Function Middleware

app/api/middleware/goget/goget.go:61–158

Middleware writes to response with html meta tags go-import and go-source. nolint:gocognit

(
	maxRepoPathDepth int,
	repoCtrl *repo.Controller,
	urlProvider url.Provider,
)

//
//nolint:gocognit
func Middleware(
	maxRepoPathDepth int,
	repoCtrl *repo.Controller,
	urlProvider url.Provider,
) func(http.Handler) http.Handler {
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(
			func(w http.ResponseWriter, r *http.Request) {
				if r.Method != http.MethodGet || r.URL.Query().Get("go-get") != "1" {
					next.ServeHTTP(w, r)
					return
				}
				ctx := r.Context()

				session, _ := request.AuthSessionFrom(ctx)
				importPath, err := request.GetRepoRefFromPath(r)
				if err != nil {
					render.TranslatedUserError(ctx, w, err)
					return
				}

				// go get can also be used with (sub)module suffixes (e.g 127.0.0.1/my-project/my-repo/v2)
				// for which go expects us to return the import path corresponding to the repository root
				// (e.g. 127.0.0.1/my-project/my-repo).
				//
				// WARNING: This can lead to ambiguities as we allow matching paths between spaces and repos:
				//  1. (space)foo     + (repo)bar + (sufix)v2 = 127.0.0.1/my-project/my-repo/v2
				//  2. (space)foo/bar + (repo)v2              = 127.0.0.1/my-project/my-repo/v2
				//
				// We handle ambiguities by always choosing the repo with the longest path (e.g. 2. case above).
				// To solve go get related ambiguities users would have to move their repositories.
				var repository *repo.RepositoryOutput
				var repoRef string

				pathSegments := paths.Segments(importPath)
				if len(pathSegments) > maxRepoPathDepth {
					pathSegments = pathSegments[:maxRepoPathDepth]
				}

				for l := len(pathSegments); l >= 2; l-- {
					repoRef = paths.Concatenate(pathSegments[:l]...)

					repository, err = repoCtrl.Find(ctx, session, repoRef)
					if err == nil {
						break
					}
					if errors.Is(err, store.ErrResourceNotFound) {
						log.Ctx(ctx).Debug().Err(err).
							Msgf("repository %q doesn't exist, assume submodule and try again", repoRef)
						continue
					}
					if errors.Is(err, auth.ErrForbidden) {
						// To avoid leaking information about repos' existence we continue as if it wasn't found.
						// WARNING: This can lead to different import results depending on access (very unlikely)
						log.Ctx(ctx).Debug().Err(err).
							Msgf("user has no access on repository %q, assume submodule and try again", repoRef)
						continue
					}