/** * Web UI routes — browse repositories, code, commits, diffs. * Now auth-aware with user profiles, repo creation, stars, and syntax highlighting. */ import { Hono } from "hono"; import { html } from "hono/html"; import { eq, and, desc, inArray, sql, gte, count } from "drizzle-orm"; import { db } from "../db"; import { fireWebhooks } from "./webhooks"; import { config } from "../lib/config"; import { users, repositories, stars, commitVerifications, activityFeed, pullRequests, prComments, issues, labels, issueLabels, repoOnboardingData, } from "../db/schema"; import { Layout } from "../views/layout"; import { PendingCommentsBanner as RepoHomePendingBanner } from "../views/pending-comments-banner"; import { RepoHeader, RepoNav, Breadcrumb, FileTable, RepoCard, BranchSwitcher, HighlightedCode, PlainCode, type RecentPush, } from "../views/components"; import { DiffView } from "../views/diff-view"; import { getTree, getBlob, listCommits, getCommit, getCommitFullMessage, getDiff, getReadme, getDefaultBranch, listBranches, listTags, repoExists, initBareRepo, getBlame, getRawBlob, searchCode, getRepoPath, } from "../git/repository"; import { renderMarkdown, markdownCss } from "../lib/markdown"; import { highlightCode } from "../lib/highlight"; import { computeHealthScore } from "../lib/health-score"; import type { HealthScore } from "../lib/health-score"; import { softAuth, requireAuth } from "../middleware/auth"; import type { AuthEnv } from "../middleware/auth"; import { resolveRepoAccess, satisfiesAccess } from "../middleware/repo-access"; import { claudeSemanticSearch } from "../lib/claude-semantic-search"; import { isAiAvailable } from "../lib/ai-client"; import { trackByName } from "../lib/traffic"; import { LandingPage } from "../views/landing"; import { Landing2030Page } from "../views/landing-2030"; import { LandingProPage, type LandingProLiveFeed } from "../views/landing-pro"; import { computePublicStats, type PublicStats } from "../lib/public-stats"; import { listQueuedAiBuildIssues, listRecentAutoMerges, listRecentAiReviews, countAiReviewsSince, listDemoActivityFeed, } from "../lib/demo-activity"; import { AgentWorkspace } from "../views/agent-workspace"; import { DailyBrief } from "../views/daily-brief"; import { TrustReport } from "../views/trust-report"; import { ProductionLayers } from "../views/production-layers"; import { DistributionView } from "../views/distribution"; import { OrgMemory } from "../views/org-memory"; const web = new Hono(); // Soft auth on all web routes — c.get("user") available but may be null web.use("*", softAuth); // --------------------------------------------------------------------------- // SECURITY: repo-content access gate. // // Every route that serves repository CONTENT (file tree, blobs, raw files, // blame, commits, diffs, branches, tags, code search, repo overview) MUST call // this before touching git-on-disk. Public repos resolve to "read" for // anonymous viewers (so public browsing stays fully anonymous); private repos // require a logged-in viewer with at least read access. // // Returns a 404 Response when the repo is missing OR the viewer lacks read // access — deliberately 404 (not 403) so we never leak the existence of a // private repo. Returns `null` when access is granted; callers proceed as // normal. The owner-username → user → repositories lookup mirrors the pattern // used by `requireRepoAccess` in ../middleware/repo-access. // --------------------------------------------------------------------------- async function assertRepoReadable( c: any, owner: string, repo: string ): Promise { const user = c.get("user") ?? null; const notFound = () => c.html(

Repository not found

{owner}/{repo} does not exist.

, 404 ); // Explicit dev/test bypass: when no database is configured at all there are // no persisted repositories to protect (private repos only exist as DB rows), // and the browse routes render purely from git-on-disk. This is a positively // established condition (DATABASE_URL unset), NOT an error inference — so the // access gate below can safely fail CLOSED on any runtime error. In // production DATABASE_URL is always set, so this branch never runs there. if (!config.databaseUrl) return null; try { const [ownerRow] = await db .select({ id: users.id }) .from(users) .where(eq(users.username, owner)) .limit(1); if (!ownerRow) return notFound(); const [repoRow] = await db .select({ id: repositories.id, isPrivate: repositories.isPrivate }) .from(repositories) .where( and(eq(repositories.ownerId, ownerRow.id), eq(repositories.name, repo)) ) .limit(1); if (!repoRow) return notFound(); const access = await resolveRepoAccess({ repoId: repoRow.id, userId: user?.id ?? null, isPublic: !repoRow.isPrivate, }); // Positive denial: the repo exists and the viewer lacks read access. // Return 404 (not 403) so we never confirm a private repo's existence. if (!satisfiesAccess(access, "read")) return notFound(); return null; } catch (err) { // Fail CLOSED. A DB is configured (checked above) but the privacy-flag // lookup errored, so we cannot positively establish that this repo is // public. Denying is the only safe choice for an access-control gate — // failing open here would re-expose private repos during a DB hiccup, // which is the exact vulnerability this function exists to close. console.warn( `[web] assertRepoReadable: access check failed for ${owner}/${repo} — denying:`, err instanceof Error ? err.message : err ); return notFound(); } } // --------------------------------------------------------------------------- // Repo AI stats — computed once per repo home page load, best-effort. // Fast because every WHERE clause is bounded to a 7-day window. // --------------------------------------------------------------------------- interface RepoAiStats { mergedCount: number; reviewCount: number; securityAlertCount: number; hoursSaved: string; } async function getRepoAiStats(repoId: string): Promise { const since = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000); // 1. AI-merged PRs this week: activity_feed entries with action = // 'auto_merge.merged' in the last 7 days for this repo. // This is cheaper than a JOIN on pull_requests and covers both the // `mergedBy = botUser` pattern and the autopilot auto-merge path. const [mergedRow] = await db .select({ n: count() }) .from(activityFeed) .where( and( eq(activityFeed.repositoryId, repoId), eq(activityFeed.action, "auto_merge.merged"), gte(activityFeed.createdAt, since) ) ); const mergedCount = Number(mergedRow?.n ?? 0); // 2. AI reviews this week: pr_comments where is_ai_review = true in // the last 7 days, joined through pull_requests to scope to this repo. const [reviewRow] = await db .select({ n: count() }) .from(prComments) .innerJoin(pullRequests, eq(prComments.pullRequestId, pullRequests.id)) .where( and( eq(pullRequests.repositoryId, repoId), eq(prComments.isAiReview, true), gte(prComments.createdAt, since) ) ); const reviewCount = Number(reviewRow?.n ?? 0); // 3. Open security alerts: open issues that carry a label whose name // contains 'security' (case-insensitive) for this repo. const [secRow] = await db .select({ n: count() }) .from(issues) .innerJoin(issueLabels, eq(issueLabels.issueId, issues.id)) .innerJoin(labels, eq(issueLabels.labelId, labels.id)) .where( and( eq(issues.repositoryId, repoId), eq(issues.state, "open"), sql`lower(${labels.name}) like '%security%'` ) ); const securityAlertCount = Number(secRow?.n ?? 0); // Hours saved: each AI-merged PR ~ 1.5 h, each AI review ~ 0.5 h. const hours = mergedCount * 1.5 + reviewCount * 0.5; const hoursSaved = hours.toFixed(1); return { mergedCount, reviewCount, securityAlertCount, hoursSaved }; } /** * Query the most recent push to a repo from the activity_feed table. * Returns a RecentPush if there's been a push in the last 24 hours, * or null otherwise. Used by the RepoHeader live/watch indicator. * * Queries activity_feed where action='push' and targetId holds the commit SHA. */ async function getRecentPush(repoId: string): Promise { try { const cutoff = new Date(Date.now() - 24 * 60 * 60 * 1000); const [row] = await db .select({ targetId: activityFeed.targetId, createdAt: activityFeed.createdAt, }) .from(activityFeed) .where( and( eq(activityFeed.repositoryId, repoId), eq(activityFeed.action, "push"), sql`${activityFeed.createdAt} >= ${cutoff.toISOString()}` ) ) .orderBy(desc(activityFeed.createdAt)) .limit(1); if (!row || !row.targetId) return null; return { sha: row.targetId, ageMs: Date.now() - new Date(row.createdAt).getTime(), }; } catch { // DB unavailable or schema mismatch — degrade gracefully. return null; } } /** * Shared CSS for the polished code-browse surfaces (parallel session 3.E). * * Inlined here rather than in `src/views/layout.tsx` because session 3.E's * scope is route-local and `layout.tsx` is locked. Each polished handler * injects this via a `
{html([readmeHtml] as unknown as TemplateStringsArray)}
); })()}