GnosysLabs/GitHop
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bind prompt history to Gitea's server-rendered session identity without an API token

Browse Source 
Hop-State: A_06FNB7D05ZQ3AHD1V0GY5P8
Hop-Proposal: R_06FNB7CDK6ZKM505CPR2DY8
Hop-Task: T_06FNB715NCG0M3SVDJAGHY8
Hop-Attempt: AT_06FNB715NCK5MKAVH59TE0G
This commit is contained in:
cyph3rasi
2026-07-12 02:17:01 -07:00
committed by Hop
parent 96cd6823b2
commit 6be764ec6e
4 changed files with 29 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/control-plane/internal/gitea/client.go
+15 -14
View File
@@ -10,6 +10,7 @@ import (
"net/http"
"net/url"
"regexp"
"strconv"
"strings"
"time"
)
@@ -17,8 +18,8 @@ import (
var ErrTokenNotConfigured = errors.New("gitea API token is not configured")
var (
settingsUsernameInput = regexp.MustCompile(`(?is)<input\b[^>]*\bid\s*=\s*["']username["'][^>]*>`)
settingsDataName = regexp.MustCompile(`(?is)\bdata-name\s*=\s*(?:"([^"]*)"|'([^']*)')`)
signedUserIDMeta = regexp.MustCompile(`(?is)<meta\s+name=["']hop-signed-user-id["']\s+content=["']([0-9]+)["']\s*/?>`)
signedUserLoginMeta = regexp.MustCompile(`(?is)<meta\s+name=["']hop-signed-user-login["']\s+content=(?:"([^"]*)"|'([^']*)')\s*/?>`)
)
type Repository struct {
@@ -135,8 +136,8 @@ func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bo
return User{}, false, nil
}
// Gitea's API user endpoint requires an API token and intentionally rejects
// browser sessions. The profile settings page is session-authenticated and
// renders the signed-in username in a stable input contract.
// browser sessions. The protected profile settings page includes Hop's custom
// server-rendered user identity metadata for the active Gitea session.
u := c.baseURL.JoinPath("user", "settings")
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
if err != nil {
@@ -163,24 +164,24 @@ func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bo
if err != nil {
return User{}, false, fmt.Errorf("read authenticated user settings: %w", err)
}
input := settingsUsernameInput.Find(body)
attribute := settingsDataName.FindSubmatch(input)
if len(attribute) != 3 {
idMatch := signedUserIDMeta.FindSubmatch(body)
loginMatch := signedUserLoginMeta.FindSubmatch(body)
if len(idMatch) != 2 || len(loginMatch) != 3 {
return User{}, false, errors.New("gitea settings page did not identify the signed-in user")
}
login := string(attribute[1])
id, err := strconv.ParseInt(string(idMatch[1]), 10, 64)
if err != nil || id <= 0 {
return User{}, false, errors.New("gitea settings page returned an invalid user ID")
}
login := string(loginMatch[1])
if login == "" {
login = string(attribute[2])
login = string(loginMatch[2])
}
login = strings.TrimSpace(html.UnescapeString(login))
if login == "" {
return User{}, false, errors.New("gitea settings page returned an empty username")
}
user, err := c.User(ctx, login)
if err != nil {
return User{}, false, fmt.Errorf("resolve authenticated user %q: %w", login, err)
}
return user, true, nil
return User{ID: id, Login: login}, true, nil
}
// ViewerCanReadRepository checks a browser's existing Gitea session against
services/control-plane/internal/gitea/client_test.go
+7 -14
View File
@@ -66,28 +66,21 @@ func TestUserUsesTokenAndDecodesStableID(t *testing.T) {
func TestAuthenticatedUserForwardsSessionCookie(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch r.URL.Path {
case "/user/settings":
if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
t.Fatalf("cookie = %q", got)
}
_, _ = w.Write([]byte(`<input id="username" name="name" value="alice" data-name="alice" required>`))
case "/api/v1/users/alice":
if got := r.Header.Get("Authorization"); got != "token gitea-token" {
t.Fatalf("authorization = %q", got)
}
_, _ = w.Write([]byte(`{"id":42,"login":"alice"}`))
default:
if r.URL.Path != "/user/settings" {
t.Fatalf("path = %q", r.URL.Path)
}
if got := r.Header.Get("Cookie"); got != "i_like_gitea=session" {
t.Fatalf("cookie = %q", got)
}
_, _ = w.Write([]byte(`<meta name="hop-signed-user-id" content="42"><meta name="hop-signed-user-login" content="alice">`))
}))
defer server.Close()
client, err := NewClient(server.URL, "gitea-token")
client, err := NewClient(server.URL, "")
if err != nil {
t.Fatal(err)
}
user, authenticated, err := client.AuthenticatedUser(context.Background(), "i_like_gitea=session")
if err != nil || !authenticated || user.ID != 42 {
if err != nil || !authenticated || user.ID != 42 || user.LoginName() != "alice" {
t.Fatalf("user = %#v, authenticated = %t, err = %v", user, authenticated, err)
}
}