internal/control/import.go
185 lines · 6699 bytes
1package control
2
3import (
4 "bufio"
5 "context"
6 "fmt"
7 "io"
8 "os"
9 "path/filepath"
10 "strings"
11 "time"
12
13 "gitbay.org/gitbay/internal/gitpin"
14 "gitbay.org/gitbay/internal/gitutil"
15 "gitbay.org/gitbay/internal/policy"
16 "gitbay.org/gitbay/internal/protocol"
17)
18
19func init() {
20 register(Command{Path: []string{"repo", "import"},
21 Summary: "server-side mirror of a foreign repository",
22 Usage: "repo import <owner/name> --from <url> [--private] [--token-stdin]",
23 Flags: []Flag{
24 {"--from", "<url>", "the repository to import", ""},
25 {"--private", "", "create it private", ""},
26 {"--token-stdin", "", "read a credential token from stdin", ""},
27 },
28 Examples: []string{"repo import krz/imported --from https://github.com/krz/old.git"},
29 ReadsStdin: true, Run: runRepoImport})
30}
31
32// askpassScript answers git's credential prompts from the environment, so
33// the token never appears on a command line or in a URL. Username prompts
34// get a placeholder (GitHub and GitLab ignore it for token auth).
35const askpassScript = `#!/bin/sh
36case "$1" in
37 Username*) echo "x-access-token" ;;
38 *) echo "${GITBAY_IMPORT_TOKEN}" ;;
39esac
40`
41
42// importLookup resolves the hosts repo import and repo import-issues
43// connect to; tests replace it.
44var importLookup gitpin.Lookup = gitpin.LookupIP
45
46func runRepoImport(c *Ctx, args []string) int {
47 f, err := c.parseArgs(args, flagSpec{Values: []string{"--from"}, Bools: []string{"--private", "--token-stdin"}, MaxPos: 1,
48 Usage: "repo import <owner/name> --from <url> [--private] [--token-stdin]"})
49 if err != nil {
50 return c.fail(protocol.ExitUsage, "%v", err)
51 }
52 path, from, private, tokenStdin := f.pos(0), f.Value("--from"), f.Has("--private"), f.Has("--token-stdin")
53 if path == "" || from == "" {
54 return c.usage()
55 }
56 owner, name, ok := strings.Cut(path, "/")
57 if !ok {
58 return c.usage()
59 }
60 if err := policy.ValidateName(name); err != nil {
61 return c.failInput(err)
62 }
63 // Same ownership rule as repo create: yourself, or an org you admin.
64 ownerKind, ownerID := "user", c.User.ID
65 if owner != c.User.Username {
66 org, err := c.Store.OrgByName(owner)
67 if err != nil {
68 return c.fail(protocol.ExitDenied, "cannot import under %q: not you and not an organization you can see", owner)
69 }
70 role, err := c.Store.OrgRole(org.ID, c.User.ID)
71 if err != nil {
72 return c.fail(protocol.ExitFailure, "%v", err)
73 }
74 if role != "admin" {
75 return c.fail(protocol.ExitDenied, "only admins of %s can import repositories there", owner)
76 }
77 ownerKind, ownerID = "org", org.ID
78 }
79 if code := checkRepoQuota(c, ownerKind, ownerID); code >= 0 {
80 return code
81 }
82
83 // http and https only. git:// has no equivalent of curl's resolve
84 // list, so its connection cannot be held to a checked address;
85 // file:// would read the server's filesystem, and ssh:// would use
86 // the server's own keys.
87 if !strings.HasPrefix(from, "https://") && !strings.HasPrefix(from, "http://") {
88 return c.fail(protocol.ExitUsage, "import fetches over http:// and https:// only; use the repository's https:// URL")
89 }
90 if strings.ContainsAny(from, "@") {
91 // Credentials belong on stdin, not in the URL where they would
92 // land in process listings and logs.
93 return c.fail(protocol.ExitUsage, "do not embed credentials in the URL; use --token-stdin")
94 }
95 if strings.ContainsAny(from, "?#") {
96 // The URL is logged and recorded; a query could carry a token.
97 return c.fail(protocol.ExitUsage, "use the plain clone URL, without a query or fragment; credentials go on stdin with --token-stdin, never in the URL")
98 }
99
100 // Resolve and check the host now and hold git to those addresses,
101 // as mirror sync does (#298).
102 timeout := time.Duration(c.Cfg.Limits.CloneTimeoutSec) * time.Second
103 ctx, cancel := context.WithTimeout(context.Background(), timeout)
104 defer cancel()
105 if err := gitpin.CheckGit(ctx); err != nil {
106 return c.fail(protocol.ExitFailure, "import unavailable: %v", err)
107 }
108 remote, err := gitpin.Resolve(ctx, importLookup, from, c.Cfg.Webhooks.AllowLocal)
109 if err != nil {
110 return c.fail(protocol.ExitFailure, "%v", err)
111 }
112
113 // The token is read from stdin and handed to git via GIT_ASKPASS and
114 // the environment — never argv, never the database, never a log line.
115 env := gitpin.Env(c.Cfg.Server.Root)
116 if tokenStdin {
117 token, err := bufio.NewReader(io.LimitReader(c.Stdin, 4096)).ReadString('\n')
118 if err != nil && err != io.EOF {
119 return c.fail(protocol.ExitFailure, "reading token: %v", err)
120 }
121 token = strings.TrimSpace(token)
122 if token == "" {
123 return c.fail(protocol.ExitUsage, "--token-stdin given but stdin held no token")
124 }
125 askpass := filepath.Join(c.Cfg.Server.Root, "askpass.sh")
126 if err := os.WriteFile(askpass, []byte(askpassScript), 0o700); err != nil {
127 return c.fail(protocol.ExitFailure, "%v", err)
128 }
129 env = append(env, "GIT_ASKPASS="+askpass, "GITBAY_IMPORT_TOKEN="+token)
130 }
131
132 visibility := "public"
133 if private {
134 visibility = "private"
135 }
136 // The early check above fails fast; this one holds the lock across
137 // the insert so a concurrent create cannot slip past the count.
138 repoCreateMu.Lock()
139 if code := checkRepoQuota(c, ownerKind, ownerID); code >= 0 {
140 repoCreateMu.Unlock()
141 return code
142 }
143 id, err := c.Store.CreateRepo(ownerKind, ownerID, name, visibility)
144 repoCreateMu.Unlock()
145 if err != nil {
146 return c.fail(protocol.ExitFailure, "%v", err)
147 }
148 dir := RepoDir(c.Cfg.Server.Root, owner, name)
149 cleanup := func() {
150 c.Store.DeleteRepo(id)
151 os.RemoveAll(dir)
152 }
153 if err := gitutil.InitBare(dir, "main", HooksDir(c.Cfg.Server.Root)); err != nil {
154 cleanup()
155 return c.fail(protocol.ExitFailure, "%v", err)
156 }
157
158 fmt.Fprintf(c.Stderr, "importing %s into %s ...\n", from, path)
159 if err := gitutil.FetchMirror(ctx, dir, from, c.Stderr, remote.Args(), env); err != nil {
160 cleanup()
161 return c.fail(protocol.ExitFailure, "import failed: %v", err)
162 }
163
164 branch, err := gitutil.RemoteDefaultBranch(ctx, dir, from, remote.Args(), env)
165 if err != nil {
166 branch = "main" // remote gone quiet after the fetch; keep the default
167 }
168 if _, rerr := gitutil.ResolveRef(dir, "refs/heads/"+branch); rerr == nil {
169 gitutil.SetHead(dir, branch)
170 c.Store.UpdateDefaultBranch(id, branch)
171 }
172 c.Store.RequestSymbolIndex(id, false)
173
174 c.Store.RecordEvent(id, c.User.ID, "repo.imported", fmt.Sprintf(`{"from":%q}`, from))
175 type out struct {
176 Path string `json:"path"`
177 Visibility string `json:"visibility"`
178 DefaultBranch string `json:"default_branch"`
179 }
180 d := out{path, visibility, branch}
181 return c.emit(d, func(w io.Writer) {
182 fmt.Fprintf(w, "imported %s (%s, default %s)\nnote: git data only — issues and pull requests do not transfer\n",
183 d.Path, d.Visibility, d.DefaultBranch)
184 })
185}