| 1 | /** @jsxImportSource hono/jsx */ |
| 2 | import { Hono } from "hono"; |
| 3 | import type { Env } from "../env.js"; |
| 4 | import type { AppVars } from "../auth/principal.js"; |
| 5 | import { registerAccount } from "./account.js"; |
| 6 | import { registerAccountLifecycle } from "./account-lifecycle.js"; |
| 7 | import { registerTasks } from "../agentic/tasks-web.js"; |
| 8 | import { registerOrgAgents } from "../agentic/org-web.js"; |
| 9 | import { registerReviews } from "../agentic/review-web.js"; |
| 10 | import { registerProject } from "../agentic/project-web.js"; |
| 11 | import { registerTerminals } from "../agentic/terminal-web.js"; |
| 12 | import { registerMailWeb } from "../mail/web.js"; |
| 13 | import { registerSecurityReports } from "./security-reports.js"; |
| 14 | import { registerStatus } from "./status.js"; |
| 15 | import { registerAuth } from "./auth.js"; |
| 16 | import { registerCliLogin } from "./cli-login.js"; |
| 17 | import { registerOAuth } from "./oauth.js"; |
| 18 | import { registerActions } from "./actions.js"; |
| 19 | import { registerCode } from "./code.js"; |
| 20 | import { registerCollab } from "./collab.js"; |
| 21 | import { registerReleases } from "./releases.js"; |
| 22 | import { registerRepoSettings } from "./repo-settings.js"; |
| 23 | import { registerImports } from "./imports.js"; |
| 24 | import { registerSeo } from "./seo.js"; |
| 25 | import { errorPage } from "./ui.js"; |
| 26 | import { RESERVED_LOGINS } from "../lib/util.js"; |
| 27 | import { registerKumoAssets } from "./kumo.js"; |
| 28 | import { registerPackages } from "./packages.js"; |
| 29 | import { registerDocs } from "../docs/web.js"; |
| 30 | import { registerModeration } from "./moderation.js"; |
| 31 | |
| 32 | /** |
| 33 | * Server-rendered web UI. Mount at "/" after the API, Git and runner routes: |
| 34 | * it owns `/`, `/docs/*`, `/llms.txt`, `/login`, `/auth/*`, `/signin/*`, `/new`, `/settings/*`, `/notifications/*`, `/invite/*`, `/-/*`, |
| 35 | * `/:owner` and `/:owner/:repo/...` (including `/:owner/:repo/raw/*`). |
| 36 | * |
| 37 | * Expects the `principal` and `dir` variables to be set by an earlier middleware. |
| 38 | * Every POST is CSRF-checked (double-submit cookie, see ./csrf.ts). |
| 39 | */ |
| 40 | export const web = new Hono<{ Bindings: Env; Variables: AppVars }>(); |
| 41 | |
| 42 | web.onError((err, c) => errorPage(c, err)); |
| 43 | |
| 44 | /** |
| 45 | * A limited API token (read or write scope, or limited to some repositories) reaches the web only |
| 46 | * for repository pages (/:owner/:repo/...), where loadRepo applies its scope and repository limits as |
| 47 | * the API does. Everywhere else (the dashboard, the command palette, notifications, profiles, |
| 48 | * settings, site administration) it would see what the API refuses it, so those pages treat it as |
| 49 | * signed out. An unlimited admin token can already read all of that through the API. |
| 50 | */ |
| 51 | export function tokenMayUseWebPage(path: string): boolean { |
| 52 | const segs = path.split("/").filter(Boolean); |
| 53 | return segs.length >= 2 && !RESERVED_LOGINS.has(segs[0]!.toLowerCase()) && segs[1] !== "-"; |
| 54 | } |
| 55 | |
| 56 | web.use("*", async (c, next) => { |
| 57 | const p = c.get("principal"); |
| 58 | const limited = p.type === "account" && p.via === "token" && (!!p.repoIds || !p.scopes.includes("admin")); |
| 59 | if (limited && !tokenMayUseWebPage(c.req.path)) c.set("principal", { type: "anonymous" }); |
| 60 | await next(); |
| 61 | }); |
| 62 | |
| 63 | // Browsers and crawlers ask for these on every origin; keep them off the /:owner route. |
| 64 | registerSeo(web); |
| 65 | // Public docs (/docs, /llms.txt, ...): before /:owner/:repo, which would otherwise match /docs/<page>. |
| 66 | registerDocs(web); |
| 67 | |
| 68 | // Order matters: fixed paths (/settings/tokens, /notifications/:id, …) must be |
| 69 | // registered before the /:owner/:repo patterns they would otherwise match. |
| 70 | registerKumoAssets(web); |
| 71 | registerAuth(web); |
| 72 | registerCliLogin(web); |
| 73 | registerOAuth(web); |
| 74 | registerPackages(web); |
| 75 | registerMailWeb(web); |
| 76 | registerSecurityReports(web); |
| 77 | // /status: before the /:owner catch-all. |
| 78 | registerStatus(web); |
| 79 | // Before registerAccount: its /:owner catch-all would otherwise swallow /imports, /new/import and /settings/linked-accounts. |
| 80 | registerImports(web); |
| 81 | // Settings → Model access and /:owner/:repo/tasks: before the /:owner and /:owner/:repo catch-alls. |
| 82 | registerTasks(web); |
| 83 | registerOrgAgents(web); |
| 84 | registerReviews(web); |
| 85 | registerProject(web); |
| 86 | registerTerminals(web); |
| 87 | // Settings → Account and the account pages of site administration: fixed /settings paths, before /:owner. |
| 88 | registerAccountLifecycle(web); |
| 89 | // /-/report and /:owner/:repo/comments/:id/...: before the /:owner and /:owner/:repo catch-alls. |
| 90 | registerModeration(web); |
| 91 | registerAccount(web); |
| 92 | registerRepoSettings(web); |
| 93 | registerActions(web); |
| 94 | registerReleases(web); |
| 95 | registerCollab(web); |
| 96 | registerCode(web); |