Line
Version next
Search GitHub

You are reading the unreleased docs (next). See latest (v0.9)

ui/server/src/cloneAuth

slice B -- the one-time access token for cloning a PRIVATE repository.

Cockpit server, next. Source: ui/server/src/cloneAuth.mjs.

Variables#

ASKPASS_SCRIPT#

const ASKPASS_SCRIPT: "#!/bin/sh\n# Construct clone helper. Holds no secret: the password is read once from file descriptor 3, a pipe from the server.\ncase "$1" in\n Username*|username*) printf '%s\n' 'x-access-token' ;;\n *) t=; IFS= read -r t <&3 || t=; printf '%s\n' "$t"; t= ;;\nesac\n"

Defined in: ui/server/src/cloneAuth.mjs:79

AUTH_MESSAGE#

const AUTH_MESSAGE: "Private or misspelled — paste a token with read access." = 'Private or misspelled — paste a token with read access.'

Defined in: ui/server/src/cloneAuth.mjs:72

AUTH_MESSAGE_WITH_TOKEN#

const AUTH_MESSAGE_WITH_TOKEN: "Private or misspelled — the token you pasted was not accepted for this repository. Paste a token with read access to it." = 'Private or misspelled — the token you pasted was not accepted for this repository. Paste a token with read access to it.'

Defined in: ui/server/src/cloneAuth.mjs:76

MAX_TOKEN_LENGTH#

const MAX_TOKEN_LENGTH: 255 = 255

Defined in: ui/server/src/cloneAuth.mjs:23

NOT_VISIBLE_CODE#

const NOT_VISIBLE_CODE: "NOT_VISIBLE_TO_CONNECTION" = 'NOT_VISIBLE_TO_CONNECTION'

Defined in: ui/server/src/cloneAuth.mjs:74

: a clone or pull made with the person's GitHub login that GitHub answered as "not found / not allowed".

NOT_VISIBLE_MESSAGE#

const NOT_VISIBLE_MESSAGE: "Your GitHub connection cannot see this repository. Either the address is misspelled, or the Cockpit's GitHub app is not installed on it: install the app on this repository, and for an organisation's repository ask an organisation owner to install or approve it. If you revoked the connection on GitHub, Disconnect and connect again. You can also paste an access token instead." = 'Your GitHub connection cannot see this repository. Either the address is misspelled, or the Cockpit's GitHub app is not installed on it: install the app on this repository, and for an organisation's repository ask an organisation owner to install or approve it. If you revoked the connection on GitHub, Disconnect and connect again. You can also paste an access token instead.'

Defined in: ui/server/src/cloneAuth.mjs:75

TOKEN_USERNAME#

const TOKEN_USERNAME: "x-access-token" = 'x-access-token'

Defined in: ui/server/src/cloneAuth.mjs:25

The fixed user name paired with a token. GitHub accepts any non-empty name with a token as the password.

Functions#

createAskpass()#

createAskpass(__namedParameters?): object

Defined in: ui/server/src/cloneAuth.mjs:92

Create the per-job askpass helper in a private directory. -> {path, dir, cleanup()} base is where the private directory is made (default $CONSTRUCT_ASKPASS_DIR, else the OS temp dir: set it when /tmp is mounted noexec); the directory is 0700 and named with this process's pid so the machine's temp-dir pruning knows whose it is.

Parameters#

__namedParameters?
base?

any = ...

Returns#

object

dir

dir: any

path

path: any = file

cleanup()

cleanup(): void

Returns

void

feedToken()#

feedToken(child, tokenBuf): boolean

Defined in: ui/server/src/cloneAuth.mjs:116

Hand the token to a spawned git through its descriptor 3, then zero the Buffer it was given (pass a COPY: the caller keeps its own for redacting output until the job ends). The spawn must have been called with stdio ['ignore', 'ignore', 'pipe', 'pipe']. -> true when written.

Parameters#

child

any

tokenBuf

any

Returns#

boolean

looksLikeAuthFailure()#

looksLikeAuthFailure(text): boolean

Defined in: ui/server/src/cloneAuth.mjs:68

Does git's own wording say "you need to sign in / no such repository as far as you can see"?

Parameters#

text

any

Returns#

boolean

makeRedactor()#

makeRedactor(tokenBuf): (text) => string

Defined in: ui/server/src/cloneAuth.mjs:54

Build a function that removes a token (when given) and anything token-shaped from a line of text.

Parameters#

tokenBuf

any

Returns#

(text) => string

parseToken()#

parseToken(input): any

Defined in: ui/server/src/cloneAuth.mjs:28

Validate the client's token. -> Buffer (the caller owns it and must zero it), or null when none was sent.

Parameters#

input

any

Returns#

any

scrubGitConfig()#

scrubGitConfig(text, tokenBuf): object

Defined in: ui/server/src/cloneAuth.mjs:129

Rewrite a .git/config text so no remote URL carries credentials; report whether the token is still in it.

Parameters#

text

any

tokenBuf

any

Returns#

object

changed

changed: boolean

stillHasToken

stillHasToken: any

text

text: any = cleaned

wipe()#

wipe(buf): void

Defined in: ui/server/src/cloneAuth.mjs:38

Overwrite a token Buffer. Safe on null.

Parameters#

buf

any

Returns#

void