@realiizlabs/admin 0.15.9 → 0.17.0

package/dist/studio/index.cjs

@@ -3,6 +3,7 @@
 require('server-only');
 var navigation = require('next/navigation');
 var ssr = require('@supabase/ssr');
+var crypto = require('crypto');
 var matter = require('gray-matter');
 var unified = require('unified');
 var remarkParse = require('remark-parse');
@@ -183,15 +184,15 @@ var ChecksFailedError = class extends Error {
   }
 };
 
-// src/git/client.ts
-var API = "https://api.github.com";
+// src/git/http.ts
+var GITHUB_API = "https://api.github.com";
 var GITHUB_TIMEOUT_MS = 1e4;
-async function ghFetch(ctx, method, path, body) {
-  const res = await fetch(API + path, {
+async function githubRequest(method, path, authorization, body, fetchImpl = fetch) {
+  const res = await fetchImpl(GITHUB_API + path, {
     method,
     signal: AbortSignal.timeout(GITHUB_TIMEOUT_MS),
     headers: {
-      Authorization: `Bearer ${ctx.token}`,
+      Authorization: authorization,
       Accept: "application/vnd.github+json",
       "X-GitHub-Api-Version": "2022-11-28",
       "User-Agent": "realiizlabs-admin",
@@ -210,6 +211,65 @@ async function ghFetch(ctx, method, path, body) {
   }
   return { ok: res.ok, status: res.status, json };
 }
+
+// src/git/app-auth.ts
+var JWT_TTL_S = 9 * 60;
+var REFRESH_BEFORE_MS = 5 * 6e4;
+var cache = /* @__PURE__ */ new Map();
+function b64url(input) {
+  return Buffer.from(input).toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function appJwt(creds, now = Math.floor(Date.now() / 1e3)) {
+  const header = b64url(JSON.stringify({ alg: "RS256", typ: "JWT" }));
+  const payload = b64url(JSON.stringify({ iat: now - 60, exp: now + JWT_TTL_S, iss: creds.appId }));
+  const signer = crypto.createSign("RSA-SHA256");
+  signer.update(`${header}.${payload}`);
+  const signature = signer.sign(creds.privateKey.replace(/\\n/g, "\n"));
+  return `${header}.${payload}.${b64url(signature)}`;
+}
+function forgetInstallationToken(creds, owner, repo) {
+  cache.delete(`${creds.appId}:${owner}/${repo}`);
+}
+async function installationToken(creds, owner, repo, fetchImpl = fetch) {
+  const key = `${creds.appId}:${owner}/${repo}`;
+  const hit = cache.get(key);
+  if (hit && hit.expiresAt - Date.now() > REFRESH_BEFORE_MS) return hit.token;
+  const bearer = `Bearer ${appJwt(creds)}`;
+  const repoPath2 = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`;
+  const found = await githubRequest("GET", `${repoPath2}/installation`, bearer, void 0, fetchImpl);
+  if (found.status === 404) {
+    throw new GitHubError(
+      `The Realiiz Studio GitHub App isn't installed on ${owner}/${repo}. The repository's owner installs it once \u2014 ask your web team for the link.`,
+      { status: 404, path: `${repoPath2}/installation`, body: found.json }
+    );
+  }
+  if (!found.ok) throw new GitHubError(`GitHub ${found.status} looking up the app installation`, { status: found.status, path: `${repoPath2}/installation`, body: found.json });
+  const minted = await githubRequest(
+    "POST",
+    `/app/installations/${found.json.id}/access_tokens`,
+    bearer,
+    void 0,
+    fetchImpl
+  );
+  if (!minted.ok) throw new GitHubError(`GitHub ${minted.status} minting an installation token`, { status: minted.status, path: "/app/installations/\u2026/access_tokens", body: minted.json });
+  cache.set(key, { token: minted.json.token, expiresAt: Date.parse(minted.json.expires_at) });
+  return minted.json.token;
+}
+
+// src/git/client.ts
+async function credentialFor(ctx) {
+  if (ctx.app) return installationToken(ctx.app, ctx.owner, ctx.repo);
+  if (ctx.token) return ctx.token;
+  throw new GitHubError(`No GitHub credential for ${ctx.owner}/${ctx.repo}: set GITHUB_APP_ID + GITHUB_APP_PRIVATE_KEY, or GITHUB_CONTENT_TOKEN.`, { status: 0, path: "", body: null });
+}
+async function ghFetch(ctx, method, path, body) {
+  const res = await githubRequest(method, path, `Bearer ${await credentialFor(ctx)}`, body);
+  if (res.status === 401 && ctx.app) {
+    forgetInstallationToken(ctx.app, ctx.owner, ctx.repo);
+    return githubRequest(method, path, `Bearer ${await credentialFor(ctx)}`, body);
+  }
+  return res;
+}
 async function ghFetchOrThrow(ctx, method, path, body) {
   const res = await ghFetch(ctx, method, path, body);
   if (!res.ok) throw toError(res, path);
@@ -416,6 +476,10 @@ function makeReaders(config, registry, pending) {
     const entries = await listDirectory(repo(), e.folder);
     return entries.find((x) => registry.slugOf(e, x.name) === slug)?.path ?? null;
   };
+  const listSlugs = async (typeId) => {
+    const items = await listItems(typeId);
+    return items.filter((i) => !i.isNew).map((i) => i.slug).sort();
+  };
   const listItems = async (typeId) => {
     const e = need(typeId);
     const ctx = repo();
@@ -491,7 +555,7 @@ function makeReaders(config, registry, pending) {
     }
   };
   const prStatus = (number) => getPullRequestStatus(repo(), number);
-  return { pathOf, listItems, countItems, readItem, lastAuthor, getPullRequest: getPullRequest2, prStatus };
+  return { pathOf, listItems, listSlugs, countItems, readItem, lastAuthor, getPullRequest: getPullRequest2, prStatus };
 }
 
 // src/git/branch.ts
@@ -613,18 +677,22 @@ ${input.body.trim()}
     if (!pictures.ok) return { ok: false, error: pictures.error };
     const files = [{ path, content }, ...pictures.files];
     const repo = config.env().repo;
+    const oldPath = input.replaces ? await readers.pathOf(entry.id, input.replaces).catch(() => null) : null;
+    const remove = oldPath && oldPath !== path ? [oldPath] : [];
+    const renamed = remove.length ? `
+Renamed from \`${oldPath}\` to \`${path}\`` : "";
     if (input.existing && await stillOpen(input.existing.number)) {
-      await writeFiles(repo, input.existing.branch, files, `Update: ${title}`);
+      await writeFiles(repo, input.existing.branch, files, `Update: ${title}`, { remove });
       navigation.redirect(`/admin/pr/${input.existing.number}`);
     }
     const branch = `admin/${entry.id}/${fileName.replace(/\.mdx$/, "")}-${stamp()}`;
     await createBranch(repo, branch);
-    await writeFiles(repo, branch, files, `Publish: ${title}`);
+    await writeFiles(repo, branch, files, `Publish: ${title}`, { remove });
     const pr = await openPullRequest(repo, branch, {
       title: `Publish: ${title}`,
       body: `Published from the dashboard by ${user.email ?? user.id}.
 
-File: \`${path}\``
+File: \`${path}\`${renamed}`
     });
     navigation.redirect(`/admin/pr/${pr.number}`);
   };
@@ -1115,7 +1183,7 @@ function makeHandlers(ctx) {
 }
 
 // src/version.ts
-var ADMIN_VERSION = "0.15.9" ;
+var ADMIN_VERSION = "0.17.0" ;
 
 // src/studio/update.ts
 var PACKAGE_NAME = "@realiizlabs/admin";