refactor(server): replace custom remote clients with macro-based implementation

- Replaced manual remote client functions with remote_client! macro for archive, blame, branch, commit, and diff services
- Simplified remote client creation logic using declarative macro approach
- Maintained same functionality while reducing code duplication across services

security(bare): enhance path traversal protection with comprehensive validation

- Added early relative_path validation to prevent path traversal attacks
- Implemented unified path validation to avoid TOCTOU race conditions
- Enhanced canonicalization checks for both existing and non-existent paths
- Added detailed logging for path traversal detection attempts

feat(cache): migrate from CLruCache to Moka with TTL and invalidation support

- Replaced clru dependency with moka for improved caching capabilities
- Added 300-second time-to-live for cache entries
- Implemented repository-specific cache invalidation mechanism
- Enhanced cache operations with thread-safe async support

refactor(commit): improve security validation for commit operations

- Added ref name validation to prevent command injection in cherry_pick_commit
- Implemented revision validation for commit selectors
- Added comprehensive input validation for create_commit parameters
- Enhanced file path validation to prevent traversal

tree/get_file_metadata.rs

@@ -2,17 +2,14 @@ use gix::object::tree::EntryKind;
 
 use crate::bare::GitBare;
 use crate::error::{GitError, GitResult};
-use crate::pb::{FileMetadata, GetFileMetadataRequest, ObjectType, object_selector};
+use crate::pb::{FileMetadata, GetFileMetadataRequest, ObjectType};
+use crate::resolve_revision;
 use crate::tree;
 
 impl GitBare {
     pub fn get_file_metadata(&self, request: GetFileMetadataRequest) -> GitResult<FileMetadata> {
         let repo = self.gix_repo()?;
-        let revision = match request.revision.and_then(|s| s.selector) {
-            Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
-            None => "HEAD".into(),
-        };
+        let revision = resolve_revision!(request.revision);
         let tree = repo
             .rev_parse_single(format!("{}^{{tree}}", revision).as_str())?
             .object()?

tree/get_tree.rs

@@ -1,25 +1,19 @@
 use crate::bare::GitBare;
 use crate::error::{GitError, GitResult};
 use crate::pb::{GetTreeRequest, ListTreeRequest, Tree};
+use crate::resolve_revision;
 
 impl GitBare {
     pub fn get_tree(&self, request: GetTreeRequest) -> GitResult<Tree> {
         let entries = self.list_tree(ListTreeRequest {
-            repository: request.repository,
+            repository: request.repository.clone(),
             revision: request.revision.clone(),
             path: request.path.clone(),
             recursive: false,
             pagination: None,
         })?;
         let repo = self.gix_repo()?;
-        let revision = request
-            .revision
-            .and_then(|s| s.selector)
-            .map(|s| match s {
-                crate::pb::object_selector::Selector::Oid(oid) => oid.hex,
-                crate::pb::object_selector::Selector::Revision(name) => name.revision,
-            })
-            .unwrap_or_else(|| "HEAD".into());
+        let revision = resolve_revision!(request.revision);
         let root = repo
             .rev_parse_single(format!("{}^{{tree}}", revision).as_str())?
             .object()?

tree/list_tree.rs

@@ -10,7 +10,10 @@ impl GitBare {
         let repo = self.gix_repo()?;
         let revision = match request.revision.clone().and_then(|s| s.selector) {
             Some(object_selector::Selector::Oid(oid)) => oid.hex,
-            Some(object_selector::Selector::Revision(name)) => name.revision,
+            Some(object_selector::Selector::Revision(name)) => {
+                crate::sanitize::validate_revision(&name.revision)?;
+                name.revision
+            }
             None => "HEAD".into(),
         };
         let mut tree = repo

tree/mod.rs

@@ -6,11 +6,16 @@ pub mod list_tree;
 use crate::bare::GitBare;
 use crate::pb::{self, RecentCommit, object_selector};
 
-pub(crate) fn resolve_revision(sel: &Option<pb::ObjectSelector>) -> String {
+pub(crate) fn resolve_revision(
+    sel: &Option<pb::ObjectSelector>,
+) -> Result<String, crate::error::GitError> {
     match sel.as_ref().and_then(|s| s.selector.as_ref()) {
-        Some(object_selector::Selector::Oid(oid)) => oid.hex.clone(),
-        Some(object_selector::Selector::Revision(name)) => name.revision.clone(),
-        None => "HEAD".into(),
+        Some(object_selector::Selector::Oid(oid)) => Ok(oid.hex.clone()),
+        Some(object_selector::Selector::Revision(name)) => {
+            crate::sanitize::validate_revision(&name.revision)?;
+            Ok(name.revision.clone())
+        }
+        None => Ok("HEAD".into()),
     }
 }