feat(p12a): services git distants (PAT/app_password) + clone HTTPS
Modèle de données : - migration #11 git_credentials (secrets chiffrés SecretBox : secret_encrypted ; colonnes ssh/oauth posées pour P12b/P12c) ; #12 repos ALTER remote_url/git_service/credential_id (pas de FK) - types partagés api.ts (GitCredentialSummary sans secret + hasSecret/secretLast4, CRUD, RemoteRepoSummary, Clone*) ; protocole additif : topic 'clones' + message clone_update (CloneOperation) Backend : - core/git-credentials.ts (GitCredentialsManager(db, box)) : CRUD chiffré, test() (GET /user), getSecret()/authContext() internes, NULLification de repos.credential_id à la suppression - core/git-clients/ (github/gitlab/gitea) via fetch, sans dépendance : verify()+listRepos() paginés, erreurs typées AUTH_FAILED/RATE_LIMITED/UNREACHABLE, SSRF base_url http(s) - core/git-auth.ts : withGitAuth (GIT_ASKPASS éphémère 0o700, secret par env, GIT_TERMINAL_PROMPT=0, jamais dans l'URL/.git/config, nettoyage finally) - core/git.ts cloneRepo (spawn git clone --progress, parse progression, timeout) - core/clone-manager.ts (EventEmitter) : clone async, dest confiné sous scanRoots + non existant, auto-enregistrement via addRepo + métadonnées de provenance, nettoyage du clone partiel, events topic 'clones' - routes/git-connections.ts (CRUD + /test + /:id/repos + POST /repos/clone 202 + GET /repos/clone/:id) ; app.ts câble box→GitCredentialsManager + CloneManager→gateway ; gateway relaie 'clones' Frontend : - ws-client subscribeClones ; stores git-connections + clone (suivi WS) - components/settings/GitConnectionsSection (liste + formulaire pat/app_password, secret jamais ré-affiché) inséré dans SettingsView ; CloneRepoModal (connexion → repos distants paginés → dest scanRoots[0] → barre de progression WS → redirection) ; bouton « Cloner » dans DashboardView ; i18n EN+FR Tests : git-credentials (round-trip SecretBox, résumé sans secret, NULLification) ; acceptance-p12.mjs (clone bare local file:// → clone_update done + repo enregistré + secret ABSENT de l'API, de la DB et du .git/config) Sous-phases restantes : P12b (SSH), P12c (OAuth device flow).
This commit is contained in:
149
packages/server/scripts/acceptance-p12.mjs
Normal file
149
packages/server/scripts/acceptance-p12.mjs
Normal file
@@ -0,0 +1,149 @@
|
|||||||
|
#!/usr/bin/env node
|
||||||
|
// Acceptation P12a (sans navigateur, sans réseau/quota) : services git distants + clone. Vrai daemon
|
||||||
|
// + credential factice + clone d'un dépôt bare LOCAL (chemin de fichier, pas de réseau). Couvre :
|
||||||
|
// création de credential (secret chiffré), POST /repos/clone (202) → progression WS clone_update →
|
||||||
|
// done → repo auto-enregistré, ET surtout : le secret en clair est ABSENT de l'API, de la DB et du
|
||||||
|
// .git/config du dépôt cloné (garde-fou « jamais de fuite de secret »).
|
||||||
|
import { spawn, execFileSync } from 'node:child_process';
|
||||||
|
import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
|
||||||
|
import { tmpdir } from 'node:os';
|
||||||
|
import { join, dirname } from 'node:path';
|
||||||
|
import { fileURLToPath } from 'node:url';
|
||||||
|
import { createRequire } from 'node:module';
|
||||||
|
|
||||||
|
const require = createRequire(import.meta.url);
|
||||||
|
const WebSocket = require('ws');
|
||||||
|
|
||||||
|
const PORT = 7555;
|
||||||
|
const ORIGIN = `http://127.0.0.1:${PORT}`;
|
||||||
|
const SECRET = 'arb-secret-token-9876XYZ'; // token factice : ne doit JAMAIS fuiter en clair
|
||||||
|
const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
|
||||||
|
const serverDir = join(dirname(fileURLToPath(import.meta.url)), '..');
|
||||||
|
const results = [];
|
||||||
|
const check = (name, ok, detail = '') => {
|
||||||
|
results.push({ name, ok, detail });
|
||||||
|
console.log(`${ok ? '✅' : '❌'} ${name}${detail ? ` — ${detail}` : ''}`);
|
||||||
|
};
|
||||||
|
|
||||||
|
const tmp = mkdtempSync(join(tmpdir(), 'arb-accept-p12-'));
|
||||||
|
const work = join(tmp, 'work'); // racine de scan + destination des clones
|
||||||
|
const src = join(tmp, 'src'); // dépôt source (working)
|
||||||
|
const bare = join(tmp, 'source.git'); // remote bare local (file path)
|
||||||
|
const dbPath = join(tmp, 'a.db');
|
||||||
|
mkdirSync(work, { recursive: true });
|
||||||
|
mkdirSync(src, { recursive: true });
|
||||||
|
const g = (cwd, ...args) => execFileSync('git', args, { cwd, stdio: 'pipe' });
|
||||||
|
g(src, 'init', '-b', 'main');
|
||||||
|
g(src, 'config', 'user.email', 'test@arboretum.dev');
|
||||||
|
g(src, 'config', 'user.name', 'Test');
|
||||||
|
writeFileSync(join(src, 'README.md'), '# cloned demo\n');
|
||||||
|
g(src, 'add', '-A');
|
||||||
|
g(src, 'commit', '-m', 'init');
|
||||||
|
execFileSync('git', ['clone', '--bare', src, bare], { stdio: 'pipe' });
|
||||||
|
|
||||||
|
const srv = spawn(
|
||||||
|
'node',
|
||||||
|
[join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', dbPath, '--claude-home', join(tmp, 'claude'), '--no-discover'],
|
||||||
|
{ env: { ...process.env, ARBORETUM_LOG: 'warn' }, stdio: ['ignore', 'pipe', 'pipe'] },
|
||||||
|
);
|
||||||
|
let srvOut = '';
|
||||||
|
srv.stdout.on('data', (d) => (srvOut += d));
|
||||||
|
srv.stderr.on('data', (d) => (srvOut += d));
|
||||||
|
|
||||||
|
function wsClient(cookie) {
|
||||||
|
const ws = new WebSocket(`ws://127.0.0.1:${PORT}/ws`, { headers: { Origin: ORIGIN, Cookie: cookie } });
|
||||||
|
const state = { msgs: [] };
|
||||||
|
ws.on('message', (data, isBinary) => {
|
||||||
|
if (!isBinary) state.msgs.push(JSON.parse(String(data)));
|
||||||
|
});
|
||||||
|
const waitMsg = async (pred, timeout = 15000) => {
|
||||||
|
const t0 = Date.now();
|
||||||
|
while (Date.now() - t0 < timeout) {
|
||||||
|
const m = state.msgs.find(pred);
|
||||||
|
if (m) return m;
|
||||||
|
await sleep(50);
|
||||||
|
}
|
||||||
|
return null;
|
||||||
|
};
|
||||||
|
return { ws, state, waitMsg, send: (m) => ws.send(JSON.stringify(m)) };
|
||||||
|
}
|
||||||
|
|
||||||
|
const j = (path, method, cookie, body) =>
|
||||||
|
fetch(`${ORIGIN}${path}`, {
|
||||||
|
method,
|
||||||
|
headers: { Origin: ORIGIN, Cookie: cookie, ...(body ? { 'Content-Type': 'application/json' } : {}) },
|
||||||
|
...(body ? { body: JSON.stringify(body) } : {}),
|
||||||
|
});
|
||||||
|
|
||||||
|
try {
|
||||||
|
await sleep(1500);
|
||||||
|
const token = /arb_[0-9a-f]+/.exec(srvOut)?.[0];
|
||||||
|
check('boot + token bootstrap', !!token);
|
||||||
|
const login = await fetch(`${ORIGIN}/api/v1/auth/login`, {
|
||||||
|
method: 'POST', headers: { 'Content-Type': 'application/json', Origin: ORIGIN }, body: JSON.stringify({ token }),
|
||||||
|
});
|
||||||
|
const cookie = login.headers.get('set-cookie')?.split(';')[0] ?? '';
|
||||||
|
check('login → cookie', login.status === 200);
|
||||||
|
|
||||||
|
// racine de scan = work (confine la destination du clone).
|
||||||
|
const patch = await j('/api/v1/settings', 'PATCH', cookie, { scanRoots: [work] });
|
||||||
|
check('PATCH scanRoots → 200', patch.status === 200);
|
||||||
|
|
||||||
|
// credential factice (secret chiffré côté serveur).
|
||||||
|
const createCred = await j('/api/v1/git-connections', 'POST', cookie, {
|
||||||
|
label: 'fake', service: 'gitea', authType: 'pat', baseUrl: 'http://localhost:9999', secret: SECRET,
|
||||||
|
});
|
||||||
|
const credBody = await createCred.json();
|
||||||
|
const credId = credBody.credential?.id;
|
||||||
|
check('POST /git-connections → 201', createCred.status === 201 && !!credId);
|
||||||
|
check('réponse de création SANS secret en clair', !JSON.stringify(credBody).includes(SECRET));
|
||||||
|
check('réponse expose secretLast4 (et hasSecret)', credBody.credential?.hasSecret === true && credBody.credential?.secretLast4 === SECRET.slice(-4));
|
||||||
|
|
||||||
|
// GET liste : pas de secret.
|
||||||
|
const listed = await (await j('/api/v1/git-connections', 'GET', cookie)).json();
|
||||||
|
check('GET /git-connections SANS secret en clair', !JSON.stringify(listed).includes(SECRET));
|
||||||
|
|
||||||
|
// WS abonné aux clones.
|
||||||
|
const c = wsClient(cookie);
|
||||||
|
await new Promise((res, rej) => (c.ws.on('open', res), c.ws.on('error', rej)));
|
||||||
|
c.send({ type: 'hello', protocol: 1 });
|
||||||
|
await c.waitMsg((m) => m.type === 'hello_ok');
|
||||||
|
c.send({ type: 'sub', topics: ['clones', 'worktrees'] });
|
||||||
|
|
||||||
|
// clone du bare local → dest sous la racine de scan.
|
||||||
|
const dest = join(work, 'cloned');
|
||||||
|
const clone = await j('/api/v1/repos/clone', 'POST', cookie, { credentialId: credId, remoteUrl: bare, dest });
|
||||||
|
const cloneBody = await clone.json();
|
||||||
|
check('POST /repos/clone → 202 + operationId', clone.status === 202 && !!cloneBody.operationId);
|
||||||
|
|
||||||
|
const doneMsg = await c.waitMsg((m) => m.type === 'clone_update' && m.operation?.id === cloneBody.operationId && m.operation?.state === 'done');
|
||||||
|
check('clone_update state=done reçu via WS', !!doneMsg, doneMsg ? `repoId=${doneMsg.operation.repoId}` : 'timeout');
|
||||||
|
check('le clone a produit un repoId (auto-enregistré)', !!doneMsg?.operation?.repoId);
|
||||||
|
|
||||||
|
// repo enregistré + visible.
|
||||||
|
const repos = await (await j('/api/v1/repos', 'GET', cookie)).json();
|
||||||
|
const cloned = (repos.repos ?? []).find((r) => r.path === dest);
|
||||||
|
check('repo cloné enregistré et listé', !!cloned);
|
||||||
|
check('le dépôt cloné existe sur disque (README.md)', existsSync(join(dest, 'README.md')));
|
||||||
|
|
||||||
|
// ---- garde-fou « pas de fuite de secret » ----
|
||||||
|
const gitConfig = existsSync(join(dest, '.git', 'config')) ? readFileSync(join(dest, '.git', 'config'), 'utf8') : '';
|
||||||
|
check('secret ABSENT du .git/config du clone', !gitConfig.includes(SECRET));
|
||||||
|
const dbBytes = [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]
|
||||||
|
.filter((p) => existsSync(p))
|
||||||
|
.map((p) => readFileSync(p).toString('latin1'))
|
||||||
|
.join('');
|
||||||
|
check('secret ABSENT de la base (chiffré au repos)', !dbBytes.includes(SECRET));
|
||||||
|
|
||||||
|
c.ws.close();
|
||||||
|
} catch (err) {
|
||||||
|
check('exception', false, String(err));
|
||||||
|
} finally {
|
||||||
|
srv.kill('SIGTERM');
|
||||||
|
await sleep(1500);
|
||||||
|
check('arrêt propre du daemon (SIGTERM)', srv.exitCode === 0 || srv.signalCode === null || srv.exitCode === null);
|
||||||
|
rmSync(tmp, { recursive: true, force: true });
|
||||||
|
const failed = results.filter((r) => !r.ok);
|
||||||
|
console.log(failed.length === 0 ? '\nACCEPTANCE P12: ALL GREEN' : `\nACCEPTANCE P12: ${failed.length} FAILURE(S)`);
|
||||||
|
process.exit(failed.length === 0 ? 0 : 1);
|
||||||
|
}
|
||||||
@@ -12,6 +12,9 @@ import { PtyManager } from './core/pty-manager.js';
|
|||||||
import { DiscoveryService } from './core/discovery-service.js';
|
import { DiscoveryService } from './core/discovery-service.js';
|
||||||
import { SessionArchiveService } from './core/session-archive.js';
|
import { SessionArchiveService } from './core/session-archive.js';
|
||||||
import { SettingsBus } from './core/settings-bus.js';
|
import { SettingsBus } from './core/settings-bus.js';
|
||||||
|
import { GitCredentialsManager } from './core/git-credentials.js';
|
||||||
|
import { CloneManager } from './core/clone-manager.js';
|
||||||
|
import { registerGitConnectionRoutes } from './routes/git-connections.js';
|
||||||
import { WorktreeManager } from './core/worktree-manager.js';
|
import { WorktreeManager } from './core/worktree-manager.js';
|
||||||
import { RepoDiscoveryService } from './core/repo-discovery.js';
|
import { RepoDiscoveryService } from './core/repo-discovery.js';
|
||||||
import { GroupManager } from './core/group-manager.js';
|
import { GroupManager } from './core/group-manager.js';
|
||||||
@@ -82,6 +85,8 @@ export interface AppBundle {
|
|||||||
push: PushService;
|
push: PushService;
|
||||||
fsWatcher: FsWatcherService;
|
fsWatcher: FsWatcherService;
|
||||||
settingsBus: SettingsBus;
|
settingsBus: SettingsBus;
|
||||||
|
gitCredentials: GitCredentialsManager;
|
||||||
|
clones: CloneManager;
|
||||||
}
|
}
|
||||||
|
|
||||||
export function buildApp(config: Config, db: Db, serverVersion: string): AppBundle {
|
export function buildApp(config: Config, db: Db, serverVersion: string): AppBundle {
|
||||||
@@ -109,6 +114,9 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
|
|||||||
const groups = new GroupManager(db);
|
const groups = new GroupManager(db);
|
||||||
// P11 — bus de diffusion des réglages : PATCH /settings émet, la gateway relaie au topic 'settings'.
|
// P11 — bus de diffusion des réglages : PATCH /settings émet, la gateway relaie au topic 'settings'.
|
||||||
const settingsBus = new SettingsBus();
|
const settingsBus = new SettingsBus();
|
||||||
|
// P12 — services git distants : `box` (SecretBox) câblé ici pour chiffrer les secrets des credentials.
|
||||||
|
const gitCredentials = new GitCredentialsManager(db, box);
|
||||||
|
const clones = new CloneManager(db, worktrees, gitCredentials);
|
||||||
|
|
||||||
// En-têtes de sécurité sur toute réponse + no-store sur les réponses sensibles (API/WS).
|
// En-têtes de sécurité sur toute réponse + no-store sur les réponses sensibles (API/WS).
|
||||||
// onSend DOIT retourner le payload (sinon Fastify vide la réponse).
|
// onSend DOIT retourner le payload (sinon Fastify vide la réponse).
|
||||||
@@ -194,13 +202,14 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
|
|||||||
registerFileRoutes(app, worktrees, db);
|
registerFileRoutes(app, worktrees, db);
|
||||||
registerPushRoutes(app, push, db);
|
registerPushRoutes(app, push, db);
|
||||||
registerSettingsRoutes(app, db, config, serverVersion, push, settingsBus);
|
registerSettingsRoutes(app, db, config, serverVersion, push, settingsBus);
|
||||||
|
registerGitConnectionRoutes(app, gitCredentials, clones, db);
|
||||||
registerFsRoutes(app);
|
registerFsRoutes(app);
|
||||||
registerAuditRoutes(app, db);
|
registerAuditRoutes(app, db);
|
||||||
registerDataRoutes(app, db, auth);
|
registerDataRoutes(app, db, auth);
|
||||||
// La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
|
// La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
|
||||||
// encapsulé) — sinon le handler reçoit la signature REST (request, reply).
|
// encapsulé) — sinon le handler reçoit la signature REST (request, reply).
|
||||||
void app.register(async (scoped) => {
|
void app.register(async (scoped) => {
|
||||||
registerWsGateway(scoped, manager, discovery, sessionArchive, worktrees, groups, settingsBus, serverVersion);
|
registerWsGateway(scoped, manager, discovery, sessionArchive, worktrees, groups, settingsBus, clones, serverVersion);
|
||||||
});
|
});
|
||||||
|
|
||||||
// SPA buildée embarquée dans le paquet npm (public/) — absente en dev (vite dev sert le front)
|
// SPA buildée embarquée dans le paquet npm (public/) — absente en dev (vite dev sert le front)
|
||||||
@@ -215,5 +224,5 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
|
|||||||
});
|
});
|
||||||
}
|
}
|
||||||
|
|
||||||
return { app, auth, manager, discovery, sessionArchive, repoDiscovery, worktrees, groups, push, fsWatcher, settingsBus };
|
return { app, auth, manager, discovery, sessionArchive, repoDiscovery, worktrees, groups, push, fsWatcher, settingsBus, gitCredentials, clones };
|
||||||
}
|
}
|
||||||
|
|||||||
118
packages/server/src/core/clone-manager.ts
Normal file
118
packages/server/src/core/clone-manager.ts
Normal file
@@ -0,0 +1,118 @@
|
|||||||
|
// Orchestration des clones (P12). Asynchrone : POST /repos/clone répond 202 avec un operationId,
|
||||||
|
// la progression est poussée en WS (topic 'clones') et lisible en REST (survit au refresh). À la fin,
|
||||||
|
// le repo cloné est auto-enregistré via WorktreeManager.addRepo (réutilise unicité/validation/event).
|
||||||
|
// `dest` est strictement confiné SOUS une racine de scan + non existant (mkdir implicite par git).
|
||||||
|
import { EventEmitter } from 'node:events';
|
||||||
|
import { randomUUID } from 'node:crypto';
|
||||||
|
import { rm, stat } from 'node:fs/promises';
|
||||||
|
import { resolve, sep } from 'node:path';
|
||||||
|
import type { CloneOperation, GitService } from '@arboretum/shared';
|
||||||
|
import type { Db } from '../db/index.js';
|
||||||
|
import { isSafeAbsolutePath, cloneRepo } from './git.js';
|
||||||
|
import { readScanRoots } from './scan-settings.js';
|
||||||
|
import { withGitAuth } from './git-auth.js';
|
||||||
|
import type { GitAuth } from './git-clients/index.js';
|
||||||
|
import type { GitCredentialsManager } from './git-credentials.js';
|
||||||
|
import type { WorktreeManager } from './worktree-manager.js';
|
||||||
|
import { recordAudit } from './audit-log.js';
|
||||||
|
|
||||||
|
export interface CloneManagerEvents {
|
||||||
|
clone_update: [CloneOperation];
|
||||||
|
}
|
||||||
|
|
||||||
|
function httpError(statusCode: number, code: string, message: string): Error & { statusCode: number; code: string } {
|
||||||
|
return Object.assign(new Error(message), { statusCode, code });
|
||||||
|
}
|
||||||
|
|
||||||
|
export class CloneManager extends EventEmitter<CloneManagerEvents> {
|
||||||
|
private readonly ops = new Map<string, CloneOperation>();
|
||||||
|
|
||||||
|
constructor(
|
||||||
|
private readonly db: Db,
|
||||||
|
private readonly worktrees: WorktreeManager,
|
||||||
|
private readonly credentials: GitCredentialsManager,
|
||||||
|
) {
|
||||||
|
super();
|
||||||
|
}
|
||||||
|
|
||||||
|
get(id: string): CloneOperation | null {
|
||||||
|
return this.ops.get(id) ?? null;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Démarre un clone (validation synchrone du dest → throw 4xx ; clone asynchrone ensuite).
|
||||||
|
* Retourne l'operationId à suivre via WS/REST. `actor` pour l'audit.
|
||||||
|
*/
|
||||||
|
async start(opts: { credentialId: string; remoteUrl: string; dest: string }, actor: string): Promise<string> {
|
||||||
|
const dest = resolve(opts.dest);
|
||||||
|
if (!isSafeAbsolutePath(dest)) throw httpError(400, 'BAD_REQUEST', 'dest must be an absolute, normalized path');
|
||||||
|
if (typeof opts.remoteUrl !== 'string' || opts.remoteUrl.trim() === '') throw httpError(400, 'BAD_REQUEST', 'remoteUrl is required');
|
||||||
|
const ctx = this.credentials.authContext(opts.credentialId);
|
||||||
|
if (!ctx) throw httpError(404, 'NOT_FOUND', 'No usable credential with this id');
|
||||||
|
|
||||||
|
// Confinement : dest DOIT être sous une racine de scan configurée (jamais d'écriture arbitraire).
|
||||||
|
const roots = readScanRoots(this.db);
|
||||||
|
if (roots.length === 0) throw httpError(400, 'NO_SCAN_ROOT', 'Configure a scan folder first (Settings → Discovery)');
|
||||||
|
const underRoot = roots.some((r) => {
|
||||||
|
const root = resolve(r);
|
||||||
|
return dest === root || dest.startsWith(root + sep);
|
||||||
|
});
|
||||||
|
if (!underRoot) throw httpError(400, 'OUTSIDE_SCAN_ROOT', 'dest must be inside a configured scan folder');
|
||||||
|
|
||||||
|
// Le parent doit exister ; le dest ne doit pas exister (git clone le crée).
|
||||||
|
const parent = dest.slice(0, dest.lastIndexOf(sep)) || sep;
|
||||||
|
try {
|
||||||
|
const st = await stat(parent);
|
||||||
|
if (!st.isDirectory()) throw httpError(400, 'BAD_DEST', 'Parent of dest is not a directory');
|
||||||
|
} catch (err) {
|
||||||
|
if ((err as { statusCode?: number }).statusCode) throw err;
|
||||||
|
throw httpError(404, 'NOT_FOUND', `Parent directory does not exist: ${parent}`);
|
||||||
|
}
|
||||||
|
if (await stat(dest).then(() => true).catch(() => false)) throw httpError(409, 'DEST_EXISTS', `Destination already exists: ${dest}`);
|
||||||
|
|
||||||
|
const id = randomUUID();
|
||||||
|
const op: CloneOperation = { id, state: 'pending', progress: null, phase: null, error: null, repoId: null, dest };
|
||||||
|
this.ops.set(id, op);
|
||||||
|
recordAudit(this.db, { actor, action: 'repo.clone', resourceId: id, details: { service: ctx.service, dest } });
|
||||||
|
// Lancement asynchrone (ne bloque pas la réponse 202).
|
||||||
|
void this.run(op, opts.remoteUrl, opts.credentialId, ctx);
|
||||||
|
return id;
|
||||||
|
}
|
||||||
|
|
||||||
|
private update(op: CloneOperation, patch: Partial<CloneOperation>): void {
|
||||||
|
Object.assign(op, patch);
|
||||||
|
this.emit('clone_update', { ...op });
|
||||||
|
}
|
||||||
|
|
||||||
|
private async run(
|
||||||
|
op: CloneOperation,
|
||||||
|
remoteUrl: string,
|
||||||
|
credentialId: string,
|
||||||
|
ctx: { service: GitService; baseUrl: string | null; auth: GitAuth },
|
||||||
|
): Promise<void> {
|
||||||
|
this.update(op, { state: 'running' });
|
||||||
|
let lastPct = -10;
|
||||||
|
const onProgress = (p: { phase: string; percent: number | null }): void => {
|
||||||
|
// throttle : on ne pousse que sur changement de phase ou +3% pour éviter le flood WS.
|
||||||
|
if (p.percent == null || p.percent - lastPct >= 3 || p.phase !== op.phase) {
|
||||||
|
lastPct = p.percent ?? lastPct;
|
||||||
|
this.update(op, { phase: p.phase, progress: p.percent });
|
||||||
|
}
|
||||||
|
};
|
||||||
|
try {
|
||||||
|
await withGitAuth(ctx.service, ctx.auth, (env) =>
|
||||||
|
cloneRepo({ url: remoteUrl, dest: op.dest, env, onProgress }),
|
||||||
|
);
|
||||||
|
// auto-enregistrement du repo cloné + métadonnées de provenance.
|
||||||
|
const repo = await this.worktrees.addRepo({ path: op.dest });
|
||||||
|
this.db
|
||||||
|
.prepare('UPDATE repos SET remote_url = ?, git_service = ?, credential_id = ? WHERE id = ?')
|
||||||
|
.run(remoteUrl, ctx.service, credentialId, repo.id);
|
||||||
|
this.update(op, { state: 'done', progress: 100, repoId: repo.id });
|
||||||
|
} catch (err) {
|
||||||
|
// nettoyage du clone partiel (best-effort).
|
||||||
|
await rm(op.dest, { recursive: true, force: true }).catch(() => {});
|
||||||
|
this.update(op, { state: 'error', error: err instanceof Error ? err.message : String(err) });
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
40
packages/server/src/core/git-auth.ts
Normal file
40
packages/server/src/core/git-auth.ts
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
// Préparation d'un environnement d'authentification git ÉPHÉMÈRE (P12). HTTPS (pat/app_password) :
|
||||||
|
// les identifiants sont fournis via GIT_ASKPASS (script 0o700 lisant deux variables d'env), JAMAIS
|
||||||
|
// dans l'URL ni dans `.git/config`. GIT_TERMINAL_PROMPT=0 (pas d'invite bloquante). Le script est
|
||||||
|
// supprimé en `finally` ; le secret ne transite que par l'env du process enfant (jamais loggé).
|
||||||
|
import { mkdtemp, writeFile, rm, chmod } from 'node:fs/promises';
|
||||||
|
import { tmpdir } from 'node:os';
|
||||||
|
import { join } from 'node:path';
|
||||||
|
import type { GitService } from '@arboretum/shared';
|
||||||
|
import type { GitAuth } from './git-clients/index.js';
|
||||||
|
|
||||||
|
// Identité HTTPS par défaut quand l'utilisateur n'a pas fourni de username (token-as-password).
|
||||||
|
const SERVICE_DEFAULT_USER: Record<GitService, string> = { github: 'x-access-token', gitlab: 'oauth2', gitea: 'oauth2' };
|
||||||
|
|
||||||
|
export async function withGitAuth<T>(
|
||||||
|
service: GitService,
|
||||||
|
auth: GitAuth,
|
||||||
|
fn: (env: NodeJS.ProcessEnv) => Promise<T>,
|
||||||
|
): Promise<T> {
|
||||||
|
const dir = await mkdtemp(join(tmpdir(), 'arb-gitauth-'));
|
||||||
|
const askpass = join(dir, 'askpass.sh');
|
||||||
|
const user = auth.username || SERVICE_DEFAULT_USER[service];
|
||||||
|
await writeFile(
|
||||||
|
askpass,
|
||||||
|
"#!/bin/sh\ncase \"$1\" in\n Username*) printf '%s' \"$ARB_GIT_USER\" ;;\n *) printf '%s' \"$ARB_GIT_PASS\" ;;\nesac\n",
|
||||||
|
{ mode: 0o700 },
|
||||||
|
);
|
||||||
|
await chmod(askpass, 0o700);
|
||||||
|
const env: NodeJS.ProcessEnv = {
|
||||||
|
...process.env,
|
||||||
|
GIT_ASKPASS: askpass,
|
||||||
|
GIT_TERMINAL_PROMPT: '0',
|
||||||
|
ARB_GIT_USER: user,
|
||||||
|
ARB_GIT_PASS: auth.secret,
|
||||||
|
};
|
||||||
|
try {
|
||||||
|
return await fn(env);
|
||||||
|
} finally {
|
||||||
|
await rm(dir, { recursive: true, force: true }).catch(() => {});
|
||||||
|
}
|
||||||
|
}
|
||||||
156
packages/server/src/core/git-clients/index.ts
Normal file
156
packages/server/src/core/git-clients/index.ts
Normal file
@@ -0,0 +1,156 @@
|
|||||||
|
// Clients des services git distants (Gitea / GitLab / GitHub) — P12. Uniquement `fetch` global
|
||||||
|
// (Node ≥ 22), AUCUNE dépendance (pas d'octokit/gitbeaker). Chaque client expose verify() (test de
|
||||||
|
// connectivité/auth) et listRepos() (paginé). Erreurs typées : AUTH_FAILED / RATE_LIMITED / UNREACHABLE.
|
||||||
|
import type { GitAuthType, GitService, RemoteRepoSummary } from '@arboretum/shared';
|
||||||
|
|
||||||
|
const REQUEST_TIMEOUT_MS = 12_000;
|
||||||
|
const PER_PAGE = 30;
|
||||||
|
|
||||||
|
export interface GitAuth {
|
||||||
|
authType: GitAuthType;
|
||||||
|
username: string | null;
|
||||||
|
secret: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
export class GitServiceError extends Error {
|
||||||
|
constructor(
|
||||||
|
public readonly errorCode: string,
|
||||||
|
message?: string,
|
||||||
|
) {
|
||||||
|
super(message ?? errorCode);
|
||||||
|
this.name = 'GitServiceError';
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface GitClient {
|
||||||
|
verify(auth: GitAuth): Promise<{ login: string }>;
|
||||||
|
listRepos(auth: GitAuth, page: number, search?: string): Promise<{ repos: RemoteRepoSummary[]; nextPage: number | null }>;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** En-têtes d'auth selon le type. app_password → Basic (username:secret) ; pat → en-tête propre au service. */
|
||||||
|
function authHeaders(service: GitService, auth: GitAuth): Record<string, string> {
|
||||||
|
if (auth.authType === 'app_password') {
|
||||||
|
const basic = Buffer.from(`${auth.username ?? ''}:${auth.secret}`).toString('base64');
|
||||||
|
return { Authorization: `Basic ${basic}` };
|
||||||
|
}
|
||||||
|
// pat
|
||||||
|
if (service === 'gitlab') return { 'PRIVATE-TOKEN': auth.secret };
|
||||||
|
if (service === 'gitea') return { Authorization: `token ${auth.secret}` };
|
||||||
|
return { Authorization: `Bearer ${auth.secret}` }; // github
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Refuse une base self-hosted non http(s) (anti-SSRF schéma) ; renvoie l'origine normalisée sans `/` final. */
|
||||||
|
function normalizeBase(baseUrl: string): string {
|
||||||
|
let u: URL;
|
||||||
|
try {
|
||||||
|
u = new URL(baseUrl);
|
||||||
|
} catch {
|
||||||
|
throw new GitServiceError('BAD_BASE_URL', 'base_url must be a valid http(s) URL');
|
||||||
|
}
|
||||||
|
if (u.protocol !== 'http:' && u.protocol !== 'https:') throw new GitServiceError('BAD_BASE_URL', 'base_url must be http(s)');
|
||||||
|
return `${u.origin}${u.pathname}`.replace(/\/+$/, '');
|
||||||
|
}
|
||||||
|
|
||||||
|
async function fetchJson(url: string, headers: Record<string, string>): Promise<{ json: unknown; headers: Headers }> {
|
||||||
|
let res: Response;
|
||||||
|
try {
|
||||||
|
res = await fetch(url, { headers: { Accept: 'application/json', ...headers }, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
|
||||||
|
} catch {
|
||||||
|
throw new GitServiceError('UNREACHABLE', 'Could not reach the git service');
|
||||||
|
}
|
||||||
|
if (res.status === 429) throw new GitServiceError('RATE_LIMITED', 'Rate limited by the git service');
|
||||||
|
if (res.status === 401 || res.status === 403) {
|
||||||
|
// 403 + quota épuisé = rate limit (GitHub) ; sinon échec d'auth.
|
||||||
|
if (res.headers.get('x-ratelimit-remaining') === '0') throw new GitServiceError('RATE_LIMITED', 'Rate limited by the git service');
|
||||||
|
throw new GitServiceError('AUTH_FAILED', 'Authentication failed');
|
||||||
|
}
|
||||||
|
if (!res.ok) throw new GitServiceError(`HTTP_${res.status}`, `Unexpected response ${res.status}`);
|
||||||
|
return { json: await res.json().catch(() => null), headers: res.headers };
|
||||||
|
}
|
||||||
|
|
||||||
|
function githubBase(baseUrl: string | null): string {
|
||||||
|
return baseUrl ? normalizeBase(baseUrl) : 'https://api.github.com';
|
||||||
|
}
|
||||||
|
function gitlabBase(baseUrl: string | null): string {
|
||||||
|
return `${baseUrl ? normalizeBase(baseUrl) : 'https://gitlab.com'}/api/v4`;
|
||||||
|
}
|
||||||
|
function giteaBase(baseUrl: string | null): string {
|
||||||
|
if (!baseUrl) throw new GitServiceError('BAD_BASE_URL', 'Gitea requires a base_url (self-hosted instance)');
|
||||||
|
return `${normalizeBase(baseUrl)}/api/v1`;
|
||||||
|
}
|
||||||
|
|
||||||
|
const githubClient = (baseUrl: string | null): GitClient => {
|
||||||
|
const base = githubBase(baseUrl);
|
||||||
|
return {
|
||||||
|
async verify(auth) {
|
||||||
|
const { json } = await fetchJson(`${base}/user`, authHeaders('github', auth));
|
||||||
|
return { login: String((json as { login?: string })?.login ?? '') };
|
||||||
|
},
|
||||||
|
async listRepos(auth, page) {
|
||||||
|
const { json } = await fetchJson(`${base}/user/repos?per_page=${PER_PAGE}&page=${page}&sort=updated`, authHeaders('github', auth));
|
||||||
|
const arr = Array.isArray(json) ? (json as Array<Record<string, unknown>>) : [];
|
||||||
|
const repos = arr.map((r): RemoteRepoSummary => ({
|
||||||
|
fullName: String(r.full_name ?? ''),
|
||||||
|
cloneUrl: String(r.clone_url ?? ''),
|
||||||
|
private: Boolean(r.private),
|
||||||
|
description: (r.description as string | null) ?? null,
|
||||||
|
defaultBranch: (r.default_branch as string | null) ?? null,
|
||||||
|
}));
|
||||||
|
return { repos, nextPage: arr.length === PER_PAGE ? page + 1 : null };
|
||||||
|
},
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
const gitlabClient = (baseUrl: string | null): GitClient => {
|
||||||
|
const base = gitlabBase(baseUrl);
|
||||||
|
return {
|
||||||
|
async verify(auth) {
|
||||||
|
const { json } = await fetchJson(`${base}/user`, authHeaders('gitlab', auth));
|
||||||
|
return { login: String((json as { username?: string })?.username ?? '') };
|
||||||
|
},
|
||||||
|
async listRepos(auth, page) {
|
||||||
|
const { json, headers } = await fetchJson(
|
||||||
|
`${base}/projects?membership=true&per_page=${PER_PAGE}&page=${page}&order_by=last_activity_at`,
|
||||||
|
authHeaders('gitlab', auth),
|
||||||
|
);
|
||||||
|
const arr = Array.isArray(json) ? (json as Array<Record<string, unknown>>) : [];
|
||||||
|
const repos = arr.map((r): RemoteRepoSummary => ({
|
||||||
|
fullName: String(r.path_with_namespace ?? ''),
|
||||||
|
cloneUrl: String(r.http_url_to_repo ?? ''),
|
||||||
|
private: r.visibility !== 'public',
|
||||||
|
description: (r.description as string | null) ?? null,
|
||||||
|
defaultBranch: (r.default_branch as string | null) ?? null,
|
||||||
|
}));
|
||||||
|
const next = headers.get('x-next-page');
|
||||||
|
return { repos, nextPage: next ? Number(next) : null };
|
||||||
|
},
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
const giteaClient = (baseUrl: string | null): GitClient => {
|
||||||
|
const base = giteaBase(baseUrl);
|
||||||
|
return {
|
||||||
|
async verify(auth) {
|
||||||
|
const { json } = await fetchJson(`${base}/user`, authHeaders('gitea', auth));
|
||||||
|
return { login: String((json as { login?: string })?.login ?? '') };
|
||||||
|
},
|
||||||
|
async listRepos(auth, page) {
|
||||||
|
const { json } = await fetchJson(`${base}/user/repos?page=${page}&limit=${PER_PAGE}`, authHeaders('gitea', auth));
|
||||||
|
const arr = Array.isArray(json) ? (json as Array<Record<string, unknown>>) : [];
|
||||||
|
const repos = arr.map((r): RemoteRepoSummary => ({
|
||||||
|
fullName: String(r.full_name ?? ''),
|
||||||
|
cloneUrl: String(r.clone_url ?? ''),
|
||||||
|
private: Boolean(r.private),
|
||||||
|
description: (r.description as string | null) ?? null,
|
||||||
|
defaultBranch: (r.default_branch as string | null) ?? null,
|
||||||
|
}));
|
||||||
|
return { repos, nextPage: arr.length === PER_PAGE ? page + 1 : null };
|
||||||
|
},
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
export function getGitClient(service: GitService, baseUrl: string | null): GitClient {
|
||||||
|
if (service === 'github') return githubClient(baseUrl);
|
||||||
|
if (service === 'gitlab') return gitlabClient(baseUrl);
|
||||||
|
return giteaClient(baseUrl);
|
||||||
|
}
|
||||||
180
packages/server/src/core/git-credentials.ts
Normal file
180
packages/server/src/core/git-credentials.ts
Normal file
@@ -0,0 +1,180 @@
|
|||||||
|
// Gestion des credentials des services git distants (P12). Les secrets (PAT/app password) sont
|
||||||
|
// chiffrés par SecretBox AVANT insertion et ne ressortent JAMAIS via l'API (résumés sans secret).
|
||||||
|
// getSecret()/authFor() sont INTERNES (clone, listRepos, test) — jamais routés.
|
||||||
|
import { randomUUID } from 'node:crypto';
|
||||||
|
import type {
|
||||||
|
CreateGitCredentialRequest,
|
||||||
|
GitCredentialSummary,
|
||||||
|
GitService,
|
||||||
|
TestCredentialResponse,
|
||||||
|
UpdateGitCredentialRequest,
|
||||||
|
} from '@arboretum/shared';
|
||||||
|
import type { Db } from '../db/index.js';
|
||||||
|
import type { SecretBox } from './secret-box.js';
|
||||||
|
import { getGitClient, GitServiceError, type GitAuth } from './git-clients/index.js';
|
||||||
|
import { recordAudit } from './audit-log.js';
|
||||||
|
|
||||||
|
interface GitCredentialRow {
|
||||||
|
id: string;
|
||||||
|
label: string;
|
||||||
|
service: GitService;
|
||||||
|
base_url: string | null;
|
||||||
|
auth_type: GitCredentialSummary['authType'];
|
||||||
|
username: string | null;
|
||||||
|
secret_encrypted: string | null;
|
||||||
|
ssh_key_path: string | null;
|
||||||
|
oauth_access_encrypted: string | null;
|
||||||
|
oauth_refresh_encrypted: string | null;
|
||||||
|
oauth_expires_at: string | null;
|
||||||
|
created_at: string;
|
||||||
|
last_tested_at: string | null;
|
||||||
|
test_result: string | null;
|
||||||
|
}
|
||||||
|
|
||||||
|
function httpError(statusCode: number, code: string, message: string): Error & { statusCode: number; code: string } {
|
||||||
|
return Object.assign(new Error(message), { statusCode, code });
|
||||||
|
}
|
||||||
|
|
||||||
|
export class GitCredentialsManager {
|
||||||
|
constructor(
|
||||||
|
private readonly db: Db,
|
||||||
|
private readonly box: SecretBox,
|
||||||
|
) {}
|
||||||
|
|
||||||
|
private getRow(id: string): GitCredentialRow | null {
|
||||||
|
return (this.db.prepare('SELECT * FROM git_credentials WHERE id = ?').get(id) as unknown as GitCredentialRow | undefined) ?? null;
|
||||||
|
}
|
||||||
|
|
||||||
|
private toSummary(row: GitCredentialRow): GitCredentialSummary {
|
||||||
|
let secretLast4: string | null = null;
|
||||||
|
if (row.secret_encrypted) {
|
||||||
|
try {
|
||||||
|
const s = this.box.decrypt(row.secret_encrypted);
|
||||||
|
secretLast4 = s.length >= 4 ? s.slice(-4) : '••••';
|
||||||
|
} catch {
|
||||||
|
secretLast4 = null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return {
|
||||||
|
id: row.id,
|
||||||
|
label: row.label,
|
||||||
|
service: row.service,
|
||||||
|
baseUrl: row.base_url,
|
||||||
|
authType: row.auth_type,
|
||||||
|
username: row.username,
|
||||||
|
hasSecret: row.secret_encrypted != null,
|
||||||
|
secretLast4,
|
||||||
|
createdAt: row.created_at,
|
||||||
|
lastTestedAt: row.last_tested_at,
|
||||||
|
testResult: row.test_result,
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
|
list(): GitCredentialSummary[] {
|
||||||
|
const rows = this.db.prepare('SELECT * FROM git_credentials ORDER BY created_at ASC').all() as unknown as GitCredentialRow[];
|
||||||
|
return rows.map((r) => this.toSummary(r));
|
||||||
|
}
|
||||||
|
|
||||||
|
get(id: string): GitCredentialSummary | null {
|
||||||
|
const row = this.getRow(id);
|
||||||
|
return row ? this.toSummary(row) : null;
|
||||||
|
}
|
||||||
|
|
||||||
|
create(opts: CreateGitCredentialRequest): GitCredentialSummary {
|
||||||
|
// P12a : seules les méthodes HTTPS (pat / app_password) sont supportées pour l'instant.
|
||||||
|
if (opts.authType !== 'pat' && opts.authType !== 'app_password') {
|
||||||
|
throw httpError(400, 'UNSUPPORTED_AUTH', 'Only pat and app_password are supported for now (SSH/OAuth: later phases)');
|
||||||
|
}
|
||||||
|
if (!opts.label?.trim()) throw httpError(400, 'BAD_REQUEST', 'label is required');
|
||||||
|
if (opts.service !== 'gitea' && opts.service !== 'gitlab' && opts.service !== 'github') {
|
||||||
|
throw httpError(400, 'BAD_REQUEST', 'service must be gitea, gitlab or github');
|
||||||
|
}
|
||||||
|
if (opts.service === 'gitea' && !opts.baseUrl) throw httpError(400, 'BAD_REQUEST', 'Gitea requires a base_url');
|
||||||
|
if (!opts.secret) throw httpError(400, 'BAD_REQUEST', 'secret (token) is required');
|
||||||
|
const row: GitCredentialRow = {
|
||||||
|
id: randomUUID(),
|
||||||
|
label: opts.label.trim(),
|
||||||
|
service: opts.service,
|
||||||
|
base_url: opts.baseUrl?.trim() || null,
|
||||||
|
auth_type: opts.authType,
|
||||||
|
username: opts.username?.trim() || null,
|
||||||
|
secret_encrypted: this.box.encrypt(opts.secret),
|
||||||
|
ssh_key_path: null,
|
||||||
|
oauth_access_encrypted: null,
|
||||||
|
oauth_refresh_encrypted: null,
|
||||||
|
oauth_expires_at: null,
|
||||||
|
created_at: new Date().toISOString(),
|
||||||
|
last_tested_at: null,
|
||||||
|
test_result: null,
|
||||||
|
};
|
||||||
|
this.db
|
||||||
|
.prepare(
|
||||||
|
`INSERT INTO git_credentials (id, label, service, base_url, auth_type, username, secret_encrypted, created_at)
|
||||||
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
|
||||||
|
)
|
||||||
|
.run(row.id, row.label, row.service, row.base_url, row.auth_type, row.username, row.secret_encrypted, row.created_at);
|
||||||
|
return this.toSummary(row);
|
||||||
|
}
|
||||||
|
|
||||||
|
update(id: string, patch: UpdateGitCredentialRequest): GitCredentialSummary {
|
||||||
|
const row = this.getRow(id);
|
||||||
|
if (!row) throw httpError(404, 'NOT_FOUND', 'No credential with this id');
|
||||||
|
if (patch.label !== undefined) row.label = patch.label.trim() || row.label;
|
||||||
|
if (patch.baseUrl !== undefined) row.base_url = patch.baseUrl.trim() || null;
|
||||||
|
if (patch.username !== undefined) row.username = patch.username.trim() || null;
|
||||||
|
if (patch.secret) row.secret_encrypted = this.box.encrypt(patch.secret);
|
||||||
|
this.db
|
||||||
|
.prepare('UPDATE git_credentials SET label = ?, base_url = ?, username = ?, secret_encrypted = ? WHERE id = ?')
|
||||||
|
.run(row.label, row.base_url, row.username, row.secret_encrypted, id);
|
||||||
|
return this.toSummary(row);
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Supprime un credential et NULLifie repos.credential_id (pas de FK). */
|
||||||
|
remove(id: string): boolean {
|
||||||
|
const res = this.db.prepare('DELETE FROM git_credentials WHERE id = ?').run(id);
|
||||||
|
if (res.changes === 0) return false;
|
||||||
|
this.db.prepare('UPDATE repos SET credential_id = NULL WHERE credential_id = ?').run(id);
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Secret déchiffré — INTERNE (clone/listRepos/test). Jamais exposé par une route. */
|
||||||
|
getSecret(id: string): string | null {
|
||||||
|
const row = this.getRow(id);
|
||||||
|
if (!row?.secret_encrypted) return null;
|
||||||
|
try {
|
||||||
|
return this.box.decrypt(row.secret_encrypted);
|
||||||
|
} catch {
|
||||||
|
return null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Contexte d'auth (service, base, secret déchiffré) pour le client API / le clone. */
|
||||||
|
authContext(id: string): { service: GitService; baseUrl: string | null; auth: GitAuth } | null {
|
||||||
|
const row = this.getRow(id);
|
||||||
|
if (!row) return null;
|
||||||
|
const secret = this.getSecret(id);
|
||||||
|
if (secret == null) return null;
|
||||||
|
return { service: row.service, baseUrl: row.base_url, auth: { authType: row.auth_type, username: row.username, secret } };
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Teste la connectivité/auth (GET /user) et mémorise le diagnostic. */
|
||||||
|
async test(id: string): Promise<TestCredentialResponse> {
|
||||||
|
const ctx = this.authContext(id);
|
||||||
|
if (!ctx) throw httpError(404, 'NOT_FOUND', 'No credential with this id');
|
||||||
|
const now = new Date().toISOString();
|
||||||
|
try {
|
||||||
|
const { login } = await getGitClient(ctx.service, ctx.baseUrl).verify(ctx.auth);
|
||||||
|
this.db.prepare('UPDATE git_credentials SET last_tested_at = ?, test_result = ? WHERE id = ?').run(now, 'ok', id);
|
||||||
|
return { ok: true, user: login };
|
||||||
|
} catch (err) {
|
||||||
|
const code = err instanceof GitServiceError ? err.errorCode : 'UNREACHABLE';
|
||||||
|
this.db.prepare('UPDATE git_credentials SET last_tested_at = ?, test_result = ? WHERE id = ?').run(now, code, id);
|
||||||
|
return { ok: false, error: code };
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Helper d'audit partagé (jamais de secret dans details). */
|
||||||
|
export function auditCredential(db: Db, actor: string, action: string, id: string | null): void {
|
||||||
|
recordAudit(db, { actor, action, resourceId: id });
|
||||||
|
}
|
||||||
@@ -1,6 +1,6 @@
|
|||||||
// Couche git sûre : tout passe par execFile (JAMAIS de shell), arguments en tableau, `--` avant
|
// Couche git sûre : tout passe par execFile (JAMAIS de shell), arguments en tableau, `--` avant
|
||||||
// les chemins/refs utilisateur. Fonctions pures sans état, prenant un cwd déjà validé par l'appelant.
|
// les chemins/refs utilisateur. Fonctions pures sans état, prenant un cwd déjà validé par l'appelant.
|
||||||
import { execFile } from 'node:child_process';
|
import { execFile, spawn } from 'node:child_process';
|
||||||
import { resolve, sep } from 'node:path';
|
import { resolve, sep } from 'node:path';
|
||||||
import type { WorktreeGitStatus, WorktreeBranchAction, WorktreeBranchMode, FileChange } from '@arboretum/shared';
|
import type { WorktreeGitStatus, WorktreeBranchAction, WorktreeBranchMode, FileChange } from '@arboretum/shared';
|
||||||
|
|
||||||
@@ -605,3 +605,50 @@ export function isDirtyWorktreeError(err: unknown): boolean {
|
|||||||
const msg = `${(err as GitError)?.stderr ?? ''} ${(err as Error)?.message ?? ''}`;
|
const msg = `${(err as GitError)?.stderr ?? ''} ${(err as Error)?.message ?? ''}`;
|
||||||
return /contains modified or untracked files|is dirty|use --force/i.test(msg);
|
return /contains modified or untracked files|is dirty|use --force/i.test(msg);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
const GIT_CLONE_TIMEOUT_MS = 10 * 60_000; // 10 min : un clone réseau peut être long.
|
||||||
|
|
||||||
|
export interface CloneProgress {
|
||||||
|
phase: string;
|
||||||
|
/** pourcentage 0–100 si git le rapporte, sinon null. */
|
||||||
|
percent: number | null;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Clone un dépôt via `git clone --progress` (P12). `spawn` (et non execFile) pour streamer la
|
||||||
|
* progression depuis stderr. `env` éphémère (cf. withGitAuth) porte l'auth — JAMAIS dans l'URL.
|
||||||
|
* `--` sépare l'URL/dest des options. L'appelant valide `dest` (sous scanRoots, non existant).
|
||||||
|
*/
|
||||||
|
export function cloneRepo(opts: {
|
||||||
|
url: string;
|
||||||
|
dest: string;
|
||||||
|
env?: NodeJS.ProcessEnv;
|
||||||
|
branch?: string;
|
||||||
|
onProgress?: (p: CloneProgress) => void;
|
||||||
|
signal?: AbortSignal;
|
||||||
|
}): Promise<void> {
|
||||||
|
return new Promise((resolveP, reject) => {
|
||||||
|
const args = ['clone', '--progress'];
|
||||||
|
if (opts.branch) args.push('--branch', opts.branch);
|
||||||
|
args.push('--', opts.url, opts.dest);
|
||||||
|
const child = spawn('git', args, {
|
||||||
|
env: { ...(opts.env ?? process.env), GIT_TERMINAL_PROMPT: '0', LC_ALL: 'C' },
|
||||||
|
stdio: ['ignore', 'ignore', 'pipe'],
|
||||||
|
timeout: GIT_CLONE_TIMEOUT_MS,
|
||||||
|
...(opts.signal ? { signal: opts.signal } : {}),
|
||||||
|
});
|
||||||
|
let stderr = '';
|
||||||
|
child.stderr.on('data', (d: Buffer) => {
|
||||||
|
const s = d.toString();
|
||||||
|
stderr += s;
|
||||||
|
if (stderr.length > 64 * 1024) stderr = stderr.slice(-64 * 1024); // borne mémoire
|
||||||
|
const m = /([A-Za-z][A-Za-z ]+):\s+(\d+)%/.exec(s);
|
||||||
|
if (m && m[1] && m[2] && opts.onProgress) opts.onProgress({ phase: m[1].trim(), percent: Number(m[2]) });
|
||||||
|
});
|
||||||
|
child.on('error', (err) => reject(err));
|
||||||
|
child.on('close', (code) => {
|
||||||
|
if (code === 0) resolveP();
|
||||||
|
else reject(new Error(stderr.trim().split('\n').pop() || `git clone exited with code ${code}`));
|
||||||
|
});
|
||||||
|
});
|
||||||
|
}
|
||||||
|
|||||||
@@ -154,6 +154,43 @@ const MIGRATIONS: Array<{ id: number; sql: string }> = [
|
|||||||
CREATE INDEX idx_sessions_archived_at ON sessions(archived_at);
|
CREATE INDEX idx_sessions_archived_at ON sessions(archived_at);
|
||||||
`,
|
`,
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
// P12 — connexions aux services git distants (Gitea/GitLab/GitHub). Les SECRETS (PAT, app
|
||||||
|
// password, tokens OAuth) sont chiffrés par SecretBox AVANT insertion (colonnes *_encrypted) :
|
||||||
|
// la base ne contient jamais de secret en clair. `ssh_key_path`/`oauth_*` sont posés dès
|
||||||
|
// maintenant (schéma stable) mais exploités en P12b/P12c. `test_result` = dernier diagnostic.
|
||||||
|
id: 11,
|
||||||
|
sql: `
|
||||||
|
CREATE TABLE git_credentials (
|
||||||
|
id TEXT PRIMARY KEY,
|
||||||
|
label TEXT NOT NULL,
|
||||||
|
service TEXT NOT NULL CHECK (service IN ('gitea','gitlab','github')),
|
||||||
|
base_url TEXT,
|
||||||
|
auth_type TEXT NOT NULL CHECK (auth_type IN ('pat','app_password','ssh_key','oauth')),
|
||||||
|
username TEXT,
|
||||||
|
secret_encrypted TEXT,
|
||||||
|
ssh_key_path TEXT,
|
||||||
|
oauth_access_encrypted TEXT,
|
||||||
|
oauth_refresh_encrypted TEXT,
|
||||||
|
oauth_expires_at TEXT,
|
||||||
|
created_at TEXT NOT NULL,
|
||||||
|
last_tested_at TEXT,
|
||||||
|
test_result TEXT
|
||||||
|
);
|
||||||
|
CREATE INDEX idx_git_credentials_service ON git_credentials(service);
|
||||||
|
`,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
// P12 — un repo enregistré peut provenir d'un clone : on retient sa source (remote_url),
|
||||||
|
// le service détecté et le credential utilisé. PAS de FK sur credential_id (cohérent avec
|
||||||
|
// sessions.group_id #8) : la suppression d'un credential nullifie ce champ côté manager.
|
||||||
|
id: 12,
|
||||||
|
sql: `
|
||||||
|
ALTER TABLE repos ADD COLUMN remote_url TEXT;
|
||||||
|
ALTER TABLE repos ADD COLUMN git_service TEXT;
|
||||||
|
ALTER TABLE repos ADD COLUMN credential_id TEXT;
|
||||||
|
`,
|
||||||
|
},
|
||||||
];
|
];
|
||||||
|
|
||||||
export type Db = DatabaseSync;
|
export type Db = DatabaseSync;
|
||||||
|
|||||||
119
packages/server/src/routes/git-connections.ts
Normal file
119
packages/server/src/routes/git-connections.ts
Normal file
@@ -0,0 +1,119 @@
|
|||||||
|
// Routes des services git distants (P12) : CRUD des credentials (secrets JAMAIS renvoyés), test de
|
||||||
|
// connexion, listing des dépôts distants, et lancement/suivi d'un clone. Authentifiées par le hook
|
||||||
|
// preValidation global. Les secrets sont chiffrés par SecretBox dans le manager.
|
||||||
|
import type { FastifyInstance, FastifyReply } from 'fastify';
|
||||||
|
import type {
|
||||||
|
CloneRequest,
|
||||||
|
CloneStartResponse,
|
||||||
|
CloneStatusResponse,
|
||||||
|
CreateGitCredentialRequest,
|
||||||
|
GitCredentialResponse,
|
||||||
|
GitCredentialsListResponse,
|
||||||
|
RemoteReposResponse,
|
||||||
|
UpdateGitCredentialRequest,
|
||||||
|
} from '@arboretum/shared';
|
||||||
|
import type { Db } from '../db/index.js';
|
||||||
|
import type { GitCredentialsManager } from '../core/git-credentials.js';
|
||||||
|
import type { CloneManager } from '../core/clone-manager.js';
|
||||||
|
import { getGitClient, GitServiceError } from '../core/git-clients/index.js';
|
||||||
|
import { recordAudit } from '../core/audit-log.js';
|
||||||
|
|
||||||
|
function sendError(reply: FastifyReply, err: unknown): FastifyReply {
|
||||||
|
const e = err as { statusCode?: number; code?: string; message?: string };
|
||||||
|
const status = typeof e.statusCode === 'number' ? e.statusCode : 500;
|
||||||
|
return reply.status(status).send({ error: { code: e.code ?? 'INTERNAL', message: e.message ?? 'Internal error' } });
|
||||||
|
}
|
||||||
|
|
||||||
|
const GIT_SERVICE_ERROR_STATUS: Record<string, number> = { AUTH_FAILED: 401, RATE_LIMITED: 429, UNREACHABLE: 502, BAD_BASE_URL: 400 };
|
||||||
|
|
||||||
|
export function registerGitConnectionRoutes(
|
||||||
|
app: FastifyInstance,
|
||||||
|
credentials: GitCredentialsManager,
|
||||||
|
clones: CloneManager,
|
||||||
|
db: Db,
|
||||||
|
): void {
|
||||||
|
const actor = (req: { authContext?: { tokenId: string } | null }): string => req.authContext?.tokenId ?? 'unknown';
|
||||||
|
|
||||||
|
app.get('/api/v1/git-connections', async (): Promise<GitCredentialsListResponse> => ({ credentials: credentials.list() }));
|
||||||
|
|
||||||
|
app.post('/api/v1/git-connections', async (req, reply) => {
|
||||||
|
try {
|
||||||
|
const cred = credentials.create((req.body ?? {}) as CreateGitCredentialRequest);
|
||||||
|
recordAudit(db, { actor: actor(req), action: 'git_credential.create', resourceId: cred.id, details: { service: cred.service, authType: cred.authType } });
|
||||||
|
const res: GitCredentialResponse = { credential: cred };
|
||||||
|
return reply.status(201).send(res);
|
||||||
|
} catch (err) {
|
||||||
|
return sendError(reply, err);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
app.patch('/api/v1/git-connections/:id', async (req, reply) => {
|
||||||
|
try {
|
||||||
|
const cred = credentials.update((req.params as { id: string }).id, (req.body ?? {}) as UpdateGitCredentialRequest);
|
||||||
|
recordAudit(db, { actor: actor(req), action: 'git_credential.update', resourceId: cred.id });
|
||||||
|
const res: GitCredentialResponse = { credential: cred };
|
||||||
|
return reply.send(res);
|
||||||
|
} catch (err) {
|
||||||
|
return sendError(reply, err);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
app.delete('/api/v1/git-connections/:id', async (req, reply) => {
|
||||||
|
const { id } = req.params as { id: string };
|
||||||
|
if (!credentials.remove(id)) {
|
||||||
|
return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No credential with this id' } });
|
||||||
|
}
|
||||||
|
recordAudit(db, { actor: actor(req), action: 'git_credential.delete', resourceId: id });
|
||||||
|
return reply.send({ ok: true });
|
||||||
|
});
|
||||||
|
|
||||||
|
app.post('/api/v1/git-connections/:id/test', async (req, reply) => {
|
||||||
|
try {
|
||||||
|
const result = await credentials.test((req.params as { id: string }).id);
|
||||||
|
recordAudit(db, { actor: actor(req), action: 'git_credential.test', resourceId: (req.params as { id: string }).id, details: { ok: result.ok } });
|
||||||
|
return reply.send(result);
|
||||||
|
} catch (err) {
|
||||||
|
return sendError(reply, err);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
app.get('/api/v1/git-connections/:id/repos', async (req, reply) => {
|
||||||
|
const { id } = req.params as { id: string };
|
||||||
|
const q = req.query as { page?: string; search?: string };
|
||||||
|
const ctx = credentials.authContext(id);
|
||||||
|
if (!ctx) return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No usable credential with this id' } });
|
||||||
|
const page = Math.max(1, Number(q.page) || 1);
|
||||||
|
try {
|
||||||
|
const { repos, nextPage } = await getGitClient(ctx.service, ctx.baseUrl).listRepos(ctx.auth, page, q.search);
|
||||||
|
const res: RemoteReposResponse = { repos, nextPage };
|
||||||
|
return reply.send(res);
|
||||||
|
} catch (err) {
|
||||||
|
if (err instanceof GitServiceError) {
|
||||||
|
return reply.status(GIT_SERVICE_ERROR_STATUS[err.errorCode] ?? 502).send({ error: { code: err.errorCode, message: err.message } });
|
||||||
|
}
|
||||||
|
return sendError(reply, err);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
// ---- Clone (asynchrone : 202 + suivi WS/REST) ----
|
||||||
|
app.post('/api/v1/repos/clone', async (req, reply) => {
|
||||||
|
const body = (req.body ?? {}) as Partial<CloneRequest>;
|
||||||
|
if (typeof body.credentialId !== 'string' || typeof body.remoteUrl !== 'string' || typeof body.dest !== 'string') {
|
||||||
|
return reply.status(400).send({ error: { code: 'BAD_REQUEST', message: 'credentialId, remoteUrl and dest are required' } });
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
const operationId = await clones.start({ credentialId: body.credentialId, remoteUrl: body.remoteUrl, dest: body.dest }, actor(req));
|
||||||
|
const res: CloneStartResponse = { operationId };
|
||||||
|
return reply.status(202).send(res);
|
||||||
|
} catch (err) {
|
||||||
|
return sendError(reply, err);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
app.get('/api/v1/repos/clone/:id', async (req, reply) => {
|
||||||
|
const op = clones.get((req.params as { id: string }).id);
|
||||||
|
if (!op) return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No clone operation with this id' } });
|
||||||
|
const res: CloneStatusResponse = { operation: op };
|
||||||
|
return reply.send(res);
|
||||||
|
});
|
||||||
|
}
|
||||||
@@ -7,6 +7,7 @@ import {
|
|||||||
parseClientMessage,
|
parseClientMessage,
|
||||||
type GroupSummary,
|
type GroupSummary,
|
||||||
type RepoSummary,
|
type RepoSummary,
|
||||||
|
type CloneOperation,
|
||||||
type ServerMessage,
|
type ServerMessage,
|
||||||
type SessionSummary,
|
type SessionSummary,
|
||||||
type SettingsBroadcast,
|
type SettingsBroadcast,
|
||||||
@@ -18,6 +19,7 @@ import type { SessionArchiveService } from '../core/session-archive.js';
|
|||||||
import type { WorktreeManager } from '../core/worktree-manager.js';
|
import type { WorktreeManager } from '../core/worktree-manager.js';
|
||||||
import type { GroupManager } from '../core/group-manager.js';
|
import type { GroupManager } from '../core/group-manager.js';
|
||||||
import type { SettingsBus } from '../core/settings-bus.js';
|
import type { SettingsBus } from '../core/settings-bus.js';
|
||||||
|
import type { CloneManager } from '../core/clone-manager.js';
|
||||||
|
|
||||||
const HEARTBEAT_MS = 30_000;
|
const HEARTBEAT_MS = 30_000;
|
||||||
|
|
||||||
@@ -34,6 +36,7 @@ export function registerWsGateway(
|
|||||||
worktrees: WorktreeManager,
|
worktrees: WorktreeManager,
|
||||||
groups: GroupManager,
|
groups: GroupManager,
|
||||||
settingsBus: SettingsBus,
|
settingsBus: SettingsBus,
|
||||||
|
clones: CloneManager,
|
||||||
serverVersion: string,
|
serverVersion: string,
|
||||||
): void {
|
): void {
|
||||||
app.get('/ws', { websocket: true }, (socket: WebSocket, req) => {
|
app.get('/ws', { websocket: true }, (socket: WebSocket, req) => {
|
||||||
@@ -45,6 +48,7 @@ export function registerWsGateway(
|
|||||||
let subscribedWorktrees = false;
|
let subscribedWorktrees = false;
|
||||||
let subscribedGroups = false;
|
let subscribedGroups = false;
|
||||||
let subscribedSettings = false;
|
let subscribedSettings = false;
|
||||||
|
let subscribedClones = false;
|
||||||
let alive = true;
|
let alive = true;
|
||||||
// Worktrees « regardés » par CETTE connexion (clé repoId\0path) → push ciblé de worktree_changes.
|
// Worktrees « regardés » par CETTE connexion (clé repoId\0path) → push ciblé de worktree_changes.
|
||||||
const watched = new Set<string>();
|
const watched = new Set<string>();
|
||||||
@@ -93,6 +97,10 @@ export function registerWsGateway(
|
|||||||
const onSettingsUpdate = (settings: SettingsBroadcast): void => {
|
const onSettingsUpdate = (settings: SettingsBroadcast): void => {
|
||||||
if (subscribedSettings) send({ type: 'settings_update', settings });
|
if (subscribedSettings) send({ type: 'settings_update', settings });
|
||||||
};
|
};
|
||||||
|
// P12 — progression d'un clone : relayée aux abonnés du topic 'clones'.
|
||||||
|
const onCloneUpdate = (operation: CloneOperation): void => {
|
||||||
|
if (subscribedClones) send({ type: 'clone_update', operation });
|
||||||
|
};
|
||||||
// P7 — détail d'un worktree modifié : poussé UNIQUEMENT si cette connexion le regarde.
|
// P7 — détail d'un worktree modifié : poussé UNIQUEMENT si cette connexion le regarde.
|
||||||
const onWorktreeChanges = (e: { repoId: string; path: string }): void => {
|
const onWorktreeChanges = (e: { repoId: string; path: string }): void => {
|
||||||
if (watched.has(watchKey(e.repoId, e.path))) send({ type: 'worktree_changes', ...e });
|
if (watched.has(watchKey(e.repoId, e.path))) send({ type: 'worktree_changes', ...e });
|
||||||
@@ -109,6 +117,7 @@ export function registerWsGateway(
|
|||||||
groups.on('group_update', onGroupUpdate);
|
groups.on('group_update', onGroupUpdate);
|
||||||
groups.on('group_removed', onGroupRemoved);
|
groups.on('group_removed', onGroupRemoved);
|
||||||
settingsBus.on('settings_update', onSettingsUpdate);
|
settingsBus.on('settings_update', onSettingsUpdate);
|
||||||
|
clones.on('clone_update', onCloneUpdate);
|
||||||
|
|
||||||
const heartbeat = setInterval(() => {
|
const heartbeat = setInterval(() => {
|
||||||
if (!alive) {
|
if (!alive) {
|
||||||
@@ -149,6 +158,7 @@ export function registerWsGateway(
|
|||||||
subscribedWorktrees = msg.topics.includes('worktrees');
|
subscribedWorktrees = msg.topics.includes('worktrees');
|
||||||
subscribedGroups = msg.topics.includes('groups');
|
subscribedGroups = msg.topics.includes('groups');
|
||||||
subscribedSettings = msg.topics.includes('settings');
|
subscribedSettings = msg.topics.includes('settings');
|
||||||
|
subscribedClones = msg.topics.includes('clones');
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
case 'watch': {
|
case 'watch': {
|
||||||
@@ -261,6 +271,7 @@ export function registerWsGateway(
|
|||||||
groups.off('group_update', onGroupUpdate);
|
groups.off('group_update', onGroupUpdate);
|
||||||
groups.off('group_removed', onGroupRemoved);
|
groups.off('group_removed', onGroupRemoved);
|
||||||
settingsBus.off('settings_update', onSettingsUpdate);
|
settingsBus.off('settings_update', onSettingsUpdate);
|
||||||
|
clones.off('clone_update', onCloneUpdate);
|
||||||
for (const [, st] of channels) manager.detach(st.sessionId, st.binding);
|
for (const [, st] of channels) manager.detach(st.sessionId, st.binding);
|
||||||
channels.clear();
|
channels.clear();
|
||||||
// Libère le refcount du watcher pour chaque worktree regardé par cette connexion.
|
// Libère le refcount du watcher pour chaque worktree regardé par cette connexion.
|
||||||
|
|||||||
54
packages/server/test/git-credentials.test.ts
Normal file
54
packages/server/test/git-credentials.test.ts
Normal file
@@ -0,0 +1,54 @@
|
|||||||
|
// Credentials git (P12) : round-trip SecretBox, résumé SANS secret, NULLification à la suppression.
|
||||||
|
import { afterEach, beforeEach, describe, expect, it } from 'vitest';
|
||||||
|
import { openDb, type Db } from '../src/db/index.js';
|
||||||
|
import { SecretBox } from '../src/core/secret-box.js';
|
||||||
|
import { GitCredentialsManager } from '../src/core/git-credentials.js';
|
||||||
|
|
||||||
|
let db: Db;
|
||||||
|
let mgr: GitCredentialsManager;
|
||||||
|
const SECRET = 'pat-super-secret-1234';
|
||||||
|
|
||||||
|
beforeEach(() => {
|
||||||
|
db = openDb(':memory:');
|
||||||
|
mgr = new GitCredentialsManager(db, new SecretBox(Buffer.alloc(32, 7)));
|
||||||
|
});
|
||||||
|
afterEach(() => db.close());
|
||||||
|
|
||||||
|
describe('GitCredentialsManager', () => {
|
||||||
|
it('crée un credential : secret chiffré en DB, résumé sans secret', () => {
|
||||||
|
const cred = mgr.create({ label: 'gh', service: 'github', authType: 'pat', secret: SECRET });
|
||||||
|
expect(cred.hasSecret).toBe(true);
|
||||||
|
expect(cred.secretLast4).toBe('1234');
|
||||||
|
// le résumé sérialisé ne contient JAMAIS le secret en clair.
|
||||||
|
expect(JSON.stringify(cred)).not.toContain(SECRET);
|
||||||
|
// en DB : valeur chiffrée (préfixe v1:), jamais le clair.
|
||||||
|
const row = db.prepare('SELECT secret_encrypted FROM git_credentials WHERE id = ?').get(cred.id) as { secret_encrypted: string };
|
||||||
|
expect(row.secret_encrypted.startsWith('v1:')).toBe(true);
|
||||||
|
expect(row.secret_encrypted).not.toContain(SECRET);
|
||||||
|
});
|
||||||
|
|
||||||
|
it('getSecret déchiffre (round-trip)', () => {
|
||||||
|
const cred = mgr.create({ label: 'gl', service: 'gitlab', authType: 'pat', secret: SECRET });
|
||||||
|
expect(mgr.getSecret(cred.id)).toBe(SECRET);
|
||||||
|
});
|
||||||
|
|
||||||
|
it('exige un base_url pour Gitea', () => {
|
||||||
|
expect(() => mgr.create({ label: 'x', service: 'gitea', authType: 'pat', secret: SECRET })).toThrow();
|
||||||
|
expect(mgr.create({ label: 'x', service: 'gitea', authType: 'pat', baseUrl: 'https://git.example.com', secret: SECRET }).baseUrl).toBe('https://git.example.com');
|
||||||
|
});
|
||||||
|
|
||||||
|
it('refuse ssh_key/oauth pour l’instant (P12a)', () => {
|
||||||
|
expect(() => mgr.create({ label: 'x', service: 'github', authType: 'ssh_key', secret: SECRET })).toThrow();
|
||||||
|
expect(() => mgr.create({ label: 'x', service: 'github', authType: 'oauth', secret: SECRET })).toThrow();
|
||||||
|
});
|
||||||
|
|
||||||
|
it('remove() NULLifie repos.credential_id (pas de FK)', () => {
|
||||||
|
const cred = mgr.create({ label: 'gh', service: 'github', authType: 'pat', secret: SECRET });
|
||||||
|
db.prepare(
|
||||||
|
"INSERT INTO repos (id, path, label, post_create_hooks, pre_trust, created_at, hidden, credential_id) VALUES ('r1', '/tmp/r1', 'r1', '[]', 0, '2020-01-01T00:00:00Z', 0, ?)",
|
||||||
|
).run(cred.id);
|
||||||
|
expect(mgr.remove(cred.id)).toBe(true);
|
||||||
|
const repo = db.prepare("SELECT credential_id FROM repos WHERE id = 'r1'").get() as { credential_id: string | null };
|
||||||
|
expect(repo.credential_id).toBeNull();
|
||||||
|
});
|
||||||
|
});
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
// Types REST partagés (préfixe /api/v1).
|
// Types REST partagés (préfixe /api/v1).
|
||||||
import type { GroupSummary, PostCreateHook, RepoSummary, SessionSummary, SettingsBroadcast, WorktreeSummary } from './protocol.js';
|
import type { CloneOperation, GroupSummary, PostCreateHook, RepoSummary, SessionSummary, SettingsBroadcast, WorktreeSummary } from './protocol.js';
|
||||||
|
|
||||||
export interface ApiError {
|
export interface ApiError {
|
||||||
error: { code: string; message: string; details?: unknown };
|
error: { code: string; message: string; details?: unknown };
|
||||||
@@ -471,3 +471,88 @@ export interface DeleteMyDataResponse {
|
|||||||
/** récapitulatif de ce qui sera/a été supprimé. */
|
/** récapitulatif de ce qui sera/a été supprimé. */
|
||||||
summary: { pushSubscriptions: number; tokenRevoked: boolean };
|
summary: { pushSubscriptions: number; tokenRevoked: boolean };
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// ---- Services git distants + clone (P12) ----
|
||||||
|
export type GitService = 'gitea' | 'gitlab' | 'github';
|
||||||
|
export type GitAuthType = 'pat' | 'app_password' | 'ssh_key' | 'oauth';
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Résumé d'un credential exposé à l'UI. Ne contient JAMAIS le secret : `hasSecret` indique sa
|
||||||
|
* présence, `secretLast4` n'en révèle que les 4 derniers caractères (repère visuel, non sensible).
|
||||||
|
*/
|
||||||
|
export interface GitCredentialSummary {
|
||||||
|
id: string;
|
||||||
|
label: string;
|
||||||
|
service: GitService;
|
||||||
|
baseUrl: string | null;
|
||||||
|
authType: GitAuthType;
|
||||||
|
username: string | null;
|
||||||
|
hasSecret: boolean;
|
||||||
|
secretLast4: string | null;
|
||||||
|
createdAt: string;
|
||||||
|
lastTestedAt: string | null;
|
||||||
|
/** diagnostic du dernier /test : 'ok' | 'AUTH_FAILED' | 'RATE_LIMITED' | 'UNREACHABLE' | … */
|
||||||
|
testResult: string | null;
|
||||||
|
}
|
||||||
|
export interface GitCredentialsListResponse {
|
||||||
|
credentials: GitCredentialSummary[];
|
||||||
|
}
|
||||||
|
export interface CreateGitCredentialRequest {
|
||||||
|
label: string;
|
||||||
|
service: GitService;
|
||||||
|
/** P12a : 'pat' | 'app_password' (HTTPS). 'ssh_key'/'oauth' arrivent en P12b/P12c. */
|
||||||
|
authType: GitAuthType;
|
||||||
|
/** instance self-hosted (Gitea/GitLab) ; absent = service public (github.com / gitlab.com). */
|
||||||
|
baseUrl?: string;
|
||||||
|
username?: string;
|
||||||
|
/** PAT ou app password — chiffré côté serveur (SecretBox), jamais relu. */
|
||||||
|
secret?: string;
|
||||||
|
}
|
||||||
|
export interface UpdateGitCredentialRequest {
|
||||||
|
label?: string;
|
||||||
|
baseUrl?: string;
|
||||||
|
username?: string;
|
||||||
|
/** si fourni, re-chiffre le secret ; absent = inchangé. */
|
||||||
|
secret?: string;
|
||||||
|
}
|
||||||
|
export interface GitCredentialResponse {
|
||||||
|
credential: GitCredentialSummary;
|
||||||
|
}
|
||||||
|
export interface TestCredentialResponse {
|
||||||
|
ok: boolean;
|
||||||
|
/** login renvoyé par le service en cas de succès. */
|
||||||
|
user?: string;
|
||||||
|
/** code d'erreur typé en cas d'échec (AUTH_FAILED, RATE_LIMITED, UNREACHABLE). */
|
||||||
|
error?: string;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Dépôt distant listé via l'API du service. */
|
||||||
|
export interface RemoteRepoSummary {
|
||||||
|
/** owner/name */
|
||||||
|
fullName: string;
|
||||||
|
/** URL HTTPS de clone. */
|
||||||
|
cloneUrl: string;
|
||||||
|
private: boolean;
|
||||||
|
description: string | null;
|
||||||
|
defaultBranch: string | null;
|
||||||
|
}
|
||||||
|
export interface RemoteReposResponse {
|
||||||
|
repos: RemoteRepoSummary[];
|
||||||
|
/** numéro de page suivant si d'autres résultats existent, sinon null. */
|
||||||
|
nextPage: number | null;
|
||||||
|
}
|
||||||
|
|
||||||
|
export interface CloneRequest {
|
||||||
|
credentialId: string;
|
||||||
|
/** URL HTTPS du dépôt à cloner. */
|
||||||
|
remoteUrl: string;
|
||||||
|
/** dossier de destination (sous une racine de scan) — créé par le clone, refus si existant. */
|
||||||
|
dest: string;
|
||||||
|
}
|
||||||
|
export interface CloneStartResponse {
|
||||||
|
operationId: string;
|
||||||
|
}
|
||||||
|
/** État d'un clone (GET /repos/clone/:id) — même forme que le push WS clone_update. */
|
||||||
|
export interface CloneStatusResponse {
|
||||||
|
operation: CloneOperation;
|
||||||
|
}
|
||||||
|
|||||||
@@ -225,6 +225,23 @@ export interface SettingsBroadcast {
|
|||||||
purgeDays: number;
|
purgeDays: number;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
// ---- Clone d'un dépôt distant (P12) ----
|
||||||
|
export type CloneState = 'pending' | 'running' | 'done' | 'error';
|
||||||
|
/** État d'une opération de clone (poussé en WS sous le topic 'clones' ET lu en REST). */
|
||||||
|
export interface CloneOperation {
|
||||||
|
id: string;
|
||||||
|
state: CloneState;
|
||||||
|
/** progression 0–100 si git la communique, sinon null. */
|
||||||
|
progress: number | null;
|
||||||
|
/** phase courante rapportée par git (« Receiving objects », « Resolving deltas »…). */
|
||||||
|
phase: string | null;
|
||||||
|
error: string | null;
|
||||||
|
/** id du repo enregistré une fois le clone terminé (null avant). */
|
||||||
|
repoId: string | null;
|
||||||
|
/** dossier de destination du clone. */
|
||||||
|
dest: string;
|
||||||
|
}
|
||||||
|
|
||||||
// ---- Messages client → serveur ----
|
// ---- Messages client → serveur ----
|
||||||
export type ClientMessage =
|
export type ClientMessage =
|
||||||
| { type: 'hello'; protocol: number }
|
| { type: 'hello'; protocol: number }
|
||||||
@@ -237,7 +254,7 @@ export type ClientMessage =
|
|||||||
| { type: 'answer'; channel: number; action: 'select' | 'confirm' | 'deny'; optionN?: number }
|
| { type: 'answer'; channel: number; action: 'select' | 'confirm' | 'deny'; optionN?: number }
|
||||||
| { type: 'resize'; channel: number; cols: number; rows: number }
|
| { type: 'resize'; channel: number; cols: number; rows: number }
|
||||||
| { type: 'ack'; channel: number; bytes: number }
|
| { type: 'ack'; channel: number; bytes: number }
|
||||||
| { type: 'sub'; topics: Array<'sessions' | 'worktrees' | 'groups' | 'settings'> }
|
| { type: 'sub'; topics: Array<'sessions' | 'worktrees' | 'groups' | 'settings' | 'clones'> }
|
||||||
// P7 — abonnement ciblé au détail d'un worktree (diff/statut fin) : on ne pousse le détail
|
// P7 — abonnement ciblé au détail d'un worktree (diff/statut fin) : on ne pousse le détail
|
||||||
// qu'aux connexions qui « regardent » ce worktree (clé = repoId + path), indépendamment du
|
// qu'aux connexions qui « regardent » ce worktree (clé = repoId + path), indépendamment du
|
||||||
// topic global 'worktrees' (qui ne transporte que les compteurs légers).
|
// topic global 'worktrees' (qui ne transporte que les compteurs légers).
|
||||||
@@ -259,6 +276,9 @@ export type ServerMessage =
|
|||||||
// P11 — un réglage a changé (PATCH /settings) : on diffuse le snapshot non sensible aux abonnés
|
// P11 — un réglage a changé (PATCH /settings) : on diffuse le snapshot non sensible aux abonnés
|
||||||
// du topic 'settings' pour que tous les clients (et onglets) se synchronisent sans polling.
|
// du topic 'settings' pour que tous les clients (et onglets) se synchronisent sans polling.
|
||||||
| { type: 'settings_update'; settings: SettingsBroadcast }
|
| { type: 'settings_update'; settings: SettingsBroadcast }
|
||||||
|
// P12 — progression/fin/erreur d'un clone, poussé aux abonnés du topic 'clones'. L'état complet
|
||||||
|
// (state) discrimine progress/done/error en un seul message.
|
||||||
|
| { type: 'clone_update'; operation: CloneOperation }
|
||||||
| { type: 'repo_update'; repo: RepoSummary }
|
| { type: 'repo_update'; repo: RepoSummary }
|
||||||
| { type: 'repo_removed'; repoId: string }
|
| { type: 'repo_removed'; repoId: string }
|
||||||
| { type: 'worktree_update'; repoId: string; worktree: WorktreeSummary }
|
| { type: 'worktree_update'; repoId: string; worktree: WorktreeSummary }
|
||||||
@@ -326,8 +346,8 @@ export function parseClientMessage(raw: string): ClientMessage | null {
|
|||||||
? { type: 'ack', channel: m.channel, bytes: m.bytes }
|
? { type: 'ack', channel: m.channel, bytes: m.bytes }
|
||||||
: null;
|
: null;
|
||||||
case 'sub':
|
case 'sub':
|
||||||
return Array.isArray(m.topics) && m.topics.every((t) => t === 'sessions' || t === 'worktrees' || t === 'groups' || t === 'settings')
|
return Array.isArray(m.topics) && m.topics.every((t) => t === 'sessions' || t === 'worktrees' || t === 'groups' || t === 'settings' || t === 'clones')
|
||||||
? { type: 'sub', topics: m.topics as Array<'sessions' | 'worktrees' | 'groups' | 'settings'> }
|
? { type: 'sub', topics: m.topics as Array<'sessions' | 'worktrees' | 'groups' | 'settings' | 'clones'> }
|
||||||
: null;
|
: null;
|
||||||
case 'watch':
|
case 'watch':
|
||||||
case 'unwatch':
|
case 'unwatch':
|
||||||
|
|||||||
173
packages/web/src/components/CloneRepoModal.vue
Normal file
173
packages/web/src/components/CloneRepoModal.vue
Normal file
@@ -0,0 +1,173 @@
|
|||||||
|
<template>
|
||||||
|
<div class="fixed inset-0 z-50 flex items-center justify-center bg-black/60 p-4" @click.self="emit('close')">
|
||||||
|
<div class="flex max-h-[90vh] w-full max-w-lg flex-col gap-3 overflow-y-auto rounded-lg border border-zinc-800 bg-zinc-900 p-4">
|
||||||
|
<header class="flex items-center gap-2">
|
||||||
|
<h2 class="font-semibold text-zinc-100">{{ t('clone.title') }}</h2>
|
||||||
|
<button class="btn ml-auto text-xs" @click="emit('close')">{{ t('common.cancel') }}</button>
|
||||||
|
</header>
|
||||||
|
|
||||||
|
<!-- aucune connexion → renvoyer vers les réglages -->
|
||||||
|
<p v-if="conn.connections.length === 0" class="text-sm text-zinc-400">
|
||||||
|
{{ t('clone.noCredential') }}
|
||||||
|
<RouterLink :to="{ name: 'settings' }" class="text-emerald-400 hover:underline" @click="emit('close')">{{ t('clone.goSettings') }}</RouterLink>
|
||||||
|
</p>
|
||||||
|
|
||||||
|
<template v-else-if="!operationId">
|
||||||
|
<label class="flex flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('clone.credential') }}
|
||||||
|
<select v-model="credentialId" class="input" @change="loadRepos(1)">
|
||||||
|
<option v-for="c in conn.connections" :key="c.id" :value="c.id">{{ c.label }} ({{ c.service }})</option>
|
||||||
|
</select>
|
||||||
|
</label>
|
||||||
|
|
||||||
|
<div class="flex items-end gap-2">
|
||||||
|
<label class="flex flex-1 flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('clone.search') }}
|
||||||
|
<input v-model.trim="search" class="input" :placeholder="t('clone.searchPlaceholder')" @keyup.enter="loadRepos(1)" />
|
||||||
|
</label>
|
||||||
|
<BaseButton size="sm" :icon="RefreshCw" :loading="loadingRepos" @click="loadRepos(1)">{{ t('common.refresh') }}</BaseButton>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<p v-if="reposError" class="text-xs text-amber-400">{{ reposError }}</p>
|
||||||
|
<ul class="flex max-h-52 flex-col gap-0.5 overflow-y-auto">
|
||||||
|
<li v-for="r in repos" :key="r.fullName">
|
||||||
|
<button
|
||||||
|
type="button"
|
||||||
|
class="flex w-full items-center gap-2 rounded px-2 py-1 text-left text-sm hover:bg-zinc-800"
|
||||||
|
:class="selected?.fullName === r.fullName ? 'bg-zinc-800 text-zinc-100' : 'text-zinc-300'"
|
||||||
|
@click="select(r)"
|
||||||
|
>
|
||||||
|
<span class="min-w-0 flex-1 truncate font-mono">{{ r.fullName }}</span>
|
||||||
|
<BaseBadge v-if="r.private" tone="zinc">{{ t('clone.private') }}</BaseBadge>
|
||||||
|
</button>
|
||||||
|
</li>
|
||||||
|
<li v-if="!loadingRepos && repos.length === 0" class="px-2 py-1 text-xs text-zinc-600">{{ t('clone.noRepos') }}</li>
|
||||||
|
</ul>
|
||||||
|
<div v-if="nextPage" class="flex justify-center">
|
||||||
|
<BaseButton size="sm" variant="ghost" :loading="loadingRepos" @click="loadRepos(nextPage)">{{ t('clone.more') }}</BaseButton>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<label class="flex flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('clone.dest') }}
|
||||||
|
<input v-model.trim="dest" class="input font-mono" :placeholder="t('clone.destPlaceholder')" />
|
||||||
|
<span class="text-xs text-zinc-600">{{ t('clone.destHint') }}</span>
|
||||||
|
</label>
|
||||||
|
|
||||||
|
<p v-if="error" class="text-xs text-amber-400">{{ error }}</p>
|
||||||
|
<div>
|
||||||
|
<BaseButton variant="primary" :icon="Download" :loading="starting" :disabled="!canClone" @click="onClone">{{ t('clone.clone') }}</BaseButton>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<!-- progression -->
|
||||||
|
<template v-else>
|
||||||
|
<p class="text-sm text-zinc-300">{{ progressLabel }}</p>
|
||||||
|
<div class="h-2 w-full overflow-hidden rounded bg-zinc-800">
|
||||||
|
<div class="h-full bg-emerald-500 transition-all" :style="{ width: `${op?.progress ?? 0}%` }" />
|
||||||
|
</div>
|
||||||
|
<p v-if="op?.state === 'error'" class="text-xs text-rose-400">{{ op.error }}</p>
|
||||||
|
<div v-if="op?.state === 'error'" class="flex gap-2">
|
||||||
|
<BaseButton size="sm" variant="ghost" @click="operationId = null">{{ t('clone.back') }}</BaseButton>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<script setup lang="ts">
|
||||||
|
import { computed, onMounted, ref, watch } from 'vue';
|
||||||
|
import { useRouter } from 'vue-router';
|
||||||
|
import { useI18n } from 'vue-i18n';
|
||||||
|
import { Download, RefreshCw } from '@lucide/vue';
|
||||||
|
import type { RemoteRepoSummary } from '@arboretum/shared';
|
||||||
|
import { useGitConnectionsStore } from '../stores/git-connections';
|
||||||
|
import { useCloneStore } from '../stores/clone';
|
||||||
|
import { useSettingsStore } from '../stores/settings';
|
||||||
|
import { useToastsStore } from '../stores/toasts';
|
||||||
|
import BaseButton from './ui/BaseButton.vue';
|
||||||
|
import BaseBadge from './ui/BaseBadge.vue';
|
||||||
|
|
||||||
|
const emit = defineEmits<{ close: [] }>();
|
||||||
|
const { t } = useI18n();
|
||||||
|
const router = useRouter();
|
||||||
|
const conn = useGitConnectionsStore();
|
||||||
|
const cloneStore = useCloneStore();
|
||||||
|
const settings = useSettingsStore();
|
||||||
|
const toasts = useToastsStore();
|
||||||
|
|
||||||
|
const credentialId = ref('');
|
||||||
|
const search = ref('');
|
||||||
|
const repos = ref<RemoteRepoSummary[]>([]);
|
||||||
|
const nextPage = ref<number | null>(null);
|
||||||
|
const loadingRepos = ref(false);
|
||||||
|
const reposError = ref<string | null>(null);
|
||||||
|
const selected = ref<RemoteRepoSummary | null>(null);
|
||||||
|
const dest = ref('');
|
||||||
|
const error = ref<string | null>(null);
|
||||||
|
const starting = ref(false);
|
||||||
|
const operationId = ref<string | null>(null);
|
||||||
|
|
||||||
|
const op = computed(() => (operationId.value ? cloneStore.get(operationId.value) ?? null : null));
|
||||||
|
const scanRoot = computed(() => settings.scanRoots[0] ?? '');
|
||||||
|
const canClone = computed(() => !!credentialId.value && !!selected.value && dest.value.trim() !== '');
|
||||||
|
const progressLabel = computed(() => {
|
||||||
|
if (!op.value) return t('clone.starting');
|
||||||
|
if (op.value.state === 'done') return t('clone.done');
|
||||||
|
if (op.value.state === 'error') return t('clone.failed');
|
||||||
|
return op.value.phase ? `${op.value.phase}… ${op.value.progress ?? 0}%` : t('clone.cloning');
|
||||||
|
});
|
||||||
|
|
||||||
|
onMounted(async () => {
|
||||||
|
if (!settings.loaded) await settings.fetch();
|
||||||
|
if (conn.connections.length === 0) await conn.fetchAll();
|
||||||
|
const first = conn.connections[0];
|
||||||
|
if (first) {
|
||||||
|
credentialId.value = first.id;
|
||||||
|
await loadRepos(1);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
async function loadRepos(page: number): Promise<void> {
|
||||||
|
if (!credentialId.value) return;
|
||||||
|
loadingRepos.value = true;
|
||||||
|
reposError.value = null;
|
||||||
|
try {
|
||||||
|
const res = await conn.listRemoteRepos(credentialId.value, page, search.value || undefined);
|
||||||
|
repos.value = page === 1 ? res.repos : [...repos.value, ...res.repos];
|
||||||
|
nextPage.value = res.nextPage;
|
||||||
|
} catch (e) {
|
||||||
|
reposError.value = e instanceof Error ? e.message : String(e);
|
||||||
|
} finally {
|
||||||
|
loadingRepos.value = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function select(r: RemoteRepoSummary): void {
|
||||||
|
selected.value = r;
|
||||||
|
const name = r.fullName.split('/').pop() ?? r.fullName;
|
||||||
|
dest.value = scanRoot.value ? `${scanRoot.value}/${name}` : '';
|
||||||
|
}
|
||||||
|
|
||||||
|
async function onClone(): Promise<void> {
|
||||||
|
if (!selected.value) return;
|
||||||
|
starting.value = true;
|
||||||
|
error.value = null;
|
||||||
|
try {
|
||||||
|
operationId.value = await cloneStore.clone({ credentialId: credentialId.value, remoteUrl: selected.value.cloneUrl, dest: dest.value.trim() });
|
||||||
|
} catch (e) {
|
||||||
|
error.value = e instanceof Error ? e.message : String(e);
|
||||||
|
operationId.value = null;
|
||||||
|
} finally {
|
||||||
|
starting.value = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// À la fin du clone : toast + redirection vers le tableau de bord (le repo y apparaît).
|
||||||
|
watch(op, (o) => {
|
||||||
|
if (o?.state === 'done') {
|
||||||
|
toasts.success(t('clone.done'));
|
||||||
|
emit('close');
|
||||||
|
void router.push({ name: 'dashboard' });
|
||||||
|
}
|
||||||
|
});
|
||||||
|
</script>
|
||||||
150
packages/web/src/components/settings/GitConnectionsSection.vue
Normal file
150
packages/web/src/components/settings/GitConnectionsSection.vue
Normal file
@@ -0,0 +1,150 @@
|
|||||||
|
<template>
|
||||||
|
<section class="card flex flex-col gap-3">
|
||||||
|
<h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
|
||||||
|
<Plug :size="16" /> {{ t('gitconn.title') }}
|
||||||
|
</h2>
|
||||||
|
<p class="text-xs text-zinc-500">{{ t('gitconn.hint') }}</p>
|
||||||
|
|
||||||
|
<!-- liste des connexions -->
|
||||||
|
<ul v-if="store.connections.length" class="flex flex-col gap-1">
|
||||||
|
<li v-for="c in store.connections" :key="c.id" class="card-inset flex flex-wrap items-center gap-2">
|
||||||
|
<BaseBadge tone="sky">{{ c.service }}</BaseBadge>
|
||||||
|
<span class="font-medium text-zinc-200">{{ c.label }}</span>
|
||||||
|
<span class="text-xs text-zinc-500">{{ c.authType }}<template v-if="c.username"> · {{ c.username }}</template></span>
|
||||||
|
<span v-if="c.hasSecret" class="font-mono text-xs text-zinc-600">••••{{ c.secretLast4 }}</span>
|
||||||
|
<BaseBadge v-if="c.testResult" :tone="c.testResult === 'ok' ? 'emerald' : 'red'">{{ c.testResult }}</BaseBadge>
|
||||||
|
<span class="ml-auto flex items-center gap-1">
|
||||||
|
<BaseButton size="sm" variant="ghost" :loading="testingId === c.id" @click="onTest(c.id)">{{ t('gitconn.test') }}</BaseButton>
|
||||||
|
<BaseButton v-if="confirmId === c.id" size="sm" variant="danger" @click="onDelete(c.id)">{{ t('common.confirm') }}</BaseButton>
|
||||||
|
<BaseButton v-else size="sm" variant="ghost" :icon="Trash2" :aria-label="t('common.delete')" icon-only @click="confirmId = c.id" />
|
||||||
|
</span>
|
||||||
|
</li>
|
||||||
|
</ul>
|
||||||
|
<p v-else class="text-xs text-zinc-600">{{ t('gitconn.empty') }}</p>
|
||||||
|
|
||||||
|
<!-- formulaire d'ajout -->
|
||||||
|
<form v-if="adding" class="card-inset flex flex-col gap-2" @submit.prevent="onCreate">
|
||||||
|
<div class="flex flex-wrap gap-2">
|
||||||
|
<label class="flex flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('gitconn.service') }}
|
||||||
|
<select v-model="form.service" class="input">
|
||||||
|
<option value="gitea">Gitea</option>
|
||||||
|
<option value="gitlab">GitLab</option>
|
||||||
|
<option value="github">GitHub</option>
|
||||||
|
</select>
|
||||||
|
</label>
|
||||||
|
<label class="flex flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('gitconn.authType') }}
|
||||||
|
<select v-model="form.authType" class="input">
|
||||||
|
<option value="pat">{{ t('gitconn.pat') }}</option>
|
||||||
|
<option value="app_password">{{ t('gitconn.appPassword') }}</option>
|
||||||
|
</select>
|
||||||
|
</label>
|
||||||
|
<label class="flex flex-1 flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('gitconn.label') }}
|
||||||
|
<input v-model.trim="form.label" class="input" :placeholder="t('gitconn.labelPlaceholder')" required />
|
||||||
|
</label>
|
||||||
|
</div>
|
||||||
|
<label v-if="form.service === 'gitea' || form.service === 'gitlab'" class="flex flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('gitconn.baseUrl') }}<template v-if="form.service === 'gitea'"> *</template>
|
||||||
|
<input v-model.trim="form.baseUrl" class="input font-mono" placeholder="https://git.example.com" :required="form.service === 'gitea'" />
|
||||||
|
</label>
|
||||||
|
<div class="flex flex-wrap gap-2">
|
||||||
|
<label class="flex flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ t('gitconn.username') }}
|
||||||
|
<input v-model.trim="form.username" class="input" :placeholder="t('gitconn.usernamePlaceholder')" />
|
||||||
|
</label>
|
||||||
|
<label class="flex flex-1 flex-col gap-1 text-xs text-zinc-400">
|
||||||
|
{{ form.authType === 'pat' ? t('gitconn.token') : t('gitconn.password') }}
|
||||||
|
<input v-model="form.secret" type="password" class="input font-mono" autocomplete="off" required />
|
||||||
|
</label>
|
||||||
|
</div>
|
||||||
|
<p v-if="error" class="text-xs text-amber-400">{{ error }}</p>
|
||||||
|
<div class="flex items-center gap-2">
|
||||||
|
<BaseButton type="submit" variant="primary" size="sm" :loading="creating" :disabled="!canCreate">{{ t('gitconn.add') }}</BaseButton>
|
||||||
|
<BaseButton type="button" size="sm" variant="ghost" @click="adding = false">{{ t('common.cancel') }}</BaseButton>
|
||||||
|
</div>
|
||||||
|
</form>
|
||||||
|
<div v-else>
|
||||||
|
<BaseButton size="sm" :icon="Plus" @click="openForm">{{ t('gitconn.addConnection') }}</BaseButton>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
</template>
|
||||||
|
|
||||||
|
<script setup lang="ts">
|
||||||
|
import { computed, onMounted, reactive, ref } from 'vue';
|
||||||
|
import { useI18n } from 'vue-i18n';
|
||||||
|
import { Plug, Plus, Trash2 } from '@lucide/vue';
|
||||||
|
import type { GitAuthType, GitService } from '@arboretum/shared';
|
||||||
|
import { useGitConnectionsStore } from '../../stores/git-connections';
|
||||||
|
import { useToastsStore } from '../../stores/toasts';
|
||||||
|
import BaseButton from '../ui/BaseButton.vue';
|
||||||
|
import BaseBadge from '../ui/BaseBadge.vue';
|
||||||
|
|
||||||
|
const { t } = useI18n();
|
||||||
|
const store = useGitConnectionsStore();
|
||||||
|
const toasts = useToastsStore();
|
||||||
|
|
||||||
|
const adding = ref(false);
|
||||||
|
const creating = ref(false);
|
||||||
|
const error = ref<string | null>(null);
|
||||||
|
const testingId = ref<string | null>(null);
|
||||||
|
const confirmId = ref<string | null>(null);
|
||||||
|
const form = reactive({ service: 'gitea' as GitService, authType: 'pat' as GitAuthType, label: '', baseUrl: '', username: '', secret: '' });
|
||||||
|
|
||||||
|
const canCreate = computed(
|
||||||
|
() => form.label.trim() !== '' && form.secret !== '' && (form.service !== 'gitea' || form.baseUrl.trim() !== ''),
|
||||||
|
);
|
||||||
|
|
||||||
|
onMounted(() => void store.fetchAll());
|
||||||
|
|
||||||
|
function openForm(): void {
|
||||||
|
Object.assign(form, { service: 'gitea', authType: 'pat', label: '', baseUrl: '', username: '', secret: '' });
|
||||||
|
error.value = null;
|
||||||
|
adding.value = true;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function onCreate(): Promise<void> {
|
||||||
|
creating.value = true;
|
||||||
|
error.value = null;
|
||||||
|
try {
|
||||||
|
await store.create({
|
||||||
|
label: form.label.trim(),
|
||||||
|
service: form.service,
|
||||||
|
authType: form.authType,
|
||||||
|
...(form.baseUrl.trim() ? { baseUrl: form.baseUrl.trim() } : {}),
|
||||||
|
...(form.username.trim() ? { username: form.username.trim() } : {}),
|
||||||
|
secret: form.secret,
|
||||||
|
});
|
||||||
|
adding.value = false;
|
||||||
|
toasts.success(t('gitconn.added'));
|
||||||
|
} catch (e) {
|
||||||
|
error.value = e instanceof Error ? e.message : String(e);
|
||||||
|
} finally {
|
||||||
|
creating.value = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async function onTest(id: string): Promise<void> {
|
||||||
|
testingId.value = id;
|
||||||
|
try {
|
||||||
|
const res = await store.test(id);
|
||||||
|
if (res.ok) toasts.success(t('gitconn.testOk', { user: res.user ?? '' }));
|
||||||
|
else toasts.error(t('gitconn.testFailed', { error: res.error ?? '' }));
|
||||||
|
} catch (e) {
|
||||||
|
toasts.error(e);
|
||||||
|
} finally {
|
||||||
|
testingId.value = null;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async function onDelete(id: string): Promise<void> {
|
||||||
|
confirmId.value = null;
|
||||||
|
try {
|
||||||
|
await store.remove(id);
|
||||||
|
toasts.success(t('gitconn.deleted'));
|
||||||
|
} catch (e) {
|
||||||
|
toasts.error(e);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
</script>
|
||||||
@@ -11,6 +11,8 @@ export default {
|
|||||||
settings: 'Settings',
|
settings: 'Settings',
|
||||||
close: 'Close',
|
close: 'Close',
|
||||||
retry: 'Retry',
|
retry: 'Retry',
|
||||||
|
confirm: 'Confirm',
|
||||||
|
delete: 'Delete',
|
||||||
},
|
},
|
||||||
login: {
|
login: {
|
||||||
title: 'Sign in with your access token',
|
title: 'Sign in with your access token',
|
||||||
@@ -254,6 +256,50 @@ export default {
|
|||||||
pullRebase: 'Pull --rebase',
|
pullRebase: 'Pull --rebase',
|
||||||
alreadyPushed: 'Cannot amend: this commit was already pushed.',
|
alreadyPushed: 'Cannot amend: this commit was already pushed.',
|
||||||
},
|
},
|
||||||
|
gitconn: {
|
||||||
|
title: 'Git connections',
|
||||||
|
hint: 'Connect to Gitea, GitLab or GitHub to clone private repositories. Tokens are encrypted at rest and never shown again.',
|
||||||
|
empty: 'No connection yet.',
|
||||||
|
addConnection: 'Add a connection',
|
||||||
|
add: 'Add',
|
||||||
|
service: 'Service',
|
||||||
|
authType: 'Authentication',
|
||||||
|
pat: 'Personal access token',
|
||||||
|
appPassword: 'App password',
|
||||||
|
label: 'Label',
|
||||||
|
labelPlaceholder: 'e.g. My Gitea',
|
||||||
|
baseUrl: 'Instance URL',
|
||||||
|
username: 'Username',
|
||||||
|
usernamePlaceholder: 'optional',
|
||||||
|
token: 'Token',
|
||||||
|
password: 'Password',
|
||||||
|
test: 'Test',
|
||||||
|
added: 'Connection added',
|
||||||
|
deleted: 'Connection deleted',
|
||||||
|
testOk: 'Connected as {user}',
|
||||||
|
testFailed: 'Connection failed: {error}',
|
||||||
|
},
|
||||||
|
clone: {
|
||||||
|
button: 'Clone',
|
||||||
|
title: 'Clone a repository',
|
||||||
|
noCredential: 'No git connection configured.',
|
||||||
|
goSettings: 'Add one in Settings',
|
||||||
|
credential: 'Connection',
|
||||||
|
search: 'Search',
|
||||||
|
searchPlaceholder: 'Filter repositories…',
|
||||||
|
private: 'private',
|
||||||
|
noRepos: 'No repository found.',
|
||||||
|
more: 'Load more',
|
||||||
|
dest: 'Destination folder',
|
||||||
|
destPlaceholder: '/path/to/clone',
|
||||||
|
destHint: 'Must be inside a configured scan folder; the folder is created by the clone.',
|
||||||
|
clone: 'Clone',
|
||||||
|
starting: 'Starting…',
|
||||||
|
cloning: 'Cloning…',
|
||||||
|
done: 'Clone complete',
|
||||||
|
failed: 'Clone failed',
|
||||||
|
back: 'Back',
|
||||||
|
},
|
||||||
terminal: {
|
terminal: {
|
||||||
observer: 'observer (read-only)',
|
observer: 'observer (read-only)',
|
||||||
sessionEnded: 'Session ended',
|
sessionEnded: 'Session ended',
|
||||||
|
|||||||
@@ -13,6 +13,8 @@ const fr: typeof en = {
|
|||||||
settings: 'Réglages',
|
settings: 'Réglages',
|
||||||
close: 'Fermer',
|
close: 'Fermer',
|
||||||
retry: 'Réessayer',
|
retry: 'Réessayer',
|
||||||
|
confirm: 'Confirmer',
|
||||||
|
delete: 'Supprimer',
|
||||||
},
|
},
|
||||||
login: {
|
login: {
|
||||||
title: 'Connectez-vous avec votre jeton d’accès',
|
title: 'Connectez-vous avec votre jeton d’accès',
|
||||||
@@ -256,6 +258,50 @@ const fr: typeof en = {
|
|||||||
pullRebase: 'Pull --rebase',
|
pullRebase: 'Pull --rebase',
|
||||||
alreadyPushed: 'Amend impossible : ce commit a déjà été poussé.',
|
alreadyPushed: 'Amend impossible : ce commit a déjà été poussé.',
|
||||||
},
|
},
|
||||||
|
gitconn: {
|
||||||
|
title: 'Connexions git',
|
||||||
|
hint: 'Connectez Gitea, GitLab ou GitHub pour cloner des dépôts privés. Les tokens sont chiffrés au repos et jamais ré-affichés.',
|
||||||
|
empty: 'Aucune connexion pour l’instant.',
|
||||||
|
addConnection: 'Ajouter une connexion',
|
||||||
|
add: 'Ajouter',
|
||||||
|
service: 'Service',
|
||||||
|
authType: 'Authentification',
|
||||||
|
pat: 'Jeton d’accès personnel',
|
||||||
|
appPassword: 'Mot de passe d’application',
|
||||||
|
label: 'Libellé',
|
||||||
|
labelPlaceholder: 'ex. Mon Gitea',
|
||||||
|
baseUrl: 'URL de l’instance',
|
||||||
|
username: 'Identifiant',
|
||||||
|
usernamePlaceholder: 'optionnel',
|
||||||
|
token: 'Jeton',
|
||||||
|
password: 'Mot de passe',
|
||||||
|
test: 'Tester',
|
||||||
|
added: 'Connexion ajoutée',
|
||||||
|
deleted: 'Connexion supprimée',
|
||||||
|
testOk: 'Connecté en tant que {user}',
|
||||||
|
testFailed: 'Échec de connexion : {error}',
|
||||||
|
},
|
||||||
|
clone: {
|
||||||
|
button: 'Cloner',
|
||||||
|
title: 'Cloner un dépôt',
|
||||||
|
noCredential: 'Aucune connexion git configurée.',
|
||||||
|
goSettings: 'En ajouter dans les Réglages',
|
||||||
|
credential: 'Connexion',
|
||||||
|
search: 'Rechercher',
|
||||||
|
searchPlaceholder: 'Filtrer les dépôts…',
|
||||||
|
private: 'privé',
|
||||||
|
noRepos: 'Aucun dépôt trouvé.',
|
||||||
|
more: 'Charger plus',
|
||||||
|
dest: 'Dossier de destination',
|
||||||
|
destPlaceholder: '/chemin/du/clone',
|
||||||
|
destHint: 'Doit être sous un dossier de scan configuré ; le dossier est créé par le clone.',
|
||||||
|
clone: 'Cloner',
|
||||||
|
starting: 'Démarrage…',
|
||||||
|
cloning: 'Clonage…',
|
||||||
|
done: 'Clone terminé',
|
||||||
|
failed: 'Échec du clone',
|
||||||
|
back: 'Retour',
|
||||||
|
},
|
||||||
terminal: {
|
terminal: {
|
||||||
observer: 'observateur (lecture seule)',
|
observer: 'observateur (lecture seule)',
|
||||||
sessionEnded: 'Session terminée',
|
sessionEnded: 'Session terminée',
|
||||||
|
|||||||
@@ -31,6 +31,8 @@ export type WorktreeEvent = Extract<ServerMessage, { type: 'repo_update' | 'repo
|
|||||||
export type GroupEvent = Extract<ServerMessage, { type: 'group_update' | 'group_removed' }>;
|
export type GroupEvent = Extract<ServerMessage, { type: 'group_update' | 'group_removed' }>;
|
||||||
/** P11 — un réglage a changé (diffusé au topic 'settings'). */
|
/** P11 — un réglage a changé (diffusé au topic 'settings'). */
|
||||||
export type SettingsUpdateEvent = Extract<ServerMessage, { type: 'settings_update' }>;
|
export type SettingsUpdateEvent = Extract<ServerMessage, { type: 'settings_update' }>;
|
||||||
|
/** P12 — progression/fin d'un clone (diffusée au topic 'clones'). */
|
||||||
|
export type CloneEvent = Extract<ServerMessage, { type: 'clone_update' }>;
|
||||||
/** P7 — signal ciblé « le détail (changes/diff) d'un worktree regardé a changé ». */
|
/** P7 — signal ciblé « le détail (changes/diff) d'un worktree regardé a changé ». */
|
||||||
export type WorktreeChangesEvent = Extract<ServerMessage, { type: 'worktree_changes' }>;
|
export type WorktreeChangesEvent = Extract<ServerMessage, { type: 'worktree_changes' }>;
|
||||||
|
|
||||||
@@ -130,6 +132,7 @@ export class WsClient {
|
|||||||
private readonly worktreeListeners = new Set<(e: WorktreeEvent) => void>();
|
private readonly worktreeListeners = new Set<(e: WorktreeEvent) => void>();
|
||||||
private readonly groupListeners = new Set<(e: GroupEvent) => void>();
|
private readonly groupListeners = new Set<(e: GroupEvent) => void>();
|
||||||
private readonly settingsListeners = new Set<(e: SettingsUpdateEvent) => void>();
|
private readonly settingsListeners = new Set<(e: SettingsUpdateEvent) => void>();
|
||||||
|
private readonly cloneListeners = new Set<(e: CloneEvent) => void>();
|
||||||
/** P7 — abonnements ciblés au détail d'un worktree (clé repoId\0path → listeners). */
|
/** P7 — abonnements ciblés au détail d'un worktree (clé repoId\0path → listeners). */
|
||||||
private readonly worktreeChangesListeners = new Map<string, Set<(e: WorktreeChangesEvent) => void>>();
|
private readonly worktreeChangesListeners = new Map<string, Set<(e: WorktreeChangesEvent) => void>>();
|
||||||
|
|
||||||
@@ -180,12 +183,13 @@ export class WsClient {
|
|||||||
}
|
}
|
||||||
|
|
||||||
/** topics actifs = union des abonnements courants (une seule connexion partagée). */
|
/** topics actifs = union des abonnements courants (une seule connexion partagée). */
|
||||||
private activeTopics(): Array<'sessions' | 'worktrees' | 'groups' | 'settings'> {
|
private activeTopics(): Array<'sessions' | 'worktrees' | 'groups' | 'settings' | 'clones'> {
|
||||||
const t: Array<'sessions' | 'worktrees' | 'groups' | 'settings'> = [];
|
const t: Array<'sessions' | 'worktrees' | 'groups' | 'settings' | 'clones'> = [];
|
||||||
if (this.sessionListeners.size > 0) t.push('sessions');
|
if (this.sessionListeners.size > 0) t.push('sessions');
|
||||||
if (this.worktreeListeners.size > 0) t.push('worktrees');
|
if (this.worktreeListeners.size > 0) t.push('worktrees');
|
||||||
if (this.groupListeners.size > 0) t.push('groups');
|
if (this.groupListeners.size > 0) t.push('groups');
|
||||||
if (this.settingsListeners.size > 0) t.push('settings');
|
if (this.settingsListeners.size > 0) t.push('settings');
|
||||||
|
if (this.cloneListeners.size > 0) t.push('clones');
|
||||||
return t;
|
return t;
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -233,6 +237,16 @@ export class WsClient {
|
|||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
|
subscribeClones(listener: (e: CloneEvent) => void): () => void {
|
||||||
|
this.cloneListeners.add(listener);
|
||||||
|
this.connect();
|
||||||
|
this.sendSub();
|
||||||
|
return () => {
|
||||||
|
this.cloneListeners.delete(listener);
|
||||||
|
this.sendSub();
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* P7 — observe le détail (changes/diff) d'un worktree précis : envoie `watch`, route les
|
* P7 — observe le détail (changes/diff) d'un worktree précis : envoie `watch`, route les
|
||||||
* `worktree_changes` correspondants vers `listener`, et ré-arme automatiquement après reconnexion.
|
* `worktree_changes` correspondants vers `listener`, et ré-arme automatiquement après reconnexion.
|
||||||
@@ -505,6 +519,10 @@ export class WsClient {
|
|||||||
for (const cb of this.settingsListeners) cb(msg);
|
for (const cb of this.settingsListeners) cb(msg);
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
case 'clone_update': {
|
||||||
|
for (const cb of this.cloneListeners) cb(msg);
|
||||||
|
return;
|
||||||
|
}
|
||||||
case 'worktree_changes': {
|
case 'worktree_changes': {
|
||||||
const set = this.worktreeChangesListeners.get(`${msg.repoId}\0${msg.path}`);
|
const set = this.worktreeChangesListeners.get(`${msg.repoId}\0${msg.path}`);
|
||||||
if (set) for (const cb of set) cb(msg);
|
if (set) for (const cb of set) cb(msg);
|
||||||
|
|||||||
40
packages/web/src/stores/clone.ts
Normal file
40
packages/web/src/stores/clone.ts
Normal file
@@ -0,0 +1,40 @@
|
|||||||
|
import { defineStore } from 'pinia';
|
||||||
|
import { ref } from 'vue';
|
||||||
|
import type { CloneOperation, CloneRequest, CloneStartResponse } from '@arboretum/shared';
|
||||||
|
import { api } from '../lib/api';
|
||||||
|
import { wsClient, type CloneEvent } from '../lib/ws-client';
|
||||||
|
|
||||||
|
// Suivi des opérations de clone (P12). État en mémoire alimenté par le push WS (topic 'clones') ;
|
||||||
|
// chaque opération survit au refresh côté serveur (GET /repos/clone/:id), non rechargé ici.
|
||||||
|
export const useCloneStore = defineStore('clone', () => {
|
||||||
|
const operations = ref<CloneOperation[]>([]);
|
||||||
|
let unsubscribe: (() => void) | null = null;
|
||||||
|
|
||||||
|
function upsert(op: CloneOperation): void {
|
||||||
|
const i = operations.value.findIndex((o) => o.id === op.id);
|
||||||
|
if (i >= 0) operations.value.splice(i, 1, op);
|
||||||
|
else operations.value.push(op);
|
||||||
|
}
|
||||||
|
|
||||||
|
function get(id: string): CloneOperation | undefined {
|
||||||
|
return operations.value.find((o) => o.id === id);
|
||||||
|
}
|
||||||
|
|
||||||
|
function startRealtime(): void {
|
||||||
|
unsubscribe ??= wsClient.subscribeClones((e: CloneEvent) => upsert(e.operation));
|
||||||
|
}
|
||||||
|
function stopRealtime(): void {
|
||||||
|
unsubscribe?.();
|
||||||
|
unsubscribe = null;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Lance un clone ; la progression arrive ensuite par WS. Retourne l'operationId à suivre.
|
||||||
|
async function clone(req: CloneRequest): Promise<string> {
|
||||||
|
startRealtime(); // s'abonner AVANT de lancer pour ne manquer aucun event
|
||||||
|
const res = await api.post<CloneStartResponse>('/api/v1/repos/clone', req);
|
||||||
|
upsert({ id: res.operationId, state: 'pending', progress: null, phase: null, error: null, repoId: null, dest: req.dest });
|
||||||
|
return res.operationId;
|
||||||
|
}
|
||||||
|
|
||||||
|
return { operations, get, clone, startRealtime, stopRealtime };
|
||||||
|
});
|
||||||
65
packages/web/src/stores/git-connections.ts
Normal file
65
packages/web/src/stores/git-connections.ts
Normal file
@@ -0,0 +1,65 @@
|
|||||||
|
import { defineStore } from 'pinia';
|
||||||
|
import { ref } from 'vue';
|
||||||
|
import type {
|
||||||
|
CreateGitCredentialRequest,
|
||||||
|
GitCredentialResponse,
|
||||||
|
GitCredentialSummary,
|
||||||
|
GitCredentialsListResponse,
|
||||||
|
RemoteReposResponse,
|
||||||
|
TestCredentialResponse,
|
||||||
|
UpdateGitCredentialRequest,
|
||||||
|
} from '@arboretum/shared';
|
||||||
|
import { api } from '../lib/api';
|
||||||
|
|
||||||
|
// Connexions aux services git distants (P12). Les secrets ne transitent jamais en lecture
|
||||||
|
// (résumés hasSecret/secretLast4 seulement) ; la création/maj envoie le secret en écriture.
|
||||||
|
export const useGitConnectionsStore = defineStore('gitConnections', () => {
|
||||||
|
const connections = ref<GitCredentialSummary[]>([]);
|
||||||
|
const loading = ref(false);
|
||||||
|
|
||||||
|
function upsert(c: GitCredentialSummary): void {
|
||||||
|
const i = connections.value.findIndex((x) => x.id === c.id);
|
||||||
|
if (i >= 0) connections.value.splice(i, 1, c);
|
||||||
|
else connections.value.push(c);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function fetchAll(): Promise<void> {
|
||||||
|
loading.value = true;
|
||||||
|
try {
|
||||||
|
connections.value = (await api.get<GitCredentialsListResponse>('/api/v1/git-connections')).credentials;
|
||||||
|
} finally {
|
||||||
|
loading.value = false;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
async function create(req: CreateGitCredentialRequest): Promise<GitCredentialSummary> {
|
||||||
|
const res = await api.post<GitCredentialResponse>('/api/v1/git-connections', req);
|
||||||
|
upsert(res.credential);
|
||||||
|
return res.credential;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function update(id: string, patch: UpdateGitCredentialRequest): Promise<GitCredentialSummary> {
|
||||||
|
const res = await api.patch<GitCredentialResponse>(`/api/v1/git-connections/${id}`, patch);
|
||||||
|
upsert(res.credential);
|
||||||
|
return res.credential;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function remove(id: string): Promise<void> {
|
||||||
|
await api.delete<{ ok: true }>(`/api/v1/git-connections/${id}`);
|
||||||
|
connections.value = connections.value.filter((c) => c.id !== id);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function test(id: string): Promise<TestCredentialResponse> {
|
||||||
|
const res = await api.post<TestCredentialResponse>(`/api/v1/git-connections/${id}/test`);
|
||||||
|
await fetchAll(); // rafraîchit lastTestedAt/testResult
|
||||||
|
return res;
|
||||||
|
}
|
||||||
|
|
||||||
|
function listRemoteRepos(id: string, page = 1, search?: string): Promise<RemoteReposResponse> {
|
||||||
|
const qs = new URLSearchParams({ page: String(page) });
|
||||||
|
if (search) qs.set('search', search);
|
||||||
|
return api.get<RemoteReposResponse>(`/api/v1/git-connections/${id}/repos?${qs.toString()}`);
|
||||||
|
}
|
||||||
|
|
||||||
|
return { connections, loading, fetchAll, create, update, remove, test, listRemoteRepos };
|
||||||
|
});
|
||||||
@@ -1,5 +1,8 @@
|
|||||||
<template>
|
<template>
|
||||||
<PageHeader :title="t('nav.worktrees')">
|
<PageHeader :title="t('nav.worktrees')">
|
||||||
|
<BaseButton variant="ghost" size="sm" :icon="CloudDownload" @click="showClone = true">
|
||||||
|
{{ t('clone.button') }}
|
||||||
|
</BaseButton>
|
||||||
<BaseButton variant="ghost" size="sm" :icon="ScanSearch" :loading="scanning" @click="onDiscover">
|
<BaseButton variant="ghost" size="sm" :icon="ScanSearch" :loading="scanning" @click="onDiscover">
|
||||||
{{ t('repos.scan') }}
|
{{ t('repos.scan') }}
|
||||||
</BaseButton>
|
</BaseButton>
|
||||||
@@ -7,6 +10,7 @@
|
|||||||
{{ t('common.refresh') }}
|
{{ t('common.refresh') }}
|
||||||
</BaseButton>
|
</BaseButton>
|
||||||
</PageHeader>
|
</PageHeader>
|
||||||
|
<CloneRepoModal v-if="showClone" @close="showClone = false" />
|
||||||
|
|
||||||
<AttentionSection />
|
<AttentionSection />
|
||||||
|
|
||||||
@@ -60,7 +64,7 @@
|
|||||||
<script setup lang="ts">
|
<script setup lang="ts">
|
||||||
import { computed, ref, watch } from 'vue';
|
import { computed, ref, watch } from 'vue';
|
||||||
import { useI18n } from 'vue-i18n';
|
import { useI18n } from 'vue-i18n';
|
||||||
import { GitBranch, RefreshCw, FolderOpen, Plus, Search, ScanSearch } from '@lucide/vue';
|
import { GitBranch, RefreshCw, FolderOpen, Plus, Search, ScanSearch, CloudDownload } from '@lucide/vue';
|
||||||
import { useWorktreesStore } from '../stores/worktrees';
|
import { useWorktreesStore } from '../stores/worktrees';
|
||||||
import { useToastsStore } from '../stores/toasts';
|
import { useToastsStore } from '../stores/toasts';
|
||||||
import { useWorktreeView } from '../composables/useWorktreeView';
|
import { useWorktreeView } from '../composables/useWorktreeView';
|
||||||
@@ -73,6 +77,7 @@ import Pagination from '../components/Pagination.vue';
|
|||||||
import AttentionSection from '../components/AttentionSection.vue';
|
import AttentionSection from '../components/AttentionSection.vue';
|
||||||
import RepoSection from '../components/RepoSection.vue';
|
import RepoSection from '../components/RepoSection.vue';
|
||||||
import DirectoryPicker from '../components/DirectoryPicker.vue';
|
import DirectoryPicker from '../components/DirectoryPicker.vue';
|
||||||
|
import CloneRepoModal from '../components/CloneRepoModal.vue';
|
||||||
|
|
||||||
const { t } = useI18n();
|
const { t } = useI18n();
|
||||||
const store = useWorktreesStore();
|
const store = useWorktreesStore();
|
||||||
@@ -81,6 +86,7 @@ const view = useWorktreeView();
|
|||||||
|
|
||||||
const newPath = ref('');
|
const newPath = ref('');
|
||||||
const showPicker = ref(false);
|
const showPicker = ref(false);
|
||||||
|
const showClone = ref(false);
|
||||||
const adding = ref(false);
|
const adding = ref(false);
|
||||||
const scanning = ref(false);
|
const scanning = ref(false);
|
||||||
const showHidden = ref(false);
|
const showHidden = ref(false);
|
||||||
|
|||||||
@@ -195,6 +195,9 @@
|
|||||||
</div>
|
</div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<!-- Connexions aux services git (P12) -->
|
||||||
|
<GitConnectionsSection />
|
||||||
|
|
||||||
<!-- Sécurité & conformité -->
|
<!-- Sécurité & conformité -->
|
||||||
<section class="card flex flex-col gap-3">
|
<section class="card flex flex-col gap-3">
|
||||||
<h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
|
<h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
|
||||||
@@ -280,6 +283,7 @@ import LanguageSwitcher from '../components/LanguageSwitcher.vue';
|
|||||||
import BaseButton from '../components/ui/BaseButton.vue';
|
import BaseButton from '../components/ui/BaseButton.vue';
|
||||||
import SkeletonRow from '../components/ui/SkeletonRow.vue';
|
import SkeletonRow from '../components/ui/SkeletonRow.vue';
|
||||||
import ServerRow from '../components/settings/ServerRow.vue';
|
import ServerRow from '../components/settings/ServerRow.vue';
|
||||||
|
import GitConnectionsSection from '../components/settings/GitConnectionsSection.vue';
|
||||||
import DirectoryPicker from '../components/DirectoryPicker.vue';
|
import DirectoryPicker from '../components/DirectoryPicker.vue';
|
||||||
|
|
||||||
const { t, locale } = useI18n();
|
const { t, locale } = useI18n();
|
||||||
|
|||||||
Reference in New Issue
Block a user