mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
aa87442fdd
Source files keep their SPDX-License-Identifier and Hanzo copyright line; the Gitea, Gogs and LFS Test Server copyrights they used to repeat now live once in NOTICE, alongside LICENSE. The header lint accepts any copyright line above the SPDX line, so it no longer demands an upstream one. Co-authored-by: Hanzo Dev <[email protected]>
43 lines
1.8 KiB
Go
43 lines
1.8 KiB
Go
// Copyright 2026 Hanzo AI, Inc. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package migrations
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net/http"
|
|
|
|
"github.com/hanzoai/git/modules/hostmatcher"
|
|
"github.com/hanzoai/git/modules/proxy"
|
|
"github.com/hanzoai/git/modules/setting"
|
|
"github.com/hanzoai/git/modules/util"
|
|
)
|
|
|
|
// migrationHTTPClient is the shared migration client. Callers that would otherwise build a client per
|
|
// request use it (via getMigrationHTTPClient) so a single connection pool is reused across downloads —
|
|
// e.g. many release assets from the same host — instead of a fresh pool and TLS handshake each time. It
|
|
// is built lazily on first use and reset by Init whenever the allow/block lists change; OnceValue keeps
|
|
// concurrent callers sharing a single client instead of racing to create their own.
|
|
var migrationHTTPClient = util.OnceValue[*http.Client]{Func: newMigrationHTTPClient}
|
|
|
|
// newMigrationHTTPClient returns a HTTP client for migration
|
|
func newMigrationHTTPClient() *http.Client {
|
|
return &http.Client{
|
|
Transport: NewMigrationHTTPTransport(),
|
|
}
|
|
}
|
|
|
|
// getMigrationHTTPClient returns the shared migration client, building it on first use so no request
|
|
// escapes the SSRF-validated transport even before Init has run.
|
|
func getMigrationHTTPClient() *http.Client {
|
|
return migrationHTTPClient.Value()
|
|
}
|
|
|
|
// NewMigrationHTTPTransport returns a HTTP transport for migration. The target is validated against the
|
|
// allow/block lists on both the direct-dial and proxy paths, so a configured proxy cannot be used to
|
|
// reach an otherwise-forbidden target (SSRF).
|
|
func NewMigrationHTTPTransport() *http.Transport {
|
|
return hostmatcher.NewHTTPTransport("migration", allowList, blockList, proxy.Proxy(), setting.Proxy.ProxyURLFixed,
|
|
&tls.Config{InsecureSkipVerify: setting.Migrations.SkipTLSVerify})
|
|
}
|