lfs: add an experimental knob to disable blob serving

The use case here is the server admin may want to store the blobs elsewhere.  As
it stands now, the `lfs.url` config on the client side is all that enforces this
(the web.allow-* permissions aren't able to block LFS blobs without also
blocking normal hg traffic).  The real solution to this is to implement the
'verify' action on the client and server, but that's not a near term goal.
Whether this is useful in its own right, and should be promoted out of
experimental at some point is TBD.

Since the other two tests that deal with LFS and `hg serve` are already complex
and have #testcases, this seems like a good time to start a new test dedicated
to access checks against the server.  Instead of conditionally wrapping the
wire protocol handler, I put this in the handler because I'd still like to bring
the annotations in from the evolve extension in order to set up the wrapping.
The 400 status probably isn't great, but that's what it would be for existing
`hg serve` instances without support for serving blobs.

tests/test-lfs-serve-access.t

@@ -0,0 +1,67 b''
+#require serve
+
+  $ cat >> $HGRCPATH <<EOF
+  > [extensions]
+  > lfs=
+  > [lfs]
+  > url=http://localhost:$HGPORT/.git/info/lfs
+  > track=all()
+  > [web]
+  > push_ssl = False
+  > allow-push = *
+  > EOF
+
+Serving LFS files can experimentally be turned off.  The long term solution is
+to support the 'verify' action in both client and server, so that the server can
+tell the client to store files elsewhere.
+
+  $ hg init server
+  $ hg --config "lfs.usercache=$TESTTMP/servercache" \
+  >    --config experimental.lfs.serve=False -R server serve -d \
+  >    -p $HGPORT --pid-file=hg.pid -A $TESTTMP/access.log -E $TESTTMP/errors.log
+  $ cat hg.pid >> $DAEMON_PIDS
+
+Uploads fail...
+
+  $ hg init client
+  $ echo 'this-is-an-lfs-file' > client/lfs.bin
+  $ hg -R client ci -Am 'initial commit'
+  adding lfs.bin
+  $ hg -R client push http://localhost:$HGPORT
+  pushing to http://localhost:$HGPORT/
+  searching for changes
+  abort: LFS HTTP error: HTTP Error 400: no such method: .git (action=upload)!
+  [255]
+
+... so do a local push to make the data available.  Remove the blob from the
+default cache, so it attempts to download.
+  $ hg --config "lfs.usercache=$TESTTMP/servercache" \
+  >    --config "lfs.url=null://" \
+  >    -R client push -q server
+  $ rm -rf `hg config lfs.usercache`
+
+Downloads fail...
+
+  $ hg clone http://localhost:$HGPORT httpclone
+  requesting all changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 1 changesets with 1 changes to 1 files
+  new changesets 525251863cad
+  updating to branch default
+  abort: LFS HTTP error: HTTP Error 400: no such method: .git (action=download)!
+  [255]
+
+  $ $PYTHON $RUNTESTDIR/killdaemons.py $DAEMON_PIDS
+
+  $ cat $TESTTMP/access.log $TESTTMP/errors.log
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=capabilities HTTP/1.1" 200 - (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=batch HTTP/1.1" 200 - x-hgarg-1:cmds=heads+%3Bknown+nodes%3D525251863cad618e55d483555f3d00a2ca99597e x-hgproto-1:0.1 0.2 comp=$USUAL_COMPRESSIONS$ (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=listkeys HTTP/1.1" 200 - x-hgarg-1:namespace=phases x-hgproto-1:0.1 0.2 comp=$USUAL_COMPRESSIONS$ (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=listkeys HTTP/1.1" 200 - x-hgarg-1:namespace=bookmarks x-hgproto-1:0.1 0.2 comp=$USUAL_COMPRESSIONS$ (glob)
+  $LOCALIP - - [$LOGDATE$] "POST /.git/info/lfs/objects/batch HTTP/1.1" 400 - (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=capabilities HTTP/1.1" 200 - (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=batch HTTP/1.1" 200 - x-hgarg-1:cmds=heads+%3Bknown+nodes%3D x-hgproto-1:0.1 0.2 comp=$USUAL_COMPRESSIONS$ (glob)
+  $LOCALIP - - [$LOGDATE$] "GET /?cmd=getbundle HTTP/1.1" 200 - x-hgarg-1:bookmarks=1&bundlecaps=HG20%2Cbundle2%3DHG20%250Abookmarks%250Achangegroup%253D01%252C02%252C03%250Adigests%253Dmd5%252Csha1%252Csha512%250Aerror%253Dabort%252Cunsupportedcontent%252Cpushraced%252Cpushkey%250Ahgtagsfnodes%250Alistkeys%250Aphases%253Dheads%250Apushkey%250Aremote-changegroup%253Dhttp%252Chttps%250Arev-branch-cache%250Astream%253Dv2&cg=1&common=0000000000000000000000000000000000000000&heads=525251863cad618e55d483555f3d00a2ca99597e&listkeys=bookmarks&phases=1 x-hgproto-1:0.1 0.2 comp=$USUAL_COMPRESSIONS$ (glob)
+  $LOCALIP - - [$LOGDATE$] "POST /.git/info/lfs/objects/batch HTTP/1.1" 400 - (glob)

hgext/lfs/__init__.py

@@ -1,391 +1,394 b''
 # lfs - hash-preserving large file support using Git-LFS protocol
 #
 # Copyright 2017 Facebook, Inc.
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 """lfs - large file support (EXPERIMENTAL)
 
 This extension allows large files to be tracked outside of the normal
 repository storage and stored on a centralized server, similar to the
 ``largefiles`` extension.  The ``git-lfs`` protocol is used when
 communicating with the server, so existing git infrastructure can be
 harnessed.  Even though the files are stored outside of the repository,
 they are still integrity checked in the same manner as normal files.
 
 The files stored outside of the repository are downloaded on demand,
 which reduces the time to clone, and possibly the local disk usage.
 This changes fundamental workflows in a DVCS, so careful thought
 should be given before deploying it.  :hg:`convert` can be used to
 convert LFS repositories to normal repositories that no longer
 require this extension, and do so without changing the commit hashes.
 This allows the extension to be disabled if the centralized workflow
 becomes burdensome.  However, the pre and post convert clones will
 not be able to communicate with each other unless the extension is
 enabled on both.
 
 To start a new repository, or to add LFS files to an existing one, just
 create an ``.hglfs`` file as described below in the root directory of
 the repository.  Typically, this file should be put under version
 control, so that the settings will propagate to other repositories with
 push and pull.  During any commit, Mercurial will consult this file to
 determine if an added or modified file should be stored externally.  The
 type of storage depends on the characteristics of the file at each
 commit.  A file that is near a size threshold may switch back and forth
 between LFS and normal storage, as needed.
 
 Alternately, both normal repositories and largefile controlled
 repositories can be converted to LFS by using :hg:`convert` and the
 ``lfs.track`` config option described below.  The ``.hglfs`` file
 should then be created and added, to control subsequent LFS selection.
 The hashes are also unchanged in this case.  The LFS and non-LFS
 repositories can be distinguished because the LFS repository will
 abort any command if this extension is disabled.
 
 Committed LFS files are held locally, until the repository is pushed.
 Prior to pushing the normal repository data, the LFS files that are
 tracked by the outgoing commits are automatically uploaded to the
 configured central server.  No LFS files are transferred on
 :hg:`pull` or :hg:`clone`.  Instead, the files are downloaded on
 demand as they need to be read, if a cached copy cannot be found
 locally.  Both committing and downloading an LFS file will link the
 file to a usercache, to speed up future access.  See the `usercache`
 config setting described below.
 
 .hglfs::
 
     The extension reads its configuration from a versioned ``.hglfs``
     configuration file found in the root of the working directory. The
     ``.hglfs`` file uses the same syntax as all other Mercurial
     configuration files. It uses a single section, ``[track]``.
 
     The ``[track]`` section specifies which files are stored as LFS (or
     not). Each line is keyed by a file pattern, with a predicate value.
     The first file pattern match is used, so put more specific patterns
     first.  The available predicates are ``all()``, ``none()``, and
     ``size()``. See "hg help filesets.size" for the latter.
 
     Example versioned ``.hglfs`` file::
 
       [track]
       # No Makefile or python file, anywhere, will be LFS
       **Makefile = none()
       **.py = none()
 
       **.zip = all()
       **.exe = size(">1MB")
 
       # Catchall for everything not matched above
       ** = size(">10MB")
 
 Configs::
 
     [lfs]
     # Remote endpoint. Multiple protocols are supported:
     # - http(s)://user:[e-mail]/path
     #   git-lfs endpoint
     # - file:///tmp/path
     #   local filesystem, usually for testing
     # if unset, lfs will prompt setting this when it must use this value.
     # (default: unset)
     url = https://example.com/repo.git/info/lfs
 
     # Which files to track in LFS.  Path tests are "**.extname" for file
     # extensions, and "path:under/some/directory" for path prefix.  Both
     # are relative to the repository root.
     # File size can be tested with the "size()" fileset, and tests can be
     # joined with fileset operators.  (See "hg help filesets.operators".)
     #
     # Some examples:
     # - all()                       # everything
     # - none()                      # nothing
     # - size(">20MB")               # larger than 20MB
     # - !**.txt                     # anything not a *.txt file
     # - **.zip | **.tar.gz | **.7z  # some types of compressed files
     # - path:bin                    # files under "bin" in the project root
     # - (**.php & size(">2MB")) | (**.js & size(">5MB")) | **.tar.gz
     #     | (path:bin & !path:/bin/README) | size(">1GB")
     # (default: none())
     #
     # This is ignored if there is a tracked '.hglfs' file, and this setting
     # will eventually be deprecated and removed.
     track = size(">10M")
 
     # how many times to retry before giving up on transferring an object
     retry = 5
 
     # the local directory to store lfs files for sharing across local clones.
     # If not set, the cache is located in an OS specific cache location.
     usercache = /path/to/global/cache
 """
 
 from __future__ import absolute_import
 
 from mercurial.i18n import _
 
 from mercurial import (
     bundle2,
     changegroup,
     cmdutil,
     config,
     context,
     error,
     exchange,
     extensions,
     filelog,
     fileset,
     hg,
     localrepo,
     minifileset,
     node,
     pycompat,
     registrar,
     revlog,
     scmutil,
     templateutil,
     upgrade,
     util,
     vfs as vfsmod,
     wireproto,
     wireprotoserver,
 )
 
 from . import (
     blobstore,
     wireprotolfsserver,
     wrapper,
 )
 
 # Note for extension authors: ONLY specify testedwith = 'ships-with-hg-core' for
 # extensions which SHIP WITH MERCURIAL. Non-mainline extensions should
 # be specifying the version(s) of Mercurial they are tested with, or
 # leave the attribute unspecified.
 testedwith = 'ships-with-hg-core'
 
 configtable = {}
 configitem = registrar.configitem(configtable)
 
+configitem('experimental', 'lfs.serve',
+    default=True,
+)
 configitem('experimental', 'lfs.user-agent',
     default=None,
 )
 configitem('experimental', 'lfs.worker-enable',
     default=False,
 )
 
 configitem('lfs', 'url',
     default=None,
 )
 configitem('lfs', 'usercache',
     default=None,
 )
 # Deprecated
 configitem('lfs', 'threshold',
     default=None,
 )
 configitem('lfs', 'track',
     default='none()',
 )
 configitem('lfs', 'retry',
     default=5,
 )
 
 cmdtable = {}
 command = registrar.command(cmdtable)
 
 templatekeyword = registrar.templatekeyword()
 filesetpredicate = registrar.filesetpredicate()
 
 def featuresetup(ui, supported):
     # don't die on seeing a repo with the lfs requirement
     supported |= {'lfs'}
 
 def uisetup(ui):
     localrepo.featuresetupfuncs.add(featuresetup)
 
 def reposetup(ui, repo):
     # Nothing to do with a remote repo
     if not repo.local():
         return
 
     repo.svfs.lfslocalblobstore = blobstore.local(repo)
     repo.svfs.lfsremoteblobstore = blobstore.remote(repo)
 
     class lfsrepo(repo.__class__):
         @localrepo.unfilteredmethod
         def commitctx(self, ctx, error=False):
             repo.svfs.options['lfstrack'] = _trackedmatcher(self)
             return super(lfsrepo, self).commitctx(ctx, error)
 
     repo.__class__ = lfsrepo
 
     if 'lfs' not in repo.requirements:
         def checkrequireslfs(ui, repo, **kwargs):
             if 'lfs' not in repo.requirements:
                 last = kwargs.get(r'node_last')
                 _bin = node.bin
                 if last:
                     s = repo.set('%n:%n', _bin(kwargs[r'node']), _bin(last))
                 else:
                     s = repo.set('%n', _bin(kwargs[r'node']))
             match = repo.narrowmatch()
             for ctx in s:
                 # TODO: is there a way to just walk the files in the commit?
                 if any(ctx[f].islfs() for f in ctx.files()
                        if f in ctx and match(f)):
                     repo.requirements.add('lfs')
                     repo._writerequirements()
                     repo.prepushoutgoinghooks.add('lfs', wrapper.prepush)
                     break
 
         ui.setconfig('hooks', 'commit.lfs', checkrequireslfs, 'lfs')
         ui.setconfig('hooks', 'pretxnchangegroup.lfs', checkrequireslfs, 'lfs')
     else:
         repo.prepushoutgoinghooks.add('lfs', wrapper.prepush)
 
 def _trackedmatcher(repo):
     """Return a function (path, size) -> bool indicating whether or not to
     track a given file with lfs."""
     if not repo.wvfs.exists('.hglfs'):
         # No '.hglfs' in wdir.  Fallback to config for now.
         trackspec = repo.ui.config('lfs', 'track')
 
         # deprecated config: lfs.threshold
         threshold = repo.ui.configbytes('lfs', 'threshold')
         if threshold:
             fileset.parse(trackspec)  # make sure syntax errors are confined
             trackspec = "(%s) | size('>%d')" % (trackspec, threshold)
 
         return minifileset.compile(trackspec)
 
     data = repo.wvfs.tryread('.hglfs')
     if not data:
         return lambda p, s: False
 
     # Parse errors here will abort with a message that points to the .hglfs file
     # and line number.
     cfg = config.config()
     cfg.parse('.hglfs', data)
 
     try:
         rules = [(minifileset.compile(pattern), minifileset.compile(rule))
                  for pattern, rule in cfg.items('track')]
     except error.ParseError as e:
         # The original exception gives no indicator that the error is in the
         # .hglfs file, so add that.
 
         # TODO: See if the line number of the file can be made available.
         raise error.Abort(_('parse error in .hglfs: %s') % e)
 
     def _match(path, size):
         for pat, rule in rules:
             if pat(path, size):
                 return rule(path, size)
 
         return False
 
     return _match
 
 def wrapfilelog(filelog):
     wrapfunction = extensions.wrapfunction
 
     wrapfunction(filelog, 'addrevision', wrapper.filelogaddrevision)
     wrapfunction(filelog, 'renamed', wrapper.filelogrenamed)
     wrapfunction(filelog, 'size', wrapper.filelogsize)
 
 def extsetup(ui):
     wrapfilelog(filelog.filelog)
 
     wrapfunction = extensions.wrapfunction
 
     wrapfunction(cmdutil, '_updatecatformatter', wrapper._updatecatformatter)
     wrapfunction(scmutil, 'wrapconvertsink', wrapper.convertsink)
 
     wrapfunction(upgrade, '_finishdatamigration',
                  wrapper.upgradefinishdatamigration)
 
     wrapfunction(upgrade, 'preservedrequirements',
                  wrapper.upgraderequirements)
 
     wrapfunction(upgrade, 'supporteddestrequirements',
                  wrapper.upgraderequirements)
 
     wrapfunction(changegroup,
                  'allsupportedversions',
                  wrapper.allsupportedversions)
 
     wrapfunction(exchange, 'push', wrapper.push)
     wrapfunction(wireproto, '_capabilities', wrapper._capabilities)
     wrapfunction(wireprotoserver, 'handlewsgirequest',
                  wireprotolfsserver.handlewsgirequest)
 
     wrapfunction(context.basefilectx, 'cmp', wrapper.filectxcmp)
     wrapfunction(context.basefilectx, 'isbinary', wrapper.filectxisbinary)
     context.basefilectx.islfs = wrapper.filectxislfs
 
     revlog.addflagprocessor(
         revlog.REVIDX_EXTSTORED,
         (
             wrapper.readfromstore,
             wrapper.writetostore,
             wrapper.bypasscheckhash,
         ),
     )
 
     wrapfunction(hg, 'clone', wrapper.hgclone)
     wrapfunction(hg, 'postshare', wrapper.hgpostshare)
 
     scmutil.fileprefetchhooks.add('lfs', wrapper._prefetchfiles)
 
     # Make bundle choose changegroup3 instead of changegroup2. This affects
     # "hg bundle" command. Note: it does not cover all bundle formats like
     # "packed1". Using "packed1" with lfs will likely cause trouble.
     exchange._bundlespeccontentopts["v2"]["cg.version"] = "03"
 
     # bundlerepo uses "vfsmod.readonlyvfs(othervfs)", we need to make sure lfs
     # options and blob stores are passed from othervfs to the new readonlyvfs.
     wrapfunction(vfsmod.readonlyvfs, '__init__', wrapper.vfsinit)
 
     # when writing a bundle via "hg bundle" command, upload related LFS blobs
     wrapfunction(bundle2, 'writenewbundle', wrapper.writenewbundle)
 
 @filesetpredicate('lfs()', callstatus=True)
 def lfsfileset(mctx, x):
     """File that uses LFS storage."""
     # i18n: "lfs" is a keyword
     fileset.getargs(x, 0, 0, _("lfs takes no arguments"))
     return [f for f in mctx.subset
             if wrapper.pointerfromctx(mctx.ctx, f, removed=True) is not None]
 
 @templatekeyword('lfs_files', requires={'ctx'})
 def lfsfiles(context, mapping):
     """List of strings. All files modified, added, or removed by this
     changeset."""
     ctx = context.resource(mapping, 'ctx')
 
     pointers = wrapper.pointersfromctx(ctx, removed=True) # {path: pointer}
     files = sorted(pointers.keys())
 
     def pointer(v):
         # In the file spec, version is first and the other keys are sorted.
         sortkeyfunc = lambda x: (x[0] != 'version', x)
         items = sorted(pointers[v].iteritems(), key=sortkeyfunc)
         return util.sortdict(items)
 
     makemap = lambda v: {
         'file': v,
         'lfsoid': pointers[v].oid() if pointers[v] else None,
         'lfspointer': templateutil.hybriddict(pointer(v)),
     }
 
     # TODO: make the separator ', '?
     f = templateutil._showcompatlist(context, mapping, 'lfs_file', files)
     return templateutil.hybrid(f, files, makemap, pycompat.identity)
 
 @command('debuglfsupload',
          [('r', 'rev', [], _('upload large files introduced by REV'))])
 def debuglfsupload(ui, repo, **opts):
     """upload lfs blobs added by the working copy parent or given revisions"""
     revs = opts.get(r'rev', [])
     pointers = wrapper.extractpointers(repo, scmutil.revrange(repo, revs))
     wrapper.uploadblobs(repo, pointers)

hgext/lfs/wireprotolfsserver.py

@@ -1,284 +1,287 b''
 # wireprotolfsserver.py - lfs protocol server side implementation
 #
 # Copyright 2018 Matt Harbison <[e-mail]>
 #
 # This software may be used and distributed according to the terms of the
 # GNU General Public License version 2 or any later version.
 
 from __future__ import absolute_import
 
 import datetime
 import errno
 import json
 import os
 
 from mercurial.hgweb import (
     common as hgwebcommon,
 )
 
 from mercurial import (
     pycompat,
 )
 
 HTTP_OK = hgwebcommon.HTTP_OK
 HTTP_CREATED = hgwebcommon.HTTP_CREATED
 HTTP_BAD_REQUEST = hgwebcommon.HTTP_BAD_REQUEST
 
 def handlewsgirequest(orig, rctx, req, res, checkperm):
     """Wrap wireprotoserver.handlewsgirequest() to possibly process an LFS
     request if it is left unprocessed by the wrapped method.
     """
     if orig(rctx, req, res, checkperm):
         return True
 
+    if not rctx.repo.ui.configbool('experimental', 'lfs.serve'):
+        return False
+
     if not req.dispatchpath:
         return False
 
     try:
         if req.dispatchpath == b'.git/info/lfs/objects/batch':
             checkperm(rctx, req, 'pull')
             return _processbatchrequest(rctx.repo, req, res)
         # TODO: reserve and use a path in the proposed http wireprotocol /api/
         #       namespace?
         elif req.dispatchpath.startswith(b'.hg/lfs/objects'):
             return _processbasictransfer(rctx.repo, req, res,
                                          lambda perm:
                                                 checkperm(rctx, req, perm))
         return False
     except hgwebcommon.ErrorResponse as e:
         # XXX: copied from the handler surrounding wireprotoserver._callhttp()
         #      in the wrapped function.  Should this be moved back to hgweb to
         #      be a common handler?
         for k, v in e.headers:
             res.headers[k] = v
         res.status = hgwebcommon.statusmessage(e.code, pycompat.bytestr(e))
         res.setbodybytes(b'0\n%s\n' % pycompat.bytestr(e))
         return True
 
 def _sethttperror(res, code, message=None):
     res.status = hgwebcommon.statusmessage(code, message=message)
     res.headers[b'Content-Type'] = b'text/plain; charset=utf-8'
     res.setbodybytes(b'')
 
 def _processbatchrequest(repo, req, res):
     """Handle a request for the Batch API, which is the gateway to granting file
     access.
 
     https://github.com/git-lfs/git-lfs/blob/master/docs/api/batch.md
     """
 
     # Mercurial client request:
     #
     #   HOST: localhost:$HGPORT
     #   ACCEPT: application/vnd.git-lfs+json
     #   ACCEPT-ENCODING: identity
     #   USER-AGENT: git-lfs/2.3.4 (Mercurial 4.5.2+1114-f48b9754f04c+20180316)
     #   Content-Length: 125
     #   Content-Type: application/vnd.git-lfs+json
     #
     #   {
     #     "objects": [
     #       {
     #         "oid": "31cf...8e5b"
     #         "size": 12
     #       }
     #     ]
     #     "operation": "upload"
     #  }
 
     if (req.method != b'POST'
         or req.headers[b'Content-Type'] != b'application/vnd.git-lfs+json'
         or req.headers[b'Accept'] != b'application/vnd.git-lfs+json'):
         # TODO: figure out what the proper handling for a bad request to the
         #       Batch API is.
         _sethttperror(res, HTTP_BAD_REQUEST, b'Invalid Batch API request')
         return True
 
     # XXX: specify an encoding?
     lfsreq = json.loads(req.bodyfh.read())
 
     # If no transfer handlers are explicitly requested, 'basic' is assumed.
     if 'basic' not in lfsreq.get('transfers', ['basic']):
         _sethttperror(res, HTTP_BAD_REQUEST,
                       b'Only the basic LFS transfer handler is supported')
         return True
 
     operation = lfsreq.get('operation')
     if operation not in ('upload', 'download'):
         _sethttperror(res, HTTP_BAD_REQUEST,
                       b'Unsupported LFS transfer operation: %s' % operation)
         return True
 
     localstore = repo.svfs.lfslocalblobstore
 
     objects = [p for p in _batchresponseobjects(req, lfsreq.get('objects', []),
                                                 operation, localstore)]
 
     rsp = {
         'transfer': 'basic',
         'objects': objects,
     }
 
     res.status = hgwebcommon.statusmessage(HTTP_OK)
     res.headers[b'Content-Type'] = b'application/vnd.git-lfs+json'
     res.setbodybytes(pycompat.bytestr(json.dumps(rsp)))
 
     return True
 
 def _batchresponseobjects(req, objects, action, store):
     """Yield one dictionary of attributes for the Batch API response for each
     object in the list.
 
     req: The parsedrequest for the Batch API request
     objects: The list of objects in the Batch API object request list
     action: 'upload' or 'download'
     store: The local blob store for servicing requests"""
 
     # Successful lfs-test-server response to solict an upload:
     # {
     #    u'objects': [{
     #       u'size': 12,
     #       u'oid': u'31cf...8e5b',
     #       u'actions': {
     #           u'upload': {
     #               u'href': u'http://localhost:$HGPORT/objects/31cf...8e5b',
     #               u'expires_at': u'0001-01-01T00:00:00Z',
     #               u'header': {
     #                   u'Accept': u'application/vnd.git-lfs'
     #               }
     #           }
     #       }
     #    }]
     # }
 
     # TODO: Sort out the expires_at/expires_in/authenticated keys.
 
     for obj in objects:
         # Convert unicode to ASCII to create a filesystem path
         oid = obj.get('oid').encode('ascii')
         rsp = {
             'oid': oid,
             'size': obj.get('size'),  # XXX: should this check the local size?
             #'authenticated': True,
         }
 
         exists = True
         verifies = False
 
         # Verify an existing file on the upload request, so that the client is
         # solicited to re-upload if it corrupt locally.  Download requests are
         # also verified, so the error can be flagged in the Batch API response.
         # (Maybe we can use this to short circuit the download for `hg verify`,
         # IFF the client can assert that the remote end is an hg server.)
         # Otherwise, it's potentially overkill on download, since it is also
         # verified as the file is streamed to the caller.
         try:
             verifies = store.verify(oid)
         except IOError as inst:
             if inst.errno != errno.ENOENT:
                 rsp['error'] = {
                     'code': 500,
                     'message': inst.strerror or 'Internal Server Server'
                 }
                 yield rsp
                 continue
 
             exists = False
 
         # Items are always listed for downloads.  They are dropped for uploads
         # IFF they already exist locally.
         if action == 'download':
             if not exists:
                 rsp['error'] = {
                     'code': 404,
                     'message': "The object does not exist"
                 }
                 yield rsp
                 continue
 
             elif not verifies:
                 rsp['error'] = {
                     'code': 422,   # XXX: is this the right code?
                     'message': "The object is corrupt"
                 }
                 yield rsp
                 continue
 
         elif verifies:
             yield rsp  # Skip 'actions': already uploaded
             continue
 
         expiresat = datetime.datetime.now() + datetime.timedelta(minutes=10)
 
         rsp['actions'] = {
             '%s' % action: {
                 # TODO: Account for the --prefix, if any.
                 'href': '%s/.hg/lfs/objects/%s' % (req.baseurl, oid),
                 # datetime.isoformat() doesn't include the 'Z' suffix
                 "expires_at": expiresat.strftime('%Y-%m-%dT%H:%M:%SZ'),
                 'header': {
                     # The spec doesn't mention the Accept header here, but avoid
                     # a gratuitous deviation from lfs-test-server in the test
                     # output.
                     'Accept': 'application/vnd.git-lfs'
                 }
             }
         }
 
         yield rsp
 
 def _processbasictransfer(repo, req, res, checkperm):
     """Handle a single file upload (PUT) or download (GET) action for the Basic
     Transfer Adapter.
 
     After determining if the request is for an upload or download, the access
     must be checked by calling ``checkperm()`` with either 'pull' or 'upload'
     before accessing the files.
 
     https://github.com/git-lfs/git-lfs/blob/master/docs/api/basic-transfers.md
     """
 
     method = req.method
     oid = os.path.basename(req.dispatchpath)
     localstore = repo.svfs.lfslocalblobstore
 
     if method == b'PUT':
         checkperm('upload')
 
         # TODO: verify Content-Type?
 
         existed = localstore.has(oid)
 
         # TODO: how to handle timeouts?  The body proxy handles limiting to
         #       Content-Length, but what happens if a client sends less than it
         #       says it will?
 
         # TODO: download() will abort if the checksum fails.  It should raise
         #       something checksum specific that can be caught here, and turned
         #       into an http code.
         localstore.download(oid, req.bodyfh)
 
         statusmessage = hgwebcommon.statusmessage
         res.status = statusmessage(HTTP_OK if existed else HTTP_CREATED)
 
         # There's no payload here, but this is the header that lfs-test-server
         # sends back.  This eliminates some gratuitous test output conditionals.
         res.headers[b'Content-Type'] = b'text/plain; charset=utf-8'
         res.setbodybytes(b'')
 
         return True
     elif method == b'GET':
         checkperm('pull')
 
         res.status = hgwebcommon.statusmessage(HTTP_OK)
         res.headers[b'Content-Type'] = b'application/octet-stream'
 
         # TODO: figure out how to send back the file in chunks, instead of
         #       reading the whole thing.
         res.setbodybytes(localstore.read(oid))
 
         return True
     else:
         _sethttperror(res, HTTP_BAD_REQUEST,
                       message=b'Unsupported LFS transfer method: %s' % method)
         return True