gitoria

8.2 KB

1. // transport.hl — CLONE, FETCH AND PUSH OVER HTTPS (ticket gitoria#7; docs/git-backend.md). Git's "smart HTTP" protocol,
2. // answered by this app itself with the `git` binary: on a repo address `<slug>.<domain>` the paths
3. // /<slug>.git/info/refs?service=git-upload-pack | git-receive-pack (what a client asks first)
4. // /<slug>.git/git-upload-pack (fetch / clone) /<slug>.git/git-receive-pack (push)
5. // spawn `git upload-pack | receive-pack --stateless-rpc` and hand the request body over and the answer back.
6. // The clone URL is https://<slug>.<domain>/<slug>.git — the folder git makes is named like the repo.
7. // * READ (clone, fetch) needs no login: every repo is public (the concept has no private repos yet).
8. // * WRITE (push) needs a token as the password (tokens.hl) of THE REPO'S OWNER — nobody else may push (decision below).
9. // * The body travels through temp files, byte for byte (a String here holds raw bytes; hl:fs writes and reads them as
10. // they are): hl:proc run() has no stdin, so the child reads `< body` and writes `> answer` in a tiny `sh -c` with
11. // the paths as positional arguments (no user text in the script). A gzip body (git compresses big requests) is
12. // unpacked first. Git protocol v2 is passed through (`Git-Protocol` → GIT_PROTOCOL, digits only).
13. // * No hook: pull requests and releases are read from the commits when their page is built.
14. import { Response } from 'hl:http1'
15. import { run } from 'hl:proc'
16. import { writeFile, readFile, remove, exists, mkDir } from 'hl:fs'
17. import { randomBytes } from 'hl:crypto'
18. import { slugError, repoBySlug } from './repos.hl'
19. import { slugOfHost, userRecord, publicUrl } from './users.hl'
20. import { userOfToken } from './tokens.hl'
21. import { gitRoot, repoDir } from './git.hl'
23. static NL = "
24. "
25. static seconds = 300 // one upload-pack / receive-pack call
26. static maxBody = 500000000 // a push or fetch request above this is refused (bytes)
28. static isBase64 = (s) => {
29. if (s.length == 0 || s.length > 600) { return false }
30. let i = 0
31. while (i < s.length) {
32. let c = s.charCodeAt(i)
33. if (!((c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c == 43 || c == 47 || c == 61)) { return false }
34. i = i + 1
35. }
36. return true
37. }
39. // the password of a Basic `Authorization` header ('user:password' → 'password'); null without one.
40. // Hybriel has no base64 decoder (hybriel ticket candidate), so `base64 -d` decodes it — the text goes in as an
41. // argument, after a check that it only holds base64 characters.
42. static passwordOf = (header) => {
43. if (header == null || hlTypeName(header) != 'String') { return null }
44. let h = header.trim()
45. if (h.length < 7 || h.slice(0, 6).toLowerCase() != 'basic ') { return null }
46. let b = h.slice(6).trim()
47. if (!isBase64(b)) { return null }
48. let r = run(['sh', '-c', 'printf %s "$1" | base64 -d 2>/dev/null', 'sh', b], { timeout = 10 })
49. if (r == null || r.exit != 0 || r.lines.length == 0) { return null }
50. let text = r.lines[0]
51. let colon = text.indexOf(':')
52. return colon < 0 ? null : text.slice(colon + 1)
53. }
55. static plain = (status, text, extra) => {
56. let headers = { 'Content-Type' = 'text/plain; charset=utf-8' 'Cache-Control' = 'no-store' }
57. if (extra != null) { for (k of extra.keys()) { headers[k] = extra[k] } }
58. return new Response(text + NL, { status = status headers = headers })
59. }
61. // git speaks protocol v2 when the client says so: `Git-Protocol: version=2` (only that shape is passed on)
62. static protocolEnv = (req) => {
63. let v = req.headers['git-protocol']
64. if (v == null || hlTypeName(v) != 'String' || v.length > 40) { return {} }
65. let ok = v.length > 0
66. let i = 0
67. while (i < v.length) {
68. let c = v.charCodeAt(i)
69. if (!((c >= 48 && c <= 57) || (c >= 97 && c <= 122) || c == 61 || c == 58)) { ok = false }
70. i = i + 1
71. }
72. return ok ? { GIT_PROTOCOL = v } : {}
73. }
75. static tmpDir = () => {
76. let d = gitRoot + '/.tmp'
77. if (!exists(d)) { mkDir(d, 448) }
78. return d
79. }
81. // ONE GIT CALL: the request body (or none) in, the answer out. → the answer's bytes as a String, or null (git failed and said nothing)
82. static callGit = (slug, service, advertise, req) => {
83. let dir = tmpDir()
84. let name = dir + '/' + randomBytes(12, 'hex')
85. let inFile = name + '.in'
86. let outFile = name + '.out'
87. let zipped = false
88. let script = 'exec git ' + service.slice(4) + ' --stateless-rpc --advertise-refs "$1" > "$3"'
89. if (!advertise) {
90. let body = req.body == null ? '' : req.body
91. writeFile(inFile, body, 384)
92. let enc = req.headers['content-encoding']
93. zipped = enc != null && hlTypeName(enc) == 'String' && (enc.toLowerCase() == 'gzip' || enc.toLowerCase() == 'x-gzip')
94. script = zipped ? 'gzip -dc < "$2" | git ' + service.slice(4) + ' --stateless-rpc "$1" > "$3"' : 'exec git ' + service.slice(4) + ' --stateless-rpc "$1" < "$2" > "$3"'
95. }
96. let r = run(['sh', '-c', script, 'sh', repoDir(slug), inFile, outFile], { timeout = seconds env = protocolEnv(req) })
97. let out = exists(outFile) ? readFile(outFile) : null
98. if (exists(inFile)) { remove(inFile) }
99. if (exists(outFile)) { remove(outFile) }
100. // git answers nothing to the client's "0000" probe of a big push (exit 0): that is a 200 with an empty body, as git http-backend does
101. if (out == null || (out == '' && (r == null || r.exit != 0))) { return null }
102. return out
103. }
105. // pkt-line: 4 hex digits of the length (itself included), then the text
106. static pktLine = (text) => {
107. let n = text.length + 4
108. let hex = '0123456789abcdef'
109. let out = ''
110. let i = 0
111. while (i < 4) {
112. let d = n % 16
113. out = hex[d] + out
114. n = (n - d) / 16
115. i = i + 1
116. }
117. return out + text
118. }
120. // THE ROUTE (project.hl): `/:repo/info/refs`, `/:repo/git-upload-pack`, `/:repo/git-receive-pack`
121. static gitTransport = (route, req) => {
122. let hostHeader = req.headers['host']
123. let slug = slugOfHost(hostHeader == null ? '' : hostHeader.split(':')[0])
124. let repoName = route.params.repo
125. if (slug == '' || slugError(slug) != null || repoName != slug + '.git' || repoBySlug(slug) == null) { return plain(404, 'no such repository') }
126. let last = req.path.slice(req.path.lastIndexOf('/') + 1)
127. let advertise = last == 'refs'
128. let service = advertise ? (req.query != null ? req.query.service : null) : last
129. if (service != 'git-upload-pack' && service != 'git-receive-pack') { return plain(403, 'only the smart git protocol is served here: use git clone / fetch / push') }
130. if (advertise && req.method != 'GET') { return plain(405, 'GET only') }
131. if (!advertise && req.method != 'POST') { return plain(405, 'POST only') }
132. // hl:http1 reads no chunked request body (body = null); nginx in front buffers it and sends a length. Say so, not "empty".
133. let te = req.headers['transfer-encoding']
134. if (!advertise && req.body == null && te != null && hlTypeName(te) == 'String' && te.toLowerCase().includes('chunked')) { return plain(411, 'this server needs the request with a length (behind the proxy that is automatic; a direct client: git config http.postBuffer 524288000)') }
135. if (req.body != null && req.body.length > maxBody) { return plain(413, 'that request is too big') }
137. if (service == 'git-receive-pack') {
138. let realm = { 'WWW-Authenticate' = 'Basic realm="gitoria"' }
139. let pw = passwordOf(req.headers['authorization'])
140. if (pw == null) { return plain(401, 'pushing needs a token: log in at ' + publicUrl + ', make one under "Access tokens", and use it as the password', realm) }
141. let userId = userOfToken(pw)
142. if (userId == null) { return plain(401, 'that token is not valid (removed, or mistyped)', realm) }
143. let repo = repoBySlug(slug)
144. if (userRecord(userId) == null || repo.owner != userId) { return plain(403, 'only the owner of this repository can push to it') }
145. }
147. let out = callGit(slug, service, advertise, req)
148. if (out == null) { return plain(500, 'git gave no answer') }
149. let headers = { 'Cache-Control' = 'no-cache, max-age=0, must-revalidate' 'Pragma' = 'no-cache' }
150. if (advertise) {
151. headers['Content-Type'] = 'application/x-' + service + '-advertisement'
152. // protocol v2 answers without the service banner; v0/v1 starts with it (as git http-backend does)
153. let v2 = protocolEnv(req).GIT_PROTOCOL != null && protocolEnv(req).GIT_PROTOCOL.includes('version=2')
154. if (!v2) { out = pktLine('# service=' + service + NL) + '0000' + out }
155. } else {
156. headers['Content-Type'] = 'application/x-' + service + '-result'
157. }
158. return new Response(out, { headers = headers })
159. }