Merge branch 'main' into encryption

Author: firu11

README.md

@@ -1,5 +1,5 @@
 # Git Calendar Core
-[![Go Report Card](https://goreportcard.com/badge/github.com/firu11/git-calendar-core)](https://goreportcard.com/report/github.com/firu11/git-calendar-core)
+[![Go Report Card](https://goreportcard.com/badge/github.com/git-calendar/core)](https://goreportcard.com/report/github.com/git-calendar/core)
 
 
 Related projects:
@@ -11,11 +11,7 @@ For Android and IOS bindings, make sure to install [gomobile](https://pkg.go.dev
 ```sh
 go install golang.org/x/mobile/cmd/gomobile@latest
 ```
-You can build for all platforms using:
-```sh
-make
-```
-or individually:
+You can build for specific platforms using:
 ```sh
 make [build_android|build_ios|build_web]
 ```

cmd/cors-proxy/README.md

@@ -27,11 +27,15 @@ podman run -d --rm \
 
 ### Enviroment variables (optional; those values are default)
 ```sh
-CORS_PROXY_HOST=0.0.0.0
-CORS_PROXY_PORT=8080
-CORS_PROXY_PRODUCTION=false
-CORS_PROXY_UPSTREAM_TIMEOUT=15s
-CORS_PROXY_MAX_RESPONSE_SIZE=1048576 # 1MB in bytes (1024^2)
+HOST=0.0.0.0
+PORT=8080
+PRODUCTION=false
+UPSTREAM_TIMEOUT=15s
+MAX_RESPONSE_SIZE=1048576 # 1MB in bytes (1024^2)
+ALLOWED_HOSTS=github.com,raw.githubusercontent.com,gitlab.com,codeberg.org
+RATE_TOKENS=40
+RATE_INTERVAL=1m
+RATE_IP_SOURCE_HEADER="" # useful when behind a reverse-proxy
 ```
 
 ## Usage
@@ -43,7 +47,7 @@ console.log(html);
 ```
 results in:
 ```
-Access to fetch at 'https://example.com' from origin 'https://...' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
+Access to fetch at 'https://github.com' from origin 'https://...' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
 ```
 
 ---
@@ -64,7 +68,7 @@ succeds!
 ## I already have a reverse-proxy
 When using a [bare Git repository](https://git-scm.com/book/en/v2/Git-on-the-Server-Getting-Git-on-a-Server) on a [VPS](https://en.wikipedia.org/wiki/Virtual_private_server) this proxy is not necessary, since you control the enviroment.
 
-You can use any [reverse-proxy](https://en.wikipedia.org/wiki/Reverse_proxy) of your choice (e.g. [Caddy](https://caddyserver.com/) or [Nginx](https://nginx.org/en/)), and just add the CORS headers there.\
+You can use any [reverse-proxy](https://en.wikipedia.org/wiki/Reverse_proxy) of your choice (e.g., [Caddy](https://caddyserver.com/) or [Nginx](https://nginx.org/en/)), and just add the CORS headers there.\
 Example configuration for Caddy:\
 (based on [this](https://www.jamesatkins.com/posts/git-over-http-with-caddy/) very cool article)
 ```caddyfile
@@ -114,6 +118,3 @@ your-repo-domain.com {
     }
 }
 ```
-
-## TODO 
-- rate-limiter (redis? for multi instance deployment)

cmd/cors-proxy/go.mod

@@ -0,0 +1,8 @@
+module github.com/git-calendar/core/cmd/cors-proxy
+
+go 1.25.5
+
+require (
+	github.com/sethvargo/go-limiter v1.1.0
+	github.com/sethvargo/go-envconfig v1.3.0
+)

cmd/cors-proxy/go.sum

@@ -0,0 +1,6 @@
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/sethvargo/go-envconfig v1.3.0 h1:gJs+Fuv8+f05omTpwWIu6KmuseFAXKrIaOZSh8RMt0U=
+github.com/sethvargo/go-envconfig v1.3.0/go.mod h1:JLd0KFWQYzyENqnEPWWZ49i4vzZo/6nRidxI8YvGiHw=
+github.com/sethvargo/go-limiter v1.1.0 h1:eLeZVQ2zqJOiEs03GguqmBVG6/T6lsZB+6PP1t7J6fA=
+github.com/sethvargo/go-limiter v1.1.0/go.mod h1:01b6tW25Ap+MeLYBuD4aHunMrJoNO5PVUFdS9rac3II=

cmd/cors-proxy/proxy.go

@@ -32,36 +32,22 @@ func main() {
 
 	s := &http.Server{
 		Addr:           fmt.Sprintf("%s:%s", cfg.Host, cfg.Port),
-		Handler:        accessLog(mux),
+		Handler:        accessLog(corsMiddleware(rateLimit(mux))),
 		ReadTimeout:    10 * time.Second,
 		WriteTimeout:   15 * time.Second,
 		MaxHeaderBytes: 64 << 10, // 1KB
 	}
 
-	slog.Info(fmt.Sprintf("configuration: %+v\n", *cfg))
+	slog.Info(fmt.Sprintf("configuration: %+v", *cfg))
 	slog.Info("running on " + s.Addr)
 
 	// run the proxy
 	if err := s.ListenAndServe(); err != nil {
-		slog.Error(err.Error())
 		panic(err)
 	}
 }
 
 func proxyHandler(w http.ResponseWriter, r *http.Request) {
-	// add cors headers to allow any browser to use this endpoint
-	w.Header().Set("Access-Control-Allow-Origin", "*") // TODO add real https://git-calendar.firu.dev or whatever
-	w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-	w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, Git-Protocol")
-
-	if r.Method == http.MethodOptions {
-		// this prevents the 405 from e.g. GitHub
-		// the browser only needs to get the CORS headers and OK for OPTIONS request,
-		// so that it knows its safe to send the real request
-		w.WriteHeader(http.StatusNoContent)
-		return
-	}
-
 	// get the destination url from query
 	destUrlQuery := r.URL.Query().Get("url")
 	if destUrlQuery == "" {

cmd/cors-proxy/utils.go

@@ -1,15 +1,20 @@
 package main
 
 import (
+	"context"
 	"log/slog"
 	"net"
 	"net/http"
 	"net/url"
-	"os"
 	"slices"
-	"strconv"
 	"strings"
 	"time"
+
+	"github.com/sethvargo/go-envconfig"
+	"github.com/sethvargo/go-limiter"
+	"github.com/sethvargo/go-limiter/httplimit"
+	"github.com/sethvargo/go-limiter/memorystore"
+	"github.com/sethvargo/go-limiter/noopstore"
 )
 
 // a transport used for destination requests
@@ -37,12 +42,65 @@ func isAllowedHost(u *url.URL) bool {
 
 // ------------------- middleware -------------------
 
+// Rate limits by IP.
+func rateLimit(next http.Handler) http.Handler {
+	var err error
+	var store limiter.Store
+
+	if cfg.Production {
+		store, err = memorystore.New(&memorystore.Config{
+			Tokens:   cfg.RateTokens,
+			Interval: cfg.RateInterval,
+		})
+	} else {
+		store, err = noopstore.New()
+	}
+	if err != nil {
+		panic(err)
+	}
+
+	var limitFunc httplimit.KeyFunc
+	if cfg.IpSourceHeader != "" {
+		limitFunc = httplimit.IPKeyFunc(cfg.IpSourceHeader)
+	} else {
+		limitFunc = httplimit.IPKeyFunc()
+	}
+
+	middleware, err := httplimit.NewMiddleware(store, limitFunc)
+	if err != nil {
+		panic(err)
+	}
+
+	return middleware.Handle(next)
+}
+
+// Adds CORS headers to allow any browser to use this endpoint.
+func corsMiddleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Access-Control-Allow-Origin", "*") // TODO: add real https://git-calendar.firu.dev or whatever
+		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, Git-Protocol")
+
+		// handle preflight OPTIONS request
+		if r.Method == http.MethodOptions {
+			// this prevents the 405 from e.g., GitHub
+			// the browser only needs to get the CORS headers and OK for OPTIONS request,
+			// so that it knows it's safe to send the real request
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+
+		next.ServeHTTP(w, r) // next handler
+	})
+}
+
+// Logs access after execution.
 func accessLog(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		start := time.Now() // start timer
 
 		ww := &responseWriter{ResponseWriter: w, status: http.StatusOK} // wrap the writer into our custom one
-		next.ServeHTTP(ww, r)                                           // execute handler
+		next.ServeHTTP(ww, r)                                           // next handler
 
 		duration := time.Since(start) // stop timer
 
@@ -54,7 +112,7 @@ func accessLog(next http.Handler) http.Handler {
 	})
 }
 
-// a http.ResponseWriter wrapper, which catches the status code for logging
+// A http.ResponseWriter wrapper, which catches the status code for logging.
 type responseWriter struct {
 	http.ResponseWriter
 	status int
@@ -105,55 +163,23 @@ func removeHopByHopHeaders(h http.Header) {
 
 // ------------------- config -------------------
 
-// External library? https://github.com/caarlos0/env
-// Overkill! (for now)
-
-const prefix = "CORS_PROXY_"
-
 type config struct {
-	Host            string
-	Port            string
-	Production      bool
-	UpstreamTimeout time.Duration
-	MaxResponseSize int64
-	AllowedHosts    []string
+	Host            string        `env:"HOST,default=0.0.0.0"`
+	Port            string        `env:"PORT,default=8080"`
+	Production      bool          `env:"PRODUCTION,default=false"`
+	UpstreamTimeout time.Duration `env:"UPSTREAM_TIMEOUT,default=15s"`
+	MaxResponseSize int64         `env:"MAX_RESPONSE_SIZE,default=1048576"` // 1MiB
+	AllowedHosts    []string      `env:"ALLOWED_HOSTS,default=github.com,raw.githubusercontent.com,gitlab.com,codeberg.org"`
+	RateTokens      uint64        `env:"RATE_TOKENS,default=40"` // 40 req/min should be ok for legit usage
+	RateInterval    time.Duration `env:"RATE_INTERVAL,default=1m"`
+	IpSourceHeader  string        `env:"RATE_IP_SOURCE_HEADER"` // for reverse proxy etc.
 }
 
 func loadConfig() {
-	cfg = &config{}
-	var err error
-
-	prodEnv := os.Getenv(prefix + "PRODUCTION")
-	cfg.Production = prodEnv == "true" || prodEnv == "1" || prodEnv == "True" || prodEnv == "TRUE"
-
-	cfg.Host = os.Getenv(prefix + "HOST") // empty is the same as 0.0.0.0
-	cfg.Port = os.Getenv(prefix + "PORT")
-	if cfg.Port == "" {
-		cfg.Port = "8080"
-	}
-
-	cfg.UpstreamTimeout, err = time.ParseDuration(os.Getenv(prefix + "UPSTREAM_TIMEOUT"))
-	if err != nil || cfg.MaxResponseSize == 0 {
-		cfg.UpstreamTimeout = 15 * time.Second
-	}
-
-	cfg.MaxResponseSize, err = strconv.ParseInt(os.Getenv(prefix+"MAX_RESPONSE_SIZE"), 10, 64)
-	if err != nil || cfg.MaxResponseSize == 0 {
-		cfg.MaxResponseSize = 1 << 20 // 1MB
-	}
+	cfg = envconfig.MustProcess(context.Background(), &config{})
 
-	rawHostsEnv := os.Getenv(prefix + "ALLOWED_HOSTS")
-	if len(rawHostsEnv) == 0 {
-		cfg.AllowedHosts = []string{
-			"github.com",
-			"raw.githubusercontent.com",
-			"gitlab.com",
-			"codeberg.org",
-		}
-	} else {
-		cfg.AllowedHosts = strings.Split(os.Getenv(prefix+"ALLOWED_HOSTS"), ",")
-		for i := range cfg.AllowedHosts {
-			cfg.AllowedHosts[i] = strings.TrimSpace(cfg.AllowedHosts[i]) // remove extra spaces: "  github.com"
-		}
+	// trim spaces for hosts
+	for i := range cfg.AllowedHosts {
+		cfg.AllowedHosts[i] = strings.TrimSpace(cfg.AllowedHosts[i])
 	}
 }

cmd/wasm/main.go

@@ -5,7 +5,7 @@ package main
 import (
 	"syscall/js"
 
-	"github.com/firu11/git-calendar-core/pkg/api"
+	"github.com/git-calendar/core/pkg/api"
 )
 
 // This is the starting point which gets called from JS.
@@ -85,9 +85,14 @@ func RegisterCallbacks(api *api.Api) {
 					return api.UpdateEvent(args[0].String())
 				})
 			}),
-			"updateEventWithStrategy": js.FuncOf(func(this js.Value, args []js.Value) any {
+			"updateRepeatingEvent": js.FuncOf(func(this js.Value, args []js.Value) any {
 				return wrapPromise(func() (any, error) {
-					return api.UpdateEventWithStrategy(args[0].String(), args[1].Int())
+					return api.UpdateRepeatingEvent(args[0].String(), args[1].String(), args[2].Int())
+				})
+			}),
+			"removeRepeatingEvent": js.FuncOf(func(this js.Value, args []js.Value) any {
+				return wrapPromise(func() (any, error) {
+					return nil, api.RemoveRepeatingEvent(args[0].String(), args[1].Int())
 				})
 			}),
 			// TODO others