@foss.global/codefeed 3.2.0 → 4.1.0

package/ts/classes.giteasourcetransfer.ts

@@ -29,10 +29,15 @@ export interface IGiteaSourceTransferOptions {
   lfsTransferTimeoutMs?: number;
 }
 
-/** A source repository, by its owner's and its own name. */
+/**
+ * A source repository: its owner's and its own name, which Git and LFS reach
+ * it by, and the id Gitea gave it, which every read checks those names against.
+ */
 export interface IGiteaSourceRepository {
   owner: string;
   name: string;
+  /** Gitea's repository id, a decimal string. */
+  id: string;
 }
 
 export interface IGiteaMirrorImportOptions {
@@ -106,35 +111,34 @@ export class GiteaSourceTransfer {
    * the GitManager's data directory, in the process-wide `GitScratchBudget`,
    * and the reservation is released once the clone has ended. While it runs
    * the import holds `target`: writes to it through the GitManager fail there
-   * with `repositoryBusy`. Rejects with a fixed `ForgeInventoryError` code:
-   * `invalid-repository`, `invalid-target`, `gitmanager-not-running`, a REST
-   * code such as `http-404`, `git-workdir-failed`, `git-workdir-too-small`,
-   * `git-mirror-failed` (also when GitManager refuses `target`, such as with
-   * `repositoryBusy` while another transfer holds it) or `request-aborted`
-   * (an abort, or a GitManager stop that cancelled the clone). GitManager
-   * error text is never passed on.
+   * with `repositoryBusy`. Git clones by name, so the repository `id` is
+   * read by id both before the clone and after it, and must still be named
+   * `owner/name` (compared without case, as Gitea looks names up): a rename,
+   * a transfer or a rename and re-create rejects with
+   * `repository-identity-changed`, a deleted repository with `http-404`, also
+   * when the clone itself failed. A rejection from the read after the clone
+   * leaves the clone at `target` for the caller to discard. Rejects with a
+   * fixed `ForgeInventoryError` code: `invalid-repository`, `invalid-target`,
+   * `gitmanager-not-running`, a REST code such as `http-404`,
+   * `repository-identity-changed`, `git-workdir-failed`,
+   * `git-workdir-too-small`, `git-mirror-failed` (also when GitManager refuses
+   * `target`, such as with `repositoryBusy` while another transfer holds it)
+   * or `request-aborted` (an abort, or a GitManager stop that cancelled the
+   * clone). GitManager error text is never passed on.
    */
   public async importMirror(
     repositoryArg: IGiteaSourceRepository,
     gitManagerArg: plugins.TGitManager,
     optionsArg: IGiteaMirrorImportOptions,
   ): Promise<IGiteaMirrorImport> {
-    const { owner, name } = this.#repository(repositoryArg);
+    const repository = this.#repository(repositoryArg);
+    const { owner, name } = repository;
     const target = optionsArg?.target;
     if (typeof target?.org !== 'string' || typeof target?.repo !== 'string') throw new validation.ForgeInventoryError('invalid-target');
     const { signal } = optionsArg;
     if (signal?.aborted) throw new validation.ForgeInventoryError('request-aborted');
     if (!gitManagerArg.running) throw new validation.ForgeInventoryError('gitmanager-not-running');
-    let reportedSizeKiB: bigint;
-    try {
-      const repository = validation.record((await this.#client.request(
-        new URL(`${this.#options.baseUrl}/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`), { signal },
-      )).body);
-      reportedSizeKiB = BigInt(validation.decimal(repository.size));
-    } catch (error) {
-      if (signal?.aborted) throw new validation.ForgeInventoryError('request-aborted');
-      throw error;
-    }
+    const reportedSizeKiB = BigInt(validation.decimal((await this.#identified(repository, signal)).size));
     let dataDir: string;
     try {
       dataDir = (await gitManagerArg.getStatus()).dataDir;
@@ -142,25 +146,31 @@ export class GiteaSourceTransfer {
       throw new validation.ForgeInventoryError('git-workdir-failed');
     }
     const release = await reserveMirrorScratch(dataDir, reportedSizeKiB, signal);
+    let imported: plugins.TGitManagerRepositoryInfo;
     try {
-      const imported = await gitManagerArg.importMirror({
-        org: target.org,
-        repo: target.repo,
-        remoteUrl: giteaCloneUrl(this.#options.baseUrl, owner, name),
-        credential: { kind: 'basic', username: this.#options.login, password: this.#options.token },
-        caCertificates: this.#options.caCertificates,
-        timeoutMs: this.#options.gitTimeoutMs,
-      }, { signal });
-      return { repository: imported, reportedSizeKiB: reportedSizeKiB.toString() };
+      try {
+        imported = await gitManagerArg.importMirror({
+          org: target.org,
+          repo: target.repo,
+          remoteUrl: giteaCloneUrl(this.#options.baseUrl, owner, name),
+          credential: { kind: 'basic', username: this.#options.login, password: this.#options.token },
+          caCertificates: this.#options.caCertificates,
+          timeoutMs: this.#options.gitTimeoutMs,
+        }, { signal });
+      } finally {
+        // The import settles only after Git has exited, so the scratch is free again.
+        release();
+      }
     } catch (error) {
       const { GitManagerError } = await plugins.getGitManager();
-      const aborted = signal?.aborted || (error instanceof GitManagerError && error.code === 'transferAborted');
+      if (signal?.aborted || (error instanceof GitManagerError && error.code === 'transferAborted')) {
+        throw new validation.ForgeInventoryError('request-aborted');
+      }
       // GitManager errors are redacted, but still remote text.
-      throw new validation.ForgeInventoryError(aborted ? 'request-aborted' : 'git-mirror-failed');
-    } finally {
-      // The import settles only after Git has exited, so the scratch is free again.
-      release();
+      return this.#explained(repository, new validation.ForgeInventoryError('git-mirror-failed'), signal);
     }
+    await this.#identified(repository, signal);
+    return { repository: imported, reportedSizeKiB: reportedSizeKiB.toString() };
   }
 
   /**
@@ -169,11 +179,16 @@ export class GiteaSourceTransfer {
    * the action's headers only. Resolves with `{ status: 'missing' }` when
    * Gitea answers error 404, otherwise with a stream of the object verified
    * against `oid` and `size` as described for `LfsBatchClient.download`.
-   * Rejects with a fixed code, such as `lfs-object-error-422` for a size Gitea
-   * disagrees with.
+   * LFS reaches the repository by name, so once Gitea has answered, the
+   * repository `id` is read by id as for `importMirror`; when it is no longer
+   * named `owner/name` the download is discarded with
+   * `repository-identity-changed`, when it is deleted with `http-404`, also
+   * when the download itself failed. Rejects with a fixed code, such as
+   * `lfs-object-error-422` for a size Gitea disagrees with.
    */
   public async downloadLfsObject(repositoryArg: IGiteaSourceRepository, oidArg: string, sizeArg: number, optionsArg: ILfsRequestOptions = {}): Promise<TLfsDownload> {
-    const { owner, name } = this.#repository(repositoryArg);
+    const repository = this.#repository(repositoryArg);
+    const { owner, name } = repository;
     const client = new LfsBatchClient({
       endpoint: `${giteaCloneUrl(this.#options.baseUrl, owner, name)}/info/lfs`,
       // Gitea's LFS routes take the token as a Basic password, not as a `token` authorization.
@@ -184,18 +199,64 @@ export class GiteaSourceTransfer {
       maxResponseBytes: this.#options.maxResponseBytes,
       batchSize: 1,
     });
+    let download: TLfsDownload;
     try {
-      const download = await client.download({ oid: oidArg, size: sizeArg }, optionsArg);
-      if (download.status === 'available') {
-        download.stream.once('close', () => client.close());
-      } else {
-        client.close();
-      }
-      return download;
+      download = await client.download({ oid: oidArg, size: sizeArg }, optionsArg);
+    } catch (error) {
+      client.close();
+      if (optionsArg.signal?.aborted) throw error;
+      return this.#explained(repository, error, optionsArg.signal);
+    }
+    try {
+      // The batch answer and the object request have both reached Gitea by now; neither can still go to another repository.
+      await this.#identified(repository, optionsArg.signal);
     } catch (error) {
+      if (download.status === 'available') download.stream.destroy();
       client.close();
       throw error;
     }
+    if (download.status === 'available') {
+      download.stream.once('close', () => client.close());
+    } else {
+      client.close();
+    }
+    return download;
+  }
+
+  /**
+   * Reads the repository by its id and checks that Gitea still names it
+   * `owner/name`, without case as Gitea looks names up: other names reject
+   * with `repository-identity-changed`, a deleted repository with `http-404`.
+   */
+  async #identified(repositoryArg: IGiteaSourceRepository, signalArg: AbortSignal | undefined): Promise<Record<string, unknown>> {
+    let record: Record<string, unknown>;
+    try {
+      record = validation.record((await this.#client.request(
+        new URL(`${this.#options.baseUrl}/api/v1/repositories/${repositoryArg.id}`), { signal: signalArg },
+      )).body);
+    } catch (error) {
+      if (signalArg?.aborted) throw new validation.ForgeInventoryError('request-aborted');
+      throw error;
+    }
+    const owner = validation.record(record.owner).login;
+    if (validation.decimal(record.id) !== repositoryArg.id || typeof owner !== 'string' || typeof record.name !== 'string'
+      || owner.toLowerCase() !== repositoryArg.owner.toLowerCase() || record.name.toLowerCase() !== repositoryArg.name.toLowerCase()) {
+      throw new validation.ForgeInventoryError('repository-identity-changed');
+    }
+    return record;
+  }
+
+  /**
+   * Rejects with `errorArg`, a failed read by name, unless the identity read
+   * explains it: then with `repository-identity-changed` or `http-404`.
+   */
+  async #explained(repositoryArg: IGiteaSourceRepository, errorArg: unknown, signalArg: AbortSignal | undefined): Promise<never> {
+    try {
+      await this.#identified(repositoryArg, signalArg);
+    } catch (error) {
+      if (error instanceof validation.ForgeInventoryError && (error.code === 'repository-identity-changed' || error.code === 'http-404')) throw error;
+    }
+    throw errorArg;
   }
 
   #repository(repositoryArg: IGiteaSourceRepository): IGiteaSourceRepository {
@@ -204,8 +265,10 @@ export class GiteaSourceTransfer {
       if (segments.length !== 1) throw new validation.ForgeInventoryError('invalid-repository');
       return segments[0];
     };
+    const id = repositoryArg?.id;
+    if (typeof id !== 'string') throw new validation.ForgeInventoryError('invalid-repository');
     try {
-      return { owner: single(repositoryArg?.owner), name: single(repositoryArg?.name) };
+      return { owner: single(repositoryArg?.owner), name: single(repositoryArg?.name), id: validation.decimal(id) };
     } catch {
       throw new validation.ForgeInventoryError('invalid-repository');
     }