hanna/fabrica

feat(git,web,cli): smart-HTTP pack transport and post-receive hook

6055231 · hanna committed on 2026-07-25

Add the read-only smart-HTTP git transport over a single shared spawn
path (git::pack::spawn), used now by HTTP and later by SSH.

- git::pack spawns upload-pack/receive-pack/upload-archive with the §3.3
  isolation env (GIT_DIR, GIT_TERMINAL_PROMPT=0, GIT_CONFIG_NOSYSTEM=1,
  HOME, and the FABRICA_* identity for hooks), piped stdio, kill_on_drop.
- web serves GET .git/info/refs (framed advertisement) and POST
  git-upload-pack: authorize BEFORE spawning; the small request is
  buffered (gunzipped if needed) and the pack response streams from the
  child's stdout, never buffered. Anonymous access to a private repo gets
  401 Basic; an authenticated stranger gets 404. HTTP push returns a
  deliberate 403 naming the SSH URL.
- fabrica hook post-receive updates pushed_at/size_bytes (store gains
  record_push), keyed by the GIT_DIR basename, always exiting 0.

Verified end-to-end: anonymous public clone, 401 private, Basic private
clone, and the 403 push all behave per spec.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +4 −0

Cargo.toml +6 −0

crates/cli/src/hook_cmd.rs +96 −0

crates/cli/src/lib.rs +9 −0

crates/git/Cargo.toml +3 −0

crates/git/src/lib.rs +1 −0

crates/git/src/pack.rs +176 −0

crates/store/src/repos.rs +20 −0

crates/web/Cargo.toml +3 −0

crates/web/src/git_http.rs +342 −0

crates/web/src/lib.rs +7 −1

crates/web/src/repo.rs +22 −1

docs/decisions.md +26 −0

@@ @@ -1541,6 +1541,7 @@ dependencies = [ @@
  "ssh-key",
  "tempfile",
  "thiserror 2.0.19",
  "tokio",
+]
 [[package]]
@@ @@ -4381,8 +4382,10 @@ dependencies = [ @@
  "auth",
  "axum",
  "axum-extra",
  "base64",
  "comrak",
  "config",
  "flate2",
  "git",
  "highlight",
  "mail",
@@ @@ -4396,6 +4399,7 @@ dependencies = [ @@
  "thiserror 2.0.19",
  "time",
  "tokio",
  "tokio-util",
  "tower",
  "tower-http",
  "tracing",

@@ @@ -84,6 +84,8 @@ tokio = { version = "1", features = [ @@
     "net",
     "time",
     "fs",
     "process",
     "io-util",
 ] }
 tempfile = "3"
 # Git object model (refs, trees, blobs, commits, diffs, signatures). Linked
@@ @@ -144,6 +146,10 @@ time = "0.3" @@
 # Markdown rendering (GFM) + HTML sanitization for READMEs and comments.
 comrak = { version = "0.54", default-features = false }
 ammonia = "4"
 # Streaming the pack subprocess stdout into the HTTP response body; gunzip for
 # gzip-encoded upload-pack requests.
 tokio-util = { version = "0.7", features = ["io"] }
 flate2 = "1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }

@@ @@ -0,0 +1,96 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! `fabrica hook post-receive` — the git hook entry point (internal, hidden).
 //!
 //! Invoked by the `post-receive` hook the server installs at repo init. It updates
 //! `pushed_at` and `size_bytes` for the pushed repo. A hook failure **must not**
 //! reject a push git already accepted, so this always exits `0`, logging loudly on
 //! error.
 use std::io::Read as _;
 use std::path::{Path, PathBuf};
 use std::process::ExitCode;
 use clap::Subcommand;
 use crate::context::{block_on, open_store};
 /// Actions under the hidden `fabrica hook` group.
 #[derive(Debug, Subcommand)]
 pub(crate) enum HookCommand {
     /// Run after a push is accepted.
     PostReceive,
+}
 /// Dispatch a hook subcommand. Always exits successfully.
 pub(crate) fn run(command: &HookCommand) -> ExitCode {
     match command {
         HookCommand::PostReceive => {
             if let Err(err) = post_receive() {
                 // Loud, but non-fatal: the push has already been accepted.
                 eprintln!("fabrica hook post-receive: {err:#}");
+            }
             ExitCode::SUCCESS
+        }
+    }
+}
 /// The fallible body of `post-receive`.
 fn post_receive() -> anyhow::Result<()> {
     // Drain stdin (`<old> <new> <ref>` lines) so git does not see a broken pipe,
     // even though we do not currently act per-ref.
     let mut input = String::new();
     std::io::stdin().read_to_string(&mut input)?;
     let git_dir = std::env::var_os("GIT_DIR")
         .map(PathBuf::from)
         .or_else(|| std::env::current_dir().ok())
         .ok_or_else(|| anyhow::anyhow!("cannot determine GIT_DIR"))?;
     // The bare repo dir is `{id}.git`; the stem is the repo's ULID.
     let Some(repo_id) = git_dir
         .file_name()
         .and_then(|n| n.to_str())
         .and_then(|n| n.strip_suffix(".git"))
         .filter(|id| id.len() == 26)
     else {
         // Not a fabrica-managed repository; nothing to do.
         return Ok(());
     };
     let repo_id = repo_id.to_string();
     let config_path = std::env::var_os("FABRICA_CONFIG").map(PathBuf::from);
     let size = dir_size(&git_dir);
     block_on(async move {
         let (_config, store) = open_store(config_path.as_deref()).await?;
         store.record_push(&repo_id, size).await?;
         anyhow::Ok(())
     })
+}
 /// Sum the sizes of every regular file under `dir` (an approximate on-disk size).
 fn dir_size(dir: &Path) -> i64 {
     fn walk(dir: &Path, total: &mut u64) {
         let Ok(entries) = std::fs::read_dir(dir) else {
             return;
         };
         for entry in entries.flatten() {
             let path = entry.path();
             match entry.file_type() {
                 Ok(ft) if ft.is_dir() => walk(&path, total),
                 Ok(ft) if ft.is_file() => {
                     if let Ok(meta) = entry.metadata() {
                         *total += meta.len();
+                    }
+                }
                 _ => {}
+            }
+        }
+    }
     let mut total = 0u64;
     walk(dir, &mut total);
     i64::try_from(total).unwrap_or(i64::MAX)
+}

@@ @@ -13,6 +13,7 @@ mod admin_cmd; @@
 mod config_cmd;
 mod context;
 mod group_cmd;
 mod hook_cmd;
 mod key_cmd;
 mod prompt;
 mod repo_cmd;
@@ @@ -104,6 +105,13 @@ enum Command { @@
         #[arg(long)]
         quiet: bool,
     },
     /// Internal git-hook entry points (invoked by installed hooks).
     #[command(hide = true)]
     Hook {
         /// The hook to run.
         #[command(subcommand)]
         command: hook_cmd::HookCommand,
     },
+}
 /// The parsed request to run `fabrica serve`, handed to the serve callback the
@@ @@ -169,5 +177,6 @@ where @@
         Command::Token { command } => token_cmd::run(command, cli.config.as_deref(), cli.json),
         Command::Migrate => admin_cmd::migrate(cli.config.as_deref()),
         Command::Doctor { quiet } => admin_cmd::doctor(cli.config.as_deref(), *quiet),
         Command::Hook { command } => Ok(hook_cmd::run(command)),
+    }
+}

@@ @@ -16,6 +16,9 @@ globset = { workspace = true } @@
 moka = { workspace = true }
 ssh-key = { workspace = true }
 pgp = { workspace = true }
 # Async subprocess spawning for pack transport (clone/fetch/push). One code path
 # shared by the HTTP (web) and SSH transports.
 tokio = { workspace = true }
 thiserror = { workspace = true }
 # Pin the libgit2 bindings to a build that requires libgit2 <= the version
 # nixpkgs ships (1.9.4). git2 0.20's default libgit2-sys (0.18.7, bundling 1.9.6)

@@ @@ -28,6 +28,7 @@ @@
 //! name→path authority; [`repo_path`] is the one place that mapping is computed.
 mod attributes;
 pub mod pack;
 mod pubkey;
 mod repo;
 mod signature;

@@ @@ -0,0 +1,176 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Pack transport: the single code path that spawns `git upload-pack` /
 //! `git receive-pack` / `git upload-archive`.
 //!
 //! libgit2 has no server side of the pack protocol, so clone/fetch/push are served
 //! by spawning the `git` binary (§3.1). Both the HTTP (web) and SSH transports call
 //! [`spawn`]. **Authorization happens before the spawn — the subprocess never makes
 //! an access decision** — and both directions stream; the pack is never buffered by
 //! the transport. The child is `kill_on_drop` so a dropped request reaps it.
 use std::path::{Path, PathBuf};
 use std::process::Stdio;
 use tokio::process::{Child, Command};
 /// The git service to run.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Service {
     /// `git upload-pack` — serves clone/fetch (read).
     UploadPack,
     /// `git receive-pack` — serves push (write).
     ReceivePack,
     /// `git upload-archive` — serves `git archive --remote`.
     UploadArchive,
+}
 impl Service {
     /// The `git` subcommand name.
     fn subcommand(self) -> &'static str {
         match self {
             Self::UploadPack => "upload-pack",
             Self::ReceivePack => "receive-pack",
             Self::UploadArchive => "upload-archive",
+        }
+    }
+}
 /// Environment applied to every pack subprocess: isolation for git, plus the
 /// identity fields hooks consume.
 #[derive(Debug, Clone, Default)]
 pub struct PackEnv {
     /// `HOME` for the child (a scratch dir under `data_dir`), so git never reads a
     /// real user's global config.
     pub home: PathBuf,
     /// The client's `Git-Protocol` value, passed through as `GIT_PROTOCOL` when v2
     /// was negotiated.
     pub protocol: Option<String>,
     /// Config path for `fabrica hook post-receive` to load (`FABRICA_CONFIG`).
     pub config_path: Option<String>,
     /// The authenticated user's id (`FABRICA_USER_ID`).
     pub user_id: Option<String>,
     /// The authenticated user's name (`FABRICA_USER_NAME`).
     pub user_name: Option<String>,
     /// The repository id (`FABRICA_REPO_ID`).
     pub repo_id: Option<String>,
     /// The SSH key id used to authenticate (`FABRICA_KEY_ID`).
     pub key_id: Option<String>,
+}
 /// Spawn a pack service against `repo_path` with piped stdio.
 ///
 /// `extra_args` are inserted before the repository path (e.g. `--stateless-rpc`,
 /// `--advertise-refs` for smart HTTP). The caller must have already authorized the
 /// request. Never interpolates into a shell — args are explicit.
 ///
 /// # Errors
 ///
 /// Returns the [`std::io::Error`] from spawning if the `git` binary cannot be run.
 pub fn spawn(
     binary: &str,
     service: Service,
     extra_args: &[&str],
     repo_path: &Path,
     env: &PackEnv,
 ) -> std::io::Result<Child> {
     let mut cmd = Command::new(binary);
     cmd.arg(service.subcommand());
     cmd.args(extra_args);
     cmd.arg(repo_path);
     // Isolation (§3.3).
     cmd.env("GIT_DIR", repo_path);
     cmd.env("GIT_TERMINAL_PROMPT", "0");
     cmd.env("GIT_CONFIG_NOSYSTEM", "1");
     cmd.env("HOME", &env.home);
     // Do not leak the parent's git environment into the child.
     cmd.env_remove("GIT_ALTERNATE_OBJECT_DIRECTORIES");
     cmd.env_remove("GIT_OBJECT_DIRECTORY");
     if let Some(protocol) = &env.protocol {
         cmd.env("GIT_PROTOCOL", protocol);
+    }
     for (key, value) in [
         ("FABRICA_CONFIG", &env.config_path),
         ("FABRICA_USER_ID", &env.user_id),
         ("FABRICA_USER_NAME", &env.user_name),
         ("FABRICA_REPO_ID", &env.repo_id),
         ("FABRICA_KEY_ID", &env.key_id),
     ] {
         if let Some(value) = value {
             cmd.env(key, value);
+        }
+    }
     cmd.stdin(Stdio::piped());
     cmd.stdout(Stdio::piped());
     cmd.stderr(Stdio::piped());
     cmd.kill_on_drop(true);
     cmd.spawn()
+}
 /// Encode `payload` as a single git pkt-line (`{len:04x}{payload}`). Used to frame
 /// the smart-HTTP service advertisement.
 #[must_use]
 pub fn pkt_line(payload: &str) -> String {
     format!("{:04x}{payload}", payload.len() + 4)
+}
 /// The pkt-line flush packet.
 pub const FLUSH_PKT: &str = "0000";
 #[cfg(test)]
 mod tests {
     #![allow(clippy::unwrap_used, clippy::expect_used)]
     use super::*;
     #[test]
     fn pkt_line_frames_length() {
         // "# service=git-upload-pack\n" is 26 bytes; framed length is 26 + 4 = 30.
         assert_eq!(
             pkt_line("# service=git-upload-pack\n"),
             "001e# service=git-upload-pack\n"
         );
         assert_eq!(pkt_line("a"), "0005a");
+    }
     #[tokio::test]
     async fn spawn_upload_pack_advertises_refs_on_a_real_repo() {
         use std::path::Path;
         use crate::create_bare;
         // git must be present; skip cleanly otherwise (matches the test policy).
         if Command::new("git").arg("--version").output().await.is_err() {
             eprintln!("skipping: git not on PATH");
             return;
+        }
         let dir = tempfile::tempdir().expect("tempdir");
         let id = "01hzxk9m2n8p7q6r5s4t3v2w1x";
         create_bare(dir.path(), id, "main", Path::new("/usr/bin/fabrica")).expect("create bare");
         let repo_path = crate::repo_path(dir.path(), id).expect("repo path");
         let env = PackEnv {
             home: dir.path().to_path_buf(),
             ..PackEnv::default()
         };
         let child = spawn(
             "git",
             Service::UploadPack,
             &["--stateless-rpc", "--advertise-refs"],
             &repo_path,
             &env,
+        )
         .expect("spawn upload-pack");
         let output = child.wait_with_output().await.expect("wait");
         // A fresh repo advertises capabilities even with no refs; the output is
         // valid pkt-line data (or empty for an unborn HEAD), and the process
         // succeeds.
         assert!(output.status.success(), "upload-pack should exit cleanly");
+    }
+}

@@ @@ -182,6 +182,26 @@ impl Store { @@
         Ok(updated > 0)
+    }
     /// Record that a repository was just pushed to: stamp `pushed_at` and refresh
     /// `size_bytes`. Called by `fabrica hook post-receive`.
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn record_push(&self, repo_id: &str, size_bytes: i64) -> Result<bool, StoreError> {
         let now = now_ms();
         let updated = sqlx::query(
             "UPDATE repos SET pushed_at = $1, size_bytes = $2, updated_at = $1 WHERE id = $3",
+        )
         .bind(now)
         .bind(size_bytes)
         .bind(repo_id)
         .execute(&self.pool)
         .await?
         .rows_affected();
         Ok(updated > 0)
+    }
     /// Delete a repository row (cascading to collaborators). The caller is
     /// responsible for the on-disk directory — moving it to trash, or purging it.
     /// Returns `true` if a row was removed.

@@ @@ -26,6 +26,9 @@ rust-embed = { workspace = true } @@
 mime_guess = { workspace = true }
 comrak = { workspace = true }
 ammonia = { workspace = true }
 tokio-util = { workspace = true }
 flate2 = { workspace = true }
 base64 = { workspace = true }
 time = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }

@@ @@ -0,0 +1,342 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! The smart-HTTP git transport (read-only).
 //!
 //! Only clone/fetch (`upload-pack`) is served; push (`receive-pack`) returns a
 //! deliberate `403` pointing at the SSH URL (§3.3). Authorization happens **before**
 //! the `git` subprocess is spawned. The refs advertisement is small and buffered;
 //! the pack response streams straight from the child's stdout so it is never held
 //! in memory. Dumb HTTP is not implemented.
 use axum::body::Body;
 use axum::extract::{Path, State};
 use axum::http::{HeaderMap, StatusCode, header};
 use axum::response::{IntoResponse, Response};
 use axum_extra::extract::cookie::CookieJar;
 use base64::Engine as _;
 use model::{Repo, User};
 use tokio::io::AsyncWriteExt as _;
 use tokio_util::io::ReaderStream;
 use crate::AppState;
 /// Split `"repo/path.git/service..."` into the repo path and the trailing service
 /// path (`info/refs`, `git-upload-pack`, `git-receive-pack`). Also accepts the
 /// forms without `.git` is *not* supported here — callers strip that themselves.
 #[must_use]
 pub fn split_git(rest: &str) -> Option<(&str, &str)> {
     let idx = rest.find(".git/")?;
     Some((&rest[..idx], &rest[idx + ".git/".len()..]))
+}
 /// Handle a GET under a `.git/` path — only `info/refs?service=git-upload-pack`.
 pub async fn http_get(
     state: &AppState,
     jar: &CookieJar,
     headers: &HeaderMap,
     owner: &str,
     repo_path: &str,
     tail: &str,
     service: Option<&str>,
 ) -> Response {
     if tail != "info/refs" {
         return StatusCode::NOT_FOUND.into_response();
+    }
     match service {
         Some("git-upload-pack") => {}
         Some("git-receive-pack") => return push_disabled(state, owner, repo_path),
         _ => return StatusCode::FORBIDDEN.into_response(),
+    }
     let repo = match authorize(state, jar, headers, owner, repo_path).await {
         Ok(repo) => repo,
         Err(response) => return response,
     };
     info_refs(state, &repo, headers).await
+}
 /// Handle a POST under a `.git/` path — `git-upload-pack` (served) or
 /// `git-receive-pack` (403).
 pub async fn pack_rpc(
     State(state): State<AppState>,
     jar: CookieJar,
     headers: HeaderMap,
     Path((owner, rest)): Path<(String, String)>,
     body: Body,
 ) -> Response {
     let Some((repo_path, tail)) = split_git(&rest) else {
         return StatusCode::NOT_FOUND.into_response();
     };
     match tail {
         "git-upload-pack" => {}
         "git-receive-pack" => return push_disabled(&state, &owner, repo_path),
         _ => return StatusCode::NOT_FOUND.into_response(),
+    }
     let repo = match authorize(&state, &jar, &headers, &owner, repo_path).await {
         Ok(repo) => repo,
         Err(response) => return response,
     };
     upload_pack_rpc(&state, &repo, &headers, body).await
+}
 /// Spawn `upload-pack --advertise-refs`, frame the output as a smart-HTTP service
 /// advertisement, and return it.
 async fn info_refs(state: &AppState, repo: &Repo, headers: &HeaderMap) -> Response {
     let repo_dir = match git::repo_path(&state.config.storage.repo_dir, &repo.id) {
         Ok(p) => p,
         Err(e) => return internal(&e.to_string()),
     };
     let env = pack_env(state, headers, repo);
     let child = git::pack::spawn(
         &state.config.git.binary,
         git::pack::Service::UploadPack,
         &["--stateless-rpc", "--advertise-refs"],
         &repo_dir,
         &env,
     );
     let output = match child {
         Ok(child) => match child.wait_with_output().await {
             Ok(out) => out,
             Err(e) => return internal(&e.to_string()),
         },
         Err(e) => return internal(&e.to_string()),
     };
     let mut framed = git::pack::pkt_line("# service=git-upload-pack\n").into_bytes();
     framed.extend_from_slice(git::pack::FLUSH_PKT.as_bytes());
     framed.extend_from_slice(&output.stdout);
+    (
+        [
+            (
                 header::CONTENT_TYPE,
                 "application/x-git-upload-pack-advertisement",
             ),
             (header::CACHE_CONTROL, "no-cache"),
         ],
         framed,
+    )
         .into_response()
+}
 /// Spawn `upload-pack --stateless-rpc`, feed it the (buffered, possibly gunzipped)
 /// request, and stream its stdout back as the response body.
 async fn upload_pack_rpc(
     state: &AppState,
     repo: &Repo,
     headers: &HeaderMap,
     body: Body,
 ) -> Response {
     let repo_dir = match git::repo_path(&state.config.storage.repo_dir, &repo.id) {
         Ok(p) => p,
         Err(e) => return internal(&e.to_string()),
     };
     // The upload-pack request (the client's "wants") is small; buffer it, and
     // decompress if the client gzipped it. The large pack is the *response*, which
     // is streamed below.
     let Ok(raw) = axum::body::to_bytes(body, 16 * 1024 * 1024).await else {
         return (StatusCode::BAD_REQUEST, "request body too large").into_response();
     };
     let request = if header_eq(headers, header::CONTENT_ENCODING, "gzip") {
         match gunzip(&raw) {
             Ok(data) => data,
             Err(_) => return (StatusCode::BAD_REQUEST, "invalid gzip body").into_response(),
+        }
     } else {
         raw.to_vec()
     };
     let env = pack_env(state, headers, repo);
     let mut child = match git::pack::spawn(
         &state.config.git.binary,
         git::pack::Service::UploadPack,
         &["--stateless-rpc"],
         &repo_dir,
         &env,
     ) {
         Ok(child) => child,
         Err(e) => return internal(&e.to_string()),
     };
     let (Some(mut stdin), Some(stdout)) = (child.stdin.take(), child.stdout.take()) else {
         return internal("failed to capture pack subprocess stdio");
     };
     // Feed the request, then own the child until it exits (or the client
     // disconnects, closing stdout and making upload-pack exit on write).
     tokio::spawn(async move {
         let _ = stdin.write_all(&request).await;
         let _ = stdin.shutdown().await;
         drop(stdin);
         let _ = child.wait().await;
     });
     let stream = ReaderStream::new(stdout);
+    (
         [(header::CONTENT_TYPE, "application/x-git-upload-pack-result")],
         Body::from_stream(stream),
+    )
         .into_response()
+}
 /// Resolve and authorize a repo for pack access. On failure returns the response
 /// to send: `401` (anonymous, credentials needed) or `404` (missing, or an
 /// authenticated stranger — no existence leak).
 #[allow(clippy::result_large_err)] // the Err is a ready-to-send Response by design.
 async fn authorize(
     state: &AppState,
     jar: &CookieJar,
     headers: &HeaderMap,
     owner: &str,
     repo_path: &str,
 ) -> Result<Repo, Response> {
     let owner_user = state.store.user_by_username(owner).await.ok().flatten();
     let repo = match owner_user {
         Some(ref u) => state
             .store
             .repo_by_owner_path(&u.id, repo_path)
             .await
             .ok()
             .flatten(),
         None => None,
     };
     let Some(repo) = repo else {
         return Err(StatusCode::NOT_FOUND.into_response());
     };
     let viewer = authenticate(state, jar, headers).await;
     let viewer_id = viewer.as_ref().map(|u| auth::Viewer {
         id: u.id.clone(),
         is_admin: u.is_admin,
     });
     let collaborator = match &viewer {
         Some(u) => state
             .store
             .collaborator_permission(&repo.id, &u.id)
             .await
             .ok()
             .flatten()
             .and_then(|p| auth::Permission::parse(&p)),
         None => None,
     };
     let access = auth::access(
         viewer_id.as_ref(),
         &repo,
         collaborator,
         state.config.instance.allow_anonymous,
     );
     if access >= auth::Access::Read {
         Ok(repo)
     } else if viewer.is_none() {
         Err(unauthorized())
     } else {
         // An authenticated stranger: 404, not 403, so existence never leaks.
         Err(StatusCode::NOT_FOUND.into_response())
+    }
+}
 /// Authenticate a pack request via the session cookie or HTTP Basic (username +
 /// password). Returns the user, or `None` for anonymous.
 async fn authenticate(state: &AppState, jar: &CookieJar, headers: &HeaderMap) -> Option<User> {
     if let Some(cookie) = jar.get(&state.config.auth.cookie_name)
         && let Ok(Some(user)) = state
             .store
             .user_for_session(&auth::session_id(cookie.value()))
             .await
+    {
         return Some(user);
+    }
     let (username, password) = parse_basic(headers)?;
     let user = state
         .store
         .user_by_username(&username)
         .await
         .ok()
         .flatten()?;
     if user.disabled_at.is_none()
         && user.password_hash.is_some()
         && auth::verify_password(&password, user.password_hash.as_deref())
+    {
         Some(user)
     } else {
         None
+    }
+}
 /// Parse an HTTP Basic `Authorization` header into `(username, password)`.
 fn parse_basic(headers: &HeaderMap) -> Option<(String, String)> {
     let value = headers.get(header::AUTHORIZATION)?.to_str().ok()?;
     let encoded = value.strip_prefix("Basic ")?;
     let decoded = base64::engine::general_purpose::STANDARD
         .decode(encoded.trim())
         .ok()?;
     let text = String::from_utf8(decoded).ok()?;
     let (user, pass) = text.split_once(':')?;
     Some((user.to_string(), pass.to_string()))
+}
 /// Build the subprocess environment for a pack spawn.
 fn pack_env(state: &AppState, headers: &HeaderMap, repo: &Repo) -> git::pack::PackEnv {
     git::pack::PackEnv {
         home: state.config.storage.data_dir.join("tmp"),
         protocol: headers
             .get("git-protocol")
             .and_then(|v| v.to_str().ok())
             .map(str::to_string),
         repo_id: Some(repo.id.clone()),
         ..git::pack::PackEnv::default()
+    }
+}
 /// The `403` push-over-HTTPS-disabled response, naming the SSH remote.
 fn push_disabled(state: &AppState, owner: &str, repo_path: &str) -> Response {
     let host = &state.config.ssh.clone_host;
     let port = state.config.ssh.clone_port;
     let ssh_url = if port == 22 {
         format!("git@{host}:{owner}/{repo_path}.git")
     } else {
         format!("ssh://git@{host}:{port}/{owner}/{repo_path}.git")
     };
+    (
         StatusCode::FORBIDDEN,
         format!("Pushing over HTTPS is disabled. Push over SSH instead:\n\n    {ssh_url}\n"),
+    )
         .into_response()
+}
 /// The `401` challenge for anonymous access to a private repo.
 fn unauthorized() -> Response {
+    (
         StatusCode::UNAUTHORIZED,
         [(header::WWW_AUTHENTICATE, "Basic realm=\"fabrica\"")],
         "Authentication required.\n",
+    )
         .into_response()
+}
 /// A `500` for an internal transport failure (detail logged, not shown).
 fn internal(detail: &str) -> Response {
     tracing::error!(error.detail = %detail, "pack transport error");
     (StatusCode::INTERNAL_SERVER_ERROR, "internal error\n").into_response()
+}
 /// Whether a header equals a value (ASCII case-insensitive).
 fn header_eq(headers: &HeaderMap, name: header::HeaderName, value: &str) -> bool {
     headers
         .get(name)
         .and_then(|v| v.to_str().ok())
         .is_some_and(|v| v.eq_ignore_ascii_case(value))
+}
 /// Decompress a gzip body.
 fn gunzip(data: &[u8]) -> std::io::Result<Vec<u8>> {
     use std::io::Read as _;
     let mut decoder = flate2::read::GzDecoder::new(data);
     let mut out = Vec::new();
     decoder.read_to_end(&mut out)?;
     Ok(out)
+}

@@ @@ -13,6 +13,7 @@ @@
 mod assets;
 mod diff;
 mod error;
 mod git_http;
 mod layout;
 mod markdown;
 mod pages;
@@ @@ -118,8 +119,13 @@ pub fn build_router(state: AppState) -> Router { @@
         .route("/theme/{file}", get(serve_assets::theme_named))
         .route("/assets/{*path}", get(serve_assets::assets))
         // Repository browsing. Variable-length paths split on `/-/` in the handler.
         // The same catch-all serves smart-HTTP pack transport: GET handles
         // `….git/info/refs` inside the dispatcher; POST is the pack RPC.
         .route("/{owner}", get(repo::user_page))
         .route("/{owner}/{*rest}", get(repo::dispatch))
         .route(
             "/{owner}/{*rest}",
             get(repo::dispatch).post(git_http::pack_rpc),
+        )
         .layer(
             ServiceBuilder::new()
                 .layer(SetRequestIdLayer::new(

@@ @@ -14,7 +14,7 @@ @@
 use std::path::Path as FsPath;
 use axum::extract::{Path, Query, State};
 use axum::http::{Uri, header};
 use axum::http::{HeaderMap, Uri, header};
 use axum::response::{Html, IntoResponse, Response};
 use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
 use maud::{Markup, html};
@@ @@ -43,6 +43,8 @@ pub struct DiffQuery { @@
     from: Option<u32>,
     /// The 1-based last line of the context window.
     to: Option<u32>,
     /// The smart-HTTP service, for `….git/info/refs?service=`.
     service: Option<String>,
+}
 /// The candidate README filenames, in lookup order.
@@ @@ -173,10 +175,29 @@ pub async fn dispatch( @@
     State(state): State<AppState>,
     MaybeUser(viewer): MaybeUser,
     jar: CookieJar,
     headers: HeaderMap,
     uri: Uri,
     Query(dq): Query<DiffQuery>,
     Path((owner_name, rest)): Path<(String, String)>,
 ) -> AppResult<Response> {
     // Smart-HTTP pack transport: `{owner}/{path}.git/info/refs`. Guarded so a blob
     // path that merely contains ".git/" is never misrouted (those carry "/-/").
     if !rest.contains("/-/")
         && let Some((repo_path, tail)) = crate::git_http::split_git(&rest)
         && matches!(tail, "info/refs" | "git-upload-pack" | "git-receive-pack")
+    {
         return Ok(crate::git_http::http_get(
             &state,
             &jar,
             &headers,
             &owner_name,
             repo_path,
             tail,
             dq.service.as_deref(),
+        )
         .await);
+    }
     if let Some((repo_path, view)) = rest.split_once("/-/") {
         let ctx = resolve(&state, &owner_name, repo_path, viewer.as_ref())
             .await?

 never be cut off, so timeouts (if any) belong per-route on non-git paths, added in
 the polish phase. The theme picker is a real GET form (works without JS) that sets
 a `fabrica_theme` cookie; `SIGHUP` re-scans `themes_dir` via an `RwLock<Assets>`.
 ## 2026-07-25 — Pack transport: 401 (not 404) for anonymous, buffered request
 **Decision:** Smart-HTTP pack routes return **401** with
 `WWW-Authenticate: Basic` for anonymous access to a repo they can't read (so git
 prompts for credentials), whereas an authenticated stranger gets **404** (no
 existence leak). This differs from the browse UI, which always 404s. The
 upload-pack **request** (client wants, small) is buffered — decompressing gzip when
 present — while the **response** pack streams straight from the child's stdout via
 `ReaderStream`, never buffered. Push over HTTP (`git-receive-pack`) returns a
 deliberate 403 naming the SSH URL.
 **Alternatives:** 404 for anonymous too (no credential prompt, breaking
 `git clone` of private repos); stream the request as well.
 **Rationale:** git's HTTP client only sends Basic credentials after a 401
 challenge, so a private clone is impossible without it — the spec mandates the 401.
 The authenticated-stranger 404 preserves the no-leak invariant for logged-in users.
 The upload-pack request is a few KB of wants, so buffering it (and handling
 `Content-Encoding: gzip`) is simpler than streaming and violates no memory
 constraint; the pack that must never be buffered is the response, which is
 streamed. HTTP auth is username+password (or session cookie); API-token Basic auth
 lands with the API phase. `fabrica hook post-receive` derives the repo id from the
 `GIT_DIR` basename and loads config from `FABRICA_CONFIG` (set by the SSH/HTTP
 server on the child) or the default location; a local push with neither set no-ops
 cleanly, and it always exits 0 so a hook error never rejects an accepted push.