Merge remote-tracking branch 'finos/main' into 946-associate-commits-by-email-rebase

Author: kriswest

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@finos/git-proxy",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "description": "Deploy custom push protections and policies on top of Git.",
   "scripts": {
     "cli": "node ./packages/git-proxy-cli/index.js",

package.json

@@ -2,7 +2,7 @@ import fs from 'fs';
 import _ from 'lodash';
 import Datastore from '@seald-io/nedb';
 import { Action } from '../../proxy/actions/Action';
-import { toClass } from '../helper';
+import { toClass, trimTrailingDotGit } from '../helper';
 import * as repo from './repo';
 import { PushQuery } from '../types';
 
@@ -138,7 +138,7 @@ export const canUserCancelPush = async (id: string, user: string) => {
       return;
     }
 
-    const repoName = pushDetail.repoName.replace('.git', '');
+    const repoName = trimTrailingDotGit(pushDetail.repoName);
     const isAllowed = await repo.isUserPushAllowed(repoName, user);
 
     if (isAllowed) {
@@ -156,7 +156,8 @@ export const canUserApproveRejectPush = async (id: string, user: string) => {
       resolve(false);
       return;
     }
-    const repoName = action.repoName.replace('.git', '');
+
+    const repoName = trimTrailingDotGit(action.repoName);
     const isAllowed = await repo.canUserApproveRejectPushRepo(repoName, user);
 
     resolve(isAllowed);

src/db/file/pushes.ts

@@ -3,3 +3,21 @@ export const toClass = function (obj: any, proto: any) {
   obj.__proto__ = proto;
   return obj;
 };
+
+export const trimTrailingDotGit = (str: string): string => {
+  const target = '.git';
+  if (str.endsWith(target)) {
+    // extract string from 0 to the end minus the length of target
+    return str.slice(0, -target.length);
+  }
+  return str;
+};
+
+export const trimPrefixRefsHeads = (str: string): string => {
+  const target = 'refs/heads/';
+  if (str.startsWith(target)) {
+    // extract string from the end of the target to the end of str
+    return str.slice(target.length);
+  }
+  return str;
+};

src/db/helper.ts

@@ -1,6 +1,6 @@
 import { connect, findDocuments, findOneDocument } from './helper';
 import { Action } from '../../proxy/actions';
-import { toClass } from '../helper';
+import { toClass, trimTrailingDotGit } from '../helper';
 import * as repo from './repo';
 import { Push, PushQuery } from '../types';
 
@@ -108,7 +108,7 @@ export const canUserApproveRejectPush = async (id: string, user: string) => {
       return;
     }
 
-    const repoName = action.repoName.replace('.git', '');
+    const repoName = trimTrailingDotGit(action.repoName);
     const isAllowed = await repo.canUserApproveRejectPushRepo(repoName, user);
 
     resolve(isAllowed);
@@ -123,7 +123,7 @@ export const canUserCancelPush = async (id: string, user: string) => {
       return;
     }
 
-    const repoName = pushDetail.repoName.replace('.git', '');
+    const repoName = trimTrailingDotGit(pushDetail.repoName);
     const isAllowed = await repo.isUserPushAllowed(repoName, user);
 
     if (isAllowed) {

src/db/mongo/pushes.ts

@@ -1,6 +1,7 @@
 import { Action, Step } from '../../actions';
 import { getRepos } from '../../../db';
 import { Repo } from '../../../db/types';
+import { trimTrailingDotGit } from '../../../db/helper';
 
 // Execute if the repo is approved
 const exec = async (
@@ -14,8 +15,8 @@ const exec = async (
   console.log(list);
 
   const found = list.find((x: Repo) => {
-    const targetName = action.repo.replace('.git', '').toLowerCase();
-    const allowedName = `${x.project}/${x.name}`.replace('.git', '').toLowerCase();
+    const targetName = trimTrailingDotGit(action.repo.toLowerCase());
+    const allowedName = trimTrailingDotGit(`${x.project}/${x.name}`.toLowerCase());
     console.log(`${targetName} = ${allowedName}`);
     return targetName === allowedName;
   });

src/proxy/processors/push-action/checkRepoInAuthorisedList.ts

@@ -1,11 +1,20 @@
 import { Action, Step } from '../../actions';
 import { getUsers, isUserPushAllowed } from '../../../db';
+import { trimTrailingDotGit } from '../../../db/helper';
 
 // Execute if the repo is approved
 const exec = async (req: any, action: Action): Promise<Action> => {
   const step = new Step('checkUserPushPermission');
 
-  const repoName = action.repo.split('/')[1].replace('.git', '');
+  const repoSplit = trimTrailingDotGit(action.repo.toLowerCase()).split('/');
+  // we expect there to be exactly one / separating org/repoName
+  if (repoSplit.length != 2) {
+    step.setError('Server-side issue extracting repoName');
+    action.addStep(step);
+    return action;
+  }
+  // pull the 2nd value of the split for repoName
+  const repoName = repoSplit[1];
   let isUserAllowed = false;
 
   // n.b. action.user will be set to whatever the user had set in their user.name config in their git client.

src/proxy/processors/push-action/checkUserPushPermission.ts

@@ -6,6 +6,7 @@ const passportLocal = require('../passport/local');
 const passportAD = require('../passport/activeDirectory');
 const authStrategies = require('../passport').authStrategies;
 const db = require('../../db');
+const { toPublicUser } = require('./publicApi');
 const { GIT_PROXY_UI_HOST: uiHost = 'http://localhost', GIT_PROXY_UI_PORT: uiPort = 3000 } =
   process.env;
 
@@ -46,6 +47,25 @@ const getLoginStrategy = () => {
   return enabledAppropriateLoginStrategies[0].type.toLowerCase();
 };
 
+const loginSuccessHandler = () => async (req, res) => {
+  try {
+    const currentUser = { ...req.user };
+    delete currentUser.password;
+    console.log(
+      `serivce.routes.auth.login: user logged in, username=${
+        currentUser.username
+      } profile=${JSON.stringify(currentUser)}`,
+    );
+    res.send({
+      message: 'success',
+      user: toPublicUser(currentUser),
+    });
+  } catch (e) {
+    console.log(`service.routes.auth.login: Error logging user in ${JSON.stringify(e)}`);
+    res.status(500).send('Failed to login').end();
+  }
+};
+
 // TODO: provide separate auth endpoints for each auth strategy or chain compatibile auth strategies
 // TODO: if providing separate auth methods, inform the frontend so it has relevant UI elements and appropriate client-side behavior
 router.post(
@@ -59,25 +79,7 @@ router.post(
     console.log('going to auth with', authType);
     return passport.authenticate(authType)(req, res, next);
   },
-  async (req, res) => {
-    try {
-      const currentUser = { ...req.user };
-      delete currentUser.password;
-      console.log(
-        `serivce.routes.auth.login: user logged in, username=${
-          currentUser.username
-        } profile=${JSON.stringify(currentUser)}`,
-      );
-      res.send({
-        message: 'success',
-        user: currentUser,
-      });
-    } catch (e) {
-      console.log(`service.routes.auth.login: Error logging user in ${JSON.stringify(e)}`);
-      res.status(500).send('Failed to login').end();
-      return;
-    }
-  },
+  loginSuccessHandler(),
 );
 
 router.get('/oidc', passport.authenticate(authStrategies['openidconnect'].type));
@@ -114,8 +116,7 @@ router.post('/logout', (req, res, next) => {
 router.get('/profile', async (req, res) => {
   if (req.user) {
     const userVal = await db.findUser(req.user.username);
-    delete userVal.password;
-    res.send(userVal);
+    res.send(toPublicUser(userVal));
   } else {
     res.status(401).end();
   }
@@ -160,14 +161,14 @@ router.post('/gitAccount', async (req, res) => {
 
 router.get('/me', async (req, res) => {
   if (req.user) {
-    const user = JSON.parse(JSON.stringify(req.user));
-    if (user && user.password) delete user.password;
-    const login = user.username;
-    const userVal = await db.findUser(login);
-    if (userVal && userVal.password) delete userVal.password;
-    res.send(userVal);
+    const userVal = await db.findUser(req.user.username);
+    res.send(toPublicUser(userVal));
   } else {
     res.status(401).end();
   }
 });
-module.exports = router;
+
+module.exports = {
+  router,
+  loginSuccessHandler
+};

src/service/routes/auth.js

@@ -10,7 +10,7 @@ const jwtAuthHandler = require('../passport/jwtAuthHandler');
 const router = new express.Router();
 
 router.use('/api', home);
-router.use('/api/auth', auth);
+router.use('/api/auth', auth.router);
 router.use('/api/v1/healthcheck', healthcheck);
 router.use('/api/v1/push', jwtAuthHandler(), push);
 router.use('/api/v1/repo', jwtAuthHandler(), repo);

src/service/routes/index.js

@@ -0,0 +1,10 @@
+export const toPublicUser = (user) => {
+  return {
+    username: user.username || '',
+    displayName: user.displayName || '',
+    email: user.email || '',
+    title: user.title || '',
+    gitAccount: user.gitAccount || '',
+    admin: user.admin || false,
+  }
+}