Something went wrong. Try again.
forked from tangled.org/core
Something went wrong. Try again.
33 kB · 1380 lines
Go
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381package knotserver
import ( "compress/gzip" "context" "crypto/hmac" "crypto/sha256" "encoding/hex" "encoding/json" "errors" "fmt" "log" "net/http" "net/url" "os" "path" "path/filepath" "strconv" "strings" "sync" "time"
securejoin "github.com/cyphar/filepath-securejoin" "github.com/gliderlabs/ssh" "github.com/go-chi/chi/v5" "github.com/go-enry/go-enry/v2" gogit "github.com/go-git/go-git/v5" "github.com/go-git/go-git/v5/plumbing" "github.com/go-git/go-git/v5/plumbing/object" "tangled.sh/tangled.sh/core/hook" "tangled.sh/tangled.sh/core/knotserver/db" "tangled.sh/tangled.sh/core/knotserver/git" "tangled.sh/tangled.sh/core/patchutil" "tangled.sh/tangled.sh/core/types")
func (h *Handle) Index(w http.ResponseWriter, r *http.Request) { w.Write([]byte("This is a knot server. More info at https://tangled.sh"))}
func (h *Handle) Capabilities(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json")
capabilities := map[string]any{ "pull_requests": map[string]any{ "format_patch": true, "patch_submissions": true, "branch_submissions": true, "fork_submissions": true, }, }
jsonData, err := json.Marshal(capabilities) if err != nil { http.Error(w, "Failed to serialize JSON", http.StatusInternalServerError) return }
w.Write(jsonData)}
func (h *Handle) RepoIndex(w http.ResponseWriter, r *http.Request) { path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) l := h.l.With("path", path, "handler", "RepoIndex") ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
gr, err := git.Open(path, ref) if err != nil { plain, err2 := git.PlainOpen(path) if err2 != nil { l.Error("opening repo", "error", err2.Error()) notFound(w) return } branches, _ := plain.Branches()
log.Println(err)
if errors.Is(err, plumbing.ErrReferenceNotFound) { resp := types.RepoIndexResponse{ IsEmpty: true, Branches: branches, } writeJSON(w, resp) return } else { l.Error("opening repo", "error", err.Error()) notFound(w) return } }
var ( commits []*object.Commit total int branches []types.Branch files []types.NiceTree tags []*git.TagReference )
var wg sync.WaitGroup errorsCh := make(chan error, 5)
wg.Add(1) go func() { defer wg.Done() cs, err := gr.Commits(0, 60) if err != nil { errorsCh <- fmt.Errorf("commits: %w", err) return } commits = cs }()
wg.Add(1) go func() { defer wg.Done() t, err := gr.TotalCommits() if err != nil { errorsCh <- fmt.Errorf("calculating total: %w", err) return } total = t }()
wg.Add(1) go func() { defer wg.Done() bs, err := gr.Branches() if err != nil { errorsCh <- fmt.Errorf("fetching branches: %w", err) return } branches = bs }()
wg.Add(1) go func() { defer wg.Done() ts, err := gr.Tags() if err != nil { errorsCh <- fmt.Errorf("fetching tags: %w", err) return } tags = ts }()
wg.Add(1) go func() { defer wg.Done() fs, err := gr.FileTree(r.Context(), "") if err != nil { errorsCh <- fmt.Errorf("fetching filetree: %w", err) return } files = fs }()
wg.Wait() close(errorsCh)
// show any errors for err := range errorsCh { l.Error("loading repo", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
rtags := []*types.TagReference{} for _, tag := range tags { tr := types.TagReference{ Tag: tag.TagObject(), }
tr.Reference = types.Reference{ Name: tag.Name(), Hash: tag.Hash().String(), }
if tag.Message() != "" { tr.Message = tag.Message() }
rtags = append(rtags, &tr) }
var readmeContent string var readmeFile string for _, readme := range h.c.Repo.Readme { content, _ := gr.FileContent(readme) if len(content) > 0 { readmeContent = string(content) readmeFile = readme } }
if ref == "" { mainBranch, err := gr.FindMainBranch() if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("finding main branch", "error", err.Error()) return } ref = mainBranch }
resp := types.RepoIndexResponse{ IsEmpty: false, Ref: ref, Commits: commits, Description: getDescription(path), Readme: readmeContent, ReadmeFileName: readmeFile, Files: files, Branches: branches, Tags: rtags, TotalCommits: total, }
writeJSON(w, resp) return}
func (h *Handle) RepoTree(w http.ResponseWriter, r *http.Request) { treePath := chi.URLParam(r, "*") ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
l := h.l.With("handler", "RepoTree", "ref", ref, "treePath", treePath)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.Open(path, ref) if err != nil { notFound(w) return }
files, err := gr.FileTree(r.Context(), treePath) if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("file tree", "error", err.Error()) return }
resp := types.RepoTreeResponse{ Ref: ref, Parent: treePath, Description: getDescription(path), DotDot: filepath.Dir(treePath), Files: files, }
writeJSON(w, resp) return}
func (h *Handle) BlobRaw(w http.ResponseWriter, r *http.Request) { treePath := chi.URLParam(r, "*") ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
l := h.l.With("handler", "BlobRaw", "ref", ref, "treePath", treePath)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.Open(path, ref) if err != nil { notFound(w) return }
contents, err := gr.RawContent(treePath) if err != nil { writeError(w, err.Error(), http.StatusBadRequest) l.Error("file content", "error", err.Error()) return }
mimeType := http.DetectContentType(contents)
// exception for svg if filepath.Ext(treePath) == ".svg" { mimeType = "image/svg+xml" }
if !strings.HasPrefix(mimeType, "image/") && !strings.HasPrefix(mimeType, "video/") { l.Error("attempted to serve non-image/video file", "mimetype", mimeType) writeError(w, "only image and video files can be accessed directly", http.StatusForbidden) return }
w.Header().Set("Cache-Control", "public, max-age=86400") // cache for 24 hours w.Header().Set("ETag", fmt.Sprintf("%x", sha256.Sum256(contents))) w.Header().Set("Content-Type", mimeType) w.Write(contents)}
func (h *Handle) Blob(w http.ResponseWriter, r *http.Request) { treePath := chi.URLParam(r, "*") ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
l := h.l.With("handler", "Blob", "ref", ref, "treePath", treePath)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.Open(path, ref) if err != nil { notFound(w) return }
var isBinaryFile bool = false contents, err := gr.FileContent(treePath) if errors.Is(err, git.ErrBinaryFile) { isBinaryFile = true } else if errors.Is(err, object.ErrFileNotFound) { notFound(w) return } else if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) return }
bytes := []byte(contents) // safe := string(sanitize(bytes)) sizeHint := len(bytes)
resp := types.RepoBlobResponse{ Ref: ref, Contents: string(bytes), Path: treePath, IsBinary: isBinaryFile, SizeHint: uint64(sizeHint), }
h.showFile(resp, w, l)}
func (h *Handle) Archive(w http.ResponseWriter, r *http.Request) { name := chi.URLParam(r, "name") file := chi.URLParam(r, "file")
l := h.l.With("handler", "Archive", "name", name, "file", file)
// TODO: extend this to add more files compression (e.g.: xz) if !strings.HasSuffix(file, ".tar.gz") { notFound(w) return }
ref := strings.TrimSuffix(file, ".tar.gz")
// This allows the browser to use a proper name for the file when // downloading filename := fmt.Sprintf("%s-%s.tar.gz", name, ref) setContentDisposition(w, filename) setGZipMIME(w)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.Open(path, ref) if err != nil { notFound(w) return }
gw := gzip.NewWriter(w) defer gw.Close()
prefix := fmt.Sprintf("%s-%s", name, ref) err = gr.WriteTar(gw, prefix) if err != nil { // once we start writing to the body we can't report error anymore // so we are only left with printing the error. l.Error("writing tar file", "error", err.Error()) return }
err = gw.Flush() if err != nil { // once we start writing to the body we can't report error anymore // so we are only left with printing the error. l.Error("flushing?", "error", err.Error()) return }}
func (h *Handle) Log(w http.ResponseWriter, r *http.Request) { ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
l := h.l.With("handler", "Log", "ref", ref, "path", path)
gr, err := git.Open(path, ref) if err != nil { notFound(w) return }
// Get page parameters page := 1 pageSize := 30
if pageParam := r.URL.Query().Get("page"); pageParam != "" { if p, err := strconv.Atoi(pageParam); err == nil && p > 0 { page = p } }
if pageSizeParam := r.URL.Query().Get("per_page"); pageSizeParam != "" { if ps, err := strconv.Atoi(pageSizeParam); err == nil && ps > 0 { pageSize = ps } }
// convert to offset/limit offset := (page - 1) * pageSize limit := pageSize
commits, err := gr.Commits(offset, limit) if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("fetching commits", "error", err.Error()) return }
total := len(commits)
resp := types.RepoLogResponse{ Commits: commits, Ref: ref, Description: getDescription(path), Log: true, Total: total, Page: page, PerPage: pageSize, }
writeJSON(w, resp) return}
func (h *Handle) Diff(w http.ResponseWriter, r *http.Request) { ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
l := h.l.With("handler", "Diff", "ref", ref)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.Open(path, ref) if err != nil { notFound(w) return }
diff, err := gr.Diff() if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("getting diff", "error", err.Error()) return }
resp := types.RepoCommitResponse{ Ref: ref, Diff: diff, }
writeJSON(w, resp) return}
func (h *Handle) Tags(w http.ResponseWriter, r *http.Request) { path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) l := h.l.With("handler", "Refs")
gr, err := git.Open(path, "") if err != nil { notFound(w) return }
tags, err := gr.Tags() if err != nil { // Non-fatal, we *should* have at least one branch to show. l.Warn("getting tags", "error", err.Error()) }
rtags := []*types.TagReference{} for _, tag := range tags { tr := types.TagReference{ Tag: tag.TagObject(), }
tr.Reference = types.Reference{ Name: tag.Name(), Hash: tag.Hash().String(), }
if tag.Message() != "" { tr.Message = tag.Message() }
rtags = append(rtags, &tr) }
resp := types.RepoTagsResponse{ Tags: rtags, }
writeJSON(w, resp) return}
func (h *Handle) Branches(w http.ResponseWriter, r *http.Request) { path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
gr, err := git.PlainOpen(path) if err != nil { notFound(w) return }
branches, _ := gr.Branches()
resp := types.RepoBranchesResponse{ Branches: branches, }
writeJSON(w, resp) return}
func (h *Handle) Branch(w http.ResponseWriter, r *http.Request) { path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) branchName := chi.URLParam(r, "branch") branchName, _ = url.PathUnescape(branchName)
l := h.l.With("handler", "Branch")
gr, err := git.PlainOpen(path) if err != nil { notFound(w) return }
ref, err := gr.Branch(branchName) if err != nil { l.Error("getting branch", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
commit, err := gr.Commit(ref.Hash()) if err != nil { l.Error("getting commit object", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
defaultBranch, err := gr.FindMainBranch() isDefault := false if err != nil { l.Error("getting default branch", "error", err.Error()) // do not quit though } else if defaultBranch == branchName { isDefault = true }
resp := types.RepoBranchResponse{ Branch: types.Branch{ Reference: types.Reference{ Name: ref.Name().Short(), Hash: ref.Hash().String(), }, Commit: commit, IsDefault: isDefault, }, }
writeJSON(w, resp) return}
func (h *Handle) Keys(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "Keys")
switch r.Method { case http.MethodGet: keys, err := h.db.GetAllPublicKeys() if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("getting public keys", "error", err.Error()) return }
data := make([]map[string]any, 0) for _, key := range keys { j := key.JSON() data = append(data, j) } writeJSON(w, data) return
case http.MethodPut: pk := db.PublicKey{} if err := json.NewDecoder(r.Body).Decode(&pk); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
_, _, _, _, err := ssh.ParseAuthorizedKey([]byte(pk.Key)) if err != nil { writeError(w, "invalid pubkey", http.StatusBadRequest) }
if err := h.db.AddPublicKey(pk); err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("adding public key", "error", err.Error()) return }
w.WriteHeader(http.StatusNoContent) return }}
func (h *Handle) NewRepo(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "NewRepo")
data := struct { Did string `json:"did"` Name string `json:"name"` DefaultBranch string `json:"default_branch,omitempty"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
if data.DefaultBranch == "" { data.DefaultBranch = h.c.Repo.MainBranch }
did := data.Did name := data.Name defaultBranch := data.DefaultBranch
if err := validateRepoName(name); err != nil { l.Error("creating repo", "error", err.Error()) writeError(w, err.Error(), http.StatusBadRequest) return }
relativeRepoPath := filepath.Join(did, name) repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath) err := git.InitBare(repoPath, defaultBranch) if err != nil { l.Error("initializing bare repo", "error", err.Error()) if errors.Is(err, gogit.ErrRepositoryAlreadyExists) { writeError(w, "That repo already exists!", http.StatusConflict) return } else { writeError(w, err.Error(), http.StatusInternalServerError) return } }
// add perms for this user to access the repo err = h.e.AddRepo(did, ThisServer, relativeRepoPath) if err != nil { l.Error("adding repo permissions", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
hook.SetupRepo( hook.Config( hook.WithScanPath(h.c.Repo.ScanPath), hook.WithInternalApi(h.c.Server.InternalListenAddr), ), repoPath, )
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) RepoForkAheadBehind(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "RepoForkSync")
data := struct { Did string `json:"did"` Source string `json:"source"` Name string `json:"name,omitempty"` HiddenRef string `json:"hiddenref"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
did := data.Did source := data.Source
if did == "" || source == "" { l.Error("invalid request body, empty did or name") w.WriteHeader(http.StatusBadRequest) return }
var name string if data.Name != "" { name = data.Name } else { name = filepath.Base(source) }
branch := chi.URLParam(r, "branch") branch, _ = url.PathUnescape(branch)
relativeRepoPath := filepath.Join(did, name) repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath)
gr, err := git.PlainOpen(repoPath) if err != nil { log.Println(err) notFound(w) return }
forkCommit, err := gr.ResolveRevision(branch) if err != nil { l.Error("error resolving ref revision", "msg", err.Error()) writeError(w, fmt.Sprintf("error resolving revision %s", branch), http.StatusBadRequest) return }
sourceCommit, err := gr.ResolveRevision(data.HiddenRef) if err != nil { l.Error("error resolving hidden ref revision", "msg", err.Error()) writeError(w, fmt.Sprintf("error resolving revision %s", data.HiddenRef), http.StatusBadRequest) return }
status := types.UpToDate if forkCommit.Hash.String() != sourceCommit.Hash.String() { isAncestor, err := forkCommit.IsAncestor(sourceCommit) if err != nil { log.Printf("error resolving whether %s is ancestor of %s: %s", branch, data.HiddenRef, err) return }
if isAncestor { status = types.FastForwardable } else { status = types.Conflict } }
w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(types.AncestorCheckResponse{Status: status})}
func (h *Handle) RepoLanguages(w http.ResponseWriter, r *http.Request) { repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) ref := chi.URLParam(r, "ref") ref, _ = url.PathUnescape(ref)
l := h.l.With("handler", "RepoLanguages")
gr, err := git.Open(repoPath, ref) if err != nil { l.Error("opening repo", "error", err.Error()) notFound(w) return }
sizes := make(map[string]int64)
ctx, cancel := context.WithTimeout(r.Context(), 1*time.Second) defer cancel()
err = gr.Walk(ctx, "", func(node object.TreeEntry, parent *object.Tree, root string) error { filepath := path.Join(root, node.Name)
content, err := gr.FileContentN(filepath, 16*1024) // 16KB if err != nil { return nil }
if enry.IsGenerated(filepath, content) { return nil }
language := analyzeLanguage(node, content) if group := enry.GetLanguageGroup(language); group != "" { language = group }
langType := enry.GetLanguageType(language) if langType != enry.Programming && langType != enry.Markup && langType != enry.Unknown { return nil }
sz, _ := parent.Size(node.Name) sizes[language] += sz
return nil }) if err != nil { l.Error("failed to recurse file tree", "error", err.Error()) writeError(w, err.Error(), http.StatusNoContent) return }
resp := types.RepoLanguageResponse{Languages: sizes}
writeJSON(w, resp) return}
func analyzeLanguage(node object.TreeEntry, content []byte) string { language, ok := enry.GetLanguageByExtension(node.Name) if ok { return language }
language, ok = enry.GetLanguageByFilename(node.Name) if ok { return language }
if len(content) == 0 { return enry.OtherLanguage }
return enry.GetLanguage(node.Name, content)}
func (h *Handle) RepoForkSync(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "RepoForkSync")
data := struct { Did string `json:"did"` Source string `json:"source"` Name string `json:"name,omitempty"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
did := data.Did source := data.Source
if did == "" || source == "" { l.Error("invalid request body, empty did or name") w.WriteHeader(http.StatusBadRequest) return }
var name string if data.Name != "" { name = data.Name } else { name = filepath.Base(source) }
branch := chi.URLParam(r, "branch") branch, _ = url.PathUnescape(branch)
relativeRepoPath := filepath.Join(did, name) repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath)
gr, err := git.PlainOpen(repoPath) if err != nil { log.Println(err) notFound(w) return }
err = gr.Sync(branch) if err != nil { l.Error("error syncing repo fork", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) RepoFork(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "RepoFork")
data := struct { Did string `json:"did"` Source string `json:"source"` Name string `json:"name,omitempty"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
did := data.Did source := data.Source
if did == "" || source == "" { l.Error("invalid request body, empty did or name") w.WriteHeader(http.StatusBadRequest) return }
var name string if data.Name != "" { name = data.Name } else { name = filepath.Base(source) }
relativeRepoPath := filepath.Join(did, name) repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath)
err := git.Fork(repoPath, source) if err != nil { l.Error("forking repo", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
// add perms for this user to access the repo err = h.e.AddRepo(did, ThisServer, relativeRepoPath) if err != nil { l.Error("adding repo permissions", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
hook.SetupRepo( hook.Config( hook.WithScanPath(h.c.Repo.ScanPath), hook.WithInternalApi(h.c.Server.InternalListenAddr), ), repoPath, )
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) RemoveRepo(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "RemoveRepo")
data := struct { Did string `json:"did"` Name string `json:"name"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
did := data.Did name := data.Name
if did == "" || name == "" { l.Error("invalid request body, empty did or name") w.WriteHeader(http.StatusBadRequest) return }
relativeRepoPath := filepath.Join(did, name) repoPath, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, relativeRepoPath) err := os.RemoveAll(repoPath) if err != nil { l.Error("removing repo", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
w.WriteHeader(http.StatusNoContent)
}func (h *Handle) Merge(w http.ResponseWriter, r *http.Request) { path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
data := types.MergeRequest{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, err.Error(), http.StatusBadRequest) h.l.Error("git: failed to unmarshal json patch", "handler", "Merge", "error", err) return }
mo := &git.MergeOptions{ AuthorName: data.AuthorName, AuthorEmail: data.AuthorEmail, CommitBody: data.CommitBody, CommitMessage: data.CommitMessage, }
patch := data.Patch branch := data.Branch gr, err := git.Open(path, branch) if err != nil { notFound(w) return }
mo.FormatPatch = patchutil.IsFormatPatch(patch)
if err := gr.MergeWithOptions([]byte(patch), branch, mo); err != nil { var mergeErr *git.ErrMerge if errors.As(err, &mergeErr) { conflicts := make([]types.ConflictInfo, len(mergeErr.Conflicts)) for i, conflict := range mergeErr.Conflicts { conflicts[i] = types.ConflictInfo{ Filename: conflict.Filename, Reason: conflict.Reason, } } response := types.MergeCheckResponse{ IsConflicted: true, Conflicts: conflicts, Message: mergeErr.Message, } writeConflict(w, response) h.l.Error("git: merge conflict", "handler", "Merge", "error", mergeErr) } else { writeError(w, err.Error(), http.StatusBadRequest) h.l.Error("git: failed to merge", "handler", "Merge", "error", err.Error()) } return }
w.WriteHeader(http.StatusOK)}
func (h *Handle) MergeCheck(w http.ResponseWriter, r *http.Request) { path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
var data struct { Patch string `json:"patch"` Branch string `json:"branch"` }
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, err.Error(), http.StatusBadRequest) h.l.Error("git: failed to unmarshal json patch", "handler", "MergeCheck", "error", err) return }
patch := data.Patch branch := data.Branch gr, err := git.Open(path, branch) if err != nil { notFound(w) return }
err = gr.MergeCheck([]byte(patch), branch) if err == nil { response := types.MergeCheckResponse{ IsConflicted: false, } writeJSON(w, response) return }
var mergeErr *git.ErrMerge if errors.As(err, &mergeErr) { conflicts := make([]types.ConflictInfo, len(mergeErr.Conflicts)) for i, conflict := range mergeErr.Conflicts { conflicts[i] = types.ConflictInfo{ Filename: conflict.Filename, Reason: conflict.Reason, } } response := types.MergeCheckResponse{ IsConflicted: true, Conflicts: conflicts, Message: mergeErr.Message, } writeConflict(w, response) h.l.Error("git: merge conflict", "handler", "MergeCheck", "error", mergeErr.Error()) return } writeError(w, err.Error(), http.StatusInternalServerError) h.l.Error("git: failed to check merge", "handler", "MergeCheck", "error", err.Error())}
func (h *Handle) Compare(w http.ResponseWriter, r *http.Request) { rev1 := chi.URLParam(r, "rev1") rev1, _ = url.PathUnescape(rev1)
rev2 := chi.URLParam(r, "rev2") rev2, _ = url.PathUnescape(rev2)
l := h.l.With("handler", "Compare", "r1", rev1, "r2", rev2)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.PlainOpen(path) if err != nil { notFound(w) return }
commit1, err := gr.ResolveRevision(rev1) if err != nil { l.Error("error resolving revision 1", "msg", err.Error()) writeError(w, fmt.Sprintf("error resolving revision %s", rev1), http.StatusBadRequest) return }
commit2, err := gr.ResolveRevision(rev2) if err != nil { l.Error("error resolving revision 2", "msg", err.Error()) writeError(w, fmt.Sprintf("error resolving revision %s", rev2), http.StatusBadRequest) return }
rawPatch, formatPatch, err := gr.FormatPatch(commit1, commit2) if err != nil { l.Error("error comparing revisions", "msg", err.Error()) writeError(w, "error comparing revisions", http.StatusBadRequest) return }
writeJSON(w, types.RepoFormatPatchResponse{ Rev1: commit1.Hash.String(), Rev2: commit2.Hash.String(), FormatPatch: formatPatch, Patch: rawPatch, }) return}
func (h *Handle) NewHiddenRef(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "NewHiddenRef")
forkRef := chi.URLParam(r, "forkRef") forkRef, _ = url.PathUnescape(forkRef)
remoteRef := chi.URLParam(r, "remoteRef") remoteRef, _ = url.PathUnescape(remoteRef)
path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r)) gr, err := git.PlainOpen(path) if err != nil { notFound(w) return }
err = gr.TrackHiddenRemoteRef(forkRef, remoteRef) if err != nil { l.Error("error tracking hidden remote ref", "msg", err.Error()) writeError(w, "error tracking hidden remote ref", http.StatusBadRequest) return }
w.WriteHeader(http.StatusNoContent) return}
func (h *Handle) AddMember(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "AddMember")
data := struct { Did string `json:"did"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
did := data.Did
if err := h.db.AddDid(did); err != nil { l.Error("adding did", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return } h.jc.AddDid(did)
if err := h.e.AddKnotMember(ThisServer, did); err != nil { l.Error("adding member", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
if err := h.fetchAndAddKeys(r.Context(), did); err != nil { l.Error("fetching and adding keys", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) AddRepoCollaborator(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "AddRepoCollaborator")
data := struct { Did string `json:"did"` }{}
ownerDid := chi.URLParam(r, "did") repo := chi.URLParam(r, "name")
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, "invalid request body", http.StatusBadRequest) return }
if err := h.db.AddDid(data.Did); err != nil { l.Error("adding did", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return } h.jc.AddDid(data.Did)
repoName, _ := securejoin.SecureJoin(ownerDid, repo) if err := h.e.AddCollaborator(data.Did, ThisServer, repoName); err != nil { l.Error("adding repo collaborator", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
if err := h.fetchAndAddKeys(r.Context(), data.Did); err != nil { l.Error("fetching and adding keys", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) DefaultBranch(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "DefaultBranch") path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
gr, err := git.Open(path, "") if err != nil { notFound(w) return }
branch, err := gr.FindMainBranch() if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("getting default branch", "error", err.Error()) return }
writeJSON(w, types.RepoDefaultBranchResponse{ Branch: branch, })}
func (h *Handle) SetDefaultBranch(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "SetDefaultBranch") path, _ := securejoin.SecureJoin(h.c.Repo.ScanPath, didPath(r))
data := struct { Branch string `json:"branch"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { writeError(w, err.Error(), http.StatusBadRequest) return }
gr, err := git.PlainOpen(path) if err != nil { notFound(w) return }
err = gr.SetDefaultBranch(data.Branch) if err != nil { writeError(w, err.Error(), http.StatusInternalServerError) l.Error("setting default branch", "error", err.Error()) return }
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) Init(w http.ResponseWriter, r *http.Request) { l := h.l.With("handler", "Init")
if h.knotInitialized { writeError(w, "knot already initialized", http.StatusConflict) return }
data := struct { Did string `json:"did"` }{}
if err := json.NewDecoder(r.Body).Decode(&data); err != nil { l.Error("failed to decode request body", "error", err.Error()) writeError(w, "invalid request body", http.StatusBadRequest) return }
if data.Did == "" { l.Error("empty DID in request", "did", data.Did) writeError(w, "did is empty", http.StatusBadRequest) return }
if err := h.db.AddDid(data.Did); err != nil { l.Error("failed to add DID", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return } h.jc.AddDid(data.Did)
if err := h.e.AddKnotOwner(ThisServer, data.Did); err != nil { l.Error("adding owner", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
if err := h.fetchAndAddKeys(r.Context(), data.Did); err != nil { l.Error("fetching and adding keys", "error", err.Error()) writeError(w, err.Error(), http.StatusInternalServerError) return }
close(h.init)
mac := hmac.New(sha256.New, []byte(h.c.Server.Secret)) mac.Write([]byte("ok")) w.Header().Add("X-Signature", hex.EncodeToString(mac.Sum(nil)))
w.WriteHeader(http.StatusNoContent)}
func (h *Handle) Health(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok"))}
func validateRepoName(name string) error { // check for path traversal attempts if name == "." || name == ".." || strings.Contains(name, "/") || strings.Contains(name, "\\") { return fmt.Errorf("Repository name contains invalid path characters") }
// check for sequences that could be used for traversal when normalized if strings.Contains(name, "./") || strings.Contains(name, "../") || strings.HasPrefix(name, ".") || strings.HasSuffix(name, ".") { return fmt.Errorf("Repository name contains invalid path sequence") }
// then continue with character validation for _, char := range name { if !((char >= 'a' && char <= 'z') || (char >= 'A' && char <= 'Z') || (char >= '0' && char <= '9') || char == '-' || char == '_' || char == '.') { return fmt.Errorf("Repository name can only contain alphanumeric characters, periods, hyphens, and underscores") } }
// additional check to prevent multiple sequential dots if strings.Contains(name, "..") { return fmt.Errorf("Repository name cannot contain sequential dots") }
// if all checks pass return nil}