GnosysLabs/GitHop
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bind prompt history to Gitea's server-rendered session identity without an API token

Browse Source 
Hop-State: A_06FNB7D05ZQ3AHD1V0GY5P8
Hop-Proposal: R_06FNB7CDK6ZKM505CPR2DY8
Hop-Task: T_06FNB715NCG0M3SVDJAGHY8
Hop-Attempt: AT_06FNB715NCK5MKAVH59TE0G
This commit is contained in:
cyph3rasi
2026-07-12 02:17:01 -07:00
committed by Hop
parent 96cd6823b2
commit 6be764ec6e
4 changed files with 29 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/control-plane/internal/gitea/client.go
+15 -14
View File
@@ -10,6 +10,7 @@ import (
"net/http"
"net/url"
"regexp"
"strconv"
"strings"
"time"
)
@@ -17,8 +18,8 @@ import (
var ErrTokenNotConfigured = errors.New("gitea API token is not configured")
var (
settingsUsernameInput = regexp.MustCompile(`(?is)<input\b[^>]*\bid\s*=\s*["']username["'][^>]*>`)
settingsDataName = regexp.MustCompile(`(?is)\bdata-name\s*=\s*(?:"([^"]*)"|'([^']*)')`)
signedUserIDMeta = regexp.MustCompile(`(?is)<meta\s+name=["']hop-signed-user-id["']\s+content=["']([0-9]+)["']\s*/?>`)
signedUserLoginMeta = regexp.MustCompile(`(?is)<meta\s+name=["']hop-signed-user-login["']\s+content=(?:"([^"]*)"|'([^']*)')\s*/?>`)
)
type Repository struct {
@@ -135,8 +136,8 @@ func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bo
return User{}, false, nil
}
// Gitea's API user endpoint requires an API token and intentionally rejects
// browser sessions. The profile settings page is session-authenticated and
// renders the signed-in username in a stable input contract.
// browser sessions. The protected profile settings page includes Hop's custom
// server-rendered user identity metadata for the active Gitea session.
u := c.baseURL.JoinPath("user", "settings")
req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
if err != nil {
@@ -163,24 +164,24 @@ func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bo
if err != nil {
return User{}, false, fmt.Errorf("read authenticated user settings: %w", err)
}
input := settingsUsernameInput.Find(body)
attribute := settingsDataName.FindSubmatch(input)
if len(attribute) != 3 {
idMatch := signedUserIDMeta.FindSubmatch(body)
loginMatch := signedUserLoginMeta.FindSubmatch(body)
if len(idMatch) != 2 || len(loginMatch) != 3 {
return User{}, false, errors.New("gitea settings page did not identify the signed-in user")
}
login := string(attribute[1])
id, err := strconv.ParseInt(string(idMatch[1]), 10, 64)
if err != nil || id <= 0 {
return User{}, false, errors.New("gitea settings page returned an invalid user ID")
}
login := string(loginMatch[1])
if login == "" {
login = string(attribute[2])
login = string(loginMatch[2])
}
login = strings.TrimSpace(html.UnescapeString(login))
if login == "" {
return User{}, false, errors.New("gitea settings page returned an empty username")
}
user, err := c.User(ctx, login)
if err != nil {
return User{}, false, fmt.Errorf("resolve authenticated user %q: %w", login, err)
}
return user, true, nil
return User{ID: id, Login: login}, true, nil
}
// ViewerCanReadRepository checks a browser's existing Gitea session against