@ticatec/omniflow-gitlab 1.0.0

package/src/client/GitLabClient.ts

@@ -0,0 +1,200 @@
+import { safeFetch, maskSecrets, extractErrorMessage } from '@ticatec/omniflow-artifact'
+
+export interface GitLabClientConfig {
+  baseUrl: string
+  token?: string
+  username?: string
+  password?: string
+  timeoutMs?: number
+}
+
+export interface ParsedGitLabRepo {
+  host: string
+  owner: string
+  repo: string
+  projectPath: string
+}
+
+/**
+ * Detect whether a hostname is official GitLab SaaS or a valid self-hosted GitLab instance,
+ * strictly rejecting spoofed hostnames (e.g. gitlab.com.evil.net, gitlab.com.cn).
+ */
+export function isGitLabHost(hostname: string): boolean {
+  const host = hostname.toLowerCase()
+  if (host === 'gitlab.com' || host === 'registry.gitlab.com' || host.endsWith('.gitlab.com')) {
+    return true
+  }
+  const segments = host.split('.')
+  // Reject subdomain spoofing where "gitlab.com" appears as subdomains of a foreign host
+  const gitlabIdx = segments.indexOf('gitlab')
+  if (gitlabIdx !== -1 && segments[gitlabIdx + 1] === 'com') {
+    return false
+  }
+  return segments.includes('gitlab')
+}
+
+export class GitLabClient {
+  readonly baseUrl: string
+  readonly token?: string
+  readonly username?: string
+  readonly password?: string
+  readonly timeoutMs: number
+
+  constructor(config: GitLabClientConfig) {
+    let base = config.baseUrl.trim().replace(/\/+$/, '')
+    if (!/^https?:\/\//i.test(base)) {
+      base = `https://${base}`
+    }
+    this.baseUrl = base
+    this.token = config.token
+    this.username = config.username
+    this.password = config.password
+    this.timeoutMs = config.timeoutMs ?? 30000
+  }
+
+  get host(): string {
+    const parsed = new URL(this.baseUrl)
+    return parsed.host
+  }
+
+  get hostname(): string {
+    const parsed = new URL(this.baseUrl)
+    return parsed.hostname
+  }
+
+  /**
+   * Return sensitive credential strings of length >= 3 for scrubbing.
+   * Username is intentionally excluded to preserve debugging visibility.
+   */
+  getSecrets(): string[] {
+    const secrets = [this.token, this.password].filter(
+      (s): s is string => typeof s === 'string' && s.length >= 3
+    )
+    if (this.username && this.password) {
+      const basic = Buffer.from(`${this.username}:${this.password}`).toString('base64')
+      if (basic.length >= 3) {
+        secrets.push(basic)
+      }
+    }
+    return secrets
+  }
+
+  /**
+   * Mask secrets in text using shared utility.
+   */
+  maskSecrets(text: string): string {
+    return maskSecrets(text, this.getSecrets())
+  }
+
+  getAuthHeaders(): Record<string, string> {
+    const headers: Record<string, string> = {
+      Accept: 'application/json'
+    }
+    if (this.token) {
+      headers['PRIVATE-TOKEN'] = this.token
+    } else if (this.username && this.password) {
+      const basic = Buffer.from(`${this.username}:${this.password}`).toString('base64')
+      headers['Authorization'] = `Basic ${basic}`
+    } else if (this.password) {
+      headers['PRIVATE-TOKEN'] = this.password
+    }
+    return headers
+  }
+
+  /**
+   * Return GitLab API v4 project endpoint URL with URL-encoded project path/ID.
+   */
+  getProjectApiUrl(projectPathOrId: string, subpath = ''): string {
+    const encoded = encodeURIComponent(projectPathOrId.replace(/^\/+/, '').replace(/\/+$/, ''))
+    const cleanSubpath = subpath ? (subpath.startsWith('/') ? subpath : `/${subpath}`) : ''
+    return `${this.baseUrl}/api/v4/projects/${encoded}${cleanSubpath}`
+  }
+
+  /**
+   * Return package registry endpoint for specific package type.
+   */
+  getPackageApiUrl(projectPathOrId: string, packageType: 'npm' | 'maven' | 'generic', subpath = ''): string {
+    const projectUrl = this.getProjectApiUrl(projectPathOrId)
+    const cleanSubpath = subpath ? (subpath.startsWith('/') ? subpath : `/${subpath}`) : ''
+
+    switch (packageType) {
+      case 'npm':
+        // NPM registry endpoint must end with trailing slash
+        return `${projectUrl}/packages/npm/`
+      case 'maven':
+        return `${projectUrl}/packages/maven${cleanSubpath}`
+      case 'generic':
+        return `${projectUrl}/packages/generic${cleanSubpath}`
+      default:
+        throw new Error(`Unsupported GitLab package type: ${packageType}`)
+    }
+  }
+
+  /**
+   * Standard HTTP request wrapper with timeout and credential masking.
+   */
+  async request(endpointOrUrl: string, init: RequestInit = {}): Promise<Response> {
+    const url = endpointOrUrl.startsWith('http://') || endpointOrUrl.startsWith('https://')
+      ? endpointOrUrl
+      : `${this.baseUrl}${endpointOrUrl.startsWith('/') ? endpointOrUrl : `/${endpointOrUrl}`}`
+
+    const headers = {
+      ...this.getAuthHeaders(),
+      ...(init.headers as Record<string, string> || {})
+    }
+
+    return await safeFetch(url, {
+      ...init,
+      headers,
+      timeoutMs: this.timeoutMs,
+      secrets: this.getSecrets()
+    })
+  }
+
+  /**
+   * Safely extract, truncate (max 500 chars), and mask error text from a response.
+   */
+  async extractErrorMessage(res: Response): Promise<string> {
+    return extractErrorMessage(res, this.getSecrets())
+  }
+
+  /**
+   * Parse repository URL or slug into host, owner, and repo.
+   */
+  static parseRepo(urlOrSlug: string, defaultHost = 'gitlab.com'): ParsedGitLabRepo {
+    let clean = urlOrSlug.trim()
+    let host = defaultHost
+
+    if (clean.includes('://')) {
+      const parsed = new URL(clean)
+      host = parsed.host
+      clean = decodeURIComponent(parsed.pathname)
+    } else if (clean.includes('@') && clean.includes(':')) {
+      const colonIdx = clean.indexOf(':')
+      const hostPart = clean.slice(0, colonIdx).replace(/.*@/, '')
+      let pathPart = clean.slice(colonIdx + 1)
+      const portMatch = pathPart.match(/^(\d+)\/(.*)/)
+      if (portMatch) {
+        host = `${hostPart}:${portMatch[1]}`
+        pathPart = portMatch[2]
+      } else {
+        host = hostPart
+      }
+      clean = decodeURIComponent(pathPart)
+    } else {
+      clean = decodeURIComponent(clean)
+    }
+
+    clean = clean.replace(/^\/+/, '').replace(/\.git$/, '')
+    const segments = clean.split('/').filter(Boolean)
+    if (segments.length < 2) {
+      throw new Error(`Invalid repository path: "${urlOrSlug}". Expected owner/repo format.`)
+    }
+
+    const owner = segments.slice(0, -1).join('/')
+    const repo = segments[segments.length - 1]
+    const projectPath = segments.join('/')
+
+    return { host, owner, repo, projectPath }
+  }
+}

package/src/index.ts

@@ -0,0 +1,58 @@
+import type { PluginContext } from '@ticatec/omniflow-core'
+import type { ArtifactPublisherRegistry } from '@ticatec/omniflow-artifact'
+import { GitLabContainerPublisher } from './artifacts/GitLabContainerPublisher.js'
+import { GitLabNpmPublisher } from './artifacts/GitLabNpmPublisher.js'
+import { GitLabMavenPublisher } from './artifacts/GitLabMavenPublisher.js'
+import { GitLabGenericPublisher } from './artifacts/GitLabGenericPublisher.js'
+
+export * from './client/GitLabClient.js'
+export * from './artifacts/GitLabContainerPublisher.js'
+export * from './artifacts/GitLabNpmPublisher.js'
+export * from './artifacts/GitLabMavenPublisher.js'
+export * from './artifacts/GitLabGenericPublisher.js'
+
+export interface RegisterGitLabOptions {
+  artifactRegistry?: ArtifactPublisherRegistry
+}
+
+/**
+ * Standard OmniFlow Plugin SPI entry point.
+ */
+export function register(ctx: PluginContext, options: Record<string, unknown> = {}): void {
+  const artifactsEnabled = options.artifacts !== false
+
+  registerGitLab({
+    artifactRegistry: artifactsEnabled ? ctx.artifactRegistry : undefined
+  })
+}
+
+export default register
+
+/**
+ * Register all GitLab artifact publishers into the artifact registry.
+ */
+export function registerGitLab(options: RegisterGitLabOptions = {}): {
+  containerPublisher: GitLabContainerPublisher
+  npmPublisher: GitLabNpmPublisher
+  mavenPublisher: GitLabMavenPublisher
+  genericPublisher: GitLabGenericPublisher
+} {
+  const containerPublisher = new GitLabContainerPublisher()
+  const npmPublisher = new GitLabNpmPublisher()
+  const mavenPublisher = new GitLabMavenPublisher()
+  const genericPublisher = new GitLabGenericPublisher()
+
+  if (options.artifactRegistry) {
+    options.artifactRegistry.register(containerPublisher)
+    options.artifactRegistry.register(npmPublisher)
+    options.artifactRegistry.register(mavenPublisher)
+    options.artifactRegistry.register(genericPublisher)
+  }
+
+  return {
+    containerPublisher,
+    npmPublisher,
+    mavenPublisher,
+    genericPublisher
+  }
+}