@vantran-se/openchamber-web 1.24.4 → 2.0.1

package/server/lib/ui-auth/ui-passkeys.js

@@ -2,12 +2,14 @@ import crypto from 'crypto';
 import fs from 'fs';
 import os from 'os';
 import path from 'path';
-import {
-  generateAuthenticationOptions,
-  generateRegistrationOptions,
-  verifyAuthenticationResponse,
-  verifyRegistrationResponse,
-} from '@simplewebauthn/server';
+
+// @simplewebauthn/server and its ASN.1 dependencies are ~130 modules; only
+// passkey registration and authentication need them, so they load on first use.
+let webauthnPending;
+const loadWebAuthn = () => {
+  webauthnPending ??= import('@simplewebauthn/server');
+  return webauthnPending;
+};
 
 const DEFAULT_STORE_VERSION = 1;
 const DEFAULT_CHALLENGE_TTL_MS = 5 * 60 * 1000;
@@ -326,7 +328,7 @@ export const createUiPasskeys = ({
       throw error;
     }
 
-    const options = await generateRegistrationOptions({
+    const options = await (await loadWebAuthn()).generateRegistrationOptions({
       rpName,
       rpID,
       userID,
@@ -377,7 +379,7 @@ export const createUiPasskeys = ({
 
     registrationChallenges.delete(requestId);
 
-    const verification = await verifyRegistrationResponse({
+    const verification = await (await loadWebAuthn()).verifyRegistrationResponse({
       response,
       expectedChallenge: matchingRecord.challenge,
       expectedOrigin: matchingRecord.expectedOrigins,
@@ -437,7 +439,7 @@ export const createUiPasskeys = ({
       throw error;
     }
 
-    const options = await generateAuthenticationOptions({
+    const options = await (await loadWebAuthn()).generateAuthenticationOptions({
       rpID,
       userVerification: 'required',
       allowCredentials: passkeys.map((passkey) => ({
@@ -485,7 +487,7 @@ export const createUiPasskeys = ({
 
     authenticationChallenges.delete(requestId);
 
-    const verification = await verifyAuthenticationResponse({
+    const verification = await (await loadWebAuthn()).verifyAuthenticationResponse({
       response,
       expectedChallenge: matchingRecord.challenge,
       expectedOrigin: matchingRecord.expectedOrigins,

package/server/lib/walkthrough/DOCUMENTATION.md

@@ -20,7 +20,8 @@ has to ask for it.
   `PROMPT_VERSION`.
 - `schema.js` — response schema, response normalization, tolerant JSON parsing.
 - `store.js` — content-addressed cache entries plus mutable pointers.
-- `pull-request.js` — PR diffs via the shared GitHub octokit helper.
+- `pull-request.js` — PR diffs and per-file contents via the shared GitHub
+  octokit helper.
 - `model-settings.js` — the feature's own model override.
 - `languages.js` — the languages the prose may be written in.
 - `index.js` — orchestration.
@@ -102,6 +103,14 @@ GitHub and malformed-response failures remain errors. Walkthrough generation
 keeps its existing empty-diff refusal. UI comparison behavior is documented in
 `packages/ui/src/components/views/DOCUMENTATION.md`.
 
+`GET /api/walkthrough/pr-file` takes the same `directory` and PR `source` plus
+`path`, optional `previousPath`, and `status`, and returns `{ original, modified }`
+for that one file as GitHub has it: the base side at the PR's merge base, the
+head side at the PR head. This is how the comparison view expands collapsed
+context for a PR: its patch arrives at fixed context and its commits may not be
+on disk, so the working tree is never read. Files above 5 MB answer `413`
+(`code: 'file-too-large'`).
+
 ## No truncation
 
 Within what it covers, the digest is complete. When it does not fit the resolved

package/server/lib/walkthrough/pull-request.js

@@ -2,14 +2,7 @@ import { getOctokitOrNull } from '../github/octokit.js';
 import assert from 'node:assert/strict';
 import { resolveGitHubRepoFromDirectory } from '../github/repo/index.js';
 
-/**
- * Raw unified diff for a pull request.
- *
- * GitHub already returns the merge-base diff for a PR, so this matches the
- * three-dot semantics used for local branch reviews: work merged in from the
- * base branch is not part of it.
- */
-export async function getPullRequestDiff(directory, number, sourceRepo, { allowEmpty = false } = {}) {
+async function resolvePullRequestRepo(directory, sourceRepo) {
   const octokit = getOctokitOrNull();
   if (!octokit) {
     throw Object.assign(new Error('Connect a GitHub account to review pull requests'), {
@@ -28,6 +21,18 @@ export async function getPullRequestDiff(directory, number, sourceRepo, { allowE
       code: 'no-github-remote',
     });
   }
+  return { octokit, repo };
+}
+
+/**
+ * Raw unified diff for a pull request.
+ *
+ * GitHub already returns the merge-base diff for a PR, so this matches the
+ * three-dot semantics used for local branch reviews: work merged in from the
+ * base branch is not part of it.
+ */
+export async function getPullRequestDiff(directory, number, sourceRepo, { allowEmpty = false } = {}) {
+  const { octokit, repo } = await resolvePullRequestRepo(directory, sourceRepo);
 
   const response = await octokit.request('GET /repos/{owner}/{repo}/pulls/{pull_number}', {
     owner: repo.owner,
@@ -47,3 +52,51 @@ export async function getPullRequestDiff(directory, number, sourceRepo, { allowE
 
   return { patch, meta: { owner: repo.owner, repo: repo.repo, number } };
 }
+
+/** Above this the full-context view is no longer a readable diff, and the round trip is wasted. */
+const MAX_FULL_FILE_BYTES = 5 * 1024 * 1024;
+
+/**
+ * Both sides of one file as GitHub has them, so the comparison view can expand
+ * collapsed context for a PR whose commits are not on disk (a fork, a branch
+ * that was never fetched) without ever reading the working tree.
+ *
+ * The base side is the merge base, not the base branch tip: the PR diff is
+ * three-dot, and reading the tip would leak unrelated base-branch work into
+ * the expanded context. Head commits of a fork PR are reachable through the
+ * base repository (`refs/pull/<n>/head`), so every read goes to one repo.
+ */
+export async function getPullRequestFileContents(directory, number, sourceRepo, { path, previousPath, status }) {
+  const { octokit, repo } = await resolvePullRequestRepo(directory, sourceRepo);
+  const pull = await octokit.request('GET /repos/{owner}/{repo}/pulls/{pull_number}', {
+    owner: repo.owner, repo: repo.repo, pull_number: number,
+  });
+  const headSha = pull.data?.head?.sha;
+  const baseSha = pull.data?.base?.sha;
+  assert.match(String(headSha), /^[0-9a-f]{40}$/, 'GitHub returned an invalid pull request head');
+  assert.match(String(baseSha), /^[0-9a-f]{40}$/, 'GitHub returned an invalid pull request base');
+  const compare = await octokit.request('GET /repos/{owner}/{repo}/compare/{basehead}', {
+    owner: repo.owner, repo: repo.repo, basehead: `${baseSha}...${headSha}`,
+  });
+  const mergeBaseSha = compare.data?.merge_base_commit?.sha;
+  assert.match(String(mergeBaseSha), /^[0-9a-f]{40}$/, 'GitHub returned an invalid merge base');
+
+  const readFile = async (filePath, ref) => {
+    const response = await octokit.request('GET /repos/{owner}/{repo}/contents/{path}', {
+      owner: repo.owner, repo: repo.repo, path: filePath, ref,
+      headers: { accept: 'application/vnd.github.raw+json' },
+    });
+    const content = response.data;
+    assert.equal(typeof content, 'string', 'GitHub returned invalid file contents');
+    if (Buffer.byteLength(content) > MAX_FULL_FILE_BYTES) {
+      throw Object.assign(new Error('This file is too large to show in full'), { statusCode: 413, code: 'file-too-large' });
+    }
+    return content;
+  };
+
+  const [original, modified] = await Promise.all([
+    status === 'A' ? '' : readFile(previousPath || path, mergeBaseSha),
+    status === 'D' ? '' : readFile(path, headSha),
+  ]);
+  return { original, modified };
+}

package/server/lib/walkthrough/pull-request.test.js

@@ -3,7 +3,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 vi.mock('../github/octokit.js', () => ({ getOctokitOrNull: vi.fn() }));
 vi.mock('../github/repo/index.js', () => ({ resolveGitHubRepoFromDirectory: vi.fn() }));
 
-const { getPullRequestDiff } = await import('./pull-request.js');
+const { getPullRequestDiff, getPullRequestFileContents } = await import('./pull-request.js');
 const { getOctokitOrNull } = await import('../github/octokit.js');
 const { resolveGitHubRepoFromDirectory } = await import('../github/repo/index.js');
 
@@ -91,3 +91,56 @@ describe('getPullRequestDiff', () => {
     });
   });
 });
+
+describe('getPullRequestFileContents', () => {
+  const HEAD = 'a'.repeat(40);
+  const BASE_TIP = 'b'.repeat(40);
+  const MERGE_BASE = 'c'.repeat(40);
+  let request;
+
+  beforeEach(() => {
+    request = vi.fn(async (route, params) => {
+      if (route === 'GET /repos/{owner}/{repo}/pulls/{pull_number}') return { data: { head: { sha: HEAD }, base: { sha: BASE_TIP } } };
+      if (route === 'GET /repos/{owner}/{repo}/compare/{basehead}') return { data: { merge_base_commit: { sha: MERGE_BASE } } };
+      if (route === 'GET /repos/{owner}/{repo}/contents/{path}') return { data: `${params.path}@${params.ref}` };
+      throw new Error(`unexpected ${route}`);
+    });
+    getOctokitOrNull.mockReturnValue({ request });
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('reads the base side at the merge base and the head side at the PR head', async () => {
+    const result = await getPullRequestFileContents('/repo', 7, { owner: 'upstream', repo: 'project' }, { path: 'src/a.ts', status: 'M' });
+    expect(result).toEqual({ original: `src/a.ts@${MERGE_BASE}`, modified: `src/a.ts@${HEAD}` });
+    expect(request).toHaveBeenCalledWith('GET /repos/{owner}/{repo}/compare/{basehead}', {
+      owner: 'upstream', repo: 'project', basehead: `${BASE_TIP}...${HEAD}`,
+    });
+    expect(request).toHaveBeenCalledWith('GET /repos/{owner}/{repo}/contents/{path}', expect.objectContaining({
+      owner: 'upstream', repo: 'project', headers: { accept: 'application/vnd.github.raw+json' },
+    }));
+  });
+
+  it('skips the missing side of added and deleted files and follows renames', async () => {
+    expect(await getPullRequestFileContents('/repo', 7, { owner: 'o', repo: 'r' }, { path: 'new.ts', status: 'A' }))
+      .toEqual({ original: '', modified: `new.ts@${HEAD}` });
+    expect(await getPullRequestFileContents('/repo', 7, { owner: 'o', repo: 'r' }, { path: 'gone.ts', status: 'D' }))
+      .toEqual({ original: `gone.ts@${MERGE_BASE}`, modified: '' });
+    expect(await getPullRequestFileContents('/repo', 7, { owner: 'o', repo: 'r' }, { path: 'new.ts', previousPath: 'old.ts', status: 'R' }))
+      .toEqual({ original: `old.ts@${MERGE_BASE}`, modified: `new.ts@${HEAD}` });
+  });
+
+  it('rejects oversized files and malformed GitHub metadata', async () => {
+    request.mockImplementationOnce(async () => ({ data: { head: { sha: 'nope' }, base: { sha: BASE_TIP } } }));
+    await expect(getPullRequestFileContents('/repo', 7, { owner: 'o', repo: 'r' }, { path: 'a.ts', status: 'M' })).rejects.toThrow(/invalid pull request head/);
+
+    request.mockImplementation(async (route) => {
+      if (route === 'GET /repos/{owner}/{repo}/pulls/{pull_number}') return { data: { head: { sha: HEAD }, base: { sha: BASE_TIP } } };
+      if (route === 'GET /repos/{owner}/{repo}/compare/{basehead}') return { data: { merge_base_commit: { sha: MERGE_BASE } } };
+      return { data: 'x'.repeat(5 * 1024 * 1024 + 1) };
+    });
+    await expect(getPullRequestFileContents('/repo', 7, { owner: 'o', repo: 'r' }, { path: 'a.ts', status: 'M' })).rejects.toMatchObject({ code: 'file-too-large', statusCode: 413 });
+  });
+});

package/server/lib/walkthrough/routes.js

@@ -70,6 +70,26 @@ export function registerWalkthroughRoutes(app, { getWalkthroughService }) {
     }
   });
 
+  // One file, both sides, straight from GitHub: the comparison view expands
+  // collapsed context on demand without touching the working tree.
+  app.get('/api/walkthrough/pr-file', async (req, res) => {
+    try {
+      const query = new URL(req.originalUrl, 'http://localhost').searchParams;
+      const directory = query.get('directory')?.trim() ?? '';
+      if (!directory) return res.status(400).json({ error: 'directory parameter is required' });
+      const source = parseSource(readSource(query.get('source')));
+      if (source.kind !== 'pr') return res.status(400).json({ error: 'A pull request source is required' });
+      const path = query.get('path')?.trim() ?? '';
+      if (!path) return res.status(400).json({ error: 'path parameter is required' });
+      const previousPath = query.get('previousPath')?.trim() || undefined;
+      const status = query.get('status') ?? 'M';
+      const { getPullRequestFileContents } = await getWalkthroughService();
+      res.json(await getPullRequestFileContents(directory, source.number, source.sourceRepo, { path, previousPath, status }));
+    } catch (error) {
+      respondWithError(res, error, 'Failed to load pull request file');
+    }
+  });
+
   // Deliberately not aborted when the client disconnects: generation runs for
   // minutes and a refresh must not throw the work away. Leaving detaches the
   // client; the job finishes and caches its result. Stopping is an explicit

package/server/lib/walkthrough/routes.test.js

@@ -23,6 +23,11 @@ describe('walkthrough routes', () => {
       if (number === 99) throw Object.assign(new Error('GitHub unavailable'), { statusCode: 503 });
       return { patch: number === 1 ? '' : 'diff --git a/a.ts b/a.ts\n' };
     },
+    async getPullRequestFileContents(directory, number, sourceRepo, file) {
+      lastArgs = { directory, number, sourceRepo, file };
+      if (file.path === 'huge.bin') throw Object.assign(new Error('too large'), { statusCode: 413, code: 'file-too-large' });
+      return { original: 'before', modified: 'after' };
+    },
     async getWalkthrough(args) {
       lastArgs = args;
       return { walkthrough: null, hunks: [], hunkCount: 0, generating: Boolean(job) };
@@ -110,6 +115,20 @@ describe('walkthrough routes', () => {
     }
   });
 
+  it('serves both sides of one PR file and passes GitHub failures through', async () => {
+    const source = { kind: 'pr', number: 42, sourceRepo: { owner: 'upstream', repo: 'project' } };
+    const request = (params) => fetch(`${base}/api/walkthrough/pr-file?${new URLSearchParams({ directory: '/repo', source: JSON.stringify(source), ...params })}`);
+    const ok = await request({ path: 'new.ts', previousPath: 'old.ts', status: 'R' });
+    expect(ok.status).toBe(200);
+    expect(await ok.json()).toEqual({ original: 'before', modified: 'after' });
+    expect(lastArgs).toEqual({ directory: '/repo', number: 42, sourceRepo: source.sourceRepo, file: { path: 'new.ts', previousPath: 'old.ts', status: 'R' } });
+    expect((await request({ path: 'a.ts', status: 'M', source: JSON.stringify({ kind: 'branch', baseRef: 'main', headRef: 'x' }) })).status).toBe(400);
+    expect((await request({ status: 'M' })).status).toBe(400);
+    const huge = await request({ path: 'huge.bin', status: 'M' });
+    expect(huge.status).toBe(413);
+    expect(await huge.json()).toMatchObject({ code: 'file-too-large' });
+  });
+
   it('delivers the result to a client that reconnected after a refresh', async () => {
     const controller = new AbortController();
     const seen = generateCalls;