fix(web): render private GitLab uploads in merge request descriptions

apps/server/src/assets/AssetAccess.test.ts

@@ -1156,6 +1156,26 @@ describe("AssetAccess", () => {
     }).pipe(Effect.provide(testLayer)),
   );
 
+  it.effect("signs an exact GitLab upload and rejects expired or altered grants", () =>
+    Effect.gen(function* () {
+      const reference = {
+        origin: "http://gl.here",
+        project: "42",
+        secret: "66dbcd21ec5d24ed6ea225176098d52b",
+        fileName: "my image.png",
+      };
+      const signed = yield* issueAssetUrl({ resource: { _tag: "gitlab-upload", reference } });
+      const suffix = signed.relativeUrl.slice(`${ASSET_ROUTE_PREFIX}/`.length);
+      const separator = suffix.indexOf("/");
+      const token = suffix.slice(0, separator);
+      const name = suffix.slice(separator + 1);
+      expect(yield* resolveAsset(token, name)).toEqual({ kind: "gitlab-upload", reference });
+      expect(yield* resolveAsset(`x${token}`, name)).toBeNull();
+      yield* TestClock.adjust("61 minutes");
+      expect(yield* resolveAsset(token, name)).toBeNull();
+    }).pipe(Effect.provide(testLayer)),
+  );
+
   it.effect("serves GitHub-hosted pull request media through the repository's credential", () =>
     Effect.gen(function* () {
       const resolve = (relativeUrl: string) => {

apps/server/src/assets/AssetAccess.ts

@@ -1,6 +1,7 @@
 import type { AssetResource } from "@t3tools/contracts";
 import {
   AssetAttachmentNotFoundError,
+  GitLabUploadReference,
   AssetGitHubMediaUrlValidationError,
   AssetPreviewTypeValidationError,
   AssetProjectFaviconInspectionError,
@@ -83,6 +84,12 @@ const PREVIEW_ASSET_EXTENSIONS = new Set([
 ]);
 
 const AssetClaimsSchema = Schema.Union([
+  Schema.Struct({
+    version: Schema.Literal(1),
+    kind: Schema.Literal("gitlab-upload"),
+    reference: GitLabUploadReference,
+    expiresAt: Schema.Number,
+  }),
   Schema.Struct({
     version: Schema.Literal(1),
     kind: Schema.Literal("workspace-file"),
@@ -153,6 +160,7 @@ const decodeAssetClaims = Schema.decodeUnknownOption(AssetClaimsJson);
 const encodeAssetClaims = Schema.encodeSync(AssetClaimsJson);
 
 export type ResolvedAsset =
+  | { readonly kind: "gitlab-upload"; readonly reference: GitLabUploadReference }
   | {
       readonly kind: "file";
       readonly path: string;
@@ -681,6 +689,16 @@ export const issueAssetUrl = Effect.fn("AssetAccess.issueAssetUrl")(function* (i
       fileName = "native-app-icon.png";
       break;
     }
+    case "gitlab-upload": {
+      claims = {
+        version: 1,
+        kind: "gitlab-upload",
+        reference: input.resource.reference,
+        expiresAt,
+      };
+      fileName = input.resource.reference.fileName;
+      break;
+    }
     case "github-media": {
       const fetchUrl = githubMediaFetchUrl(input.resource.url);
       if (fetchUrl === null) {
@@ -796,6 +814,10 @@ export const resolveAsset = Effect.fn("AssetAccess.resolveAsset")(function* (
       : null;
   }
 
+  if (claims.kind === "gitlab-upload") {
+    return { kind: "gitlab-upload", reference: claims.reference } satisfies ResolvedAsset;
+  }
+
   if (claims.kind === "github-media") {
     return {
       kind: "github-media",

apps/server/src/assets/GitLabUploadMedia.test.ts

@@ -0,0 +1,305 @@
+import { describe, expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import {
+  FetchHttpClient,
+  HttpClient,
+  HttpClientResponse,
+  HttpServerResponse,
+} from "effect/unstable/http";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import type { GitLabUploadReference } from "@t3tools/contracts";
+import * as GitLabUploadMedia from "./GitLabUploadMedia.ts";
+import * as GitLabCli from "../sourceControl/GitLabCli.ts";
+import * as ServerConfig from "../config.ts";
+
+const reference: GitLabUploadReference = {
+  origin: "http://gl.here",
+  project: "team/project",
+  secret: "66dbcd21ec5d24ed6ea225176098d52b",
+  fileName: "my clip.mp4",
+};
+const output = (stdout: string) => ({
+  stdout,
+  stderr: "",
+  stdoutTruncated: false,
+  stderrTruncated: false,
+  exitCode: ChildProcessSpawner.ExitCode(0),
+});
+
+function fixture(
+  options: {
+    protocol?: string;
+    endpoint?: string;
+    token?: () => string;
+    response?: (
+      request: { url: string; method: string; headers: Readonly<Record<string, string>> },
+      index: number,
+    ) => Response;
+  } = {},
+) {
+  const commands: ReadonlyArray<string>[] = [];
+  const requests: { url: string; method: string; headers: Readonly<Record<string, string>> }[] = [];
+  const client = HttpClient.make((request) => {
+    requests.push(request);
+    return Effect.succeed(
+      HttpClientResponse.fromWeb(
+        request,
+        options.response?.(request, requests.length - 1) ??
+          new Response("video-bytes", {
+            headers: {
+              "content-type": "application/octet-stream",
+              "content-length": "11",
+              "accept-ranges": "bytes",
+            },
+          }),
+      ),
+    );
+  });
+  const layer = GitLabUploadMedia.layer.pipe(
+    Layer.provide(
+      Layer.mock(GitLabCli.GitLabCli)({
+        execute: ({ args }) => {
+          commands.push(args);
+          return Effect.succeed(
+            output(
+              args[0] === "config"
+                ? (options.protocol ?? "https")
+                : `REST API Endpoint: ${options.endpoint ?? "https://api.example/api/v4/"}\nToken found in config file: ${options.token?.() ?? "private-credential"}`,
+            ),
+          );
+        },
+      }),
+    ),
+    Layer.provide(Layer.succeed(HttpClient.HttpClient, client)),
+    Layer.provide(
+      ServerConfig.ServerConfig.layerTest(process.cwd(), { prefix: "t3-gitlab-media-test-" }),
+    ),
+    Layer.provide(NodeServices.layer),
+  );
+  return { layer, commands, requests };
+}
+
+describe("GitLabUploadMedia", () => {
+  it.effect("streams decoded upload names through the HTTPS API and reuses the credential", () => {
+    const f = fixture();
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      const response = HttpServerResponse.toWeb(yield* service.respond(reference, {}, "GET"));
+      expect(yield* Effect.promise(() => response.text())).toBe("video-bytes");
+      expect(response.headers.get("content-type")).toBe("video/mp4");
+      expect(response.headers.get("cache-control")).toBe("private, no-store");
+      yield* service.respond(reference, {}, "GET");
+      expect(f.commands).toHaveLength(2);
+      expect(f.commands[1]).toEqual(["auth", "status", "--hostname", "gl.here", "--show-token"]);
+      expect(f.requests[0]?.url).toBe(
+        `https://api.example/api/v4/projects/team%2Fproject/uploads/${reference.secret}/my%20clip.mp4`,
+      );
+      expect(f.requests[0]?.headers["private-token"]).toBe("private-credential");
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("rejects plaintext configuration before auth status can transmit a credential", () => {
+    const f = fixture({ protocol: "http" });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      expect((yield* service.respond(reference, {}, "GET")).status).toBe(502);
+      expect(f.commands).toHaveLength(1);
+      expect(f.requests).toHaveLength(0);
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("rejects a plaintext API endpoint even when the configured protocol is HTTPS", () => {
+    const f = fixture({ endpoint: "http://api.example/api/v4/" });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      expect((yield* service.respond(reference, {}, "GET")).status).toBe(502);
+      expect(f.requests).toHaveLength(0);
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("does not cache a missing credential after login", () => {
+    let token = "";
+    const f = fixture({ token: () => token });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      expect((yield* service.respond(reference, {}, "GET")).status).toBe(502);
+      token = "signed-in";
+      expect((yield* service.respond(reference, {}, "GET")).status).toBe(200);
+      expect(f.commands).toHaveLength(4);
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("keeps credentials off storage redirects, including a later hop back", () => {
+    const f = fixture({
+      response: (_, index) =>
+        index < 2
+          ? new Response(null, {
+              status: 302,
+              headers: {
+                location:
+                  index === 0 ? "https://storage.example/signed" : "https://api.example/file",
+              },
+            })
+          : new Response("png", { headers: { "content-type": "image/png" } }),
+    });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      expect((yield* service.respond(reference, {}, "GET")).status).toBe(200);
+      expect(f.requests.map((r) => r.headers["private-token"])).toEqual([
+        "private-credential",
+        undefined,
+        undefined,
+      ]);
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("forwards ranges and if-range and serves HEAD without a body", () => {
+    const f = fixture({
+      response: ({ method }) =>
+        new Response(method === "HEAD" ? null : "part", {
+          status: method === "HEAD" ? 200 : 206,
+          headers: {
+            "content-type": "video/mp4",
+            "content-range": "bytes 2-5/11",
+            "content-length": "4",
+          },
+        }),
+    });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      const response = HttpServerResponse.toWeb(
+        yield* service.respond(reference, { range: "bytes=2-5", "if-range": '"etag"' }, "GET"),
+      );
+      expect(response.status).toBe(206);
+      expect(response.headers.get("content-range")).toBe("bytes 2-5/11");
+      expect(response.headers.get("cache-control")).toBe("private, no-store");
+      expect(yield* Effect.promise(() => response.text())).toBe("part");
+      expect(f.requests[0]?.headers.range).toBe("bytes=2-5");
+      expect(f.requests[0]?.headers["if-range"]).toBe('"etag"');
+      const head = HttpServerResponse.toWeb(yield* service.respond(reference, {}, "HEAD"));
+      expect(f.requests[1]?.method).toBe("HEAD");
+      expect(yield* Effect.promise(() => head.text())).toBe("");
+      expect(head.headers.get("cache-control")).toBe("private, no-store");
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("uses project IDs verbatim and removes the configured installation subfolder", () => {
+    const f = fixture({ endpoint: "https://api.example/gitlab/api/v4/" });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      yield* service.respond({ ...reference, project: "gitlab/team/project" }, {}, "GET");
+      yield* service.respond({ ...reference, project: "42" }, {}, "GET");
+      expect(f.requests[0]?.url).toContain("/gitlab/api/v4/projects/team%2Fproject/uploads/");
+      expect(f.requests[1]?.url).toContain("/gitlab/api/v4/projects/42/uploads/");
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("omits unsafe lengths and protects SVG responses", () => {
+    const f = fixture({
+      response: () =>
+        new Response("<svg/>", {
+          headers: { "content-type": "image/svg+xml", "content-length": "9007199254740992" },
+        }),
+    });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      const response = yield* service.respond(reference, {}, "GET");
+      expect(response.headers["content-length"]).toBeUndefined();
+      expect(response.headers["content-security-policy"]).toContain("sandbox");
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("rejects redirect loops, insecure targets and non-media responses", () => {
+    return Effect.forEach(
+      [
+        { status: 302, headers: { location: "http://api.example/file" } },
+        { status: 302, headers: { location: "https://user:pass@api.example/file" } },
+        { status: 302, headers: { location: "https://api.example/loop" } },
+        { status: 302, headers: { location: "https://[" } },
+        { status: 200, headers: { "content-type": "text/html" } },
+        { status: 206, headers: { "content-type": "video/mp4" } },
+        {
+          status: 206,
+          headers: {
+            "content-type": "video/mp4",
+            "content-range": "bytes 0-2/3",
+            "content-encoding": "gzip",
+          },
+        },
+      ],
+      (response) => {
+        const f = fixture({ response: () => new Response("bad", response) });
+        return Effect.gen(function* () {
+          const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+          const result = yield* service.respond(reference, {}, "GET");
+          expect(result.status).toBe(502);
+          expect(result.headers["cache-control"]).toBe("private, no-store");
+          expect(f.requests.length).toBeLessThanOrEqual(5);
+        }).pipe(Effect.provide(f.layer), Effect.scoped);
+      },
+    );
+  });
+
+  it.effect("preserves unsatisfiable ranges without forwarding error bodies", () => {
+    const f = fixture({
+      response: () =>
+        new Response("private upstream error", {
+          status: 416,
+          headers: { "content-range": "bytes */11", "content-length": "22" },
+        }),
+    });
+    return Effect.gen(function* () {
+      const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+      const response = HttpServerResponse.toWeb(
+        yield* service.respond(reference, { range: "bytes=100-" }, "GET"),
+      );
+      expect(response.status).toBe(416);
+      expect(response.headers.get("content-range")).toBe("bytes */11");
+      expect(yield* Effect.promise(() => response.text())).toBe("");
+    }).pipe(Effect.provide(f.layer), Effect.scoped);
+  });
+
+  it.effect("cancels the upstream transfer when the caller closes its scope", () => {
+    let signal: AbortSignal | null | undefined;
+    return Effect.gen(function* () {
+      yield* Effect.gen(function* () {
+        const service = yield* GitLabUploadMedia.GitLabUploadMedia;
+        yield* service.respond(reference, {}, "GET");
+        expect(signal?.aborted).toBe(false);
+      }).pipe(Effect.scoped);
+      expect(signal?.aborted).toBe(true);
+    }).pipe(
+      Effect.provide(
+        GitLabUploadMedia.layer.pipe(
+          Layer.provide(
+            Layer.mock(GitLabCli.GitLabCli)({
+              execute: ({ args }) =>
+                Effect.succeed(
+                  output(
+                    args[0] === "config"
+                      ? "https"
+                      : "REST API Endpoint: https://api.example/api/v4/\nToken found in config file: token",
+                  ),
+                ),
+            }),
+          ),
+          Layer.provide(FetchHttpClient.layer),
+          Layer.provide(
+            Layer.succeed(FetchHttpClient.Fetch, (_url, init) => {
+              signal = init?.signal;
+              return Promise.resolve(
+                new Response("bytes", { headers: { "content-type": "video/mp4" } }),
+              );
+            }),
+          ),
+          Layer.provide(
+            ServerConfig.ServerConfig.layerTest(process.cwd(), { prefix: "t3-gitlab-cancel-" }),
+          ),
+          Layer.provide(NodeServices.layer),
+        ),
+      ),
+    );
+  });
+});