Struct Dispatch 

pub struct Dispatch { /* private fields */ }

Parse → resolve → check, with no SSH anywhere in it.

Kept separate from the Handler so the security decision can be tested directly, exhaustively and without a handshake, and so there is exactly one place where it is made.

Implementations

impl Dispatch

pub fn new(control: Control) -> Self

Build a dispatch over the control plane.

pub fn control(&self) -> &Control

The control plane this dispatch authenticates and authorises against.

pub fn authorise( &self, principal: &Principal, key_fingerprint: Option<&Fingerprint>, raw: &[u8], ) -> Result<ServiceRequest, DispatchError>

Decide whether principal may run raw on this server.

Parse (which includes the sandbox), resolve, then check the grant. A storage failure at either lookup comes back as DispatchError::Store rather than as a denial. See crate::control.

The client’s environment is not a parameter here, and must not become one. The returned ServiceRequest carries git_protocol: None; the handler attaches the allowlisted value with ServiceRequest::with_git_protocol after this decision has already been made, so there is no path by which anything the client typed into its environment can reach the grant check.

pub fn authorise_service( &self, principal: &Principal, key_fingerprint: Option<&Fingerprint>, service: GitService, path: RepoRef, ) -> Result<ServiceRequest, DispatchError>

The same decision, entered from a URL path rather than an exec line.

Smart HTTP does not send git-upload-pack '<path>'; it sends POST /<path>/git-upload-pack. The verb and the path arrive already separated, and the path has no shell quoting on it, so there is nothing for command::parse to do — but everything after the parse is identical and must stay identical: resolve, ask the ACL, and refuse in the one way that does not tell a caller whether a repository exists.

So this is where that decision lives and Dispatch::authorise is now a parser in front of it. Two entry points, one answer (one implementation). A second copy of this in gunnar-http is precisely the thing that ends with SSH and HTTP disagreeing about who may push, and the disagreement being found by whoever pushes.

repo is a RepoRef, which is to say it has already been through gunnar_core::resolve_repo_path. The sandbox is not optional on this path either: the caller cannot construct a RepoRef without it.

Trait Implementations

impl Clone for Dispatch

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Dispatch

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.