mirror of
https://gitea.com/gitea/tea.git
synced 2026-10-26 19:11:25 +01:00
bircni
2b218a5bae
Part 1/5 of the tea 1.0 rewrite. **Stack** (split from #1121; each PR targets `main` and builds, tests and lints on its own — the shipped CLI only changes in part 5): 1. #1122 Toolchain and foundation packages ← this PR 2. #1123 Credentials and Git 3. #1124 Terminal 4. #1125 Services 5. #1126 CLI wiring, docs, removal of the old tree ## Changes - **build:** require Go 1.27; bump gofumpt and golangci-lint to releases that can read Go 1.27 export data (own commit). - `internal/clierr`: typed errors and executable exit codes. - `internal/version`: build version and tags. - `internal/filelock`: moved unchanged from `modules/filelock`. - `internal/aliases`: user-defined command aliases. - `internal/transport`: the HTTP client the Gitea SDK runs on (part 4): token, Sudo and SSH-signature auth, retries for safe reads, connect/TLS/response-header timeouts, typed API errors that keep Gitea's message, and a redacted request log for `--debug`; plus raw requests for `tea api`, signed downloads that follow object-storage redirects, and log streaming. - `internal/settings`: split `config.yml` / `hosts.yml` with locked transactions, plus remote URL parsing. Nothing imports these packages yet. Note: `flake.nix` now asks for `go_1_27`; the pinned nixpkgs in `flake.lock` predates Go 1.27 and still needs a `nix flake update nixpkgs`. Reviewed-on: https://gitea.com/gitea/tea/pulls/1122 Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>
84 lines
2.7 KiB
Go
84 lines
2.7 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package transport
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"net/http"
|
|
"net/url"
|
|
)
|
|
|
|
// Download opens an instance-scoped file URL without following redirects.
|
|
func (c *Client) Download(ctx context.Context, raw string) (*http.Response, error) {
|
|
_, target, err := c.downloadTarget(raw)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return c.get(ctx, target, false)
|
|
}
|
|
|
|
// downloadTarget returns the parsed instance URL and raw, which must lie within its base path.
|
|
func (c *Client) downloadTarget(raw string) (*url.URL, *url.URL, error) {
|
|
base, target, err := c.scoped(raw, "download URL")
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
if !within(base, target, "/") {
|
|
return nil, nil, errors.New("download URL must belong to the selected instance and base path")
|
|
}
|
|
return base, target, nil
|
|
}
|
|
|
|
func (c *Client) get(ctx context.Context, target *url.URL, allowRedirect bool) (*http.Response, error) {
|
|
ctx, failure := CaptureErrors(ctx)
|
|
request, err := http.NewRequestWithContext(ctx, http.MethodGet, target.String(), nil)
|
|
if err != nil {
|
|
return nil, errors.New("cannot construct download request")
|
|
}
|
|
response, err := c.API().Do(request)
|
|
if err != nil {
|
|
return nil, RequestError(ctx, "download failed", err)
|
|
}
|
|
if (allowRedirect && redirect(response.StatusCode)) || (response.StatusCode >= 200 && response.StatusCode < 300) {
|
|
return response, nil
|
|
}
|
|
_ = response.Body.Close()
|
|
return nil, failure()
|
|
}
|
|
|
|
func redirect(status int) bool {
|
|
switch status {
|
|
case http.StatusMovedPermanently, http.StatusFound, http.StatusSeeOther, http.StatusTemporaryRedirect, http.StatusPermanentRedirect:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// DownloadSigned opens an instance-scoped file URL and follows at most one redirect without
|
|
// credentials, such as Gitea's redirect to signed object-storage URLs. The redirect target may be
|
|
// another host, but must use HTTPS or the instance's scheme. Automatic redirects remain disabled,
|
|
// including on an injected HTTP client.
|
|
func (c *Client) DownloadSigned(ctx context.Context, raw string) (*http.Response, error) {
|
|
base, target, err := c.downloadTarget(raw)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
response, err := c.get(ctx, target, true)
|
|
if err != nil || !redirect(response.StatusCode) {
|
|
return response, err
|
|
}
|
|
_ = response.Body.Close()
|
|
location, err := response.Location()
|
|
if err != nil {
|
|
return nil, errors.New("download returned an invalid redirect")
|
|
}
|
|
if location.Scheme != "https" && location.Scheme != base.Scheme {
|
|
return nil, errors.New("download redirect must use HTTPS or the instance's scheme")
|
|
}
|
|
unsigned := *c
|
|
unsigned.Token, unsigned.Signer, unsigned.Sudo = "", nil, ""
|
|
return unsigned.get(ctx, location, false)
|
|
}
|