GitLab

* fix: allow requests from electron renderer

The Electron Renderer process runs in an embedded  browser window so
has access to browser-native `fetch`.  If this is used by
`ipfs-http-client` to make requests against the HTTP API, the
`User-Agent` header is set to a value that looks similar to a browser
but no `Origin` or `Referer` headers are sent.

The change here is to relax the user agent check to allow through
requests from clients with `'Electron'` in their user agents.

* refactor: move environment-based command restrictions to be stored with the command itself

Fix build on Plan 9

build(deps): bump github.com/ipfs/go-log from 1.0.3 to 1.0.4

Fix go-ipfs#7242: Remove "HEAD" from Allow methods

(when GET is not allowed).

* Staticcheck fixes

This fixes all staticcheck warnings for this library.

doc: update docs for interface changes

Bumps [github.com/ipfs/go-log](https://github.com/ipfs/go-log) from 1.0.3 to 1.0.4.
- [Release notes](https://github.com/ipfs/go-log/releases)
- [Commits](https://github.com/ipfs/go-log/compare/v1.0.3...v1.0.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Fix: disallow POST without Origin nor Referer from specific user agents

Addresses browsers being able to POST without control due to things like
https://bugzilla.mozilla.org/show_bug.cgi?id=429594

doc: document command fields

change HandledMethods to AllowGet and cleanup method handling

Allowing methods isn't as simple as just allowing/disallowing them because
different methods do different things.

* HEAD: should be allowed everywhere GET is allowed.
* OPTIONS:
  * When a CORS request is made, this will be handled by the CORS library.
  * Otherewise, we need to return the allowed methods.
* POST: always allowed.
* Everything else: always denied.

Changing HandledMethods to a simple AllowGet makes it easier to "do the right
thing".

remove deprecated log.Warning(f)

Part of the work to unblock: https://github.com/ipfs/go-log/pull/65

http: configurable allowed request methods for the API.

This Handler option is used it to allow/deny request by their method.

The API is an RPC API so it normally should only work with PUT, but we also
use a read-only, GET-based partial API that runs with the gateway.

This commit makes the actual allowed (or handled) methods configurable.

A test is added, and test facilities improved to be able to set/modify
this option.

build(deps): bump github.com/ipfs/go-ipfs-files from 0.0.7 to 0.0.8

Bumps [github.com/ipfs/go-ipfs-files](https://github.com/ipfs/go-ipfs-files) from 0.0.7 to 0.0.8.
- [Release notes](https://github.com/ipfs/go-ipfs-files/releases)
- [Commits](https://github.com/ipfs/go-ipfs-files/compare/v0.0.7...v0.0.8)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

#183 refactored the request options conversion code per the ticket requirements

fix typo

Now options are converted and saved before the request object is generated

fix: normalize options when parsing them

We introduced a bug where we forgot to do this and couldn't find the definition
for the option.

This _also_ fixes (and tests) a bug where we'd allow duplicate flags in some
cases.