feat: gist & co-authors

public/css/style.css

@@ -1661,6 +1661,18 @@ code {
   border-color: var(--border-color);
 }
 
+.type-badge.type-coauthor {
+  background: rgba(99, 102, 241, 0.12);
+  color: #4f46e5;
+  border-color: rgba(99, 102, 241, 0.35);
+  margin-left: 6px;
+}
+.dark-mode .type-badge.type-coauthor {
+  background: rgba(129, 140, 248, 0.18);
+  color: #a5b4fc;
+  border-color: rgba(165, 180, 252, 0.45);
+}
+
 /* Type filter button group */
 .btn-group .btn:not(.btn-primary) {
   background: var(--hover-bg-color);

public/partials/anonymize.htm

@@ -5,8 +5,8 @@
       <div class="paper-crumbs">My work &nbsp;/&nbsp; <span class="here">New anonymization</span></div>
       <h1 class="paper-page-title">New <em>anonymization</em></h1>
       <p class="paper-page-lede">
-        Paste a GitHub repository or pull-request URL. We&rsquo;ll fetch it,
+        Paste a GitHub repository, pull-request, or gist URL. We&rsquo;ll fetch
-        strip every trace of identity, and hand you back a stable link.
+        it, strip every trace of identity, and hand you back a stable link.
       </p>
       <div class="form-group mt-4 mb-2">
         <label class="paper-field-label" for="sourceUrl-landing">Source URL</label>
@@ -15,13 +15,13 @@
           type="text"
           class="form-control form-control-lg"
           ng-model="sourceUrl"
-          placeholder="https://github.com/owner/repo  or  https://github.com/owner/repo/pull/42"
+          placeholder="https://github.com/owner/repo, https://github.com/owner/repo/pull/42, or https://gist.github.com/owner/abcdef…"
           ng-model-options="{ debounce: {default: 1000, blur: 0, click: 0}, updateOn: 'default blur click' }"
           ng-change="urlSelected()"
         />
       </div>
       <small class="form-text" style="color: var(--ink-muted);">
-        Paste a repository URL to anonymize a repo, or a pull-request URL to anonymize a PR.
+        Paste a repository URL to anonymize a repo, a pull-request URL for a PR, or a gist URL for a gist.
       </small>
     </div>
   </div>
@@ -39,8 +39,8 @@
             <span ng-if="!isUpdate">New <em>anonymization</em></span>
             <span ng-if="isUpdate">Edit <em>anonymization</em></span>
           </h1>
-          <span class="type-badge" ng-show="detectedType" ng-class="{'type-repo': detectedType === 'repo', 'type-pr': detectedType === 'pr'}">
+          <span class="type-badge" ng-show="detectedType" ng-class="{'type-repo': detectedType === 'repo', 'type-pr': detectedType === 'pr', 'type-gist': detectedType === 'gist'}">
-            {{detectedType === 'repo' ? 'Repo' : 'PR'}}
+            {{detectedType === 'repo' ? 'Repo' : detectedType === 'pr' ? 'PR' : 'Gist'}}
           </span>
         </div>
       </div>
@@ -131,6 +131,14 @@
               <div class="invalid-feedback" ng-show="anonymize.pullRequestId.$error.used">{{pullRequestId}} is already used.</div>
             </div>
 
+            <div class="form-group" ng-show="detectedType === 'gist'">
+              <label class="paper-field-label" for="gistId">Anonymized gist ID</label>
+              <input type="text" class="form-control" name="gistId" id="gistId" ng-class="{'is-invalid': anonymize.gistId.$invalid}" ng-model="gistId" ng-model-options="{ debounce: {default: 1000, blur: 0, click: 0}, updateOn: 'default blur click' }" />
+              <small class="form-text text-muted">Your share link will be <code>anonymous.4open.science/gist/{{gistId}}</code>.</small>
+              <div class="invalid-feedback" ng-show="anonymize.gistId.$error.format">ID can only contain letters and numbers.</div>
+              <div class="invalid-feedback" ng-show="anonymize.gistId.$error.used">{{gistId}} is already used.</div>
+            </div>
+
             <div class="form-group">
               <label class="paper-field-label" for="conference">Conference <span class="paper-optional">(optional)</span></label>
               <input class="form-control" id="conference" name="conference" ng-model="conference" ng-class="{'is-invalid': anonymize.conference.$invalid}" />
@@ -186,6 +194,33 @@
               </div>
             </div>
 
+            <div ng-show="detectedType === 'gist'">
+              <div class="form-check">
+                <input class="form-check-input" type="checkbox" id="title-gist" name="title-gist" ng-model="options.title" />
+                <label class="form-check-label" for="title-gist">Gist description</label>
+              </div>
+              <div class="form-check">
+                <input class="form-check-input" type="checkbox" id="content-gist" name="content-gist" ng-model="options.content" />
+                <label class="form-check-label" for="content-gist">File contents</label>
+              </div>
+              <div class="form-check">
+                <input class="form-check-input" type="checkbox" id="comments-gist" name="comments-gist" ng-model="options.comments" />
+                <label class="form-check-label" for="comments-gist">Comments</label>
+              </div>
+              <div class="form-check">
+                <input class="form-check-input" type="checkbox" id="username-gist" name="username-gist" ng-model="options.username" />
+                <label class="form-check-label" for="username-gist">Usernames</label>
+              </div>
+              <div class="form-check">
+                <input class="form-check-input" type="checkbox" id="date-gist" name="date-gist" ng-model="options.date" />
+                <label class="form-check-label" for="date-gist">Dates</label>
+              </div>
+              <div class="form-check">
+                <input class="form-check-input" type="checkbox" id="origin-gist" name="origin-gist" ng-model="options.origin" />
+                <label class="form-check-label" for="origin-gist">Source gist ID</label>
+              </div>
+            </div>
+
             <div ng-show="detectedType === 'pr'">
               <div class="form-check">
                 <input class="form-check-input" type="checkbox" id="title" name="title" ng-model="options.title" />
@@ -239,6 +274,50 @@
             <small class="form-text text-muted" ng-show="options.expirationMode=='redirect'">After {{options.expirationDate | date}}, visitors will be redirected to GitHub.</small>
           </section>
 
+          <section class="paper-settings-section" ng-show="isUpdate && detectedType === 'repo'">
+            <div class="paper-section-eyebrow">Co-authors</div>
+            <p class="form-text text-muted" style="margin-bottom: 8px;">
+              Co-authors can view and edit these settings. They cannot delete the anonymization or manage co-authors.
+            </p>
+
+            <div class="form-group" ng-show="role === 'owner' || role === 'admin'">
+              <label class="paper-field-label" for="coauthorSearch">Add a GitHub user</label>
+              <div style="position: relative;">
+                <input
+                  type="text"
+                  id="coauthorSearch"
+                  class="form-control"
+                  placeholder="Search GitHub username…"
+                  ng-model="coauthorSearch"
+                  ng-change="searchCoauthors()"
+                  ng-model-options="{ debounce: 300 }"
+                  autocomplete="off"
+                />
+                <div class="dropdown-menu show" style="display: block; max-height: 220px; overflow-y: auto; width: 100%;" ng-show="coauthorResults.length > 0">
+                  <a href="#" class="dropdown-item d-flex align-items-center" ng-repeat="u in coauthorResults" ng-click="addCoauthor(u, $event)">
+                    <img ng-src="{{u.photo}}" alt="" style="width: 22px; height: 22px; border-radius: 50%; margin-right: 8px;" />
+                    <span ng-bind="u.username"></span>
+                  </a>
+                </div>
+              </div>
+              <small class="form-text text-muted" ng-show="coauthorError" ng-bind="coauthorError"></small>
+            </div>
+
+            <div class="coauthor-list">
+              <div class="coauthor-row d-flex align-items-center" ng-repeat="c in coauthors" style="padding: 6px 0; gap: 8px;">
+                <img ng-src="{{c.photo}}" alt="" style="width: 24px; height: 24px; border-radius: 50%;" ng-if="c.photo" />
+                <a ng-href="https://github.com/{{c.username}}" target="_blank" ng-bind="c.username"></a>
+                <span class="type-badge type-coauthor">Co-author</span>
+                <button type="button" class="btn btn-sm" ng-click="removeCoauthor(c)" ng-show="role === 'owner' || role === 'admin'" style="margin-left: auto;" title="Remove co-author">
+                  <i class="fas fa-times"></i>
+                </button>
+              </div>
+              <div class="form-text text-muted" ng-show="!coauthors || coauthors.length === 0">
+                No co-authors yet.
+              </div>
+            </div>
+          </section>
+
           <div class="alert alert-danger" role="alert" ng-if="error" ng-bind="error"></div>
 
           <div class="anonymize-submit-bar" ng-show="detectedType">
@@ -254,6 +333,12 @@
             <button type="submit" class="btn btn-ink" ng-click="anonymizePullRequest($event)" ng-if="detectedType === 'pr' && isUpdate">
               <i class="fas fa-save mr-1"></i> Update Pull Request
             </button>
+            <button type="submit" class="btn btn-ink" ng-click="anonymizeGist($event)" ng-if="detectedType === 'gist' && !isUpdate">
+              <i class="fas fa-user-secret mr-1"></i> Anonymize Gist
+            </button>
+            <button type="submit" class="btn btn-ink" ng-click="anonymizeGist($event)" ng-if="detectedType === 'gist' && isUpdate">
+              <i class="fas fa-save mr-1"></i> Update Gist
+            </button>
           </div>
         </form>
       </div>
@@ -270,6 +355,51 @@
         <div class="anonymize-preview-body markdown-body body" ng-bind-html="html_readme"></div>
       </div>
 
+      <div class="anonymize-preview-col" ng-if="detectedType === 'gist' && details">
+        <div class="anonymize-preview-head">
+          <span class="paper-eyebrow">Live preview</span>
+          <span class="anonymize-preview-sub">Gist with redactions applied</span>
+        </div>
+        <div class="anonymize-preview-body">
+          <div class="d-flex w-100 justify-content-between align-items-center flex-wrap">
+            <h2 class="pr-title mb-1">
+              <span ng-if="options.title">{{anonymizeGistContent(details.gist.description) || 'Untitled gist'}}</span>
+              <span class="badge" ng-class="{'badge-success': details.gist.isPublic, 'badge-secondary': !details.gist.isPublic}">
+                {{details.gist.isPublic ? 'public' : 'secret'}}
+              </span>
+            </h2>
+            <small ng-bind="details.gist.updatedDate | date" ng-if="options.date"></small>
+          </div>
+          <small ng-if="options.origin">Gist ID: {{details.source.gistId}}</small>
+          <small ng-if="options.username && details.gist.ownerLogin">By @{{anonymizeGistContent(details.gist.ownerLogin)}}</small>
+          <ul class="pr-comments mt-3">
+            <li class="pr-comment" ng-repeat="file in details.gist.files" ng-if="options.content">
+              <div class="pr-comment-head">
+                <strong ng-bind="anonymizeGistContent(file.filename)"></strong>
+                <span class="pr-comment-date" ng-if="file.language">{{file.language}}</span>
+              </div>
+              <pre class="pr-diff"><code ng-bind="anonymizeGistContent(file.content)"></code></pre>
+            </li>
+          </ul>
+          <div ng-if="options.comments && details.gist.comments && details.gist.comments.length">
+            <h3 class="paper-section-eyebrow mt-3">Comments</h3>
+            <ul class="pr-comments">
+              <li class="pr-comment" ng-repeat="comment in details.gist.comments">
+                <div class="pr-comment-head">
+                  <span class="pr-comment-author" ng-if="options.username">
+                    <i class="far fa-user"></i> @<span ng-bind="anonymizeGistContent(comment.author)"></span>
+                  </span>
+                  <span class="pr-comment-date" ng-if="options.date" ng-bind="comment.updatedDate | date"></span>
+                </div>
+                <div class="pr-comment-body" ng-if="options.body">
+                  <markdown content="anonymizeGistContent(comment.body)" options="options" terms="terms"></markdown>
+                </div>
+              </li>
+            </ul>
+          </div>
+        </div>
+      </div>
+
       <div class="anonymize-preview-col" ng-if="detectedType === 'pr' && details"
            ng-init="prTabState = { active: options.diff ? 'diff' : 'comments' }">
         <div class="anonymize-preview-head">

public/partials/dashboard.htm

@@ -86,6 +86,7 @@
               <button type="button" class="btn" ng-class="{'btn-primary': typeFilter === 'all'}" ng-click="typeFilter = 'all'">All</button>
               <button type="button" class="btn" ng-class="{'btn-primary': typeFilter === 'repo'}" ng-click="typeFilter = 'repo'">Repos</button>
               <button type="button" class="btn" ng-class="{'btn-primary': typeFilter === 'pr'}" ng-click="typeFilter = 'pr'">PRs</button>
+              <button type="button" class="btn" ng-class="{'btn-primary': typeFilter === 'gist'}" ng-click="typeFilter = 'gist'">Gists</button>
             </div>
 
             <div class="dropdown">
@@ -182,12 +183,14 @@
         ng-repeat="item in items | filter:itemFilter | orderBy:orderBy as filteredItems"
       >
         <div class="cell-anon" role="cell">
-          <span class="type-badge" ng-class="{'type-repo': item._type === 'repo', 'type-pr': item._type === 'pr'}">{{item._type === 'repo' ? 'Repo' : 'PR'}}</span>
+          <span class="type-badge" ng-class="{'type-repo': item._type === 'repo', 'type-pr': item._type === 'pr', 'type-gist': item._type === 'gist'}">{{item._type === 'repo' ? 'Repo' : item._type === 'pr' ? 'PR' : 'Gist'}}</span>
+          <span class="type-badge type-coauthor" ng-if="item.role === 'coauthor'" title="You are a co-author on this anonymization">Co-author</span>
           <div class="anon-text">
             <a ng-href="{{item._viewUrl}}" class="repo-name" ng-bind="item._name"></a>
             <div class="anon-sub">
               <a ng-if="item._type === 'repo'" href="https://github.com/{{item.source.fullName}}/" ng-bind="item.source.fullName"></a><span ng-if="item._type === 'repo' && item.options.update">&nbsp;&middot;&nbsp;<a href="https://github.com/{{item.source.fullName}}/tree/{{item.source.branch}}" ng-bind="item.source.branch"></a><span ng-if="item.source.commit">&nbsp;&middot;&nbsp;@<a href="https://github.com/{{item.source.fullName}}/tree/{{item.source.commit}}" ng-bind="item.source.commit.substring(0, 8)"></a></span></span><span ng-if="item._type === 'repo' && !item.options.update">&nbsp;&middot;&nbsp;@<a href="https://github.com/{{item.source.fullName}}/tree/{{item.source.commit}}" ng-bind="item.source.commit.substring(0, 8)"></a></span>
               <a ng-if="item._type === 'pr'" href="https://github.com/{{item.source.repositoryFullName}}/pull/{{item.source.pullRequestId}}" ng-bind="item._source"></a>
+              <a ng-if="item._type === 'gist'" href="https://gist.github.com/{{item.source.gistId}}" ng-bind="item._source"></a>
             </div>
           </div>
         </div>
@@ -232,7 +235,7 @@
               <a class="dropdown-item" href="#" ng-show="item.status == 'removed'" ng-click="refreshItem(item)">
                 <i class="fas fa-check-circle"></i> Enable
               </a>
-              <a class="dropdown-item" href="#" ng-show="item.status == 'ready' || item.status == 'expired' || item.status == 'error'" ng-click="removeItem(item)">
+              <a class="dropdown-item" href="#" ng-show="(item.status == 'ready' || item.status == 'expired' || item.status == 'error') && item.role !== 'coauthor'" ng-click="removeItem(item)">
                 <i class="fas fa-trash-alt"></i> Remove
               </a>
               <a class="dropdown-item" ng-href="{{item._viewUrl}}">

public/partials/gist.htm

@@ -0,0 +1,98 @@
+<div class="pr-page" ng-init="tabState = { active: (details && details.files) ? 'files' : 'comments' }">
+  <div class="container paper-page pr-page-inner">
+    <div class="paper-crumbs">
+      <a href="/dashboard">Reviewer</a> &nbsp;/&nbsp;
+      <span class="here">Gist</span>
+    </div>
+
+    <header class="pr-header">
+      <h1 class="paper-page-title pr-title">
+        <span ng-if="details.description" ng-bind="details.description"></span>
+        <span ng-if="!details.description" class="text-muted">Untitled gist</span>
+      </h1>
+      <div class="pr-header-meta">
+        <span class="paper-pill" ng-class="{'good': details.isPublic, 'warn': !details.isPublic}">
+          {{ details.isPublic ? 'Public' : 'Secret' }}
+        </span>
+        <span class="pr-meta-item" ng-if="details.ownerLogin">
+          <i class="far fa-user"></i> @<span ng-bind="details.ownerLogin"></span>
+        </span>
+        <span class="pr-meta-item" ng-if="details.updatedDate">
+          <i class="far fa-clock"></i> <span ng-bind="details.updatedDate | date"></span>
+        </span>
+        <span class="pr-meta-item" ng-if="details.anonymizeDate">
+          <i class="fas fa-user-secret"></i> Anonymized <span ng-bind="details.anonymizeDate | date"></span>
+        </span>
+      </div>
+    </header>
+
+    <nav class="paper-tabs" ng-if="details.files || details.comments" role="tablist">
+      <button
+        class="paper-tab"
+        ng-if="details.files"
+        ng-class="{'active': tabState.active == 'files'}"
+        ng-click="tabState.active = 'files'"
+        type="button"
+        role="tab"
+      >
+        <i class="fas fa-file-code"></i>
+        <ng-pluralize
+          count="details.files.length"
+          when="{'0': 'No files', 'one': '1 file', 'other': '{} files'}"
+        ></ng-pluralize>
+      </button>
+      <button
+        class="paper-tab"
+        ng-if="details.comments"
+        ng-class="{'active': tabState.active == 'comments'}"
+        ng-click="tabState.active = 'comments'"
+        type="button"
+        role="tab"
+      >
+        <i class="far fa-comment-dots"></i>
+        <ng-pluralize
+          count="details.comments.length"
+          when="{'0': 'No comments', 'one': '1 comment', 'other': '{} comments'}"
+        ></ng-pluralize>
+      </button>
+    </nav>
+
+    <div class="paper-tab-content">
+      <div ng-if="details.files && tabState.active =='files'">
+        <ul class="pr-comments">
+          <li class="pr-comment" ng-repeat="file in details.files">
+            <div class="pr-comment-head">
+              <strong ng-bind="file.filename"></strong>
+              <span class="pr-comment-date" ng-if="file.language">{{file.language}}</span>
+            </div>
+            <pre class="pr-diff"><code ng-bind="file.content"></code></pre>
+          </li>
+          <li class="paper-table-empty" ng-if="!details.files.length">
+            <i class="fas fa-file"></i>
+            <span>No files in this gist.</span>
+          </li>
+        </ul>
+      </div>
+
+      <div ng-if="details.comments && tabState.active =='comments'">
+        <ul class="pr-comments">
+          <li class="pr-comment" ng-repeat="comment in details.comments">
+            <div class="pr-comment-head">
+              <span class="pr-comment-author" ng-if="comment.author">
+                <i class="far fa-user"></i> @<span ng-bind="comment.author"></span>
+              </span>
+              <span class="pr-comment-date" ng-if="comment.updatedDate" ng-bind="comment.updatedDate | date"></span>
+            </div>
+            <div class="pr-comment-body" ng-if="comment.body">
+              <markdown content="comment.body"></markdown>
+            </div>
+          </li>
+          <li class="paper-table-empty" ng-if="!details.comments.length">
+            <i class="far fa-comment-dots"></i>
+            <span>No comments on this gist.</span>
+          </li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</div>

public/script/app.js

@@ -43,6 +43,11 @@ angular
           controller: "anonymizeController",
           title: "Anonymize a pull request – Anonymous GitHub",
         })
+        .when("/gist-anonymize/:gistId?", {
+          templateUrl: "/partials/anonymize.htm",
+          controller: "anonymizeController",
+          title: "Anonymize a gist – Anonymous GitHub",
+        })
         .when("/status/:repoId", {
           templateUrl: "/partials/status.htm",
           controller: "statusController",
@@ -89,6 +94,12 @@ angular
           title: "Anonymous pull request – Anonymous GitHub",
           reloadOnUrl: false,
         })
+        .when("/gist/:gistId", {
+          templateUrl: "/partials/gist.htm",
+          controller: "gistController",
+          title: "Anonymous gist – Anonymous GitHub",
+          reloadOnUrl: false,
+        })
         .when("/r/:repoId/:path*?", {
           templateUrl: "/partials/explorer.htm",
           controller: "exploreController",
@@ -930,14 +941,18 @@ angular
 
       let loadedRepos = null;
       let loadedPRs = null;
+      let loadedGists = null;
 
       function mergeItems() {
-        $scope.items = (loadedRepos || []).concat(loadedPRs || []);
+        $scope.items = (loadedRepos || [])
+          .concat(loadedPRs || [])
+          .concat(loadedGists || []);
       }
 
       function loadAll() {
         loadedRepos = null;
         loadedPRs = null;
+        loadedGists = null;
         $http.get("/api/user/anonymized_repositories").then(
           (res) => {
             loadedRepos = res.data.map((repo) => {
@@ -974,6 +989,24 @@ angular
           },
           (err) => { console.error(err); }
         );
+        $http.get("/api/user/anonymized_gists").then(
+          (res3) => {
+            loadedGists = res3.data.map((g) => {
+              if (!g.pageView) g.pageView = 0;
+              if (!g.lastView) g.lastView = "";
+              g.options.terms = (g.options.terms || []).filter((f) => f);
+              g._type = "gist";
+              g._id = g.gistId;
+              g._name = g.gistId;
+              g._source = g.source.gistId;
+              g._editUrl = "/gist-anonymize/" + g.gistId;
+              g._viewUrl = "/gist/" + g.gistId + "/";
+              return g;
+            });
+            mergeItems();
+          },
+          (err) => { console.error(err); }
+        );
       }
       loadAll();
 
@@ -998,8 +1031,13 @@ angular
         });
       }
 
+      const labelOf = (t) =>
+        t === "repo" ? "repository" : t === "gist" ? "gist" : "pull request";
+      const apiBaseOf = (t) =>
+        t === "repo" ? "/api/repo" : t === "gist" ? "/api/gist" : "/api/pr";
+
       $scope.removeItem = (item) => {
-        const label = item._type === "repo" ? "repository" : "pull request";
+        const label = labelOf(item._type);
         if (confirm(`Are you sure that you want to remove the ${label} ${item._id}?`)) {
           const toast = {
             title: `Removing ${item._id}...`,
@@ -1007,7 +1045,7 @@ angular
             body: `The ${label} ${item._id} is going to be removed.`,
           };
           $scope.addToast(toast);
-          const endpoint = item._type === "repo" ? `/api/repo/${item._id}` : `/api/pr/${item._id}`;
+          const endpoint = `${apiBaseOf(item._type)}/${item._id}`;
           $http.delete(endpoint).then(
             () => {
               if (item._type === "repo") {
@@ -1032,16 +1070,14 @@ angular
       };
 
       $scope.refreshItem = (item) => {
-        const label = item._type === "repo" ? "repository" : "pull request";
+        const label = labelOf(item._type);
         const toast = {
           title: `Refreshing ${item._id}...`,
           date: new Date(),
           body: `The ${label} ${item._id} is going to be refreshed.`,
         };
         $scope.addToast(toast);
-        const endpoint = item._type === "repo"
+        const endpoint = `${apiBaseOf(item._type)}/${item._id}/refresh`;
-          ? `/api/repo/${item._id}/refresh`
-          : `/api/pr/${item._id}/refresh`;
         $http.post(endpoint).then(
           () => {
             if (item._type === "repo") {
@@ -1144,9 +1180,10 @@ angular
     function ($scope, $http, $sce, $routeParams, $location, $translate, $timeout) {
       // Unified state
       $scope.sourceUrl = "";
-      $scope.detectedType = null; // 'repo' or 'pr'
+      $scope.detectedType = null; // 'repo' | 'pr' | 'gist'
       $scope.repoId = "";
       $scope.pullRequestId = "";
+      $scope.gistId = "";
       $scope.terms = "";
       $scope.defaultTerms = "";
       $scope.branches = [];
@@ -1163,6 +1200,7 @@ angular
         title: true,
         origin: false,
         diff: true,
+        content: true,
         comments: true,
         username: true,
         date: true,
@@ -1210,6 +1248,8 @@ angular
               $scope.sourceUrl = "https://github.com/" + res.data.source.fullName;
               $scope.terms = res.data.options.terms.filter((f) => f).join("\n");
               $scope.source = res.data.source;
+              $scope.role = res.data.role || "owner";
+              $scope.coauthors = res.data.coauthors || [];
               // Remember the saved branch so the source.branch watcher knows
               // not to bump source.commit to GitHub HEAD on edit-page load
               // (#360). Without this, just opening the Edit form silently
@@ -1258,6 +1298,31 @@ angular
             if ($scope.anonymize.sourceUrl) $scope.anonymize.sourceUrl.$$element[0].disabled = true;
           });
         }
+        // Edit mode: Gist
+        if ($routeParams.gistId && $routeParams.gistId != "") {
+          $scope.isUpdate = true;
+          $scope.detectedType = "gist";
+          $scope.gistId = $routeParams.gistId;
+          $http.get("/api/gist/" + $scope.gistId).then(
+            async (res) => {
+              $scope.sourceUrl = "https://gist.github.com/" + res.data.source.gistId;
+              $scope.terms = res.data.options.terms.filter((f) => f).join("\n");
+              $scope.source = res.data.source;
+              $scope.options = Object.assign({}, $scope.options, res.data.options);
+              $scope.conference = res.data.conference;
+              if (res.data.options.expirationDate) {
+                $scope.options.expirationDate = new Date(res.data.options.expirationDate);
+              }
+              $scope.details = (await $http.get(`/api/gist/source/${res.data.source.gistId}`)).data;
+              $scope.$apply();
+            },
+            () => { $location.url("/404"); }
+          );
+          $scope.$watch("anonymize", () => {
+            if ($scope.anonymize.gistId) $scope.anonymize.gistId.$$element[0].disabled = true;
+            if ($scope.anonymize.sourceUrl) $scope.anonymize.sourceUrl.$$element[0].disabled = true;
+          });
+        }
       });
 
       // URL change handler - auto-detect type
@@ -1265,6 +1330,7 @@ angular
         $scope.terms = $scope.defaultTerms;
         $scope.repoId = "";
         $scope.pullRequestId = "";
+        $scope.gistId = "";
         $scope.details = null;
         $scope.branches = [];
         $scope.source = { type: "GitHubStream", branch: "", commit: "" };
@@ -1282,7 +1348,11 @@ angular
         }
         setValidity("sourceUrl", "github", true);
         try {
-          if (o.pullRequestId) {
+          if (o.gistId && !o.repo) {
+            $scope.detectedType = "gist";
+            $scope.source = { gistId: o.gistId };
+            await getGistDetails();
+          } else if (o.pullRequestId) {
             $scope.detectedType = "pr";
             $scope.source = { repositoryFullName: o.owner + "/" + o.repo, pullRequestId: o.pullRequestId };
             await getPrDetails();
@@ -1555,15 +1625,85 @@ angular
       $scope.anonymizePrContent = function (content) {
         if (!content) return content;
         if (_prAnonCache.has(content)) return _prAnonCache.get(content);
-        // First time we've seen this content — kick off a refresh and return
-        // the original for now. The watcher below also schedules refreshes on
-        // term/option changes; this branch handles late-arriving comment data.
         if (!_prSeenContents.has(content)) {
           refreshPrPreview();
         }
         return content;
       };
 
+      // ========== GIST LOGIC ==========
+      async function getGistDetails() {
+        const o = parseGithubUrl($scope.sourceUrl);
+        try {
+          resetValidity();
+          const res = await $http.get(`/api/gist/source/${o.gistId}`);
+          $scope.details = res.data;
+          if (!$scope.gistId) {
+            $scope.gistId = "gist-" + o.gistId.substring(0, 6) + "-" + generateRandomId(4);
+          }
+        } catch (error) {
+          if (error.data) {
+            $translate("ERRORS." + error.data.error).then((translation) => {
+              $scope.addToast({ title: "Error", date: new Date(), body: translation });
+              $scope.error = translation;
+            }, console.error);
+            displayErrorMessage(error.data.error);
+          }
+          setValidity("sourceUrl", "missing", false);
+          throw error;
+        }
+      }
+
+      let _gistAnonCache = new Map();
+      let _gistSeenContents = new Set();
+
+      function collectGistContents() {
+        const out = new Set();
+        const d = $scope.details && $scope.details.gist;
+        if (!d) return out;
+        if (typeof d.description === "string") out.add(d.description);
+        if (typeof d.ownerLogin === "string") out.add(d.ownerLogin);
+        const files = (d.files) || [];
+        for (const f of files) {
+          if (typeof f.filename === "string") out.add(f.filename);
+          if (typeof f.content === "string") out.add(f.content);
+        }
+        const comments = d.comments || [];
+        for (const c of comments) {
+          if (typeof c.author === "string") out.add(c.author);
+          if (typeof c.body === "string") out.add(c.body);
+        }
+        return out;
+      }
+
+      const refreshGistPreview = makePreviewBatcher(
+        () => {
+          const seen = collectGistContents();
+          _gistSeenContents = seen;
+          const list = Array.from(seen);
+          if (list.length === 0) return null;
+          return { contents: list, options: previewOptions() };
+        },
+        (data) => {
+          if (!data || !Array.isArray(data.contents)) return;
+          const seen = Array.from(_gistSeenContents);
+          const next = new Map();
+          for (let i = 0; i < seen.length && i < data.contents.length; i++) {
+            next.set(seen[i], data.contents[i]);
+          }
+          _gistAnonCache = next;
+        }
+      );
+
+      $scope.anonymizeGistContent = function (content) {
+        if (!content) return content;
+        if (_gistAnonCache.has(content)) return _gistAnonCache.get(content);
+        if (!_gistSeenContents.has(content)) {
+          refreshGistPreview();
+        }
+        return content;
+      };
+
       // ========== SHARED LOGIC ==========
       function getConference() {
         if (!$scope.conference) return;
@@ -1589,6 +1729,8 @@ angular
         setValidity("repoId", "format", true);
         setValidity("pullRequestId", "used", true);
         setValidity("pullRequestId", "format", true);
+        setValidity("gistId", "used", true);
+        setValidity("gistId", "format", true);
         setValidity("sourceUrl", "used", true);
         setValidity("sourceUrl", "missing", true);
         setValidity("sourceUrl", "access", true);
@@ -1599,7 +1741,12 @@ angular
       }
 
       function displayErrorMessage(message) {
-        const idField = $scope.detectedType === "pr" ? "pullRequestId" : "repoId";
+        const idField =
+          $scope.detectedType === "pr"
+            ? "pullRequestId"
+            : $scope.detectedType === "gist"
+            ? "gistId"
+            : "repoId";
         switch (message) {
           case "repoId_already_used": setValidity(idField, "used", false); break;
           case "invalid_repoId": setValidity(idField, "format", false); break;
@@ -1612,6 +1759,71 @@ angular
         }
       }
 
+      // ========== CO-AUTHORS ==========
+      $scope.coauthors = $scope.coauthors || [];
+      $scope.coauthorResults = [];
+      $scope.coauthorError = "";
+
+      $scope.searchCoauthors = () => {
+        const q = ($scope.coauthorSearch || "").trim();
+        $scope.coauthorError = "";
+        if (q.length < 2) {
+          $scope.coauthorResults = [];
+          return;
+        }
+        $http.get("/api/user/search/github-users", { params: { q } }).then(
+          (res) => {
+            const existing = new Set(
+              ($scope.coauthors || []).map((c) => (c.username || "").toLowerCase())
+            );
+            $scope.coauthorResults = (res.data || []).filter(
+              (u) => !existing.has((u.username || "").toLowerCase())
+            );
+          },
+          () => { $scope.coauthorResults = []; }
+        );
+      };
+
+      $scope.addCoauthor = (u, event) => {
+        if (event) event.preventDefault();
+        if (!u || !u.username) return;
+        $http
+          .post("/api/repo/" + $scope.repoId + "/coauthors", {
+            username: u.username,
+          })
+          .then(
+            (res) => {
+              $scope.coauthors = res.data || [];
+              $scope.coauthorResults = [];
+              $scope.coauthorSearch = "";
+              $scope.coauthorError = "";
+            },
+            (err) => {
+              const code = (err && err.data && err.data.error) || "unknown_error";
+              $scope.coauthorError = code;
+            }
+          );
+      };
+
+      $scope.removeCoauthor = (c) => {
+        if (!c || !c.username) return;
+        if (!confirm("Remove co-author " + c.username + "?")) return;
+        $http
+          .delete(
+            "/api/repo/" +
+              $scope.repoId +
+              "/coauthors/" +
+              encodeURIComponent(c.username)
+          )
+          .then(
+            (res) => { $scope.coauthors = res.data || []; },
+            (err) => {
+              const code = (err && err.data && err.data.error) || "unknown_error";
+              $scope.coauthorError = code;
+            }
+          );
+      };
+
       // Submit: repo
       $scope.anonymizeRepo = (event) => {
         event.target.disabled = true;
@@ -1639,6 +1851,30 @@ angular
         ).finally(() => { event.target.disabled = false; $scope.$apply(); });
       };
 
+      // Submit: Gist
+      $scope.anonymizeGist = (event) => {
+        event.target.disabled = true;
+        const o = parseGithubUrl($scope.sourceUrl);
+        const payload = {
+          gistId: $scope.gistId,
+          terms: $scope.terms.trim().split("\n").filter((f) => f),
+          source: { gistId: o.gistId },
+          options: $scope.options,
+          conference: $scope.conference,
+        };
+        resetValidity();
+        const url = $scope.isUpdate ? "/api/gist/" + $scope.gistId : "/api/gist/";
+        $http.post(url, payload, { headers: { "Content-Type": "application/json" } }).then(
+          () => { window.location.href = "/gist/" + $scope.gistId; },
+          (error) => {
+            if (error.data) {
+              $translate("ERRORS." + error.data.error).then((t) => { $scope.error = t; }, console.error);
+              displayErrorMessage(error.data.error);
+            }
+          }
+        ).finally(() => { event.target.disabled = false; $scope.$apply(); });
+      };
+
       // Submit: PR
       $scope.anonymizePullRequest = (event) => {
         event.target.disabled = true;
@@ -1667,17 +1903,21 @@ angular
       $scope.$watch("terms", () => {
         if ($scope.detectedType === "repo") anonymizeReadme();
         if ($scope.detectedType === "pr") refreshPrPreview();
+        if ($scope.detectedType === "gist") refreshGistPreview();
       });
       $scope.$watch("options.image", () => {
         if ($scope.detectedType === "repo") anonymizeReadme();
         if ($scope.detectedType === "pr") refreshPrPreview();
+        if ($scope.detectedType === "gist") refreshGistPreview();
       });
       $scope.$watch("options.link", () => {
         if ($scope.detectedType === "repo") anonymizeReadme();
         if ($scope.detectedType === "pr") refreshPrPreview();
+        if ($scope.detectedType === "gist") refreshGistPreview();
       });
       $scope.$watch("details", () => {
         if ($scope.detectedType === "pr") refreshPrPreview();
+        if ($scope.detectedType === "gist") refreshGistPreview();
       }, true);
     },
   ])
@@ -2187,6 +2427,51 @@ angular
       init();
     },
   ])
+  .controller("gistController", [
+    "$scope",
+    "$http",
+    "$location",
+    "$routeParams",
+    "$sce",
+    function ($scope, $http, $location, $routeParams, $sce) {
+      async function getOption(callback) {
+        $http.get(`/api/gist/${$scope.gistId}/options`).then(
+          (res) => {
+            $scope.options = res.data;
+            if ($scope.options.url) {
+              window.location = $scope.options.url;
+              return;
+            }
+            if (callback) callback(res.data);
+          },
+          (err) => {
+            $scope.type = "error";
+            $scope.content = err.data.error;
+          }
+        );
+      }
+      async function getGist(callback) {
+        $http.get(`/api/gist/${$scope.gistId}/content`).then(
+          (res) => {
+            $scope.details = res.data;
+            if (callback) callback(res.data);
+          },
+          (err) => {
+            $scope.type = "error";
+            $scope.content = err.data.error;
+          }
+        );
+      }
+
+      function init() {
+        $scope.gistId = $routeParams.gistId;
+        $scope.type = "loading";
+        getOption(() => { getGist(); });
+      }
+
+      init();
+    },
+  ])
   .controller("conferencesController", [
     "$scope",
     "$http",

public/script/utils.js

@@ -147,6 +147,17 @@ function generateRandomId(length) {
 
 function parseGithubUrl(url) {
   if (!url) throw "Invalid url";
+  // Gist URLs: https://gist.github.com/<owner>/<gistId> or
+  // https://gist.github.com/<gistId>
+  const gistMatch = url.match(
+    /gist\.github\.com\/(?:(?<owner>[\w-\._]+)\/)?(?<gist>[a-fA-F0-9]+)/
+  );
+  if (gistMatch && gistMatch.groups.gist) {
+    return {
+      owner: gistMatch.groups.owner,
+      gistId: gistMatch.groups.gist,
+    };
+  }
   const matches = url
     .replace(/\.git(\/|$)/, "$1")
     .match(

src/core/Gist.ts

@@ -0,0 +1,284 @@
+import { RepositoryStatus } from "./types";
+import User from "./User";
+import UserModel from "./model/users/users.model";
+import Conference from "./Conference";
+import ConferenceModel from "./model/conference/conferences.model";
+import AnonymousError from "./AnonymousError";
+import { IAnonymizedGistDocument } from "./model/anonymizedGists/anonymizedGists.types";
+import config from "../config";
+import { octokit } from "./GitHubUtils";
+import { ContentAnonimizer } from "./anonymize-utils";
+
+export default class Gist {
+  private _model: IAnonymizedGistDocument;
+  owner: User;
+
+  constructor(data: IAnonymizedGistDocument) {
+    this._model = data;
+    this.owner = new User(new UserModel({ _id: data.owner }));
+    this.owner.model.isNew = false;
+  }
+
+  async getToken() {
+    let owner = this.owner.model;
+    if (owner && !owner.accessTokens.github) {
+      const temp = await UserModel.findById(owner._id);
+      if (temp) {
+        owner = temp;
+      }
+    }
+    if (owner && owner.accessTokens && owner.accessTokens.github) {
+      if (owner.accessTokens.github != this._model.source.accessToken) {
+        this._model.source.accessToken = owner.accessTokens.github;
+      }
+      return owner.accessTokens.github;
+    }
+    if (this._model.source.accessToken) {
+      try {
+        return this._model.source.accessToken;
+      } catch {
+        console.debug("[ERROR] Token is invalid", this._model.source.gistId);
+      }
+    }
+    return config.GITHUB_TOKEN;
+  }
+
+  async download() {
+    console.debug("[INFO] Downloading gist", this._model.source.gistId);
+    const oct = octokit(await this.getToken());
+
+    const gist_id = this._model.source.gistId;
+
+    const [gistInfo, comments] = await Promise.all([
+      oct.rest.gists.get({ gist_id }),
+      oct.paginate("GET /gists/{gist_id}/comments", {
+        gist_id,
+        per_page: 100,
+      }),
+    ]);
+
+    const files = Object.values(gistInfo.data.files || {})
+      .filter((f): f is NonNullable<typeof f> => !!f)
+      .map((f) => ({
+        filename: f.filename || "",
+        content: f.content || "",
+        language: f.language || undefined,
+        size: f.size || 0,
+        type: f.type || undefined,
+      }));
+
+    this._model.gist = {
+      description: gistInfo.data.description || "",
+      isPublic: gistInfo.data.public,
+      creationDate: gistInfo.data.created_at
+        ? new Date(gistInfo.data.created_at)
+        : new Date(),
+      updatedDate: gistInfo.data.updated_at
+        ? new Date(gistInfo.data.updated_at)
+        : new Date(),
+      ownerLogin: gistInfo.data.owner?.login,
+      files,
+      comments: comments.map((comment) => ({
+        body: comment.body || "",
+        creationDate: new Date(comment.created_at),
+        updatedDate: new Date(comment.updated_at),
+        author: comment.user?.login || "",
+      })),
+    };
+  }
+
+  /**
+   * Check the status of the gist
+   */
+  async check() {
+    if (
+      this._model.options.expirationMode !== "never" &&
+      this.status == "ready" &&
+      this._model.options.expirationDate
+    ) {
+      if (this._model.options.expirationDate <= new Date()) {
+        await this.expire();
+      }
+    }
+    if (
+      this.status == "expired" ||
+      this.status == "expiring" ||
+      this.status == "removing" ||
+      this.status == "removed"
+    ) {
+      throw new AnonymousError("gist_expired", {
+        object: this,
+        httpStatus: 410,
+      });
+    }
+    const fiveMinuteAgo = new Date();
+    fiveMinuteAgo.setMinutes(fiveMinuteAgo.getMinutes() - 5);
+
+    if (
+      this.status == "preparing" ||
+      (this.status == "download" && this._model.statusDate > fiveMinuteAgo)
+    ) {
+      throw new AnonymousError("gist_not_ready", {
+        object: this,
+        httpStatus: 503,
+      });
+    }
+  }
+
+  async updateIfNeeded(opt?: { force: boolean }): Promise<void> {
+    const yesterday = new Date();
+    yesterday.setDate(yesterday.getDate() - 1);
+    if (
+      opt?.force ||
+      (this._model.options.update && this._model.anonymizeDate < yesterday)
+    ) {
+      await this.updateStatus(RepositoryStatus.DOWNLOAD);
+      await this.download();
+      this._model.anonymizeDate = new Date();
+      await this.updateStatus(RepositoryStatus.READY);
+      await this._model.save();
+    }
+  }
+
+  async anonymize() {
+    if (this.status === RepositoryStatus.READY) return;
+    await this.updateStatus(RepositoryStatus.PREPARING);
+    await this.updateIfNeeded({ force: true });
+    await this.updateStatus(RepositoryStatus.READY);
+  }
+
+  async countView() {
+    this._model.lastView = new Date();
+    this._model.pageView = (this._model.pageView || 0) + 1;
+    await this._model.save();
+  }
+
+  async updateStatus(status: RepositoryStatus, statusMessage?: string) {
+    this._model.status = status;
+    this._model.statusDate = new Date();
+    this._model.statusMessage = statusMessage;
+    await this._model.save();
+  }
+
+  async expire() {
+    await this.updateStatus(RepositoryStatus.EXPIRING);
+    await this.resetSate();
+    await this.updateStatus(RepositoryStatus.EXPIRED);
+  }
+
+  async remove() {
+    await this.updateStatus(RepositoryStatus.REMOVING);
+    await this.resetSate();
+    await this.updateStatus(RepositoryStatus.REMOVED);
+  }
+
+  async resetSate(status?: RepositoryStatus, statusMessage?: string) {
+    if (status) this._model.status = status;
+    if (statusMessage) this._model.statusMessage = statusMessage;
+    this._model.gist.comments = [];
+    this._model.gist.description = "";
+    this._model.gist.files = [];
+    this._model.gist.ownerLogin = "";
+    await this._model.save();
+  }
+
+  async conference(): Promise<Conference | null> {
+    if (!this._model.conference) {
+      return null;
+    }
+    const conference = await ConferenceModel.findOne({
+      conferenceID: this._model.conference,
+    });
+    if (conference) return new Conference(conference);
+    return null;
+  }
+
+  content() {
+    const output: Record<string, unknown> = {
+      anonymizeDate: this._model.anonymizeDate,
+      isPublic: this._model.gist.isPublic,
+    };
+    const anonymizer = new ContentAnonimizer({
+      ...this.options,
+      repoId: this.gistId,
+    });
+    if (this.options.title) {
+      output.description = anonymizer.anonymize(this._model.gist.description);
+    }
+    if (this.options.username) {
+      output.ownerLogin = anonymizer.anonymize(
+        this._model.gist.ownerLogin || ""
+      );
+    }
+    if (this.options.content) {
+      output.files = (this._model.gist.files || []).map((f) => ({
+        filename: anonymizer.anonymize(f.filename),
+        content: anonymizer.anonymize(f.content),
+        language: f.language,
+        size: f.size,
+        type: f.type,
+      }));
+    }
+    if (this.options.comments) {
+      output.comments = this._model.gist.comments?.map((comment) => {
+        const o: Record<string, unknown> = {};
+        if (this.options.body) o.body = anonymizer.anonymize(comment.body);
+        if (this.options.username)
+          o.author = anonymizer.anonymize(comment.author);
+        if (this.options.date) {
+          o.updatedDate = comment.updatedDate;
+          o.creationDate = comment.creationDate;
+        }
+        return o;
+      });
+    }
+    if (this.options.origin) {
+      output.sourceGistId = this._model.source.gistId;
+    }
+    if (this.options.date) {
+      output.updatedDate = this._model.gist.updatedDate;
+      output.creationDate = this._model.gist.creationDate;
+    }
+    return output;
+  }
+
+  /***** Getters ********/
+
+  get gistId() {
+    return this._model.gistId;
+  }
+
+  get options() {
+    return this._model.options;
+  }
+
+  get source() {
+    return this._model.source;
+  }
+
+  get model() {
+    return this._model;
+  }
+
+  get status() {
+    return this._model.status;
+  }
+
+  toJSON() {
+    return {
+      gistId: this._model.gistId,
+      options: this._model.options,
+      conference: this._model.conference,
+      anonymizeDate: this._model.anonymizeDate,
+      status: this._model.status,
+      isPublic: this._model.gist.isPublic,
+      statusMessage: this._model.statusMessage,
+      source: {
+        gistId: this._model.source.gistId,
+      },
+      gist: this._model.gist,
+      lastView: this._model.lastView,
+      pageView: this._model.pageView,
+    };
+  }
+}

src/core/Repository.ts

@@ -520,6 +520,10 @@ export default class Repository {
     return this._model.options;
   }
 
+  get coauthors() {
+    return this._model.coauthors || [];
+  }
+
   get model() {
     return this._model;
   }
@@ -537,6 +541,11 @@ export default class Repository {
     return {
       repoId: this._model.repoId,
       options: this._model.options,
+      coauthors: (this._model.coauthors || []).map((c) => ({
+        username: c.username,
+        githubId: c.githubId,
+        photo: c.photo,
+      })),
       conference: this._model.conference,
       anonymizeDate: this._model.anonymizeDate,
       status: this.status,

src/core/User.ts

@@ -5,6 +5,8 @@ import Repository from "./Repository";
 import { GitHubRepository } from "./source/GitHubRepository";
 import PullRequest from "./PullRequest";
 import AnonymizedPullRequestModel from "./model/anonymizedPullRequests/anonymizedPullRequests.model";
+import Gist from "./Gist";
+import AnonymizedGistModel from "./model/anonymizedGists/anonymizedGists.model";
 import { octokit } from "./GitHubUtils";
 
 /**
@@ -119,10 +121,11 @@ export default class User {
    * @returns the list of anonymized repositories
    */
   async getRepositories() {
+    const query: Record<string, unknown> = this.username
+      ? { $or: [{ owner: this.id }, { "coauthors.username": this.username }] }
+      : { owner: this.id };
     const repositories = (
-      await AnonymizedRepositoryModel.find({
+      await AnonymizedRepositoryModel.find(query).exec()
-        owner: this.id,
-      }).exec()
     ).map((d) => new Repository(d));
     const promises = [];
     for (const repo of repositories) {
@@ -165,6 +168,28 @@ export default class User {
     return pullRequests;
   }
 
+  /**
+   * Get the list of anonymized gists
+   */
+  async getGists() {
+    const gists = (
+      await AnonymizedGistModel.find({ owner: this.id }).exec()
+    ).map((d) => new Gist(d));
+    const promises = [];
+    for (const g of gists) {
+      if (
+        g.status == "ready" &&
+        g.options.expirationMode != "never" &&
+        g.options.expirationDate != null &&
+        g.options.expirationDate < new Date()
+      ) {
+        promises.push(g.expire());
+      }
+    }
+    await Promise.all(promises);
+    return gists;
+  }
+
   get model() {
     return this._model;
   }

src/core/model/anonymizedGists/anonymizedGists.model.ts

@@ -0,0 +1,14 @@
+import { model } from "mongoose";
+
+import AnonymizedGistSchema from "./anonymizedGists.schema";
+import {
+  IAnonymizedGistDocument,
+  IAnonymizedGistModel,
+} from "./anonymizedGists.types";
+
+const AnonymizedGistModel = model<IAnonymizedGistDocument>(
+  "AnonymizedGist",
+  AnonymizedGistSchema
+) as IAnonymizedGistModel;
+
+export default AnonymizedGistModel;

src/core/model/anonymizedGists/anonymizedGists.schema.ts

@@ -0,0 +1,68 @@
+import { Schema } from "mongoose";
+
+const AnonymizedGistSchema = new Schema({
+  gistId: {
+    type: String,
+    index: { unique: true },
+  },
+  status: {
+    type: String,
+    default: "preparing",
+  },
+  statusDate: Date,
+  statusMessage: String,
+  anonymizeDate: Date,
+  lastView: Date,
+  pageView: Number,
+  owner: Schema.Types.ObjectId,
+  conference: String,
+  source: {
+    gistId: String,
+    accessToken: String,
+  },
+  options: {
+    terms: [String],
+    expirationMode: { type: String },
+    expirationDate: Date,
+    update: Boolean,
+    image: Boolean,
+    link: Boolean,
+    title: Boolean,
+    body: Boolean,
+    comments: Boolean,
+    content: Boolean,
+    origin: Boolean,
+    username: Boolean,
+    date: Boolean,
+  },
+  dateOfEntry: {
+    type: Date,
+    default: new Date(),
+  },
+  gist: {
+    description: String,
+    isPublic: Boolean,
+    creationDate: Date,
+    updatedDate: Date,
+    ownerLogin: String,
+    files: [
+      {
+        filename: String,
+        content: String,
+        language: String,
+        size: Number,
+        type: String,
+      },
+    ],
+    comments: [
+      {
+        body: String,
+        creationDate: Date,
+        updatedDate: Date,
+        author: String,
+      },
+    ],
+  },
+});
+
+export default AnonymizedGistSchema;

src/core/model/anonymizedGists/anonymizedGists.types.ts

@@ -0,0 +1,58 @@
+import { Document, Model } from "mongoose";
+import { RepositoryStatus } from "../../types";
+
+export interface IAnonymizedGist {
+  gistId: string;
+  status?: RepositoryStatus;
+  statusMessage?: string;
+  statusDate: Date;
+  anonymizeDate: Date;
+  source: {
+    gistId: string;
+    accessToken?: string;
+  };
+  owner: string;
+  conference: string;
+  options: {
+    terms: string[];
+    expirationMode: "never" | "redirect" | "remove";
+    expirationDate?: Date;
+    update: boolean;
+    image: boolean;
+    link: boolean;
+    title: boolean;
+    body: boolean;
+    comments: boolean;
+    content: boolean;
+    origin: boolean;
+    username: boolean;
+    date: boolean;
+  };
+  pageView: number;
+  lastView: Date;
+  gist: {
+    description: string;
+    isPublic?: boolean;
+    creationDate: Date;
+    updatedDate: Date;
+    ownerLogin?: string;
+    files?: {
+      filename: string;
+      content: string;
+      language?: string;
+      size?: number;
+      type?: string;
+    }[];
+    comments?: {
+      body: string;
+      creationDate: Date;
+      updatedDate: Date;
+      author: string;
+    }[];
+  };
+}
+
+export interface IAnonymizedGistDocument extends IAnonymizedGist, Document {
+  setLastUpdated: (this: IAnonymizedGistDocument) => Promise<void>;
+}
+export interface IAnonymizedGistModel extends Model<IAnonymizedGistDocument> {}

src/core/model/anonymizedRepositories/anonymizedRepositories.schema.ts

@@ -20,6 +20,14 @@ const AnonymizedRepositorySchema = new Schema({
     ref: "user",
     index: true,
   },
+  coauthors: [
+    {
+      username: { type: String, index: true },
+      githubId: { type: String },
+      photo: { type: String },
+      addedAt: { type: Date, default: Date.now },
+    },
+  ],
   conference: String,
   source: {
     type: { type: String },

src/core/model/anonymizedRepositories/anonymizedRepositories.types.ts

@@ -17,6 +17,12 @@ export interface IAnonymizedRepository {
     accessToken?: string;
   };
   owner: string;
+  coauthors?: {
+    username: string;
+    githubId?: string;
+    photo?: string;
+    addedAt?: Date;
+  }[];
   truncatedFolders: string[];
   conference: string;
   options: {

src/server/database.ts

@@ -5,6 +5,8 @@ import AnonymizedRepositoryModel from "../core/model/anonymizedRepositories/anon
 import AnonymousError from "../core/AnonymousError";
 import AnonymizedPullRequestModel from "../core/model/anonymizedPullRequests/anonymizedPullRequests.model";
 import PullRequest from "../core/PullRequest";
+import AnonymizedGistModel from "../core/model/anonymizedGists/anonymizedGists.model";
+import Gist from "../core/Gist";
 
 const MONGO_URL = `mongodb://${config.DB_USERNAME}:${config.DB_PASSWORD}@${config.DB_HOSTNAME}:27017/`;
 
@@ -59,3 +61,20 @@ export async function getPullRequest(pullRequestId: string) {
     });
   return new PullRequest(data);
 }
+export async function getGist(gistId: string) {
+  if (!gistId || gistId == "undefined") {
+    throw new AnonymousError("gist_not_found", {
+      object: gistId,
+      httpStatus: 404,
+    });
+  }
+  const data = await AnonymizedGistModel.findOne({
+    gistId,
+  });
+  if (!data)
+    throw new AnonymousError("gist_not_found", {
+      object: gistId,
+      httpStatus: 404,
+    });
+  return new Gist(data);
+}

src/server/index.ts

@@ -161,6 +161,8 @@ export default async function start() {
   apiRouter.use("/repo", speedLimiter, router.repositoryPrivate);
   apiRouter.use("/pr", speedLimiter, router.pullRequestPublic);
   apiRouter.use("/pr", speedLimiter, router.pullRequestPrivate);
+  apiRouter.use("/gist", speedLimiter, router.gistPublic);
+  apiRouter.use("/gist", speedLimiter, router.gistPrivate);
   apiRouter.use("/anonymize-preview", speedLimiter, router.anonymizePreview);
 
   apiRouter.get("/message", async (_, res) => {

src/server/routes/gist-private.ts

@@ -0,0 +1,224 @@
+import * as express from "express";
+import { ensureAuthenticated } from "./connection";
+
+import { getGist, getUser, handleError, isOwnerOrAdmin } from "./route-utils";
+import AnonymousError from "../../core/AnonymousError";
+import { IAnonymizedGistDocument } from "../../core/model/anonymizedGists/anonymizedGists.types";
+import Gist from "../../core/Gist";
+import AnonymizedGistModel from "../../core/model/anonymizedGists/anonymizedGists.model";
+import { RepositoryStatus } from "../../core/types";
+
+const router = express.Router();
+
+// user needs to be connected for all user API
+router.use(ensureAuthenticated);
+
+// refresh gist
+router.post(
+  "/:gistId/refresh",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+
+      const user = await getUser(req);
+      isOwnerOrAdmin([gist.owner.id], user);
+      await gist.updateIfNeeded({ force: true });
+      res.json({ status: gist.status });
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// delete a gist
+router.delete(
+  "/:gistId/",
+  async (req: express.Request, res: express.Response) => {
+    const gist = await getGist(req, res, { nocheck: true });
+    if (!gist) return;
+    try {
+      if (gist.status == "removed")
+        throw new AnonymousError("is_removed", {
+          object: req.params.gistId,
+          httpStatus: 410,
+        });
+      const user = await getUser(req);
+      isOwnerOrAdmin([gist.owner.id], user);
+      await gist.remove();
+      return res.json({ status: gist.status });
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// fetch GitHub gist details (used by anonymize form)
+router.get(
+  "/source/:gistId",
+  async (req: express.Request, res: express.Response) => {
+    const user = await getUser(req);
+    try {
+      const gist = new Gist(
+        new AnonymizedGistModel({
+          owner: user.id,
+          source: {
+            gistId: req.params.gistId,
+          },
+        })
+      );
+      gist.owner = user;
+      await gist.download();
+      res.json(gist.toJSON());
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// get gist information
+router.get(
+  "/:gistId/",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+
+      const user = await getUser(req);
+      isOwnerOrAdmin([gist.owner.id], user);
+      res.json(gist.toJSON());
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function validateNewGist(gistUpdate: any): void {
+  const validCharacters = /^[0-9a-zA-Z\-_]+$/;
+  if (
+    !gistUpdate.gistId ||
+    !gistUpdate.gistId.match(validCharacters) ||
+    gistUpdate.gistId.length < 3
+  ) {
+    throw new AnonymousError("invalid_gistId", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+  if (!gistUpdate.source || !gistUpdate.source.gistId) {
+    throw new AnonymousError("gistId_not_specified", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+  if (!gistUpdate.options) {
+    throw new AnonymousError("options_not_provided", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+  if (!Array.isArray(gistUpdate.terms)) {
+    throw new AnonymousError("invalid_terms_format", {
+      object: gistUpdate,
+      httpStatus: 400,
+    });
+  }
+}
+
+function updateGistModel(
+  model: IAnonymizedGistDocument,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  gistUpdate: any
+) {
+  model.options = {
+    terms: gistUpdate.terms,
+    expirationMode: gistUpdate.options.expirationMode,
+    expirationDate: gistUpdate.options.expirationDate
+      ? new Date(gistUpdate.options.expirationDate)
+      : undefined,
+    update: gistUpdate.options.update,
+    image: gistUpdate.options.image,
+    link: gistUpdate.options.link,
+    body: gistUpdate.options.body,
+    title: gistUpdate.options.title,
+    username: gistUpdate.options.username,
+    origin: gistUpdate.options.origin,
+    content: gistUpdate.options.content,
+    comments: gistUpdate.options.comments,
+    date: gistUpdate.options.date,
+  };
+}
+
+// update a gist
+router.post(
+  "/:gistId/",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+      const user = await getUser(req);
+
+      isOwnerOrAdmin([gist.owner.id], user);
+      const gistUpdate = req.body;
+      validateNewGist(gistUpdate);
+      gist.model.anonymizeDate = new Date();
+
+      updateGistModel(gist.model, gistUpdate);
+      gist.model.conference = gistUpdate.conference;
+      await gist.updateStatus(RepositoryStatus.PREPARING);
+      await gist.updateIfNeeded({ force: true });
+      res.json(gist.toJSON());
+    } catch (error) {
+      return handleError(error, res, req);
+    }
+  }
+);
+
+// add gist
+router.post("/", async (req: express.Request, res: express.Response) => {
+  const user = await getUser(req);
+  const gistUpdate = req.body;
+
+  try {
+    validateNewGist(gistUpdate);
+
+    const gist = new Gist(
+      new AnonymizedGistModel({
+        owner: user.id,
+        options: gistUpdate.options,
+      })
+    );
+
+    gist.model.gistId = gistUpdate.gistId;
+    gist.model.anonymizeDate = new Date();
+    gist.model.owner = user.id;
+
+    updateGistModel(gist.model, gistUpdate);
+    gist.source.accessToken = user.accessToken;
+    gist.source.gistId = gistUpdate.source.gistId;
+
+    gist.model.conference = gistUpdate.conference;
+
+    await gist.anonymize();
+    res.send(gist.toJSON());
+  } catch (error) {
+    if (
+      error instanceof Error &&
+      error.message.indexOf(" duplicate key") > -1
+    ) {
+      return handleError(
+        new AnonymousError("gistId_already_used", {
+          httpStatus: 400,
+          cause: error,
+          object: gistUpdate,
+        }),
+        res,
+        req
+      );
+    }
+    return handleError(error, res, req);
+  }
+});
+
+export default router;

src/server/routes/gist-public.ts

@@ -0,0 +1,85 @@
+import * as express from "express";
+
+import { getGist, handleError } from "./route-utils";
+import AnonymousError from "../../core/AnonymousError";
+
+const router = express.Router();
+
+router.get(
+  "/:gistId/options",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      res.header("Cache-Control", "no-cache");
+      const gist = await getGist(req, res, { nocheck: true });
+      if (!gist) return;
+      let redirectURL = null;
+      if (
+        gist.status == "expired" &&
+        gist.options.expirationMode == "redirect"
+      ) {
+        redirectURL = `https://gist.github.com/${gist.source.gistId}`;
+      } else {
+        if (
+          gist.status == "expired" ||
+          gist.status == "expiring" ||
+          gist.status == "removing" ||
+          gist.status == "removed"
+        ) {
+          throw new AnonymousError("gist_expired", {
+            object: gist,
+            httpStatus: 410,
+          });
+        }
+
+        const fiveMinuteAgo = new Date();
+        fiveMinuteAgo.setMinutes(fiveMinuteAgo.getMinutes() - 5);
+        if (gist.status != "ready") {
+          if (gist.model.statusDate < fiveMinuteAgo) {
+            await gist.updateIfNeeded({ force: true });
+          }
+          if (gist.status == "error") {
+            throw new AnonymousError(
+              gist.model.statusMessage
+                ? gist.model.statusMessage
+                : "gist_not_available",
+              {
+                object: gist,
+                httpStatus: 500,
+              }
+            );
+          }
+          throw new AnonymousError("gist_not_ready", {
+            httpStatus: 404,
+            object: gist,
+          });
+        }
+
+        await gist.updateIfNeeded();
+      }
+
+      res.json({
+        url: redirectURL,
+        lastUpdateDate: gist.model.statusDate,
+      });
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+router.get(
+  "/:gistId/content",
+  async (req: express.Request, res: express.Response) => {
+    const gist = await getGist(req, res);
+    if (!gist) return;
+    try {
+      await gist.countView();
+      res.header("Cache-Control", "no-cache");
+      res.json(gist.content());
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+export default router;

src/server/routes/index.ts

@@ -1,5 +1,7 @@
 import pullRequestPrivate from "./pullRequest-private";
 import pullRequestPublic from "./pullRequest-public";
+import gistPrivate from "./gist-private";
+import gistPublic from "./gist-public";
 import repositoryPrivate from "./repository-private";
 import repositoryPublic from "./repository-public";
 import conference from "./conference";
@@ -13,6 +15,8 @@ import anonymizePreview from "./anonymize-preview";
 export default {
   pullRequestPrivate,
   pullRequestPublic,
+  gistPrivate,
+  gistPublic,
   repositoryPrivate,
   repositoryPublic,
   file,

src/server/routes/repository-private.ts

@@ -2,7 +2,13 @@ import * as express from "express";
 import { ensureAuthenticated } from "./connection";
 
 import * as db from "../database";
-import { getRepo, getUser, handleError, isOwnerOrAdmin } from "./route-utils";
+import {
+  getRepo,
+  getUser,
+  handleError,
+  isOwnerOrAdmin,
+  isOwnerCoauthorOrAdmin,
+} from "./route-utils";
 import { getRepositoryFromGitHub } from "../../core/source/GitHubRepository";
 import gh = require("parse-github-url");
 import AnonymizedRepositoryModel from "../../core/model/anonymizedRepositories/anonymizedRepositories.model";
@@ -16,7 +22,7 @@ import RepositoryModel from "../../core/model/repositories/repositories.model";
 import User from "../../core/User";
 import { RepositoryStatus } from "../../core/types";
 import { IUserDocument } from "../../core/model/users/users.types";
-import { checkToken } from "../../core/GitHubUtils";
+import { checkToken, octokit } from "../../core/GitHubUtils";
 
 const router = express.Router();
 
@@ -142,7 +148,7 @@ router.post(
         return;
 
       const user = await getUser(req);
-      isOwnerOrAdmin([repo.owner.id], user);
+      isOwnerCoauthorOrAdmin(repo, user);
       await repo.updateIfNeeded({ force: true });
       res.json({ status: repo.status });
     } catch (error) {
@@ -273,8 +279,17 @@ router.get("/:repoId/", async (req: express.Request, res: express.Response) => {
     if (!repo) return;
 
     const user = await getUser(req);
-    isOwnerOrAdmin([repo.owner.id], user);
+    isOwnerCoauthorOrAdmin(repo, user);
-    res.json((await db.getRepository(req.params.repoId)).toJSON());
+    const fullRepo = await db.getRepository(req.params.repoId);
+    const json = fullRepo.toJSON() as Record<string, unknown>;
+    json.ownerId = fullRepo.owner.id;
+    json.role =
+      user.isAdmin && fullRepo.owner.id !== user.model.id
+        ? "admin"
+        : fullRepo.owner.id === user.model.id
+        ? "owner"
+        : "coauthor";
+    res.json(json);
   } catch (error) {
     handleError(error, res, req);
   }
@@ -359,7 +374,7 @@ router.post(
       if (!repo) return;
       const user = await getUser(req);
 
-      isOwnerOrAdmin([repo.owner.id], user);
+      isOwnerCoauthorOrAdmin(repo, user);
 
       const repoUpdate = req.body;
 
@@ -567,4 +582,108 @@ router.post("/", async (req: express.Request, res: express.Response) => {
   }
 });
 
+// list coauthors
+router.get(
+  "/:repoId/coauthors",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const repo = await getRepo(req, res, { nocheck: true });
+      if (!repo) return;
+      const user = await getUser(req);
+      isOwnerCoauthorOrAdmin(repo, user);
+      res.json(repo.coauthors);
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// add a coauthor (owner/admin only)
+router.post(
+  "/:repoId/coauthors",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const repo = await getRepo(req, res, { nocheck: true });
+      if (!repo) return;
+      const user = await getUser(req);
+      isOwnerOrAdmin([repo.owner.id], user);
+
+      const username = (req.body.username || "").trim();
+      if (!username) {
+        throw new AnonymousError("username_not_defined", {
+          object: req.body,
+          httpStatus: 400,
+        });
+      }
+
+      // verify the GitHub user exists and capture identity fields
+      const oct = octokit(user.accessToken);
+      let ghUser;
+      try {
+        const r = await oct.users.getByUsername({ username });
+        ghUser = r.data;
+      } catch (e) {
+        throw new AnonymousError("github_user_not_found", {
+          object: { username },
+          httpStatus: 404,
+        });
+      }
+
+      if (ghUser.login.toLowerCase() === user.username.toLowerCase()) {
+        throw new AnonymousError("cannot_coauthor_self", {
+          httpStatus: 400,
+        });
+      }
+
+      const list = repo.model.coauthors || [];
+      if (
+        list.some(
+          (c) => c.username.toLowerCase() === ghUser.login.toLowerCase()
+        )
+      ) {
+        return res.json(list);
+      }
+      list.push({
+        username: ghUser.login,
+        githubId: String(ghUser.id),
+        photo: ghUser.avatar_url,
+        addedAt: new Date(),
+      });
+      repo.model.coauthors = list;
+      await repo.model.save();
+      res.json(repo.model.coauthors);
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
+// remove a coauthor (owner/admin only, or the coauthor themselves)
+router.delete(
+  "/:repoId/coauthors/:username",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const repo = await getRepo(req, res, { nocheck: true });
+      if (!repo) return;
+      const user = await getUser(req);
+      const target = req.params.username;
+      const isOwner = repo.owner.id === user.model.id;
+      const isSelf =
+        !!user.username &&
+        user.username.toLowerCase() === target.toLowerCase();
+      if (!isOwner && !isSelf && !user.isAdmin) {
+        throw new AnonymousError("not_authorized", { httpStatus: 401 });
+      }
+
+      repo.model.coauthors = (repo.model.coauthors || []).filter(
+        (c) => c.username.toLowerCase() !== target.toLowerCase()
+      );
+      await repo.model.save();
+      res.json(repo.model.coauthors);
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
 export default router;

src/server/routes/route-utils.ts

@@ -3,9 +3,35 @@ import AnonymousError from "../../core/AnonymousError";
 import * as db from "../database";
 import UserModel from "../../core/model/users/users.model";
 import User from "../../core/User";
+import Repository from "../../core/Repository";
 import { HTTPError } from "got";
 import { RepositoryStatus } from "../../core/types";
 
+export async function getGist(
+  req: express.Request,
+  res: express.Response,
+  opt?: { nocheck?: boolean }
+) {
+  try {
+    const gist = await db.getGist(req.params.gistId);
+    if (opt?.nocheck !== true) {
+      if (
+        gist.status == "expired" &&
+        gist.options.expirationMode == "redirect"
+      ) {
+        res.redirect(`https://gist.github.com/${gist.source.gistId}`);
+        return null;
+      }
+
+      await gist.check();
+    }
+    return gist;
+  } catch (error) {
+    handleError(error, res, req);
+    return null;
+  }
+}
+
 export async function getPullRequest(
   req: express.Request,
   res: express.Response,
@@ -71,6 +97,20 @@ export function isOwnerOrAdmin(authorizedUsers: string[], user: User) {
   }
 }
 
+export function isCoauthor(repo: Repository, user: User): boolean {
+  if (!user.username) return false;
+  return (repo.model.coauthors || []).some((c) => c.username === user.username);
+}
+
+export function isOwnerCoauthorOrAdmin(repo: Repository, user: User) {
+  if (user.isAdmin) return;
+  if (repo.owner.id === user.model.id) return;
+  if (isCoauthor(repo, user)) return;
+  throw new AnonymousError("not_authorized", {
+    httpStatus: 401,
+  });
+}
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function printError(error: any, req?: express.Request) {
   if (error instanceof AnonymousError) {

src/server/routes/user.ts

@@ -6,6 +6,7 @@ import UserModel from "../../core/model/users/users.model";
 import User from "../../core/User";
 import FileModel from "../../core/model/files/files.model";
 import { isConnected } from "../database";
+import { octokit } from "../../core/GitHubUtils";
 
 const router = express.Router();
 
@@ -41,7 +42,9 @@ router.get("/", async (req: express.Request, res: express.Response) => {
 router.get("/quota", async (req: express.Request, res: express.Response) => {
   try {
     const user = await getUser(req);
-    const repositories = await user.getRepositories();
+    const repositories = (await user.getRepositories()).filter(
+      (r) => r.owner.id === user.model.id
+    );
     const ready = repositories.filter((r) => r.status == "ready");
 
     let totalStorage = 0;
@@ -138,6 +141,23 @@ router.get(
       const user = await getUser(req);
       res.json(
         (await user.getRepositories()).map((x) => {
+          const json = x.toJSON() as Record<string, unknown>;
+          json.role = x.owner.id === user.model.id ? "owner" : "coauthor";
+          return json;
+        })
+      );
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+router.get(
+  "/anonymized_gists",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const user = await getUser(req);
+      res.json(
+        (await user.getGists()).map((x) => {
           return x.toJSON();
         })
       );
@@ -162,6 +182,31 @@ router.get(
   }
 );
 
+// search GitHub users (used by the coauthor picker)
+router.get(
+  "/search/github-users",
+  async (req: express.Request, res: express.Response) => {
+    try {
+      const user = await getUser(req);
+      const q = (req.query.q as string) || "";
+      if (!q || q.length < 2) {
+        return res.json([]);
+      }
+      const oct = octokit(user.accessToken);
+      const r = await oct.search.users({ q, per_page: 10 });
+      res.json(
+        r.data.items.map((u) => ({
+          username: u.login,
+          githubId: String(u.id),
+          photo: u.avatar_url,
+        }))
+      );
+    } catch (error) {
+      handleError(error, res, req);
+    }
+  }
+);
+
 async function getAllRepositories(user: User, force: boolean) {
   const repos = await user.getGitHubRepositories({
     force,