gitoria

8.0 KB

1. // project.hl — gitoria.worldapi.org: THE APP. Routes and WHO HEARS WHAT. Hybriel on hl:web.
2. //
3. // HOW A REPO GETS ITS ADDRESS (ticket #6, gitoria#16): nginx sends `gitoria.worldapi.org` AND every
4. // `<slug>.gitoria.worldapi.org` to this one app. Every page component that declares `host = null` gets the
5. // request's host (without port, hybriel#74) on the SERVER, on the first load and on every hl:web navigation:
6. // the main address shows the repo list + "create" (components/index.hl → list.hl), `<slug>.` shows that repo —
7. // each repo view is its own page component on its own route (readme, code, branch, commit, pulls, releases,
8. // tickets), rendered on the server WITH its content: git is read with hl:proc run(), which waits (hybriel#80).
9. // The session cookie carries `Domain=.<host>` (hl:web `sessionDomain`, hybriel#44) so one
10. // login holds on every address; the login button always returns through the main address
11. // (the only origin registered in ident) and then on to the repo the login started from.
12. import WebFramework from 'hl:web'
13. import { env } from 'hl:proc'
14. import { Response } from 'hl:http1'
15. import { randomBytes } from 'hl:crypto'
17. import Styles from './styles.hl'
18. import { reply, fail, wantsMarkdown, markdownReply } from './api.hl'
19. import { repoRows, repoRow, repoDocument, listDocument, slugError } from './repos.hl'
20. import { exchangeCode, ensureUser, hostPort, hostOnly, scheme, domainFor } from './users.hl'
22. import { gitTransport } from './transport.hl'
23. import { gitKeys, gitAccess } from './sshgate.hl'
25. import Index from './components/index.hl'
26. import Code from './components/code.hl'
27. import Branch from './components/branch.hl'
28. import Commit from './components/commit.hl'
29. import Pulls from './components/pulls.hl'
30. import Releases from './components/releases.hl'
31. import Tickets from './components/tickets.hl'
32. import LoginFailed from './components/loginfailed.hl'
34. static siteName = "gitoria"
36. appTitle = siteName
37. styles = Styles
39. // ---- the API: reads are public (creating a repo is a web action for now) ------------------------
40. apiRepos = (route, req) => {
41. if (req.method != 'GET') { return fail(405, 'GET only') }
42. let rows = repoRows()
43. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows)) }
44. return { repos = rows }
45. }
47. apiRepo = (route, req) => {
48. if (req.method != 'GET') { return fail(405, 'GET only') }
49. let row = repoRow(route.params.slug)
50. if (row == null) { return fail(404, 'no such repository') }
51. if (wantsMarkdown(req)) { return markdownReply(repoDocument(row)) }
52. return row
53. }
55. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident") ----------------------------
56. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
57. // goes (one `/`, URL-safe characters, ≤ 500) — or a full URL of THIS system: <scheme>://<label>.<host>
58. // with a valid, non-reserved repo label and such a path. Anything else → `/`.
59. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
60. safePath = (want) => {
61. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
62. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
63. let i = 0
64. while (i < want.length) {
65. if (!nextChars.includes(want[i])) { return '/' }
66. i = i + 1
67. }
68. return want
69. }
71. safeNext = (want) => {
72. if (want == null || hlTypeName(want) != 'String' || want.length > 500) { return '/' }
73. let prefix = scheme + '://'
74. if (!want.startsWith(prefix)) { return safePath(want) }
75. let rest = want.slice(prefix.length)
76. let slash = rest.indexOf('/')
77. let hp = slash < 0 ? rest : rest.slice(0, slash)
78. let path = slash < 0 ? '/' : rest.slice(slash)
79. let dot = hp.indexOf('.')
80. if (dot < 1 || hp.slice(dot + 1) != hostPort || slugError(hp.slice(0, dot)) != null) { return '/' }
81. let p = safePath(path)
82. if (p == '/' && path != '/') { return '/' }
83. return prefix + hp + p
84. }
86. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
87. failed = (req, why) => {
88. let s = req.session
89. let fresh = s == null
90. if (fresh) { s = server.sessions.mint() }
91. s.data.loginError = why
92. server.sessions.save(s)
93. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
94. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
95. return res
96. }
98. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
99. loginCallback = (route, req) => {
100. if (req.method != 'GET') { return failed(req, 'GET only') }
101. let q = req.query != null ? req.query : {}
102. let code = q.ident_code
103. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
104. let x = exchangeCode(code)
105. if (x.error != null) { return failed(req, x.error) }
106. let u = ensureUser(x.identity)
107. if (u == null) { return failed(req, 'could not store the user') }
108. let s = req.session
109. let fresh = s == null
110. if (fresh) { s = server.sessions.mint() }
111. s.user = { id = u.id }
112. s.data.tag = randomBytes(16)
113. s.data.loginError = null
114. server.sessions.save(s)
115. let res = new Response('logged in', { status = 302 headers = { 'Location' = safeNext(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
116. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
117. return res
118. }
120. // EVERY REPO VIEW IS ITS OWN PAGE (gitoria#16); `/` is the list on the main address, the Readme on a repo address.
121. routes = [
122. { pattern = "/favicon.ico" direct = "" }
123. { pattern = "/login/callback" function = loginCallback }
124. { pattern = "/login/failed" component = LoginFailed }
125. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
126. { pattern = "/api/repos" function = apiRepos }
127. { pattern = "/api/repos/:slug" function = apiRepo }
128. { pattern = "/" component = Index }
129. { pattern = "/code" component = Code }
130. { pattern = "/code/*path" component = Code }
131. { pattern = "/branch/*path" component = Branch }
132. { pattern = "/commit/*path" component = Commit }
133. { pattern = "/pulls" component = Pulls }
134. { pattern = "/releases" component = Releases }
135. { pattern = "/tickets" component = Tickets }
136. { pattern = "/__git/keys" function = gitKeys }
137. { pattern = "/__git/access" function = gitAccess }
138. { pattern = "/:repo/info/refs" function = gitTransport }
139. { pattern = "/:repo/git-upload-pack" function = gitTransport }
140. { pattern = "/:repo/git-receive-pack" function = gitTransport }
141. ]
143. // WHO GETS THE PUSH: a new repo reaches every open page (the list follows live)
144. // `gitoriaSignedIn` / `gitoriaSignedOut` go to the tabs of ONE session: the one whose login carries
145. // that random tag (session.data.tag, set at login) — every open page of it switches without a reload.
146. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
147. audience = {
148. repoCreated = (row, session) => { return true }
149. ticketOpened = (slug, row, session) => { return true }
150. gitoriaSignedIn = (tag, info, session) => { return tag != null && tagOf(session) == tag }
151. gitoriaSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
152. }
154. sessionDir = env('GITORIA_SESSIONS') != null ? env('GITORIA_SESSIONS') : null
155. port = env('GITORIA_PORT') != null ? toNumber(env('GITORIA_PORT')) : 8360
156. // HL_HOST = the interface hl:web binds (hybriel #24, fixed upstream): 127.0.0.1 on Byrodin behind nginx;
157. // unset = 0.0.0.0 (dev on Loreana). GITORIA_WATCH=0 = no dev watcher. The session cookie is `gitoriasid` (hybriel #10).
158. watching = env('GITORIA_WATCH') != '0'
159. sessionCookie = 'gitoriasid'
160. // the cookie's Domain (hybriel#44): every <slug>.<host> shares the login (users.hl domainFor; '' = host-only → null)
161. sessionDomain = domainFor(hostOnly) != '' ? domainFor(hostOnly) : null
162. server = new WebFramework(routes = routes, styles = styles, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie, sessionDomain = sessionDomain)
164. on Error(e) { console.log('error absorbed: ' + e.message) }