// Copyright 2022 The Gitea Authors. All rights reserved.// SPDX-License-Identifier: MIT package packages import (	"net/http"	"regexp"	"strings" 	auth_model "forgejo.org/models/auth"	"forgejo.org/models/perm"	quota_model "forgejo.org/models/quota"	"forgejo.org/modules/log"	"forgejo.org/modules/setting"	"forgejo.org/modules/web"	"forgejo.org/routers/api/packages/alpine"	"forgejo.org/routers/api/packages/alt"	"forgejo.org/routers/api/packages/arch"	"forgejo.org/routers/api/packages/cargo"	"forgejo.org/routers/api/packages/chef"	"forgejo.org/routers/api/packages/composer"	"forgejo.org/routers/api/packages/conan"	"forgejo.org/routers/api/packages/conda"	"forgejo.org/routers/api/packages/container"	"forgejo.org/routers/api/packages/cran"	"forgejo.org/routers/api/packages/debian"	"forgejo.org/routers/api/packages/generic"	"forgejo.org/routers/api/packages/goproxy"	"forgejo.org/routers/api/packages/helm"	"forgejo.org/routers/api/packages/maven"	"forgejo.org/routers/api/packages/npm"	"forgejo.org/routers/api/packages/nuget"	"forgejo.org/routers/api/packages/pub"	"forgejo.org/routers/api/packages/pypi"	"forgejo.org/routers/api/packages/rpm"	"forgejo.org/routers/api/packages/rubygems"	"forgejo.org/routers/api/packages/swift"	"forgejo.org/routers/api/packages/vagrant"	"forgejo.org/services/auth"	"forgejo.org/services/context") func reqPackageAccess(accessMode perm.AccessMode) func(ctx *context.Context) {	return func(ctx *context.Context) {		if ctx.Data["IsApiToken"] == true {			scope, ok := ctx.Data["ApiTokenScope"].(auth_model.AccessTokenScope)			if ok { // it's a personal access token but not oauth2 token				scopeMatched := false				var err error				switch accessMode {				case perm.AccessModeRead:					scopeMatched, err = scope.HasScope(auth_model.AccessTokenScopeReadPackage)					if err != nil {						ctx.Error(http.StatusInternalServerError, "HasScope", err.Error())						return					}				case perm.AccessModeWrite:					scopeMatched, err = scope.HasScope(auth_model.AccessTokenScopeWritePackage)					if err != nil {						ctx.Error(http.StatusInternalServerError, "HasScope", err.Error())						return					}				}				if !scopeMatched {					ctx.Resp.Header().Set("WWW-Authenticate", `Basic realm="Gitea Package API"`)					ctx.Error(http.StatusUnauthorized, "reqPackageAccess", "user should have specific permission or be a site admin")					return				} 				// check if scope only applies to public resources				publicOnly, err := scope.PublicOnly()				if err != nil {					ctx.Error(http.StatusForbidden, "tokenRequiresScope", "parsing public resource scope failed: "+err.Error())					return				} 				if publicOnly {					if ctx.Package != nil && ctx.Package.Owner.Visibility.IsPrivate() {						ctx.Error(http.StatusForbidden, "reqToken", "token scope is limited to public packages")						return					}				}			}		} 		if ctx.Package.AccessMode < accessMode && !ctx.IsUserSiteAdmin() {			ctx.Resp.Header().Set("WWW-Authenticate", `Basic realm="Gitea Package API"`)			ctx.Error(http.StatusUnauthorized, "reqPackageAccess", "user should have specific permission or be a site admin")			return		}	}} func enforcePackagesQuota() func(ctx *context.Context) {	return func(ctx *context.Context) {		ok, err := quota_model.EvaluateForUser(ctx, ctx.Doer.ID, quota_model.LimitSubjectSizeAssetsPackagesAll)		if err != nil {			log.Error("quota_model.EvaluateForUser: %v", err)			ctx.Error(http.StatusInternalServerError, "Error checking quota")			return		}		if !ok {			ctx.Error(http.StatusRequestEntityTooLarge, "enforcePackagesQuota", "quota exceeded")			return		}	}} func verifyAuth(r *web.Route, authMethods []auth.Method) {	if setting.Service.EnableReverseProxyAuth {		authMethods = append(authMethods, &auth.ReverseProxy{})	}	authGroup := auth.NewGroup(authMethods...) 	r.Use(func(ctx *context.Context) {		var err error		ctx.Doer, err = authGroup.Verify(ctx.Req, ctx.Resp, ctx, ctx.Session)		if err != nil {			log.Error("Failed to verify user: %v", err)			ctx.Error(http.StatusUnauthorized, "authGroup.Verify")			return		}		ctx.IsSigned = ctx.Doer != nil	})} // CommonRoutes provide endpoints for most package managers (except containers - see below)// These are mounted on `/api/packages` (not `/api/v1/packages`)func CommonRoutes() *web.Route {	r := web.NewRoute() 	r.Use(context.PackageContexter()) 	verifyAuth(r, []auth.Method{		&auth.OAuth2{},		&auth.Basic{},		&nuget.Auth{},		&conan.Auth{},		&chef.Auth{},	}) 	r.Group("/{username}", func() {		r.Group("/alpine", func() {			r.Get("/key", alpine.GetRepositoryKey)			r.Group("/{branch}/{repository}", func() {				r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), alpine.UploadPackageFile)				r.Group("/{architecture}", func() {					r.Get("/APKINDEX.tar.gz", alpine.GetRepositoryFile)					r.Group("/{filename}", func() {						r.Get("", alpine.DownloadPackageFile)						r.Delete("", reqPackageAccess(perm.AccessModeWrite), alpine.DeletePackageFile)					})				})			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/arch", func() {			r.Methods("HEAD,GET", "/repository.key", arch.GetRepositoryKey)			r.Methods("HEAD,GET", "*", arch.GetPackageOrDB)			r.Methods("PUT", "*", reqPackageAccess(perm.AccessModeWrite), arch.PushPackage)			r.Methods("DELETE", "*", reqPackageAccess(perm.AccessModeWrite), arch.RemovePackage)		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/cargo", func() {			r.Group("/api/v1/crates", func() {				r.Get("", cargo.SearchPackages)				r.Put("/new", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), cargo.UploadPackage)				r.Group("/{package}", func() {					r.Group("/{version}", func() {						r.Get("/download", cargo.DownloadPackageFile)						r.Delete("/yank", reqPackageAccess(perm.AccessModeWrite), cargo.YankPackage)						r.Put("/unyank", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), cargo.UnyankPackage)					})					r.Get("/owners", cargo.ListOwners)				})			})			r.Get("/config.json", cargo.RepositoryConfig)			r.Get("/1/{package}", cargo.EnumeratePackageVersions)			r.Get("/2/{package}", cargo.EnumeratePackageVersions)			// Use dummy placeholders because these parts are not of interest			r.Get("/3/{_}/{package}", cargo.EnumeratePackageVersions)			r.Get("/{_}/{__}/{package}", cargo.EnumeratePackageVersions)		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/chef", func() {			r.Group("/api/v1", func() {				r.Get("/universe", chef.PackagesUniverse)				r.Get("/search", chef.EnumeratePackages)				r.Group("/cookbooks", func() {					r.Get("", chef.EnumeratePackages)					r.Post("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), chef.UploadPackage)					r.Group("/{name}", func() {						r.Get("", chef.PackageMetadata)						r.Group("/versions/{version}", func() {							r.Get("", chef.PackageVersionMetadata)							r.Delete("", reqPackageAccess(perm.AccessModeWrite), chef.DeletePackageVersion)							r.Get("/download", chef.DownloadPackage)						})						r.Delete("", reqPackageAccess(perm.AccessModeWrite), chef.DeletePackage)					})				})			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/composer", func() {			r.Get("/packages.json", composer.ServiceIndex)			r.Get("/search.json", composer.SearchPackages)			r.Get("/list.json", composer.EnumeratePackages)			r.Get("/p2/{vendorname}/{projectname}~dev.json", composer.PackageMetadata)			r.Get("/p2/{vendorname}/{projectname}.json", composer.PackageMetadata)			r.Get("/files/{package}/{version}/{filename}", composer.DownloadPackageFile)			r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), composer.UploadPackage)		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/conan", func() {			r.Group("/v1", func() {				r.Get("/ping", conan.Ping)				r.Group("/users", func() {					r.Get("/authenticate", conan.Authenticate)					r.Get("/check_credentials", conan.CheckCredentials)				})				r.Group("/conans", func() {					r.Get("/search", conan.SearchRecipes)					r.Group("/{name}/{version}/{user}/{channel}", func() {						r.Get("", conan.RecipeSnapshot)						r.Delete("", reqPackageAccess(perm.AccessModeWrite), conan.DeleteRecipeV1)						r.Get("/search", conan.SearchPackagesV1)						r.Get("/digest", conan.RecipeDownloadURLs)						r.Post("/upload_urls", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), conan.RecipeUploadURLs)						r.Get("/download_urls", conan.RecipeDownloadURLs)						r.Group("/packages", func() {							r.Post("/delete", reqPackageAccess(perm.AccessModeWrite), conan.DeletePackageV1)							r.Group("/{package_reference}", func() {								r.Get("", conan.PackageSnapshot)								r.Get("/digest", conan.PackageDownloadURLs)								r.Post("/upload_urls", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), conan.PackageUploadURLs)								r.Get("/download_urls", conan.PackageDownloadURLs)							})						})					}, conan.ExtractPathParameters)				})				r.Group("/files/{name}/{version}/{user}/{channel}/{recipe_revision}", func() {					r.Group("/recipe/{filename}", func() {						r.Get("", conan.DownloadRecipeFile)						r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), conan.UploadRecipeFile)					})					r.Group("/package/{package_reference}/{package_revision}/{filename}", func() {						r.Get("", conan.DownloadPackageFile)						r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), conan.UploadPackageFile)					})				}, conan.ExtractPathParameters)			})			r.Group("/v2", func() {				r.Get("/ping", conan.Ping)				r.Group("/users", func() {					r.Get("/authenticate", conan.Authenticate)					r.Get("/check_credentials", conan.CheckCredentials)				})				r.Group("/conans", func() {					r.Get("/search", conan.SearchRecipes)					r.Group("/{name}/{version}/{user}/{channel}", func() {						r.Delete("", reqPackageAccess(perm.AccessModeWrite), conan.DeleteRecipeV2)						r.Get("/search", conan.SearchPackagesV2)						r.Get("/latest", conan.LatestRecipeRevision)						r.Group("/revisions", func() {							r.Get("", conan.ListRecipeRevisions)							r.Group("/{recipe_revision}", func() {								r.Delete("", reqPackageAccess(perm.AccessModeWrite), conan.DeleteRecipeV2)								r.Get("/search", conan.SearchPackagesV2)								r.Group("/files", func() {									r.Get("", conan.ListRecipeRevisionFiles)									r.Group("/{filename}", func() {										r.Get("", conan.DownloadRecipeFile)										r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), conan.UploadRecipeFile)									})								})								r.Group("/packages", func() {									r.Delete("", reqPackageAccess(perm.AccessModeWrite), conan.DeletePackageV2)									r.Group("/{package_reference}", func() {										r.Delete("", reqPackageAccess(perm.AccessModeWrite), conan.DeletePackageV2)										r.Get("/latest", conan.LatestPackageRevision)										r.Group("/revisions", func() {											r.Get("", conan.ListPackageRevisions)											r.Group("/{package_revision}", func() {												r.Delete("", reqPackageAccess(perm.AccessModeWrite), conan.DeletePackageV2)												r.Group("/files", func() {													r.Get("", conan.ListPackageRevisionFiles)													r.Group("/{filename}", func() {														r.Get("", conan.DownloadPackageFile)														r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), conan.UploadPackageFile)													})												})											})										})									})								})							})						})					}, conan.ExtractPathParameters)				})			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/conda", func() {			var (				downloadPattern = regexp.MustCompile(`\A(.+/)?(.+)/((?:[^/]+(?:\.tar\.bz2|\.conda))|(?:current_)?repodata\.json(?:\.bz2)?)\z`)				uploadPattern   = regexp.MustCompile(`\A(.+/)?([^/]+(?:\.tar\.bz2|\.conda))\z`)			) 			r.Get("/*", func(ctx *context.Context) {				m := downloadPattern.FindStringSubmatch(ctx.Params("*"))				if len(m) == 0 {					ctx.Status(http.StatusNotFound)					return				} 				ctx.SetParams("channel", strings.TrimSuffix(m[1], "/"))				ctx.SetParams("architecture", m[2])				ctx.SetParams("filename", m[3]) 				switch m[3] {				case "repodata.json", "repodata.json.bz2", "current_repodata.json", "current_repodata.json.bz2":					conda.EnumeratePackages(ctx)				default:					conda.DownloadPackageFile(ctx)				}			})			r.Put("/*", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), func(ctx *context.Context) {				m := uploadPattern.FindStringSubmatch(ctx.Params("*"))				if len(m) == 0 {					ctx.Status(http.StatusNotFound)					return				} 				ctx.SetParams("channel", strings.TrimSuffix(m[1], "/"))				ctx.SetParams("filename", m[2]) 				conda.UploadPackageFile(ctx)			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/cran", func() {			r.Group("/src", func() {				r.Group("/contrib", func() {					r.Get("/PACKAGES", cran.EnumerateSourcePackages)					r.Get("/PACKAGES{format}", cran.EnumerateSourcePackages)					r.Get("/{filename}", cran.DownloadSourcePackageFile)					r.Get("/Archive/{packagename}/{filename}", cran.DownloadSourcePackageFile)				})				r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), cran.UploadSourcePackageFile)			})			r.Group("/bin", func() {				r.Group("/{platform}/contrib/{rversion}", func() {					r.Get("/PACKAGES", cran.EnumerateBinaryPackages)					r.Get("/PACKAGES{format}", cran.EnumerateBinaryPackages)					r.Get("/{filename}", cran.DownloadBinaryPackageFile)				})				r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), cran.UploadBinaryPackageFile)			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/debian", func() {			r.Get("/repository.key", debian.GetRepositoryKey)			r.Group("/dists/{distribution}", func() {				r.Get("/{filename}", debian.GetRepositoryFile)				r.Get("/by-hash/{algorithm}/{hash}", debian.GetRepositoryFileByHash)				r.Group("/{component}/{architecture}", func() {					r.Get("/{filename}", debian.GetRepositoryFile)					r.Get("/by-hash/{algorithm}/{hash}", debian.GetRepositoryFileByHash)				})			})			r.Group("/pool/{distribution}/{component}", func() {				r.Get("/{name}_{version}_{architecture}.deb", debian.DownloadPackageFile)				r.Group("", func() {					r.Put("/upload", enforcePackagesQuota(), debian.UploadPackageFile)					r.Delete("/{name}/{version}/{architecture}", debian.DeletePackageFile)				}, reqPackageAccess(perm.AccessModeWrite))			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/go", func() {			r.Put("/upload", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), goproxy.UploadPackage)			r.Get("/sumdb/sum.golang.org/supported", func(ctx *context.Context) {				ctx.Status(http.StatusNotFound)			}) 			// Manual mapping of routes because the package name contains slashes which chi does not support			// https://go.dev/ref/mod#goproxy-protocol			r.Get("/*", func(ctx *context.Context) {				path := ctx.Params("*") 				if strings.HasSuffix(path, "/@latest") {					ctx.SetParams("name", path[:len(path)-len("/@latest")])					ctx.SetParams("version", "latest") 					goproxy.PackageVersionMetadata(ctx)					return				} 				parts := strings.SplitN(path, "/@v/", 2)				if len(parts) != 2 {					ctx.Status(http.StatusNotFound)					return				} 				ctx.SetParams("name", parts[0]) 				// <package/name>/@v/list				if parts[1] == "list" {					goproxy.EnumeratePackageVersions(ctx)					return				} 				// <package/name>/@v/<version>.zip				if strings.HasSuffix(parts[1], ".zip") {					ctx.SetParams("version", parts[1][:len(parts[1])-len(".zip")]) 					goproxy.DownloadPackageFile(ctx)					return				}				// <package/name>/@v/<version>.info				if strings.HasSuffix(parts[1], ".info") {					ctx.SetParams("version", parts[1][:len(parts[1])-len(".info")]) 					goproxy.PackageVersionMetadata(ctx)					return				}				// <package/name>/@v/<version>.mod				if strings.HasSuffix(parts[1], ".mod") {					ctx.SetParams("version", parts[1][:len(parts[1])-len(".mod")]) 					goproxy.PackageVersionGoModContent(ctx)					return				} 				ctx.Status(http.StatusNotFound)			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/generic", func() {			r.Group("/{packagename}/{packageversion}", func() {				r.Delete("", reqPackageAccess(perm.AccessModeWrite), generic.DeletePackage)				r.Group("/{filename}", func() {					r.Get("", generic.DownloadPackageFile)					r.Group("", func() {						r.Put("", enforcePackagesQuota(), generic.UploadPackage)						r.Delete("", generic.DeletePackageFile)					}, reqPackageAccess(perm.AccessModeWrite))				})			})		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/helm", func() {			r.Get("/index.yaml", helm.Index)			r.Get("/{filename}", helm.DownloadPackageFile)			r.Post("/api/charts", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), helm.UploadPackage)		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/maven", func() {			r.Put("/*", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), maven.UploadPackageFile)			r.Get("/*", maven.DownloadPackageFile)			r.Head("/*", maven.ProvidePackageFileHeader)		}, reqPackageAccess(perm.AccessModeRead))		r.Group("/nuget", func() {			r.Group("", func() { // Needs to be unauthenticated for the NuGet client.				r.Get("/", nuget.ServiceIndexV2)				r.Get("/index.json", nuget.ServiceIndexV3)				r.Get("/$metadata", nuget.FeedCapabilityResource)			})			r.Group("", func() {				r.Get("/query", nuget.SearchServiceV3)				r.Group("/registration/{id}", func() {					r.Get("/index.json", nuget.RegistrationIndex)					r.Get("/{version}", nuget.RegistrationLeafV3)				})				r.Group("/package/{id}", func() {					r.Get("/index.json", nuget.EnumeratePackageVersionsV3)					r.Get("/{version}/{filename}", nuget.DownloadPackageFile)				})				r.Group("", func() {					r.Put("/", enforcePackagesQuota(), nuget.UploadPackage)					r.Put("/symbolpackage", enforcePackagesQuota(), nuget.UploadSymbolPackage)					r.Delete("/{id}/{version}", nuget.DeletePackage)				}, reqPackageAccess(perm.AccessModeWrite))				r.Get("/symbols/{filename}/{guid:[0-9a-fA-F]{32}[fF]{8}}/{filename2}", nuget.DownloadSymbolFile)				r.Get("/Packages(Id='{id:[^']+}',Version='{version:[^']+}')", nuget.RegistrationLeafV2)				r.Group("/Packages()", func() {					r.Get("", nuget.SearchServiceV2)					r.Get("/$count", nuget.SearchServiceV2Count)				})				r.Group("/FindPackagesById()", func() {					r.Get("", nuget.EnumeratePackageVersionsV2)					r.Get("/$count", nuget.EnumeratePackageVersionsV2Count)				})				r.Group("/Search()", func() {					r.Get("", nuget.SearchServiceV2)					r.Get("/$count", nuget.SearchServiceV2Count)				})			}, reqPackageAccess(perm.AccessModeRead))		})		r.Group("/npm", func() {			r.Group("/@{scope}/{id}", func() {				r.Get("", npm.PackageMetadata)				r.Put("", reqPackageAccess(perm.AccessModeWrite), enforcePackagesQuota(), npm.UploadPackage)				r.Group("/-/{version}/{filename}", func() {					r.Get("", npm.DownloadPackageFile)					r.Delete("/-rev/{revision}", reqPackageAccess(perm.AccessModeWrite), npm.DeletePackageVersion)				})				r.Get("/-/{filename}", npm.DownloadPackageFileByName)				r.Group("/-rev/{revision}", func() {					r.Delete("", npm.DeletePackage)

Lines 1–500 of 936. Load more