fhirsmith 0.13.4 → 0.14.1

package/publisher/publisher.js

@@ -2,13 +2,17 @@ const express = require('express');
 const path = require('path');
 const fs = require('fs');
 const validation = require('./validation');
+const gitRemote = require('./git-remote');
+const githubRelease = require('./github-release');
 const Database = require('sqlite3').Database;
 const bcrypt = require('bcrypt');
 const session = require('express-session');
+const lusca = require('lusca');
 const rateLimit = require('express-rate-limit');
 const crypto = require('crypto');
 const folders = require('../library/folder-setup');
 const escape = require('escape-html');
+const { requireSameOrigin } = require('../library/same-origin');
 const {Utilities} = require("../library/utilities");
 
 // GitHub refuses any file larger than this at the pre-receive hook, and the rejection takes down
@@ -57,14 +61,29 @@ class PublisherModule {
         // plain HTTP - without it the browser will not send the cookie back and login
         // appears to succeed and then silently do nothing.
         secure: this.config.cookieSecure ?? true,
+        // CSRF: the browser leaves the cookie off a POST that starts on another site. That,
+        // with the Origin check below, is what stops another site's page from driving a
+        // logged-in browser to create, approve or delete tasks, or to add users
+        sameSite: 'lax',
+        httpOnly: true,
         maxAge: 24 * 60 * 60 * 1000 // 24 hours
       }
       // Not using SQLiteStore to avoid the database conflict
     }));
 
+    // every POST must come from one of our own pages - see library/same-origin.js
+    this.router.use(requireSameOrigin());
+
     // Parse form data
     this.router.use(express.urlencoded({ extended: true }));
 
+    // CSRF tokens (lusca): every form carries the session's token in a hidden _csrf field,
+    // and every POST route has this.csrf in it, written out so static analysis can see it.
+    // Pages only make a token for someone logged in (making one stores a secret in the
+    // session, and anonymous visitors should not get sessions); the login page always does
+    this.csrf = lusca.csrf({ key: '_csrf' });
+    this.csrfIfLoggedIn = (req, res, next) => req.session && req.session.userId ? this.csrf(req, res, next) : next();
+
     // Set up routes
     this.setupRoutes();
 
@@ -150,6 +169,7 @@ class PublisherModule {
                                           build_output_path TEXT,
                                           failure_reason TEXT,
                                           announcement TEXT,
+                                          release_url TEXT,
                                           approved_by INTEGER,
                                           queued_at DATETIME DEFAULT CURRENT_TIMESTAMP,
                                           building_at DATETIME,
@@ -235,6 +255,17 @@ class PublisherModule {
         });
       });
     }
+    if (!columnNames.includes('release_url')) {
+      await new Promise((resolve, reject) => {
+        this.db.run('ALTER TABLE tasks ADD COLUMN release_url TEXT', (err) => {
+          if (err) reject(err);
+          else {
+            this.logger.info('Migration: added release_url column to tasks table');
+            resolve();
+          }
+        });
+      });
+    }
     const websiteColumns = await new Promise((resolve, reject) => {
       this.db.all("PRAGMA table_info(websites)", (err, rows) => {
         if (err) reject(err);
@@ -294,7 +325,7 @@ class PublisherModule {
 
   setupRoutes() {
     // Main dashboard
-    this.router.get('/', this.renderDashboard.bind(this));
+    this.router.get('/', this.csrfIfLoggedIn, this.renderDashboard.bind(this));
 
     // Authentication. The login post is rate limited: besides slowing down guessing, it
     // is the one unauthenticated route that runs bcrypt, and bcrypt.compare holds a libuv
@@ -308,20 +339,39 @@ class PublisherModule {
       legacyHeaders: false
     });
 
-    this.router.get('/login', this.renderLogin.bind(this));
-    this.router.post('/login', loginLimiter, this.handleLogin.bind(this));
-    this.router.post('/logout', this.handleLogout.bind(this));
+    // Task actions delete build output from disk or queue new builds: a logged-in user can't
+    // be allowed to hammer them either
+    const taskActionLimiter = rateLimit({
+      windowMs: 60 * 1000,
+      max: this.config.taskActionsPerMinute ?? 30,
+      message: 'Too many task actions, please try again later.',
+      standardHeaders: true,
+      legacyHeaders: false
+    });
+
+    // the task pages read build logs and QA output from disk
+    const taskReadLimiter = rateLimit({
+      windowMs: 60 * 1000,
+      max: this.config.taskReadsPerMinute ?? 300,
+      message: 'Too many requests, please try again later.',
+      standardHeaders: true,
+      legacyHeaders: false
+    });
+
+    this.router.get('/login', this.csrf, this.renderLogin.bind(this));
+    this.router.post('/login', loginLimiter, this.csrf, this.handleLogin.bind(this));
+    this.router.post('/logout', this.csrf, this.handleLogout.bind(this));
 
     // Tasks
-    this.router.get('/tasks', this.renderTasks.bind(this));
-    this.router.post('/tasks', this.requireAuth.bind(this), this.createTask.bind(this));
-    this.router.post('/tasks/:id/approve', this.requireAuth.bind(this), this.approveTask.bind(this));
-    this.router.post('/tasks/:id/delete', this.requireAuth.bind(this), this.deleteTask.bind(this));
-    this.router.post('/tasks/:id/retry', this.requireAuth.bind(this), this.retryTask.bind(this));
-    this.router.get('/tasks/:id/output', this.getTaskOutput.bind(this));
-    this.router.get('/tasks/:id/history', this.getTaskHistory.bind(this));
-    this.router.get('/tasks/:id/qa', this.getTaskQA.bind(this));
-    this.router.use('/tasks/:id/qa-files', (req, res, next) => {
+    this.router.get('/tasks', this.csrfIfLoggedIn, this.renderTasks.bind(this));
+    this.router.post('/tasks', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.createTask.bind(this));
+    this.router.post('/tasks/:id/approve', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.approveTask.bind(this));
+    this.router.post('/tasks/:id/delete', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.deleteTask.bind(this));
+    this.router.post('/tasks/:id/retry', taskActionLimiter, this.csrf, this.requireAuth.bind(this), this.retryTask.bind(this));
+    this.router.get('/tasks/:id/output', taskReadLimiter, this.csrfIfLoggedIn, this.getTaskOutput.bind(this));
+    this.router.get('/tasks/:id/history', taskReadLimiter, this.csrfIfLoggedIn, this.getTaskHistory.bind(this));
+    this.router.get('/tasks/:id/qa', taskReadLimiter, this.csrfIfLoggedIn, this.getTaskQA.bind(this));
+    this.router.use('/tasks/:id/qa-files', taskReadLimiter, (req, res, next) => {
       const taskId = req.params.id;
       this.getTask(taskId).then(task => {
         if (!task || !task.local_folder) {
@@ -333,13 +383,27 @@ class PublisherModule {
     });
 
     // Admin routes
-    this.router.get('/admin/websites', this.requireAdmin.bind(this), this.renderWebsites.bind(this));
-    this.router.post('/admin/websites', this.requireAdmin.bind(this), this.createWebsite.bind(this));
-    this.router.get('/admin/websites/:id/edit', this.requireAdmin.bind(this), this.renderEditWebsite.bind(this));
-    this.router.post('/admin/websites/:id/edit', this.requireAdmin.bind(this), this.updateWebsite.bind(this));
-    this.router.get('/admin/users', this.requireAdmin.bind(this), this.renderUsers.bind(this));
-    this.router.post('/admin/users', this.requireAdmin.bind(this), this.createUser.bind(this));
-    this.router.post('/admin/permissions', this.requireAdmin.bind(this), this.updatePermissions.bind(this));
+    this.router.get('/admin/websites', this.csrf, this.requireAdmin.bind(this), this.renderWebsites.bind(this));
+    this.router.post('/admin/websites', this.csrf, this.requireAdmin.bind(this), this.createWebsite.bind(this));
+    this.router.get('/admin/websites/:id/edit', this.csrf, this.requireAdmin.bind(this), this.renderEditWebsite.bind(this));
+    this.router.post('/admin/websites/:id/edit', this.csrf, this.requireAdmin.bind(this), this.updateWebsite.bind(this));
+    this.router.get('/admin/users', this.csrf, this.requireAdmin.bind(this), this.renderUsers.bind(this));
+    this.router.post('/admin/users', this.csrf, this.requireAdmin.bind(this), this.createUser.bind(this));
+    this.router.post('/admin/permissions', this.csrf, this.requireAdmin.bind(this), this.updatePermissions.bind(this));
+
+    // lusca rejects a post with a missing or wrong token by passing on an error
+    this.router.use((err, req, res, next) => {
+      if (err && typeof err.message === 'string' && err.message.startsWith('CSRF token')) {
+        return res.status(403).type('text/plain').send('The form has expired or did not come from this site - go back, reload the page and try again');
+      }
+      next(err);
+    });
+  }
+
+  /** The hidden field every POST form carries: the session's CSRF token. */
+  csrfField(res) {
+    const token = res.locals && res.locals._csrf;
+    return token ? '<input type="hidden" name="_csrf" value="' + escape(token) + '">' : '';
   }
 
   // Background Task Processing
@@ -722,7 +786,7 @@ class PublisherModule {
 
   async cloneRepository(task, draftDir) {
     const { spawn } = require('child_process');
-    const gitUrl = 'https://github.com/' + task.github_org + '/' + task.github_repo + '.git';
+    const gitUrl = gitRemote.githubUrl(task.github_org, task.github_repo);
 
     await this.logTaskMessage(task.id, 'info', 'Cloning repository: ' + gitUrl + ' (branch: ' + task.git_branch + ')');
 
@@ -734,7 +798,10 @@ class PublisherModule {
         gitUrl,
         draftDir
       ], {
-        stdio: ['pipe', 'pipe', 'pipe']
+        stdio: ['pipe', 'pipe', 'pipe'],
+        // no terminal prompt: a missing repo looks like a private one to GitHub, and
+        // git would otherwise ask for a username (see git-remote.js)
+        env: gitRemote.gitEnv()
       });
 
       let stderr = '';
@@ -748,7 +815,10 @@ class PublisherModule {
           await this.logTaskMessage(task.id, 'info', 'Repository cloned successfully');
           resolve();
         } else {
-          const error = 'Git clone failed with code ' + code + ': ' + stderr;
+          const explained = gitRemote.explainCloneFailure(stderr, task.github_org, task.github_repo, task.git_branch);
+          const error = explained
+            ? 'Git clone failed: ' + explained
+            : 'Git clone failed with code ' + code + ': ' + stderr;
           await this.logTaskMessage(task.id, 'error', error);
           reject(new Error(error));
         }
@@ -868,6 +938,28 @@ class PublisherModule {
       errors.push('Version mismatch: task specifies "' + task.version + '" but build produced "' + qaData['ig-ver'] + '"');
     }
 
+    // publication-request.json is what the publication run actually follows - it decides the
+    // version folder the IG is published into. If it wasn't updated along with the IG, the run
+    // publishes the new content over the previous release's folder, so catch it here, before the
+    // task can be approved.
+    const prPath = path.join(draftDir, 'publication-request.json');
+    if (fs.existsSync(prPath)) {
+      let pr = null;
+      try {
+        pr = JSON.parse(fs.readFileSync(prPath, 'utf8'));
+      } catch (e) {
+        errors.push('publication-request.json could not be parsed: ' + e.message);
+      }
+      if (pr) {
+        if (pr['package-id'] !== task.npm_package_id) {
+          errors.push('publication-request.json package-id is "' + pr['package-id'] + '" but the task specifies "' + task.npm_package_id + '"');
+        }
+        if (pr.version !== task.version) {
+          errors.push('publication-request.json version is "' + pr.version + '" but the task specifies "' + task.version + '" - update publication-request.json in the IG');
+        }
+      }
+    }
+
     if (errors.length > 0) {
       for (const err of errors) {
         await this.logTaskMessage(task.id, 'error', err);
@@ -950,10 +1042,14 @@ class PublisherModule {
       if (typeof json.url === 'string' && json.url.startsWith('file:')) {
         problems.push('url is a local file path (' + json.url + ')');
       }
+      if (json.version !== task.version) {
+        problems.push('its version is ' + json.version + ', not ' + task.version);
+      }
       if (problems.length > 0) {
-        throw new Error('Published package ' + pkgPath + ' is a draft build, not a publication build (' +
-            problems.join('; ') + '). The IG Publisher publication run likely skipped package ' +
-            'regeneration (e.g. a Jekyll/template failure). Not committing.');
+        throw new Error('Published package ' + pkgPath + ' is not the publication build of ' +
+            task.npm_package_id + '#' + task.version + ' (' + problems.join('; ') + '). ' +
+            'Either the IG Publisher publication run skipped package regeneration (e.g. a Jekyll/template ' +
+            'failure), or publication-request.json points at another version. Not committing.');
       }
       await this.logTaskMessage(task.id, 'info', 'Verified publication package: ' + pkgPath);
     }
@@ -1203,15 +1299,24 @@ class PublisherModule {
     // Step 7: Commit and push the ig-registry
     await this.logTaskMessage(task.id, 'info', 'Committing changes to ig-registry...');
     const registryCommitMsg = 'publish ' + task.npm_package_id + '#' + task.version;
-    await this.runCommand('git', ['commit', '-a', '-m', registryCommitMsg], { cwd: registryDir }, task.id, 'Committing ig-registry changes');
-    await this.runCommand('git', ['pull'], { cwd: registryDir }, task.id, 'Pulling latest ig-registry');
-    await this.runCommand('git', ['push'], { cwd: registryDir }, task.id, 'Pushing ig-registry changes');
+    // A republication of a version the registry already lists (a technical correction) leaves the
+    // registry as it was, and 'git commit' fails on a clean tree - which is not an error here.
+    const registryStatus = await this.runCommand('git', ['status', '--porcelain', '--untracked-files=no'],
+        { cwd: registryDir }, task.id, 'Checking for ig-registry changes');
+    if (registryStatus.trim() === '') {
+      await this.logTaskMessage(task.id, 'warn', 'The publication run made no changes to the ig-registry - nothing to commit');
+    } else {
+      await this.runCommand('git', ['commit', '-a', '-m', registryCommitMsg], { cwd: registryDir }, task.id, 'Committing ig-registry changes');
+      await this.runCommand('git', ['pull'], { cwd: registryDir }, task.id, 'Pulling latest ig-registry');
+      await this.runCommand('git', ['push'], { cwd: registryDir }, task.id, 'Pushing ig-registry changes');
+    }
 
     // Step 8: Read the announcement text and store it in the database
+    let announcement = null;
     const announcementPath = path.join(zipsDir, task.npm_package_id + '#' + task.version + '-announcement.txt');
     if (fs.existsSync(announcementPath)) {
       try {
-        const announcement = fs.readFileSync(announcementPath, 'utf8');
+        announcement = fs.readFileSync(announcementPath, 'utf8');
         await this.updateTaskFields(task.id, { announcement: announcement });
         await this.logTaskMessage(task.id, 'info', 'Announcement text saved (' + announcement.length + ' chars)');
       } catch (err) {
@@ -1221,6 +1326,9 @@ class PublisherModule {
       await this.logTaskMessage(task.id, 'warn', 'No announcement file found at ' + announcementPath);
     }
 
+    // Step 8b: Tag the source repository and publish a GitHub release carrying its source zip
+    await this.createSourceRelease(task, draftDir, zipsDir, announcement);
+
     // Step 9: Run the website update script
     if (website.server_update_script) {
       await this.logTaskMessage(task.id, 'info', 'Running website update script: ' + website.server_update_script);
@@ -1228,6 +1336,60 @@ class PublisherModule {
     }
   }
 
+  // Tag the IG source repository and publish a GitHub release with a zip of the source at the
+  // commit that was published. Runs only when a GitHub App is configured; without one there is no
+  // credential that can write to the source repository, and the step is skipped.
+  //
+  // Nothing here is allowed to fail the task. By the time this runs the IG is published, the web
+  // folder is pushed and the registry is updated - a release that did not get made is worth a
+  // warning in the log and nothing more.
+  async createSourceRelease(task, draftDir, zipsDir, announcement) {
+    const appConfig = this.config && this.config['github-app'];
+    if (!githubRelease.isConfigured(appConfig)) {
+      await this.logTaskMessage(task.id, 'info',
+          'No GitHub App configured - skipping the source tag and release');
+      return;
+    }
+
+    try {
+      // The draft clone is the exact tree that was published, so its HEAD is the commit the
+      // release should point at.
+      const sha = (await this.runCommand('git', ['rev-parse', 'HEAD'], { cwd: draftDir },
+          task.id, 'Reading the published commit')).trim();
+
+      // git archive takes the committed state, not the working directory: by now the publisher has
+      // built in this folder twice and left output/, temp/, template/ and fsh-generated/ behind,
+      // none of which are in the archive. It is also exactly reproducible from the tag.
+      const stem = task.npm_package_id + '-' + task.version;
+      const assetName = stem + '-source.zip';
+      const zipPath = path.join(zipsDir, assetName);
+      await this.runCommand('git',
+          ['archive', '--format=zip', '--prefix=' + stem + '/', '-o', zipPath, 'HEAD'],
+          { cwd: draftDir }, task.id, 'Building the source zip');
+
+      const result = await githubRelease.publishRelease({
+        config: appConfig,
+        org: task.github_org,
+        repo: task.github_repo,
+        tag: 'v' + task.version,
+        sha: sha,
+        releaseName: task.npm_package_id + '#' + task.version,
+        body: announcement || '',
+        zipPath: zipPath,
+        assetName: assetName,
+        // logTaskMessage never rejects, and github-release logs without waiting
+        log: (level, message) => { void this.logTaskMessage(task.id, level, message); }
+      });
+
+      await this.updateTaskFields(task.id, { release_url: result.url });
+    } catch (err) {
+      const detail = (err.response && err.response.data && err.response.data.message) || err.message;
+      await this.logTaskMessage(task.id, 'warn',
+          'Could not tag and release the source repository: ' + detail +
+          '. The IG itself is published - this does not affect it.');
+    }
+  }
+
   async runPublisherGoPublish(taskId, publisherJar, sourceDir, webDir, registryDir, historyDir, templatesDir, zipsDir, logFile) {
     const { spawn } = require('child_process');
 
@@ -1364,7 +1526,7 @@ class PublisherModule {
             content += '<a href="/publisher/admin/websites" class="btn btn-secondary me-2">Manage Websites</a>';
             content += '<a href="/publisher/admin/users" class="btn btn-secondary">Manage Users</a>';
           }
-          content += '<form style="display: inline-block; margin-left: 10px;" method="post" action="/publisher/logout">';
+          content += '<form style="display: inline-block; margin-left: 10px;" method="post" action="/publisher/logout">' + this.csrfField(res);
           content += '<button type="submit" class="btn btn-outline-secondary">' + escape(req.session.userName) + ' \u2014 Logout</button>';
           content += '</form>';
           content += '</div>';
@@ -1405,7 +1567,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }
         });
 
@@ -1429,7 +1591,7 @@ class PublisherModule {
       let content = '<div class="row justify-content-center">';
       content += '<div class="col-md-6">';
       content += '<h3>Login</h3>';
-      content += '<form method="post" action="/publisher/login">';
+      content += '<form method="post" action="/publisher/login">' + this.csrfField(res);
       content += '<div class="mb-3">';
       content += '<label for="login" class="form-label">Username</label>';
       content += '<input type="text" class="form-control" id="login" name="login" required>';
@@ -1447,7 +1609,7 @@ class PublisherModule {
         templateVars: {
           loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
           loginPath: req.session.userId ? "logout" : 'login',
-          loginAction: req.session.userId ? "POST" : 'GET'
+          loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
         }});
       res.setHeader('Content-Type', 'text/html');
       res.send(html);
@@ -1483,6 +1645,9 @@ class PublisherModule {
           return res.redirect('/publisher/login?error=invalid');
         }
 
+        // a new session id on login, so an id planted in the browser before login
+        // (session fixation) does not become a logged-in session
+        await new Promise((resolve, reject) => req.session.regenerate(e => e ? reject(e) : resolve()));
         req.session.userId = user.id;
         req.session.userName = user.name;
         req.session.isAdmin = user.is_admin;
@@ -1528,7 +1693,7 @@ class PublisherModule {
           content += '<button class="btn btn-primary" onclick="document.getElementById(\'create-task-panel\').style.display = document.getElementById(\'create-task-panel\').style.display === \'none\' ? \'block\' : \'none\'">New Publication Task</button>';
           content += '<div id="create-task-panel" style="display: none;" class="mt-3">';
           content += '<h3>Create New Publication Task</h3>';
-          content += '<form id="create-task-form" method="post" action="/publisher/tasks" class="row g-3">';
+          content += '<form id="create-task-form" method="post" action="/publisher/tasks" class="row g-3">' + this.csrfField(res);
           content += '<div class="col-md-3">';
           content += '<label for="website_id" class="form-label">Target Website</label>';
           content += '<select class="form-select" id="website_id" name="website_id" required>';
@@ -1606,7 +1771,7 @@ class PublisherModule {
               content += '<a href="/publisher/tasks/' + task.id + '/qa-files/index.html" class="btn btn-sm btn-outline-secondary me-1">View IG</a>';
               content += '<a href="/publisher/tasks/' + task.id + '/qa" class="btn btn-sm btn-outline-secondary me-1">View QA</a>';
               if (canApprove) {
-                content += '<form method="post" action="/publisher/tasks/' + task.id + '/approve" style="display: inline;">';
+                content += '<form method="post" action="/publisher/tasks/' + task.id + '/approve" style="display: inline;">' + this.csrfField(res);
                 content += '<button type="submit" name="approve" class="btn btn-sm btn-success me-1">Approve</button>';
                 content += '</form>';
               }
@@ -1623,13 +1788,13 @@ class PublisherModule {
             }
 
             if (canDelete) {
-              content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">';
+              content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">' + this.csrfField(res);
               content += '<button type="submit" class="btn btn-sm btn-danger">Delete</button>';
               content += '</form>';
             }
 
             if (req.session.userId && task.status === 'failed') {
-              content += ' <form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;">';
+              content += ' <form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;">' + this.csrfField(res);
               content += '<button type="submit" class="btn btn-sm btn-warning">Retry</button>';
               content += '</form>';
             }
@@ -1649,7 +1814,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -1692,6 +1857,18 @@ class PublisherModule {
           return res.status(400).send('An active task for this package and version is already in progress. Wait for it to complete or fail before resubmitting.');
         }
 
+        // Check the repo and branch actually exist before queueing, so a typo is
+        // reported now rather than when the build starts. If GitHub can't be
+        // reached, don't block - the clone will report any real problem.
+        const remote = await gitRemote.checkRemoteBranch(github_org, github_repo, git_branch);
+        if (!remote.ok) {
+          if (remote.unreachable) {
+            this.logger.warn('Could not verify ' + github_org + '/' + github_repo + '#' + git_branch + ' before queueing: ' + remote.error);
+          } else {
+            return res.status(400).send('Invalid task details: ' + remote.error);
+          }
+        }
+
         // Insert task (ID will be auto-generated)
         const result = await new Promise((resolve, reject) => {
           this.db.run(
@@ -1827,7 +2004,7 @@ class PublisherModule {
         res.redirect('/publisher/tasks');
       } catch (error) {
         this.logger.error('Error deleting task:', error);
-        res.status(500).send('Failed to delete task: ' + error.message);
+        res.status(500).type('text/plain').send('Failed to delete task: ' + escape(error.message));
       }
     } finally {
       this.stats.countRequest('delete-task', Date.now() - start);
@@ -1858,7 +2035,7 @@ class PublisherModule {
         res.redirect('/publisher/tasks/' + newTaskId + '/history');
       } catch (error) {
         this.logger.error('Error retrying task:', error);
-        res.status(500).send('Failed to retry task: ' + error.message);
+        res.status(500).type('text/plain').send('Failed to retry task: ' + escape(error.message));
       }
     } finally {
       this.stats.countRequest('retry-task', Date.now() - start);
@@ -1908,6 +2085,9 @@ class PublisherModule {
           let content = '<h3>Task Output: #' + task.id + ' - ' + escape(task.npm_package_id) + '#' + escape(task.version) + '</h3>';
           content += '<p><strong>Status:</strong> <span class="badge bg-' + this.getStatusColor(task.status) + '">' + escape(task.status) + '</span></p>';
           content += '<p><strong>GitHub:</strong> ' + escape(task.github_org) + '/' + escape(task.github_repo) + ' (' + escape(task.git_branch) + ')</p>';
+          if (task.release_url) {
+            content += '<p><strong>Release:</strong> <a href="' + escape(task.release_url) + '" target="_blank" rel="noopener noreferrer">' + escape(task.release_url) + '</a></p>';
+          }
 
           if (task.publisher_version) {
             content += '<p><strong>IG Publisher:</strong> <code>' + escape(task.publisher_version) + '</code></p>';
@@ -1966,7 +2146,7 @@ class PublisherModule {
             templateVars: {
               loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
               loginPath: req.session.userId ? "logout" : 'login',
-              loginAction: req.session.userId ? "POST" : 'GET'
+              loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
             }});
           res.setHeader('Content-Type', 'text/html');
           res.send(html);
@@ -2053,6 +2233,9 @@ class PublisherModule {
         content += '</div>';
         content += '<div class="col-md-6">';
         content += '<p><strong>GitHub:</strong> ' + escape(task.github_org) + '/' + escape(task.github_repo) + ' (' + escape(task.git_branch) + ')</p>';
+        if (task.release_url) {
+          content += '<p><strong>Release:</strong> <a href="' + escape(task.release_url) + '" target="_blank" rel="noopener noreferrer">' + escape(task.release_url) + '</a></p>';
+        }
         content += '<p><strong>Created by:</strong> ' + escape(task.user_name) + ' (' + escape(task.user_login) + ')</p>';
         if (task.approved_by_name) {
           content += '<p><strong>Approved by:</strong> ' + escape(task.approved_by_name) + '</p>';
@@ -2180,7 +2363,7 @@ class PublisherModule {
           content += '<a href="/publisher/tasks/' + task.id + '/qa" class="btn btn-outline-secondary me-2">View QA Report</a>';
         }
         if (req.session.userId && task.status === 'failed') {
-          content += '<form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;" class="me-2">';
+          content += '<form method="post" action="/publisher/tasks/' + task.id + '/retry" style="display: inline;" class="me-2">' + this.csrfField(res);
           content += '<button type="submit" class="btn btn-warning">Retry</button>';
           content += '</form>';
         }
@@ -2194,7 +2377,7 @@ class PublisherModule {
             (detailIsPostApprovalFailed && req.session.isAdmin)
         );
         if (detailCanDelete) {
-          content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" class="me-2" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">';
+          content += '<form method="post" action="/publisher/tasks/' + task.id + '/delete" style="display: inline;" class="me-2" onsubmit="return confirm(\'Delete task #' + task.id + ' and all its build output? This cannot be undone.\')">' + this.csrfField(res);
           content += '<button type="submit" class="btn btn-danger">Delete</button>';
           content += '</form>';
         }
@@ -2205,7 +2388,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -2226,7 +2409,7 @@ class PublisherModule {
       if (!website) return res.status(404).send('Website not found');
 
       let content = '<h3>Edit Website</h3>';
-      content += '<form method="post" action="/publisher/admin/websites/' + website.id + '/edit" class="row g-3">';
+      content += '<form method="post" action="/publisher/admin/websites/' + website.id + '/edit" class="row g-3">' + this.csrfField(res);
       content += '<div class="col-md-4"><label class="form-label">Website Name</label>';
       content += '<input type="text" class="form-control" name="name" value="' + escape(website.name) + '" required></div>';
       content += '<div class="col-md-4"><label class="form-label">Local Folder</label>';
@@ -2246,7 +2429,7 @@ class PublisherModule {
       content += '</form>';
 
       const html = htmlServer.renderPage('publisher', 'Edit Website - FHIR Publisher', content, {
-        templateVars: { loginTitle: (req.session.userName || '') + ' \u2014 Logout', loginPath: 'logout', loginAction: 'POST' }
+        templateVars: { loginTitle: (req.session.userName || '') + ' \u2014 Logout', loginPath: 'logout', loginAction: 'POST', csrfToken: res.locals._csrf || '' }
       });
       res.setHeader('Content-Type', 'text/html');
       res.send(html);
@@ -2297,7 +2480,7 @@ class PublisherModule {
         content += '<button class="btn btn-primary" onclick="document.getElementById(\'add-website-panel\').style.display = document.getElementById(\'add-website-panel\').style.display === \'none\' ? \'block\' : \'none\'">Add New Website</button>';
         content += '<div id="add-website-panel" style="display: none;" class="mt-3">';
         content += '<h3>Add New Website</h3>';
-        content += '<form method="post" action="/publisher/admin/websites" class="row g-3">';
+        content += '<form method="post" action="/publisher/admin/websites" class="row g-3">' + this.csrfField(res);
         content += '<div class="col-md-4">';
         content += '<label for="name" class="form-label">Website Name</label>';
         content += '<input type="text" class="form-control" id="name" name="name" required>';
@@ -2366,7 +2549,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -2426,7 +2609,7 @@ class PublisherModule {
         content += '<button class="btn btn-primary" onclick="document.getElementById(\'add-user-panel\').style.display = document.getElementById(\'add-user-panel\').style.display === \'none\' ? \'block\' : \'none\'">Add New User</button>';
         content += '<div id="add-user-panel" style="display: none;" class="mt-3">';
         content += '<h3>Add New User</h3>';
-        content += '<form method="post" action="/publisher/admin/users" class="row g-3">';
+        content += '<form method="post" action="/publisher/admin/users" class="row g-3">' + this.csrfField(res);
         content += '<div class="col-md-3">';
         content += '<label for="name" class="form-label">Full Name</label>';
         content += '<input type="text" class="form-control" id="name" name="name" required>';
@@ -2471,7 +2654,7 @@ class PublisherModule {
             if (websites.length === 0) {
               content += '<p>No websites available for permission assignment.</p>';
             } else {
-              content += '<form method="post" action="/publisher/admin/permissions">';
+              content += '<form method="post" action="/publisher/admin/permissions">' + this.csrfField(res);
               content += '<input type="hidden" name="user_id" value="' + user.id + '">';
               content += '<div class="permission-grid">';
               content += '<div><strong>Website</strong></div>';
@@ -2508,7 +2691,7 @@ class PublisherModule {
           templateVars: {
             loginTitle: req.session.userId ? (req.session.userName + ' \u2014 Logout') : 'Login',
             loginPath: req.session.userId ? "logout" : 'login',
-            loginAction: req.session.userId ? "POST" : 'GET'
+            loginAction: req.session.userId ? "POST" : 'GET', csrfToken: res.locals._csrf || ''
           }});
         res.setHeader('Content-Type', 'text/html');
         res.send(html);
@@ -2747,10 +2930,12 @@ class PublisherModule {
     await this.logTaskMessage(taskId, 'info', description);
 
     return new Promise((resolve, reject) => {
-      const proc = spawn(command, args, {
-        stdio: ['pipe', 'pipe', 'pipe'],
-        ...options
-      });
+      const spawnOptions = { stdio: ['pipe', 'pipe', 'pipe'], ...options };
+      if (command === 'git') {
+        // never let git block on (or fail obscurely at) a credentials prompt
+        spawnOptions.env = gitRemote.gitEnv(spawnOptions.env || process.env);
+      }
+      const proc = spawn(command, args, spawnOptions);
 
       let stdout = '';
       let stderr = '';

package/registry/registry.js

@@ -721,7 +721,8 @@ class RegistryModule {
    * @returns {string} Formatted URL with edition description
    */
   _describeSnomedEdition(url) {
-    if (!url.startsWith('http://snomed.info/sct')) {
+    // the test edition is published under xsct (http://snomed.info/xsct/31000003106/...)
+    if (!url.startsWith('http://snomed.info/sct') && !url.startsWith('http://snomed.info/xsct')) {
       return url;
     }
 
@@ -745,6 +746,7 @@ class RegistryModule {
     // Match edition code to description
     switch (editionCode) {
       case '900000000000207008': edition = 'Intl'; break;
+      case '31000003106': edition = 'Test'; break; // tx-ecosystem test edition (xsct)
       case '731000124108': edition = 'US'; break;
       case '32506021000036107': edition = 'AU'; break;
       case '449081005': edition = 'ES/Intl'; break;