Public
Open-source lightweight git hosting.
handlers.go
·
361 lines
·
12.6 KB
| 1 | package handlers |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "fmt" |
| 6 | "log/slog" |
| 7 | "net/http" |
| 8 | "net/url" |
| 9 | "strings" |
| 10 | "time" |
| 11 | |
| 12 | "polar/internal/auth" |
| 13 | "polar/internal/config" |
| 14 | "polar/internal/db" |
| 15 | "polar/internal/i18n" |
| 16 | "polar/internal/repo" |
| 17 | "polar/internal/user" |
| 18 | "polar/internal/web/middleware" |
| 19 | "polar/internal/web/static" |
| 20 | "polar/internal/web/views" |
| 21 | |
| 22 | "github.com/gofiber/fiber/v2" |
| 23 | "github.com/gofiber/fiber/v2/middleware/filesystem" |
| 24 | ) |
| 25 | |
| 26 | type Handler struct { |
| 27 | cfg config.Config |
| 28 | db *db.DB |
| 29 | authSvc *auth.Service |
| 30 | userSvc *user.Service |
| 31 | repoSvc *repo.Service |
| 32 | views *views.Engine |
| 33 | logger *slog.Logger |
| 34 | } |
| 35 | |
| 36 | func New( |
| 37 | cfg config.Config, |
| 38 | database *db.DB, |
| 39 | authSvc *auth.Service, |
| 40 | userSvc *user.Service, |
| 41 | repoSvc *repo.Service, |
| 42 | viewsEngine *views.Engine, |
| 43 | logger *slog.Logger, |
| 44 | ) *Handler { |
| 45 | return &Handler{ |
| 46 | cfg: cfg, |
| 47 | db: database, |
| 48 | authSvc: authSvc, |
| 49 | userSvc: userSvc, |
| 50 | repoSvc: repoSvc, |
| 51 | views: viewsEngine, |
| 52 | logger: logger, |
| 53 | } |
| 54 | } |
| 55 | |
| 56 | func (h *Handler) RegisterRoutes(app *fiber.App) { |
| 57 | app.Use(middleware.RecoverAndLog(h.logger)) |
| 58 | app.Use(middleware.SecurityHeaders()) |
| 59 | |
| 60 | app.Get("/healthz", h.Healthz) |
| 61 | |
| 62 | app.Use("/static", filesystem.New(filesystem.Config{ |
| 63 | Root: http.FS(static.FS), |
| 64 | Browse: false, |
| 65 | MaxAge: 0, |
| 66 | })) |
| 67 | |
| 68 | app.Use(middleware.LocaleAndTheme(h.cfg.Landing.DefaultLang)) |
| 69 | app.Use(middleware.SessionAuth(h.authSvc, h.userSvc)) |
| 70 | app.Use(middleware.CSRFProtection()) |
| 71 | |
| 72 | authLimiter := middleware.NewRateLimiter(20, time.Minute) |
| 73 | |
| 74 | // Public & Root routes |
| 75 | app.Get("/", h.Home) |
| 76 | app.Get("/explore", h.Explore) |
| 77 | |
| 78 | // Auth routes |
| 79 | app.Get("/login", h.LoginPage) |
| 80 | app.Post("/login", authLimiter.Handler(), h.LoginSubmit) |
| 81 | app.Get("/register", h.RegisterPage) |
| 82 | app.Post("/register", authLimiter.Handler(), h.RegisterSubmit) |
| 83 | app.Post("/logout", h.LogoutSubmit) |
| 84 | app.Get("/login/device", h.DeviceVerifyPage) |
| 85 | app.Post("/login/device", h.DeviceVerifySubmit) |
| 86 | app.Post("/api/v1/device/code", h.DeviceCodeAPI) |
| 87 | app.Post("/api/v1/device/token", h.DeviceTokenAPI) |
| 88 | |
| 89 | // Authenticated user routes |
| 90 | app.Get("/repos", middleware.RequireAuth(), h.MyRepos) |
| 91 | app.Get("/new", middleware.RequireAuth(), h.NewRepoPage) |
| 92 | app.Post("/new", middleware.RequireAuth(), h.NewRepoSubmit) |
| 93 | app.Get("/settings", middleware.RequireAuth(), h.SettingsPage) |
| 94 | app.Post("/settings/profile", middleware.RequireAuth(), h.UpdateProfileSubmit) |
| 95 | app.Post("/settings/password", middleware.RequireAuth(), h.UpdatePasswordSubmit) |
| 96 | app.Post("/settings/tokens", middleware.RequireAuth(), h.CreateTokenSubmit) |
| 97 | app.Post("/settings/tokens/:id/revoke", middleware.RequireAuth(), h.RevokeTokenSubmit) |
| 98 | |
| 99 | // Admin routes |
| 100 | app.Get("/admin", middleware.RequireAdmin(), h.AdminPage) |
| 101 | app.Post("/admin/settings", middleware.RequireAdmin(), h.AdminSettingsSubmit) |
| 102 | |
| 103 | // Git Smart HTTP endpoints (supports both /:owner/:repo.git/* and /:owner/:repo/*) |
| 104 | app.Get("/:owner/:repo/info/refs", h.GitInfoRefs) |
| 105 | app.Post("/:owner/:repo/git-upload-pack", h.GitUploadPack) |
| 106 | app.Post("/:owner/:repo/git-receive-pack", h.GitReceivePack) |
| 107 | |
| 108 | // Repository Web UI routes |
| 109 | app.Get("/:owner/:repo/settings", middleware.RequireAuth(), h.RepoSettingsPage) |
| 110 | app.Post("/:owner/:repo/settings", middleware.RequireAuth(), h.RepoSettingsSubmit) |
| 111 | app.Post("/:owner/:repo/settings/rename", middleware.RequireAuth(), h.RepoRenameSubmit) |
| 112 | app.Post("/:owner/:repo/settings/delete", middleware.RequireAuth(), h.RepoDeleteSubmit) |
| 113 | app.Post("/:owner/:repo/settings/collaborators/add", middleware.RequireAuth(), h.RepoCollaboratorAddSubmit) |
| 114 | app.Post("/:owner/:repo/settings/collaborators/remove", middleware.RequireAuth(), h.RepoCollaboratorRemoveSubmit) |
| 115 | |
| 116 | app.Get("/:owner/:repo/branches", h.RepoBranchesPage) |
| 117 | app.Post("/:owner/:repo/branches", middleware.RequireAuth(), h.RepoCreateBranchSubmit) |
| 118 | app.Post("/:owner/:repo/branches/delete", middleware.RequireAuth(), h.RepoDeleteBranchSubmit) |
| 119 | app.Post("/:owner/:repo/tags", middleware.RequireAuth(), h.RepoCreateTagSubmit) |
| 120 | app.Post("/:owner/:repo/tags/delete", middleware.RequireAuth(), h.RepoDeleteTagSubmit) |
| 121 | app.Get("/:owner/:repo/archive/*", h.RepoArchiveZip) |
| 122 | app.Get("/:owner/:repo/new-file", middleware.RequireAuth(), h.RepoNewFilePage) |
| 123 | app.Post("/:owner/:repo/new-file", middleware.RequireAuth(), h.RepoCreateFileSubmit) |
| 124 | app.Get("/:owner/:repo/new-folder", middleware.RequireAuth(), h.RepoNewFolderPage) |
| 125 | app.Post("/:owner/:repo/new-folder", middleware.RequireAuth(), h.RepoCreateFolderSubmit) |
| 126 | app.Get("/:owner/:repo/upload", middleware.RequireAuth(), h.RepoUploadPage) |
| 127 | app.Post("/:owner/:repo/upload", middleware.RequireAuth(), h.RepoUploadSubmit) |
| 128 | |
| 129 | app.Post("/:owner/:repo/fork", middleware.RequireAuth(), h.RepoForkSubmit) |
| 130 | app.Get("/:owner/:repo/forks", h.RepoForksPage) |
| 131 | |
| 132 | app.Get("/:owner/:repo/issues", h.RepoIssuesPage) |
| 133 | app.Get("/:owner/:repo/issues/new", middleware.RequireAuth(), h.RepoNewIssuePage) |
| 134 | app.Post("/:owner/:repo/issues/new", middleware.RequireAuth(), h.RepoNewIssueSubmit) |
| 135 | app.Get("/:owner/:repo/issues/:number", h.RepoIssueDetailPage) |
| 136 | app.Post("/:owner/:repo/issues/:number/comments", middleware.RequireAuth(), h.RepoIssueCommentSubmit) |
| 137 | app.Post("/:owner/:repo/issues/:number/state", middleware.RequireAuth(), h.RepoIssueStateSubmit) |
| 138 | |
| 139 | // Pull Requests |
| 140 | app.Get("/:owner/:repo/pulls", h.RepoPullsPage) |
| 141 | app.Get("/:owner/:repo/pulls/new", middleware.RequireAuth(), h.RepoNewPullPage) |
| 142 | app.Post("/:owner/:repo/pulls/new", middleware.RequireAuth(), h.RepoNewPullSubmit) |
| 143 | app.Get("/:owner/:repo/pulls/:number", h.RepoPullDetailPage) |
| 144 | app.Post("/:owner/:repo/pulls/:number/comments", middleware.RequireAuth(), h.RepoPullCommentSubmit) |
| 145 | app.Post("/:owner/:repo/pulls/:number/state", middleware.RequireAuth(), h.RepoPullStateSubmit) |
| 146 | app.Post("/:owner/:repo/pulls/:number/merge", middleware.RequireAuth(), h.RepoPullMergeSubmit) |
| 147 | app.Post("/:owner/:repo/pulls/:number/review", middleware.RequireAuth(), h.RepoPullReviewSubmit) |
| 148 | |
| 149 | // Releases |
| 150 | app.Get("/:owner/:repo/releases", h.RepoReleasesPage) |
| 151 | app.Get("/:owner/:repo/releases/new", middleware.RequireAuth(), h.RepoNewReleasePage) |
| 152 | app.Post("/:owner/:repo/releases/new", middleware.RequireAuth(), h.RepoNewReleaseSubmit) |
| 153 | app.Post("/:owner/:repo/releases/:id/delete", middleware.RequireAuth(), h.RepoDeleteReleaseSubmit) |
| 154 | |
| 155 | // Activity |
| 156 | app.Get("/:owner/:repo/activity", h.RepoActivityPage) |
| 157 | |
| 158 | app.Get("/:owner/:repo/commits/:ref", h.RepoCommitsPage) |
| 159 | app.Get("/:owner/:repo/commit/:hash", h.RepoCommitDetailPage) |
| 160 | app.Get("/:owner/:repo/tree/:ref/*", h.RepoTreePage) |
| 161 | app.Get("/:owner/:repo/tree/:ref", h.RepoTreePage) |
| 162 | app.Get("/:owner/:repo/blob/:ref/*", h.RepoBlobPage) |
| 163 | app.Get("/:owner/:repo/raw/:ref/*", h.RepoRawBlob) |
| 164 | app.Get("/:owner/:repo", h.RepoHomePage) |
| 165 | |
| 166 | // User profile page |
| 167 | app.Get("/:username", h.UserProfilePage) |
| 168 | } |
| 169 | |
| 170 | func (h *Handler) Healthz(c *fiber.Ctx) error { |
| 171 | if err := h.db.PingContext(c.UserContext()); err != nil { |
| 172 | return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{ |
| 173 | "status": "error", |
| 174 | "db": "unreachable", |
| 175 | }) |
| 176 | } |
| 177 | return c.Status(fiber.StatusOK).JSON(fiber.Map{ |
| 178 | "status": "ok", |
| 179 | "service": "polar", |
| 180 | }) |
| 181 | } |
| 182 | |
| 183 | func (h *Handler) baseData(c *fiber.Ctx, title string) map[string]any { |
| 184 | u := middleware.CurrentUser(c) |
| 185 | lang := h.langOf(c) |
| 186 | theme, _ := c.Locals("theme").(string) |
| 187 | if theme == "" { |
| 188 | theme = "system" |
| 189 | } |
| 190 | csrf, _ := c.Locals("csrf_token").(string) |
| 191 | |
| 192 | flash := c.Cookies("polar_flash") |
| 193 | if flash != "" { |
| 194 | if decoded, err := url.QueryUnescape(flash); err == nil { |
| 195 | flash = decoded |
| 196 | } |
| 197 | c.ClearCookie("polar_flash") |
| 198 | } |
| 199 | |
| 200 | ctx := c.UserContext() |
| 201 | anonRead := h.db.IsAnonymousReadEnabled(ctx) |
| 202 | var paletteRepos []repo.Repository |
| 203 | if u != nil || anonRead { |
| 204 | paletteRepos, _ = h.repoSvc.ListAccessible(ctx, u, 25) |
| 205 | } |
| 206 | |
| 207 | data := map[string]any{ |
| 208 | "Title": title, |
| 209 | "Lang": lang, |
| 210 | "Theme": theme, |
| 211 | "CSRFToken": csrf, |
| 212 | "CurrentUser": u, |
| 213 | "Flash": flash, |
| 214 | "RegistrationEnabled": h.isRegistrationAllowed(c), |
| 215 | "ExploreEnabled": h.db.IsExploreEnabled(ctx), |
| 216 | "LandingEnabled": h.db.IsLandingEnabled(ctx, h.cfg.Landing.Enabled), |
| 217 | "AnonymousReadEnabled": anonRead, |
| 218 | "IssuesEnabled": h.db.IsIssuesEnabled(ctx), |
| 219 | "PaletteRepos": paletteRepos, |
| 220 | } |
| 221 | if extra := h.repoNavData(c); extra != nil { |
| 222 | for k, v := range extra { |
| 223 | data[k] = v |
| 224 | } |
| 225 | } |
| 226 | return data |
| 227 | } |
| 228 | |
| 229 | // repoNavData enriches template data for /:owner/:repo routes with fork |
| 230 | // navigation state used by the repository header. |
| 231 | func (h *Handler) repoNavData(c *fiber.Ctx) map[string]any { |
| 232 | owner, name := c.Params("owner"), strings.TrimSuffix(c.Params("repo"), ".git") |
| 233 | if owner == "" || name == "" { |
| 234 | return nil |
| 235 | } |
| 236 | ctx := c.UserContext() |
| 237 | nr, err := h.repoSvc.GetByOwnerAndName(ctx, owner, name) |
| 238 | if err != nil || nr == nil { |
| 239 | return nil |
| 240 | } |
| 241 | u := middleware.CurrentUser(c) |
| 242 | data := map[string]any{"NavRepo": nr} |
| 243 | data["IsRepoOwner"] = u != nil && u.ID == nr.OwnerID |
| 244 | if u != nil && u.ID != nr.OwnerID { |
| 245 | if fork, ferr := h.repoSvc.FindForkByOwner(ctx, nr.ID, u.ID); ferr == nil && fork != nil { |
| 246 | data["ViewerFork"] = fork |
| 247 | } |
| 248 | } |
| 249 | return data |
| 250 | } |
| 251 | |
| 252 | func (h *Handler) setFlash(c *fiber.Ctx, msg string) { |
| 253 | c.Cookie(&fiber.Cookie{ |
| 254 | Name: "polar_flash", |
| 255 | Value: url.QueryEscape(msg), |
| 256 | Path: "/", |
| 257 | MaxAge: 30, |
| 258 | HTTPOnly: true, |
| 259 | SameSite: "Lax", |
| 260 | }) |
| 261 | } |
| 262 | |
| 263 | // langOf resolves the active UI language for the current request. |
| 264 | func (h *Handler) langOf(c *fiber.Ctx) i18n.Lang { |
| 265 | lang, _ := c.Locals("lang").(i18n.Lang) |
| 266 | if lang == "" { |
| 267 | lang = i18n.Normalize(h.cfg.Landing.DefaultLang) |
| 268 | } |
| 269 | return lang |
| 270 | } |
| 271 | |
| 272 | // tr translates key for the current request and formats it with args. |
| 273 | func (h *Handler) tr(c *fiber.Ctx, key string, args ...any) string { |
| 274 | return fmt.Sprintf(i18n.T(h.langOf(c), key), args...) |
| 275 | } |
| 276 | |
| 277 | // setFlashT stores a localized flash message. |
| 278 | func (h *Handler) setFlashT(c *fiber.Ctx, key string, args ...any) { |
| 279 | h.setFlash(c, h.tr(c, key, args...)) |
| 280 | } |
| 281 | |
| 282 | // renderErrorT renders an error page with localized title and message. |
| 283 | func (h *Handler) renderErrorT(c *fiber.Ctx, status int, titleKey, msgKey string, args ...any) error { |
| 284 | return h.renderError(c, status, i18n.T(h.langOf(c), titleKey), h.tr(c, msgKey, args...)) |
| 285 | } |
| 286 | |
| 287 | func (h *Handler) isRegistrationAllowed(c *fiber.Ctx) bool { |
| 288 | if cnt, err := h.userSvc.Count(c.UserContext()); err == nil && cnt == 0 { |
| 289 | return true |
| 290 | } |
| 291 | return h.db.IsRegistrationEnabled(c.UserContext(), h.cfg.Auth.RegistrationEnabled) |
| 292 | } |
| 293 | |
| 294 | func (h *Handler) render(c *fiber.Ctx, status int, page string, data map[string]any) error { |
| 295 | var buf bytes.Buffer |
| 296 | if err := h.views.Render(&buf, page, data); err != nil { |
| 297 | h.logger.Error("render template failed", "page", page, "err", err) |
| 298 | return c.Status(fiber.StatusInternalServerError).SendString("Template render error") |
| 299 | } |
| 300 | c.Status(status) |
| 301 | c.Set(fiber.HeaderContentType, fiber.MIMETextHTMLCharsetUTF8) |
| 302 | return c.Send(buf.Bytes()) |
| 303 | } |
| 304 | |
| 305 | func (h *Handler) renderError(c *fiber.Ctx, status int, title, message string) error { |
| 306 | data := h.baseData(c, title) |
| 307 | data["StatusCode"] = status |
| 308 | data["Title"] = title |
| 309 | data["Message"] = message |
| 310 | return h.render(c, status, "error", data) |
| 311 | } |
| 312 | |
| 313 | func (h *Handler) Home(c *fiber.Ctx) error { |
| 314 | if !h.db.IsLandingEnabled(c.UserContext(), h.cfg.Landing.Enabled) { |
| 315 | if middleware.CurrentUser(c) != nil { |
| 316 | return c.Redirect("/repos", fiber.StatusSeeOther) |
| 317 | } |
| 318 | return c.Redirect("/login", fiber.StatusSeeOther) |
| 319 | } |
| 320 | data := h.baseData(c, "") |
| 321 | if h.db.IsExploreEnabled(c.UserContext()) && (middleware.CurrentUser(c) != nil || h.db.IsAnonymousReadEnabled(c.UserContext())) { |
| 322 | repos, _ := h.repoSvc.ListPublic(c.UserContext(), 10) |
| 323 | data["Repos"] = repos |
| 324 | } |
| 325 | return h.render(c, fiber.StatusOK, "landing", data) |
| 326 | } |
| 327 | |
| 328 | func (h *Handler) Explore(c *fiber.Ctx) error { |
| 329 | if !h.db.IsExploreEnabled(c.UserContext()) { |
| 330 | return h.renderErrorT(c, fiber.StatusNotFound, "err.not_found", "err.explore_disabled") |
| 331 | } |
| 332 | if middleware.CurrentUser(c) == nil && !h.db.IsAnonymousReadEnabled(c.UserContext()) { |
| 333 | return c.Redirect("/login", fiber.StatusSeeOther) |
| 334 | } |
| 335 | lang, _ := c.Locals("lang").(i18n.Lang) |
| 336 | data := h.baseData(c, i18n.T(lang, "nav.explore")) |
| 337 | repos, _ := h.repoSvc.ListPublic(c.UserContext(), 100) |
| 338 | data["PageHeading"] = i18n.T(lang, "nav.explore") |
| 339 | data["Repos"] = repos |
| 340 | return h.render(c, fiber.StatusOK, "repos", data) |
| 341 | } |
| 342 | |
| 343 | func (h *Handler) MyRepos(c *fiber.Ctx) error { |
| 344 | u := middleware.CurrentUser(c) |
| 345 | lang, _ := c.Locals("lang").(i18n.Lang) |
| 346 | data := h.baseData(c, i18n.T(lang, "nav.repositories")) |
| 347 | repos, _ := h.repoSvc.ListByOwner(c.UserContext(), u.ID, true) |
| 348 | data["PageHeading"] = i18n.T(lang, "nav.repositories") |
| 349 | data["Repos"] = repos |
| 350 | return h.render(c, fiber.StatusOK, "repos", data) |
| 351 | } |
| 352 | |
| 353 | func (h *Handler) cloneURL(c *fiber.Ctx, ownerUsername, repoName string) string { |
| 354 | base := strings.TrimRight(h.cfg.Server.BaseURL, "/") |
| 355 | if base == "" || strings.Contains(base, "localhost:3000") { |
| 356 | if reqBase := c.BaseURL(); reqBase != "" { |
| 357 | base = strings.TrimRight(reqBase, "/") |
| 358 | } |
| 359 | } |
| 360 | return base + "/" + ownerUsername + "/" + repoName + ".git" |
| 361 | } |
| 362 |