@foss.global/codefeed 3.1.0 → 4.0.0

package/ts/classes.giteasourcetransfer.ts

@@ -29,10 +29,15 @@ export interface IGiteaSourceTransferOptions {
   lfsTransferTimeoutMs?: number;
 }
 
-/** A source repository, by its owner's and its own name. */
+/**
+ * A source repository: its owner's and its own name, which Git and LFS reach
+ * it by, and the id Gitea gave it, which every read checks those names against.
+ */
 export interface IGiteaSourceRepository {
   owner: string;
   name: string;
+  /** Gitea's repository id, a decimal string. */
+  id: string;
 }
 
 export interface IGiteaMirrorImportOptions {
@@ -106,35 +111,34 @@ export class GiteaSourceTransfer {
    * the GitManager's data directory, in the process-wide `GitScratchBudget`,
    * and the reservation is released once the clone has ended. While it runs
    * the import holds `target`: writes to it through the GitManager fail there
-   * with `repositoryBusy`. Rejects with a fixed `ForgeInventoryError` code:
-   * `invalid-repository`, `invalid-target`, `gitmanager-not-running`, a REST
-   * code such as `http-404`, `git-workdir-failed`, `git-workdir-too-small`,
-   * `git-mirror-failed` (also when GitManager refuses `target`, such as with
-   * `repositoryBusy` while another transfer holds it) or `request-aborted`
-   * (an abort, or a GitManager stop that cancelled the clone). GitManager
-   * error text is never passed on.
+   * with `repositoryBusy`. Git clones by name, so the repository `id` is
+   * read by id both before the clone and after it, and must still be named
+   * `owner/name` (compared without case, as Gitea looks names up): a rename,
+   * a transfer or a rename and re-create rejects with
+   * `repository-identity-changed`, a deleted repository with `http-404`, also
+   * when the clone itself failed. A rejection from the read after the clone
+   * leaves the clone at `target` for the caller to discard. Rejects with a
+   * fixed `ForgeInventoryError` code: `invalid-repository`, `invalid-target`,
+   * `gitmanager-not-running`, a REST code such as `http-404`,
+   * `repository-identity-changed`, `git-workdir-failed`,
+   * `git-workdir-too-small`, `git-mirror-failed` (also when GitManager refuses
+   * `target`, such as with `repositoryBusy` while another transfer holds it)
+   * or `request-aborted` (an abort, or a GitManager stop that cancelled the
+   * clone). GitManager error text is never passed on.
    */
   public async importMirror(
     repositoryArg: IGiteaSourceRepository,
     gitManagerArg: plugins.TGitManager,
     optionsArg: IGiteaMirrorImportOptions,
   ): Promise<IGiteaMirrorImport> {
-    const { owner, name } = this.#repository(repositoryArg);
+    const repository = this.#repository(repositoryArg);
+    const { owner, name } = repository;
     const target = optionsArg?.target;
     if (typeof target?.org !== 'string' || typeof target?.repo !== 'string') throw new validation.ForgeInventoryError('invalid-target');
     const { signal } = optionsArg;
     if (signal?.aborted) throw new validation.ForgeInventoryError('request-aborted');
     if (!gitManagerArg.running) throw new validation.ForgeInventoryError('gitmanager-not-running');
-    let reportedSizeKiB: bigint;
-    try {
-      const repository = validation.record((await this.#client.request(
-        new URL(`${this.#options.baseUrl}/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`), { signal },
-      )).body);
-      reportedSizeKiB = BigInt(validation.decimal(repository.size));
-    } catch (error) {
-      if (signal?.aborted) throw new validation.ForgeInventoryError('request-aborted');
-      throw error;
-    }
+    const reportedSizeKiB = BigInt(validation.decimal((await this.#identified(repository, signal)).size));
     let dataDir: string;
     try {
       dataDir = (await gitManagerArg.getStatus()).dataDir;
@@ -142,25 +146,31 @@ export class GiteaSourceTransfer {
       throw new validation.ForgeInventoryError('git-workdir-failed');
     }
     const release = await reserveMirrorScratch(dataDir, reportedSizeKiB, signal);
+    let imported: plugins.TGitManagerRepositoryInfo;
     try {
-      const imported = await gitManagerArg.importMirror({
-        org: target.org,
-        repo: target.repo,
-        remoteUrl: giteaCloneUrl(this.#options.baseUrl, owner, name),
-        credential: { kind: 'basic', username: this.#options.login, password: this.#options.token },
-        caCertificates: this.#options.caCertificates,
-        timeoutMs: this.#options.gitTimeoutMs,
-      }, { signal });
-      return { repository: imported, reportedSizeKiB: reportedSizeKiB.toString() };
+      try {
+        imported = await gitManagerArg.importMirror({
+          org: target.org,
+          repo: target.repo,
+          remoteUrl: giteaCloneUrl(this.#options.baseUrl, owner, name),
+          credential: { kind: 'basic', username: this.#options.login, password: this.#options.token },
+          caCertificates: this.#options.caCertificates,
+          timeoutMs: this.#options.gitTimeoutMs,
+        }, { signal });
+      } finally {
+        // The import settles only after Git has exited, so the scratch is free again.
+        release();
+      }
     } catch (error) {
       const { GitManagerError } = await plugins.getGitManager();
-      const aborted = signal?.aborted || (error instanceof GitManagerError && error.code === 'transferAborted');
+      if (signal?.aborted || (error instanceof GitManagerError && error.code === 'transferAborted')) {
+        throw new validation.ForgeInventoryError('request-aborted');
+      }
       // GitManager errors are redacted, but still remote text.
-      throw new validation.ForgeInventoryError(aborted ? 'request-aborted' : 'git-mirror-failed');
-    } finally {
-      // The import settles only after Git has exited, so the scratch is free again.
-      release();
+      return this.#explained(repository, new validation.ForgeInventoryError('git-mirror-failed'), signal);
     }
+    await this.#identified(repository, signal);
+    return { repository: imported, reportedSizeKiB: reportedSizeKiB.toString() };
   }
 
   /**
@@ -169,11 +179,16 @@ export class GiteaSourceTransfer {
    * the action's headers only. Resolves with `{ status: 'missing' }` when
    * Gitea answers error 404, otherwise with a stream of the object verified
    * against `oid` and `size` as described for `LfsBatchClient.download`.
-   * Rejects with a fixed code, such as `lfs-object-error-422` for a size Gitea
-   * disagrees with.
+   * LFS reaches the repository by name, so once Gitea has answered, the
+   * repository `id` is read by id as for `importMirror`; when it is no longer
+   * named `owner/name` the download is discarded with
+   * `repository-identity-changed`, when it is deleted with `http-404`, also
+   * when the download itself failed. Rejects with a fixed code, such as
+   * `lfs-object-error-422` for a size Gitea disagrees with.
    */
   public async downloadLfsObject(repositoryArg: IGiteaSourceRepository, oidArg: string, sizeArg: number, optionsArg: ILfsRequestOptions = {}): Promise<TLfsDownload> {
-    const { owner, name } = this.#repository(repositoryArg);
+    const repository = this.#repository(repositoryArg);
+    const { owner, name } = repository;
     const client = new LfsBatchClient({
       endpoint: `${giteaCloneUrl(this.#options.baseUrl, owner, name)}/info/lfs`,
       // Gitea's LFS routes take the token as a Basic password, not as a `token` authorization.
@@ -184,18 +199,64 @@ export class GiteaSourceTransfer {
       maxResponseBytes: this.#options.maxResponseBytes,
       batchSize: 1,
     });
+    let download: TLfsDownload;
     try {
-      const download = await client.download({ oid: oidArg, size: sizeArg }, optionsArg);
-      if (download.status === 'available') {
-        download.stream.once('close', () => client.close());
-      } else {
-        client.close();
-      }
-      return download;
+      download = await client.download({ oid: oidArg, size: sizeArg }, optionsArg);
+    } catch (error) {
+      client.close();
+      if (optionsArg.signal?.aborted) throw error;
+      return this.#explained(repository, error, optionsArg.signal);
+    }
+    try {
+      // The batch answer and the object request have both reached Gitea by now; neither can still go to another repository.
+      await this.#identified(repository, optionsArg.signal);
     } catch (error) {
+      if (download.status === 'available') download.stream.destroy();
       client.close();
       throw error;
     }
+    if (download.status === 'available') {
+      download.stream.once('close', () => client.close());
+    } else {
+      client.close();
+    }
+    return download;
+  }
+
+  /**
+   * Reads the repository by its id and checks that Gitea still names it
+   * `owner/name`, without case as Gitea looks names up: other names reject
+   * with `repository-identity-changed`, a deleted repository with `http-404`.
+   */
+  async #identified(repositoryArg: IGiteaSourceRepository, signalArg: AbortSignal | undefined): Promise<Record<string, unknown>> {
+    let record: Record<string, unknown>;
+    try {
+      record = validation.record((await this.#client.request(
+        new URL(`${this.#options.baseUrl}/api/v1/repositories/${repositoryArg.id}`), { signal: signalArg },
+      )).body);
+    } catch (error) {
+      if (signalArg?.aborted) throw new validation.ForgeInventoryError('request-aborted');
+      throw error;
+    }
+    const owner = validation.record(record.owner).login;
+    if (validation.decimal(record.id) !== repositoryArg.id || typeof owner !== 'string' || typeof record.name !== 'string'
+      || owner.toLowerCase() !== repositoryArg.owner.toLowerCase() || record.name.toLowerCase() !== repositoryArg.name.toLowerCase()) {
+      throw new validation.ForgeInventoryError('repository-identity-changed');
+    }
+    return record;
+  }
+
+  /**
+   * Rejects with `errorArg`, a failed read by name, unless the identity read
+   * explains it: then with `repository-identity-changed` or `http-404`.
+   */
+  async #explained(repositoryArg: IGiteaSourceRepository, errorArg: unknown, signalArg: AbortSignal | undefined): Promise<never> {
+    try {
+      await this.#identified(repositoryArg, signalArg);
+    } catch (error) {
+      if (error instanceof validation.ForgeInventoryError && (error.code === 'repository-identity-changed' || error.code === 'http-404')) throw error;
+    }
+    throw errorArg;
   }
 
   #repository(repositoryArg: IGiteaSourceRepository): IGiteaSourceRepository {
@@ -204,8 +265,10 @@ export class GiteaSourceTransfer {
       if (segments.length !== 1) throw new validation.ForgeInventoryError('invalid-repository');
       return segments[0];
     };
+    const id = repositoryArg?.id;
+    if (typeof id !== 'string') throw new validation.ForgeInventoryError('invalid-repository');
     try {
-      return { owner: single(repositoryArg?.owner), name: single(repositoryArg?.name) };
+      return { owner: single(repositoryArg?.owner), name: single(repositoryArg?.name), id: validation.decimal(id) };
     } catch {
       throw new validation.ForgeInventoryError('invalid-repository');
     }

package/ts/giteasourceinventory.git.ts

@@ -5,6 +5,14 @@ import type { ForgeRequestClient } from './forgeinventory.client.js';
 type TMeasure = plugins.fossInterfaces.data.TForgeSourceMeasure;
 type IGitCounts = Omit<plugins.fossInterfaces.data.IForgeSourceGitCounts, 'reportedSizeKiB'>;
 type ILfsCounts = plugins.fossInterfaces.data.IForgeSourceLfsCounts;
+type IHead = plugins.fossInterfaces.data.IForgeSourceRepositoryHead;
+
+/** The Git level measure of one repository; `head` is null when the mirror's refs could not be read. */
+export interface IGiteaMirrorMeasure {
+  git: IGitCounts;
+  lfs: ILfsCounts;
+  head: IHead | null;
+}
 
 export interface IGiteaMirrorSource {
   /** Instance root without a trailing slash. */
@@ -185,13 +193,13 @@ const stepFailure = (errorArg: unknown, stepArg: string, signalArg?: AbortSignal
 
 /**
  * Measures one repository at the Git level: clones every ref Gitea advertises
- * into a temporary mirror, counts its refs and objects, finds the LFS pointers
+ * into a temporary mirror, records its HEAD, counts its refs and objects, finds the LFS pointers
  * of every reachable revision and checks through the LFS batch API which of
  * their objects Gitea holds. The mirror is removed afterwards. The clone starts
  * only once its scratch reservation fits the work directory's free space; a
  * repository too large for it fails with `git-workdir-too-small`.
  */
-export const measureGiteaMirror = async (sourceArg: IGiteaMirrorSource): Promise<{ git: IGitCounts; lfs: ILfsCounts }> => {
+export const measureGiteaMirror = async (sourceArg: IGiteaMirrorSource): Promise<IGiteaMirrorMeasure> => {
   const { signal } = sourceArg;
   if (signal?.aborted) throw new validation.ForgeInventoryError('request-aborted');
   let release: () => void;
@@ -199,7 +207,7 @@ export const measureGiteaMirror = async (sourceArg: IGiteaMirrorSource): Promise
     release = await reserveMirrorScratch(sourceArg.workDir, sourceArg.reportedSizeKiB, signal);
   } catch (error) {
     const failure = stepFailure(error, 'git-workdir-failed', signal);
-    return { git: failedGit(failure), lfs: failedLfs(failure) };
+    return { git: failedGit(failure), lfs: failedLfs(failure), head: null };
   }
   try {
     return await measureReservedMirror(sourceArg);
@@ -208,14 +216,14 @@ export const measureGiteaMirror = async (sourceArg: IGiteaMirrorSource): Promise
   }
 };
 
-const measureReservedMirror = async (sourceArg: IGiteaMirrorSource): Promise<{ git: IGitCounts; lfs: ILfsCounts }> => {
+const measureReservedMirror = async (sourceArg: IGiteaMirrorSource): Promise<IGiteaMirrorMeasure> => {
   const { signal } = sourceArg;
   const { GitManager } = await plugins.getGitManager();
   let directory: string;
   try {
     directory = await plugins.fs.mkdtemp(plugins.path.join(sourceArg.workDir, 'mirror-'));
   } catch {
-    return { git: failedGit('git-workdir-failed'), lfs: failedLfs('git-workdir-failed') };
+    return { git: failedGit('git-workdir-failed'), lfs: failedLfs('git-workdir-failed'), head: null };
   }
   const manager = new GitManager({ dataDir: directory });
   // The engine serves this measurement alone; stopping it ends the ref, object
@@ -237,16 +245,16 @@ const measureReservedMirror = async (sourceArg: IGiteaMirrorSource): Promise<{ g
       }, { signal });
     } catch (error) {
       const failure = stepFailure(error, 'git-mirror-failed', signal);
-      return { git: failedGit(failure), lfs: failedLfs(failure) };
+      return { git: failedGit(failure), lfs: failedLfs(failure), head: null };
     }
-    const git = await measureRefsAndObjects(manager, selector, signal);
+    const { git, head } = await measureRefsAndObjects(manager, selector, signal);
     let pointers: Array<{ oid: string; sizeBytes: number }>;
     try {
       pointers = await manager.listRepositoryLfsPointers(selector);
     } catch (error) {
-      return { git, lfs: failedLfs(stepFailure(error, 'lfs-pointer-scan-failed', signal)) };
+      return { git, lfs: failedLfs(stepFailure(error, 'lfs-pointer-scan-failed', signal)), head };
     }
-    return { git, lfs: await giteaLfsPresence(sourceArg, pointers) };
+    return { git, lfs: await giteaLfsPresence(sourceArg, pointers), head };
   } finally {
     signal?.removeEventListener('abort', abort);
     await manager.stop().catch(() => undefined);
@@ -258,8 +266,9 @@ const measureRefsAndObjects = async (
   managerArg: plugins.TGitManager,
   selectorArg: { org: string; repo: string },
   signalArg?: AbortSignal,
-): Promise<IGitCounts> => {
+): Promise<Pick<IGiteaMirrorMeasure, 'git' | 'head'>> => {
   const counts = { branches: 0, tags: 0, pullRequestRefs: 0, otherRefs: 0 };
+  let head: IHead | null = null;
   let refsFailure: string | null = null;
   try {
     let cursor: string | undefined;
@@ -267,6 +276,8 @@ const measureRefsAndObjects = async (
       const page = await managerArg.listRefs({ ...selectorArg, cursor });
       // Nothing writes to the private mirror, so a changed inventory is a failure.
       if (page.status === 'stale') throw new validation.ForgeInventoryError('git-refs-changed');
+      // Every page carries HEAD; its digest binds it, so all pages agree. An unborn HEAD has no object.
+      head = { target: page.head.symbolicTarget, resolves: page.head.objectId !== null };
       for (const ref of page.refs) {
         if (ref.name.startsWith('refs/heads/')) counts.branches++;
         else if (ref.name.startsWith('refs/tags/')) counts.tags++;
@@ -276,6 +287,7 @@ const measureRefsAndObjects = async (
       cursor = page.pagination.status === 'more' ? page.pagination.cursor : undefined;
     } while (cursor !== undefined);
   } catch (error) {
+    head = null;
     refsFailure = stepFailure(error, 'git-refs-failed', signalArg);
   }
   const refs = (valueArg: number) => refsFailure === null ? complete(valueArg) : partial(0, refsFailure);
@@ -289,8 +301,11 @@ const measureRefsAndObjects = async (
     objects = objectBytes = partial(0, stepFailure(error, 'git-size-failed', signalArg));
   }
   return {
-    branches: refs(counts.branches), tags: refs(counts.tags), pullRequestRefs: refs(counts.pullRequestRefs), otherRefs: refs(counts.otherRefs),
-    objects, objectBytes,
+    git: {
+      branches: refs(counts.branches), tags: refs(counts.tags), pullRequestRefs: refs(counts.pullRequestRefs), otherRefs: refs(counts.otherRefs),
+      objects, objectBytes,
+    },
+    head,
   };
 };