5 Commits

Include renames

Author	SHA1	Message	Date
jochen	f2d765320a	gitea forge bundle: name the parent the forge used, match protection rules as the forge does, bound a commit's size and a search's time (issue 539) ... The forge's contents and diffpatch endpoints take a branch, never a commit to build on, so the parent is read from the commit the forge made, and a branch that moved under the commit is said. Blobs are read at the commit read first, not at the branch name. Protection rules match as Gitea 1.27 matches them ([...], {a,b}, escapes, a plain name in any case), in the Go bundle and in guard.ts alike. One commit carries at most 4 MiB per file or patch and 16 MiB together; code search stops at its deadline and says so. The HTTP client the two Go bundles copied is one package, internal/forgehttp.	2026-10-12 12:51:22 +02:00
jochen	5eab586116	Put no caller's text in a forge path unjudged: every segment checked, every sent path checked again ... The confirmation review of 2026-10-09 found the dedicated tools building paths from caller text: a branch named .. became DELETE /repos/o/r/ (the repository), a file path ../../../../version reached /api/v1/version, and a sha with ?sudo= set a status as any user. Each caller-supplied segment now goes through one helper refusing empty, . and .. and / ? # %; a sha must be a commit; and the client judges every path once more as it sends it: no dot or empty segment, encoded or not, and only the allow-listed query keys.	2026-10-09 13:35:15 +02:00
jochen	ea772a9cce	Let gitea_api send only the query keys it needs, never sudo, and never approve a pull request ... The confirmation review of 2026-10-09 measured GET /user?sudo=… answer the operator's own account: the query went to the forge unjudged, and the tools' token is the site administrator's, so any caller could act as any user. gitea_api now sends only allow-listed query keys and refuses sudo in any case, and a review that approves or requests changes is the operator's.	2026-10-09 12:57:16 +02:00
jochen	ff648ad32b	Send the path gitea_api judged, keep a pull request's base, merge only into a guarded branch, and delete only the tools' own idle repositories ... Follow-ups of the review of 2026-10-09: the escape hatch sent the raw path it had judged in normalised form; a pull request's base could be moved through it; the merge tool would merge into a branch no rule guards; a rule named for a branch could undercut the glob rule guarding it; and the delete tool took any unguarded repository. It now takes only a repository of the tools' own user with no protection and no commit in 30 days, named in full.	2026-10-09 12:26:37 +02:00
jochen	080c113d69	Let the forge's tools never weaken protection or merge past the checks ... gitea_api took any endpoint with a token minted for the forge's administrator with write:admin: an agent could drop a branch's protection or its required checks, set the merge check's status, write to main or merge its own pull request (novox/hq ADR 0266 §7, the review of 2026-10-09). gitea_api now reads anything but the administration and writes only what an author writes; protection is only strengthened; a merge needs every required status a success and merges only that head; a guarded repository is not deleted; and the token is minted without write:admin, a kept one re-minted at the next start.	2026-10-09 11:47:36 +02:00