424 lines
18 KiB
JavaScript
424 lines
18 KiB
JavaScript
// Shared forge logic: account discovery (gh + tea-cli), REST access, git URL parsing,
|
|
// clone and push. Used by the Host plugin (index.js) and the git credential helper.
|
|
import { execFile } from 'node:child_process'
|
|
import fs from 'node:fs'
|
|
import os from 'node:os'
|
|
import path from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
|
|
export const HELPER_PATH = path.join(path.dirname(fileURLToPath(import.meta.url)), 'credential-helper.mjs')
|
|
|
|
const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v)
|
|
|
|
// ---- process helpers --------------------------------------------------------
|
|
|
|
/** Run a command; resolves { code, stdout, stderr } (never rejects on exit code). */
|
|
export function run(cmd, args, { cwd, env, timeoutMs = 30000, signal, input } = {}) {
|
|
return new Promise((resolve) => {
|
|
const child = execFile(cmd, args, {
|
|
cwd,
|
|
env: { ...process.env, ...env },
|
|
timeout: timeoutMs,
|
|
maxBuffer: 32 * 1024 * 1024,
|
|
signal,
|
|
windowsHide: true,
|
|
}, (error, stdout, stderr) => {
|
|
const code = error ? (typeof error.code === 'number' ? error.code : 1) : 0
|
|
resolve({ code, stdout: String(stdout ?? ''), stderr: String(stderr ?? '') || (error && code !== 0 && !stderr ? String(error.message) : ''), error })
|
|
})
|
|
if (input !== undefined) child.stdin?.end(input)
|
|
})
|
|
}
|
|
|
|
// ---- account discovery ------------------------------------------------------
|
|
|
|
function unquote(v) {
|
|
v = v.trim()
|
|
if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) return v.slice(1, -1)
|
|
return v
|
|
}
|
|
|
|
/** Minimal parser for tea's config.yml `logins:` list. */
|
|
export function parseTeaConfig(text) {
|
|
const logins = []
|
|
let inLogins = false
|
|
let cur = null
|
|
for (const raw of text.split(/\r?\n/)) {
|
|
if (!raw.trim() || raw.trim().startsWith('#')) continue
|
|
if (/^[^\s-]/.test(raw)) { inLogins = /^logins\s*:/.test(raw); cur = null; continue }
|
|
if (!inLogins) continue
|
|
let line = raw
|
|
const item = /^(\s*)-\s+(.*)$/.exec(line)
|
|
if (item) { cur = {}; logins.push(cur); line = item[2] } else line = line.trim()
|
|
const kv = /^([A-Za-z0-9_]+)\s*:\s*(.*)$/.exec(line)
|
|
if (cur && kv) cur[kv[1]] = unquote(kv[2])
|
|
}
|
|
return logins
|
|
}
|
|
|
|
function teaConfigPath() {
|
|
const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config')
|
|
return path.join(base, 'tea', 'config.yml')
|
|
}
|
|
|
|
function giteaAccounts() {
|
|
let text
|
|
try { text = fs.readFileSync(teaConfigPath(), 'utf8') } catch { return [] }
|
|
const out = []
|
|
for (const l of parseTeaConfig(text)) {
|
|
if (!l.url || !l.token) continue
|
|
let u
|
|
try { u = new URL(l.url) } catch { continue }
|
|
const base = l.url.replace(/\/+$/, '')
|
|
out.push({
|
|
id: `gitea:${l.name || u.host}`,
|
|
kind: 'gitea',
|
|
name: l.name || u.host,
|
|
host: u.host,
|
|
sshHost: l.ssh_host || u.hostname,
|
|
user: l.user || '',
|
|
url: base,
|
|
apiBase: `${base}/api/v1`,
|
|
token: l.token,
|
|
insecure: l.insecure === 'true',
|
|
})
|
|
}
|
|
return out
|
|
}
|
|
|
|
async function githubAccounts() {
|
|
const st = await run('gh', ['auth', 'status', '--json', 'hosts'], { timeoutMs: 15000 })
|
|
if (st.code !== 0 && !st.stdout.trim()) return []
|
|
let data
|
|
try { data = JSON.parse(st.stdout) } catch { return [] }
|
|
const out = []
|
|
for (const [host, entries] of Object.entries(data?.hosts ?? {})) {
|
|
for (const e of Array.isArray(entries) ? entries : []) {
|
|
if (!e?.login || (e.state && e.state !== 'success')) continue
|
|
const tok = await run('gh', ['auth', 'token', '--hostname', host, '--user', e.login], { timeoutMs: 15000 })
|
|
const token = tok.stdout.trim()
|
|
if (tok.code !== 0 || !token) continue
|
|
out.push({
|
|
id: `github:${host === 'github.com' ? '' : host + ':'}${e.login}`,
|
|
kind: 'github',
|
|
name: e.login,
|
|
host,
|
|
sshHost: host,
|
|
user: e.login,
|
|
url: `https://${host}`,
|
|
apiBase: host === 'github.com' ? 'https://api.github.com' : `https://${host}/api/v3`,
|
|
token,
|
|
active: e.active !== false,
|
|
})
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
const flavorCache = new Map()
|
|
/** Gitea and Forgejo share the /api/v1 API; Forgejo additionally serves /api/forgejo/v1/version. */
|
|
async function detectFlavor(account) {
|
|
if (flavorCache.has(account.url)) return flavorCache.get(account.url)
|
|
let flavor = 'gitea'
|
|
try {
|
|
const res = await fetch(`${account.url}/api/forgejo/v1/version`, { headers: { authorization: `token ${account.token}` }, signal: AbortSignal.timeout(5000) })
|
|
if (res.ok) flavor = 'forgejo'
|
|
} catch { return 'gitea' }
|
|
flavorCache.set(account.url, flavor)
|
|
return flavor
|
|
}
|
|
|
|
let accountCache = null
|
|
/** Drop cached accounts (after login/logout). */
|
|
export function resetAccountCache() { accountCache = null }
|
|
/** All authorized accounts (tokens included — never send them to a client). */
|
|
export async function listAccounts({ refresh = false } = {}) {
|
|
if (!refresh && accountCache && Date.now() - accountCache.at < 60000) return accountCache.accounts
|
|
const [gh, gt] = await Promise.all([githubAccounts().catch(() => []), Promise.resolve(giteaAccounts())])
|
|
await Promise.all(gt.map(async (a) => { a.flavor = await detectFlavor(a) }))
|
|
const accounts = [...gh, ...gt]
|
|
accountCache = { at: Date.now(), accounts }
|
|
return accounts
|
|
}
|
|
|
|
export const publicAccount = (a) => ({ id: a.id, kind: a.kind, flavor: a.flavor ?? a.kind, name: a.name, host: a.host, user: a.user ?? '', url: a.url })
|
|
|
|
// ---- git URLs ---------------------------------------------------------------
|
|
|
|
/** Parse https/http/ssh/scp-like git URLs → { protocol, host, hostname, port, owner, name, fullName } or null. */
|
|
export function parseGitUrl(input) {
|
|
const s = String(input ?? '').trim()
|
|
if (!s) return null
|
|
if (!s.includes('://')) {
|
|
// scp-like: [user@]host:owner/name(.git)
|
|
const m = /^(?:([\w.-]+)@)?([\w.-]+):\/?(.+)$/.exec(s)
|
|
if (m && m[2].length > 1) return finish('ssh', m[2], m[2], '', m[3], m[1] || 'git')
|
|
return null
|
|
}
|
|
let u
|
|
try { u = new URL(s) } catch { return null }
|
|
const protocol = u.protocol.replace(/:$/, '')
|
|
if (!['http', 'https', 'ssh', 'git'].includes(protocol)) return null
|
|
return finish(protocol, u.host, u.hostname, u.port, decodeURIComponent(u.pathname), u.username || '')
|
|
|
|
function finish(protocol, host, hostname, port, pathname, user) {
|
|
const parts = pathname.replace(/^\/+|\/+$/g, '').replace(/\.git$/, '').split('/').filter(Boolean)
|
|
if (parts.length < 2) return null
|
|
const name = parts[parts.length - 1]
|
|
const owner = parts.slice(0, -1).join('/')
|
|
return { protocol, host, hostname, port, user, owner, name, fullName: `${owner}/${name}` }
|
|
}
|
|
}
|
|
|
|
function hostMatches(account, parsed) {
|
|
const h = parsed.hostname.toLowerCase()
|
|
const candidates = [account.host, account.sshHost, account.host.split(':')[0]].filter(Boolean).map((x) => x.toLowerCase())
|
|
return candidates.includes(h) || candidates.includes(parsed.host.toLowerCase())
|
|
}
|
|
|
|
/** Pick the account matching a URL host (prefers a login owning the repo owner). */
|
|
export function accountForUrl(accounts, parsed) {
|
|
if (!parsed) return null
|
|
const matches = accounts.filter((a) => hostMatches(a, parsed))
|
|
if (!matches.length) return null
|
|
return matches.find((a) => a.user && a.user.toLowerCase() === parsed.owner.toLowerCase()) ?? matches.find((a) => a.active !== false) ?? matches[0]
|
|
}
|
|
|
|
export function httpsCloneUrl(account, parsed) {
|
|
if (account) return `${account.url}/${parsed.fullName}.git`
|
|
return `https://${parsed.hostname}/${parsed.fullName}.git`
|
|
}
|
|
|
|
function hasSshKeys() {
|
|
try {
|
|
const dir = path.join(os.homedir(), '.ssh')
|
|
return fs.readdirSync(dir).some((f) => /^id_/.test(f) && !f.endsWith('.pub'))
|
|
} catch { return false }
|
|
}
|
|
|
|
export function expandHome(p) {
|
|
p = String(p ?? '').trim()
|
|
if (p === '~') return os.homedir()
|
|
if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2))
|
|
return p
|
|
}
|
|
|
|
// ---- REST -------------------------------------------------------------------
|
|
|
|
export class ForgeError extends Error {
|
|
constructor(message, status, data) { super(message); this.status = status; this.data = data }
|
|
}
|
|
|
|
/** Call a forge REST API. `pathname` is relative to the API base (e.g. "/user/repos"). */
|
|
export async function api(account, method, pathname, { query, body, signal, raw = false } = {}) {
|
|
let url = /^https?:\/\//.test(pathname) ? pathname : `${account.apiBase}${pathname.startsWith('/') ? '' : '/'}${pathname}`
|
|
if (query) {
|
|
const u = new URL(url)
|
|
for (const [k, v] of Object.entries(query)) if (v !== undefined && v !== null && v !== '') u.searchParams.set(k, String(v))
|
|
url = u.toString()
|
|
}
|
|
const headers = {
|
|
accept: account.kind === 'github' ? 'application/vnd.github+json' : 'application/json',
|
|
authorization: account.kind === 'github' ? `Bearer ${account.token}` : `token ${account.token}`,
|
|
'user-agent': 'dsh-git-forge',
|
|
}
|
|
if (body !== undefined) headers['content-type'] = 'application/json'
|
|
const timeout = AbortSignal.timeout(30000)
|
|
const res = await fetch(url, {
|
|
method,
|
|
headers,
|
|
body: body === undefined ? undefined : JSON.stringify(body),
|
|
signal: signal ? AbortSignal.any([signal, timeout]) : timeout,
|
|
})
|
|
const text = await res.text()
|
|
let data = text
|
|
try { data = text ? JSON.parse(text) : null } catch { /* keep text */ }
|
|
if (!res.ok) {
|
|
const msg = isObj(data) ? (data.message || data.error || JSON.stringify(data)) : String(text).slice(0, 500)
|
|
throw new ForgeError(`${method} ${pathname} → ${res.status}: ${msg}`, res.status, data)
|
|
}
|
|
return raw ? { status: res.status, headers: Object.fromEntries(res.headers), data } : data
|
|
}
|
|
|
|
/** Paginated GET collecting arrays (or `.items`) up to `max` entries. */
|
|
export async function apiList(account, pathname, { query = {}, max = 100, signal } = {}) {
|
|
const per = account.kind === 'github' ? Math.min(100, max) : Math.min(50, max)
|
|
const out = []
|
|
for (let page = 1; out.length < max && page <= 20; page++) {
|
|
const q = { ...query, page, ...(account.kind === 'github' ? { per_page: per } : { limit: per }) }
|
|
const data = await api(account, 'GET', pathname, { query: q, signal })
|
|
const items = Array.isArray(data) ? data : Array.isArray(data?.items) ? data.items : Array.isArray(data?.data) ? data.data : []
|
|
out.push(...items)
|
|
if (items.length < per) break
|
|
}
|
|
return out.slice(0, max)
|
|
}
|
|
|
|
export function normRepo(account, r) {
|
|
return {
|
|
account: account.id,
|
|
kind: account.kind,
|
|
flavor: account.flavor ?? account.kind,
|
|
host: account.host,
|
|
fullName: r.full_name,
|
|
owner: r.owner?.login ?? r.owner?.username ?? '',
|
|
name: r.name,
|
|
description: r.description || '',
|
|
private: !!r.private,
|
|
fork: !!r.fork,
|
|
archived: !!r.archived,
|
|
cloneUrl: r.clone_url,
|
|
sshUrl: r.ssh_url,
|
|
htmlUrl: r.html_url,
|
|
defaultBranch: r.default_branch,
|
|
updatedAt: r.updated_at || r.pushed_at || null,
|
|
}
|
|
}
|
|
|
|
export async function listRepos(account, { query, owner, max = 300, signal } = {}) {
|
|
let raw
|
|
if (query) {
|
|
if (account.kind === 'github') {
|
|
const q = owner ? `${query} user:${owner}` : query
|
|
raw = await apiList(account, '/search/repositories', { query: { q }, max: Math.min(max, 100), signal })
|
|
} else {
|
|
raw = await apiList(account, '/repos/search', { query: { q: query, ...(owner ? { owner } : {}) }, max: Math.min(max, 100), signal })
|
|
}
|
|
} else if (owner && owner.toLowerCase() !== (account.user || '').toLowerCase()) {
|
|
raw = await apiList(account, `/orgs/${encodeURIComponent(owner)}/repos`, { max, signal })
|
|
.catch(() => apiList(account, `/users/${encodeURIComponent(owner)}/repos`, { max, signal }))
|
|
} else if (account.kind === 'github') {
|
|
raw = await apiList(account, '/user/repos', { query: { sort: 'updated', affiliation: 'owner,collaborator,organization_member' }, max, signal })
|
|
} else {
|
|
raw = await apiList(account, '/user/repos', { max, signal })
|
|
}
|
|
return raw.map((r) => normRepo(account, r))
|
|
}
|
|
|
|
// ---- git operations ---------------------------------------------------------
|
|
|
|
/** git -c options that make git ask our helper for credentials of known accounts. */
|
|
export function credentialArgs() {
|
|
const helper = `!'${process.execPath.replace(/'/g, "'\\''")}' '${HELPER_PATH.replace(/'/g, "'\\''")}'`
|
|
return ['-c', 'credential.helper=', '-c', `credential.helper=${helper}`]
|
|
}
|
|
|
|
const GIT_ENV = {
|
|
GIT_TERMINAL_PROMPT: '0',
|
|
GIT_SSH_COMMAND: 'ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new',
|
|
}
|
|
|
|
export function deriveName(url) {
|
|
const p = parseGitUrl(url)
|
|
if (p) return p.name
|
|
const last = String(url).replace(/[\\/]+$/, '').split(/[\\/:]/).pop() || 'repo'
|
|
return last.replace(/\.git$/, '')
|
|
}
|
|
|
|
/**
|
|
* Clone `url` into `parent/name`. SSH URLs of hosts without local SSH keys are
|
|
* rewritten to HTTPS so the account token can be used.
|
|
*/
|
|
export async function cloneRepo({ url, parent, name, branch, depth, signal }) {
|
|
url = String(url ?? '').trim()
|
|
if (!url) throw new ForgeError('url is required', 400)
|
|
parent = path.resolve(expandHome(parent || os.homedir()))
|
|
name = String(name || deriveName(url)).trim()
|
|
if (!name || name === '.' || name === '..' || /[\\/]/.test(name)) throw new ForgeError(`invalid folder name: ${name}`, 400)
|
|
const target = path.join(parent, name)
|
|
if (fs.existsSync(target) && fs.readdirSync(target).length > 0) throw new ForgeError(`destination already exists and is not empty: ${target}`, 409)
|
|
fs.mkdirSync(parent, { recursive: true })
|
|
|
|
const accounts = await listAccounts()
|
|
const parsed = parseGitUrl(url)
|
|
const account = accountForUrl(accounts, parsed)
|
|
let effective = url
|
|
if (parsed && (parsed.protocol === 'ssh' || parsed.protocol === 'git') && (account || !hasSshKeys())) {
|
|
effective = httpsCloneUrl(account, parsed)
|
|
}
|
|
const args = [...credentialArgs(), 'clone', '--progress']
|
|
if (branch) args.push('--branch', String(branch))
|
|
if (depth) args.push('--depth', String(depth))
|
|
args.push('--', effective, target)
|
|
const r = await run('git', args, { env: GIT_ENV, timeoutMs: 30 * 60000, signal })
|
|
if (r.code !== 0) {
|
|
const msg = r.stderr.split('\n').filter((l) => l.trim() && !/^(Cloning into|remote: (Counting|Compressing|Enumerating|Total)|Receiving|Resolving)/.test(l)).slice(-6).join('\n')
|
|
throw new ForgeError(`git clone failed: ${msg || r.stderr.slice(-500) || 'unknown error'}`, 422)
|
|
}
|
|
// Keep the repo's own pushes/fetches authenticated through the helper.
|
|
if (account) {
|
|
await run('git', ['-C', target, 'config', '--local', '--add', 'credential.helper', ''])
|
|
await run('git', ['-C', target, 'config', '--local', '--add', 'credential.helper', credentialArgs()[3].slice('credential.helper='.length)])
|
|
}
|
|
return { path: target, url: effective, account: account ? account.id : null }
|
|
}
|
|
|
|
export async function gitIn(cwd, args, opts = {}) {
|
|
return run('git', ['-C', cwd, ...args], { env: GIT_ENV, timeoutMs: 10 * 60000, ...opts })
|
|
}
|
|
|
|
/** Push local commits using account credentials. */
|
|
export async function pushRepo({ cwd, remote = 'origin', branch, setUpstream = true, force = false, tags = false, signal }) {
|
|
const top = await gitIn(cwd, ['rev-parse', '--show-toplevel'])
|
|
if (top.code !== 0) throw new ForgeError(`not a git repository: ${cwd}`, 400)
|
|
const root = top.stdout.trim()
|
|
if (!branch) {
|
|
const b = await gitIn(root, ['symbolic-ref', '--short', 'HEAD'])
|
|
if (b.code !== 0) throw new ForgeError('HEAD is detached; pass branch explicitly', 400)
|
|
branch = b.stdout.trim()
|
|
}
|
|
const remoteUrl = (await gitIn(root, ['remote', 'get-url', remote])).stdout.trim()
|
|
if (!remoteUrl) throw new ForgeError(`remote "${remote}" not found`, 400)
|
|
let pushTarget = remote
|
|
const parsed = parseGitUrl(remoteUrl)
|
|
if (parsed && parsed.protocol === 'ssh' && !hasSshKeys()) {
|
|
const account = accountForUrl(await listAccounts(), parsed)
|
|
pushTarget = httpsCloneUrl(account, parsed)
|
|
}
|
|
const ahead = await gitIn(root, ['rev-list', '--count', `${remote}/${branch}..${branch}`])
|
|
const args = [...credentialArgs(), '-C', root, 'push', '--porcelain']
|
|
if (setUpstream && pushTarget === remote) args.push('--set-upstream')
|
|
if (force) args.push('--force-with-lease')
|
|
if (tags) args.push('--follow-tags')
|
|
args.push(pushTarget, `${branch}:${branch}`)
|
|
const r = await run('git', args, { env: GIT_ENV, timeoutMs: 10 * 60000, signal })
|
|
if (r.code !== 0) throw new ForgeError(`git push failed: ${(r.stderr || r.stdout).trim().slice(-1500)}`, 422)
|
|
if (pushTarget !== remote) await gitIn(root, ['fetch', remote, branch]).catch(() => {})
|
|
return {
|
|
repository: root,
|
|
remote,
|
|
remoteUrl,
|
|
branch,
|
|
commitsPushed: ahead.code === 0 ? Number(ahead.stdout.trim()) : null,
|
|
output: (r.stdout + r.stderr).trim().split('\n').filter((l) => !/^remote:\s*$/.test(l)).slice(-15).join('\n'),
|
|
}
|
|
}
|
|
|
|
/** Resolve "owner/name", a URL, or the cwd's remote into { account, owner, name }. */
|
|
export async function resolveRepo({ repo, account: accountId, cwd, remote = 'origin' }) {
|
|
const accounts = await listAccounts()
|
|
if (!accounts.length) throw new ForgeError('no authorized accounts: run `gh auth login` or `tea-cli login add` (or `tea login add`) on the host', 400)
|
|
let byId = null
|
|
if (accountId) {
|
|
byId = accounts.find((a) => a.id === accountId || a.name === accountId || `${a.user}@${a.host}` === accountId)
|
|
if (!byId) throw new ForgeError(`unknown account "${accountId}"; available: ${accounts.map((a) => a.id).join(', ')}`, 400)
|
|
}
|
|
let parsed = null
|
|
if (repo && /[:@]|\/\//.test(repo)) parsed = parseGitUrl(repo)
|
|
else if (repo) {
|
|
const parts = String(repo).replace(/^\/+|\/+$/g, '').split('/')
|
|
if (parts.length < 2) throw new ForgeError(`repo must be "owner/name" or a URL, got "${repo}"`, 400)
|
|
const account = byId ?? (accounts.length === 1 ? accounts[0] : null)
|
|
if (!account) throw new ForgeError(`several accounts are authorized; pass account (one of ${accounts.map((a) => a.id).join(', ')}) or a full repo URL`, 400)
|
|
return { account, owner: parts.slice(0, -1).join('/'), name: parts[parts.length - 1].replace(/\.git$/, '') }
|
|
} else if (cwd) {
|
|
const r = await gitIn(cwd, ['remote', 'get-url', remote], { timeoutMs: 10000 })
|
|
if (r.code !== 0) throw new ForgeError(`no repo given and ${cwd} has no "${remote}" remote`, 400)
|
|
parsed = parseGitUrl(r.stdout.trim())
|
|
}
|
|
if (!parsed) throw new ForgeError(`cannot parse repository "${repo ?? ''}"`, 400)
|
|
const account = byId ?? accountForUrl(accounts, parsed)
|
|
if (!account) throw new ForgeError(`no authorized account for host ${parsed.host}; available: ${accounts.map((a) => `${a.id} (${a.host})`).join(', ')}`, 400)
|
|
return { account, owner: parsed.owner, name: parsed.name }
|
|
}
|