X-Git-Url: http://www.git.cypherpunks.ru/?p=gocheese.git;a=blobdiff_plain;f=upload.go;h=5ab1048c3cefd07b675493983d5d70c802bec80a;hp=3765c56cacb4108d0bfa5697f5372c1c3d8f6272;hb=HEAD;hpb=0f9a4972ff6b08ea3af9bfd17417df688de4e2bd

diff --git a/upload.go b/upload.go
index 3765c56..7e5ed2a 100644
--- a/upload.go
+++ b/upload.go
@@ -1,20 +1,18 @@
-/*
-GoCheese -- Python private package repository and caching proxy
-Copyright (C) 2019-2023 Sergey Matveev <stargrave@stargrave.org>
-              2019-2023 Elena Balakhonova <balakhonova_e@riseup.net>
-
-This program is free software: you can redistribute it and/or modify
-it under the terms of the GNU General Public License as published by
-the Free Software Foundation, version 3 of the License.
-
-This program is distributed in the hope that it will be useful,
-but WITHOUT ANY WARRANTY; without even the implied warranty of
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-GNU General Public License for more details.
-
-You should have received a copy of the GNU General Public License
-along with this program.  If not, see <http://www.gnu.org/licenses/>.
-*/
+// GoCheese -- Python private package repository and caching proxy
+// Copyright (C) 2019-2024 Sergey Matveev <stargrave@stargrave.org>
+//               2019-2024 Elena Balakhonova <balakhonova_e@riseup.net>
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, version 3 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 package main
 
@@ -38,19 +36,15 @@ import (
 var NormalizationRe = regexp.MustCompilePOSIX("[-_.]+")
 
 func serveUpload(w http.ResponseWriter, r *http.Request) {
-	// Authentication
-	username, password, ok := r.BasicAuth()
-	if !ok {
-		log.Println(r.RemoteAddr, "unauthenticated", username)
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+	user := r.Context().Value(CtxUserKey).(*User)
+	if user == nil {
+		log.Println(r.RemoteAddr, "unauthorised")
+		http.Error(w, "unauthorised", http.StatusUnauthorized)
 		return
 	}
-	PasswordsM.RLock()
-	auther, ok := Passwords[username]
-	PasswordsM.RUnlock()
-	if !ok || !auther.Auth(password) {
-		log.Println(r.RemoteAddr, "unauthenticated", username)
-		http.Error(w, "unauthenticated", http.StatusUnauthorized)
+	if user.ro {
+		log.Println(r.RemoteAddr, "ro user", user.name)
+		http.Error(w, "unauthorised", http.StatusUnauthorized)
 		return
 	}
 
@@ -67,7 +61,6 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
 	}
 	pkgName := strings.ToLower(NormalizationRe.ReplaceAllString(pkgNames[0], "-"))
 	dirPath := filepath.Join(Root, pkgName)
-	gpgSigsExpected := make(map[string]struct{})
 	now := time.Now().UTC()
 
 	var digestSHA256Expected []byte
@@ -96,8 +89,7 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
 
 	for _, file := range r.MultipartForm.File["content"] {
 		filename := file.Filename
-		gpgSigsExpected[filename+GPGSigExt] = struct{}{}
-		log.Println(r.RemoteAddr, "put", filename, "by", username)
+		log.Println(r.RemoteAddr, "put", filename, "by", user.name)
 		path := filepath.Join(dirPath, filename)
 		if _, err = os.Stat(path); err == nil {
 			log.Println(r.RemoteAddr, filename, "already exists")
@@ -166,7 +158,7 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
 				log.Println(r.RemoteAddr, filename, "good BLAKE2b-256 checksum received")
 			} else {
 				log.Println(r.RemoteAddr, filename, "bad BLAKE2b-256 checksum received")
-				http.Error(w, "bad blake2_256 checksum", http.StatusBadRequest)
+				http.Error(w, "bad blake2b_256 checksum", http.StatusBadRequest)
 				os.Remove(dst.Name())
 				return
 			}
@@ -193,40 +185,6 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 	}
-	for _, file := range r.MultipartForm.File["gpg_signature"] {
-		filename := file.Filename
-		if _, exists := gpgSigsExpected[filename]; !exists {
-			log.Println(r.RemoteAddr, filename, "unexpected GPG signature filename")
-			http.Error(w, "unexpected GPG signature filename", http.StatusBadRequest)
-			return
-		}
-		delete(gpgSigsExpected, filename)
-		log.Println(r.RemoteAddr, "put", filename, "by", username)
-		path := filepath.Join(dirPath, filename)
-		if _, err = os.Stat(path); err == nil {
-			log.Println(r.RemoteAddr, filename, "already exists")
-			http.Error(w, "already exists", http.StatusBadRequest)
-			return
-		}
-		src, err := file.Open()
-		if err != nil {
-			log.Println("error", r.RemoteAddr, filename, err)
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-		sig, err := io.ReadAll(src)
-		src.Close()
-		if err != nil {
-			log.Println("error", r.RemoteAddr, filename, err)
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-		if err = WriteFileSync(dirPath, path, sig, now); err != nil {
-			log.Println("error", r.RemoteAddr, path, err)
-			http.Error(w, err.Error(), http.StatusInternalServerError)
-			return
-		}
-	}
 
 	var buf bytes.Buffer
 	wr := recfile.NewWriter(&buf)
@@ -244,7 +202,7 @@ func serveUpload(w http.ResponseWriter, r *http.Request) {
 					})
 				}
 				if err != nil {
-					log.Fatalln(err)
+					log.Fatal(err)
 				}
 			}
 		}