pygitweb 0.1.0__tar.gz → 0.2.0__tar.gz

{pygitweb-0.1.0 → pygitweb-0.2.0}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.1.0
+Version: 0.2.0
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: pygittools>=0.1.0
+Requires-Dist: pygittools>=0.2.0
 Requires-Dist: fastapi[standard-no-fastapi-cloud-cli]>=0.104.0
 Requires-Dist: uvicorn[standard]>=0.24.0
 Requires-Dist: python-multipart>=0.0.6
@@ -22,32 +22,6 @@ Dynamic: license-file
 
 Gitweb reimplementation using **Python**, **FastAPI**, and **Pygit2**, ported from `git/gitweb/gitweb.perl`.
 
-## Setup
-
-```bash
-uv sync --package pygitweb
-```
-
-Or install everything in the workspace (all members + dev tools):
-
-```bash
-uv sync --all-packages --group dev
-```
-
-## Run
-
-From the repository root (after `uv sync`), with the workspace `.venv` activated:
-
-```bash
-uvicorn pygitweb.main:app --reload --host 0.0.0.0 --port 8000
-```
-
-Or:
-
-```bash
-python -m pygitweb.main
-```
-
 ## Config
 
 Settings load from `~/.pygitweb/settings.json` (or `PYGITWEB_SETTINGS_CONFIG`), `PYGITWEB_*`

{pygitweb-0.1.0 → pygitweb-0.2.0}/README.md

@@ -2,32 +2,6 @@
 
 Gitweb reimplementation using **Python**, **FastAPI**, and **Pygit2**, ported from `git/gitweb/gitweb.perl`.
 
-## Setup
-
-```bash
-uv sync --package pygitweb
-```
-
-Or install everything in the workspace (all members + dev tools):
-
-```bash
-uv sync --all-packages --group dev
-```
-
-## Run
-
-From the repository root (after `uv sync`), with the workspace `.venv` activated:
-
-```bash
-uvicorn pygitweb.main:app --reload --host 0.0.0.0 --port 8000
-```
-
-Or:
-
-```bash
-python -m pygitweb.main
-```
-
 ## Config
 
 Settings load from `~/.pygitweb/settings.json` (or `PYGITWEB_SETTINGS_CONFIG`), `PYGITWEB_*`

{pygitweb-0.1.0 → pygitweb-0.2.0}/__meta__.py

@@ -2,7 +2,7 @@
 Metadata for PyGitWeb - this is the canonical source of all information below.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 __author__ = "Will Bowers"
 __license__ = "MIT"
 __description__ = "FastAPI + Pygit2 Repo Browser"

{pygitweb-0.1.0 → pygitweb-0.2.0}/actions.py

@@ -1057,7 +1057,7 @@ def git_tags(project: str, request: Request, page: int, pagecount: int) -> HTMLR
 	)
 
 
-def git_tag(project: str, h: str | None) -> HTMLResponse:
+def git_tag(project: str, h: str | None, notice: str | None = None) -> HTMLResponse:
 	"""Single tag view. Port of git_tag."""
 	if not h:
 		raise HTTPException(status_code=400, detail="Tag ref or hash (h) required")
@@ -1101,6 +1101,7 @@ def git_tag(project: str, h: str | None) -> HTMLResponse:
 			tag_oid=tag_oid,
 			tagger=tagger,
 			tagger_date=_format_date(tagger_epoch, tagger_tz),
+			notice=notice,
 		)
 	target_short = target_oid[:7] if target_oid else ""
 	if target_type == "commit":

{pygitweb-0.1.0 → pygitweb-0.2.0}/addproject_permissions_test.py

@@ -6,13 +6,12 @@ from fastapi.testclient import TestClient
 
 from pygitweb.auth_config import AuthConfig, LocalUser
 from pygitweb.main import app
-from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
+from pygitweb.permissions import PERMISSION_ADD_PROJECTS, permissions_with_defaults
 
 _ADDPROJECTS_AUTH = AuthConfig(
 	auth_mode="local",
 	local_users=[LocalUser(user="admin", password="secret"), LocalUser(user="viewer", password="secret")],
-	oauth_permissions=PermissionsMap.model_validate({
-		"*": [],
+	oauth_permissions=permissions_with_defaults({
 		PERMISSION_ADD_PROJECTS: ["admin"],
 	}),
 )

{pygitweb-0.1.0 → pygitweb-0.2.0}/auth.py

@@ -33,6 +33,7 @@ from pygitweb.config import settings
 from pygitweb.gravatar import gravatar_url
 from pygitweb.password_hash import verify_password
 from pygitweb.permissions import Permission, PermissionPrincipal
+from pygitweb.projects import git_get_project_owner
 from pygitweb.sessions import create_session, get_session, revoke_session
 from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env
 
@@ -78,6 +79,72 @@ def has_permission(
 	return auth_config.oauth_permissions.has_permission(principal.identity, permission, project)
 
 
+def _owner_matches(project: str, token: str | None) -> bool:
+	if not settings.AUTH or not token:
+		return False
+	principal = principal_from_session(token)
+	if principal is None:
+		return False
+	owner = git_get_project_owner(project)
+	if not owner or not owner.strip():
+		return False
+	owner_norm = owner.strip()
+	identity = principal.identity
+	if hmac.compare_digest(owner_norm, identity):
+		return True
+	return owner_norm.lower() == identity.lower()
+
+
+def can_read_project(project: str, token: str | None) -> bool:
+	if not settings.AUTH:
+		return True
+	if _owner_matches(project, token):
+		return True
+	return has_permission(Permission.READ, project, token=token)
+
+
+def can_write_project(project: str, token: str | None) -> bool:
+	if not settings.AUTH:
+		return True
+	if _owner_matches(project, token):
+		return True
+	return has_permission(Permission.WRITE, project, token=token)
+
+
+def ensure_read_project(project: str, token: str | None) -> None:
+	if can_read_project(project, token):
+		return
+	raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="No such project")
+
+
+def ensure_write_project(project: str, token: str | None) -> None:
+	if not settings.AUTH:
+		return
+	if not is_auth_configured(auth_config):
+		raise HTTPException(
+			status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+			detail="Authentication enabled but auth.json is not configured",
+		)
+	if not token:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+	if decode_access_token(token) is None:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+	if can_write_project(project, token):
+		return
+	raise HTTPException(
+		status_code=status.HTTP_403_FORBIDDEN,
+		detail="Insufficient permissions",
+	)
+
+
 def ensure_permission(
 	permission: Permission,
 	project: str | None = None,
@@ -85,6 +152,8 @@ def ensure_permission(
 	token: str | None,
 ) -> None:
 	ensure_active_user_if_auth_enabled(token)
+	if project is not None:
+		ensure_read_project(project, token)
 	if has_permission(permission, project, token=token):
 		return
 	raise HTTPException(

{pygitweb-0.1.0 → pygitweb-0.2.0}/auth.schema.json

@@ -60,7 +60,7 @@
         "additionalProperties": {
           "type": "array",
           "items": { "type": "string" },
-          "description": "Scoped keys: pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project path)"
+          "description": "Scoped keys: pgw.read.{scope}, pgw.write.{scope}, pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project path). Principal * matches any authenticated user."
         }
       },
       "local_users": {

{pygitweb-0.1.0 → pygitweb-0.2.0}/auth_config.py

@@ -134,7 +134,7 @@ def default_auth_config(*, admin_password: str, salt: str) -> AuthConfig:
 		oauth_redirect_uri="",
 		oauth_username_from="email",
 		oauth_allowed_emails=[],
-		oauth_permissions=PermissionsMap.empty(),
+		oauth_permissions=PermissionsMap.default_access(),
 		local_users=[LocalUser(user="admin", pass_hash=hash_password(admin_password, config_salt=salt))],
 	)
 

{pygitweb-0.1.0 → pygitweb-0.2.0}/auth_test.py

@@ -319,17 +319,17 @@ def test_oauth_callback_creates_session(client: TestClient, oauth_auth_config: A
 			params={"code": "auth-code", "state": "idp-state"},
 			follow_redirects=False,
 		)
-	assert r.status_code == 303
-	rec = get_session(r.cookies["pygitweb_access_token"])
-	assert rec is not None
-	assert rec.username == "user@example.com"
-	assert rec.subject == "oauth-sub-1"
-	assert rec.email == "user@example.com"
-	assert rec.auth_method == "oauth"
-	assert client.get("/users/me").json()["username"] == "user@example.com"
-	status = client.get("/auth/status").json()
-	assert status["username"] == "user@example.com"
-	assert status["gravatar_url"] == gravatar_url("user@example.com")
+		assert r.status_code == 303
+		rec = get_session(r.cookies["pygitweb_access_token"])
+		assert rec is not None
+		assert rec.username == "user@example.com"
+		assert rec.subject == "oauth-sub-1"
+		assert rec.email == "user@example.com"
+		assert rec.auth_method == "oauth"
+		assert client.get("/users/me").json()["username"] == "user@example.com"
+		status = client.get("/auth/status").json()
+		assert status["username"] == "user@example.com"
+		assert status["gravatar_url"] == gravatar_url("user@example.com")
 	clear_client_cookies(client)
 
 

pygitweb-0.2.0/board_refs.py

@@ -0,0 +1,154 @@
+"""Client-side reference manifest for board task @ / # lookups."""
+
+from __future__ import annotations
+
+import os
+from datetime import UTC, datetime, timedelta, timezone
+from typing import TypedDict
+from urllib.parse import quote
+
+from pygit2 import Oid, Repository, Tag
+
+from pygittools.merge import MR_REF_PREFIX, get_merge_request_by_oid
+from pygitweb.config import settings
+from pygitweb.git_helpers import get_commit_history
+from pygitweb.tasks import TASK_REF_PREFIX, get_board_tasks_grouped
+
+BOARD_REF_MANIFEST_COMMIT_LIMIT = 100
+
+
+class BoardRefManifestEntry(TypedDict):
+	name: str
+	insert: str
+	url: str
+	tags: str
+	snippet: str
+	created: str
+
+
+class BoardRefManifest(TypedDict):
+	commits: list[BoardRefManifestEntry]
+	refs: list[BoardRefManifestEntry]
+
+
+def _format_epoch(epoch: int | None, tz_offset: int | None = None) -> str:
+	if epoch is None:
+		return ""
+	try:
+		tz = timezone(timedelta(seconds=tz_offset * 60)) if tz_offset is not None else UTC
+		return datetime.fromtimestamp(epoch, tz=tz).strftime("%Y-%m-%d %H:%M:%S")
+	except (ValueError, OSError):
+		return ""
+
+
+def _project_url(project: str) -> str:
+	return f"/project/{quote(project, safe='/')}"
+
+
+def _board_task_url(project: str, board_name: str, task_ref: str) -> str:
+	base = f"{_project_url(project)}/board/"
+	qs = f"b={quote(board_name, safe='')}&task={quote(task_ref, safe='')}"
+	return f"{base}?{qs}" if board_name != "Tasks" else f"{base}?task={quote(task_ref, safe='')}"
+
+
+def _task_display_id(ref: str) -> str:
+	slug = ref.removeprefix(TASK_REF_PREFIX)
+	if slug.startswith("task_"):
+		return slug.removeprefix("task_")
+	return slug
+
+
+def _manifest_commits(project: str) -> list[BoardRefManifestEntry]:
+	project_url = _project_url(project)
+	entries: list[BoardRefManifestEntry] = []
+	for commit in get_commit_history(project, ref=None, max_count=BOARD_REF_MANIFEST_COMMIT_LIMIT):
+		oid = str(commit.get("oid") or "")
+		if not oid:
+			continue
+		short = oid[:7]
+		subject = str(commit.get("subject") or "")
+		author = str(commit.get("author") or "")
+		created = _format_epoch(commit.get("author_epoch"), commit.get("author_tz"))
+		search_tags = " ".join(part.lower() for part in (oid, short, subject, author) if part)
+		entries.append({
+			"name": f"{short} {subject}".strip(),
+			"insert": short,
+			"url": f"{project_url}?a=commit&h={quote(oid, safe='')}",
+			"tags": search_tags,
+			"snippet": author,
+			"created": created,
+		})
+	return entries
+
+
+def _manifest_board_tasks(project: str, board_name: str) -> list[BoardRefManifestEntry]:
+	entries: list[BoardRefManifestEntry] = []
+	seen_refs: set[str] = set()
+	try:
+		columns = get_board_tasks_grouped(project, board_name)
+	except KeyError:
+		return entries
+	for column in columns:
+		for task in column["tasks"]:
+			task_ref = str(task.get("ref") or "")
+			if not task_ref or task_ref in seen_refs:
+				continue
+			seen_refs.add(task_ref)
+			task_id = str(task.get("id") or _task_display_id(task_ref))
+			title = str(task.get("title") or "Untitled")
+			slug = task_ref.removeprefix("refs/tags/")
+			created = str(task.get("updated_at") or task.get("created_at") or "")
+			search_tags = " ".join(
+				part.lower() for part in (task_id, slug, task_ref, title, str(task.get("status") or "")) if part
+			)
+			entries.append({
+				"name": title,
+				"insert": task_id,
+				"url": _board_task_url(project, board_name, task_ref),
+				"tags": search_tags,
+				"snippet": f"task {task_id}",
+				"created": created,
+			})
+	return entries
+
+
+def _manifest_merge_requests(project: str) -> list[BoardRefManifestEntry]:
+	project_url = _project_url(project)
+	repo = Repository(os.path.join(settings.PROJECTROOT, project))
+	entries: list[BoardRefManifestEntry] = []
+	for ref_name in repo.references:
+		if not ref_name.startswith(MR_REF_PREFIX):
+			continue
+		try:
+			oid = repo.references[ref_name].resolve().target
+			obj = repo[oid]
+			if not isinstance(obj, Tag):
+				continue
+			mr = get_merge_request_by_oid(repo, Oid(hex=str(oid)))
+		except (ValueError, KeyError, TypeError):
+			continue
+		slug = ref_name.removeprefix(MR_REF_PREFIX)
+		title = mr.title or slug
+		created = mr.updated_at.isoformat() if mr.updated_at else ""
+		search_tags = " ".join(
+			part.lower() for part in (slug, ref_name, title, mr.description or "", mr.ours or "") if part
+		)
+		entries.append({
+			"name": title,
+			"insert": slug,
+			"url": f"{project_url}?a=tag&h={quote(ref_name, safe='')}",
+			"tags": search_tags,
+			"snippet": f"merge request {slug}",
+			"created": created,
+		})
+	return entries
+
+
+def board_ref_manifest(project: str, board_name: str) -> BoardRefManifest:
+	refs = _manifest_board_tasks(project, board_name)
+	refs.extend(_manifest_merge_requests(project))
+	refs.sort(key=lambda entry: (entry["created"], entry["name"]), reverse=True)
+	return {
+		"commits": _manifest_commits(project),
+		"refs": refs,
+	}

pygitweb-0.2.0/board_refs_test.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+from fastapi.testclient import TestClient
+from pygit2 import Oid, Signature, init_repository
+
+from pygittools.merge import MR_REF_PREFIX, MergeRequest
+from pygittools.tasks import BOARD_REF_PREFIX, EMPTY_TREE_OID_HEX, TASK_REF_PREFIX, Board, Task
+from pygitweb.board_refs import board_ref_manifest
+from pygitweb.config import settings
+from pygitweb.main import app
+
+EMPTY_TREE_OID = Oid(hex=EMPTY_TREE_OID_HEX)
+SIG = Signature("tester", "tester@example.com")
+
+
+@pytest.fixture
+def manifest_env(tmp_path: Path) -> dict[str, str | TestClient]:
+	root = tmp_path / "manifest"
+	repo_dir = root / "demo"
+	repo_dir.mkdir(parents=True)
+	repo = init_repository(str(repo_dir), bare=False)
+
+	index = repo.index
+	(repo_dir / "README").write_text("hello\n", encoding="utf-8")
+	index.add("README")
+	index.write()
+	tree = index.write_tree()
+	first = repo.create_commit("refs/heads/main", SIG, SIG, "Initial commit", tree, [])
+	second_tree = index.write_tree()
+	second = repo.create_commit("refs/heads/main", SIG, SIG, "Second commit", second_tree, [first])
+	repo.set_head(second)
+
+	board_ref = f"{BOARD_REF_PREFIX}Tasks"
+	board = Board(EMPTY_TREE_OID, board_ref, tagger="", description="Main")
+	task_ref = f"{TASK_REF_PREFIX}task_1782144988054"
+	task = Task(
+		EMPTY_TREE_OID,
+		task_ref,
+		tagger="",
+		title="Ref lookup task",
+		description="See @8054",
+		status=Task.Status.TODO,
+	)
+	task_oid = task.write(repo)
+	board.tasks = [str(task_oid)]
+	board.update_message()
+	board.write(repo)
+
+	mr_ref = f"{MR_REF_PREFIX}aaaabbbbccccdddd"
+	mr = MergeRequest(
+		target=second,
+		opener=SIG,
+		ours="refs/heads/main",
+		title="Test MR",
+		description="Merge me",
+		name=mr_ref,
+	)
+	mr.write(repo)
+
+	with (
+		patch.object(settings, "PROJECTROOT", str(root)),
+		patch.object(settings, "PROJECTS_LIST", str(root)),
+		patch.object(settings, "STRICT_EXPORT", False),
+		patch.object(settings, "EXPORT_OK", ""),
+		patch.object(settings, "AUTH", False),
+	):
+		yield {"client": TestClient(app), "project": "demo", "task_ref": task_ref, "mr_ref": mr_ref}
+
+
+def test_board_ref_manifest_includes_commits_tasks_and_merge_requests(
+	manifest_env: dict[str, str | TestClient],
+) -> None:
+	manifest = board_ref_manifest(str(manifest_env["project"]), "Tasks")
+
+	assert len(manifest["commits"]) == 2
+	assert "Second commit" in manifest["commits"][0]["name"]
+	assert manifest["commits"][0]["insert"] == manifest["commits"][0]["name"].split()[0]
+
+	task_entries = [entry for entry in manifest["refs"] if "1782144988054" in entry["tags"]]
+	assert len(task_entries) == 1
+	assert task_entries[0]["insert"] == "1782144988054"
+	assert task_entries[0]["name"] == "Ref lookup task"
+	assert "task=refs" in task_entries[0]["url"]
+	assert "task_1782144988054" in task_entries[0]["url"]
+
+	mr_entries = [entry for entry in manifest["refs"] if entry["insert"] == "aaaabbbbccccdddd"]
+	assert len(mr_entries) == 1
+	assert mr_entries[0]["name"] == "Test MR"
+	assert "a=tag" in mr_entries[0]["url"]
+
+
+def test_board_ref_manifest_route(manifest_env: dict[str, str | TestClient]) -> None:
+	client = manifest_env["client"]
+	assert isinstance(client, TestClient)
+	resp = client.get(
+		f"/project/{manifest_env['project']}/board-ref-manifest",
+		params={"b": "Tasks"},
+	)
+	assert resp.status_code == 200
+	body = resp.json()
+	assert len(body["commits"]) == 2
+	assert any(entry["insert"] == "1782144988054" for entry in body["refs"])

{pygitweb-0.1.0 → pygitweb-0.2.0}/boards_permissions_test.py

@@ -12,14 +12,14 @@ from fastapi.testclient import TestClient
 from pygitweb.auth_config import AuthConfig, LocalUser
 from pygitweb.config import settings
 from pygitweb.conftest import client_as_user
-from pygitweb.permissions import Permission, PermissionsMap, permission_key
+from pygitweb.main import app
+from pygitweb.permissions import Permission, permission_key, permissions_with_defaults
 from pygitweb.tasks import board_router
 
 _BOARDS_AUTH = AuthConfig(
 	auth_mode="local",
 	local_users=[LocalUser(user="admin", password="secret"), LocalUser(user="viewer", password="secret")],
-	oauth_permissions=PermissionsMap.model_validate({
-		"*": [],
+	oauth_permissions=permissions_with_defaults({
 		permission_key(Permission.BOARDS, "demo"): ["admin"],
 	}),
 )
@@ -102,6 +102,36 @@ def test_board_create_forbidden_without_grant(board_env: dict[str, str | TestCli
 	assert r.status_code == 403
 
 
+def test_board_create_get_forbidden_without_grant(board_env: dict[str, str | TestClient]) -> None:
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.main.auth_config", _BOARDS_AUTH),
+	):
+		client = TestClient(app)
+		with client_as_user(client, "viewer"):
+			r = client.get(
+				"/board/create",
+				params={"project": board_env["project"]},
+				follow_redirects=False,
+			)
+	assert r.status_code == 403
+
+
+def test_board_create_get_allowed_with_grant(board_env: dict[str, str | TestClient]) -> None:
+	with (
+		patch.object(settings, "AUTH", True),
+		patch("pygitweb.main.auth_config", _BOARDS_AUTH),
+	):
+		client = TestClient(app)
+		with client_as_user(client, "admin"):
+			r = client.get(
+				"/board/create",
+				params={"project": board_env["project"]},
+				follow_redirects=False,
+			)
+	assert r.status_code == 303
+
+
 def test_board_delete_forbidden_without_grant(board_env: dict[str, str | TestClient]) -> None:
 	client = board_env["client"]
 	assert isinstance(client, TestClient)

{pygitweb-0.1.0 → pygitweb-0.2.0}/change_queue_routes_test.py

@@ -12,6 +12,7 @@ from httpx import ASGITransport
 
 from pygitweb.change_queue import CHANGE_QUEUE
 from pygitweb.config import settings
+from pygitweb.dependencies import is_loopback_host
 from pygitweb.main import app
 
 
@@ -144,3 +145,24 @@ class TestUpdatesLongPoll:
 				return resp.status_code
 
 		assert asyncio.run(scenario()) == 404
+
+	def test_notify_rejects_non_loopback_client(self, updates_env: dict[str, str]) -> None:
+		del updates_env
+
+		async def scenario() -> int:
+			transport = ASGITransport(app=app, client=("203.0.113.1", 999))
+			async with httpx.AsyncClient(transport=transport, base_url="http://test") as client:
+				resp = await client.post("/_internal/notify", params={"project": "alpha"})
+				return resp.status_code
+
+		assert asyncio.run(scenario()) == 403
+
+
+class TestLoopbackHost:
+	def test_is_loopback_host(self) -> None:
+		assert is_loopback_host("127.0.0.1")
+		assert is_loopback_host("::1")
+		assert is_loopback_host("localhost")
+		assert not is_loopback_host("203.0.113.1")
+		assert not is_loopback_host(None)
+		assert not is_loopback_host("")