internal/httpd/routes.go
222 lines · 11739 bytes
1package httpd
2
3import (
4 "fmt"
5 "net"
6 "net/http"
7 "strings"
8)
9
10// Route is one entry in the explicit route table. The view-only guarantee is
11// structural: Handler() consults web.mode when building the table, and the
12// route test asserts no mutating route exists in view_only mode.
13type Route struct {
14 Method string
15 Pattern string // without method prefix
16 // Mutating marks routes that can change server state. The git transport
17 // POSTs are not mutating: upload-pack is a pure read, and the
18 // receive-pack endpoint is a static refusal that writes nothing.
19 Mutating bool
20 Handler http.HandlerFunc
21}
22
23// Routes returns the route table for the configured web.mode.
24func (s *Server) Routes() []Route {
25 // Git smart transport (anonymous, public repos only).
26 routes := []Route{
27 {Method: "GET", Pattern: "/{owner}/{repo}/info/refs", Handler: s.infoRefs},
28 {Method: "POST", Pattern: "/{owner}/{repo}/git-upload-pack", Handler: s.uploadPack},
29 {Method: "POST", Pattern: "/{owner}/{repo}/git-receive-pack", Handler: s.receivePackRefusal},
30 // Git LFS: token-authenticated transport (minted over SSH), not
31 // web-session routes — anonymous download for public repos only.
32 {Method: "POST", Pattern: "/{owner}/{repo}/info/lfs/objects/batch", Handler: s.lfsBatch},
33 {Method: "GET", Pattern: "/{owner}/{repo}/info/lfs/objects/{oid}", Handler: s.lfsDownload},
34 {Method: "PUT", Pattern: "/{owner}/{repo}/info/lfs/objects/{oid}", Handler: s.lfsUpload},
35 }
36
37 // Web UI, read-only. These exist in every mode.
38 routes = append(routes,
39 Route{Method: "GET", Pattern: "/{$}", Handler: s.index},
40 Route{Method: "GET", Pattern: "/explore", Handler: s.explore},
41 Route{Method: "GET", Pattern: "/privacy", Handler: s.privacy},
42 Route{Method: "GET", Pattern: "/static/style.css", Handler: s.stylesheet},
43 // Literal per-file routes: a {name} wildcard is ambiguous against
44 // /{owner}/{repo}/... patterns in ServeMux precedence.
45 Route{Method: "GET", Pattern: "/static/fonts/plex-sans.woff2", Handler: s.font},
46 Route{Method: "GET", Pattern: "/static/fonts/plex-mono-400.woff2", Handler: s.font},
47 Route{Method: "GET", Pattern: "/static/fonts/plex-mono-500.woff2", Handler: s.font},
48 Route{Method: "GET", Pattern: "/favicon.svg", Handler: s.favicon},
49 Route{Method: "GET", Pattern: "/{owner}", Handler: s.ownerPage},
50 Route{Method: "GET", Pattern: "/{owner}/{repo}", Handler: s.repoHome},
51 Route{Method: "GET", Pattern: "/{owner}/{repo}/tree/{ref}/{path...}", Handler: s.tree},
52 Route{Method: "GET", Pattern: "/{owner}/{repo}/blob/{ref}/{path...}", Handler: s.blob},
53 Route{Method: "GET", Pattern: "/{owner}/{repo}/blame/{ref}/{path...}", Handler: s.blame},
54 Route{Method: "GET", Pattern: "/{owner}/{repo}/search", Handler: s.search},
55 Route{Method: "GET", Pattern: "/{owner}/{repo}/milestones", Handler: s.milestones},
56 Route{Method: "GET", Pattern: "/{owner}/{repo}/wiki", Handler: s.wiki},
57 Route{Method: "GET", Pattern: "/{owner}/{repo}/wiki/_raw/{path...}", Handler: s.wikiRaw},
58 Route{Method: "GET", Pattern: "/{owner}/{repo}/wiki/{page}", Handler: s.wiki},
59 Route{Method: "GET", Pattern: "/{owner}/{repo}/releases", Handler: s.releases},
60 Route{Method: "GET", Pattern: "/{owner}/{repo}/builds", Handler: s.builds},
61 Route{Method: "GET", Pattern: "/{owner}/{repo}/badge/build.svg", Handler: s.buildBadge},
62 Route{Method: "GET", Pattern: "/{owner}/{repo}/builds/{n}", Handler: s.build},
63 Route{Method: "GET", Pattern: "/{owner}/{repo}/releases/download/{tag}/{name}", Handler: s.releaseAsset},
64 Route{Method: "GET", Pattern: "/{owner}/{repo}/raw/{ref}/{path...}", Handler: s.raw},
65 Route{Method: "GET", Pattern: "/{owner}/{repo}/log", Handler: s.log},
66 Route{Method: "GET", Pattern: "/{owner}/{repo}/log/{ref}", Handler: s.log},
67 Route{Method: "GET", Pattern: "/{owner}/{repo}/commit/{sha}", Handler: s.commit},
68 Route{Method: "GET", Pattern: "/{owner}/{repo}/refs", Handler: s.refs},
69 Route{Method: "GET", Pattern: "/{owner}/{repo}/archive/{file}", Handler: s.archive},
70 Route{Method: "GET", Pattern: "/{owner}/{repo}/issues", Handler: s.issues},
71 Route{Method: "GET", Pattern: "/{owner}/{repo}/issues/{n}", Handler: s.issue},
72 Route{Method: "GET", Pattern: "/{owner}/{repo}/mrs", Handler: s.mrs},
73 Route{Method: "GET", Pattern: "/{owner}/{repo}/mrs/{n}", Handler: s.mr},
74 )
75
76 // The JSON API is its own opt-in surface, independent of web.mode.
77 if s.cfg.API.Enabled {
78 routes = append(routes,
79 Route{Method: "POST", Pattern: "/api/v1/cmd", Mutating: true, Handler: s.apiCmd},
80 Route{Method: "GET", Pattern: "/api/v1/read", Handler: s.apiRead},
81 )
82 }
83
84 // Account-mode routes exist only when web.mode = "accounts". In
85 // view_only they are never registered — the structural guarantee.
86 if s.cfg.Web.Mode == "accounts" {
87 routes = append(routes,
88 Route{Method: "GET", Pattern: "/login", Handler: s.login, Mutating: true}, // consumes a one-time token
89 Route{Method: "POST", Pattern: "/logout", Mutating: true,
90 Handler: s.checkOrigin(s.logout)},
91 Route{Method: "GET", Pattern: "/new", Handler: s.requireUser(s.newRepoForm)},
92 Route{Method: "GET", Pattern: "/settings", Handler: s.requireUser(s.accountForm)},
93 Route{Method: "POST", Pattern: "/{owner}", Mutating: true,
94 Handler: s.checkOrigin(s.requireUser(s.orgSubmit))},
95 Route{Method: "POST", Pattern: "/settings", Mutating: true,
96 Handler: s.checkOrigin(s.requireUser(s.accountSubmit))},
97 )
98 // Web signup fronts the same registration path as SSH register,
99 // so it exists only when registration is open or invite.
100 if s.cfg.Registration.Mode != "closed" {
101 routes = append(routes,
102 Route{Method: "GET", Pattern: "/register", Handler: s.signupForm},
103 Route{Method: "POST", Pattern: "/register", Mutating: true,
104 Handler: s.checkOrigin(s.signupSubmit)},
105 )
106 }
107 routes = append(routes,
108 Route{Method: "POST", Pattern: "/new", Mutating: true,
109 Handler: s.checkOrigin(s.requireUser(s.newRepoSubmit))},
110 Route{Method: "POST", Pattern: "/{owner}/{repo}/pin", Mutating: true,
111 Handler: s.checkOrigin(s.requireUser(s.pinToggle))},
112 Route{Method: "GET", Pattern: "/{owner}/{repo}/issues/new",
113 Handler: s.requireUser(s.issueCreateForm)},
114 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/new", Mutating: true,
115 Handler: s.checkOrigin(s.requireUser(s.issueCreateSubmit))},
116 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/comment", Mutating: true,
117 Handler: s.checkOrigin(s.requireUser(s.issueCommentSubmit))},
118 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/edit", Mutating: true,
119 Handler: s.checkOrigin(s.requireUser(s.issueEditSubmit))},
120 // Triage: each runs the matching issue command.
121 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/state", Mutating: true,
122 Handler: s.checkOrigin(s.requireUser(s.issueStateSubmit))},
123 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/label", Mutating: true,
124 Handler: s.checkOrigin(s.requireUser(s.issueLabelSubmit))},
125 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/assign", Mutating: true,
126 Handler: s.checkOrigin(s.requireUser(s.issueAssignSubmit))},
127 Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/milestone", Mutating: true,
128 Handler: s.checkOrigin(s.requireUser(s.issueMilestoneSubmit))},
129 Route{Method: "POST", Pattern: "/{owner}/{repo}/releases", Mutating: true,
130 Handler: s.checkOrigin(s.requireUser(s.releaseSubmit))},
131 Route{Method: "POST", Pattern: "/{owner}/{repo}/builds", Mutating: true,
132 Handler: s.checkOrigin(s.requireUser(s.buildTriggerSubmit))},
133 Route{Method: "GET", Pattern: "/{owner}/{repo}/settings",
134 Handler: s.requireUser(s.settingsForm)},
135 Route{Method: "POST", Pattern: "/{owner}/{repo}/settings", Mutating: true,
136 Handler: s.checkOrigin(s.requireUser(s.settingsSubmit))},
137 Route{Method: "GET", Pattern: "/{owner}/{repo}/mrs/new",
138 Handler: s.requireUser(s.mrCreateForm)},
139 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/new", Mutating: true,
140 Handler: s.checkOrigin(s.requireUser(s.mrCreateSubmit))},
141 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/edit", Mutating: true,
142 Handler: s.checkOrigin(s.requireUser(s.mrEditSubmit))},
143 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/comment", Mutating: true,
144 Handler: s.checkOrigin(s.requireUser(s.mrCommentSubmit))},
145 // Review loop: each runs the matching mr command.
146 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/review", Mutating: true,
147 Handler: s.checkOrigin(s.requireUser(s.mrReviewSubmit))},
148 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/merge", Mutating: true,
149 Handler: s.checkOrigin(s.requireUser(s.mrMergeSubmit))},
150 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/close", Mutating: true,
151 Handler: s.checkOrigin(s.requireUser(s.mrCloseSubmit))},
152 Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/thread", Mutating: true,
153 Handler: s.checkOrigin(s.requireUser(s.mrThreadSubmit))},
154 Route{Method: "GET", Pattern: "/{owner}/{repo}/edit/{ref}/{path...}",
155 Handler: s.requireUser(s.editForm)},
156 Route{Method: "POST", Pattern: "/{owner}/{repo}/edit/{ref}/{path...}", Mutating: true,
157 Handler: s.checkOrigin(s.requireUser(s.editSubmit))},
158 )
159 }
160 return routes
161}
162
163func (s *Server) Handler() http.Handler {
164 mux := http.NewServeMux()
165 for _, r := range s.Routes() {
166 mux.HandleFunc(r.Method+" "+r.Pattern, r.Handler)
167 }
168 var h http.Handler = mux
169 if len(s.cfg.GoImport) > 0 {
170 h = s.goImportHandler(mux)
171 }
172 // Always wrapped: custom pages domains work with or without the
173 // built-in [pages] domain.
174 return s.pagesRouter(s.securityHeaders(h))
175}
176
177// securityHeaders sets defensive response headers on every reply. The CSP
178// is strict where it can be: no scripts at all (the UI needs none), no
179// plugins, no embedding. Inline styles are allowed because label chips
180// carry their color inline (chroma is class-based so the syntax palette
181// can follow the color scheme). Images may load from anywhere so external README images
182// still render; they are the one thing a reader-facing forge can't police
183// without a proxy.
184func (s *Server) securityHeaders(next http.Handler) http.Handler {
185 const csp = "default-src 'self'; script-src 'none'; style-src 'self' 'unsafe-inline'; " +
186 "img-src * data:; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'"
187 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
188 hd := w.Header()
189 hd.Set("Content-Security-Policy", csp)
190 hd.Set("X-Frame-Options", "DENY")
191 hd.Set("X-Content-Type-Options", "nosniff")
192 hd.Set("Referrer-Policy", "no-referrer")
193 hd.Set("Cross-Origin-Opener-Policy", "same-origin")
194 if s.cfg.HTTP.TLS != "off" {
195 hd.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
196 }
197 next.ServeHTTP(w, r)
198 })
199}
200
201func (s *Server) goImportHandler(mux http.Handler) http.Handler {
202 // Vanity Go modules: ?go-get=1 requests under a configured module
203 // path answer with the go-import meta tag before normal routing.
204 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
205 if r.URL.Query().Get("go-get") == "1" {
206 host := r.Host
207 if h, _, err := net.SplitHostPort(host); err == nil {
208 host = h
209 }
210 requested := host + strings.TrimSuffix(r.URL.Path, "/")
211 for module, repo := range s.cfg.GoImport {
212 if requested == module || strings.HasPrefix(requested, module+"/") {
213 w.Header().Set("Content-Type", "text/html; charset=utf-8")
214 fmt.Fprintf(w, `<!DOCTYPE html><html><head><meta name="go-import" content="%s git %s/%s.git"></head><body>%s</body></html>`,
215 module, s.cfg.Server.SiteURL, repo, module)
216 return
217 }
218 }
219 }
220 mux.ServeHTTP(w, r)
221 })
222}