From 5e5cde1624b1b4ffd00efa73935c48e547a5a8d3 Mon Sep 17 00:00:00 2001
From: Rutger Broekhoff
Date: Sat, 30 Mar 2024 15:19:49 +0100
Subject: Restructure authorization flow

Tried to write verify_claims such that the happy path is to the left as
much as possible.
---
 server/src/main.rs | 97 +++++++++++++++++++++++++++++++-----------------------
 1 file changed, 56 insertions(+), 41 deletions(-)

(limited to 'server/src')

diff --git a/server/src/main.rs b/server/src/main.rs
index 4a88dcd..e615d19 100644
--- a/server/src/main.rs
+++ b/server/src/main.rs
@@ -762,28 +762,46 @@ fn authorize_batch(
         specific_claims: common::SpecificClaims::BatchApi(operation),
         repo_path,
     };
-    if verify_claims(conf, &claims, headers)? {
-        return Ok(Trusted(true));
+    if !verify_claims(conf, &claims, headers)? {
+        return authorize_batch_unauthenticated(conf, public, operation, headers);
     }
+    return Ok(Trusted(true));
+}
 
+fn authorize_batch_unauthenticated(
+    conf: &AuthorizationConfig,
+    public: bool,
+    operation: common::Operation,
+    headers: &HeaderMap,
+) -> Result<Trusted, GitLfsErrorResponse<'static>> {
     let trusted = forwarded_from_trusted_host(headers, &conf.trusted_forwarded_hosts)?;
-    if operation != common::Operation::Download {
-        if trusted {
+    match operation {
+        common::Operation::Upload => {
+            // Trusted users can clone all repositories (by virtue of accessing the server via a
+            // trusted network). However, they can not push without proper authentication. Untrusted
+            // users who are also not authenticated should not need to know which repositories exists.
+            // Therefore, we tell untrusted && unauthenticated users that the repo doesn't exist, but
+            // tell trusted users that they need to authenticate.
+            if !trusted {
+                return Err(REPO_NOT_FOUND);
+            }
             return Err(make_error_resp(
                 StatusCode::FORBIDDEN,
                 "Authentication required to upload",
             ));
+        },
+        common::Operation::Download => {
+            // Again, trusted users can see all repos. For untrusted users, we first need to check
+            // whether the repo is public before we authorize. If the user is untrusted and the
+            // repo isn't public, we just act like it doesn't even exist.
+            if !trusted {
+                if !public {
+                    return Err(REPO_NOT_FOUND)
+                }
+                return Ok(Trusted(false))
+            }
+            return Ok(Trusted(true));
         }
-        return Err(REPO_NOT_FOUND);
-    }
-    if trusted {
-        return Ok(Trusted(true));
-    }
-
-    if public {
-        Ok(Trusted(false))
-    } else {
-        Err(REPO_NOT_FOUND)
     }
 }
 
@@ -909,35 +927,32 @@ fn verify_claims(
     const INVALID_AUTHZ_HEADER: GitLfsErrorResponse =
         make_error_resp(StatusCode::BAD_REQUEST, "Invalid authorization header");
 
-    if let Some(authz) = headers.get(header::AUTHORIZATION) {
-        if let Ok(authz) = authz.to_str() {
-            if let Some(val) = authz.strip_prefix("Gitolfs3-Hmac-Sha256 ") {
-                let (tag, expires_at) = val.split_once(' ').ok_or(INVALID_AUTHZ_HEADER)?;
-                let tag: common::Digest<32> = tag.parse().map_err(|_| INVALID_AUTHZ_HEADER)?;
-                let expires_at: i64 = expires_at.parse().map_err(|_| INVALID_AUTHZ_HEADER)?;
-                let expires_at =
-                    DateTime::<Utc>::from_timestamp(expires_at, 0).ok_or(INVALID_AUTHZ_HEADER)?;
-                let Some(expected_tag) = common::generate_tag(
-                    common::Claims {
-                        specific_claims: claims.specific_claims,
-                        repo_path: claims.repo_path,
-                        expires_at,
-                    },
-                    &conf.key,
-                ) else {
-                    return Err(make_error_resp(
-                        StatusCode::INTERNAL_SERVER_ERROR,
-                        "Internal server error",
-                    ));
-                };
-                if tag == expected_tag {
-                    return Ok(true);
-                }
-            }
-        }
+    let Some(authz) = headers.get(header::AUTHORIZATION) else {
+        return Ok(false);
+    };
+    let authz = authz.to_str().map_err(|_| INVALID_AUTHZ_HEADER)?;
+    let val = authz.strip_prefix("Gitolfs3-Hmac-Sha256 ").ok_or(INVALID_AUTHZ_HEADER)?;
+    let (tag, expires_at) = val.split_once(' ').ok_or(INVALID_AUTHZ_HEADER)?;
+    let tag: common::Digest<32> = tag.parse().map_err(|_| INVALID_AUTHZ_HEADER)?;
+    let expires_at: i64 = expires_at.parse().map_err(|_| INVALID_AUTHZ_HEADER)?;
+    let expires_at =
+        DateTime::<Utc>::from_timestamp(expires_at, 0).ok_or(INVALID_AUTHZ_HEADER)?;
+    let expected_tag = common::generate_tag(
+        common::Claims {
+            specific_claims: claims.specific_claims,
+            repo_path: claims.repo_path,
+            expires_at,
+        },
+        &conf.key,
+    ).ok_or_else(|| make_error_resp(
+        StatusCode::INTERNAL_SERVER_ERROR,
+        "Internal server error",
+    ))?;
+    if tag != expected_tag {
         return Err(INVALID_AUTHZ_HEADER);
     }
-    Ok(false)
+
+    Ok(true)
 }
 
 fn authorize_get(
-- 
cgit v1.2.3