fix(http): add transport timeouts so tea fails fast on stalled servers (#1020)

Fixes #1018

Co-authored-by: dinsmoor <204368+dinsmoor@noreply.gitea.com>
Co-committed-by: dinsmoor <204368+dinsmoor@noreply.gitea.com>

modules/httputil/httputil.go

@@ -4,6 +4,7 @@
 package httputil
 
 import (
+	"crypto/tls"
 	"fmt"
 	"net/http"
 	"runtime"
@@ -20,12 +21,14 @@ func UserAgent() string {
 	return ua
 }
 
-// WrapTransport wraps an http.RoundTripper to add the User-Agent header.
-func WrapTransport(base http.RoundTripper) http.RoundTripper {
-	if base == nil {
-		base = http.DefaultTransport
-	}
-	return &userAgentTransport{base: base}
+// WrapTransport returns tea's standard HTTP transport: an *http.Transport
+// preset with tea's connection / response-header timeouts (see timeoutTransport)
+// and decorated to add the User-Agent header on every request. The supplied
+// tlsConfig is attached as-is (nil is fine); callers use it for insecure /
+// skip-verify logins. This is the single entry point for building a tea HTTP
+// client transport, so the timeouts can't be accidentally omitted.
+func WrapTransport(tlsConfig *tls.Config) http.RoundTripper {
+	return &userAgentTransport{base: timeoutTransport(tlsConfig)}
 }
 
 type userAgentTransport struct {
@@ -33,6 +36,11 @@ type userAgentTransport struct {
 }
 
 func (t *userAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	// Set the UA at the transport so every client built from WrapTransport
+	// identifies itself, including the non-SDK clients (oauth2 flow, token
+	// refresh) that never pass through the SDK's own SetUserAgent. For SDK
+	// clients this overlaps gitea.SetUserAgent; both use httputil.UserAgent(),
+	// so the duplicate Header.Set is a no-op.
 	req.Header.Set("User-Agent", UserAgent())
 	return t.base.RoundTrip(req)
 }