jgit/org.eclipse.jgit.http.server/src/org/eclipse/jgit/http/server/resolver/AsIsFileService.java

/*
 * Copyright (C) 2009-2010, Google Inc. and others
 *
 * This program and the accompanying materials are made available under the
 * terms of the Eclipse Distribution License v. 1.0 which is available at
 * https://www.eclipse.org/org/documents/edl-v10.php.
 *
 * SPDX-License-Identifier: BSD-3-Clause
 */

package org.eclipse.jgit.http.server.resolver;

import javax.servlet.http.HttpServletRequest;

import org.eclipse.jgit.lib.Config;
import org.eclipse.jgit.lib.Repository;
import org.eclipse.jgit.transport.resolver.ServiceNotAuthorizedException;
import org.eclipse.jgit.transport.resolver.ServiceNotEnabledException;

/**
 * Controls access to bare files in a repository.
 * <p>
 * Older HTTP clients which do not speak the smart HTTP variant of the Git
 * protocol fetch from a repository by directly getting its objects and pack
 * files. This class, along with the {@code http.getanyfile} per-repository
 * configuration setting, can be used by
 * {@link org.eclipse.jgit.http.server.GitServlet} to control whether or not
 * these older clients are permitted to read these direct files.
 */
public class AsIsFileService {
	/** Always throws {@link ServiceNotEnabledException}. */
	public static final AsIsFileService DISABLED = new AsIsFileService() {
		@Override
		public void access(HttpServletRequest req, Repository db)
				throws ServiceNotEnabledException {
			throw new ServiceNotEnabledException();
		}
	};

	private static class ServiceConfig {
		final boolean enabled;

		ServiceConfig(Config cfg) {
			enabled = cfg.getBoolean("http", "getanyfile", true);
		}
	}

	/**
	 * Determine if {@code http.getanyfile} is enabled in the configuration.
	 *
	 * @param db
	 *            the repository to check.
	 * @return {@code false} if {@code http.getanyfile} was explicitly set to
	 *         {@code false} in the repository's configuration file; otherwise
	 *         {@code true}.
	 */
	protected static boolean isEnabled(Repository db) {
		return db.getConfig().get(ServiceConfig::new).enabled;
	}

	/**
	 * Determine if access to any bare file of the repository is allowed.
	 * <p>
	 * This method silently succeeds if the request is allowed, or fails by
	 * throwing a checked exception if access should be denied.
	 * <p>
	 * The default implementation of this method checks {@code http.getanyfile},
	 * throwing
	 * {@link org.eclipse.jgit.transport.resolver.ServiceNotEnabledException} if
	 * it was explicitly set to {@code false}, and otherwise succeeding
	 * silently.
	 *
	 * @param req
	 *            current HTTP request, in case information from the request may
	 *            help determine the access request.
	 * @param db
	 *            the repository the request would obtain a bare file from.
	 * @throws ServiceNotEnabledException
	 *             bare file access is not allowed on the target repository, by
	 *             any user, for any reason.
	 * @throws ServiceNotAuthorizedException
	 *             bare file access is not allowed for this HTTP request and
	 *             repository, such as due to a permission error.
	 */
	public void access(HttpServletRequest req, Repository db)
			throws ServiceNotEnabledException, ServiceNotAuthorizedException {
		if (!isEnabled(db))
			throw new ServiceNotEnabledException();
	}
}