( request: EgressRequestShape, canonicalHost = "gitlab.cfdata.org", aliases = ["gitlab-access.cfdata.org"], )
| 33 | } |
| 34 | |
| 35 | export function classifyGitLabSmartHttp( |
| 36 | request: EgressRequestShape, |
| 37 | canonicalHost = "gitlab.cfdata.org", |
| 38 | aliases = ["gitlab-access.cfdata.org"], |
| 39 | ): GitLabDecision { |
| 40 | if (request.host !== canonicalHost && !aliases.includes(request.host)) { |
| 41 | return { classification: "Unknown", decision: "deny", provider: "gitlab", reason: "unknown_gitlab_host" }; |
| 42 | } |
| 43 | if (request.path.includes("/info/lfs/objects/batch")) { |
| 44 | return { classification: "Unknown", decision: "deny", provider: "gitlab", reason: "git_lfs_not_supported" }; |
| 45 | } |
| 46 | const repo = extractGitLabRepoFromGitPath(request.path); |
| 47 | if (!repo) { |
| 48 | return { classification: "Unknown", decision: "deny", provider: "gitlab", reason: "unsupported_git_protocol_request" }; |
| 49 | } |
| 50 | const repoKey = buildGitLabRepoKey(canonicalHost, repo); |
| 51 | if (request.path.endsWith("/git-upload-pack") && request.method === "POST") { |
| 52 | return { classification: "RepoRead", decision: "allow", provider: "gitlab", repoKey, grantKind: "git_repo_read" }; |
| 53 | } |
| 54 | if (request.path.endsWith("/git-receive-pack") && request.method === "POST") { |
| 55 | return { classification: "RepoWrite", decision: "require_consent", provider: "gitlab", repoKey, grantKind: "git_repo_write" }; |
| 56 | } |
| 57 | if (request.path.endsWith("/info/refs") && ["GET", "HEAD"].includes(request.method)) { |
| 58 | const service = new URLSearchParams(request.query).get("service"); |
| 59 | if (!service || service === "git-upload-pack") { |
| 60 | return { classification: "RepoRead", decision: "allow", provider: "gitlab", repoKey, grantKind: "git_repo_read" }; |
| 61 | } |
| 62 | if (service === "git-receive-pack") { |
| 63 | return { classification: "RepoWrite", decision: "require_consent", provider: "gitlab", repoKey, grantKind: "git_repo_write" }; |
| 64 | } |
| 65 | return { classification: "Unknown", decision: "deny", provider: "gitlab", repoKey, reason: "unsupported_git_service" }; |
| 66 | } |
| 67 | if ((request.path.endsWith("/HEAD") || request.path.includes("/objects/")) && ["GET", "HEAD"].includes(request.method)) { |
| 68 | return { classification: "RepoRead", decision: "allow", provider: "gitlab", repoKey, grantKind: "git_repo_read" }; |
| 69 | } |
| 70 | return { classification: "Unknown", decision: "deny", provider: "gitlab", repoKey, reason: "unsupported_git_protocol_request" }; |
| 71 | } |
| 72 | |
| 73 | /** |
| 74 | * Normalize a Git smart HTTP request for forwarding through the GitLab OAuth |
no test coverage detected