| | @@ -12,6 +12,7 @@ use std::{ |
| 12 | 12 | task::{Context, Poll}, |
| 13 | 13 | }; |
| 14 | 14 | |
| 15 | +use base64::{Engine, engine::general_purpose::STANDARD}; |
| 15 | 16 | use bytes::Bytes; |
| 16 | 17 | use futures_util::TryStreamExt; |
| 17 | 18 | use http_body::Frame; |
| | @@ -22,19 +23,23 @@ use topcoat::{ |
| 22 | 23 | Result, |
| 23 | 24 | context::Cx, |
| 24 | 25 | router::{ |
| 25 | | − Body, Response, |
| 26 | | − error::{RouterErrorExt, bad_request, forbidden, not_found}, |
| 27 | | − parse_query_params, path_param, route, |
| 26 | + Body, Response, StatusCode, |
| 27 | + error::{bad_request, forbidden, not_found}, |
| 28 | + header::{AUTHORIZATION, WWW_AUTHENTICATE}, |
| 29 | + headers, parse_query_params, path_param, route, |
| 28 | 30 | }, |
| 29 | 31 | }; |
| 30 | 32 | |
| 31 | 33 | use crate::{ |
| 32 | | − application::{Error, GitClientHeaders, GitEndpoint, GitService, port::ByteStream, serve_git}, |
| 33 | | − domain::{DomainError, RepoName}, |
| 34 | + application::{ |
| 35 | + Error, GitClientHeaders, GitEndpoint, GitService, authenticate_token, port::ByteStream, |
| 36 | + serve_git, |
| 37 | + }, |
| 38 | + domain::{Actor, DomainError, RepoName}, |
| 34 | 39 | }; |
| 35 | 40 | |
| 36 | 41 | use super::{ |
| 37 | | − context::{current_actor, memberships, orgs, protocol, repos, server_error}, |
| 42 | + context::{current_actor, memberships, orgs, protocol, repos, server_error, tokens}, |
| 38 | 43 | profile::handle_param, |
| 39 | 44 | }; |
| 40 | 45 | |
| | @@ -67,7 +72,7 @@ fn repo_param(cx: &Cx) -> Result<RepoName> { |
| 67 | 72 | |
| 68 | 73 | /// The four request headers that change what git does. |
| 69 | 74 | fn client_headers(cx: &Cx) -> GitClientHeaders { |
| 70 | | − let headers = topcoat::router::headers(cx); |
| 75 | + let headers = headers(cx); |
| 71 | 76 | let value = |name: &str| { |
| 72 | 77 | headers |
| 73 | 78 | .get(name) |
| | @@ -83,14 +88,70 @@ fn client_headers(cx: &Cx) -> GitClientHeaders { |
| 83 | 88 | } |
| 84 | 89 | } |
| 85 | 90 | |
| 86 | | −/// Runs one protocol request and turns the result into an HTTP response. |
| 91 | +/// Who is making this git request. |
| 92 | +/// |
| 93 | +/// A personal access token over HTTP Basic first, then the session cookie. Both are |
| 94 | +/// supported because both happen: git presents a token, and a signed-in person clicking |
| 95 | +/// a `.git` URL in a browser presents a cookie. |
| 96 | +/// |
| 97 | +/// A credential that does not authenticate falls through to anonymous rather than |
| 98 | +/// failing, matching how a bad session cookie is treated. The caller then gets the same |
| 99 | +/// 401 challenge as someone who presented nothing, and can try again. |
| 100 | +async fn git_actor(cx: &Cx) -> Result<Actor> { |
| 101 | + if let Some(presented) = basic_credential(cx) { |
| 102 | + let actor = authenticate_token(&presented, &tokens(cx)) |
| 103 | + .await |
| 104 | + .map_err(server_error)?; |
| 105 | + |
| 106 | + if actor.user_id().is_some() { |
| 107 | + return Ok(actor); |
| 108 | + } |
| 109 | + } |
| 110 | + |
| 111 | + current_actor(cx).await |
| 112 | +} |
| 113 | + |
| 114 | +/// The secret from an `Authorization: Basic` header. |
| 115 | +/// |
| 116 | +/// Git puts the token in the password field, so that is preferred; a token pasted into |
| 117 | +/// the username field with no password is accepted too, because people do that and the |
| 118 | +/// alternative is an authentication failure nothing explains. |
| 119 | +fn basic_credential(cx: &Cx) -> Option<String> { |
| 120 | + let header = headers(cx).get(AUTHORIZATION)?.to_str().ok()?; |
| 121 | + let encoded = header.strip_prefix("Basic ")?; |
| 122 | + let decoded = STANDARD.decode(encoded).ok()?; |
| 123 | + let decoded = String::from_utf8(decoded).ok()?; |
| 124 | + |
| 125 | + let (user, password) = decoded.split_once(':')?; |
| 126 | + |
| 127 | + if password.is_empty() { |
| 128 | + Some(user.to_owned()) |
| 129 | + } else { |
| 130 | + Some(password.to_owned()) |
| 131 | + } |
| 132 | +} |
| 133 | + |
| 134 | +/// Asks for credentials. |
| 87 | 135 | /// |
| 88 | | −/// A repository that does not exist and one the viewer may not see are the same 404, |
| 89 | | −/// deliberately — see [`serve_git`]. |
| 136 | +/// Sent for anything an anonymous caller may not have — including repositories that do |
| 137 | +/// not exist — so that nothing in the response distinguishes "private" from "absent". |
| 138 | +/// A git client only offers a credential after seeing this, so answering 404 instead |
| 139 | +/// would make an authenticated private clone impossible. See |
| 140 | +/// [0007](../../plans/decisions/0007-tokens-over-http-basic.md). |
| 141 | +fn challenge() -> Result<Response<GitBody>> { |
| 142 | + Response::builder() |
| 143 | + .status(StatusCode::UNAUTHORIZED) |
| 144 | + .header(WWW_AUTHENTICATE, r#"Basic realm="steid""#) |
| 145 | + .body(GitBody::new(Box::pin(tokio::io::empty()))) |
| 146 | + .map_err(server_error) |
| 147 | +} |
| 148 | + |
| 149 | +/// Runs one protocol request and turns the result into an HTTP response. |
| 90 | 150 | async fn serve(cx: &Cx, endpoint: GitEndpoint, body: ByteStream) -> Result<Response<GitBody>> { |
| 91 | 151 | let handle = handle_param(cx)?; |
| 92 | 152 | let name = repo_param(cx)?; |
| 93 | | − let actor = current_actor(cx).await?; |
| 153 | + let actor = git_actor(cx).await?; |
| 154 | + let anonymous = actor.user_id().is_none(); |
| 94 | 155 | |
| 95 | 156 | let served = serve_git( |
| 96 | 157 | &handle, |
| | @@ -104,13 +165,24 @@ async fn serve(cx: &Cx, endpoint: GitEndpoint, body: ByteStream) -> Result<Respo |
| 104 | 165 | &repos(cx), |
| 105 | 166 | &protocol(cx), |
| 106 | 167 | ) |
| 107 | | − .await |
| 108 | | − .map_err(|error| match error { |
| 109 | | − // Push, until Milestone 4b. Everything else the visitor cannot act on. |
| 110 | | − Error::Domain(DomainError::Forbidden) => forbidden().into(), |
| 111 | | − other => server_error(other), |
| 112 | | − })? |
| 113 | | − .ok_or_not_found()?; |
| 168 | + .await; |
| 169 | + |
| 170 | + let served = match served { |
| 171 | + Ok(Some(served)) => served, |
| 172 | + |
| 173 | + // Absent, or invisible to this caller — the two are the same answer by design. |
| 174 | + // Anonymous callers are asked for credentials instead, so that a private |
| 175 | + // repository and a missing one are indistinguishable from outside. |
| 176 | + Ok(None) if anonymous => return challenge(), |
| 177 | + Ok(None) => return Err(not_found().into()), |
| 178 | + |
| 179 | + // Refused a write. Someone signed in is told so; someone anonymous is asked to |
| 180 | + // identify themselves first, because they may well be allowed once they do. |
| 181 | + Err(Error::Domain(DomainError::Forbidden)) if anonymous => return challenge(), |
| 182 | + Err(Error::Domain(DomainError::Forbidden)) => return Err(forbidden().into()), |
| 183 | + |
| 184 | + Err(other) => return Err(server_error(other)), |
| 185 | + }; |
| 114 | 186 | |
| 115 | 187 | let mut response = Response::builder().status(served.status); |
| 116 | 188 | for (name, value) in served.headers { |
| | @@ -127,8 +199,8 @@ async fn serve(cx: &Cx, endpoint: GitEndpoint, body: ByteStream) -> Result<Respo |
| 127 | 199 | |
| 128 | 200 | /// The ref advertisement that opens every exchange. |
| 129 | 201 | /// |
| 130 | | −/// The service names the operation, so `service=git-receive-pack` is a write and is |
| 131 | | −/// refused here, before a client has been told a single ref exists. |
| 202 | +/// The service names the operation, so `service=git-receive-pack` is a write, and is |
| 203 | +/// authorized as one before a client has been told a single ref exists. |
| 132 | 204 | #[route(GET "/{handle}/repos/{repo}/info/refs")] |
| 133 | 205 | async fn info_refs(cx: &Cx) -> Result<Response<GitBody>> { |
| 134 | 206 | let query = |