copy: Don't leak the existence of repositories

Previously copy would report that the target existed before running ACLs.

While saving a bunch of effort by reporting this early,
this means you can see if a repository exists by copying to it
even if you haven't got read access to the repository.

This is now changed to only report that after the writability check.

This has been moved to before the creation check
since for the sake of error reporting
we should check in order of ascending privilege,
and post-write-check is the earliest we can reveal the repository's existence.

1 files changed, 10 insertions, 8 deletions

diff --git a/lib/gitano/copycommand.lua b/lib/gitano/copycommand.lua
index 6645dd2..f395d70 100644
--- a/lib/gitano/copycommand.lua
+++ b/lib/gitano/copycommand.lua
@@ -35,10 +35,6 @@ local function builtin_copy_validate(config, srcrepo, cmdline)
       log.fatal("Cannot continue")
       return false
    end
-   if not tgtrepo.is_nascent then
-      log.error("Repository", tgtrepo.name, "already exists")
-      return false
-   end
    cmdline.tgtrepo = tgtrepo
    return true
 end
@@ -52,16 +48,22 @@ local function builtin_copy_prep(config, srcrepo, cmdline, context)
    if action ~= "allow" then
       return action, reason
    end
-   -- Check 2, target repository can be created
+   -- Check 2, target repository can be written to
    ctx = util.deep_copy(context)
-   ctx.operation = "createrepo"
+   ctx.operation = "write"
    action, reason = cmdline.tgtrepo:run_lace(ctx)
    if action ~= "allow" then
       return action, reason
    end
-   -- Check 3, target repository can be written to
+   -- Check 3, target repository does not already exist
+   -- We knew this for a while but failing earlier would leak its existence.
+   if not cmdline.tgtrepo.is_nascent then
+       log.error("Repository", cmdline.tgtrepo.name, "already exists")
+       return "deny", "Repository already exists"
+   end
+   -- Check 4, target repository can be created
    ctx = util.deep_copy(context)
-   ctx.operation = "write"
+   ctx.operation = "createrepo"
    action, reason = cmdline.tgtrepo:run_lace(ctx)
    if action ~= "allow" then
       return action, reason