collin/anvil · 2b6114fa

Initial commit: anvil — a minimal git forge in Rust on gitoxide

Collin Richards · 2026-06-09 18:03 UTC · 2b6114fae9e5cf8bb66835db9ec6db2a961651c7 · browse files

added.gitignore+6 −0

addedCargo.lock+4860 −0

addedCargo.toml+51 −0

addedREADME.md+41 −0

addedTODO.md+6 −0

addedanvil.example.toml+19 −0

addedcrates/anvil-core/Cargo.toml+22 −0

addedcrates/anvil-core/src/access.rs+23 −0

addedcrates/anvil-core/src/config.rs+145 −0

addedcrates/anvil-core/src/db.rs+36 −0

addedcrates/anvil-core/src/error.rs+32 −0

addedcrates/anvil-core/src/lib.rs+60 −0

addedcrates/anvil-core/src/models.rs+67 −0

addedcrates/anvil-core/src/repos.rs+156 −0

addedcrates/anvil-core/src/sessions.rs+79 −0

addedcrates/anvil-core/src/ssh_keys.rs+98 −0

addedcrates/anvil-core/src/storage.rs+87 −0

addedcrates/anvil-core/src/users.rs+112 −0

addedcrates/anvil-git/Cargo.toml+16 −0

addedcrates/anvil-git/src/browse.rs+300 −0

addedcrates/anvil-git/src/error.rs+18 −0

addedcrates/anvil-git/src/lib.rs+28 −0

addedcrates/anvil-git/src/smart_http.rs+155 −0

addedcrates/anvil-git/src/ssh.rs+228 −0

addedcrates/anvil-ssh/Cargo.toml+16 −0

addedcrates/anvil-ssh/src/lib.rs+275 −0

addedcrates/anvil-web/Cargo.toml+24 −0

addedcrates/anvil-web/assets/htmx.min.js+1 −0

addedcrates/anvil-web/src/auth.rs+156 −0

addedcrates/anvil-web/src/git_http.rs+221 −0

addedcrates/anvil-web/src/lib.rs+51 −0

addedcrates/anvil-web/src/ui.rs+1055 −0

addedcrates/anvil/Cargo.toml+23 −0

addedcrates/anvil/src/main.rs+214 −0

addedrustfmt.toml+7 −0

addedvendor/gitserver-core/Cargo.toml+25 −0

addedvendor/gitserver-core/LICENSE+373 −0

addedvendor/gitserver-core/NOTICE+7 −0

addedvendor/gitserver-core/UPSTREAM-LICENSE+21 −0

addedvendor/gitserver-core/VENDOR.md+27 −0

addedvendor/gitserver-core/src/backend.rs+251 −0

addedvendor/gitserver-core/src/discovery.rs+305 −0

addedvendor/gitserver-core/src/dynamic_registry.rs+275 −0

addedvendor/gitserver-core/src/error.rs+47 −0

addedvendor/gitserver-core/src/lib.rs+10 −0

addedvendor/gitserver-core/src/pack.rs+848 −0

addedvendor/gitserver-core/src/path.rs+103 −0

addedvendor/gitserver-core/src/pktline.rs+58 −0

addedvendor/gitserver-core/src/protocol_v2.rs+752 −0

addedvendor/gitserver-core/src/receive_pack.rs+562 −0

addedvendor/gitserver-core/src/refs.rs+223 −0

1	+	/target
2	+	/data
3	+	*.db
4	+	*.db-wal
5	+	*.db-shm
6	+	anvil.toml

1	+	[workspace]
2	+	resolver = "2"
3	+	members = [
4	+	"crates/*",
5	+	"vendor/gitserver-core",
6	+	]
7	+
8	+	[workspace.package]
9	+	version = "0.0.0"
10	+	edition = "2024"
11	+	license = "MIT OR Apache-2.0"
12	+	repository = "https://github.com/richardscollin/anvil"
13	+	rust-version = "1.95"
14	+
15	+	[workspace.dependencies]
16	+	# Internal crates
17	+	anvil-core = { path = "crates/anvil-core" }
18	+	anvil-git = { path = "crates/anvil-git" }
19	+	anvil-web = { path = "crates/anvil-web" }
20	+	anvil-ssh = { path = "crates/anvil-ssh" }
21	+
22	+	anyhow = "1"
23	+	argon2 = { version = "0.5", features = ["std"] }
24	+	axum = "0.8"
25	+	axum-extra = { version = "0.10", features = ["cookie"] }
26	+	base64 = "0.22"
27	+	clap = { version = "4", features = ["derive"] }
28	+	gitserver-core = { path = "vendor/gitserver-core" }
29	+	gix = { version = "0.84", default-features = false, features = ["sha1", "max-performance-safe", "blob-diff", "revision"] }
30	+	gix-pack = { version = "0.71", features = ["sha1"] }
31	+	maud = { version = "0.27", features = ["axum"] }
32	+	rand = "0.10"
33	+	serde = { version = "1", features = ["derive"] }
34	+	similar = "2"
35	+	syntect = { version = "5", default-features = false, features = ["default-fancy"] }
36	+	thiserror = "2"
37	+	time = { version = "0.3", features = ["serde", "formatting"] }
38	+	toasty = { version = "0.7", features = ["sqlite"] }
39	+	tokio = { version = "1", features = ["full"] }
40	+	tokio-util = { version = "0.7", features = ["io"] }
41	+	toml = "0.8"
42	+	tower = "0.5"
43	+	tower-http = { version = "0.6", features = ["trace", "fs"] }
44	+	tracing = "0.1"
45	+	tracing-subscriber = { version = "0.3", features = ["env-filter"] }
46	+
47	+	# ssh
48	+	russh = "0.61"
49	+	# ssh-key parsing/fingerprinting, shared by anvil-core (storage) and anvil-ssh
50	+	# (auth). Pinned to match russh's transitive ssh-key so fingerprints agree.
51	+	ssh-key = "0.7.0-rc.10"

1	+	# anvil
2	+
3	+	A minimal self-hosted git forge in Rust, built on [gix (gitoxide)](https://github.com/GitoxideLabs/gitoxide).
4	+	Modeled on Gitea's basic feature set: repository hosting, web code browsing,
5	+	the git smart protocols (HTTP and SSH), issues, pull requests, users/orgs with
6	+	access control, and webhooks. No wiki, no CI/CD.
7	+
8	+	## Status
9	+
10	+	Early development. Milestone 1 (workspace scaffold + storage) is in place:
11	+	`anvild` can initialize its database and create users and bare repositories on
12	+	disk. The git wire protocol, web UI, and SSH transport follow.
13	+
14	+	## Architecture
15	+
16	+	A Cargo workspace. The keystone is `anvil-git`: gix is a client library
17	+	with no server-side protocol, so anvil supplies its own transport-agnostic
18	+	`upload-pack`/`receive-pack` (smart-HTTP and SSH share one implementation).
19	+
20	+	\| Crate \| Responsibility \|
21	+	\|--------------\|----------------\|
22	+	\| `anvil-core` \| Domain model, SQLite persistence, on-disk bare-repo storage \|
23	+	\| `anvil-git` \| Server-side git wire protocol on gix (upstream-candidate) \|
24	+	\| `anvil-web` \| axum HTTP server: web UI + smart-HTTP git endpoints \|
25	+	\| `anvil-ssh` \| git-over-SSH (russh) \|
26	+	\| `anvil` \| `anvild` daemon + admin CLI \|
27	+
28	+	## Quick start
29	+
30	+	```sh
31	+	cargo run -- migrate # create data/ + database
32	+	cargo run -- user create alice --password secret # create a user
33	+	cargo run -- repo create alice/hello # create a bare repo on disk
34	+	cargo run -- serve # start the server
35	+	```
36	+
37	+	Configuration is optional; see [`anvil.example.toml`](anvil.example.toml).
38	+
39	+	## License
40	+
41	+	MIT OR Apache-2.0.

1	+	- [ ] don't expose a users email on their profile page
2	+	- [ ] implement github action style CI feature
3	+	- I want to get this to a sufficient state that we could bootstrap this app using this CI and automate deployments if we wished
4	+	- probably might want to have other isolated anvil workers or something running for CI jobs
5	+	- [ ] implement github pages style hosting feature
6	+	- [ ] security audit

1	+	# anvil configuration. Copy to `anvil.toml` and edit. All fields are optional;
2	+	# omitted fields fall back to the defaults shown here.
3	+
4	+	# Root directory for all server state (database + repositories).
5	+	data_dir = "data"
6	+
7	+	[http]
8	+	listen = "127.0.0.1:3000"
9	+	base_url = "http://localhost:3000"
10	+
11	+	[ssh]
12	+	enabled = false
13	+	# Internal bind address. Under Docker, set host = "0.0.0.0" and forward the port.
14	+	listen = "127.0.0.1:2222"
15	+	# What to show users in SSH clone URLs. Set clone_port to the externally
16	+	# forwarded port if it differs from the internal bind (e.g. Docker -p 2200:2222).
17	+	clone_host = "localhost"
18	+	clone_port = 2222
19	+	clone_user = "git"

1	+	[package]
2	+	name = "anvil-core"
3	+	version.workspace = true
4	+	edition.workspace = true
5	+	license.workspace = true
6	+	repository.workspace = true
7	+	rust-version.workspace = true
8	+	description = "Domain model, persistence, and on-disk repository storage for the anvil git forge."
9	+
10	+	[dependencies]
11	+	gix.workspace = true
12	+	toasty.workspace = true
13	+	argon2.workspace = true
14	+	ssh-key.workspace = true
15	+	serde.workspace = true
16	+	toml.workspace = true
17	+	thiserror.workspace = true
18	+	tracing.workspace = true
19	+
20	+	[dev-dependencies]
21	+	tokio = { workspace = true }
22	+	tempfile = "3"

1	+	//! Authorization rules for repositories.
2	+	//!
3	+	//! The model is deliberately simple, matching a personal / small-team forge:
4	+	//! a repo is owned by one user; private repos are visible only to their owner;
5	+	//! writes (push) and settings changes are owner-only. Admins may do anything.
6	+
7	+	use crate::models::{
8	+	Repository,
9	+	User,
10	+	};
11	+
12	+	/// Whether `viewer` may read (browse / clone) `repo`.
13	+	pub fn can_read(repo: &Repository, viewer: Option<&User>) -> bool {
14	+	!repo.is_private \|\| can_write(repo, viewer)
15	+	}
16	+
17	+	/// Whether `viewer` may write (push) to / administer `repo`.
18	+	pub fn can_write(repo: &Repository, viewer: Option<&User>) -> bool {
19	+	match viewer {
20	+	Some(user) => user.id == repo.owner_id \|\| user.is_admin,
21	+	None => false,
22	+	}
23	+	}

1	+	//! Server configuration: loaded from a TOML file with sensible defaults.
2	+
3	+	use std::path::{
4	+	Path,
5	+	PathBuf,
6	+	};
7	+
8	+	use serde::{
9	+	Deserialize,
10	+	Serialize,
11	+	};
12	+
13	+	use crate::error::{
14	+	Error,
15	+	Result,
16	+	};
17	+
18	+	/// Top-level anvil configuration.
19	+	///
20	+	/// Load with [`Config::load`] (from a TOML file) or [`Config::default`].
21	+	#[derive(Debug, Clone, Serialize, Deserialize)]
22	+	#[serde(default)]
23	+	pub struct Config {
24	+	/// Root directory holding all server state (database + repositories).
25	+	pub data_dir: PathBuf,
26	+	/// HTTP server settings.
27	+	pub http: HttpConfig,
28	+	/// SSH server settings.
29	+	pub ssh: SshConfig,
30	+	}
31	+
32	+	#[derive(Debug, Clone, Serialize, Deserialize)]
33	+	#[serde(default)]
34	+	pub struct HttpConfig {
35	+	/// Address the HTTP server binds to, e.g. `127.0.0.1:3000`.
36	+	pub listen: String,
37	+	/// Externally visible base URL, used when constructing clone URLs.
38	+	pub base_url: String,
39	+	}
40	+
41	+	#[derive(Debug, Clone, Serialize, Deserialize)]
42	+	#[serde(default)]
43	+	pub struct SshConfig {
44	+	/// Whether the SSH git transport is enabled.
45	+	pub enabled: bool,
46	+	/// Address the SSH server binds to internally, e.g. `0.0.0.0:2222`. Under
47	+	/// Docker this is the in-container bind, which may differ from the
48	+	/// externally forwarded port — see the `clone_*` fields below.
49	+	pub listen: String,
50	+	/// Hostname shown in SSH clone URLs (what users actually connect to).
51	+	pub clone_host: String,
52	+	/// Port shown in SSH clone URLs. Set this to the externally forwarded
53	+	/// port when it differs from the internal bind (e.g. Docker `-p 2200:2222`).
54	+	pub clone_port: u16,
55	+	/// Username shown in SSH clone URLs (conventionally `git`).
56	+	pub clone_user: String,
57	+	}
58	+
59	+	impl Default for Config {
60	+	fn default() -> Self {
61	+	Self {
62	+	data_dir: PathBuf::from("data"),
63	+	http: HttpConfig::default(),
64	+	ssh: SshConfig::default(),
65	+	}
66	+	}
67	+	}
68	+
69	+	impl Default for HttpConfig {
70	+	fn default() -> Self {
71	+	Self {
72	+	listen: "127.0.0.1:3000".to_string(),
73	+	base_url: "http://localhost:3000".to_string(),
74	+	}
75	+	}
76	+	}
77	+
78	+	impl Default for SshConfig {
79	+	fn default() -> Self {
80	+	Self {
81	+	enabled: false,
82	+	listen: "127.0.0.1:2222".to_string(),
83	+	clone_host: "localhost".to_string(),
84	+	clone_port: 2222,
85	+	clone_user: "git".to_string(),
86	+	}
87	+	}
88	+	}
89	+
90	+	impl Config {
91	+	/// Load configuration from a TOML file. Missing fields fall back to defaults.
92	+	pub fn load(path: impl AsRef<Path>) -> Result<Self> {
93	+	let path = path.as_ref();
94	+	let text = std::fs::read_to_string(path)
95	+	.map_err(\|e\| Error::Config(format!("reading {}: {e}", path.display())))?;
96	+	toml::from_str(&text).map_err(\|e\| Error::Config(format!("parsing {}: {e}", path.display())))
97	+	}
98	+
99	+	/// Load from `path` if it exists, otherwise return defaults.
100	+	pub fn load_or_default(path: impl AsRef<Path>) -> Result<Self> {
101	+	let path = path.as_ref();
102	+	if path.exists() {
103	+	Self::load(path)
104	+	} else {
105	+	Ok(Self::default())
106	+	}
107	+	}
108	+
109	+	/// Filesystem path to the SQLite database file.
110	+	pub fn database_path(&self) -> PathBuf {
111	+	self.data_dir.join("anvil.db")
112	+	}
113	+
114	+	/// Root directory under which bare repositories are stored.
115	+	pub fn repositories_dir(&self) -> PathBuf {
116	+	self.data_dir.join("repositories")
117	+	}
118	+
119	+	/// The HTTP clone URL for `<owner>/<name>`, e.g.
120	+	/// `http://localhost:3000/alice/hello.git`.
121	+	pub fn http_clone_url(&self, owner: &str, name: &str) -> String {
122	+	format!(
123	+	"{}/{owner}/{name}.git",
124	+	self.http.base_url.trim_end_matches('/')
125	+	)
126	+	}
127	+
128	+	/// The SSH clone URL for `<owner>/<name>`, using the externally advertised
129	+	/// host/port/user (which may differ from the internal bind under Docker).
130	+	/// The port is omitted when it is the SSH default (22).
131	+	pub fn ssh_clone_url(&self, owner: &str, name: &str) -> String {
132	+	let ssh = &self.ssh;
133	+	if ssh.clone_port == 22 {
134	+	format!(
135	+	"ssh://{}@{}/{owner}/{name}.git",
136	+	ssh.clone_user, ssh.clone_host
137	+	)
138	+	} else {
139	+	format!(
140	+	"ssh://{}@{}:{}/{owner}/{name}.git",
141	+	ssh.clone_user, ssh.clone_host, ssh.clone_port
142	+	)
143	+	}
144	+	}
145	+	}

1	+	//! Database connection and schema setup via Toasty.
2	+
3	+	use std::path::Path;
4	+
5	+	use crate::error::Result;
6	+	use crate::models::{
7	+	Repository,
8	+	Session,
9	+	SshKey,
10	+	User,
11	+	};
12	+
13	+	/// Open (creating if necessary) the SQLite database at `path`, creating the
14	+	/// schema on first run.
15	+	///
16	+	/// Note: Toasty 0.7's `push_schema` emits plain `CREATE TABLE` (no
17	+	/// `IF NOT EXISTS`) for model tables, so it is not idempotent — calling it on
18	+	/// an existing database errors. We therefore only push the schema when the
19	+	/// database file does not yet exist. Skipping it on an existing database issues
20	+	/// no DDL, so data is never touched. Schema evolution will move to Toasty's
21	+	/// migration system when models start changing.
22	+	pub async fn connect(path: impl AsRef<Path>) -> Result<toasty::Db> {
23	+	let path = path.as_ref();
24	+	let fresh = !path.exists();
25	+	let url = format!("sqlite:{}", path.display());
26	+
27	+	let db = toasty::Db::builder()
28	+	.models(toasty::models!(User, Repository, SshKey, Session))
29	+	.connect(&url)
30	+	.await?;
31	+
32	+	if fresh {
33	+	db.push_schema().await?;
34	+	}
35	+	Ok(db)
36	+	}

1	+	//! Crate-wide error type.
2	+
3	+	/// Errors produced by the core domain and storage layers.
4	+	#[derive(Debug, thiserror::Error)]
5	+	pub enum Error {
6	+	#[error("database error: {0}")]
7	+	Db(#[from] toasty::Error),
8	+
9	+	#[error("repository storage error: {0}")]
10	+	Storage(String),
11	+
12	+	#[error("password hashing error: {0}")]
13	+	Password(String),
14	+
15	+	#[error("config error: {0}")]
16	+	Config(String),
17	+
18	+	#[error("not found: {0}")]
19	+	NotFound(String),
20	+
21	+	#[error("already exists: {0}")]
22	+	AlreadyExists(String),
23	+
24	+	#[error("invalid input: {0}")]
25	+	Invalid(String),
26	+
27	+	#[error(transparent)]
28	+	Io(#[from] std::io::Error),
29	+	}
30	+
31	+	/// Convenience alias used throughout the crate.
32	+	pub type Result<T> = std::result::Result<T, Error>;

1	+	//! Core domain model, persistence, and on-disk repository storage for anvil.
2	+	//!
3	+	//! This crate is transport-agnostic: it knows about users, repositories, the
4	+	//! SQLite database, and bare git repositories on disk, but nothing about HTTP,
5	+	//! SSH, or the git wire protocol. Higher layers (`anvil-web`, `anvil-ssh`,
6	+	//! `anvil-git`) build on top of it.
7	+
8	+	pub mod access;
9	+	pub mod config;
10	+	pub mod db;
11	+	pub mod error;
12	+	pub mod models;
13	+	pub mod repos;
14	+	pub mod sessions;
15	+	pub mod ssh_keys;
16	+	pub mod storage;
17	+	pub mod users;
18	+
19	+	pub use config::Config;
20	+	pub use error::{
21	+	Error,
22	+	Result,
23	+	};
24	+	pub use models::{
25	+	Repository,
26	+	Session,
27	+	SshKey,
28	+	User,
29	+	};
30	+
31	+	/// Current Unix time in seconds, for `created_at` columns.
32	+	pub(crate) fn now() -> i64 {
33	+	std::time::SystemTime::now()
34	+	.duration_since(std::time::UNIX_EPOCH)
35	+	.map(\|d\| d.as_secs() as i64)
36	+	.unwrap_or(0)
37	+	}
38	+
39	+	/// Shared application state: configuration plus a database handle.
40	+	///
41	+	/// Cloneable and cheap to pass around — `toasty::Db` is internally reference
42	+	/// counted and backed by a connection pool.
43	+	#[derive(Clone)]
44	+	pub struct App {
45	+	pub config: Config,
46	+	pub db: toasty::Db,
47	+	}
48	+
49	+	impl App {
50	+	/// Initialize application state from a config: ensure the data directories
51	+	/// exist, then open the database and create the schema.
52	+	pub async fn bootstrap(config: Config) -> Result<Self> {
53	+	std::fs::create_dir_all(&config.data_dir)?;
54	+	std::fs::create_dir_all(config.repositories_dir())?;
55	+
56	+	let db = db::connect(config.database_path()).await?;
57	+
58	+	Ok(Self { config, db })
59	+	}
60	+	}

1	+	//! Persisted domain types, defined as Toasty models. Tables are created from
2	+	//! these definitions via [`crate::db`]'s `push_schema`.
3	+	//!
4	+	//! Foreign keys are kept as plain scalar fields (`owner_id`, `user_id`) and
5	+	//! queried explicitly, rather than declaring Toasty relations — simpler and a
6	+	//! good fit for our small schema.
7	+
8	+	/// A registered user account.
9	+	#[derive(Debug, toasty::Model)]
10	+	pub struct User {
11	+	#[key]
12	+	#[auto]
13	+	pub id: i64,
14	+	#[unique]
15	+	pub username: String,
16	+	pub email: String,
17	+	/// Argon2 PHC-format password hash.
18	+	pub password_hash: String,
19	+	pub is_admin: bool,
20	+	/// Unix timestamp (seconds) of account creation.
21	+	pub created_at: i64,
22	+	}
23	+
24	+	/// A hosted repository, owned by a [`User`].
25	+	#[derive(Debug, toasty::Model)]
26	+	pub struct Repository {
27	+	#[key]
28	+	#[auto]
29	+	pub id: i64,
30	+	#[index]
31	+	pub owner_id: i64,
32	+	pub name: String,
33	+	pub description: String,
34	+	pub is_private: bool,
35	+	/// Short name of the default branch, e.g. `main`.
36	+	pub default_branch: String,
37	+	pub created_at: i64,
38	+	}
39	+
40	+	/// A web login session, keyed by an opaque random token stored in a cookie.
41	+	#[derive(Debug, toasty::Model)]
42	+	pub struct Session {
43	+	#[key]
44	+	pub token: String,
45	+	#[index]
46	+	pub user_id: i64,
47	+	pub created_at: i64,
48	+	/// Unix timestamp (seconds) after which the session is invalid.
49	+	pub expires_at: i64,
50	+	}
51	+
52	+	/// A registered SSH public key, used to authenticate git-over-SSH connections.
53	+	#[derive(Debug, toasty::Model)]
54	+	pub struct SshKey {
55	+	#[key]
56	+	#[auto]
57	+	pub id: i64,
58	+	#[index]
59	+	pub user_id: i64,
60	+	pub title: String,
61	+	/// Canonical SHA256 fingerprint, e.g. `SHA256:…`.
62	+	#[unique]
63	+	pub fingerprint: String,
64	+	/// Normalized OpenSSH public-key line.
65	+	pub content: String,
66	+	pub created_at: i64,
67	+	}

1	+	//! Repository records: creation (DB row + on-disk bare repo) and lookup.
2	+
3	+	use std::path::Path;
4	+
5	+	use crate::error::{
6	+	Error,
7	+	Result,
8	+	};
9	+	use crate::models::{
10	+	Repository,
11	+	User,
12	+	};
13	+	use crate::storage;
14	+
15	+	/// A repository joined with its owner's username, for listing pages.
16	+	pub struct RepoWithOwner {
17	+	pub owner_id: i64,
18	+	pub owner: String,
19	+	pub name: String,
20	+	pub description: String,
21	+	pub is_private: bool,
22	+	pub default_branch: String,
23	+	}
24	+
25	+	/// Create a repository owned by `owner`: insert the database row and initialize
26	+	/// the bare repository on disk. If the on-disk init fails, the row is rolled
27	+	/// back (deleted) so no orphan remains.
28	+	pub async fn create(
29	+	db: &toasty::Db,
30	+	repositories_dir: &Path,
31	+	owner: &User,
32	+	name: &str,
33	+	description: &str,
34	+	is_private: bool,
35	+	) -> Result<Repository> {
36	+	validate_name(name)?;
37	+	if find(db, owner.id, name).await?.is_some() {
38	+	return Err(Error::AlreadyExists(format!(
39	+	"repository {}/{name}",
40	+	owner.username
41	+	)));
42	+	}
43	+
44	+	let mut conn = db.clone();
45	+	let repo = toasty::create!(Repository {
46	+	owner_id: owner.id,
47	+	name: name,
48	+	description: description,
49	+	is_private: is_private,
50	+	default_branch: "main",
51	+	created_at: crate::now(),
52	+	})
53	+	.exec(&mut conn)
54	+	.await?;
55	+
56	+	// Create the bare repo on disk; on failure, remove the row we just wrote.
57	+	if let Err(e) = storage::create_bare(
58	+	repositories_dir,
59	+	&owner.username,
60	+	name,
61	+	&repo.default_branch,
62	+	) {
63	+	let _ = repo.delete().exec(&mut conn).await;
64	+	return Err(e);
65	+	}
66	+	Ok(repo)
67	+	}
68	+
69	+	/// Find a repository by its id.
70	+	pub async fn find_by_id(db: &toasty::Db, id: i64) -> Result<Option<Repository>> {
71	+	let mut db = db.clone();
72	+	let repo = Repository::filter(Repository::fields().id().eq(id))
73	+	.first()
74	+	.exec(&mut db)
75	+	.await?;
76	+	Ok(repo)
77	+	}
78	+
79	+	/// Update a repository's description and visibility.
80	+	pub async fn update_settings(
81	+	db: &toasty::Db,
82	+	repo_id: i64,
83	+	description: &str,
84	+	is_private: bool,
85	+	) -> Result<()> {
86	+	let mut conn = db.clone();
87	+	let Some(mut repo) = Repository::filter(Repository::fields().id().eq(repo_id))
88	+	.first()
89	+	.exec(&mut conn)
90	+	.await?
91	+	else {
92	+	return Err(Error::NotFound(format!("repository id {repo_id}")));
93	+	};
94	+	let mut conn = db.clone();
95	+	repo.update()
96	+	.description(description)
97	+	.is_private(is_private)
98	+	.exec(&mut conn)
99	+	.await?;
100	+	Ok(())
101	+	}
102	+
103	+	/// Find a repository by owner id and name.
104	+	pub async fn find(db: &toasty::Db, owner_id: i64, name: &str) -> Result<Option<Repository>> {
105	+	let mut db = db.clone();
106	+	let repo = Repository::filter(Repository::fields().owner_id().eq(owner_id))
107	+	.filter(Repository::fields().name().eq(name))
108	+	.first()
109	+	.exec(&mut db)
110	+	.await?;
111	+	Ok(repo)
112	+	}
113	+
114	+	/// List all repositories owned by `owner_id`.
115	+	pub async fn list_by_owner(db: &toasty::Db, owner_id: i64) -> Result<Vec<Repository>> {
116	+	let mut db = db.clone();
117	+	let repos = Repository::filter(Repository::fields().owner_id().eq(owner_id))
118	+	.exec(&mut db)
119	+	.await?;
120	+	Ok(repos)
121	+	}
122	+
123	+	/// List all repositories with their owner usernames, ordered by owner then name.
124	+	pub async fn list_all_with_owner(db: &toasty::Db) -> Result<Vec<RepoWithOwner>> {
125	+	let mut conn = db.clone();
126	+	let users = User::all().exec(&mut conn).await?;
127	+	let owner_name: std::collections::HashMap<i64, String> =
128	+	users.into_iter().map(\|u\| (u.id, u.username)).collect();
129	+
130	+	let mut conn = db.clone();
131	+	let repos = Repository::all().exec(&mut conn).await?;
132	+	let mut out: Vec<RepoWithOwner> = repos
133	+	.into_iter()
134	+	.map(\|r\| RepoWithOwner {
135	+	owner: owner_name.get(&r.owner_id).cloned().unwrap_or_default(),
136	+	owner_id: r.owner_id,
137	+	name: r.name,
138	+	description: r.description,
139	+	is_private: r.is_private,
140	+	default_branch: r.default_branch,
141	+	})
142	+	.collect();
143	+	out.sort_by(\|a, b\| (&a.owner, &a.name).cmp(&(&b.owner, &b.name)));
144	+	Ok(out)
145	+	}
146	+
147	+	/// Reject names that are empty or contain path separators / traversal.
148	+	fn validate_name(name: &str) -> Result<()> {
149	+	if name.is_empty() {
150	+	return Err(Error::Invalid("repository name must not be empty".into()));
151	+	}
152	+	if name.contains('/') \|\| name.contains('\\') \|\| name.contains("..") {
153	+	return Err(Error::Invalid(format!("invalid repository name: {name:?}")));
154	+	}
155	+	Ok(())
156	+	}

1	+	//! Web login sessions: opaque random tokens stored server-side and referenced
2	+	//! by a cookie.
3	+
4	+	use argon2::password_hash::rand_core::{
5	+	OsRng,
6	+	RngCore,
7	+	};
8	+
9	+	use crate::error::Result;
10	+	use crate::models::{
11	+	Session,
12	+	User,
13	+	};
14	+
15	+	/// Default session lifetime: 30 days.
16	+	const SESSION_TTL_SECS: i64 = 60 * 60 * 24 * 30;
17	+
18	+	/// Generate a 256-bit random session token, hex-encoded.
19	+	fn generate_token() -> String {
20	+	let mut bytes = [0u8; 32];
21	+	let mut rng = OsRng;
22	+	rng.fill_bytes(&mut bytes);
23	+	bytes.iter().map(\|b\| format!("{b:02x}")).collect()
24	+	}
25	+
26	+	/// Create a new session for `user_id`, returning it (the `token` goes in a cookie).
27	+	pub async fn create(db: &toasty::Db, user_id: i64) -> Result<Session> {
28	+	let mut conn = db.clone();
29	+	let now = crate::now();
30	+	let session = toasty::create!(Session {
31	+	token: generate_token(),
32	+	user_id: user_id,
33	+	created_at: now,
34	+	expires_at: now + SESSION_TTL_SECS,
35	+	})
36	+	.exec(&mut conn)
37	+	.await?;
38	+	Ok(session)
39	+	}
40	+
41	+	/// Resolve a session token to its user, or `None` if missing/expired.
42	+	/// Expired sessions are deleted as a side effect.
43	+	pub async fn lookup_user(db: &toasty::Db, token: &str) -> Result<Option<User>> {
44	+	let mut conn = db.clone();
45	+	let Some(session) = Session::filter(Session::fields().token().eq(token))
46	+	.first()
47	+	.exec(&mut conn)
48	+	.await?
49	+	else {
50	+	return Ok(None);
51	+	};
52	+
53	+	if session.expires_at < crate::now() {
54	+	let mut conn = db.clone();
55	+	let _ = session.delete().exec(&mut conn).await;
56	+	return Ok(None);
57	+	}
58	+
59	+	let mut conn = db.clone();
60	+	let user = User::filter(User::fields().id().eq(session.user_id))
61	+	.first()
62	+	.exec(&mut conn)
63	+	.await?;
64	+	Ok(user)
65	+	}
66	+
67	+	/// Delete a session (logout). No-op if the token is unknown.
68	+	pub async fn delete(db: &toasty::Db, token: &str) -> Result<()> {
69	+	let mut conn = db.clone();
70	+	if let Some(session) = Session::filter(Session::fields().token().eq(token))
71	+	.first()
72	+	.exec(&mut conn)
73	+	.await?
74	+	{
75	+	let mut conn = db.clone();
76	+	session.delete().exec(&mut conn).await?;
77	+	}
78	+	Ok(())
79	+	}

1	+	//! SSH public keys: parsing, registration, and lookup for git-over-SSH
2	+	//! authentication.
3	+
4	+	use ssh_key::{
5	+	HashAlg,
6	+	PublicKey,
7	+	};
8	+
9	+	use crate::error::{
10	+	Error,
11	+	Result,
12	+	};
13	+	use crate::models::SshKey;
14	+
15	+	/// Parse an OpenSSH public-key line (`ssh-ed25519 AAAA… comment`) into its
16	+	/// canonical SHA256 fingerprint and normalized key line, for registration.
17	+	pub fn parse_public_key(openssh: &str) -> Result<(String, String)> {
18	+	let key = PublicKey::from_openssh(openssh.trim())
19	+	.map_err(\|e\| Error::Invalid(format!("invalid ssh public key: {e}")))?;
20	+	let fingerprint = key.fingerprint(HashAlg::Sha256).to_string();
21	+	let normalized = key
22	+	.to_openssh()
23	+	.map_err(\|e\| Error::Invalid(format!("encoding ssh public key: {e}")))?;
24	+	Ok((fingerprint, normalized))
25	+	}
26	+
27	+	/// Register an SSH public key for a user.
28	+	///
29	+	/// `fingerprint` must be the canonical SHA256 fingerprint and `content` the
30	+	/// normalized OpenSSH key line. Returns [`Error::AlreadyExists`] if the
31	+	/// fingerprint is already registered.
32	+	pub async fn add(
33	+	db: &toasty::Db,
34	+	user_id: i64,
35	+	title: &str,
36	+	fingerprint: &str,
37	+	content: &str,
38	+	) -> Result<SshKey> {
39	+	if find_by_fingerprint(db, fingerprint).await?.is_some() {
40	+	return Err(Error::AlreadyExists(format!("ssh key {fingerprint}")));
41	+	}
42	+	let mut db = db.clone();
43	+	let key = toasty::create!(SshKey {
44	+	user_id: user_id,
45	+	title: title,
46	+	fingerprint: fingerprint,
47	+	content: content,
48	+	created_at: crate::now(),
49	+	})
50	+	.exec(&mut db)
51	+	.await?;
52	+	Ok(key)
53	+	}
54	+
55	+	/// Look up a key by its fingerprint.
56	+	pub async fn find_by_fingerprint(db: &toasty::Db, fingerprint: &str) -> Result<Option<SshKey>> {
57	+	let mut db = db.clone();
58	+	let key = SshKey::filter(SshKey::fields().fingerprint().eq(fingerprint))
59	+	.first()
60	+	.exec(&mut db)
61	+	.await?;
62	+	Ok(key)
63	+	}
64	+
65	+	/// Find the user id that owns the key with this fingerprint, if any.
66	+	pub async fn find_user_id_by_fingerprint(
67	+	db: &toasty::Db,
68	+	fingerprint: &str,
69	+	) -> Result<Option<i64>> {
70	+	Ok(find_by_fingerprint(db, fingerprint)
71	+	.await?
72	+	.map(\|k\| k.user_id))
73	+	}
74	+
75	+	/// Delete one of `user_id`'s keys by id. No-op if the key is missing or owned
76	+	/// by someone else.
77	+	pub async fn delete(db: &toasty::Db, id: i64, user_id: i64) -> Result<()> {
78	+	let mut conn = db.clone();
79	+	if let Some(key) = SshKey::filter(SshKey::fields().id().eq(id))
80	+	.first()
81	+	.exec(&mut conn)
82	+	.await?
83	+	&& key.user_id == user_id
84	+	{
85	+	let mut conn = db.clone();
86	+	key.delete().exec(&mut conn).await?;
87	+	}
88	+	Ok(())
89	+	}
90	+
91	+	/// List a user's registered SSH keys.
92	+	pub async fn list_by_user(db: &toasty::Db, user_id: i64) -> Result<Vec<SshKey>> {
93	+	let mut db = db.clone();
94	+	let keys = SshKey::filter(SshKey::fields().user_id().eq(user_id))
95	+	.exec(&mut db)
96	+	.await?;
97	+	Ok(keys)
98	+	}

1	+	# This file is automatically @generated by Cargo.
2	+	# It is not intended for manual editing.
3	+	version = 4
4	+
5	+	[[package]]
6	+	name = "adler2"
7	+	version = "2.0.1"
8	+	source = "registry+https://github.com/rust-lang/crates.io-index"
9	+	checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
10	+
11	+	[[package]]
12	+	name = "aead"
13	+	version = "0.6.0"
14	+	source = "registry+https://github.com/rust-lang/crates.io-index"
15	+	checksum = "ef60ac202874e574ce7a7158cc8bca7313dd344322482e4fadee288bf4a306b8"
16	+	dependencies = [
17	+	"crypto-common 0.2.2",
18	+	"inout",
19	+	]
20	+
21	+	[[package]]
22	+	name = "aes"
23	+	version = "0.9.1"
24	+	source = "registry+https://github.com/rust-lang/crates.io-index"
25	+	checksum = "f1fc76eaeac4c9164506c466d4ffdd8ec9d0c5bf57ee97177c4d8eceb3a0e138"
26	+	dependencies = [
27	+	"cipher",
28	+	"cpubits",
29	+	"cpufeatures 0.3.0",
30	+	"zeroize",
31	+	]
32	+
33	+	[[package]]
34	+	name = "aes-gcm"
35	+	version = "0.11.0-rc.4"
36	+	source = "registry+https://github.com/rust-lang/crates.io-index"
37	+	checksum = "da8c919c118108f144adecad74b425b804ad075580d605d9b33c2d6d1c62a2f8"
38	+	dependencies = [
39	+	"aead",
40	+	"aes",

1	+	//! Read-only repository browsing via gix: refs, trees, and blobs.
2	+	//!
3	+	//! These helpers back the web UI. Each opens the bare repo by path; that is
4	+	//! cheap enough at our scale and keeps the API stateless.
5	+
6	+	use std::collections::{
7	+	BTreeMap,
8	+	BTreeSet,
9	+	};
10	+	use std::fmt::Display;
11	+	use std::path::Path;
12	+
13	+	use crate::error::{
14	+	Error,
15	+	Result,
16	+	};
17	+
18	+	/// Summary of a repository's refs and state, for the repo landing page.
19	+	pub struct Overview {
20	+	/// Short name of the default branch (from `HEAD`), if resolvable.
21	+	pub default_branch: Option<String>,
22	+	pub branches: Vec<String>,
23	+	pub tags: Vec<String>,
24	+	/// True if the repository has no commits yet (unborn `HEAD`).
25	+	pub is_empty: bool,
26	+	}
27	+
28	+	/// One entry in a tree listing.
29	+	pub struct TreeEntry {
30	+	pub name: String,
31	+	pub is_dir: bool,
32	+	pub oid: String,
33	+	}
34	+
35	+	/// Map any gix error into our error type without a forest of `From` impls.
36	+	fn read(e: impl Display) -> Error {
37	+	Error::Read(e.to_string())
38	+	}
39	+
40	+	/// Summarize a repository's default branch, branches, and tags.

1	+	//! Git smart-HTTP protocol, transport-agnostic.
2	+	//!
3	+	//! These functions take a bare-repository path plus request bytes and return
4	+	//! response bytes (or a packfile stream), with no dependency on the HTTP
5	+	//! framework. `anvil-web` adapts them to axum; a future `anvil-ssh` can reuse
6	+	//! the same engine over an SSH channel.
7	+	//!
8	+	//! The protocol engine is [`gitserver_core`]; this module orchestrates it into
9	+	//! the request/response shapes a transport needs. We target git protocol v2
10	+	//! for fetch (the modern default) with a v0 fallback, and the classic v0
11	+	//! advertisement for `receive-pack` (push).
12	+
13	+	use std::path::Path;
14	+	use std::pin::Pin;
15	+
16	+	use gitserver_core::backend::GitBackend;
17	+	use gitserver_core::{
18	+	pack,
19	+	pktline,
20	+	protocol_v2,
21	+	};
22	+	use tokio::io::AsyncRead;
23	+
24	+	use crate::error::Result;
25	+
26	+	/// The two git wire services.
27	+	#[derive(Debug, Copy, Clone, Eq, PartialEq)]
28	+	pub enum Service {
29	+	/// `git-upload-pack` — serves fetch/clone.
30	+	UploadPack,
31	+	/// `git-receive-pack` — accepts push.
32	+	ReceivePack,
33	+	}
34	+
35	+	impl Service {
36	+	pub fn as_str(self) -> &'static str {
37	+	match self {
38	+	Service::UploadPack => "git-upload-pack",
39	+	Service::ReceivePack => "git-receive-pack",
40	+	}

1	+	//! Git smart protocol over a bidirectional stream (SSH transport / `git://`).
2	+	//!
3	+	//! Unlike smart-HTTP — which is a sequence of independent request/response pairs
4	+	//! — the SSH transport is one duplex stream: the server writes the ref
5	+	//! advertisement, then reads the client's request(s) and writes the
6	+	//! response/packfile on the same connection. SSH also omits the HTTP-only
7	+	//! `# service=…` announcement line.
8	+	//!
9	+	//! This module reuses the same [`crate::smart_http`] engine; it only adds the
10	+	//! stream framing (reading pkt-line requests and stripping the HTTP prefix).
11	+
12	+	use std::path::Path;
13	+
14	+	use gitserver_core::backend::GitBackend;
15	+	use tokio::io::{
16	+	AsyncRead,
17	+	AsyncReadExt,
18	+	AsyncWrite,
19	+	AsyncWriteExt,
20	+	};
21	+
22	+	use crate::error::Result;
23	+	use crate::smart_http::{
24	+	self,
25	+	Service,
26	+	UploadPack,
27	+	};
28	+
29	+	/// Parse an SSH `exec` command such as `git-upload-pack '/alice/hello.git'`,
30	+	/// returning the service and the (leading-slash-trimmed) repository path.
31	+	pub fn parse_command(command: &str) -> Option<(Service, String)> {
32	+	let command = command.trim();
33	+	for (prefix, service) in [
34	+	("git-upload-pack", Service::UploadPack),
35	+	("git-receive-pack", Service::ReceivePack),
36	+	] {
37	+	if let Some(rest) = command.strip_prefix(prefix) {
38	+	let path = rest
39	+	.trim()
40	+	.trim_matches('\'')

1	+	//! On-disk repository storage.
2	+	//!
3	+	//! Repositories are bare git repositories laid out as
4	+	//! `<repositories_dir>/<owner>/<name>.git`. This module owns the mapping
5	+	//! between forge identities and filesystem paths, plus creation/opening via
6	+	//! `gix`. No database access happens here.
7	+
8	+	use std::path::{
9	+	Path,
10	+	PathBuf,
11	+	};
12	+
13	+	use crate::error::{
14	+	Error,
15	+	Result,
16	+	};
17	+
18	+	/// Compute the on-disk path of a bare repository.
19	+	pub fn repo_path(repositories_dir: &Path, owner: &str, name: &str) -> PathBuf {
20	+	repositories_dir.join(owner).join(format!("{name}.git"))
21	+	}
22	+
23	+	/// Create a new bare repository on disk, returning the opened handle.
24	+	///
25	+	/// `HEAD` is pointed at `refs/heads/<default_branch>` so the on-disk repository
26	+	/// agrees with the forge's recorded default branch (gix otherwise defaults to
27	+	/// whatever `init.defaultBranch` resolves to, often `master`).
28	+	///
29	+	/// Fails if a repository already exists at the target path. The owner
30	+	/// directory is created as needed.
31	+	pub fn create_bare(
32	+	repositories_dir: &Path,
33	+	owner: &str,
34	+	name: &str,
35	+	default_branch: &str,
36	+	) -> Result<gix::Repository> {
37	+	let path = repo_path(repositories_dir, owner, name);
38	+	if path.exists() {
39	+	return Err(Error::AlreadyExists(format!(
40	+	"repository on disk at {}",
41	+	path.display()
42	+	)));
43	+	}
44	+	if let Some(parent) = path.parent() {
45	+	std::fs::create_dir_all(parent)?;
46	+	}
47	+	let repo = gix::init_bare(&path)
48	+	.map_err(\|e\| Error::Storage(format!("init bare {}: {e}", path.display())))?;
49	+	set_head_branch(&repo, default_branch)?;
50	+	Ok(repo)
51	+	}
52	+
53	+	/// Point `HEAD` at `refs/heads/<branch>` as a symbolic reference.
54	+	fn set_head_branch(repo: &gix::Repository, branch: &str) -> Result<()> {
55	+	use gix::refs::Target;
56	+	use gix::refs::transaction::{
57	+	Change,
58	+	LogChange,
59	+	PreviousValue,
60	+	RefEdit,
61	+	};
62	+
63	+	let target_name: gix::refs::FullName = format!("refs/heads/{branch}")
64	+	.try_into()
65	+	.map_err(\|e\| Error::Storage(format!("invalid branch name {branch:?}: {e}")))?;
66	+	let head_name: gix::refs::FullName = "HEAD"
67	+	.try_into()
68	+	.map_err(\|e\| Error::Storage(format!("HEAD ref name: {e}")))?;
69	+
70	+	repo.edit_reference(RefEdit {
71	+	change: Change::Update {
72	+	log: LogChange::default(),
73	+	expected: PreviousValue::Any,
74	+	new: Target::Symbolic(target_name),
75	+	},
76	+	name: head_name,
77	+	deref: false,
78	+	})
79	+	.map_err(\|e\| Error::Storage(format!("set HEAD to {branch}: {e}")))?;
80	+	Ok(())
81	+	}
82	+
83	+	/// Open an existing bare repository.
84	+	pub fn open(repositories_dir: &Path, owner: &str, name: &str) -> Result<gix::Repository> {
85	+	let path = repo_path(repositories_dir, owner, name);
86	+	gix::open(&path).map_err(\|e\| Error::Storage(format!("open {}: {e}", path.display())))
87	+	}

1	+	//! User accounts: creation, lookup, and password hashing.
2	+
3	+	use argon2::Argon2;
4	+	use argon2::password_hash::rand_core::OsRng;
5	+	use argon2::password_hash::{
6	+	PasswordHash,
7	+	PasswordHasher,
8	+	PasswordVerifier,
9	+	SaltString,
10	+	};
11	+
12	+	use crate::error::{
13	+	Error,
14	+	Result,
15	+	};
16	+	use crate::models::User;
17	+
18	+	/// Usernames reserved for system use — they collide with (or could be confused
19	+	/// for) top-level routes such as the `/-/…` namespace.
20	+	const RESERVED_USERNAMES: &[&str] = &[
21	+	"-",
22	+	"new",
23	+	"settings",
24	+	"login",
25	+	"logout",
26	+	"static",
27	+	"healthz",
28	+	"admin",
29	+	"api",
30	+	"about",
31	+	"help",
32	+	"assets",
33	+	"favicon.ico",
34	+	"robots.txt",
35	+	];
36	+
37	+	/// Hash a plaintext password into a PHC-format Argon2 string.
38	+	pub fn hash_password(password: &str) -> Result<String> {
39	+	let salt = SaltString::generate(&mut OsRng);
40	+	Argon2::default()
41	+	.hash_password(password.as_bytes(), &salt)
42	+	.map(\|h\| h.to_string())
43	+	.map_err(\|e\| Error::Password(e.to_string()))
44	+	}
45	+
46	+	/// Verify a plaintext password against a stored PHC hash.
47	+	pub fn verify_password(hash: &str, password: &str) -> Result<bool> {
48	+	let parsed = PasswordHash::new(hash).map_err(\|e\| Error::Password(e.to_string()))?;
49	+	Ok(Argon2::default()
50	+	.verify_password(password.as_bytes(), &parsed)
51	+	.is_ok())
52	+	}
53	+
54	+	/// Create a new user, hashing `password` before storage.
55	+	///
56	+	/// Returns [`Error::AlreadyExists`] if the username is taken.
57	+	pub async fn create(
58	+	db: &toasty::Db,
59	+	username: &str,
60	+	email: &str,
61	+	password: &str,
62	+	is_admin: bool,
63	+	) -> Result<User> {
64	+	if username.trim().is_empty() {
65	+	return Err(Error::Invalid("username must not be empty".into()));
66	+	}
67	+	// Usernames live in the URL root namespace (e.g. `/<username>`) and on disk
68	+	// under `repositories/<username>/`. Reject path-unsafe characters and names
69	+	// reserved for system routes (the `/-/…` prefix is reserved structurally,
70	+	// but we keep a denylist as defense-in-depth).
71	+	if username.contains('/') \|\| username.contains('\\') \|\| username.contains("..") {
72	+	return Err(Error::Invalid(format!("invalid username: {username:?}")));
73	+	}
74	+	if RESERVED_USERNAMES.contains(&username.to_ascii_lowercase().as_str()) {
75	+	return Err(Error::Invalid(format!("username '{username}' is reserved")));
76	+	}
77	+	if find_by_username(db, username).await?.is_some() {
78	+	return Err(Error::AlreadyExists(format!("user {username}")));
79	+	}
80	+
81	+	let mut db = db.clone();
82	+	let user = toasty::create!(User {
83	+	username: username,
84	+	email: email,
85	+	password_hash: hash_password(password)?,
86	+	is_admin: is_admin,
87	+	created_at: crate::now(),
88	+	})
89	+	.exec(&mut db)
90	+	.await?;
91	+	Ok(user)
92	+	}
93	+
94	+	/// Look up a user by id.
95	+	pub async fn find_by_id(db: &toasty::Db, id: i64) -> Result<Option<User>> {
96	+	let mut db = db.clone();
97	+	let user = User::filter(User::fields().id().eq(id))
98	+	.first()
99	+	.exec(&mut db)
100	+	.await?;
101	+	Ok(user)
102	+	}
103	+
104	+	/// Look up a user by exact username.
105	+	pub async fn find_by_username(db: &toasty::Db, username: &str) -> Result<Option<User>> {
106	+	let mut db = db.clone();
107	+	let user = User::filter(User::fields().username().eq(username))
108	+	.first()
109	+	.exec(&mut db)
110	+	.await?;
111	+	Ok(user)
112	+	}

1	+	[package]
2	+	name = "anvil-git"
3	+	version.workspace = true
4	+	edition.workspace = true
5	+	license.workspace = true
6	+	repository.workspace = true
7	+	rust-version.workspace = true
8	+	description = "Server-side git wire protocol (smart-HTTP / SSH) on top of gix. Transport-agnostic; upstream-candidate."
9	+
10	+	[dependencies]
11	+	anvil-core.workspace = true
12	+	gix.workspace = true
13	+	gitserver-core.workspace = true
14	+	tokio.workspace = true
15	+	thiserror.workspace = true
16	+	tracing.workspace = true

1	+	//! Errors from the git wire-protocol layer.
2	+
3	+	/// Errors produced while serving the git smart protocol.
4	+	#[derive(Debug, thiserror::Error)]
5	+	pub enum Error {
6	+	/// An error from the underlying protocol engine (`gitserver-core`).
7	+	#[error(transparent)]
8	+	Core(#[from] gitserver_core::error::Error),
9	+
10	+	#[error(transparent)]
11	+	Io(#[from] std::io::Error),
12	+
13	+	/// An error reading repository contents via gix (browse layer).
14	+	#[error("git read error: {0}")]
15	+	Read(String),
16	+	}
17	+
18	+	pub type Result<T> = std::result::Result<T, Error>;

1	+	//! Server-side git wire protocol for anvil.
2	+	//!
3	+	//! `gix` provides object/ref/pack plumbing but no server-side protocol: it
4	+	//! ships no `upload-pack`/`receive-pack` and its `gix-transport`/`gix-protocol`
5	+	//! crates are client-only. This crate fills that gap.
6	+	//!
7	+	//! ## Design
8	+	//! - Transport-agnostic. [`smart_http`] takes a repo path plus request bytes
9	+	//! and returns response bytes / a packfile stream, with no HTTP dependency, so
10	+	//! the same engine serves smart-HTTP (`anvil-web`) and, later, SSH
11	+	//! (`anvil-ssh`).
12	+	//! - Bootstrapped on [`gitserver_core`] (vendored, gix-native pkt-line /
13	+	//! protocol-v2 / upload-pack / receive-pack), behind this crate's interface so
14	+	//! it can be replaced incrementally with an upstream-shaped implementation.
15	+
16	+	pub mod browse;
17	+	pub mod error;
18	+	pub mod smart_http;
19	+	pub mod ssh;
20	+
21	+	pub use error::{
22	+	Error,
23	+	Result,
24	+	};
25	+	pub use smart_http::{
26	+	Service,
27	+	UploadPack,
28	+	};

1	+	[package]
2	+	name = "anvil-ssh"
3	+	version.workspace = true
4	+	edition.workspace = true
5	+	license.workspace = true
6	+	repository.workspace = true
7	+	rust-version.workspace = true
8	+	description = "git-over-SSH transport for anvil (russh), delegating to anvil-git. Added in milestone 6."
9	+
10	+	[dependencies]
11	+	anvil-core.workspace = true
12	+	anvil-git.workspace = true
13	+	russh.workspace = true
14	+	tokio.workspace = true
15	+	tracing.workspace = true
16	+	rand.workspace = true

1	+	//! git-over-SSH transport for anvil, built on `russh` (pure Rust — no OpenSSH).
2	+	//!
3	+	//! Authenticates by public key, then handles `git-upload-pack` /
4	+	//! `git-receive-pack` `exec` requests by running the transport-agnostic engine
5	+	//! in [`anvil_git::ssh`] over the channel's byte stream.
6	+	//!
7	+	//! The SSH bind address is configurable (`[ssh] listen` in the config).
8	+
9	+	use std::net::SocketAddr;
10	+	use std::path::{
11	+	Path,
12	+	PathBuf,
13	+	};
14	+	use std::sync::Arc;
15	+	use std::time::Duration;
16	+
17	+	use anvil_core::{
18	+	App,
19	+	Error as CoreError,
20	+	Result as CoreResult,
21	+	access,
22	+	repos,
23	+	users,
24	+	};
25	+	use anvil_git::ssh as git_ssh;
26	+	use russh::keys::ssh_key::{
27	+	HashAlg,
28	+	LineEnding,
29	+	PublicKey,
30	+	};
31	+	use russh::keys::{
32	+	Algorithm,
33	+	PrivateKey,
34	+	};
35	+	use russh::server::{
36	+	self,
37	+	Auth,
38	+	Handler,
39	+	Msg,
40	+	Server as _,
41	+	Session,
42	+	};
43	+	use russh::{
44	+	Channel,
45	+	ChannelId,
46	+	};
47	+	use tokio::net::TcpListener;
48	+
49	+	/// Bind to the configured SSH address and serve git over SSH until shutdown.
50	+	pub async fn serve(app: App) -> CoreResult<()> {
51	+	let listen = app.config.ssh.listen.clone();
52	+	let host_key = load_or_create_host_key(&app.config.data_dir)?;
53	+
54	+	let config = Arc::new(server::Config {
55	+	inactivity_timeout: Some(Duration::from_secs(3600)),
56	+	auth_rejection_time: Duration::from_secs(1),
57	+	keys: vec![host_key],
58	+	..Default::default()
59	+	});
60	+
61	+	let listener = TcpListener::bind(&listen).await?;
62	+	tracing::info!("anvil ssh server listening on {listen}");
63	+
64	+	let mut server = GitSshServer { app };
65	+	server
66	+	.run_on_socket(config, &listener)
67	+	.await
68	+	.map_err(\|e\| CoreError::Storage(format!("ssh server: {e}")))?;
69	+	Ok(())
70	+	}
71	+
72	+	/// Load the persistent ed25519 host key, generating and saving it on first run
73	+	/// so the server identity is stable across restarts.
74	+	fn load_or_create_host_key(data_dir: &Path) -> CoreResult<PrivateKey> {
75	+	let path = data_dir.join("ssh_host_ed25519_key");
76	+	if path.exists() {
77	+	let pem = std::fs::read_to_string(&path)?;
78	+	return PrivateKey::from_openssh(&pem).map_err(\|e\| {
79	+	CoreError::Config(format!("reading ssh host key {}: {e}", path.display()))
80	+	});
81	+	}
82	+
83	+	let key = PrivateKey::random(&mut rand::rng(), Algorithm::Ed25519)
84	+	.map_err(\|e\| CoreError::Config(format!("generating ssh host key: {e}")))?;
85	+	let pem = key
86	+	.to_openssh(LineEnding::LF)
87	+	.map_err(\|e\| CoreError::Config(format!("encoding ssh host key: {e}")))?;
88	+	std::fs::write(&path, pem.as_bytes())?;
89	+	#[cfg(unix)]
90	+	{
91	+	use std::os::unix::fs::PermissionsExt;
92	+	let _ = std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600));
93	+	}
94	+	tracing::info!("generated ssh host key at {}", path.display());
95	+	Ok(key)
96	+	}
97	+
98	+	struct GitSshServer {
99	+	app: App,
100	+	}
101	+
102	+	impl server::Server for GitSshServer {
103	+	type Handler = GitSshSession;
104	+
105	+	fn new_client(&mut self, _peer: Option<SocketAddr>) -> GitSshSession {
106	+	GitSshSession {
107	+	app: self.app.clone(),
108	+	channel: None,
109	+	protocol_v2: false,
110	+	authed_user: None,
111	+	}
112	+	}
113	+	}
114	+
115	+	struct GitSshSession {
116	+	app: App,
117	+	/// The session channel, taken in `channel_open_session` and consumed by the
118	+	/// git protocol task in `exec_request`.
119	+	channel: Option<Channel<Msg>>,
120	+	/// Set if the client requested git protocol v2 via the `GIT_PROTOCOL` env.
121	+	protocol_v2: bool,
122	+	/// The user id authenticated by public key, set in `auth_publickey`.
123	+	authed_user: Option<i64>,
124	+	}
125	+
126	+	impl Handler for GitSshSession {
127	+	type Error = russh::Error;
128	+
129	+	async fn auth_publickey(&mut self, _user: &str, key: &PublicKey) -> Result<Auth, Self::Error> {
130	+	// Authenticate by matching the (signature-verified) key's fingerprint to
131	+	// a registered user. Unknown keys are rejected. Per-repo authorization
132	+	// is a later milestone; for now any authenticated user has full access.
133	+	let fingerprint = key.fingerprint(HashAlg::Sha256).to_string();
134	+	match anvil_core::ssh_keys::find_user_id_by_fingerprint(&self.app.db, &fingerprint).await {
135	+	Ok(Some(user_id)) => {
136	+	self.authed_user = Some(user_id);
137	+	tracing::info!("ssh auth: accepted key {fingerprint} (user {user_id})");
138	+	Ok(Auth::Accept)
139	+	}
140	+	Ok(None) => {
141	+	tracing::info!("ssh auth: rejected unknown key {fingerprint}");
142	+	Ok(Auth::reject())
143	+	}
144	+	Err(e) => {
145	+	tracing::error!("ssh auth: key lookup failed: {e}");
146	+	Ok(Auth::reject())
147	+	}
148	+	}
149	+	}
150	+
151	+	async fn channel_open_session(
152	+	&mut self,
153	+	channel: Channel<Msg>,
154	+	_session: &mut Session,
155	+	) -> Result<bool, Self::Error> {
156	+	self.channel = Some(channel);
157	+	Ok(true)
158	+	}
159	+
160	+	async fn env_request(
161	+	&mut self,
162	+	_channel: ChannelId,
163	+	name: &str,
164	+	value: &str,
165	+	_session: &mut Session,
166	+	) -> Result<(), Self::Error> {
167	+	if name == "GIT_PROTOCOL" && value.split(':').any(\|v\| v.trim() == "version=2") {
168	+	self.protocol_v2 = true;
169	+	}
170	+	Ok(())
171	+	}
172	+
173	+	async fn exec_request(
174	+	&mut self,
175	+	channel_id: ChannelId,
176	+	data: &[u8],
177	+	session: &mut Session,
178	+	) -> Result<(), Self::Error> {
179	+	let command = String::from_utf8_lossy(data);
180	+	let Some((service, rel)) = git_ssh::parse_command(&command) else {
181	+	return fail(session, channel_id, "unsupported command");
182	+	};
183	+	let need_write = service == anvil_git::Service::ReceivePack;
184	+	let path = match authorize_repo(&self.app, self.authed_user, &rel, need_write).await {
185	+	Ok(path) => path,
186	+	Err(message) => return fail(session, channel_id, message),
187	+	};
188	+	let Some(channel) = self.channel.take() else {
189	+	return fail(session, channel_id, "no session channel");
190	+	};
191	+
192	+	tracing::info!(
193	+	"ssh {} on {rel} (user {:?})",
194	+	service.as_str(),
195	+	self.authed_user
196	+	);
197	+
198	+	let protocol_v2 = self.protocol_v2;
199	+	let handle = session.handle();
200	+	session.channel_success(channel_id)?;
201	+
202	+	tokio::spawn(async move {
203	+	let stream = channel.into_stream();
204	+	let code = match git_ssh::serve(&path, service, protocol_v2, stream).await {
205	+	Ok(()) => 0,
206	+	Err(e) => {
207	+	tracing::error!("git ssh {}: {e}", service.as_str());
208	+	1
209	+	}
210	+	};
211	+	let _ = handle.exit_status_request(channel_id, code).await;
212	+	let _ = handle.eof(channel_id).await;
213	+	let _ = handle.close(channel_id).await;
214	+	});
215	+	Ok(())
216	+	}
217	+	}
218	+
219	+	/// Write a one-line error to the channel and close it with a failure status.
220	+	fn fail(session: &mut Session, channel_id: ChannelId, message: &str) -> Result<(), russh::Error> {
221	+	let _ = session.data(channel_id, format!("{message}\n").into_bytes());
222	+	session.exit_status_request(channel_id, 1)?;
223	+	session.close(channel_id)?;
224	+	Ok(())
225	+	}
226	+
227	+	/// Resolve an SSH repo path (`owner/name[.git]`) to an existing bare repo and
228	+	/// enforce access for the authenticated user. Returns the on-disk path or a
229	+	/// short error message. Rejects traversal.
230	+	async fn authorize_repo(
231	+	app: &App,
232	+	authed_user: Option<i64>,
233	+	rel: &str,
234	+	need_write: bool,
235	+	) -> Result<PathBuf, &'static str> {
236	+	let (owner, repo) = rel
237	+	.trim_start_matches('/')
238	+	.split_once('/')
239	+	.ok_or("invalid repository path")?;
240	+	let name = repo.strip_suffix(".git").unwrap_or(repo);
241	+	let bad = \|s: &str\| s.is_empty() \|\| s.contains("..") \|\| s.contains('\\') \|\| s.contains('/');
242	+	if bad(owner) \|\| bad(name) {
243	+	return Err("invalid repository path");
244	+	}
245	+
246	+	let owner_user = users::find_by_username(&app.db, owner)
247	+	.await
248	+	.ok()
249	+	.flatten()
250	+	.ok_or("repository not found")?;
251	+	let repo = repos::find(&app.db, owner_user.id, name)
252	+	.await
253	+	.ok()
254	+	.flatten()
255	+	.ok_or("repository not found")?;
256	+
257	+	let viewer = match authed_user {
258	+	Some(id) => users::find_by_id(&app.db, id).await.ok().flatten(),
259	+	None => None,
260	+	};
261	+	let allowed = if need_write {
262	+	access::can_write(&repo, viewer.as_ref())
263	+	} else {
264	+	access::can_read(&repo, viewer.as_ref())
265	+	};
266	+	if !allowed {
267	+	return Err("access denied");
268	+	}
269	+
270	+	let path = anvil_core::storage::repo_path(&app.config.repositories_dir(), owner, name);
271	+	if !path.exists() {
272	+	return Err("repository not found");
273	+	}
274	+	Ok(path)
275	+	}

1	+	[package]
2	+	name = "anvil-web"
3	+	version.workspace = true
4	+	edition.workspace = true
5	+	license.workspace = true
6	+	repository.workspace = true
7	+	rust-version.workspace = true
8	+	description = "HTTP server for anvil: web UI and smart-HTTP git endpoints (axum)."
9	+
10	+	[dependencies]
11	+	anvil-core.workspace = true
12	+	anvil-git.workspace = true
13	+	axum.workspace = true
14	+	axum-extra.workspace = true
15	+	tokio.workspace = true
16	+	tokio-util.workspace = true
17	+	tower-http.workspace = true
18	+	tracing.workspace = true
19	+	serde.workspace = true
20	+	base64.workspace = true
21	+	maud.workspace = true
22	+	similar.workspace = true
23	+	syntect.workspace = true
24	+	time.workspace = true

1	+	//! Web authentication: cookie sessions, login/logout, the `CurrentUser`
2	+	//! extractor, and HTTP Basic auth for git push.
3	+
4	+	use std::convert::Infallible;
5	+
6	+	use anvil_core::{
7	+	App,
8	+	User,
9	+	sessions,
10	+	users,
11	+	};
12	+	use axum::{
13	+	Form,
14	+	extract::{
15	+	FromRequestParts,
16	+	State,
17	+	},
18	+	http::request::Parts,
19	+	response::{
20	+	IntoResponse,
21	+	Redirect,
22	+	Response,
23	+	},
24	+	};
25	+	use axum_extra::extract::cookie::{
26	+	Cookie,
27	+	CookieJar,
28	+	SameSite,
29	+	};
30	+	use maud::{
31	+	Markup,
32	+	html,
33	+	};
34	+
35	+	use crate::ui::layout;
36	+
37	+	const SESSION_COOKIE: &str = "anvil_session";
38	+
39	+	/// Extractor yielding the logged-in user, if any, from the session cookie.
40	+	/// Never fails — absence of a valid session simply yields `None`.
41	+	pub struct CurrentUser(pub Option<User>);
42	+
43	+	impl FromRequestParts<App> for CurrentUser {
44	+	type Rejection = Infallible;
45	+
46	+	async fn from_request_parts(parts: &mut Parts, app: &App) -> Result<Self, Infallible> {
47	+	let jar = CookieJar::from_headers(&parts.headers);
48	+	let user = match jar.get(SESSION_COOKIE) {
49	+	Some(cookie) => sessions::lookup_user(&app.db, cookie.value())
50	+	.await
51	+	.ok()
52	+	.flatten(),
53	+	None => None,
54	+	};
55	+	Ok(CurrentUser(user))
56	+	}
57	+	}
58	+
59	+	#[derive(serde::Deserialize)]
60	+	pub struct LoginForm {
61	+	username: String,
62	+	password: String,
63	+	}
64	+
65	+	/// `GET /login` — show the login form (or bounce home if already signed in).
66	+	pub async fn login_form(CurrentUser(user): CurrentUser) -> Response {
67	+	if user.is_some() {
68	+	return Redirect::to("/").into_response();
69	+	}
70	+	login_page(None).into_response()
71	+	}
72	+
73	+	/// `POST /login` — verify credentials, create a session, set the cookie.
74	+	pub async fn login_submit(
75	+	State(app): State<App>,
76	+	jar: CookieJar,
77	+	Form(form): Form<LoginForm>,
78	+	) -> Response {
79	+	let ok = match users::find_by_username(&app.db, &form.username).await {
80	+	Ok(Some(user)) => users::verify_password(&user.password_hash, &form.password)
81	+	.unwrap_or(false)
82	+	.then_some(user),
83	+	_ => None,
84	+	};
85	+
86	+	let Some(user) = ok else {
87	+	return (
88	+	axum::http::StatusCode::UNAUTHORIZED,
89	+	login_page(Some("Invalid username or password.")),
90	+	)
91	+	.into_response();
92	+	};
93	+
94	+	match sessions::create(&app.db, user.id).await {
95	+	Ok(session) => {
96	+	let cookie = Cookie::build((SESSION_COOKIE, session.token))
97	+	.path("/")
98	+	.http_only(true)
99	+	.same_site(SameSite::Lax)
100	+	.build();
101	+	(jar.add(cookie), Redirect::to("/")).into_response()
102	+	}
103	+	Err(e) => {
104	+	tracing::error!("session create failed: {e}");
105	+	(
106	+	axum::http::StatusCode::INTERNAL_SERVER_ERROR,
107	+	login_page(Some("Could not start a session.")),
108	+	)
109	+	.into_response()
110	+	}
111	+	}
112	+	}
113	+
114	+	/// `POST /logout` — destroy the session and clear the cookie.
115	+	pub async fn logout(State(app): State<App>, jar: CookieJar) -> Response {
116	+	if let Some(cookie) = jar.get(SESSION_COOKIE) {
117	+	let _ = sessions::delete(&app.db, cookie.value()).await;
118	+	}
119	+	(jar.remove(Cookie::from(SESSION_COOKIE)), Redirect::to("/")).into_response()
120	+	}
121	+
122	+	fn login_page(error: Option<&str>) -> Markup {
123	+	layout(
124	+	"Sign in",
125	+	None,
126	+	html! {
127	+	h1 { "Sign in" }
128	+	@if let Some(error) = error {
129	+	p style="color:#cf222e" { (error) }
130	+	}
131	+	form method="post" action="/-/login" style="max-width:320px" {
132	+	p { label { "Username" br; input name="username" autofocus; } }
133	+	p { label { "Password" br; input name="password" type="password"; } }
134	+	button type="submit" { "Sign in" }
135	+	}
136	+	},
137	+	)
138	+	}
139	+
140	+	/// Verify HTTP Basic credentials from the `Authorization` header against a user.
141	+	/// Returns the authenticated user, or `None` if absent/invalid.
142	+	pub async fn basic_auth_user(app: &App, authorization: Option<&str>) -> Option<User> {
143	+	use base64::Engine;
144	+
145	+	let encoded = authorization?.strip_prefix("Basic ")?;
146	+	let decoded = base64::engine::general_purpose::STANDARD
147	+	.decode(encoded.trim())
148	+	.ok()?;
149	+	let creds = String::from_utf8(decoded).ok()?;
150	+	let (username, password) = creds.split_once(':')?;
151	+
152	+	let user = users::find_by_username(&app.db, username).await.ok()??;
153	+	users::verify_password(&user.password_hash, password)
154	+	.unwrap_or(false)
155	+	.then_some(user)
156	+	}

1	+	//! Smart-HTTP git endpoints: `info/refs`, `git-upload-pack` (clone/fetch), and
2	+	//! `git-receive-pack` (push). These adapt the transport-agnostic protocol layer
3	+	//! in [`anvil_git::smart_http`] to axum.
4	+	//!
5	+	//! Routes are mounted under `/{owner}/{repo}/…` where `{repo}` is the URL form
6	+	//! including the `.git` suffix (e.g. `/alice/hello.git/info/refs`).
7	+	//!
8	+	//! Access control: public repos may be cloned anonymously; private repos and all
9	+	//! pushes require HTTP Basic auth, enforced via [`anvil_core::access`].
10	+
11	+	use std::collections::HashMap;
12	+	use std::path::PathBuf;
13	+
14	+	use anvil_core::{
15	+	App,
16	+	Repository,
17	+	access,
18	+	repos,
19	+	users,
20	+	};
21	+	use anvil_git::smart_http::{
22	+	self,
23	+	Service,
24	+	UploadPack,
25	+	};
26	+	use axum::{
27	+	Router,
28	+	body::{
29	+	Body,
30	+	Bytes,
31	+	},
32	+	extract::{
33	+	Path,
34	+	Query,
35	+	State,
36	+	},
37	+	http::{
38	+	HeaderMap,
39	+	StatusCode,
40	+	header,
41	+	},
42	+	response::{
43	+	IntoResponse,
44	+	Response,
45	+	},
46	+	routing::{
47	+	get,
48	+	post,
49	+	},
50	+	};
51	+	use tokio_util::io::ReaderStream;
52	+
53	+	/// Mount the smart-HTTP git routes onto `router`.
54	+	pub fn routes(router: Router<App>) -> Router<App> {
55	+	router
56	+	.route("/{owner}/{repo}/info/refs", get(info_refs))
57	+	.route("/{owner}/{repo}/git-upload-pack", post(upload_pack))
58	+	.route("/{owner}/{repo}/git-receive-pack", post(receive_pack))
59	+	}
60	+
61	+	/// Resolve `<owner>/<repo>` (repo may carry a `.git` suffix) to its on-disk path
62	+	/// and metadata row, rejecting traversal and missing repos.
63	+	async fn load_repo(app: &App, owner: &str, repo: &str) -> Result<(PathBuf, Repository), Response> {
64	+	let name = repo.strip_suffix(".git").unwrap_or(repo);
65	+	let bad = \|s: &str\| s.is_empty() \|\| s.contains('/') \|\| s.contains('\\') \|\| s.contains("..");
66	+	if bad(owner) \|\| bad(name) {
67	+	return Err((StatusCode::BAD_REQUEST, "invalid repository path").into_response());
68	+	}
69	+	let not_found = \|\| (StatusCode::NOT_FOUND, "repository not found").into_response();
70	+	let owner_user = users::find_by_username(&app.db, owner)
71	+	.await
72	+	.map_err(internal)?
73	+	.ok_or_else(not_found)?;
74	+	let meta = repos::find(&app.db, owner_user.id, name)
75	+	.await
76	+	.map_err(internal)?
77	+	.ok_or_else(not_found)?;
78	+	let path = anvil_core::storage::repo_path(&app.config.repositories_dir(), owner, name);
79	+	if !path.exists() {
80	+	return Err(not_found());
81	+	}
82	+	Ok((path, meta))
83	+	}
84	+
85	+	/// Enforce access for a git request: anonymous reads are allowed for public
86	+	/// repos; private reads and all writes require valid Basic credentials. On
87	+	/// failure, returns a `401` with a `WWW-Authenticate` challenge so the git
88	+	/// client prompts for credentials.
89	+	async fn authorize(
90	+	app: &App,
91	+	headers: &HeaderMap,
92	+	repo: &Repository,
93	+	need_write: bool,
94	+	) -> Result<(), Response> {
95	+	let authorization = headers
96	+	.get(header::AUTHORIZATION)
97	+	.and_then(\|v\| v.to_str().ok());
98	+	let user = crate::auth::basic_auth_user(app, authorization).await;
99	+	let allowed = if need_write {
100	+	access::can_write(repo, user.as_ref())
101	+	} else {
102	+	access::can_read(repo, user.as_ref())
103	+	};
104	+	if allowed {
105	+	Ok(())
106	+	} else {
107	+	Err(Response::builder()
108	+	.status(StatusCode::UNAUTHORIZED)
109	+	.header(header::WWW_AUTHENTICATE, "Basic realm=\"anvil\"")
110	+	.body(Body::from("authentication required"))
111	+	.unwrap())
112	+	}
113	+	}
114	+
115	+	/// True if the client requested git protocol v2 via the `Git-Protocol` header.
116	+	fn wants_v2(headers: &HeaderMap) -> bool {
117	+	headers
118	+	.get("git-protocol")
119	+	.and_then(\|v\| v.to_str().ok())
120	+	.map(\|v\| v.split(':').any(\|item\| item.trim() == "version=2"))
121	+	.unwrap_or(false)
122	+	}
123	+
124	+	fn internal(err: impl std::fmt::Display) -> Response {
125	+	tracing::error!("git smart-http error: {err}");
126	+	(StatusCode::INTERNAL_SERVER_ERROR, "internal server error").into_response()
127	+	}
128	+
129	+	fn rpc_response(content_type: String, body: Body) -> Response {
130	+	Response::builder()
131	+	.status(StatusCode::OK)
132	+	.header(header::CONTENT_TYPE, content_type)
133	+	.header(header::CACHE_CONTROL, "no-cache")
134	+	.body(body)
135	+	.unwrap()
136	+	}
137	+
138	+	/// `GET /{owner}/{repo}/info/refs?service=…` — ref advertisement.
139	+	async fn info_refs(
140	+	State(app): State<App>,
141	+	Path((owner, repo)): Path<(String, String)>,
142	+	Query(query): Query<HashMap<String, String>>,
143	+	headers: HeaderMap,
144	+	) -> Response {
145	+	let (path, meta) = match load_repo(&app, &owner, &repo).await {
146	+	Ok(v) => v,
147	+	Err(resp) => return resp,
148	+	};
149	+	let Some(service) = query.get("service").and_then(\|s\| Service::from_query(s)) else {
150	+	return (StatusCode::BAD_REQUEST, "missing or unsupported service").into_response();
151	+	};
152	+	let need_write = service == Service::ReceivePack;
153	+	if let Err(resp) = authorize(&app, &headers, &meta, need_write).await {
154	+	return resp;
155	+	}
156	+
157	+	let v2 = service == Service::UploadPack && wants_v2(&headers);
158	+	match smart_http::advertise(&path, service, v2) {
159	+	Ok(body) => Response::builder()
160	+	.status(StatusCode::OK)
161	+	.header(header::CONTENT_TYPE, service.advertisement_content_type())
162	+	.header(header::CACHE_CONTROL, "no-cache")
163	+	.body(Body::from(body))
164	+	.unwrap(),
165	+	Err(e) => internal(e),
166	+	}
167	+	}
168	+
169	+	/// `POST /{owner}/{repo}/git-upload-pack` — clone/fetch (read access).
170	+	async fn upload_pack(
171	+	State(app): State<App>,
172	+	Path((owner, repo)): Path<(String, String)>,
173	+	headers: HeaderMap,
174	+	body: Bytes,
175	+	) -> Response {
176	+	let (path, meta) = match load_repo(&app, &owner, &repo).await {
177	+	Ok(v) => v,
178	+	Err(resp) => return resp,
179	+	};
180	+	if let Err(resp) = authorize(&app, &headers, &meta, false).await {
181	+	return resp;
182	+	}
183	+	let content_type = Service::UploadPack.result_content_type();
184	+
185	+	if wants_v2(&headers) {
186	+	match smart_http::upload_pack_v2(&path, &body).await {
187	+	Ok(UploadPack::Buffered(b)) => rpc_response(content_type, Body::from(b)),
188	+	Ok(UploadPack::Pack(reader)) => {
189	+	rpc_response(content_type, Body::from_stream(ReaderStream::new(reader)))
190	+	}
191	+	Err(e) => internal(e),
192	+	}
193	+	} else {
194	+	match smart_http::upload_pack_v0(&path, &body).await {
195	+	Ok(reader) => rpc_response(content_type, Body::from_stream(ReaderStream::new(reader))),
196	+	Err(e) => internal(e),
197	+	}
198	+	}
199	+	}
200	+
201	+	/// `POST /{owner}/{repo}/git-receive-pack` — push (write access).
202	+	async fn receive_pack(
203	+	State(app): State<App>,
204	+	Path((owner, repo)): Path<(String, String)>,
205	+	headers: HeaderMap,
206	+	body: Bytes,
207	+	) -> Response {
208	+	let (path, meta) = match load_repo(&app, &owner, &repo).await {
209	+	Ok(v) => v,
210	+	Err(resp) => return resp,
211	+	};
212	+	if let Err(resp) = authorize(&app, &headers, &meta, true).await {
213	+	return resp;
214	+	}
215	+
216	+	let reader = std::io::Cursor::new(body.to_vec());
217	+	match smart_http::receive_pack(&path, reader).await {
218	+	Ok(b) => rpc_response(Service::ReceivePack.result_content_type(), Body::from(b)),
219	+	Err(e) => internal(e),
220	+	}
221	+	}

1	+	//! HTTP server for anvil: the web UI and the smart-HTTP git endpoints
2	+	//! (`/<owner>/<repo>.git/info/refs`, `/git-upload-pack`, `/git-receive-pack`),
3	+	//! plus cookie-session auth.
4	+
5	+	// Handlers return `Result<_, Response>` — the idiomatic axum pattern where the
6	+	// error arm is a ready-made HTTP response (404/500/redirect). `Response` is
7	+	// intrinsically large, so `result_large_err` fires across the crate; the
8	+	// pattern is intentional and the responses are never hot-path allocated en masse.
9	+	#![allow(clippy::result_large_err)]
10	+
11	+	use anvil_core::{
12	+	App,
13	+	Result,
14	+	};
15	+	use axum::{
16	+	Router,
17	+	routing::{
18	+	get,
19	+	post,
20	+	},
21	+	};
22	+
23	+	pub mod auth;
24	+	pub mod git_http;
25	+	pub mod ui;
26	+
27	+	/// Build the application router.
28	+	pub fn router(app: App) -> Router {
29	+	let mut router = Router::new()
30	+	.route("/-/healthz", get(healthz))
31	+	.route("/-/login", get(auth::login_form).post(auth::login_submit))
32	+	.route("/-/logout", post(auth::logout));
33	+	router = ui::routes(router); // web UI, including `/`
34	+	router = git_http::routes(router); // smart-HTTP git endpoints
35	+	router.with_state(app)
36	+	}
37	+
38	+	/// Bind to the configured HTTP address and serve until shutdown.
39	+	pub async fn serve(app: App) -> Result<()> {
40	+	let listen = app.config.http.listen.clone();
41	+	let router = router(app);
42	+
43	+	let listener = tokio::net::TcpListener::bind(&listen).await?;
44	+	tracing::info!("anvil web server listening on http://{listen}");
45	+	axum::serve(listener, router).await?;
46	+	Ok(())
47	+	}
48	+
49	+	async fn healthz() -> &'static str {
50	+	"ok"
51	+	}

1	+	[package]
2	+	name = "anvil"
3	+	version.workspace = true
4	+	edition.workspace = true
5	+	license.workspace = true
6	+	repository.workspace = true
7	+	rust-version.workspace = true
8	+	description = "anvil git forge daemon and admin CLI."
9	+	default-run = "anvild"
10	+
11	+	[[bin]]
12	+	name = "anvild"
13	+	path = "src/main.rs"
14	+
15	+	[dependencies]
16	+	anvil-core.workspace = true
17	+	anvil-web.workspace = true
18	+	anvil-ssh.workspace = true
19	+	tokio.workspace = true
20	+	clap.workspace = true
21	+	anyhow.workspace = true
22	+	tracing.workspace = true
23	+	tracing-subscriber.workspace = true

1	+	//! `anvild` — the anvil git forge daemon and admin CLI.
2	+
3	+	use anvil_core::{
4	+	App,
5	+	Config,
6	+	repos,
7	+	ssh_keys,
8	+	users,
9	+	};
10	+	use anyhow::{
11	+	Context,
12	+	Result,
13	+	};
14	+	use clap::{
15	+	Parser,
16	+	Subcommand,
17	+	};
18	+
19	+	#[derive(Parser)]
20	+	#[command(name = "anvild", version, about = "anvil git forge")]
21	+	struct Cli {
22	+	/// Path to the configuration file (TOML). Defaults are used if absent.
23	+	#[arg(long, short, default_value = "anvil.toml", global = true)]
24	+	config: String,
25	+
26	+	/// Override the data directory from config.
27	+	#[arg(long, global = true)]
28	+	data_dir: Option<String>,
29	+
30	+	#[command(subcommand)]
31	+	command: Option<Command>,
32	+	}
33	+
34	+	#[derive(Subcommand)]
35	+	enum Command {
36	+	/// Run the server (default).
37	+	Serve,
38	+	/// Apply database migrations and exit.
39	+	Migrate,
40	+	/// Manage users.
41	+	User {
42	+	#[command(subcommand)]
43	+	command: UserCommand,
44	+	},
45	+	/// Manage repositories.
46	+	Repo {
47	+	#[command(subcommand)]
48	+	command: RepoCommand,
49	+	},
50	+	}
51	+
52	+	#[derive(Subcommand)]
53	+	enum UserCommand {
54	+	/// Create a new user.
55	+	Create {
56	+	username: String,
57	+	#[arg(long, default_value = "")]
58	+	email: String,
59	+	#[arg(long)]
60	+	password: String,
61	+	#[arg(long)]
62	+	admin: bool,
63	+	},
64	+	/// Register an SSH public key for a user (for git-over-SSH access).
65	+	AddKey {
66	+	username: String,
67	+	/// The OpenSSH public key line. Mutually exclusive with --key-file.
68	+	#[arg(long)]
69	+	key: Option<String>,
70	+	/// Path to a `.pub` file (e.g. ~/.ssh/id_ed25519.pub).
71	+	#[arg(long)]
72	+	key_file: Option<String>,
73	+	#[arg(long, default_value = "")]
74	+	title: String,
75	+	},
76	+	}
77	+
78	+	#[derive(Subcommand)]
79	+	enum RepoCommand {
80	+	/// Create a repository, given as `owner/name`.
81	+	Create {
82	+	/// Repository in `owner/name` form.
83	+	path: String,
84	+	#[arg(long, default_value = "")]
85	+	description: String,
86	+	#[arg(long)]
87	+	private: bool,
88	+	},
89	+	}
90	+
91	+	#[tokio::main]
92	+	async fn main() -> Result<()> {
93	+	tracing_subscriber::fmt()
94	+	.with_env_filter(
95	+	tracing_subscriber::EnvFilter::try_from_default_env().unwrap_or_else(\|_\| "info".into()),
96	+	)
97	+	.init();
98	+
99	+	let cli = Cli::parse();
100	+
101	+	let mut config = Config::load_or_default(&cli.config)
102	+	.with_context(\|\| format!("loading config from {}", cli.config))?;
103	+	if let Some(dir) = &cli.data_dir {
104	+	config.data_dir = dir.into();
105	+	}
106	+
107	+	match cli.command.unwrap_or(Command::Serve) {
108	+	Command::Serve => serve(config).await,
109	+	Command::Migrate => migrate(config).await,
110	+	Command::User { command } => user(config, command).await,
111	+	Command::Repo { command } => repo(config, command).await,
112	+	}
113	+	}
114	+
115	+	async fn serve(config: Config) -> Result<()> {
116	+	let app = App::bootstrap(config).await?;
117	+	if app.config.ssh.enabled {
118	+	// Run the HTTP and SSH servers concurrently; if either exits, stop.
119	+	tokio::try_join!(anvil_web::serve(app.clone()), anvil_ssh::serve(app))?;
120	+	} else {
121	+	anvil_web::serve(app).await?;
122	+	}
123	+	Ok(())
124	+	}
125	+
126	+	async fn migrate(config: Config) -> Result<()> {
127	+	App::bootstrap(config).await?;
128	+	println!("migrations applied");
129	+	Ok(())
130	+	}
131	+
132	+	async fn user(config: Config, command: UserCommand) -> Result<()> {
133	+	let app = App::bootstrap(config).await?;
134	+	match command {
135	+	UserCommand::Create {
136	+	username,
137	+	email,
138	+	password,
139	+	admin,
140	+	} => {
141	+	let user = users::create(&app.db, &username, &email, &password, admin).await?;
142	+	println!(
143	+	"created user {} (id {}){}",
144	+	user.username,
145	+	user.id,
146	+	if user.is_admin { " [admin]" } else { "" }
147	+	);
148	+	}
149	+	UserCommand::AddKey {
150	+	username,
151	+	key,
152	+	key_file,
153	+	title,
154	+	} => {
155	+	let user = users::find_by_username(&app.db, &username)
156	+	.await?
157	+	.with_context(\|\| format!("no such user: {username}"))?;
158	+	let openssh = match (key, key_file) {
159	+	(Some(k), None) => k,
160	+	(None, Some(path)) => std::fs::read_to_string(&path)
161	+	.with_context(\|\| format!("reading key file {path}"))?,
162	+	(Some(_), Some(_)) => anyhow::bail!("pass only one of --key / --key-file"),
163	+	(None, None) => anyhow::bail!("pass --key or --key-file"),
164	+	};
165	+	let (fingerprint, content) = ssh_keys::parse_public_key(&openssh)?;
166	+	let saved = ssh_keys::add(&app.db, user.id, &title, &fingerprint, &content).await?;
167	+	println!(
168	+	"added ssh key for {} ({})",
169	+	user.username, saved.fingerprint
170	+	);
171	+	}
172	+	}
173	+	Ok(())
174	+	}
175	+
176	+	async fn repo(config: Config, command: RepoCommand) -> Result<()> {
177	+	let app = App::bootstrap(config).await?;
178	+	match command {
179	+	RepoCommand::Create {
180	+	path,
181	+	description,
182	+	private,
183	+	} => {
184	+	let (owner_name, name) = path
185	+	.split_once('/')
186	+	.context("repository path must be in `owner/name` form")?;
187	+	let owner = users::find_by_username(&app.db, owner_name)
188	+	.await?
189	+	.with_context(\|\| format!("no such user: {owner_name}"))?;
190	+	let repo = repos::create(
191	+	&app.db,
192	+	&app.config.repositories_dir(),
193	+	&owner,
194	+	name,
195	+	&description,
196	+	private,
197	+	)
198	+	.await?;
199	+	println!(
200	+	"created repository {}/{} (id {}) at {}",
201	+	owner.username,
202	+	repo.name,
203	+	repo.id,
204	+	anvil_core::storage::repo_path(
205	+	&app.config.repositories_dir(),
206	+	&owner.username,
207	+	name
208	+	)
209	+	.display()
210	+	);
211	+	}
212	+	}
213	+	Ok(())
214	+	}

1	+	# https://github.com/rust-lang/rustfmt/blob/master/Configurations.md
2	+
3	+	# using nightly rustfmt options
4	+	# use: cargo +nightly fmt
5	+
6	+	group_imports = "StdExternalCrate"
7	+	imports_layout = "Vertical"

1	+	[package]
2	+	name = "gitserver-core"
3	+	description = "Core Git protocol operations (vendored into anvil from WJQSERVER/gitserver, bumped to gix 0.84)."
4	+	version = "0.0.3"
5	+	edition = "2024"
6	+	license = "MPL-2.0"
7	+	repository = "https://github.com/WJQSERVER/gitserver"
8	+
9	+	[dependencies]
10	+	# gix / gix-pack come from the anvil workspace (bumped to 0.84 / 0.71 here).
11	+	gix = { workspace = true }
12	+	gix-pack = { workspace = true }
13	+	tokio = { workspace = true }
14	+	tracing = { workspace = true }
15	+	serde = { workspace = true }
16	+	thiserror = { workspace = true }
17	+	miniz_oxide = "0.8"
18	+	sha1 = "0.10"
19	+	tokio-stream = "0.1"
20	+	tokio-util = { version = "0.7", features = ["io", "io-util"] }
21	+	bytes = "1"
22	+
23	+	[dev-dependencies]
24	+	tempfile = "3"
25	+	tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

1	+	Mozilla Public License Version 2.0
2	+	==================================
3	+
4	+	1. Definitions
5	+	--------------
6	+
7	+	1.1. "Contributor"
8	+	means each individual or legal entity that creates, contributes to
9	+	the creation of, or owns Covered Software.
10	+
11	+	1.2. "Contributor Version"
12	+	means the combination of the Contributions of others (if any) used
13	+	by a Contributor and that particular Contributor's Contribution.
14	+
15	+	1.3. "Contribution"
16	+	means Covered Software of a particular Contributor.
17	+
18	+	1.4. "Covered Software"
19	+	means Source Code Form to which the initial Contributor has attached
20	+	the notice in Exhibit A, the Executable Form of such Source Code
21	+	Form, and Modifications of such Source Code Form, in each case
22	+	including portions thereof.
23	+
24	+	1.5. "Incompatible With Secondary Licenses"
25	+	means
26	+
27	+	(a) that the initial Contributor has attached the notice described
28	+	in Exhibit B to the Covered Software; or
29	+
30	+	(b) that the Covered Software was made available under the terms of
31	+	version 1.1 or earlier of the License, but not also under the
32	+	terms of a Secondary License.
33	+
34	+	1.6. "Executable Form"
35	+	means any form of the work other than Source Code Form.
36	+
37	+	1.7. "Larger Work"
38	+	means a work that combines Covered Software with other material, in
39	+	a separate file or files, that is not Covered Software.
40	+
41	+	1.8. "License"
42	+	means this document.
43	+
44	+	1.9. "Licensable"
45	+	means having the right to grant, to the maximum extent possible,
46	+	whether at the time of the initial grant or subsequently, any and
47	+	all of the rights conveyed by this License.
48	+
49	+	1.10. "Modifications"
50	+	means any of the following:
51	+
52	+	(a) any file in Source Code Form that results from an addition to,
53	+	deletion from, or modification of the contents of Covered
54	+	Software; or
55	+
56	+	(b) any new file in Source Code Form that contains any Covered
57	+	Software.
58	+
59	+	1.11. "Patent Claims" of a Contributor
60	+	means any patent claim(s), including without limitation, method,
61	+	process, and apparatus claims, in any patent Licensable by such
62	+	Contributor that would be infringed, but for the grant of the
63	+	License, by the making, using, selling, offering for sale, having
64	+	made, import, or transfer of either its Contributions or its
65	+	Contributor Version.
66	+
67	+	1.12. "Secondary License"
68	+	means either the GNU General Public License, Version 2.0, the GNU
69	+	Lesser General Public License, Version 2.1, the GNU Affero General
70	+	Public License, Version 3.0, or any later versions of those
71	+	licenses.
72	+
73	+	1.13. "Source Code Form"
74	+	means the form of the work preferred for making modifications.
75	+
76	+	1.14. "You" (or "Your")
77	+	means an individual or a legal entity exercising rights under this
78	+	License. For legal entities, "You" includes any entity that
79	+	controls, is controlled by, or is under common control with You. For
80	+	purposes of this definition, "control" means (a) the power, direct
81	+	or indirect, to cause the direction or management of such entity,
82	+	whether by contract or otherwise, or (b) ownership of more than
83	+	fifty percent (50%) of the outstanding shares or beneficial
84	+	ownership of such entity.
85	+
86	+	2. License Grants and Conditions
87	+	--------------------------------
88	+
89	+	2.1. Grants
90	+
91	+	Each Contributor hereby grants You a world-wide, royalty-free,
92	+	non-exclusive license:
93	+
94	+	(a) under intellectual property rights (other than patent or trademark)
95	+	Licensable by such Contributor to use, reproduce, make available,
96	+	modify, display, perform, distribute, and otherwise exploit its
97	+	Contributions, either on an unmodified basis, with Modifications, or
98	+	as part of a Larger Work; and
99	+
100	+	(b) under Patent Claims of such Contributor to make, use, sell, offer
101	+	for sale, have made, import, and otherwise transfer either its
102	+	Contributions or its Contributor Version.
103	+
104	+	2.2. Effective Date
105	+
106	+	The licenses granted in Section 2.1 with respect to any Contribution
107	+	become effective for each Contribution on the date the Contributor first
108	+	distributes such Contribution.
109	+
110	+	2.3. Limitations on Grant Scope
111	+
112	+	The licenses granted in this Section 2 are the only rights granted under
113	+	this License. No additional rights or licenses will be implied from the
114	+	distribution or licensing of Covered Software under this License.
115	+	Notwithstanding Section 2.1(b) above, no patent license is granted by a
116	+	Contributor:
117	+
118	+	(a) for any code that a Contributor has removed from Covered Software;
119	+	or
120	+
121	+	(b) for infringements caused by: (i) Your and any other third party's
122	+	modifications of Covered Software, or (ii) the combination of its
123	+	Contributions with other software (except as part of its Contributor
124	+	Version); or
125	+
126	+	(c) under Patent Claims infringed by Covered Software in the absence of
127	+	its Contributions.
128	+
129	+	This License does not grant any rights in the trademarks, service marks,
130	+	or logos of any Contributor (except as may be necessary to comply with
131	+	the notice requirements in Section 3.4).
132	+
133	+	2.4. Subsequent Licenses
134	+
135	+	No Contributor makes additional grants as a result of Your choice to
136	+	distribute the Covered Software under a subsequent version of this
137	+	License (see Section 10.2) or under the terms of a Secondary License (if
138	+	permitted under the terms of Section 3.3).
139	+
140	+	2.5. Representation
141	+
142	+	Each Contributor represents that the Contributor believes its
143	+	Contributions are its original creation(s) or it has sufficient rights
144	+	to grant the rights to its Contributions conveyed by this License.
145	+
146	+	2.6. Fair Use
147	+
148	+	This License is not intended to limit any rights You have under
149	+	applicable copyright doctrines of fair use, fair dealing, or other
150	+	equivalents.
151	+
152	+	2.7. Conditions
153	+
154	+	Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
155	+	in Section 2.1.
156	+
157	+	3. Responsibilities
158	+	-------------------
159	+
160	+	3.1. Distribution of Source Form
161	+
162	+	All distribution of Covered Software in Source Code Form, including any
163	+	Modifications that You create or to which You contribute, must be under
164	+	the terms of this License. You must inform recipients that the Source
165	+	Code Form of the Covered Software is governed by the terms of this
166	+	License, and how they can obtain a copy of this License. You may not
167	+	attempt to alter or restrict the recipients' rights in the Source Code
168	+	Form.
169	+
170	+	3.2. Distribution of Executable Form
171	+
172	+	If You distribute Covered Software in Executable Form then:
173	+
174	+	(a) such Covered Software must also be made available in Source Code
175	+	Form, as described in Section 3.1, and You must inform recipients of
176	+	the Executable Form how they can obtain a copy of such Source Code
177	+	Form by reasonable means in a timely manner, at a charge no more
178	+	than the cost of distribution to the recipient; and
179	+
180	+	(b) You may distribute such Executable Form under the terms of this
181	+	License, or sublicense it under different terms, provided that the
182	+	license for the Executable Form does not attempt to limit or alter
183	+	the recipients' rights in the Source Code Form under this License.
184	+
185	+	3.3. Distribution of a Larger Work
186	+
187	+	You may create and distribute a Larger Work under terms of Your choice,
188	+	provided that You also comply with the requirements of this License for
189	+	the Covered Software. If the Larger Work is a combination of Covered
190	+	Software with a work governed by one or more Secondary Licenses, and the
191	+	Covered Software is not Incompatible With Secondary Licenses, this
192	+	License permits You to additionally distribute such Covered Software
193	+	under the terms of such Secondary License(s), so that the recipient of
194	+	the Larger Work may, at their option, further distribute the Covered
195	+	Software under the terms of either this License or such Secondary
196	+	License(s).
197	+
198	+	3.4. Notices
199	+
200	+	You may not remove or alter the substance of any license notices
201	+	(including copyright notices, patent notices, disclaimers of warranty,
202	+	or limitations of liability) contained within the Source Code Form of
203	+	the Covered Software, except that You may alter any license notices to
204	+	the extent required to remedy known factual inaccuracies.
205	+
206	+	3.5. Application of Additional Terms
207	+
208	+	You may choose to offer, and to charge a fee for, warranty, support,
209	+	indemnity or liability obligations to one or more recipients of Covered
210	+	Software. However, You may do so only on Your own behalf, and not on
211	+	behalf of any Contributor. You must make it absolutely clear that any
212	+	such warranty, support, indemnity, or liability obligation is offered by
213	+	You alone, and You hereby agree to indemnify every Contributor for any
214	+	liability incurred by such Contributor as a result of warranty, support,
215	+	indemnity or liability terms You offer. You may include additional
216	+	disclaimers of warranty and limitations of liability specific to any
217	+	jurisdiction.
218	+
219	+	4. Inability to Comply Due to Statute or Regulation
220	+	---------------------------------------------------
221	+
222	+	If it is impossible for You to comply with any of the terms of this
223	+	License with respect to some or all of the Covered Software due to
224	+	statute, judicial order, or regulation then You must: (a) comply with
225	+	the terms of this License to the maximum extent possible; and (b)
226	+	describe the limitations and the code they affect. Such description must
227	+	be placed in a text file included with all distributions of the Covered
228	+	Software under this License. Except to the extent prohibited by statute
229	+	or regulation, such description must be sufficiently detailed for a
230	+	recipient of ordinary skill to be able to understand it.
231	+
232	+	5. Termination
233	+	--------------
234	+
235	+	5.1. The rights granted under this License will terminate automatically
236	+	if You fail to comply with any of its terms. However, if You become
237	+	compliant, then the rights granted under this License from a particular
238	+	Contributor are reinstated (a) provisionally, unless and until such
239	+	Contributor explicitly and finally terminates Your grants, and (b) on an
240	+	ongoing basis, if such Contributor fails to notify You of the
241	+	non-compliance by some reasonable means prior to 60 days after You have
242	+	come back into compliance. Moreover, Your grants from a particular
243	+	Contributor are reinstated on an ongoing basis if such Contributor
244	+	notifies You of the non-compliance by some reasonable means, this is the
245	+	first time You have received notice of non-compliance with this License
246	+	from such Contributor, and You become compliant prior to 30 days after
247	+	Your receipt of the notice.
248	+
249	+	5.2. If You initiate litigation against any entity by asserting a patent
250	+	infringement claim (excluding declaratory judgment actions,
251	+	counter-claims, and cross-claims) alleging that a Contributor Version
252	+	directly or indirectly infringes any patent, then the rights granted to
253	+	You by any and all Contributors for the Covered Software under Section
254	+	2.1 of this License shall terminate.
255	+
256	+	5.3. In the event of termination under Sections 5.1 or 5.2 above, all
257	+	end user license agreements (excluding distributors and resellers) which
258	+	have been validly granted by You or Your distributors under this License
259	+	prior to termination shall survive termination.
260	+
261	+	************************************************************************
262	+	* *
263	+	* 6. Disclaimer of Warranty *
264	+	* ------------------------- *
265	+	* *
266	+	* Covered Software is provided under this License on an "as is" *
267	+	* basis, without warranty of any kind, either expressed, implied, or *
268	+	* statutory, including, without limitation, warranties that the *
269	+	* Covered Software is free of defects, merchantable, fit for a *
270	+	* particular purpose or non-infringing. The entire risk as to the *
271	+	* quality and performance of the Covered Software is with You. *
272	+	* Should any Covered Software prove defective in any respect, You *
273	+	* (not any Contributor) assume the cost of any necessary servicing, *
274	+	* repair, or correction. This disclaimer of warranty constitutes an *
275	+	* essential part of this License. No use of any Covered Software is *
276	+	* authorized under this License except under this disclaimer. *
277	+	* *
278	+	************************************************************************
279	+
280	+	************************************************************************
281	+	* *
282	+	* 7. Limitation of Liability *
283	+	* -------------------------- *
284	+	* *
285	+	* Under no circumstances and under no legal theory, whether tort *
286	+	* (including negligence), contract, or otherwise, shall any *
287	+	* Contributor, or anyone who distributes Covered Software as *
288	+	* permitted above, be liable to You for any direct, indirect, *
289	+	* special, incidental, or consequential damages of any character *
290	+	* including, without limitation, damages for lost profits, loss of *
291	+	* goodwill, work stoppage, computer failure or malfunction, or any *
292	+	* and all other commercial damages or losses, even if such party *
293	+	* shall have been informed of the possibility of such damages. This *
294	+	* limitation of liability shall not apply to liability for death or *
295	+	* personal injury resulting from such party's negligence to the *
296	+	* extent applicable law prohibits such limitation. Some *
297	+	* jurisdictions do not allow the exclusion or limitation of *
298	+	* incidental or consequential damages, so this exclusion and *
299	+	* limitation may not apply to You. *
300	+	* *
301	+	************************************************************************
302	+
303	+	8. Litigation
304	+	-------------
305	+
306	+	Any litigation relating to this License may be brought only in the
307	+	courts of a jurisdiction where the defendant maintains its principal
308	+	place of business and such litigation shall be governed by laws of that
309	+	jurisdiction, without reference to its conflict-of-law provisions.
310	+	Nothing in this Section shall prevent a party's ability to bring
311	+	cross-claims or counter-claims.
312	+
313	+	9. Miscellaneous
314	+	----------------
315	+
316	+	This License represents the complete agreement concerning the subject
317	+	matter hereof. If any provision of this License is held to be
318	+	unenforceable, such provision shall be reformed only to the extent
319	+	necessary to make it enforceable. Any law or regulation which provides
320	+	that the language of a contract shall be construed against the drafter
321	+	shall not be used to construe this License against a Contributor.
322	+
323	+	10. Versions of the License
324	+	---------------------------
325	+
326	+	10.1. New Versions
327	+
328	+	Mozilla Foundation is the license steward. Except as provided in Section
329	+	10.3, no one other than the license steward has the right to modify or
330	+	publish new versions of this License. Each version will be given a
331	+	distinguishing version number.
332	+
333	+	10.2. Effect of New Versions
334	+
335	+	You may distribute the Covered Software under the terms of the version
336	+	of the License under which You originally received the Covered Software,
337	+	or under the terms of any subsequent version published by the license
338	+	steward.
339	+
340	+	10.3. Modified Versions
341	+
342	+	If you create software not governed by this License, and you want to
343	+	create a new license for such software, you may create and use a
344	+	modified version of this License if you rename the license and remove
345	+	any references to the name of the license steward (except to note that
346	+	such modified license differs from this License).
347	+
348	+	10.4. Distributing Source Code Form that is Incompatible With Secondary
349	+	Licenses
350	+
351	+	If You choose to distribute Source Code Form that is Incompatible With
352	+	Secondary Licenses under the terms of this version of the License, the
353	+	notice described in Exhibit B of this License must be attached.
354	+
355	+	Exhibit A - Source Code Form License Notice
356	+	-------------------------------------------
357	+
358	+	This Source Code Form is subject to the terms of the Mozilla Public
359	+	License, v. 2.0. If a copy of the MPL was not distributed with this
360	+	file, You can obtain one at https://mozilla.org/MPL/2.0/.
361	+
362	+	If it is not possible or desirable to put the notice in a particular
363	+	file, then You may include the notice in a location (such as a LICENSE
364	+	file in a relevant directory) where a recipient would be likely to look
365	+	for such a notice.
366	+
367	+	You may add additional accurate notices of copyright ownership.
368	+
369	+	Exhibit B - "Incompatible With Secondary Licenses" Notice
370	+	---------------------------------------------------------
371	+
372	+	This Source Code Form is "Incompatible With Secondary Licenses", as
373	+	defined by the Mozilla Public License, v. 2.0.

1	+	Copyright (c) 2026 WJQSERVER
2	+
3	+	Repository licensing summary:
4	+	- Primary repository license: MPL-2.0 (see `LICENSE`)
5	+	- Upstream project: https://github.com/ggueret/git-server
6	+	- Upstream MIT license text is preserved in `UPSTREAM-LICENSE` and in each crate's `license/UPSTREAM-LICENSE`
7	+	- File-level notices and preserved upstream license files govern specific files where applicable

1	+	MIT License
2	+
3	+	Copyright (c) 2026 Geoffrey Guéret
4	+
5	+	Permission is hereby granted, free of charge, to any person obtaining a copy
6	+	of this software and associated documentation files (the "Software"), to deal
7	+	in the Software without restriction, including without limitation the rights
8	+	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9	+	copies of the Software, and to permit persons to whom the Software is
10	+	furnished to do so, subject to the following conditions:
11	+
12	+	The above copyright notice and this permission notice shall be included in all
13	+	copies or substantial portions of the Software.
14	+
15	+	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16	+	IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17	+	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18	+	AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19	+	LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20	+	OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21	+	SOFTWARE.

1	+	# Vendored: gitserver-core
2	+
3	+	This is a vendored, modified copy of the `gitserver-core` crate from
4	+	[WJQSERVER/gitserver](https://github.com/WJQSERVER/gitserver), which implements
5	+	the server side of the git wire protocol (pkt-line, protocol v2 `ls-refs` /
6	+	`fetch` / `upload-pack`, and `receive-pack`) on top of `gix` — the piece gix
7	+	itself does not provide.
8	+
9	+	- Upstream commit: `3cec05b02eea3220c67782e4d9d0404d8b001aa3` (2026-04-27)
10	+	- License: MPL-2.0 (see `LICENSE`); upstream MIT material noted in
11	+	`UPSTREAM-LICENSE` / `NOTICE`. MPL is file-level copyleft: modifications to
12	+	these files stay MPL, but anvil as a whole may carry its own license.
13	+
14	+	## Why vendored
15	+
16	+	We vendor rather than depend on crates.io so we can (1) bump `gix` from the
17	+	upstream-pinned 0.80 to the workspace version (0.84) and keep it in lockstep
18	+	with the rest of anvil, and (2) modify the protocol code as `anvil-git` evolves.
19	+
20	+	`anvil-git` wraps this crate behind its own interface so the dependency can be
21	+	incrementally replaced with an upstream-shaped, gix-native implementation.
22	+
23	+	## Local modifications
24	+
25	+	- `Cargo.toml`: standalone manifest using the anvil workspace's `gix` (0.84) and
26	+	`gix-pack` (0.71) instead of upstream's pinned 0.80 / 0.67.
27	+	- Source changes required by the gix version bump are recorded in git history.

1	+	use std::fs;
2	+	use std::path::{
3	+	Path,
4	+	PathBuf,
5	+	};
6	+
7	+	use serde::Serialize;
8	+
9	+	pub use crate::dynamic_registry::{
10	+	DynamicRepoRegistry,
11	+	MutableRepoRegistry,
12	+	RepoResolver,
13	+	};
14	+	use crate::error::{
15	+	Error,
16	+	Result,
17	+	};
18	+
19	+	const DEFAULT_GIT_DESCRIPTION: &str =
20	+	"Unnamed repository; edit this file 'description' to name the repository.";
21	+
22	+	/// Information about a discovered bare git repository.
23	+	#[derive(Debug, Clone, Serialize)]
24	+	pub struct RepoInfo {
25	+	pub name: String,
26	+	pub relative_path: String,
27	+	#[serde(skip)]
28	+	pub absolute_path: PathBuf,
29	+	#[serde(skip_serializing_if = "Option::is_none")]
30	+	pub description: Option<String>,
31	+	}
32	+
33	+	/// A store of discovered repositories under a root directory.
34	+	#[derive(Debug, Clone)]
35	+	pub struct RepoStore {
36	+	root: PathBuf,
37	+	max_depth: u32,
38	+	repos: Vec<RepoInfo>,
39	+	}
40	+
41	+	impl RepoStore {
42	+	/// Scan `root` recursively up to `max_depth` levels for bare git repositories.
43	+	///
44	+	/// `max_depth = 0` means only repositories directly inside `root`.
45	+	/// `max_depth = 3` means up to 3 levels of subdirectories below `root`.
46	+	pub fn discover(root: PathBuf, max_depth: u32) -> Result<Self> {
47	+	let root = root.canonicalize()?;
48	+	let mut repos = Vec::new();
49	+
50	+	// Walk starts at depth 0 (root itself). We scan children of root at depth 1,
51	+	// and allow descending up to max_depth subdirectory levels below root.
52	+	walk_dir(&root, &root, 0, max_depth, &mut repos)?;
53	+
54	+	repos.sort_by(\|a, b\| a.relative_path.cmp(&b.relative_path));
55	+
56	+	Ok(Self {
57	+	root,
58	+	max_depth,
59	+	repos,
60	+	})
61	+	}
62	+
63	+	/// Resolve a relative path to a `RepoInfo`.
64	+	///
65	+	/// Uses `crate::path::resolve_repo_path` for validation, then matches by
66	+	/// canonical absolute path.
67	+	pub fn resolve(&self, relative: &str) -> Result<&RepoInfo> {
68	+	let canonical = crate::path::resolve_repo_path(&self.root, relative)?;
69	+	self.repos
70	+	.iter()
71	+	.find(\|r\| r.absolute_path == canonical)
72	+	.ok_or_else(\|\| Error::RepoNotFound(relative.to_string()))
73	+	}
74	+
75	+	/// Returns all discovered repositories, sorted by relative path.
76	+	pub fn list(&self) -> &[RepoInfo] {
77	+	&self.repos
78	+	}
79	+
80	+	/// Returns the root directory used for discovery.
81	+	pub fn root(&self) -> &Path {
82	+	&self.root
83	+	}
84	+
85	+	/// Returns the configured maximum discovery depth.
86	+	pub fn max_depth(&self) -> u32 {
87	+	self.max_depth
88	+	}
89	+
90	+	/// Re-run repository discovery using the original root and max depth.
91	+	pub fn refresh(&mut self) -> Result<()> {
92	+	let refreshed = Self::discover(self.root.clone(), self.max_depth)?;
93	+	self.repos = refreshed.repos;
94	+	Ok(())
95	+	}
96	+	}
97	+
98	+	/// Recursively walk `dir`, recording bare repositories.
99	+	///
100	+	/// `depth` is the current depth relative to `root` (root itself is depth 0).
101	+	/// Entries inside root are at depth 1. We descend while `depth <= max_depth`.
102	+	fn walk_dir(
103	+	root: &Path,
104	+	dir: &Path,
105	+	depth: u32,
106	+	max_depth: u32,
107	+	repos: &mut Vec<RepoInfo>,
108	+	) -> Result<()> {
109	+	let read = match fs::read_dir(dir) {
110	+	Ok(r) => r,
111	+	Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => return Ok(()),
112	+	Err(e) => return Err(Error::Io(e)),
113	+	};
114	+
115	+	for entry in read {
116	+	let entry = entry?;
117	+	let path = entry.path();
118	+
119	+	let metadata = match fs::metadata(&path) {
120	+	Ok(m) => m,
121	+	Err(_) => continue,
122	+	};
123	+
124	+	if !metadata.is_dir() {
125	+	continue;
126	+	}
127	+
128	+	// Try to open as a git repository.
129	+	match gix::open(&path) {
130	+	Ok(repo) if repo.is_bare() => {
131	+	let absolute_path = path.canonicalize()?;
132	+	let relative_path = absolute_path
133	+	.strip_prefix(root)
134	+	.expect("discovered path must be inside root")
135	+	.to_string_lossy()
136	+	.into_owned();
137	+	let name = absolute_path
138	+	.file_name()
139	+	.map(\|n\| n.to_string_lossy().into_owned())
140	+	.unwrap_or_else(\|\| relative_path.clone());
141	+	let description = read_description(&absolute_path);
142	+
143	+	repos.push(RepoInfo {
144	+	name,
145	+	relative_path,
146	+	absolute_path,
147	+	description,
148	+	});
149	+	// Do not descend into a repository directory.
150	+	}
151	+	_ => {
152	+	// Not a bare repo (or open failed). Descend if within max_depth.
153	+	if depth < max_depth {
154	+	walk_dir(root, &path, depth + 1, max_depth, repos)?;
155	+	}
156	+	}
157	+	}
158	+	}
159	+
160	+	Ok(())
161	+	}
162	+
163	+	/// Read the `description` file from a bare repository directory.
164	+	///
165	+	/// Returns `None` if the file is absent, unreadable, or contains the default
166	+	/// git placeholder text.
167	+	fn read_description(repo_path: &Path) -> Option<String> {
168	+	let desc_path = repo_path.join("description");
169	+	let content = fs::read_to_string(&desc_path).ok()?;
170	+	let trimmed = content.trim().to_string();
171	+	if trimmed.is_empty() \|\| trimmed == DEFAULT_GIT_DESCRIPTION {
172	+	None
173	+	} else {
174	+	Some(trimmed)
175	+	}
176	+	}
177	+
178	+	#[cfg(test)]
179	+	mod tests {
180	+	use std::path::Path;
181	+	use std::process::Command;
182	+
183	+	use tempfile::TempDir;
184	+
185	+	use super::*;
186	+
187	+	fn create_bare_repo(path: &Path) {
188	+	Command::new("git")
189	+	.args(["init", "--bare", path.to_str().unwrap()])
190	+	.output()
191	+	.expect("git init --bare failed");
192	+	}
193	+
194	+	#[test]
195	+	fn discover_finds_bare_repos() {
196	+	let dir = TempDir::new().unwrap();
197	+	create_bare_repo(&dir.path().join("alpha.git"));
198	+	create_bare_repo(&dir.path().join("beta.git"));
199	+
200	+	let store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
201	+	assert_eq!(store.list().len(), 2);
202	+	}
203	+
204	+	#[test]
205	+	fn discover_finds_nested_repos() {
206	+	let dir = TempDir::new().unwrap();
207	+	let repo_path = dir.path().join("org").join("project.git");
208	+	std::fs::create_dir_all(&repo_path).unwrap();
209	+	create_bare_repo(&repo_path);
210	+
211	+	let store = RepoStore::discover(dir.path().to_path_buf(), 1).unwrap();
212	+	assert_eq!(store.list().len(), 1);
213	+	assert_eq!(store.list()[0].relative_path, "org/project.git");
214	+	}
215	+
216	+	#[test]
217	+	fn discover_respects_max_depth() {
218	+	let dir = TempDir::new().unwrap();
219	+	let deep = dir.path().join("a").join("b").join("c").join("deep.git");
220	+	std::fs::create_dir_all(&deep).unwrap();
221	+	create_bare_repo(&deep);
222	+
223	+	// max_depth 2 should not find it (it is 3 levels below root)
224	+	let store_shallow = RepoStore::discover(dir.path().to_path_buf(), 2).unwrap();
225	+	assert_eq!(store_shallow.list().len(), 0);
226	+
227	+	// max_depth 3 should find it
228	+	let store_deep = RepoStore::discover(dir.path().to_path_buf(), 3).unwrap();
229	+	assert_eq!(store_deep.list().len(), 1);
230	+	}
231	+
232	+	#[test]
233	+	fn discover_max_depth_zero_only_root_level() {
234	+	let dir = TempDir::new().unwrap();
235	+	create_bare_repo(&dir.path().join("root-level.git"));
236	+	let nested = dir.path().join("nested").join("deep.git");
237	+	std::fs::create_dir_all(&nested).unwrap();
238	+	create_bare_repo(&nested);
239	+
240	+	let store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
241	+	assert_eq!(store.list().len(), 1);
242	+	assert_eq!(store.list()[0].relative_path, "root-level.git");
243	+	}
244	+
245	+	#[test]
246	+	fn discover_ignores_non_bare_dirs() {
247	+	let dir = TempDir::new().unwrap();
248	+	// A plain directory -- not a git repo
249	+	std::fs::create_dir(dir.path().join("just-a-dir")).unwrap();
250	+
251	+	let store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
252	+	assert_eq!(store.list().len(), 0);
253	+	}
254	+
255	+	#[test]
256	+	fn resolve_existing_repo() {
257	+	let dir = TempDir::new().unwrap();
258	+	create_bare_repo(&dir.path().join("myrepo.git"));
259	+
260	+	let store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
261	+	let info = store.resolve("myrepo.git").unwrap();
262	+	assert_eq!(info.relative_path, "myrepo.git");
263	+	assert_eq!(info.name, "myrepo.git");
264	+	}
265	+
266	+	#[test]
267	+	fn resolve_missing_repo() {
268	+	let dir = TempDir::new().unwrap();
269	+	create_bare_repo(&dir.path().join("exists.git"));
270	+
271	+	let store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
272	+	let err = store.resolve("nope.git").unwrap_err();
273	+	assert!(matches!(err, Error::RepoNotFound(_)));
274	+	}
275	+
276	+	#[test]
277	+	fn reads_description_file() {
278	+	let dir = TempDir::new().unwrap();
279	+	let repo_path = dir.path().join("described.git");
280	+	create_bare_repo(&repo_path);
281	+	std::fs::write(repo_path.join("description"), "A test repository\n").unwrap();
282	+
283	+	let store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
284	+	assert_eq!(store.list().len(), 1);
285	+	assert_eq!(
286	+	store.list()[0].description.as_deref(),
287	+	Some("A test repository")
288	+	);
289	+	}
290	+
291	+	#[test]
292	+	fn refresh_picks_up_new_repositories() {
293	+	let dir = TempDir::new().unwrap();
294	+	create_bare_repo(&dir.path().join("alpha.git"));
295	+
296	+	let mut store = RepoStore::discover(dir.path().to_path_buf(), 0).unwrap();
297	+	assert_eq!(store.list().len(), 1);
298	+
299	+	create_bare_repo(&dir.path().join("beta.git"));
300	+	store.refresh().unwrap();
301	+
302	+	assert_eq!(store.list().len(), 2);
303	+	assert!(store.list().iter().any(\|repo\| repo.name == "beta.git"));
304	+	}
305	+	}