@weibaohui/dsh-git-server 0.1.0

package/server/dist/sshx/dispatch.js

@@ -0,0 +1,160 @@
+// Shared SSH command dispatch used by both the builtin SSH server and the
+// `serv` subcommand (authorized_keys mode). Verbs mirror gogs cmd/gogs/serv.go
+// plus the LFS-over-SSH extensions (git-lfs-authenticate, git-lfs-transfer).
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { spawn } from 'node:child_process';
+import { conf } from '../conf.js';
+import * as db from '../db/db.js';
+import { runLFSTransfer } from './lfs-transfer.js';
+export function parseSSHCmd(cmd) {
+    const m = /^\s*(git[-\s][a-z-]+|git-lfs-authenticate|git-lfs-transfer)\s+'(.*)'\s*$/.exec(cmd) ??
+        /^\s*(git[-\s][a-z-]+|git-lfs-authenticate|git-lfs-transfer)\s+"(.*)"\s*$/.exec(cmd) ??
+        /^\s*(git[-\s][a-z-]+|git-lfs-authenticate|git-lfs-transfer)\s+(.*)\s*$/.exec(cmd);
+    if (!m)
+        return [];
+    return [m[1], m[2].replace(/^~\//, '')];
+}
+function resolveRepo(repoFullName) {
+    let repoName = repoFullName.replace(/^\//, '').replace(/\.git$/, '');
+    let isWiki = false;
+    if (repoName.endsWith('.wiki')) {
+        isWiki = true;
+        repoName = repoName.slice(0, -5);
+    }
+    const slash = repoName.indexOf('/');
+    const ownerName = slash > 0 ? repoName.slice(0, slash) : repoName;
+    const name = slash > 0 ? repoName.slice(slash + 1) : repoName;
+    const owner = db.getUserByUsername(ownerName);
+    const repo = owner ? db.getRepoByOwnerAndName(owner, name) : null;
+    if (!owner || !repo)
+        return null;
+    const repoDir = isWiki ? repo.WikiPath() : repo.RepoPath();
+    if (!fs.existsSync(repoDir))
+        return null;
+    return { owner, repo, repoDir };
+}
+/** git-upload-pack / git-receive-pack with gogs permission semantics. */
+export function serveGit(verb, repoFullName, identity, io) {
+    let repoName = repoFullName.replace(/^\//, '').replace(/\.git$/, '');
+    let isWiki = false;
+    if (repoName.endsWith('.wiki')) {
+        isWiki = true;
+        repoName = repoName.slice(0, -5);
+    }
+    const slash = repoName.indexOf('/');
+    const ownerName = slash > 0 ? repoName.slice(0, slash) : repoName;
+    const name = slash > 0 ? repoName.slice(slash + 1) : repoName;
+    const owner = db.getUserByUsername(ownerName);
+    const repo = owner ? db.getRepoByOwnerAndName(owner, name) : null;
+    const fail = (msg) => {
+        io.write(Buffer.from(`\r\n${msg}\r\n`));
+        io.close(1);
+    };
+    if (!owner || !repo)
+        return fail('Repository does not exist');
+    const repoDir = isWiki ? repo.WikiPath() : repo.RepoPath();
+    if (!fs.existsSync(repoDir))
+        return fail('Repository does not exist');
+    const isPull = verb === 'git-upload-pack';
+    // deploy keys: single-repo, read-only
+    if (identity.deployRepoID !== null && (!isPull || identity.deployRepoID !== repo.id)) {
+        return fail('Access denied');
+    }
+    const mode = db.accessMode(identity.userID, repo);
+    const need = isPull ? db.AccessMode.READ : db.AccessMode.WRITE;
+    if (!(isPull && !repo.is_private && !conf.requireSigninView) && mode < need) {
+        return fail('Access denied');
+    }
+    if (!isPull && repo.is_mirror)
+        return fail('Mirror repository is read-only');
+    const args = isPull ? ['upload-pack', repoDir] : ['receive-pack', repoDir];
+    const env = {};
+    if (!isPull) {
+        const user = db.getUserByID(identity.userID);
+        Object.assign(env, {
+            GOGS_AUTH_USER_ID: String(user?.id ?? 0),
+            GOGS_AUTH_USER_NAME: String(user?.name ?? ''),
+            GOGS_AUTH_USER_EMAIL: String(user?.email ?? ''),
+            GOGS_REPO_OWNER_NAME: owner.name,
+            GOGS_REPO_ID: String(repo.id),
+            GOGS_REPO_NAME: String(repo.name),
+            GOGS_REPO_CUSTOM_HOOKS_PATH: path.join(repoDir, 'custom_hooks'),
+        });
+    }
+    const child = spawn('git', args, { env: { ...process.env, ...env } });
+    child.stdout.on('data', (d) => io.write(d));
+    child.stderr.on('data', (d) => io.write(Buffer.from(`remote: ${d.toString()}`)));
+    io.onStdin((data) => child.stdin.write(data));
+    child.on('close', (code) => io.close(code ?? 0));
+    child.on('error', () => io.close(1));
+}
+/** git-lfs-authenticate <path> <download|upload> → JSON auth response on stdout. */
+export async function serveLFSAuthenticate(argStr, identity, io) {
+    const parts = argStr.trim().split(/\s+/);
+    const repoFullName = parts[0];
+    const operation = parts[1] ?? 'download';
+    if (!['download', 'upload'].includes(operation)) {
+        io.write(Buffer.from(`lfs-authenticate: invalid operation: ${operation}\n`));
+        io.close(1);
+        return;
+    }
+    const resolved = resolveRepo(repoFullName);
+    if (!resolved) {
+        io.write(Buffer.from('Repository does not exist\n'));
+        io.close(1);
+        return;
+    }
+    const { owner, repo } = resolved;
+    const mode = db.accessMode(identity.userID, repo);
+    const need = operation === 'upload' ? db.AccessMode.WRITE : db.AccessMode.READ;
+    if (!(operation === 'download' && !repo.is_private && !conf.requireSigninView) && mode < need) {
+        io.write(Buffer.from('Access denied\n'));
+        io.close(1);
+        return;
+    }
+    const { mintLFSToken } = await import('../lfsx.js');
+    const { token, expiresAt } = mintLFSToken(identity.userID, repo.id);
+    const href = `${conf.externalURL}${owner.name}/${repo.name}.git/info/lfs/objects/batch`;
+    io.write(Buffer.from(JSON.stringify({
+        href,
+        header: { Authorization: `RemoteAuth ${token}` },
+        'expires_in': 86400,
+        'expires_at': new Date(expiresAt * 1000).toISOString(),
+    }) + '\n'));
+    io.close(0);
+}
+/** git-lfs-transfer <path> <download|upload> — pure SSH LFS transfer protocol (lfs-transfer-1). */
+export async function serveLFSTransfer(argStr, identity, io) {
+    await runLFSTransfer(argStr, identity, io);
+}
+/** Top-level dispatch: parse and run one SSH command. */
+export function dispatchSSHCommand(command, identity, io) {
+    const [verb, args] = parseSSHCmd(command);
+    if (!verb) {
+        io.close(1);
+        return;
+    }
+    switch (verb) {
+        case 'git-upload-pack':
+        case 'git-receive-pack':
+            serveGit(verb, args, identity, io);
+            return;
+        case 'git-lfs-authenticate':
+            serveLFSAuthenticate(args, identity, io).catch((e) => {
+                console.error('[lfs-auth] error:', e);
+                io.close(1);
+            });
+            return;
+        case 'git-lfs-transfer':
+            serveLFSTransfer(args, identity, io).catch((e) => {
+                console.error('[lfs-transfer] error:', e);
+                io.close(1);
+            });
+            return;
+        default:
+            io.write(Buffer.from(`Serv: unknown command: ${verb}\n`));
+            io.close(1);
+    }
+}
+//# sourceMappingURL=dispatch.js.map

package/server/dist/sshx/lfs-transfer.js

@@ -0,0 +1,289 @@
+// git-lfs-transfer: pure SSH LFS transfer protocol (lfs-transfer-1) per the
+// git-lfs spec (docs/proposals/ssh_adapter.md). pkt-line framing: flush=0000,
+// delim=0001, data pkt = hex(len) + payload. Binary payloads are pkt-framed.
+import * as crypto from 'node:crypto';
+import * as fs from 'node:fs';
+import { conf } from '../conf.js';
+import * as db from '../db/db.js';
+// pkt-line control frames are FOUR ASCII chars '0000'/'0001'
+const FLUSH = Buffer.from('0000', 'ascii');
+const DELIM = Buffer.from('0001', 'ascii');
+function pkt(data) {
+    const buf = Buffer.isBuffer(data) ? data : Buffer.from(data, 'utf8');
+    const header = Buffer.from((buf.length + 4).toString(16).padStart(4, '0'), 'ascii');
+    return Buffer.concat([header, buf]);
+}
+function lfsObjectPath(oid) {
+    return `${conf.appDataPath}/lfs-objects/${oid.slice(0, 2)}/${oid.slice(2, 4)}/${oid}`;
+}
+/** Resolve owner/repo the same way as dispatch.serveGit. */
+function resolveRepo(repoFullName) {
+    let repoName = repoFullName.replace(/^\//, '').replace(/\.git$/, '');
+    if (repoName.endsWith('.wiki'))
+        repoName = repoName.slice(0, -5);
+    const slash = repoName.indexOf('/');
+    const ownerName = slash > 0 ? repoName.slice(0, slash) : repoName;
+    const name = slash > 0 ? repoName.slice(slash + 1) : repoName;
+    const owner = db.getUserByUsername(ownerName);
+    const repo = owner ? db.getRepoByOwnerAndName(owner, name) : null;
+    return owner && repo ? { owner, repo } : null;
+}
+class PktReader {
+    buf = Buffer.alloc(0);
+    closed = false;
+    waiters = [];
+    push(data) {
+        this.buf = Buffer.concat([this.buf, data]);
+        const w = this.waiters.splice(0);
+        for (const fn of w)
+            fn();
+    }
+    end() {
+        this.closed = true;
+        const w = this.waiters.splice(0);
+        for (const fn of w)
+            fn();
+    }
+    /** Returns next pkt: {type:'data',payload} | {type:'flush'} | {type:'delim'} | null(EOF). */
+    async next() {
+        while (true) {
+            if (this.buf.length >= 4) {
+                const lenStr = this.buf.toString('utf8', 0, 4);
+                if (/^[0-9a-f]{4}$/.test(lenStr)) {
+                    const len = parseInt(lenStr, 16);
+                    if (len === 0) {
+                        this.buf = this.buf.subarray(4);
+                        return { type: 'flush', payload: Buffer.alloc(0) };
+                    }
+                    if (len === 1) {
+                        this.buf = this.buf.subarray(4);
+                        return { type: 'delim', payload: Buffer.alloc(0) };
+                    }
+                    if (len >= 4 && this.buf.length >= len) {
+                        const payload = this.buf.subarray(4, len);
+                        this.buf = this.buf.subarray(len);
+                        return { type: 'data', payload };
+                    }
+                }
+            }
+            if (this.closed && this.buf.length < 4)
+                return null;
+            await new Promise((resolve) => this.waiters.push(resolve));
+        }
+    }
+}
+export async function runLFSTransfer(argStr, identity, io) {
+    const parts = argStr.trim().split(/\s+/);
+    const repoFullName = parts[0];
+    const operation = parts[1] ?? 'download';
+    if (!['download', 'upload'].includes(operation)) {
+        io.write(Buffer.from(`git-lfs-transfer: invalid operation: ${operation}\n`));
+        io.close(1);
+        return;
+    }
+    const resolved = resolveRepo(repoFullName);
+    if (!resolved) {
+        io.write(Buffer.from('Repository does not exist\n'));
+        io.close(1);
+        return;
+    }
+    const { owner, repo } = resolved;
+    const mode = db.accessMode(identity.userID, repo);
+    const need = operation === 'upload' ? db.AccessMode.WRITE : db.AccessMode.READ;
+    if (!(operation === 'download' && !repo.is_private && !conf.requireSigninView) && mode < need) {
+        io.write(Buffer.from('Access denied\n'));
+        io.close(1);
+        return;
+    }
+    const reader = new PktReader();
+    io.onStdin((data) => reader.push(data));
+    const writePkt = (s) => io.write(pkt(s));
+    const writeFlush = () => io.write(FLUSH);
+    const writeDelim = () => io.write(DELIM);
+    const writeStatus = (code, args = [], delim = false) => {
+        io.write(pkt(`status ${code}`));
+        for (const a of args)
+            io.write(pkt(a));
+        if (delim)
+            writeDelim();
+        writeFlush();
+    };
+    // 1. capability advertisement (server speaks first)
+    io.write(pkt('capability-list'));
+    io.write(pkt('version=1'));
+    io.write(pkt('begin-upload'));
+    io.write(pkt('begin-download'));
+    writeFlush();
+    let quit = false;
+    while (!quit) {
+        const p = await reader.next();
+        if (p === null)
+            break;
+        if (p.type === 'flush')
+            continue;
+        if (p.type !== 'data')
+            continue;
+        const line = p.payload.toString('utf8').replace(/\n$/, '');
+        const sp = line.indexOf(' ');
+        const cmd = sp < 0 ? line : line.slice(0, sp);
+        const rest = sp < 0 ? '' : line.slice(sp + 1);
+        switch (cmd) {
+            case 'version': {
+                if (rest === '1')
+                    writeStatus(200);
+                else
+                    writeStatus(400);
+                break;
+            }
+            case 'quit': {
+                writeStatus(200);
+                quit = true;
+                break;
+            }
+            case 'batch': {
+                // collect arguments until delim, then oid lines until flush
+                const args = {};
+                const oids = [];
+                let inOids = false;
+                while (true) {
+                    const q = await reader.next();
+                    if (q === null || q.type === 'flush')
+                        break;
+                    if (q.type === 'delim') {
+                        inOids = true;
+                        continue;
+                    }
+                    if (q.type !== 'data')
+                        continue;
+                    const l = q.payload.toString('utf8').replace(/\n$/, '');
+                    if (!inOids) {
+                        const eq = l.indexOf('=');
+                        if (eq > 0)
+                            args[l.slice(0, eq)] = l.slice(eq + 1);
+                    }
+                    else {
+                        const m = /^(\S+) (\d+)(?: (.*))?$/.exec(l);
+                        if (m)
+                            oids.push({ oid: m[1], size: Number(m[2]) });
+                    }
+                }
+                io.write(pkt('status 200'));
+                writeDelim();
+                const wantUpload = operation === 'upload';
+                for (const o of oids) {
+                    const row = db.db().prepare('SELECT * FROM lfs_object WHERE repo_id = ? AND oid = ?').get(repo.id, o.oid);
+                    const exists = !!row && fs.existsSync(lfsObjectPath(o.oid));
+                    let action;
+                    if (wantUpload) {
+                        // upload: offer upload when missing or size mismatch; else noop
+                        action = !exists || row.size !== o.size ? 'upload' : 'noop';
+                    }
+                    else {
+                        if (!exists) {
+                            action = 'noop'; // mirrors HTTP 404 → error shape
+                            io.write(pkt(`${o.oid} ${o.size} error message=[Object does not exist]`));
+                            continue;
+                        }
+                        action = row.size === o.size ? 'download' : 'noop';
+                    }
+                    io.write(pkt(`${o.oid} ${o.size} ${action}`));
+                }
+                writeFlush();
+                break;
+            }
+            case 'get-object': {
+                const oid = rest.trim();
+                const file = lfsObjectPath(oid);
+                const row = db.db().prepare('SELECT * FROM lfs_object WHERE repo_id = ? AND oid = ?').get(repo.id, oid);
+                if (!row || !fs.existsSync(file)) {
+                    writeStatus(404, [], true);
+                    io.write(pkt('Object does not exist\n'));
+                    writeFlush();
+                    break;
+                }
+                io.write(pkt('status 200'));
+                io.write(pkt(`size=${row.size}`));
+                writeDelim();
+                const content = fs.readFileSync(file);
+                for (let off = 0; off < content.length; off += 65516) {
+                    io.write(pkt(content.subarray(off, Math.min(off + 65516, content.length))));
+                }
+                writeFlush();
+                break;
+            }
+            case 'put-object': {
+                const oid = rest.trim();
+                // arguments until DELIM, then binary data until FLUSH
+                let size = 0;
+                while (true) {
+                    const q = await reader.next();
+                    if (q === null || q.type === 'flush')
+                        break;
+                    if (q.type === 'delim')
+                        break;
+                    if (q.type !== 'data')
+                        continue;
+                    const l = q.payload.toString('utf8').replace(/\n$/, '');
+                    const eq = l.indexOf('=');
+                    if (eq > 0 && l.slice(0, eq) === 'size')
+                        size = Number(l.slice(eq + 1));
+                }
+                // binary payload: collect until flush
+                const chunks = [];
+                while (true) {
+                    const q = await reader.next();
+                    if (q === null || q.type === 'flush')
+                        break;
+                    if (q.type === 'data')
+                        chunks.push(q.payload);
+                }
+                const content = Buffer.concat(chunks);
+                const hash = crypto.createHash('sha256').update(content).digest('hex');
+                if (hash !== oid || (size > 0 && content.length !== size)) {
+                    writeStatus(422, [], true);
+                    io.write(pkt('Content-Length and Oid mismatches\n'));
+                    writeFlush();
+                    break;
+                }
+                const dst = lfsObjectPath(oid);
+                fs.mkdirSync(dst.slice(0, dst.lastIndexOf('/')), { recursive: true });
+                fs.writeFileSync(dst, content);
+                db.db()
+                    .prepare('INSERT OR REPLACE INTO lfs_object (repo_id, oid, size, storage, created_at) VALUES (?,?,?,?,?)')
+                    .run(repo.id, oid, content.length, 'local', new Date().toISOString().replace('T', ' ').replace('Z', ''));
+                writeStatus(200);
+                break;
+            }
+            case 'verify-object': {
+                const oid = rest.trim();
+                let size = 0;
+                while (true) {
+                    const q = await reader.next();
+                    if (q === null || q.type === 'flush')
+                        break;
+                    if (q.type !== 'data')
+                        continue;
+                    const l = q.payload.toString('utf8').replace(/\n$/, '');
+                    const eq = l.indexOf('=');
+                    if (eq > 0 && l.slice(0, eq) === 'size')
+                        size = Number(l.slice(eq + 1));
+                }
+                const row = db.db().prepare('SELECT * FROM lfs_object WHERE repo_id = ? AND oid = ?').get(repo.id, oid);
+                if (!row) {
+                    writeStatus(404);
+                    break;
+                }
+                writeStatus(row.size === size ? 200 : 422);
+                break;
+            }
+            default: {
+                // unknown command → protocol error status
+                writeStatus(400, [], true);
+                io.write(pkt(`Unknown command: ${cmd}\n`));
+                writeFlush();
+            }
+        }
+    }
+    io.close(0);
+}
+//# sourceMappingURL=lfs-transfer.js.map

package/server/dist/sshx/server.js

@@ -0,0 +1,107 @@
+// Builtin SSH server (gogs START_SSH_SERVER): publickey auth against the
+// public_key table, then pipes `git-upload-pack`/`git-receive-pack` sessions.
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import { conf } from '../conf.js';
+import * as db from '../db/db.js';
+import { dispatchSSHCommand } from './dispatch.js';
+function hostKeyPath() {
+    return path.join(conf.customDir, 'ssh', 'gogs_ed25519.key');
+}
+function ensureHostKey() {
+    const file = hostKeyPath();
+    if (fs.existsSync(file))
+        return fs.readFileSync(file, 'utf8');
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const { privateKey } = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
+    // ssh2 parses PKCS#1 "RSA PRIVATE KEY" PEM reliably
+    const pem = privateKey.export({ type: 'pkcs1', format: 'pem' }).toString();
+    fs.writeFileSync(file, pem, { mode: 0o600 });
+    return pem;
+}
+/** Normalize a public key to "type base64" for comparison. */
+function normalizeKey(content) {
+    const parts = content.trim().split(/\s+/);
+    if (parts.length < 2)
+        return '';
+    return `${parts[0]} ${parts[1]}`;
+}
+async function authorizeKey(keyData) {
+    const presented = normalizeKey(keyData.toString('utf8'));
+    if (!presented)
+        return null;
+    const rows = db.db().prepare('SELECT id, owner_id, content, type FROM public_key').all();
+    for (const row of rows) {
+        if (normalizeKey(row.content) === presented) {
+            if (row.type === 2) {
+                const dk = db.db().prepare('SELECT repo_id FROM deploy_key WHERE key_id = ?').get(row.id);
+                return { userID: row.owner_id, keyID: row.id, deployRepoID: dk?.repo_id ?? null };
+            }
+            return { userID: row.owner_id, keyID: row.id, deployRepoID: null };
+        }
+    }
+    return null;
+}
+export function startSSHServer() {
+    import('ssh2').then(({ default: ssh2 }) => {
+        const hostKey = ensureHostKey();
+        const server = new ssh2.Server({ hostKeys: [hostKey] }, (client) => {
+            let authedUser = null;
+            client
+                .on('ready', () => {
+                client.on('session', (accept) => {
+                    const session = accept();
+                    session.on('exec', (accept, _reject, info) => {
+                        const stream = accept();
+                        const user = authedUser;
+                        if (!user) {
+                            stream.exit(1);
+                            stream.end();
+                            return;
+                        }
+                        dispatchSSHCommand(String(info.command), user, {
+                            write: (chunk) => stream.write(chunk),
+                            onStdin: (cb) => stream.on('data', (d) => cb(d)),
+                            close: (code) => {
+                                stream.exit(code);
+                                stream.end();
+                            },
+                        });
+                    });
+                });
+            })
+                .on('error', () => { });
+            client.on('authentication', (ctx) => {
+                if (ctx.method !== 'publickey') {
+                    return ctx.reject(['publickey']);
+                }
+                const buf = ctx.key?.data;
+                if (!buf)
+                    return ctx.reject();
+                // the wire blob starts with a length-prefixed algorithm name
+                const algLen = buf.readUInt32BE(0);
+                const algName = buf.subarray(4, 4 + algLen).toString('utf8');
+                // the .pub base64 IS the full wire blob (alg prefix + body)
+                const b64 = buf.toString('base64');
+                const line = `${algName} ${b64}`;
+                authorizeKey(Buffer.from(line)).then((u) => {
+                    if (u) {
+                        authedUser = u;
+                        ctx.accept();
+                    }
+                    else {
+                        ctx.reject();
+                    }
+                });
+            });
+        });
+        const port = conf.sshPort === 22 ? 22 : conf.sshPort;
+        const listenPort = process.env.GOGS_SSH_PORT ? Number(process.env.GOGS_SSH_PORT) : port;
+        server.listen(listenPort, '0.0.0.0', () => {
+            console.log(`SSH server started on 0.0.0.0:${listenPort}`);
+        });
+        server.on('error', (e) => console.error('[ssh]', e));
+    });
+}
+//# sourceMappingURL=server.js.map

package/server/dist/toolx.js

@@ -0,0 +1,108 @@
+// Time-limited activation/reset codes, captcha, and email-activate helpers —
+// mirroring gogs internal/tool TimeLimitCode semantics (sha1, minute resolution).
+import * as crypto from 'node:crypto';
+import { conf } from './conf.js';
+export const TIME_LIMIT_CODE_LENGTH = 12 + 6 + 40;
+function createTimeLimitCode(data, minutes, startStr) {
+    const format = (d) => String(d.getFullYear()).padStart(4, '0') +
+        String(d.getMonth() + 1).padStart(2, '0') +
+        String(d.getDate()).padStart(2, '0') +
+        String(d.getHours()).padStart(2, '0') +
+        String(d.getMinutes()).padStart(2, '0');
+    const start = startStr ? new Date(Number(startStr.slice(0, 4)), Number(startStr.slice(4, 6)) - 1, Number(startStr.slice(6, 8)), Number(startStr.slice(8, 10)), Number(startStr.slice(10, 12))) : new Date();
+    const startFormatted = startStr ?? format(start);
+    const end = new Date(start.getTime() + minutes * 60000);
+    const endStr = format(end);
+    const sh = crypto.createHash('sha1');
+    sh.update(data + conf.secretKey + startFormatted + endStr + String(minutes));
+    const encoded = sh.digest('hex');
+    return `${startFormatted}${String(minutes).padStart(6, '0')}${encoded}`;
+}
+export function verifyTimeLimitCode(data, minutes, code) {
+    if (code.length <= 18)
+        return false;
+    const start = code.slice(0, 12);
+    const lives = code.slice(12, 18);
+    const parsed = Number(lives);
+    if (!Number.isNaN(parsed))
+        minutes = parsed;
+    const retCode = createTimeLimitCode(data, minutes, start);
+    if (retCode === code && minutes > 0) {
+        const before = new Date(Number(start.slice(0, 4)), Number(start.slice(4, 6)) - 1, Number(start.slice(6, 8)), Number(start.slice(8, 10)), Number(start.slice(10, 12)));
+        return before.getTime() + minutes * 60000 > Date.now();
+    }
+    return false;
+}
+/** User activation code: gogs verifyUserActiveCode data format. */
+export function createActivateCode(user, minutes) {
+    const data = String(user.id) + user.email + user.lower_name + user.passwd + user.rands;
+    return createTimeLimitCode(data, minutes, null);
+}
+export function verifyActivateCode(user, code) {
+    if (!user)
+        return false;
+    const data = String(user.id) + user.email + user.lower_name + user.passwd + user.rands;
+    return verifyTimeLimitCode(data, conf.activateCodeLives, code);
+}
+/** Verify an activation/reset code for the user named inside it (gogs parseUserFromCode + verify). */
+export function verifyUserFromCode(code, lookup) {
+    if (code.length <= TIME_LIMIT_CODE_LENGTH)
+        return null;
+    const hexStr = code.slice(TIME_LIMIT_CODE_LENGTH);
+    let username;
+    try {
+        username = Buffer.from(hexStr, 'hex').toString('utf8');
+    }
+    catch {
+        return null;
+    }
+    const user = lookup(username);
+    if (!user)
+        return { user: null, valid: false };
+    return { user, valid: verifyActivateCode(user, code.slice(0, TIME_LIMIT_CODE_LENGTH)) };
+}
+const captchaCache = new Map();
+function sweepCaptcha() {
+    const now = Date.now();
+    for (const [k, v] of captchaCache) {
+        if (v.expires < now)
+            captchaCache.delete(k);
+    }
+}
+export function newCaptcha() {
+    sweepCaptcha();
+    const id = crypto.randomBytes(16).toString('hex');
+    const code = String(Math.floor(100000 + Math.random() * 900000));
+    captchaCache.set(id, { code, expires: Date.now() + 10 * 60000 });
+    // distorted-digit SVG
+    const w = 240;
+    const h = 80;
+    const colors = ['#333', '#555', '#722', '#252', '#335'];
+    let digits = '';
+    for (let i = 0; i < code.length; i++) {
+        const x = 28 + i * 34 + Math.random() * 8;
+        const y = h / 2 + Math.random() * 10 - 5;
+        const rot = Math.random() * 50 - 25;
+        const color = colors[Math.floor(Math.random() * colors.length)];
+        digits += `<text x="${x.toFixed(1)}" y="${y.toFixed(1)}" font-size="44" font-family="monospace" font-weight="bold" fill="${color}" transform="rotate(${rot.toFixed(1)} ${x.toFixed(1)} ${y.toFixed(1)})">${code[i]}</text>`;
+    }
+    let noise = '';
+    for (let i = 0; i < 6; i++) {
+        const x1 = Math.random() * w;
+        const y1 = Math.random() * h;
+        const x2 = Math.random() * w;
+        const y2 = Math.random() * h;
+        noise += `<line x1="${x1.toFixed(0)}" y1="${y1.toFixed(0)}" x2="${x2.toFixed(0)}" y2="${y2.toFixed(0)}" stroke="#999" stroke-width="1" opacity="0.6"/>`;
+    }
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="${w}" height="${h}" viewBox="0 0 ${w} ${h}"><rect width="100%" height="100%" fill="#f8f8f8"/>${noise}${digits}</svg>`;
+    return { id, svg };
+}
+export function validateCaptcha(id, text) {
+    const entry = captchaCache.get(id);
+    if (!entry || entry.expires < Date.now())
+        return false;
+    const ok = entry.code === String(text).trim();
+    captchaCache.delete(id); // single-use
+    return ok;
+}
+//# sourceMappingURL=toolx.js.map