modules/lfstransfer: call private LFS API

modules/lfstransfer/backend/backend.go

@@ -7,6 +7,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/base64"
+	"fmt"
 	"io"
 	"net/http"
 	"net/url"
@@ -36,6 +37,7 @@ type GiteaBackend struct {
 	server *url.URL
 	op     string
 	token  string
+	itoken string
 	logger transfer.Logger
 }
 
@@ -45,8 +47,8 @@ func New(ctx context.Context, repo, op, token string, logger transfer.Logger) (t
 	if err != nil {
 		return nil, err
 	}
-	server = server.JoinPath(repo, "info/lfs")
-	return &GiteaBackend{ctx: ctx, server: server, op: op, token: token, logger: logger}, nil
+	server = server.JoinPath("api/internal/repo", repo, "info/lfs")
+	return &GiteaBackend{ctx: ctx, server: server, op: op, token: token, itoken: fmt.Sprintf("Bearer %s", setting.InternalToken), logger: logger}, nil
 }
 
 // Batch implements transfer.Backend
@@ -71,7 +73,8 @@ func (g *GiteaBackend) Batch(_ string, pointers []transfer.BatchItem, args trans
 	}
 	url := g.server.JoinPath("objects/batch").String()
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerAccept:        mimeGitLFS,
 		headerContentType:   mimeGitLFS,
 	}
@@ -180,7 +183,8 @@ func (g *GiteaBackend) Download(oid string, args transfer.Args) (io.ReadCloser,
 	}
 	url := action.Href
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerAccept:        mimeOctetStream,
 	}
 	req := newInternalRequest(g.ctx, url, http.MethodGet, headers, nil)
@@ -225,7 +229,8 @@ func (g *GiteaBackend) Upload(oid string, size int64, r io.Reader, args transfer
 	}
 	url := action.Href
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerContentType:   mimeOctetStream,
 		headerContentLength: strconv.FormatInt(size, 10),
 	}
@@ -274,7 +279,8 @@ func (g *GiteaBackend) Verify(oid string, size int64, args transfer.Args) (trans
 	}
 	url := action.Href
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerAccept:        mimeGitLFS,
 		headerContentType:   mimeGitLFS,
 	}

modules/lfstransfer/backend/lock.go

@@ -25,12 +25,13 @@ type giteaLockBackend struct {
 	g      *GiteaBackend
 	server *url.URL
 	token  string
+	itoken string
 	logger transfer.Logger
 }
 
 func newGiteaLockBackend(g *GiteaBackend) transfer.LockBackend {
 	server := g.server.JoinPath("locks")
-	return &giteaLockBackend{ctx: g.ctx, g: g, server: server, token: g.token, logger: g.logger}
+	return &giteaLockBackend{ctx: g.ctx, g: g, server: server, token: g.token, itoken: g.itoken, logger: g.logger}
 }
 
 // Create implements transfer.LockBackend
@@ -44,7 +45,8 @@ func (g *giteaLockBackend) Create(path, refname string) (transfer.Lock, error) {
 	}
 	url := g.server.String()
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerAccept:        mimeGitLFS,
 		headerContentType:   mimeGitLFS,
 	}
@@ -95,7 +97,8 @@ func (g *giteaLockBackend) Unlock(lock transfer.Lock) error {
 	}
 	url := g.server.JoinPath(lock.ID(), "unlock").String()
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerAccept:        mimeGitLFS,
 		headerContentType:   mimeGitLFS,
 	}
@@ -177,7 +180,8 @@ func (g *giteaLockBackend) queryLocks(v url.Values) ([]transfer.Lock, string, er
 	urlq.RawQuery = v.Encode()
 	url := urlq.String()
 	headers := map[string]string{
-		headerAuthorisation: g.token,
+		headerAuthorisation: g.itoken,
+		headerAuthX:         g.token,
 		headerAccept:        mimeGitLFS,
 		headerContentType:   mimeGitLFS,
 	}

modules/lfstransfer/backend/util.go

@@ -22,6 +22,7 @@ import (
 const (
 	headerAccept        = "Accept"
 	headerAuthorisation = "Authorization"
+	headerAuthX         = "X-Auth"
 	headerContentType   = "Content-Type"
 	headerContentLength = "Content-Length"
 )

routers/private/internal.go

@@ -48,6 +48,14 @@ func bind[T any](_ T) any {
 	}
 }
 
+// SwapAuthToken swaps Authorization header with X-Auth header
+func swapAuthToken(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		req.Header.Set("Authorization", req.Header.Get("X-Auth"))
+		next.ServeHTTP(w, req)
+	})
+}
+
 // Routes registers all internal APIs routes to web application.
 // These APIs will be invoked by internal commands for example `gitea serv` and etc.
 func Routes() *web.Router {
@@ -98,7 +106,7 @@ func Routes() *web.Router {
 			r.Any("/*", func(ctx *context.Context) {
 				ctx.NotFound("", nil)
 			})
-		})
+		}, swapAuthToken)
 	}, common.Sessioner(), context.Contexter())
 	// end "/repo/{username}/{reponame}": git (LFS) API mirror