Something went wrong. Try again.
forked from tangled.org/core
Something went wrong. Try again.
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091import { seal, sha256Base64Url } from "#lib/server/sealed.ts";import { internalUrl } from "#lib/auth/returnTo.ts";import type { GitHubEnv } from "#lib/server/github/env.ts";import type { GitHubError } from "#lib/github.ts";import type { Fetch } from "#lib/fetch.ts";
export const CALLBACK_PATH = "/_internal/github/callback";
export interface GitHubState { landing: Landing; did: string; verifier: string; exp: number;}
const STATE_TTL_MS = 10 * 60_000;
export const newVerifier = () => crypto.randomUUID().replaceAll("-", "") + crypto.randomUUID().replaceAll("-", "");
export const pkceChallenge = (verifier: string) => sha256Base64Url(verifier);
export const sealState = (secret: string, state: Omit<GitHubState, "exp">) => seal({ ...state, exp: Date.now() + STATE_TTL_MS }, secret);
export const authorizeUrl = (env: GitHubEnv, origin: string, state: string, challenge: string) => { const target = new URL(`${env.publicOrigin}/login/oauth/authorize`); target.searchParams.set("client_id", env.clientId); target.searchParams.set("redirect_uri", `${origin}${CALLBACK_PATH}`); target.searchParams.set("state", state); target.searchParams.set("code_challenge", challenge); target.searchParams.set("code_challenge_method", "S256"); return target.toString();};
export const installUrl = (env: GitHubEnv, state: string) => `${env.publicOrigin}/apps/${encodeURIComponent(env.appSlug)}/installations/new?state=${encodeURIComponent(state)}`;
export const tokenFromCode = async ( env: GitHubEnv, code: string, verifier: string, redirectUri: string, fetcher: Fetch = fetch) => { const response = await fetcher(`${env.publicOrigin}/login/oauth/access_token`, { method: "POST", headers: { accept: "application/json", "content-type": "application/json" }, body: JSON.stringify({ client_id: env.clientId, client_secret: env.clientSecret, code, code_verifier: verifier, redirect_uri: redirectUri }) }); if (!response.ok) throw new Error(`oauth upstream ${response.status}`); const json = (await response.json()) as { access_token?: string }; if (!json.access_token) throw new Error("oauth token missing"); return json.access_token;};
export type Landing = | { readonly kind: "page"; readonly href: string } | { readonly kind: "home" } | { readonly kind: "refused" };
export const HOME_LANDING: Landing = { kind: "home" };
// allowed host pages for github connect round-tripsconst HOST_PAGES = new Set(["/repo/import/github", "/repo/migrate", "/repo/new", "/welcome"]);
const NOTICE_PARAM = "github_error";const REFUSED: GitHubError = "return_unexpected";const INTERNAL_ORIGIN = "https://tangled.invalid";
export const landingFrom = (raw: string | null): Landing => { if (!raw) return HOME_LANDING; const url = internalUrl(raw); if (!url || !HOST_PAGES.has(url.pathname)) return { kind: "refused" }; url.searchParams.delete(NOTICE_PARAM); return { kind: "page", href: url.pathname + url.search };};
export const landingHref = (landing: Landing, notice?: GitHubError): string => { const url = new URL(landing.kind === "page" ? landing.href : "/", INTERNAL_ORIGIN); if (landing.kind === "refused") url.searchParams.set(NOTICE_PARAM, REFUSED); if (notice) url.searchParams.set(NOTICE_PARAM, notice); return url.pathname + url.search;};