gitoria

1.2 KB

1. #!/bin/sh
2. # The forced command of every key: `gitoria-shell <user id>`. What the client asked is in SSH_ORIGINAL_COMMAND and may only be
3. # git-upload-pack (clone, fetch) or git-receive-pack (push) of ONE repository '<slug>.git'; the app decides who may push.
4. user=$1
5. cmd=${SSH_ORIGINAL_COMMAND:-}
6. refuse() { echo "gitoria: $1" >&2; exit 1; }
7. case "$cmd" in
8. "git-upload-pack "*) service=git-upload-pack; write=0 ;;
9. "git-receive-pack "*) service=git-receive-pack; write=1 ;;
10. *) refuse "only git clone, fetch and push work over ssh (no shell)" ;;
11. esac
12. arg=${cmd#* }
13. arg=${arg#\'}; arg=${arg%\'}; arg=${arg#/}
14. slug=${arg%.git}
15. [ "$arg" = "$slug.git" ] || refuse "no such repository"
16. case "$slug" in
17. ""|*[!a-z0-9-]*|-*|*-) refuse "no such repository" ;;
18. esac
19. [ ${#slug} -ge 2 ] && [ ${#slug} -le 40 ] || refuse "no such repository"
20. status=$(curl -sS --max-time 10 -G -o /tmp/gitoria-access.$$ -w '%{http_code}' -H "X-Gitoria-Secret: $(cat /run/gitoria-secret)" \
21. --data-urlencode "user=$user" --data-urlencode "slug=$slug" --data-urlencode "write=$write" "$(cat /run/gitoria-url)/__git/access") || status=000
22. msg=$(cat /tmp/gitoria-access.$$ 2>/dev/null); rm -f /tmp/gitoria-access.$$
23. [ "$status" = 200 ] || refuse "${msg:-the server did not answer}"
24. exec "$service" "/repos/$slug.git"