@manojkmfsi/monodog 1.1.17 → 1.1.19

package/dist/routes/permission-routes.js

@@ -0,0 +1,161 @@
+"use strict";
+/**
+ * Repository Permission Routes
+ * Handles checking and managing repository permissions
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const auth_middleware_1 = require("../middleware/auth-middleware");
+const permission_service_1 = require("../services/permission-service");
+const logger_1 = require("../middleware/logger");
+const router = (0, express_1.Router)();
+/**
+ * Get user's permission for a specific repository
+ * GET /permissions/:owner/:repo
+ */
+router.get('/:owner/:repo', auth_middleware_1.authenticationMiddleware, async (req, res) => {
+    try {
+        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+        if (!session) {
+            res.status(401).json({
+                error: 'Unauthorized',
+                message: 'No active session',
+            });
+            return;
+        }
+        const { owner, repo } = req.params;
+        const forceRefresh = req.query.refresh === 'true';
+        if (!owner || !repo) {
+            res.status(400).json({
+                error: 'Bad request',
+                message: 'Owner and repo parameters are required',
+            });
+            return;
+        }
+        logger_1.AppLogger.debug(`Checking permission for ${session.user.login} in ${owner}/${repo}`);
+        // Get permission from cache or GitHub API
+        const cachedPermission = await (0, permission_service_1.getUserRepositoryPermission)(session.accessToken, session.user.id, session.user.login, owner, repo, forceRefresh);
+        const response = {
+            permission: cachedPermission.permission,
+            role: cachedPermission.role,
+            canAdmin: cachedPermission.permission === 'admin',
+            canMaintain: (0, permission_service_1.canPerformAction)(cachedPermission.permission, 'maintain'),
+            canWrite: (0, permission_service_1.canPerformAction)(cachedPermission.permission, 'write'),
+            canRead: (0, permission_service_1.canPerformAction)(cachedPermission.permission, 'read'),
+            denied: cachedPermission.permission === 'none',
+        };
+        res.json({
+            success: true,
+            owner,
+            repo,
+            user: session.user.login,
+            ...response,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to check permission: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Internal server error',
+            message: 'Failed to check repository permission',
+        });
+    }
+});
+/**
+ * Check if user can perform a specific action
+ * POST /permissions/:owner/:repo/can-action
+ */
+router.post('/:owner/:repo/can-action', auth_middleware_1.authenticationMiddleware, async (req, res) => {
+    try {
+        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+        if (!session) {
+            res.status(401).json({
+                error: 'Unauthorized',
+                message: 'No active session',
+            });
+            return;
+        }
+        const { owner, repo } = req.params;
+        const { action } = req.body;
+        if (!owner || !repo) {
+            res.status(400).json({
+                error: 'Bad request',
+                message: 'Owner and repo parameters are required',
+            });
+            return;
+        }
+        if (!action || !['read', 'write', 'maintain', 'admin'].includes(action)) {
+            res.status(400).json({
+                error: 'Bad request',
+                message: 'Valid action is required (read, write, maintain, or admin)',
+            });
+            return;
+        }
+        logger_1.AppLogger.debug(`Checking if ${session.user.login} can perform '${action}' in ${owner}/${repo}`);
+        // Get permission
+        const cachedPermission = await (0, permission_service_1.getUserRepositoryPermission)(session.accessToken, session.user.id, session.user.login, owner, repo);
+        // Check if user can perform action
+        const can = (0, permission_service_1.canPerformAction)(cachedPermission.permission, action);
+        res.json({
+            success: true,
+            owner,
+            repo,
+            user: session.user.login,
+            action,
+            can,
+            permission: cachedPermission.permission,
+            role: cachedPermission.role,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to check action permission: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Internal server error',
+            message: 'Failed to check action permission',
+        });
+    }
+});
+/**
+ * Invalidate permission cache for a repository
+ * POST /permissions/:owner/:repo/invalidate
+ */
+router.post('/:owner/:repo/invalidate', auth_middleware_1.authenticationMiddleware, (req, res) => {
+    try {
+        const session = (0, auth_middleware_1.getSessionFromRequest)(req);
+        if (!session) {
+            res.status(401).json({
+                error: 'Unauthorized',
+                message: 'No active session',
+            });
+            return;
+        }
+        const { owner, repo } = req.params;
+        if (!owner || !repo) {
+            res.status(400).json({
+                error: 'Bad request',
+                message: 'Owner and repo parameters are required',
+            });
+            return;
+        }
+        logger_1.AppLogger.debug(`Invalidating permission cache for ${session.user.login} in ${owner}/${repo}`);
+        // Invalidate cache
+        (0, permission_service_1.invalidatePermissionCache)(session.user.id, owner, repo);
+        res.json({
+            success: true,
+            message: 'Permission cache invalidated',
+            owner,
+            repo,
+            user: session.user.login,
+        });
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to invalidate cache: ${error}`);
+        res.status(500).json({
+            success: false,
+            error: 'Internal server error',
+            message: 'Failed to invalidate permission cache',
+        });
+    }
+});
+exports.default = router;

package/dist/serve.js

@@ -8,11 +8,16 @@
  * 1. Start the API server for the dashboard.
  * 2. Start serving the dashboard frontend.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
+const dotenv_1 = __importDefault(require("dotenv"));
+const path_1 = __importDefault(require("path"));
 const index_1 = require("./index");
 const utilities_1 = require("./utils/utilities");
-let logLevel = '';
-let nodeEnv = 'production';
+let logLevel = process.env.LOG_LEVEL || 'info';
+let nodeEnv = process.env.NODE_ENV || 'production';
 const args = process.argv;
 if (args.includes('--dev')) {
     nodeEnv = 'development';
@@ -24,6 +29,7 @@ if (args.includes('--debug')) {
 else if (args.includes('--info')) {
     logLevel = 'info';
 }
+dotenv_1.default.config({ path: path_1.default.resolve(process.cwd(), '.env') });
 process.env.LOG_LEVEL = logLevel;
 process.env.NODE_ENV = nodeEnv;
 const rootPath = (0, utilities_1.findMonorepoRoot)();

package/dist/services/github-oauth-service.js

@@ -0,0 +1,223 @@
+"use strict";
+/**
+ * GitHub API Service
+ * Handles all GitHub API interactions including OAuth and permission checks
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeCodeForToken = exchangeCodeForToken;
+exports.getAuthenticatedUser = getAuthenticatedUser;
+exports.getUserEmail = getUserEmail;
+exports.getRepositoryPermission = getRepositoryPermission;
+exports.mapPermissionToRole = mapPermissionToRole;
+exports.hasPermission = hasPermission;
+exports.validateToken = validateToken;
+exports.generateAuthorizationUrl = generateAuthorizationUrl;
+const https_1 = __importDefault(require("https"));
+const logger_1 = require("../middleware/logger");
+const GITHUB_API_BASE = 'https://api.github.com';
+const GITHUB_OAUTH_BASE = 'https://github.com';
+/**
+ * Make an HTTPS request to GitHub API
+ */
+function makeGitHubRequest(options, data) {
+    return new Promise((resolve, reject) => {
+        const request = https_1.default.request(options, (response) => {
+            let body = '';
+            response.on('data', (chunk) => {
+                body += chunk;
+            });
+            response.on('end', () => {
+                try {
+                    if (response.statusCode && response.statusCode >= 400) {
+                        reject(new Error(`GitHub API error: ${response.statusCode} - ${body}`));
+                    }
+                    else {
+                        const result = body ? JSON.parse(body) : {};
+                        resolve(result);
+                    }
+                }
+                catch (error) {
+                    reject(new Error(`Failed to parse GitHub API response: ${error}`));
+                }
+            });
+        });
+        request.on('error', (error) => {
+            logger_1.AppLogger.error(`GitHub API request failed: ${error.message}`);
+            reject(error);
+        });
+        request.setTimeout(10000, () => {
+            request.destroy();
+            reject(new Error('GitHub API request timeout'));
+        });
+        if (data) {
+            request.write(data);
+        }
+        request.end();
+    });
+}
+/**
+ * Exchange OAuth code for access token
+ */
+async function exchangeCodeForToken(code, clientId, clientSecret, redirectUri) {
+    const payload = JSON.stringify({
+        client_id: clientId,
+        client_secret: clientSecret,
+        code,
+        redirect_uri: redirectUri,
+    });
+    const options = {
+        hostname: 'github.com',
+        path: '/login/oauth/access_token',
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            'Content-Length': String(Buffer.byteLength(payload)),
+            Accept: 'application/json',
+        },
+    };
+    try {
+        const response = await makeGitHubRequest(options, payload);
+        if (response.error) {
+            throw new Error(`OAuth exchange failed: ${response.error}`);
+        }
+        logger_1.AppLogger.debug('Successfully exchanged OAuth code for access token');
+        return response;
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to exchange OAuth code: ${error}`);
+        throw error;
+    }
+}
+/**
+ * Get authenticated user information
+ */
+async function getAuthenticatedUser(accessToken) {
+    const options = {
+        hostname: 'api.github.com',
+        path: '/user',
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'User-Agent': 'MonoDog',
+            Accept: 'application/vnd.github+json',
+        },
+    };
+    try {
+        const user = await makeGitHubRequest(options);
+        logger_1.AppLogger.debug(`Retrieved user info: ${user.login}`);
+        return user;
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to get user info: ${error}`);
+        throw error;
+    }
+}
+/**
+ * Get user's email from GitHub (with proper scopes)
+ */
+async function getUserEmail(accessToken) {
+    const options = {
+        hostname: 'api.github.com',
+        path: '/user/emails',
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'User-Agent': 'MonoDog',
+            Accept: 'application/vnd.github+json',
+        },
+    };
+    try {
+        const emails = await makeGitHubRequest(options);
+        const primaryEmail = emails.find((e) => e.primary && e.verified);
+        return primaryEmail?.email || null;
+    }
+    catch (error) {
+        logger_1.AppLogger.warn(`Failed to get user email: ${error}`);
+        return null;
+    }
+}
+/**
+ * Get user's permission for a specific repository
+ * Returns the user's permission level in the target repository
+ */
+async function getRepositoryPermission(accessToken, owner, repo, username) {
+    const options = {
+        hostname: 'api.github.com',
+        path: `/repos/${owner}/${repo}/collaborators/${username}/permission`,
+        method: 'GET',
+        headers: {
+            Authorization: `Bearer ${accessToken}`,
+            'User-Agent': 'MonoDog',
+            Accept: 'application/vnd.github+json',
+        },
+    };
+    try {
+        const response = await makeGitHubRequest(options);
+        logger_1.AppLogger.debug(`Retrieved permission for ${username} in ${owner}/${repo}: ${response.permission}`);
+        return response;
+    }
+    catch (error) {
+        logger_1.AppLogger.warn(`Failed to get repository permission for ${username} in ${owner}/${repo}: ${error}`);
+        // If error (likely 404 or no access), return 'none' permission
+        return { permission: 'none' };
+    }
+}
+/**
+ * Map GitHub permission to MonoDog role
+ */
+function mapPermissionToRole(permission) {
+    switch (permission) {
+        case 'admin':
+            return 'Admin';
+        case 'maintain':
+            return 'Maintainer';
+        case 'write':
+        case 'read':
+            return 'Collaborator';
+        case 'none':
+        default:
+            return 'Denied';
+    }
+}
+/**
+ * Check if user has required permission level
+ */
+function hasPermission(userPermission, requiredPermission) {
+    const permissionHierarchy = {
+        admin: 4,
+        maintain: 3,
+        write: 2,
+        read: 1,
+        none: 0,
+    };
+    return (permissionHierarchy[userPermission] >= permissionHierarchy[requiredPermission]);
+}
+/**
+ * Validate OAuth token is still valid
+ */
+async function validateToken(accessToken) {
+    try {
+        await getAuthenticatedUser(accessToken);
+        return true;
+    }
+    catch (error) {
+        logger_1.AppLogger.warn(`Token validation failed: ${error}`);
+        return false;
+    }
+}
+/**
+ * Generate OAuth authorization URL
+ */
+function generateAuthorizationUrl(clientId, redirectUri, state, scopes = ['read:user', 'user:email', 'repo']) {
+    const params = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        state,
+        scope: scopes.join(','),
+        allow_signup: 'true',
+    });
+    return `${GITHUB_OAUTH_BASE}/login/oauth/authorize?${params.toString()}`;
+}

package/dist/services/permission-service.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * Permission Service
+ * Manages repository permission caching and validation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startCacheCleanup = startCacheCleanup;
+exports.getUserRepositoryPermission = getUserRepositoryPermission;
+exports.invalidatePermissionCache = invalidatePermissionCache;
+exports.invalidateUserCache = invalidateUserCache;
+exports.clearAllCache = clearAllCache;
+exports.getCacheStats = getCacheStats;
+exports.canPerformAction = canPerformAction;
+const github_oauth_service_1 = require("./github-oauth-service");
+const logger_1 = require("../middleware/logger");
+// Cache storage: key = `${userId}:${owner}/${repo}`
+const permissionCache = new Map();
+// Configuration
+const DEFAULT_TTL = 5 * 60 * 1000; // 5 minutes
+const MAX_CACHE_SIZE = 10000;
+const CLEANUP_INTERVAL = 60 * 1000; // 1 minute
+/**
+ * Start periodic cleanup of expired cache entries
+ */
+function startCacheCleanup() {
+    setInterval(() => {
+        const now = Date.now();
+        let cleanedCount = 0;
+        for (const [key, entry] of permissionCache.entries()) {
+            if (now > entry.cachedAt + entry.ttl) {
+                permissionCache.delete(key);
+                cleanedCount++;
+            }
+        }
+        if (cleanedCount > 0) {
+            logger_1.AppLogger.debug(`Cleaned ${cleanedCount} expired permission cache entries`);
+        }
+    }, CLEANUP_INTERVAL);
+}
+/**
+ * Generate cache key
+ */
+function getCacheKey(userId, owner, repo) {
+    return `${userId}:${owner}/${repo}`;
+}
+/**
+ * Get cached permission if still valid
+ */
+function getCachedPermission(userId, owner, repo) {
+    const key = getCacheKey(userId, owner, repo);
+    const cached = permissionCache.get(key);
+    if (!cached) {
+        return null;
+    }
+    const now = Date.now();
+    if (now > cached.cachedAt + cached.ttl) {
+        // Cache expired
+        permissionCache.delete(key);
+        logger_1.AppLogger.debug(`Cache expired for ${key}`);
+        return null;
+    }
+    return cached;
+}
+/**
+ * Set permission in cache
+ */
+function setCachedPermission(userId, username, owner, repo, permission, ttl = DEFAULT_TTL) {
+    const role = (0, github_oauth_service_1.mapPermissionToRole)(permission);
+    const cached = {
+        userId,
+        username,
+        owner,
+        repo,
+        permission,
+        role,
+        cachedAt: Date.now(),
+        ttl,
+    };
+    const key = getCacheKey(userId, owner, repo);
+    // Check cache size and evict oldest if needed
+    if (permissionCache.size >= MAX_CACHE_SIZE) {
+        let oldestKey = '';
+        let oldestTime = Date.now();
+        for (const [k, entry] of permissionCache.entries()) {
+            if (entry.cachedAt < oldestTime) {
+                oldestTime = entry.cachedAt;
+                oldestKey = k;
+            }
+        }
+        if (oldestKey) {
+            permissionCache.delete(oldestKey);
+            logger_1.AppLogger.debug(`Evicted oldest cache entry: ${oldestKey}`);
+        }
+    }
+    permissionCache.set(key, cached);
+    logger_1.AppLogger.debug(`Cached permission for ${key}: ${permission}`);
+    return cached;
+}
+/**
+ * Get user's permission for a repository
+ * Checks cache first, then queries GitHub API if needed
+ */
+async function getUserRepositoryPermission(accessToken, userId, username, owner, repo, forceRefresh = false) {
+    // Check cache if not forcing refresh
+    if (!forceRefresh) {
+        const cached = getCachedPermission(userId, owner, repo);
+        if (cached) {
+            return cached;
+        }
+    }
+    // Query GitHub API
+    logger_1.AppLogger.debug(`Querying GitHub API for ${username}'s permission in ${owner}/${repo}`);
+    try {
+        const response = await (0, github_oauth_service_1.getRepositoryPermission)(accessToken, owner, repo, username);
+        return setCachedPermission(userId, username, owner, repo, response.permission);
+    }
+    catch (error) {
+        logger_1.AppLogger.error(`Failed to get repository permission: ${error}`);
+        // Return 'none' permission on error
+        return setCachedPermission(userId, username, owner, repo, 'none');
+    }
+}
+/**
+ * Invalidate permission cache for a user-repository pair
+ */
+function invalidatePermissionCache(userId, owner, repo) {
+    const key = getCacheKey(userId, owner, repo);
+    permissionCache.delete(key);
+    logger_1.AppLogger.debug(`Invalidated cache for ${key}`);
+}
+/**
+ * Invalidate all permissions for a user
+ */
+function invalidateUserCache(userId) {
+    let invalidatedCount = 0;
+    for (const key of permissionCache.keys()) {
+        if (key.startsWith(`${userId}:`)) {
+            permissionCache.delete(key);
+            invalidatedCount++;
+        }
+    }
+    logger_1.AppLogger.debug(`Invalidated ${invalidatedCount} cache entries for user ${userId}`);
+}
+/**
+ * Clear all permission cache (useful for testing)
+ */
+function clearAllCache() {
+    const size = permissionCache.size;
+    permissionCache.clear();
+    logger_1.AppLogger.info(`Cleared all permission cache (${size} entries)`);
+}
+/**
+ * Get cache statistics
+ */
+function getCacheStats() {
+    return {
+        size: permissionCache.size,
+        capacity: MAX_CACHE_SIZE,
+        utilizationPercent: (permissionCache.size / MAX_CACHE_SIZE) * 100,
+    };
+}
+/**
+ * Check if user can perform an action based on permission
+ */
+function canPerformAction(permission, requiredAction) {
+    const actionPermissionMap = {
+        read: ['read', 'write', 'maintain', 'admin'],
+        write: ['write', 'maintain', 'admin'],
+        maintain: ['maintain', 'admin'],
+        admin: ['admin'],
+    };
+    const allowedPermissions = actionPermissionMap[requiredAction] || [];
+    return allowedPermissions.includes(permission);
+}

package/dist/types/auth.js

@@ -0,0 +1,5 @@
+"use strict";
+/**
+ * GitHub OAuth and Authentication Types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });