internal/httpd/control.go

  1package httpd
  2
  3import (
  4	"bytes"
  5	"encoding/json"
  6	"io"
  7	"net/http"
  8	"strings"
  9
 10	"gitbay.org/gitbay/internal/control"
 11	"gitbay.org/gitbay/internal/gitutil"
 12	"gitbay.org/gitbay/internal/protocol"
 13	"gitbay.org/gitbay/internal/store"
 14)
 15
 16// runControl executes a control command as the browser session's user,
 17// through the same registry the CLI and the JSON API reach. Web writes
 18// never reimplement command logic — merge gates, review rules, and audit
 19// entries stay in one place — so the surfaces cannot drift apart.
 20//
 21// ViaAPI is set, which marks the request as one that arrived over HTTP.
 22// Nothing is held back from that door any more (#234): what a caller may
 23// do is the account's rights and its credential's scope, decided in one
 24// place for every surface.
 25func (s *Server) runControl(u store.User, argv []string) (out string, msg string, ok bool) {
 26	out, msg, code := s.runControlCode(u, argv)
 27	return out, msg, code == protocol.ExitOK
 28}
 29
 30// runControlCode is runControl with the exit code, for handlers that
 31// answer a form: not-found and denied deserve their own statuses rather
 32// than a redirect carrying the message (#106).
 33func (s *Server) runControlCode(u store.User, argv []string) (out string, msg string, code int) {
 34	var stdout, stderr bytes.Buffer
 35	ctx := &control.Ctx{
 36		User:   u,
 37		Source: control.SourceWeb,
 38		Scope:  "full",
 39		Store:  s.st,
 40		Cfg:    s.cfg,
 41		Stdin:  strings.NewReader(""),
 42		Stdout: &stdout,
 43		Stderr: &stderr,
 44		ViaAPI: true,
 45	}
 46	code = control.Dispatch(ctx, argv)
 47	m := strings.TrimSpace(stderr.String())
 48	if m == "" {
 49		m = strings.TrimSpace(stdout.String())
 50	}
 51	return stdout.String(), m, code
 52}
 53
 54// runControlStream runs a command whose output is written as it is
 55// produced: stdout goes to out, and done ends the command when the
 56// request does. msg is stderr.
 57func (s *Server) runControlStream(u store.User, argv []string, out io.Writer, done <-chan struct{}) (msg string, code int) {
 58	var stderr bytes.Buffer
 59	ctx := &control.Ctx{
 60		User:     u,
 61		Source:   control.SourceWeb,
 62		Scope:    "full",
 63		Store:    s.st,
 64		Cfg:      s.cfg,
 65		Stdin:    strings.NewReader(""),
 66		Stdout:   out,
 67		Stderr:   &stderr,
 68		ViaAPI:   true,
 69		Done:     done,
 70		Stopping: s.stopping,
 71	}
 72	code = control.Dispatch(ctx, argv)
 73	return strings.TrimSpace(stderr.String()), code
 74}
 75
 76// done finishes a form action by exit code: back to the page on success,
 77// the 404 page when the thing does not exist, and back to the page with
 78// the message for anything else. A refusal is feedback on the page a
 79// person was looking at, whether it is a merge gate, a permission they
 80// lack, or a field they got wrong; only a thing that does not exist has
 81// no page to go back to.
 82func (s *Server) done(w http.ResponseWriter, r *http.Request, code int, msg string,
 83	redirect func(http.ResponseWriter, *http.Request, string)) {
 84	switch code {
 85	case protocol.ExitOK:
 86		redirect(w, r, "")
 87	case protocol.ExitNotFound:
 88		s.notFound(w, r)
 89	default:
 90		redirect(w, r, msg)
 91	}
 92}
 93
 94// runControlStdin is runControl for the handful of commands whose input
 95// arrives on stdin: public keys, and review comment bodies. Stdin is
 96// also where a secret goes when one is set through this path, since
 97// argv is world-readable in /proc and the audit log keeps flag values.
 98func (s *Server) runControlStdin(u store.User, argv []string, stdin string) (msg string, ok bool) {
 99	msg, code := s.runControlStdinCode(u, argv, stdin)
100	return msg, code == protocol.ExitOK
101}
102
103func (s *Server) runControlStdinCode(u store.User, argv []string, stdin string) (msg string, code int) {
104	return s.runControlReader(u, argv, strings.NewReader(stdin))
105}
106
107// runControlReader is runControlStdinCode for a body too large to hold
108// as a string: the command reads it from stdin as a stream.
109func (s *Server) runControlReader(u store.User, argv []string, stdin io.Reader) (msg string, code int) {
110	var stdout, stderr bytes.Buffer
111	ctx := &control.Ctx{
112		User:   u,
113		Source: control.SourceWeb,
114		Scope:  "full",
115		Store:  s.st,
116		Cfg:    s.cfg,
117		Stdin:  stdin,
118		Stdout: &stdout,
119		Stderr: &stderr,
120		ViaAPI: true,
121	}
122	code = control.Dispatch(ctx, argv)
123	m := strings.TrimSpace(stderr.String())
124	if m == "" {
125		m = strings.TrimSpace(stdout.String())
126	}
127	return m, code
128}
129
130// runControlInto runs a command in JSON mode and decodes its data into
131// target. Read handlers use it so the web renders exactly what the CLI
132// and the API return, rather than reaching past the registry into git.
133func (s *Server) runControlInto(u store.User, argv []string, target any) (msg string, ok bool) {
134	code, msg := s.dispatchInto(u, argv, target)
135	return msg, code == protocol.ExitOK
136}
137
138// runControlIntoCode is runControlInto for handlers that have to tell
139// "no such thing" from "that failed": a profile page 404s on the first
140// and errors on the second.
141func (s *Server) runControlIntoCode(u store.User, argv []string, target any) (code int, msg string) {
142	return s.dispatchInto(u, argv, target)
143}
144
145func (s *Server) dispatchInto(u store.User, argv []string, target any) (int, string) {
146	return s.dispatchIntoStdin(u, argv, "", target)
147}
148
149// dispatchIntoStdin is dispatchInto with a body on stdin, decoding the
150// command's named payload rather than a map (#126).
151func (s *Server) dispatchIntoStdin(u store.User, argv []string, stdin string, target any) (int, string) {
152	var stdout, stderr bytes.Buffer
153	ctx := &control.Ctx{
154		User:   u,
155		Source: control.SourceWeb,
156		Scope:  "full",
157		Store:  s.st,
158		Cfg:    s.cfg,
159		Stdin:  strings.NewReader(stdin),
160		Stdout: &stdout,
161		Stderr: &stderr,
162		JSON:   true,
163		ViaAPI: true,
164	}
165	code := control.Dispatch(ctx, argv)
166	var env struct {
167		Data  json.RawMessage `json:"data"`
168		Error string          `json:"error"`
169	}
170	json.Unmarshal(stdout.Bytes(), &env)
171	if code != protocol.ExitOK {
172		m := env.Error
173		if m == "" {
174			m = strings.TrimSpace(stderr.String())
175		}
176		return code, m
177	}
178	if len(env.Data) > 0 {
179		if err := json.Unmarshal(env.Data, target); err != nil {
180			return protocol.ExitFailure, "unreadable response"
181		}
182	}
183	return protocol.ExitOK, ""
184}
185
186// dispatchJSON runs a command in JSON mode with stdin and returns its exit
187// code and, on failure, the message. In JSON mode a failure is an envelope
188// carrying the message rather than stderr text, so both paths are read
189// from the same envelope. A handler that wants the payload uses
190// runControlInto, which decodes into the command's own type instead of a
191// map nothing type-checks.
192func (s *Server) dispatchJSON(u store.User, argv []string, stdin string) (code int, msg string) {
193	var stdout, stderr bytes.Buffer
194	ctx := &control.Ctx{
195		User:   u,
196		Source: control.SourceWeb,
197		Scope:  "full",
198		Store:  s.st,
199		Cfg:    s.cfg,
200		Stdin:  strings.NewReader(stdin),
201		Stdout: &stdout,
202		Stderr: &stderr,
203		JSON:   true,
204		ViaAPI: true,
205	}
206	code = control.Dispatch(ctx, argv)
207	var env struct {
208		Error string `json:"error"`
209	}
210	json.Unmarshal(stdout.Bytes(), &env)
211	if code != protocol.ExitOK {
212		m := env.Error
213		if m == "" {
214			m = strings.TrimSpace(stderr.String())
215		}
216		if m == "" {
217			m = "the command failed"
218		}
219		return code, m
220	}
221	return code, ""
222}
223
224// authorNames maps commit author addresses to account names for one
225// request. A commit carries whatever name git was configured with; when
226// the address is a verified address here, the account's own name is the
227// truthful one to show, and it links somewhere.
228type authorNames struct {
229	st    *store.Store
230	cache map[string]string
231}
232
233func (s *Server) authorNames() *authorNames {
234	return &authorNames{st: s.st, cache: map[string]string{}}
235}
236
237// name returns the account name for an address, or the commit's own
238// author name when no account has verified it.
239func (a *authorNames) name(email, fallback string) string {
240	if email == "" {
241		return fallback
242	}
243	if got, ok := a.cache[email]; ok {
244		if got == "" {
245			return fallback
246		}
247		return got
248	}
249	name, _ := a.st.UsernameByVerifiedEmail(email)
250	a.cache[email] = name
251	if name == "" {
252		return fallback
253	}
254	return name
255}
256
257// account returns the account name behind an address, if any, so callers
258// can link the displayed name to a profile.
259func (a *authorNames) account(email string) (string, bool) {
260	if email == "" {
261		return "", false
262	}
263	if got, ok := a.cache[email]; ok {
264		return got, got != ""
265	}
266	name, _ := a.st.UsernameByVerifiedEmail(email)
267	a.cache[email] = name
268	return name, name != ""
269}
270
271// namedCommit is a listing commit plus the account behind its author
272// address, when there is one, so the name can link to a profile.
273type namedCommit struct {
274	gitutil.EntryCommit
275	User string
276}
277
278// namedCommits rewrites listing authors to account names where the
279// address is verified here.
280func (s *Server) namedCommits(m map[string]gitutil.EntryCommit) map[string]namedCommit {
281	names := s.authorNames()
282	out := make(map[string]namedCommit, len(m))
283	for k, c := range m {
284		user, _ := names.account(c.Email)
285		c.Author = names.name(c.Email, c.Author)
286		out[k] = namedCommit{EntryCommit: c, User: user}
287	}
288	return out
289}
290
291// namedTip does the same for the single commit above a tree listing.
292func (s *Server) namedTip(c gitutil.EntryCommit) namedCommit {
293	names := s.authorNames()
294	user, _ := names.account(c.Email)
295	c.Author = names.name(c.Email, c.Author)
296	return namedCommit{EntryCommit: c, User: user}
297}
298
299// webViewer is the account behind a page request, or the zero user when
300// the instance serves the web without accounts.
301func (s *Server) webViewer(r *http.Request) store.User {
302	if s.cfg.Web.Mode != "accounts" {
303		return store.User{}
304	}
305	return s.viewer(r)
306}