refactor(cache): redesign cache system with structured keys and improved performance

- Add repo_path parameter to cached_response and cached_vec_response functions
- Implement structured cache key format with namespace, repo_path, and request proto
- Replace global cache with Moka in-memory cache using weight-based eviction
- Set 256MB memory cap with 10-minute TTL and 2-minute TTI policy
- Add metrics collection for cache operations and evictions
- Implement efficient repo-scoped invalidation using key structure
- Add detailed documentation comments explaining cache architecture
- Remove outdated dependencies and update dependency versions
- Add error handling for encoding failures in cache operations
- Optimize Vec responses with length-delimited encoding and pre-allocation

tree/get_file_metadata.rs

@@ -8,6 +8,7 @@ use crate::tree;
 
 impl GitBare {
     pub fn get_file_metadata(&self, request: GetFileMetadataRequest) -> GitResult<FileMetadata> {
+        crate::sanitize::validate_file_path(&request.path)?;
         let repo = self.gix_repo()?;
         let revision = resolve_revision!(request.revision);
         let tree = repo

tree/list_tree.rs

@@ -5,11 +5,16 @@ use crate::error::{GitError, GitResult};
 use crate::paginate;
 use crate::pb::{ListTreeRequest, ListTreeResponse, TreeEntry, object_selector, tree_entry};
 
+const MAX_RECURSIVE_TREE_DEPTH: usize = 256;
+
 impl GitBare {
     pub fn list_tree(&self, request: ListTreeRequest) -> GitResult<ListTreeResponse> {
         let repo = self.gix_repo()?;
         let revision = match request.revision.clone().and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
+            Some(object_selector::Selector::Oid(oid)) => {
+                crate::sanitize::validate_oid_hex(&oid.hex)?;
+                oid.hex
+            }
             Some(object_selector::Selector::Revision(name)) => {
                 crate::sanitize::validate_revision(&name.revision)?;
                 name.revision
@@ -22,6 +27,17 @@ impl GitBare {
             .try_into_tree()
             .map_err(|e| GitError::Gix(e.to_string()))?;
         if !request.path.is_empty() {
+            crate::sanitize::validate_file_path(&request.path)?;
+            let depth = request
+                .path
+                .split('/')
+                .filter(|part| !part.is_empty())
+                .count();
+            if depth > MAX_RECURSIVE_TREE_DEPTH {
+                return Err(GitError::InvalidArgument(format!(
+                    "tree depth exceeds maximum of {MAX_RECURSIVE_TREE_DEPTH}"
+                )));
+            }
             let entry = tree
                 .lookup_entry_by_path(&request.path)?
                 .ok_or_else(|| GitError::NotFound(request.path.clone()))?;
@@ -43,6 +59,7 @@ impl GitBare {
             };
             let kind = entry.kind();
             let hex = entry.id().to_string();
+            let child_path = path.clone();
             entries.push(TreeEntry {
                 name,
                 path,
@@ -55,7 +72,6 @@ impl GitBare {
             });
 
             if request.recursive && matches!(kind, EntryKind::Tree) {
-                let child_path = entries.last().unwrap().path.clone();
                 let child = self.list_tree(ListTreeRequest {
                     repository: request.repository.clone(),
                     revision: request.revision.clone(),

tree/mod.rs

@@ -10,7 +10,10 @@ pub(crate) fn resolve_revision(
     sel: &Option<pb::ObjectSelector>,
 ) -> Result<String, crate::error::GitError> {
     match sel.as_ref().and_then(|s| s.selector.as_ref()) {
-        Some(object_selector::Selector::Oid(oid)) => Ok(oid.hex.clone()),
+        Some(object_selector::Selector::Oid(oid)) => {
+            crate::sanitize::validate_oid_hex(&oid.hex)?;
+            Ok(oid.hex.clone())
+        }
         Some(object_selector::Selector::Revision(name)) => {
             crate::sanitize::validate_revision(&name.revision)?;
             Ok(name.revision.clone())