oxy-server: a host may refuse a push by what it adds (Backend::vet_push) 67a4fe1aa2d5

                // The hint comes from the status alone: the server's text

                // (a host's reason for refusing a push, several lines

                // perhaps) is shown as it is, never read for hints.

                let status = format!("{url}: HTTP {code}");

                let msg = format!("{status}: {}", text.trim());

                Err(RepoError::Msg(match hint_for(&status) {

                    Some(h) => format!("{msg}\n  hint: {h}"),

                    None => msg,

                }))

    /// Vet a push by what it adds before anything of it is stored or any

    /// reference moves (spec §16.1): `bundle` is the push as decoded, its

    /// changes with their lines, `updates` the references it would move.

    /// A host refuses the whole push by returning a [`Failure`], whose

    /// text reaches the client as the push's error, as it is, several

    /// lines included; it should answer neither 401, 403 nor 404, which a

    /// client takes for a credential it should change. Called for every

    /// part of a push sent in parts (each part's changes are its own),

    /// outside the repository's push lock, so a slow vet holds up no

    /// other push. The default accepts everything at no cost.

    fn vet_push(

        &self,

        _name: &str,

        _repo: &Repo,

        _bundle: &oxy_core::protocol::Bundle,

        _updates: &[oxy_core::protocol::RefUpdate],

        _headers: &HeaderMap,

    ) -> Result<(), Failure> {

        Ok(())

    }

                // The host vets what the push adds before anything is stored

                // or bound: a refused push leaves the repository as it was.

                self.backend

                    .vet_push(name, &r, &bundle, &updates, headers)?;

/// A host refuses a push by what it adds (`Backend::vet_push`): the client

/// sees the host's reason, every line of it, and nothing is stored, bound

/// or moved; a push without that content then lands.

#[test]

fn a_host_refuses_a_push_by_its_content() {

    use axum::extract::{Path as AxPath, State};

    use axum::http::{HeaderMap, Method, StatusCode};

    use axum::response::Response;

    use oxy_core::objects::Edit;

    use oxy_core::protocol::{Bundle, RefUpdate};

    use oxy_server::{Access, Backend, DirBackend, Endpoint, Failure, Server};

    use std::sync::Arc;

    struct Vetting(DirBackend);

    impl Backend for Vetting {

        fn open(&self, name: &str) -> Result<Repo, Failure> {

            self.0.open(name)

        }

        fn authorize(

            &self,

            name: &str,

            access: Access,

            headers: &HeaderMap,

        ) -> Result<(), Failure> {

            self.0.authorize(name, access, headers)

        }

        fn vet_push(

            &self,

            _name: &str,

            _repo: &Repo,

            bundle: &Bundle,

            updates: &[RefUpdate],

            _headers: &HeaderMap,

        ) -> Result<(), Failure> {

            let adds_it = bundle.changes.iter().any(|(c, _)| {

                c.edits.iter().any(|e| match e {

                    Edit::Insert { lines, .. } => lines

                        .iter()

                        .any(|l| l.windows(11).any(|w| w == b"DO NOT PUSH")),

                    _ => false,

                })

            });

            if adds_it {

                return Err(Failure(

                    StatusCode::UNPROCESSABLE_ENTITY,

                    format!(

                        "refused: a change adds DO NOT PUSH\n  a.txt:2\nremove it and push {} again",

                        updates.first().map(|u| u.name.as_str()).unwrap_or("")

                    ),

                ));

            }

            Ok(())

        }

    }

    async fn route(

        State(server): State<Arc<Server>>,

        AxPath((repo, endpoint)): AxPath<(String, String)>,

        method: Method,

        headers: HeaderMap,

        body: axum::body::Bytes,

    ) -> Response {

        let e = Endpoint::parse(&endpoint).unwrap();

        server.handle(repo, e, &method, &headers, body).await

    }

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let served = root.join("served");

    let hosted = Repo::init_bare_unbound(&served.join("lib")).unwrap();

    let server = Server::new(Vetting(DirBackend {

        root: served.clone(),

        tokens: vec![],

    }));

    let listener = TcpListener::bind("127.0.0.1:0").unwrap();

    let port = listener.local_addr().unwrap().port();

    std::thread::spawn(move || {

        let rt = tokio::runtime::Builder::new_multi_thread()

            .enable_all()

            .build()

            .unwrap();

        rt.block_on(async move {

            listener.set_nonblocking(true).unwrap();

            let app = axum::Router::new()

                .route("/{repo}/oxy/v1/{endpoint}", axum::routing::any(route))

                .with_state(server);

            axum::serve(tokio::net::TcpListener::from_std(listener).unwrap(), app)

                .await

                .unwrap();

        });

    });

    std::thread::sleep(std::time::Duration::from_millis(50));

    let url = format!("http://127.0.0.1:{port}/lib");

    let work = root.join("work");

    let mut local = Repo::init(&work).unwrap();

    local.config.set("remote.origin.url", &url).unwrap();

    local.save_config().unwrap();

    write(&work, "a.txt", b"one\nDO NOT PUSH\n");

    local.snapshot("test").unwrap();

    let bad = local.commit("a", &[]).unwrap();

    let err = local.push("origin", false).err().unwrap().to_string();

    assert!(

        err.contains("HTTP 422")

            && err.contains(

                "refused: a change adds DO NOT PUSH\n  a.txt:2\nremove it and push main again"

            )

            && !err.contains("hint:"),

        "{err}"

    );

    let hosted_now = Repo::open(&served.join("lib")).unwrap();

    assert!(hosted_now.is_unbound(), "a refused push binds nothing");

    assert!(hosted_now.bookmark_heads().unwrap().is_empty());

    assert!(

        hosted_now.store().get_change(&bad).is_err(),

        "nothing stored"

    );

    drop(hosted);

    // Without it, the push lands.

    write(&work, "a.txt", b"one\n");

    local.snapshot("test").unwrap();

    local.amend(None).unwrap();

    let results = local.push("origin", false).unwrap();

    assert!(results.iter().all(|r| r.ok), "{results:?}");

    assert_eq!(

        Repo::open(&served.join("lib"))

            .unwrap()

            .bookmark_heads()

            .unwrap()

            .len(),

        1

    );

}

  `ok = false` in the push response, not an HTTP error; one a host

  refuses by its content (`vet_push`, spec §16.4) is an HTTP error with

  the host's reason as its text, and nothing of it is stored.

`after_push` hook, and `vet_push`, with which a host refuses a push by

what it adds before anything is stored: an HTTP error, `422` say, whose

text, several lines perhaps, the client shows as it is; spec §16.4), so a hub with `owner/name` paths and its own accounts

**Refused by content.** Before any of the checks above, and before a push binds an unbound repository, a host MAY refuse a push by what it adds: the lines its changes insert, the blobs it carries (a forge's secret scanning is one such check). The refusal rejects the whole push, or the whole part of a push in parts, with nothing stored, bound or moved, and is an HTTP error (the reference server's hosts choose `422`, never `401`, `403` or `404`, which a client takes for a credential to change) whose plain-text body is the host's reason, which MAY run to several lines; a client MUST show it as it is. In the reference server this is `Backend::vet_push`, which accepts everything unless a host implements it.