pygitweb 0.1.0__tar.gz → 0.2.1__tar.gz

{pygitweb-0.1.0 → pygitweb-0.2.1}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: pygitweb
-Version: 0.1.0
+Version: 0.2.1
 Summary: Gitweb reimplementation with FastAPI and Pygit2
 License-Expression: MIT
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: pygittools>=0.1.0
+Requires-Dist: pygittools>=0.2.0
 Requires-Dist: fastapi[standard-no-fastapi-cloud-cli]>=0.104.0
 Requires-Dist: uvicorn[standard]>=0.24.0
 Requires-Dist: python-multipart>=0.0.6
@@ -22,32 +22,6 @@ Dynamic: license-file
 
 Gitweb reimplementation using **Python**, **FastAPI**, and **Pygit2**, ported from `git/gitweb/gitweb.perl`.
 
-## Setup
-
-```bash
-uv sync --package pygitweb
-```
-
-Or install everything in the workspace (all members + dev tools):
-
-```bash
-uv sync --all-packages --group dev
-```
-
-## Run
-
-From the repository root (after `uv sync`), with the workspace `.venv` activated:
-
-```bash
-uvicorn pygitweb.main:app --reload --host 0.0.0.0 --port 8000
-```
-
-Or:
-
-```bash
-python -m pygitweb.main
-```
-
 ## Config
 
 Settings load from `~/.pygitweb/settings.json` (or `PYGITWEB_SETTINGS_CONFIG`), `PYGITWEB_*`
@@ -66,7 +40,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -94,8 +68,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -146,16 +120,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.1.0 → pygitweb-0.2.1}/README.md

@@ -2,32 +2,6 @@
 
 Gitweb reimplementation using **Python**, **FastAPI**, and **Pygit2**, ported from `git/gitweb/gitweb.perl`.
 
-## Setup
-
-```bash
-uv sync --package pygitweb
-```
-
-Or install everything in the workspace (all members + dev tools):
-
-```bash
-uv sync --all-packages --group dev
-```
-
-## Run
-
-From the repository root (after `uv sync`), with the workspace `.venv` activated:
-
-```bash
-uvicorn pygitweb.main:app --reload --host 0.0.0.0 --port 8000
-```
-
-Or:
-
-```bash
-python -m pygitweb.main
-```
-
 ## Config
 
 Settings load from `~/.pygitweb/settings.json` (or `PYGITWEB_SETTINGS_CONFIG`), `PYGITWEB_*`
@@ -46,7 +20,7 @@ environment variables, and optionally a `.env` file in the working directory via
 
 ## Routes
 
-Load the `/docs` page for a detailed view of routes (below the readme) if in debug mode. 
+Load the `/docs` page for a detailed view of routes (below the readme). 
 
 **No-project routes**
 
@@ -74,8 +48,8 @@ Load the `/docs` page for a detailed view of routes (below the readme) if in deb
 | heads | `updates`, `pf` | `GET /project/{project}?a=heads` | List branch heads. Supports long-poll subscribe. |
 | tags | `updates`, `pf` | `GET /project/{project}?a=tags` | List all tags. Supports long-poll subscribe. |
 | tag | `h` | `GET /project/{project}?a=tag&h=...` | Single tag view (tag ref or hash). |
-| commit | — | `GET /project/{project}?a=commit` | Commit information. |
-| commitdiff | — | `GET /project/{project}?a=commitdiff` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
+| commit | `h` | `GET /project/{project}?a=commit&h=...` | Commit information. |
+| commitdiff | `h` | `GET /project/{project}?a=commitdiff&h=...` | Commit diff (unified diff rendered with [diff2html](https://github.com/rtfpessoa/diff2html)). |
 | patch | `h` | `GET /project/{project}?a=patch&h=...` | Single-commit patch (plain text). |
 | patches | `h`, `hb` | `GET /project/{project}?a=patches&h=...&hb=...` | Multi-commit patches for range `hb..h` (plain text). |
 | blobdiff | `h`, `hb`, `f`, `fp` | `GET /project/{project}?a=blobdiff&h=...&hb=...&f=...&fp=...` | Blob diff (two versions of a file) rendered with diff2html. |
@@ -126,16 +100,16 @@ subscribe to the project's change queue. The request is held for up to 30 second
   just the URL project (the action is still rendered for the URL project).
 
 The notify endpoint is intended for loopback use by `pygittools` post-receive hooks (see
-`pygittools/hook_samples/post-receive.notify`); production deployments should restrict it
-at the reverse proxy.
+`pygittools/hook_samples/post-receive.notify`). The server enforces loopback-only access and
+rejects unknown projects; production deployments should still restrict it at the reverse proxy.
 
 ## Hook management
 
-The project summary page exposes an **Update Hook** row that installs / removes the
-`update` bundle: `post-receive.notify` (feeds the change queue when refs are pushed) and
-`post-commit.notify` (feeds the change queue when a working clone of this repo records
-a local commit). Either is sufficient to wake long-poll subscribers; installing both
-covers server-side and client-side commit paths.
+The project summary page exposes a **Hooks** row that lists installed hooks and lets you
+install or remove pygittools samples, including the `update` bundle: `post-receive.notify`
+(feeds the change queue when refs are pushed) and `post-commit.notify` (feeds the change
+queue when a working clone of this repo records a local commit). Either is sufficient to
+wake long-poll subscribers; installing both covers server-side and client-side commit paths.
 
 The same operations are available programmatically via
 `POST /project/{name}/hook?name=<sample-or-bundle>&op=<...>`. Bundle status is

{pygitweb-0.1.0 → pygitweb-0.2.1}/__meta__.py

@@ -2,7 +2,7 @@
 Metadata for PyGitWeb - this is the canonical source of all information below.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 __author__ = "Will Bowers"
 __license__ = "MIT"
 __description__ = "FastAPI + Pygit2 Repo Browser"

{pygitweb-0.1.0 → pygitweb-0.2.1}/actions.py

@@ -1057,7 +1057,7 @@ def git_tags(project: str, request: Request, page: int, pagecount: int) -> HTMLR
 	)
 
 
-def git_tag(project: str, h: str | None) -> HTMLResponse:
+def git_tag(project: str, h: str | None, notice: str | None = None) -> HTMLResponse:
 	"""Single tag view. Port of git_tag."""
 	if not h:
 		raise HTTPException(status_code=400, detail="Tag ref or hash (h) required")
@@ -1101,6 +1101,7 @@ def git_tag(project: str, h: str | None) -> HTMLResponse:
 			tag_oid=tag_oid,
 			tagger=tagger,
 			tagger_date=_format_date(tagger_epoch, tagger_tz),
+			notice=notice,
 		)
 	target_short = target_oid[:7] if target_oid else ""
 	if target_type == "commit":

{pygitweb-0.1.0 → pygitweb-0.2.1}/addproject_permissions_test.py

@@ -6,13 +6,12 @@ from fastapi.testclient import TestClient
 
 from pygitweb.auth_config import AuthConfig, LocalUser
 from pygitweb.main import app
-from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
+from pygitweb.permissions import PERMISSION_ADD_PROJECTS, permissions_with_defaults
 
 _ADDPROJECTS_AUTH = AuthConfig(
 	auth_mode="local",
 	local_users=[LocalUser(user="admin", password="secret"), LocalUser(user="viewer", password="secret")],
-	oauth_permissions=PermissionsMap.model_validate({
-		"*": [],
+	oauth_permissions=permissions_with_defaults({
 		PERMISSION_ADD_PROJECTS: ["admin"],
 	}),
 )

{pygitweb-0.1.0 → pygitweb-0.2.1}/auth.py

@@ -33,6 +33,7 @@ from pygitweb.config import settings
 from pygitweb.gravatar import gravatar_url
 from pygitweb.password_hash import verify_password
 from pygitweb.permissions import Permission, PermissionPrincipal
+from pygitweb.projects import git_get_project_owner
 from pygitweb.sessions import create_session, get_session, revoke_session
 from pygitweb.templates_env import POSTAMBLE, PREAMBLE, env
 
@@ -78,6 +79,72 @@ def has_permission(
 	return auth_config.oauth_permissions.has_permission(principal.identity, permission, project)
 
 
+def _owner_matches(project: str, token: str | None) -> bool:
+	if not settings.AUTH or not token:
+		return False
+	principal = principal_from_session(token)
+	if principal is None:
+		return False
+	owner = git_get_project_owner(project)
+	if not owner or not owner.strip():
+		return False
+	owner_norm = owner.strip()
+	identity = principal.identity
+	if hmac.compare_digest(owner_norm, identity):
+		return True
+	return owner_norm.lower() == identity.lower()
+
+
+def can_read_project(project: str, token: str | None) -> bool:
+	if not settings.AUTH:
+		return True
+	if _owner_matches(project, token):
+		return True
+	return has_permission(Permission.READ, project, token=token)
+
+
+def can_write_project(project: str, token: str | None) -> bool:
+	if not settings.AUTH:
+		return True
+	if _owner_matches(project, token):
+		return True
+	return has_permission(Permission.WRITE, project, token=token)
+
+
+def ensure_read_project(project: str, token: str | None) -> None:
+	if can_read_project(project, token):
+		return
+	raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="No such project")
+
+
+def ensure_write_project(project: str, token: str | None) -> None:
+	if not settings.AUTH:
+		return
+	if not is_auth_configured(auth_config):
+		raise HTTPException(
+			status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
+			detail="Authentication enabled but auth.json is not configured",
+		)
+	if not token:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+	if decode_access_token(token) is None:
+		raise HTTPException(
+			status_code=status.HTTP_401_UNAUTHORIZED,
+			detail="Not authenticated",
+			headers={"WWW-Authenticate": "Bearer"},
+		)
+	if can_write_project(project, token):
+		return
+	raise HTTPException(
+		status_code=status.HTTP_403_FORBIDDEN,
+		detail="Insufficient permissions",
+	)
+
+
 def ensure_permission(
 	permission: Permission,
 	project: str | None = None,
@@ -85,6 +152,8 @@ def ensure_permission(
 	token: str | None,
 ) -> None:
 	ensure_active_user_if_auth_enabled(token)
+	if project is not None:
+		ensure_read_project(project, token)
 	if has_permission(permission, project, token=token):
 		return
 	raise HTTPException(

{pygitweb-0.1.0 → pygitweb-0.2.1}/auth.schema.json

@@ -60,7 +60,7 @@
         "additionalProperties": {
           "type": "array",
           "items": { "type": "string" },
-          "description": "Scoped keys: pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project path)"
+          "description": "Scoped keys: pgw.read.{scope}, pgw.write.{scope}, pgw.boards.{scope}, pgw.tasks.{scope}, pgw.comments.{scope}, pgw.hooks.{scope}, pgw.mr.create.{scope}, pgw.mr.merge.{scope} (fnmatch on project path). Principal * matches any authenticated user."
         }
       },
       "local_users": {

{pygitweb-0.1.0 → pygitweb-0.2.1}/auth_config.py

@@ -134,7 +134,7 @@ def default_auth_config(*, admin_password: str, salt: str) -> AuthConfig:
 		oauth_redirect_uri="",
 		oauth_username_from="email",
 		oauth_allowed_emails=[],
-		oauth_permissions=PermissionsMap.empty(),
+		oauth_permissions=PermissionsMap.default_access(),
 		local_users=[LocalUser(user="admin", pass_hash=hash_password(admin_password, config_salt=salt))],
 	)
 

{pygitweb-0.1.0 → pygitweb-0.2.1}/auth_test.py

@@ -1,3 +1,4 @@
+import asyncio
 import json
 import os
 import sys
@@ -6,11 +7,20 @@ from pathlib import Path
 from unittest.mock import AsyncMock, patch
 
 import pytest
+from fastapi import HTTPException
 from fastapi.testclient import TestClient
 
 from pygitweb.auth import ACCESS_TOKEN_COOKIE_NAME
 from pygitweb.auth_config import AuthConfig, LocalUser, init_auth_config, write_auth_config
-from pygitweb.auth_oauth import OAUTH_STATE_COOKIE_NAME, _seal_oauth_state, is_oauth_email_allowed
+from pygitweb.auth_oauth import (
+	OAUTH_STATE_COOKIE_NAME,
+	_exchange_code,
+	_fetch_github_profile,
+	_fetch_google_profile,
+	_fetch_profile,
+	_seal_oauth_state,
+	is_oauth_email_allowed,
+)
 from pygitweb.config import Settings, settings
 from pygitweb.conftest import clear_client_cookies
 from pygitweb.gravatar import gravatar_url
@@ -19,6 +29,19 @@ from pygitweb.password_hash import hash_password, verify_password
 from pygitweb.permissions import PERMISSION_ADD_PROJECTS, PermissionsMap
 from pygitweb.sessions import get_session
 
+
+class _DummyResponse:
+	def __init__(self, payload: object, is_success: bool = True) -> None:
+		self._payload = payload
+		self.is_success = is_success
+
+	def raise_for_status(self) -> None:
+		return None
+
+	def json(self) -> object:
+		return self._payload
+
+
 _LOCAL_ADMIN = AuthConfig(
 	auth_mode="local",
 	local_users=[LocalUser(user="admin", password="secret")],
@@ -319,17 +342,17 @@ def test_oauth_callback_creates_session(client: TestClient, oauth_auth_config: A
 			params={"code": "auth-code", "state": "idp-state"},
 			follow_redirects=False,
 		)
-	assert r.status_code == 303
-	rec = get_session(r.cookies["pygitweb_access_token"])
-	assert rec is not None
-	assert rec.username == "user@example.com"
-	assert rec.subject == "oauth-sub-1"
-	assert rec.email == "user@example.com"
-	assert rec.auth_method == "oauth"
-	assert client.get("/users/me").json()["username"] == "user@example.com"
-	status = client.get("/auth/status").json()
-	assert status["username"] == "user@example.com"
-	assert status["gravatar_url"] == gravatar_url("user@example.com")
+		assert r.status_code == 303
+		rec = get_session(r.cookies["pygitweb_access_token"])
+		assert rec is not None
+		assert rec.username == "user@example.com"
+		assert rec.subject == "oauth-sub-1"
+		assert rec.email == "user@example.com"
+		assert rec.auth_method == "oauth"
+		assert client.get("/users/me").json()["username"] == "user@example.com"
+		status = client.get("/auth/status").json()
+		assert status["username"] == "user@example.com"
+		assert status["gravatar_url"] == gravatar_url("user@example.com")
 	clear_client_cookies(client)
 
 
@@ -388,3 +411,151 @@ def test_authenticate_local_user_pass_hash() -> None:
 	assert user is not None
 	assert user.username == "admin"
 	assert authenticate_local_user("admin", "wrong") is None
+
+
+def test_exchange_code_success(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse({"access_token": "tok", "other": "x"})
+
+	client = AsyncMock()
+	client.post.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			out = await _exchange_code(
+				oauth_auth_config,
+				code="auth-code",
+				code_verifier="verifier",
+			)
+		assert out["access_token"] == "tok"
+
+	asyncio.run(runner())
+
+
+def test_exchange_code_rejects_non_mapping(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse(["not-a-dict"])
+
+	client = AsyncMock()
+	client.post.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _exchange_code(
+				oauth_auth_config,
+				code="auth-code",
+				code_verifier="verifier",
+			)
+
+	asyncio.run(runner())
+
+
+def test_fetch_google_profile_success(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse({"sub": "123", "email": "user@example.com"})
+
+	client = AsyncMock()
+	client.get.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			profile = await _fetch_google_profile("access-token")
+		assert profile["email"] == "user@example.com"
+
+	asyncio.run(runner())
+
+
+def test_fetch_google_profile_rejects_non_mapping(oauth_auth_config: AuthConfig) -> None:
+	resp = _DummyResponse("not-a-dict")
+
+	client = AsyncMock()
+	client.get.return_value = resp
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _fetch_google_profile("access-token")
+
+	asyncio.run(runner())
+
+
+def test_fetch_github_profile_uses_primary_verified_email() -> None:
+	resp_user = _DummyResponse({"login": "octocat", "email": None})
+	resp_emails = _DummyResponse([
+		{"email": "secondary@example.com", "primary": False, "verified": True},
+		{"email": "primary@example.com", "primary": True, "verified": True},
+	])
+
+	client = AsyncMock()
+	client.get.side_effect = (resp_user, resp_emails)
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client):
+			profile = await _fetch_github_profile("access-token")
+		assert profile["email"] == "primary@example.com"
+
+	asyncio.run(runner())
+
+
+def test_fetch_github_profile_rejects_non_mapping() -> None:
+	resp_user = _DummyResponse("not-a-dict")
+
+	client = AsyncMock()
+	client.get.return_value = resp_user
+	client.__aenter__.return_value = client
+	client.__aexit__.return_value = None
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth.httpx.AsyncClient", return_value=client), pytest.raises(HTTPException):
+			await _fetch_github_profile("access-token")
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_google(oauth_auth_config: AuthConfig) -> None:
+	token_payload = {"access_token": "tok"}
+	profile: dict[str, object] = {"sub": "123"}
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth._fetch_google_profile", new_callable=AsyncMock, return_value=profile):
+			out = await _fetch_profile(oauth_auth_config, token_payload)
+		assert out is profile
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_github() -> None:
+	cfg = _OAUTH_CFG.model_copy(update={"oauth_provider": "github"})
+	token_payload = {"access_token": "tok"}
+	profile: dict[str, object] = {"id": "123"}
+
+	async def runner() -> None:
+		with patch("pygitweb.auth_oauth._fetch_github_profile", new_callable=AsyncMock, return_value=profile):
+			out = await _fetch_profile(cfg, token_payload)
+		assert out is profile
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_missing_access_token(oauth_auth_config: AuthConfig) -> None:
+	async def runner() -> None:
+		with pytest.raises(HTTPException):
+			await _fetch_profile(oauth_auth_config, {})
+
+	asyncio.run(runner())
+
+
+def test_fetch_profile_unknown_provider() -> None:
+	cfg = _OAUTH_CFG.model_copy(update={"oauth_provider": "other"})
+
+	async def runner() -> None:
+		with pytest.raises(HTTPException):
+			await _fetch_profile(cfg, {"access_token": "tok"})
+
+	asyncio.run(runner())