harden rpm virtual redirects, fail closed, keep data files resolvable

- reject absolute and dot-segment member paths, escape the target, keep the query
- return 502 when any member's repodata can't be fetched
- serve recently merged data files by hash for 5m after repomd changes
- fold xml:base under a member upstream into the virtual href

internal/virtual/engine.go

@@ -8,9 +8,11 @@ import (
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"slices"
 	"strings"
 	"sync"
+	"time"
 
 	"git.unkin.net/unkin/artifactapi/internal/database"
 	"git.unkin.net/unkin/artifactapi/internal/provider"
@@ -21,10 +23,26 @@ import (
 type Engine struct {
 	db          *database.DB
 	proxyEngine *proxy.Engine
+	getRemote   func(context.Context, string) (*models.Remote, error)
+	rpmMember   func(context.Context, string) (*RPMMember, error)
+
+	mu       sync.Mutex
+	rpmFiles map[string]rpmFile
 }
 
+type rpmFile struct {
+	body    []byte
+	expires time.Time
+}
+
+// rpmFileTTL keeps content-hashed data files resolvable after repomd moves on,
+// so a client that fetched the previous repomd can still fetch its data.
+const rpmFileTTL = 5 * time.Minute
+
 func NewEngine(db *database.DB, proxyEngine *proxy.Engine) *Engine {
-	return &Engine{db: db, proxyEngine: proxyEngine}
+	e := &Engine{db: db, proxyEngine: proxyEngine, getRemote: db.GetRemote}
+	e.rpmMember = e.fetchRPMMember
+	return e
 }
 
 func (e *Engine) Fetch(ctx context.Context, virt models.Virtual, path string, proxyBaseURL string) ([]byte, string, error) {
@@ -143,61 +161,89 @@ func (e *Engine) fetchLocalIndex(ctx context.Context, remote models.Remote, path
 	return indexer.GenerateLocalIndex(ctx, e.db, remote.Name, path)
 }
 
-var ErrNotFound = errors.New("not found")
+var (
+	ErrNotFound = errors.New("not found")
+	ErrBadPath  = errors.New("invalid path")
+)
 
 // MemberRedirect maps an rpm virtual package path (<member>/<href>, as written
-// by MergeRPM) to the owning member's route. ok is false for any other path.
-func (e *Engine) MemberRedirect(ctx context.Context, virt models.Virtual, path, proxyBaseURL string) (string, bool) {
+// by MergeRPM) to the owning member's route. ok is false for any other path;
+// ErrBadPath means the path is absolute or escapes the member.
+func (e *Engine) MemberRedirect(ctx context.Context, virt models.Virtual, path, rawQuery, proxyBaseURL string) (string, bool, error) {
 	if virt.PackageType != models.PackageRPM || strings.HasPrefix(path, "repodata/") {
-		return "", false
+		return "", false, nil
 	}
 	name, rest, found := strings.Cut(path, "/")
 	if !found || !slices.Contains(virt.Members, name) {
-		return "", false
+		return "", false, nil
 	}
-	remote, err := e.db.GetRemote(ctx, name)
+	segs, err := memberSegments(rest)
 	if err != nil {
-		return "", false
+		return "", false, err
 	}
-	return fmt.Sprintf("%s/api/v1/%s/%s/%s", strings.TrimRight(proxyBaseURL, "/"), remote.RepoType, name, rest), true
+	remote, err := e.getRemote(ctx, name)
+	if err != nil {
+		return "", false, nil
+	}
+	loc := fmt.Sprintf("%s/api/v1/%s/%s/%s", strings.TrimRight(proxyBaseURL, "/"), remote.RepoType, url.PathEscape(name), strings.Join(segs, "/"))
+	if rawQuery != "" {
+		loc += "?" + rawQuery
+	}
+	return loc, true, nil
+}
+
+// memberSegments decodes rest and returns its path-escaped segments, rejecting
+// absolute paths and any "." or ".." segment.
+func memberSegments(rest string) ([]string, error) {
+	dec, err := url.PathUnescape(rest)
+	if err != nil || dec == "" || strings.HasPrefix(dec, "/") {
+		return nil, ErrBadPath
+	}
+	segs := strings.Split(dec, "/")
+	for i, s := range segs {
+		if s == "." || s == ".." || strings.Contains(s, "\\") {
+			return nil, ErrBadPath
+		}
+		segs[i] = url.PathEscape(s)
+	}
+	return segs, nil
 }
 
 func (e *Engine) fetchRPM(ctx context.Context, virt models.Virtual, path string) ([]byte, string, error) {
 	if !strings.HasPrefix(path, "repodata/") {
 		return nil, "", ErrNotFound
 	}
+	if path != "repodata/repomd.xml" {
+		if body, ok := e.cachedRPMFile(path); ok {
+			return body, "application/gzip", nil
+		}
+	}
 
-	results := make([]*RPMMember, len(virt.Members))
+	members := make([]RPMMember, len(virt.Members))
+	errs := make([]error, len(virt.Members))
 	var wg sync.WaitGroup
 	for i, name := range virt.Members {
 		wg.Add(1)
 		go func() {
 			defer wg.Done()
-			m, err := e.fetchRPMMember(ctx, name)
+			m, err := e.rpmMember(ctx, name)
 			if err != nil {
-				slog.Warn("virtual member fetch failed", "virtual", virt.Name, "member", name, "error", err)
+				errs[i] = fmt.Errorf("member %q: %w", name, err)
 				return
 			}
-			results[i] = m
+			members[i] = *m
 		}()
 	}
 	wg.Wait()
-
-	var members []RPMMember
-	for _, m := range results {
-		if m != nil {
-			members = append(members, *m)
-		}
-	}
-	if len(members) == 0 {
-		return nil, "", fmt.Errorf("no members reachable for virtual %q", virt.Name)
+	if err := errors.Join(errs...); err != nil {
+		return nil, "", fmt.Errorf("virtual %q: %w", virt.Name, err)
 	}
 
-	// ponytail: merges on every repodata request; cache keyed on member repomd checksums if member count/size makes this slow.
 	repo, err := MergeRPM(members)
 	if err != nil {
 		return nil, "", fmt.Errorf("merge rpm repodata: %w", err)
 	}
+	e.storeRPMFiles(repo.Files)
 	if path == "repodata/repomd.xml" {
 		return repo.Repomd, "application/xml", nil
 	}
@@ -207,8 +253,38 @@ func (e *Engine) fetchRPM(ctx context.Context, virt models.Virtual, path string)
 	return nil, "", ErrNotFound
 }
 
+// ponytail: per-replica cache; behind a non-sticky LB a data request landing on
+// another replica re-merges and 404s if a member changed in between. Move to the
+// shared redis cache if that shows up.
+func (e *Engine) storeRPMFiles(files map[string][]byte) {
+	now := time.Now()
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	if e.rpmFiles == nil {
+		e.rpmFiles = map[string]rpmFile{}
+	}
+	for k, f := range e.rpmFiles {
+		if now.After(f.expires) {
+			delete(e.rpmFiles, k)
+		}
+	}
+	for k, body := range files {
+		e.rpmFiles[k] = rpmFile{body: body, expires: now.Add(rpmFileTTL)}
+	}
+}
+
+func (e *Engine) cachedRPMFile(path string) ([]byte, bool) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	f, ok := e.rpmFiles[path]
+	if !ok || time.Now().After(f.expires) {
+		return nil, false
+	}
+	return f.body, true
+}
+
 func (e *Engine) fetchRPMMember(ctx context.Context, name string) (*RPMMember, error) {
-	remote, err := e.db.GetRemote(ctx, name)
+	remote, err := e.getRemote(ctx, name)
 	if err != nil {
 		return nil, fmt.Errorf("remote %q: %w", name, err)
 	}
@@ -220,7 +296,7 @@ func (e *Engine) fetchRPMMember(ctx context.Context, name string) (*RPMMember, e
 	if err != nil {
 		return nil, err
 	}
-	m := &RPMMember{RemoteName: name, Timestamp: ts, Data: map[string][]byte{}}
+	m := &RPMMember{RemoteName: name, Bases: remote.UpstreamPool(), Timestamp: ts, Data: map[string][]byte{}}
 	for t, href := range locs {
 		raw, err := e.fetchMemberPath(ctx, *remote, href)
 		if err != nil {