lfsx_server/

auth.rs

mod backoff;
mod budget;
mod cache;
mod credentials;
mod gitea;
mod github;
mod gitlab;
mod restricted;

use std::collections::HashMap;

use axum::extract::{Path, Request, State};
use axum::http::HeaderMap;
use axum::middleware::Next;
use axum::response::Response;

use crate::config::{Auth, Provider};
use crate::error::Error;
use crate::namespace::Namespace;
use crate::state::Shared;
use budget::Budget;
use cache::{Cache, Caller, Decision, IdentityCache};
pub use restricted::Restricted;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Permission {
    Read,
    Write,
    Admin,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Actor(pub String);

impl Permission {
    pub fn require_write(self) -> Result<(), Error> {
        matches!(self, Self::Write | Self::Admin)
            .then_some(())
            .ok_or(Error::Forbidden)
    }

    pub fn require_admin(self) -> Result<(), Error> {
        matches!(self, Self::Admin)
            .then_some(())
            .ok_or(Error::Forbidden)
    }
}

pub enum Authorizer {
    Forge {
        provider: Provider,
        client: reqwest::Client,
        api_url: String,
        // Boxed because this variant carries four sizeable things and the other
        // carries nothing, so every `Authorizer` in the process would pay for the
        // difference. The same reason `Backend::Bucket` boxes its handle.
        cache: Box<Cache>,
        identities: IdentityCache,
        // Spent only on a lookup the caches could not answer, which is what
        // makes it a ceiling on forge traffic rather than on requests: a push of
        // two hundred objects under one token costs one.
        budget: Budget,
        anonymous_read: bool,
        // Namespaces whose objects take write access to read. The forge answer
        // stays the ceiling, this is a floor underneath it that a public
        // repository's `pull: true` cannot reach.
        restricted: Restricted,
        app: Option<Box<github::app::App>>,
    },
    Disabled,
}

impl Authorizer {
    pub fn new(auth: &Auth) -> Self {
        crate::tls::install_crypto_provider();

        match auth {
            Auth::Disabled => Self::Disabled,
            Auth::Forge {
                provider,
                api_url,
                cache_ttl,
                rejection_ttl,
                lookup_budget,
                anonymous_read,
                restricted,
                github_app,
            } => Self::Forge {
                provider: *provider,
                client: reqwest::Client::builder()
                    .user_agent(concat!("lfsx/", env!("CARGO_PKG_VERSION")))
                    .timeout(std::time::Duration::from_secs(10))
                    .build()
                    .expect("http client"),
                api_url: api_url.clone(),
                cache: Box::new(Cache::new(*cache_ttl, *rejection_ttl)),
                identities: IdentityCache::new(*cache_ttl),
                budget: Budget::new(*lookup_budget),
                anonymous_read: *anonymous_read,
                restricted: restricted.clone(),
                app: github_app.as_ref().map(|configured| {
                    Box::new(github::app::App::load(
                        &configured.app_id,
                        &configured.key_file,
                        *rejection_ttl,
                    ))
                }),
            },
        }
    }

    #[tracing::instrument(skip_all, fields(namespace = %ns))]
    async fn permission(&self, headers: &HeaderMap, ns: &Namespace) -> Result<Permission, Error> {
        let Self::Forge {
            provider,
            client,
            api_url,
            cache,
            budget,
            anonymous_read,
            restricted,
            app,
            ..
        } = self
        else {
            return Ok(Permission::Admin);
        };

        let writers_only = restricted.covers(ns);
        let decided = |outcome: Result<Permission, Error>| {
            if writers_only {
                let permission = outcome?;
                permission.require_write()?;
                return Ok(permission);
            }
            outcome
        };

        // A request with no credentials is the one an anonymous `git clone` makes.
        // The forge already knows whether that should be allowed, so it is asked
        // rather than refused outright, and the answer is cached under its own
        // key so it can never be handed to somebody presenting a token.
        let Some(token) = credentials::token(headers) else {
            // A restricted namespace wants write access, which nobody anonymous
            // has, so the forge is not asked. Unauthenticated rather than
            // Forbidden for the reason github.rs records about private
            // repositories: a 403 tells git-lfs the answer is final and it stops
            // asking the credential helper, so the caller who does hold write
            // access could never present it.
            if !*anonymous_read || writers_only {
                return Err(Error::Unauthenticated);
            }

            if let Some(decision) = cache.get(Caller::Anonymous, ns) {
                return decision.into();
            }

            budget.afford()?;

            let outcome = match provider {
                Provider::Github => github::public(client, api_url, app.as_deref(), ns).await,
                Provider::Gitlab => gitlab::public(client, api_url, ns).await,
                Provider::Gitea => gitea::public(client, api_url, ns).await,
            };
            if let Some(decision) = Decision::of(&outcome) {
                cache.insert(Caller::Anonymous, ns, decision);
            }

            return outcome;
        };

        if let Some(decision) = cache.get(Caller::Token(&token), ns) {
            return decided(decision.into());
        }

        // Only here, past both caches. Everything above this line was answered
        // without asking anybody.
        budget.afford()?;

        let outcome = match provider {
            Provider::Github => github::permission(client, api_url, &token, ns).await,
            Provider::Gitlab => gitlab::permission(client, api_url, &token, ns).await,
            Provider::Gitea => gitea::permission(client, api_url, &token, ns).await,
        };
        if let Some(decision) = Decision::of(&outcome) {
            cache.insert(Caller::Token(&token), ns, decision);
        }

        decided(outcome)
    }
}

impl Authorizer {
    #[tracing::instrument(skip_all)]
    pub async fn actor(&self, headers: &HeaderMap) -> Result<Actor, Error> {
        let Self::Forge {
            provider,
            client,
            api_url,
            identities,
            budget,
            ..
        } = self
        else {
            return Ok(Actor("anonymous".to_owned()));
        };

        let token = credentials::token(headers).ok_or(Error::Unauthenticated)?;
        if let Some(login) = identities.get(&token) {
            return Ok(Actor(login));
        }

        budget.afford()?;

        let login = match provider {
            Provider::Github => github::login(client, api_url, &token).await?,
            Provider::Gitlab => gitlab::login(client, api_url, &token).await?,
            Provider::Gitea => gitea::login(client, api_url, &token).await?,
        };
        identities.insert(&token, &login);

        Ok(Actor(login))
    }
}

pub async fn authorize(
    State(state): State<Shared>,
    Path(params): Path<HashMap<String, String>>,
    mut request: Request,
    next: Next,
) -> Result<Response, Error> {
    let (Some(org), Some(repo)) = (params.get("org"), params.get("repo")) else {
        return Err(Error::MalformedNamespace);
    };
    let ns = Namespace::new(org.as_str(), repo.as_str())?;

    let permission = state.authorizer.permission(request.headers(), &ns).await?;
    request.extensions_mut().insert(permission);
    request.extensions_mut().insert(ns);

    Ok(next.run(request).await)
}

#[cfg(test)]
mod tests;