gitoria

10.7 KB

1. // project.hl — gitoria.worldapi.org: THE APP. Routes and WHO HEARS WHAT. Hybriel on hl:web.
2. //
3. // HOW A REPO GETS ITS ADDRESS (ticket #6, gitoria#16): nginx sends `gitoria.worldapi.org` AND every
4. // `<slug>.gitoria.worldapi.org` to this one app. Every page component that declares `host = null` gets the
5. // request's host (without port, hybriel#74) on the SERVER, on the first load and on every hl:web navigation:
6. // the main address shows the repo list + "create" (components/index.hl → list.hl), `<slug>.` shows that repo —
7. // each repo view is its own page component on its own route (readme, code, branch, commit, pulls, releases,
8. // tickets), rendered on the server WITH its content: git is read with hl:proc run(), which waits (hybriel#80).
9. // The session cookie carries `Domain=.<host>` (hl:web `sessionDomain`, hybriel#44) so one
10. // login holds on every address; the login button always returns through the main address
11. // (the only origin registered in ident) and then on to the repo the login started from.
12. import WebFramework from 'hl:web'
13. import { env } from 'hl:proc'
14. import { Response } from 'hl:http1'
15. import { randomBytes } from 'hl:crypto'
17. import Styles from './styles.hl'
18. import { reply, fail, wantsMarkdown, markdownReply } from './api.hl'
19. import { repoRows, repoRow, repoDocument, listDocument, slugError } from './repos.hl'
20. import { exchangeCode, ensureUser, hostPort, hostOnly, scheme, domainFor, slugOfHost } from './users.hl'
21. import { ownsRepo, setTicketsConnection, repoBySlug } from './repos.hl'
22. import { connectHref, exchangeConnect, notifyPush } from './tickets.hl'
24. import { gitTransport } from './transport.hl'
25. import { gitKeys, gitAccess } from './sshgate.hl'
27. import Index from './components/index.hl'
28. import Code from './components/code.hl'
29. import Branch from './components/branch.hl'
30. import Commit from './components/commit.hl'
31. import Pulls from './components/pulls.hl'
32. import Releases from './components/releases.hl'
33. import Tickets from './components/tickets.hl'
34. import Settings from './components/settings.hl'
35. import LoginFailed from './components/loginfailed.hl'
37. static siteName = "gitoria"
39. appTitle = siteName
40. styles = Styles
42. // ---- the API: reads are public (creating a repo is a web action for now) ------------------------
43. apiRepos = (route, req) => {
44. if (req.method != 'GET') { return fail(405, 'GET only') }
45. let rows = repoRows()
46. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows)) }
47. return { repos = rows }
48. }
50. apiRepo = (route, req) => {
51. if (req.method != 'GET') { return fail(405, 'GET only') }
52. let row = repoRow(route.params.slug)
53. if (row == null) { return fail(404, 'no such repository') }
54. if (wantsMarkdown(req)) { return markdownReply(repoDocument(row)) }
55. return row
56. }
58. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident") ----------------------------
59. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
60. // goes (one `/`, URL-safe characters, ≤ 500) — or a full URL of THIS system: <scheme>://<label>.<host>
61. // with a valid, non-reserved repo label and such a path. Anything else → `/`.
62. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
63. safePath = (want) => {
64. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
65. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
66. let i = 0
67. while (i < want.length) {
68. if (!nextChars.includes(want[i])) { return '/' }
69. i = i + 1
70. }
71. return want
72. }
74. safeNext = (want) => {
75. if (want == null || hlTypeName(want) != 'String' || want.length > 500) { return '/' }
76. let prefix = scheme + '://'
77. if (!want.startsWith(prefix)) { return safePath(want) }
78. let rest = want.slice(prefix.length)
79. let slash = rest.indexOf('/')
80. let hp = slash < 0 ? rest : rest.slice(0, slash)
81. let path = slash < 0 ? '/' : rest.slice(slash)
82. let dot = hp.indexOf('.')
83. if (dot < 1 || hp.slice(dot + 1) != hostPort || slugError(hp.slice(0, dot)) != null) { return '/' }
84. let p = safePath(path)
85. if (p == '/' && path != '/') { return '/' }
86. return prefix + hp + p
87. }
89. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
90. failed = (req, why) => {
91. let s = req.session
92. let fresh = s == null
93. if (fresh) { s = server.sessions.mint() }
94. s.data.loginError = why
95. server.sessions.save(s)
96. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
97. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
98. return res
99. }
101. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
102. loginCallback = (route, req) => {
103. if (req.method != 'GET') { return failed(req, 'GET only') }
104. let q = req.query != null ? req.query : {}
105. let code = q.ident_code
106. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
107. let x = exchangeCode(code)
108. if (x.error != null) { return failed(req, x.error) }
109. let u = ensureUser(x.identity)
110. if (u == null) { return failed(req, 'could not store the user') }
111. let s = req.session
112. let fresh = s == null
113. if (fresh) { s = server.sessions.mint() }
114. s.user = { id = u.id }
115. s.data.tag = randomBytes(16)
116. s.data.loginError = null
117. server.sessions.save(s)
118. let res = new Response('logged in', { status = 302 headers = { 'Location' = safeNext(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
119. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
120. return res
121. }
123. // ---- CONNECT A REPO TO A TICKETS PROJECT (gitoria#18; tickets.hl, components/settings.hl) ----------------------------
124. // /settings/connect: the owner's click → a fresh nonce parked in the session (bound to the repo) → tickets' /connect.
125. // /settings/connected: tickets' return with ?code&state → the nonce must match, the person must own the repo → the code is
126. // exchanged from here, the key stored per repo → back to /settings. A failure is a note on the settings page.
127. repoOfRequest = (req) => {
128. let h = req.headers['host']
129. let slug = slugOfHost(h == null ? '' : h.split(':')[0])
130. return slug == '' || slugError(slug) != null ? null : repoBySlug(slug)
131. }
132. goTo = (req, where) => {
133. let res = new Response('redirect', { status = 302 headers = { 'Location' = where 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
134. return res
135. }
136. connectStart = (route, req) => {
137. if (req.method != 'GET') { return fail(405, 'GET only') }
138. let repo = repoOfRequest(req)
139. if (repo == null) { return fail(404, 'no such repository') }
140. let s = req.session
141. if (s == null || !ownsRepo(repo.slug, s)) { return goTo(req, '/settings') }
142. let nonce = randomBytes(16)
143. s.data.connectState = repo.slug + '.' + nonce
144. s.data.connectNote = null
145. server.sessions.save(s)
146. return goTo(req, connectHref(repo.slug, nonce))
147. }
148. connectBack = (route, req) => {
149. if (req.method != 'GET') { return fail(405, 'GET only') }
150. let repo = repoOfRequest(req)
151. if (repo == null) { return fail(404, 'no such repository') }
152. let s = req.session
153. if (s == null || !ownsRepo(repo.slug, s)) { return goTo(req, '/settings') }
154. let q = req.query != null ? req.query : {}
155. let want = s.data.connectState
156. s.data.connectState = null
157. let note = ''
158. if (q.error != null && q.code == null) {
159. note = 'Tickets did not connect: ' + ('' + q.error).slice(0, 100)
160. } else if (want == null || want != repo.slug + '.' + q.state) {
161. note = 'That connection was not started here (or was used already) — click "Tickets: connect" again.'
162. } else {
163. let x = exchangeConnect(q.code)
164. if (x.error != null) {
165. note = x.error
166. } else {
167. let r = setTicketsConnection(repo.slug, x.key, x.project, x.title, x.api)
168. if (r.error != null) { note = r.error } else { notifyPush(repo.slug, true) }
169. }
170. }
171. s.data.connectNote = note == '' ? null : note
172. server.sessions.save(s)
173. return goTo(req, '/settings')
174. }
176. // EVERY REPO VIEW IS ITS OWN PAGE (gitoria#16); `/` is the list on the main address, the Readme on a repo address.
177. routes = [
178. { pattern = "/favicon.ico" direct = "" }
179. { pattern = "/login/callback" function = loginCallback }
180. { pattern = "/login/failed" component = LoginFailed }
181. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
182. { pattern = "/api/repos" function = apiRepos }
183. { pattern = "/api/repos/:slug" function = apiRepo }
184. { pattern = "/" component = Index }
185. { pattern = "/code" component = Code }
186. { pattern = "/code/*path" component = Code }
187. { pattern = "/branch/*path" component = Branch }
188. { pattern = "/commit/*path" component = Commit }
189. { pattern = "/pulls" component = Pulls }
190. { pattern = "/releases" component = Releases }
191. { pattern = "/tickets" component = Tickets }
192. { pattern = "/settings" component = Settings }
193. { pattern = "/settings/connect" function = connectStart }
194. { pattern = "/settings/connected" function = connectBack }
195. { pattern = "/__git/keys" function = gitKeys }
196. { pattern = "/__git/access" function = gitAccess }
197. { pattern = "/:repo/info/refs" function = gitTransport }
198. { pattern = "/:repo/git-upload-pack" function = gitTransport }
199. { pattern = "/:repo/git-receive-pack" function = gitTransport }
200. ]
202. // WHO GETS THE PUSH: a new repo reaches every open page (the list follows live)
203. // `gitoriaSignedIn` / `gitoriaSignedOut` go to the tabs of ONE session: the one whose login carries
204. // that random tag (session.data.tag, set at login) — every open page of it switches without a reload.
205. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
206. audience = {
207. repoCreated = (row, session) => { return true }
208. ticketOpened = (slug, row, session) => { return true }
209. gitoriaSignedIn = (tag, info, session) => { return tag != null && tagOf(session) == tag }
210. gitoriaSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
211. }
213. sessionDir = env('GITORIA_SESSIONS') != null ? env('GITORIA_SESSIONS') : null
214. port = env('GITORIA_PORT') != null ? toNumber(env('GITORIA_PORT')) : 8360
215. // HL_HOST = the interface hl:web binds (hybriel #24, fixed upstream): 127.0.0.1 on Byrodin behind nginx;
216. // unset = 0.0.0.0 (dev on Loreana). GITORIA_WATCH=0 = no dev watcher. The session cookie is `gitoriasid` (hybriel #10).
217. watching = env('GITORIA_WATCH') != '0'
218. sessionCookie = 'gitoriasid'
219. // the cookie's Domain (hybriel#44): every <slug>.<host> shares the login (users.hl domainFor; '' = host-only → null)
220. sessionDomain = domainFor(hostOnly) != '' ? domainFor(hostOnly) : null
221. server = new WebFramework(routes = routes, styles = styles, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie, sessionDomain = sessionDomain)
223. on Error(e) { console.log('error absorbed: ' + e.message) }