commit 6058b1c2d07c1daae797a8ec4a710741fa7aafd9 · dunkirk.sh/core

+29 -14

cmd/repoguard/main.go

···

       1
       1
        
       package main

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"context"

     

       4
       5
        
       	"flag"

     

       5
       6
        
       	"fmt"

     

       6
       7
        
       	"log"

     

       7
       8
        
       	"os"

     

       8
       9
        
       	"os/exec"

     

       10
       10
       +
       	"path"

     

       9
       11
        
       	"path/filepath"

     

       10
       12
        
       	"strings"

     

       11
       13
        
       	"time"

     

       14
       14
       +
       

     

       15
       15
       +
       	"github.com/icyphox/bild/routes/auth"

     

       12
       16
        
       )

     

       13
       17
        
       

     

       14
       18
        
       var (

     
···

       58
       62
        
       	}

     

       59
       63
        
       

     

       60
       64
        
       	gitCommand := cmdParts[0]

     

       61
       61
       -
       	repoName := strings.Trim(cmdParts[1], "'")

     

       65
       65
       +
       

     

       66
       66
       +
       	// example.com/repo

     

       67
       67
       +
       	handlePath := strings.Trim(cmdParts[1], "'")

     

       68
       68
       +
       	repoName := handleToDID(handlePath)

     

       62
       69
        
       

     

       63
       70
        
       	validCommands := map[string]bool{

     

       64
       71
        
       		"git-receive-pack":   true,

     
···

       69
       76
        
       		exitWithLog("access denied: invalid git command")

     

       70
       77
        
       	}

     

       71
       78
        
       

     

       72
       72
       -
       	if !isAllowedUser(*allowedUser, repoName) {

     

       73
       73
       -
       		exitWithLog("access denied: user not allowed")

     

       79
       79
       +
       	did := path.Dir(repoName)

     

       80
       80
       +
       	if gitCommand != "git-upload-pack" {

     

       81
       81
       +
       		if !isAllowedUser(*allowedUser, did) {

     

       82
       82
       +
       			exitWithLog("access denied: user not allowed")

     

       83
       83
       +
       		}

     

       74
       84
        
       	}

     

       75
       85
        
       

     

       76
       86
        
       	fullPath := filepath.Join(*baseDirFlag, repoName)

     
···

       101
       111
        
       	})

     

       102
       112
        
       }

     

       103
       113
        
       

     

       114
       114
       +
       func handleToDID(handlePath string) string {

     

       115
       115
       +
       	handle := path.Dir(handlePath)

     

       116
       116
       +
       

     

       117
       117
       +
       	ident, err := auth.ResolveIdent(context.Background(), handle)

     

       118
       118
       +
       	if err != nil {

     

       119
       119
       +
       		exitWithLog(fmt.Sprintf("error resolving handle: %v", err))

     

       120
       120
       +
       	}

     

       121
       121
       +
       

     

       122
       122
       +
       	// did:plc:foobarbaz/repo

     

       123
       123
       +
       	didPath := filepath.Join(ident.DID.String(), path.Base(handlePath))

     

       124
       124
       +
       

     

       125
       125
       +
       	return didPath

     

       126
       126
       +
       }

     

       127
       127
       +
       

     

       104
       128
        
       func initLogger() {

     

       105
       129
        
       	var err error

     

       106
       130
        
       	logFile, err = os.OpenFile(*logPathFlag, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0600)

     
···

       142
       166
        
       	}

     

       143
       167
        
       }

     

       144
       168
        
       

     

       145
       145
       -
       func isAllowedUser(user, repoPath string) bool {

     

       146
       146
       -
       	fullPath := filepath.Join(*baseDirFlag, repoPath)

     

       147
       147
       -
       	didPath := filepath.Join(fullPath, "did")

     

       148
       148
       -
       

     

       149
       149
       -
       	didBytes, err := os.ReadFile(didPath)

     

       150
       150
       -
       	if err != nil {

     

       151
       151
       -
       		return false

     

       152
       152
       -
       	}

     

       153
       153
       -
       

     

       154
       154
       -
       	allowedUser := strings.TrimSpace(string(didBytes))

     

       155
       155
       -
       	return allowedUser == user

     

       169
       169
       +
       func isAllowedUser(user, did string) bool {

     

       170
       170
       +
       	return user == did

     

       156
       171
        
       }

+3 -3

routes/auth/auth.go

···

       21
       21
        
       	return &Auth{store}

     

       22
       22
        
       }

     

       23
       23
        
       

     

       24
       24
       -
       func resolveIdent(ctx context.Context, arg string) (*identity.Identity, error) {

     

       24
       24
       +
       func ResolveIdent(ctx context.Context, arg string) (*identity.Identity, error) {

     

       25
       25
        
       	id, err := syntax.ParseAtIdentifier(arg)

     

       26
       26
        
       	if err != nil {

     

       27
       27
        
       		return nil, err

     
···

       57
       57
        
       

     

       58
       58
        
       func (a *Auth) CreateInitialSession(w http.ResponseWriter, r *http.Request, username, appPassword string) (AtSessionCreate, error) {

     

       59
       59
        
       	ctx := r.Context()

     

       60
       60
       -
       	resolved, err := resolveIdent(ctx, username)

     

       60
       60
       +
       	resolved, err := ResolveIdent(ctx, username)

     

       61
       61
        
       	if err != nil {

     

       62
       62
        
       		return AtSessionCreate{}, fmt.Errorf("invalid handle: %s", err)

     

       63
       63
        
       	}

     
···

       118
       118
        
       		return nil, fmt.Errorf("user is not authenticated")

     

       119
       119
        
       	}

     

       120
       120
        
       

     

       121
       121
       -
       	return resolveIdent(r.Context(), did)

     

       121
       121
       +
       	return ResolveIdent(r.Context(), did)

     

       122
       122
        
       }