internal/httpd/routes.go

 1package httpd
 2
 3import "net/http"
 4
 5// Route is one entry in the explicit route table. The view-only guarantee is
 6// structural: Handler() consults web.mode when building the table, and the
 7// route test asserts no mutating route exists in view_only mode.
 8type Route struct {
 9	Method  string
10	Pattern string // without method prefix
11	// Mutating marks routes that can change server state. The git transport
12	// POSTs are not mutating: upload-pack is a pure read, and the
13	// receive-pack endpoint is a static refusal that writes nothing.
14	Mutating bool
15	Handler  http.HandlerFunc
16}
17
18// Routes returns the route table for the configured web.mode.
19func (s *Server) Routes() []Route {
20	// Git smart transport (anonymous, public repos only).
21	routes := []Route{
22		{Method: "GET", Pattern: "/{owner}/{repo}/info/refs", Handler: s.infoRefs},
23		{Method: "POST", Pattern: "/{owner}/{repo}/git-upload-pack", Handler: s.uploadPack},
24		{Method: "POST", Pattern: "/{owner}/{repo}/git-receive-pack", Handler: s.receivePackRefusal},
25	}
26
27	// Web UI, read-only. These exist in every mode.
28	routes = append(routes,
29		Route{Method: "GET", Pattern: "/{$}", Handler: s.index},
30		Route{Method: "GET", Pattern: "/explore", Handler: s.explore},
31		Route{Method: "GET", Pattern: "/static/style.css", Handler: s.stylesheet},
32		Route{Method: "GET", Pattern: "/favicon.svg", Handler: s.favicon},
33		Route{Method: "GET", Pattern: "/{owner}", Handler: s.ownerPage},
34		Route{Method: "GET", Pattern: "/{owner}/{repo}", Handler: s.repoHome},
35		Route{Method: "GET", Pattern: "/{owner}/{repo}/tree/{ref}/{path...}", Handler: s.tree},
36		Route{Method: "GET", Pattern: "/{owner}/{repo}/blob/{ref}/{path...}", Handler: s.blob},
37		Route{Method: "GET", Pattern: "/{owner}/{repo}/blame/{ref}/{path...}", Handler: s.blame},
38		Route{Method: "GET", Pattern: "/{owner}/{repo}/search", Handler: s.search},
39		Route{Method: "GET", Pattern: "/{owner}/{repo}/milestones", Handler: s.milestones},
40		Route{Method: "GET", Pattern: "/{owner}/{repo}/raw/{ref}/{path...}", Handler: s.raw},
41		Route{Method: "GET", Pattern: "/{owner}/{repo}/log", Handler: s.log},
42		Route{Method: "GET", Pattern: "/{owner}/{repo}/log/{ref}", Handler: s.log},
43		Route{Method: "GET", Pattern: "/{owner}/{repo}/commit/{sha}", Handler: s.commit},
44		Route{Method: "GET", Pattern: "/{owner}/{repo}/refs", Handler: s.refs},
45		Route{Method: "GET", Pattern: "/{owner}/{repo}/archive/{file}", Handler: s.archive},
46		Route{Method: "GET", Pattern: "/{owner}/{repo}/issues", Handler: s.issues},
47		Route{Method: "GET", Pattern: "/{owner}/{repo}/issues/{n}", Handler: s.issue},
48		Route{Method: "GET", Pattern: "/{owner}/{repo}/mrs", Handler: s.mrs},
49		Route{Method: "GET", Pattern: "/{owner}/{repo}/mrs/{n}", Handler: s.mr},
50	)
51
52	// The JSON API is its own opt-in surface, independent of web.mode.
53	if s.cfg.API.Enabled {
54		routes = append(routes,
55			Route{Method: "POST", Pattern: "/api/v1/cmd", Mutating: true, Handler: s.apiCmd},
56		)
57	}
58
59	// Account-mode routes exist only when web.mode = "accounts". In
60	// view_only they are never registered — the structural guarantee.
61	if s.cfg.Web.Mode == "accounts" {
62		routes = append(routes,
63			Route{Method: "GET", Pattern: "/login", Handler: s.login, Mutating: true}, // consumes a one-time token
64			Route{Method: "POST", Pattern: "/logout", Mutating: true,
65				Handler: s.checkOrigin(s.logout)},
66			Route{Method: "GET", Pattern: "/new", Handler: s.requireUser(s.newRepoForm)},
67			Route{Method: "POST", Pattern: "/new", Mutating: true,
68				Handler: s.checkOrigin(s.requireUser(s.newRepoSubmit))},
69			Route{Method: "GET", Pattern: "/{owner}/{repo}/issues/new",
70				Handler: s.requireUser(s.issueCreateForm)},
71			Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/new", Mutating: true,
72				Handler: s.checkOrigin(s.requireUser(s.issueCreateSubmit))},
73			Route{Method: "POST", Pattern: "/{owner}/{repo}/issues/{n}/comment", Mutating: true,
74				Handler: s.checkOrigin(s.requireUser(s.issueCommentSubmit))},
75			Route{Method: "POST", Pattern: "/{owner}/{repo}/mrs/{n}/comment", Mutating: true,
76				Handler: s.checkOrigin(s.requireUser(s.mrCommentSubmit))},
77			Route{Method: "GET", Pattern: "/{owner}/{repo}/edit/{ref}/{path...}",
78				Handler: s.requireUser(s.editForm)},
79			Route{Method: "POST", Pattern: "/{owner}/{repo}/edit/{ref}/{path...}", Mutating: true,
80				Handler: s.checkOrigin(s.requireUser(s.editSubmit))},
81		)
82	}
83	return routes
84}
85
86func (s *Server) Handler() http.Handler {
87	mux := http.NewServeMux()
88	for _, r := range s.Routes() {
89		mux.HandleFunc(r.Method+" "+r.Pattern, r.Handler)
90	}
91	return mux
92}