SIZE) {
+            (0, web_1.fail)(res, 413, 'That is more than one upload may carry; push it with git instead.', viewer, retryUrl);
+            return;
+        }
+        // Browsers send the name the file had on disk, and some send a whole
+        // path; only the last segment is ours to use, and it still has to be a
+        // path this repository would accept.
+        const files = [];
+        for (const upload of uploads) {
+            const name = (upload.filename ?? '').split(/[\\/]/).pop() ?? '';
+            const full = dir === '' ? name : `${dir}/${name}`;
+            if (name === '' || name === '.' || name === '..' || !(0, git_1.isValidRepoPath)(full)) {
+                (0, web_1.fail)(res, 400, `${name || 'That file'} does not have a usable name.`, viewer, retryUrl);
+                return;
+            }
+            files.push({ path: full, content: upload.data });
+        }
+        const summary = (0, multipart_1.partField)(parts, 'message').trim();
+        const description = (0, multipart_1.partField)(parts, 'description').trim();
+        const fallback = files.length === 1 ? `Add ${files[0].path.split('/').pop()}` : `Add ${files.length} files`;
+        const message = `${summary || fallback}${description ? `\n\n${description}` : ''}`;
+        let onto = branch;
+        if ((0, multipart_1.partField)(parts, 'newBranchWanted') === '1') {
+            const wanted = (0, multipart_1.partField)(parts, 'newBranch').trim();
+            if (wanted === '' || expected === null) {
+                (0, web_1.fail)(res, 400, 'Name the new branch, or untick the box to commit to this one.', viewer, retryUrl);
+                return;
+            }
+            try {
+                await ops.createBranch(loaded.repo.dir, wanted, expected);
+            }
+            catch (e) {
+                const message2 = e instanceof ops_1.OpError ? e.message : 'Could not create that branch.';
+                (0, web_1.fail)(res, e instanceof ops_1.OpError ? (0, ops_1.opErrorStatus)(e.kind) : 400, message2, viewer, retryUrl);
+                return;
+            }
+            onto = wanted;
+        }
+        try {
+            const sha = await ops.commitFiles(loaded.repo.dir, {
+                branch: onto,
+                files,
+                message,
+                author: authorFor(viewer, req),
+                expectedHead: expected,
+            });
+            fire(loaded.repo, onto, expected, sha, viewer.auth.username);
+        }
+        catch (e) {
+            await handleOpError(e, req, res, viewer, target, retryUrl);
+            return;
+        }
+        if (onto !== branch) {
+            res.redirect(`${urlOf(loaded.repo)}/compare/${(0, views_1.encPath)(branch)}...${(0, views_1.encPath)(onto)}`);
+            return;
+        }
+        res.redirect(`${urlOf(loaded.repo)}/tree/${(0, views_1.encPath)(onto)}${dir === '' ? '' : `/${(0, views_1.encPath)(dir)}`}`);
+    }));
+    app.get('/:collection/:repo/new/*', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: true });
+        if (!target)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, target.loaded, target.branch, viewer);
+        const preset = target.tip === null ? { filename: 'README.md', content: `# ${target.loaded.repo.name}\n` } : {};
+        res.type('html').send(forms.newFilePage(ctx, target.branch, target.filePath, target.tip, preset));
+    }));
+    app.post('/:collection/:repo/new/*', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: true });
+        if (!target)
+            return;
+        const { loaded, branch, filePath: dir } = target;
+        const expectedField = (0, web_1.field)(req, 'expected');
+        const expected = expectedField === '' ? null : expectedField;
+        if (expected !== null && !(0, git_1.isValidSha)(expected)) {
+            (0, web_1.fail)(res, 400, 'The form is missing its base commit; reload and try again.', viewer);
+            return;
+        }
+        if (expected === null && target.tip !== null) {
+            // The form was rendered against an empty repository, but a branch has
+            // appeared since; treat it as the branch having moved.
+            await handleOpError(new ops_1.OpError('branch created meanwhile', 'conflict'), req, res, viewer, target, req.originalUrl);
+            return;
+        }
+        const filename = (0, web_1.field)(req, 'filename').trim().replace(/^\/+|\/+$/g, '');
+        const fullPath = dir === '' ? filename : `${dir}/${filename}`;
+        const retryUrl = req.originalUrl;
+        if (filename === '' || !(0, git_1.isValidRepoPath)(fullPath)) {
+            (0, web_1.fail)(res, 400, 'Invalid file name.', viewer, retryUrl);
+            return;
+        }
+        const content = normalizeContent((0, web_1.field)(req, 'content'));
+        const message = commitMessage(req, `Create ${filename.split('/').pop()}`);
+        let written;
+        try {
+            written = await ops.writeFile(loaded.repo.dir, {
+                branch,
+                newBranch: newBranchWanted(req),
+                filePath: fullPath,
+                message,
+                author: authorFor(viewer, req),
+                expectedHead: expected,
+                action: { kind: 'create', content: Buffer.from(content, 'utf8') },
+            });
+        }
+        catch (e) {
+            await handleOpError(e, req, res, viewer, target, retryUrl);
+            return;
+        }
+        const onto = written.branch;
+        fire(loaded.repo, onto, expected, written.sha, viewer.auth.username);
+        if (onto !== branch) {
+            res.redirect(`${urlOf(loaded.repo)}/compare/${(0, views_1.encPath)(branch)}...${(0, views_1.encPath)(onto)}`);
+            return;
+        }
+        res.redirect(`${urlOf(loaded.repo)}/blob/${(0, views_1.encPath)(onto)}/${(0, views_1.encPath)(fullPath)}`);
+    }));
+    app.get('/:collection/:repo/delete/*', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: false });
+        if (!target)
+            return;
+        const { loaded, branch, filePath } = target;
+        const type = await loaded.repo.entryType(branch, filePath);
+        if (type !== 'blob') {
+            (0, web_1.send404)(res, `File ${filePath} not found at ${branch}`, viewer);
+            return;
+        }
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, branch, viewer);
+        res.type('html').send(forms.deleteFilePage(ctx, filePath, target.tip));
+    }));
+    app.post('/:collection/:repo/delete/*', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const target = await loadFileTarget(req, res, viewer, { allowEmptyRepo: false });
+        if (!target)
+            return;
+        const { loaded, branch, filePath } = target;
+        const expected = (0, web_1.field)(req, 'expected');
+        if (!(0, git_1.isValidSha)(expected)) {
+            (0, web_1.fail)(res, 400, 'The form is missing its base commit; reload and try again.', viewer);
+            return;
+        }
+        const message = commitMessage(req, `Delete ${filePath.split('/').pop()}`);
+        const retryUrl = `${urlOf(loaded.repo)}/delete/${(0, views_1.encPath)(branch)}/${(0, views_1.encPath)(filePath)}`;
+        try {
+            const sha = await ops.commitFileChange(loaded.repo.dir, {
+                branch,
+                filePath,
+                message,
+                author: authorFor(viewer, req),
+                expectedHead: expected,
+                action: { kind: 'delete' },
+            });
+            fire(loaded.repo, branch, expected, sha, viewer.auth.username);
+        }
+        catch (e) {
+            await handleOpError(e, req, res, viewer, target, retryUrl);
+            return;
+        }
+        const parent = filePath.split('/').slice(0, -1).join('/');
+        res.redirect(`${urlOf(loaded.repo)}/tree/${(0, views_1.encPath)(branch)}${parent ? `/${(0, views_1.encPath)(parent)}` : ''}`);
+    }));
+    // ---- branches and tags ----
+    async function loadForRefOp(req, res, viewer) {
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return null;
+        if (!(0, perms_1.atLeast)(loaded.role, 'write')) {
+            (0, web_1.fail)(res, 403, `You do not have the write role on ${loaded.repo.collection}/${loaded.repo.name}.`, viewer, urlOf(loaded.repo));
+            return null;
+        }
+        return loaded;
+    }
+    app.post('/:collection/:repo/branches/create', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRefOp(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/branches`;
+        const name = (0, web_1.field)(req, 'name').trim();
+        const from = (0, web_1.field)(req, 'from').trim() || loaded.defaultBranch || '';
+        try {
+            await ops.createBranch(loaded.repo.dir, name, from);
+            const created = loaded.branches.find((b) => b.name === from);
+            const tip = created?.sha ?? loaded.tags.find((t) => t.name === from)?.sha;
+            if (tip)
+                fire(loaded.repo, name, null, tip, viewer.auth.username);
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                (0, web_1.fail)(res, (0, ops_1.opErrorStatus)(e.kind), e.message, viewer, backUrl);
+                return;
+            }
+            throw e;
+        }
+        res.redirect(backUrl);
+    }));
+    app.post('/:collection/:repo/branches/delete', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRefOp(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/branches`;
+        const name = (0, web_1.field)(req, 'name');
+        if (!loaded.branches.some((b) => b.name === name)) {
+            (0, web_1.fail)(res, 404, `Branch ${name} not found.`, viewer, backUrl);
+            return;
+        }
+        if (name === loaded.defaultBranch) {
+            (0, web_1.fail)(res, 400, 'The default branch cannot be deleted. Change the default branch in Settings first.', viewer, backUrl);
+            return;
+        }
+        await ops.deleteBranch(loaded.repo.dir, name);
+        res.redirect(backUrl);
+    }));
+    app.post('/:collection/:repo/tags/create', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRefOp(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/tags`;
+        const name = (0, web_1.field)(req, 'name').trim();
+        const at = (0, web_1.field)(req, 'at').trim() || loaded.defaultBranch || '';
+        try {
+            await ops.createTag(loaded.repo.dir, name, at);
+        }
+        catch (e) {
+            if (e instanceof ops_1.OpError) {
+                (0, web_1.fail)(res, (0, ops_1.opErrorStatus)(e.kind), e.message, viewer, backUrl);
+                return;
+            }
+            throw e;
+        }
+        res.redirect(backUrl);
+    }));
+    app.post('/:collection/:repo/tags/delete', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRefOp(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/tags`;
+        const name = (0, web_1.field)(req, 'name');
+        if (!loaded.tags.some((t) => t.name === name)) {
+            (0, web_1.fail)(res, 404, `Tag ${name} not found.`, viewer, backUrl);
+            return;
+        }
+        await ops.deleteTag(loaded.repo.dir, name);
+        res.redirect(backUrl);
+    }));
+    // ---- repository settings ----
+    app.get('/:collection/:repo/settings', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, loaded.defaultBranch ?? '', viewer);
+        if (!ctx.canPush && !ctx.canAdmin) {
+            (0, web_1.fail)(res, 403, 'You do not have access to this repository’s settings.', viewer, urlOf(loaded.repo));
+            return;
+        }
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        const access = (0, perms_1.repoAccess)(loaded.repo.dir);
+        res.type('html').send(forms.settingsPage(ctx, (0, scan_1.repoDescription)(loaded.repo.dir) ?? '', {
+            collaborators: Object.entries(access.collaborators).map(([username, role]) => ({ username, role })),
+            owners: (0, perms_1.collectionOwners)(root, loaded.repo.collection),
+        }, msg));
+    }));
+    app.post('/:collection/:repo/settings', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        if (!(0, perms_1.atLeast)(loaded.role, 'write')) {
+            (0, web_1.fail)(res, 403, `You do not have the write role on ${loaded.repo.collection}/${loaded.repo.name}.`, viewer, backUrl);
+            return;
+        }
+        ops.setDescription(loaded.repo.dir, (0, web_1.field)(req, 'description'));
+        const defaultBranch = (0, web_1.field)(req, 'defaultBranch');
+        if (defaultBranch !== '' && defaultBranch !== loaded.defaultBranch) {
+            if (!loaded.branches.some((b) => b.name === defaultBranch)) {
+                (0, web_1.fail)(res, 400, `Branch ${defaultBranch} not found.`, viewer, backUrl);
+                return;
+            }
+            await ops.setDefaultBranch(loaded.repo.dir, defaultBranch);
+        }
+        res.redirect(`${backUrl}?msg=${encodeURIComponent('Settings saved.')}`);
+    }));
+    // ---- visibility and collaborators ----
+    // Both take the admin role: who may see or write a repository is decided by
+    // the people who administer it, the same rule the JSON API applies.
+    async function loadForRepoAdmin(req, res, viewer) {
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return null;
+        if (!(0, perms_1.atLeast)(loaded.role, 'admin')) {
+            (0, web_1.fail)(res, 403, `This takes the admin role on ${loaded.repo.collection}/${loaded.repo.name}.`, viewer, `${urlOf(loaded.repo)}/settings`);
+            return null;
+        }
+        return loaded;
+    }
+    app.post('/:collection/:repo/settings/visibility', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRepoAdmin(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const priv = (0, web_1.field)(req, 'private') === 'true';
+        (0, perms_1.setRepoPrivate)(loaded.repo.dir, priv);
+        const msg = priv
+            ? 'This repository is now private: visible to its collaborators, the collection’s owners, and site admins.'
+            : 'This repository is now public: anyone can read it.';
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(msg)}`);
+    }));
+    app.post('/:collection/:repo/settings/collaborators', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRepoAdmin(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const username = (0, web_1.field)(req, 'username').trim();
+        const role = (0, web_1.field)(req, 'role');
+        if (role !== 'read' && role !== 'write' && role !== 'admin') {
+            (0, web_1.fail)(res, 400, 'The role must be read, write, or admin.', viewer, backUrl);
+            return;
+        }
+        // Only a user the vault knows: an entry for a name nobody holds grants
+        // nothing today and everything it says to whoever gets the name later.
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok' || !state.vault.users[username]) {
+            (0, web_1.fail)(res, 404, `No user ${username || '(no name given)'} in this vault.`, viewer, backUrl);
+            return;
+        }
+        (0, perms_1.setCollaborator)(loaded.repo.dir, username, role);
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(`${username} now has the ${role} role here.`)}`);
+    }));
+    app.post('/:collection/:repo/settings/collaborators/remove', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await loadForRepoAdmin(req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const username = (0, web_1.field)(req, 'username').trim();
+        if ((0, perms_1.repoAccess)(loaded.repo.dir).collaborators[username] === undefined) {
+            (0, web_1.fail)(res, 404, `${username} is not a collaborator here.`, viewer, backUrl);
+            return;
+        }
+        (0, perms_1.removeCollaborator)(loaded.repo.dir, username);
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(`Removed ${username}.`)}`);
+    }));
+    // ---- forking ----
+    app.get('/:collection/:repo/fork', (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, loaded.defaultBranch ?? '', viewer);
+        // A vault usually has a collection named after each user, so that is the
+        // suggestion; anything the actor may push to is accepted.
+        res
+            .type('html')
+            .send(forms.forkPage(ctx, viewer, (0, scan_1.listCollections)(root).map((c) => c.name), {
+            collection: viewer.auth.username,
+            name: loaded.repo.name,
+        }));
+    }));
+    app.post('/:collection/:repo/fork', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const ctx = await (0, web_1.makeCtx)(root, req, loaded, loaded.defaultBranch ?? '', viewer);
+        const toCollection = (0, web_1.field)(req, 'collection').trim();
+        const toName = (0, web_1.field)(req, 'name').trim() || loaded.repo.name;
+        const names = (0, scan_1.listCollections)(root).map((c) => c.name);
+        if (!(0, scan_1.isValidName)(toCollection) || !(0, scan_1.isValidName)(toName) || !(0, perms_1.canCreateRepo)(root, viewer.auth, toCollection, toName)) {
+            res
+                .status(403)
+                .type('html')
+                .send(forms.forkPage(ctx, viewer, names, { collection: toCollection, name: toName }, `You are not allowed to create repositories in ${toCollection || '(no collection)'}.`));
+            return;
+        }
+        try {
+            await ops.forkRepo(root, loaded.repo.collection, loaded.repo.name, toCollection, toName);
+        }
+        catch (e) {
+            const message = e instanceof ops_1.OpError ? e.message : 'Could not fork the repository.';
+            res
+                .status(e instanceof ops_1.OpError ? (0, ops_1.opErrorStatus)(e.kind) : 400)
+                .type('html')
+                .send(forms.forkPage(ctx, viewer, names, { collection: toCollection, name: toName }, message));
+            return;
+        }
+        res.redirect((0, views_1.repoUrl)({ collection: toCollection, repo: toName }));
+    }));
+    app.post('/:collection/:repo/settings/rename', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const from = `${loaded.repo.collection}/${loaded.repo.name}`;
+        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const toCollection = (0, web_1.field)(req, 'collection').trim() || loaded.repo.collection;
+        const toName = (0, web_1.field)(req, 'name').trim();
+        const blocker = (0, perms_1.repoRenameBlocker)(root, viewer.auth, loaded.repo, toCollection, toName);
+        if (blocker) {
+            (0, web_1.fail)(res, 403, `Renaming or moving this repository needs ${blocker}.`, viewer, backUrl);
+            return;
+        }
+        try {
+            await ops.renameRepo(root, loaded.repo.collection, loaded.repo.name, toCollection, toName, repoCtx);
+        }
+        catch (e) {
+            const message = e instanceof ops_1.OpError ? e.message : 'Could not move the repository.';
+            (0, web_1.fail)(res, e instanceof ops_1.OpError ? (0, ops_1.opErrorStatus)(e.kind) : 400, message, viewer, backUrl);
+            return;
+        }
+        const to = (0, views_1.repoUrl)({ collection: toCollection, repo: toName });
+        res.redirect(`${to}/settings?msg=${encodeURIComponent(`Moved from ${from}.`)}`);
+    }));
+    app.post('/:collection/:repo/settings/delete', form, (0, web_1.ah)(async (req, res) => {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return;
+        const loaded = await (0, web_1.loadRepo)(root, req, res, viewer);
+        if (!loaded)
+            return;
+        const backUrl = `${urlOf(loaded.repo)}/settings`;
+        const target = `${loaded.repo.collection}/${loaded.repo.name}`;
+        if (!(0, perms_1.atLeast)(loaded.role, 'admin')) {
+            (0, web_1.fail)(res, 403, `Repository deletion requires the admin role on ${target}.`, viewer, backUrl);
+            return;
+        }
+        if ((0, web_1.field)(req, 'confirm').trim() !== target) {
+            (0, web_1.fail)(res, 400, `Type ${target} exactly to confirm deletion.`, viewer, backUrl);
+            return;
+        }
+        await ops.deleteRepo(root, loaded.repo.collection, loaded.repo.name, repoCtx);
+        res.redirect(`/${encodeURIComponent(loaded.repo.collection)}`);
+    }));
+    // ---- user administration ----
+    // Users are the site admin's business, mirroring the JSON API: creating
+    // them, the site-admin bit, and their tokens. What a user may reach is not
+    // set here; it lives with the repositories (collaborators) and collections
+    // (owners) that grant it.
+    function requireAdminPage(req, res) {
+        const viewer = (0, web_1.requireViewerPage)(root, req, res);
+        if (!viewer)
+            return null;
+        if (!(0, session_1.viewerIsAdmin)(viewer)) {
+            (0, web_1.fail)(res, 403, 'Site admin access required (sessions from restricted tokens carry no admin rights).', viewer, '/');
+            return null;
+        }
+        return viewer;
+    }
+    function requireAdminPost(req, res) {
+        const viewer = (0, web_1.requireViewerPost)(root, req, res);
+        if (!viewer)
+            return null;
+        if (!(0, session_1.viewerIsAdmin)(viewer)) {
+            (0, web_1.fail)(res, 403, 'Site admin access required (sessions from restricted tokens carry no admin rights).', viewer, '/');
+            return null;
+        }
+        return viewer;
+    }
+    // Everything under /admin already takes a site admin; the helper survives
+    // so a page for a weaker audience added later has the check to reach for.
+    function canSetVaultWide(viewer) {
+        return (0, perms_1.isSiteAdmin)(viewer.auth);
+    }
+    app.get('/admin', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        res.type('html').send(forms.adminIndexPage(viewer, canSetVaultWide(viewer)));
+    });
+    app.get('/admin/egress', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        if (!canSetVaultWide(viewer)) {
+            const why = 'The egress budget is vault-wide, so it takes a site admin.';
+            (0, web_1.fail)(res, 403, why, viewer, '/admin');
+            return;
+        }
+        if (!egress) {
+            (0, web_1.fail)(res, 500, 'This server is not counting outgoing bytes.', viewer, '/admin');
+            return;
+        }
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.egressPage(viewer, egress.snapshot(), { lfsBucket: lfs?.offloaded ?? false, msg }));
+    });
+    app.post('/admin/egress', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        if (!canSetVaultWide(viewer)) {
+            const why = 'The egress budget is vault-wide, so it takes a site admin.';
+            (0, web_1.fail)(res, 403, why, viewer, '/admin');
+            return;
+        }
+        const raw = (0, web_1.field)(req, 'egressGbPerDay').trim();
+        const gb = Number(raw);
+        if (raw === '' || !Number.isFinite(gb) || gb < 0) {
+            (0, web_1.fail)(res, 400, 'Give a number of gigabytes per day, or 0 to send without a limit.', viewer, '/admin/egress');
+            return;
+        }
+        // The whole block is written back, since saveConfig replaces a top-level key
+        // rather than merging into it. Every other field keeps the value it has, so a
+        // vault that has tuned its concurrencies by hand does not lose them here.
+        (0, config_1.saveConfig)(root, { limits: { ...(0, config_1.loadConfig)(root).limits, egressGbPerDay: gb } });
+        const msg = gb > 0 ? `Daily egress limit set to ${gb} GB.` : 'Daily egress limit removed.';
+        res.redirect(`/admin/egress?msg=${encodeURIComponent(msg)}`);
+    });
+    app.get('/admin/appearance', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        if (!canSetVaultWide(viewer)) {
+            (0, web_1.fail)(res, 403, 'Changing the theme takes a site admin.', viewer, '/admin');
+            return;
+        }
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.appearancePage(viewer, themes_1.THEMES, (0, config_1.loadConfig)(root).theme, msg));
+    });
+    app.post('/admin/appearance', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        if (!canSetVaultWide(viewer)) {
+            (0, web_1.fail)(res, 403, 'Changing the theme takes a site admin.', viewer, '/admin');
+            return;
+        }
+        const name = (0, web_1.field)(req, 'theme');
+        if (!(0, themes_1.findTheme)(name)) {
+            (0, web_1.fail)(res, 400, `Unknown theme: ${name || '(none selected)'}.`, viewer, '/admin/appearance');
+            return;
+        }
+        (0, config_1.saveConfig)(root, { theme: name });
+        (0, themes_1.setActiveTheme)(name);
+        res.redirect(`/admin/appearance?msg=${encodeURIComponent(`Theme set to ${name}.`)}`);
+    });
+    app.get('/admin/users', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, web_1.fail)(res, 500, 'The vault is not available.', viewer);
+            return;
+        }
+        const users = Object.entries(state.vault.users).map(([name, user]) => ({ name, user }));
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.adminUsersPage(viewer, users, msg));
+    });
+    app.post('/admin/users', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const username = (0, web_1.field)(req, 'username').trim();
+        const backUrl = '/admin/users';
+        if (!(0, scan_1.isValidUserName)(username)) {
+            (0, web_1.fail)(res, 400, 'A valid username is required (letters, digits, dot, underscore, dash, not starting with a dot).', viewer, backUrl);
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, web_1.fail)(res, 500, 'The vault is not available.', viewer, backUrl);
+            return;
+        }
+        if (state.vault.users[username]) {
+            (0, web_1.fail)(res, 409, `User ${username} already exists; use Grant or Mint token on the users page instead.`, viewer, backUrl);
+            return;
+        }
+        const result = (0, vault_1.addUserToken)(root, username, { siteAdmin: (0, web_1.field)(req, 'siteAdmin') === 'true' });
+        res.type('html').send(forms.tokenPage(viewer, username, result.token, true));
+    });
+    /**
+     * One user, with their tokens laid out and revocable. requireAdminPage has
+     * already established the actor is a site admin, which is the whole
+     * authorization here, as it is on the JSON API.
+     */
+    function loadUserForAdmin(req, res, viewer, backUrl) {
+        const name = req.params.name;
+        if (!(0, scan_1.isValidName)(name)) {
+            (0, web_1.fail)(res, 400, 'Invalid username.', viewer, backUrl);
+            return null;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, web_1.fail)(res, 500, 'The vault is not available.', viewer, backUrl);
+            return null;
+        }
+        const user = state.vault.users[name];
+        if (!user) {
+            (0, web_1.fail)(res, 404, `No user ${name}.`, viewer, backUrl);
+            return null;
+        }
+        return { name, user };
+    }
+    app.get('/admin/users/:name', (req, res) => {
+        const viewer = requireAdminPage(req, res);
+        if (!viewer)
+            return;
+        const found = loadUserForAdmin(req, res, viewer, '/admin/users');
+        if (!found)
+            return;
+        const msg = typeof req.query.msg === 'string' ? req.query.msg : undefined;
+        res.type('html').send(forms.adminUserPage(viewer, found.name, found.user, msg));
+    });
+    app.post('/admin/users/:name/tokens/:id/revoke', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const backUrl = `/admin/users/${encodeURIComponent(req.params.name)}`;
+        const found = loadUserForAdmin(req, res, viewer, backUrl);
+        if (!found)
+            return;
+        const wasThisSession = found.name === viewer.auth.username && (0, vault_1.tokenId)(viewer.auth.token) === req.params.id;
+        let result;
+        try {
+            result = (0, vault_1.revokeToken)(root, found.name, req.params.id);
+        }
+        catch (e) {
+            (0, web_1.fail)(res, 500, e instanceof Error ? e.message : String(e), viewer, backUrl);
+            return;
+        }
+        if (!result.revoked) {
+            (0, web_1.fail)(res, 404, `No token ${req.params.id} for ${found.name}.`, viewer, backUrl);
+            return;
+        }
+        // Revoking the session's own token is allowed, and the session it ends is
+        // this one: the redirect lands on the sign-in page rather than pretending
+        // otherwise.
+        if (wasThisSession) {
+            res.redirect('/login');
+            return;
+        }
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(`Revoked token ${req.params.id}.`)}`);
+    });
+    app.post('/admin/users/:name/emails', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const backUrl = `/admin/users/${encodeURIComponent(req.params.name)}`;
+        const found = loadUserForAdmin(req, res, viewer, backUrl);
+        if (!found)
+            return;
+        const emails = (0, web_1.field)(req, 'emails')
+            .split(/[\s,]+/)
+            .filter((s) => s.length > 0);
+        // The shape check is deliberately loose -- an @ with something either
+        // side -- since git itself enforces nothing about author emails and the
+        // point is to match whatever this person's commits actually carry.
+        const bad = emails.find((e) => e.length >= 200 || !/^[^@\s]+@[^@\s]+$/.test(e));
+        if (bad !== undefined) {
+            (0, web_1.fail)(res, 400, `That does not look like an email: ${bad}`, viewer, backUrl);
+            return;
+        }
+        (0, vault_1.setUserEmails)(root, found.name, emails);
+        const msg = emails.length ? `Emails saved for ${found.name}.` : `Emails cleared for ${found.name}.`;
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(msg)}`);
+    });
+    app.post('/admin/users/:name/delete', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const backUrl = `/admin/users/${encodeURIComponent(req.params.name)}`;
+        const found = loadUserForAdmin(req, res, viewer, backUrl);
+        if (!found)
+            return;
+        // Deleting yourself would leave a vault its owner cannot administer except
+        // by hand, and unlike revoking one token it cannot be undone by minting
+        // another.
+        if (found.name === viewer.auth.username) {
+            (0, web_1.fail)(res, 409, 'A user cannot delete themselves; another admin can, or edit vault.json by hand.', viewer, backUrl);
+            return;
+        }
+        if ((0, web_1.field)(req, 'confirm').trim() !== found.name) {
+            (0, web_1.fail)(res, 400, `Type ${found.name} exactly to confirm deletion.`, viewer, backUrl);
+            return;
+        }
+        // Their grants go with them: a collaborator entry or an owners listing
+        // left behind would belong to whoever is given this name next.
+        if ((0, vault_1.removeUser)(root, found.name))
+            (0, perms_1.removeUserGrants)(root, found.name);
+        res.redirect(`/admin/users?msg=${encodeURIComponent(`Deleted ${found.name} and revoked their tokens.`)}`);
+    });
+    app.post('/admin/users/:name/grant', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const username = req.params.name;
+        const backUrl = safeNext((0, web_1.field)(req, 'next')) === '/' ? '/admin/users' : safeNext((0, web_1.field)(req, 'next'));
+        if (!(0, scan_1.isValidName)(username)) {
+            (0, web_1.fail)(res, 400, 'Invalid username.', viewer, backUrl);
+            return;
+        }
+        const value = (0, web_1.field)(req, 'siteAdmin');
+        if (value !== 'true' && value !== 'false') {
+            (0, web_1.fail)(res, 400, 'Say whether to grant or withdraw site admin.', viewer, backUrl);
+            return;
+        }
+        try {
+            (0, vault_1.setSiteAdmin)(root, username, value === 'true');
+        }
+        catch (e) {
+            (0, web_1.fail)(res, 404, e instanceof Error ? e.message : String(e), viewer, backUrl);
+            return;
+        }
+        const msg = value === 'true' ? `${username} is now a site admin.` : `${username} is no longer a site admin.`;
+        res.redirect(`${backUrl}?msg=${encodeURIComponent(msg)}`);
+    });
+    app.post('/admin/users/:name/token', form, (req, res) => {
+        const viewer = requireAdminPost(req, res);
+        if (!viewer)
+            return;
+        const username = req.params.name;
+        const backUrl = '/admin/users';
+        if (!(0, scan_1.isValidName)(username)) {
+            (0, web_1.fail)(res, 400, 'Invalid username.', viewer, backUrl);
+            return;
+        }
+        const state = (0, vault_1.loadVault)(root);
+        if (state.status !== 'ok') {
+            (0, web_1.fail)(res, 500, 'The vault is not available.', viewer, backUrl);
+            return;
+        }
+        const existing = state.vault.users[username];
+        if (!existing) {
+            (0, web_1.fail)(res, 404, `User ${username} does not exist.`, viewer, backUrl);
+            return;
+        }
+        const tokenScope = globsField(req, 'tokenScope');
+        if (tokenScope === null) {
+            (0, web_1.fail)(res, 400, 'Token scope globs are too long.', viewer, backUrl);
+            return;
+        }
+        const result = (0, vault_1.addUserToken)(root, username, {
+            tokenScope: tokenScope.length ? tokenScope : undefined,
+        });
+        res.type('html').send(forms.tokenPage(viewer, username, result.token, false));
+    });
+}