client.go RawHistoryFolder

1// SPDX-License-Identifier: MIT
2
3package actionscache
4
5import (
6	"errors"
7	"fmt"
8	"net/http"
9	"slices"
10
11	"bnema.dev/ermite-runner/internal/urlorigin"
12)
13
14func originOf(raw string) string { return urlorigin.Canonical(raw) }
15
16// NewClient returns the client that downloads the archives. It follows
17// redirects (GitHub's codeload does redirect) but never carries credentials
18// across an origin: the Authorization header is dropped as soon as the scheme,
19// the host or the port changes, and a redirect from https to http is refused.
20// (net/http alone would keep the header for subdomains and ignore the scheme and
21// the port.) Tests may supply their own transport through Actions.HTTPClient;
22// its redirect policy is replaced.
23func NewClient(base *http.Client) *http.Client {
24	c := &http.Client{}
25	if base != nil {
26		cp := *base
27		c = &cp
28	}
29	c.CheckRedirect = func(req *http.Request, via []*http.Request) error {
30		if len(via) >= 10 {
31			return errors.New("stopped after 10 redirects")
32		}
33		// Go builds every redirected request from the headers of the first one
34		// (copying Authorization when the host matches), so the header must be
35		// removed again on every hop that is not on the origin the token was meant
36		// for: the first request's. Once the chain left that origin, it never gets
37		// the header back, even if a later hop returns to it (A -> B -> A would
38		// otherwise be re-authorised by the copy).
39		origin := originOf(via[0].URL.String())
40		chain := slices.Concat(via[1:], []*http.Request{req}) // not append: via belongs to the client
41		for i, r := range chain {
42			prev := via[i]
43			if prev.URL.Scheme == "https" && r.URL.Scheme != "https" {
44				return fmt.Errorf("refusing to follow a redirect from https to %s", r.URL.Scheme)
45			}
46		}
47		for _, r := range chain {
48			if originOf(r.URL.String()) != origin {
49				req.Header.Del("Authorization")
50				break
51			}
52		}
53		return nil
54	}
55	return c
56}