plugin-git-manager 1.0.10 → 1.0.12

package/dist/server/poller.js

@@ -67,39 +67,78 @@ function getPollerStatus() {
     intervalSec: POLL_INTERVAL_MS / 1e3
   };
 }
+const ADVISORY_LOCK_KEY = 777042;
 async function tryAcquirePollerLock(app) {
   var _a, _b, _c;
+  const noop = { release: async () => void 0 };
+  const sequelize = app.db.sequelize;
+  if (!sequelize) return noop;
+  const dialect = (_a = sequelize.getDialect) == null ? void 0 : _a.call(sequelize);
+  if (dialect !== "postgres" && dialect !== "mysql" && dialect !== "mariadb") {
+    return noop;
+  }
+  let transaction;
   try {
-    const sequelize = app.db.sequelize;
-    if (!sequelize) return true;
-    const dialect = (_a = sequelize.getDialect) == null ? void 0 : _a.call(sequelize);
-    const lockKey = 777042;
-    if (dialect === "postgres") {
-      const [results] = await sequelize.query(`SELECT pg_try_advisory_lock(${lockKey}) AS locked`);
-      return ((_b = results == null ? void 0 : results[0]) == null ? void 0 : _b.locked) === true;
-    }
-    if (dialect === "mysql" || dialect === "mariadb") {
-      const [results] = await sequelize.query(`SELECT GET_LOCK('git_poller', 0) AS locked`);
-      return ((_c = results == null ? void 0 : results[0]) == null ? void 0 : _c.locked) === 1;
-    }
-    return true;
+    transaction = await sequelize.transaction();
   } catch {
-    return true;
+    return noop;
   }
-}
-async function releasePollerLock(app) {
-  var _a;
   try {
-    const sequelize = app.db.sequelize;
-    if (!sequelize) return;
-    const dialect = (_a = sequelize.getDialect) == null ? void 0 : _a.call(sequelize);
-    const lockKey = 777042;
+    let acquired = false;
     if (dialect === "postgres") {
-      await sequelize.query(`SELECT pg_advisory_unlock(${lockKey})`);
-    } else if (dialect === "mysql" || dialect === "mariadb") {
-      await sequelize.query(`SELECT RELEASE_LOCK('git_poller')`);
+      const [results] = await sequelize.query(
+        `SELECT pg_try_advisory_lock(${ADVISORY_LOCK_KEY}) AS locked`,
+        { transaction }
+      );
+      acquired = ((_b = results == null ? void 0 : results[0]) == null ? void 0 : _b.locked) === true;
+    } else {
+      const [results] = await sequelize.query(
+        `SELECT GET_LOCK('git_poller', 0) AS locked`,
+        { transaction }
+      );
+      const v = (_c = results == null ? void 0 : results[0]) == null ? void 0 : _c.locked;
+      acquired = v === 1 || v === "1" || v === true;
+    }
+    if (!acquired) {
+      try {
+        await transaction.rollback();
+      } catch {
+      }
+      return null;
     }
+    return {
+      release: async () => {
+        try {
+          if (dialect === "postgres") {
+            await sequelize.query(
+              `SELECT pg_advisory_unlock(${ADVISORY_LOCK_KEY})`,
+              { transaction }
+            );
+          } else {
+            await sequelize.query(
+              `SELECT RELEASE_LOCK('git_poller')`,
+              { transaction }
+            );
+          }
+        } catch {
+        } finally {
+          try {
+            await transaction.commit();
+          } catch {
+            try {
+              await transaction.rollback();
+            } catch {
+            }
+          }
+        }
+      }
+    };
   } catch {
+    try {
+      await transaction.rollback();
+    } catch {
+    }
+    return noop;
   }
 }
 async function pollAllRepos(app) {
@@ -113,8 +152,8 @@ async function pollAllRepos(app) {
       return { scanned: 0, triggered: 0 };
     }
   }
-  const lockAcquired = await tryAcquirePollerLock(app);
-  if (!lockAcquired) {
+  const lock = await tryAcquirePollerLock(app);
+  if (!lock) {
     (_d = (_c = app.log) == null ? void 0 : _c.debug) == null ? void 0 : _d.call(_c, "poller: another node holds the advisory lock \u2014 skipping");
     return { scanned: 0, triggered: 0 };
   }
@@ -142,7 +181,7 @@ async function pollAllRepos(app) {
   } finally {
     isPolling = false;
     pollStartedAt = null;
-    await releasePollerLock(app);
+    await lock.release();
   }
   return { scanned, triggered };
 }
@@ -211,6 +250,43 @@ async function pollOneRepo(app, repo) {
 async function listMergeRequests(repo, updatedAfter) {
   const repoUrl = repo.get("repoUrl");
   const pat = repo.get("pat");
+  const isGitHub = typeof repoUrl === "string" && repoUrl.includes("github.com");
+  if (isGitHub) {
+    const { projectPath } = (0, import_gitlab_url.parseGitLabProject)(repoUrl);
+    const params2 = new URLSearchParams({
+      state: "open",
+      per_page: String(MR_PAGE_SIZE),
+      sort: "updated",
+      direction: "desc"
+    });
+    const headers = { Accept: "application/vnd.github.v3+json" };
+    if (pat) headers["Authorization"] = `Bearer ${pat}`;
+    const response2 = await fetch(
+      `https://api.github.com/repos/${projectPath}/pulls?${params2.toString()}`,
+      { headers }
+    );
+    if (!response2.ok) {
+      const body = await response2.text().catch(() => "");
+      throw new Error(`GitHub API error ${response2.status}: ${body}`);
+    }
+    let prs = await response2.json();
+    if (Array.isArray(prs) && updatedAfter) {
+      const cutoff = updatedAfter.getTime() - 1e3;
+      prs = prs.filter((pr) => {
+        const t = (pr == null ? void 0 : pr.updated_at) ? new Date(pr.updated_at).getTime() : 0;
+        return t >= cutoff;
+      });
+    }
+    return (prs || []).map((pr) => {
+      var _a, _b, _c;
+      return {
+        iid: pr.number,
+        sha: (_a = pr.head) == null ? void 0 : _a.sha,
+        source_branch: (_b = pr.head) == null ? void 0 : _b.ref,
+        target_branch: (_c = pr.base) == null ? void 0 : _c.ref
+      };
+    });
+  }
   const { apiBase, encodedProject } = (0, import_gitlab_url.parseGitLabProject)(repoUrl);
   const params = new URLSearchParams({
     state: "opened",

package/dist/server/utils/redact.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Redact embedded credentials from URLs in arbitrary strings.
+ * Matches `scheme://user:password@host` and replaces with `scheme://***:***@host`.
+ * Used to scrub error messages before persisting them to the DB or
+ * returning them to the client, since simple-git often echoes the
+ * authenticated remote URL in stderr.
+ */
+export declare function redactPat(s: unknown): string;
+/**
+ * Mutate `err.message` (and common fields where simple-git stashes stderr)
+ * to remove any embedded PAT before the error propagates further.
+ */
+export declare function redactError<T>(err: T): T;

package/dist/server/utils/redact.js

@@ -0,0 +1,49 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var redact_exports = {};
+__export(redact_exports, {
+  redactError: () => redactError,
+  redactPat: () => redactPat
+});
+module.exports = __toCommonJS(redact_exports);
+function redactPat(s) {
+  if (typeof s !== "string") return s == null ? "" : String(s);
+  return s.replace(/(https?:\/\/)([^\/:@\s]+):([^@\s]+)@/g, "$1***:***@");
+}
+function redactError(err) {
+  if (!err || typeof err !== "object") return err;
+  const e = err;
+  if (typeof e.message === "string") e.message = redactPat(e.message);
+  if (typeof e.stderr === "string") e.stderr = redactPat(e.stderr);
+  if (typeof e.stdout === "string") e.stdout = redactPat(e.stdout);
+  return err;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  redactError,
+  redactPat
+});

package/package.json

@@ -3,7 +3,7 @@
   "displayName": "Git Manager",
   "displayName.zh-CN": "Git 管理器",
   "description": "Manage Git repositories with PAT authentication - pull, push, fetch, diff, file browsing",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "license": "Apache-2.0",
   "main": "dist/server/index.js",
   "files": [

package/src/server/actions/git-actions.ts

@@ -2,8 +2,11 @@ import simpleGit, { SimpleGit } from 'simple-git';
 import { Context } from '@nocobase/actions';
 import * as path from 'path';
 import * as fs from 'fs';
+import { redactPat, redactError } from '../utils/redact';
 
-const REF_PATTERN = /^[a-zA-Z0-9._\-\/]+$/;
+// Disallow leading `-` to prevent argument-injection (e.g. `--upload-pack=...`)
+// when refs are passed as positional args to git.
+const REF_PATTERN = /^(?!-)[a-zA-Z0-9._\-\/]+$/;
 
 // Per-repo mutex to prevent PAT race conditions in withAuth
 const repoLocks = new Map<string, Promise<any>>();
@@ -45,14 +48,21 @@ function validateRepoUrl(repoUrl: string): void {
   }
 }
 
-async function withAuth(git: ReturnType<typeof simpleGit>, repoUrl: string, pat: string, fn: () => Promise<any>, username?: string) {
-  const lockKey = repoUrl;
+async function withAuth(git: ReturnType<typeof simpleGit>, localPath: string, repoUrl: string, pat: string, fn: () => Promise<any>, username?: string) {
+  // Lock by local working tree — that's what `git.remote('set-url', ...)`
+  // mutates. Two repo records sharing a `repoUrl` but cloned to different
+  // paths can run in parallel safely; conversely, two repos pointed at the
+  // same `localPath` (config error) must NOT run concurrent set-url's.
+  const lockKey = localPath;
   const lock = acquireLock(lockKey);
   await lock.promise;
   const authUrl = getAuthUrl(repoUrl, pat, username);
   await git.remote(['set-url', 'origin', authUrl]);
   try {
     return await fn();
+  } catch (err) {
+    // simple-git often echoes the authenticated URL in stderr — scrub before re-throw
+    throw redactError(err);
   } finally {
     // H-2 fix: guard PAT cleanup — if reset fails, the PAT-embedded URL persists on disk
     try {
@@ -64,9 +74,9 @@ async function withAuth(git: ReturnType<typeof simpleGit>, repoUrl: string, pat:
       } catch {
         // Log but don't throw — the original operation already completed
         console.error(
-          `[plugin-git-manager] CRITICAL: failed to remove PAT from remote URL for ${repoUrl}. ` +
+          `[plugin-git-manager] CRITICAL: failed to remove PAT from remote URL for ${redactPat(repoUrl)}. ` +
           `Manual cleanup of .git/config may be required.`,
-          cleanupErr,
+          redactError(cleanupErr),
         );
       }
     }
@@ -75,9 +85,9 @@ async function withAuth(git: ReturnType<typeof simpleGit>, repoUrl: string, pat:
 }
 
 function getAuthUrl(repoUrl: string, pat: string, username?: string): string {
-  const url = new URL(repoUrl);
-  url.username = username || 'oauth2';
-  url.password = pat;
+  const url = new URL(repoUrl.trim());
+  url.username = (username || 'oauth2').trim();
+  url.password = pat.trim();
   return url.toString();
 }
 
@@ -114,11 +124,14 @@ function validateLocalPath(localPath: string): string {
 export async function clone(ctx: Context, next: () => Promise<void>) {
   const repo = await getRepo(ctx);
   const localPath = validateLocalPath(repo.get('localPath'));
-  const repoUrl = repo.get('repoUrl') as string;
-  const pat = repo.get('pat') as string;
-  const username = repo.get('username') as string;
+  const repoUrl = (repo.get('repoUrl') as string || '').trim();
+  const pat = (repo.get('pat') as string || '').trim();
+  const username = (repo.get('username') as string || '').trim();
+  const defaultBranch = ((repo.get('defaultBranch') as string) || 'main').trim() || 'main';
 
   validateRepoUrl(repoUrl);
+  // Prevent argument-injection through `defaultBranch` (e.g. `--upload-pack=...`)
+  validateBranch(defaultBranch);
 
   // Check if directory already exists
   if (fs.existsSync(localPath)) {
@@ -131,7 +144,7 @@ export async function clone(ctx: Context, next: () => Promise<void>) {
 
   const authUrl = getAuthUrl(repoUrl, pat, username);
   try {
-    await simpleGit().clone(authUrl, localPath, ['--branch', repo.get('defaultBranch') || 'main']);
+    await simpleGit().clone(authUrl, localPath, ['--branch', defaultBranch]);
     // Remove PAT from the cloned repo's remote URL
     await simpleGit(localPath).remote(['set-url', 'origin', repoUrl]);
     await ctx.db.getRepository('gitRepositories').update({
@@ -144,7 +157,8 @@ export async function clone(ctx: Context, next: () => Promise<void>) {
       filterByTk: repo.get('id'),
       values: { status: 'error' },
     });
-    throw err;
+    // Redact embedded PAT before the error reaches the client / log
+    throw redactError(err);
   }
   await next();
 }
@@ -152,12 +166,12 @@ export async function clone(ctx: Context, next: () => Promise<void>) {
 export async function pull(ctx: Context, next: () => Promise<void>) {
   const repo = await getRepo(ctx);
   const localPath = validateLocalPath(repo.get('localPath'));
-  const pat = repo.get('pat') as string;
-  const repoUrl = repo.get('repoUrl') as string;
-  const username = repo.get('username') as string;
+  const pat = (repo.get('pat') as string || '').trim();
+  const repoUrl = (repo.get('repoUrl') as string || '').trim();
+  const username = (repo.get('username') as string || '').trim();
 
   const git = getGit(localPath);
-  const result = await withAuth(git, repoUrl, pat, () => git.pull(), username);
+  const result = await withAuth(git, localPath, repoUrl, pat, () => git.pull(), username);
 
   ctx.body = { success: true, data: result };
   await next();
@@ -166,12 +180,12 @@ export async function pull(ctx: Context, next: () => Promise<void>) {
 export async function push(ctx: Context, next: () => Promise<void>) {
   const repo = await getRepo(ctx);
   const localPath = validateLocalPath(repo.get('localPath'));
-  const pat = repo.get('pat') as string;
-  const repoUrl = repo.get('repoUrl') as string;
-  const username = repo.get('username') as string;
+  const pat = (repo.get('pat') as string || '').trim();
+  const repoUrl = (repo.get('repoUrl') as string || '').trim();
+  const username = (repo.get('username') as string || '').trim();
 
   const git = getGit(localPath);
-  const result = await withAuth(git, repoUrl, pat, () => git.push(), username);
+  const result = await withAuth(git, localPath, repoUrl, pat, () => git.push(), username);
 
   ctx.body = { success: true, data: result };
   await next();
@@ -180,12 +194,12 @@ export async function push(ctx: Context, next: () => Promise<void>) {
 export async function fetch(ctx: Context, next: () => Promise<void>) {
   const repo = await getRepo(ctx);
   const localPath = validateLocalPath(repo.get('localPath'));
-  const pat = repo.get('pat') as string;
-  const repoUrl = repo.get('repoUrl') as string;
-  const username = repo.get('username') as string;
+  const pat = (repo.get('pat') as string || '').trim();
+  const repoUrl = (repo.get('repoUrl') as string || '').trim();
+  const username = (repo.get('username') as string || '').trim();
 
   const git = getGit(localPath);
-  const result = await withAuth(git, repoUrl, pat, () => git.fetch(), username);
+  const result = await withAuth(git, localPath, repoUrl, pat, () => git.fetch(), username);
 
   ctx.body = { success: true, data: result };
   await next();

package/src/server/actions/gitlab-api.ts

@@ -42,8 +42,8 @@ async function getRepoApiContext(ctx: Context) {
   if (!repo) {
     ctx.throw(404, 'Repository not found');
   }
-  const pat = repo.get('pat') as string;
-  const repoUrl = repo.get('repoUrl') as string;
+  const pat = (repo.get('pat') as string || '').trim();
+  const repoUrl = (repo.get('repoUrl') as string || '').trim();
   const isGitHub = repoUrl.includes('github.com');
   const { apiBase, encodedProject, projectPath } = parseGitLabProject(repoUrl);
   return { repo, pat, apiBase, encodedProject, projectPath, isGitHub };
@@ -104,7 +104,8 @@ export async function mergeRequests(ctx: Context, next: () => Promise<void>) {
   let items;
 
   if (isGitHub) {
-    // Map GitLab state to GitHub state
+    // Map GitLab state to GitHub state. `merged` requires fetching `closed`
+    // and filtering client-side, since GitHub has no dedicated state.
     const ghState = state === 'opened' ? 'open' : state === 'closed' ? 'closed' : state === 'merged' ? 'closed' : 'all';
     result = await githubFetch(`/repos/${projectPath}/pulls`, pat, {
       state: ghState,
@@ -113,11 +114,19 @@ export async function mergeRequests(ctx: Context, next: () => Promise<void>) {
       sort: orderBy === 'updated_at' ? 'updated' : 'created',
       direction: sort,
     });
-    
+
     let pullRequests = result.data || [];
-    // If state is merged, filter the closed ones that are merged
+    // If state is merged, filter the closed ones that are merged.
+    // Pagination metadata from GitHub still reflects the unfiltered `closed`
+    // total — null it out to avoid misleading the UI.
+    let mergedFilterApplied = false;
     if (state === 'merged') {
       pullRequests = pullRequests.filter((pr: any) => pr.merged_at);
+      mergedFilterApplied = true;
+    }
+    if (mergedFilterApplied) {
+      result.totalPages = null;
+      result.total = null;
     }
 
     items = pullRequests.map((pr: any) => ({
@@ -133,16 +142,18 @@ export async function mergeRequests(ctx: Context, next: () => Promise<void>) {
       reviewers: (pr.requested_reviewers || []).map((r: any) => ({ name: r.login, username: r.login, avatarUrl: r.avatar_url })),
       labels: (pr.labels || []).map((l: any) => l.name),
       draft: pr.draft || false,
-      mergedBy: null, // Not returned in list API
+      mergedBy: null, // Not returned by the PR list endpoint
       mergedAt: pr.merged_at,
       createdAt: pr.created_at,
       updatedAt: pr.updated_at,
-      userNotesCount: 0, // Not returned in pull list API
+      userNotesCount: typeof pr.comments === 'number' ? pr.comments : 0,
       upvotes: 0,
       downvotes: 0,
       webUrl: pr.html_url,
-      hasConflicts: false, // Not guaranteed in list
-      changesCount: 0,
+      // GitHub's PR list does not include mergeability info — surface as
+      // `null` (unknown) so the UI doesn't render a misleading "no conflicts".
+      hasConflicts: null,
+      changesCount: typeof pr.changed_files === 'number' ? pr.changed_files : null,
     }));
   } else {
     if (!pat) ctx.throw(400, 'Personal Access Token is required for GitLab API access');
@@ -240,8 +251,20 @@ export async function mergeRequestDetail(ctx: Context, next: () => Promise<void>
       closedBy: null, // Not always readily available on GitHub without extra call
       closedAt: pr.closed_at,
       webUrl: pr.html_url,
-      hasConflicts: pr.mergeable_state === 'dirty',
-      diffStats: { additions: pr.additions },
+      // `mergeable_state === 'unknown'` when GitHub is still computing — surface
+      // `null` instead of `false` so the UI can distinguish "no conflicts" from
+      // "not yet known".
+      hasConflicts:
+        pr.mergeable_state === 'dirty'
+          ? true
+          : pr.mergeable_state === 'unknown' || pr.mergeable === null
+            ? null
+            : false,
+      diffStats: {
+        additions: typeof pr.additions === 'number' ? pr.additions : null,
+        deletions: typeof pr.deletions === 'number' ? pr.deletions : null,
+        changedFiles: typeof pr.changed_files === 'number' ? pr.changed_files : null,
+      },
       changes,
     };
   } else {