internal/control/import.go
170 lines · 5713 bytes
1package control
2
3import (
4 "bufio"
5 "context"
6 "fmt"
7 "io"
8 "os"
9 "path/filepath"
10 "strings"
11 "time"
12
13 "gitbay.org/gitbay/internal/gitutil"
14 "gitbay.org/gitbay/internal/policy"
15 "gitbay.org/gitbay/internal/protocol"
16)
17
18func init() {
19 register(Command{Path: []string{"repo", "import"},
20 Summary: "server-side mirror of a foreign repository",
21 Usage: "repo import <owner/name> --from <url> [--private] [--token-stdin]",
22 ReadsStdin: true, Run: runRepoImport})
23}
24
25// askpassScript answers git's credential prompts from the environment, so
26// the token never appears on a command line or in a URL. Username prompts
27// get a placeholder (GitHub and GitLab ignore it for token auth).
28const askpassScript = `#!/bin/sh
29case "$1" in
30 Username*) echo "x-access-token" ;;
31 *) echo "${GITBAY_IMPORT_TOKEN}" ;;
32esac
33`
34
35func runRepoImport(c *Ctx, args []string) int {
36 f, err := parseFlags(args, flagSpec{Values: []string{"--from"}, Bools: []string{"--private", "--token-stdin"}, MaxPos: 1,
37 Usage: "repo import <owner/name> --from <url> [--private] [--token-stdin]"})
38 if err != nil {
39 return c.fail(protocol.ExitUsage, "%v", err)
40 }
41 path, from, private, tokenStdin := f.pos(0), f.Value("--from"), f.Has("--private"), f.Has("--token-stdin")
42 if path == "" || from == "" {
43 return c.fail(protocol.ExitUsage, "usage: repo import <owner/name> --from <url> [--private] [--token-stdin]")
44 }
45 owner, name, ok := strings.Cut(path, "/")
46 if !ok {
47 return c.fail(protocol.ExitUsage, "usage: repo import <owner/name> --from <url>")
48 }
49 if err := policy.ValidateName(name); err != nil {
50 return c.failErr(err)
51 }
52 // Same ownership rule as repo create: yourself, or an org you admin.
53 ownerKind, ownerID := "user", c.User.ID
54 if owner != c.User.Username {
55 org, err := c.Store.OrgByName(owner)
56 if err != nil {
57 return c.fail(protocol.ExitDenied, "cannot import under %q: not you and not an organization you can see", owner)
58 }
59 role, err := c.Store.OrgRole(org.ID, c.User.ID)
60 if err != nil {
61 return c.fail(protocol.ExitFailure, "%v", err)
62 }
63 if role != "admin" {
64 return c.fail(protocol.ExitDenied, "only admins of %s can import repositories there", owner)
65 }
66 ownerKind, ownerID = "org", org.ID
67 }
68 if ownerKind == "user" {
69 if code := checkRepoQuota(c); code >= 0 {
70 return code
71 }
72 }
73
74 // Scheme allowlist. file:// (and anything else local) would read the
75 // server's filesystem; ssh:// would use the server's own keys.
76 switch {
77 case strings.HasPrefix(from, "https://"), strings.HasPrefix(from, "http://"), strings.HasPrefix(from, "git://"):
78 default:
79 return c.fail(protocol.ExitUsage, "import supports https://, http://, and git:// URLs only")
80 }
81 if strings.ContainsAny(from, "@") {
82 // Credentials belong on stdin, not in the URL where they would
83 // land in process listings and logs.
84 return c.fail(protocol.ExitUsage, "do not embed credentials in the URL; use --token-stdin")
85 }
86
87 // The token is read from stdin and handed to git via GIT_ASKPASS and
88 // the environment — never argv, never the database, never a log line.
89 var env []string
90 if tokenStdin {
91 token, err := bufio.NewReader(io.LimitReader(c.Stdin, 4096)).ReadString('\n')
92 if err != nil && err != io.EOF {
93 return c.fail(protocol.ExitFailure, "reading token: %v", err)
94 }
95 token = strings.TrimSpace(token)
96 if token == "" {
97 return c.fail(protocol.ExitUsage, "--token-stdin given but stdin held no token")
98 }
99 askpass := filepath.Join(c.Cfg.Server.Root, "askpass.sh")
100 if err := os.WriteFile(askpass, []byte(askpassScript), 0o700); err != nil {
101 return c.fail(protocol.ExitFailure, "%v", err)
102 }
103 env = []string{
104 "GIT_ASKPASS=" + askpass,
105 "GITBAY_IMPORT_TOKEN=" + token,
106 "GIT_TERMINAL_PROMPT=0",
107 }
108 } else {
109 env = []string{"GIT_TERMINAL_PROMPT=0"}
110 }
111
112 visibility := "public"
113 if private {
114 visibility = "private"
115 }
116 // The early check above fails fast; this one holds the lock across
117 // the insert so a concurrent create cannot slip past the count.
118 repoCreateMu.Lock()
119 if ownerKind == "user" {
120 if code := checkRepoQuota(c); code >= 0 {
121 repoCreateMu.Unlock()
122 return code
123 }
124 }
125 id, err := c.Store.CreateRepo(ownerKind, ownerID, name, visibility)
126 repoCreateMu.Unlock()
127 if err != nil {
128 return c.fail(protocol.ExitFailure, "%v", err)
129 }
130 dir := RepoDir(c.Cfg.Server.Root, owner, name)
131 cleanup := func() {
132 c.Store.DeleteRepo(id)
133 os.RemoveAll(dir)
134 }
135 if err := gitutil.InitBare(dir, "main", HooksDir(c.Cfg.Server.Root)); err != nil {
136 cleanup()
137 return c.fail(protocol.ExitFailure, "%v", err)
138 }
139
140 timeout := time.Duration(c.Cfg.Limits.CloneTimeoutSec) * time.Second
141 ctx, cancel := context.WithTimeout(context.Background(), timeout)
142 defer cancel()
143
144 fmt.Fprintf(c.Stderr, "importing %s into %s ...\n", from, path)
145 if err := gitutil.FetchMirror(ctx, dir, from, c.Stderr, env); err != nil {
146 cleanup()
147 return c.fail(protocol.ExitFailure, "import failed: %v", err)
148 }
149
150 branch, err := gitutil.RemoteDefaultBranch(ctx, from, env)
151 if err != nil {
152 branch = "main" // remote gone quiet after the fetch; keep the default
153 }
154 if _, rerr := gitutil.ResolveRef(dir, "refs/heads/"+branch); rerr == nil {
155 gitutil.SetHead(dir, branch)
156 c.Store.UpdateDefaultBranch(id, branch)
157 }
158
159 c.Store.RecordEvent(id, c.User.ID, "repo.imported", fmt.Sprintf(`{"from":%q}`, from))
160 type out struct {
161 Path string `json:"path"`
162 Visibility string `json:"visibility"`
163 DefaultBranch string `json:"default_branch"`
164 }
165 d := out{path, visibility, branch}
166 return c.emit(d, func(w io.Writer) {
167 fmt.Fprintf(w, "imported %s (%s, default %s)\nnote: git data only — issues and pull requests do not transfer\n",
168 d.Path, d.Visibility, d.DefaultBranch)
169 })
170}