not tracked no coverage low coverage * * * * * * * * high coverage
package main

import (
        "log"
        "net/http"
        "os"
        "strings"
        "time"

        "git.curoverse.com/arvados.git/sdk/go/arvadosclient"
        "git.curoverse.com/arvados.git/sdk/go/auth"
        "git.curoverse.com/arvados.git/sdk/go/httpserver"
)

var clientPool = arvadosclient.MakeClientPool()

type authHandler struct {
        handler http.Handler
}

func (h *authHandler) ServeHTTP(wOrig http.ResponseWriter, r *http.Request) {
        var statusCode int
        var statusText string
        var apiToken string
        var repoName string
        var validApiToken bool

        w := httpserver.WrapResponseWriter(wOrig)

        defer func() {
                if w.WroteStatus() == 0 {
                        // Nobody has called WriteHeader yet: that
                        // must be our job.
                        w.WriteHeader(statusCode)
                        w.Write([]byte(statusText))
                }

                // If the given password is a valid token, log the first 10 characters of the token.
                // Otherwise: log the string <invalid> if a password is given, else an empty string.
                passwordToLog := ""
                if !validApiToken {
                        if len(apiToken) > 0 {
                                passwordToLog = "<invalid>"
                        }
                } else {
                        passwordToLog = apiToken[0:10]
                }

                httpserver.Log(r.RemoteAddr, passwordToLog, w.WroteStatus(), statusText, repoName, r.Method, r.URL.Path)
        }()

        creds := auth.NewCredentialsFromHTTPRequest(r)
        if len(creds.Tokens) == 0 {
                statusCode, statusText = http.StatusUnauthorized, "no credentials provided"
                w.Header().Add("WWW-Authenticate", "Basic realm=\"git\"")
                return
        }
        apiToken = creds.Tokens[0]

        // Access to paths "/foo/bar.git/*" and "/foo/bar/.git/*" are
        // protected by the permissions on the repository named
        // "foo/bar".
        pathParts := strings.SplitN(r.URL.Path[1:], ".git/", 2)
        if len(pathParts) != 2 {
                statusCode, statusText = http.StatusBadRequest, "bad request"
                return
        }
        repoName = pathParts[0]
        repoName = strings.TrimRight(repoName, "/")

        arv := clientPool.Get()
        if arv == nil {
                statusCode, statusText = http.StatusInternalServerError, "connection pool failed: "+clientPool.Err().Error()
                return
        }
        defer clientPool.Put(arv)

        // Ask API server whether the repository is readable using
        // this token (by trying to read it!)
        arv.ApiToken = apiToken
        reposFound := arvadosclient.Dict{}
        if err := arv.List("repositories", arvadosclient.Dict{
                "filters": [][]string{{"name", "=", repoName}},
        }, &reposFound); err != nil {
                statusCode, statusText = http.StatusInternalServerError, err.Error()
                return
        }
        validApiToken = true
        if avail, ok := reposFound["items_available"].(float64); !ok {
                statusCode, statusText = http.StatusInternalServerError, "bad list response from API"
                return
        } else if avail < 1 {
                statusCode, statusText = http.StatusNotFound, "not found"
                return
        } else if avail > 1 {
                statusCode, statusText = http.StatusInternalServerError, "name collision"
                return
        }

        repoUUID := reposFound["items"].([]interface{})[0].(map[string]interface{})["uuid"].(string)

        isWrite := strings.HasSuffix(r.URL.Path, "/git-receive-pack")
        if !isWrite {
                statusText = "read"
        } else {
                err := arv.Update("repositories", repoUUID, arvadosclient.Dict{
                        "repository": arvadosclient.Dict{
                                "modified_at": time.Now().String(),
                        },
                }, &arvadosclient.Dict{})
                if err != nil {
                        statusCode, statusText = http.StatusForbidden, err.Error()
                        return
                }
                statusText = "write"
        }

        // Regardless of whether the client asked for "/foo.git" or
        // "/foo/.git", we choose whichever variant exists in our repo
        // root, and we try {uuid}.git and {uuid}/.git first. If none
        // of these exist, we 404 even though the API told us the repo
        // _should_ exist (presumably this means the repo was just
        // created, and gitolite sync hasn't run yet).
        rewrittenPath := ""
        tryDirs := []string{
                "/" + repoUUID + ".git",
                "/" + repoUUID + "/.git",
                "/" + repoName + ".git",
                "/" + repoName + "/.git",
        }
        for _, dir := range tryDirs {
                if fileInfo, err := os.Stat(theConfig.Root + dir); err != nil {
                        if !os.IsNotExist(err) {
                                statusCode, statusText = http.StatusInternalServerError, err.Error()
                                return
                        }
                } else if fileInfo.IsDir() {
                        rewrittenPath = dir + "/" + pathParts[1]
                        break
                }
        }
        if rewrittenPath == "" {
                log.Println("WARNING:", repoUUID,
                        "git directory not found in", theConfig.Root, tryDirs)
                // We say "content not found" to disambiguate from the
                // earlier "API says that repo does not exist" error.
                statusCode, statusText = http.StatusNotFound, "content not found"
                return
        }
        r.URL.Path = rewrittenPath

        h.handler.ServeHTTP(&w, r)
}