gnodet-bot commented on code in PR #2211:
URL: https://github.com/apache/maven-resolver/pull/2211#discussion_r4327886176
##########
maven-resolver-api/src/main/java/org/eclipse/aether/ConfigurationProperties.java:
##########
@@ -253,16 +253,90 @@ public final class ConfigurationProperties {
* a redirect - including redirects that leave the repository origin.
Avoid placing credentials (for example
* {@code Authorization}, cookies or private token headers) in this map
where repository authentication can be
* used instead: repository authentication is negotiated per host. All
shipped HTTP transports scope configured
- * headers to the repository origin by default, see the per-transport
{@code originScopedHeaders} configuration
- * keys ({@code aether.transport.apache.originScopedHeaders}, {@code
aether.transport.jdk.originScopedHeaders},
- * {@code aether.transport.jetty.originScopedHeaders}).
+ * headers to the repository origin by default, controlled by {@link
#HTTP_ORIGIN_SCOPED_HEADERS}.
*
* @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
* @configurationType {@link java.util.Map}
* @configurationRepoIdSuffix Yes
*/
public static final String HTTP_HEADERS = PREFIX_TRANSPORT_HTTP +
"headers";
+ public enum RedirectMode {
+ /**
+ * No redirects allowed.
+ */
+ NONE,
+ /**
+ * Redirects only within same authority.
+ */
+ SAME_AUTHORITY,
+ /**
+ * Any redirect is followed.
+ */
+ ANY
+ }
+
+ /**
+ * Optionally restricts HTTP redirects to either the same authority or not
allowing any redirects at all.
+ * By default, any redirect is followed.
+ * Blocked redirects lead to exceptions being thrown by the transport.
+ *
+ * @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
+ * @configurationType {@link ConfigurationProperties.RedirectMode}
+ * @configurationDefaultValue {@link #HTTP_REDIRECT_MODE}
+ * @configurationRepoIdSuffix Yes
+ * @since 2.0.25
+ * @see {@link #HTTP_ORIGIN_SCOPED_HEADERS} for restricing headers passed
to redirect targets
+ * @see {@link #HTTP_FOLLOW_INSECURE_REDIRECT} for controlling whether
HTTPS-to-HTTP redirects are followed
+ */
+ public static final String HTTP_REDIRECT_MODE = PREFIX_TRANSPORT_HTTP +
"redirectMode";
Review Comment:
⚠️ **Javadoc: `@configurationDefaultValue` references the key, not the
default; `@see` tags are malformed; typo in `@see` description**
The `@configurationDefaultValue` tag should reference the actual default
value constant (`DEFAULT_REDIRECT_MODE`), not the key constant
(`HTTP_REDIRECT_MODE`). The `@see` tags use non-standard `{@link}` nesting
(just use `@see #ConstantName`). Also "restricing" should be "restricting".
```suggestion
* @configurationType {@link ConfigurationProperties.RedirectMode}
* @configurationDefaultValue {@link #DEFAULT_REDIRECT_MODE}
* @configurationRepoIdSuffix Yes
* @since 2.0.25
* @see #HTTP_ORIGIN_SCOPED_HEADERS
* @see #HTTP_FOLLOW_INSECURE_REDIRECT
```
##########
maven-resolver-api/src/main/java/org/eclipse/aether/ConfigurationProperties.java:
##########
@@ -253,16 +253,90 @@ public final class ConfigurationProperties {
* a redirect - including redirects that leave the repository origin.
Avoid placing credentials (for example
* {@code Authorization}, cookies or private token headers) in this map
where repository authentication can be
* used instead: repository authentication is negotiated per host. All
shipped HTTP transports scope configured
- * headers to the repository origin by default, see the per-transport
{@code originScopedHeaders} configuration
- * keys ({@code aether.transport.apache.originScopedHeaders}, {@code
aether.transport.jdk.originScopedHeaders},
- * {@code aether.transport.jetty.originScopedHeaders}).
+ * headers to the repository origin by default, controlled by {@link
#HTTP_ORIGIN_SCOPED_HEADERS}.
*
* @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
* @configurationType {@link java.util.Map}
* @configurationRepoIdSuffix Yes
*/
public static final String HTTP_HEADERS = PREFIX_TRANSPORT_HTTP +
"headers";
+ public enum RedirectMode {
Review Comment:
💡 **`RedirectMode` enum is missing a `@since` tag**
This is a new public API type. The enum declaration itself should have a
Javadoc block with `@since 2.0.25` (each field constant also having it is not
sufficient — the type-level tag is needed for tooling and API docs).
##########
maven-resolver-api/src/main/java/org/eclipse/aether/ConfigurationProperties.java:
##########
@@ -253,16 +253,90 @@ public final class ConfigurationProperties {
* a redirect - including redirects that leave the repository origin.
Avoid placing credentials (for example
* {@code Authorization}, cookies or private token headers) in this map
where repository authentication can be
* used instead: repository authentication is negotiated per host. All
shipped HTTP transports scope configured
- * headers to the repository origin by default, see the per-transport
{@code originScopedHeaders} configuration
- * keys ({@code aether.transport.apache.originScopedHeaders}, {@code
aether.transport.jdk.originScopedHeaders},
- * {@code aether.transport.jetty.originScopedHeaders}).
+ * headers to the repository origin by default, controlled by {@link
#HTTP_ORIGIN_SCOPED_HEADERS}.
*
* @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
* @configurationType {@link java.util.Map}
* @configurationRepoIdSuffix Yes
*/
public static final String HTTP_HEADERS = PREFIX_TRANSPORT_HTTP +
"headers";
+ public enum RedirectMode {
+ /**
+ * No redirects allowed.
+ */
+ NONE,
+ /**
+ * Redirects only within same authority.
+ */
+ SAME_AUTHORITY,
+ /**
+ * Any redirect is followed.
+ */
+ ANY
+ }
+
+ /**
+ * Optionally restricts HTTP redirects to either the same authority or not
allowing any redirects at all.
+ * By default, any redirect is followed.
+ * Blocked redirects lead to exceptions being thrown by the transport.
+ *
+ * @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
+ * @configurationType {@link ConfigurationProperties.RedirectMode}
+ * @configurationDefaultValue {@link #HTTP_REDIRECT_MODE}
+ * @configurationRepoIdSuffix Yes
+ * @since 2.0.25
+ * @see {@link #HTTP_ORIGIN_SCOPED_HEADERS} for restricing headers passed
to redirect targets
+ * @see {@link #HTTP_FOLLOW_INSECURE_REDIRECT} for controlling whether
HTTPS-to-HTTP redirects are followed
+ */
+ public static final String HTTP_REDIRECT_MODE = PREFIX_TRANSPORT_HTTP +
"redirectMode";
+
+ /**
+ * Default value if {@link #HTTP_REDIRECT_MODE} is not set.
+ *
+ * @since 2.0.25
+ */
+ public static final RedirectMode DEFAULT_REDIRECT_MODE = RedirectMode.ANY;
+
+ /**
+ * If enabled (default), HTTP transports only send configured request
headers and preemptively applied
+ * {@code Authorization} on requests targeting the repository origin.
+ *
+ * @configurationSource {@link
RepositorySystemSession#getConfigProperties()}
+ * @configurationType {@link java.lang.Boolean}
+ * @configurationDefaultValue {@link #DEFAULT_HTTP_ORIGIN_SCOPED_HEADERS}
+ * @configurationRepoIdSuffix Yes
+ * @since 2.0.25
+ * @see {@link#HTTP_REDIRECT_MODE} for controlling the behavior of HTTP
redirects
Review Comment:
💡 **Malformed `{@link#...}` — missing space before `#`**
`{@link#HTTP_REDIRECT_MODE}` is missing the space between `@link` and `#`,
which causes this Javadoc link to silently fail. Also, `@see {@link ...}` is
non-standard — use `@see #ConstantName` directly.
```suggestion
* @see #HTTP_REDIRECT_MODE
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
