gitoria

12.8 KB

1. // project.hl — gitoria.worldapi.org: THE APP. Routes and WHO HEARS WHAT. Hybriel on hl:web.
2. //
3. // HOW A REPO GETS ITS ADDRESS (ticket #6, gitoria#16): nginx sends `gitoria.worldapi.org` AND every
4. // `<slug>.gitoria.worldapi.org` to this one app. Every page component that declares `host = null` gets the
5. // request's host (without port, hybriel#74) on the SERVER, on the first load and on every hl:web navigation:
6. // the main address shows the repo list + "create" (components/index.hl → list.hl), `<slug>.` shows that repo —
7. // each repo view is its own page component on its own route (readme, code, branch, commit, pulls, releases,
8. // tickets), rendered on the server WITH its content: git is read with hl:proc run(), which waits (hybriel#80).
9. // The session cookie carries `Domain=.<host>` (hl:web `sessionDomain`, hybriel#44) so one
10. // login holds on every address; the login button always returns through the main address
11. // (the only origin registered in ident) and then on to the repo the login started from.
12. import WebFramework from 'hl:web'
13. import { env } from 'hl:proc'
14. import { Response } from 'hl:http1'
15. import { randomBytes } from 'hl:crypto'
17. import Styles from './styles.hl'
18. import { dark, darker } from './shared/tokens.hl'
19. import { reply, fail, wantsMarkdown, markdownReply } from './api.hl'
20. import { repoRows, repoRow, repoDocument, listDocument, slugError } from './repos.hl'
21. import { exchangeCode, ensureUser, hostPort, hostOnly, scheme, domainFor, slugOfHost } from './users.hl'
22. import { ownsRepo, setTicketsConnection, repoBySlug } from './repos.hl'
23. import { connectHref, exchangeConnect, notifyPush } from './tickets.hl'
25. import { gitTransport } from './transport.hl'
26. import { gitKeys, gitAccess } from './sshgate.hl'
28. import Index from './components/index.hl'
29. import Code from './components/code.hl'
30. import Branch from './components/branch.hl'
31. import Commit from './components/commit.hl'
32. import Pulls from './components/pulls.hl'
33. import Releases from './components/releases.hl'
34. import Tickets from './components/tickets.hl'
35. import Settings from './components/settings.hl'
36. import LoginFailed from './components/loginfailed.hl'
38. static siteName = "gitoria"
40. appTitle = siteName
41. styles = Styles
43. // ---- THE INSTALLABLE APP (mission 046), the same way calendar.worldapi.org and tracker do it: hl:web's own web app
44. // manifest (/__hl/manifest.webmanifest, linked from every head with the apple-touch-icon and theme-color) and service
45. // worker (/__hl/sw.js) from these settings — no JavaScript of ours. Icons in icons/ (icon.svg is the source, the PNGs
46. // are rendered from it with rsvg-convert, README "PWA"). The theme colour is the header's background (darker), the
47. // splash background the page's (dark) — both off the tokens. Every repo address is its own origin, so each one gets
48. // its own manifest and worker (start_url / = that repo's Readme).
49. appThemeColor = darker.value
50. appBackgroundColor = dark.value
51. appIcons = [
52. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'any' }
53. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'any' }
54. { src = '/icons/icon-192.png' sizes = '192x192' purpose = 'maskable' }
55. { src = '/icons/icon-512.png' sizes = '512x512' purpose = 'maskable' }
56. ]
57. appTouchIcon = '/icons/apple-touch-icon.png'
58. appFavicon = '/icons/favicon.svg'
59. // OFFLINE: only the shell and `/` (components/main.hl says "You are offline" while the browser has no network). `/`
60. // is kept as last seen (the worker is network-first and refreshes its copy on every online visit): the repo list on
61. // the main address, the Readme on a repo address. Every other page (code, commits, pulls, …) needs the network and
62. // gets hl:web's "Unavailable offline" page.
63. offline = [ Index ]
65. // ---- the API: reads are public (creating a repo is a web action for now) ------------------------
66. apiRepos = (route, req) => {
67. if (req.method != 'GET') { return fail(405, 'GET only') }
68. let rows = repoRows()
69. if (wantsMarkdown(req)) { return markdownReply(listDocument(rows)) }
70. return { repos = rows }
71. }
73. apiRepo = (route, req) => {
74. if (req.method != 'GET') { return fail(405, 'GET only') }
75. let row = repoRow(route.params.slug)
76. if (row == null) { return fail(404, 'no such repository') }
77. if (wantsMarkdown(req)) { return markdownReply(repoDocument(row)) }
78. return row
79. }
81. // ---- THE LOGIN BUTTON'S RETURN (ident README "How apps use ident") ----------------------------
82. // BACK TO THE PAGE: /login.js puts `?next=` into the button's return URL at the click. Only a same-origin PATH
83. // goes (one `/`, URL-safe characters, ≤ 500) — or a full URL of THIS system: <scheme>://<label>.<host>
84. // with a valid, non-reserved repo label and such a path. Anything else → `/`.
85. nextChars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~/?&=%+,;@!$()*:'
86. safePath = (want) => {
87. if (want == null || hlTypeName(want) != 'String' || want == '' || want.length > 500) { return '/' }
88. if (want.slice(0, 1) != '/' || want.slice(0, 2) == '//' || want.slice(0, 7) == '/login/') { return '/' }
89. let i = 0
90. while (i < want.length) {
91. if (!nextChars.includes(want[i])) { return '/' }
92. i = i + 1
93. }
94. return want
95. }
97. safeNext = (want) => {
98. if (want == null || hlTypeName(want) != 'String' || want.length > 500) { return '/' }
99. let prefix = scheme + '://'
100. if (!want.startsWith(prefix)) { return safePath(want) }
101. let rest = want.slice(prefix.length)
102. let slash = rest.indexOf('/')
103. let hp = slash < 0 ? rest : rest.slice(0, slash)
104. let path = slash < 0 ? '/' : rest.slice(slash)
105. let dot = hp.indexOf('.')
106. if (dot < 1 || hp.slice(dot + 1) != hostPort || slugError(hp.slice(0, dot)) != null) { return '/' }
107. let p = safePath(path)
108. if (p == '/' && path != '/') { return '/' }
109. return prefix + hp + p
110. }
112. // A FAILED LOGIN is a page (components/loginfailed.hl): the reason is parked in the session, then → /login/failed
113. failed = (req, why) => {
114. let s = req.session
115. let fresh = s == null
116. if (fresh) { s = server.sessions.mint() }
117. s.data.loginError = why
118. server.sessions.save(s)
119. let res = new Response('login failed: ' + why, { status = 302 headers = { 'Location' = '/login/failed' 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
120. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
121. return res
122. }
124. // the function route gets the cookie's session as req.session (hybriel #11); none yet → minted here
125. loginCallback = (route, req) => {
126. if (req.method != 'GET') { return failed(req, 'GET only') }
127. let q = req.query != null ? req.query : {}
128. let code = q.ident_code
129. if (code == null || code == '') { return failed(req, 'ident sent no login code') }
130. let x = exchangeCode(code)
131. if (x.error != null) { return failed(req, x.error) }
132. let u = ensureUser(x.identity)
133. if (u == null) { return failed(req, 'could not store the user') }
134. let s = req.session
135. let fresh = s == null
136. if (fresh) { s = server.sessions.mint() }
137. s.user = { id = u.id }
138. s.data.tag = randomBytes(16)
139. s.data.loginError = null
140. server.sessions.save(s)
141. let res = new Response('logged in', { status = 302 headers = { 'Location' = safeNext(q.next) 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
142. if (fresh) { res.headers['Set-Cookie'] = server.sessions.cookieHeader(s.id) }
143. return res
144. }
146. // ---- CONNECT A REPO TO A TICKETS PROJECT (gitoria#18; tickets.hl, components/settings.hl) ----------------------------
147. // /settings/connect: the owner's click → a fresh nonce parked in the session (bound to the repo) → tickets' /connect.
148. // /settings/connected: tickets' return with ?code&state → the nonce must match, the person must own the repo → the code is
149. // exchanged from here, the key stored per repo → back to /settings. A failure is a note on the settings page.
150. repoOfRequest = (req) => {
151. let h = req.headers['host']
152. let slug = slugOfHost(h == null ? '' : h.split(':')[0])
153. return slug == '' || slugError(slug) != null ? null : repoBySlug(slug)
154. }
155. goTo = (req, where) => {
156. let res = new Response('redirect', { status = 302 headers = { 'Location' = where 'Cache-Control' = 'no-store' 'Content-Type' = 'text/plain; charset=utf-8' } })
157. return res
158. }
159. connectStart = (route, req) => {
160. if (req.method != 'GET') { return fail(405, 'GET only') }
161. let repo = repoOfRequest(req)
162. if (repo == null) { return fail(404, 'no such repository') }
163. let s = req.session
164. if (s == null || !ownsRepo(repo.slug, s)) { return goTo(req, '/settings') }
165. let nonce = randomBytes(16)
166. s.data.connectState = repo.slug + '.' + nonce
167. s.data.connectNote = null
168. server.sessions.save(s)
169. return goTo(req, connectHref(repo.slug, nonce))
170. }
171. connectBack = (route, req) => {
172. if (req.method != 'GET') { return fail(405, 'GET only') }
173. let repo = repoOfRequest(req)
174. if (repo == null) { return fail(404, 'no such repository') }
175. let s = req.session
176. if (s == null || !ownsRepo(repo.slug, s)) { return goTo(req, '/settings') }
177. let q = req.query != null ? req.query : {}
178. let want = s.data.connectState
179. s.data.connectState = null
180. let note = ''
181. if (q.error != null && q.code == null) {
182. note = 'Tickets did not connect: ' + ('' + q.error).slice(0, 100)
183. } else if (want == null || want != repo.slug + '.' + q.state) {
184. note = 'That connection was not started here (or was used already) — click "Tickets: connect" again.'
185. } else {
186. let x = exchangeConnect(q.code)
187. if (x.error != null) {
188. note = x.error
189. } else {
190. let r = setTicketsConnection(repo.slug, x.key, x.project, x.title, x.api)
191. if (r.error != null) { note = r.error } else { notifyPush(repo.slug, true) }
192. }
193. }
194. s.data.connectNote = note == '' ? null : note
195. server.sessions.save(s)
196. return goTo(req, '/settings')
197. }
199. // EVERY REPO VIEW IS ITS OWN PAGE (gitoria#16); `/` is the list on the main address, the Readme on a repo address.
200. routes = [
201. { pattern = "/favicon.ico" file = "./icons/favicon.ico" headers = { 'Cache-Control' = 'no-cache' } }
202. // the installable app (mission 046): the icons (manifest and service worker are hl:web's own, from appIcons / offline)
203. { pattern = "/icons/icon-192.png" file = "./icons/icon-192.png" headers = { 'Cache-Control' = 'no-cache' } }
204. { pattern = "/icons/icon-512.png" file = "./icons/icon-512.png" headers = { 'Cache-Control' = 'no-cache' } }
205. { pattern = "/icons/apple-touch-icon.png" file = "./icons/apple-touch-icon.png" headers = { 'Cache-Control' = 'no-cache' } }
206. { pattern = "/icons/favicon.svg" file = "./icons/favicon.svg" headers = { 'Cache-Control' = 'no-cache' } }
207. { pattern = "/login/callback" function = loginCallback }
208. { pattern = "/login/failed" component = LoginFailed }
209. { pattern = "/login.js" file = "./login.js" headers = { 'Cache-Control' = 'no-cache' } }
210. { pattern = "/api/repos" function = apiRepos }
211. { pattern = "/api/repos/:slug" function = apiRepo }
212. { pattern = "/" component = Index }
213. { pattern = "/code" component = Code }
214. { pattern = "/code/*path" component = Code }
215. { pattern = "/branch/*path" component = Branch }
216. { pattern = "/commit/*path" component = Commit }
217. { pattern = "/pulls" component = Pulls }
218. { pattern = "/releases" component = Releases }
219. { pattern = "/tickets" component = Tickets }
220. { pattern = "/settings" component = Settings }
221. { pattern = "/settings/connect" function = connectStart }
222. { pattern = "/settings/connected" function = connectBack }
223. { pattern = "/__git/keys" function = gitKeys }
224. { pattern = "/__git/access" function = gitAccess }
225. { pattern = "/:repo/info/refs" function = gitTransport }
226. { pattern = "/:repo/git-upload-pack" function = gitTransport }
227. { pattern = "/:repo/git-receive-pack" function = gitTransport }
228. ]
230. // WHO GETS THE PUSH: a new repo reaches every open page (the list follows live)
231. // `gitoriaSignedIn` / `gitoriaSignedOut` go to the tabs of ONE session: the one whose login carries
232. // that random tag (session.data.tag, set at login) — every open page of it switches without a reload.
233. tagOf = (session) => { return session != null && session.data != null ? session.data.tag : null }
234. audience = {
235. repoCreated = (row, session) => { return true }
236. ticketOpened = (slug, row, session) => { return true }
237. gitoriaSignedIn = (tag, info, session) => { return tag != null && tagOf(session) == tag }
238. gitoriaSignedOut = (tag, session) => { return tag != null && tagOf(session) == tag }
239. }
241. sessionDir = env('GITORIA_SESSIONS') != null ? env('GITORIA_SESSIONS') : null
242. port = env('GITORIA_PORT') != null ? toNumber(env('GITORIA_PORT')) : 8360
243. // HL_HOST = the interface hl:web binds (hybriel #24, fixed upstream): 127.0.0.1 on Byrodin behind nginx;
244. // unset = 0.0.0.0 (dev on Loreana). GITORIA_WATCH=0 = no dev watcher. The session cookie is `gitoriasid` (hybriel #10).
245. watching = env('GITORIA_WATCH') != '0'
246. sessionCookie = 'gitoriasid'
247. // the cookie's Domain (hybriel#44): every <slug>.<host> shares the login (users.hl domainFor; '' = host-only → null)
248. sessionDomain = domainFor(hostOnly) != '' ? domainFor(hostOnly) : null
249. server = new WebFramework(routes = routes, styles = styles, minify = true, port = port, watchMode = watching, sessionCookie = sessionCookie, sessionDomain = sessionDomain)
251. on Error(e) { console.log('error absorbed: ' + e.message) }