Proxy Git with Your Own Auth

import { importPKCS8, SignJWT } from 'jose';
import { serve } from 'srvx';

// Your own auth logic. See "Connect your user system".
import { authenticate, authorize } from './auth.ts';

const org = process.env.PIERRE_ORG!;
const codeStorage = `https://${org}.code.storage`;
const keyPem = process.env.PIERRE_PRIVATE_KEY!;
const signingKey = await importPKCS8(keyPem, 'ES256');

type Access = 'read' | 'write';

// The four Git endpoints, and the access that each one needs.
const routes = new Map<string, Access>([
  ['GET info/refs?service=git-upload-pack', 'read'],
  ['POST git-upload-pack', 'read'],
  ['GET info/refs?service=git-receive-pack', 'write'],
  ['POST git-receive-pack', 'write'],
]);

type Route = { repoId: string; path: string; access: Access };

// Match /{repo}.git/{path}. A repository ID can contain slashes.
function matchRoute(req: Request): Route | null {
  const url = new URL(req.url);
  const match = url.pathname.match(/^\/(.+?)\.git\/(.+)$/);
  if (!match) return null;
  const [, repoId, endpoint] = match;
  const path = endpoint + url.search;
  const access = routes.get(`${req.method} ${path}`);
  return access ? { repoId, path, access } : null;
}

// Handle one Git request. `ip` is the client IP, for the log.
async function handleGit(req: Request, ip: string) {
  const route = matchRoute(req);
  if (!route) return notFound();

  const user = await authenticate(req);
  if (!user) {
    return new Response('Authentication required\n', {
      status: 401,
      headers: { 'WWW-Authenticate': 'Basic realm="git"' },
    });
  }
  // Return 404, so that a user cannot find repositories that
  // they cannot access.
  const { repoId, path, access } = route;
  if (!(await authorize(user, repoId, access))) return notFound();

  const token = await signToken(user.id, repoId, access);
  const url = `${codeStorage}/${repoId}.git/${path}`;
  const res = await forward(req, url, token);

  const entry = { user: user.id, ip, repoId, path };
  console.log(JSON.stringify({ ...entry, status: res.status }));
  return res;
}

function notFound() {
  return new Response('Not found\n', { status: 404 });
}

// Sign a short-lived Code Storage token for one request.
function signToken(sub: string, repo: string, access: Access) {
  const scopes = ['git:read'];
  if (access === 'write') scopes.push('git:write');

  const now = Math.floor(Date.now() / 1000);
  return new SignJWT({
    iss: org,
    sub, // Your user ID. Code Storage shows it in logs.
    repo,
    scopes,
    // Ref policies for this user.
    refs: [['refs/heads/main', ['no-force-push']]],
    iat: now,
    exp: now + 300,
  })
    .setProtectedHeader({ alg: 'ES256', typ: 'JWT' })
    .sign(signingKey);
}

// The request headers that Git needs.
const requestHeaders = [
  'accept',
  'content-type',
  'content-encoding', // Compressed requests.
  'git-protocol', // Git protocol v2.
  'user-agent',
];
const responseHeaders = ['content-type', 'cache-control'];

// Forward the request with the token. Stream both bodies.
async function forward(req: Request, url: string, token: string) {
  const auth = `Basic ${btoa(`t:${token}`)}`;
  const headers = new Headers({ Authorization: auth });
  for (const name of requestHeaders) {
    const value = req.headers.get(name);
    if (value) headers.set(name, value);
  }

  const res = await fetch(url, {
    method: req.method,
    headers,
    body: req.body,
    duplex: 'half',
  } as RequestInit);

  const resHeaders = new Headers();
  for (const name of responseHeaders) {
    const value = res.headers.get(name);
    if (value) resHeaders.set(name, value);
  }
  const init = { status: res.status, headers: resHeaders };
  return new Response(res.body, init);
}

serve({
  port: 8080,
  fetch: (req) => handleGit(req, req.ip ?? 'unknown'),
});