fix gitea oauth

internal/app/auth.go

@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"log"
 	"net/http"
 	"net/url"
 	"strings"
@@ -90,6 +91,7 @@ func (s *Server) handleCallback(w http.ResponseWriter, r *http.Request) {
 
 	user, err := s.exchangeOAuthCode(r.Context(), code)
 	if err != nil {
+		log.Printf("Gitea OAuth code exchange failed: %v", err)
 		http.Error(w, "Gitea sign-in failed", http.StatusBadGateway)
 		return
 	}
@@ -154,7 +156,7 @@ func (s *Server) exchangeOAuthCode(ctx context.Context, code string) (giteaUser,
 	request, err := http.NewRequestWithContext(
 		ctx,
 		http.MethodPost,
-		joinURL(s.cfg.GiteaURL, "/login/oauth/access_token"),
+		joinURL(s.cfg.GiteaInternalURL, "/login/oauth/access_token"),
 		strings.NewReader(form.Encode()),
 	)
 	if err != nil {
@@ -181,7 +183,7 @@ func (s *Server) exchangeOAuthCode(ctx context.Context, code string) (giteaUser,
 	request, err = http.NewRequestWithContext(
 		ctx,
 		http.MethodGet,
-		joinURL(s.cfg.GiteaURL, "/api/v1/user"),
+		joinURL(s.cfg.GiteaInternalURL, "/api/v1/user"),
 		nil,
 	)
 	if err != nil {

internal/app/config.go

@@ -15,6 +15,7 @@ type Config struct {
 	PublicURL         *url.URL
 	DatabaseDSN       string
 	GiteaURL          *url.URL
+	GiteaInternalURL  *url.URL
 	GiteaClientID     string
 	GiteaClientSecret string
 	GiteaPackageOwner string
@@ -65,6 +66,14 @@ func LoadConfig() (Config, error) {
 	if err != nil {
 		return cfg, err
 	}
+	cfg.GiteaInternalURL, err = parseURLValue(
+		"TAPM_GITEA_INTERNAL_URL",
+		envDefault("TAPM_GITEA_INTERNAL_URL", "http://gitea:3000"),
+		true,
+	)
+	if err != nil {
+		return cfg, err
+	}
 	cfg.CookieSecure = cfg.PublicURL.Scheme == "https"
 
 	cfg.DefaultDuration, err = time.ParseDuration(
@@ -137,7 +146,10 @@ func LoadConfig() (Config, error) {
 }
 
 func parseAbsoluteURL(name string, allowInsecureHTTP bool) (*url.URL, error) {
-	raw := os.Getenv(name)
+	return parseURLValue(name, os.Getenv(name), allowInsecureHTTP)
+}
+
+func parseURLValue(name string, raw string, allowInsecureHTTP bool) (*url.URL, error) {
 	parsed, err := url.Parse(raw)
 	validScheme := parsed != nil && parsed.Scheme == "https"
 	if allowInsecureHTTP && parsed != nil && parsed.Scheme == "http" {

internal/app/config_test.go

@@ -47,4 +47,19 @@ func TestHTTPSConfigUsesSecureCookies(t *testing.T) {
 	if !cfg.CookieSecure {
 		t.Fatal("HTTPS mode did not enable secure cookies")
 	}
+	if got := cfg.GiteaInternalURL.String(); got != "http://gitea:3000" {
+		t.Fatalf("GiteaInternalURL = %q, want private Compose URL", got)
+	}
+}
+
+func TestConfigAcceptsExplicitInternalGiteaURL(t *testing.T) {
+	setRequiredConfigEnvironment(t, "https")
+	t.Setenv("TAPM_GITEA_INTERNAL_URL", "http://gitea-test:3000")
+	cfg, err := LoadConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := cfg.GiteaInternalURL.String(); got != "http://gitea-test:3000" {
+		t.Fatalf("GiteaInternalURL = %q, want configured private URL", got)
+	}
 }

internal/app/download.go

@@ -372,7 +372,7 @@ func (s *Server) handlePackageDownload(w http.ResponseWriter, r *http.Request) {
 	}
 
 	registryURL := joinURL(
-		s.cfg.GiteaURL,
+		s.cfg.GiteaInternalURL,
 		fmt.Sprintf(
 			"/api/packages/%s/generic/%s/%s/%s",
 			url.PathEscape(s.cfg.GiteaPackageOwner),

internal/app/upload.go

@@ -240,7 +240,7 @@ func (s *Server) streamPackageToGitea(
 	source io.Reader,
 ) (string, int64, int, error) {
 	registryURL := joinURL(
-		s.cfg.GiteaURL,
+		s.cfg.GiteaInternalURL,
 		fmt.Sprintf(
 			"/api/packages/%s/generic/%s/%s/%s",
 			url.PathEscape(s.cfg.GiteaPackageOwner),
@@ -289,7 +289,7 @@ func (s *Server) deletePackageVersion(
 	packageVersion string,
 ) error {
 	registryURL := joinURL(
-		s.cfg.GiteaURL,
+		s.cfg.GiteaInternalURL,
 		fmt.Sprintf(
 			"/api/packages/%s/generic/%s/%s",
 			url.PathEscape(s.cfg.GiteaPackageOwner),

internal/app/upload_test.go

@@ -59,6 +59,7 @@ func TestStreamPackageToGitea(t *testing.T) {
 	server := &Server{
 		cfg: Config{
 			GiteaURL:          registryURL,
+			GiteaInternalURL:  registryURL,
 			GiteaPackageOwner: "TAI",
 			GiteaWriteUser:    "publisher",
 			GiteaWriteToken:   "write-token",
@@ -112,6 +113,7 @@ func TestDeletePackageVersion(t *testing.T) {
 	server := &Server{
 		cfg: Config{
 			GiteaURL:          registryURL,
+			GiteaInternalURL:  registryURL,
 			GiteaPackageOwner: "TAI",
 			GiteaWriteUser:    "publisher",
 			GiteaWriteToken:   "write-token",