scmclient.go

package util

import (
	"context"
	"fmt"
	"net/http"
	"net/url"
	"os"
	"strings"

	"golang.org/x/oauth2"

	"github.com/hashicorp/go-multierror"
	"github.com/jenkins-x/go-scm/scm"
	"github.com/jenkins-x/go-scm/scm/factory"
	"github.com/jenkins-x/go-scm/scm/transport"
	"github.com/jenkins-x/lighthouse/pkg/config"
	"github.com/jenkins-x/lighthouse/pkg/scmprovider"
	"github.com/pkg/errors"
	"github.com/sirupsen/logrus"
)

// AddAuthToSCMClient configures an existing go-scm client with transport and authorization using the given token,
// depending on whether the token is a GitHub App token
func AddAuthToSCMClient(client *scm.Client, token string, isGitHubApp bool) {
	if isGitHubApp {
		defaultScmTransport(client)
		tr := &transport.Custom{
			Base: http.DefaultTransport,
			Before: func(r *http.Request) {
				r.Header.Set("Authorization", "token "+token)
				r.Header.Set("Accept", "application/vnd.github.machine-man-preview+json")
			},
		}
		client.Client.Transport = tr
		return
	}
	driver := client.Driver.String()
	if driver == "gitea" {
		client.Client = &http.Client{
			Transport: &transport.Authorization{
				Scheme:      "token",
				Credentials: token,
			},
		}
	} else if driver == "gitlab" {
		client.Client = &http.Client{
			Transport: &transport.PrivateToken{
				Token: token,
			},
		}
	} else if driver != "bitbucket" && driver != "bitbucketcloud" {
		ts := oauth2.StaticTokenSource(
			&oauth2.Token{AccessToken: token},
		)
		client.Client = oauth2.NewClient(context.Background(), ts)
	}
}

func defaultScmTransport(scmClient *scm.Client) {
	if scmClient.Client == nil {
		scmClient.Client = http.DefaultClient
	}
	if scmClient.Client.Transport == nil {
		scmClient.Client.Transport = http.DefaultTransport
	}
}

// GetGitServer returns the git server base URL from the environment
func GetGitServer(cfg config.Getter) string {
	serverURL := os.Getenv("GIT_SERVER")

	actualConfig := cfg()
	if serverURL == "" && actualConfig != nil && actualConfig.ProviderConfig != nil {
		serverURL = actualConfig.ProviderConfig.Server
	}
	if serverURL == "" {
		serverURL = "https://github.com"
	}
	return serverURL
}

// GetSCMClient gets the Lighthouse SCM client, go-scm client, server URL, and token for the current user and server
func GetSCMClient(owner string, cfg config.Getter) (scmprovider.SCMClient, *scm.Client, string, string, error) {
	kind := GitKind(cfg)
	serverURL := GetGitServer(cfg)
	ghaSecretDir := GetGitHubAppSecretDir()

	var token string
	var err error
	if ghaSecretDir != "" && owner != "" {
		tokenFinder := NewOwnerTokensDir(serverURL, ghaSecretDir)
		token, err = tokenFinder.FindToken(owner)
		if err != nil {
			logrus.Errorf("failed to read owner token: %s", err.Error())
			return nil, nil, "", "", errors.Wrapf(err, "failed to read owner token for owner %s", owner)
		}
	} else {
		token, err = GetSCMToken(kind)
		if err != nil {
			return nil, nil, serverURL, token, err
		}
	}

	botName := GetBotName(cfg)
	client, err := factory.NewClient(kind, serverURL, token, factory.SetUsername(botName))
	scmClient := scmprovider.ToClient(client, botName)
	return scmClient, client, serverURL, token, err
}

// GitKind gets the git kind from the environment
func GitKind(cfg config.Getter) string {
	kind := os.Getenv("GIT_KIND")
	actualConfig := cfg()
	if kind == "" && actualConfig != nil && actualConfig.ProviderConfig != nil {
		kind = actualConfig.ProviderConfig.Kind
	}
	if kind == "" {
		kind = "github"
	}
	return kind
}

// GetBotName returns the bot name from the environment
func GetBotName(cfg config.Getter) string {
	if GetGitHubAppSecretDir() != "" {
		ghaBotName, err := GetGitHubAppAPIUser()
		// TODO: Probably should handle error cases here better, but for now, just fall through.
		if err == nil && ghaBotName != "" {
			return ghaBotName
		}
	}
	botName := os.Getenv("GIT_USER")
	actualConfig := cfg()
	if botName == "" && actualConfig != nil && actualConfig.ProviderConfig != nil {
		botName = actualConfig.ProviderConfig.BotUser
	}
	if botName == "" {
		botName = "jenkins-x-bot"
	}
	return botName
}

// GetSCMToken gets the SCM secret from the environment
func GetSCMToken(gitKind string) (string, error) {
	envName := "GIT_TOKEN"
	value := os.Getenv(envName)
	var err error
	if value == "" {
		err = fmt.Errorf("no token available for git kind %s at environment variable $%s", gitKind, envName)
	}
	// If we could not retrieve the Git token from the environment then attempt
	// to read it from the filesystem
	if err != nil {
		value, pathErr := getSCMTokenFromPath(gitKind)
		if pathErr == nil {
			return value, nil
		}
		// Construct multi error to avoid hiding issues
		multiErr := multierror.Error{
			Errors: []error{err, pathErr},
		}
		err = multiErr.ErrorOrNil()
	}
	return value, err
}

// getSCMTokenFromPath retrieves the SCM secret from the filesystem
func getSCMTokenFromPath(gitKind string) (string, error) {
	envName := "GIT_TOKEN_PATH"
	value := os.Getenv(envName)
	if value == "" {
		return value, fmt.Errorf("no token path available for git kind %s at environment variable $%s", gitKind, envName)
	}
	b, err := os.ReadFile(value)
	if err != nil {
		return "", err
	}
	return string(b), nil
}

// HMACToken gets the HMAC token from the environment or filesystem
func HMACToken() string {
	hmacToken := os.Getenv("HMAC_TOKEN")
	// For backwards compatibility we only attempt to read from the filesystem
	// if the HMAC token is not set in the environment
	if len(hmacToken) == 0 {
		// If HMAC_TOKEN_PATH is specified then attempt to read from the filesystem
		hmacTokenPath := os.Getenv("HMAC_TOKEN_PATH")
		if len(hmacTokenPath) > 0 {
			b, err := os.ReadFile(hmacTokenPath)
			if err != nil {
				logrus.Errorf("failed to read HMAC_TOKEN_PATH %s: %s", hmacTokenPath, err)
				return hmacToken
			}
			hmacToken = string(b)
		}
	}
	return hmacToken
}

// BlobURLForProvider gets the link to the blob for an individual file in a commit or branch
func BlobURLForProvider(providerType string, baseURL *url.URL, owner, repo, branch string, fullPath string) string {
	switch providerType {
	case "stash":
		u := fmt.Sprintf("%s/projects/%s/repos/%s/browse/%v", strings.TrimSuffix(baseURL.String(), "/"), strings.ToUpper(owner), repo, fullPath)
		if branch != "master" {
			u = fmt.Sprintf("%s?at=%s", u, url.QueryEscape("refs/heads/"+branch))
		}
		return u
	case "gitlab":
		return fmt.Sprintf("%s/%s/%s/-/blob/%s/%v", strings.TrimSuffix(baseURL.String(), "/"), owner, repo, branch, fullPath)
	case "gitea":
		return fmt.Sprintf("%s/%s/%s/src/branch/%s/%v", strings.TrimSuffix(baseURL.String(), "/"), owner, repo, branch, fullPath)
	default:
		return fmt.Sprintf("%s/%s/%s/blob/%s/%v", strings.TrimSuffix(baseURL.String(), "/"), owner, repo, branch, fullPath)
	}
}