summercms/modules/fetchguard/client.go

package fetchguard

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"io"
	"net/http"
	"net/url"
	"strings"
	"time"

	"git.golem15.com/golem15/summercms/modules/compass"
)

// Client is a guarded outbound HTTP client for calling service APIs: any
// method, JSON or multipart bodies, caller-supplied headers. It keeps the
// guarantees of Fetch for the policy it was built with: URL validation
// before any I/O, the dial-time private and reserved address check on every
// new connection (except in TrustedMode), a response body cap and no
// redirects. Status codes are returned, never judged.
//
// A Client is safe for concurrent use; build one per vendor and reuse it so
// connections are kept alive.
type Client struct {
	policy   Policy
	maxBytes int64
	timeout  time.Duration
	http     *http.Client
}

// NewClient resolves the policy's limits once (zero MaxBytes or Timeout fall
// back to cfg, then to Defaults) and builds the client.
func NewClient(policy Policy, cfg *compass.Config) (*Client, error) {
	maxBytes, timeout, err := resolveLimits(policy, cfg)
	if err != nil {
		return nil, err
	}
	return &Client{
		policy:   policy,
		maxBytes: maxBytes,
		timeout:  timeout,
		http:     newHTTPClient(newTransport(policy, timeout, true), timeout),
	}, nil
}

type transportKey struct{}

// WithTransport returns a context whose requests a Client sends through rt
// instead of its own network transport. It is the test and parity-replay
// seam: a test hands it a fake http.RoundTripper (for example the tide
// upstream fake) so the client's real request is asserted offline.
//
// The override is code-only. No Policy field, Client field, config key,
// environment variable or request header can set it; only Go code holding
// the context can. URL validation still runs before the override is
// consulted, and redirects are still not followed.
func WithTransport(ctx context.Context, rt http.RoundTripper) context.Context {
	if ctx == nil {
		ctx = context.Background()
	}
	return context.WithValue(ctx, transportKey{}, rt)
}

func transportFrom(ctx context.Context) http.RoundTripper {
	if ctx == nil {
		return nil
	}
	rt, _ := ctx.Value(transportKey{}).(http.RoundTripper)
	return rt
}

// Do validates req's URL against the client's policy and sends it. The
// response body is capped at the policy's MaxBytes: reading past it fails
// with an *Error whose Reason is ReasonTooLarge. The caller closes the body.
// A 3xx response is returned as-is; redirects are never followed.
//
// A non-nil error is always *Error.
func (c *Client) Do(req *http.Request) (*http.Response, error) {
	if req == nil || req.URL == nil {
		return nil, &Error{Reason: ReasonInvalidURL}
	}
	if err := c.check(req.URL); err != nil {
		return nil, err
	}
	hc := c.http
	if rt := transportFrom(req.Context()); rt != nil {
		hc = newHTTPClient(rt, c.timeout)
	}
	resp, err := hc.Do(req)
	if err != nil {
		return nil, mapTransportError(err)
	}
	resp.Body = &cappedBody{rc: resp.Body, max: c.maxBytes}
	return resp, nil
}

// Send sends req through Do and reads the whole capped body into a Result.
func (c *Client) Send(req *http.Request) (*Result, error) {
	resp, err := c.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	data, err := io.ReadAll(resp.Body)
	if err != nil {
		var fe *Error
		if errors.As(err, &fe) {
			return nil, fe
		}
		return nil, &Error{Reason: ReasonNetworkError, Err: err}
	}
	return &Result{
		Body:        data,
		ContentType: resp.Header.Get("Content-Type"),
		StatusCode:  resp.StatusCode,
		Header:      resp.Header,
	}, nil
}

// PostJSON marshals body as JSON and POSTs it to rawURL. Content-Type is set
// to application/json first, then header is copied over it, so a caller can
// override any header including Content-Type.
func (c *Client) PostJSON(ctx context.Context, rawURL string, header http.Header, body any) (*Result, error) {
	return c.sendJSON(ctx, http.MethodPost, rawURL, header, body)
}

// Get sends a GET to rawURL with header.
func (c *Client) Get(ctx context.Context, rawURL string, header http.Header) (*Result, error) {
	return c.send(ctx, http.MethodGet, rawURL, nil, header, nil)
}

func (c *Client) sendJSON(ctx context.Context, method, rawURL string, header http.Header, body any) (*Result, error) {
	raw, err := json.Marshal(body)
	if err != nil {
		return nil, &Error{Reason: ReasonInvalidURL, Err: err}
	}
	h := http.Header{}
	h.Set("Content-Type", "application/json")
	return c.send(ctx, method, rawURL, h, header, bytes.NewReader(raw))
}

func (c *Client) send(ctx context.Context, method, rawURL string, base, header http.Header, body io.Reader) (*Result, error) {
	if ctx == nil {
		ctx = context.Background()
	}
	req, err := http.NewRequestWithContext(ctx, method, rawURL, body)
	if err != nil {
		return nil, &Error{Reason: ReasonInvalidURL, Err: err}
	}
	for k, vs := range base {
		req.Header[k] = append([]string(nil), vs...)
	}
	for k, vs := range header {
		req.Header[http.CanonicalHeaderKey(k)] = append([]string(nil), vs...)
	}
	return c.Send(req)
}

// check applies the policy's URL rules before any I/O.
func (c *Client) check(u *url.URL) error {
	if u.Scheme == "" || u.Host == "" {
		return &Error{Reason: ReasonInvalidURL}
	}
	if strings.ToLower(u.Scheme) != "https" {
		return &Error{Reason: ReasonScheme}
	}
	if c.policy.Mode == AllowHostsMode && !hostAllowed(u.Hostname(), c.policy.AllowHosts) {
		return &Error{Reason: ReasonInvalidURL}
	}
	return nil
}

// cappedBody fails with ReasonTooLarge once more than max bytes were read.
type cappedBody struct {
	rc  io.ReadCloser
	max int64
	n   int64
}

func (b *cappedBody) Read(p []byte) (int, error) {
	if b.n > b.max {
		return 0, &Error{Reason: ReasonTooLarge}
	}
	if room := b.max - b.n + 1; int64(len(p)) > room {
		p = p[:room]
	}
	n, err := b.rc.Read(p)
	b.n += int64(n)
	if b.n > b.max {
		return n - int(b.n-b.max), &Error{Reason: ReasonTooLarge}
	}
	return n, err
}

func (b *cappedBody) Close() error { return b.rc.Close() }