hanna/fabrica

feat(lfs): git-LFS batch API, transfer, and SSH authentication

a3d1c7c · hanna committed on 2026-07-26

Implement git-LFS end to end:

- HTTP endpoints under `…/info/lfs/`: the Batch API (objects/batch),
  basic transfer (GET/PUT objects/{oid}), and objects/{oid}/verify,
  wired into the repo catch-all routes. Uploads stream to a temp file,
  are verified against the claimed sha256 oid, and only then moved into
  the content-addressed store under storage.lfs_dir.
- Authorization runs before any bytes move (download = Read, upload =
  Write). git_http::authorize now takes the required Access level, and
  authenticate also accepts a Bearer JWT.
- SSH `git-lfs-authenticate` mints a one-hour bearer token and returns
  the HTTP LFS endpoint, so SSH-cloned repos transfer LFS over HTTP.
  The SSH server gains the signing secret for this.

Objects are tracked per-repo in lfs_objects; the bytes never enter the
git object database. Includes helper and store-level tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +2 −0

Cargo.toml +2 −0

crates/ssh/src/command.rs +27 −0

crates/ssh/src/server.rs +106 −0

crates/store/src/tests.rs +35 −0

crates/web/Cargo.toml +2 −0

crates/web/src/git_http.rs +53 −7

crates/web/src/lfs.rs +534 −0

crates/web/src/lib.rs +2 −1

crates/web/src/repo.rs +17 −0

src/serve.rs +2 −1

  "comrak",
  "config",
  "flate2",
+ "futures-util",
  "git",
  "git2",
  "grep",
  "rust-embed",
  "serde",
  "serde_json",
+ "sha2 0.10.9",
  "store",
  "tempfile",
  "thiserror 2.0.19",

 # Streaming the pack subprocess stdout into the HTTP response body; gunzip for
 # gzip-encoded upload-pack requests.
 tokio-util = { version = "0.7", features = ["io"] }
+# Stream adapters for LFS: turn the request body stream into an AsyncRead.
+futures-util = "0.3"
 flate2 = "1"
 # Content search (ripgrep's engine). Dual Unlicense/MIT — MIT satisfies the gate.
 grep = "0.3"

     })
+}
+/// A parsed `git-lfs-authenticate <path> <operation>` command: the git-lfs client
+/// runs this over SSH to obtain an HTTP endpoint and bearer token for LFS transfer.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct LfsAuth {
+    /// The repository path argument (still needs normalizing).
+    pub path: String,
+    /// The operation: `upload` or `download`.
+    pub operation: String,
+}
+/// Parse a `git-lfs-authenticate <path> <operation>` command line, or `None`.
+#[must_use]
+pub fn parse_lfs(command: &str) -> Option<LfsAuth> {
+    let words = shell_split(command)?;
+    let (name, rest) = words.split_first()?;
+    if name != "git-lfs-authenticate" || rest.len() != 2 {
+        return None;
+    }
+    if rest[1] != "upload" && rest[1] != "download" {
+        return None;
+    }
+    Some(LfsAuth {
+        path: rest[0].clone(),
+        operation: rest[1].clone(),
+    })
+}
 /// Split a command line into words, honouring single and double quotes (git sends
 /// the path single-quoted). Returns `None` on an unterminated quote.
 fn shell_split(input: &str) -> Option<Vec<String>> {

     config: Arc<Config>,
     /// The `--config` path to hand hooks via `FABRICA_CONFIG`.
     config_path: Option<String>,
+    /// The instance signing secret, for minting short-lived LFS bearer tokens.
+    secret: String,
+}
 /// The russh `Server` factory.
         let Some(identity) = self.identity.clone() else {
             return Err("Authentication required.".to_string());
         };
+        // git-lfs-authenticate: hand back an HTTP endpoint + bearer token, then exit.
+        if let Some(lfs) = command::parse_lfs(command) {
+            return self
+                .lfs_authenticate(channel, &identity, &lfs, session)
+                .await;
+        }
         let parsed = command::parse(command).ok_or_else(|| self.no_shell_banner())?;
         let (owner, repo_path) = resolve::normalize(&parsed.path)
             .ok_or_else(|| "Invalid repository path.".to_string())?;
         Ok(())
+    }
+    /// Handle `git-lfs-authenticate`: authorize the repo for the operation, mint a
+    /// short-lived bearer token, and write the LFS endpoint JSON to stdout. The
+    /// actual object transfer then happens over HTTP against that endpoint.
+    async fn lfs_authenticate(
+        &mut self,
+        channel: ChannelId,
+        identity: &Identity,
+        lfs: &command::LfsAuth,
+        session: &mut Session,
+    ) -> Result<(), String> {
+        let (owner, repo_path) =
+            resolve::normalize(&lfs.path).ok_or_else(|| "Invalid repository path.".to_string())?;
+        let not_found = || "Repository not found.".to_string();
+        let owner_user = self
+            .shared
+            .store
+            .user_by_username(&owner)
+            .await
+            .ok()
+            .flatten()
+            .ok_or_else(not_found)?;
+        let repo = self
+            .shared
+            .store
+            .repo_by_owner_path(&owner_user.id, &repo_path)
+            .await
+            .ok()
+            .flatten()
+            .ok_or_else(not_found)?;
+        let collaborator = self
+            .shared
+            .store
+            .collaborator_permission(&repo.id, &identity.user_id)
+            .await
+            .ok()
+            .flatten()
+            .and_then(|p| auth::Permission::parse(&p));
+        let viewer = auth::Viewer {
+            id: identity.user_id.clone(),
+            is_admin: identity.is_admin,
+        };
+        let access = auth::access(
+            Some(&viewer),
+            &repo,
+            collaborator,
+            self.shared.config.instance.allow_anonymous,
+        );
+        let required = if lfs.operation == "upload" {
+            auth::Access::Write
+        } else {
+            auth::Access::Read
+        };
+        if access < required {
+            return Err(if access >= auth::Access::Read {
+                "You do not have write access to this repository.".to_string()
+            } else {
+                not_found()
+            });
+        }
+        // A one-hour bearer token the HTTP LFS endpoints accept (verified by
+        // signature + expiry, not the API-token revocation path).
+        let now_s = i64::try_from(
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .map_or(0, |d| d.as_secs()),
+        )
+        .unwrap_or(0);
+        let claims = auth::Claims {
+            sub: identity.user_id.clone(),
+            jti: format!("lfs-{}", repo.id),
+            scopes: "lfs".to_string(),
+            iat: now_s,
+            exp: now_s + 3600,
+        };
+        let token = auth::mint_jwt(&self.shared.secret, &claims)
+            .map_err(|_| "Could not issue an LFS token.".to_string())?;
+        let href = format!(
+            "{}/{}/{}.git/info/lfs",
+            self.shared.config.instance.url.trim_end_matches('/'),
+            owner,
+            repo_path
+        );
+        // git-lfs reads this JSON from stdout. href/token contain only URL- and
+        // JWT-safe characters, so no escaping is needed.
+        let json = format!(
+            "{{\"href\":\"{href}\",\"header\":{{\"Authorization\":\"Bearer {token}\"}},\"expires_in\":3600}}\n"
+        );
+        let handle = session.handle();
+        let _ = handle.data(channel, json.into_bytes()).await;
+        let _ = handle.exit_status_request(channel, 0).await;
+        let _ = handle.eof(channel).await;
+        let _ = handle.close(channel).await;
+        Ok(())
+    }
     /// Resolve and authorize the repo for the requested service.
     async fn resolve_repo(
         &self,
     config: Arc<Config>,
     store: Store,
     config_path: Option<String>,
+    secret: String,
 ) -> Result<(), SshError> {
     if !config.ssh.enabled {
         tracing::info!("ssh disabled (ssh.enabled = false)");
         store,
         config: Arc::clone(&config),
         config_path,
+        secret,
     });
     let addr = (config.ssh.address.clone(), config.ssh.port);
     tracing::info!(address = %config.ssh.address, port = config.ssh.port, "ssh server listening");

+}
 #[tokio::test]
+async fn lfs_objects_track_per_repo() {
+    for fx in sqlite_fixtures().await {
+        let owner = fx
+            .store
+            .create_user(sample_user("lfs", "lfs@example.com"))
+            .await
+            .unwrap();
+        let repo = fx
+            .store
+            .create_repo(NewRepo {
+                owner_id: owner.id,
+                group_id: None,
+                name: "r".to_string(),
+                path: "r".to_string(),
+                description: None,
+                visibility: model::Visibility::Private,
+                default_branch: "main".to_string(),
+            })
+            .await
+            .unwrap();
+        let oid = "a".repeat(64);
+        assert!(!fx.store.lfs_object_exists(&repo.id, &oid).await.unwrap());
+        fx.store.lfs_object_add(&repo.id, &oid, 1234).await.unwrap();
+        // A repeat add is a no-op (idempotent), not a conflict.
+        fx.store.lfs_object_add(&repo.id, &oid, 1234).await.unwrap();
+        assert!(fx.store.lfs_object_exists(&repo.id, &oid).await.unwrap());
+        assert_eq!(
+            fx.store.lfs_object_size(&repo.id, &oid).await.unwrap(),
+            Some(1234)
+        );
+        assert_eq!(fx.store.lfs_repo_bytes(&repo.id).await.unwrap(), 1234);
+    }
+}
+#[tokio::test]
 async fn keys_get_stable_per_user_ordinals() {
     for fx in sqlite_fixtures().await {
         let user = fx

 comrak = { workspace = true }
 ammonia = { workspace = true }
 tokio-util = { workspace = true }
+futures-util = { workspace = true }
+sha2 = { workspace = true }
 flate2 = { workspace = true }
 grep = { workspace = true }
 reqwest = { workspace = true }

         _ => return StatusCode::FORBIDDEN.into_response(),
+    }
-    let repo = match authorize(state, jar, headers, owner, repo_path).await {
+    let repo = match authorize(state, jar, headers, owner, repo_path, auth::Access::Read).await {
         Ok(repo) => repo,
         Err(response) => return response,
     };
     Path((owner, rest)): Path<(String, String)>,
     body: Body,
 ) -> Response {
+    // LFS batch/verify share the POST catch-all; route them before pack RPC.
+    if let Some((repo_path, tail)) = crate::lfs::split_lfs(&rest) {
+        let repo_path = repo_path.to_string();
+        return match tail {
+            "objects/batch" => crate::lfs::batch(state, jar, headers, owner, repo_path, body).await,
+            t if t.starts_with("objects/") && t.ends_with("/verify") => {
+                crate::lfs::verify(state, jar, headers, owner, repo_path, body).await
+            }
+            _ => StatusCode::NOT_FOUND.into_response(),
+        };
+    }
     let Some((repo_path, tail)) = split_git(&rest) else {
         return StatusCode::NOT_FOUND.into_response();
     };
         _ => return StatusCode::NOT_FOUND.into_response(),
+    }
-    let repo = match authorize(&state, &jar, &headers, &owner, repo_path).await {
+    let repo = match authorize(
+        &state,
+        &jar,
+        &headers,
+        &owner,
+        repo_path,
+        auth::Access::Read,
+    )
+    .await
+    {
         Ok(repo) => repo,
         Err(response) => return response,
     };
 /// to send: `401` (anonymous, credentials needed) or `404` (missing, or an
 /// authenticated stranger — no existence leak).
 #[allow(clippy::result_large_err)] // the Err is a ready-to-send Response by design.
-async fn authorize(
+pub(crate) async fn authorize(
     state: &AppState,
     jar: &CookieJar,
     headers: &HeaderMap,
     owner: &str,
     repo_path: &str,
+    required: auth::Access,
 ) -> Result<Repo, Response> {
     let owner_user = state.store.user_by_username(owner).await.ok().flatten();
     let repo = match owner_user {
         collaborator,
         state.allow_anonymous(),
     );
-    if access >= auth::Access::Read {
+    if access >= required {
         Ok(repo)
     } else if viewer.is_none() {
         Err(unauthorized())
+    }
+}
-/// Authenticate a pack request via the session cookie or HTTP Basic (username +
+/// Authenticate a request via the session cookie, an LFS bearer token (minted by
-/// password). Returns the user, or `None` for anonymous.
+/// SSH `git-lfs-authenticate`), or HTTP Basic (username + password). Returns the
-async fn authenticate(state: &AppState, jar: &CookieJar, headers: &HeaderMap) -> Option<User> {
+/// user, or `None` for anonymous.
+pub(crate) async fn authenticate(
+    state: &AppState,
+    jar: &CookieJar,
+    headers: &HeaderMap,
+) -> Option<User> {
     if let Some(cookie) = jar.get(&state.config.auth.cookie_name)
         && let Ok(Some(user)) = state
             .store
+    {
         return Some(user);
+    }
+    if let Some(user) = bearer_user(state, headers).await {
+        return Some(user);
+    }
     let (username, password) = parse_basic(headers)?;
     let user = state
         .store
+    }
+}
+/// Resolve an `Authorization: Bearer <jwt>` header to its user. The token is an
+/// LFS access token minted by SSH `git-lfs-authenticate`; only its signature and
+/// expiry are proven here (access is re-checked per repo by [`authorize`]).
+async fn bearer_user(state: &AppState, headers: &HeaderMap) -> Option<User> {
+    let value = headers.get(header::AUTHORIZATION)?.to_str().ok()?;
+    let token = value.strip_prefix("Bearer ")?.trim();
+    let now = crate::now_ms() / 1000;
+    let claims = auth::verify_jwt(state.secret.as_str(), token, now).ok()?;
+    state
+        .store
+        .user_by_id(&claims.sub)
+        .await
+        .ok()
+        .flatten()
+        .filter(|u| u.disabled_at.is_none())
+}
 /// Parse an HTTP Basic `Authorization` header into `(username, password)`.
 fn parse_basic(headers: &HeaderMap) -> Option<(String, String)> {
     let value = headers.get(header::AUTHORIZATION)?.to_str().ok()?;

+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+//! Git-LFS: the [Batch API] and basic transfer (upload / download) over HTTP.
+//!
+//! Objects are content-addressed by their sha256 `oid` and stored on disk under
+//! `storage.lfs_dir`, sharded `{oid[0..2]}/{oid[2..4]}/{oid}`; the `lfs_objects`
+//! table records which repository holds which object (for access control and the
+//! batch "do you have this?" answer). Uploads stream to a temp file, are verified
+//! against the claimed oid, and only then moved into place — a corrupt or
+//! mislabelled upload never becomes a servable object.
+//!
+//! Authorization runs before any bytes move: download needs [`Access::Read`],
+//! upload needs [`Access::Write`]. HTTPS clients authenticate with Basic
+//! credentials; SSH clients present the bearer token minted by
+//! `git-lfs-authenticate` (see [`crate::git_http::authenticate`]).
+//!
+//! [Batch API]: https://github.com/git-lfs/git-lfs/blob/main/docs/api/batch.md
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::sync::atomic::{AtomicU64, Ordering};
+use axum::body::Body;
+use axum::extract::{Path, State};
+use axum::http::{HeaderMap, StatusCode, header};
+use axum::response::{IntoResponse, Response};
+use axum_extra::extract::cookie::CookieJar;
+use futures_util::TryStreamExt as _;
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
+use tokio_util::io::{ReaderStream, StreamReader};
+use crate::AppState;
+use crate::git_http::authorize;
+/// The media type every LFS JSON request and response uses.
+const LFS_JSON: &str = "application/vnd.git-lfs+json";
+/// Per-process counter for unique upload temp-file names.
+static TMP_SEQ: AtomicU64 = AtomicU64::new(0);
+/// Split a repo-relative path on `/info/lfs/`, returning `(repo_path, lfs_tail)`
+/// with any trailing `.git` stripped from the repo path. `lfs_tail` is e.g.
+/// `objects/batch` or `objects/<oid>`.
+#[must_use]
+pub(crate) fn split_lfs(rest: &str) -> Option<(&str, &str)> {
+    let idx = rest.find("/info/lfs/")?;
+    let repo = rest[..idx].strip_suffix(".git").unwrap_or(&rest[..idx]);
+    Some((repo, &rest[idx + "/info/lfs/".len()..]))
+}
+/// A 64-char lowercase-hex sha256 is the only shape we treat as an oid; anything
+/// else is rejected before it can touch the filesystem.
+fn valid_oid(oid: &str) -> bool {
+    oid.len() == 64
+        && oid
+            .bytes()
+            .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+}
+/// The on-disk path for an object, sharded by the first two byte-pairs of the oid.
+fn object_path(lfs_dir: &std::path::Path, oid: &str) -> PathBuf {
+    lfs_dir.join(&oid[0..2]).join(&oid[2..4]).join(oid)
+}
+/// Hex-encode a byte slice (lowercase), for comparing a computed digest to an oid.
+fn hex(bytes: &[u8]) -> String {
+    let mut s = String::with_capacity(bytes.len() * 2);
+    for b in bytes {
+        s.push(char::from_digit(u32::from(b >> 4), 16).unwrap_or('0'));
+        s.push(char::from_digit(u32::from(b & 0xf), 16).unwrap_or('0'));
+    }
+    s
+}
+/// `PUT /{owner}/{*rest}` — the object-upload route. Recognizes only the LFS
+/// `…/info/lfs/objects/{oid}` shape and rejects everything else.
+pub(crate) async fn put(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    headers: HeaderMap,
+    Path((owner, rest)): Path<(String, String)>,
+    body: Body,
+) -> Response {
+    let Some((repo_path, tail)) = split_lfs(&rest) else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let Some(oid) = tail.strip_prefix("objects/") else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    if oid.contains('/') {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+    upload(
+        state,
+        jar,
+        headers,
+        owner,
+        repo_path.to_string(),
+        oid.to_string(),
+        body,
+    )
+    .await
+}
+// ---- Batch API ----
+/// One `{oid, size}` pair in a batch request.
+#[derive(Debug, Deserialize)]
+struct ObjectId {
+    oid: String,
+    #[serde(default)]
+    size: i64,
+}
+/// A `POST objects/batch` request body.
+#[derive(Debug, Deserialize)]
+struct BatchRequest {
+    operation: String,
+    objects: Vec<ObjectId>,
+}
+/// A single transfer action (an href the client PUTs to or GETs from).
+#[derive(Debug, Serialize)]
+struct Action {
+    href: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    header: Option<HashMap<String, String>>,
+}
+/// The actions available for one object (only the relevant ones are set).
+#[derive(Debug, Default, Serialize)]
+struct Actions {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    download: Option<Action>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    upload: Option<Action>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    verify: Option<Action>,
+}
+/// A per-object error in the batch response.
+#[derive(Debug, Serialize)]
+struct ObjectError {
+    code: u16,
+    message: String,
+}
+/// One object in the batch response.
+#[derive(Debug, Serialize)]
+struct BatchObject {
+    oid: String,
+    size: i64,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    actions: Option<Actions>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error: Option<ObjectError>,
+}
+/// The `POST objects/batch` response body.
+#[derive(Debug, Serialize)]
+struct BatchResponse {
+    transfer: String,
+    objects: Vec<BatchObject>,
+}
+/// `POST .../info/lfs/objects/batch` — negotiate which objects the client may
+/// upload or download and where.
+pub(crate) async fn batch(
+    state: AppState,
+    jar: CookieJar,
+    headers: HeaderMap,
+    owner: String,
+    repo_path: String,
+    body: Body,
+) -> Response {
+    let Ok(raw) = axum::body::to_bytes(body, 1024 * 1024).await else {
+        return lfs_error(StatusCode::BAD_REQUEST, "request too large");
+    };
+    let Ok(req) = serde_json::from_slice::<BatchRequest>(&raw) else {
+        return lfs_error(StatusCode::BAD_REQUEST, "malformed batch request");
+    };
+    let uploading = req.operation == "upload";
+    let required = if uploading {
+        auth::Access::Write
+    } else {
+        auth::Access::Read
+    };
+    let repo = match authorize(&state, &jar, &headers, &owner, &repo_path, required).await {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    let base = format!(
+        "{}/{}/{}.git/info/lfs/objects",
+        state.config.instance.url.trim_end_matches('/'),
+        owner,
+        repo_path
+    );
+    let mut objects = Vec::with_capacity(req.objects.len());
+    for obj in &req.objects {
+        objects.push(if uploading {
+            batch_upload(&state, &repo.id, &base, obj).await
+        } else {
+            batch_download(&state, &repo.id, &base, obj).await
+        });
+    }
+    let payload = BatchResponse {
+        transfer: "basic".to_string(),
+        objects,
+    };
+    lfs_json(StatusCode::OK, &payload)
+}
+/// Resolve one object for a download batch: offer a download action if we hold it.
+async fn batch_download(
+    state: &AppState,
+    repo_id: &str,
+    base: &str,
+    obj: &ObjectId,
+) -> BatchObject {
+    if valid_oid(&obj.oid)
+        && state
+            .store
+            .lfs_object_exists(repo_id, &obj.oid)
+            .await
+            .unwrap_or(false)
+    {
+        BatchObject {
+            oid: obj.oid.clone(),
+            size: obj.size,
+            actions: Some(Actions {
+                download: Some(Action {
+                    href: format!("{base}/{}", obj.oid),
+                    header: None,
+                }),
+                ..Actions::default()
+            }),
+            error: None,
+        }
+    } else {
+        BatchObject {
+            oid: obj.oid.clone(),
+            size: obj.size,
+            actions: None,
+            error: Some(ObjectError {
+                code: 404,
+                message: "object does not exist".to_string(),
+            }),
+        }
+    }
+}
+/// Resolve one object for an upload batch: offer upload+verify unless we have it.
+async fn batch_upload(state: &AppState, repo_id: &str, base: &str, obj: &ObjectId) -> BatchObject {
+    if !valid_oid(&obj.oid) {
+        return BatchObject {
+            oid: obj.oid.clone(),
+            size: obj.size,
+            actions: None,
+            error: Some(ObjectError {
+                code: 422,
+                message: "invalid oid".to_string(),
+            }),
+        };
+    }
+    // Already stored (in this repo): no action needed, the client skips it.
+    if state
+        .store
+        .lfs_object_exists(repo_id, &obj.oid)
+        .await
+        .unwrap_or(false)
+    {
+        return BatchObject {
+            oid: obj.oid.clone(),
+            size: obj.size,
+            actions: None,
+            error: None,
+        };
+    }
+    BatchObject {
+        oid: obj.oid.clone(),
+        size: obj.size,
+        actions: Some(Actions {
+            upload: Some(Action {
+                href: format!("{base}/{}", obj.oid),
+                header: None,
+            }),
+            verify: Some(Action {
+                href: format!("{base}/{}/verify", obj.oid),
+                header: None,
+            }),
+            ..Actions::default()
+        }),
+        error: None,
+    }
+}
+// ---- Basic transfer ----
+/// `GET .../info/lfs/objects/{oid}` — stream a stored object.
+pub(crate) async fn download(
+    state: AppState,
+    jar: CookieJar,
+    headers: HeaderMap,
+    owner: String,
+    repo_path: String,
+    oid: String,
+) -> Response {
+    let repo = match authorize(
+        &state,
+        &jar,
+        &headers,
+        &owner,
+        &repo_path,
+        auth::Access::Read,
+    )
+    .await
+    {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    if !valid_oid(&oid)
+        || !state
+            .store
+            .lfs_object_exists(&repo.id, &oid)
+            .await
+            .unwrap_or(false)
+    {
+        return StatusCode::NOT_FOUND.into_response();
+    }
+    let path = object_path(&state.config.storage.lfs_dir, &oid);
+    let Ok(file) = tokio::fs::File::open(&path).await else {
+        return StatusCode::NOT_FOUND.into_response();
+    };
+    let len = file.metadata().await.map_or(0, |m| m.len());
+    let body = Body::from_stream(ReaderStream::new(file));
+    (
+        [
+            (header::CONTENT_TYPE, "application/octet-stream".to_string()),
+            (header::CONTENT_LENGTH, len.to_string()),
+        ],
+        body,
+    )
+        .into_response()
+}
+/// `PUT .../info/lfs/objects/{oid}` — receive an object, verifying its sha256
+/// matches the oid before it becomes servable.
+pub(crate) async fn upload(
+    state: AppState,
+    jar: CookieJar,
+    headers: HeaderMap,
+    owner: String,
+    repo_path: String,
+    oid: String,
+    body: Body,
+) -> Response {
+    let repo = match authorize(
+        &state,
+        &jar,
+        &headers,
+        &owner,
+        &repo_path,
+        auth::Access::Write,
+    )
+    .await
+    {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    if !valid_oid(&oid) {
+        return lfs_error(StatusCode::UNPROCESSABLE_ENTITY, "invalid oid");
+    }
+    // Idempotent: if we already hold it, drain the body and succeed.
+    if state
+        .store
+        .lfs_object_exists(&repo.id, &oid)
+        .await
+        .unwrap_or(false)
+    {
+        return StatusCode::OK.into_response();
+    }
+    let lfs_dir = &state.config.storage.lfs_dir;
+    let tmp_dir = lfs_dir.join("tmp");
+    if tokio::fs::create_dir_all(&tmp_dir).await.is_err() {
+        return lfs_error(StatusCode::INTERNAL_SERVER_ERROR, "storage error");
+    }
+    let tmp = tmp_dir.join(format!(
+        "{}.{}.tmp",
+        std::process::id(),
+        TMP_SEQ.fetch_add(1, Ordering::Relaxed)
+    ));
+    let Ok((digest, size)) = stream_to_file(body, &tmp).await else {
+        let _ = tokio::fs::remove_file(&tmp).await;
+        return lfs_error(StatusCode::INTERNAL_SERVER_ERROR, "write failed");
+    };
+    if digest != oid {
+        let _ = tokio::fs::remove_file(&tmp).await;
+        return lfs_error(StatusCode::UNPROCESSABLE_ENTITY, "oid mismatch");
+    }
+    let dest = object_path(lfs_dir, &oid);
+    if let Some(parent) = dest.parent() {
+        let _ = tokio::fs::create_dir_all(parent).await;
+    }
+    if tokio::fs::rename(&tmp, &dest).await.is_err() {
+        let _ = tokio::fs::remove_file(&tmp).await;
+        return lfs_error(StatusCode::INTERNAL_SERVER_ERROR, "storage error");
+    }
+    if state
+        .store
+        .lfs_object_add(&repo.id, &oid, size)
+        .await
+        .is_err()
+    {
+        return lfs_error(StatusCode::INTERNAL_SERVER_ERROR, "storage error");
+    }
+    StatusCode::OK.into_response()
+}
+/// `POST .../info/lfs/objects/{oid}/verify` — confirm an object landed at the
+/// expected size (git-lfs calls this after an upload).
+pub(crate) async fn verify(
+    state: AppState,
+    jar: CookieJar,
+    headers: HeaderMap,
+    owner: String,
+    repo_path: String,
+    body: Body,
+) -> Response {
+    let repo = match authorize(
+        &state,
+        &jar,
+        &headers,
+        &owner,
+        &repo_path,
+        auth::Access::Read,
+    )
+    .await
+    {
+        Ok(repo) => repo,
+        Err(resp) => return resp,
+    };
+    let Ok(raw) = axum::body::to_bytes(body, 64 * 1024).await else {
+        return lfs_error(StatusCode::BAD_REQUEST, "request too large");
+    };
+    let Ok(obj) = serde_json::from_slice::<ObjectId>(&raw) else {
+        return lfs_error(StatusCode::BAD_REQUEST, "malformed request");
+    };
+    match state.store.lfs_object_size(&repo.id, &obj.oid).await {
+        Ok(Some(size)) if size == obj.size => StatusCode::OK.into_response(),
+        _ => lfs_error(StatusCode::NOT_FOUND, "object not found"),
+    }
+}
+/// Stream `body` into `path`, returning `(hex_sha256, size)`.
+async fn stream_to_file(body: Body, path: &std::path::Path) -> std::io::Result<(String, i64)> {
+    let stream = body.into_data_stream().map_err(std::io::Error::other);
+    let reader = StreamReader::new(stream);
+    tokio::pin!(reader);
+    let mut file = tokio::fs::File::create(path).await?;
+    let mut hasher = Sha256::new();
+    let mut buf = vec![0u8; 64 * 1024];
+    let mut size: i64 = 0;
+    loop {
+        let n = reader.read(&mut buf).await?;
+        if n == 0 {
+            break;
+        }
+        hasher.update(&buf[..n]);
+        file.write_all(&buf[..n]).await?;
+        size += i64::try_from(n).unwrap_or(0);
+    }
+    file.flush().await?;
+    Ok((hex(&hasher.finalize()), size))
+}
+/// Render a value as an LFS JSON response with the required content type.
+fn lfs_json<T: Serialize>(status: StatusCode, value: &T) -> Response {
+    match serde_json::to_vec(value) {
+        Ok(bytes) => (status, [(header::CONTENT_TYPE, LFS_JSON)], bytes).into_response(),
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
+    }
+}
+/// Render an LFS error body (`{"message": "..."}`) with the given status.
+fn lfs_error(status: StatusCode, message: &str) -> Response {
+    let body = serde_json::json!({ "message": message });
+    (status, [(header::CONTENT_TYPE, LFS_JSON)], body.to_string()).into_response()
+}
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn split_lfs_finds_the_repo_and_tail() {
+        assert_eq!(
+            split_lfs("owner-scope/repo.git/info/lfs/objects/batch"),
+            Some(("owner-scope/repo", "objects/batch"))
+        );
+        // The `.git` is optional (git-lfs derives the endpoint from the remote).
+        assert_eq!(
+            split_lfs("grp/sub/repo/info/lfs/objects/abc"),
+            Some(("grp/sub/repo", "objects/abc"))
+        );
+        assert_eq!(split_lfs("owner/repo.git/info/refs"), None);
+    }
+    #[test]
+    fn valid_oid_accepts_only_lowercase_hex_sha256() {
+        assert!(valid_oid(&"a".repeat(64)));
+        assert!(valid_oid(&"0123456789abcdef".repeat(4)));
+        assert!(!valid_oid(&"a".repeat(63)), "too short");
+        assert!(!valid_oid(&"A".repeat(64)), "uppercase rejected");
+        assert!(!valid_oid(&"g".repeat(64)), "non-hex rejected");
+    }
+    #[test]
+    fn hex_matches_a_known_sha256() {
+        // sha256("") = e3b0c442...
+        let digest = Sha256::digest(b"");
+        assert_eq!(
+            hex(&digest),
+            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+        );
+    }
+}

 mod issues;
 mod languages;
 mod layout;
+mod lfs;
 mod license;
 mod markdown;
 mod pages;
         .route("/{owner}", get(repo::user_page))
         .route(
             "/{owner}/{*rest}",
-            get(repo::dispatch).post(git_http::pack_rpc),
+            get(repo::dispatch).post(git_http::pack_rpc).put(lfs::put),
+        )
         .layer(
             ServiceBuilder::new()

     Query(dq): Query<DiffQuery>,
     Path((owner_name, rest)): Path<(String, String)>,
 ) -> AppResult<Response> {
+    // LFS object download shares the GET catch-all (`…/info/lfs/objects/{oid}`).
+    if !rest.contains("/-/")
+        && let Some((repo_path, tail)) = crate::lfs::split_lfs(&rest)
+        && let Some(oid) = tail.strip_prefix("objects/")
+        && !oid.contains('/')
+    {
+        return Ok(crate::lfs::download(
+            state,
+            jar,
+            headers,
+            owner_name,
+            repo_path.to_string(),
+            oid.to_string(),
+        )
+        .await);
+    }
     // Smart-HTTP pack transport: `{owner}/{path}.git/info/refs`. Guarded so a blob
     // path that merely contains ".git/" is never misrouted (those carry "/-/").
     if !rest.contains("/-/")

         let ssh_config = Arc::clone(&config);
         let ssh_store = store.clone();
         let ssh_config_path = req.config_path.as_ref().map(|p| p.display().to_string());
+        let ssh_secret = secret.clone();
         let ssh_task = tokio::spawn(async move {
-            if let Err(err) = ssh::serve(ssh_config, ssh_store, ssh_config_path).await {
+            if let Err(err) = ssh::serve(ssh_config, ssh_store, ssh_config_path, ssh_secret).await {
                 eprintln!("ssh server error: {err}");
+            }
         });