Delete personal Gitea repositories on creation again, behind API checks

peopleportal/server/src/clients/GiteaClient/index.ts

@@ -666,6 +666,25 @@ export class GiteaClient implements SharedResourceClient {
         }
     }
 
+    /**
+     * Whether `name` is an organization rather than a user. Only a 404 means
+     * "not an organization"; any other failure throws, so callers that act on
+     * the answer fail closed.
+     */
+    public async isOrganization(name: string): Promise<boolean> {
+        try {
+            await axios.request({
+                ...this.GiteaBaseConfig,
+                method: "get",
+                url: `/api/v1/orgs/${encodeURIComponent(name)}`,
+            });
+            return true;
+        } catch (e) {
+            if ((e as AxiosError).response?.status == 404) return false;
+            throw e;
+        }
+    }
+
     /* Repository Management */
     public async getRepository(
         owner: string,
@@ -684,7 +703,7 @@ export class GiteaClient implements SharedResourceClient {
         var RequestConfig: any = {
             ...this.GiteaBaseConfig,
             method: "delete",
-            url: `/api/v1/repos/${owner}/${repo}`,
+            url: `/api/v1/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`,
         };
 
         try {

peopleportal/server/src/controllers/HooksController.ts

@@ -34,6 +34,12 @@ import { AuthentikClient } from "../clients/AuthentikClient";
 
 @Route("/api/webhook")
 export class HooksController extends Controller {
+    /* How recently a personal repository must have been created for its
+       creation event to delete it. Webhooks arrive within seconds; the margin
+       covers queueing and clock skew, and an older repository is never touched
+       by a replayed or forged event. */
+    static readonly PERSONAL_REPO_DELETE_WINDOW_MS = 10 * 60 * 1000;
+
     private readonly giteaClient: GiteaClient;
     private readonly authentikClient: AuthentikClient;
 
@@ -104,6 +110,23 @@ export class HooksController extends Controller {
     }
 
     private async handleRepoCreation(repoEvent: GiteaHookRepositoryTrigger) {
+        /* Gitea fills `organization` with the owner even for personal
+           repositories, so ask the API which kind of owner this is. */
+        let ownerIsOrganization: boolean;
+        try {
+            ownerIsOrganization = await this.giteaClient.isOrganization(
+                repoEvent.repository.owner.username,
+            );
+        } catch (e: any) {
+            console.error(
+                `Failed resolving the owner of ${repoEvent.repository.full_name}: ${e.message}`,
+            );
+            return "OK (Actions Failed)";
+        }
+
+        if (!ownerIsOrganization)
+            return this.handlePersonalRepoCreation(repoEvent);
+
         try {
             const organizationName = repoEvent.organization.username;
             if (repoEvent.repository.owner.username !== organizationName) {
@@ -137,4 +160,50 @@ export class HooksController extends Controller {
             return "OK (Actions Failed)";
         }
     }
+
+    /**
+     * Team code lives in team organizations, so personal repositories are
+     * deleted as soon as they are created. The delete only happens once the API
+     * confirms the event describes a repository that exists with the same id
+     * and owner, belongs to a user rather than an organization, and was
+     * created within PERSONAL_REPO_DELETE_WINDOW_MS. Anything else is logged
+     * and left alone, so a forged or replayed event cannot delete an older or
+     * different repository.
+     */
+    private async handlePersonalRepoCreation(
+        repoEvent: GiteaHookRepositoryTrigger,
+    ) {
+        const ownerName = repoEvent.repository.owner.username;
+        try {
+            const repository = await this.giteaClient.getRepository(
+                ownerName,
+                repoEvent.repository.name,
+            );
+            if (
+                repository.id !== repoEvent.repository.id ||
+                repository.owner.username !== ownerName
+            ) {
+                throw new Error("Repository does not match webhook event");
+            }
+
+            const age = Date.now() - Date.parse(repository.created_at);
+            if (
+                !Number.isFinite(age) ||
+                Math.abs(age) > HooksController.PERSONAL_REPO_DELETE_WINDOW_MS
+            ) {
+                throw new Error("Repository was not created just now");
+            }
+
+            await this.giteaClient.deleteRepository(ownerName, repository.name);
+            console.warn(
+                `Deleted personal repository ${repository.full_name}: team code belongs in a team organization`,
+            );
+            return "OK (Personal Repository Deleted)";
+        } catch (e: any) {
+            console.error(
+                `Not deleting personal repository ${repoEvent.repository.full_name}: ${e.message}`,
+            );
+            return "OK (Actions Failed)";
+        }
+    }
 }