pygitweb 0.1.0__py3-none-any.whl

pygitweb/merge_requests.py

@@ -0,0 +1,230 @@
+"""Merge request tag view helpers and fast-forward merge endpoint."""
+
+from __future__ import annotations
+
+import json
+from typing import Any
+from urllib.parse import quote
+
+import pygit2
+from fastapi import APIRouter, Depends, Form, HTTPException, Query
+from fastapi.responses import HTMLResponse, RedirectResponse, Response
+
+from pygittools.merge import MergeRequest, MergeRequestStatus, get_merge_request_by_oid
+from pygitweb.auth import require_permission
+from pygitweb.config import settings
+from pygitweb.dependencies import ValidatedFormProject, ValidatedQueryProject
+from pygitweb.git_helpers import open_repo
+from pygitweb.permissions import Permission
+from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env, jinja_escape
+from pygitweb.validation import is_valid_ref_format
+
+
+def _branch_short_name(ref: str) -> str:
+	return ref.removeprefix("refs/heads/") if ref.startswith("refs/heads/") else ref
+
+
+merge_router = APIRouter(tags=["merge_requests"])
+
+_STATUS_LABELS: dict[MergeRequestStatus, str] = {
+	MergeRequestStatus.CAN_FAST_FORWARD: "Can fast-forward",
+	MergeRequestStatus.UP_TO_DATE: "Already up to date",
+	MergeRequestStatus.BLOCKED_DIVERGED: "Blocked: histories diverged (not fast-forward)",
+	MergeRequestStatus.OURS_REF_MISSING: "Blocked: ours ref is missing",
+	MergeRequestStatus.MR_HEAD_MISSING: "Blocked: merge request head is missing from the repository",
+}
+
+
+def try_merge_request_from_tag(repo: pygit2.Repository, tag: pygit2.Tag) -> MergeRequest | None:
+	try:
+		return get_merge_request_by_oid(repo, tag.id)
+	except (ValueError, json.JSONDecodeError, TypeError, KeyError):
+		return None
+
+
+def resolve_merge_request_tag_to_tip(
+	repo: pygit2.Repository, obj: pygit2.Tag
+) -> tuple[pygit2.Tag, MergeRequest] | None:
+	"""If ``obj`` is an MR tag and ``refs/tags/mr/…`` points to a newer tag object, return that tip."""
+	mr = try_merge_request_from_tag(repo, obj)
+	if mr is None:
+		return None
+	if mr.name not in repo.references:
+		return obj, mr
+	tip_id = repo.references[mr.name].resolve().target
+	if tip_id == obj.id:
+		return obj, mr
+	tip_obj = repo[tip_id]
+	if not isinstance(tip_obj, pygit2.Tag):
+		return obj, mr
+	mr_tip = try_merge_request_from_tag(repo, tip_obj)
+	if mr_tip is None:
+		return obj, mr
+	return tip_obj, mr_tip
+
+
+def merge_request_status_fields(repo: pygit2.Repository, mr: MergeRequest) -> dict[str, Any]:
+	try:
+		status = mr.check_status(repo)
+	except ValueError as exc:
+		return {
+			"status_code": "error",
+			"status_label": "Unable to analyze merge",
+			"status_detail": str(exc),
+			"show_merge_button": False,
+		}
+	label = _STATUS_LABELS.get(status, status.value)
+	return {
+		"status_code": status.value,
+		"status_label": label,
+		"status_detail": "",
+		"show_merge_button": status == MergeRequestStatus.CAN_FAST_FORWARD,
+	}
+
+
+def _head_view_url(project: str, repo: pygit2.Repository, head_hex: str) -> tuple[str, str]:
+	try:
+		oid = pygit2.Oid(hex=head_hex)
+		obj = repo[oid]
+	except (KeyError, ValueError, TypeError):
+		return head_hex[:7], ""
+	t = getattr(obj, "type_str", "") or ""
+	short = head_hex[:7]
+	if t == "commit":
+		return short, f"/project/{project}?a=commit&h={quote(head_hex, safe='')}"
+	if t == "tag":
+		return short, f"/project/{project}?a=tag&h={quote(head_hex, safe='')}"
+	return short, ""
+
+
+def merge_request_tag_response(
+	project: str,
+	repo: pygit2.Repository,
+	mr: MergeRequest,
+	tag_name: str,
+	tag_oid: str,
+	tagger: str,
+	tagger_date: str,
+) -> Response:
+	new_oid = mr.refresh_from_theirs(repo)
+	if new_oid is not None:
+		return RedirectResponse(
+			url=f"/project/{project}?a=tag&h={quote(str(new_oid), safe='')}",
+			status_code=302,
+		)
+
+	status_fields = merge_request_status_fields(repo, mr)
+	head_short, head_url = _head_view_url(project, repo, str(mr.target))
+	ours_ref = mr.ours
+	ours_url = f"/project/{project}?a=log&h={quote(ours_ref, safe='')}"
+	theirs_ref = mr.theirs or ""
+	theirs_url = f"/project/{project}?a=log&h={quote(theirs_ref, safe='')}" if mr.theirs else ""
+
+	comments_rows: list[tuple[str, str]] = []
+	for c in mr.comments:
+		ch = str(c)
+		comments_rows.append((ch[:7], f"/project/{project}?a=tag&h={quote(ch, safe='')}"))
+
+	current_tag_oid = str(repo.references[mr.name].resolve().target)
+
+	ctx = {
+		"project": project,
+		"project_url": f"/project/{project}",
+		"tag_name": tag_name,
+		"tag_oid": current_tag_oid,
+		"tag_view_url": f"/project/{project}?a=tag&h={quote(current_tag_oid, safe='')}",
+		"mr_title": mr.title,
+		"mr_description": mr.description or "",
+		"ours_ref": ours_ref,
+		"ours_url": ours_url,
+		"theirs_ref": theirs_ref,
+		"theirs_url": theirs_url,
+		"head_short": head_short,
+		"head_url": head_url,
+		"head_full": str(mr.target),
+		"tagger": tagger,
+		"tagger_date": tagger_date,
+		"opener": str(mr.opener),
+		"created_at": mr.created_at.isoformat() if mr.created_at else "",
+		"updated_at": mr.updated_at.isoformat() if mr.updated_at else "",
+		"comments": comments_rows,
+		"merge_action_url": f"/mr/ff?project={quote(project, safe='')}&h={quote(current_tag_oid, safe='')}",
+		**status_fields,
+	}
+	title = f"Merge request: {jinja_escape(mr.title) or ''} — {jinja_escape(project) or ''}"
+	pre = PREAMBLE.render(title=title, site_name=settings.SITE_NAME)
+	body = env.get_template("merge_request_tag.html").render(**ctx)
+	return HTMLResponse(f"{pre}{body}{POSTAMBLE}")
+
+
+@merge_router.post(
+	"/create",
+	dependencies=[Depends(require_permission(Permission.MR_CREATE, project_from_form=True))],
+)
+def merge_request_create(
+	project: ValidatedFormProject,
+	theirs: str = Form(...),
+	ours: str = Form(...),
+	title: str = Form(""),
+) -> RedirectResponse:
+	theirs_ref = theirs.strip()
+	ours_ref = ours.strip()
+	if not theirs_ref or not ours_ref:
+		raise HTTPException(status_code=400, detail="theirs and ours are required")
+	if not is_valid_ref_format(theirs_ref) or not is_valid_ref_format(ours_ref):
+		raise HTTPException(status_code=400, detail="Invalid ref format")
+	repo = open_repo(project)
+	try:
+		theirs_tip = repo.revparse_single(theirs_ref).peel(pygit2.Commit).id
+	except (KeyError, ValueError, pygit2.GitError) as exc:
+		raise HTTPException(status_code=404, detail=f"Cannot resolve theirs ref {theirs_ref!r}") from exc
+	try:
+		repo.revparse_single(ours_ref)
+	except (KeyError, ValueError, pygit2.GitError) as exc:
+		raise HTTPException(status_code=404, detail=f"Cannot resolve ours ref {ours_ref!r}") from exc
+	opener = repo.default_signature
+	t = title.strip()
+	if not t:
+		t = f"Merge {_branch_short_name(theirs_ref)} into {_branch_short_name(ours_ref)}"
+	mr = MergeRequest(
+		target=theirs_tip,
+		opener=opener,
+		ours=ours_ref,
+		theirs=theirs_ref,
+		title=t,
+		description="",
+	)
+	oid = mr.write(repo)
+	dest = f"/project/{project}?a=tag&h={quote(str(oid), safe='')}"
+	return RedirectResponse(url=dest, status_code=303)
+
+
+@merge_router.post(
+	"/ff",
+	dependencies=[Depends(require_permission(Permission.MR_MERGE, project_from_query=True))],
+)
+def merge_fast_forward(
+	project: ValidatedQueryProject,
+	h: str = Query(..., description="Annotated tag object id (hex)"),
+) -> RedirectResponse:
+	if not h or not is_valid_ref_format(h):
+		raise HTTPException(status_code=400, detail="Invalid tag hash (h)")
+	repo = open_repo(project)
+	try:
+		obj = repo.revparse_single(h)
+	except (KeyError, pygit2.GitError, OSError) as exc:
+		raise HTTPException(status_code=404, detail="Tag not found") from exc
+	if not isinstance(obj, pygit2.Tag):
+		raise HTTPException(status_code=400, detail="Not an annotated tag")
+	resolved = resolve_merge_request_tag_to_tip(repo, obj)
+	if resolved is None:
+		raise HTTPException(status_code=400, detail="Not a merge request tag")
+	obj, mr = resolved
+	mr.refresh_from_theirs(repo)
+	try:
+		mr.merge(repo)
+	except ValueError as exc:
+		raise HTTPException(status_code=400, detail=str(exc)) from exc
+	tag_oid = str(repo.references[mr.name].resolve().target)
+	dest = f"/project/{project}?a=tag&h={quote(tag_oid, safe='')}"
+	return RedirectResponse(url=dest, status_code=303)

pygitweb/merge_requests_test.py

@@ -0,0 +1,85 @@
+from __future__ import annotations
+
+from collections.abc import Generator
+from pathlib import Path
+from unittest.mock import patch
+
+import pygit2
+import pytest
+from fastapi.testclient import TestClient
+
+from pygittools.merge import MR_REF_PREFIX, MergeRequest
+from pygitweb.config import settings
+from pygitweb.main import app
+
+
+def _commit_chain(repo: pygit2.Repository) -> tuple[pygit2.Oid, pygit2.Oid]:
+	sig = pygit2.Signature("tester", "tester@example.com")
+	tb = repo.TreeBuilder()
+	tree = tb.write()
+	a = repo.create_commit(None, sig, sig, "a", tree, [])
+	repo.create_reference("refs/heads/main", a)
+	b = repo.create_commit(None, sig, sig, "b", tree, [a])
+	return a, b
+
+
+class TestMergeRequestTagView:
+	@pytest.fixture
+	def mr_env(self, tmp_path: Path) -> Generator[dict[str, str], None, None]:
+		root: Path = tmp_path / "merge-requests-web"
+		root.mkdir()
+		repo_dir: Path = root / "demo"
+		repo_dir.mkdir()
+		repo = pygit2.init_repository(str(repo_dir), bare=False)
+		_a, b = _commit_chain(repo)
+		mr = MergeRequest(
+			b,
+			repo.default_signature,
+			ours="refs/heads/main",
+			title="Feature MR",
+			description="Desc line",
+			name=f"{MR_REF_PREFIX}aaaabbbbccccdddd",
+		)
+		mr_oid = mr.write(repo)
+		projects_list: Path = root / "projects.list"
+		projects_list.write_text("demo tester\n", encoding="utf-8")
+		with (
+			patch.object(settings, "PROJECTROOT", str(root)),
+			patch.object(settings, "PROJECTS_LIST", str(projects_list)),
+			patch.object(settings, "STRICT_EXPORT", False),
+			patch.object(settings, "EXPORT_OK", ""),
+			patch.object(settings, "AUTH", False),
+		):
+			client = TestClient(app)
+			yield {
+				"client": client,
+				"project": "demo",
+				"mr_tag_oid": str(mr_oid),
+				"mr_ref": mr.name,
+				"tip_b": str(b),
+			}
+
+	def test_tag_action_renders_merge_request_template(self, mr_env: dict[str, str]) -> None:
+		client = mr_env["client"]
+		resp = client.get(
+			f"/project/{mr_env['project']}",
+			params={"a": "tag", "h": mr_env["mr_tag_oid"]},
+		)
+		assert resp.status_code == 200
+		text = resp.text
+		assert "Merge request" in text
+		assert "Feature MR" in text
+		assert "Desc line" in text
+		assert "Can fast-forward" in text
+		assert "refs/heads/main" in text
+
+	def test_merge_ff_updates_branch(self, mr_env: dict[str, str]) -> None:
+		client = mr_env["client"]
+		post = client.post(
+			"/mr/ff",
+			params={"project": mr_env["project"], "h": mr_env["mr_tag_oid"]},
+			follow_redirects=False,
+		)
+		assert post.status_code == 303
+		repo = pygit2.Repository(str(Path(settings.PROJECTROOT) / mr_env["project"]))
+		assert repo.references["refs/heads/main"].resolve().target == pygit2.Oid(hex=mr_env["tip_b"])

pygitweb/mr_permissions_test.py

@@ -0,0 +1,148 @@
+from __future__ import annotations
+
+from collections.abc import Generator
+from pathlib import Path
+from unittest.mock import patch
+
+import pygit2
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+
+from pygittools.merge import MR_REF_PREFIX, MergeRequest
+from pygitweb.auth_config import AuthConfig, LocalUser
+from pygitweb.config import settings
+from pygitweb.conftest import client_as_user
+from pygitweb.merge_requests import merge_router
+from pygitweb.permissions import Permission, PermissionsMap, permission_key
+
+
+def _commit_chain(repo: pygit2.Repository) -> tuple[pygit2.Oid, pygit2.Oid]:
+	sig = pygit2.Signature("tester", "tester@example.com")
+	tb = repo.TreeBuilder()
+	tree = tb.write()
+	a = repo.create_commit(None, sig, sig, "a", tree, [])
+	repo.create_reference("refs/heads/main", a)
+	b = repo.create_commit(None, sig, sig, "b", tree, [a])
+	return a, b
+
+
+_MR_AUTH = AuthConfig(
+	auth_mode="local",
+	local_users=[LocalUser(user="creator", password="secret"), LocalUser(user="merger", password="secret")],
+	oauth_permissions=PermissionsMap.model_validate({
+		"*": [],
+		permission_key(Permission.MR_CREATE, "demo"): ["creator"],
+		permission_key(Permission.MR_MERGE, "demo"): ["merger"],
+	}),
+)
+
+
+def _build_client() -> TestClient:
+	app = FastAPI()
+	app.include_router(merge_router, prefix="/mr")
+	return TestClient(app)
+
+
+@pytest.fixture
+def mr_env(tmp_path: Path) -> Generator[dict[str, str], None, None]:
+	root = tmp_path / "mr-perms"
+	root.mkdir()
+	repo_dir = root / "demo"
+	repo_dir.mkdir()
+	repo = pygit2.init_repository(str(repo_dir), bare=False)
+	_a, b = _commit_chain(repo)
+	mr = MergeRequest(
+		b,
+		repo.default_signature,
+		ours="refs/heads/main",
+		title="Feature MR",
+		name=f"{MR_REF_PREFIX}aaaabbbbccccdddd",
+	)
+	mr_oid = mr.write(repo)
+	projects_list = root / "projects.list"
+	projects_list.write_text("demo tester\n", encoding="utf-8")
+	with (
+		patch.object(settings, "PROJECTROOT", str(root)),
+		patch.object(settings, "PROJECTS_LIST", str(projects_list)),
+		patch.object(settings, "STRICT_EXPORT", False),
+		patch.object(settings, "EXPORT_OK", ""),
+		patch("pygitweb.auth_config.auth_config", _MR_AUTH),
+		patch("pygitweb.auth.auth_config", _MR_AUTH),
+	):
+		yield {
+			"client": _build_client(),
+			"project": "demo",
+			"mr_tag_oid": str(mr_oid),
+			"tip_b": str(b),
+		}
+
+
+def test_mr_ff_open_when_auth_disabled(mr_env: dict[str, str]) -> None:
+	client = mr_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", False):
+		r = client.post(
+			"/mr/ff",
+			params={"project": mr_env["project"], "h": mr_env["mr_tag_oid"]},
+			follow_redirects=False,
+		)
+	assert r.status_code == 303
+
+
+def test_mr_create_401_without_login(mr_env: dict[str, str]) -> None:
+	client = mr_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True):
+		r = client.post(
+			"/mr/create",
+			data={
+				"project": mr_env["project"],
+				"theirs": "refs/heads/main",
+				"ours": "refs/heads/main",
+				"title": "MR",
+			},
+			follow_redirects=False,
+		)
+	assert r.status_code == 401
+
+
+def test_mr_create_forbidden_without_create_grant(mr_env: dict[str, str]) -> None:
+	client = mr_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True), client_as_user(client, "merger"):
+		r = client.post(
+			"/mr/create",
+			data={
+				"project": mr_env["project"],
+				"theirs": "refs/heads/main",
+				"ours": "refs/heads/main",
+				"title": "MR",
+			},
+			follow_redirects=False,
+		)
+	assert r.status_code == 403
+
+
+def test_mr_ff_forbidden_without_merge_grant(mr_env: dict[str, str]) -> None:
+	client = mr_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True), client_as_user(client, "creator"):
+		r = client.post(
+			"/mr/ff",
+			params={"project": mr_env["project"], "h": mr_env["mr_tag_oid"]},
+			follow_redirects=False,
+		)
+	assert r.status_code == 403
+
+
+def test_mr_ff_allowed_with_merge_grant(mr_env: dict[str, str]) -> None:
+	client = mr_env["client"]
+	assert isinstance(client, TestClient)
+	with patch.object(settings, "AUTH", True), client_as_user(client, "merger"):
+		r = client.post(
+			"/mr/ff",
+			params={"project": mr_env["project"], "h": mr_env["mr_tag_oid"]},
+			follow_redirects=False,
+		)
+	assert r.status_code == 303

pygitweb/password_hash.py

@@ -0,0 +1,74 @@
+"""Password hashing with stdlib scrypt (Argon2id is not used)."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import secrets
+
+_SCRYPT_N = 2**17
+_SCRYPT_R = 8
+_SCRYPT_P = 1
+_SCRYPT_DKLEN = 64
+_SCRYPT_SALT_BYTES = 16
+_SCRYPT_MAXMEM = 128 * _SCRYPT_N * _SCRYPT_R * (_SCRYPT_P + 2)
+_ALGORITHM = "scrypt"
+
+
+def _password_material(password: str, config_salt: str) -> str:
+	if not config_salt:
+		return password
+	return f"{config_salt}:{password}"
+
+
+def _scrypt_key(password: str, *, salt: bytes, n: int, r: int, p: int, dklen: int) -> bytes:
+	return hashlib.scrypt(
+		password.encode("utf-8"),
+		salt=salt,
+		n=n,
+		r=r,
+		p=p,
+		maxmem=max(128 * n * r * (p + 2), _SCRYPT_MAXMEM),
+		dklen=dklen,
+	)
+
+
+def hash_password(password: str, *, config_salt: str = "") -> str:
+	material = _password_material(password, config_salt)
+	salt = secrets.token_bytes(_SCRYPT_SALT_BYTES)
+	key = _scrypt_key(material, salt=salt, n=_SCRYPT_N, r=_SCRYPT_R, p=_SCRYPT_P, dklen=_SCRYPT_DKLEN)
+	salt_b64 = base64.b64encode(salt).decode("ascii")
+	key_b64 = base64.b64encode(key).decode("ascii")
+	return f"{_ALGORITHM}${_SCRYPT_N}${_SCRYPT_R}${_SCRYPT_P}${salt_b64}${key_b64}"
+
+
+def verify_password(password: str, pass_hash: str, *, config_salt: str = "") -> bool:
+	if not pass_hash:
+		return False
+	if config_salt and _verify_password_material(_password_material(password, config_salt), pass_hash):
+		return True
+	return _verify_password_material(password, pass_hash)
+
+
+def _verify_password_material(material: str, pass_hash: str) -> bool:
+	if not pass_hash:
+		return False
+	parts = pass_hash.split("$")
+	if len(parts) != 6 or parts[0] != _ALGORITHM:
+		return False
+	try:
+		n = int(parts[1])
+		r = int(parts[2])
+		p = int(parts[3])
+		if n < _SCRYPT_N or r < _SCRYPT_R or p < _SCRYPT_P:
+			return False
+		salt = base64.b64decode(parts[4], validate=True)
+		expected = base64.b64decode(parts[5], validate=True)
+	except (ValueError, TypeError):
+		return False
+	try:
+		actual = _scrypt_key(material, salt=salt, n=n, r=r, p=p, dklen=len(expected))
+	except ValueError:
+		return False
+	return hmac.compare_digest(actual, expected)

pygitweb/password_hash_test.py

@@ -0,0 +1,20 @@
+from pygitweb.password_hash import hash_password, verify_password
+
+
+def test_hash_and_verify_roundtrip() -> None:
+	stored = hash_password("secret-password", config_salt="a1b2c3d4e5f67890")
+	assert stored.startswith("scrypt$131072$8$1$")
+	assert verify_password("secret-password", stored, config_salt="a1b2c3d4e5f67890")
+	assert not verify_password("wrong", stored, config_salt="a1b2c3d4e5f67890")
+
+
+def test_verify_legacy_hash_without_config_salt() -> None:
+	stored = hash_password("legacy")
+	assert verify_password("legacy", stored, config_salt="0123456789abcdef")
+
+
+def test_verify_rejects_weak_parameters() -> None:
+	stored = hash_password("x")
+	parts = stored.split("$")
+	parts[1] = "65536"
+	assert not verify_password("x", "$".join(parts))