Compare

+`/raw/` URL; images over 10 MiB skip the preview and offer the download only.

+the log; it is never consulted for authorization. By default Authentik

+decides who may reach the handler at all -- anyone forward_auth lets through

+`/admin/*` can edit notices.

+### Gating notices editing to a group

+

+`/admin/*` is also where [Login](#login) mints the `gsg_user` cookie, so

+forward_auth for the whole prefix is usually left open to everyone you want

+able to log in (for share links, hidden-repo visibility, etc). To let more

+people log in without also handing them notices editing, add `-admin-group`:

+

+```sh

+./gsg -root /srv/git -notices /etc/gsg/notices.yaml \

+ -admin-addr 127.0.0.1:8081 -admin-group gsg-admins

+```

+

+This checks the `X-Authentik-Groups` header (override with

+`-admin-group-header`) for `gsg-admins` among its `|`-delimited entries,

+Authentik's own format for that header, and answers `403` to any request

+under `/admin/notices` from a caller that isn't a member -- before the

+handler does anything else, including setting the CSRF cookie. Add the group

+header to the same `forward_auth` block used above:

+

+```caddyfile

+ forward_auth authentik:9000 {

+ uri /outpost.goauthentik.io/auth/caddy

+ copy_headers X-Authentik-Username X-Authentik-Groups

+ }

+```

+

+Leaving `-admin-group` unset keeps today's behavior: anyone forward_auth

+admits to `/admin/*` can edit notices.

+

+## Login

+

+Logging in reveals hidden repos whose `gsg.visible-to` list includes your

+username; everyone else, logged in or not, sees exactly what an anonymous

+visitor sees. It reuses the same Authentik `forward_auth` setup as the

+notices admin UI above, and needs nothing extra beyond `-admin-addr`

+(notices editing is not required — `-admin-addr` alone is enough to enable

+login).

+

+```sh

+./gsg -root /srv/git -admin-addr 127.0.0.1:8081

+```

+

+```caddyfile

+example.com {

+ # Login: same trust boundary as /admin/*, one hop mints the cookie

+ # and redirects back. This must be the exact path, not /auth/*: gsg

+ # also serves /auth/logout, but on the *public* listener, since

+ # logging out only clears gsg's own cookie and needs no Authentik

+ # round trip at all. Routing /auth/* here would send logout to the

+ # admin listener too, where no such handler exists, and gate it

+ # behind an Authentik check it doesn't need.

+ handle /auth/login {

+ forward_auth authentik:9000 {

+ uri /outpost.goauthentik.io/auth/caddy

+ copy_headers X-Authentik-Username

+ }

+ reverse_proxy gsg:8081

+ }

+

+ # Public, read-only (also handles /auth/logout, /share/new, /share/view/*).

+ handle {

+ reverse_proxy gsg:8080

+ }

+}

+```

+

+Visiting `/auth/login` (through Caddy, so `X-Authentik-Username` is set and

+trustworthy by the time gsg sees the request) mints a signed, stateless

+`gsg_user` cookie and redirects back to `/`. The cookie is verified on the

+public listener with an in-memory key — nothing is written to disk, and a

+process restart signs everyone out. `/auth/logout` clears it and needs no

+round trip through Authentik, since it only has to forget gsg's own cookie.

+

+**There is no "log in" link anywhere in the UI.** `/auth/login` is not

+discoverable from the site; people who need it are told the URL out of

+band. Once logged in, the nav bar shows who you are and a log-out link.

+

+## Share links

+

+Once logged in, `/share/new` lets you pick from your own hidden repos and

+mint a link that grants view access to exactly those repos to anyone who

+has it — no login, no Authentik involvement. It's entirely stateless: the

+link is a signed, self-contained token, and gsg keeps no record of what's

+been shared. An optional password can gate it.

+

+```

+git --git-dir=/srv/git/demo.git config gsg.share-max-age "720h"

+```

+

+`gsg.share-max-age` (Go duration syntax, default 30 days if unset) is both

+the ceiling no link's expiry may exceed and the default when the minting

+form doesn't specify one — you can always ask for less, never more. Sharing

+several repos at once uses the smallest ceiling among them.

+

+**Passwords are never stored, not even hashed.** The password is folded

+directly into the link's signature instead of being embedded in it: nobody

+holding just the URL has anything to brute-force offline, and checking a

+guess requires asking the server, which rate-limits attempts. This is a

+soft gate appropriate for a small self-hosted tool, not a cryptographic

+secret protecting high-value data.

+

+**Revocation.** A stateless token can't be individually revoked — there's

+no list of what's been issued. The one lever:

+

+```

+git --git-dir=/srv/git/demo.git config gsg.share-revoked-after "$(date +%s)"

+```

+

+Any share grant for that repo issued at or before this timestamp stops

+working immediately, including in a browser that already redeemed the

+link — not just future redemptions. Two things worth knowing before you

+rely on this:

+

+- There's no per-recipient state, so revoking means invalidating *every*

+ outstanding share of that repo, then re-sharing with whoever should still

+ have it.

+- Removing a username from `gsg.visible-to` does **not** revoke a share

+ link that user already minted for that repo. The two mechanisms are

+ independent; only `gsg.share-revoked-after` invalidates outstanding

+ shares.

+

+git --git-dir=/srv/git/demo.git config gsg.visible-to "alice,bob"

+git --git-dir=/srv/git/demo.git config gsg.share-max-age "720h"

+git --git-dir=/srv/git/demo.git config gsg.share-revoked-after "$(date +%s)"

+A repo's slug is its directory name (minus `.git`), and slugs share the

+public listener's URL namespace with a few reserved top-level paths:

+`static`, `auth`, and `share`. A repo named e.g. `share.git` would collide

+with the share-link endpoints below and is not supported.

+

+`gsg.visible-to` is a comma-separated allowlist of usernames (matched

+case-insensitively against a logged-in session, see "Login" below) who may

+see this repo even though `gsg.hide` is set. It's a separate key from

+`gsg.owner` on purpose: `Owner` is a free-text display field that falls

+back to `gitweb.owner` for cgit-migrated repos, so treating it as an access

+list could silently grant visibility nobody intended.

+

+go 1.23.0

+ golang.org/x/sync v0.14.0

+golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ=

+golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=

+ "strconv"

+ "time"

+

+ // configRev counts every upsert/remove, i.e. every time a repo's own

+ // git config or existence changes (watch.go's reconcile calls mutate

+ // for exactly this). Folded into Revision() so that ETags and the

+ // module cache invalidate when a repo's config changes -- gsg.hide,

+ // gsg.visible-to, gsg.share-revoked-after -- not just when notices do.

+ // Without this, a browser could revalidate a stale, cached page whose

+ // ETag predates a config change that was supposed to take effect

+ // immediately, such as a share-link revocation.

+ configRev atomic.Uint64

+ bySlug map[string]Handle // every known repo, hidden or not -- Server.buildCtx enforces visibility

+// Lookup resolves a repo by slug for per-repo routes, hidden or not -- the

+// caller (Server.buildCtx) is responsible for enforcing RepoInfo.Hidden /

+// CanView before using the result.

+// inputs that change outside a commit -- notices, and any repo's own git

+// config (gsg.hide, gsg.visible-to, gsg.share-revoked-after, ...). Nil-safe

+// because tests construct bare *Ctx values and LoadTemplates parses with

+// &Ctx{}.

+ if s == nil {

+ rev := strconv.FormatUint(s.configRev.Load(), 10)

+ if s.RevFn != nil {

+ rev += "|" + s.RevFn()

+ }

+ return rev

+ bySlug[h.Info.Slug] = h

+ s.configRev.Add(1)

+// visible-to = alice,bob

+// cache-max-age = 2m

+ // VisibleTo is the gsg.visible-to allowlist: usernames (matched against

+ // an authenticated session, case-insensitively) who may see this repo

+ // even though Hidden is set. A separate key from Owner deliberately --

+ // Owner is a free-text display field (and falls back to gitweb.owner

+ // for cgit-migrated repos), so reusing it as an ACL could silently

+ // grant access nobody intended.

+ VisibleTo []string

+

+ // ShareMaxAge is gsg.share-max-age: both the ceiling no share-link

+ // expiry for this repo may exceed, and the default when a mint request

+ // doesn't specify one. Falls back to defaultShareMaxAge when unset.

+ ShareMaxAge time.Duration

+

+ // ShareRevokedAfter is gsg.share-revoked-after: any share-link grant

+ // for this repo issued at or before this instant is rejected,

+ // regardless of the link's own expiry. It is the only revocation lever

+ // a stateless share token has -- see internal/share.

+ ShareRevokedAfter time.Time

+

+

+ // CacheMaxAge is gsg.cache-max-age: how long an anonymous (no session,

+ // no share grant) response for this repo may be reused -- both by the

+ // requesting browser (Cache-Control: public, max-age=...) and by gsg's

+ // own in-memory response cache (Server.respCache) -- before either has

+ // to ask again. Falls back to defaultAnonCacheMaxAge when unset.

+ CacheMaxAge time.Duration

+ Slug: r.Slug,

+ Title: title,

+ Description: desc,

+ Owner: r.ConfigFirst("gsg.owner", "gitweb.owner"),

+ Clone: r.ConfigFirst("gsg.clone", "gitweb.url"),

+ Section: r.ConfigFirst("gsg.section", "gitweb.category"),

+ Hidden: strings.EqualFold(r.Config("gsg.hide"), "true"),

+ VisibleTo: splitUsers(r.Config("gsg.visible-to")),

+ ShareMaxAge: parseShareMaxAge(r.Config("gsg.share-max-age")),

+ ShareRevokedAfter: parseUnixTime(r.Config("gsg.share-revoked-after")),

+ GPGKeyring: r.Config("gsg.gpgkeyring"),

+ CacheMaxAge: parseCacheMaxAge(r.Config("gsg.cache-max-age")),

+ }

+}

+

+// defaultShareMaxAge is the ceiling/default applied when a repo doesn't set

+// gsg.share-max-age.

+const defaultShareMaxAge = 30 * 24 * time.Hour

+

+func parseShareMaxAge(v string) time.Duration {

+ if v == "" {

+ return defaultShareMaxAge

+ }

+ d, err := time.ParseDuration(v)

+ if err != nil || d <= 0 {

+ return defaultShareMaxAge

+ }

+ return d

+}

+

+// defaultAnonCacheMaxAge is the ceiling/default applied when a repo doesn't

+// set gsg.cache-max-age.

+const defaultAnonCacheMaxAge = 2 * time.Minute

+

+func parseCacheMaxAge(v string) time.Duration {

+ if v == "" {

+ return defaultAnonCacheMaxAge

+ }

+ d, err := time.ParseDuration(v)

+ if err != nil || d <= 0 {

+ return defaultAnonCacheMaxAge

+ }

+ return d

+}

+

+func parseUnixTime(v string) time.Time {

+ if v == "" {

+ return time.Time{}

+ }

+ sec, err := strconv.ParseInt(v, 10, 64)

+ if err != nil {

+ return time.Time{}

+ }

+ return time.Unix(sec, 0)

+}

+

+// splitUsers parses a comma-separated gsg.visible-to value into trimmed,

+// non-empty usernames.

+func splitUsers(v string) []string {

+ if v == "" {

+ return nil

+ }

+ parts := strings.Split(v, ",")

+ out := make([]string, 0, len(parts))

+ for _, p := range parts {

+ if p = strings.TrimSpace(p); p != "" {

+ out = append(out, p)

+ }

+ return out

+}

+

+// CanView reports whether user (an authenticated username, or "" for

+// anonymous) may see this repo even if it's Hidden. Anonymous callers never

+// match -- VisibleTo entries are login usernames, and "" would otherwise

+// vacuously match a blank/misconfigured entry.

+func (info RepoInfo) CanView(user string) bool {

+ if user == "" {

+ return false

+ }

+ for _, u := range info.VisibleTo {

+ if strings.EqualFold(u, user) {

+ return true

+ }

+ }

+ return false

+}

+

+// SharedVisible reports whether a verified gsg_share grant -- the slug set

+// and issued-at time from its ShareClaims -- still unlocks this repo. It's

+// not enough for slugs to just name this repo: if gsg.share-revoked-after

+// has been bumped since the grant was issued, it's revoked, even though the

+// signature on the browser's cookie is still perfectly valid. This is

+// checked on every request (not just at redemption), which is what makes

+// bumping the timestamp reach a browser that already redeemed the link.

+func (info RepoInfo) SharedVisible(slugs []string, issuedAt time.Time) bool {

+ found := false

+ for _, s := range slugs {

+ if s == info.Slug {

+ found = true

+ break

+ }

+ }

+ if !found {

+ return false

+ }

+ if !info.ShareRevokedAfter.IsZero() && !issuedAt.After(info.ShareRevokedAfter) {

+ return false

+ }

+ return true

+ // User is the authenticated username from the gsg_user session cookie,

+ // or "" for an anonymous request. Resolved once in Server.buildCtx.

+ // Never derived from a request header directly -- see internal/session.

+ User string

+

+ // SharedSlugs and SharedIssuedAt come from a verified gsg_share cookie,

+ // if one was present (SharedSlugs is nil otherwise). They are not yet

+ // filtered for revocation -- RepoInfo.SharedVisible applies

+ // gsg.share-revoked-after against SharedIssuedAt at the point of use,

+ // since revocation is per-repo and this Ctx may span several.

+ SharedSlugs []string

+ SharedIssuedAt time.Time

+

+ // StaticTag is Server.StaticTag, threaded through so the `static`

+ // template func can build cache-busting asset URLs without a package

+ // import cycle back to Server.

+ StaticTag string

+

+ n.User = c.User

+ n.SharedSlugs = c.SharedSlugs

+ n.SharedIssuedAt = c.SharedIssuedAt

+// cacheMaxAge is how long an anonymous response for this repo may be

+// reused before revalidating. Server.buildResponseHead (the browser-facing

+// Cache-Control header) and Server.fillResponse (the server-side response

+// cache's own TTL) both read this, so the two never disagree about

+// staleness.

+func (c *Ctx) cacheMaxAge() time.Duration {

+ if c.Info.CacheMaxAge > 0 {

+ return c.Info.CacheMaxAge

+ }

+ return defaultAnonCacheMaxAge

+}

+

+ // static builds a cache-busting asset URL, e.g. "css/base.css" ->

+ // "/static/css/base.css?v=<tag>". The `v` param is what lets

+ // main.go's static handler hand out a year-long immutable

+ // Cache-Control instead of a short one -- a URL without it is

+ // still served, just not frozen for a year.

+ "static": func(p string) string {

+ return "/static/" + p + "?v=" + c.StaticTag

+ },

+ return s[:n] + "…"

+ // CacheableAnon opts a route into Server's in-memory response cache for

+ // anonymous, shareless requests (see Server.cacheEligible) -- a full

+ // rendered response is stored and replayed to the next matching

+ // request within Ctx.cacheMaxAge, without touching git at all. Reserved

+ // for the small-HTML page routes most likely to be a spike's hot page;

+ // left off routes whose bodies can be large or unboundedly numerous

+ // (blob, raw, compare -- see routes.go) and the JSON api-* endpoints,

+ // to keep this pass's scope and memory footprint bounded: respCache is

+ // an LRU bounded by entry count, not bytes.

+ CacheableAnon bool

+ "context"

+ "golang.org/x/sync/singleflight"

+

+ "gsg/internal/session"

+ // Sessions verifies the gsg_user login cookie. Nil-safe: an unset

+ // Sessions makes every request resolve as anonymous, i.e. today's

+ // behavior.

+ Sessions *session.Manager

+

+ // iteration without a restart; leave empty in production. Also disables

+ // the response cache below, so a live-edited template is never masked

+ // by a stale cached response.

+ // StaticTag is a content hash of the embedded static assets (set once

+ // at startup in main.go via HashFS), threaded onto every Ctx so the

+ // `static` template func can build cache-busting asset URLs.

+ StaticTag string

+

+

+ // respCache holds full rendered responses for CacheableAnon routes,

+ // keyed on the request (route+path+query, see cacheEligible) rather

+ // than content identity. sf collapses every request that arrives while

+ // a key is cold into one fill instead of one per request -- the thing

+ // that actually matters during a traffic spike is many distinct

+ // anonymous visitors hitting the same hot page, not just requests that

+ // happen to land in the same instant.

+ respCache *LRU

+ sf singleflight.Group

+ Log: slog.Default(),

+ Timeout: 10 * time.Second,

+ MaxGit: 16 << 20, // headroom above modules.maxPreviewSize (10 MiB)

+ cache: NewLRU(cacheSize),

+ respCache: NewLRU(cacheSize),

+ tag, err := HashFS(fsys)

+// HashFS digests every file in fsys, path and contents both, into a short

+// stable tag. Used for the template set (so editing the theme invalidates

+// every ETag at once -- without this a restyled page keeps serving 304s)

+// and, via main.go, for the embedded static assets, so a CSS/JS edit mints

+// a new cache-busting URL instead of being masked by a year-long immutable

+// Cache-Control.

+func HashFS(fsys fs.FS) (string, error) {

+// cachedResponse is a full rendered response, header and body both, as

+// stored in respCache. expiresAt is only meaningful for entries actually

+// stored there.

+type cachedResponse struct {

+ header http.Header

+ body []byte

+ expiresAt time.Time

+}

+

+ if key, ok := s.cacheEligible(rt, r); ok {

+ if cr, ok := s.respCacheGet(key); ok {

+ writeResponse(w, r, cr)

+ return

+ }

+ // singleflight collapses every request that arrives while this key

+ // is cold into one fill. That fill runs on a context detached from

+ // whichever request happened to trigger it: without that, the

+ // first caller to disconnect or time out would kill the shared

+ // git/render work and fail every other request that coalesced onto

+ // it too, even ones with their own deadline still well in the

+ // future. Bounded by s.Timeout so a genuinely stuck fill still

+ // gets reaped.

+ //

+ // The closure below captures r, the *triggering* (leader) request

+ // -- every follower that coalesces onto this Do gets a response

+ // built from the leader's request, not their own. That's only safe

+ // because cacheEligible already pinned every request-varying input

+ // that matters (user == "", no share cookie) and the key covers

+ // path+query, so leader and followers are asking an identical

+ // question. A future CacheableAnon route whose render depends on

+ // anything else request-specific (a header, say) would silently

+ // break this.

+ v, err, _ := s.sf.Do(key, func() (any, error) {

+ fillCtx, cancel := context.WithTimeout(context.Background(), s.Timeout)

+ defer cancel()

+ return s.fillResponse(reqCtx{fillCtx}, rt, r)

+ })

+ if err != nil {

+ s.fail(w, r, rt, err)

+ return

+ }

+ cr := v.(*cachedResponse)

+ s.respCache.Put(key, cr)

+ writeResponse(w, r, cr)

+ return

+ }

+

+ c, header, err := s.buildResponseHead(ctx, rt, r)

+ copyHeader(w.Header(), header)

+ if match := r.Header.Get("If-None-Match"); match != "" && strings.Contains(match, header.Get("ETag")) {

+ w.WriteHeader(http.StatusNotModified)

+ return

+ }

+

+ s.mu.RLock()

+ ts := s.templates

+ s.mu.RUnlock()

+ body, err := rt.Render.Render(c, ts)

+ if err != nil {

+ s.fail(w, r, rt, err)

+ return

+ }

+ w.Header().Set("Content-Type", rt.Render.ContentType())

+ if hs, ok := rt.Render.(HeaderSetter); ok {

+ hs.Headers(c, w.Header())

+ }

+ w.Write(body)

+}

+

+// cacheEligible reports whether rt/r may be served from, and stored in,

+// the shared response cache, and if so, the key to use. Eligibility is

+// decided entirely from cheap, git-free signals -- cookies and

+// already-loaded repo config -- so a cache hit costs nothing beyond a map

+// lookup, and a miss doesn't cost anything extra either before falling

+// through to the real render.

+//

+// Two independent conditions gate it, deliberately redundant: the request

+// must carry neither a session nor a share cookie (the same

+// anonymous-and-shareless condition the Cache-Control split in

+// buildResponseHead already trusts), AND, for a repo-scoped route, that

+// repo must not be Hidden -- checked directly from RepoInfo, with no

+// reference to any cookie at all. A cache entry is shared state replayed

+// to whoever asks next, so a false negative here has a bigger blast

+// radius than a single mis-issued header would: the Hidden check means a

+// bug in cookie detection alone can never leak a hidden repo's content,

+// since that repo's responses are never eligible for the shared cache in

+// the first place.

+func (s *Server) cacheEligible(rt Route, r *http.Request) (string, bool) {

+ if !rt.CacheableAnon || s.TemplateDir != "" {

+ return "", false

+ }

+ if s.Sessions.Verify(r) != "" {

+ return "", false

+ }

+ if _, ok := s.Sessions.VerifyShareCookie(r); ok {

+ return "", false

+ }

+ if rt.Scope == ScopeRepo {

+ h, ok := s.Site.Lookup(r.PathValue("repo"))

+ if !ok || h.Info.Hidden {

+ return "", false

+ }

+ }

+ return rt.Name + "\x00" + r.URL.Path + "\x00" + r.URL.RawQuery, true

+}

+

+func (s *Server) respCacheGet(key string) (*cachedResponse, bool) {

+ v, ok := s.respCache.Get(key)

+ if !ok {

+ return nil, false

+ }

+ cr := v.(*cachedResponse)

+ if time.Now().After(cr.expiresAt) {

+ return nil, false

+ }

+ return cr, true

+}

+

+// fillResponse builds a full response for storage in respCache: header and

+// body both, since an entry has to be complete before anyone else can be

+// served from it.

+func (s *Server) fillResponse(ctx contexter, rt Route, r *http.Request) (*cachedResponse, error) {

+ c, header, err := s.buildResponseHead(ctx, rt, r)

+ if err != nil {

+ return nil, err

+ }

+ s.mu.RLock()

+ ts := s.templates

+ s.mu.RUnlock()

+ body, err := rt.Render.Render(c, ts)

+ if err != nil {

+ return nil, err

+ }

+ header.Set("Content-Type", rt.Render.ContentType())

+ if hs, ok := rt.Render.(HeaderSetter); ok {

+ hs.Headers(c, header)

+ }

+ return &cachedResponse{header: header, body: body, expiresAt: time.Now().Add(c.cacheMaxAge())}, nil

+}

+

+// buildResponseHead resolves the Ctx and computes the ETag/Cache-Control

+// header, without executing the template -- split out so a matching

+// If-None-Match can skip rendering the body entirely.

+//

+// ETag is derived from the resolved commit SHA and every other input that

+// can change what's rendered, not the response body, so a conditional

+// request costs one ref lookup instead of a render.

+func (s *Server) buildResponseHead(ctx contexter, rt Route, r *http.Request) (*Ctx, http.Header, error) {

+ c, err := s.buildCtx(ctx, rt, r)

+ if err != nil {

+ return nil, nil, err

+ }

+ //

+ // c.User and the raw gsg_share cookie value are folded in here,

+ // deliberately not into contentIdentity itself: contentIdentity also

+ // drives Ctx.CacheKey, the cross-request module Store key, and module

+ // results (tree/blob/log/...) aren't user-dependent -- authorization

+ // happens in buildCtx's Lookup gate, not inside a module. Keying the

+ // shared LRU per grant would fragment it for no benefit. The ETag,

+ // unlike the module cache, must vary by identity: without c.User,

+ // logging in or out keeps the same ETag as the anonymous response and a

+ // browser's stale If-None-Match earns a 304 with the wrong body. The

+ // share cookie needs the same treatment for the same reason: two

+ // anonymous visitors holding different share grants both have

+ // c.User == "", so without it they'd collide on one ETag and one

+ // share-holder's listing could be served to another. The cookie's own

+ // signature bytes already uniquely identify the grant, and folding them

+ // into a hash never echoes them back in a header.

+ //

+ // s.StaticTag is folded in too: a CSS/JS-only edit changes every

+ // rendered `static "..."` URL, so page ETags have to move with it.

+ shareCookie := ""

+ if ck, err := r.Cookie(session.ShareCookieName); err == nil {

+ shareCookie = ck.Value

+ }

+ etag := `"` + shortHash(rt.Name, r.URL.Path, r.URL.RawQuery, tag, s.StaticTag, c.contentIdentity(), c.User, shareCookie) + `"`

+

+ header := http.Header{}

+ header.Set("ETag", etag)

+ header.Set("Cache-Control", "public, max-age=31536000, immutable")

+ // Vary: Cookie applies to every response here, not just personalized

+ // ones -- the *absence* of gsg_user is also a cache dimension. Without

+ // it on the anonymous branch too, a shared cache could store an

+ // anonymous response keyed on URL alone and later serve it back to a

+ // request that does carry a session cookie.

+ header.Add("Vary", "Cookie")

+ if c.User != "" || len(c.SharedSlugs) > 0 {

+ // No shared/intermediary cache (proxy, CDN, or gsg's own

+ // respCache) may ever store this response, only the requesting

+ // browser -- otherwise a misbehaving shared cache could serve

+ // one user's hidden-repo listing to a different visitor. Vary:

+ // Cookie above is defense in depth for any cache that honors

+ // Vary but not Cache-Control: private.

+ header.Set("Cache-Control", "private, no-cache")

+ } else {

+ // public, with a real max-age rather than no-cache: the ETag

+ // already folds in c.User and the share cookie (above), so the

+ // only failure mode for a shared cache that mishandles Vary is

+ // serving this anonymous view to a logged-in or share-holding

+ // visitor within the TTL -- they see fewer repos, or a 404 on a

+ // hidden one. A UX papercut, not a disclosure: the dangerous

+ // direction (private content served to an anonymous visitor)

+ // can't happen here, since that's the separate branch above.

+ header.Set("Cache-Control", fmt.Sprintf("public, max-age=%d", int(c.cacheMaxAge().Seconds())))

+ }

+ return c, header, nil

+}

+

+func copyHeader(dst, src http.Header) {

+ for k, vs := range src {

+ for _, v := range vs {

+ dst.Add(k, v)

+ }

+}

+func writeResponse(w http.ResponseWriter, r *http.Request, cr *cachedResponse) {

+ copyHeader(w.Header(), cr.header)

+ if match := r.Header.Get("If-None-Match"); match != "" && strings.Contains(match, cr.header.Get("ETag")) {

+ w.WriteHeader(http.StatusNotModified)

+ w.Write(cr.body)

+ // Resolved once, before the scope branch, so the site-scoped early

+ // return (the index page -- the main surface a login or share link is

+ // meant to affect) doesn't skip it.

+ user := s.Sessions.Verify(r)

+ var sharedSlugs []string

+ var sharedIssuedAt time.Time

+ if claims, ok := s.Sessions.VerifyShareCookie(r); ok {

+ sharedSlugs, sharedIssuedAt = claims.Slugs, claims.IssuedAt()

+ }

+

+ c.User = user

+ c.SharedSlugs, c.SharedIssuedAt = sharedSlugs, sharedIssuedAt

+ c.StaticTag = s.StaticTag

+ // Hidden repos are 404, indistinguishable from nonexistent, unless the

+ // resolved identity is explicitly allowed to see this one, either as an

+ // owner (gsg.visible-to) or via an unrevoked share grant.

+ if h.Info.Hidden && !h.Info.CanView(user) && !h.Info.SharedVisible(sharedSlugs, sharedIssuedAt) {

+ return nil, Errorf(http.StatusNotFound, "no such repository %q", slug)

+ }

+ c.User = user

+ c.SharedSlugs, c.SharedIssuedAt = sharedSlugs, sharedIssuedAt

+ c.StaticTag = s.StaticTag

+ // buildResponseHead reads the same field, so page chrome that must not

+ // be frozen into a year-long response is suppressed by exactly the

+ // condition that makes the response year-long.

+ // The cached-response and cache-fill paths in serve() only ever reach

+ // fail() before anything is written to w, so for those there is

+ // nothing to strip. But the plain (non-cacheable) path copies

+ // buildResponseHead's ETag/Cache-Control onto w *before* calling

+ // Render, on the assumption that Render will succeed -- if it doesn't,

+ // this Del/Set is still what prevents a failed response from going out

+ // with a stale ETag or, worse, the year-long immutable Cache-Control

+ // from a commit route.

+// and MaxGit still bounds every git read -- it must stay above this value or

+// a previewable-sized image would already be truncated by the time it gets

+// here.

+const maxPreviewSize = 10 << 20 // 10 MiB

+// publicRepos returns every publicly-visible repository, newest activity

+// first, refreshed at most once per reposCacheTTL. This is the expensive,

+// I/O-bound part (one git log per repo) that the cache above exists for,

+// and it is deliberately untouched by personalization (see reposMod):

+// anonymous traffic -- the overwhelming majority of requests -- keeps

+// paying exactly what it paid before logins or share links existed,

+// regardless of how many hidden repos a site has.

+func publicRepos(c *core.Ctx) []RepoSummary {

+ return out

+ out = append(out, summarize(h))

+ return out

+}

+

+func summarize(h core.Handle) RepoSummary {

+ s := RepoSummary{RepoInfo: h.Info}

+ if log, err := h.Repo.Log(h.Repo.HeadRef(), 1, 0, false); err == nil && len(log) > 0 {

+ s.LastCommit = log[0].When

+ }

+ return s

+}

+

+// repos: every repository visible to the requester, newest activity first

+// -- every public repo, plus any hidden repo the current identity is

+// allowed to see, whether as an owner (gsg.visible-to) or via an unrevoked

+// share grant. Site-scoped -- does not touch c.Repo, so it is safe on the

+// site Ctx.

+func reposMod(c *core.Ctx, args ...string) (any, error) {

+ base := publicRepos(c)

+ if c.User == "" && len(c.SharedSlugs) == 0 {

+ return base, nil

+ }

+

+ // Uncached and on-demand, by design: only the handful of hidden repos

+ // this specific identity unlocks, never a walk weighted by total

+ // hidden-repo count. Cost scales with how many repos one person can

+ // see, not with site size -- an owner (or share-link visitor) reloading

+ // "/" pays one git log per repo they can unlock, on every request (not

+ // cross-request-memoized), which is the trade-off for keeping

+ // publicRepos's shared cache above entirely free of personalization.

+ var unlocked []RepoSummary

+ for _, h := range c.Site.RepoList() {

+ if !h.Info.Hidden {

+ continue

+ }

+ if h.Info.CanView(c.User) || h.Info.SharedVisible(c.SharedSlugs, c.SharedIssuedAt) {

+ unlocked = append(unlocked, summarize(h))

+ }

+ }

+ if len(unlocked) == 0 {

+ return base, nil

+ }

+

+ out := make([]RepoSummary, 0, len(base)+len(unlocked))

+ out = append(out, base...)

+ out = append(out, unlocked...)

+ sort.Slice(out, func(i, j int) bool { return out[i].LastCommit.After(out[j].LastCommit) })

+

+ // GroupHeader and RequiredGroup gate the admin surface itself, on top of

+ // whatever authentication the reverse proxy already did. Authentik's

+ // forward_auth can be shared by every /admin/* route (so several people

+ // can log in for share links), while only members of RequiredGroup may

+ // reach notices editing. RequiredGroup empty disables the check -- every

+ // request that reaches this handler is authorized, i.e. today's

+ // behavior. GroupHeader defaults to "X-Authentik-Groups", which

+ // Authentik sends as a "|"-delimited list of the user's groups.

+ GroupHeader string

+ RequiredGroup string

+

+ Logger *slog.Logger

+ if cfg.GroupHeader == "" {

+ cfg.GroupHeader = "X-Authentik-Groups"

+ }

+

+ if cfg.RequiredGroup == "" {

+ return mux, nil

+ }

+ return h.requireGroup(mux), nil

+}

+

+// requireGroup wraps next so that every admin route first checks

+// RequiredGroup, before any handler runs (including the CSRF cookie setup

+// in get/index -- a rejected caller gets no state from this handler at

+// all). Authentication already happened upstream at the reverse proxy; this

+// is authorization on top of it, using a group claim the proxy forwards, so

+// that reaching the (shared) /admin/* forward_auth is not by itself enough

+// to edit notices.

+func (h *handler) requireGroup(next http.Handler) http.Handler {

+ return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

+ if !h.inRequiredGroup(r) {

+ h.cfg.Logger.Warn("notices admin: group check rejected",

+ "user", r.Header.Get(h.cfg.UserHeader),

+ "groups", r.Header.Get(h.cfg.GroupHeader))

+ http.Error(w, "forbidden", http.StatusForbidden)

+ return

+ }

+ next.ServeHTTP(w, r)

+ })

+}

+

+// inRequiredGroup reports whether r carries cfg.RequiredGroup in its

+// GroupHeader. Authentik delimits multiple groups with "|"; entries are

+// trimmed so incidental whitespace around the delimiter doesn't cause a

+// false negative.

+func (h *handler) inRequiredGroup(r *http.Request) bool {

+ for _, g := range strings.Split(r.Header.Get(h.cfg.GroupHeader), "|") {

+ if strings.TrimSpace(g) == h.cfg.RequiredGroup {

+ return true

+ }

+ }

+ return false

+package notices

+

+import (

+ "log/slog"

+ "net/http"

+ "net/http/httptest"

+ "path/filepath"

+ "testing"

+)

+

+func testHandler(t *testing.T, cfg HandlerConfig) http.Handler {

+ t.Helper()

+ store, err := Open(filepath.Join(t.TempDir(), "notices.yaml"))

+ if err != nil {

+ t.Fatalf("Open: %v", err)

+ }

+ t.Cleanup(store.Close)

+ cfg.Store = store

+ if cfg.Logger == nil {

+ cfg.Logger = slog.Default()

+ }

+ h, err := NewHandler(cfg)

+ if err != nil {

+ t.Fatalf("NewHandler: %v", err)

+ }

+ return h

+}

+

+// Without RequiredGroup, the handler behaves exactly as it always did:

+// reaching it at all is enough, regardless of any group header.

+func TestHandlerNoGroupGateByDefault(t *testing.T) {

+ h := testHandler(t, HandlerConfig{})

+

+ req := httptest.NewRequest("GET", "/admin/notices", nil)

+ rec := httptest.NewRecorder()

+ h.ServeHTTP(rec, req)

+ if rec.Code != http.StatusOK {

+ t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)

+ }

+}

+

+// With RequiredGroup set, a caller whose GroupHeader doesn't list it is

+// refused before the handler does anything else -- no CSRF cookie, no page.

+func TestHandlerRejectsMissingGroup(t *testing.T) {

+ h := testHandler(t, HandlerConfig{RequiredGroup: "gsg-admins"})

+

+ cases := []struct {

+ name string

+ groups string

+ }{

+ {"no header", ""},

+ {"different group", "some-other-group"},

+ {"prefix collision", "gsg-admins-extra"},

+ }

+ for _, tc := range cases {

+ t.Run(tc.name, func(t *testing.T) {

+ req := httptest.NewRequest("GET", "/admin/notices", nil)

+ if tc.groups != "" {

+ req.Header.Set("X-Authentik-Groups", tc.groups)

+ }

+ rec := httptest.NewRecorder()

+ h.ServeHTTP(rec, req)

+ if rec.Code != http.StatusForbidden {

+ t.Fatalf("status = %d, want %d", rec.Code, http.StatusForbidden)

+ }

+ if rec.Result().Cookies() != nil && len(rec.Result().Cookies()) != 0 {

+ t.Errorf("rejected request set cookies: %v", rec.Result().Cookies())

+ }

+ })

+ }

+}

+

+// A member -- anywhere in the "|"-delimited list, with incidental

+// whitespace -- is let through.

+func TestHandlerAllowsMemberGroup(t *testing.T) {

+ h := testHandler(t, HandlerConfig{RequiredGroup: "gsg-admins"})

+

+ cases := []string{

+ "gsg-admins",

+ "other-group|gsg-admins",

+ "gsg-admins|other-group",

+ "other-group| gsg-admins |another",

+ }

+ for _, groups := range cases {

+ req := httptest.NewRequest("GET", "/admin/notices", nil)

+ req.Header.Set("X-Authentik-Groups", groups)

+ rec := httptest.NewRecorder()

+ h.ServeHTTP(rec, req)

+ if rec.Code != http.StatusOK {

+ t.Errorf("groups=%q: status = %d, want %d", groups, rec.Code, http.StatusOK)

+ }

+ }

+}

+

+// A custom GroupHeader is honored instead of the Authentik default.

+func TestHandlerCustomGroupHeader(t *testing.T) {

+ h := testHandler(t, HandlerConfig{RequiredGroup: "gsg-admins", GroupHeader: "X-Custom-Groups"})

+

+ req := httptest.NewRequest("GET", "/admin/notices", nil)

+ req.Header.Set("X-Authentik-Groups", "gsg-admins") // wrong header, should not count

+ rec := httptest.NewRecorder()

+ h.ServeHTTP(rec, req)

+ if rec.Code != http.StatusForbidden {

+ t.Fatalf("status = %d, want %d (wrong header should not authorize)", rec.Code, http.StatusForbidden)

+ }

+

+ req = httptest.NewRequest("GET", "/admin/notices", nil)

+ req.Header.Set("X-Custom-Groups", "gsg-admins")

+ rec = httptest.NewRecorder()

+ h.ServeHTTP(rec, req)

+ if rec.Code != http.StatusOK {

+ t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)

+ }

+}

+// Package session mints and verifies the signed, stateless cookies gsg

+// uses to recognize a logged-in browser. There is no server-side session

+// store: everything needed to verify a cookie travels inside it, HMAC-signed

+// against a secret that lives only in this process's memory. A restart

+// invalidates every outstanding session -- an accepted trade-off for a

+// login this lightweight.

+//

+// The master secret is never used to sign anything directly. Each purpose

+// (today: the user session cookie; later: share-link tokens) gets its own

+// key derived from the secret via deriveKey, so a value signed for one

+// purpose can never be replayed as another -- that's enforced by

+// construction, not by a discriminator field a bug could skip.

+package session

+

+import (

+ "crypto/hmac"

+ "crypto/rand"

+ "crypto/sha256"

+ "crypto/subtle"

+ "encoding/base64"

+ "encoding/json"

+ "fmt"

+ "net/http"

+ "strconv"

+ "strings"

+ "time"

+)

+

+const (

+ // CookieName is the browser cookie carrying the signed session.

+ CookieName = "gsg_user"

+

+ // TTL is how long a session lasts after login before it must be

+ // re-established. Embedded inside the signed payload, not left to the

+ // cookie's own Max-Age/Expires alone, so a copied cookie can't outlive

+ // what the server considers valid.

+ TTL = 30 * 24 * time.Hour

+

+ // ShareCookieName is the browser cookie a redeemed share link mints.

+ ShareCookieName = "gsg_share"

+

+ purposeSession = "session"

+ purposeShareURL = "share-url"

+ purposeShareCookie = "share-cookie"

+)

+

+// Manager issues and verifies gsg's signed cookies. Safe for concurrent

+// use; a nil *Manager verifies every request as anonymous, so wiring it up

+// is optional.

+type Manager struct {

+ secret []byte

+}

+

+// NewManager generates a fresh in-memory secret.

+func NewManager() *Manager {

+ secret := make([]byte, 32)

+ if _, err := rand.Read(secret); err != nil {

+ panic("session: failed to generate secret: " + err.Error())

+ }

+ return &Manager{secret: secret}

+}

+

+// deriveKey derives a purpose-scoped signing key from the master secret.

+// This is a single-step HMAC-based derivation (not full RFC 5869 HKDF),

+// which is sufficient here: the input is already a uniformly random 32-byte

+// secret, so there's no entropy-extraction step to do, only labeling.

+func (m *Manager) deriveKey(purpose string) []byte {

+ mac := hmac.New(sha256.New, m.secret)

+ mac.Write([]byte(purpose))

+ return mac.Sum(nil)

+}

+

+// Issue mints a signed session cookie for username.

+func (m *Manager) Issue(username string) *http.Cookie {

+ exp := time.Now().Add(TTL).Unix()

+ payload := username + "|" + strconv.FormatInt(exp, 10)

+ return &http.Cookie{

+ Name: CookieName,

+ Value: sign(m.deriveKey(purposeSession), payload, ""),

+ Path: "/",

+ HttpOnly: true,

+ Secure: true,

+ SameSite: http.SameSiteLaxMode,

+ Expires: time.Unix(exp, 0),

+ }

+}

+

+// Verify reads and checks the session cookie on r, returning the

+// authenticated username, or "" if there is none, it's malformed, it's

+// signed for a different purpose, or it has expired.

+func (m *Manager) Verify(r *http.Request) string {

+ if m == nil {

+ return ""

+ }

+ c, err := r.Cookie(CookieName)

+ if err != nil {

+ return ""

+ }

+ payload, ok := verify(m.deriveKey(purposeSession), c.Value, "")

+ if !ok {

+ return ""

+ }

+ user, expStr, ok := strings.Cut(payload, "|")

+ if !ok {

+ return ""

+ }

+ exp, err := strconv.ParseInt(expStr, 10, 64)

+ if err != nil || time.Now().Unix() > exp {

+ return ""

+ }

+ return user

+}

+

+// Clear returns a cookie that immediately expires the session.

+func (m *Manager) Clear() *http.Cookie {

+ return &http.Cookie{

+ Name: CookieName,

+ Value: "",

+ Path: "/",

+ HttpOnly: true,

+ Secure: true,

+ SameSite: http.SameSiteLaxMode,

+ MaxAge: -1,

+ }

+}

+

+// ShareClaims is the payload embedded in both a share-URL token and the

+// gsg_share cookie minted on redemption. Slugs is the set of repo slugs the

+// grant unlocks; IAT/Exp are unix seconds. Pwd records only whether the

+// URL token requires a password -- it carries no password material itself.

+type ShareClaims struct {

+ V int `json:"v"`

+ Slugs []string `json:"slugs"`

+ IAT int64 `json:"iat"`

+ Exp int64 `json:"exp"`

+ Pwd bool `json:"pwd"`

+}

+

+func (c ShareClaims) expired() bool { return c.Exp != 0 && time.Now().Unix() > c.Exp }

+

+// IssuedAt is c.IAT as a time.Time, for comparison against a repo's

+// gsg.share-revoked-after.

+func (c ShareClaims) IssuedAt() time.Time { return time.Unix(c.IAT, 0) }

+

+// NewShareToken signs a share-URL token. password is "" for an unprotected

+// link; when set, it is folded into the signature, never stored in the

+// token -- see the package doc.

+func (m *Manager) NewShareToken(slugs []string, ttl time.Duration, password string) (string, ShareClaims) {

+ now := time.Now()

+ claims := ShareClaims{V: 1, Slugs: slugs, IAT: now.Unix(), Exp: now.Add(ttl).Unix(), Pwd: password != ""}

+ b, _ := json.Marshal(claims) // ShareClaims always marshals; no error path

+ return sign(m.deriveKey(purposeShareURL), string(b), password), claims

+}

+

+// PeekShareToken decodes a share-URL token's claims WITHOUT verifying its

+// signature. It exists only so the redemption page can decide whether to

+// show a password prompt before it knows the password; the result must

+// never be used to grant access -- only VerifyShareToken's result may do

+// that.

+func PeekShareToken(tok string) (ShareClaims, bool) {

+ encPayload, _, found := strings.Cut(tok, ".")

+ if !found {

+ return ShareClaims{}, false

+ }

+ b, err := dec(encPayload)

+ if err != nil {

+ return ShareClaims{}, false

+ }

+ var c ShareClaims

+ if err := json.Unmarshal(b, &c); err != nil || c.V != 1 {

+ return ShareClaims{}, false

+ }

+ return c, true

+}

+

+// VerifyShareToken checks a share-URL token against the password the

+// visitor supplied (pass "" for a token that doesn't require one) and

+// returns its claims. Wrong password, tampering, or expiry all fail the

+// same way -- there is nothing here for an attacker to distinguish.

+func (m *Manager) VerifyShareToken(tok, password string) (ShareClaims, bool) {

+ payload, ok := verify(m.deriveKey(purposeShareURL), tok, password)

+ if !ok {

+ return ShareClaims{}, false

+ }

+ var c ShareClaims

+ if err := json.Unmarshal([]byte(payload), &c); err != nil || c.V != 1 || c.expired() {

+ return ShareClaims{}, false

+ }

+ return c, true

+}

+

+// IssueShareCookie mints the gsg_share cookie from already-verified claims.

+// IAT and Exp are copied verbatim from the URL token, not restamped to

+// "now": the revocation check compares a repo's gsg.share-revoked-after

+// against IAT, and resetting it here would let an already-redeemed browser

+// outlive a revocation aimed at it.

+func (m *Manager) IssueShareCookie(claims ShareClaims) *http.Cookie {

+ b, _ := json.Marshal(claims)

+ return &http.Cookie{

+ Name: ShareCookieName,

+ Value: sign(m.deriveKey(purposeShareCookie), string(b), ""),

+ Path: "/",

+ HttpOnly: true,

+ Secure: true,

+ SameSite: http.SameSiteLaxMode,

+ Expires: time.Unix(claims.Exp, 0),

+ }

+}

+

+// VerifyShareCookie reads and checks the gsg_share cookie on r.

+func (m *Manager) VerifyShareCookie(r *http.Request) (ShareClaims, bool) {

+ if m == nil {

+ return ShareClaims{}, false

+ }

+ c, err := r.Cookie(ShareCookieName)

+ if err != nil {

+ return ShareClaims{}, false

+ }

+ payload, ok := verify(m.deriveKey(purposeShareCookie), c.Value, "")

+ if !ok {

+ return ShareClaims{}, false

+ }

+ var claims ShareClaims

+ if err := json.Unmarshal([]byte(payload), &claims); err != nil || claims.V != 1 || claims.expired() {

+ return ShareClaims{}, false

+ }

+ return claims, true

+}

+

+// sign produces "base64url(payload).base64url(hmac-sha256(payload||0||extra))".

+// Compact and self-contained like a JWT, without pulling in a JWT library or

+// its algorithm-confusion surface (alg:none, HS/RS key confusion) -- the key

+// and the hash are fixed by this package, not negotiable per token. extra is

+// "" for every purpose except a password-protected share-URL token, where

+// it's the password: folding it into the signature input (rather than

+// storing a hash of it in the payload) means nobody holding just the token

+// can crack it offline, and a guess can only be checked by asking the

+// server, which can rate-limit attempts.

+func sign(key []byte, payload, extra string) string {

+ mac := hmac.New(sha256.New, key)

+ mac.Write([]byte(payload))

+ mac.Write([]byte{0})

+ mac.Write([]byte(extra))

+ return enc(payload) + "." + enc(string(mac.Sum(nil)))

+}

+

+// verify checks tok against key and extra and, on success, returns the

+// payload.

+func verify(key []byte, tok, extra string) (payload string, ok bool) {

+ encPayload, encSig, found := strings.Cut(tok, ".")

+ if !found {

+ return "", false

+ }

+ payloadBytes, err := dec(encPayload)

+ if err != nil {

+ return "", false

+ }

+ sig, err := dec(encSig)

+ if err != nil {

+ return "", false

+ }

+ mac := hmac.New(sha256.New, key)

+ mac.Write(payloadBytes)

+ mac.Write([]byte{0})

+ mac.Write([]byte(extra))

+ if subtle.ConstantTimeCompare(sig, mac.Sum(nil)) != 1 {

+ return "", false

+ }

+ return string(payloadBytes), true

+}

+

+func enc(s string) string { return base64.RawURLEncoding.EncodeToString([]byte(s)) }

+

+func dec(s string) ([]byte, error) {

+ b, err := base64.RawURLEncoding.DecodeString(s)

+ if err != nil {

+ return nil, fmt.Errorf("session: bad encoding: %w", err)

+ }

+ return b, nil

+}

+<!doctype html>

+<html lang="en">

+<head>

+<meta charset="utf-8">

+<meta name="viewport" content="width=device-width, initial-scale=1">

+<title>Share &middot; {{ .Site }}</title>

+<link rel="stylesheet" href="/static/css/base.css">

+<link rel="stylesheet" href="/static/css/share.css">

+</head>

+<body>

+<main class="wrap">

+ <header class="hero">

+ <h1 class="page-title">Share a hidden repository</h1>

+ <p class="page-subtitle">Anyone with the link can view exactly the repositories you select below &mdash; no login required.</p>

+ </header>

+

+ {{ if .Result }}

+ <div class="notice notice-fix">

+ <strong class="notice-title">Link ready</strong>

+ <p class="share-link"><a href="{{ .Result }}">{{ .Result }}</a></p>

+ <p class="share-hint">Send this URL to whoever needs it. If you set a password, tell them separately &mdash; it isn't part of the link.</p>

+ </div>

+ <p><a href="/share/new">Create another</a></p>

+ {{ else }}

+ {{ if .Error }}

+ <div class="notice notice-critical">

+ <strong class="notice-title">Not created</strong>

+ <p>{{ .Error }}</p>

+ </div>

+ {{ end }}

+

+ {{ if not .Repos }}

+ <p>You don't have any hidden repositories to share.</p>

+ {{ else }}

+ <form method="post" action="/share/new" class="share-form">

+ <fieldset class="share-repos">

+ <legend>Repositories</legend>

+ {{ $sel := .Selected }}

+ {{ range .Repos }}

+ <label class="share-repo">

+ <input type="checkbox" name="repo" value="{{ .Slug }}"{{ if index $sel .Slug }} checked{{ end }}>

+ <span class="share-repo-title">{{ .Title }}</span>

+ <span class="share-maxage">up to {{ humanDuration .MaxAge }}</span>

+ </label>

+ {{ end }}

+ </fieldset>

+

+ <label class="share-field">

+ <span>Password (optional)</span>

+ <input type="password" name="password" autocomplete="new-password">

+ </label>

+

+ <label class="share-field">

+ <span>Expires in (optional &mdash; e.g. "24h", "168h")</span>

+ <input type="text" name="ttl" placeholder="defaults to the shortest selected repo's ceiling">

+ </label>

+

+ <button class="chip admin-save" type="submit">Create link</button>

+ </form>

+ {{ end }}

+ {{ end }}

+</main>

+</body>

+</html>

+// Package share implements anonymous, stateless share links: a logged-in

+// user picks a set of their hidden repos and mints a signed URL that grants

+// view access to exactly those repos, no login required, optionally gated

+// by a password. Everything needed to verify a link travels inside it --

+// there is no server-side record of what's been shared, only the one

+// revocation lever gsg.share-revoked-after provides (see internal/core).

+//

+// This package is deliberately decoupled from gsg/internal/core, the same

+// way internal/notices is: HandlerConfig takes plain data and callbacks,

+// not core.Site or core.RepoInfo, so main.go is the only place that bridges

+// the two.

+package share

+

+import (

+ "embed"

+ "fmt"

+ "html/template"

+ "log/slog"

+ "net"

+ "net/http"

+ "net/url"

+ "sort"

+ "strings"

+ "sync"

+ "time"

+

+ "gsg/internal/session"

+)

+

+//go:embed new.html view.html

+var templatesFS embed.FS

+

+// maxSlugs caps how many repos a single share token may name. The token

+// travels as a URL, and an unbounded slug list eventually exceeds practical

+// length limits in browsers, mail clients, and proxies (roughly 2000

+// characters).

+const maxSlugs = 64

+

+const (

+ rateLimitWindow = time.Minute

+ rateLimitMax = 10

+)

+

+// RepoOption is one hidden repo a user could choose to share.

+type RepoOption struct {

+ Slug string

+ Title string

+ MaxAge time.Duration // gsg.share-max-age: the ceiling/default for this repo

+}

+

+// HandlerConfig is everything the share surface needs that it cannot

+// discover for itself.

+type HandlerConfig struct {

+ Sessions *session.Manager

+

+ // VisibleHiddenRepos returns the hidden repos user is currently allowed

+ // to see (and therefore may share). Used both to populate the mint form

+ // and to re-filter a mint submission -- a submitted slug is never

+ // trusted just because the form included it.

+ VisibleHiddenRepos func(user string) []RepoOption

+

+ // RevokedAfter returns a repo's gsg.share-revoked-after (zero if unset)

+ // and whether the repo still exists at all, for filtering a token's

+ // slugs at redemption time.

+ RevokedAfter func(slug string) (revokedAfter time.Time, exists bool)

+

+ SiteName string

+ Logger *slog.Logger

+}

+

+type handler struct {

+ cfg HandlerConfig

+ newTmpl *template.Template

+ viewTmpl *template.Template

+ limiter *rateLimiter

+}

+

+// NewHandler builds the share mux: minting (requires a gsg_user session)

+// and redemption (does not). Both belong on the public listener (see

+// main.go) and are hand-mounted directly on its mux rather than expressed

+// as a core.Route -- core.Route's Renderer always builds a body from a Ctx,

+// and a mint result page or a redirect-plus-Set-Cookie don't fit that

+// shape.

+func NewHandler(cfg HandlerConfig) (http.Handler, error) {

+ if cfg.Sessions == nil {

+ return nil, fmt.Errorf("share: no session manager")

+ }

+ if cfg.VisibleHiddenRepos == nil || cfg.RevokedAfter == nil {

+ return nil, fmt.Errorf("share: missing required callback")

+ }

+ if cfg.Logger == nil {

+ cfg.Logger = slog.Default()

+ }

+

+ funcs := template.FuncMap{"humanDuration": humanDuration}

+ newTmpl, err := template.New("new.html").Funcs(funcs).ParseFS(templatesFS, "new.html")

+ if err != nil {

+ return nil, fmt.Errorf("share: new.html: %w", err)

+ }

+ viewTmpl, err := template.New("view.html").Funcs(funcs).ParseFS(templatesFS, "view.html")

+ if err != nil {

+ return nil, fmt.Errorf("share: view.html: %w", err)

+ }

+

+ h := &handler{cfg: cfg, newTmpl: newTmpl, viewTmpl: viewTmpl, limiter: newRateLimiter()}

+

+ mux := http.NewServeMux()

+ mux.HandleFunc("GET /share/new", h.newForm)

+ mux.HandleFunc("POST /share/new", h.newSubmit)

+ mux.HandleFunc("GET /share/view/{token}", h.view)

+ mux.HandleFunc("POST /share/view/{token}", h.redeem)

+ return mux, nil

+}

+

+type formView struct {

+ Site string

+ Error string

+ Result string

+ Repos []RepoOption

+ Selected map[string]bool

+}

+

+func (h *handler) newForm(w http.ResponseWriter, r *http.Request) {

+ user := h.cfg.Sessions.Verify(r)

+ if user == "" {

+ http.Redirect(w, r, "/auth/login?next=/share/new", http.StatusSeeOther)

+ return

+ }

+ h.renderForm(w, http.StatusOK, user, "", nil)

+}

+

+func (h *handler) renderForm(w http.ResponseWriter, status int, user, errMsg string, selected map[string]bool) {

+ repos := h.cfg.VisibleHiddenRepos(user)

+ sort.Slice(repos, func(i, j int) bool { return repos[i].Slug < repos[j].Slug })

+

+ secureHeaders(w)

+ w.Header().Set("Content-Type", "text/html; charset=utf-8")

+ w.WriteHeader(status)

+ if err := h.newTmpl.Execute(w, formView{

+ Site: h.cfg.SiteName, Error: errMsg, Repos: repos, Selected: selected,

+ }); err != nil {

+ h.cfg.Logger.Error("share new render", "err", err)

+ }

+}

+

+func (h *handler) newSubmit(w http.ResponseWriter, r *http.Request) {

+ user := h.cfg.Sessions.Verify(r)

+ if user == "" {

+ http.Error(w, "not logged in", http.StatusUnauthorized)

+ return

+ }

+ // Same-origin check on the POST: minting persists nothing server-side,

+ // but it's still an authenticated action worth CSRF-class protection --

+ // a cross-site page shouldn't be able to make a logged-in visitor's

+ // browser silently mint share links.

+ if !sameOrigin(r) {

+ h.cfg.Logger.Warn("share new: origin rejected",

+ "host", r.Host, "origin", r.Header.Get("Origin"),

+ "sec-fetch-site", r.Header.Get("Sec-Fetch-Site"))

+ http.Error(w, "forbidden", http.StatusForbidden)

+ return

+ }

+ r.Body = http.MaxBytesReader(w, r.Body, 1<<16)

+ if err := r.ParseForm(); err != nil {

+ h.renderForm(w, http.StatusBadRequest, user, "bad form submission", nil)

+ return

+ }

+

+ allowed := h.cfg.VisibleHiddenRepos(user)

+ byslug := make(map[string]RepoOption, len(allowed))

+ for _, o := range allowed {

+ byslug[o.Slug] = o

+ }

+

+ submitted := r.PostForm["repo"]

+ selected := make(map[string]bool, len(submitted))

+ for _, s := range submitted {

+ selected[s] = true

+ }

+

+ // Never trust the submitted slug list: only repos byslug (this user's

+ // own current visibility) can end up in the token, however the form

+ // was tampered with.

+ var slugs []string

+ var ceiling time.Duration

+ for _, s := range submitted {

+ o, ok := byslug[s]

+ if !ok {

+ continue

+ }

+ slugs = append(slugs, o.Slug)

+ if ceiling == 0 || o.MaxAge < ceiling {

+ ceiling = o.MaxAge

+ }

+ }

+ if len(slugs) == 0 {

+ h.renderForm(w, http.StatusBadRequest, user, "select at least one repository", selected)

+ return

+ }

+ if len(slugs) > maxSlugs {

+ h.renderForm(w, http.StatusBadRequest, user,

+ fmt.Sprintf("a single link can name at most %d repositories", maxSlugs), selected)

+ return

+ }

+ sort.Strings(slugs)

+

+ // The user may always ask for less than the ceiling, never more; an

+ // unparsable or too-long value falls back to the ceiling rather than

+ // rejecting the submission outright, since the ceiling is always a

+ // valid choice.

+ ttl := ceiling

+ if v := strings.TrimSpace(r.PostForm.Get("ttl")); v != "" {

+ if d, err := time.ParseDuration(v); err == nil && d > 0 && d <= ceiling {

+ ttl = d

+ }

+ }

+

+ password := r.PostForm.Get("password")

+ tok, claims := h.cfg.Sessions.NewShareToken(slugs, ttl, password)

+

+ h.cfg.Logger.Info("share link minted",

+ "user", user, "repos", len(slugs), "password", password != "",

+ "exp", time.Unix(claims.Exp, 0).Format(time.RFC3339))

+

+ secureHeaders(w)

+ w.Header().Set("Content-Type", "text/html; charset=utf-8")

+ if err := h.newTmpl.Execute(w, formView{

+ Site: h.cfg.SiteName, Result: absoluteURL(r, "/share/view/"+tok),

+ }); err != nil {

+ h.cfg.Logger.Error("share new render", "err", err)

+ }

+}

+

+type viewData struct {

+ Site string

+ Error string

+ Action string

+}

+

+// view is the landing page for a share link. A token that requires no

+// password redeems immediately; one that does gets a password prompt

+// first. PeekShareToken is unverified and only decides which of those two

+// to show -- redeem always re-derives the real answer via VerifyShareToken.

+func (h *handler) view(w http.ResponseWriter, r *http.Request) {

+ tok := r.PathValue("token")

+ claims, ok := session.PeekShareToken(tok)

+ if !ok {

+ http.Error(w, "invalid share link", http.StatusNotFound)

+ return

+ }

+ if !claims.Pwd {

+ h.redeem(w, r)

+ return

+ }

+ h.renderPassword(w, http.StatusOK, tok, "")

+}

+

+func (h *handler) renderPassword(w http.ResponseWriter, status int, tok, errMsg string) {

+ secureHeaders(w)

+ w.Header().Set("Content-Type", "text/html; charset=utf-8")

+ w.WriteHeader(status)

+ if err := h.viewTmpl.Execute(w, viewData{

+ Site: h.cfg.SiteName, Error: errMsg, Action: "/share/view/" + tok,

+ }); err != nil {

+ h.cfg.Logger.Error("share view render", "err", err)

+ }

+}

+

+// redeem verifies the token (with whatever password was submitted, "" if

+// none), filters its slugs against live revocation state, and mints the

+// gsg_share cookie. It also serves the no-password GET path via view above,

+// where the submitted password is always "".

+func (h *handler) redeem(w http.ResponseWriter, r *http.Request) {

+ tok := r.PathValue("token")

+ r.Body = http.MaxBytesReader(w, r.Body, 1<<16)

+ if err := r.ParseForm(); err != nil {

+ http.Error(w, "bad form submission", http.StatusBadRequest)

+ return

+ }

+ password := r.PostForm.Get("password")

+

+ // Only rate-limit actual guesses against a password-protected link --

+ // there is nothing to guess on an unprotected one. Keyed on the source

+ // IP alone, not IP+token: PeekShareToken doesn't verify a signature, so

+ // keying on the token string would let an unauthenticated caller mint

+ // unbounded distinct keys (one per invented token) for free. IP-only

+ // also has the right semantics anyway -- one source gets a fixed

+ // budget of guesses per window, not a fixed budget per link it tries.

+ if peek, ok := session.PeekShareToken(tok); ok && peek.Pwd {

+ if !h.limiter.allow(remoteIP(r)) {

+ http.Error(w, "too many attempts, try again later", http.StatusTooManyRequests)

+ return

+ }

+ }

+

+ claims, ok := h.cfg.Sessions.VerifyShareToken(tok, password)

+ if !ok {

+ if peek, peekOK := session.PeekShareToken(tok); peekOK && peek.Pwd {

+ h.renderPassword(w, http.StatusUnauthorized, tok, "incorrect password")

+ return

+ }

+ http.Error(w, "invalid or expired share link", http.StatusNotFound)

+ return

+ }

+

+ // Narrow to what's still live: a repo that no longer exists, or whose

+ // gsg.share-revoked-after postdates this grant, drops out here. This is

+ // a courtesy at redemption time -- the authoritative check runs again

+ // on every subsequent request in core.Server.buildCtx, since revocation

+ // must reach a browser that already holds the cookie, not just block

+ // new redemptions.

+ kept := make([]string, 0, len(claims.Slugs))

+ for _, slug := range claims.Slugs {

+ revokedAfter, exists := h.cfg.RevokedAfter(slug)

+ if !exists {

+ continue

+ }

+ if !revokedAfter.IsZero() && !claims.IssuedAt().After(revokedAfter) {

+ continue

+ }

+ kept = append(kept, slug)

+ }

+ if len(kept) == 0 {

+ http.Error(w, "this share link no longer grants access to any repository", http.StatusGone)

+ return

+ }

+ claims.Slugs = kept

+

+ http.SetCookie(w, h.cfg.Sessions.IssueShareCookie(claims))

+ http.Redirect(w, r, "/", http.StatusSeeOther)

+}

+

+// rateLimiter is a small in-memory, per-process fixed-window limiter --

+// the same posture gsg already accepts elsewhere (see reposCache in

+// internal/modules/repos.go): it resets on restart, and, as a known

+// simplification, never evicts a key once created. Acceptable for guarding

+// a share link's password on a self-hosted, single-instance tool.

+type rateLimiter struct {

+ mu sync.Mutex

+ hits map[string][]time.Time

+}

+

+func newRateLimiter() *rateLimiter { return &rateLimiter{hits: map[string][]time.Time{}} }

+

+func (l *rateLimiter) allow(key string) bool {

+ l.mu.Lock()

+ defer l.mu.Unlock()

+ now := time.Now()

+ cutoff := now.Add(-rateLimitWindow)

+

+ // Compact in place: safe because append never writes past the range

+ // index it's reading from.

+ kept := l.hits[key][:0]

+ for _, t := range l.hits[key] {

+ if t.After(cutoff) {

+ kept = append(kept, t)

+ }

+ }

+ if len(kept) >= rateLimitMax {

+ l.hits[key] = kept

+ return false

+ }

+ l.hits[key] = append(kept, now)

+ return true

+}

+

+func remoteIP(r *http.Request) string {

+ host, _, err := net.SplitHostPort(r.RemoteAddr)

+ if err != nil {

+ return r.RemoteAddr

+ }

+ return host

+}

+

+// secureHeaders mirrors internal/notices's admin page: no inline script or

+// style, so the CSP can stay tight. script-src is 'none' here (stricter

+// than notices' 'self') since these pages ship no JS at all. Cache-Control

+// is stricter still: the mint result page's body is a bearer capability

+// (the share URL itself), so unlike the rest of the site it must never be

+// stored anywhere, not even by the requesting browser.

+func secureHeaders(w http.ResponseWriter) {

+ hdr := w.Header()

+ hdr.Set("X-Content-Type-Options", "nosniff")

+ hdr.Set("X-Frame-Options", "DENY")

+ hdr.Set("Content-Security-Policy",

+ "default-src 'none'; style-src 'self'; script-src 'none'; img-src 'self'; form-action 'self'; base-uri 'none'")

+ hdr.Set("Cache-Control", "no-store")

+}

+

+// sameOrigin blocks a cross-site POST even if the session cookie would

+// otherwise be sent. A valid gsg_user cookie proves the browser is logged

+// in; it does not prove the request came from our own page.

+func sameOrigin(r *http.Request) bool {

+ switch r.Header.Get("Sec-Fetch-Site") {

+ case "", "same-origin", "none":

+ default:

+ return false

+ }

+ if o := r.Header.Get("Origin"); o != "" {

+ u, err := url.Parse(o)

+ if err != nil || !strings.EqualFold(u.Host, r.Host) {

+ return false

+ }

+ }

+ return true

+}

+

+func absoluteURL(r *http.Request, path string) string {

+ scheme := "http"

+ if r.TLS != nil || strings.EqualFold(r.Header.Get("X-Forwarded-Proto"), "https") {

+ scheme = "https"

+ }

+ return scheme + "://" + r.Host + path

+}

+

+func humanDuration(d time.Duration) string {

+ switch {

+ case d <= 0:

+ return "0"

+ case d%(24*time.Hour) == 0:

+ days := d / (24 * time.Hour)

+ if days == 1 {

+ return "1 day"

+ }

+ return fmt.Sprintf("%d days", days)

+ case d%time.Hour == 0:

+ hours := d / time.Hour

+ if hours == 1 {

+ return "1 hour"

+ }

+ return fmt.Sprintf("%d hours", hours)

+ default:

+ return d.String()

+ }

+}

+<!doctype html>

+<html lang="en">

+<head>

+<meta charset="utf-8">

+<meta name="viewport" content="width=device-width, initial-scale=1">

+<title>Share link &middot; {{ .Site }}</title>

+<link rel="stylesheet" href="/static/css/base.css">

+<link rel="stylesheet" href="/static/css/share.css">

+</head>

+<body>

+<main class="wrap">

+ <header class="hero">

+ <h1 class="page-title">Password required</h1>

+ <p class="page-subtitle">This share link is password-protected.</p>

+ </header>

+

+ {{ if .Error }}

+ <div class="notice notice-critical"><p>{{ .Error }}</p></div>

+ {{ end }}

+

+ <form method="post" action="{{ .Action }}" class="share-form">

+ <label class="share-field">

+ <span>Password</span>

+ <input type="password" name="password" autofocus>

+ </label>

+ <button class="chip admin-save" type="submit">View</button>

+ </form>

+</main>

+</body>

+</html>

+ {Name: "index", Scope: core.ScopeSite, CacheableAnon: true,

+ {Name: "repo", CacheableAnon: true,

+ {Name: "tree", NavLabel: "files", CacheableAnon: true,

+ {Name: "log", NavLabel: "log", CacheableAnon: true,

+ {Name: "graph", NavLabel: "graph", CacheableAnon: true,

+ {Name: "refs", NavLabel: "refs", CacheableAnon: true,

+ // Arbitrary two-commit diff: /demo/compare/main...feature. Not

+ // CacheableAnon: a diff body is bounded only by MaxGit (16 MiB,

+ // larger than a blob preview), and every valid ref pair is a

+ // distinct key -- a repo with N refs has ~N^2 reachable ones. The

+ // response cache has no size-aware eviction, so this route would

+ // risk filling it with a few huge entries for no real hit-rate

+ // benefit (see internal/core/route.go's CacheableAnon doc).

+// gsg -root /srv/git -admin-addr 127.0.0.1:8081 # login only, no notices

+// gsg -root /srv/git -notices /etc/gsg/notices.yaml -admin-addr 127.0.0.1:8081 -admin-group gsg-admins

+// git --git-dir=/srv/git/foo.git config gsg.visible-to "alice,bob"

+ "net/url"

+ "strings"

+ "gsg/internal/session"

+ "gsg/internal/share"

+ adminGroupHeader, adminGroup string

+ flag.StringVar(&o.adminGroup, "admin-group", "", "group required (via -admin-group-header) to reach the notices admin UI; empty allows anyone the reverse proxy lets through")

+ flag.StringVar(&o.adminGroupHeader, "admin-group-header", "X-Authentik-Groups", "header carrying the caller's \"|\"-delimited groups, checked against -admin-group")

+ flag.IntVar(&o.cacheSize, "cache", 4096, "entries per cache (module results and the anonymous response cache each get their own, sized identically)")

+ // One in-memory secret for the whole process: it signs the gsg_user

+ // login cookie minted on the admin listener and verified on the public

+ // one. A restart invalidates every outstanding session -- acceptable

+ // for a login this lightweight.

+ sessions := session.NewManager()

+

+ srv.Sessions = sessions

+ // Content hash of the embedded assets, not a build timestamp, so it's

+ // stable across restarts that don't change any file and only changes

+ // when one actually does -- templates use it (via the `static` funcmap

+ // entry) to mint cache-busting URLs.

+ staticTag, err := core.HashFS(static)

+ if err != nil {

+ return err

+ }

+ srv.StaticTag = staticTag

+ mux.Handle("/static/", cachedStatic(static))

+ // Logout only clears gsg's own cookie -- it needs no round trip through

+ // Authentik, so it lives on the public listener, not behind

+ // forward_auth like /auth/login. It's hand-mounted here rather than

+ // through site.Routes() for the same reason /auth/login is hand-mounted

+ // on the admin mux below: core.Route's Renderer always builds a body

+ // from a Ctx, and a redirect-plus-Set-Cookie doesn't fit that shape.

+ mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) {

+ http.SetCookie(w, sessions.Clear())

+ http.Redirect(w, r, "/", http.StatusSeeOther)

+ })

+

+ // Share links: minting authorizes off the gsg_user cookie, which only

+ // this (public) listener ever verifies -- the admin listener's whole

+ // reason to exist is trusting X-Authentik-Username, not browser

+ // cookies, so mixing the two would blur that boundary for no benefit.

+ // Redemption is by definition unauthenticated public traffic.

+ shareHandler, err := share.NewHandler(share.HandlerConfig{

+ Sessions: sessions,

+ VisibleHiddenRepos: func(user string) []share.RepoOption {

+ var out []share.RepoOption

+ for _, h := range siteCfg.RepoList() {

+ if h.Info.Hidden && h.Info.CanView(user) {

+ out = append(out, share.RepoOption{

+ Slug: h.Info.Slug,

+ Title: h.Info.Title,

+ MaxAge: h.Info.ShareMaxAge,

+ })

+ }

+ }

+ return out

+ },

+ RevokedAfter: func(slug string) (time.Time, bool) {

+ h, ok := siteCfg.Lookup(slug)

+ if !ok {

+ return time.Time{}, false

+ }

+ return h.Info.ShareRevokedAfter, true

+ },

+ SiteName: o.name,

+ Logger: slog.Default(),

+ })

+ if err != nil {

+ return err

+ }

+ mux.Handle("/share/", shareHandler)

+

+ // The public mux stays strictly read-only. Anything that trusts

+ // X-Authentik-Username -- notices editing, login -- lives on this

+ // separate listener so a misconfigured Caddy forward_auth cannot

+ // expose it on the public port.

+ amux.Handle("/static/", cachedStatic(static))

+

+ // /auth/login: reachable only through the same Caddy forward_auth

+ // block as /admin/*, so by the time a request lands here,

+ // X-Authentik-Username is already set and trustworthy. There is no

+ // separate /auth/callback -- one hop does the whole job. There is

+ // also no link to this URL anywhere in the UI; people who need it

+ // are told out of band.

+ amux.HandleFunc("GET /auth/login", func(w http.ResponseWriter, r *http.Request) {

+ user := r.Header.Get("X-Authentik-Username")

+ if user == "" {

+ http.Error(w, "missing identity header", http.StatusUnauthorized)

+ return

+ }

+ http.SetCookie(w, sessions.Issue(user))

+ http.Redirect(w, r, safeNext(r.URL.Query().Get("next")), http.StatusSeeOther)

+ })

+

+ // Notices editing is a separate opt-in on top of the admin

+ // listener: -admin-addr alone is enough to enable login.

+ if nstore != nil {

+ repos := make([]string, 0)

+ for _, h := range siteCfg.RepoList() {

+ if !h.Info.Hidden {

+ repos = append(repos, h.Info.Slug)

+ }

+ }

+ adminHandler, err := notices.NewHandler(notices.HandlerConfig{

+ Store: nstore,

+ Repos: repos,

+ SiteName: o.name,

+ UserHeader: "X-Authentik-Username",

+ GroupHeader: o.adminGroupHeader,

+ RequiredGroup: o.adminGroup,

+ Logger: slog.Default(),

+ })

+ if err != nil {

+ return err

+ }

+ amux.Handle("/admin/", adminHandler)

+ }

+

+// cachedStatic serves fsys with a Cache-Control that depends on whether the

+// request carries the `v` cache-busting query param the `static` template

+// func mints (see internal/core/funcs.go). Requests that carry it are

+// addressed by content hash, so they're frozen for a year; everything else

+// -- share/notices/error-page assets, which don't go through that funcmap

+// and so never get a `v` -- still gets a real improvement over no

+// Cache-Control at all, just a short one, in case a template edit changes

+// what a bare URL should serve.

+func cachedStatic(fsys fs.FS) http.Handler {

+ fileServer := http.FileServer(http.FS(fsys))

+ h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {

+ if r.URL.Query().Get("v") != "" {

+ w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")

+ } else {

+ w.Header().Set("Cache-Control", "public, max-age=600")

+ }

+ fileServer.ServeHTTP(w, r)

+ })

+ return http.StripPrefix("/static/", h)

+}

+

+// safeNext returns next if it is a same-site relative path, else "/". next

+// comes from a query parameter on a login redirect; without this check it

+// would be an open redirect (?next=https://evil.example) off a trusted

+// domain, right after proving who the user is.

+func safeNext(next string) string {

+ if next == "" || !strings.HasPrefix(next, "/") || strings.HasPrefix(next, "//") {

+ return "/"

+ }

+ if u, err := url.Parse(next); err != nil || u.Scheme != "" || u.Host != "" {

+ return "/"

+ }

+ return next

+}

+

+ display: flex; align-items: center; gap: .75rem;

+}

+

+.nav-user {

+ font-size: .78rem;

+ color: var(--fg-muted);

+ white-space: nowrap;

+.nav-user a { color: var(--fg-muted); }

+.nav-user a:hover { color: var(--accent); }

+/* Share link pages: mint form, password prompt. Small and self-contained,

+ built on base.css's tokens rather than introducing new ones. */

+

+.share-form {

+ display: flex;

+ flex-direction: column;

+ gap: 1rem;

+ max-width: 32rem;

+ margin-top: 1rem;

+}

+

+.share-repos {

+ border: 1px solid var(--line);

+ border-radius: var(--r-sm);

+ padding: .75rem 1rem;

+ display: flex;

+ flex-direction: column;

+ gap: .5rem;

+}

+

+.share-repos legend {

+ padding: 0 .4rem;

+ color: var(--fg-muted);

+ font-size: .8rem;

+}

+

+.share-repo {

+ display: flex;

+ align-items: baseline;

+ gap: .5rem;

+}

+

+.share-repo-title { color: var(--fg); }

+

+.share-maxage {

+ color: var(--fg-muted);

+ font-size: .78rem;

+ margin-left: auto;

+}

+

+.share-field {

+ display: flex;

+ flex-direction: column;

+ gap: .3rem;

+ font-size: .85rem;

+ color: var(--fg-muted);

+}

+

+.share-field input {

+ font: inherit;

+ color: var(--fg);

+ background: var(--bg);

+ border: 1px solid var(--line);

+ border-radius: var(--r-sm);

+ padding: .4rem .6rem;

+}

+

+.share-link { word-break: break-all; }

+

+.share-hint {

+ color: var(--fg-muted);

+ font-size: .82rem;

+}

+<link rel="stylesheet" href="{{ static "css/base.css" }}">

+ <span>{{ .Site.Name }} v1.3</span>

+ {{ end }}

+ <div class="nav-end">

+ {{ with .Info.Slug }}

+ {{ end }}

+ {{/* One-sided on purpose: no "log in" link when anonymous. There is

+ no discoverable entry point into /auth/login anywhere in the UI;

+ people who need it are told the URL out of band. */}}

+ {{ with $.User }}

+ <span class="nav-user">Logged in as {{ . }} &middot; <a href="/auth/logout">log out</a></span>

+ {{ end }}

+ </div>

+{{ define "styles" }}<link rel="stylesheet" href="{{ static "css/blob.css" }}">{{ end }}

+{{ define "scripts" }}{{ if (mod "blob").Structured }}<script src="{{ static "js/structured.js" }}" defer></script>{{ end }}{{ end }}

+<link rel="stylesheet" href="{{ static "css/diff.css" }}">

+<link rel="stylesheet" href="{{ static "css/readme.css" }}">

+{{ define "styles" }}<link rel="stylesheet" href="{{ static "css/diff.css" }}">{{ end }}

+{{ define "styles" }}<link rel="stylesheet" href="{{ static "css/graph.css" }}">{{ end }}

+{{ define "styles" }}<link rel="stylesheet" href="{{ static "css/repo-list.css" }}">{{ end }}

+<link rel="stylesheet" href="{{ static "css/repo.css" }}">

+<link rel="stylesheet" href="{{ static "css/readme.css" }}">