From 6058b1c2d07c1daae797a8ec4a710741fa7aafd9 Mon Sep 17 00:00:00 2001
From: Anirudh Oppiliappan <x@icyphox.sh>
Date: Tue, 28 Jan 2025 22:07:48 +0200
Subject: [PATCH] repoguard: resolve handle to did and compare that to parent
 directory

---
 cmd/repoguard/main.go | 43 +++++++++++++++++++++++++++++--------------
 routes/auth/auth.go   |  6 +++---
 2 files changed, 32 insertions(+), 17 deletions(-)

diff --git a/cmd/repoguard/main.go b/cmd/repoguard/main.go
index 2eafdf7..f780eb6 100644
--- a/cmd/repoguard/main.go
+++ b/cmd/repoguard/main.go
@@ -1,14 +1,18 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"log"
 	"os"
 	"os/exec"
+	"path"
 	"path/filepath"
 	"strings"
 	"time"
+
+	"github.com/icyphox/bild/routes/auth"
 )
 
 var (
@@ -58,7 +62,10 @@ func main() {
 	}
 
 	gitCommand := cmdParts[0]
-	repoName := strings.Trim(cmdParts[1], "'")
+
+	// example.com/repo
+	handlePath := strings.Trim(cmdParts[1], "'")
+	repoName := handleToDID(handlePath)
 
 	validCommands := map[string]bool{
 		"git-receive-pack":   true,
@@ -69,8 +76,11 @@ func main() {
 		exitWithLog("access denied: invalid git command")
 	}
 
-	if !isAllowedUser(*allowedUser, repoName) {
-		exitWithLog("access denied: user not allowed")
+	did := path.Dir(repoName)
+	if gitCommand != "git-upload-pack" {
+		if !isAllowedUser(*allowedUser, did) {
+			exitWithLog("access denied: user not allowed")
+		}
 	}
 
 	fullPath := filepath.Join(*baseDirFlag, repoName)
@@ -101,6 +111,20 @@ func main() {
 	})
 }
 
+func handleToDID(handlePath string) string {
+	handle := path.Dir(handlePath)
+
+	ident, err := auth.ResolveIdent(context.Background(), handle)
+	if err != nil {
+		exitWithLog(fmt.Sprintf("error resolving handle: %v", err))
+	}
+
+	// did:plc:foobarbaz/repo
+	didPath := filepath.Join(ident.DID.String(), path.Base(handlePath))
+
+	return didPath
+}
+
 func initLogger() {
 	var err error
 	logFile, err = os.OpenFile(*logPathFlag, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)
@@ -142,15 +166,6 @@ func cleanup() {
 	}
 }
 
-func isAllowedUser(user, repoPath string) bool {
-	fullPath := filepath.Join(*baseDirFlag, repoPath)
-	didPath := filepath.Join(fullPath, "did")
-
-	didBytes, err := os.ReadFile(didPath)
-	if err != nil {
-		return false
-	}
-
-	allowedUser := strings.TrimSpace(string(didBytes))
-	return allowedUser == user
+func isAllowedUser(user, did string) bool {
+	return user == did
 }
diff --git a/routes/auth/auth.go b/routes/auth/auth.go
index cf4eb3b..bd315d8 100644
--- a/routes/auth/auth.go
+++ b/routes/auth/auth.go
@@ -21,7 +21,7 @@ func NewAuth(store sessions.Store) *Auth {
 	return &Auth{store}
 }
 
-func resolveIdent(ctx context.Context, arg string) (*identity.Identity, error) {
+func ResolveIdent(ctx context.Context, arg string) (*identity.Identity, error) {
 	id, err := syntax.ParseAtIdentifier(arg)
 	if err != nil {
 		return nil, err
@@ -57,7 +57,7 @@ func (a *Auth) AuthorizedClient(r *http.Request) (*xrpc.Client, error) {
 
 func (a *Auth) CreateInitialSession(w http.ResponseWriter, r *http.Request, username, appPassword string) (AtSessionCreate, error) {
 	ctx := r.Context()
-	resolved, err := resolveIdent(ctx, username)
+	resolved, err := ResolveIdent(ctx, username)
 	if err != nil {
 		return AtSessionCreate{}, fmt.Errorf("invalid handle: %s", err)
 	}
@@ -118,5 +118,5 @@ func (a *Auth) GetSessionUser(r *http.Request) (*identity.Identity, error) {
 		return nil, fmt.Errorf("user is not authenticated")
 	}
 
-	return resolveIdent(r.Context(), did)
+	return ResolveIdent(r.Context(), did)
 }
-- 
2.51.2