mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2026-06-22 10:02:15 +00:00
The goal is to enable access to Git LFS resources with Authorized Integrations JWTs. Blocker that needed to be resolved is that adding the `AuthorizedIntegration` auth method would conflict with the LFS tokens, which are handed out during git ssh clones to allow access to LFS resources -- `AuthorizedIntegration` would mark these as `AuthenticationAttemptedIncorrectCredential`, and therefore the requests would 401 before they got to the LFS-specific token validation routines. The fix is to move LFS token authentication into an authentication group so that it could be resolved at the same time as the authorized integration, rather than doing it inside the LFS server routines. Refactors for LFS tokens are covered by refreshed test automation. Authorized integrations LFS Access has been manually tested, and will be further covered in an end-to-end integration test (https://code.forgejo.org/forgejo/end-to-end/pulls/1954). ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [x] in their respective `*_test.go` for unit tests. - [ ] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [ ] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12725 Reviewed-by: Andreas Ahlenstorf <aahlenst@noreply.codeberg.org> Reviewed-by: Gusted <gusted@noreply.codeberg.org>
129 lines
3.9 KiB
Go
129 lines
3.9 KiB
Go
// Copyright 2020 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package lfs
|
|
|
|
import (
|
|
"errors"
|
|
"fmt"
|
|
"time"
|
|
|
|
"forgejo.org/modules/util"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
const (
|
|
// MediaType contains the media type for LFS server requests
|
|
MediaType = "application/vnd.git-lfs+json"
|
|
// AcceptHeader Some LFS servers offer content with other types, so fallback to '*/*' if application/vnd.git-lfs+json cannot be served
|
|
AcceptHeader = "application/vnd.git-lfs+json;q=0.9, */*;q=0.8"
|
|
// UserAgentHeader Add User-Agent for gitea's self-implemented lfs client,
|
|
// and the version is consistent with the latest version of git lfs can be avoided incompatibilities.
|
|
// Some lfs servers will check this
|
|
UserAgentHeader = "git-lfs/3.6.0 (Forgejo)"
|
|
)
|
|
|
|
// BatchRequest contains multiple requests processed in one batch operation.
|
|
// https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md#requests
|
|
type BatchRequest struct {
|
|
Operation string `json:"operation"`
|
|
Transfers []string `json:"transfers,omitempty"`
|
|
Ref *Reference `json:"ref,omitempty"`
|
|
Objects []Pointer `json:"objects"`
|
|
}
|
|
|
|
// Reference contains a git reference.
|
|
// https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md#ref-property
|
|
type Reference struct {
|
|
Name string `json:"name"`
|
|
}
|
|
|
|
// Pointer contains LFS pointer data
|
|
type Pointer struct {
|
|
Oid string `json:"oid" xorm:"UNIQUE(s) INDEX NOT NULL"`
|
|
Size int64 `json:"size" xorm:"NOT NULL"`
|
|
}
|
|
|
|
// BatchResponse contains multiple object metadata Representation structures
|
|
// for use with the batch API.
|
|
// https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md#successful-responses
|
|
type BatchResponse struct {
|
|
Transfer string `json:"transfer,omitempty"`
|
|
Objects []*ObjectResponse `json:"objects"`
|
|
}
|
|
|
|
// ObjectResponse is object metadata as seen by clients of the LFS server.
|
|
type ObjectResponse struct {
|
|
Pointer
|
|
Actions map[string]*Link `json:"actions,omitempty"`
|
|
Links map[string]*Link `json:"_links,omitempty"`
|
|
Error *ObjectError `json:"error,omitempty"`
|
|
}
|
|
|
|
// Link provides a structure with information about how to access a object.
|
|
type Link struct {
|
|
Href string `json:"href"`
|
|
Header map[string]string `json:"header,omitempty"`
|
|
ExpiresAt *time.Time `json:"expires_at,omitempty"`
|
|
}
|
|
|
|
// ObjectError defines the JSON structure returned to the client in case of an error.
|
|
type ObjectError struct {
|
|
Code int `json:"code"`
|
|
Message string `json:"message"`
|
|
}
|
|
|
|
var (
|
|
// See https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md#successful-responses
|
|
// LFS object error codes should match HTTP status codes where possible:
|
|
// 404 - The object does not exist on the server.
|
|
// 409 - The specified hash algorithm disagrees with the server's acceptable options.
|
|
// 410 - The object was removed by the owner.
|
|
// 422 - Validation error.
|
|
|
|
ErrObjectNotExist = util.ErrNotExist // the object does not exist on the server
|
|
ErrObjectHashMismatch = errors.New("the specified hash algorithm disagrees with the server's acceptable options")
|
|
ErrObjectRemoved = errors.New("the object was removed by the owner")
|
|
ErrObjectValidation = errors.New("validation error")
|
|
)
|
|
|
|
func (e *ObjectError) Error() string {
|
|
return fmt.Sprintf("[%d] %s", e.Code, e.Message)
|
|
}
|
|
|
|
func (e *ObjectError) Unwrap() error {
|
|
switch e.Code {
|
|
case 404:
|
|
return ErrObjectNotExist
|
|
case 409:
|
|
return ErrObjectHashMismatch
|
|
case 410:
|
|
return ErrObjectRemoved
|
|
case 422:
|
|
return ErrObjectValidation
|
|
default:
|
|
return errors.New(e.Message)
|
|
}
|
|
}
|
|
|
|
// PointerBlob associates a Git blob with a Pointer.
|
|
type PointerBlob struct {
|
|
Hash string
|
|
Pointer
|
|
}
|
|
|
|
// ErrorResponse describes the error to the client.
|
|
type ErrorResponse struct {
|
|
Message string
|
|
DocumentationURL string `json:"documentation_url,omitempty"`
|
|
RequestID string `json:"request_id,omitempty"`
|
|
}
|
|
|
|
// Claims is a JWT Token Claims
|
|
type Claims struct {
|
|
RepoID int64
|
|
Op string
|
|
UserID int64
|
|
jwt.RegisteredClaims
|
|
}
|