gitgateway

type CredentialProvider ¶

type CredentialProvider struct {
	// contains filtered or unexported fields
}

CredentialProvider injects forge-appropriate Basic auth into upstream requests, resolving the actual token value through a SecretResolver.

func NewCredentialProvider(hosts []HostForgeConfig, resolver SecretResolver) *CredentialProvider

func (c *CredentialProvider) Configured() bool

func (c *CredentialProvider) Inject(req *http.Request, host string) error

func (c *CredentialProvider) SchemeFor(host string) string

type Entry ¶

type Entry struct {
	Token string
	Repos map[RepoKey]Permission
}

Entry is one job token's authorization: which repos it may reach and at what permission level. docs/plans/git-gateway-cutover.md PR3 の許可集合 (自 project は fetch+push or fetch のみ、workspace peer は fetch のみ、 read-only 追加許可 repo も fetch のみ) はすべて呼び出し側 (PR4 の dispatch 配線) が Repos map の構築時に表現する — Registry 自体は集合の形を知らない。

type Forge ¶

type Forge string

Forge identifies which upstream git host convention to use for Basic auth.

const (
	ForgeGitHub    Forge = "github"
	ForgeBitbucket Forge = "bitbucket"
)

type HostForgeConfig ¶

type HostForgeConfig struct {
	// Host is the upstream host as it appears in the gateway route path
	// (e.g. "github.com"), used as the lookup key.
	Host string `yaml:"host"`
	// Forge selects the Basic-auth username convention and (in future
	// callers) any forge-specific behavior.
	Forge Forge `yaml:"forge"`
	// SecretKey is a reference into the secret store
	// (internal/dispatcher/secret_store.go); never a plaintext token.
	SecretKey string `yaml:"secret_key"`
	// Scheme overrides the upstream request scheme; empty means "https".
	// Production forge hosts always use https — this only exists so tests
	// can point a HostForgeConfig at a plaintext httptest upstream.
	Scheme string `yaml:"-"`
}

HostForgeConfig declares how the gateway authenticates requests to one upstream host: which forge convention to use and which secret-store key holds the token. "設定 1 フィールドで forge 種別を持てば足りる" per the container-based-boid.md token 戦略 section — Forge is that field.

type NotifierFuncs ¶

type NotifierFuncs struct {
	UpstreamAuthFailure func(host string, repo RepoKey)
	CredentialError     func(host string, repo RepoKey, err error)
}

NotifierFuncs adapts plain functions to UpstreamAuthFailureNotifier. Either field may be left nil, in which case the corresponding notification is a no-op — callers that only care about one of the two failure modes (e.g. tests) do not need to stub both.

func (f NotifierFuncs) NotifyCredentialError(host string, repo RepoKey, err error)

func (f NotifierFuncs) NotifyUpstreamAuthFailure(host string, repo RepoKey)

type Operation ¶

type Operation string

Operation is the git operation implied by a request, derived from the endpoint name (and, for info/refs, the ?service= query parameter) rather than the HTTP method — docs/plans/git-gateway-cutover.md PR3: "push は git-receive-pack、fetch は git-upload-pack で判別 (endpoint 名 + service query param 両方)".

const (
	OpFetch Operation = "fetch" // git-upload-pack
	OpPush  Operation = "push"  // git-receive-pack
)

type Permission ¶

type Permission int

Permission is the access level a job token has on one repo.

const (
	// PermFetch allows git-upload-pack only (read/clone/fetch).
	PermFetch Permission = iota + 1
	// PermFetchPush allows both git-upload-pack and git-receive-pack.
	PermFetchPush
)

func (p Permission) Allows(op Operation) bool

type Registry ¶

type Registry struct {
	// contains filtered or unexported fields
}

Registry is the job-token → allowed-repo-set store. It is a deliberately simple sync.RWMutex-guarded map (docs/plans/git-gateway-cutover.md PR3 実装ヒント: 「job token レジストリは sync.RWMutex で守った map[token]entry の素朴実装で足りる」); PR4 adds the dispatch-time Register/Unregister call sites and a richer lifecycle, but the shape here doesn't need to change for that.

func NewRegistry() *Registry

func (r *Registry) Authorize(token string, repo RepoKey, op Operation) (allowed, tokenValid bool)

func (r *Registry) Lookup(token string) (Entry, bool)

func (r *Registry) Register(repos map[RepoKey]Permission) string

func (r *Registry) RegisterToken(token string, repos map[RepoKey]Permission)

func (r *Registry) Unregister(token string)

type RepoKey ¶

type RepoKey string

RepoKey identifies a repo by its normalized "<host>/<owner>/<repo>" form — always suffix-free. docs/plans/git-gateway-cutover.md PR3 節の設計調整: PR2 の Opus レビューで NormalizeOriginURL の HTTPS/SSH 非対称 (HTTPS 入力は suffix なし passthrough、SSH 入力は suffix 付与) が浮上した。 gateway はこの非対称を吸収する層として、".git" suffix の有無を問わず 同じ RepoKey に正規化する — 登録時 (Registry.Register) も lookup 時 (parsePath 経由) も必ずこの型を経由させ、吸収ロジックを一箇所に閉じる。

func NewRepoKey(host, owner, repo string) RepoKey

type SecretResolver ¶

type SecretResolver func(key string) (string, error)

SecretResolver resolves a secret-store key reference to its plaintext value. config.yaml (PR4) carries only the key reference — never the plaintext token (docs/plans/git-gateway-cutover.md: 「config.yaml の gateway ブロックは forge 種別と secret key 参照のみ持つ」). This is a plain function type, mirroring internal/sandbox.SecretResolver's shape, so PR4 can adapt internal/dispatcher.SecretStore.Get to it with a one-line closure instead of gitgateway importing the dispatcher package (which would drag the sqlite-backed internal/db build into this otherwise db-free package).

type Server ¶

type Server struct {
	// contains filtered or unexported fields
}

Server is the git gateway's HTTP handler: a thin net/http/httputil. ReverseProxy wrapper that does path-based authorization (Registry) and forge credential injection (CredentialProvider) around the standard library's streaming transport. It never buffers request bodies — packfile POSTs are streamed straight through to the upstream forge (docs/plans/git-gateway-cutover.md PR3: 「ボディは無バッファ転送必須」).

Server has been wired into the running daemon since PR4 (docs/plans/git-gateway-cutover.md): internal/server/wire.go constructs one (Registry + CredentialProvider + notifier) and Server.Start/Stop own its listener lifecycle alongside the daemon's other subservers. PR5 is the first PR whose traffic actually reaches it in practice (the runner's sandbox-internal clone sequence, gated behind the still-inert sandbox.CloneSpec opt-in) — until a caller sets that, this handler serves zero real requests.

func NewServer(registry *Registry, credentials *CredentialProvider, notifier UpstreamAuthFailureNotifier) *Server

func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request)

type UpstreamAuthFailureNotifier ¶

type UpstreamAuthFailureNotifier interface {
	NotifyUpstreamAuthFailure(host string, repo RepoKey)
	NotifyCredentialError(host string, repo RepoKey, err error)
}

UpstreamAuthFailureNotifier is invoked on two distinct failure modes so an operator can tell them apart (docs/plans/git-gateway-cutover.md PR4, flagged in PR3's review: 「config error (認証注入失敗) と token 失効を differentiate できると良い」):

• NotifyUpstreamAuthFailure: the upstream forge responded with 401 to a request that WAS sent with injected credentials — the token itself is wrong/expired/revoked ("rotate the token"; docs/plans/container-based-boid.md 「token 戦略」: 「失効前提の運用」。両 forge とも token は失効前提).
• NotifyCredentialError: credential injection itself failed before the request ever reached the upstream — an unconfigured host, a missing resolver, or a secret-store lookup error ("fix the gateway config").

The gateway always logs a warning on either condition and additionally calls the matching hook, but never aborts serving other requests because of it (docs/plans/git-gateway-cutover.md: 「gateway 自体は落とさない」).

var NoopNotifier UpstreamAuthFailureNotifier = NotifierFuncs{}