npm - github-issue-tower-defence-management - Versions diffs - 1.94.2 → 1.94.4 - Mend

github-issue-tower-defence-management 1.94.2 → 1.94.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (33) hide show

package/bin/adapter/entry-points/console/ui-dist/index.html CHANGED Viewed

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>TDPM Console</title>
-    <script type="module" crossorigin src="/assets/index-eSyo3r3C.js"></script>
+    <script type="module" crossorigin src="/assets/index-fKvnL036.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-CO3Vvzqr.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "github-issue-tower-defence-management",
-  "version": "1.94.2",
+  "version": "1.94.4",
   "description": "",
   "main": "bin/index.js",
   "scripts": {

package/src/adapter/entry-points/cli/index.ts CHANGED Viewed

@@ -716,6 +716,7 @@ program
       consoleDataOutputDir,
       inTmuxDataDir,
       dashboardDir,
+      githubToken: token,
       issueRepository,
       resolveProject,
       issueTitleStateCache: new IssueTitleStateCache(),

package/src/adapter/entry-points/console/consoleImageProxy.test.ts ADDED Viewed

@@ -0,0 +1,140 @@
+import {
+  type ImageFetcher,
+  fetchProxiedImage,
+  isAllowedImageUrl,
+} from './consoleImageProxy';
+describe('isAllowedImageUrl', () => {
+  it('allows github user-attachments URLs', () => {
+    expect(
+      isAllowedImageUrl(
+        'https://github.com/user-attachments/assets/0a1b2c3d-4e5f',
+      ),
+    ).toBe(true);
+  });
+  it('allows githubusercontent subdomain URLs', () => {
+    expect(
+      isAllowedImageUrl(
+        'https://private-user-images.githubusercontent.com/1/2.png',
+      ),
+    ).toBe(true);
+  });
+  it('rejects arbitrary external hosts', () => {
+    expect(isAllowedImageUrl('https://example.com/avatar.png')).toBe(false);
+  });
+  it('rejects non-https github paths outside user-attachments', () => {
+    expect(isAllowedImageUrl('https://github.com/HiromiShikata/repo')).toBe(
+      false,
+    );
+  });
+  it('rejects a host that merely contains githubusercontent.com as a suffix trick', () => {
+    expect(isAllowedImageUrl('https://evil-githubusercontent.com/x.png')).toBe(
+      false,
+    );
+  });
+});
+describe('fetchProxiedImage', () => {
+  const successFetcher: ImageFetcher = async (_url, headers) => {
+    expect(headers.Authorization).toBe('token gh-token-value');
+    return {
+      status: 200,
+      contentType: 'image/png',
+      body: Buffer.from([0x89, 0x50, 0x4e, 0x47]),
+    };
+  };
+  it('returns image bytes for an allow-listed url with a valid token', async () => {
+    const result = await fetchProxiedImage(
+      'https://github.com/user-attachments/assets/abc',
+      'gh-token-value',
+      successFetcher,
+    );
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.contentType).toBe('image/png');
+      expect(Array.from(result.body)).toEqual([0x89, 0x50, 0x4e, 0x47]);
+    }
+  });
+  it('rejects a missing url with status 400', async () => {
+    const result = await fetchProxiedImage(
+      '',
+      'gh-token-value',
+      successFetcher,
+    );
+    expect(result).toEqual({
+      ok: false,
+      statusCode: 400,
+      error: 'missing url parameter',
+    });
+  });
+  it('rejects a non-allow-listed url with status 400', async () => {
+    const result = await fetchProxiedImage(
+      'https://example.com/avatar.png',
+      'gh-token-value',
+      successFetcher,
+    );
+    expect(result).toEqual({
+      ok: false,
+      statusCode: 400,
+      error: 'url not in allowed domain',
+    });
+  });
+  it('returns 502 when the upstream responds with a non-2xx status', async () => {
+    const failingFetcher: ImageFetcher = async () => ({
+      status: 404,
+      contentType: null,
+      body: Buffer.alloc(0),
+    });
+    const result = await fetchProxiedImage(
+      'https://github.com/user-attachments/assets/abc',
+      'gh-token-value',
+      failingFetcher,
+    );
+    expect(result).toEqual({
+      ok: false,
+      statusCode: 502,
+      error: 'upstream 404',
+    });
+  });
+  it('returns 502 when the fetcher throws', async () => {
+    const throwingFetcher: ImageFetcher = async () => {
+      throw new Error('network down');
+    };
+    const result = await fetchProxiedImage(
+      'https://github.com/user-attachments/assets/abc',
+      'gh-token-value',
+      throwingFetcher,
+    );
+    expect(result).toEqual({
+      ok: false,
+      statusCode: 502,
+      error: 'proxy error: network down',
+    });
+  });
+  it('falls back to octet-stream content type when upstream omits it', async () => {
+    const noContentTypeFetcher: ImageFetcher = async () => ({
+      status: 200,
+      contentType: null,
+      body: Buffer.from([0x01]),
+    });
+    const result = await fetchProxiedImage(
+      'https://private-user-images.githubusercontent.com/1/2',
+      'gh-token-value',
+      noContentTypeFetcher,
+    );
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.contentType).toBe('application/octet-stream');
+    }
+  });
+});

package/src/adapter/entry-points/console/consoleImageProxy.ts ADDED Viewed

@@ -0,0 +1,111 @@
+const GITHUBUSERCONTENT_HOST_SUFFIX = '.githubusercontent.com';
+const isAllowedHost = (hostname: string): boolean => {
+  if (hostname === 'github.com') {
+    return true;
+  }
+  if (!hostname.endsWith(GITHUBUSERCONTENT_HOST_SUFFIX)) {
+    return false;
+  }
+  const subdomain = hostname.slice(
+    0,
+    hostname.length - GITHUBUSERCONTENT_HOST_SUFFIX.length,
+  );
+  return subdomain.length > 0 && /^[a-z0-9][a-z0-9.-]*$/.test(subdomain);
+};
+const parseAllowedImageUrl = (url: string): URL | null => {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== 'https:') {
+    return null;
+  }
+  if (parsed.hostname === 'github.com') {
+    return parsed.pathname.startsWith('/user-attachments/') ? parsed : null;
+  }
+  return isAllowedHost(parsed.hostname) ? parsed : null;
+};
+export const isAllowedImageUrl = (url: string): boolean =>
+  parseAllowedImageUrl(url) !== null;
+export type ProxiedImageSuccess = {
+  ok: true;
+  contentType: string;
+  body: Buffer;
+};
+export type ProxiedImageFailure = {
+  ok: false;
+  statusCode: number;
+  error: string;
+};
+export type ProxiedImageResult = ProxiedImageSuccess | ProxiedImageFailure;
+export type ImageFetcher = (
+  url: string,
+  headers: Record<string, string>,
+) => Promise<{
+  status: number;
+  contentType: string | null;
+  body: Buffer;
+}>;
+const defaultImageFetcher: ImageFetcher = async (url, headers) => {
+  const validated = parseAllowedImageUrl(url);
+  if (validated === null) {
+    throw new Error('url not in allowed domain');
+  }
+  const safeUrl = `https://${validated.host}${validated.pathname}${validated.search}`;
+  const response = await fetch(safeUrl, { headers, redirect: 'follow' });
+  const arrayBuffer = await response.arrayBuffer();
+  return {
+    status: response.status,
+    contentType: response.headers.get('content-type'),
+    body: Buffer.from(arrayBuffer),
+  };
+};
+export const fetchProxiedImage = async (
+  url: string,
+  githubToken: string,
+  fetcher: ImageFetcher = defaultImageFetcher,
+): Promise<ProxiedImageResult> => {
+  if (url.length === 0) {
+    return { ok: false, statusCode: 400, error: 'missing url parameter' };
+  }
+  const allowedUrl = parseAllowedImageUrl(url);
+  if (allowedUrl === null) {
+    return { ok: false, statusCode: 400, error: 'url not in allowed domain' };
+  }
+  let result: {
+    status: number;
+    contentType: string | null;
+    body: Buffer;
+  };
+  try {
+    result = await fetcher(allowedUrl.toString(), {
+      Authorization: `token ${githubToken}`,
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    return { ok: false, statusCode: 502, error: `proxy error: ${detail}` };
+  }
+  if (result.status < 200 || result.status >= 300) {
+    return {
+      ok: false,
+      statusCode: 502,
+      error: `upstream ${result.status}`,
+    };
+  }
+  return {
+    ok: true,
+    contentType: result.contentType ?? 'application/octet-stream',
+    body: result.body,
+  };
+};

package/src/adapter/entry-points/console/consoleServer.test.ts CHANGED Viewed

@@ -15,6 +15,7 @@ import {
   resolveDashboardFilePath,
   startConsoleServer,
 } from './consoleServer';
+import type { ImageFetcher } from './consoleImageProxy';
 import { IssueTitleStateCache } from './consoleReadApi';
 import { readDoneProjectItemIds } from './consoleDoneStore';
 import { IssueRepository } from '../../../domain/usecases/adapter-interfaces/IssueRepository';
@@ -1131,3 +1132,184 @@ describe('consoleServer dashboard /tdpm.txt route integration', () => {
     }
   });
 });
+describe('consoleServer image proxy', () => {
+  const testToken = 'image-proxy-token-value';
+  const githubToken = 'gh-token-value';
+  const allowedUrl = 'https://github.com/user-attachments/assets/abc-123';
+  const pngBytes = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a]);
+  const stubFetcher: ImageFetcher = async () => ({
+    status: 200,
+    contentType: 'image/png',
+    body: pngBytes,
+  });
+  const closeServer = (server: http.Server): Promise<void> =>
+    new Promise((resolve, reject) => {
+      server.close((error) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+        resolve();
+      });
+    });
+  const requestImage = (
+    server: http.Server,
+    requestPath: string,
+  ): Promise<{
+    statusCode: number;
+    contentType: string | undefined;
+    contentLength: string | undefined;
+    cacheControl: string | undefined;
+    body: Buffer;
+  }> => {
+    const address = server.address();
+    if (address === null || typeof address === 'string') {
+      throw new Error('server is not listening on a TCP port');
+    }
+    const port = address.port;
+    return new Promise((resolve, reject) => {
+      const request = http.request(
+        { host: '127.0.0.1', port, path: requestPath, method: 'GET' },
+        (response) => {
+          const chunks: Uint8Array[] = [];
+          response.on('data', (chunk: Uint8Array) => chunks.push(chunk));
+          response.on('end', () => {
+            resolve({
+              statusCode: response.statusCode ?? 0,
+              contentType: response.headers['content-type'],
+              contentLength: response.headers['content-length'],
+              cacheControl: response.headers['cache-control'],
+              body: Buffer.concat(chunks),
+            });
+          });
+        },
+      );
+      request.on('error', reject);
+      request.end();
+    });
+  };
+  const startProxyServer = (
+    fetcher: ImageFetcher | null = stubFetcher,
+    token: string | null = githubToken,
+  ): Promise<{ server: http.Server; tmpDir: string }> =>
+    (async () => {
+      const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'console-server-'));
+      const server = await startConsoleServer({
+        accessToken: testToken,
+        uiDistDir: path.join(tmpDir, 'ui-dist'),
+        consoleDataOutputDir: null,
+        inTmuxDataDir: null,
+        dashboardDir: null,
+        githubToken: token,
+        imageFetcher: fetcher,
+        port: 0,
+      });
+      return { server, tmpDir };
+    })();
+  it('returns image bytes for an allow-listed url with a valid token', async () => {
+    const { server, tmpDir } = await startProxyServer();
+    try {
+      const response = await requestImage(
+        server,
+        `/api/img?url=${encodeURIComponent(allowedUrl)}&k=${testToken}`,
+      );
+      expect(response.statusCode).toBe(200);
+      expect(response.contentType).toBe('image/png');
+      expect(response.contentLength).toBe(String(pngBytes.length));
+      expect(response.cacheControl).toBe('private, max-age=300');
+      expect(Array.from(response.body)).toEqual(Array.from(pngBytes));
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+  it('rejects a non-allow-listed url with 400', async () => {
+    const { server, tmpDir } = await startProxyServer();
+    try {
+      const response = await requestImage(
+        server,
+        `/api/img?url=${encodeURIComponent('https://example.com/x.png')}&k=${testToken}`,
+      );
+      expect(response.statusCode).toBe(400);
+      expect(response.body.toString('utf-8')).toContain(
+        'not in allowed domain',
+      );
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+  it('rejects a request without a token with 401', async () => {
+    const { server, tmpDir } = await startProxyServer();
+    try {
+      const response = await requestImage(
+        server,
+        `/api/img?url=${encodeURIComponent(allowedUrl)}`,
+      );
+      expect(response.statusCode).toBe(401);
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+  it('rejects a request with an invalid token with 401', async () => {
+    const { server, tmpDir } = await startProxyServer();
+    try {
+      const response = await requestImage(
+        server,
+        `/api/img?url=${encodeURIComponent(allowedUrl)}&k=wrong-token`,
+      );
+      expect(response.statusCode).toBe(401);
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+  it('returns 502 when the github token is not configured', async () => {
+    const { server, tmpDir } = await startProxyServer(stubFetcher, null);
+    try {
+      const response = await requestImage(
+        server,
+        `/api/img?url=${encodeURIComponent(allowedUrl)}&k=${testToken}`,
+      );
+      expect(response.statusCode).toBe(502);
+      expect(response.body.toString('utf-8')).toContain(
+        'github token is not configured',
+      );
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+  it('returns 502 when the upstream image fetch fails', async () => {
+    const failingFetcher: ImageFetcher = async () => ({
+      status: 404,
+      contentType: null,
+      body: Buffer.alloc(0),
+    });
+    const { server, tmpDir } = await startProxyServer(failingFetcher);
+    try {
+      const response = await requestImage(
+        server,
+        `/api/img?url=${encodeURIComponent(allowedUrl)}&k=${testToken}`,
+      );
+      expect(response.statusCode).toBe(502);
+      expect(response.body.toString('utf-8')).toContain('upstream 404');
+    } finally {
+      await closeServer(server);
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/adapter/entry-points/console/consoleServer.ts CHANGED Viewed

@@ -24,6 +24,7 @@ import {
   handleReview,
   handleTriage,
 } from './consoleOperationApi';
+import { ImageFetcher, fetchProxiedImage } from './consoleImageProxy';
 export const DEFAULT_CONSOLE_PORT = 9981;
@@ -156,6 +157,8 @@ export type ConsoleServerOptions = {
   consoleDataOutputDir: string | null;
   inTmuxDataDir: string | null;
   dashboardDir: string | null;
+  githubToken?: string | null;
+  imageFetcher?: ImageFetcher | null;
   issueRepository?: IssueRepository | null;
   resolveProject?: ConsoleProjectResolver | null;
   issueTitleStateCache?: IssueTitleStateCache | null;
@@ -167,6 +170,8 @@ const FLAT_IN_TMUX_FILE = /^[A-Za-z0-9._-]+\.json$/;
 export const DASHBOARD_REQUEST_PATH = '/tdpm.txt';
+export const IMAGE_PROXY_REQUEST_PATH = '/api/img';
 const DASHBOARD_FILE_NAME = 'tdpm.txt';
 export const resolveDashboardFilePath = (
@@ -259,6 +264,42 @@ const sendJson = (
   response.end(JSON.stringify(body));
 };
+const sendImage = (
+  response: http.ServerResponse,
+  contentType: string,
+  body: Buffer,
+): void => {
+  response.writeHead(200, {
+    'Content-Type': contentType,
+    'Content-Length': String(body.length),
+    'Cache-Control': 'private, max-age=300',
+  });
+  response.end(body);
+};
+const handleImageProxy = async (
+  options: ConsoleServerOptions,
+  response: http.ServerResponse,
+  searchParams: URLSearchParams,
+): Promise<void> => {
+  const githubToken = options.githubToken ?? null;
+  if (githubToken === null || githubToken.length === 0) {
+    sendJson(response, 502, { error: 'github token is not configured' });
+    return;
+  }
+  const url = searchParams.get('url') ?? '';
+  const result = await fetchProxiedImage(
+    url,
+    githubToken,
+    options.imageFetcher ?? undefined,
+  );
+  if (!result.ok) {
+    sendJson(response, result.statusCode, { error: result.error });
+    return;
+  }
+  sendImage(response, result.contentType, result.body);
+};
 const sendDataResponse = (
   response: http.ServerResponse,
   statusCode: number,
@@ -371,6 +412,10 @@ const handleTokenedRequest = async (
   if (requestPath.startsWith('/api/')) {
     if (method === 'GET') {
+      if (requestPath === IMAGE_PROXY_REQUEST_PATH) {
+        await handleImageProxy(options, response, searchParams);
+        return;
+      }
       const readResult = await handleReadApi(
         options,
         requestPath,

package/src/adapter/entry-points/console/consoleUiDistSync.test.ts ADDED Viewed

@@ -0,0 +1,66 @@
+import * as fs from 'fs';
+import * as path from 'path';
+const repoRoot = path.resolve(__dirname, '..', '..', '..', '..');
+const srcUiDistDir = path.join(
+  repoRoot,
+  'src',
+  'adapter',
+  'entry-points',
+  'console',
+  'ui-dist',
+);
+const binUiDistDir = path.join(
+  repoRoot,
+  'bin',
+  'adapter',
+  'entry-points',
+  'console',
+  'ui-dist',
+);
+const listFilesRecursively = (dir: string): string[] => {
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  return entries
+    .flatMap((entry) => {
+      const fullPath = path.join(dir, entry.name);
+      return entry.isDirectory() ? listFilesRecursively(fullPath) : [fullPath];
+    })
+    .sort();
+};
+const relativePaths = (dir: string): string[] =>
+  listFilesRecursively(dir).map((file) => path.relative(dir, file));
+describe('console ui-dist served bundle synchronization', () => {
+  it('has the same file set in bin/ui-dist as in src/ui-dist', () => {
+    expect(relativePaths(binUiDistDir)).toEqual(relativePaths(srcUiDistDir));
+  });
+  it('has byte-identical files in bin/ui-dist and src/ui-dist', () => {
+    for (const relativePath of relativePaths(srcUiDistDir)) {
+      const srcContent = fs
+        .readFileSync(path.join(srcUiDistDir, relativePath))
+        .toString('base64');
+      const binContent = fs
+        .readFileSync(path.join(binUiDistDir, relativePath))
+        .toString('base64');
+      expect(binContent).toBe(srcContent);
+    }
+  });
+  it('serves bundle assets that read the API from the server root, never via a relative path', () => {
+    const assetsDir = path.join(binUiDistDir, 'assets');
+    const scriptFiles = fs
+      .readdirSync(assetsDir)
+      .filter((name) => name.endsWith('.js'));
+    expect(scriptFiles.length).toBeGreaterThan(0);
+    for (const scriptFile of scriptFiles) {
+      const content = fs.readFileSync(
+        path.join(assetsDir, scriptFile),
+        'utf-8',
+      );
+      expect(content).not.toMatch(/\.\/api\//);
+    }
+  });
+});

package/src/adapter/entry-points/console/ui/src/features/console/components/content/ConsoleMarkdownContent.stories.tsx CHANGED Viewed

@@ -1,6 +1,8 @@
 import type { Meta, StoryObj } from '@storybook/react-vite';
+import { buildImageProxyUrl } from '../../lib/imageProxy';
 import {
   consoleMarkdownBodyFixture,
+  consoleMarkdownImageBodyFixture,
   consoleMermaidBodyFixture,
 } from '../../testing/fixtures';
 import { ConsoleMarkdownContent } from './ConsoleMarkdownContent';
@@ -22,6 +24,14 @@ export const WithMermaidFence: Story = {
   args: { body: consoleMermaidBodyFixture },
 };
+export const WithProxiedGitHubImages: Story = {
+  args: {
+    body: consoleMarkdownImageBodyFixture,
+    buildImageProxyUrl: (src) =>
+      buildImageProxyUrl(src, 'console-token-fixture'),
+  },
+};
 export const Empty: Story = {
   args: { body: '' },
 };

package/src/adapter/entry-points/console/ui/src/features/console/components/content/ConsoleMarkdownContent.tsx CHANGED Viewed

@@ -1,4 +1,8 @@
 import { useEffect, useMemo, useRef } from 'react';
+import {
+  type ImageProxyUrlBuilder,
+  rewriteGitHubImageSources,
+} from '../../lib/imageProxy';
 import {
   renderMarkdownToSafeHtml,
   splitMarkdownSegments,
@@ -7,16 +11,25 @@ import { ConsoleMermaidDiagram } from './ConsoleMermaidDiagram';
 export type ConsoleMarkdownViewProps = {
   body: string;
+  buildImageProxyUrl?: ImageProxyUrlBuilder;
 };
 type ConsoleMarkdownHtmlBlockProps = {
   source: string;
+  buildImageProxyUrl?: ImageProxyUrlBuilder;
 };
 const ConsoleMarkdownHtmlBlock = ({
   source,
+  buildImageProxyUrl,
 }: ConsoleMarkdownHtmlBlockProps) => {
-  const html = useMemo(() => renderMarkdownToSafeHtml(source), [source]);
+  const html = useMemo(() => {
+    const safeHtml = renderMarkdownToSafeHtml(source);
+    if (buildImageProxyUrl === undefined) {
+      return safeHtml;
+    }
+    return rewriteGitHubImageSources(safeHtml, buildImageProxyUrl);
+  }, [source, buildImageProxyUrl]);
   const containerRef = useRef<HTMLDivElement>(null);
   useEffect(() => {
@@ -29,7 +42,10 @@ const ConsoleMarkdownHtmlBlock = ({
   return <div ref={containerRef} className="console-markdown" />;
 };
-export const ConsoleMarkdownContent = ({ body }: ConsoleMarkdownViewProps) => {
+export const ConsoleMarkdownContent = ({
+  body,
+  buildImageProxyUrl,
+}: ConsoleMarkdownViewProps) => {
   const segments = useMemo(() => splitMarkdownSegments(body), [body]);
   if (body.trim() === '') {
@@ -42,7 +58,11 @@ export const ConsoleMarkdownContent = ({ body }: ConsoleMarkdownViewProps) => {
         segment.kind === 'mermaid' ? (
           <ConsoleMermaidDiagram key={segment.key} code={segment.code} />
         ) : (
-          <ConsoleMarkdownHtmlBlock key={segment.key} source={segment.source} />
+          <ConsoleMarkdownHtmlBlock
+            key={segment.key}
+            source={segment.source}
+            buildImageProxyUrl={buildImageProxyUrl}
+          />
         ),
       )}
     </div>