Fix issue checking out branches/tags on private repos

Use authentication for remote repository operations that use go-git to
ensure we can read remote references in private repositories.

Project clone now always checks for a credentials file mounted to the
DWO hard-coded credentials path (/.git-credentials/credentials) and
attempts to use credentials from there if they match on hostname.

For information purposes, project clone now logs whether or not a
personal-access-token was found.

Signed-off-by: Angel Misevski <[email protected]>

Author: amisevsk

project-clone/internal/git/operations.go

@@ -24,6 +24,7 @@ import (
 	gitConfig "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 
+	"github.com/devfile/devworkspace-operator/project-clone/internal"
 	"github.com/devfile/devworkspace-operator/project-clone/internal/shell"
 )
 
@@ -113,7 +114,13 @@ func CheckoutReference(repo *git.Repository, project *dw.Project, projectPath st
 		return fmt.Errorf("could not find remote %s: %s", defaultRemoteName, err)
 	}
 
-	refs, err := remote.List(&git.ListOptions{})
+	auth, err := internal.GetAuthForHost(remote.Config().URLs[0])
+	if err != nil {
+		log.Printf("Error reading credentials file: %s", err)
+	}
+	refs, err := remote.List(&git.ListOptions{
+		Auth: auth,
+	})
 	if err != nil {
 		return fmt.Errorf("failed to read remote %s: %s", defaultRemoteName, err)
 	}

project-clone/internal/global.go

@@ -16,15 +16,28 @@
 package internal
 
 import (
+	"errors"
+	"fmt"
 	"log"
 	"os"
+	"regexp"
 
 	"github.com/devfile/devworkspace-operator/pkg/library/constants"
+	gittransport "github.com/go-git/go-git/v5/plumbing/transport"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
+	gitssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
+)
+
+const (
+	credentialsMountPath = "/.git-credentials/credentials"
 )
 
 var (
-	ProjectsRoot string
-	CloneTmpDir  string
+	ProjectsRoot     string
+	CloneTmpDir      string
+	tokenAuthMethod  map[string]*githttp.BasicAuth
+	sshAuthMethod    *gitssh.PublicKeys
+	credentialsRegex = regexp.MustCompile(`https://(.+):(.+)@(.+)`)
 )
 
 // Read and store ProjectsRoot env var for reuse throughout project-clone.
@@ -43,4 +56,60 @@ func init() {
 	}
 	log.Printf("Using temporary directory %s", tmpDir)
 	CloneTmpDir = tmpDir
+
+	setupAuth()
+}
+
+func GetAuthForHost(repoURLStr string) (gittransport.AuthMethod, error) {
+	endpoint, err := gittransport.NewEndpoint(repoURLStr)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse url: %w", err)
+	}
+	switch endpoint.Protocol {
+	case "ssh":
+		// TODO
+		return nil, fmt.Errorf("SSH support not yet implemented")
+	case "http", "https":
+		authMethod, ok := tokenAuthMethod[endpoint.Host]
+		if !ok {
+			log.Printf("No personal access token found for URL %s", repoURLStr)
+			return nil, nil
+		}
+		log.Printf("Found personal access token for URL %s", repoURLStr)
+		return authMethod, nil
+	default:
+		log.Printf("No personal access token for URL %s; unsupported protocol: %s", repoURLStr, endpoint.Protocol)
+	}
+	return nil, nil
+}
+
+func setupAuth() {
+	gitCredentials, err := os.ReadFile(credentialsMountPath)
+	if err != nil {
+		// If file does not exist, no credentials to mount
+		if !errors.Is(err, os.ErrNotExist) {
+			log.Printf("Unexpected error reading git credentials file: %s", err)
+			os.Exit(1)
+		}
+	} else {
+		tokenAuthMethod = parseCredentialsFile(string(gitCredentials))
+	}
+}
+
+func parseCredentialsFile(gitCredentials string) map[string]*githttp.BasicAuth {
+	result := map[string]*githttp.BasicAuth{}
+	matches := credentialsRegex.FindAllStringSubmatch(gitCredentials, -1)
+	for idx, credential := range matches {
+		if len(credential) != 4 {
+			log.Printf("Malformed credential found in credentials file on line %d. Skipping", idx+1)
+		}
+		username := credential[1]
+		pat := credential[2]
+		url := credential[3]
+		result[url] = &githttp.BasicAuth{
+			Username: username,
+			Password: pat,
+		}
+	}
+	return result
 }

project-clone/main.go

@@ -34,7 +34,6 @@ const (
 )
 
 // TODO: Handle sparse checkout
-// TODO: Add support for auth
 func main() {
 	f, err := os.Create(tmpLogFilePath)
 	if err != nil {