| 1 | //! Git over HTTPS: the smart HTTP remote at `/<namespace>/<repo>.git`, |
| 2 | //! proxied to the git store with a short-lived token. |
| 3 | |
| 4 | use g1t_contracts::identity::GitCredentialsArgs; |
| 5 | use g1t_contracts::repos::{GitAccess, GitService, RepoPath}; |
| 6 | use g1t_contracts::{FailureCode, Outcome, Viewer}; |
| 7 | use worker::js_sys::Uint8Array; |
| 8 | use worker::{Fetch, Fetcher, Headers, Method, Request, RequestInit, Response, Result, Url}; |
| 9 | |
| 10 | const ENDPOINTS: [&str; 3] = ["info/refs", "git-upload-pack", "git-receive-pack"]; |
| 11 | const FORWARDED_HEADERS: [&str; 5] = [ |
| 12 | "accept", |
| 13 | "content-encoding", |
| 14 | "content-type", |
| 15 | "git-protocol", |
| 16 | "user-agent", |
| 17 | ]; |
| 18 | |
| 19 | /// A git request, parsed from its URL. |
| 20 | pub struct GitRequest { |
| 21 | pub path: RepoPath, |
| 22 | pub endpoint: &'static str, |
| 23 | pub service: GitService, |
| 24 | } |
| 25 | |
| 26 | /// Parses `/<namespace>/<name>[.git]/<endpoint>`, or returns `None` if the |
| 27 | /// request is not git's. |
| 28 | pub fn parse(url: &Url) -> Option<GitRequest> { |
| 29 | let path = url.path().strip_prefix('/')?; |
| 30 | let endpoint = ENDPOINTS |
| 31 | .into_iter() |
| 32 | .find(|endpoint| path.ends_with(&format!("/{endpoint}")))?; |
| 33 | let repo = &path[..path.len() - endpoint.len() - 1]; |
| 34 | let (namespace, name) = repo.split_once('/')?; |
| 35 | let name = name.strip_suffix(".git").unwrap_or(name); |
| 36 | if namespace.is_empty() || name.is_empty() || name.contains('/') { |
| 37 | return None; |
| 38 | } |
| 39 | let service = if endpoint == "info/refs" { |
| 40 | url.query_pairs() |
| 41 | .find(|(key, _)| key == "service") |
| 42 | .map(|(_, value)| value.into_owned())? |
| 43 | } else { |
| 44 | endpoint.to_owned() |
| 45 | }; |
| 46 | let service = match service.as_str() { |
| 47 | "git-upload-pack" => GitService::UploadPack, |
| 48 | "git-receive-pack" => GitService::ReceivePack, |
| 49 | _ => return None, |
| 50 | }; |
| 51 | Some(GitRequest { |
| 52 | path: RepoPath { |
| 53 | namespace: namespace.to_owned(), |
| 54 | name: name.to_owned(), |
| 55 | }, |
| 56 | endpoint, |
| 57 | service, |
| 58 | }) |
| 59 | } |
| 60 | |
| 61 | /// The user named by an HTTP Basic `Authorization` header, as git sends it. |
| 62 | pub async fn viewer(request: &Request, identity: &Fetcher) -> Result<Viewer> { |
| 63 | let Some(header) = request.headers().get("authorization")? else { |
| 64 | return Ok(None); |
| 65 | }; |
| 66 | let Some((scheme, encoded)) = header.split_once(' ') else { |
| 67 | return Ok(None); |
| 68 | }; |
| 69 | if !scheme.eq_ignore_ascii_case("basic") { |
| 70 | return Ok(None); |
| 71 | } |
| 72 | let Some(decoded) = decode_base64(encoded.trim()) else { |
| 73 | return Ok(None); |
| 74 | }; |
| 75 | let Some((username, secret)) = decoded.split_once(':') else { |
| 76 | return Ok(None); |
| 77 | }; |
| 78 | g1t_kit::call( |
| 79 | identity, |
| 80 | "user_for_git_credentials", |
| 81 | &GitCredentialsArgs { |
| 82 | username: username.to_owned(), |
| 83 | secret: secret.to_owned(), |
| 84 | }, |
| 85 | ) |
| 86 | .await |
| 87 | } |
| 88 | |
| 89 | /// Standard base64 to a UTF-8 string, or `None` if either step fails. |
| 90 | fn decode_base64(input: &str) -> Option<String> { |
| 91 | let mut bytes = Vec::with_capacity(input.len() * 3 / 4); |
| 92 | let mut buffer = 0u32; |
| 93 | let mut bits = 0; |
| 94 | for byte in input.bytes().filter(|byte| *byte != b'=') { |
| 95 | let value = match byte { |
| 96 | b'A'..=b'Z' => byte - b'A', |
| 97 | b'a'..=b'z' => byte - b'a' + 26, |
| 98 | b'0'..=b'9' => byte - b'0' + 52, |
| 99 | b'+' => 62, |
| 100 | b'/' => 63, |
| 101 | _ => return None, |
| 102 | }; |
| 103 | buffer = (buffer << 6) | u32::from(value); |
| 104 | bits += 6; |
| 105 | if bits >= 8 { |
| 106 | bits -= 8; |
| 107 | bytes.push((buffer >> bits) as u8); |
| 108 | } |
| 109 | } |
| 110 | String::from_utf8(bytes).ok() |
| 111 | } |
| 112 | |
| 113 | /// The response for a refused git request. Anonymous callers are asked to |
| 114 | /// authenticate, which is what makes git prompt for credentials. |
| 115 | pub fn refuse<T>(outcome: Outcome<T>) -> Result<Response> { |
| 116 | let Outcome::Fail(failure) = outcome else { |
| 117 | return Response::error("Not found", 404); |
| 118 | }; |
| 119 | let mut response = Response::error(failure.message, failure.code.http_status())?; |
| 120 | if failure.code == FailureCode::Unauthenticated { |
| 121 | response |
| 122 | .headers_mut() |
| 123 | .set("www-authenticate", "Basic realm=\"g1t\"")?; |
| 124 | } |
| 125 | Ok(response) |
| 126 | } |
| 127 | |
| 128 | /// Sends the request on to the git store and returns its response as is. |
| 129 | pub async fn forward( |
| 130 | mut request: Request, |
| 131 | git: &GitRequest, |
| 132 | access: &GitAccess, |
| 133 | ) -> Result<Response> { |
| 134 | let headers = Headers::new(); |
| 135 | headers.set("authorization", &format!("Bearer {}", access.token))?; |
| 136 | for name in FORWARDED_HEADERS { |
| 137 | if let Some(value) = request.headers().get(name)? { |
| 138 | headers.set(name, &value)?; |
| 139 | } |
| 140 | } |
| 141 | let query = request |
| 142 | .url()? |
| 143 | .query() |
| 144 | .map(|query| format!("?{query}")) |
| 145 | .unwrap_or_default(); |
| 146 | let mut init = RequestInit::new(); |
| 147 | init.with_method(request.method()).with_headers(headers); |
| 148 | if request.method() == Method::Post { |
| 149 | // Pushes are capped at 100 MB by the platform, so buffering is safe. |
| 150 | let body = request.bytes().await?; |
| 151 | init.with_body(Some(Uint8Array::from(body.as_slice()).into())); |
| 152 | } |
| 153 | let upstream = |
| 154 | Request::new_with_init(&format!("{}/{}{query}", access.remote, git.endpoint), &init)?; |
| 155 | Fetch::Request(upstream).send().await |
| 156 | } |