Recognize authenticated Gitea browser sessions without weakening per-user prompt isolation

Hop-State: A_06FNB6HTKZAXH2SX1G8AB0R
Hop-Proposal: R_06FNB6HA40Y1E1T39G6YJHG
Hop-Task: T_06FNB5TE4DHAVABVH82WBN8
Hop-Attempt: AT_06FNB5TE4FW7MD6KTFYP3EG

services/control-plane/internal/gitea/client.go

@@ -5,14 +5,22 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"html"
+	"io"
 	"net/http"
 	"net/url"
+	"regexp"
 	"strings"
 	"time"
 )
 
 var ErrTokenNotConfigured = errors.New("gitea API token is not configured")
 
+var (
+	settingsUsernameInput = regexp.MustCompile(`(?is)<input\b[^>]*\bid\s*=\s*["']username["'][^>]*>`)
+	settingsDataName      = regexp.MustCompile(`(?is)\bdata-name\s*=\s*(?:"([^"]*)"|'([^']*)')`)
+)
+
 type Repository struct {
 	ID            int64  `json:"id"`
 	Owner         Owner  `json:"owner"`
@@ -126,51 +134,71 @@ func (c *Client) AuthenticatedUser(ctx context.Context, cookie string) (User, bo
 	if strings.TrimSpace(cookie) == "" {
 		return User{}, false, nil
 	}
-	u := c.baseURL.JoinPath("api", "v1", "user")
+	// Gitea's API user endpoint requires an API token and intentionally rejects
+	// browser sessions. The profile settings page is session-authenticated and
+	// renders the signed-in username in a stable input contract.
+	u := c.baseURL.JoinPath("user", "settings")
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 	if err != nil {
 		return User{}, false, err
 	}
 	req.Header.Set("Cookie", cookie)
-	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Accept", "text/html")
 
-	resp, err := c.http.Do(req)
+	resp, err := c.doWithoutRedirect(req)
 	if err != nil {
 		return User{}, false, fmt.Errorf("load authenticated user: %w", err)
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+	switch resp.StatusCode {
+	case http.StatusFound, http.StatusSeeOther, http.StatusTemporaryRedirect, http.StatusPermanentRedirect,
+		http.StatusUnauthorized, http.StatusForbidden:
 		return User{}, false, nil
-	}
-	if resp.StatusCode != http.StatusOK {
+	case http.StatusOK:
+		// Continue below.
+	default:
 		return User{}, false, fmt.Errorf("gitea authenticated user lookup returned %s", resp.Status)
 	}
-	var user User
-	if err := json.NewDecoder(resp.Body).Decode(&user); err != nil {
-		return User{}, false, fmt.Errorf("decode authenticated user: %w", err)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 2<<20))
+	if err != nil {
+		return User{}, false, fmt.Errorf("read authenticated user settings: %w", err)
 	}
-	if user.ID <= 0 || user.LoginName() == "" {
-		return User{}, false, errors.New("gitea returned an incomplete authenticated user")
+	input := settingsUsernameInput.Find(body)
+	attribute := settingsDataName.FindSubmatch(input)
+	if len(attribute) != 3 {
+		return User{}, false, errors.New("gitea settings page did not identify the signed-in user")
+	}
+	login := string(attribute[1])
+	if login == "" {
+		login = string(attribute[2])
+	}
+	login = strings.TrimSpace(html.UnescapeString(login))
+	if login == "" {
+		return User{}, false, errors.New("gitea settings page returned an empty username")
+	}
+	user, err := c.User(ctx, login)
+	if err != nil {
+		return User{}, false, fmt.Errorf("resolve authenticated user %q: %w", login, err)
 	}
 	return user, true, nil
 }
 
-// ViewerCanReadRepository checks a browser's existing Gitea session before
-// returning prompt data. Prompts may contain sensitive intent, so the Hop API
-// must never turn a private repository into a public metadata feed.
+// ViewerCanReadRepository checks a browser's existing Gitea session against
+// the repository web route. Gitea API routes require API tokens and do not
+// recognize browser sessions.
 func (c *Client) ViewerCanReadRepository(ctx context.Context, cookie, owner, name string) (bool, error) {
 	if strings.TrimSpace(cookie) == "" {
 		return false, nil
 	}
-	u := c.baseURL.JoinPath("api", "v1", "repos", owner, name)
+	u := c.baseURL.JoinPath(owner, name)
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 	if err != nil {
 		return false, err
 	}
 	req.Header.Set("Cookie", cookie)
-	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Accept", "text/html")
 
-	resp, err := c.http.Do(req)
+	resp, err := c.doWithoutRedirect(req)
 	if err != nil {
 		return false, fmt.Errorf("check viewer repository access: %w", err)
 	}
@@ -178,9 +206,18 @@ func (c *Client) ViewerCanReadRepository(ctx context.Context, cookie, owner, nam
 	switch resp.StatusCode {
 	case http.StatusOK:
 		return true, nil
-	case http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound:
+	case http.StatusFound, http.StatusSeeOther, http.StatusTemporaryRedirect, http.StatusPermanentRedirect,
+		http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound:
 		return false, nil
 	default:
 		return false, fmt.Errorf("gitea viewer repository check returned %s", resp.Status)
 	}
 }
+
+func (c *Client) doWithoutRedirect(req *http.Request) (*http.Response, error) {
+	client := *c.http
+	client.CheckRedirect = func(*http.Request, []*http.Request) error {
+		return http.ErrUseLastResponse
+	}
+	return client.Do(req)
+}