view release on metacpan or  search on metacpan

lib/Net/Blossom/Server/MirrorFetcher/HTTP.pm  view on Meta::CPAN

            status => 502,
            reason => 'Origin Content-Length is invalid',
        ) unless $content_length =~ /\A\d+\z/;
        _too_large() if $content_length > $max_bytes;
    }

    my $type = _header($headers, 'content-type');
    $type = 'application/octet-stream' unless defined $type && length $type;

    my %metadata = (type => $type);
    $metadata{content_length} = $content_length if defined $content_length;
    return %metadata;
}

sub _too_large {
    Net::Blossom::Server::Error->throw(
        status => 413,
        reason => 'Mirrored blob is too large',
    );
}

sub _valid_allowed_host {
    my ($host) = @_;
    return 0 if $host =~ /[\x00-\x20]/;
    return 0 if $host =~ m{[/?#\@:]};
    return length $host;
}

1;

=pod

=head1 NAME

Net::Blossom::Server::MirrorFetcher::HTTP - Allowlist HTTP fetcher for Blossom mirrors

=head1 SYNOPSIS

    use Net::Blossom::Server::MirrorFetcher::HTTP;

    my $fetcher = Net::Blossom::Server::MirrorFetcher::HTTP->new(
        allowed_hosts => ['cdn.example.com'],
        max_bytes     => 50_000_000,
        timeout       => 5,
    );

    my $server = Net::Blossom::Server->new(
        storage        => $storage,
        mirror_fetcher => $fetcher,
    );

=head1 DESCRIPTION

C<Net::Blossom::Server::MirrorFetcher::HTTP> is a small allowlist-only fetcher
for C<PUT /mirror>. It is intentionally conservative: it does not provide public
internet mirroring by default.

The fetcher validates the URL before making a request, requires the URL host to
match one of the configured C<allowed_hosts>, disables redirects in the default
HTTP client, clears common proxy environment variables while fetching, and
enforces a maximum response size while streaming into the supplied sink.

=head1 CONSTRUCTOR

=head2 new

    my $fetcher = Net::Blossom::Server::MirrorFetcher::HTTP->new(%args);

Required arguments:

=over 4

=item * C<allowed_hosts>

Array reference of host names that may be mirrored. Matching is exact and
case-insensitive. Wildcards are not supported. Only default ports for the URL
scheme are allowed.

=item * C<max_bytes>

Positive integer maximum response size in bytes.

=back

Optional arguments:

=over 4

=item * C<timeout>

Positive integer request timeout in seconds. Defaults to C<5>.

=item * C<user_agent>

Object with a C<request> method compatible with C<HTTP::Tiny>. This is mainly
for tests or applications that need to supply their own HTTP transport.

Custom user agents are trusted transport policy. They must not follow redirects
unless each redirected URL is checked against the same allowlist, and they must
not route requests through proxies or other transports that bypass the configured
C<allowed_hosts> policy.

=back

Unknown arguments or invalid values croak.

=head1 ACCESSORS

=head2 allowed_hosts

Returns a copy array reference of allowed host names.

=head2 timeout

Returns the request timeout.

=head2 max_bytes

Returns the maximum response size.

=head2 user_agent