Improve SSH cache

commit-id:b4c3585d

josh-proxy/Cargo.toml

@@ -44,3 +44,4 @@ url = "2.3.1"
 uuid = { version = "1.2.2", features = ["v4"] }
 josh-rpc = { path = "../josh-rpc" }
 tokio-util = "0.7.4"
+tempdir = "0.3.7"

josh-proxy/src/auth.rs

@@ -73,13 +73,6 @@ pub async fn check_auth(url: &str, auth: &Handle, required: bool) -> josh::JoshR
         return Ok(false);
     }
 
-    // If the upsteam is ssh we don't really handle authentication here.
-    // All we need is a username, the private key is expected to available localy.
-    // This is really not secure at all and should never be used in a production deployment.
-    if url.starts_with("ssh") {
-        return Ok(auth.hash != "");
-    }
-
     if let Some(last) = AUTH_TIMERS.lock()?.get(&(url.to_string(), auth.clone())) {
         let since = std::time::Instant::now().duration_since(*last);
         tracing::trace!("last: {:?}, since: {:?}", last, since);
@@ -99,47 +92,50 @@ pub async fn check_auth(url: &str, auth: &Handle, required: bool) -> josh::JoshR
         .get(auth)
         .unwrap_or(&Header { header: None })
         .to_owned();
-    let nurl = format!("{}/info/refs?service=git-upload-pack", url);
+    let refs_url = format!("{}/info/refs?service=git-upload-pack", url);
 
-    let builder = hyper::Request::builder().method("GET").uri(&nurl);
+    let builder = hyper::Request::builder()
+        .method(hyper::Method::GET)
+        .uri(&refs_url);
 
-    let builder = if let Some(h) = password.header {
-        builder.header("authorization", h)
+    let builder = if let Some(value) = password.header {
+        builder.header(hyper::header::AUTHORIZATION, value)
     } else {
         builder
     };
 
-    let r = builder.body(hyper::Body::empty())?;
-    let resp = client.request(r).await?;
+    let request = builder.body(hyper::Body::empty())?;
+    let resp = client.request(request).await?;
 
     let status = resp.status();
 
     tracing::trace!("http resp.status {:?}", resp.status());
 
-    let msg = format!("got http response: {} {:?}", nurl, resp);
+    let err_msg = format!("got http response: {} {:?}", refs_url, resp);
 
-    if status == 200 {
+    if status == hyper::StatusCode::OK {
         AUTH_TIMERS
             .lock()?
             .insert((url.to_string(), auth.clone()), std::time::Instant::now());
         Ok(true)
-    } else if status == 401 {
-        tracing::warn!("resp.status == 401: {:?}", &msg);
+    } else if status == hyper::StatusCode::UNAUTHORIZED {
+        tracing::warn!("resp.status == 401: {:?}", &err_msg);
         tracing::trace!(
             "body: {:?}",
             std::str::from_utf8(&hyper::body::to_bytes(resp.into_body()).await?)
         );
         Ok(false)
     } else {
-        return Err(josh::josh_error(&msg));
+        return Err(josh::josh_error(&err_msg));
     }
 }
 
 pub fn strip_auth(
     req: hyper::Request<hyper::Body>,
 ) -> josh::JoshResult<(Handle, hyper::Request<hyper::Body>)> {
     let mut req = req;
-    let header: Option<hyper::header::HeaderValue> = req.headers_mut().remove("authorization");
+    let header: Option<hyper::header::HeaderValue> =
+        req.headers_mut().remove(hyper::header::AUTHORIZATION);
 
     if let Some(header) = header {
         let hp = Handle {