authorisedList entries with * never match repository URLs

[cniska-oura]

Describe the bug

getRepoByUrl performs an exact URL lookup on authorisedList. Entries intended as org-level wildcards, e.g. https://github.com/example-org/*, do not match concrete repo URLs such as https://github.com/example-org/some-repo.git. There is no way to allowlist all repos under an org without enumerating every URL.

To Reproduce

Steps to reproduce the behavior:

1. Run @finos/git-proxy@2.0.0.
2. Add an authorised list entry: { "url": "https://github.com/example-org/*" }
3. Clone or pull https://github.com/example-org/some-repo through the proxy.
4. See error: repo not found on authorised list / request rejected as unauthorised.

Expected behavior

https://github.com/example-org/* should match any repo under that org, e.g. https://github.com/example-org/foo and https://github.com/example-org/foo.git. For github.com, repo URLs are always owner/repo. Exact URL entries should continue to work as today.

Screenshots

N/A

Desktop (please complete the following information):

• OS: Linux; macOS
• Browser: N/A (HTTP client / git CLI)
• Version: Node 20+; @finos/git-proxy 2.0.0

Smartphone (please complete the following information):

• Device: N/A
• OS: N/A
• Browser: N/A
• Version: N/A

Additional context

Suggested fallback when exact lookup misses:

function wildcardToRegExp(pattern) {
  const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
  return new RegExp('^' + escaped.replace(/\*/g, '[^/]+') + '$');
}

const originalGetRepoByUrl = db.getRepoByUrl;
db.getRepoByUrl = async function (url) {
  const exact = await originalGetRepoByUrl(url);
  if (exact) return exact;
  for (const repo of await db.getRepos()) {
    if (repo.url?.includes('*') && wildcardToRegExp(repo.url).test(url)) {
      return repo;
    }
  }
  return null;
};

Happy to open a PR if useful.

[kriswest]

As this was never intended to be supported, it would be better to word this as a feature request than a bug IMHO. As a feature request it'll need a better specification of behaviour to apply when dealing with overlapping entries, i.e. a full repo specification within an organisation and a wildcard entry for that organisation - how are these handled or prevented?

[cniska-oura]

Fair point. Happy to treat this as a feature request.

Overlap: exact lookup first; wildcard only on miss. If both https://github.com/example-org/foo.git and https://github.com/example-org/* exist, a request for example-org/foo resolves to the exact entry. Wildcards fill gaps; they do not override explicit repos.

[jescalada]

The issue here is that organizations can add new repositories over time. Example Org could have repo-1, repo-2 with approved licenses that we would like to contribute to, so we add https://github.com/example-org/* to the authorisedList. What if Example Org added repo-3 that ships with a license not approved by our legal team? For firms that rely on license approval for open-source contribution, this would cause lots of headaches.

There might be other solutions here to improve user experience - for example, Repository Groups. That way, we can manage reviewers and contributors as a group instead of adding them one by one to each repo.

As for adding new repos, we could have a Bulk Add feature to select multiple repositories within a given organization (via a checkbox) and show the current license for each repository (so repos with unapproved licenses don't go through).

Would these features be helpful to you? @cniska-oura

CC: @kriswest