package gitrepo

import ( "context" "crypto/sha256" "errors" "fmt" "os" "path" "sort" "strings" "sync"

"github.com/go-git/go-billy/v5"
"github.com/go-git/go-billy/v5/osfs"
"github.com/go-git/go-billy/v5/util"
"github.com/go-git/go-git/v5/plumbing/protocol/packp"
"github.com/go-git/go-git/v5/plumbing/storer"
"github.com/go-git/go-git/v5/storage/filesystem"

"gitweb/internal/githttp"
"gitweb/internal/store"

)

// ErrConcurrentModification is returned when a repo's store Sequence changed // between materialization and write-back, meaning the tree was modified out of // band during the push. The push is abandoned without writing anything. var ErrConcurrentModification = errors.New("remote repository changed during push; please retry")

// defaultPushConcurrency caps pushes in flight across all repos; each one // holds a full private copy of its repo on disk while it runs. const defaultPushConcurrency = 2

// Pusher applies a git receive-pack (push) to an upspin-stored repo. It // materializes a private, writable copy of the repo, runs the push against it // with go-git, and writes the changed files back to the store. Pushes to the // same repo are serialized, and total pushes in flight are bounded. type Pusher struct { st store.WriteStore cache *Cache sem chan struct{} // bounds concurrent pushes

mu    sync.Mutex
locks map[string]*sync.Mutex

}

// NewPusher returns a Pusher writing through st and invalidating c on success. func NewPusher(st store.WriteStore, c *Cache) *Pusher { return &Pusher{ st: st, cache: c, sem: make(chan struct{}, defaultPushConcurrency), locks: map[string]*sync.Mutex{}, } }

func (p *Pusher) lockFor(repoPath string) *sync.Mutex { p.mu.Lock() defer p.mu.Unlock() l := p.locks[repoPath] if l == nil { l = &sync.Mutex{} p.locks[repoPath] = l } return l }

// noPackfileWriter hides the storer's optional PackfileWriter capability from // the receive-pack session. With it visible, go-git copies the client's // packfile verbatim into objects/pack, and that path cannot resolve the // REF_DELTA entries of a thin pack — which git sends on every incremental // push, deltifying against objects that live in the repo, not in the pack — // so such pushes fail with "reference delta not found". Hidden, go-git parses // the pack against the storer, resolving thin deltas and storing the new // objects loose. type noPackfileWriter struct{ storer.Storer }

// ReceivePack runs the push described by req against repoPath and writes the // result back to the store. The returned ReportStatus should be sent to the // client even when err is non-nil (it carries per-ref status). func (p *Pusher) ReceivePack(ctx context.Context, repoPath string, req *packp.ReferenceUpdateRequest) (*packp.ReportStatus, error) { lock := p.lockFor(repoPath) lock.Lock() defer lock.Unlock()

// Bound pushes in flight (each holds a private on-disk repo copy). Taken
// after the per-repo lock: holders always release, so no cycle.
select {
case p.sem <- struct{}{}:
	defer func() { <-p.sem }()
case <-ctx.Done():
	return nil, ctx.Err()
}

seq0, err := p.st.Seq(repoPath)
if err != nil {
	return nil, err
}

// A private on-disk copy: never the shared read cache, which serves
// concurrent readers and must not be mutated.
dir, err := os.MkdirTemp(p.cache.dir, "push-")
if err != nil {
	return nil, err
}
defer removeDir(dir)
fs := osfs.New(dir)
before, err := materialize(p.st, repoPath, fs, p.cache.maxRepo)
if err != nil {
	return nil, err
}

sto := filesystem.NewStorage(fs, p.cache.objects)
sess, err := githttp.NewReceivePackSession(noPackfileWriter{sto})
if err != nil {
	return nil, err
}
defer sess.Close()

rs, rpErr := sess.ReceivePack(ctx, req)
if rpErr != nil {
	// Unpack or ref update failed; the storer may be in a partial state, so
	// do not write anything back. The report status still goes to the client.
	return rs, rpErr
}

after, err := walkManifest(fs, p.cache.maxRepo)
if err != nil {
	return failReport(rs, err), err
}

// Guard against an out-of-band change to the tree since we materialized.
// The per-repo lock already excludes other pushes through this server.
seq1, err := p.st.Seq(repoPath)
if err != nil {
	return failReport(rs, err), err
}
if seq1 != seq0 {
	return failReport(rs, ErrConcurrentModification), ErrConcurrentModification
}

if err := p.writeBack(fs, before, after, repoPath); err != nil {
	return failReport(rs, err), err
}
p.cache.Invalidate(repoPath)
return rs, nil

}

// failReport downgrades every "ok" per-ref status in rs to err's message. The // session updated only the private copy; when persisting to the store fails, // the client must see its refs rejected, not an "ok" report for updates that // were never written. The message is flattened to one line so it survives // pkt-line framing. func failReport(rs *packp.ReportStatus, err error) *packp.ReportStatus { if rs == nil { return nil } msg := strings.Join(strings.Fields(err.Error()), " ") for _, cs := range rs.CommandStatuses { if cs.Error() == nil { // "ok" cs.Status = msg } } return rs }

// writeBack applies the difference between the before and after manifests to the // store: new/changed files are written objects-first then refs, and files that // disappeared are deleted last. This ordering keeps a concurrent reader's view // consistent — it may briefly see extra unreachable objects, never a ref that // points at a missing object. func (p *Pusher) writeBack(fs billy.Filesystem, before, after Manifest, repoPath string) error { var objectPuts, refPuts, dels []string for name, info := range after { if old, ok := before[name]; ok && old.Sum == info.Sum { continue // unchanged } if strings.HasPrefix(name, "objects/") { objectPuts = append(objectPuts, name) } else { refPuts = append(refPuts, name) } } for name := range before { if _, ok := after[name]; !ok { dels = append(dels, name) } } // Deterministic order (aids testing and reproducibility). sort.Strings(objectPuts) sort.Strings(refPuts) sort.Strings(dels)

put := func(name string) error {
	data, err := util.ReadFile(fs, name)
	if err != nil {
		return err
	}
	return p.st.Put(path.Join(repoPath, name), data)
}
for _, name := range objectPuts {
	if err := put(name); err != nil {
		return fmt.Errorf("push write object %s: %w", name, err)
	}
}
for _, name := range refPuts {
	if err := put(name); err != nil {
		return fmt.Errorf("push write ref %s: %w", name, err)
	}
}
for _, name := range dels {
	if err := p.st.Delete(path.Join(repoPath, name)); err != nil && err != store.ErrNotFound {
		return fmt.Errorf("push delete %s: %w", name, err)
	}
}
return nil

}

// walkManifest builds a manifest of every regular file currently in fs, // enforcing the size cap and skipping go-git's dotgit temp files. func walkManifest(fs billy.Filesystem, maxBytes int64) (Manifest, error) { man := Manifest{} var total int64 err := util.Walk(fs, "/", func(p string, info os.FileInfo, err error) error { if err != nil { return err } if info.IsDir() { return nil } rel := strings.TrimPrefix(p, "/") base := path.Base(rel) if strings.HasPrefix(base, "tmp_") || strings.HasPrefix(base, "._packed-refs") { return nil // go-git dotgit scratch file, not part of the repo } total += info.Size() if total > maxBytes { return fmt.Errorf("%w (limit %d bytes)", ErrRepoTooLarge, maxBytes) } data, err := util.ReadFile(fs, rel) if err != nil { return err } man[rel] = FileInfo{Size: info.Size(), Sum: sha256.Sum256(data)} return nil }) if err != nil { return nil, err } return man, nil }