gitroots 0.5.0 → 0.6.0

package/src/config.js

@@ -0,0 +1,66 @@
+// Where gitroots keeps its settings and sign-in.
+//   ~/.gitroots/config.json   server, user, chosen workspace (no secrets)
+//   token                     macOS Keychain, or ~/.gitroots/credentials.json (mode 600) elsewhere
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+export const DEFAULT_SERVER = process.env.GITROOTS_SERVER || 'https://gitroots.com';
+
+export function home() {
+  return process.env.GITROOTS_HOME || path.join(os.homedir(), '.gitroots');
+}
+
+const file = (name) => path.join(home(), name);
+
+function readJson(name, fallback) {
+  try { return JSON.parse(fs.readFileSync(file(name), 'utf8')); } catch { return fallback; }
+}
+
+function writeJson(name, data) {
+  fs.mkdirSync(home(), { recursive: true });
+  fs.writeFileSync(file(name), JSON.stringify(data, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(file(name), 0o600); } catch { /* windows */ }
+}
+
+export function readConfig() { return readJson('config.json', {}); }
+export function writeConfig(cfg) { writeJson('config.json', cfg); }
+export function updateConfig(patch) { const c = { ...readConfig(), ...patch }; writeConfig(c); return c; }
+
+const useKeychain = () => process.platform === 'darwin' && !process.env.GITROOTS_NO_KEYCHAIN;
+const service = (server) => `gitroots-cli:${server}`;
+
+export function saveToken(server, username, token) {
+  if (useKeychain()) {
+    const r = spawnSync('security', ['add-generic-password', '-U', '-a', username, '-s', service(server), '-w', token], { stdio: 'ignore' });
+    if (r.status === 0) return 'keychain';
+  }
+  const all = readJson('credentials.json', {});
+  all[`${username}@${server}`] = token;
+  writeJson('credentials.json', all);
+  return 'file';
+}
+
+export function loadToken(server, username) {
+  if (process.env.GITROOTS_TOKEN) return process.env.GITROOTS_TOKEN;
+  if (!server || !username) return null;
+  if (useKeychain()) {
+    const r = spawnSync('security', ['find-generic-password', '-a', username, '-s', service(server), '-w'], { encoding: 'utf8' });
+    if (r.status === 0) return r.stdout.replace(/\n$/, '');
+  }
+  return readJson('credentials.json', {})[`${username}@${server}`] || null;
+}
+
+export function forgetToken(server, username) {
+  if (process.platform === 'darwin') spawnSync('security', ['delete-generic-password', '-a', username, '-s', service(server)], { stdio: 'ignore' });
+  const all = readJson('credentials.json', {});
+  delete all[`${username}@${server}`];
+  writeJson('credentials.json', all);
+}
+
+// Small local caches (branch rules for the push hook, command history).
+export function readCache(name, fallback) { return readJson(`cache-${name}.json`, fallback); }
+export function writeCache(name, data) { try { writeJson(`cache-${name}.json`, data); } catch { /* read-only home */ } }
+
+export function historyFile() { return file('history'); }

package/src/rules.js

@@ -0,0 +1,88 @@
+// Branch rules for the repo being pushed, from (in order):
+//   1. gitroots: the workspace's branch rules for this GitHub repo (cached for offline pushes)
+//   2. .gitroots.json at the repo root: { "protected": ["main", "release/*"], "paths": [{ "pattern": "infra/**", "needs": "an ops review" }] }
+import fs from 'node:fs';
+import path from 'node:path';
+import { tryGit } from './git/checks.js';
+import { readCache, writeCache, readConfig } from './config.js';
+
+export function remoteFullName(url) {
+  if (!url) return null;
+  const m = /github\.com[:/]+([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(url.trim());
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
+export function globMatch(pattern, value) {
+  const re = new RegExp(`^${pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*/g, '\u0000')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\u0000/g, '.*')
+    .replace(/\?/g, '.')}$`);
+  return re.test(value);
+}
+
+function localConfig(top) {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(top, '.gitroots.json'), 'utf8'));
+    return {
+      rules: (cfg.protected || []).map((p) => ({ pattern: p, level: 'protected', allow_direct_push: false, required_approvals: 0, description: 'No direct pushes · .gitroots.json' })),
+      paths: (cfg.paths || []).map((p) => (typeof p === 'string' ? { pattern: p, needs: 'a review' } : p)),
+      suggest: cfg.suggest,
+    };
+  } catch { return null; }
+}
+
+/** Rules for the repository at cwd. api is optional; with it, rules are refreshed from gitroots. */
+export async function loadRules(cwd, { api = null, timeout = 3000 } = {}) {
+  const top = tryGit(['rev-parse', '--show-toplevel'], cwd);
+  if (!top) return { source: 'none', repo: null, rules: [], paths: [] };
+  const url = tryGit(['remote', 'get-url', 'origin'], cwd);
+  const fullName = remoteFullName(url);
+  const local = localConfig(top);
+  const cache = readCache('rules', {});
+  let source = 'none';
+  let rules = [];
+  if (fullName && api && api.signedIn) {
+    try {
+      const d = await api.repo(fullName, { timeout });
+      rules = d.branch_rules || [];
+      cache[fullName.toLowerCase()] = { rules, at: new Date().toISOString(), org: api.orgId };
+      writeCache('rules', cache);
+      source = 'gitroots';
+    } catch (e) {
+      if (e.status === 404) { delete cache[fullName.toLowerCase()]; writeCache('rules', cache); }
+    }
+  }
+  if (source === 'none' && fullName && cache[fullName.toLowerCase()]) {
+    rules = cache[fullName.toLowerCase()].rules;
+    source = 'cache';
+  }
+  if (local) {
+    rules = [...rules, ...local.rules];
+    if (source === 'none') source = '.gitroots.json';
+  }
+  return { source, repo: fullName || path.basename(top), top, rules, paths: local ? local.paths : [], suggest: local?.suggest };
+}
+
+export function ruleFor(rules, branch) {
+  return rules.find((r) => r.pattern === branch) || rules.find((r) => globMatch(r.pattern, branch)) || null;
+}
+
+const LEAD_ROLES = new Set(['owner', 'lead', 'admin']);
+
+/** Is a direct push of `branch` allowed? */
+export function decide(set, branch) {
+  const rule = ruleFor(set.rules, branch);
+  if (!rule) return { blocked: false, rule: null, label: set.source === 'none' ? 'no rules for this repo' : `${branch} · no rule, developers can push` };
+  const role = (readConfig().org?.role || '').toLowerCase();
+  const label = `${rule.pattern}: ${rule.description || rule.level}`;
+  if (rule.allow_direct_push === false) {
+    const needs = rule.required_approvals ? `, it needs ${rule.required_approvals} approval${rule.required_approvals > 1 ? 's' : ''}` : '';
+    return { blocked: true, rule, label, suggest: set.suggest || `push to a feature branch, then open a pull request into ${branch}${needs}` };
+  }
+  if (rule.level === 'leads' && !LEAD_ROLES.has(role)) {
+    return { blocked: true, rule, label, suggest: 'only workspace leads push here · push to a feature branch and ask a lead to merge' };
+  }
+  return { blocked: false, rule, label };
+}

package/src/runtime.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
-export const VERSION = '0.5.0';
+export const VERSION = '0.6.0';
 
 // Default download location for install.sh / gitroots update. Override with GITROOTS_DOWNLOAD_BASE.
 export const DOWNLOAD_BASE = process.env.GITROOTS_DOWNLOAD_BASE || 'https://gitroots.com/cli';

package/src/session/account.js

@@ -0,0 +1,133 @@
+// /login · /logout · /whoami · /workspace
+import os from 'node:os';
+import { spawn } from 'node:child_process';
+import { Api, ApiError } from '../api.js';
+import { DEFAULT_SERVER, readConfig, writeConfig, updateConfig, saveToken, forgetToken } from '../config.js';
+import { select, interactive, spinner, sleep } from '../ui/term.js';
+import { json } from '../ui/components.js';
+import { c, line, pad, next, needSignIn, load, cmdText } from './helpers.js';
+
+function openBrowser(url) {
+  const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+    child.on('error', () => {});
+    child.unref();
+    return true;
+  } catch { return false; }
+}
+
+async function pickWorkspace(ctx, workspaces, current) {
+  if (!workspaces.length) return null;
+  if (workspaces.length === 1 || !interactive() || ctx.json) return workspaces.find((w) => w.id === current) || workspaces[0];
+  line(`${c.i(c.b('?'))} Which workspace?`);
+  const start = Math.max(0, workspaces.findIndex((w) => w.id === current));
+  const res = await select({
+    count: workspaces.length,
+    initial: start,
+    render: (i) => workspaces.map((w, j) => `${j === i ? c.g('❯ ') : '  '}${j === i ? c.b(pad(w.name, 32)) : pad(w.name, 32)}${c.m(`${w.slug}${w.role ? ` · ${w.role}` : ''}`)}`).join('\n'),
+  });
+  if (res.action === 'cancel') return null;
+  return workspaces[res.index];
+}
+
+function roleOf(ws, me) {
+  const m = (me.memberships || []).find((x) => x.organization === ws.id);
+  return m ? m.role : ws.role_flags?.is_admin ? 'admin' : 'member';
+}
+
+function workspaceList(me) {
+  return (me.workspaces || []).map((w) => ({ id: w.id, name: w.name, slug: w.slug, role: roleOf(w, me) }));
+}
+
+export async function login(ctx, args, flags) {
+  const server = String(flags.server || readConfig().server || DEFAULT_SERVER).replace(/\/+$/, '');
+  const anon = new Api({ server });
+  const start = await load(ctx, `Contacting ${anon.host}…`, () => anon.authStart(`gitroots CLI on ${os.hostname().replace(/\.local$/, '')}`));
+  line();
+  line(`  Sign in by approving this code in your browser:`);
+  line();
+  line(`      ${c.b(c.g(start.user_code))}`);
+  line();
+  const opened = !flags['no-browser'] && interactive() && openBrowser(start.verification_url);
+  line(`  ${opened ? c.m('Opened') : c.m('Open')} ${c.i(start.verification_url)}`);
+  line(`  ${c.m('Check the code matches, then press Approve. ctrl-c cancels.')}`);
+  line();
+
+  const deadline = Date.now() + start.expires_in * 1000;
+  const sp = spinner((f) => `${c.i(f)} ${c.s('Waiting for approval in the browser…')}`);
+  let result = null;
+  try {
+    while (Date.now() < deadline) {
+      if (ctx.signal?.aborted) throw new ApiError('sign-in cancelled', 0);
+      const r = await anon.authPoll(start.device_code, ctx.signal);
+      if (r.status === 200) { result = r.data; break; }
+      if (r.status !== 202) throw new ApiError(r.data?.detail || 'sign-in failed', r.status);
+      const t0 = Date.now();
+      while (Date.now() - t0 < (start.interval || 2) * 1000) { if (ctx.signal?.aborted) break; await sleep(100); }
+    }
+  } finally { sp.stop(); }
+  if (!result) throw new ApiError(`the code expired · run ${cmdText(ctx, 'login')} again`, 410);
+
+  const user = result.user;
+  const where = saveToken(server, user.username, result.token);
+  const api = new Api({ server, token: result.token });
+  const me = await load(ctx, 'Loading your workspaces…', () => api.me());
+  const prev = readConfig();
+  const ws = await pickWorkspace(ctx, workspaceList(me), prev.org?.id);
+  writeConfig({ server, username: user.username, user: { id: user.id, name: user.name, email: user.email }, org: ws, signedInAt: new Date().toISOString() });
+  ctx.reload();
+  if (ctx.json) { json({ user, org: ws, server }); return 0; }
+  line(`${c.g('✓')} Signed in as ${c.b(user.name || user.username)} ${c.m(`<${user.email}>`)}${ws ? `  ${c.m('·')} workspace ${c.b(ws.name)} ${c.m(`(${ws.role})`)}` : ''}`);
+  line(`  ${c.m(`token kept in ${where === 'keychain' ? 'the macOS Keychain' : '~/.gitroots/credentials.json (only you can read it)'}`)}`);
+  if (!ws) line(`  ${c.w('◐ you are not in a workspace yet · create or join one on gitroots.com')}`);
+  next(ctx, 'status');
+  return 0;
+}
+
+export async function logout(ctx) {
+  const cfg = readConfig();
+  if (!cfg.username) { line(c.m('○ not signed in')); return 0; }
+  forgetToken(cfg.server, cfg.username);
+  writeConfig({ server: cfg.server });
+  ctx.reload();
+  line(`${c.g('✓')} Signed out ${c.b(cfg.username)} on this computer ${c.m(`· ${cfg.server}`)}`);
+  line(`  ${c.m('The token is shared with the gitroots app; revoke it under Settings › Account › Sessions on gitroots.com.')}`);
+  return 0;
+}
+
+export async function whoami(ctx) {
+  needSignIn(ctx);
+  const me = await load(ctx, 'Checking your account…', () => ctx.api.me({ signal: ctx.signal }));
+  const cfg = readConfig();
+  const wss = workspaceList(me);
+  if (ctx.json) { json({ user: me.user, server: ctx.api.server, workspace: cfg.org, workspaces: wss }); return 0; }
+  const u = me.user;
+  line(`${c.g(c.b('gitroots'))} ${c.m('·')} ${c.b(u.display_name || u.username)} ${c.m(`<${u.email}>`)}${u.is_staff ? c.m(' · staff') : ''}`);
+  line(`  ${c.s(pad('server', 11))}${ctx.api.server}`);
+  line(`  ${c.s(pad('workspace', 11))}${cfg.org ? `${c.b(cfg.org.name)} ${c.m(`(${cfg.org.role})`)}` : c.m('none')}`);
+  if (wss.length > 1) line(`  ${c.s(pad('also in', 11))}${wss.filter((w) => w.id !== cfg.org?.id).map((w) => w.name).join(', ')}   ${c.g(`→ ${cmdText(ctx, 'workspace')}`)}`);
+  return 0;
+}
+
+export async function workspace(ctx, args) {
+  needSignIn(ctx);
+  const me = await load(ctx, 'Loading your workspaces…', () => ctx.api.me({ signal: ctx.signal }));
+  const wss = workspaceList(me);
+  if (!wss.length) { line(c.w('◐ you are not in a workspace yet · create or join one on gitroots.com')); return 1; }
+  let ws;
+  if (args[0]) {
+    ws = wss.find((w) => w.slug === args[0] || w.name.toLowerCase() === args.join(' ').toLowerCase() || String(w.id) === args[0]);
+    if (!ws) throw new Error(`no workspace "${args.join(' ')}" · yours: ${wss.map((w) => w.slug).join(', ')}`);
+  } else {
+    ws = await pickWorkspace(ctx, wss, readConfig().org?.id);
+    if (!ws) return 1;
+  }
+  updateConfig({ org: ws });
+  ctx.reload();
+  if (ctx.json) { json(ws); return 0; }
+  line(`${c.g('✓')} Workspace ${c.b(ws.name)} ${c.m(`(${ws.role})`)}`);
+  next(ctx, 'status');
+  return 0;
+}