fix: add gpg_check_status for commit detail (#1697)

cargo fmt



cargo fmt



fix: mv gpg_status into CommitSummary struct



fix: code review



fix: code review



fix: code review

Signed-off-by: Ruizhi Huang <231220075@smail.nju.edu.cn>

Author: 231220075

ceres/src/api_service/commit_ops.rs

@@ -10,13 +10,91 @@ use git_internal::{
 };
 
 use crate::api_service::{ApiHandler, history, tree_ops};
-use crate::model::commit::{CommitDetail, CommitSummary};
+use crate::model::commit::{CommitDetail, CommitSummary, GpgStatus};
 use crate::model::git::{CommitBindingInfo, LatestCommitInfo};
 use common::model::{DiffItem, Pagination};
 use git_internal::hash::SHA1;
 use redis::AsyncCommands;
 use std::collections::{HashMap, HashSet, VecDeque};
 
+/// Compute GPG signature verification status for a commit.
+///
+/// This function checks whether a commit has a valid GPG signature by:
+/// 1. Checking Redis cache for previously computed status
+/// 2. Extracting the GPG signature from commit content
+/// 3. Verifying the signature against stored GPG keys for the committer
+///
+/// # Arguments
+/// * `handler` - API handler providing storage and cache access
+/// * `commit` - The commit to verify
+/// * `committer` - Username of the committer for key lookup
+///
+/// # Returns
+/// * `GpgStatus::Verified` - Commit has a valid signature
+/// * `GpgStatus::Unverified` - Commit has a signature but verification failed
+/// * `GpgStatus::NoSignature` - Commit is not signed
+///
+/// # Cache
+/// Results are cached in Redis with a 600-second TTL to avoid redundant verification.
+async fn compute_gpg_status_for_commit<T: ApiHandler + ?Sized>(
+    handler: &T,
+    commit: &Commit,
+    committer: &str,
+) -> GpgStatus {
+    // Cache key per commit
+    let cache_key = format!(
+        "{}:gpg_status:v1:sha={}",
+        handler.object_cache().prefix,
+        commit.id
+    );
+
+    // Try cache first
+    let mut conn = handler.object_cache().connection.clone();
+    if let Ok(Some(json)) = conn.get::<_, Option<String>>(&cache_key).await
+        && let Ok(status) = serde_json::from_str::<GpgStatus>(&json)
+    {
+        let _ = conn.expire::<_, ()>(&cache_key, 600).await;
+        return status;
+    }
+
+    let content = &commit.message;
+    let status = {
+        let (_commit_msg, sig_opt) =
+            crate::merge_checker::gpg_signature_checker::extract_from_commit_content(content);
+        if sig_opt.is_none() {
+            GpgStatus::NoSignature
+        } else {
+            let storage = handler.get_context();
+            let checker = crate::merge_checker::gpg_signature_checker::GpgSignatureChecker {
+                storage: Arc::new(storage),
+            };
+            match checker
+                .verify_commit_gpg_signature(content, committer.to_string())
+                .await
+            {
+                Ok(()) => GpgStatus::Verified,
+                Err(e) => {
+                    tracing::debug!("GPG verification failed for commit {}: {}", commit.id, e);
+                    GpgStatus::Unverified
+                }
+            }
+        }
+    };
+
+    // Save to cache
+    match serde_json::to_string(&status) {
+        Ok(json) => {
+            if let Err(e) = conn.set_ex::<_, _, ()>(&cache_key, json, 600).await {
+                tracing::warn!("Failed to cache GPG status for {}: {}", cache_key, e);
+            }
+        }
+        Err(e) => {
+            tracing::warn!("Failed to serialize GPG status for {}: {}", cache_key, e);
+        }
+    }
+    status
+}
+
 /// Get the latest commit that modified a file or directory.
 ///
 /// This unified function handles both tag-based and commit-based browsing through
@@ -426,13 +504,15 @@ pub async fn list_commit_history<T: ApiHandler + ?Sized>(
             let c = handler.get_commit_by_hash(sha).await?;
             let mut info: LatestCommitInfo = c.clone().into();
             apply_username_binding(handler, &c.id.to_string(), &mut info).await;
+            let gpg_status = compute_gpg_status_for_commit(handler, &c, &info.committer).await;
             res.push(CommitSummary {
                 sha: c.id.to_string(),
                 short_message: info.short_message,
                 author: info.author,
                 committer: info.committer,
                 date: info.date,
                 parents: c.parent_commit_ids.iter().map(|p| p.to_string()).collect(),
+                gpg_status,
             });
         }
         return Ok((res, total));
@@ -468,13 +548,15 @@ pub async fn list_commit_history<T: ApiHandler + ?Sized>(
     for c in slice {
         let mut info: LatestCommitInfo = c.clone().into();
         apply_username_binding(handler, &c.id.to_string(), &mut info).await;
+        let gpg_status = compute_gpg_status_for_commit(handler, c, &info.committer).await;
         res.push(CommitSummary {
             sha: c.id.to_string(),
             short_message: info.short_message,
             author: info.author,
             committer: info.committer,
             date: info.date,
             parents: c.parent_commit_ids.iter().map(|p| p.to_string()).collect(),
+            gpg_status,
         });
     }
 
@@ -511,6 +593,7 @@ pub async fn build_commit_detail<T: ApiHandler + ?Sized>(
     // Summary
     let mut info: LatestCommitInfo = commit.clone().into();
     apply_username_binding(handler, &commit.id.to_string(), &mut info).await;
+    let gpg_status = compute_gpg_status_for_commit(handler, &commit, &info.committer).await;
     let summary = CommitSummary {
         sha: commit.id.to_string(),
         short_message: info.short_message,
@@ -522,6 +605,7 @@ pub async fn build_commit_detail<T: ApiHandler + ?Sized>(
             .iter()
             .map(|p| p.to_string())
             .collect(),
+        gpg_status,
     };
 
     // Collect diffs vs each parent and merge by path

ceres/src/merge_checker/gpg_signature_checker.rs

@@ -74,7 +74,7 @@ impl GpgSignatureChecker {
         Ok(())
     }
 
-    async fn verify_commit_gpg_signature(
+    pub(crate) async fn verify_commit_gpg_signature(
         &self,
         commit_content: &str,
         assignee: String,
@@ -138,7 +138,7 @@ fn normalize_signature_block(sig_block: &str) -> String {
     lines.join("\n") + "\n"
 }
 
-fn extract_from_commit_content(msg_gpg: &str) -> (String, Option<String>) {
+pub(crate) fn extract_from_commit_content(msg_gpg: &str) -> (String, Option<String>) {
     const SIG_PATTERN: &str = r"gpgsig (-----BEGIN (?:PGP|SSH) SIGNATURE-----[\s\S]*?-----END (?:PGP|SSH) SIGNATURE-----)";
     let sig_regex = Regex::new(SIG_PATTERN).unwrap();
 

ceres/src/merge_checker/mod.rs

@@ -14,7 +14,7 @@ use jupiter::{model::cl_dto::ClInfoDto, storage::Storage};
 pub mod cl_sync_checker;
 mod code_review_checker;
 mod commit_message_checker;
-mod gpg_signature_checker;
+pub(crate) mod gpg_signature_checker;
 
 #[async_trait]
 pub trait Checker: Send + Sync {

ceres/src/model/commit.rs

@@ -1,6 +1,15 @@
 use serde::{Deserialize, Serialize};
 use utoipa::ToSchema;
 
+#[derive(Debug, Serialize, Deserialize, ToSchema, Clone, Default)]
+#[serde(rename_all = "PascalCase")]
+pub enum GpgStatus {
+    Verified,
+    Unverified,
+    #[default]
+    NoSignature,
+}
+
 #[derive(Debug, Serialize, Deserialize, ToSchema, Clone)]
 pub struct CommitSummary {
     pub sha: String,
@@ -9,6 +18,9 @@ pub struct CommitSummary {
     pub committer: String,
     pub date: String,
     pub parents: Vec<String>,
+    /// GPG verification status for this commit.
+    #[serde(default)]
+    pub gpg_status: GpgStatus,
 }
 
 #[derive(Debug, Serialize, Deserialize, ToSchema, Clone, Default)]