gcb-host 0.0.0 → 0.0.2

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# gcb-host
+
+## 0.0.2
+
+### Patch Changes
+
+- [#43](https://github.com/code-vaults/git-credential-broker/pull/43) [`92a28e4`](https://github.com/code-vaults/git-credential-broker/commit/92a28e4ed8d1048ec1d712ea47ea3c32dc65f18a) Thanks [@JounQin](https://github.com/JounQin)! - Default `gcb probe` and `gcb logs` to `github.com`, name the rendered sidecar file
+  `docker-compose.yml` in the deployment directory, and document the deployment layout and the
+  `--user` requirement.
+
+- [#40](https://github.com/code-vaults/git-credential-broker/pull/40) [`25b46e3`](https://github.com/code-vaults/git-credential-broker/commit/25b46e33aabf29540df1aeddb72e43947f9a4da8) Thanks [@JounQin](https://github.com/JounQin)! - Read one pull request review with `gcb pr review --number <n> --id <id>`.
+  
+  When `--jq` is used, the action token is kept in the isolated gh config instead of the
+  environment, so the expression cannot print it.
+- Updated dependencies [[`25b46e3`](https://github.com/code-vaults/git-credential-broker/commit/25b46e33aabf29540df1aeddb72e43947f9a4da8)]:
+  - gcb-core@0.0.2
+
+## 0.0.1
+
+### Patch Changes
+
+- [#33](https://github.com/code-vaults/git-credential-broker/pull/33) [`4bab834`](https://github.com/code-vaults/git-credential-broker/commit/4bab834c781e6175b6b6e588ad542fa09d532be7) Thanks [@JounQin](https://github.com/JounQin)! - Prepare the first public release of the renamed packages.
+- Updated dependencies [[`4bab834`](https://github.com/code-vaults/git-credential-broker/commit/4bab834c781e6175b6b6e588ad542fa09d532be7)]:
+  - gcb-core@0.0.1

package/bin/gcb.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { runCli } from 'gcb-core';
+import { hostBackend } from 'gcb-host';
+
+process.exitCode = await runCli(process.argv.slice(2), hostBackend);

package/lib/audit.d.ts

@@ -0,0 +1,25 @@
+import type { AuditSink } from 'gcb-core';
+/** Options for {@link createAudit}. */
+export interface AuditOptions {
+    /** Log path; omitted or null means "log nothing to disk". */
+    path?: string | null;
+    /** Clock, injectable for tests. */
+    now?: () => number;
+    /** Where write failures are reported. */
+    stderr?: NodeJS.WritableStream;
+}
+/**
+ * Remove secret-looking fields from one audit record.
+ *
+ * @param event - the record a caller wants to log.
+ * @returns the record with secret-bearing keys replaced by `<redacted>`.
+ */
+export declare function redact(event: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Create the audit sink.
+ *
+ * @param options - sink options.
+ * @returns the sink; a null path yields a sink that writes nothing.
+ */
+export declare function createAudit(options?: AuditOptions): AuditSink;
+//# sourceMappingURL=audit.d.ts.map

package/lib/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAY1C,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;CAChC;AAGD;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAM9E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAE,YAAiB,GAAG,SAAS,CAkCjE"}

package/lib/audit.js

@@ -0,0 +1,73 @@
+/**
+ * Append-only audit log for credential decisions.
+ *
+ * The log records *that* a credential was issued and for which repository, never the
+ * credential itself: callers pass only a short SHA-256 fingerprint. A defensive redaction
+ * pass drops any secret-looking key a future caller might add by accident, and the file is
+ * created 0600 so it stays broker-owned.
+ */
+import { chmodSync, closeSync, createWriteStream, mkdirSync, openSync } from 'node:fs';
+import { dirname } from 'node:path';
+/**
+ * Keys whose values must never reach the audit log.
+ *
+ * `token_fingerprint` is deliberately exempt: it is a hash, not a credential, and it is the
+ * whole point of the allow records. Without the negative lookahead the `^token` branch would
+ * swallow it, and the operator would lose the ability to correlate a grant with a later
+ * event — a real bug this pattern previously had.
+ */
+const FORBIDDEN_KEY_RE = /pass(word)?|secret|^token(?!_fingerprint)|token$|credential/i;
+/**
+ * Remove secret-looking fields from one audit record.
+ *
+ * @param event - the record a caller wants to log.
+ * @returns the record with secret-bearing keys replaced by `<redacted>`.
+ */
+export function redact(event) {
+    const out = {};
+    for (const [key, value] of Object.entries(event)) {
+        out[key] = FORBIDDEN_KEY_RE.test(key) ? '<redacted>' : value;
+    }
+    return out;
+}
+/**
+ * Create the audit sink.
+ *
+ * @param options - sink options.
+ * @returns the sink; a null path yields a sink that writes nothing.
+ */
+export function createAudit(options = {}) {
+    const { path = null, now = () => Date.now(), stderr = process.stderr } = options;
+    let stream = null;
+    if (path) {
+        mkdirSync(dirname(path), { recursive: true });
+        // Create, restrict, then append through the stream. The mode passed to a create call is
+        // advisory on an ACL-based share, which would leave the audit trail writable by other local
+        // users — and an audit trail someone else can append to is not an audit trail.
+        closeSync(openSync(path, 'a', 0o600));
+        chmodSync(path, 0o600);
+        stream = createWriteStream(path, { flags: 'a', mode: 0o600 });
+        stream.on('error', (error) => {
+            stderr.write(`gcb daemon: audit write failed: ${error.message}\n`);
+        });
+    }
+    return {
+        path,
+        record(event) {
+            if (!stream)
+                return;
+            stream.write(`${JSON.stringify({ ts: new Date(now()).toISOString(), ...redact(event) })}\n`);
+        },
+        close() {
+            const target = stream;
+            return new Promise((resolve) => {
+                if (!target) {
+                    resolve();
+                    return;
+                }
+                target.end(resolve);
+            });
+        },
+    };
+}
+//# sourceMappingURL=audit.js.map

package/lib/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,iBAAiB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEvF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,8DAA8D,CAAC;AAaxF;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,KAA8B;IACnD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAO,GAAiB,EAAE;IACpD,MAAM,EAAE,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC;IAEjF,IAAI,MAAM,GAAuB,IAAI,CAAC;IACtC,IAAI,IAAI,EAAE,CAAC;QACT,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,wFAAwF;QACxF,4FAA4F;QAC5F,+EAA+E;QAC/E,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACtC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,CAAC,KAA8B;YACnC,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK;YACH,MAAM,MAAM,GAAG,MAAM,CAAC;YACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC7B,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/broker.d.ts

@@ -0,0 +1,61 @@
+import type { AuditSink, BrokerConfig, Provider, WireResponse } from 'gcb-core';
+/** Reported by the `ping` operation so the container side can prove what it reached. */
+export declare const BROKER_VERSION: string;
+/** Response codes returned to the helper. */
+export declare const CODES: {
+    readonly BAD_REQUEST: 'bad-request';
+    readonly PROTOCOL_NOT_HTTPS: 'protocol-not-https';
+    readonly HOST_NOT_ALLOWED: 'host-not-allowed';
+    readonly PATH_REQUIRED: 'path-required';
+    readonly REPO_NOT_ALLOWED: 'repo-not-allowed';
+    readonly PROVIDER_ERROR: 'provider-error';
+};
+/** Options for {@link createRequestHandler}. */
+export interface RequestHandlerOptions {
+    readonly config: BrokerConfig;
+    readonly audit: AuditSink;
+    readonly providers: ReadonlyMap<string, Provider>;
+    /** Host-side diagnostics sink; never seen by the caller. */
+    readonly log?: (message: string) => void;
+}
+/**
+ * Make the socket path safe to bind.
+ *
+ * A stale socket left by a crashed broker is removed. Anything else at that path — a
+ * symlink, a regular file, a directory — is refused rather than overwritten, because the path
+ * may sit in a directory the agent container can write to. The containing directory is checked
+ * for the same reason: a symlinked directory would let the container choose where the socket
+ * gets bound.
+ *
+ * @param socketPath - the configured socket path.
+ * @throws {Error} when the path exists and is not a stale socket, or the directory is a symlink.
+ */
+export declare function prepareSocketPath(socketPath: string): void;
+/**
+ * Build the request handler. Kept separate from the server so it can be unit-tested without
+ * a socket.
+ *
+ * @param options - handler options.
+ * @returns the handler.
+ */
+export declare function createRequestHandler(options: RequestHandlerOptions): (message: Record<string, unknown>) => Promise<WireResponse>;
+/** Options for {@link startBroker}. */
+export interface StartBrokerOptions {
+    readonly config: BrokerConfig;
+    readonly audit: AuditSink;
+    readonly providers: ReadonlyMap<string, Provider>;
+    readonly log?: (message: string) => void;
+}
+/** A running broker. */
+export interface RunningBroker {
+    readonly socketPath: string;
+    close(): Promise<void>;
+}
+/**
+ * Start the broker.
+ *
+ * @param options - server options.
+ * @returns the running broker.
+ */
+export declare function startBroker(options: StartBrokerOptions): Promise<RunningBroker>;
+//# sourceMappingURL=broker.d.ts.map

package/lib/broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"broker.d.ts","sourceRoot":"","sources":["../src/broker.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAgB,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE9F,wFAAwF;AACxF,eAAO,MAAM,cAAc,QAAkB,CAAC;AAS9C,6CAA6C;AAC7C,eAAO,MAAM,KAAK;aAChB,WAAW,EAAE,aAAa;aAC1B,kBAAkB,EAAE,oBAAoB;aACxC,gBAAgB,EAAE,kBAAkB;aACpC,aAAa,EAAE,eAAe;aAC9B,gBAAgB,EAAE,kBAAkB;aACpC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAUX,gDAAgD;AAChD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,4DAA4D;IAC5D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAkC1D;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,qBAAqB,GAC7B,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,YAAY,CAAC,CAqb7D;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAED,wBAAwB;AACxB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC,CAsErF"}