// Package server is the HTTP layer of the git browser. The upspin path is the // URL path: GET /user@domain/<path...>. If the path resolves inside a bare // git repository the request is handled by the git browser (summary, tree, // blob, log, commit, refs); otherwise it falls back to plain upspin namespace // browsing (directory listings and raw files) so users can drill down to repos. package server

import ( "bytes" "context" "embed" "errors" "html/template" "io" "log" "mime" "net/http" "net/url" "os" "path" "strings"

"gitweb/internal/auth"
"gitweb/internal/gitrepo"
"gitweb/internal/render"
"gitweb/internal/store"

)

//go:embed templates/*.html var tmplFS embed.FS

var pageTmpl = template.Must(template.ParseFS(tmplFS, "templates/page.html"))

// Config configures a Server. type Config struct { Store store.WriteStore // read for browse/clone; write for push Web http.FileSystem // static assets (style.css, landing index.html) Realm string // HTTP Basic auth realm; defaults to "gitweb" // Vault, if non-nil, verifies issuer-signed SSO bearer tokens (the passkey // login path). When nil, only PATs are accepted. Vault *auth.VaultVerifier // SSOAuthorizeURL is the issuer's browser login endpoint (e.g. // https://vault.cosmocr.at/authorize). When set (with Vault non-nil), the // browser "Sign in" flow at /_auth/login is enabled. Empty disables it. SSOAuthorizeURL string // SSOAudience is the audience requested in the browser SSO flow (e.g. // "gitweb"); it must match the audience Vault accepts. SSOAudience string // BaseURL is this service's public origin (e.g. https://git.cosmocr.at), // used to build the SSO redirect_uri. Not derived from the Host header, so a // spoofed Host cannot redirect the token elsewhere. BaseURL string // CacheDir is where repos are materialized on disk. Its contents are // deleted at startup. Empty means an ephemeral directory under the system // temp dir (dev and tests). CacheDir string // CacheBudgetBytes and MaxRepoBytes bound the repo cache; 0 means the // gitrepo defaults (512 MiB / 256 MiB). CacheBudgetBytes int64 MaxRepoBytes int64 }

// Server serves upspin-stored git repositories over HTTP: a browse UI, plus the // git smart-HTTP protocol for clone and push. Access is gated by upspin Access // files; private repos require Basic-auth credentials (a vault SSO token or a // personal access token). type Server struct { store store.Store web http.FileSystem renderer *render.Renderer renderers *render.Registry repos *gitrepo.Cache authz *auth.Authorizer pat *auth.PATVerifier vault *auth.VaultVerifier // may be nil pusher *gitrepo.Pusher realm string ssoAuthURL string // issuer login endpoint; "" disables browser SSO ssoAud string // audience requested in the browser SSO flow baseURL string // this service's public origin, for redirect_uri chroma []byte // generated highlighter stylesheet landing []byte // /index.html, served at "/" }

// New builds a Server. func New(c Config) (*Server, error) { css, err := render.CSS() if err != nil { return nil, err } rnd := render.New() cacheDir := c.CacheDir if cacheDir == "" { cacheDir, err = os.MkdirTemp("", "gitweb-cache-") if err != nil { return nil, err } } repos, err := gitrepo.NewCache(c.Store, gitrepo.CacheOptions{ Dir: cacheDir, BudgetBytes: c.CacheBudgetBytes, MaxRepoBytes: c.MaxRepoBytes, }) if err != nil { return nil, err } realm := c.Realm if realm == "" { realm = "gitweb" } s := &Server{ store: c.Store, web: c.Web, renderer: rnd, renderers: render.NewRegistry(rnd), repos: repos, authz: auth.NewAuthorizer(c.Store), pat: auth.NewPATVerifier(c.Store), vault: c.Vault, pusher: gitrepo.NewPusher(c.Store, repos), realm: realm, chroma: css, ssoAuthURL: c.SSOAuthorizeURL, ssoAud: c.SSOAudience, baseURL: strings.TrimRight(c.BaseURL, "/"), } if f, err := c.Web.Open("index.html"); err == nil { s.landing, _ = io.ReadAll(f) f.Close() } return s, nil }

// Handler returns the HTTP handler. func (s Server) Handler() http.Handler { mux := http.NewServeMux() mux.HandleFunc("GET /_assets/chroma.css", s.handleChromaCSS) mux.Handle("GET /_assets/", http.StripPrefix("/_assets/", http.FileServer(s.web))) // Browser SSO: /_auth/ cannot collide with an upspin path (users are // user@domain). Enabled only when an issuer login endpoint is configured. if s.ssoEnabled() { mux.HandleFunc("GET /_auth/login", s.handleLogin) mux.HandleFunc("GET /_auth/callback", s.handleCallback) mux.HandleFunc("POST /_auth/session", s.handleSession) mux.HandleFunc("GET /_auth/logout", s.handleLogout) } // The catch-all accepts every method: git smart-HTTP needs POST, and // ServeMux cannot match the "/info/refs", "/git-upload-pack", // "/git-receive-pack" suffixes, so handleRoot dispatches by suffix itself. mux.HandleFunc("/", s.handleRoot) return securityHeaders(mux) }

// handleRoot dispatches between the git smart-HTTP endpoints and the browse UI. func (s *Server) handleRoot(w http.ResponseWriter, r *http.Request) { if ep, ok := gitEndpoint(r); ok { s.handleGitHTTP(w, r, ep) return } if r.Method != http.MethodGet { http.Error(w, "405 method not allowed", http.StatusMethodNotAllowed) return } s.handlePath(w, r) }

func (s *Server) handleChromaCSS(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "text/css; charset=utf-8") w.Write(s.chroma) }

// handlePath dispatches a request whose URL path is an upspin path. func (s *Server) handlePath(w http.ResponseWriter, r *http.Request) { raw := strings.TrimPrefix(r.URL.Path, "/") if raw == "" { s.serveLanding(w) return }

// First element is the upspin user; validate before building any path.
user, rest, _ := strings.Cut(raw, "/")
if !store.ValidUser(user) {
	s.notFound(w)
	return
}
// Clean the remainder; path.Clean collapses any ".." so it cannot escape
// the user's tree. clean always begins with "/".
clean := path.Clean("/" + rest)
upath := user + clean // e.g. "u@d.com/proj.git"; root is "u@d.com/"

// Identify the caller (anonymous if no/blank credentials) before deciding
// what they may see.
authUser, ok := s.authenticate(w, r)
if !ok {
	return // 401 already written
}
// Carry the viewer identity so page rendering can show sign-in/out state.
r = r.WithContext(context.WithValue(r.Context(), viewerKey{}, authUser))

// If the path lies inside a bare git repo, hand off to the git browser;
// otherwise fall back to plain upspin namespace browsing.
repoPath, gitRest, isRepo, err := gitrepo.Locate(s.store, user, clean)
if err != nil {
	s.storeErr(w, err)
	return
}

// Gate the browse UI by the same public/private rule as clone: anonymous
// users see only world-readable paths; others must be granted read.
resource := upath
if isRepo {
	resource = repoPath
}
allowed, err := s.authz.CanRead(authUser, resource)
if err != nil {
	s.serverErr(w, err)
	return
}
if !allowed {
	s.denyRead(w, r, authUser)
	return
}

if isRepo {
	s.serveGit(w, r, repoPath, gitRest)
	return
}

isDir, err := s.store.Stat(upath)
if err != nil {
	s.storeErr(w, err)
	return
}

if isDir {
	s.serveDir(w, r, user, clean, upath)
	return
}
s.serveFile(w, r, upath, clean)

}

// serveDir renders a directory: README.md/index.md if present, else a listing. func (s *Server) serveDir(w http.ResponseWriter, r *http.Request, user, clean, upath string) { // A trailing slash is required so relative links resolve against the dir. if !strings.HasSuffix(r.URL.Path, "/") { http.Redirect(w, r, r.URL.Path+"/", http.StatusMovedPermanently) return }

entries, err := s.store.List(upath)
if err != nil {
	s.storeErr(w, err)
	return
}

// Prefer an index document if the directory has one.
for _, name := range []string{"index.md", "README.md", "readme.md"} {
	if hasEntry(entries, name) {
		s.serveFile(w, r, strings.TrimRight(upath, "/")+"/"+name, clean)
		return
	}
}

var body bytes.Buffer
body.WriteString(`<h1>Index of `)
body.WriteString(template.HTMLEscapeString(displayPath(user, clean)))
body.WriteString("</h1>\n<ul class=\"dir\">\n")
if clean != "/" {
	body.WriteString(`<li><a href="../">../</a></li>` + "\n")
}
for _, e := range entries {
	if isAccessFile(e.Name) {
		continue // never expose upspin ACLs in a listing
	}
	name := e.Name
	if e.IsDir {
		name += "/"
	}
	esc := template.HTMLEscapeString(name)
	body.WriteString(`<li><a href="` + esc + `">` + esc + "</a></li>\n")
}
body.WriteString("</ul>\n")
s.renderPage(w, r, displayPath(user, clean), template.HTML(body.String()))

}

// serveFile renders a markdown file, or serves any other file raw. func (s *Server) serveFile(w http.ResponseWriter, r *http.Request, upath, clean string) { // Never serve an upspin Access file's contents (its user/group list), // even when requested directly by path. if isAccessFile(path.Base(upath)) { s.notFound(w) return } data, err := s.store.Get(upath) if err != nil { s.storeErr(w, err) return }

if isMarkdown(upath) {
	html, err := s.renderer.ToHTML(data)
	if err != nil {
		s.serverErr(w, err)
		return
	}
	s.renderPage(w, r, path.Base(clean), template.HTML(html))
	return
}

// Raw asset (images referenced by markdown, etc.).
ctype := mime.TypeByExtension(path.Ext(upath))
if ctype == "" {
	ctype = http.DetectContentType(data)
}
w.Header().Set("Content-Type", ctype)
w.Write(data)

}

func (s *Server) renderPage(w http.ResponseWriter, r *http.Request, title string, body template.HTML) { w.Header().Set("Content-Type", "text/html; charset=utf-8") err := pageTmpl.Execute(w, struct { Title string Body template.HTML Nav template.HTML }{Title: title, Body: body, Nav: s.navHTML(r)}) if err != nil { log.Printf("gitweb: template: %v", err) } }

// viewerKey stashes the authenticated viewer (or "") on the request context, so // renderPage can show sign-in state without every render path taking it as an // argument. type viewerKey struct{}

// navHTML builds the account nav shown on every rendered page: sign-out when the // viewer is authenticated, sign-in when SSO is available, nothing otherwise. func (s *Server) navHTML(r *http.Request) template.HTML { if r == nil { return "" } viewer, _ := r.Context().Value(viewerKey{}).(string) if viewer != "" { return template.HTML(Signed in as <strong> + template.HTMLEscapeString(viewer) + </strong> &middot; <a href="/_auth/logout">Sign out</a>) } if s.ssoEnabled() { return template.HTML(<a href="/_auth/login?next= + template.HTMLEscapeString(url.QueryEscape(r.URL.Path)) + ">Sign in</a>) } return "" }

func (s *Server) serveLanding(w http.ResponseWriter) { if s.landing == nil { s.notFound(w) return } w.Header().Set("Content-Type", "text/html; charset=utf-8") w.Write(s.landing) }

// --- errors ---

func (s *Server) storeErr(w http.ResponseWriter, err error) { if errors.Is(err, store.ErrNotFound) { s.notFound(w) return } s.serverErr(w, err) }

func (s *Server) notFound(w http.ResponseWriter) { http.Error(w, "404 not found", http.StatusNotFound) }

// denyRead responds to a caller who may not read the requested resource. An // already-authenticated caller gets a 404, which does not reveal whether the // resource exists. An anonymous caller gets either a redirect into the browser // SSO flow (if this looks like a browser and SSO is enabled) or a Basic-auth // challenge (so a git/curl client can retry with credentials). func (s *Server) denyRead(w http.ResponseWriter, r *http.Request, authUser string) { if authUser != "" { s.notFound(w) return } if s.ssoEnabled() && wantsHTML(r) { http.Redirect(w, r, "/_auth/login?next="+url.QueryEscape(r.URL.Path), http.StatusSeeOther) return } s.challenge(w) }

// wantsHTML reports whether the request looks like a browser navigation (as // opposed to git/curl), so we can redirect it to the login page rather than // issue a Basic-auth challenge it can't satisfy interactively. func wantsHTML(r *http.Request) bool { return strings.Contains(r.Header.Get("Accept"), "text/html") }

// challenge writes a 401 with a Basic-auth challenge. The body is deliberately // vague so anonymous callers cannot distinguish "private" from "absent". func (s *Server) challenge(w http.ResponseWriter) { w.Header().Set("WWW-Authenticate", Basic realm="+s.realm+", charset="UTF-8") http.Error(w, "not found, or authentication required", http.StatusUnauthorized) }

func (s *Server) serverErr(w http.ResponseWriter, err error) { log.Printf("gitweb: 500: %v", err) http.Error(w, "500 internal server error", http.StatusInternalServerError) }

// --- helpers ---

func isMarkdown(p string) bool { switch strings.ToLower(path.Ext(p)) { case ".md", ".markdown": return true } return false }

// isAccessFile reports whether name is an upspin Access file. gitweb never lists // or renders these: their contents enumerate the upspin users and groups granted // access, which must not be exposed to browsers. func isAccessFile(name string) bool { return name == "Access" }

func hasEntry(entries []store.Entry, name string) bool { for _, e := range entries { if !e.IsDir && e.Name == name { return true } } return false }

// displayPath renders the upspin path for a heading: "u@d.com/docs/". func displayPath(user, clean string) string { if clean == "/" { return user + "/" } return user + clean }

func securityHeaders(h http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("X-Frame-Options", "DENY") w.Header().Set("Referrer-Policy", "no-referrer") // script-src 'self': the only scripts are our own, same-origin mermaid // files (mermaid-init.js and the vendored bundle). No 'unsafe-inline', so // script injected via rendered markdown cannot execute. style-src allows // 'unsafe-inline' because mermaid injects diagram styles at render time; // this permits inline styles but not scripts. Markdown may embed external // https images; everything else is same-origin. w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; "+ "img-src 'self' data: https:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'") h.ServeHTTP(w, r) }) }