gitfor/platform

import { env } from "cloudflare:workers";
import { z } from "zod";
import { first, run } from "./db";
import { randomToken, timingSafeEqualStrings, toBase64 } from "./crypto";
import { pendingLoginCookie, requiresSecondFactor } from "./two-factor";
import { cookieAttributes, cookieName, cookieValue, createSessionCookie } from "./auth";
import { accountNameTaken, createUser, reclaimUnverifiedEmail } from "./accounts";
import { publicUrl } from "./events/emit";
import { isReservedName } from "~/lib/reserved-names";

const STATE_TTL_SECONDS = 600;
const GITHUB_USER_AGENT = "gitfor-forge";
const MAX_NAME_SUFFIX = 1000;
const STATE_COOKIE_BASE = "gitfor_oauth";

function clearStateCookie(): string {
  return `${cookieName(STATE_COOKIE_BASE)}=; ${cookieAttributes(0)}`;
}

const tokenResponse = z.object({ access_token: z.string() });
const githubUser = z.object({
  id: z.number(),
  login: z.string(),
  name: z.string().nullable(),
});
const githubEmails = z.array(z.object({ email: z.string(), primary: z.boolean(), verified: z.boolean() }));

/** Always the canonical origin (AUTH-A11): the callback and its `__Host-` cookies must live on PUBLIC_URL. */
function callbackUrl(): string {
  return publicUrl("/auth/github/callback");
}

/** Auth routes reached on an alias host (e.g. `*.workers.dev`) bounce to PUBLIC_URL so cookies and redirect_uri agree. */
function canonicalRedirect(request: Request): Response | null {
  const requested = new URL(request.url);
  const canonical = new URL(env.PUBLIC_URL);
  if (requested.host === canonical.host) return null;
  return Response.redirect(publicUrl(`${requested.pathname}${requested.search}`), 302);
}