Allow authentication to git HTTP & git LFS via an authorized integration. This is the first step in getting rid of OAuth, basic auth, etc.'s usage of [`isGitRawOrAttachPath(req)`](https://codeberg.org/forgejo/forgejo/src/commit/26f18a94ee80a5fd8972833b95b1df995ee92fc4/services/auth/method/basic.go#L38-L40). I don't want to follow that pattern of HTTP route matching in the authentication method, so I've broken the HTTP routes related to git functionality out to using a separate authentication middleware in the top-level `web.Routes` handler. As this approach is expanded to the other endpoints in order to add support to them for authorized integrations, eventually it will be possible to remove this URL matching completely and just rely on middleware installation. ## Checklist The [contributor guide](https://forgejo.org/docs/next/contributor/) contains information that will be helpful to first time contributors. All work and communication must conform to Forgejo's [AI Agreement](https://codeberg.org/forgejo/governance/src/branch/main/AIAgreement.md). There also are a few [conditions for merging Pull Requests in Forgejo repositories](https://codeberg.org/forgejo/governance/src/branch/main/PullRequestsAgreement.md). You are also welcome to join the [Forgejo development chatroom](https://matrix.to/#/#forgejo-development:matrix.org). ### Tests for Go changes - I added test coverage for Go changes... - [ ] in their respective `*_test.go` for unit tests. - [x] in the `tests/integration` directory if it involves interactions with a live Forgejo server. - I ran... - [x] `make pr-go` before pushing ### Documentation - [ ] I created a pull request [to the documentation](https://codeberg.org/forgejo/docs) to explain to Forgejo users how to use this change. - [x] I did not document these changes and I do not expect someone else to do it. ### Release notes - [ ] This change will be noticed by a Forgejo user or admin (feature, bug fix, performance, etc.). I suggest to include a release note for this change. - [x] This change is not visible to a Forgejo user or admin (refactor, dependency upgrade, etc.). I think there is no need to add a release note for this change. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12715 Reviewed-by: Gusted <gusted@noreply.codeberg.org>
213 lines
5.5 KiB
Go
213 lines
5.5 KiB
Go
// Copyright 2020 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package web
|
|
|
|
import (
|
|
"net/http"
|
|
"strings"
|
|
|
|
"forgejo.org/modules/web/middleware"
|
|
|
|
"code.forgejo.org/go-chi/binding"
|
|
"github.com/go-chi/chi/v5"
|
|
)
|
|
|
|
// Bind binding an obj to a handler's context data
|
|
func Bind[T any](_ T) http.HandlerFunc {
|
|
return func(resp http.ResponseWriter, req *http.Request) {
|
|
theObj := new(T) // create a new form obj for every request but not use obj directly
|
|
data := middleware.GetContextData(req.Context())
|
|
binding.Bind(req, theObj)
|
|
SetForm(data, theObj)
|
|
middleware.AssignForm(theObj, data)
|
|
}
|
|
}
|
|
|
|
// SetForm set the form object
|
|
func SetForm(dataStore middleware.ContextDataStore, obj any) {
|
|
dataStore.GetData()["__form"] = obj
|
|
}
|
|
|
|
// GetForm returns the validate form information
|
|
func GetForm(dataStore middleware.ContextDataStore) any {
|
|
return dataStore.GetData()["__form"]
|
|
}
|
|
|
|
// Route defines a route based on chi's router
|
|
type Route struct {
|
|
R chi.Router
|
|
curGroupPrefix string
|
|
curMiddlewares []any
|
|
}
|
|
|
|
// NewRoute creates a new route
|
|
func NewRoute() *Route {
|
|
r := chi.NewRouter()
|
|
return &Route{R: r}
|
|
}
|
|
|
|
// Use supports two middlewares
|
|
func (r *Route) Use(middlewares ...any) {
|
|
for _, m := range middlewares {
|
|
if m != nil {
|
|
r.R.Use(toHandlerProvider(m))
|
|
}
|
|
}
|
|
}
|
|
|
|
// Group mounts a sub-Router along a `pattern` string.
|
|
func (r *Route) Group(pattern string, fn func(), middlewares ...any) {
|
|
previousGroupPrefix := r.curGroupPrefix
|
|
previousMiddlewares := r.curMiddlewares
|
|
r.curGroupPrefix += pattern
|
|
r.curMiddlewares = append(r.curMiddlewares, middlewares...)
|
|
|
|
fn()
|
|
|
|
r.curGroupPrefix = previousGroupPrefix
|
|
r.curMiddlewares = previousMiddlewares
|
|
}
|
|
|
|
func (r *Route) getPattern(pattern string) string {
|
|
newPattern := r.curGroupPrefix + pattern
|
|
if !strings.HasPrefix(newPattern, "/") {
|
|
newPattern = "/" + newPattern
|
|
}
|
|
if newPattern == "/" {
|
|
return newPattern
|
|
}
|
|
return strings.TrimSuffix(newPattern, "/")
|
|
}
|
|
|
|
func (r *Route) wrapMiddlewareAndHandler(h []any) ([]func(http.Handler) http.Handler, http.HandlerFunc) {
|
|
handlerProviders := make([]func(http.Handler) http.Handler, 0, len(r.curMiddlewares)+len(h)+1)
|
|
for _, m := range r.curMiddlewares {
|
|
if m != nil {
|
|
handlerProviders = append(handlerProviders, toHandlerProvider(m))
|
|
}
|
|
}
|
|
for _, m := range h {
|
|
if m != nil {
|
|
handlerProviders = append(handlerProviders, toHandlerProvider(m))
|
|
}
|
|
}
|
|
middlewares := handlerProviders[:len(handlerProviders)-1]
|
|
handlerFunc := handlerProviders[len(handlerProviders)-1](nil).ServeHTTP
|
|
mockPoint := RouteMockPoint(MockAfterMiddlewares)
|
|
if mockPoint != nil {
|
|
middlewares = append(middlewares, mockPoint)
|
|
}
|
|
return middlewares, handlerFunc
|
|
}
|
|
|
|
// Methods adds the same handlers for multiple http "methods" (separated by ",").
|
|
// If any method is invalid, the lower level router will panic.
|
|
func (r *Route) Methods(methods, pattern string, h ...any) {
|
|
middlewares, handlerFunc := r.wrapMiddlewareAndHandler(h)
|
|
fullPattern := r.getPattern(pattern)
|
|
if strings.Contains(methods, ",") {
|
|
methods := strings.SplitSeq(methods, ",")
|
|
for method := range methods {
|
|
r.R.With(middlewares...).Method(strings.TrimSpace(method), fullPattern, handlerFunc)
|
|
}
|
|
} else {
|
|
r.R.With(middlewares...).Method(methods, fullPattern, handlerFunc)
|
|
}
|
|
}
|
|
|
|
// Mount attaches another Route along ./pattern/*
|
|
func (r *Route) Mount(pattern string, subR *Route) {
|
|
subR.Use(r.curMiddlewares...)
|
|
r.R.Mount(r.getPattern(pattern), subR.R)
|
|
}
|
|
|
|
// Any delegate requests for all methods
|
|
func (r *Route) Any(pattern string, h ...any) {
|
|
middlewares, handlerFunc := r.wrapMiddlewareAndHandler(h)
|
|
r.R.With(middlewares...).HandleFunc(r.getPattern(pattern), handlerFunc)
|
|
}
|
|
|
|
// Delete delegate delete method
|
|
func (r *Route) Delete(pattern string, h ...any) {
|
|
r.Methods("DELETE", pattern, h...)
|
|
}
|
|
|
|
// Get delegate get method
|
|
func (r *Route) Get(pattern string, h ...any) {
|
|
r.Methods("GET", pattern, h...)
|
|
}
|
|
|
|
// Head delegate head method
|
|
func (r *Route) Head(pattern string, h ...any) {
|
|
r.Methods("HEAD", pattern, h...)
|
|
}
|
|
|
|
// Post delegate post method
|
|
func (r *Route) Post(pattern string, h ...any) {
|
|
r.Methods("POST", pattern, h...)
|
|
}
|
|
|
|
// Put delegate put method
|
|
func (r *Route) Put(pattern string, h ...any) {
|
|
r.Methods("PUT", pattern, h...)
|
|
}
|
|
|
|
// Patch delegate patch method
|
|
func (r *Route) Patch(pattern string, h ...any) {
|
|
r.Methods("PATCH", pattern, h...)
|
|
}
|
|
|
|
// ServeHTTP implements http.Handler
|
|
func (r *Route) ServeHTTP(w http.ResponseWriter, req *http.Request) {
|
|
r.R.ServeHTTP(w, req)
|
|
}
|
|
|
|
// NotFound defines a handler to respond whenever a route could not be found.
|
|
func (r *Route) NotFound(h ...any) {
|
|
middlewares, handlerFunc := r.wrapMiddlewareAndHandler(h)
|
|
r.R.With(middlewares...).NotFound(handlerFunc)
|
|
}
|
|
|
|
// Combo delegates requests to Combo
|
|
func (r *Route) Combo(pattern string, h ...any) *Combo {
|
|
return &Combo{r, pattern, h}
|
|
}
|
|
|
|
// Combo represents a tiny group routes with same pattern
|
|
type Combo struct {
|
|
r *Route
|
|
pattern string
|
|
h []any
|
|
}
|
|
|
|
// Get delegates Get method
|
|
func (c *Combo) Get(h ...any) *Combo {
|
|
c.r.Get(c.pattern, append(c.h, h...)...)
|
|
return c
|
|
}
|
|
|
|
// Post delegates Post method
|
|
func (c *Combo) Post(h ...any) *Combo {
|
|
c.r.Post(c.pattern, append(c.h, h...)...)
|
|
return c
|
|
}
|
|
|
|
// Delete delegates Delete method
|
|
func (c *Combo) Delete(h ...any) *Combo {
|
|
c.r.Delete(c.pattern, append(c.h, h...)...)
|
|
return c
|
|
}
|
|
|
|
// Put delegates Put method
|
|
func (c *Combo) Put(h ...any) *Combo {
|
|
c.r.Put(c.pattern, append(c.h, h...)...)
|
|
return c
|
|
}
|
|
|
|
// Patch delegates Patch method
|
|
func (c *Combo) Patch(h ...any) *Combo {
|
|
c.r.Patch(c.pattern, append(c.h, h...)...)
|
|
return c
|
|
}
|