1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package usecase
4
5import (
6 "context"
7 "crypto/sha256"
8 "encoding/base64"
9 "encoding/hex"
10 "fmt"
11 "io"
12 "slices"
13 "strconv"
14 "strings"
15
16 "bnema.dev/ermite/internal/domain"
17 "bnema.dev/ermite/internal/ports"
18)
19
20// Browse are the read use cases over the Git data of a repository: refs,
21// trees, blobs, history and commits. Every method applies the access rule
22// first: a repository the principal may not read, or that does not exist,
23// answers domain.ErrNotFound before the Git reader is touched.
24type Browse struct {
25 meta ports.RepoMetaStore
26 reader ports.RepoReader
27 // history keeps the answers about a commit designated by its full id (a
28 // tree with the last commit of its entries, the latest commit of a path):
29 // they never change, and computing them costs a history walk. Nil
30 // disables it.
31 history *historyCache
32}
33
34var _ ports.BrowseService = (*Browse)(nil)
35
36// NewBrowse builds the read use cases over their ports, with a history cache
37// of the default bounds.
38func NewBrowse(meta ports.RepoMetaStore, reader ports.RepoReader) *Browse {
39 return &Browse{
40 meta: meta, reader: reader,
41 history: newHistoryCache(DefaultHistoryCacheEntries, DefaultHistoryCacheBytes),
42 }
43}
44
45// WithHistoryCache replaces the bounds of the history cache: at most
46// maxEntries answers and about maxBytes of memory, least recently used first
47// out. A bound that is not positive disables the cache. Call it before the
48// first request.
49func (b *Browse) WithHistoryCache(maxEntries int, maxBytes int64) *Browse {
50 b.history = newHistoryCache(maxEntries, maxBytes)
51 return b
52}
53
54// authorize returns the repository if p may read it. The caller uses it to
55// tell a repository from a later one created under the same name.
56func (b *Browse) authorize(ctx context.Context, p domain.Principal, name domain.RepoName) (domain.Repo, error) {
57 repo, err := lookupRepo(ctx, b.meta, name)
58 if err != nil {
59 return domain.Repo{}, err
60 }
61 if !canRead(p, repo) {
62 return domain.Repo{}, domain.ErrNotFound
63 }
64 return repo, nil
65}
66
67// repoEpoch identifies one life of a repository name: its creation time in
68// nanoseconds, 0 if unknown.
69func repoEpoch(r domain.Repo) int64 {
70 if r.CreatedAt.IsZero() {
71 return 0
72 }
73 return r.CreatedAt.UnixNano()
74}
75
76func kindRank(k domain.RefKind) int {
77 switch k {
78 case domain.RefKindHead:
79 return 0
80 case domain.RefKindBranch:
81 return 1
82 }
83 return 2
84}
85
86// ListRefs lists HEAD, the branches and the tags, in that order, then by
87// name. The page token names the last ref of the previous page, so refs that
88// appear or disappear between two pages never shift the others.
89func (b *Browse) ListRefs(ctx context.Context, p domain.Principal, repo domain.RepoName, params ports.ListRefsParams) (ports.RefPage, error) {
90 size, err := pageSizeUpTo(params.PageSize, MaxRefPageSize)
91 if err != nil {
92 return ports.RefPage{}, err
93 }
94 for _, k := range params.Kinds {
95 if k != domain.RefKindHead && k != domain.RefKindBranch && k != domain.RefKindTag {
96 return ports.RefPage{}, fmt.Errorf("%w: %q", domain.ErrInvalidRefKind, k)
97 }
98 }
99 after, err := decodeRefToken(params.PageToken)
100 if err != nil {
101 return ports.RefPage{}, err
102 }
103 if _, err := b.authorize(ctx, p, repo); err != nil {
104 return ports.RefPage{}, err
105 }
106 all, err := b.reader.ListRefs(ctx, repo)
107 if err != nil {
108 return ports.RefPage{}, err
109 }
110
111 var wanted []domain.Ref
112 for _, r := range all {
113 if len(params.Kinds) == 0 || slices.Contains(params.Kinds, r.Kind) {
114 wanted = append(wanted, r)
115 }
116 }
117 var page ports.RefPage
118 page.Refs, page.NextPageToken = pageAfter(wanted, size,
119 func(r domain.Ref) bool { return after == nil || refAfter(r, *after) },
120 encodeRefToken)
121 return page, nil
122}
123
124// refAfter reports whether r sorts after the ref the token names.
125func refAfter(r domain.Ref, last refCursor) bool {
126 if kr, lr := kindRank(r.Kind), kindRank(last.kind); kr != lr {
127 return kr > lr
128 }
129 return r.Name > last.name
130}
131
132// refCursor is the decoded page token of ListRefs.
133type refCursor struct {
134 kind domain.RefKind
135 name string
136}
137
138const (
139 refTokenPrefix = "r1:"
140 commitTokenPrefix = "c1:"
141)
142
143func encodeRefToken(last domain.Ref) string {
144 return base64.RawURLEncoding.EncodeToString([]byte(refTokenPrefix + string(last.Kind) + ":" + last.Name))
145}
146
147// decodeRefToken returns nil for the empty token.
148func decodeRefToken(tok string) (*refCursor, error) {
149 if tok == "" {
150 return nil, nil
151 }
152 raw, ok := decodeToken(tok, refTokenPrefix)
153 if !ok {
154 return nil, fmt.Errorf("%w: refs", domain.ErrInvalidPageToken)
155 }
156 kind, name, ok := strings.Cut(raw, ":")
157 k := domain.RefKind(kind)
158 if !ok || name == "" || (k != domain.RefKindHead && k != domain.RefKindBranch && k != domain.RefKindTag) {
159 return nil, fmt.Errorf("%w: refs", domain.ErrInvalidPageToken)
160 }
161 return &refCursor{kind: k, name: name}, nil
162}
163
164// ResolveRevision turns a revision into the commit it designates.
165func (b *Browse) ResolveRevision(ctx context.Context, p domain.Principal, repo domain.RepoName, rev domain.Revision) (domain.ResolvedRevision, error) {
166 if _, err := b.authorize(ctx, p, repo); err != nil {
167 return domain.ResolvedRevision{}, err
168 }
169 return b.reader.ResolveRevision(ctx, repo, rev)
170}
171
172// ResolveRefPath splits a path such as "feature/x/dir/file" into the longest
173// leading ref and the path inside it.
174func (b *Browse) ResolveRefPath(ctx context.Context, p domain.Principal, repo domain.RepoName, path string) (domain.RefPath, error) {
175 if _, err := b.authorize(ctx, p, repo); err != nil {
176 return domain.RefPath{}, err
177 }
178 return b.reader.ResolveRefPath(ctx, repo, path)
179}
180
181// GetTree lists a directory at a revision. With includeLastCommit, entries get
182// their last commit, for at most domain.MaxLastCommitEntries of them.
183func (b *Browse) GetTree(ctx context.Context, p domain.Principal, repo domain.RepoName, rev domain.Revision, path domain.TreePath, includeLastCommit bool) (domain.Tree, error) {
184 r, err := b.authorize(ctx, p, repo)
185 if err != nil {
186 return domain.Tree{}, err
187 }
188 // The last commits are the costly part (a history walk per entry) and
189 // depend only on the commit and the path: cache them once the revision is
190 // a full commit id. A name or HEAD can move, so it is never a key.
191 if !includeLastCommit || !rev.IsObjectID() {
192 return b.reader.GetTree(ctx, repo, rev, path, includeLastCommit)
193 }
194 key := historyKey{repo: repo, created: repoEpoch(r), rev: rev.String(), path: path.String(), kind: kindTreeLast}
195 if e, ok := b.history.get(key); ok {
196 return cloneTree(e.tree), nil
197 }
198 tree, err := b.reader.GetTree(ctx, repo, rev, path, true)
199 if err != nil {
200 return domain.Tree{}, err
201 }
202 b.history.put(treeEntry(key, tree))
203 return tree, nil
204}
205
206// ListPaths lists the paths of every file and symbolic link of a revision, at
207// most domain.MaxPathEntries paths and domain.MaxPathBytes bytes of paths.
208func (b *Browse) ListPaths(ctx context.Context, p domain.Principal, repo domain.RepoName, rev domain.Revision) (domain.PathList, error) {
209 if _, err := b.authorize(ctx, p, repo); err != nil {
210 return domain.PathList{}, err
211 }
212 return b.reader.ListPaths(ctx, repo, rev, domain.MaxPathEntries, domain.MaxPathBytes)
213}
214
215// OpenBlob returns the description of a file and a reader of its content. The
216// caller closes the reader.
217func (b *Browse) OpenBlob(ctx context.Context, p domain.Principal, repo domain.RepoName, rev domain.Revision, path domain.TreePath) (domain.BlobInfo, io.ReadCloser, error) {
218 if _, err := b.authorize(ctx, p, repo); err != nil {
219 return domain.BlobInfo{}, nil, err
220 }
221 return b.reader.OpenBlob(ctx, repo, rev, path)
222}
223
224// ListCommits returns a page of history. The page token holds the commit the
225// listing started from, how many commits were already returned and a digest
226// of the path; a token used with another path is invalid.
227func (b *Browse) ListCommits(ctx context.Context, p domain.Principal, repo domain.RepoName, params ports.ListCommitsParams) (ports.HistoryPage, error) {
228 size, err := pageSize(params.PageSize)
229 if err != nil {
230 return ports.HistoryPage{}, err
231 }
232 q := ports.CommitQuery{Revision: params.Revision, Path: params.Path, Limit: size}
233 if params.PageToken != "" {
234 head, skip, err := decodeCommitToken(params.PageToken, params.Path)
235 if err != nil {
236 return ports.HistoryPage{}, err
237 }
238 q.Revision, q.Skip = domain.RevisionOf(head), skip
239 }
240 r, err := b.authorize(ctx, p, repo)
241 if err != nil {
242 return ports.HistoryPage{}, err
243 }
244 res, err := b.listCommits(ctx, r, q)
245 if err != nil {
246 return ports.HistoryPage{}, err
247 }
248 out := ports.HistoryPage{Commits: res.Commits}
249 if res.HasMore {
250 out.NextPageToken = encodeCommitToken(res.Head, q.Skip+len(res.Commits), params.Path)
251 }
252 return out, nil
253}
254
255// listCommits asks the reader, through the history cache for the first
256// commit of a path at a full commit id (the "last change" of a file): that
257// answer is immutable.
258func (b *Browse) listCommits(ctx context.Context, r domain.Repo, q ports.CommitQuery) (ports.CommitPage, error) {
259 repo := r.Name
260 if q.Limit != 1 || q.Skip != 0 || !q.Revision.IsObjectID() {
261 return b.reader.ListCommits(ctx, repo, q)
262 }
263 key := historyKey{repo: r.Name, created: repoEpoch(r), rev: q.Revision.String(), path: q.Path.String(), kind: kindPage, limit: q.Limit}
264 if e, ok := b.history.get(key); ok {
265 return clonePage(e.page), nil
266 }
267 res, err := b.reader.ListCommits(ctx, repo, q)
268 if err != nil {
269 return ports.CommitPage{}, err
270 }
271 b.history.put(pageEntry(key, res))
272 return res, nil
273}
274
275func pathDigest(path domain.TreePath) string {
276 sum := sha256.Sum256([]byte(path.String()))
277 return hex.EncodeToString(sum[:6])
278}
279
280func encodeCommitToken(head domain.ObjectID, skip int, path domain.TreePath) string {
281 raw := commitTokenPrefix + head.String() + ":" + strconv.Itoa(skip) + ":" + pathDigest(path)
282 return base64.RawURLEncoding.EncodeToString([]byte(raw))
283}
284
285func decodeCommitToken(tok string, path domain.TreePath) (domain.ObjectID, int, error) {
286 bad := fmt.Errorf("%w: commits", domain.ErrInvalidPageToken)
287 raw, ok := decodeToken(tok, commitTokenPrefix)
288 if !ok {
289 return domain.ObjectID{}, 0, bad
290 }
291 parts := strings.Split(raw, ":")
292 if len(parts) != 3 {
293 return domain.ObjectID{}, 0, bad
294 }
295 head, err := domain.ParseObjectID(parts[0])
296 skip, err2 := strconv.Atoi(parts[1])
297 if err != nil || err2 != nil || skip < 0 || skip > MaxCommitSkip || parts[2] != pathDigest(path) {
298 return domain.ObjectID{}, 0, bad
299 }
300 return head, skip, nil
301}
302
303// GetCommit returns a commit with its statistics and its diff against the
304// first parent, within the default diff limits.
305func (b *Browse) GetCommit(ctx context.Context, p domain.Principal, repo domain.RepoName, rev domain.Revision) (domain.CommitDetail, error) {
306 if _, err := b.authorize(ctx, p, repo); err != nil {
307 return domain.CommitDetail{}, err
308 }
309 return b.reader.GetCommit(ctx, repo, rev, domain.DefaultDiffLimits())
310}