@rmdes/indiekit-endpoint-github 1.2.7 → 1.2.8

package/index.js

@@ -12,6 +12,8 @@ import { dashboardController } from "./lib/controllers/dashboard.js";
 import { featuredController } from "./lib/controllers/featured.js";
 import { starsController } from "./lib/controllers/stars.js";
 import { starredController } from "./lib/controllers/starred.js";
+import { reposController } from "./lib/controllers/repos.js";
+import { GITHUB_BLOCKS } from "./lib/blocks.js";
 
 // Module-level routers (matching Indiekit's endpoint pattern)
 const protectedRouter = express.Router();
@@ -66,6 +68,10 @@ export default class GitHubEndpoint {
     };
   }
 
+  get blocks() {
+    return GITHUB_BLOCKS;
+  }
+
   /**
    * Protected routes (require authentication)
    * HTML pages for admin dashboard
@@ -99,6 +105,7 @@ export default class GitHubEndpoint {
     publicRouter.get("/api/changelog", changelogController.api);
     publicRouter.get("/api/starred/all", starredController.all);
     publicRouter.get("/api/starred/recent", starredController.recent);
+    publicRouter.get("/api/repos", reposController.api);
 
     return publicRouter;
   }

package/lib/blocks.js

@@ -0,0 +1,36 @@
+/**
+ * GitHub v2 block declaration (Phase 7c — plugin block ownership).
+ *
+ * The `github-repos` sidebar widget was a site-config BUILTIN_BLOCKS seed
+ * (requiresPlugin null). Declaring it here makes site-config's scanPlugins stamp
+ * `sourcePlugin` → `requiresPlugin` ("GitHub activity endpoint"), so the block is
+ * properly plugin-gated (theme ENDPOINT_SLUGS maps it to the `github` loadout
+ * slug). scanPlugins precedence is `built-in < plugin blocks`, so this entry
+ * OVERWRITES the builtin seed where the plugin is loaded; the seed itself is
+ * removed from site-config in Phase 7d alongside the legacy-map bridge.
+ *
+ * `source:"api"` is honest: the widget fetches the plugin's JSON API LIVE
+ * client-side (commits/featured/contributions/repos) — no rebuild needed for
+ * fresh data. As of 7c the Repos tab also routes through this plugin
+ * (/api/repos) instead of hitting api.github.com directly from the browser, so
+ * the plugin is the single source of truth. Bespoke template: the theme owns
+ * `components/widgets/github-repos.njk` + `js/widgets/github-repos.js`.
+ *
+ * @module lib/blocks
+ */
+
+/** @type {Array<object>} */
+export const GITHUB_BLOCKS = [
+  {
+    id: "github-repos",
+    version: 1,
+    label: "GitHub Projects",
+    description: "GitHub repositories and activity",
+    icon: "github",
+    category: "social",
+    placement: { regions: ["sidebar"], surfaces: ["homepage"] },
+    multiple: false,
+    data: { source: "api" },
+    schema: { type: "object", additionalProperties: false, properties: {} },
+  },
+];

package/lib/controllers/repos.js

@@ -0,0 +1,57 @@
+import { GitHubClient } from "../github-client.js";
+
+/**
+ * Public JSON API for the user's own repositories (Phase 7c).
+ *
+ * The sidebar widget's "Repos" tab previously fetched api.github.com DIRECTLY
+ * from the browser (sort=updated, type=owner) and filtered fork/private
+ * client-side — bypassing this plugin, so the GitHub token never protected the
+ * call (rate limits, no auth). This endpoint moves that fetch server-side: the
+ * plugin (GitHubClient + token + 15-min cache) is now the single source of truth.
+ *
+ * Returns a SLIM shape using the RAW GitHub field names the widget template
+ * already reads (html_url/name/description/language/stargazers_count/updated_at),
+ * so github-repos.njk needs no change — only the widget's fetch URL moves to
+ * /api/repos.
+ * @type {import("express").RequestHandler}
+ */
+export const reposController = {
+  async api(request, response, next) {
+    try {
+      const { username, token, cacheTtl, limits } =
+        request.app.locals.application.githubConfig;
+
+      if (!username) {
+        return response.status(400).json({ error: "No username configured" });
+      }
+
+      const client = new GitHubClient({ token, cacheTtl });
+
+      let raw = [];
+      try {
+        // Fetch extra (×2) so the fork/private filter still yields enough.
+        raw = await client.getUserRepos(username, (limits.repos || 10) * 2, "updated");
+      } catch (apiError) {
+        return response
+          .status(apiError.status || 500)
+          .json({ error: apiError.message });
+      }
+
+      const repos = (Array.isArray(raw) ? raw : [])
+        .filter((r) => r && !r.fork && !r.private)
+        .slice(0, limits.repos || 10)
+        .map((r) => ({
+          name: r.name,
+          html_url: r.html_url,
+          description: r.description,
+          language: r.language,
+          stargazers_count: r.stargazers_count,
+          updated_at: r.updated_at,
+        }));
+
+      response.json({ repos });
+    } catch (error) {
+      next(error);
+    }
+  },
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmdes/indiekit-endpoint-github",
-  "version": "1.2.7",
+  "version": "1.2.8",
   "description": "GitHub activity endpoint for Indiekit. Display commits, stars, contributions, and featured repositories.",
   "keywords": [
     "indiekit",