@weibaohui/dsh-git-server 0.1.0 → 0.1.1

package/server/dist/sshx/lfs-transfer.js

@@ -1,289 +0,0 @@
-// git-lfs-transfer: pure SSH LFS transfer protocol (lfs-transfer-1) per the
-// git-lfs spec (docs/proposals/ssh_adapter.md). pkt-line framing: flush=0000,
-// delim=0001, data pkt = hex(len) + payload. Binary payloads are pkt-framed.
-import * as crypto from 'node:crypto';
-import * as fs from 'node:fs';
-import { conf } from '../conf.js';
-import * as db from '../db/db.js';
-// pkt-line control frames are FOUR ASCII chars '0000'/'0001'
-const FLUSH = Buffer.from('0000', 'ascii');
-const DELIM = Buffer.from('0001', 'ascii');
-function pkt(data) {
-    const buf = Buffer.isBuffer(data) ? data : Buffer.from(data, 'utf8');
-    const header = Buffer.from((buf.length + 4).toString(16).padStart(4, '0'), 'ascii');
-    return Buffer.concat([header, buf]);
-}
-function lfsObjectPath(oid) {
-    return `${conf.appDataPath}/lfs-objects/${oid.slice(0, 2)}/${oid.slice(2, 4)}/${oid}`;
-}
-/** Resolve owner/repo the same way as dispatch.serveGit. */
-function resolveRepo(repoFullName) {
-    let repoName = repoFullName.replace(/^\//, '').replace(/\.git$/, '');
-    if (repoName.endsWith('.wiki'))
-        repoName = repoName.slice(0, -5);
-    const slash = repoName.indexOf('/');
-    const ownerName = slash > 0 ? repoName.slice(0, slash) : repoName;
-    const name = slash > 0 ? repoName.slice(slash + 1) : repoName;
-    const owner = db.getUserByUsername(ownerName);
-    const repo = owner ? db.getRepoByOwnerAndName(owner, name) : null;
-    return owner && repo ? { owner, repo } : null;
-}
-class PktReader {
-    buf = Buffer.alloc(0);
-    closed = false;
-    waiters = [];
-    push(data) {
-        this.buf = Buffer.concat([this.buf, data]);
-        const w = this.waiters.splice(0);
-        for (const fn of w)
-            fn();
-    }
-    end() {
-        this.closed = true;
-        const w = this.waiters.splice(0);
-        for (const fn of w)
-            fn();
-    }
-    /** Returns next pkt: {type:'data',payload} | {type:'flush'} | {type:'delim'} | null(EOF). */
-    async next() {
-        while (true) {
-            if (this.buf.length >= 4) {
-                const lenStr = this.buf.toString('utf8', 0, 4);
-                if (/^[0-9a-f]{4}$/.test(lenStr)) {
-                    const len = parseInt(lenStr, 16);
-                    if (len === 0) {
-                        this.buf = this.buf.subarray(4);
-                        return { type: 'flush', payload: Buffer.alloc(0) };
-                    }
-                    if (len === 1) {
-                        this.buf = this.buf.subarray(4);
-                        return { type: 'delim', payload: Buffer.alloc(0) };
-                    }
-                    if (len >= 4 && this.buf.length >= len) {
-                        const payload = this.buf.subarray(4, len);
-                        this.buf = this.buf.subarray(len);
-                        return { type: 'data', payload };
-                    }
-                }
-            }
-            if (this.closed && this.buf.length < 4)
-                return null;
-            await new Promise((resolve) => this.waiters.push(resolve));
-        }
-    }
-}
-export async function runLFSTransfer(argStr, identity, io) {
-    const parts = argStr.trim().split(/\s+/);
-    const repoFullName = parts[0];
-    const operation = parts[1] ?? 'download';
-    if (!['download', 'upload'].includes(operation)) {
-        io.write(Buffer.from(`git-lfs-transfer: invalid operation: ${operation}\n`));
-        io.close(1);
-        return;
-    }
-    const resolved = resolveRepo(repoFullName);
-    if (!resolved) {
-        io.write(Buffer.from('Repository does not exist\n'));
-        io.close(1);
-        return;
-    }
-    const { owner, repo } = resolved;
-    const mode = db.accessMode(identity.userID, repo);
-    const need = operation === 'upload' ? db.AccessMode.WRITE : db.AccessMode.READ;
-    if (!(operation === 'download' && !repo.is_private && !conf.requireSigninView) && mode < need) {
-        io.write(Buffer.from('Access denied\n'));
-        io.close(1);
-        return;
-    }
-    const reader = new PktReader();
-    io.onStdin((data) => reader.push(data));
-    const writePkt = (s) => io.write(pkt(s));
-    const writeFlush = () => io.write(FLUSH);
-    const writeDelim = () => io.write(DELIM);
-    const writeStatus = (code, args = [], delim = false) => {
-        io.write(pkt(`status ${code}`));
-        for (const a of args)
-            io.write(pkt(a));
-        if (delim)
-            writeDelim();
-        writeFlush();
-    };
-    // 1. capability advertisement (server speaks first)
-    io.write(pkt('capability-list'));
-    io.write(pkt('version=1'));
-    io.write(pkt('begin-upload'));
-    io.write(pkt('begin-download'));
-    writeFlush();
-    let quit = false;
-    while (!quit) {
-        const p = await reader.next();
-        if (p === null)
-            break;
-        if (p.type === 'flush')
-            continue;
-        if (p.type !== 'data')
-            continue;
-        const line = p.payload.toString('utf8').replace(/\n$/, '');
-        const sp = line.indexOf(' ');
-        const cmd = sp < 0 ? line : line.slice(0, sp);
-        const rest = sp < 0 ? '' : line.slice(sp + 1);
-        switch (cmd) {
-            case 'version': {
-                if (rest === '1')
-                    writeStatus(200);
-                else
-                    writeStatus(400);
-                break;
-            }
-            case 'quit': {
-                writeStatus(200);
-                quit = true;
-                break;
-            }
-            case 'batch': {
-                // collect arguments until delim, then oid lines until flush
-                const args = {};
-                const oids = [];
-                let inOids = false;
-                while (true) {
-                    const q = await reader.next();
-                    if (q === null || q.type === 'flush')
-                        break;
-                    if (q.type === 'delim') {
-                        inOids = true;
-                        continue;
-                    }
-                    if (q.type !== 'data')
-                        continue;
-                    const l = q.payload.toString('utf8').replace(/\n$/, '');
-                    if (!inOids) {
-                        const eq = l.indexOf('=');
-                        if (eq > 0)
-                            args[l.slice(0, eq)] = l.slice(eq + 1);
-                    }
-                    else {
-                        const m = /^(\S+) (\d+)(?: (.*))?$/.exec(l);
-                        if (m)
-                            oids.push({ oid: m[1], size: Number(m[2]) });
-                    }
-                }
-                io.write(pkt('status 200'));
-                writeDelim();
-                const wantUpload = operation === 'upload';
-                for (const o of oids) {
-                    const row = db.db().prepare('SELECT * FROM lfs_object WHERE repo_id = ? AND oid = ?').get(repo.id, o.oid);
-                    const exists = !!row && fs.existsSync(lfsObjectPath(o.oid));
-                    let action;
-                    if (wantUpload) {
-                        // upload: offer upload when missing or size mismatch; else noop
-                        action = !exists || row.size !== o.size ? 'upload' : 'noop';
-                    }
-                    else {
-                        if (!exists) {
-                            action = 'noop'; // mirrors HTTP 404 → error shape
-                            io.write(pkt(`${o.oid} ${o.size} error message=[Object does not exist]`));
-                            continue;
-                        }
-                        action = row.size === o.size ? 'download' : 'noop';
-                    }
-                    io.write(pkt(`${o.oid} ${o.size} ${action}`));
-                }
-                writeFlush();
-                break;
-            }
-            case 'get-object': {
-                const oid = rest.trim();
-                const file = lfsObjectPath(oid);
-                const row = db.db().prepare('SELECT * FROM lfs_object WHERE repo_id = ? AND oid = ?').get(repo.id, oid);
-                if (!row || !fs.existsSync(file)) {
-                    writeStatus(404, [], true);
-                    io.write(pkt('Object does not exist\n'));
-                    writeFlush();
-                    break;
-                }
-                io.write(pkt('status 200'));
-                io.write(pkt(`size=${row.size}`));
-                writeDelim();
-                const content = fs.readFileSync(file);
-                for (let off = 0; off < content.length; off += 65516) {
-                    io.write(pkt(content.subarray(off, Math.min(off + 65516, content.length))));
-                }
-                writeFlush();
-                break;
-            }
-            case 'put-object': {
-                const oid = rest.trim();
-                // arguments until DELIM, then binary data until FLUSH
-                let size = 0;
-                while (true) {
-                    const q = await reader.next();
-                    if (q === null || q.type === 'flush')
-                        break;
-                    if (q.type === 'delim')
-                        break;
-                    if (q.type !== 'data')
-                        continue;
-                    const l = q.payload.toString('utf8').replace(/\n$/, '');
-                    const eq = l.indexOf('=');
-                    if (eq > 0 && l.slice(0, eq) === 'size')
-                        size = Number(l.slice(eq + 1));
-                }
-                // binary payload: collect until flush
-                const chunks = [];
-                while (true) {
-                    const q = await reader.next();
-                    if (q === null || q.type === 'flush')
-                        break;
-                    if (q.type === 'data')
-                        chunks.push(q.payload);
-                }
-                const content = Buffer.concat(chunks);
-                const hash = crypto.createHash('sha256').update(content).digest('hex');
-                if (hash !== oid || (size > 0 && content.length !== size)) {
-                    writeStatus(422, [], true);
-                    io.write(pkt('Content-Length and Oid mismatches\n'));
-                    writeFlush();
-                    break;
-                }
-                const dst = lfsObjectPath(oid);
-                fs.mkdirSync(dst.slice(0, dst.lastIndexOf('/')), { recursive: true });
-                fs.writeFileSync(dst, content);
-                db.db()
-                    .prepare('INSERT OR REPLACE INTO lfs_object (repo_id, oid, size, storage, created_at) VALUES (?,?,?,?,?)')
-                    .run(repo.id, oid, content.length, 'local', new Date().toISOString().replace('T', ' ').replace('Z', ''));
-                writeStatus(200);
-                break;
-            }
-            case 'verify-object': {
-                const oid = rest.trim();
-                let size = 0;
-                while (true) {
-                    const q = await reader.next();
-                    if (q === null || q.type === 'flush')
-                        break;
-                    if (q.type !== 'data')
-                        continue;
-                    const l = q.payload.toString('utf8').replace(/\n$/, '');
-                    const eq = l.indexOf('=');
-                    if (eq > 0 && l.slice(0, eq) === 'size')
-                        size = Number(l.slice(eq + 1));
-                }
-                const row = db.db().prepare('SELECT * FROM lfs_object WHERE repo_id = ? AND oid = ?').get(repo.id, oid);
-                if (!row) {
-                    writeStatus(404);
-                    break;
-                }
-                writeStatus(row.size === size ? 200 : 422);
-                break;
-            }
-            default: {
-                // unknown command → protocol error status
-                writeStatus(400, [], true);
-                io.write(pkt(`Unknown command: ${cmd}\n`));
-                writeFlush();
-            }
-        }
-    }
-    io.close(0);
-}
-//# sourceMappingURL=lfs-transfer.js.map

package/server/dist/sshx/server.js

@@ -1,107 +0,0 @@
-// Builtin SSH server (gogs START_SSH_SERVER): publickey auth against the
-// public_key table, then pipes `git-upload-pack`/`git-receive-pack` sessions.
-import * as fs from 'node:fs';
-import * as path from 'node:path';
-import * as crypto from 'node:crypto';
-import { conf } from '../conf.js';
-import * as db from '../db/db.js';
-import { dispatchSSHCommand } from './dispatch.js';
-function hostKeyPath() {
-    return path.join(conf.customDir, 'ssh', 'gogs_ed25519.key');
-}
-function ensureHostKey() {
-    const file = hostKeyPath();
-    if (fs.existsSync(file))
-        return fs.readFileSync(file, 'utf8');
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const { privateKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
-    // ssh2 parses PKCS#1 "RSA PRIVATE KEY" PEM reliably
-    const pem = privateKey.export({ type: 'pkcs1', format: 'pem' }).toString();
-    fs.writeFileSync(file, pem, { mode: 0o600 });
-    return pem;
-}
-/** Normalize a public key to "type base64" for comparison. */
-function normalizeKey(content) {
-    const parts = content.trim().split(/\s+/);
-    if (parts.length < 2)
-        return '';
-    return `${parts[0]} ${parts[1]}`;
-}
-async function authorizeKey(keyData) {
-    const presented = normalizeKey(keyData.toString('utf8'));
-    if (!presented)
-        return null;
-    const rows = db.db().prepare('SELECT id, owner_id, content, type FROM public_key').all();
-    for (const row of rows) {
-        if (normalizeKey(row.content) === presented) {
-            if (row.type === 2) {
-                const dk = db.db().prepare('SELECT repo_id FROM deploy_key WHERE key_id = ?').get(row.id);
-                return { userID: row.owner_id, keyID: row.id, deployRepoID: dk?.repo_id ?? null };
-            }
-            return { userID: row.owner_id, keyID: row.id, deployRepoID: null };
-        }
-    }
-    return null;
-}
-export function startSSHServer() {
-    import('ssh2').then(({ default: ssh2 }) => {
-        const hostKey = ensureHostKey();
-        const server = new ssh2.Server({ hostKeys: [hostKey] }, (client) => {
-            let authedUser = null;
-            client
-                .on('ready', () => {
-                client.on('session', (accept) => {
-                    const session = accept();
-                    session.on('exec', (accept, _reject, info) => {
-                        const stream = accept();
-                        const user = authedUser;
-                        if (!user) {
-                            stream.exit(1);
-                            stream.end();
-                            return;
-                        }
-                        dispatchSSHCommand(String(info.command), user, {
-                            write: (chunk) => stream.write(chunk),
-                            onStdin: (cb) => stream.on('data', (d) => cb(d)),
-                            close: (code) => {
-                                stream.exit(code);
-                                stream.end();
-                            },
-                        });
-                    });
-                });
-            })
-                .on('error', () => { });
-            client.on('authentication', (ctx) => {
-                if (ctx.method !== 'publickey') {
-                    return ctx.reject(['publickey']);
-                }
-                const buf = ctx.key?.data;
-                if (!buf)
-                    return ctx.reject();
-                // the wire blob starts with a length-prefixed algorithm name
-                const algLen = buf.readUInt32BE(0);
-                const algName = buf.subarray(4, 4 + algLen).toString('utf8');
-                // the .pub base64 IS the full wire blob (alg prefix + body)
-                const b64 = buf.toString('base64');
-                const line = `${algName} ${b64}`;
-                authorizeKey(Buffer.from(line)).then((u) => {
-                    if (u) {
-                        authedUser = u;
-                        ctx.accept();
-                    }
-                    else {
-                        ctx.reject();
-                    }
-                });
-            });
-        });
-        const port = conf.sshPort === 22 ? 22 : conf.sshPort;
-        const listenPort = process.env.GOGS_SSH_PORT ? Number(process.env.GOGS_SSH_PORT) : port;
-        server.listen(listenPort, '0.0.0.0', () => {
-            console.log(`SSH server started on 0.0.0.0:${listenPort}`);
-        });
-        server.on('error', (e) => console.error('[ssh]', e));
-    });
-}
-//# sourceMappingURL=server.js.map

package/server/dist/twofactor.js

@@ -1,160 +0,0 @@
-// Two-factor authentication: TOTP (RFC 6238), AES-GCM secret storage compatible
-// with gogs cryptox, and recovery codes.
-import * as crypto from 'node:crypto';
-import * as db from './db/db.js';
-import { conf } from './conf.js';
-import { randomChars } from './db/db.js';
-// ---------------------------------------------------------------- crypto (cryptox compat)
-function md5Bytes(str) {
-    return crypto.createHash('md5').update(str).digest();
-}
-export function aesGcmEncrypt(key, plaintext) {
-    // golang.org/x/crypto GCM: 12-byte nonce prepended, tag appended
-    const nonce = crypto.randomBytes(12);
-    const cipher = crypto.createCipheriv('aes-128-gcm', key, nonce);
-    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
-    return Buffer.concat([nonce, enc, cipher.getAuthTag()]);
-}
-export function aesGcmDecrypt(key, ciphertext) {
-    const nonce = ciphertext.subarray(0, 12);
-    const tag = ciphertext.subarray(ciphertext.length - 16);
-    const data = ciphertext.subarray(12, ciphertext.length - 16);
-    const decipher = crypto.createDecipheriv('aes-128-gcm', key, nonce);
-    decipher.setAuthTag(tag);
-    return Buffer.concat([decipher.update(data), decipher.final()]);
-}
-function secretKey() {
-    return md5Bytes(conf.secretKey);
-}
-// ---------------------------------------------------------------- TOTP (RFC 6238)
-const B32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-function base32Encode(buf) {
-    let bits = 0;
-    let value = 0;
-    let out = '';
-    for (const byte of buf) {
-        value = (value << 8) | byte;
-        bits += 8;
-        while (bits >= 5) {
-            out += B32[(value >>> (bits - 5)) & 31];
-            bits -= 5;
-        }
-    }
-    if (bits > 0)
-        out += B32[(value << (5 - bits)) & 31];
-    return out;
-}
-function base32Decode(str) {
-    const clean = str.toUpperCase().replace(/[=\s]/g, '');
-    let bits = 0;
-    let value = 0;
-    const out = [];
-    for (const ch of clean) {
-        const idx = B32.indexOf(ch);
-        if (idx < 0)
-            continue;
-        value = (value << 5) | idx;
-        bits += 5;
-        if (bits >= 8) {
-            out.push((value >>> (bits - 8)) & 0xff);
-            bits -= 8;
-        }
-    }
-    return Buffer.from(out);
-}
-export function totpGenerate(issuer, accountName) {
-    const raw = crypto.randomBytes(20);
-    const secret = base32Encode(raw);
-    const url = `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}`;
-    return { secret, url };
-}
-export function totpCode(secret, timeStep = Math.floor(Date.now() / 30000)) {
-    const key = base32Decode(secret);
-    const counter = Buffer.alloc(8);
-    counter.writeUInt32BE(Math.floor(timeStep / 2 ** 32), 0);
-    counter.writeUInt32BE(timeStep >>> 0, 4);
-    const hmac = crypto.createHmac('sha1', key).update(counter).digest();
-    const offset = hmac[hmac.length - 1] & 0xf;
-    const code = ((hmac[offset] & 0x7f) << 24) | (hmac[offset + 1] << 16) | (hmac[offset + 2] << 8) | hmac[offset + 3];
-    return String(code % 1000000).padStart(6, '0');
-}
-/** totp.Validate: accepts ±1 time step for clock skew, exactly 6 digits. */
-export function totpValidate(passcode, secret) {
-    if (!/^\d{6}$/.test(passcode))
-        return false;
-    const step = Math.floor(Date.now() / 30000);
-    for (const t of [step - 1, step, step + 1]) {
-        if (totpCode(secret, t) === passcode)
-            return true;
-    }
-    return false;
-}
-// ---------------------------------------------------------------- storage
-function encryptSecret(secret) {
-    return aesGcmEncrypt(secretKey(), Buffer.from(secret)).toString('base64');
-}
-function decryptSecret(stored) {
-    return aesGcmDecrypt(secretKey(), Buffer.from(stored, 'base64')).toString();
-}
-export function isTwoFactorEnabled(userID) {
-    return !!db.db().prepare('SELECT 1 FROM two_factor WHERE user_id = ?').get(userID);
-}
-export function getTwoFactorByUserID(userID) {
-    return db.db().prepare('SELECT * FROM two_factor WHERE user_id = ?').get(userID) ?? null;
-}
-export function createTwoFactor(userID, secret) {
-    const now = Math.floor(Date.now() / 1000);
-    db.db()
-        .prepare('INSERT INTO two_factor (user_id, secret, created_unix) VALUES (?,?,?) ON CONFLICT(user_id) DO UPDATE SET secret = excluded.secret')
-        .run(userID, encryptSecret(secret), now);
-    // 10 recovery codes like gogs
-    for (let i = 0; i < 10; i++) {
-        const code = randomChars(10);
-        db.db().prepare('INSERT INTO two_factor_recovery_code (user_id, code, is_used) VALUES (?,?,0)').run(userID, code.slice(0, 5).toLowerCase() + '-' + code.slice(5).toLowerCase());
-    }
-}
-export function deleteTwoFactor(userID) {
-    db.db().prepare('DELETE FROM two_factor WHERE user_id = ?').run(userID);
-    db.db().prepare('DELETE FROM two_factor_recovery_code WHERE user_id = ?').run(userID);
-}
-export function validateTOTP(userID, passcode) {
-    const t = getTwoFactorByUserID(userID);
-    if (!t)
-        return false;
-    try {
-        return totpValidate(passcode, decryptSecret(t.secret));
-    }
-    catch {
-        return false;
-    }
-}
-export function listRecoveryCodes(userID) {
-    return db.db().prepare('SELECT * FROM two_factor_recovery_code WHERE user_id = ? ORDER BY id').all(userID);
-}
-export function regenerateRecoveryCodes(userID) {
-    db.db().prepare('DELETE FROM two_factor_recovery_code WHERE user_id = ?').run(userID);
-    for (let i = 0; i < 10; i++) {
-        const code = randomChars(10);
-        db.db().prepare('INSERT INTO two_factor_recovery_code (user_id, code, is_used) VALUES (?,?,0)').run(userID, code.slice(0, 5).toLowerCase() + '-' + code.slice(5).toLowerCase());
-    }
-}
-export function useRecoveryCode(userID, codeInput) {
-    const code = String(codeInput).toLowerCase().trim();
-    const row = db.db().prepare('SELECT * FROM two_factor_recovery_code WHERE user_id = ? AND code = ? AND is_used = 0').get(userID, code);
-    if (!row)
-        return false;
-    db.db().prepare('UPDATE two_factor_recovery_code SET is_used = 1 WHERE id = ?').run(row.id);
-    return true;
-}
-// passcode reuse cache (60s) like gogs cache.TwoFactorCacheKey
-const usedPasscodes = new Set();
-export function passcodeRecentlyUsed(userID, passcode) {
-    const key = `${userID}:${passcode}`;
-    return usedPasscodes.has(key);
-}
-export function markPasscodeUsed(userID, passcode) {
-    const key = `${userID}:${passcode}`;
-    usedPasscodes.add(key);
-    setTimeout(() => usedPasscodes.delete(key), 60000);
-}
-//# sourceMappingURL=twofactor.js.map