| 1 | /** |
| 2 | * The parts of signing in with GitHub and installing g1t's GitHub App that |
| 3 | * the site itself decides: the cookies that bind a trip to GitHub to the |
| 4 | * browser that started it, and checking what comes back. |
| 5 | */ |
| 6 | |
| 7 | /** The state sent to GitHub to sign in or link, for ten minutes. */ |
| 8 | export const STATE_COOKIE = "g1t_github_state"; |
| 9 | /** A GitHub sign-in waiting on a username, or on signing in to link. */ |
| 10 | export const PENDING_COOKIE = "g1t_github_pending"; |
| 11 | /** A sign-in that gave the right password and waits for a two-factor code: identity's challenge. */ |
| 12 | export const TWO_FACTOR_COOKIE = "g1t_two_factor"; |
| 13 | /** How long that waits, in seconds, as identity's `TWO_FACTOR_CHALLENGE_SECONDS`. */ |
| 14 | export const TWO_FACTOR_SECONDS = 600; |
| 15 | /** An installation under way: its state and the workspace it is for. */ |
| 16 | export const INSTALL_COOKIE = "g1t_github_install"; |
| 17 | |
| 18 | /** The value of a cookie, or null. Values here are hex and slugs only. */ |
| 19 | export function readCookie(header: string | null, name: string): string | null { |
| 20 | for (const part of (header ?? "").split(";")) { |
| 21 | const [key, ...rest] = part.trim().split("="); |
| 22 | if (key === name) { |
| 23 | const value = rest.join("="); |
| 24 | return /^[0-9a-z.-]{1,200}$/.test(value) ? value : null; |
| 25 | } |
| 26 | } |
| 27 | return null; |
| 28 | } |
| 29 | |
| 30 | /** A `Set-Cookie` value: HttpOnly, Secure, same-site Lax; 0 clears it. */ |
| 31 | export function cookie(name: string, value: string, maxAge: number): string { |
| 32 | return `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`; |
| 33 | } |
| 34 | |
| 35 | /** Compares two strings in time that does not depend on where they differ. */ |
| 36 | export function sameString(a: string, b: string): boolean { |
| 37 | if (a.length !== b.length) return false; |
| 38 | let difference = 0; |
| 39 | for (let i = 0; i < a.length; i++) difference |= a.charCodeAt(i) ^ b.charCodeAt(i); |
| 40 | return difference === 0; |
| 41 | } |
| 42 | |
| 43 | /** |
| 44 | * Whether the state GitHub sent back is the one this browser was given. |
| 45 | * Both must be present: a callback without the cookie came from somewhere |
| 46 | * else. |
| 47 | */ |
| 48 | export function stateMatches(fromCookie: string | null, fromGithub: string | null): boolean { |
| 49 | if (!fromCookie || !fromGithub) return false; |
| 50 | return sameString(fromCookie, fromGithub); |
| 51 | } |
| 52 | |
| 53 | /** The install cookie's value: `<state>.<workspace>`. */ |
| 54 | export function installCookieValue(state: string, workspace: string): string { |
| 55 | return `${state}.${workspace}`; |
| 56 | } |
| 57 | |
| 58 | /** The workspace an installation was started for, if the state matches. */ |
| 59 | export function installWorkspace(fromCookie: string | null, fromGithub: string | null): string | null { |
| 60 | if (!fromCookie) return null; |
| 61 | const dot = fromCookie.indexOf("."); |
| 62 | if (dot < 0) return null; |
| 63 | const state = fromCookie.slice(0, dot); |
| 64 | const workspace = fromCookie.slice(dot + 1); |
| 65 | return stateMatches(state, fromGithub) && workspace ? workspace : null; |
| 66 | } |
| 67 | |
| 68 | /** A fresh random state: 32 bytes, hex. */ |
| 69 | export function newState(): string { |
| 70 | const bytes = new Uint8Array(32); |
| 71 | crypto.getRandomValues(bytes); |
| 72 | return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join(""); |
| 73 | } |
| 74 | |
| 75 | /** What each way of bringing a repository across does, for the picker. */ |
| 76 | export const MODES = [ |
| 77 | { |
| 78 | id: "import", |
| 79 | title: "Import", |
| 80 | text: "Copy it once: every branch and tag, and its issues if you like. The copy on g1t is then its own.", |
| 81 | }, |
| 82 | { |
| 83 | id: "mirror", |
| 84 | title: "Mirror", |
| 85 | text: "Keep the code on GitHub. Every push there is fetched into g1t, so agents can work on it, and deployments build it once you turn them on.", |
| 86 | }, |
| 87 | { |
| 88 | id: "push", |
| 89 | title: "Move to g1t", |
| 90 | text: "Work on g1t from now on. Every push here is pushed to GitHub, so it stays up to date for everyone else.", |
| 91 | }, |
| 92 | ] as const; |