gitfor/platform

import { basicAuthHeader, repoTokenSecret } from "./artifacts";
import { invalidateRefs } from "./refs";
import {
  limitStream,
  packStream,
  parseReportStatus,
  parseSyncableRefs,
  receivePackBody,
  uploadPackRequest,
} from "./ref-sync-protocol";
import type { AdvertisedRef, RefCommand } from "./ref-sync-protocol";
import { badRequest } from "../errors";
import { assertResolvesPublic } from "../net/resolve-guard";
import { publicUrl } from "../events/emit";
import type { RepoRow } from "~/lib/types";

const MAX_HAVES = 256;
const ADVERTISEMENT_TIMEOUT_MS = 30_000;
const UPLOAD_TIMEOUT_MS = 10 * 60_000;
const MAX_ADVERTISEMENT_BYTES = 8 * 1024 * 1024;
const MAX_REDIRECTS = 3;
const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
const AUTH_STATUSES = new Set([401, 403]);
const HTTP_NOT_FOUND = 404;
const USER_AGENT = "git/gitfor";
const IPV4_LITERAL = /^\d{1,3}(\.\d{1,3}){3}$/;
const BLOCKED_SUFFIXES = [".workers.dev", ".localhost", ".local", ".internal"];

export type ScreenResult = { body: ReadableStream<Uint8Array>; rejected: Map<string, string> };

/** Thrown by relayPack when `screen` refuses refs; nothing was sent to the target. */
export class RelayScreenRejected extends Error {
  constructor(readonly rejected: Map<string, string>) {
    super(`Refused ${rejected.size} ref(s)`);
  }
}

/** `trusted` sources are our own Artifacts remotes; anything else is a user-supplied URL. */
export type RelaySource = { url: string; authorization: string | null; trusted?: boolean };