npm - laneyard - Versions diffs - 0.4.1 → 0.6.0 - Mend

laneyard 0.4.1 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (35) hide show

package/README.md +312 -282
package/dist/src/cli/adopt.js +221 -0
package/dist/src/cli/home.js +46 -0
package/dist/src/cli/remove.js +195 -0
package/dist/src/cli/reset.js +117 -0
package/dist/src/cli/setup.js +123 -11
package/dist/src/cli/uninstall.js +2 -24
package/dist/src/config/accounts.js +103 -39
package/dist/src/config/load.js +3 -27
package/dist/src/config/resolve.js +36 -0
package/dist/src/config/schema.js +25 -9
package/dist/src/config/store.js +27 -3
package/dist/src/data/remove-project.js +70 -0
package/dist/src/db/runs.js +11 -0
package/dist/src/fastfile/adoption.js +142 -0
package/dist/src/fastfile/splice.js +38 -0
package/dist/src/logs/store.js +9 -1
package/dist/src/main.js +24 -16
package/dist/src/secrets/vault.js +6 -5
package/dist/src/server/app.js +17 -12
package/dist/src/server/permissions.js +50 -0
package/dist/src/server/routes/account.js +56 -1
package/dist/src/server/routes/fastfile.js +7 -0
package/dist/src/server/routes/projects.js +95 -86
package/dist/src/server/routes/users.js +47 -4
package/dist/src/sidecar/bridge.js +5 -4
package/dist/src/sidecar/fastlane-dir.js +8 -8
package/dist/src/sidecar/prism-ruby.js +42 -0
package/dist/src/sidecar/scan.js +44 -0
package/dist/web/assets/{Editor-9nLYwtg7.js → Editor-CMa4-4N3.js} +1 -1
package/dist/web/assets/index-B8lAQPEM.js +62 -0
package/dist/web/index.html +1 -1
package/package.json +1 -1
package/ruby/scan.rb +176 -0
package/dist/web/assets/index-pzPa9EZr.js +0 -62

package/dist/web/index.html CHANGED Viewed

@@ -4,7 +4,7 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>laneyard</title>
-    <script type="module" crossorigin src="/assets/index-pzPa9EZr.js"></script>
+    <script type="module" crossorigin src="/assets/index-B8lAQPEM.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DsjxZtsO.css">
   </head>
   <body>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "laneyard",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "type": "module",
   "bin": {
     "laneyard": "dist/src/main.js"

package/ruby/scan.rb ADDED Viewed

@@ -0,0 +1,176 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+# Laneyard's Fastfile scanner.
+#
+#   ruby scan.rb --fastlane-dir fastlane
+#
+# Deliberately ignorant. It reports the keyword arguments given directly to a
+# call whose value is a literal string, with the byte ranges of the value and of
+# the whole `key: value` pair, and has no idea what a credential is. Deciding
+# which of those matters is `src/fastfile/adoption.ts`'s job, next to the one
+# table that already describes each credential kind — a second copy of that
+# table here would be free to disagree with it, in a language that cannot check
+# it.
+#
+# Nested structures are deliberately not descended into. The literal inside
+# `gym(export_options: { provisioningProfiles: { "id" => "./x" } })` has no
+# keyword to report — its key is a bundle id — and attributing it to `gym` would
+# be noise the caller cannot act on. This claim stays narrow on purpose: a
+# confident answer that is wrong is worse than one that admits its edge.
+#
+# It never requires fastlane. `introspect.rb` must, to enumerate lanes; a
+# syntax tree needs only Prism, and paying a fastlane boot for it would make
+# this too slow to run during `laneyard setup`.
+#
+# The output contract is `introspect.rb`'s: { "ok": true, ... } or
+# { "ok": false, "error": "..." }. An error is a valid response.
+require "json"
+REAL_STDOUT = $stdout.dup
+# Writes the one JSON object this process produces, and stops.
+#
+# Serialisation is *not* done here, on purpose: `JSON.generate` raises on a
+# string that is not valid UTF-8, and a Fastfile may well hold one
+# (`supply(json_key: "./key\xFF.json")` is enough). Raising from inside the
+# writer put the failure outside every guard in this file, so the caller got a
+# Ruby trace on stderr and nothing at all on stdout — the one outcome the
+# contract at the top promises never to happen. Callers generate under a guard
+# and hand the finished string here.
+def emit(json)
+  REAL_STDOUT.puts json
+  REAL_STDOUT.flush
+  exit 0
+end
+def respond(payload)
+  emit(JSON.generate(payload))
+end
+def fail_with(message)
+  # Scrubbed, because an error message can quote the bytes that caused it:
+  # `JSON::GeneratorError` names the offending literal. An error path that
+  # raises while reporting an error leaves the caller with nothing.
+  respond({ ok: false, error: message.to_s.dup.force_encoding("UTF-8").scrub("?") })
+end
+dir_index = ARGV.index("--fastlane-dir")
+fastlane_dir = dir_index ? ARGV[dir_index + 1] : "fastlane"
+fastfile_path = File.join(Dir.pwd, fastlane_dir, "Fastfile")
+fail_with("Fastfile not found: #{fastfile_path}") unless File.exist?(fastfile_path)
+# Insurance, not a fix for a known culprit: unlike `introspect.rb`, which faces
+# a fastlane that really does print banners and deprecation notices, nothing
+# here prints — Prism parses silently and the Fastfile is never executed. The
+# redirection stands so that anything which *starts* printing later (a stray
+# `puts`, a warning from some future require) lands on stderr instead of
+# corrupting the one JSON object the real output carries.
+$stdout = $stderr
+begin
+  require "prism"
+rescue LoadError => e
+  fail_with("prism is not available in this Ruby (#{e.message})")
+end
+# Every `key: "literal"` inside a call, wherever the call sits.
+#
+# Descends through everything: a call inside an `if`, inside a `def`, inside a
+# `platform` block, is still a call this file makes. `calls_within` in
+# introspect.rb resolves helper methods to attribute actions to a *lane*; there
+# is no such need here, because a literal path is a problem wherever it is
+# written and belongs to the file rather than to any one lane.
+def literals_in(node, out = [])
+  return out if node.nil?
+  node.compact_child_nodes.each do |child|
+    if child.is_a?(Prism::CallNode)
+      # Both node types, because `supply(json_key: "…")` parses as a
+      # KeywordHashNode and `supply({json_key: "…"})` as a HashNode. They are
+      # the same argument written two ways, and looking for only the first
+      # missed the braced form entirely — silently, since a scan that finds
+      # nothing is indistinguishable from a file with nothing to find.
+      hashes = (child.arguments&.arguments || []).select do |a|
+        a.is_a?(Prism::KeywordHashNode) || a.is_a?(Prism::HashNode)
+      end
+      hashes.flat_map(&:elements).each do |el|
+        next unless el.is_a?(Prism::AssocNode)
+        next unless el.key.is_a?(Prism::SymbolNode)
+        next unless el.value.is_a?(Prism::StringNode)
+        # A heredoc's location covers its *marker* — `<<~P` is four bytes —
+        # while its value lives on the lines below. Reporting that range would
+        # have the caller splice `ENV.fetch("...")` over the marker and leave
+        # the body stranded after the call: a Fastfile that no longer parses,
+        # written silently into someone's repository. Dropping heredocs costs
+        # nothing real, because a credential path is never written as one while
+        # `changelog:` and `message:` routinely are. Only Ruby can tell a
+        # heredoc from a quoted string, so the decision has to be made here.
+        next if el.value.opening&.start_with?("<<")
+        # `start_offset` and `length` are byte offsets, and must stay that way:
+        # the caller splices them into a Buffer. Prism also offers
+        # `start_character_offset`, and swapping one in would still pass any
+        # test whose fixture is pure ASCII while putting one accent above the
+        # literal enough to land a patch mid-string in a build file.
+        out << {
+          action: child.name.to_s,
+          arg: el.key.unescaped,
+          value: el.value.unescaped,
+          value_start: el.value.location.start_offset,
+          value_length: el.value.location.length,
+          pair_start: el.location.start_offset,
+          pair_length: el.location.length,
+          line: el.location.start_line
+        }
+      end
+    end
+    literals_in(child, out)
+  end
+  out
+end
+# A Fastfile that does not parse, told apart from everything else that can go
+# wrong in the block below, so each gets a sentence that is true of it.
+ParseFailure = Class.new(StandardError)
+# Prism's first complaint, and the line it points at.
+#
+# "Fastfile could not be parsed" on its own leaves someone opening the file and
+# hunting; a flow that is about to offer to *edit* that file owes them better
+# than that. The first error is the one worth showing — the ones behind it are
+# usually the same mistake seen again from further down.
+def parse_failure(result)
+  first = result.errors.first
+  return "Fastfile could not be parsed" unless first
+  "Fastfile could not be parsed, line #{first.location.start_line}: #{first.message}"
+end
+begin
+  source = File.read(fastfile_path)
+  result = Prism.parse(source)
+  # A plain `raise`, not `fail_with`, and deliberately so: `fail_with` ends in
+  # `respond`'s `exit 0`, which raises SystemExit — a subclass of Exception, so
+  # calling it from inside this very `begin` would be caught by the `rescue`
+  # below and answered a second time, corrupting the output with two JSON
+  # blobs. Raising here and answering from the `rescue` clause (which is not
+  # itself guarded) is the same shape `introspect.rb` uses for this.
+  raise ParseFailure, parse_failure(result) unless result.success?
+  # Serialised here rather than at the `emit` below, so that a literal Prism
+  # read fine but JSON cannot represent — anything that is not valid UTF-8 —
+  # becomes an ordinary `{ "ok": false }` instead of a trace. Only the write
+  # stays outside the guard, for the SystemExit reason above.
+  payload = JSON.generate({ ok: true, literals: literals_in(result.value) })
+rescue ParseFailure => e
+  # Already a whole sentence, and prefixing it produced the visible doubling
+  # this replaced: "Could not read the Fastfile: Fastfile could not be parsed",
+  # whose first half was also false — the read had succeeded.
+  fail_with(e.message)
+rescue Exception => e # rubocop:disable Lint/RescueException
+  fail_with("Could not scan the Fastfile: #{e.message}")
+end
+emit(payload)