feat: update gitea vendor

package/gitea/source/services/lfs/server.go

@@ -18,22 +18,22 @@ import (
 	"strings"
 	"time"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	git_model "code.gitea.io/gitea/models/git"
-	perm_model "code.gitea.io/gitea/models/perm"
-	access_model "code.gitea.io/gitea/models/perm/access"
-	repo_model "code.gitea.io/gitea/models/repo"
-	"code.gitea.io/gitea/models/unit"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/auth/httpauth"
-	"code.gitea.io/gitea/modules/httplib"
-	"code.gitea.io/gitea/modules/json"
-	lfs_module "code.gitea.io/gitea/modules/lfs"
-	"code.gitea.io/gitea/modules/log"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/storage"
-	"code.gitea.io/gitea/modules/util"
-	"code.gitea.io/gitea/services/context"
+	auth_model "gitea.dev/models/auth"
+	git_model "gitea.dev/models/git"
+	perm_model "gitea.dev/models/perm"
+	access_model "gitea.dev/models/perm/access"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/auth/httpauth"
+	"gitea.dev/modules/httplib"
+	"gitea.dev/modules/json"
+	lfs_module "gitea.dev/modules/lfs"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/setting"
+	"gitea.dev/modules/storage"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/context"
 
 	"github.com/golang-jwt/jwt/v5"
 )
@@ -254,6 +254,17 @@ func BatchHandler(ctx *context.Context) {
 
 		var responseObject *lfs_module.ObjectResponse
 		if isUpload {
+			if exists && meta == nil {
+				// The object exists in the content store but is not linked to this
+				// repo. Do not auto-link it based on cross-repo access: the token
+				// only authorizes this repo, and for deploy keys ctx.Doer is the
+				// repo owner, so trusting it here would let a single-repo key pull
+				// objects from any repo the owner can see. Require proof of
+				// possession by making the client upload the (hash-verified) bytes,
+				// and treat it as a new upload for size-limit enforcement below.
+				exists = false
+			}
+
 			var err *lfs_module.ObjectError
 			if !exists && setting.LFS.MaxFileSize > 0 && p.Size > setting.LFS.MaxFileSize {
 				err = &lfs_module.ObjectError{
@@ -262,25 +273,6 @@ func BatchHandler(ctx *context.Context) {
 				}
 			}
 
-			if exists && meta == nil {
-				accessible, err := git_model.LFSObjectAccessible(ctx, ctx.Doer, p.Oid)
-				if err != nil {
-					log.Error("Unable to check if LFS MetaObject [%s] is accessible. Error: %v", p.Oid, err)
-					writeStatus(ctx, http.StatusInternalServerError)
-					return
-				}
-				if accessible {
-					_, err := git_model.NewLFSMetaObject(ctx, repository.ID, p)
-					if err != nil {
-						log.Error("Unable to create LFS MetaObject [%s] for %s/%s. Error: %v", p.Oid, rc.User, rc.Repo, err)
-						writeStatus(ctx, http.StatusInternalServerError)
-						return
-					}
-				} else {
-					exists = false
-				}
-			}
-
 			responseObject = buildObjectResponse(rc, p, false, !exists, err)
 		} else {
 			var err *lfs_module.ObjectError
@@ -337,13 +329,17 @@ func UploadHandler(ctx *context.Context) {
 
 	uploadOrVerify := func() error {
 		if exists {
-			accessible, err := git_model.LFSObjectAccessible(ctx, ctx.Doer, p.Oid)
-			if err != nil {
-				log.Error("Unable to check if LFS MetaObject [%s] is accessible. Error: %v", p.Oid, err)
+			// The bytes already exist in the content store. Only skip proof of
+			// possession when the object is already linked to *this* repo; never
+			// trust cross-repo access (ctx.Doer is the repo owner for deploy keys),
+			// which would let a caller link an object it cannot produce.
+			meta, err := git_model.GetLFSMetaObjectByOid(ctx, repository.ID, p.Oid)
+			if err != nil && err != git_model.ErrLFSObjectNotExist {
+				log.Error("Unable to get LFS MetaObject [%s]. Error: %v", p.Oid, err)
 				return err
 			}
-			if !accessible {
-				// The file exists but the user has no access to it.
+			if meta == nil {
+				// The file exists but is not linked to this repo.
 				// The upload gets verified by hashing and size comparison to prove access to it.
 				hash := sha256.New()
 				written, err := io.Copy(hash, ctx.Req.Body)
@@ -376,9 +372,6 @@ func UploadHandler(ctx *context.Context) {
 			log.Error("Error whilst uploadOrVerify LFS OID[%s]: %v", p.Oid, err)
 			writeStatus(ctx, http.StatusInternalServerError)
 		}
-		if _, err = git_model.RemoveLFSMetaObjectByOid(ctx, repository.ID, p.Oid); err != nil {
-			log.Error("Error whilst removing MetaObject for LFS OID[%s]: %v", p.Oid, err)
-		}
 		return
 	}