Fix .bat anonymization, truncated-tree misses, submodule warning, account deletion (#742)

* fix: anonymize Windows batch scripts (#735)

mime-types maps .bat to application/x-msdownload, the same MIME type as
.exe/.dll, so batch scripts were classified as binary and streamed
through without any anonymization. Special-case .bat/.cmd as text before
the MIME lookup, keeping .exe/.dll binary.

* fix: recover files missing from truncated tree listings (#738)

GitHub truncates tree listings of very large repositories. Folders whose
listing was truncated are recorded in truncatedFolders, but files that
fell outside the listing never reached the database, so requesting them
returned 404 file_not_found even though they exist on GitHub — and a
force refresh could not help.

When a file lookup misses and its directory is under a truncated folder,
fetch the file metadata directly from GitHub's contents API (object
media type, so it works past the 1MB inline limit), cache it in the
database, and serve it normally.

* feat: warn when a repository uses git submodules (#737)

GitHub archives and tree listings never include submodule contents, so
submodules end up as empty folders in the anonymized repository, which
surprises users. Detect a root .gitmodules file and show a warning
banner in the explorer explaining that submodule contents are not
included.

* feat: allow users to delete their account (#741)

Add DELETE /api/user: removes all anonymized repositories, gists, and
pull requests owned by the user, best-effort revokes the GitHub OAuth
grant, and scrubs personal data (username, emails, tokens, GitHub id,
photo) from the user record. The record itself is kept with a
placeholder username so removed repoIds stay reserved and owner
references remain resolvable.

The settings page gains an Account section with a confirmed delete
button.

* fix: add missing error translations for token_expired and job_is_active

The error-code coverage test failed because both backend codes had no
frontend translation.

public/asset-manifest.json

@@ -1,6 +1,6 @@
 {
   "core.min.js": "core.6332b3c288.min.js",
-  "vendor.min.js": "vendor.d7d972f465.min.js",
+  "vendor.min.js": "vendor.2b972dfbd5.min.js",
   "mermaid.min.js": "mermaid.f848a72d16.min.js",
   "all.min.css": "all.1a9babcb45.min.css"
 }

public/i18n/locale-en.json

@@ -108,12 +108,15 @@
     "cannot_coauthor_self": "You cannot add yourself as a co-author.",
     "storage_write_size_mismatch": "The downloaded file was smaller than expected. The upstream source may have returned an incomplete response — please try again.",
     "storage_read_error": "An error occurred while reading the file from storage — please try again.",
-    "upstream_error": "A temporary error occurred while fetching from GitHub — please try again."
+    "upstream_error": "A temporary error occurred while fetching from GitHub — please try again.",
+    "token_expired": "Your GitHub access token has expired. Please log out and log in again to refresh it.",
+    "job_is_active": "This job is currently running — wait for it to finish or remove it first."
   },
   "WARNINGS": {
     "page_not_enabled_on_repo": "GitHub Pages is not enabled on this repository. Enable it in the repository's Settings → Pages on GitHub, then refresh.",
     "page_branch_mismatch": "GitHub Pages on this repository is served from the '{{pageBranch}}' branch, but you selected '{{selectedBranch}}'. Switch the branch above to '{{pageBranch}}' to anonymize the Pages site.",
     "folder_truncated": "This folder has more than 10,000 entries; only a partial listing is shown.",
-    "repo_truncated": "Some folders in this repository have too many files to be fully listed. Affected folders are marked with a warning icon."
+    "repo_truncated": "Some folders in this repository have too many files to be fully listed. Affected folders are marked with a warning icon.",
+    "submodules_not_included": "This repository uses git submodules. Submodule contents are not included in the anonymized repository and appear as empty folders."
   }
 }

public/partials/explorer.htm

@@ -50,6 +50,14 @@
         <i class="fas fa-exclamation-triangle"></i>
         {{ 'WARNINGS.repo_truncated' | translate }}
       </div>
+      <div
+        ng-if="options.hasSubmodules"
+        class="paper-inline-warning"
+        role="alert"
+      >
+        <i class="fas fa-exclamation-triangle"></i>
+        {{ 'WARNINGS.submodules_not_included' | translate }}
+      </div>
       <tree class="files" file="files" search-query="fileSearchQuery" search-results="fileSearchResults"></tree>
     </div>
     <div class="leftCol-foot">

public/partials/profile.htm

@@ -12,6 +12,7 @@
         <a href="#settings-rendering">Rendering</a>
         <a href="#settings-features">Features</a>
         <a href="#settings-expiration">Expiration</a>
+        <a href="#settings-account">Account</a>
       </nav>
     </aside>
 
@@ -168,6 +169,20 @@
           </button>
         </div>
       </form>
+
+      <section id="settings-account" class="paper-settings-section">
+        <div class="paper-section-eyebrow">Account</div>
+        <p class="form-text text-muted">
+          Deleting your account removes all your anonymized repositories,
+          gists, and pull requests, revokes the application's access to your
+          GitHub account, and erases your personal data (username, email,
+          access tokens) from our database. This cannot be undone.
+        </p>
+        <div class="alert alert-danger" role="alert" ng-if="deleteError" ng-bind="deleteError"></div>
+        <button type="button" class="btn btn-danger" ng-click="deleteAccount()" ng-disabled="deletingAccount">
+          {{ deletingAccount ? 'Deleting…' : 'Delete my account' }}
+        </button>
+      </section>
     </div>
   </div>
 </div>

public/script/app.js

@@ -1161,6 +1161,26 @@ angular
           }
         );
       };
+
+      $scope.deleteAccount = () => {
+        if (
+          !confirm(
+            "Delete your account? All your anonymized repositories, gists, and pull requests will be removed, and your personal data will be erased. This cannot be undone."
+          )
+        )
+          return;
+        $scope.deletingAccount = true;
+        $http.delete("/api/user").then(
+          () => {
+            window.location.href = "/";
+          },
+          () => {
+            $scope.deletingAccount = false;
+            $scope.deleteError =
+              "Unable to delete the account. Please try again.";
+          }
+        );
+      };
     },
   ])
   .controller("claimController", [

public/script/vendor.min.js

@@ -1 +1 @@
-function markedMermaid(e){return{extensions:[{name:"mermaid",level:"block",start(e){return e.match(/^```mermaid/m)?.index},tokenizer(e,t){e=/^```mermaid\n([\s\S]*?)\n```/.exec(e);if(e)return{type:"mermaid",raw:e[0],text:e[1].trim()}},renderer(e){const t="mermaid-"+Math.random().toString(36).substr(2,9);e=`<div class="mermaid" id="${t}">${e.text}</div>`;return"undefined"==typeof mermaid&&"function"==typeof window.loadMermaid&&window.loadMermaid(),setTimeout(()=>{if("undefined"!=typeof mermaid){window.mermaidInitialized||(mermaid.initialize({startOnLoad:!1,theme:"default",securityLevel:"strict"}),window.mermaidInitialized=!0);try{var e=document.getElementById(t);e&&!e.getAttribute("data-processed")&&(mermaid.init(void 0,e),e.setAttribute("data-processed","true"))}catch(e){console.error("Mermaid rendering error:",e)}}},100),e}}]}}"undefined"==typeof PDFJS&&(("undefined"!=typeof window?window:this).PDFJS={}),function(){function r(e,t){return new n(this.slice(e,t))}function s(e,t){arguments.length<2&&(t=0);for(var n=0,i=e.length;n<i;++n,++t)this[t]=255&e[n]}function n(e){if("number"==typeof e)for(var t=[],n=0;n<e;++n)t[n]=0;else if("slice"in e)t=e.slice(0);else{t=[];for(var n=0,i=e.length;n<i;++n)t[n]=e[n]}return t.subarray=r,(t.buffer=t).byteLength=t.length,t.set=s,"object"==typeof e&&e.buffer&&(t.buffer=e.buffer),t}"undefined"!=typeof Uint8Array?(void 0===Uint8Array.prototype.subarray&&(Uint8Array.prototype.subarray=function(e,t){return new Uint8Array(this.slice(e,t))},Float32Array.prototype.subarray=function(e,t){return new Float32Array(this.slice(e,t))}),"undefined"==typeof Float64Array&&(window.Float64Array=Float32Array)):(window.Uint8Array=n,window.Uint32Array=n,window.Int32Array=n,window.Uint16Array=n,window.Float32Array=n,window.Float64Array=n)}(),window.URL||(window.URL=window.webkitURL),void 0===Object.create&&(Object.create=function(e){function t(){}return t.prototype=e,new t}),function(){if(void 0!==Object.defineProperty){var t=!0;try{Object.defineProperty(new Image,"id",{value:"test"});function e(){}e.prototype={get id(){}},Object.defineProperty(new e,"id",{value:"",configurable:!0,enumerable:!0,writable:!1})}catch(e){t=!1}if(t)return}Object.defineProperty=function(e,t,n){delete e[t],"get"in n&&e.__defineGetter__(t,n.get),"set"in n&&e.__defineSetter__(t,n.set),"value"in n&&(e.__defineSetter__(t,function(e){return this.__defineGetter__(t,function(){return e}),e}),e[t]=n.value)}}(),void 0===Object.keys&&(Object.keys=function(e){var t,n=[];for(t in e)e.hasOwnProperty(t)&&n.push(t);return n}),function(){var e;"undefined"==typeof FileReader||"readAsArrayBuffer"in(e=FileReader.prototype)||Object.defineProperty(e,"readAsArrayBuffer",{value:function(e){var t=new FileReader,s=this;t.onload=function(e){e=e.target.result;for(var t=new ArrayBuffer(e.length),n=new Uint8Array(t),i=0,r=e.length;i<r;i++)n[i]=e.charCodeAt(i);Object.defineProperty(s,"result",{value:t,enumerable:!0,writable:!1,configurable:!0}),(e=document.createEvent("HTMLEvents")).initEvent("load",!1,!1),s.dispatchEvent(e)},t.readAsBinaryString(e)}})}(),function(){var e=XMLHttpRequest.prototype;"overrideMimeType"in e||Object.defineProperty(e,"overrideMimeType",{value:function(){}}),"response"in e||"mozResponseArrayBuffer"in e||"mozResponse"in e||"responseArrayBuffer"in e||("undefined"!=typeof VBArray?Object.defineProperty(e,"response",{get:function(){return new Uint8Array(new VBArray(this.responseBody).toArray())}}):("function"==typeof e.overrideMimeType&&Object.defineProperty(e,"responseType",{set:function(){this.overrideMimeType("text/plain; charset=x-user-defined")}}),Object.defineProperty(e,"response",{get:function(){for(var e=this.responseText,t=e.length,n=new Uint8Array(t),i=0;i<t;++i)n[i]=255&e.charCodeAt(i);return n}})))}(),"btoa"in window||(window.btoa=function(e){for(var t="",n=0,i=e.length;n<i;n+=3)var r=255&e.charCodeAt(n),s=255&e.charCodeAt(n+1),o=255&e.charCodeAt(n+2),a=(3&r)<<4|s>>4,s=n+1<i?(15&s)<<2|o>>6:64,o=n+2<i?63&o:64,t=t+("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(r>>2)+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(a)+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(s)+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(o));return t}),"atob"in window||(window.atob=function(e){if(1==(e=e.replace(/=+$/,"")).length%4)throw Error("bad atob input");for(var t,n,i=0,r=0,s="";n=e.charAt(r++);~n&&(t=i%4?64*t+n:n,i++%4)&&(s+=String.fromCharCode(255&t>>(-2*i&6))))n="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(n);return s}),void 0===Function.prototype.bind&&(Function.prototype.bind=function(t){var n=this,i=Array.prototype.slice.call(arguments,1);return function(){var e=Array.prototype.concat.apply(i,arguments);return n.apply(t,e)}}),"dataset"in document.createElement("div")||Object.defineProperty(HTMLElement.prototype,"dataset",{get:function(){if(this._dataset)return this._dataset;for(var e={},t=0,n=Line truncated
+function markedMermaid(e){return{extensions:[{name:"mermaid",level:"block",start(e){return e.match(/^```mermaid/m)?.index},tokenizer(e,t){e=/^```mermaid\n([\s\S]*?)\n```/.exec(e);if(e)return{type:"mermaid",raw:e[0],text:e[1].trim()}},renderer(e){const t="mermaid-"+Math.random().toString(36).substr(2,9);e=`<div class="mermaid" id="${t}">${e.text}</div>`;return"undefined"==typeof mermaid&&"function"==typeof window.loadMermaid&&window.loadMermaid(),setTimeout(()=>{if("undefined"!=typeof mermaid){window.mermaidInitialized||(mermaid.initialize({startOnLoad:!1,theme:"default",securityLevel:"strict"}),window.mermaidInitialized=!0);try{var e=document.getElementById(t);e&&!e.getAttribute("data-processed")&&(mermaid.init(void 0,e),e.setAttribute("data-processed","true"))}catch(e){console.error("Mermaid rendering error:",e)}}},100),e}}]}}"undefined"==typeof PDFJS&&(("undefined"!=typeof window?window:this).PDFJS={}),function(){function r(e,t){return new n(this.slice(e,t))}function s(e,t){arguments.length<2&&(t=0);for(var n=0,i=e.length;n<i;++n,++t)this[t]=255&e[n]}function n(e){if("number"==typeof e)for(var t=[],n=0;n<e;++n)t[n]=0;else if("slice"in e)t=e.slice(0);else{t=[];for(var n=0,i=e.length;n<i;++n)t[n]=e[n]}return t.subarray=r,(t.buffer=t).byteLength=t.length,t.set=s,"object"==typeof e&&e.buffer&&(t.buffer=e.buffer),t}"undefined"!=typeof Uint8Array?(void 0===Uint8Array.prototype.subarray&&(Uint8Array.prototype.subarray=function(e,t){return new Uint8Array(this.slice(e,t))},Float32Array.prototype.subarray=function(e,t){return new Float32Array(this.slice(e,t))}),"undefined"==typeof Float64Array&&(window.Float64Array=Float32Array)):(window.Uint8Array=n,window.Uint32Array=n,window.Int32Array=n,window.Uint16Array=n,window.Float32Array=n,window.Float64Array=n)}(),window.URL||(window.URL=window.webkitURL),void 0===Object.create&&(Object.create=function(e){function t(){}return t.prototype=e,new t}),function(){if(void 0!==Object.defineProperty){var t=!0;try{Object.defineProperty(new Image,"id",{value:"test"});function e(){}e.prototype={get id(){}},Object.defineProperty(new e,"id",{value:"",configurable:!0,enumerable:!0,writable:!1})}catch(e){t=!1}if(t)return}Object.defineProperty=function(e,t,n){delete e[t],"get"in n&&e.__defineGetter__(t,n.get),"set"in n&&e.__defineSetter__(t,n.set),"value"in n&&(e.__defineSetter__(t,function(e){return this.__defineGetter__(t,function(){return e}),e}),e[t]=n.value)}}(),void 0===Object.keys&&(Object.keys=function(e){var t,n=[];for(t in e)e.hasOwnProperty(t)&&n.push(t);return n}),function(){var e;"undefined"==typeof FileReader||"readAsArrayBuffer"in(e=FileReader.prototype)||Object.defineProperty(e,"readAsArrayBuffer",{value:function(e){var t=new FileReader,s=this;t.onload=function(e){e=e.target.result;for(var t=new ArrayBuffer(e.length),n=new Uint8Array(t),i=0,r=e.length;i<r;i++)n[i]=e.charCodeAt(i);Object.defineProperty(s,"result",{value:t,enumerable:!0,writable:!1,configurable:!0}),(e=document.createEvent("HTMLEvents")).initEvent("load",!1,!1),s.dispatchEvent(e)},t.readAsBinaryString(e)}})}(),function(){var e=XMLHttpRequest.prototype;"overrideMimeType"in e||Object.defineProperty(e,"overrideMimeType",{value:function(){}}),"response"in e||"mozResponseArrayBuffer"in e||"mozResponse"in e||"responseArrayBuffer"in e||("undefined"!=typeof VBArray?Object.defineProperty(e,"response",{get:function(){return new Uint8Array(new VBArray(this.responseBody).toArray())}}):("function"==typeof e.overrideMimeType&&Object.defineProperty(e,"responseType",{set:function(){this.overrideMimeType("text/plain; charset=x-user-defined")}}),Object.defineProperty(e,"response",{get:function(){for(var e=this.responseText,t=e.length,n=new Uint8Array(t),i=0;i<t;++i)n[i]=255&e.charCodeAt(i);return n}})))}(),"btoa"in window||(window.btoa=function(e){for(var t="",n=0,i=e.length;n<i;n+=3)var r=255&e.charCodeAt(n),s=255&e.charCodeAt(n+1),o=255&e.charCodeAt(n+2),a=(3&r)<<4|s>>4,s=n+1<i?(15&s)<<2|o>>6:64,o=n+2<i?63&o:64,t=t+("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(r>>2)+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(a)+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(s)+"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".charAt(o));return t}),"atob"in window||(window.atob=function(e){if(1==(e=e.replace(/=+$/,"")).length%4)throw Error("bad atob input");for(var t,n,i=0,r=0,s="";n=e.charAt(r++);~n&&(t=i%4?64*t+n:n,i++%4)&&(s+=String.fromCharCode(255&t>>(-2*i&6))))n="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(n);return s}),void 0===Function.prototype.bind&&(Function.prototype.bind=function(t){var n=this,i=Array.prototype.slice.call(arguments,1);return function(){var e=Array.prototype.concat.apply(i,arguments);return n.apply(t,e)}}),"dataset"in document.createElement("div")||Object.defineProperty(HTMLElement.prototype,"dataset",{get:function(){if(this._dataset)return this._dataset;for(var e={},t=0,n=Line truncated