@weibaohui/dsh-git-server 0.1.0

package/server/dist/twofactor.js

@@ -0,0 +1,160 @@
+// Two-factor authentication: TOTP (RFC 6238), AES-GCM secret storage compatible
+// with gogs cryptox, and recovery codes.
+import * as crypto from 'node:crypto';
+import * as db from './db/db.js';
+import { conf } from './conf.js';
+import { randomChars } from './db/db.js';
+// ---------------------------------------------------------------- crypto (cryptox compat)
+function md5Bytes(str) {
+    return crypto.createHash('md5').update(str).digest();
+}
+export function aesGcmEncrypt(key, plaintext) {
+    // golang.org/x/crypto GCM: 12-byte nonce prepended, tag appended
+    const nonce = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv('aes-128-gcm', key, nonce);
+    const enc = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return Buffer.concat([nonce, enc, cipher.getAuthTag()]);
+}
+export function aesGcmDecrypt(key, ciphertext) {
+    const nonce = ciphertext.subarray(0, 12);
+    const tag = ciphertext.subarray(ciphertext.length - 16);
+    const data = ciphertext.subarray(12, ciphertext.length - 16);
+    const decipher = crypto.createDecipheriv('aes-128-gcm', key, nonce);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(data), decipher.final()]);
+}
+function secretKey() {
+    return md5Bytes(conf.secretKey);
+}
+// ---------------------------------------------------------------- TOTP (RFC 6238)
+const B32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+function base32Encode(buf) {
+    let bits = 0;
+    let value = 0;
+    let out = '';
+    for (const byte of buf) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            out += B32[(value >>> (bits - 5)) & 31];
+            bits -= 5;
+        }
+    }
+    if (bits > 0)
+        out += B32[(value << (5 - bits)) & 31];
+    return out;
+}
+function base32Decode(str) {
+    const clean = str.toUpperCase().replace(/[=\s]/g, '');
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const ch of clean) {
+        const idx = B32.indexOf(ch);
+        if (idx < 0)
+            continue;
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(out);
+}
+export function totpGenerate(issuer, accountName) {
+    const raw = crypto.randomBytes(20);
+    const secret = base32Encode(raw);
+    const url = `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(accountName)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}`;
+    return { secret, url };
+}
+export function totpCode(secret, timeStep = Math.floor(Date.now() / 30000)) {
+    const key = base32Decode(secret);
+    const counter = Buffer.alloc(8);
+    counter.writeUInt32BE(Math.floor(timeStep / 2 ** 32), 0);
+    counter.writeUInt32BE(timeStep >>> 0, 4);
+    const hmac = crypto.createHmac('sha1', key).update(counter).digest();
+    const offset = hmac[hmac.length - 1] & 0xf;
+    const code = ((hmac[offset] & 0x7f) << 24) | (hmac[offset + 1] << 16) | (hmac[offset + 2] << 8) | hmac[offset + 3];
+    return String(code % 1000000).padStart(6, '0');
+}
+/** totp.Validate: accepts ±1 time step for clock skew, exactly 6 digits. */
+export function totpValidate(passcode, secret) {
+    if (!/^\d{6}$/.test(passcode))
+        return false;
+    const step = Math.floor(Date.now() / 30000);
+    for (const t of [step - 1, step, step + 1]) {
+        if (totpCode(secret, t) === passcode)
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------- storage
+function encryptSecret(secret) {
+    return aesGcmEncrypt(secretKey(), Buffer.from(secret)).toString('base64');
+}
+function decryptSecret(stored) {
+    return aesGcmDecrypt(secretKey(), Buffer.from(stored, 'base64')).toString();
+}
+export function isTwoFactorEnabled(userID) {
+    return !!db.db().prepare('SELECT 1 FROM two_factor WHERE user_id = ?').get(userID);
+}
+export function getTwoFactorByUserID(userID) {
+    return db.db().prepare('SELECT * FROM two_factor WHERE user_id = ?').get(userID) ?? null;
+}
+export function createTwoFactor(userID, secret) {
+    const now = Math.floor(Date.now() / 1000);
+    db.db()
+        .prepare('INSERT INTO two_factor (user_id, secret, created_unix) VALUES (?,?,?) ON CONFLICT(user_id) DO UPDATE SET secret = excluded.secret')
+        .run(userID, encryptSecret(secret), now);
+    // 10 recovery codes like gogs
+    for (let i = 0; i < 10; i++) {
+        const code = randomChars(10);
+        db.db().prepare('INSERT INTO two_factor_recovery_code (user_id, code, is_used) VALUES (?,?,0)').run(userID, code.slice(0, 5).toLowerCase() + '-' + code.slice(5).toLowerCase());
+    }
+}
+export function deleteTwoFactor(userID) {
+    db.db().prepare('DELETE FROM two_factor WHERE user_id = ?').run(userID);
+    db.db().prepare('DELETE FROM two_factor_recovery_code WHERE user_id = ?').run(userID);
+}
+export function validateTOTP(userID, passcode) {
+    const t = getTwoFactorByUserID(userID);
+    if (!t)
+        return false;
+    try {
+        return totpValidate(passcode, decryptSecret(t.secret));
+    }
+    catch {
+        return false;
+    }
+}
+export function listRecoveryCodes(userID) {
+    return db.db().prepare('SELECT * FROM two_factor_recovery_code WHERE user_id = ? ORDER BY id').all(userID);
+}
+export function regenerateRecoveryCodes(userID) {
+    db.db().prepare('DELETE FROM two_factor_recovery_code WHERE user_id = ?').run(userID);
+    for (let i = 0; i < 10; i++) {
+        const code = randomChars(10);
+        db.db().prepare('INSERT INTO two_factor_recovery_code (user_id, code, is_used) VALUES (?,?,0)').run(userID, code.slice(0, 5).toLowerCase() + '-' + code.slice(5).toLowerCase());
+    }
+}
+export function useRecoveryCode(userID, codeInput) {
+    const code = String(codeInput).toLowerCase().trim();
+    const row = db.db().prepare('SELECT * FROM two_factor_recovery_code WHERE user_id = ? AND code = ? AND is_used = 0').get(userID, code);
+    if (!row)
+        return false;
+    db.db().prepare('UPDATE two_factor_recovery_code SET is_used = 1 WHERE id = ?').run(row.id);
+    return true;
+}
+// passcode reuse cache (60s) like gogs cache.TwoFactorCacheKey
+const usedPasscodes = new Set();
+export function passcodeRecentlyUsed(userID, passcode) {
+    const key = `${userID}:${passcode}`;
+    return usedPasscodes.has(key);
+}
+export function markPasscodeUsed(userID, passcode) {
+    const key = `${userID}:${passcode}`;
+    usedPasscodes.add(key);
+    setTimeout(() => usedPasscodes.delete(key), 60000);
+}
+//# sourceMappingURL=twofactor.js.map

package/server/dist/webapi.js

@@ -0,0 +1,377 @@
+// /api/web/* JSON endpoints consumed by the React SPA (sign-in/up, MFA,
+// activate, reset password, repo header/watch/star/commit).
+import * as db from './db/db.js';
+import { conf } from './conf.js';
+import { completeSignIn } from './context.js';
+import { getCommit } from './gitx/git.js';
+function errBody(error, fields) {
+    const out = {};
+    if (error)
+        out.error = error;
+    if (fields)
+        out.fields = fields;
+    return out;
+}
+function isAlphaDashDot(s) {
+    return !/[^\d\w\-_.]/.test(s);
+}
+export async function handleWebAPI(c, subPath) {
+    // subPath begins after /api/web
+    const method = c.Method();
+    if (subPath === '/user/info' && method === 'GET') {
+        if (!c.User) {
+            c.Status(204);
+            c.res.end();
+            c.rendered = true;
+            return true;
+        }
+        c.JSONSuccess({
+            username: c.User.name,
+            avatarURL: c.User.AvatarURL(),
+            isAdmin: c.User.is_admin === 1,
+            canCreateOrganization: c.User.CanCreateOrganization(),
+        });
+        return true;
+    }
+    if (subPath === '/user/sign-up') {
+        if (method === 'GET') {
+            c.JSONSuccess({
+                registrationDisabled: conf.disableRegistration,
+                captchaEnabled: conf.enableRegistrationCaptcha,
+            });
+            return true;
+        }
+        if (method === 'POST') {
+            const req = await c.form();
+            const userName = String(req.userName ?? '');
+            const email = String(req.email ?? '');
+            const password = String(req.password ?? '');
+            if (conf.disableRegistration) {
+                c.JSON(403, errBody(c.Tr('auth.disable_register_prompt')));
+                return true;
+            }
+            if (conf.enableRegistrationCaptcha) {
+                const { validateCaptcha } = await import('./toolx.js');
+                const captchaID = c.GetCookie('gogs_captcha');
+                if (!validateCaptcha(captchaID, String(req.captcha ?? ''))) {
+                    const msg = c.Tr('form.captcha_incorrect');
+                    c.JSON(401, errBody(undefined, { captcha: msg }));
+                    return true;
+                }
+            }
+            if (!userName || !isAlphaDashDot(userName) || userName.length > 35) {
+                c.JSON(400, errBody(undefined, { userName: c.Tr('form.username') + c.Tr('form.alpha_dash_dot_error') }));
+                return true;
+            }
+            if (!email || !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(email) || email.length > 254) {
+                c.JSON(400, errBody(undefined, { email: c.Tr('form.email') + c.Tr('form.email_error') }));
+                return true;
+            }
+            if (!password || password.length > 255) {
+                c.JSON(400, errBody(undefined, { password: c.Tr('form.password') + c.Tr('form.require_error') }));
+                return true;
+            }
+            let user;
+            try {
+                user = db.createUser(userName, email, { password, activated: !conf.requireEmailConfirmation });
+            }
+            catch (e) {
+                if (e instanceof db.AlreadyExistError) {
+                    if (String(e.message).includes('email')) {
+                        c.JSON(422, errBody(undefined, { email: c.Tr('form.email_been_used') }));
+                    }
+                    else {
+                        c.JSON(422, errBody(undefined, { userName: c.Tr('form.username_been_taken') }));
+                    }
+                    return true;
+                }
+                if (e instanceof db.NameNotAllowedError) {
+                    c.JSON(400, errBody(undefined, { userName: c.Tr('user.form.name_not_allowed', userName) }));
+                    return true;
+                }
+                throw e;
+            }
+            // first user becomes admin & activated
+            const count = db.db().prepare('SELECT COUNT(*) AS c FROM user WHERE type = 0').get().c;
+            if (count === 1) {
+                db.updateUserColumns(user.id, { is_active: 1, is_admin: 1 });
+            }
+            c.JSONSuccess({});
+            return true;
+        }
+    }
+    if (subPath === '/user/sign-in') {
+        if (method === 'GET') {
+            // local auth only in this port; no external login sources yet
+            c.JSONSuccess({ loginSources: [] });
+            return true;
+        }
+        if (method === 'POST') {
+            const req = await c.form();
+            const username = String(req.username ?? '');
+            const password = String(req.password ?? '');
+            const user = db.getUserByUsername(username) ?? db.getUserByEmail(username);
+            const { verifyPassword } = await import('./authx/password.js');
+            // 兜底管理员：永远允许本地登录（插件自有紧急账号）
+            const bootstrapName = (process.env.DSH_BOOTSTRAP_ADMIN || '').split(':')[0] || 'root';
+            if (user && user.type === 0 && user.name === bootstrapName && verifyPassword(password, user.salt, user.passwd)) {
+                completeSignIn(c, user);
+                c.JSONSuccess({});
+                return true;
+            }
+            // 账户单一来源：UM service 启用时登录只走 service；本地密码仅当
+            // service 不可用时兜底（防影子账号残留的旧同步密码绕过）
+            const um = await import('./authx/um.js');
+            if (um.umServiceEnabled()) {
+                const check = await um.umCheckLogin(username, password);
+                if (check.ok) {
+                    const shadow = um.ensureShadowUser(check.user);
+                    if (shadow && shadow.type === 0) {
+                        completeSignIn(c, shadow);
+                        c.JSONSuccess({});
+                        return true;
+                    }
+                }
+                if (!check.unavailable) {
+                    c.JSON(401, errBody(c.Tr('form.username_password_incorrect'), { username: null, password: null }));
+                    return true;
+                }
+            }
+            const authed = !!(user && user.type === 0 && verifyPassword(password, user.salt, user.passwd));
+            if (!authed) {
+                c.JSON(401, errBody(c.Tr('form.username_password_incorrect'), { username: null, password: null }));
+                return true;
+            }
+            completeSignIn(c, user);
+            c.JSONSuccess({});
+            return true;
+        }
+    }
+    if (subPath === '/user/sign-out' && method === 'POST') {
+        c.session.Clear();
+        c.session.Release();
+        c.SetCookie(conf.cookieUserName, '', 0);
+        c.NoContent();
+        return true;
+    }
+    if (subPath === '/user/reset-password') {
+        if (method === 'GET') {
+            const code = c.Query('code');
+            let valid = false;
+            if (code) {
+                const { verifyUserFromCode } = await import('./toolx.js');
+                const parsed = verifyUserFromCode(code, (u) => db.getUserByUsername(u));
+                valid = !!parsed?.valid;
+            }
+            c.JSONSuccess({ emailEnabled: conf.emailEnabled, valid });
+            return true;
+        }
+        if (method === 'POST') {
+            if (!conf.emailEnabled) {
+                c.JSON(403, errBody(c.Tr('auth.disable_register_mail')));
+                return true;
+            }
+            const req = await c.form();
+            const email = String(req.email ?? '').toLowerCase().trim();
+            const user = db.getUserByEmail(email);
+            if (!user) {
+                c.JSONSuccess({ hours: Math.floor(conf.activateCodeLives / 60) });
+                return true;
+            }
+            if (user.type !== 0) {
+                const msg = c.Tr('auth.non_local_account');
+                c.JSON(403, errBody(undefined, { email: msg }));
+                return true;
+            }
+            try {
+                const { createActivateCode } = await import('./toolx.js');
+                const { sendResetPasswordMail } = await import('./mailer.js');
+                const code = createActivateCode(user, conf.resetPwdCodeLives) + Buffer.from(user.name).toString('hex');
+                await sendResetPasswordMail(user, code);
+                c.JSONSuccess({ hours: Math.floor(conf.resetPwdCodeLives / 60) });
+            }
+            catch (e) {
+                console.error('[mailer] reset mail:', e?.message ?? e);
+                c.JSONSuccess({ hours: Math.floor(conf.resetPwdCodeLives / 60) });
+            }
+            return true;
+        }
+    }
+    if (subPath === '/user/reset-password/complete' && method === 'POST') {
+        const req = await c.form();
+        const code = String(req.code ?? '');
+        const { verifyUserFromCode } = await import('./toolx.js');
+        const parsed = verifyUserFromCode(code, (u) => db.getUserByUsername(u));
+        if (!parsed || !parsed.valid) {
+            c.JSON(400, errBody(c.Tr('auth.invalid_code')));
+            return true;
+        }
+        const password = String(req.password ?? '');
+        if (password.length < 6) {
+            const msg = c.Tr('auth.password_too_short');
+            c.JSON(400, errBody(undefined, { password: msg }));
+            return true;
+        }
+        const { encodePassword, randomSalt } = await import('./authx/password.js');
+        const salt = randomSalt();
+        db.updateUserColumns(parsed.user.id, { passwd: encodePassword(password, salt), salt });
+        c.Status(204);
+        c.res.end();
+        c.rendered = true;
+        return true;
+    }
+    if (subPath === '/user/activate') {
+        if (!c.User) {
+            c.Status(401);
+            c.res.end();
+            c.rendered = true;
+            return true;
+        }
+        if (method === 'POST') {
+            if (!conf.requireEmailConfirmation) {
+                c.JSON(403, errBody(c.Tr('auth.disable_register_mail')));
+                return true;
+            }
+            if (!conf.emailEnabled) {
+                c.JSON(403, errBody(c.Tr('auth.disable_register_mail')));
+                return true;
+            }
+            try {
+                const { createActivateCode } = await import('./toolx.js');
+                const { sendActivateMail } = await import('./mailer.js');
+                const code = createActivateCode(c.User, conf.activateCodeLives) + Buffer.from(c.User.name).toString('hex');
+                await sendActivateMail(c.User, code);
+                c.JSONSuccess({ codeLifetimeHours: Math.floor(conf.activateCodeLives / 60) });
+            }
+            catch (e) {
+                console.error('[mailer] activate mail:', e?.message ?? e);
+                c.JSON(500, errBody(String(e?.message ?? e)));
+            }
+            return true;
+        }
+        c.JSONSuccess({ email: c.User.email, codeLifetimeHours: Math.floor(conf.activateCodeLives / 60) });
+        return true;
+    }
+    if (subPath === '/user/activate/complete' && method === 'POST') {
+        const req = await c.form();
+        const code = String(req.code ?? '');
+        const { verifyUserFromCode } = await import('./toolx.js');
+        const parsed = verifyUserFromCode(code, (u) => db.getUserByUsername(u));
+        if (!parsed || !parsed.valid) {
+            c.JSON(400, errBody(c.Tr('auth.invalid_code')));
+            return true;
+        }
+        const { randomSalt } = await import('./authx/password.js');
+        const salt = randomSalt();
+        db.updateUserColumns(parsed.user.id, { is_active: 1, rands: salt });
+        completeSignIn(c, parsed.user);
+        c.Status(204);
+        c.res.end();
+        c.rendered = true;
+        return true;
+    }
+    // repo endpoints
+    const repoMatch = /^\/([^/]+)\/([^/]+)(\/.*)?$/.exec(subPath);
+    if (repoMatch) {
+        const [, ownerName, repoName, rest] = repoMatch;
+        const owner = db.getUserByUsername(ownerName);
+        const repo = owner ? db.getRepoByOwnerAndName(owner, repoName) : null;
+        if (owner && repo) {
+            const viewerID = c.UserID();
+            const mode = db.accessMode(viewerID, repo);
+            const canRead = mode >= db.AccessMode.READ || (!repo.is_private && !conf.requireSigninView);
+            if (rest === '/header' && method === 'GET') {
+                if (!canRead) {
+                    c.Status(404);
+                    c.res.end();
+                    c.rendered = true;
+                    return true;
+                }
+                c.JSONSuccess({
+                    id: repo.id,
+                    owner: owner.name,
+                    name: repo.name,
+                    avatarURL: owner.AvatarURL(),
+                    visibility: repo.is_private ? 'private' : 'public',
+                    watchCount: repo.num_watches,
+                    starCount: repo.num_stars,
+                    forkCount: repo.num_forks,
+                    issuesEnabled: repo.enable_issues === 1,
+                    openIssueCount: repo.num_issues - repo.num_closed_issues,
+                    pullRequestsEnabled: repo.enable_pulls === 1,
+                    openPullRequestCount: repo.num_pulls - repo.num_closed_pulls,
+                    wikiEnabled: repo.enable_wiki === 1,
+                    viewerCanAdminister: mode >= db.AccessMode.ADMIN,
+                    viewerIsWatching: !!db.isWatching(viewerID, repo.id),
+                    viewerIsStarring: !!db.isStaring(viewerID, repo.id),
+                });
+                return true;
+            }
+            if (rest === '/watch') {
+                if (method === 'POST') {
+                    db.watchRepo(viewerID, repo.id, true);
+                    c.NoContent();
+                    return true;
+                }
+                if (method === 'DELETE') {
+                    db.watchRepo(viewerID, repo.id, false);
+                    c.NoContent();
+                    return true;
+                }
+            }
+            if (rest === '/star') {
+                if (method === 'POST') {
+                    db.starRepo(viewerID, repo.id, true);
+                    c.NoContent();
+                    return true;
+                }
+                if (method === 'DELETE') {
+                    db.starRepo(viewerID, repo.id, false);
+                    c.NoContent();
+                    return true;
+                }
+            }
+            const commitMatch = /^\/commit\/([0-9a-f]{7,40})$/.exec(rest ?? '');
+            if (commitMatch && method === 'GET') {
+                if (!canRead) {
+                    c.Status(404);
+                    c.res.end();
+                    c.rendered = true;
+                    return true;
+                }
+                const commit = await getCommit(repo.RepoPath(), commitMatch[1]);
+                if (!commit) {
+                    c.Status(404);
+                    c.res.end();
+                    c.rendered = true;
+                    return true;
+                }
+                const authorUser = db.getUserByEmail(commit.author.email);
+                c.JSONSuccess({
+                    sha: commit.id,
+                    subject: commit.Summary(),
+                    body: commit.message.slice(commit.Summary().length).replace(/^\n/, ''),
+                    author: {
+                        name: commit.author.name,
+                        email: commit.author.email,
+                        when: commit.author.when.toISOString(),
+                        avatarURL: avatarURLForEmail(commit.author.email),
+                        ...(authorUser ? { profileURL: authorUser.HomeURLPath() } : {}),
+                    },
+                    parents: commit.parents,
+                });
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function avatarURLForEmail(email) {
+    return conf.subpath + '/user/avatar/' + require_md5(email);
+}
+// small helper to avoid import cycle overhead
+import { md5 } from './authx/password.js';
+function require_md5(s) {
+    return md5(s.trim().toLowerCase());
+}
+//# sourceMappingURL=webapi.js.map

package/server/dist/webhook.js

@@ -0,0 +1,128 @@
+// Webhook delivery (hook_task persistence + async HTTP POST), mirroring gogs
+// webhook.go deliverHooks with HMAC-SHA256 signature.
+import * as http from 'node:http';
+import * as https from 'node:https';
+import * as crypto from 'node:crypto';
+import * as db from './db/db.js';
+import { newUUID } from './db/db.js';
+import { conf } from './conf.js';
+export function deliverWebhook(hook, eventType, payload, repo) {
+    const hookTaskType = hook.hook_task_type ?? 1;
+    const isJSON = hook.content_type === 1;
+    let payloadContent = '';
+    if (hookTaskType === 1) {
+        payloadContent = JSON.stringify(payload);
+    }
+    else if (hookTaskType === 2) {
+        // slack
+        const meta = JSON.parse(hook.meta ?? '{}');
+        payloadContent = JSON.stringify({
+            channel: meta.channel,
+            username: meta.username ?? 'Gogs',
+            icon_url: meta.icon_url ?? conf.externalURL + 'img/favicon.png',
+            text: slackText(eventType, payload),
+        });
+    }
+    else if (hookTaskType === 3) {
+        const meta = JSON.parse(hook.meta ?? '{}');
+        payloadContent = JSON.stringify({
+            username: meta.username ?? 'Gogs',
+            content: `\`\`\`${slackText(eventType, payload)}\`\`\``,
+        });
+    }
+    else {
+        payloadContent = JSON.stringify({ msgtype: 'text', text: { content: slackText(eventType, payload) } });
+    }
+    const body = isJSON ? payloadContent : new URLSearchParams({ payload: payloadContent }).toString();
+    const signature = crypto
+        .createHmac('sha256', hook.secret ?? '')
+        .update(payloadContent)
+        .digest('hex');
+    const task = db
+        .db()
+        .prepare(`INSERT INTO hook_task (repo_id, hook_id, uuid, type, url, signature, payload_content, content_type, event_type, is_ssl, is_delivered, delivered, is_succeed)
+       VALUES (?,?,?,?,?,?,?,?,?,?,0,?,0)`)
+        .run(repo.id, hook.id, newUUID(), hookTaskType, hook.url, signature, payloadContent, hook.content_type ?? 1, eventType, hook.is_ssl ?? 0, process.hrtime.bigint() // delivered UnixNano (placeholder until completion)
+    );
+    const taskID = Number(task.lastInsertRowid);
+    db.updateWebhookLastStatus(hook.id, 2); // pending → failed until success
+    const delivery = (async () => {
+        const started = process.hrtime.bigint();
+        try {
+            const { status } = await postURL(String(hook.url), Buffer.from(body), isJSON ? 'application/json' : 'application/x-www-form-urlencoded', {
+                'X-Gogs-Delivery': String(taskID),
+                'X-Gogs-Event': eventType,
+                'X-Gogs-Event-Type': eventType,
+                'X-Gogs-Signature': signature,
+                'X-GitHub-Delivery': String(taskID),
+                'X-GitHub-Event': eventType,
+            });
+            const delivered = process.hrtime.bigint();
+            db.db()
+                .prepare(`UPDATE hook_task SET is_delivered = 1, delivered = ?, is_succeed = ?, request_content = ?, response_content = ? WHERE id = ?`)
+                .run(delivered, status >= 200 && status < 300 ? 1 : 0, JSON.stringify({ headers: {} }), JSON.stringify({ status, headers: {}, body: '' }), taskID);
+            if (status >= 200 && status < 300) {
+                db.updateWebhookLastStatus(hook.id, 1);
+            }
+        }
+        catch (e) {
+            db.db()
+                .prepare(`UPDATE hook_task SET is_delivered = 1, delivered = ?, is_succeed = 0, response_content = ? WHERE id = ?`)
+                .run(process.hrtime.bigint(), JSON.stringify({ err: String(e?.message ?? e) }), taskID);
+        }
+    })();
+    pendingDeliveries.add(delivery);
+    void delivery.finally(() => pendingDeliveries.delete(delivery));
+}
+/** In-flight deliveries — short-lived processes (git hooks) must await these before exit. */
+export const pendingDeliveries = new Set();
+function slackText(eventType, payload) {
+    const repo = payload?.repository?.full_name ?? '';
+    const who = payload?.sender?.username ?? payload?.pusher?.username ?? '';
+    switch (eventType) {
+        case 'push': {
+            const commits = payload?.commits ?? [];
+            return `[${repo}] ${who} pushed ${commits.length} commit(s):\n` + commits.map((c) => `  - ${c.message}`).join('\n');
+        }
+        case 'issues':
+            return `[${repo}] Issue #${payload?.number}: "${payload?.issue?.title}" ${payload?.action ?? 'opened'} by ${who}`;
+        case 'pull_request':
+            return `[${repo}] Pull request #${payload?.number}: "${payload?.issue?.title}" ${payload?.action ?? 'opened'} by ${who}`;
+        case 'issue_comment':
+            return `[${repo}] New comment on #${payload?.number} by ${who}`;
+        case 'create':
+            return `[${repo}] ${payload?.ref_type} "${payload?.ref}" created by ${who}`;
+        case 'delete':
+            return `[${repo}] ${payload?.ref_type} "${payload?.ref}" deleted by ${who}`;
+        case 'fork':
+            return `[${repo}] forked by ${who}`;
+        case 'release':
+            return `[${repo}] Release "${payload?.release?.tag_name}" ${payload?.action ?? 'published'} by ${who}`;
+        default:
+            return `[${repo}] ${eventType} by ${who}`;
+    }
+}
+function postURL(url, body, contentType, headers) {
+    return new Promise((resolve, reject) => {
+        const u = new URL(url);
+        const mod = u.protocol === 'https:' ? https : http;
+        const req = mod.request({
+            method: 'POST',
+            hostname: u.hostname,
+            port: u.port || (u.protocol === 'https:' ? 443 : 80),
+            path: u.pathname + u.search,
+            headers: { 'Content-Type': contentType, 'Content-Length': String(body.length), ...headers },
+            timeout: conf.deliverTimeout * 1000,
+            rejectUnauthorized: !conf.skipVerify,
+        }, (res) => {
+            res.resume();
+            res.on('end', () => resolve({ status: res.statusCode ?? 0 }));
+        });
+        req.on('error', reject);
+        req.on('timeout', () => {
+            req.destroy(new Error('timeout'));
+        });
+        req.end(body);
+    });
+}
+//# sourceMappingURL=webhook.js.map