From 25c141902fa0dfae88622f8e61ea2e915a9f02e4 Mon Sep 17 00:00:00 2001
From: Marc Ole Bulling <Marc-Ole@gmx.de>
Date: Wed, 14 May 2025 11:36:22 +0200
Subject: [PATCH] Add feature that disallows reverting append-only mode

---
 .env.sample                               |  5 ++++-
 Containers/RepoManage/RepoManage.tsx      | 16 ++++++++++++----
 pages/api/v1/repositories/[slug]/index.ts |  9 +++++++++
 3 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/.env.sample b/.env.sample
index 68d3bf0a..bdb9d6bf 100644
--- a/.env.sample
+++ b/.env.sample
@@ -35,6 +35,9 @@ SSH_SERVER_PORT_LAN=
 # Disable the DELETE feature
 #DISABLE_DELETE_REPO=true
 
+# Do not allow to remove append-only mode, once set
+#DISABLE_REVERT_APPEND_ONLY=true
+
 # Disable the integrations (API tokens to CRUD repositories)
 #DISABLE_INTEGRATIONS=true
 
@@ -50,4 +53,4 @@ MAIL_SMTP_PWD=
 MAIL_REJECT_SELFSIGNED_TLS=
 
 # Force app to start on IPv6
-#HOSTNAME=::
\ No newline at end of file
+#HOSTNAME=::
diff --git a/Containers/RepoManage/RepoManage.tsx b/Containers/RepoManage/RepoManage.tsx
index 6bd4f8b2..503413f2 100644
--- a/Containers/RepoManage/RepoManage.tsx
+++ b/Containers/RepoManage/RepoManage.tsx
@@ -221,10 +221,18 @@ export default function RepoManage(props: RepoManageProps) {
             );
             router.replace('/');
           } else {
-            const errorMessage = await response.json();
-            toast.error(`An error has occurred : ${errorMessage.message.stderr}`, toastOptions);
-            router.replace('/');
-            console.log(`Fail to ${props.mode}`);
+            if (response.status == 403) {
+              toast.warning(
+                '🔒 The server is currently protected against reverting append-only mode.',
+                toastOptions
+              );
+              router.replace('/');
+            } else {
+              const errorMessage = await response.json();
+              toast.error(`An error has occurred : ${errorMessage.message.stderr}`, toastOptions);
+              router.replace('/');
+              console.log(`Fail to ${props.mode}`);
+            }
           }
         })
         .catch((error) => {
diff --git a/pages/api/v1/repositories/[slug]/index.ts b/pages/api/v1/repositories/[slug]/index.ts
index 283ac868..a2b3843c 100644
--- a/pages/api/v1/repositories/[slug]/index.ts
+++ b/pages/api/v1/repositories/[slug]/index.ts
@@ -94,6 +94,15 @@ export default async function handler(
             'The SSH key is already used in another repository. Please use another key or delete the key from the other repository.',
         });
       }
+      if (repo.appendOnlyMode && appendOnlyMode === false) {
+	  if (process.env.DISABLE_REVERT_APPEND_ONLY === "true") {
+	    res.status(403).json({
+	    status: 403,
+	    message: 'Reverting Append-Only mode is disabled on this server',
+	    });
+	  return;
+	}
+      }
 
       const updatedRepo: Repository = {
         ...repo,