ui/server/src/cloneAuth

slice B -- the one-time access token for cloning a PRIVATE repository.

Cockpit server, v0.8. Source: ui/server/src/cloneAuth.mjs.

Variables#

ASKPASS_SCRIPT#

const ASKPASS_SCRIPT: "#!/bin/sh\n# Construct clone helper. Holds no secret: the password is read once from file descriptor 3, a pipe from the server.\ncase "$1" in\n Username*|username*) printf '%s\n' 'x-access-token' ;;\n *) t=; IFS= read -r t <&3 || t=; printf '%s\n' "$t"; t= ;;\nesac\n"

Defined in: ui/server/src/cloneAuth.mjs:76

---

AUTH_MESSAGE#

const AUTH_MESSAGE: "Private or misspelled — paste a token with read access." = 'Private or misspelled — paste a token with read access.'

Defined in: ui/server/src/cloneAuth.mjs:72

---

AUTH_MESSAGE_WITH_TOKEN#

const AUTH_MESSAGE_WITH_TOKEN: "Private or misspelled — the token you pasted was not accepted for this repository. Paste a token with read access to it." = 'Private or misspelled — the token you pasted was not accepted for this repository. Paste a token with read access to it.'

Defined in: ui/server/src/cloneAuth.mjs:73

---

MAX_TOKEN_LENGTH#

const MAX_TOKEN_LENGTH: 255 = 255

Defined in: ui/server/src/cloneAuth.mjs:23

---

TOKEN_USERNAME#

const TOKEN_USERNAME: "x-access-token" = 'x-access-token'

Defined in: ui/server/src/cloneAuth.mjs:25

The fixed user name paired with a token. GitHub accepts any non-empty name with a token as the password.

Functions#

createAskpass()#

createAskpass(__namedParameters?): object

Defined in: ui/server/src/cloneAuth.mjs:89

Create the per-job askpass helper in a private directory. -> {path, dir, cleanup()} base is where the private directory is made (default $CONSTRUCT_ASKPASS_DIR, else the OS temp dir: set it when /tmp is mounted noexec); the directory is 0700 and named with this process's pid so the machine's temp-dir pruning knows whose it is.

Parameters#

__namedParameters?

base?

any = ...

Returns#

object

dir

dir: any

path

path: any = file

cleanup()

cleanup(): void

Returns

void

---

feedToken()#

feedToken(child, tokenBuf): boolean

Defined in: ui/server/src/cloneAuth.mjs:113

Hand the token to a spawned git through its descriptor 3, then zero the Buffer it was given (pass a COPY: the caller keeps its own for redacting output until the job ends). The spawn must have been called with stdio ['ignore', 'ignore', 'pipe', 'pipe']. -> true when written.

Parameters#

child

any

tokenBuf

any

Returns#

boolean

---

looksLikeAuthFailure()#

looksLikeAuthFailure(text): boolean

Defined in: ui/server/src/cloneAuth.mjs:68

Does git's own wording say "you need to sign in / no such repository as far as you can see"?

Parameters#

text

any

Returns#

boolean

---

makeRedactor()#

makeRedactor(tokenBuf): (text) => string

Defined in: ui/server/src/cloneAuth.mjs:54

Build a function that removes a token (when given) and anything token-shaped from a line of text.

Parameters#

tokenBuf

any

Returns#

(text) => string

---

parseToken()#

parseToken(input): any

Defined in: ui/server/src/cloneAuth.mjs:28

Validate the client's token. -> Buffer (the caller owns it and must zero it), or null when none was sent.

Parameters#

input

any

Returns#

any

---

scrubGitConfig()#

scrubGitConfig(text, tokenBuf): object

Defined in: ui/server/src/cloneAuth.mjs:126

Rewrite a .git/config text so no remote URL carries credentials; report whether the token is still in it.

Parameters#

text

any

tokenBuf

any

Returns#

object

changed

changed: boolean

stillHasToken

stillHasToken: any

text

text: any = cleaned

---

wipe()#

wipe(buf): void

Defined in: ui/server/src/cloneAuth.mjs:38

Overwrite a token Buffer. Safe on null.

Parameters#

buf

any

Returns#

void