Show inline images on GitLab #143

Closed
opened 2026-10-12 07:51:40 -05:00 by deadstyle · 3 comments
Owner

Problem

Images in GitLab MR and issue bodies stay links, because the adapter has no AssetReader. Parent: #137. Depends on #138.

Acceptance criteria

  • A GitLab upload that stands alone in a paragraph of an MR or issue body draws inline in the Details pane, as on Forgejo, on public and private projects (design.md → Images).
  • An image that fails to load, or is on another host, stays the 🖼 alt link (design.md → Images).
  • The token is never sent off the GitLab host.

Plan

  • Body links are /uploads/<secret>/<file> relative to the project's web URL (or /-/project/<id>/uploads/<secret>/<file>). Web routes likely don't accept a token, so OpenAsset rewrites a same-origin upload URL to GET /api/v4/projects/:id/uploads/:secret/:filename (GitLab 17.4+, Guest and above) and streams it with the token, dropping it on any hop off the origin, as ADR 0017 does for GitHub. A URL that isn't an upload is fetched as-is. Older servers return 404 → the link stays.
  • Check first how relative upload links are resolved before they reach OpenAsset (ADR 0016), since GitLab's are relative to the project, not the host root.
  • Record the decision in ADR 0016 or 0018; update architecture.md.

Context

  • Precedents: internal/forge/github/assets.go, #87, ADR 0016. docs.gitlab.com → Project markdown uploads API.
## Problem Images in GitLab MR and issue bodies stay links, because the adapter has no `AssetReader`. Parent: #137. **Depends on #138.** ## Acceptance criteria - A GitLab upload that stands alone in a paragraph of an MR or issue body draws inline in the Details pane, as on Forgejo, on public and private projects *(design.md → Images)*. - An image that fails to load, or is on another host, stays the `🖼 alt` link *(design.md → Images)*. - The token is never sent off the GitLab host. ## Plan - Body links are `/uploads/<secret>/<file>` relative to the project's web URL (or `/-/project/<id>/uploads/<secret>/<file>`). Web routes likely don't accept a token, so `OpenAsset` rewrites a same-origin upload URL to `GET /api/v4/projects/:id/uploads/:secret/:filename` (GitLab 17.4+, Guest and above) and streams it with the token, dropping it on any hop off the origin, as ADR 0017 does for GitHub. A URL that isn't an upload is fetched as-is. Older servers return 404 → the link stays. - Check first how relative upload links are resolved before they reach `OpenAsset` (ADR 0016), since GitLab's are relative to the project, not the host root. - Record the decision in ADR 0016 or 0018; update architecture.md. ## Context - Precedents: `internal/forge/github/assets.go`, #87, ADR 0016. docs.gitlab.com → Project markdown uploads API.
Author
Owner

🤖 Planned through composer-lite (plan in the run; summary: an I/O-free asset resolver so GitLab's project-relative /uploads/ links resolve to the right project, OpenAsset through the uploads API, and a client-wide guard so the token never follows a redirect off the GitLab host). Starts once #139 merges.

🤖 Planned through composer-lite (plan in the run; summary: an I/O-free asset resolver so GitLab's project-relative `/uploads/` links resolve to the right project, `OpenAsset` through the uploads API, and a client-wide guard so the token never follows a redirect off the GitLab host). Starts once #139 merges.
Author
Owner

🤖 MR open: #149

🤖 MR open: https://git.bobparsons.dev/deadstyle/lazyforge/pulls/149
Author
Owner

🤖 merged: #149

🤖 merged: https://git.bobparsons.dev/deadstyle/lazyforge/pulls/149
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
deadstyle/lazyforge#143
No description provided.