gitea/services/context/context.go

// Copyright 2014 The Gogs Authors. All rights reserved.
// Copyright 2020 The Gitea Authors. All rights reserved.
// SPDX-License-Identifier: MIT

package context

import (
	"context"
	"fmt"
	"html/template"
	"io"
	"net/http"
	"net/url"
	"strings"

	"gitea.dev/models/unit"
	user_model "gitea.dev/models/user"
	"gitea.dev/modules/cache"
	"gitea.dev/modules/httpcache"
	"gitea.dev/modules/reqctx"
	"gitea.dev/modules/session"
	"gitea.dev/modules/setting"
	"gitea.dev/modules/templates"
	"gitea.dev/modules/translation"
	"gitea.dev/modules/util"
	"gitea.dev/modules/validation"
	"gitea.dev/modules/web"
	"gitea.dev/modules/web/middleware"
	web_types "gitea.dev/modules/web/types"
)

// Render represents a template render
type Render interface {
	TemplateLookup(tmpl string, templateCtx context.Context) (templates.TemplateExecutor, error)
	HTML(w io.Writer, status int, name templates.TplName, data any, templateCtx context.Context) error
}

// Context represents context of a web request.
// ATTENTION: This struct should never be manually constructed in routes/services,
// it has many internal details which should be carefully prepared by the framework.
// If it is abused, it would cause strange bugs like panic/resource-leak.
type Context struct {
	*Base

	TemplateContext TemplateContext

	Render   Render
	PageData map[string]any // data used by JavaScript modules in one page, it's `window.config.pageData`

	Cache   cache.StringCache
	Flash   *middleware.Flash
	Session session.Store

	Link string // current request URL (without query string)

	Doer        *user_model.User // current signed-in user
	IsSigned    bool
	IsBasicAuth bool

	ContextUser *user_model.User // the user which is being visited, in most cases it differs from Doer

	Repo    *Repository
	Org     *Organization
	Package *Package
}

func init() {
	web.RegisterResponseStatusProvider[*Base](func(req *http.Request) web_types.ResponseStatusProvider {
		return reqctx.MustContextValue[*Base](req.Context(), BaseContextKey)
	})
	web.RegisterResponseStatusProvider[*Context](func(req *http.Request) web_types.ResponseStatusProvider {
		return reqctx.MustContextValue[*Context](req.Context(), WebContextKey)
	})
}

type webContextKeyType struct{}

var WebContextKey = webContextKeyType{}

func GetWebContext(ctx context.Context) *Context {
	webCtx, _ := ctx.Value(WebContextKey).(*Context)
	return webCtx
}

func NewTemplateContextForWeb(ctx reqctx.RequestContext, req *http.Request, locale translation.Locale) TemplateContext {
	tmplCtx := NewTemplateContext(ctx, req)
	tmplCtx["Locale"] = locale
	tmplCtx["AvatarUtils"] = templates.NewAvatarUtils(ctx)
	tmplCtx["RenderUtils"] = templates.NewRenderUtils(ctx)
	tmplCtx["MiscUtils"] = templates.NewMiscUtils(ctx)
	tmplCtx["ActionsUtils"] = templates.NewActionsUtils(ctx)
	tmplCtx["RootData"] = ctx.GetData()
	tmplCtx["Consts"] = map[string]any{
		"RepoUnitTypeCode":            unit.TypeCode,
		"RepoUnitTypeIssues":          unit.TypeIssues,
		"RepoUnitTypePullRequests":    unit.TypePullRequests,
		"RepoUnitTypeReleases":        unit.TypeReleases,
		"RepoUnitTypeWiki":            unit.TypeWiki,
		"RepoUnitTypeExternalWiki":    unit.TypeExternalWiki,
		"RepoUnitTypeExternalTracker": unit.TypeExternalTracker,
		"RepoUnitTypeProjects":        unit.TypeProjects,
		"RepoUnitTypePackages":        unit.TypePackages,
		"RepoUnitTypeActions":         unit.TypeActions,
	}
	return tmplCtx
}

func NewWebContext(base *Base, render Render, session session.Store) *Context {
	ctx := &Context{
		Base:    base,
		Render:  render,
		Session: session,

		Cache: cache.GetCache(),
		Link:  setting.AppSubURL + strings.TrimSuffix(base.Req.URL.EscapedPath(), "/"),
		Repo:  &Repository{},
		Org:   &Organization{},
	}
	ctx.TemplateContext = NewTemplateContextForWeb(ctx, ctx.Base.Req, ctx.Base.Locale)
	ctx.Flash = &middleware.Flash{DataStore: ctx, Values: url.Values{}}
	ctx.SetContextValue(WebContextKey, ctx)
	return ctx
}

func ContexterInstallPage(data map[string]any) func(next http.Handler) http.Handler {
	rnd := templates.PageRenderer()
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
			base := NewBaseContext(resp, req)
			ctx := NewWebContext(base, rnd, session.GetContextSession(req))
			ctx.Data.MergeFrom(middleware.CommonTemplateContextData())
			ctx.Data.MergeFrom(reqctx.ContextData{
				"Title":         ctx.Locale.Tr("install.install"),
				"PageIsInstall": true,
				"AllLangs":      translation.AllLangs(),
			})
			ctx.Data.MergeFrom(data)
			next.ServeHTTP(resp, ctx.Req)
		})
	}
}

// Contexter initializes a classic context for a request.
func Contexter() func(next http.Handler) http.Handler {
	rnd := templates.PageRenderer()
	return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
			base := NewBaseContext(resp, req)
			ctx := NewWebContext(base, rnd, session.GetContextSession(req))
			ctx.Data.MergeFrom(middleware.CommonTemplateContextData())
			ctx.Data["CurrentURL"] = setting.AppSubURL + req.URL.RequestURI()
			ctx.Data["Link"] = ctx.Link

			// PageData is passed by reference, and it will be rendered to `window.config.pageData` in `head.tmpl` for JavaScript modules
			ctx.PageData = map[string]any{}
			ctx.Data["PageData"] = ctx.PageData

			// get the last flash message from cookie
			lastFlashCookie, lastFlashMsg := middleware.GetSiteCookieFlashMessage(ctx, ctx.Req, CookieNameFlash)
			if vals, _ := url.ParseQuery(lastFlashCookie); len(vals) > 0 {
				ctx.Data["Flash"] = lastFlashMsg // store last Flash message into the template data, to render it
			}

			// if there are new messages in the ctx.Flash, write them into cookie
			ctx.Resp.Before(func(resp ResponseWriter) {
				if val := ctx.Flash.Encode(); val != "" {
					middleware.SetSiteCookie(ctx.Resp, CookieNameFlash, val, 0)
				} else if lastFlashCookie != "" {
					middleware.SetSiteCookie(ctx.Resp, CookieNameFlash, "", -1)
				}
			})

			// FIXME: GLOBAL-PARSE-FORM: this ParseMultipartForm was used for parsing the csrf token from multipart/form-data
			// We have dropped the csrf token, so ideally this global ParseMultipartForm should be removed.
			// When removing this, we need to avoid regressions in the handler functions because Golang's http framework is quite fragile
			// and developers sometimes need to manually parse the form before accessing some values.
			if ctx.Req.Method == http.MethodPost && strings.Contains(ctx.Req.Header.Get("Content-Type"), "multipart/form-data") {
				if !ctx.ParseMultipartForm() {
					return
				}
			}

			httpcache.SetCacheControlInHeader(ctx.Resp.Header(), &httpcache.CacheControlOptions{})

			ctx.Data["SystemConfig"] = setting.Config()

			ctx.Data["ShowTwoFactorRequiredMessage"] = ctx.DoerNeedTwoFactorAuth()

			// FIXME: do we really always need these setting? There should be someway to have to avoid having to always set these
			ctx.Data["DisableMigrations"] = setting.Repository.DisableMigrations
			ctx.Data["DisableStars"] = setting.Repository.DisableStars
			ctx.Data["EnableActions"] = setting.Actions.Enabled && !unit.TypeActions.UnitGlobalDisabled()

			ctx.Data["AllLangs"] = translation.AllLangs()

			next.ServeHTTP(ctx.Resp, ctx.Req)
		})
	}
}

func (ctx *Context) DoerNeedTwoFactorAuth() bool {
	if !setting.TwoFactorAuthEnforced {
		return false
	}
	return ctx.Session.Get(session.KeyUserHasTwoFactorAuth) == false
}

// DoerIsImpersonated returns true if the current session is an admin impersonating the doer
func (ctx *Context) DoerIsImpersonated() bool {
	return ctx.Session.Get(session.KeyImpersonatorData) != nil
}

// HasError returns true if error occurs in form validation.
// Attention: this function changes ctx.Data and ctx.Flash
// If HasError is called, then before Redirect, the error message should be stored by ctx.Flash.Error(ctx.GetErrMsg()) again.
func (ctx *Context) HasError() bool {
	hasErr, _ := ctx.Data["HasError"].(bool)
	hasErr = hasErr || ctx.Flash.ErrorMsg != ""
	if !hasErr {
		return false
	}
	if ctx.Flash.ErrorMsg == "" {
		ctx.Flash.ErrorMsg = ctx.GetErrMsg()
	}
	ctx.Data["Flash"] = ctx.Flash
	return hasErr
}

// GetErrMsg returns error message in form validation.
func (ctx *Context) GetErrMsg() string {
	msg, _ := ctx.Data["ErrorMsg"].(string)
	if msg == "" {
		msg = "invalid form data"
	}
	return msg
}

func (ctx *Context) JSONRedirect(redirect string) {
	ctx.JSON(http.StatusOK, map[string]any{"redirect": redirect})
}

func (ctx *Context) JSONOK() {
	ctx.JSON(http.StatusOK, map[string]any{"ok": true}) // this is only a dummy response, frontend seldom uses it
}

func buildJsonErrorMap(msg any) map[string]any {
	switch v := msg.(type) {
	case string:
		return map[string]any{"errorMessage": v, "renderFormat": "text"}
	case template.HTML:
		return map[string]any{"errorMessage": v, "renderFormat": "html"}
	}
	panic(fmt.Sprintf("unsupported type: %T", msg))
}

func (ctx *Context) JSONError(msg any) {
	ctx.JSON(http.StatusBadRequest, buildJsonErrorMap(msg))
}

func (ctx *Context) JSONErrorWithField(msg any, field string) {
	m := buildJsonErrorMap(msg)
	m["errorFields"] = []string{field}
	ctx.JSON(http.StatusBadRequest, m)
}

func (ctx *Context) JSONErrorNotFound(optMsg ...string) {
	msg := util.OptionalArg(optMsg)
	if msg == "" {
		msg = ctx.Locale.TrString("error.not_found")
	}
	ctx.JSON(http.StatusNotFound, buildJsonErrorMap(msg))
}

func GetFetchActionForm[T middleware.Form](ctx *Context) (ret T) {
	if web.IsFormSet(ctx) {
		panic("don't mix fetch-action form validation with template-based form validation")
	}
	form, errs := middleware.BindFormValidate[T](ctx.Req, validation.Binder())
	errorMessage, fieldName, _ := middleware.BuildValidationErrorForUser(form, ctx.Locale, errs)
	if errorMessage != "" {
		ctx.Resp.Header().Set("Content-Type", "application/json")
		ctx.JSONErrorWithField(errorMessage, fieldName)
		return ret
	}
	return form
}