+430

api/tangled/cbor_gen.go

··· 5854 5854 5855 5855 return nil 5856 5856 } 5857 5857 + func (t *RepoCollaborator) MarshalCBOR(w io.Writer) error { 5858 5858 + if t == nil { 5859 5859 + _, err := w.Write(cbg.CborNull) 5860 5860 + return err 5861 5861 + } 5862 5862 + 5863 5863 + cw := cbg.NewCborWriter(w) 5864 5864 + 5865 5865 + if _, err := cw.Write([]byte{164}); err != nil { 5866 5866 + return err 5867 5867 + } 5868 5868 + 5869 5869 + // t.Repo (string) (string) 5870 5870 + if len("repo") > 1000000 { 5871 5871 + return xerrors.Errorf("Value in field \"repo\" was too long") 5872 5872 + } 5873 5873 + 5874 5874 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("repo"))); err != nil { 5875 5875 + return err 5876 5876 + } 5877 5877 + if _, err := cw.WriteString(string("repo")); err != nil { 5878 5878 + return err 5879 5879 + } 5880 5880 + 5881 5881 + if len(t.Repo) > 1000000 { 5882 5882 + return xerrors.Errorf("Value in field t.Repo was too long") 5883 5883 + } 5884 5884 + 5885 5885 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Repo))); err != nil { 5886 5886 + return err 5887 5887 + } 5888 5888 + if _, err := cw.WriteString(string(t.Repo)); err != nil { 5889 5889 + return err 5890 5890 + } 5891 5891 + 5892 5892 + // t.LexiconTypeID (string) (string) 5893 5893 + if len("$type") > 1000000 { 5894 5894 + return xerrors.Errorf("Value in field \"$type\" was too long") 5895 5895 + } 5896 5896 + 5897 5897 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("$type"))); err != nil { 5898 5898 + return err 5899 5899 + } 5900 5900 + if _, err := cw.WriteString(string("$type")); err != nil { 5901 5901 + return err 5902 5902 + } 5903 5903 + 5904 5904 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("sh.tangled.repo.collaborator"))); err != nil { 5905 5905 + return err 5906 5906 + } 5907 5907 + if _, err := cw.WriteString(string("sh.tangled.repo.collaborator")); err != nil { 5908 5908 + return err 5909 5909 + } 5910 5910 + 5911 5911 + // t.Subject (string) (string) 5912 5912 + if len("subject") > 1000000 { 5913 5913 + return xerrors.Errorf("Value in field \"subject\" was too long") 5914 5914 + } 5915 5915 + 5916 5916 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("subject"))); err != nil { 5917 5917 + return err 5918 5918 + } 5919 5919 + if _, err := cw.WriteString(string("subject")); err != nil { 5920 5920 + return err 5921 5921 + } 5922 5922 + 5923 5923 + if len(t.Subject) > 1000000 { 5924 5924 + return xerrors.Errorf("Value in field t.Subject was too long") 5925 5925 + } 5926 5926 + 5927 5927 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Subject))); err != nil { 5928 5928 + return err 5929 5929 + } 5930 5930 + if _, err := cw.WriteString(string(t.Subject)); err != nil { 5931 5931 + return err 5932 5932 + } 5933 5933 + 5934 5934 + // t.CreatedAt (string) (string) 5935 5935 + if len("createdAt") > 1000000 { 5936 5936 + return xerrors.Errorf("Value in field \"createdAt\" was too long") 5937 5937 + } 5938 5938 + 5939 5939 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("createdAt"))); err != nil { 5940 5940 + return err 5941 5941 + } 5942 5942 + if _, err := cw.WriteString(string("createdAt")); err != nil { 5943 5943 + return err 5944 5944 + } 5945 5945 + 5946 5946 + if len(t.CreatedAt) > 1000000 { 5947 5947 + return xerrors.Errorf("Value in field t.CreatedAt was too long") 5948 5948 + } 5949 5949 + 5950 5950 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.CreatedAt))); err != nil { 5951 5951 + return err 5952 5952 + } 5953 5953 + if _, err := cw.WriteString(string(t.CreatedAt)); err != nil { 5954 5954 + return err 5955 5955 + } 5956 5956 + return nil 5957 5957 + } 5958 5958 + 5959 5959 + func (t *RepoCollaborator) UnmarshalCBOR(r io.Reader) (err error) { 5960 5960 + *t = RepoCollaborator{} 5961 5961 + 5962 5962 + cr := cbg.NewCborReader(r) 5963 5963 + 5964 5964 + maj, extra, err := cr.ReadHeader() 5965 5965 + if err != nil { 5966 5966 + return err 5967 5967 + } 5968 5968 + defer func() { 5969 5969 + if err == io.EOF { 5970 5970 + err = io.ErrUnexpectedEOF 5971 5971 + } 5972 5972 + }() 5973 5973 + 5974 5974 + if maj != cbg.MajMap { 5975 5975 + return fmt.Errorf("cbor input should be of type map") 5976 5976 + } 5977 5977 + 5978 5978 + if extra > cbg.MaxLength { 5979 5979 + return fmt.Errorf("RepoCollaborator: map struct too large (%d)", extra) 5980 5980 + } 5981 5981 + 5982 5982 + n := extra 5983 5983 + 5984 5984 + nameBuf := make([]byte, 9) 5985 5985 + for i := uint64(0); i < n; i++ { 5986 5986 + nameLen, ok, err := cbg.ReadFullStringIntoBuf(cr, nameBuf, 1000000) 5987 5987 + if err != nil { 5988 5988 + return err 5989 5989 + } 5990 5990 + 5991 5991 + if !ok { 5992 5992 + // Field doesn't exist on this type, so ignore it 5993 5993 + if err := cbg.ScanForLinks(cr, func(cid.Cid) {}); err != nil { 5994 5994 + return err 5995 5995 + } 5996 5996 + continue 5997 5997 + } 5998 5998 + 5999 5999 + switch string(nameBuf[:nameLen]) { 6000 6000 + // t.Repo (string) (string) 6001 6001 + case "repo": 6002 6002 + 6003 6003 + { 6004 6004 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 6005 6005 + if err != nil { 6006 6006 + return err 6007 6007 + } 6008 6008 + 6009 6009 + t.Repo = string(sval) 6010 6010 + } 6011 6011 + // t.LexiconTypeID (string) (string) 6012 6012 + case "$type": 6013 6013 + 6014 6014 + { 6015 6015 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 6016 6016 + if err != nil { 6017 6017 + return err 6018 6018 + } 6019 6019 + 6020 6020 + t.LexiconTypeID = string(sval) 6021 6021 + } 6022 6022 + // t.Subject (string) (string) 6023 6023 + case "subject": 6024 6024 + 6025 6025 + { 6026 6026 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 6027 6027 + if err != nil { 6028 6028 + return err 6029 6029 + } 6030 6030 + 6031 6031 + t.Subject = string(sval) 6032 6032 + } 6033 6033 + // t.CreatedAt (string) (string) 6034 6034 + case "createdAt": 6035 6035 + 6036 6036 + { 6037 6037 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 6038 6038 + if err != nil { 6039 6039 + return err 6040 6040 + } 6041 6041 + 6042 6042 + t.CreatedAt = string(sval) 6043 6043 + } 6044 6044 + 6045 6045 + default: 6046 6046 + // Field doesn't exist on this type, so ignore it 6047 6047 + if err := cbg.ScanForLinks(r, func(cid.Cid) {}); err != nil { 6048 6048 + return err 6049 6049 + } 6050 6050 + } 6051 6051 + } 6052 6052 + 6053 6053 + return nil 6054 6054 + } 5857 6055 func (t *RepoIssue) MarshalCBOR(w io.Writer) error { 5858 6056 if t == nil { 5859 6057 _, err := w.Write(cbg.CborNull) ··· 8225 8423 8226 8424 return nil 8227 8425 } 8426 8426 + func (t *String) MarshalCBOR(w io.Writer) error { 8427 8427 + if t == nil { 8428 8428 + _, err := w.Write(cbg.CborNull) 8429 8429 + return err 8430 8430 + } 8431 8431 + 8432 8432 + cw := cbg.NewCborWriter(w) 8433 8433 + 8434 8434 + if _, err := cw.Write([]byte{165}); err != nil { 8435 8435 + return err 8436 8436 + } 8437 8437 + 8438 8438 + // t.LexiconTypeID (string) (string) 8439 8439 + if len("$type") > 1000000 { 8440 8440 + return xerrors.Errorf("Value in field \"$type\" was too long") 8441 8441 + } 8442 8442 + 8443 8443 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("$type"))); err != nil { 8444 8444 + return err 8445 8445 + } 8446 8446 + if _, err := cw.WriteString(string("$type")); err != nil { 8447 8447 + return err 8448 8448 + } 8449 8449 + 8450 8450 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("sh.tangled.string"))); err != nil { 8451 8451 + return err 8452 8452 + } 8453 8453 + if _, err := cw.WriteString(string("sh.tangled.string")); err != nil { 8454 8454 + return err 8455 8455 + } 8456 8456 + 8457 8457 + // t.Contents (string) (string) 8458 8458 + if len("contents") > 1000000 { 8459 8459 + return xerrors.Errorf("Value in field \"contents\" was too long") 8460 8460 + } 8461 8461 + 8462 8462 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("contents"))); err != nil { 8463 8463 + return err 8464 8464 + } 8465 8465 + if _, err := cw.WriteString(string("contents")); err != nil { 8466 8466 + return err 8467 8467 + } 8468 8468 + 8469 8469 + if len(t.Contents) > 1000000 { 8470 8470 + return xerrors.Errorf("Value in field t.Contents was too long") 8471 8471 + } 8472 8472 + 8473 8473 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Contents))); err != nil { 8474 8474 + return err 8475 8475 + } 8476 8476 + if _, err := cw.WriteString(string(t.Contents)); err != nil { 8477 8477 + return err 8478 8478 + } 8479 8479 + 8480 8480 + // t.Filename (string) (string) 8481 8481 + if len("filename") > 1000000 { 8482 8482 + return xerrors.Errorf("Value in field \"filename\" was too long") 8483 8483 + } 8484 8484 + 8485 8485 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("filename"))); err != nil { 8486 8486 + return err 8487 8487 + } 8488 8488 + if _, err := cw.WriteString(string("filename")); err != nil { 8489 8489 + return err 8490 8490 + } 8491 8491 + 8492 8492 + if len(t.Filename) > 1000000 { 8493 8493 + return xerrors.Errorf("Value in field t.Filename was too long") 8494 8494 + } 8495 8495 + 8496 8496 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Filename))); err != nil { 8497 8497 + return err 8498 8498 + } 8499 8499 + if _, err := cw.WriteString(string(t.Filename)); err != nil { 8500 8500 + return err 8501 8501 + } 8502 8502 + 8503 8503 + // t.CreatedAt (string) (string) 8504 8504 + if len("createdAt") > 1000000 { 8505 8505 + return xerrors.Errorf("Value in field \"createdAt\" was too long") 8506 8506 + } 8507 8507 + 8508 8508 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("createdAt"))); err != nil { 8509 8509 + return err 8510 8510 + } 8511 8511 + if _, err := cw.WriteString(string("createdAt")); err != nil { 8512 8512 + return err 8513 8513 + } 8514 8514 + 8515 8515 + if len(t.CreatedAt) > 1000000 { 8516 8516 + return xerrors.Errorf("Value in field t.CreatedAt was too long") 8517 8517 + } 8518 8518 + 8519 8519 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.CreatedAt))); err != nil { 8520 8520 + return err 8521 8521 + } 8522 8522 + if _, err := cw.WriteString(string(t.CreatedAt)); err != nil { 8523 8523 + return err 8524 8524 + } 8525 8525 + 8526 8526 + // t.Description (string) (string) 8527 8527 + if len("description") > 1000000 { 8528 8528 + return xerrors.Errorf("Value in field \"description\" was too long") 8529 8529 + } 8530 8530 + 8531 8531 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("description"))); err != nil { 8532 8532 + return err 8533 8533 + } 8534 8534 + if _, err := cw.WriteString(string("description")); err != nil { 8535 8535 + return err 8536 8536 + } 8537 8537 + 8538 8538 + if len(t.Description) > 1000000 { 8539 8539 + return xerrors.Errorf("Value in field t.Description was too long") 8540 8540 + } 8541 8541 + 8542 8542 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Description))); err != nil { 8543 8543 + return err 8544 8544 + } 8545 8545 + if _, err := cw.WriteString(string(t.Description)); err != nil { 8546 8546 + return err 8547 8547 + } 8548 8548 + return nil 8549 8549 + } 8550 8550 + 8551 8551 + func (t *String) UnmarshalCBOR(r io.Reader) (err error) { 8552 8552 + *t = String{} 8553 8553 + 8554 8554 + cr := cbg.NewCborReader(r) 8555 8555 + 8556 8556 + maj, extra, err := cr.ReadHeader() 8557 8557 + if err != nil { 8558 8558 + return err 8559 8559 + } 8560 8560 + defer func() { 8561 8561 + if err == io.EOF { 8562 8562 + err = io.ErrUnexpectedEOF 8563 8563 + } 8564 8564 + }() 8565 8565 + 8566 8566 + if maj != cbg.MajMap { 8567 8567 + return fmt.Errorf("cbor input should be of type map") 8568 8568 + } 8569 8569 + 8570 8570 + if extra > cbg.MaxLength { 8571 8571 + return fmt.Errorf("String: map struct too large (%d)", extra) 8572 8572 + } 8573 8573 + 8574 8574 + n := extra 8575 8575 + 8576 8576 + nameBuf := make([]byte, 11) 8577 8577 + for i := uint64(0); i < n; i++ { 8578 8578 + nameLen, ok, err := cbg.ReadFullStringIntoBuf(cr, nameBuf, 1000000) 8579 8579 + if err != nil { 8580 8580 + return err 8581 8581 + } 8582 8582 + 8583 8583 + if !ok { 8584 8584 + // Field doesn't exist on this type, so ignore it 8585 8585 + if err := cbg.ScanForLinks(cr, func(cid.Cid) {}); err != nil { 8586 8586 + return err 8587 8587 + } 8588 8588 + continue 8589 8589 + } 8590 8590 + 8591 8591 + switch string(nameBuf[:nameLen]) { 8592 8592 + // t.LexiconTypeID (string) (string) 8593 8593 + case "$type": 8594 8594 + 8595 8595 + { 8596 8596 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 8597 8597 + if err != nil { 8598 8598 + return err 8599 8599 + } 8600 8600 + 8601 8601 + t.LexiconTypeID = string(sval) 8602 8602 + } 8603 8603 + // t.Contents (string) (string) 8604 8604 + case "contents": 8605 8605 + 8606 8606 + { 8607 8607 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 8608 8608 + if err != nil { 8609 8609 + return err 8610 8610 + } 8611 8611 + 8612 8612 + t.Contents = string(sval) 8613 8613 + } 8614 8614 + // t.Filename (string) (string) 8615 8615 + case "filename": 8616 8616 + 8617 8617 + { 8618 8618 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 8619 8619 + if err != nil { 8620 8620 + return err 8621 8621 + } 8622 8622 + 8623 8623 + t.Filename = string(sval) 8624 8624 + } 8625 8625 + // t.CreatedAt (string) (string) 8626 8626 + case "createdAt": 8627 8627 + 8628 8628 + { 8629 8629 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 8630 8630 + if err != nil { 8631 8631 + return err 8632 8632 + } 8633 8633 + 8634 8634 + t.CreatedAt = string(sval) 8635 8635 + } 8636 8636 + // t.Description (string) (string) 8637 8637 + case "description": 8638 8638 + 8639 8639 + { 8640 8640 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 8641 8641 + if err != nil { 8642 8642 + return err 8643 8643 + } 8644 8644 + 8645 8645 + t.Description = string(sval) 8646 8646 + } 8647 8647 + 8648 8648 + default: 8649 8649 + // Field doesn't exist on this type, so ignore it 8650 8650 + if err := cbg.ScanForLinks(r, func(cid.Cid) {}); err != nil { 8651 8651 + return err 8652 8652 + } 8653 8653 + } 8654 8654 + } 8655 8655 + 8656 8656 + return nil 8657 8657 + }

+25

api/tangled/repocollaborator.go

··· 1 1 + // Code generated by cmd/lexgen (see Makefile's lexgen); DO NOT EDIT. 2 2 + 3 3 + package tangled 4 4 + 5 5 + // schema: sh.tangled.repo.collaborator 6 6 + 7 7 + import ( 8 8 + "github.com/bluesky-social/indigo/lex/util" 9 9 + ) 10 10 + 11 11 + const ( 12 12 + RepoCollaboratorNSID = "sh.tangled.repo.collaborator" 13 13 + ) 14 14 + 15 15 + func init() { 16 16 + util.RegisterType("sh.tangled.repo.collaborator", &RepoCollaborator{}) 17 17 + } // 18 18 + // RECORDTYPE: RepoCollaborator 19 19 + type RepoCollaborator struct { 20 20 + LexiconTypeID string `json:"$type,const=sh.tangled.repo.collaborator" cborgen:"$type,const=sh.tangled.repo.collaborator"` 21 21 + CreatedAt string `json:"createdAt" cborgen:"createdAt"` 22 22 + // repo: repo to add this user to 23 23 + Repo string `json:"repo" cborgen:"repo"` 24 24 + Subject string `json:"subject" cborgen:"subject"` 25 25 + }

+25

api/tangled/tangledstring.go

··· 1 1 + // Code generated by cmd/lexgen (see Makefile's lexgen); DO NOT EDIT. 2 2 + 3 3 + package tangled 4 4 + 5 5 + // schema: sh.tangled.string 6 6 + 7 7 + import ( 8 8 + "github.com/bluesky-social/indigo/lex/util" 9 9 + ) 10 10 + 11 11 + const ( 12 12 + StringNSID = "sh.tangled.string" 13 13 + ) 14 14 + 15 15 + func init() { 16 16 + util.RegisterType("sh.tangled.string", &String{}) 17 17 + } // 18 18 + // RECORDTYPE: String 19 19 + type String struct { 20 20 + LexiconTypeID string `json:"$type,const=sh.tangled.string" cborgen:"$type,const=sh.tangled.string"` 21 21 + Contents string `json:"contents" cborgen:"contents"` 22 22 + CreatedAt string `json:"createdAt" cborgen:"createdAt"` 23 23 + Description string `json:"description" cborgen:"description"` 24 24 + Filename string `json:"filename" cborgen:"filename"` 25 25 + }

+18 -5

appview/config/config.go

··· 10 10 ) 11 11 12 12 type CoreConfig struct { 13 13 - CookieSecret string `env:"COOKIE_SECRET, default=00000000000000000000000000000000"` 14 14 - DbPath string `env:"DB_PATH, default=appview.db"` 15 15 - ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:3000"` 16 16 - AppviewHost string `env:"APPVIEW_HOST, default=https://tangled.sh"` 17 17 - Dev bool `env:"DEV, default=false"` 13 13 + CookieSecret string `env:"COOKIE_SECRET, default=00000000000000000000000000000000"` 14 14 + DbPath string `env:"DB_PATH, default=appview.db"` 15 15 + ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:3000"` 16 16 + AppviewHost string `env:"APPVIEW_HOST, default=https://tangled.sh"` 17 17 + Dev bool `env:"DEV, default=false"` 18 18 + DisallowedNicknamesFile string `env:"DISALLOWED_NICKNAMES_FILE"` 18 19 } 19 20 20 21 type OAuthConfig struct { ··· 59 60 DB int `env:"DB, default=0"` 60 61 } 61 62 63 63 + type PdsConfig struct { 64 64 + Host string `env:"HOST, default=https://tngl.sh"` 65 65 + AdminSecret string `env:"ADMIN_SECRET"` 66 66 + } 67 67 + 68 68 + type Cloudflare struct { 69 69 + ApiToken string `env:"API_TOKEN"` 70 70 + ZoneId string `env:"ZONE_ID"` 71 71 + } 72 72 + 62 73 func (cfg RedisConfig) ToURL() string { 63 74 u := &url.URL{ 64 75 Scheme: "redis", ··· 84 95 Avatar AvatarConfig `env:",prefix=TANGLED_AVATAR_"` 85 96 OAuth OAuthConfig `env:",prefix=TANGLED_OAUTH_"` 86 97 Redis RedisConfig `env:",prefix=TANGLED_REDIS_"` 98 98 + Pds PdsConfig `env:",prefix=TANGLED_PDS_"` 99 99 + Cloudflare Cloudflare `env:",prefix=TANGLED_CLOUDFLARE_"` 87 100 } 88 101 89 102 func LoadConfig(ctx context.Context) (*Config, error) {

+76

appview/db/collaborators.go

··· 1 1 + package db 2 2 + 3 3 + import ( 4 4 + "fmt" 5 5 + "strings" 6 6 + "time" 7 7 + 8 8 + "github.com/bluesky-social/indigo/atproto/syntax" 9 9 + ) 10 10 + 11 11 + type Collaborator struct { 12 12 + // identifiers for the record 13 13 + Id int64 14 14 + Did syntax.DID 15 15 + Rkey string 16 16 + 17 17 + // content 18 18 + SubjectDid syntax.DID 19 19 + RepoAt syntax.ATURI 20 20 + 21 21 + // meta 22 22 + Created time.Time 23 23 + } 24 24 + 25 25 + func AddCollaborator(e Execer, c Collaborator) error { 26 26 + _, err := e.Exec( 27 27 + `insert into collaborators (did, rkey, subject_did, repo_at) values (?, ?, ?, ?);`, 28 28 + c.Did, c.Rkey, c.SubjectDid, c.RepoAt, 29 29 + ) 30 30 + return err 31 31 + } 32 32 + 33 33 + func DeleteCollaborator(e Execer, filters ...filter) error { 34 34 + var conditions []string 35 35 + var args []any 36 36 + for _, filter := range filters { 37 37 + conditions = append(conditions, filter.Condition()) 38 38 + args = append(args, filter.Arg()...) 39 39 + } 40 40 + 41 41 + whereClause := "" 42 42 + if conditions != nil { 43 43 + whereClause = " where " + strings.Join(conditions, " and ") 44 44 + } 45 45 + 46 46 + query := fmt.Sprintf(`delete from collaborators %s`, whereClause) 47 47 + 48 48 + _, err := e.Exec(query, args...) 49 49 + return err 50 50 + } 51 51 + 52 52 + func CollaboratingIn(e Execer, collaborator string) ([]Repo, error) { 53 53 + rows, err := e.Query(`select repo_at from collaborators where subject_did = ?`, collaborator) 54 54 + if err != nil { 55 55 + return nil, err 56 56 + } 57 57 + defer rows.Close() 58 58 + 59 59 + var repoAts []string 60 60 + for rows.Next() { 61 61 + var aturi string 62 62 + err := rows.Scan(&aturi) 63 63 + if err != nil { 64 64 + return nil, err 65 65 + } 66 66 + repoAts = append(repoAts, aturi) 67 67 + } 68 68 + if err := rows.Err(); err != nil { 69 69 + return nil, err 70 70 + } 71 71 + if repoAts == nil { 72 72 + return nil, nil 73 73 + } 74 74 + 75 75 + return GetRepos(e, 0, FilterIn("at_uri", repoAts)) 76 76 + }

+80 -3

appview/db/db.go

··· 355 355 created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')), 356 356 357 357 -- constraints 358 358 - foreign key (did, instance) references spindles(owner, instance) on delete cascade, 359 358 unique (did, instance, subject) 360 359 ); 361 360 ··· 435 434 bytes integer not null check (bytes >= 0), 436 435 437 436 unique(repo_at, ref, language) 437 437 + ); 438 438 + 439 439 + create table if not exists signups_inflight ( 440 440 + id integer primary key autoincrement, 441 441 + email text not null unique, 442 442 + invite_code text not null, 443 443 + created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')) 444 444 + ); 445 445 + 446 446 + create table if not exists strings ( 447 447 + -- identifiers 448 448 + did text not null, 449 449 + rkey text not null, 450 450 + 451 451 + -- content 452 452 + filename text not null, 453 453 + description text, 454 454 + content text not null, 455 455 + created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')), 456 456 + edited text, 457 457 + 458 458 + primary key (did, rkey) 438 459 ); 439 460 440 461 create table if not exists migrations ( ··· 579 600 return nil 580 601 }) 581 602 603 603 + // recreate and add rkey + created columns with default constraint 604 604 + runMigration(db, "rework-collaborators-table", func(tx *sql.Tx) error { 605 605 + // create new table 606 606 + // - repo_at instead of repo integer 607 607 + // - rkey field 608 608 + // - created field 609 609 + _, err := tx.Exec(` 610 610 + create table collaborators_new ( 611 611 + -- identifiers for the record 612 612 + id integer primary key autoincrement, 613 613 + did text not null, 614 614 + rkey text, 615 615 + 616 616 + -- content 617 617 + subject_did text not null, 618 618 + repo_at text not null, 619 619 + 620 620 + -- meta 621 621 + created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')), 622 622 + 623 623 + -- constraints 624 624 + foreign key (repo_at) references repos(at_uri) on delete cascade 625 625 + ) 626 626 + `) 627 627 + if err != nil { 628 628 + return err 629 629 + } 630 630 + 631 631 + // copy data 632 632 + _, err = tx.Exec(` 633 633 + insert into collaborators_new (id, did, rkey, subject_did, repo_at) 634 634 + select 635 635 + c.id, 636 636 + r.did, 637 637 + '', 638 638 + c.did, 639 639 + r.at_uri 640 640 + from collaborators c 641 641 + join repos r on c.repo = r.id 642 642 + `) 643 643 + if err != nil { 644 644 + return err 645 645 + } 646 646 + 647 647 + // drop old table 648 648 + _, err = tx.Exec(`drop table collaborators`) 649 649 + if err != nil { 650 650 + return err 651 651 + } 652 652 + 653 653 + // rename new table 654 654 + _, err = tx.Exec(`alter table collaborators_new rename to collaborators`) 655 655 + return err 656 656 + }) 657 657 + 582 658 return &DB{db}, nil 583 659 } 584 660 ··· 654 730 // if we have `FilterIn(k, [1, 2, 3])`, compile it down to `k in (?, ?, ?)` 655 731 if kind == reflect.Slice || kind == reflect.Array { 656 732 if rv.Len() == 0 { 657 657 - panic(fmt.Sprintf("empty slice passed to %q filter on %s", f.cmp, f.key)) 733 733 + // always false 734 734 + return "1 = 0" 658 735 } 659 736 660 737 placeholders := make([]string, rv.Len()) ··· 673 750 kind := rv.Kind() 674 751 if kind == reflect.Slice || kind == reflect.Array { 675 752 if rv.Len() == 0 { 676 676 - panic(fmt.Sprintf("empty slice passed to %q filter on %s", f.cmp, f.key)) 753 753 + return nil 677 754 } 678 755 679 756 out := make([]any, rv.Len())

+16 -2

appview/db/email.go

··· 103 103 query := ` 104 104 select email, did 105 105 from emails 106 106 - where 107 107 - verified = ? 106 106 + where 107 107 + verified = ? 108 108 and email in (` + strings.Join(placeholders, ",") + `) 109 109 ` 110 110 ··· 153 153 ` 154 154 var count int 155 155 err := e.QueryRow(query, did, email).Scan(&count) 156 156 + if err != nil { 157 157 + return false, err 158 158 + } 159 159 + return count > 0, nil 160 160 + } 161 161 + 162 162 + func CheckEmailExistsAtAll(e Execer, email string) (bool, error) { 163 163 + query := ` 164 164 + select count(*) 165 165 + from emails 166 166 + where email = ? 167 167 + ` 168 168 + var count int 169 169 + err := e.QueryRow(query, email).Scan(&count) 156 170 if err != nil { 157 171 return false, err 158 172 }

-34

appview/db/repos.go

··· 550 550 return &repo, nil 551 551 } 552 552 553 553 - func AddCollaborator(e Execer, collaborator, repoOwnerDid, repoName, repoKnot string) error { 554 554 - _, err := e.Exec( 555 555 - `insert into collaborators (did, repo) 556 556 - values (?, (select id from repos where did = ? and name = ? and knot = ?));`, 557 557 - collaborator, repoOwnerDid, repoName, repoKnot) 558 558 - return err 559 559 - } 560 560 - 561 553 func UpdateDescription(e Execer, repoAt, newDescription string) error { 562 554 _, err := e.Exec( 563 555 `update repos set description = ? where at_uri = ?`, newDescription, repoAt) ··· 568 560 _, err := e.Exec( 569 561 `update repos set spindle = ? where at_uri = ?`, spindle, repoAt) 570 562 return err 571 571 - } 572 572 - 573 573 - func CollaboratingIn(e Execer, collaborator string) ([]Repo, error) { 574 574 - rows, err := e.Query(`select repo from collaborators where did = ?`, collaborator) 575 575 - if err != nil { 576 576 - return nil, err 577 577 - } 578 578 - defer rows.Close() 579 579 - 580 580 - var repoIds []int 581 581 - for rows.Next() { 582 582 - var id int 583 583 - err := rows.Scan(&id) 584 584 - if err != nil { 585 585 - return nil, err 586 586 - } 587 587 - repoIds = append(repoIds, id) 588 588 - } 589 589 - if err := rows.Err(); err != nil { 590 590 - return nil, err 591 591 - } 592 592 - if repoIds == nil { 593 593 - return nil, nil 594 594 - } 595 595 - 596 596 - return GetRepos(e, 0, FilterIn("id", repoIds)) 597 563 } 598 564 599 565 type RepoStats struct {

+29

appview/db/signup.go

··· 1 1 + package db 2 2 + 3 3 + import "time" 4 4 + 5 5 + type InflightSignup struct { 6 6 + Id int64 7 7 + Email string 8 8 + InviteCode string 9 9 + Created time.Time 10 10 + } 11 11 + 12 12 + func AddInflightSignup(e Execer, signup InflightSignup) error { 13 13 + query := `insert into signups_inflight (email, invite_code) values (?, ?)` 14 14 + _, err := e.Exec(query, signup.Email, signup.InviteCode) 15 15 + return err 16 16 + } 17 17 + 18 18 + func DeleteInflightSignup(e Execer, email string) error { 19 19 + query := `delete from signups_inflight where email = ?` 20 20 + _, err := e.Exec(query, email) 21 21 + return err 22 22 + } 23 23 + 24 24 + func GetEmailForCode(e Execer, inviteCode string) (string, error) { 25 25 + query := `select email from signups_inflight where invite_code = ?` 26 26 + var email string 27 27 + err := e.QueryRow(query, inviteCode).Scan(&email) 28 28 + return email, err 29 29 + }

+251

appview/db/strings.go

··· 1 1 + package db 2 2 + 3 3 + import ( 4 4 + "bytes" 5 5 + "database/sql" 6 6 + "errors" 7 7 + "fmt" 8 8 + "io" 9 9 + "strings" 10 10 + "time" 11 11 + "unicode/utf8" 12 12 + 13 13 + "github.com/bluesky-social/indigo/atproto/syntax" 14 14 + "tangled.sh/tangled.sh/core/api/tangled" 15 15 + ) 16 16 + 17 17 + type String struct { 18 18 + Did syntax.DID 19 19 + Rkey string 20 20 + 21 21 + Filename string 22 22 + Description string 23 23 + Contents string 24 24 + Created time.Time 25 25 + Edited *time.Time 26 26 + } 27 27 + 28 28 + func (s *String) StringAt() syntax.ATURI { 29 29 + return syntax.ATURI(fmt.Sprintf("at://%s/%s/%s", s.Did, tangled.StringNSID, s.Rkey)) 30 30 + } 31 31 + 32 32 + type StringStats struct { 33 33 + LineCount uint64 34 34 + ByteCount uint64 35 35 + } 36 36 + 37 37 + func (s String) Stats() StringStats { 38 38 + lineCount, err := countLines(strings.NewReader(s.Contents)) 39 39 + if err != nil { 40 40 + // non-fatal 41 41 + // TODO: log this? 42 42 + } 43 43 + 44 44 + return StringStats{ 45 45 + LineCount: uint64(lineCount), 46 46 + ByteCount: uint64(len(s.Contents)), 47 47 + } 48 48 + } 49 49 + 50 50 + func (s String) Validate() error { 51 51 + var err error 52 52 + 53 53 + if !strings.Contains(s.Filename, ".") { 54 54 + err = errors.Join(err, fmt.Errorf("missing filename extension")) 55 55 + } 56 56 + 57 57 + if strings.HasSuffix(s.Filename, ".") { 58 58 + err = errors.Join(err, fmt.Errorf("filename ends with `.`")) 59 59 + } 60 60 + 61 61 + if utf8.RuneCountInString(s.Filename) > 140 { 62 62 + err = errors.Join(err, fmt.Errorf("filename too long")) 63 63 + } 64 64 + 65 65 + if utf8.RuneCountInString(s.Description) > 280 { 66 66 + err = errors.Join(err, fmt.Errorf("description too long")) 67 67 + } 68 68 + 69 69 + if len(s.Contents) == 0 { 70 70 + err = errors.Join(err, fmt.Errorf("contents is empty")) 71 71 + } 72 72 + 73 73 + return err 74 74 + } 75 75 + 76 76 + func (s *String) AsRecord() tangled.String { 77 77 + return tangled.String{ 78 78 + Filename: s.Filename, 79 79 + Description: s.Description, 80 80 + Contents: s.Contents, 81 81 + CreatedAt: s.Created.Format(time.RFC3339), 82 82 + } 83 83 + } 84 84 + 85 85 + func StringFromRecord(did, rkey string, record tangled.String) String { 86 86 + created, err := time.Parse(record.CreatedAt, time.RFC3339) 87 87 + if err != nil { 88 88 + created = time.Now() 89 89 + } 90 90 + return String{ 91 91 + Did: syntax.DID(did), 92 92 + Rkey: rkey, 93 93 + Filename: record.Filename, 94 94 + Description: record.Description, 95 95 + Contents: record.Contents, 96 96 + Created: created, 97 97 + } 98 98 + } 99 99 + 100 100 + func AddString(e Execer, s String) error { 101 101 + _, err := e.Exec( 102 102 + `insert into strings ( 103 103 + did, 104 104 + rkey, 105 105 + filename, 106 106 + description, 107 107 + content, 108 108 + created, 109 109 + edited 110 110 + ) 111 111 + values (?, ?, ?, ?, ?, ?, null) 112 112 + on conflict(did, rkey) do update set 113 113 + filename = excluded.filename, 114 114 + description = excluded.description, 115 115 + content = excluded.content, 116 116 + edited = case 117 117 + when 118 118 + strings.content != excluded.content 119 119 + or strings.filename != excluded.filename 120 120 + or strings.description != excluded.description then ? 121 121 + else strings.edited 122 122 + end`, 123 123 + s.Did, 124 124 + s.Rkey, 125 125 + s.Filename, 126 126 + s.Description, 127 127 + s.Contents, 128 128 + s.Created.Format(time.RFC3339), 129 129 + time.Now().Format(time.RFC3339), 130 130 + ) 131 131 + return err 132 132 + } 133 133 + 134 134 + func GetStrings(e Execer, filters ...filter) ([]String, error) { 135 135 + var all []String 136 136 + 137 137 + var conditions []string 138 138 + var args []any 139 139 + for _, filter := range filters { 140 140 + conditions = append(conditions, filter.Condition()) 141 141 + args = append(args, filter.Arg()...) 142 142 + } 143 143 + 144 144 + whereClause := "" 145 145 + if conditions != nil { 146 146 + whereClause = " where " + strings.Join(conditions, " and ") 147 147 + } 148 148 + 149 149 + query := fmt.Sprintf(`select 150 150 + did, 151 151 + rkey, 152 152 + filename, 153 153 + description, 154 154 + content, 155 155 + created, 156 156 + edited 157 157 + from strings %s`, 158 158 + whereClause, 159 159 + ) 160 160 + 161 161 + rows, err := e.Query(query, args...) 162 162 + 163 163 + if err != nil { 164 164 + return nil, err 165 165 + } 166 166 + defer rows.Close() 167 167 + 168 168 + for rows.Next() { 169 169 + var s String 170 170 + var createdAt string 171 171 + var editedAt sql.NullString 172 172 + 173 173 + if err := rows.Scan( 174 174 + &s.Did, 175 175 + &s.Rkey, 176 176 + &s.Filename, 177 177 + &s.Description, 178 178 + &s.Contents, 179 179 + &createdAt, 180 180 + &editedAt, 181 181 + ); err != nil { 182 182 + return nil, err 183 183 + } 184 184 + 185 185 + s.Created, err = time.Parse(time.RFC3339, createdAt) 186 186 + if err != nil { 187 187 + s.Created = time.Now() 188 188 + } 189 189 + 190 190 + if editedAt.Valid { 191 191 + e, err := time.Parse(time.RFC3339, editedAt.String) 192 192 + if err != nil { 193 193 + e = time.Now() 194 194 + } 195 195 + s.Edited = &e 196 196 + } 197 197 + 198 198 + all = append(all, s) 199 199 + } 200 200 + 201 201 + if err := rows.Err(); err != nil { 202 202 + return nil, err 203 203 + } 204 204 + 205 205 + return all, nil 206 206 + } 207 207 + 208 208 + func DeleteString(e Execer, filters ...filter) error { 209 209 + var conditions []string 210 210 + var args []any 211 211 + for _, filter := range filters { 212 212 + conditions = append(conditions, filter.Condition()) 213 213 + args = append(args, filter.Arg()...) 214 214 + } 215 215 + 216 216 + whereClause := "" 217 217 + if conditions != nil { 218 218 + whereClause = " where " + strings.Join(conditions, " and ") 219 219 + } 220 220 + 221 221 + query := fmt.Sprintf(`delete from strings %s`, whereClause) 222 222 + 223 223 + _, err := e.Exec(query, args...) 224 224 + return err 225 225 + } 226 226 + 227 227 + func countLines(r io.Reader) (int, error) { 228 228 + buf := make([]byte, 32*1024) 229 229 + bufLen := 0 230 230 + count := 0 231 231 + nl := []byte{'\n'} 232 232 + 233 233 + for { 234 234 + c, err := r.Read(buf) 235 235 + if c > 0 { 236 236 + bufLen += c 237 237 + } 238 238 + count += bytes.Count(buf[:c], nl) 239 239 + 240 240 + switch { 241 241 + case err == io.EOF: 242 242 + /* handle last line not having a newline at the end */ 243 243 + if bufLen >= 1 && buf[(bufLen-1)%(32*1024)] != '\n' { 244 244 + count++ 245 245 + } 246 246 + return count, nil 247 247 + case err != nil: 248 248 + return 0, err 249 249 + } 250 250 + } 251 251 + }

+53

appview/dns/cloudflare.go

··· 1 1 + package dns 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "fmt" 6 6 + 7 7 + "github.com/cloudflare/cloudflare-go" 8 8 + "tangled.sh/tangled.sh/core/appview/config" 9 9 + ) 10 10 + 11 11 + type Record struct { 12 12 + Type string 13 13 + Name string 14 14 + Content string 15 15 + TTL int 16 16 + Proxied bool 17 17 + } 18 18 + 19 19 + type Cloudflare struct { 20 20 + api *cloudflare.API 21 21 + zone string 22 22 + } 23 23 + 24 24 + func NewCloudflare(c *config.Config) (*Cloudflare, error) { 25 25 + apiToken := c.Cloudflare.ApiToken 26 26 + api, err := cloudflare.NewWithAPIToken(apiToken) 27 27 + if err != nil { 28 28 + return nil, err 29 29 + } 30 30 + return &Cloudflare{api: api, zone: c.Cloudflare.ZoneId}, nil 31 31 + } 32 32 + 33 33 + func (cf *Cloudflare) CreateDNSRecord(ctx context.Context, record Record) error { 34 34 + _, err := cf.api.CreateDNSRecord(ctx, cloudflare.ZoneIdentifier(cf.zone), cloudflare.CreateDNSRecordParams{ 35 35 + Type: record.Type, 36 36 + Name: record.Name, 37 37 + Content: record.Content, 38 38 + TTL: record.TTL, 39 39 + Proxied: &record.Proxied, 40 40 + }) 41 41 + if err != nil { 42 42 + return fmt.Errorf("failed to create DNS record: %w", err) 43 43 + } 44 44 + return nil 45 45 + } 46 46 + 47 47 + func (cf *Cloudflare) DeleteDNSRecord(ctx context.Context, recordID string) error { 48 48 + err := cf.api.DeleteDNSRecord(ctx, cloudflare.ZoneIdentifier(cf.zone), recordID) 49 49 + if err != nil { 50 50 + return fmt.Errorf("failed to delete DNS record: %w", err) 51 51 + } 52 52 + return nil 53 53 + }

+66

appview/ingester.go

··· 64 64 err = i.ingestSpindleMember(e) 65 65 case tangled.SpindleNSID: 66 66 err = i.ingestSpindle(e) 67 67 + case tangled.StringNSID: 68 68 + err = i.ingestString(e) 67 69 } 68 70 l = i.Logger.With("nsid", e.Commit.Collection) 69 71 } ··· 510 512 i.Enforcer.E.LoadPolicy() 511 513 }() 512 514 515 515 + // remove spindle members first 516 516 + err = db.RemoveSpindleMember( 517 517 + tx, 518 518 + db.FilterEq("owner", did), 519 519 + db.FilterEq("instance", instance), 520 520 + ) 521 521 + if err != nil { 522 522 + return err 523 523 + } 524 524 + 513 525 err = db.DeleteSpindle( 514 526 tx, 515 527 db.FilterEq("owner", did), ··· 539 551 540 552 return nil 541 553 } 554 554 + 555 555 + func (i *Ingester) ingestString(e *models.Event) error { 556 556 + did := e.Did 557 557 + rkey := e.Commit.RKey 558 558 + 559 559 + var err error 560 560 + 561 561 + l := i.Logger.With("handler", "ingestString", "nsid", e.Commit.Collection, "did", did, "rkey", rkey) 562 562 + l.Info("ingesting record") 563 563 + 564 564 + ddb, ok := i.Db.Execer.(*db.DB) 565 565 + if !ok { 566 566 + return fmt.Errorf("failed to index string record, invalid db cast") 567 567 + } 568 568 + 569 569 + switch e.Commit.Operation { 570 570 + case models.CommitOperationCreate, models.CommitOperationUpdate: 571 571 + raw := json.RawMessage(e.Commit.Record) 572 572 + record := tangled.String{} 573 573 + err = json.Unmarshal(raw, &record) 574 574 + if err != nil { 575 575 + l.Error("invalid record", "err", err) 576 576 + return err 577 577 + } 578 578 + 579 579 + string := db.StringFromRecord(did, rkey, record) 580 580 + 581 581 + if err = string.Validate(); err != nil { 582 582 + l.Error("invalid record", "err", err) 583 583 + return err 584 584 + } 585 585 + 586 586 + if err = db.AddString(ddb, string); err != nil { 587 587 + l.Error("failed to add string", "err", err) 588 588 + return err 589 589 + } 590 590 + 591 591 + return nil 592 592 + 593 593 + case models.CommitOperationDelete: 594 594 + if err := db.DeleteString( 595 595 + ddb, 596 596 + db.FilterEq("did", did), 597 597 + db.FilterEq("rkey", rkey), 598 598 + ); err != nil { 599 599 + l.Error("failed to delete", "err", err) 600 600 + return fmt.Errorf("failed to delete string record: %w", err) 601 601 + } 602 602 + 603 603 + return nil 604 604 + } 605 605 + 606 606 + return nil 607 607 + }

+2 -10

appview/middleware/middleware.go

··· 167 167 } 168 168 } 169 169 170 170 - func StripLeadingAt(next http.Handler) http.Handler { 171 171 - return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) { 172 172 - path := req.URL.EscapedPath() 173 173 - if strings.HasPrefix(path, "/@") { 174 174 - req.URL.RawPath = "/" + strings.TrimPrefix(path, "/@") 175 175 - } 176 176 - next.ServeHTTP(w, req) 177 177 - }) 178 178 - } 179 179 - 180 170 func (mw Middleware) ResolveIdent() middlewareFunc { 181 171 excluded := []string{"favicon.ico"} 182 172 ··· 187 177 next.ServeHTTP(w, req) 188 178 return 189 179 } 180 180 + 181 181 + didOrHandle = strings.TrimPrefix(didOrHandle, "@") 190 182 191 183 id, err := mw.idResolver.ResolveIdent(req.Context(), didOrHandle) 192 184 if err != nil {

+73

appview/oauth/oauth.go

··· 7 7 "net/url" 8 8 "time" 9 9 10 10 + indigo_xrpc "github.com/bluesky-social/indigo/xrpc" 10 11 "github.com/gorilla/sessions" 11 12 oauth "tangled.sh/icyphox.sh/atproto-oauth" 12 13 "tangled.sh/icyphox.sh/atproto-oauth/helpers" ··· 204 205 }) 205 206 206 207 return xrpcClient, nil 208 208 + } 209 209 + 210 210 + // use this to create a client to communicate with knots or spindles 211 211 + // 212 212 + // this is a higher level abstraction on ServerGetServiceAuth 213 213 + type ServiceClientOpts struct { 214 214 + service string 215 215 + exp int64 216 216 + lxm string 217 217 + dev bool 218 218 + } 219 219 + 220 220 + type ServiceClientOpt func(*ServiceClientOpts) 221 221 + 222 222 + func WithService(service string) ServiceClientOpt { 223 223 + return func(s *ServiceClientOpts) { 224 224 + s.service = service 225 225 + } 226 226 + } 227 227 + func WithExp(exp int64) ServiceClientOpt { 228 228 + return func(s *ServiceClientOpts) { 229 229 + s.exp = exp 230 230 + } 231 231 + } 232 232 + 233 233 + func WithLxm(lxm string) ServiceClientOpt { 234 234 + return func(s *ServiceClientOpts) { 235 235 + s.lxm = lxm 236 236 + } 237 237 + } 238 238 + 239 239 + func WithDev(dev bool) ServiceClientOpt { 240 240 + return func(s *ServiceClientOpts) { 241 241 + s.dev = dev 242 242 + } 243 243 + } 244 244 + 245 245 + func (s *ServiceClientOpts) Audience() string { 246 246 + return fmt.Sprintf("did:web:%s", s.service) 247 247 + } 248 248 + 249 249 + func (s *ServiceClientOpts) Host() string { 250 250 + scheme := "https://" 251 251 + if s.dev { 252 252 + scheme = "http://" 253 253 + } 254 254 + 255 255 + return scheme + s.service 256 256 + } 257 257 + 258 258 + func (o *OAuth) ServiceClient(r *http.Request, os ...ServiceClientOpt) (*indigo_xrpc.Client, error) { 259 259 + opts := ServiceClientOpts{} 260 260 + for _, o := range os { 261 261 + o(&opts) 262 262 + } 263 263 + 264 264 + authorizedClient, err := o.AuthorizedClient(r) 265 265 + if err != nil { 266 266 + return nil, err 267 267 + } 268 268 + 269 269 + resp, err := authorizedClient.ServerGetServiceAuth(r.Context(), opts.Audience(), opts.exp, opts.lxm) 270 270 + if err != nil { 271 271 + return nil, err 272 272 + } 273 273 + 274 274 + return &indigo_xrpc.Client{ 275 275 + Auth: &indigo_xrpc.AuthInfo{ 276 276 + AccessJwt: resp.Token, 277 277 + }, 278 278 + Host: opts.Host(), 279 279 + }, nil 207 280 } 208 281 209 282 type ClientMetadata struct {

+2 -2

appview/pages/markup/camo.go

··· 9 9 "github.com/yuin/goldmark/ast" 10 10 ) 11 11 12 12 - func generateCamoURL(baseURL, secret, imageURL string) string { 12 12 + func GenerateCamoURL(baseURL, secret, imageURL string) string { 13 13 h := hmac.New(sha256.New, []byte(secret)) 14 14 h.Write([]byte(imageURL)) 15 15 signature := hex.EncodeToString(h.Sum(nil)) ··· 24 24 } 25 25 26 26 if rctx.CamoUrl != "" && rctx.CamoSecret != "" { 27 27 - return generateCamoURL(rctx.CamoUrl, rctx.CamoSecret, dst) 27 27 + return GenerateCamoURL(rctx.CamoUrl, rctx.CamoSecret, dst) 28 28 } 29 29 30 30 return dst

+150 -1

appview/pages/pages.go

··· 16 16 "strings" 17 17 "sync" 18 18 19 19 + "tangled.sh/tangled.sh/core/api/tangled" 19 20 "tangled.sh/tangled.sh/core/appview/commitverify" 20 21 "tangled.sh/tangled.sh/core/appview/config" 21 22 "tangled.sh/tangled.sh/core/appview/db" ··· 30 31 chromahtml "github.com/alecthomas/chroma/v2/formatters/html" 31 32 "github.com/alecthomas/chroma/v2/lexers" 32 33 "github.com/alecthomas/chroma/v2/styles" 34 34 + "github.com/bluesky-social/indigo/atproto/identity" 33 35 "github.com/bluesky-social/indigo/atproto/syntax" 34 36 "github.com/go-git/go-git/v5/plumbing" 35 37 "github.com/go-git/go-git/v5/plumbing/object" ··· 261 263 return p.executePlain("user/login", w, params) 262 264 } 263 265 266 266 + func (p *Pages) Signup(w io.Writer) error { 267 267 + return p.executePlain("user/signup", w, nil) 268 268 + } 269 269 + 270 270 + func (p *Pages) CompleteSignup(w io.Writer) error { 271 271 + return p.executePlain("user/completeSignup", w, nil) 272 272 + } 273 273 + 274 274 + type TermsOfServiceParams struct { 275 275 + LoggedInUser *oauth.User 276 276 + } 277 277 + 278 278 + func (p *Pages) TermsOfService(w io.Writer, params TermsOfServiceParams) error { 279 279 + return p.execute("legal/terms", w, params) 280 280 + } 281 281 + 282 282 + type PrivacyPolicyParams struct { 283 283 + LoggedInUser *oauth.User 284 284 + } 285 285 + 286 286 + func (p *Pages) PrivacyPolicy(w io.Writer, params PrivacyPolicyParams) error { 287 287 + return p.execute("legal/privacy", w, params) 288 288 + } 289 289 + 264 290 type TimelineParams struct { 265 291 LoggedInUser *oauth.User 266 292 Timeline []db.TimelineEvent ··· 390 416 UserDid string 391 417 UserHandle string 392 418 FollowStatus db.FollowStatus 393 393 - AvatarUri string 394 419 Followers int 395 420 Following int 396 421 ··· 623 648 LoggedInUser *oauth.User 624 649 RepoInfo repoinfo.RepoInfo 625 650 Active string 651 651 + Unsupported bool 652 652 + IsImage bool 653 653 + IsVideo bool 654 654 + ContentSrc string 626 655 BreadCrumbs [][]string 627 656 ShowRendered bool 628 657 RenderToggle bool ··· 690 719 Branches []types.Branch 691 720 Spindles []string 692 721 CurrentSpindle string 722 722 + Secrets []*tangled.RepoListSecrets_Secret 723 723 + 693 724 // TODO: use repoinfo.roles 694 725 IsCollaboratorInviteAllowed bool 695 726 } ··· 699 730 return p.executeRepo("repo/settings", w, params) 700 731 } 701 732 733 733 + type RepoGeneralSettingsParams struct { 734 734 + LoggedInUser *oauth.User 735 735 + RepoInfo repoinfo.RepoInfo 736 736 + Active string 737 737 + Tabs []map[string]any 738 738 + Tab string 739 739 + Branches []types.Branch 740 740 + } 741 741 + 742 742 + func (p *Pages) RepoGeneralSettings(w io.Writer, params RepoGeneralSettingsParams) error { 743 743 + params.Active = "settings" 744 744 + return p.executeRepo("repo/settings/general", w, params) 745 745 + } 746 746 + 747 747 + type RepoAccessSettingsParams struct { 748 748 + LoggedInUser *oauth.User 749 749 + RepoInfo repoinfo.RepoInfo 750 750 + Active string 751 751 + Tabs []map[string]any 752 752 + Tab string 753 753 + Collaborators []Collaborator 754 754 + } 755 755 + 756 756 + func (p *Pages) RepoAccessSettings(w io.Writer, params RepoAccessSettingsParams) error { 757 757 + params.Active = "settings" 758 758 + return p.executeRepo("repo/settings/access", w, params) 759 759 + } 760 760 + 761 761 + type RepoPipelineSettingsParams struct { 762 762 + LoggedInUser *oauth.User 763 763 + RepoInfo repoinfo.RepoInfo 764 764 + Active string 765 765 + Tabs []map[string]any 766 766 + Tab string 767 767 + Spindles []string 768 768 + CurrentSpindle string 769 769 + Secrets []map[string]any 770 770 + } 771 771 + 772 772 + func (p *Pages) RepoPipelineSettings(w io.Writer, params RepoPipelineSettingsParams) error { 773 773 + params.Active = "settings" 774 774 + return p.executeRepo("repo/settings/pipelines", w, params) 775 775 + } 776 776 + 702 777 type RepoIssuesParams struct { 703 778 LoggedInUser *oauth.User 704 779 RepoInfo repoinfo.RepoInfo ··· 810 885 DidHandleMap map[string]string 811 886 FilteringBy db.PullState 812 887 Stacks map[string]db.Stack 888 888 + Pipelines map[string]db.Pipeline 813 889 } 814 890 815 891 func (p *Pages) RepoPulls(w io.Writer, params RepoPullsParams) error { ··· 1066 1142 func (p *Pages) Workflow(w io.Writer, params WorkflowParams) error { 1067 1143 params.Active = "pipelines" 1068 1144 return p.executeRepo("repo/pipelines/workflow", w, params) 1145 1145 + } 1146 1146 + 1147 1147 + type PutStringParams struct { 1148 1148 + LoggedInUser *oauth.User 1149 1149 + Action string 1150 1150 + 1151 1151 + // this is supplied in the case of editing an existing string 1152 1152 + String db.String 1153 1153 + } 1154 1154 + 1155 1155 + func (p *Pages) PutString(w io.Writer, params PutStringParams) error { 1156 1156 + return p.execute("strings/put", w, params) 1157 1157 + } 1158 1158 + 1159 1159 + type StringsDashboardParams struct { 1160 1160 + LoggedInUser *oauth.User 1161 1161 + Card ProfileCard 1162 1162 + Strings []db.String 1163 1163 + } 1164 1164 + 1165 1165 + func (p *Pages) StringsDashboard(w io.Writer, params StringsDashboardParams) error { 1166 1166 + return p.execute("strings/dashboard", w, params) 1167 1167 + } 1168 1168 + 1169 1169 + type SingleStringParams struct { 1170 1170 + LoggedInUser *oauth.User 1171 1171 + ShowRendered bool 1172 1172 + RenderToggle bool 1173 1173 + RenderedContents template.HTML 1174 1174 + String db.String 1175 1175 + Stats db.StringStats 1176 1176 + Owner identity.Identity 1177 1177 + } 1178 1178 + 1179 1179 + func (p *Pages) SingleString(w io.Writer, params SingleStringParams) error { 1180 1180 + var style *chroma.Style = styles.Get("catpuccin-latte") 1181 1181 + 1182 1182 + if params.ShowRendered { 1183 1183 + switch markup.GetFormat(params.String.Filename) { 1184 1184 + case markup.FormatMarkdown: 1185 1185 + p.rctx.RendererType = markup.RendererTypeDefault 1186 1186 + htmlString := p.rctx.RenderMarkdown(params.String.Contents) 1187 1187 + params.RenderedContents = template.HTML(p.rctx.Sanitize(htmlString)) 1188 1188 + } 1189 1189 + } 1190 1190 + 1191 1191 + c := params.String.Contents 1192 1192 + formatter := chromahtml.New( 1193 1193 + chromahtml.InlineCode(false), 1194 1194 + chromahtml.WithLineNumbers(true), 1195 1195 + chromahtml.WithLinkableLineNumbers(true, "L"), 1196 1196 + chromahtml.Standalone(false), 1197 1197 + chromahtml.WithClasses(true), 1198 1198 + ) 1199 1199 + 1200 1200 + lexer := lexers.Get(filepath.Base(params.String.Filename)) 1201 1201 + if lexer == nil { 1202 1202 + lexer = lexers.Fallback 1203 1203 + } 1204 1204 + 1205 1205 + iterator, err := lexer.Tokenise(nil, c) 1206 1206 + if err != nil { 1207 1207 + return fmt.Errorf("chroma tokenize: %w", err) 1208 1208 + } 1209 1209 + 1210 1210 + var code bytes.Buffer 1211 1211 + err = formatter.Format(&code, style, iterator) 1212 1212 + if err != nil { 1213 1213 + return fmt.Errorf("chroma format: %w", err) 1214 1214 + } 1215 1215 + 1216 1216 + params.String.Contents = code.String() 1217 1217 + return p.execute("strings/string", w, params) 1069 1218 } 1070 1219 1071 1220 func (p *Pages) Static() http.Handler {

+1 -1

appview/pages/templates/knots/fragments/addMemberModal.html

··· 13 13 <div 14 14 id="add-member-{{ .Id }}" 15 15 popover 16 16 - class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded drop-shadow dark:text-white"> 16 16 + class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-gray-200 dark:border-gray-700 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50"> 17 17 {{ block "addKnotMemberPopover" . }} {{ end }} 18 18 </div> 19 19 {{ end }}

+19 -30

appview/pages/templates/layouts/base.html

··· 14 14 <title>{{ block "title" . }}{{ end }} · tangled</title> 15 15 {{ block "extrameta" . }}{{ end }} 16 16 </head> 17 17 - <body class="bg-slate-100 dark:bg-gray-900 dark:text-white transition-colors duration-200"> 18 18 - <div class="px-1"> 19 19 - {{ block "topbarLayout" . }} 20 20 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 21 21 - <header class="col-span-1 md:col-start-3 md:col-span-8" style="z-index: 20;"> 22 22 - {{ template "layouts/topbar" . }} 23 23 - </header> 24 24 - </div> 25 25 - {{ end }} 26 26 - </div> 17 17 + <body class="min-h-screen grid grid-cols-1 grid-rows-[min-content_auto_min-content] md:grid-cols-12 gap-4 bg-slate-100 dark:bg-gray-900 dark:text-white transition-colors duration-200"> 18 18 + {{ block "topbarLayout" . }} 19 19 + <header class="px-1 col-span-1 md:col-start-3 md:col-span-8" style="z-index: 20;"> 20 20 + {{ template "layouts/topbar" . }} 21 21 + </header> 22 22 + {{ end }} 27 23 28 28 - <div class="px-1 flex flex-col min-h-screen gap-4"> 29 29 - {{ block "contentLayout" . }} 30 30 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 24 24 + {{ block "mainLayout" . }} 25 25 + <div class="px-1 col-span-1 md:col-start-3 md:col-span-8 flex flex-col gap-4"> 26 26 + {{ block "contentLayout" . }} 31 27 <div class="col-span-1 md:col-span-2"> 32 28 {{ block "contentLeft" . }} {{ end }} 33 29 </div> ··· 37 33 <div class="col-span-1 md:col-span-2"> 38 34 {{ block "contentRight" . }} {{ end }} 39 35 </div> 40 40 - </div> 41 41 - {{ end }} 42 42 - 43 43 - {{ block "contentAfterLayout" . }} 44 44 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 36 36 + {{ end }} 37 37 + 38 38 + {{ block "contentAfterLayout" . }} 45 39 <div class="col-span-1 md:col-span-2"> 46 40 {{ block "contentAfterLeft" . }} {{ end }} 47 41 </div> ··· 51 45 <div class="col-span-1 md:col-span-2"> 52 46 {{ block "contentAfterRight" . }} {{ end }} 53 47 </div> 54 54 - </div> 55 55 - {{ end }} 56 56 - </div> 57 57 - 58 58 - <div class="px-1 mt-16"> 59 59 - {{ block "footerLayout" . }} 60 60 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 61 61 - <footer class="col-span-1 md:col-start-3 md:col-span-8"> 62 62 - {{ template "layouts/footer" . }} 63 63 - </footer> 48 48 + {{ end }} 64 49 </div> 65 65 - {{ end }} 66 66 - </div> 50 50 + {{ end }} 67 51 52 52 + {{ block "footerLayout" . }} 53 53 + <footer class="px-1 col-span-1 md:col-start-3 md:col-span-8 mt-12"> 54 54 + {{ template "layouts/footer" . }} 55 55 + </footer> 56 56 + {{ end }} 68 57 </body> 69 58 </html> 70 59 {{ end }}

+44 -3

appview/pages/templates/layouts/footer.html

··· 1 1 {{ define "layouts/footer" }} 2 2 - <div class="w-full p-4 bg-white dark:bg-gray-800 rounded-t drop-shadow-sm"> 3 3 - <div class="container mx-auto text-center text-gray-600 dark:text-gray-400 text-sm"> 4 4 - <span class="font-semibold italic">tangled</span> &mdash; made by <a href="/@oppi.li">@oppi.li</a> and <a href="/@icyphox.sh">@icyphox.sh</a> 2 2 + <div class="w-full p-4 md:p-8 bg-white dark:bg-gray-800 rounded-t drop-shadow-sm"> 3 3 + <div class="container mx-auto max-w-7xl px-4"> 4 4 + <div class="flex flex-col lg:flex-row justify-between items-start text-gray-600 dark:text-gray-400 text-sm gap-8"> 5 5 + <div class="mb-4 md:mb-0"> 6 6 + <a href="/" hx-boost="true" class="flex gap-2 font-semibold italic"> 7 7 + tangled_alpha 8 8 + </a> 9 9 + </div> 10 10 + 11 11 + {{ $headerStyle := "text-gray-900 dark:text-gray-200 font-bold text-xs uppercase tracking-wide mb-1" }} 12 12 + {{ $linkStyle := "text-gray-500 dark:text-gray-400 hover:text-gray-900 dark:hover:text-gray-200 hover:underline inline-flex gap-1 items-center" }} 13 13 + {{ $iconStyle := "w-4 h-4 flex-shrink-0" }} 14 14 + <div class="grid grid-cols-1 sm:grid-cols-1 md:grid-cols-4 sm:gap-6 md:gap-2 gap-6 flex-1"> 15 15 + <div class="flex flex-col gap-1"> 16 16 + <div class="{{ $headerStyle }}">legal</div> 17 17 + <a href="/terms" class="{{ $linkStyle }}">{{ i "file-text" $iconStyle }} terms of service</a> 18 18 + <a href="/privacy" class="{{ $linkStyle }}">{{ i "shield" $iconStyle }} privacy policy</a> 19 19 + </div> 20 20 + 21 21 + <div class="flex flex-col gap-1"> 22 22 + <div class="{{ $headerStyle }}">resources</div> 23 23 + <a href="https://blog.tangled.sh" class="{{ $linkStyle }}" target="_blank" rel="noopener noreferrer">{{ i "book-open" $iconStyle }} blog</a> 24 24 + <a href="https://tangled.sh/@tangled.sh/core/tree/master/docs" class="{{ $linkStyle }}">{{ i "book" $iconStyle }} docs</a> 25 25 + <a href="https://tangled.sh/@tangled.sh/core" class="{{ $linkStyle }}">{{ i "code" $iconStyle }} source</a> 26 26 + </div> 27 27 + 28 28 + <div class="flex flex-col gap-1"> 29 29 + <div class="{{ $headerStyle }}">social</div> 30 30 + <a href="https://chat.tangled.sh" class="{{ $linkStyle }}" target="_blank" rel="noopener noreferrer">{{ i "message-circle" $iconStyle }} discord</a> 31 31 + <a href="https://web.libera.chat/#tangled" class="{{ $linkStyle }}" target="_blank" rel="noopener noreferrer">{{ i "hash" $iconStyle }} irc</a> 32 32 + <a href="https://bsky.app/profile/tangled.sh" class="{{ $linkStyle }}" target="_blank" rel="noopener noreferrer">{{ template "user/fragments/bluesky" $iconStyle }} bluesky</a> 33 33 + </div> 34 34 + 35 35 + <div class="flex flex-col gap-1"> 36 36 + <div class="{{ $headerStyle }}">contact</div> 37 37 + <a href="mailto:team@tangled.sh" class="{{ $linkStyle }}">{{ i "mail" "w-4 h-4 flex-shrink-0" }} team@tangled.sh</a> 38 38 + <a href="mailto:security@tangled.sh" class="{{ $linkStyle }}">{{ i "shield-check" "w-4 h-4 flex-shrink-0" }} security@tangled.sh</a> 39 39 + </div> 40 40 + </div> 41 41 + 42 42 + <div class="text-center lg:text-right flex-shrink-0"> 43 43 + <div class="text-xs">&copy; 2025 Tangled Labs Oy. All rights reserved.</div> 44 44 + </div> 5 45 </div> 46 46 + </div> 6 47 </div> 7 48 {{ end }}

+26 -17

appview/pages/templates/layouts/topbar.html

··· 1 1 {{ define "layouts/topbar" }} 2 2 - <nav class="space-x-4 mb-4 px-6 py-2 rounded bg-white dark:bg-gray-800 dark:text-white drop-shadow-sm"> 2 2 + <nav class="space-x-4 px-6 py-2 rounded bg-white dark:bg-gray-800 dark:text-white drop-shadow-sm"> 3 3 <div class="flex justify-between p-0 items-center"> 4 4 <div id="left-items"> 5 5 <a href="/" hx-boost="true" class="flex gap-2 font-semibold italic"> 6 6 tangled_alpha 7 7 </a> 8 8 </div> 9 9 - <div class="hidden md:flex gap-4 items-center"> 10 10 - <a href="https://chat.tangled.sh" class="inline-flex gap-1 items-center"> 11 11 - {{ i "message-circle" "size-4" }} discord 12 12 - </a> 13 9 14 14 - <a href="https://web.libera.chat/#tangled" class="inline-flex gap-1 items-center"> 15 15 - {{ i "hash" "size-4" }} irc 16 16 - </a> 17 17 - 18 18 - <a href="https://tangled.sh/@tangled.sh/core" class="inline-flex gap-1 items-center"> 19 19 - {{ i "code" "size-4" }} source 20 20 - </a> 21 21 - </div> 22 22 - <div id="right-items" class="flex items-center gap-4"> 10 10 + <div id="right-items" class="flex items-center gap-2"> 23 11 {{ with .LoggedInUser }} 24 24 - <a href="/repo/new" hx-boost="true" class="btn-create hover:no-underline hover:text-white"> 25 25 - {{ i "plus" "w-4 h-4" }} 26 26 - </a> 12 12 + {{ block "newButton" . }} {{ end }} 27 13 {{ block "dropDown" . }} {{ end }} 28 14 {{ else }} 29 15 <a href="/login">login</a> 16 16 + <span class="text-gray-500 dark:text-gray-400">or</span> 17 17 + <a href="/signup" class="btn-create py-0 hover:no-underline hover:text-white flex items-center gap-2"> 18 18 + join now {{ i "arrow-right" "size-4" }} 19 19 + </a> 30 20 {{ end }} 31 21 </div> 32 22 </div> 33 23 </nav> 34 24 {{ end }} 35 25 26 26 + {{ define "newButton" }} 27 27 + <details class="relative inline-block text-left"> 28 28 + <summary class="btn-create py-0 cursor-pointer list-none flex items-center gap-2"> 29 29 + {{ i "plus" "w-4 h-4" }} new 30 30 + </summary> 31 31 + <div class="absolute flex flex-col right-0 mt-4 p-4 rounded w-48 bg-white dark:bg-gray-800 dark:text-white border border-gray-200 dark:border-gray-700"> 32 32 + <a href="/repo/new" class="flex items-center gap-2"> 33 33 + {{ i "book-plus" "w-4 h-4" }} 34 34 + new repository 35 35 + </a> 36 36 + <a href="/strings/new" class="flex items-center gap-2"> 37 37 + {{ i "line-squiggle" "w-4 h-4" }} 38 38 + new string 39 39 + </a> 40 40 + </div> 41 41 + </details> 42 42 + {{ end }} 43 43 + 36 44 {{ define "dropDown" }} 37 45 <details class="relative inline-block text-left"> 38 46 <summary ··· 46 54 > 47 55 <a href="/{{ $user }}">profile</a> 48 56 <a href="/{{ $user }}?tab=repos">repositories</a> 57 57 + <a href="/strings/{{ $user }}">strings</a> 49 58 <a href="/knots">knots</a> 50 59 <a href="/spindles">spindles</a> 51 60 <a href="/settings">settings</a>

+133

appview/pages/templates/legal/privacy.html

··· 1 1 + {{ define "title" }} privacy policy {{ end }} 2 2 + {{ define "content" }} 3 3 + <div class="max-w-4xl mx-auto px-4 py-8"> 4 4 + <div class="bg-white dark:bg-gray-800 rounded-lg shadow-sm p-8"> 5 5 + <div class="prose prose-gray dark:prose-invert max-w-none"> 6 6 + <h1>Privacy Policy</h1> 7 7 + 8 8 + <p><strong>Last updated:</strong> {{ now.Format "January 2, 2006" }}</p> 9 9 + 10 10 + <p>This Privacy Policy describes how Tangled ("we," "us," or "our") collects, uses, and shares your personal information when you use our platform and services (the "Service").</p> 11 11 + 12 12 + <h2>1. Information We Collect</h2> 13 13 + 14 14 + <h3>Account Information</h3> 15 15 + <p>When you create an account, we collect:</p> 16 16 + <ul> 17 17 + <li>Your chosen username</li> 18 18 + <li>Email address</li> 19 19 + <li>Profile information you choose to provide</li> 20 20 + <li>Authentication data</li> 21 21 + </ul> 22 22 + 23 23 + <h3>Content and Activity</h3> 24 24 + <p>We store:</p> 25 25 + <ul> 26 26 + <li>Code repositories and associated metadata</li> 27 27 + <li>Issues, pull requests, and comments</li> 28 28 + <li>Activity logs and usage patterns</li> 29 29 + <li>Public keys for authentication</li> 30 30 + </ul> 31 31 + 32 32 + <h2>2. Data Location and Hosting</h2> 33 33 + <div class="bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg p-4 my-6"> 34 34 + <h3 class="text-blue-800 dark:text-blue-200 font-semibold mb-2">EU Data Hosting</h3> 35 35 + <p class="text-blue-700 dark:text-blue-300"> 36 36 + <strong>All Tangled service data is hosted within the European Union.</strong> Specifically: 37 37 + </p> 38 38 + <ul class="text-blue-700 dark:text-blue-300 mt-2"> 39 39 + <li><strong>Personal Data Servers (PDS):</strong> Accounts hosted on Tangled PDS (*.tngl.sh) are located in Finland</li> 40 40 + <li><strong>Application Data:</strong> All other service data is stored on EU-based servers</li> 41 41 + <li><strong>Data Processing:</strong> All data processing occurs within EU jurisdiction</li> 42 42 + </ul> 43 43 + </div> 44 44 + 45 45 + <div class="bg-yellow-50 dark:bg-yellow-900/20 border border-yellow-200 dark:border-yellow-800 rounded-lg p-4 my-6"> 46 46 + <h3 class="text-yellow-800 dark:text-yellow-200 font-semibold mb-2">External PDS Notice</h3> 47 47 + <p class="text-yellow-700 dark:text-yellow-300"> 48 48 + <strong>Important:</strong> If your account is hosted on Bluesky's PDS or other self-hosted Personal Data Servers (not *.tngl.sh), we do not control that data. The data protection, storage location, and privacy practices for such accounts are governed by the respective PDS provider's policies, not this Privacy Policy. We only control data processing within our own services and infrastructure. 49 49 + </p> 50 50 + </div> 51 51 + 52 52 + <h2>3. Third-Party Data Processors</h2> 53 53 + <p>We only share your data with the following third-party processors:</p> 54 54 + 55 55 + <h3>Resend (Email Services)</h3> 56 56 + <ul> 57 57 + <li><strong>Purpose:</strong> Sending transactional emails (account verification, notifications)</li> 58 58 + <li><strong>Data Shared:</strong> Email address and necessary message content</li> 59 59 + <li><strong>Location:</strong> EU-compliant email delivery service</li> 60 60 + </ul> 61 61 + 62 62 + <h3>Cloudflare (Image Caching)</h3> 63 63 + <ul> 64 64 + <li><strong>Purpose:</strong> Caching and optimizing image delivery</li> 65 65 + <li><strong>Data Shared:</strong> Public images and associated metadata for caching purposes</li> 66 66 + <li><strong>Location:</strong> Global CDN with EU data protection compliance</li> 67 67 + </ul> 68 68 + 69 69 + <h2>4. How We Use Your Information</h2> 70 70 + <p>We use your information to:</p> 71 71 + <ul> 72 72 + <li>Provide and maintain the Service</li> 73 73 + <li>Process your transactions and requests</li> 74 74 + <li>Send you technical notices and support messages</li> 75 75 + <li>Improve and develop new features</li> 76 76 + <li>Ensure security and prevent fraud</li> 77 77 + <li>Comply with legal obligations</li> 78 78 + </ul> 79 79 + 80 80 + <h2>5. Data Sharing and Disclosure</h2> 81 81 + <p>We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:</p> 82 82 + <ul> 83 83 + <li>With the third-party processors listed above</li> 84 84 + <li>When required by law or legal process</li> 85 85 + <li>To protect our rights, property, or safety, or that of our users</li> 86 86 + <li>In connection with a merger, acquisition, or sale of assets (with appropriate protections)</li> 87 87 + </ul> 88 88 + 89 89 + <h2>6. Data Security</h2> 90 90 + <p>We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.</p> 91 91 + 92 92 + <h2>7. Data Retention</h2> 93 93 + <p>We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.</p> 94 94 + 95 95 + <h2>8. Your Rights</h2> 96 96 + <p>Under applicable data protection laws, you have the right to:</p> 97 97 + <ul> 98 98 + <li>Access your personal information</li> 99 99 + <li>Correct inaccurate information</li> 100 100 + <li>Request deletion of your information</li> 101 101 + <li>Object to processing of your information</li> 102 102 + <li>Data portability</li> 103 103 + <li>Withdraw consent (where applicable)</li> 104 104 + </ul> 105 105 + 106 106 + <h2>9. Cookies and Tracking</h2> 107 107 + <p>We use cookies and similar technologies to:</p> 108 108 + <ul> 109 109 + <li>Maintain your login session</li> 110 110 + <li>Remember your preferences</li> 111 111 + <li>Analyze usage patterns to improve the Service</li> 112 112 + </ul> 113 113 + <p>You can control cookie settings through your browser preferences.</p> 114 114 + 115 115 + <h2>10. Children's Privacy</h2> 116 116 + <p>The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take steps to delete it.</p> 117 117 + 118 118 + <h2>11. International Data Transfers</h2> 119 119 + <p>While all our primary data processing occurs within the EU, some of our third-party processors may process data outside the EU. When this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.</p> 120 120 + 121 121 + <h2>12. Changes to This Privacy Policy</h2> 122 122 + <p>We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.</p> 123 123 + 124 124 + <h2>13. Contact Information</h2> 125 125 + <p>If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us through our platform or via email.</p> 126 126 + 127 127 + <div class="mt-8 pt-6 border-t border-gray-200 dark:border-gray-700 text-sm text-gray-600 dark:text-gray-400"> 128 128 + <p>This Privacy Policy complies with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws.</p> 129 129 + </div> 130 130 + </div> 131 131 + </div> 132 132 + </div> 133 133 + {{ end }}

+71

appview/pages/templates/legal/terms.html

··· 1 1 + {{ define "title" }}terms of service{{ end }} 2 2 + 3 3 + {{ define "content" }} 4 4 + <div class="max-w-4xl mx-auto px-4 py-8"> 5 5 + <div class="bg-white dark:bg-gray-800 rounded-lg shadow-sm p-8"> 6 6 + <div class="prose prose-gray dark:prose-invert max-w-none"> 7 7 + <h1>Terms of Service</h1> 8 8 + 9 9 + <p><strong>Last updated:</strong> {{ now.Format "January 2, 2006" }}</p> 10 10 + 11 11 + <p>Welcome to Tangled. These Terms of Service ("Terms") govern your access to and use of the Tangled platform and services (the "Service") operated by us ("Tangled," "we," "us," or "our").</p> 12 12 + 13 13 + <h2>1. Acceptance of Terms</h2> 14 14 + <p>By accessing or using our Service, you agree to be bound by these Terms. If you disagree with any part of these terms, then you may not access the Service.</p> 15 15 + 16 16 + <h2>2. Account Registration</h2> 17 17 + <p>To use certain features of the Service, you must register for an account. You agree to provide accurate, current, and complete information during the registration process and to update such information to keep it accurate, current, and complete.</p> 18 18 + 19 19 + <h2>3. Account Termination</h2> 20 20 + <div class="bg-red-50 dark:bg-red-900/20 border border-red-200 dark:border-red-800 rounded-lg p-4 my-6"> 21 21 + <h3 class="text-red-800 dark:text-red-200 font-semibold mb-2">Important Notice</h3> 22 22 + <p class="text-red-700 dark:text-red-300"> 23 23 + <strong>We reserve the right to terminate, suspend, or restrict access to your account at any time, for any reason, or for no reason at all, at our sole discretion.</strong> This includes, but is not limited to, termination for violation of these Terms, inappropriate conduct, spam, abuse, or any other behavior we deem harmful to the Service or other users. 24 24 + </p> 25 25 + <p class="text-red-700 dark:text-red-300 mt-2"> 26 26 + Account termination may result in the loss of access to your repositories, data, and other content associated with your account. We are not obligated to provide advance notice of termination, though we may do so in our discretion. 27 27 + </p> 28 28 + </div> 29 29 + 30 30 + <h2>4. Acceptable Use</h2> 31 31 + <p>You agree not to use the Service to:</p> 32 32 + <ul> 33 33 + <li>Violate any applicable laws or regulations</li> 34 34 + <li>Infringe upon the rights of others</li> 35 35 + <li>Upload, store, or share content that is illegal, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, or otherwise objectionable</li> 36 36 + <li>Engage in spam, phishing, or other deceptive practices</li> 37 37 + <li>Attempt to gain unauthorized access to the Service or other users' accounts</li> 38 38 + <li>Interfere with or disrupt the Service or servers connected to the Service</li> 39 39 + </ul> 40 40 + 41 41 + <h2>5. Content and Intellectual Property</h2> 42 42 + <p>You retain ownership of the content you upload to the Service. By uploading content, you grant us a non-exclusive, worldwide, royalty-free license to use, reproduce, modify, and distribute your content as necessary to provide the Service.</p> 43 43 + 44 44 + <h2>6. Privacy</h2> 45 45 + <p>Your privacy is important to us. Please review our <a href="/privacy" class="text-blue-600 hover:text-blue-800 dark:text-blue-400 dark:hover:text-blue-300">Privacy Policy</a>, which also governs your use of the Service.</p> 46 46 + 47 47 + <h2>7. Disclaimers</h2> 48 48 + <p>The Service is provided on an "AS IS" and "AS AVAILABLE" basis. We make no warranties, expressed or implied, and hereby disclaim and negate all other warranties including without limitation, implied warranties or conditions of merchantability, fitness for a particular purpose, or non-infringement of intellectual property or other violation of rights.</p> 49 49 + 50 50 + <h2>8. Limitation of Liability</h2> 51 51 + <p>In no event shall Tangled, nor its directors, employees, partners, agents, suppliers, or affiliates, be liable for any indirect, incidental, special, consequential, or punitive damages, including without limitation, loss of profits, data, use, goodwill, or other intangible losses, resulting from your use of the Service.</p> 52 52 + 53 53 + <h2>9. Indemnification</h2> 54 54 + <p>You agree to defend, indemnify, and hold harmless Tangled and its affiliates, officers, directors, employees, and agents from and against any and all claims, damages, obligations, losses, liabilities, costs, or debt, and expenses (including attorney's fees).</p> 55 55 + 56 56 + <h2>10. Governing Law</h2> 57 57 + <p>These Terms shall be interpreted and governed by the laws of Finland, without regard to its conflict of law provisions.</p> 58 58 + 59 59 + <h2>11. Changes to Terms</h2> 60 60 + <p>We reserve the right to modify or replace these Terms at any time. If a revision is material, we will try to provide at least 30 days notice prior to any new terms taking effect.</p> 61 61 + 62 62 + <h2>12. Contact Information</h2> 63 63 + <p>If you have any questions about these Terms of Service, please contact us through our platform or via email.</p> 64 64 + 65 65 + <div class="mt-8 pt-6 border-t border-gray-200 dark:border-gray-700 text-sm text-gray-600 dark:text-gray-400"> 66 66 + <p>These terms are effective as of the last updated date shown above and will remain in effect except with respect to any changes in their provisions in the future, which will be in effect immediately after being posted on this page.</p> 67 67 + </div> 68 68 + </div> 69 69 + </div> 70 70 + </div> 71 71 + {{ end }}

+19 -6

appview/pages/templates/repo/blob.html

··· 5 5 6 6 {{ $title := printf "%s at %s &middot; %s" .Path .Ref .RepoInfo.FullName }} 7 7 {{ $url := printf "https://tangled.sh/%s/blob/%s/%s" .RepoInfo.FullName .Ref .Path }} 8 8 - 8 8 + 9 9 {{ template "repo/fragments/og" (dict "RepoInfo" .RepoInfo "Title" $title "Url" $url) }} 10 10 - 10 10 + 11 11 {{ end }} 12 12 13 13 {{ define "repoContent" }} ··· 44 44 <a href="/{{ .RepoInfo.FullName }}/raw/{{ .Ref }}/{{ .Path }}">view raw</a> 45 45 {{ if .RenderToggle }} 46 46 <span class="select-none px-1 md:px-2 [&:before]:content-['·']"></span> 47 47 - <a 48 48 - href="/{{ .RepoInfo.FullName }}/blob/{{ .Ref }}/{{ .Path }}?code={{ .ShowRendered }}" 47 47 + <a 48 48 + href="/{{ .RepoInfo.FullName }}/blob/{{ .Ref }}/{{ .Path }}?code={{ .ShowRendered }}" 49 49 hx-boost="true" 50 50 >view {{ if .ShowRendered }}code{{ else }}rendered{{ end }}</a> 51 51 {{ end }} 52 52 </div> 53 53 </div> 54 54 </div> 55 55 - {{ if .IsBinary }} 55 55 + {{ if and .IsBinary .Unsupported }} 56 56 <p class="text-center text-gray-400 dark:text-gray-500"> 57 57 - This is a binary file and will not be displayed. 57 57 + Previews are not supported for this file type. 58 58 </p> 59 59 + {{ else if .IsBinary }} 60 60 + <div class="text-center"> 61 61 + {{ if .IsImage }} 62 62 + <img src="{{ .ContentSrc }}" 63 63 + alt="{{ .Path }}" 64 64 + class="max-w-full h-auto mx-auto border border-gray-200 dark:border-gray-700 rounded" /> 65 65 + {{ else if .IsVideo }} 66 66 + <video controls class="max-w-full h-auto mx-auto border border-gray-200 dark:border-gray-700 rounded"> 67 67 + <source src="{{ .ContentSrc }}"> 68 68 + Your browser does not support the video tag. 69 69 + </video> 70 70 + {{ end }} 71 71 + </div> 59 72 {{ else }} 60 73 <div class="overflow-auto relative"> 61 74 {{ if .ShowRendered }}

+20 -14

appview/pages/templates/repo/commit.html

··· 80 80 {{end}} 81 81 82 82 {{ define "topbarLayout" }} 83 83 - <header style="z-index: 20;"> 83 83 + <header class="px-1 col-span-full" style="z-index: 20;"> 84 84 {{ template "layouts/topbar" . }} 85 85 </header> 86 86 {{ end }} 87 87 88 88 - {{ define "contentLayout" }} 89 89 - {{ block "content" . }}{{ end }} 90 90 - {{ end }} 88 88 + {{ define "mainLayout" }} 89 89 + <div class="px-1 col-span-full flex flex-col gap-4"> 90 90 + {{ block "contentLayout" . }} 91 91 + {{ block "content" . }}{{ end }} 92 92 + {{ end }} 91 93 92 92 - {{ define "contentAfterLayout" }} 93 93 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 94 94 - <div class="col-span-1 md:col-span-2"> 95 95 - {{ block "contentAfterLeft" . }} {{ end }} 94 94 + {{ block "contentAfterLayout" . }} 95 95 + <div class="flex-grow grid grid-cols-1 md:grid-cols-12 gap-4"> 96 96 + <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 97 97 + {{ block "contentAfterLeft" . }} {{ end }} 98 98 + </div> 99 99 + <main class="col-span-1 md:col-span-10"> 100 100 + {{ block "contentAfter" . }}{{ end }} 101 101 + </main> 96 102 </div> 97 97 - <main class="col-span-1 md:col-span-10"> 98 98 - {{ block "contentAfter" . }}{{ end }} 99 99 - </main> 103 103 + {{ end }} 100 104 </div> 101 105 {{ end }} 102 106 103 103 - {{ define "footerLayout" }} 104 104 - {{ template "layouts/footer" . }} 107 107 + {{ define "footerLayout" }} 108 108 + <footer class="px-1 col-span-full mt-12"> 109 109 + {{ template "layouts/footer" . }} 110 110 + </footer> 105 111 {{ end }} 106 112 107 113 {{ define "contentAfter" }} ··· 112 118 <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 113 119 {{ template "repo/fragments/diffOpts" .DiffOpts }} 114 120 </div> 115 115 - <div class="sticky top-0 mt-4"> 121 121 + <div class="sticky top-0 flex-grow max-h-screen"> 116 122 {{ template "repo/fragments/diffChangedFiles" .Diff }} 117 123 </div> 118 124 {{end}}

+22 -14

appview/pages/templates/repo/compare/compare.html

··· 11 11 {{ end }} 12 12 13 13 {{ define "topbarLayout" }} 14 14 - {{ template "layouts/topbar" . }} 14 14 + <header class="px-1 col-span-full" style="z-index: 20;"> 15 15 + {{ template "layouts/topbar" . }} 16 16 + </header> 15 17 {{ end }} 16 18 17 17 - {{ define "contentLayout" }} 18 18 - {{ block "content" . }}{{ end }} 19 19 - {{ end }} 19 19 + {{ define "mainLayout" }} 20 20 + <div class="px-1 col-span-full flex flex-col gap-4"> 21 21 + {{ block "contentLayout" . }} 22 22 + {{ block "content" . }}{{ end }} 23 23 + {{ end }} 20 24 21 21 - {{ define "contentAfterLayout" }} 22 22 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 23 23 - <div class="col-span-1 md:col-span-2"> 24 24 - {{ block "contentAfterLeft" . }} {{ end }} 25 25 + {{ block "contentAfterLayout" . }} 26 26 + <div class="flex-grow grid grid-cols-1 md:grid-cols-12 gap-4"> 27 27 + <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 28 28 + {{ block "contentAfterLeft" . }} {{ end }} 29 29 + </div> 30 30 + <main class="col-span-1 md:col-span-10"> 31 31 + {{ block "contentAfter" . }}{{ end }} 32 32 + </main> 25 33 </div> 26 26 - <main class="col-span-1 md:col-span-10"> 27 27 - {{ block "contentAfter" . }}{{ end }} 28 28 - </main> 34 34 + {{ end }} 29 35 </div> 30 36 {{ end }} 31 37 32 32 - {{ define "footerLayout" }} 33 33 - {{ template "layouts/footer" . }} 38 38 + {{ define "footerLayout" }} 39 39 + <footer class="px-1 col-span-full mt-12"> 40 40 + {{ template "layouts/footer" . }} 41 41 + </footer> 34 42 {{ end }} 35 43 36 44 {{ define "contentAfter" }} ··· 41 49 <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 42 50 {{ template "repo/fragments/diffOpts" .DiffOpts }} 43 51 </div> 44 44 - <div class="sticky top-0 mt-4"> 52 52 + <div class="sticky top-0 flex-grow max-h-screen"> 45 53 {{ template "repo/fragments/diffChangedFiles" .Diff }} 46 54 </div> 47 55 {{end}}

+1 -1

appview/pages/templates/repo/fragments/diffChangedFiles.html

··· 1 1 {{ define "repo/fragments/diffChangedFiles" }} 2 2 {{ $stat := .Stat }} 3 3 {{ $fileTree := fileTree .ChangedFiles }} 4 4 - <section class="overflow-x-auto text-sm px-6 py-2 border border-gray-200 dark:border-gray-700 w-full mx-auto md:min-h-screen rounded bg-white dark:bg-gray-800 drop-shadow-sm"> 4 4 + <section class="overflow-x-auto text-sm px-6 py-2 border border-gray-200 dark:border-gray-700 w-full mx-auto min-h-full rounded bg-white dark:bg-gray-800 drop-shadow-sm"> 5 5 <div class="diff-stat"> 6 6 <div class="flex gap-2 items-center"> 7 7 <strong class="text-sm uppercase dark:text-gray-200">Changed files</strong>

+1 -1

appview/pages/templates/repo/fragments/interdiffFiles.html

··· 1 1 {{ define "repo/fragments/interdiffFiles" }} 2 2 {{ $fileTree := fileTree .AffectedFiles }} 3 3 - <section class="mt-4 px-6 py-2 border border-gray-200 dark:border-gray-700 w-full mx-auto rounded bg-white dark:bg-gray-800 drop-shadow-sm md:min-h-screen text-sm"> 3 3 + <section class="mt-4 px-6 py-2 border border-gray-200 dark:border-gray-700 w-full mx-auto rounded bg-white dark:bg-gray-800 drop-shadow-sm min-h-full text-sm"> 4 4 <div class="diff-stat"> 5 5 <div class="flex gap-2 items-center"> 6 6 <strong class="text-sm uppercase dark:text-gray-200">files</strong>

+9 -21

appview/pages/templates/repo/index.html

··· 170 170 {{ define "commitLog" }} 171 171 <div id="commit-log" class="md:col-span-1 px-2 pb-4"> 172 172 <div class="flex justify-between items-center"> 173 173 - <a href="/{{ .RepoInfo.FullName }}/commits/{{ .Ref | urlquery }}" class="flex text-black dark:text-white items-center gap-4 pb-2 no-underline hover:no-underline group"> 174 174 - <div class="flex gap-2 items-center font-bold"> 175 175 - {{ i "logs" "w-4 h-4" }} commits 176 176 - </div> 177 177 - <span class="hidden group-hover:flex gap-2 items-center text-sm text-gray-500 dark:text-gray-400 "> 178 178 - view {{ .TotalCommits }} commits {{ i "chevron-right" "w-4 h-4" }} 179 179 - </span> 173 173 + <a href="/{{ .RepoInfo.FullName }}/commits/{{ .Ref | urlquery }}" class="flex items-center gap-2 pb-2 cursor-pointer font-bold hover:text-gray-600 dark:hover:text-gray-300 hover:no-underline"> 174 174 + {{ i "logs" "w-4 h-4" }} commits 175 175 + <span class="bg-gray-100 dark:bg-gray-700 font-normal rounded py-1/2 px-1 text-sm">{{ .TotalCommits }}</span> 180 176 </a> 181 177 </div> 182 178 <div class="flex flex-col gap-6"> ··· 278 274 {{ define "branchList" }} 279 275 {{ if gt (len .BranchesTrunc) 0 }} 280 276 <div id="branches" class="md:col-span-1 px-2 py-4 border-t border-gray-200 dark:border-gray-700"> 281 281 - <a href="/{{ .RepoInfo.FullName }}/branches" class="flex text-black dark:text-white items-center gap-4 pb-2 no-underline hover:no-underline group"> 282 282 - <div class="flex gap-2 items-center font-bold"> 283 283 - {{ i "git-branch" "w-4 h-4" }} branches 284 284 - </div> 285 285 - <span class="hidden group-hover:flex gap-2 items-center text-sm text-gray-500 dark:text-gray-400 "> 286 286 - view {{ len .Branches }} branches {{ i "chevron-right" "w-4 h-4" }} 287 287 - </span> 277 277 + <a href="/{{ .RepoInfo.FullName }}/branches" class="flex items-center gap-2 pb-2 cursor-pointer font-bold hover:text-gray-600 dark:hover:text-gray-300 hover:no-underline"> 278 278 + {{ i "git-branch" "w-4 h-4" }} branches 279 279 + <span class="bg-gray-100 dark:bg-gray-700 font-normal rounded py-1/2 px-1 text-sm">{{ len .Branches }}</span> 288 280 </a> 289 281 <div class="flex flex-col gap-1"> 290 282 {{ range .BranchesTrunc }} ··· 321 313 {{ if gt (len .TagsTrunc) 0 }} 322 314 <div id="tags" class="md:col-span-1 px-2 py-4 border-t border-gray-200 dark:border-gray-700"> 323 315 <div class="flex justify-between items-center"> 324 324 - <a href="/{{ .RepoInfo.FullName }}/tags" class="flex text-black dark:text-white items-center gap-4 pb-2 no-underline hover:no-underline group"> 325 325 - <div class="flex gap-2 items-center font-bold"> 326 326 - {{ i "tags" "w-4 h-4" }} tags 327 327 - </div> 328 328 - <span class="hidden group-hover:flex gap-2 items-center text-sm text-gray-500 dark:text-gray-400 "> 329 329 - view {{ len .Tags }} tags {{ i "chevron-right" "w-4 h-4" }} 330 330 - </span> 316 316 + <a href="/{{ .RepoInfo.FullName }}/tags" class="flex items-center gap-2 pb-2 cursor-pointer font-bold hover:text-gray-600 dark:hover:text-gray-300 hover:no-underline"> 317 317 + {{ i "tags" "w-4 h-4" }} tags 318 318 + <span class="bg-gray-100 dark:bg-gray-700 font-normal rounded py-1/2 px-1 text-sm">{{ len .Tags }}</span> 331 319 </a> 332 320 </div> 333 321 <div class="flex flex-col gap-1">

+2 -4

appview/pages/templates/repo/issues/fragments/editIssueComment.html

··· 1 1 {{ define "repo/issues/fragments/editIssueComment" }} 2 2 {{ with .Comment }} 3 3 <div id="comment-container-{{.CommentId}}"> 4 4 - <div class="flex items-center gap-2 mb-2 text-gray-500 text-sm"> 4 4 + <div class="flex items-center gap-2 mb-2 text-gray-500 dark:text-gray-400 text-sm flex-wrap"> 5 5 {{ $owner := didOrHandle $.LoggedInUser.Did $.LoggedInUser.Handle }} 6 6 <a href="/{{ $owner }}" class="no-underline hover:underline">{{ $owner }}</a> 7 7 ··· 9 9 {{ $isIssueAuthor := eq .OwnerDid $.Issue.OwnerDid }} 10 10 {{ if $isIssueAuthor }} 11 11 <span class="before:content-['·']"></span> 12 12 - <span class="rounded bg-gray-100 text-black font-mono px-2 mx-1/2 inline-flex items-center"> 13 12 author 14 14 - </span> 15 13 {{ end }} 16 14 17 15 <span class="before:content-['·']"></span> 18 16 <a 19 17 href="#{{ .CommentId }}" 20 20 - class="text-gray-500 hover:text-gray-500 hover:underline no-underline" 18 18 + class="text-gray-500 dark:text-gray-400 hover:text-gray-500 dark:hover:text-gray-400 hover:underline no-underline" 21 19 id="{{ .CommentId }}"> 22 20 {{ template "repo/fragments/time" .Created }} 23 21 </a>

+7 -8

appview/pages/templates/repo/issues/fragments/issueComment.html

··· 5 5 {{ $owner := index $.DidHandleMap .OwnerDid }} 6 6 {{ template "user/fragments/picHandleLink" $owner }} 7 7 8 8 + <!-- show user "hats" --> 9 9 + {{ $isIssueAuthor := eq .OwnerDid $.Issue.OwnerDid }} 10 10 + {{ if $isIssueAuthor }} 11 11 + <span class="before:content-['·']"></span> 12 12 + author 13 13 + {{ end }} 14 14 + 8 15 <span class="before:content-['·']"></span> 9 16 <a 10 17 href="#{{ .CommentId }}" ··· 18 25 {{ template "repo/fragments/time" .Created }} 19 26 {{ end }} 20 27 </a> 21 21 - 22 22 - <!-- show user "hats" --> 23 23 - {{ $isIssueAuthor := eq .OwnerDid $.Issue.OwnerDid }} 24 24 - {{ if $isIssueAuthor }} 25 25 - <span class="text-xs rounded bg-gray-100 dark:bg-gray-700 text-black dark:text-white font-mono px-2 mx-1/2 inline-flex items-center"> 26 26 - author 27 27 - </span> 28 28 - {{ end }} 29 28 30 29 {{ $isCommentOwner := and $.LoggedInUser (eq $.LoggedInUser.Did .OwnerDid) }} 31 30 {{ if and $isCommentOwner (not .Deleted) }}

+2 -2

appview/pages/templates/repo/log.html

··· 21 21 <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-3">Commit</div> 22 22 <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-6">Message</div> 23 23 <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-1"></div> 24 24 - <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-2">Date</div> 24 24 + <div class="py-2 text-sm text-left text-gray-700 dark:text-gray-300 uppercase font-bold col-span-2 justify-self-end">Date</div> 25 25 </div> 26 26 {{ range $index, $commit := .Commits }} 27 27 {{ $messageParts := splitN $commit.Message "\n\n" 2 }} ··· 85 85 {{ template "repo/pipelines/fragments/pipelineSymbolLong" (dict "Pipeline" $pipeline "RepoInfo" $.RepoInfo) }} 86 86 {{ end }} 87 87 </div> 88 88 - <div class="align-top text-gray-500 dark:text-gray-400 col-span-2">{{ template "repo/fragments/shortTimeAgo" $commit.Committer.When }}</div> 88 88 + <div class="align-top justify-self-end text-gray-500 dark:text-gray-400 col-span-2">{{ template "repo/fragments/shortTimeAgo" $commit.Committer.When }}</div> 89 89 </div> 90 90 {{ end }} 91 91 </div>

+5 -7

appview/pages/templates/repo/pulls/fragments/summarizedPullHeader.html

··· 13 13 </span> 14 14 </div> 15 15 16 16 - <div class="flex-shrink-0 flex items-center"> 16 16 + <div class="flex-shrink-0 flex items-center gap-2"> 17 17 {{ $latestRound := .LastRoundNumber }} 18 18 {{ $lastSubmission := index .Submissions $latestRound }} 19 19 {{ $commentCount := len $lastSubmission.Comments }} 20 20 {{ if and $pipeline $pipeline.Id }} 21 21 - <div class="inline-flex items-center gap-2"> 22 22 - {{ template "repo/pipelines/fragments/pipelineSymbol" $pipeline }} 23 23 - <span class="mx-2 before:content-['·'] before:select-none"></span> 24 24 - </div> 21 21 + {{ template "repo/pipelines/fragments/pipelineSymbol" $pipeline }} 22 22 + <span class="before:content-['·'] before:select-none text-gray-500 dark:text-gray-400"></span> 25 23 {{ end }} 26 24 <span> 27 27 - <div class="inline-flex items-center gap-2"> 25 25 + <div class="inline-flex items-center gap-1"> 28 26 {{ i "message-square" "w-3 h-3 md:hidden" }} 29 27 {{ $commentCount }} 30 28 <span class="hidden md:inline">comment{{if ne $commentCount 1}}s{{end}}</span> 31 29 </div> 32 30 </span> 33 33 - <span class="mx-2 before:content-['·'] before:select-none"></span> 31 31 + <span class="before:content-['·'] before:select-none text-gray-500 dark:text-gray-400"></span> 34 32 <span> 35 33 <span class="hidden md:inline">round</span> 36 34 <span class="font-mono">#{{ $latestRound }}</span>

+22 -14

appview/pages/templates/repo/pulls/interdiff.html

··· 29 29 {{ end }} 30 30 31 31 {{ define "topbarLayout" }} 32 32 - {{ template "layouts/topbar" . }} 32 32 + <header class="px-1 col-span-full" style="z-index: 20;"> 33 33 + {{ template "layouts/topbar" . }} 34 34 + </header> 33 35 {{ end }} 34 36 35 35 - {{ define "contentLayout" }} 36 36 - {{ block "content" . }}{{ end }} 37 37 - {{ end }} 37 37 + {{ define "mainLayout" }} 38 38 + <div class="px-1 col-span-full flex flex-col gap-4"> 39 39 + {{ block "contentLayout" . }} 40 40 + {{ block "content" . }}{{ end }} 41 41 + {{ end }} 38 42 39 39 - {{ define "contentAfterLayout" }} 40 40 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 41 41 - <div class="col-span-1 md:col-span-2"> 42 42 - {{ block "contentAfterLeft" . }} {{ end }} 43 43 + {{ block "contentAfterLayout" . }} 44 44 + <div class="flex-grow grid grid-cols-1 md:grid-cols-12 gap-4"> 45 45 + <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 46 46 + {{ block "contentAfterLeft" . }} {{ end }} 47 47 + </div> 48 48 + <main class="col-span-1 md:col-span-10"> 49 49 + {{ block "contentAfter" . }}{{ end }} 50 50 + </main> 43 51 </div> 44 44 - <main class="col-span-1 md:col-span-10"> 45 45 - {{ block "contentAfter" . }}{{ end }} 46 46 - </main> 52 52 + {{ end }} 47 53 </div> 48 54 {{ end }} 49 55 50 50 - {{ define "footerLayout" }} 51 51 - {{ template "layouts/footer" . }} 56 56 + {{ define "footerLayout" }} 57 57 + <footer class="px-1 col-span-full mt-12"> 58 58 + {{ template "layouts/footer" . }} 59 59 + </footer> 52 60 {{ end }} 53 61 54 62 ··· 60 68 <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 61 69 {{ template "repo/fragments/diffOpts" .DiffOpts }} 62 70 </div> 63 63 - <div class="sticky top-0 mt-4"> 71 71 + <div class="sticky top-0 flex-grow max-h-screen"> 64 72 {{ template "repo/fragments/interdiffFiles" .Interdiff }} 65 73 </div> 66 74 {{end}}

+22 -14

appview/pages/templates/repo/pulls/patch.html

··· 35 35 {{ end }} 36 36 37 37 {{ define "topbarLayout" }} 38 38 - {{ template "layouts/topbar" . }} 38 38 + <header class="px-1 col-span-full" style="z-index: 20;"> 39 39 + {{ template "layouts/topbar" . }} 40 40 + </header> 39 41 {{ end }} 40 42 41 41 - {{ define "contentLayout" }} 42 42 - {{ block "content" . }}{{ end }} 43 43 - {{ end }} 43 43 + {{ define "mainLayout" }} 44 44 + <div class="px-1 col-span-full flex flex-col gap-4"> 45 45 + {{ block "contentLayout" . }} 46 46 + {{ block "content" . }}{{ end }} 47 47 + {{ end }} 44 48 45 45 - {{ define "contentAfterLayout" }} 46 46 - <div class="grid grid-cols-1 md:grid-cols-12 gap-4"> 47 47 - <div class="col-span-1 md:col-span-2"> 48 48 - {{ block "contentAfterLeft" . }} {{ end }} 49 49 + {{ block "contentAfterLayout" . }} 50 50 + <div class="flex-grow grid grid-cols-1 md:grid-cols-12 gap-4"> 51 51 + <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 52 52 + {{ block "contentAfterLeft" . }} {{ end }} 53 53 + </div> 54 54 + <main class="col-span-1 md:col-span-10"> 55 55 + {{ block "contentAfter" . }}{{ end }} 56 56 + </main> 49 57 </div> 50 50 - <main class="col-span-1 md:col-span-10"> 51 51 - {{ block "contentAfter" . }}{{ end }} 52 52 - </main> 58 58 + {{ end }} 53 59 </div> 54 60 {{ end }} 55 61 56 56 - {{ define "footerLayout" }} 57 57 - {{ template "layouts/footer" . }} 62 62 + {{ define "footerLayout" }} 63 63 + <footer class="px-1 col-span-full mt-12"> 64 64 + {{ template "layouts/footer" . }} 65 65 + </footer> 58 66 {{ end }} 59 67 60 68 {{ define "contentAfter" }} ··· 65 73 <div class="flex flex-col gap-4 col-span-1 md:col-span-2"> 66 74 {{ template "repo/fragments/diffOpts" .DiffOpts }} 67 75 </div> 68 68 - <div class="sticky top-0 mt-4"> 76 76 + <div class="sticky top-0 flex-grow max-h-screen"> 69 77 {{ template "repo/fragments/diffChangedFiles" .Diff }} 70 78 </div> 71 79 {{end}}

+43 -52

appview/pages/templates/repo/pulls/pulls.html

··· 54 54 <span class="text-gray-500 dark:text-gray-400">#{{ .PullId }}</span> 55 55 </a> 56 56 </div> 57 57 - <p class="text-sm text-gray-500 dark:text-gray-400 flex flex-wrap items-center gap-1"> 57 57 + <div class="text-sm text-gray-500 dark:text-gray-400 flex flex-wrap items-center gap-1"> 58 58 {{ $owner := index $.DidHandleMap .OwnerDid }} 59 59 {{ $bgColor := "bg-gray-800 dark:bg-gray-700" }} 60 60 {{ $icon := "ban" }} ··· 83 83 {{ template "repo/fragments/time" .Created }} 84 84 </span> 85 85 86 86 + 87 87 + {{ $latestRound := .LastRoundNumber }} 88 88 + {{ $lastSubmission := index .Submissions $latestRound }} 89 89 + 86 90 <span class="before:content-['·']"> 87 87 - targeting 88 88 - <span class="text-xs rounded bg-gray-100 dark:bg-gray-700 text-black dark:text-white font-mono px-2 mx-1/2 inline-flex items-center"> 89 89 - {{ .TargetBranch }} 90 90 - </span> 91 91 + {{ $commentCount := len $lastSubmission.Comments }} 92 92 + {{ $s := "s" }} 93 93 + {{ if eq $commentCount 1 }} 94 94 + {{ $s = "" }} 95 95 + {{ end }} 96 96 + 97 97 + {{ len $lastSubmission.Comments}} comment{{$s}} 91 98 </span> 92 92 - {{ if not .IsPatchBased }} 93 93 - from 94 94 - <span class="text-xs rounded bg-gray-100 dark:bg-gray-700 text-black dark:text-white font-mono px-2 mx-1/2 inline-flex items-center"> 95 95 - {{ if .IsForkBased }} 96 96 - {{ if .PullSource.Repo }} 97 97 - <a href="/{{ $owner }}/{{ .PullSource.Repo.Name }}" class="no-underline hover:underline">{{ $owner }}/{{ .PullSource.Repo.Name }}</a>: 98 98 - {{- else -}} 99 99 - <span class="italic">[deleted fork]</span> 100 100 - {{- end -}} 101 101 - {{- end -}} 102 102 - {{- .PullSource.Branch -}} 99 99 + 100 100 + <span class="before:content-['·']"> 101 101 + round 102 102 + <span class="font-mono"> 103 103 + #{{ .LastRoundNumber }} 104 104 + </span> 103 105 </span> 106 106 + 107 107 + {{ $pipeline := index $.Pipelines .LatestSha }} 108 108 + {{ if and $pipeline $pipeline.Id }} 109 109 + <span class="before:content-['·']"></span> 110 110 + {{ template "repo/pipelines/fragments/pipelineSymbol" $pipeline }} 104 111 {{ end }} 105 105 - <span class="before:content-['·']"> 106 106 - {{ $latestRound := .LastRoundNumber }} 107 107 - {{ $lastSubmission := index .Submissions $latestRound }} 108 108 - round 109 109 - <span class="text-xs rounded bg-gray-100 dark:bg-gray-700 text-black dark:text-white font-mono px-2 mx-1/2 inline-flex items-center"> 110 110 - #{{ .LastRoundNumber }} 111 111 - </span> 112 112 - {{ $commentCount := len $lastSubmission.Comments }} 113 113 - {{ $s := "s" }} 114 114 - {{ if eq $commentCount 1 }} 115 115 - {{ $s = "" }} 116 116 - {{ end }} 117 117 - 118 118 - {{ if eq $commentCount 0 }} 119 119 - awaiting comments 120 120 - {{ else }} 121 121 - recieved {{ len $lastSubmission.Comments}} comment{{$s}} 122 122 - {{ end }} 123 123 - </span> 124 124 - </p> 112 112 + </div> 125 113 </div> 126 114 {{ if .StackId }} 127 115 {{ $otherPulls := index $.Stacks .StackId }} 128 128 - <details class="bg-white dark:bg-gray-800 group"> 129 129 - <summary class="pb-4 px-6 text-xs list-none cursor-pointer hover:text-gray-500 hover:dark:text-gray-400"> 130 130 - {{ $s := "s" }} 131 131 - {{ if eq (len $otherPulls) 1 }} 132 132 - {{ $s = "" }} 133 133 - {{ end }} 134 134 - <div class="group-open:hidden flex items-center gap-2"> 135 135 - {{ i "chevrons-up-down" "w-4 h-4" }} expand {{ len $otherPulls }} pull{{$s}} in this stack 136 136 - </div> 137 137 - <div class="hidden group-open:flex items-center gap-2"> 138 138 - {{ i "chevrons-down-up" "w-4 h-4" }} hide {{ len $otherPulls }} pull{{$s}} in this stack 139 139 - </div> 140 140 - </summary> 141 141 - {{ block "pullList" (list $otherPulls $) }} {{ end }} 142 142 - </details> 116 116 + {{ if gt (len $otherPulls) 0 }} 117 117 + <details class="bg-white dark:bg-gray-800 group"> 118 118 + <summary class="pb-4 px-6 text-xs list-none cursor-pointer hover:text-gray-500 hover:dark:text-gray-400"> 119 119 + {{ $s := "s" }} 120 120 + {{ if eq (len $otherPulls) 1 }} 121 121 + {{ $s = "" }} 122 122 + {{ end }} 123 123 + <div class="group-open:hidden flex items-center gap-2"> 124 124 + {{ i "chevrons-up-down" "w-4 h-4" }} expand {{ len $otherPulls }} pull{{$s}} in this stack 125 125 + </div> 126 126 + <div class="hidden group-open:flex items-center gap-2"> 127 127 + {{ i "chevrons-down-up" "w-4 h-4" }} hide {{ len $otherPulls }} pull{{$s}} in this stack 128 128 + </div> 129 129 + </summary> 130 130 + {{ block "pullList" (list $otherPulls $) }} {{ end }} 131 131 + </details> 132 132 + {{ end }} 143 133 {{ end }} 144 134 </div> 145 135 {{ end }} ··· 151 141 {{ $root := index . 1 }} 152 142 <div class="grid grid-cols-1 rounded-b border-b border-t border-gray-200 dark:border-gray-900 divide-y divide-gray-200 dark:divide-gray-900"> 153 143 {{ range $pull := $list }} 144 144 + {{ $pipeline := index $root.Pipelines $pull.LatestSha }} 154 145 <a href="/{{ $root.RepoInfo.FullName }}/pulls/{{ $pull.PullId }}" class="no-underline hover:no-underline hover:bg-gray-100/25 hover:dark:bg-gray-700/25"> 155 146 <div class="flex gap-2 items-center px-6"> 156 147 <div class="flex-grow min-w-0 w-full py-2"> 157 157 - {{ template "repo/pulls/fragments/summarizedHeader" (list $pull 0) }} 148 148 + {{ template "repo/pulls/fragments/summarizedHeader" (list $pull $pipeline) }} 158 149 </div> 159 150 </div> 160 151 </a>

+110

appview/pages/templates/repo/settings/access.html

··· 1 1 + {{ define "title" }}{{ .Tab }} settings &middot; {{ .RepoInfo.FullName }}{{ end }} 2 2 + 3 3 + {{ define "repoContent" }} 4 4 + <section class="w-full grid grid-cols-1 md:grid-cols-4 gap-2"> 5 5 + <div class="col-span-1"> 6 6 + {{ template "repo/settings/fragments/sidebar" . }} 7 7 + </div> 8 8 + <div class="col-span-1 md:col-span-3 flex flex-col gap-6 p-2"> 9 9 + {{ template "collaboratorSettings" . }} 10 10 + </div> 11 11 + </section> 12 12 + {{ end }} 13 13 + 14 14 + {{ define "collaboratorSettings" }} 15 15 + <div class="grid grid-cols-1 gap-4 items-center"> 16 16 + <div class="col-span-1"> 17 17 + <h2 class="text-sm pb-2 uppercase font-bold">Collaborators</h2> 18 18 + <p class="text-gray-500 dark:text-gray-400"> 19 19 + Any user added as a collaborator will be able to push commits and tags to this repository, upload releases, and workflows. 20 20 + </p> 21 21 + </div> 22 22 + {{ template "collaboratorsGrid" . }} 23 23 + </div> 24 24 + {{ end }} 25 25 + 26 26 + {{ define "collaboratorsGrid" }} 27 27 + <div class="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4"> 28 28 + {{ if .RepoInfo.Roles.CollaboratorInviteAllowed }} 29 29 + {{ template "addCollaboratorButton" . }} 30 30 + {{ end }} 31 31 + {{ range .Collaborators }} 32 32 + <div class="border border-gray-200 dark:border-gray-700 rounded p-4"> 33 33 + <div class="flex items-center gap-3"> 34 34 + <img 35 35 + src="{{ fullAvatar .Handle }}" 36 36 + alt="{{ .Handle }}" 37 37 + class="rounded-full h-10 w-10 border border-gray-300 dark:border-gray-600 flex-shrink-0"/> 38 38 + 39 39 + <div class="flex-1 min-w-0"> 40 40 + <a href="/{{ .Handle }}" class="block truncate"> 41 41 + {{ didOrHandle .Did .Handle }} 42 42 + </a> 43 43 + <p class="text-sm text-gray-500 dark:text-gray-400">{{ .Role }}</p> 44 44 + </div> 45 45 + </div> 46 46 + </div> 47 47 + {{ end }} 48 48 + </div> 49 49 + {{ end }} 50 50 + 51 51 + {{ define "addCollaboratorButton" }} 52 52 + <button 53 53 + class="btn block rounded p-4" 54 54 + popovertarget="add-collaborator-modal" 55 55 + popovertargetaction="toggle"> 56 56 + <div class="flex items-center gap-3"> 57 57 + <div class="w-10 h-10 rounded-full bg-gray-100 dark:bg-gray-700 flex items-center justify-center"> 58 58 + {{ i "user-plus" "size-4" }} 59 59 + </div> 60 60 + 61 61 + <div class="text-left flex-1 min-w-0 block truncate"> 62 62 + Add collaborator 63 63 + </div> 64 64 + </div> 65 65 + </button> 66 66 + <div 67 67 + id="add-collaborator-modal" 68 68 + popover 69 69 + class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-gray-200 dark:border-gray-700 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50"> 70 70 + {{ template "addCollaboratorModal" . }} 71 71 + </div> 72 72 + {{ end }} 73 73 + 74 74 + {{ define "addCollaboratorModal" }} 75 75 + <form 76 76 + hx-put="/{{ $.RepoInfo.FullName }}/settings/collaborator" 77 77 + hx-indicator="#spinner" 78 78 + hx-swap="none" 79 79 + class="flex flex-col gap-2" 80 80 + > 81 81 + <label for="add-collaborator" class="uppercase p-0"> 82 82 + ADD COLLABORATOR 83 83 + </label> 84 84 + <p class="text-sm text-gray-500 dark:text-gray-400">Collaborators can push to this repository.</p> 85 85 + <input 86 86 + type="text" 87 87 + id="add-collaborator" 88 88 + name="collaborator" 89 89 + required 90 90 + placeholder="@foo.bsky.social" 91 91 + /> 92 92 + <div class="flex gap-2 pt-2"> 93 93 + <button 94 94 + type="button" 95 95 + popovertarget="add-collaborator-modal" 96 96 + popovertargetaction="hide" 97 97 + class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300" 98 98 + > 99 99 + {{ i "x" "size-4" }} cancel 100 100 + </button> 101 101 + <button type="submit" class="btn w-1/2 flex items-center"> 102 102 + <span class="inline-flex gap-2 items-center">{{ i "user-plus" "size-4" }} add</span> 103 103 + <span id="spinner" class="group"> 104 104 + {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 105 105 + </span> 106 106 + </button> 107 107 + </div> 108 108 + <div id="add-collaborator-error" class="text-red-500 dark:text-red-400"></div> 109 109 + </form> 110 110 + {{ end }}

+29

appview/pages/templates/repo/settings/fragments/secretListing.html

··· 1 1 + {{ define "repo/settings/fragments/secretListing" }} 2 2 + {{ $root := index . 0 }} 3 3 + {{ $secret := index . 1 }} 4 4 + <div id="secret-{{$secret.Key}}" class="flex items-center justify-between p-2"> 5 5 + <div class="hover:no-underline flex flex-col gap-1 text-sm min-w-0 max-w-[80%]"> 6 6 + <span class="font-mono"> 7 7 + {{ $secret.Key }} 8 8 + </span> 9 9 + <div class="flex flex-wrap text items-center gap-1 text-gray-500 dark:text-gray-400"> 10 10 + <span>added by</span> 11 11 + <span>{{ template "user/fragments/picHandleLink" $secret.CreatedBy }}</span> 12 12 + <span class="before:content-['·'] before:select-none"></span> 13 13 + <span>{{ template "repo/fragments/shortTimeAgo" $secret.CreatedAt }}</span> 14 14 + </div> 15 15 + </div> 16 16 + <button 17 17 + class="btn text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300 gap-2 group" 18 18 + title="Delete secret" 19 19 + hx-delete="/{{ $root.RepoInfo.FullName }}/settings/secrets" 20 20 + hx-swap="none" 21 21 + hx-vals='{"key": "{{ $secret.Key }}"}' 22 22 + hx-confirm="Are you sure you want to delete the secret {{ $secret.Key }}?" 23 23 + > 24 24 + {{ i "trash-2" "w-5 h-5" }} 25 25 + <span class="hidden md:inline">delete</span> 26 26 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 27 27 + </button> 28 28 + </div> 29 29 + {{ end }}

+16

appview/pages/templates/repo/settings/fragments/sidebar.html

··· 1 1 + {{ define "repo/settings/fragments/sidebar" }} 2 2 + {{ $active := .Tab }} 3 3 + {{ $tabs := .Tabs }} 4 4 + <div class="sticky top-2 grid grid-cols-1 rounded border border-gray-200 dark:border-gray-700 divide-y divide-gray-200 dark:divide-gray-700 shadow-inner"> 5 5 + {{ $activeTab := "bg-white dark:bg-gray-700 drop-shadow-sm" }} 6 6 + {{ $inactiveTab := "bg-gray-100 dark:bg-gray-800" }} 7 7 + {{ range $tabs }} 8 8 + <a href="/{{ $.RepoInfo.FullName }}/settings?tab={{.Name}}" class="no-underline hover:no-underline hover:bg-gray-100/25 hover:dark:bg-gray-700/25"> 9 9 + <div class="flex gap-3 items-center p-2 {{ if eq .Name $active }} {{ $activeTab }} {{ else }} {{ $inactiveTab }} {{ end }}"> 10 10 + {{ i .Icon "size-4" }} 11 11 + {{ .Name }} 12 12 + </div> 13 13 + </a> 14 14 + {{ end }} 15 15 + </div> 16 16 + {{ end }}

+68

appview/pages/templates/repo/settings/general.html

··· 1 1 + {{ define "title" }}{{ .Tab }} settings &middot; {{ .RepoInfo.FullName }}{{ end }} 2 2 + 3 3 + {{ define "repoContent" }} 4 4 + <section class="w-full grid grid-cols-1 md:grid-cols-4 gap-2"> 5 5 + <div class="col-span-1"> 6 6 + {{ template "repo/settings/fragments/sidebar" . }} 7 7 + </div> 8 8 + <div class="col-span-1 md:col-span-3 flex flex-col gap-6 p-2"> 9 9 + {{ template "branchSettings" . }} 10 10 + {{ template "deleteRepo" . }} 11 11 + </div> 12 12 + </section> 13 13 + {{ end }} 14 14 + 15 15 + {{ define "branchSettings" }} 16 16 + <div class="grid grid-cols-1 md:grid-cols-3 gap-4 items-center"> 17 17 + <div class="col-span-1 md:col-span-2"> 18 18 + <h2 class="text-sm pb-2 uppercase font-bold">Default Branch</h2> 19 19 + <p class="text-gray-500 dark:text-gray-400"> 20 20 + The default branch is considered the “base” branch in your repository, 21 21 + against which all pull requests and code commits are automatically made, 22 22 + unless you specify a different branch. 23 23 + </p> 24 24 + </div> 25 25 + <form hx-put="/{{ $.RepoInfo.FullName }}/settings/branches/default" class="col-span-1 md:col-span-1 md:justify-self-end group flex gap-2 items-stretch"> 26 26 + <select id="branch" name="branch" required class="p-1 max-w-64 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 27 27 + <option value="" disabled selected > 28 28 + Choose a default branch 29 29 + </option> 30 30 + {{ range .Branches }} 31 31 + <option value="{{ .Name }}" class="py-1" {{ if .IsDefault }}selected{{ end }} > 32 32 + {{ .Name }} 33 33 + </option> 34 34 + {{ end }} 35 35 + </select> 36 36 + <button class="btn flex gap-2 items-center" type="submit"> 37 37 + {{ i "check" "size-4" }} 38 38 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 39 39 + </button> 40 40 + </form> 41 41 + </div> 42 42 + {{ end }} 43 43 + 44 44 + {{ define "deleteRepo" }} 45 45 + {{ if .RepoInfo.Roles.RepoDeleteAllowed }} 46 46 + <div class="grid grid-cols-1 md:grid-cols-3 gap-4 items-center"> 47 47 + <div class="col-span-1 md:col-span-2"> 48 48 + <h2 class="text-sm pb-2 uppercase text-red-500 dark:text-red-400 font-bold">Delete Repository</h2> 49 49 + <p class="text-red-500 dark:text-red-400 "> 50 50 + Deleting a repository is irreversible and permanent. Be certain before deleting a repository. 51 51 + </p> 52 52 + </div> 53 53 + <div class="col-span-1 md:col-span-1 md:justify-self-end"> 54 54 + <button 55 55 + class="btn group text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300 flex gap-2 items-center" 56 56 + type="button" 57 57 + hx-delete="/{{ $.RepoInfo.FullName }}/settings/delete" 58 58 + hx-confirm="Are you sure you want to delete {{ $.RepoInfo.FullName }}?"> 59 59 + {{ i "trash-2" "size-4" }} 60 60 + delete 61 61 + <span class="ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline"> 62 62 + {{ i "loader-circle" "w-4 h-4" }} 63 63 + </span> 64 64 + </button> 65 65 + </div> 66 66 + </div> 67 67 + {{ end }} 68 68 + {{ end }}

+140

appview/pages/templates/repo/settings/pipelines.html

··· 1 1 + {{ define "title" }}{{ .Tab }} settings &middot; {{ .RepoInfo.FullName }}{{ end }} 2 2 + 3 3 + {{ define "repoContent" }} 4 4 + <section class="w-full grid grid-cols-1 md:grid-cols-4 gap-2"> 5 5 + <div class="col-span-1"> 6 6 + {{ template "repo/settings/fragments/sidebar" . }} 7 7 + </div> 8 8 + <div class="col-span-1 md:col-span-3 flex flex-col gap-6 p-2"> 9 9 + {{ template "spindleSettings" . }} 10 10 + {{ if $.CurrentSpindle }} 11 11 + {{ template "secretSettings" . }} 12 12 + {{ end }} 13 13 + <div id="operation-error" class="text-red-500 dark:text-red-400"></div> 14 14 + </div> 15 15 + </section> 16 16 + {{ end }} 17 17 + 18 18 + {{ define "spindleSettings" }} 19 19 + <div class="grid grid-cols-1 md:grid-cols-3 gap-4 items-center"> 20 20 + <div class="col-span-1 md:col-span-2"> 21 21 + <h2 class="text-sm pb-2 uppercase font-bold">Spindle</h2> 22 22 + <p class="text-gray-500 dark:text-gray-400"> 23 23 + Choose a spindle to execute your workflows on. Only repository owners 24 24 + can configure spindles. Spindles can be selfhosted, 25 25 + <a class="text-gray-500 dark:text-gray-400 underline" href="https://tangled.sh/@tangled.sh/core/blob/master/docs/spindle/hosting.md"> 26 26 + click to learn more. 27 27 + </a> 28 28 + </p> 29 29 + </div> 30 30 + {{ if not $.RepoInfo.Roles.IsOwner }} 31 31 + <div class="col-span-1 md:col-span-1 md:justify-self-end group flex gap-2 items-stretch"> 32 32 + {{ or $.CurrentSpindle "No spindle configured" }} 33 33 + </div> 34 34 + {{ else }} 35 35 + <form hx-post="/{{ $.RepoInfo.FullName }}/settings/spindle" class="col-span-1 md:col-span-1 md:justify-self-end group flex gap-2 items-stretch"> 36 36 + <select 37 37 + id="spindle" 38 38 + name="spindle" 39 39 + required 40 40 + class="p-1 max-w-64 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 41 41 + <option value="" disabled> 42 42 + Choose a spindle 43 43 + </option> 44 44 + {{ range $.Spindles }} 45 45 + <option value="{{ . }}" class="py-1" {{ if eq . $.CurrentSpindle }}selected{{ end }}> 46 46 + {{ . }} 47 47 + </option> 48 48 + {{ end }} 49 49 + </select> 50 50 + <button class="btn flex gap-2 items-center" type="submit" {{ if not $.RepoInfo.Roles.IsOwner }}disabled{{ end }}> 51 51 + {{ i "check" "size-4" }} 52 52 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 53 53 + </button> 54 54 + </form> 55 55 + {{ end }} 56 56 + </div> 57 57 + {{ end }} 58 58 + 59 59 + {{ define "secretSettings" }} 60 60 + <div class="grid grid-cols-1 md:grid-cols-3 gap-4 items-center"> 61 61 + <div class="col-span-1 md:col-span-2"> 62 62 + <h2 class="text-sm pb-2 uppercase font-bold">SECRETS</h2> 63 63 + <p class="text-gray-500 dark:text-gray-400"> 64 64 + Secrets are accessible in workflow runs via environment variables. Anyone 65 65 + with collaborator access to this repository can add and use secrets in 66 66 + workflow runs. 67 67 + </p> 68 68 + </div> 69 69 + <div class="col-span-1 md:col-span-1 md:justify-self-end"> 70 70 + {{ template "addSecretButton" . }} 71 71 + </div> 72 72 + </div> 73 73 + <div class="flex flex-col rounded border border-gray-200 dark:border-gray-700 divide-y divide-gray-200 dark:divide-gray-700 w-full"> 74 74 + {{ range .Secrets }} 75 75 + {{ template "repo/settings/fragments/secretListing" (list $ .) }} 76 76 + {{ else }} 77 77 + <div class="flex items-center justify-center p-2 text-gray-500"> 78 78 + no secrets added yet 79 79 + </div> 80 80 + {{ end }} 81 81 + </div> 82 82 + {{ end }} 83 83 + 84 84 + {{ define "addSecretButton" }} 85 85 + <button 86 86 + class="btn flex items-center gap-2" 87 87 + popovertarget="add-secret-modal" 88 88 + popovertargetaction="toggle"> 89 89 + {{ i "plus" "size-4" }} 90 90 + add secret 91 91 + </button> 92 92 + <div 93 93 + id="add-secret-modal" 94 94 + popover 95 95 + class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-gray-200 dark:border-gray-700 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50"> 96 96 + {{ template "addSecretModal" . }} 97 97 + </div> 98 98 + {{ end}} 99 99 + 100 100 + {{ define "addSecretModal" }} 101 101 + <form 102 102 + hx-put="/{{ $.RepoInfo.FullName }}/settings/secrets" 103 103 + hx-indicator="#spinner" 104 104 + hx-swap="none" 105 105 + class="flex flex-col gap-2" 106 106 + > 107 107 + <p class="uppercase p-0">ADD SECRET</p> 108 108 + <p class="text-sm text-gray-500 dark:text-gray-400">Secrets are available as environment variables in the workflow.</p> 109 109 + <input 110 110 + type="text" 111 111 + id="secret-key" 112 112 + name="key" 113 113 + required 114 114 + placeholder="SECRET_NAME" 115 115 + /> 116 116 + <textarea 117 117 + type="text" 118 118 + id="secret-value" 119 119 + name="value" 120 120 + required 121 121 + placeholder="secret value"></textarea> 122 122 + <div class="flex gap-2 pt-2"> 123 123 + <button 124 124 + type="button" 125 125 + popovertarget="add-secret-modal" 126 126 + popovertargetaction="hide" 127 127 + class="btn w-1/2 flex items-center gap-2 text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300" 128 128 + > 129 129 + {{ i "x" "size-4" }} cancel 130 130 + </button> 131 131 + <button type="submit" class="btn w-1/2 flex items-center"> 132 132 + <span class="inline-flex gap-2 items-center">{{ i "plus" "size-4" }} add</span> 133 133 + <span id="spinner" class="group"> 134 134 + {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 135 135 + </span> 136 136 + </button> 137 137 + </div> 138 138 + <div id="add-secret-error" class="text-red-500 dark:text-red-400"></div> 139 139 + </form> 140 140 + {{ end }}

+150 -120

appview/pages/templates/repo/settings.html

··· 1 1 {{ define "title" }}settings &middot; {{ .RepoInfo.FullName }}{{ end }} 2 2 + 2 3 {{ define "repoContent" }} 3 3 - <header class="font-bold text-sm mb-4 uppercase dark:text-white"> 4 4 - Collaborators 5 5 - </header> 4 4 + {{ template "collaboratorSettings" . }} 5 5 + {{ template "branchSettings" . }} 6 6 + {{ template "dangerZone" . }} 7 7 + {{ template "spindleSelector" . }} 8 8 + {{ template "spindleSecrets" . }} 9 9 + {{ end }} 6 10 7 7 - <div id="collaborator-list" class="flex flex-col gap-2 mb-2"> 8 8 - {{ range .Collaborators }} 9 9 - <div id="collaborator" class="mb-2"> 10 10 - <a 11 11 - href="/{{ didOrHandle .Did .Handle }}" 12 12 - class="no-underline hover:underline text-black dark:text-white" 13 13 - > 14 14 - {{ didOrHandle .Did .Handle }} 15 15 - </a> 16 16 - <div> 17 17 - <span class="text-sm text-gray-500 dark:text-gray-400"> 18 18 - {{ .Role }} 19 19 - </span> 20 20 - </div> 21 21 - </div> 22 22 - {{ end }} 23 23 - </div> 11 11 + {{ define "collaboratorSettings" }} 12 12 + <header class="font-bold text-sm mb-4 uppercase dark:text-white"> 13 13 + Collaborators 14 14 + </header> 24 15 25 25 - {{ if .RepoInfo.Roles.CollaboratorInviteAllowed }} 26 26 - <form 27 27 - hx-put="/{{ $.RepoInfo.FullName }}/settings/collaborator" 28 28 - class="group" 16 16 + <div id="collaborator-list" class="flex flex-col gap-2 mb-2"> 17 17 + {{ range .Collaborators }} 18 18 + <div id="collaborator" class="mb-2"> 19 19 + <a 20 20 + href="/{{ didOrHandle .Did .Handle }}" 21 21 + class="no-underline hover:underline text-black dark:text-white" 29 22 > 30 30 - <label for="collaborator" class="dark:text-white"> 31 31 - add collaborator 32 32 - </label> 33 33 - <input 34 34 - type="text" 35 35 - id="collaborator" 36 36 - name="collaborator" 37 37 - required 38 38 - class="dark:bg-gray-700 dark:text-white" 39 39 - placeholder="enter did or handle" 40 40 - > 41 41 - <button 42 42 - class="btn my-2 flex gap-2 items-center dark:text-white dark:hover:bg-gray-700" 43 43 - type="text" 44 44 - > 45 45 - <span>add</span> 46 46 - {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 47 47 - </button> 48 48 - </form> 23 23 + {{ didOrHandle .Did .Handle }} 24 24 + </a> 25 25 + <div> 26 26 + <span class="text-sm text-gray-500 dark:text-gray-400"> 27 27 + {{ .Role }} 28 28 + </span> 29 29 + </div> 30 30 + </div> 49 31 {{ end }} 32 32 + </div> 50 33 34 34 + {{ if .RepoInfo.Roles.CollaboratorInviteAllowed }} 51 35 <form 52 52 - hx-put="/{{ $.RepoInfo.FullName }}/settings/branches/default" 53 53 - class="mt-6 group" 36 36 + hx-put="/{{ $.RepoInfo.FullName }}/settings/collaborator" 37 37 + class="group" 54 38 > 55 55 - <label for="branch">default branch</label> 56 56 - <div class="flex gap-2 items-center"> 57 57 - <select id="branch" name="branch" required class="p-1 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 58 58 - <option 59 59 - value="" 60 60 - disabled 61 61 - selected 62 62 - > 63 63 - Choose a default branch 64 64 - </option> 65 65 - {{ range .Branches }} 66 66 - <option 67 67 - value="{{ .Name }}" 68 68 - class="py-1" 69 69 - {{ if .IsDefault }} 70 70 - selected 71 71 - {{ end }} 72 72 - > 73 73 - {{ .Name }} 74 74 - </option> 75 75 - {{ end }} 76 76 - </select> 77 77 - <button class="btn my-2 flex gap-2 items-center" type="submit"> 78 78 - <span>save</span> 79 79 - {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 80 80 - </button> 81 81 - </div> 82 82 - </form> 83 83 - 84 84 - {{ if .RepoInfo.Roles.IsOwner }} 85 85 - <form 86 86 - hx-post="/{{ $.RepoInfo.FullName }}/settings/spindle" 87 87 - class="mt-6 group" 88 88 - > 89 89 - <label for="spindle">spindle</label> 90 90 - <div class="flex gap-2 items-center"> 91 91 - <select id="spindle" name="spindle" required class="p-1 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 92 92 - <option 93 93 - value="" 94 94 - selected 95 95 - > 96 96 - None 97 97 - </option> 98 98 - {{ range .Spindles }} 99 99 - <option 100 100 - value="{{ . }}" 101 101 - class="py-1" 102 102 - {{ if eq . $.CurrentSpindle }} 103 103 - selected 104 104 - {{ end }} 105 105 - > 106 106 - {{ . }} 107 107 - </option> 108 108 - {{ end }} 109 109 - </select> 110 110 - <button class="btn my-2 flex gap-2 items-center" type="submit"> 111 111 - <span>save</span> 112 112 - {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 113 113 - </button> 114 114 - </div> 39 39 + <label for="collaborator" class="dark:text-white"> 40 40 + add collaborator 41 41 + </label> 42 42 + <input 43 43 + type="text" 44 44 + id="collaborator" 45 45 + name="collaborator" 46 46 + required 47 47 + class="dark:bg-gray-700 dark:text-white" 48 48 + placeholder="enter did or handle"> 49 49 + <button class="btn my-2 flex gap-2 items-center dark:text-white dark:hover:bg-gray-700" type="text"> 50 50 + <span>add</span> 51 51 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 52 52 + </button> 115 53 </form> 116 116 - {{ end }} 54 54 + {{ end }} 55 55 + {{ end }} 117 56 118 118 - {{ if .RepoInfo.Roles.RepoDeleteAllowed }} 57 57 + {{ define "dangerZone" }} 58 58 + {{ if .RepoInfo.Roles.RepoDeleteAllowed }} 119 59 <form 120 60 hx-confirm="Are you sure you want to delete this repository?" 121 61 hx-delete="/{{ $.RepoInfo.FullName }}/settings/delete" 122 62 class="mt-6" 123 123 - hx-indicator="#delete-repo-spinner" 124 124 - > 125 125 - <label for="branch">delete repository</label> 126 126 - <button class="btn my-2 flex items-center" type="text"> 127 127 - <span>delete</span> 128 128 - <span id="delete-repo-spinner" class="group"> 129 129 - {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 130 130 - </span> 131 131 - </button> 132 132 - <span> 133 133 - Deleting a repository is irreversible and permanent. 134 134 - </span> 63 63 + hx-indicator="#delete-repo-spinner"> 64 64 + <label for="branch">delete repository</label> 65 65 + <button class="btn my-2 flex items-center" type="text"> 66 66 + <span>delete</span> 67 67 + <span id="delete-repo-spinner" class="group"> 68 68 + {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 69 69 + </span> 70 70 + </button> 71 71 + <span> 72 72 + Deleting a repository is irreversible and permanent. 73 73 + </span> 135 74 </form> 136 136 - {{ end }} 75 75 + {{ end }} 76 76 + {{ end }} 77 77 + 78 78 + {{ define "branchSettings" }} 79 79 + <form hx-put="/{{ $.RepoInfo.FullName }}/settings/branches/default" class="mt-6 group"> 80 80 + <label for="branch">default branch</label> 81 81 + <div class="flex gap-2 items-center"> 82 82 + <select id="branch" name="branch" required class="p-1 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 83 83 + <option value="" disabled selected > 84 84 + Choose a default branch 85 85 + </option> 86 86 + {{ range .Branches }} 87 87 + <option value="{{ .Name }}" class="py-1" {{ if .IsDefault }}selected{{ end }} > 88 88 + {{ .Name }} 89 89 + </option> 90 90 + {{ end }} 91 91 + </select> 92 92 + <button class="btn my-2 flex gap-2 items-center" type="submit"> 93 93 + <span>save</span> 94 94 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 95 95 + </button> 96 96 + </div> 97 97 + </form> 98 98 + {{ end }} 99 99 + 100 100 + {{ define "spindleSelector" }} 101 101 + {{ if .RepoInfo.Roles.IsOwner }} 102 102 + <form hx-post="/{{ $.RepoInfo.FullName }}/settings/spindle" class="mt-6 group" > 103 103 + <label for="spindle">spindle</label> 104 104 + <div class="flex gap-2 items-center"> 105 105 + <select id="spindle" name="spindle" required class="p-1 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 106 106 + <option value="" selected > 107 107 + None 108 108 + </option> 109 109 + {{ range .Spindles }} 110 110 + <option value="{{ . }}" class="py-1" {{ if eq . $.CurrentSpindle }}selected{{ end }}> 111 111 + {{ . }} 112 112 + </option> 113 113 + {{ end }} 114 114 + </select> 115 115 + <button class="btn my-2 flex gap-2 items-center" type="submit"> 116 116 + <span>save</span> 117 117 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 118 118 + </button> 119 119 + </div> 120 120 + </form> 121 121 + {{ end }} 122 122 + {{ end }} 123 123 + 124 124 + {{ define "spindleSecrets" }} 125 125 + {{ if $.CurrentSpindle }} 126 126 + <header class="font-bold text-sm mb-4 uppercase dark:text-white"> 127 127 + Secrets 128 128 + </header> 129 129 + 130 130 + <div id="secret-list" class="flex flex-col gap-2 mb-2"> 131 131 + {{ range $idx, $secret := .Secrets }} 132 132 + {{ with $secret }} 133 133 + <div id="secret-{{$idx}}" class="mb-2"> 134 134 + {{ .Key }} created on {{ .CreatedAt }} by {{ .CreatedBy }} 135 135 + </div> 136 136 + {{ end }} 137 137 + {{ end }} 138 138 + </div> 139 139 + <form 140 140 + hx-put="/{{ $.RepoInfo.FullName }}/settings/secrets" 141 141 + class="mt-6" 142 142 + hx-indicator="#add-secret-spinner"> 143 143 + <label for="key">secret key</label> 144 144 + <input 145 145 + type="text" 146 146 + id="key" 147 147 + name="key" 148 148 + required 149 149 + class="dark:bg-gray-700 dark:text-white" 150 150 + placeholder="SECRET_KEY" /> 151 151 + <label for="value">secret value</label> 152 152 + <input 153 153 + type="text" 154 154 + id="value" 155 155 + name="value" 156 156 + required 157 157 + class="dark:bg-gray-700 dark:text-white" 158 158 + placeholder="SECRET VALUE" /> 137 159 160 160 + <button class="btn my-2 flex items-center" type="text"> 161 161 + <span>add</span> 162 162 + <span id="add-secret-spinner" class="group"> 163 163 + {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 164 164 + </span> 165 165 + </button> 166 166 + </form> 167 167 + {{ end }} 138 168 {{ end }}

+1 -1

appview/pages/templates/spindles/fragments/addMemberModal.html

··· 13 13 <div 14 14 id="add-member-{{ .Instance }}" 15 15 popover 16 16 - class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded drop-shadow dark:text-white"> 16 16 + class="bg-white w-full md:w-96 dark:bg-gray-800 p-4 rounded border border-gray-200 dark:border-gray-700 drop-shadow dark:text-white backdrop:bg-gray-400/50 dark:backdrop:bg-gray-800/50"> 17 17 {{ block "addMemberPopover" . }} {{ end }} 18 18 </div> 19 19 {{ end }}

+57

appview/pages/templates/strings/dashboard.html

··· 1 1 + {{ define "title" }}strings by {{ or .Card.UserHandle .Card.UserDid }}{{ end }} 2 2 + 3 3 + {{ define "extrameta" }} 4 4 + <meta property="og:title" content="{{ or .Card.UserHandle .Card.UserDid }}" /> 5 5 + <meta property="og:type" content="profile" /> 6 6 + <meta property="og:url" content="https://tangled.sh/{{ or .Card.UserHandle .Card.UserDid }}" /> 7 7 + <meta property="og:description" content="{{ or .Card.Profile.Description .Card.UserHandle .Card.UserDid }}" /> 8 8 + {{ end }} 9 9 + 10 10 + 11 11 + {{ define "content" }} 12 12 + <div class="grid grid-cols-1 md:grid-cols-11 gap-4"> 13 13 + <div class="md:col-span-3 order-1 md:order-1"> 14 14 + {{ template "user/fragments/profileCard" .Card }} 15 15 + </div> 16 16 + <div id="all-strings" class="md:col-span-8 order-2 md:order-2"> 17 17 + {{ block "allStrings" . }}{{ end }} 18 18 + </div> 19 19 + </div> 20 20 + {{ end }} 21 21 + 22 22 + {{ define "allStrings" }} 23 23 + <p class="text-sm font-bold p-2 dark:text-white">ALL STRINGS</p> 24 24 + <div id="strings" class="grid grid-cols-1 gap-4 mb-6"> 25 25 + {{ range .Strings }} 26 26 + {{ template "singleString" (list $ .) }} 27 27 + {{ else }} 28 28 + <p class="px-6 dark:text-white">This user does not have any strings yet.</p> 29 29 + {{ end }} 30 30 + </div> 31 31 + {{ end }} 32 32 + 33 33 + {{ define "singleString" }} 34 34 + {{ $root := index . 0 }} 35 35 + {{ $s := index . 1 }} 36 36 + <div class="py-4 px-6 drop-shadow-sm rounded bg-white dark:bg-gray-800"> 37 37 + <div class="font-medium dark:text-white flex gap-2 items-center"> 38 38 + <a href="/strings/{{ or $root.Card.UserHandle $root.Card.UserDid }}/{{ $s.Rkey }}">{{ $s.Filename }}</a> 39 39 + </div> 40 40 + {{ with $s.Description }} 41 41 + <div class="text-gray-600 dark:text-gray-300 text-sm"> 42 42 + {{ . }} 43 43 + </div> 44 44 + {{ end }} 45 45 + 46 46 + {{ $stat := $s.Stats }} 47 47 + <div class="text-gray-400 pt-4 text-sm font-mono inline-flex gap-2 mt-auto"> 48 48 + <span>{{ $stat.LineCount }} line{{if ne $stat.LineCount 1}}s{{end}}</span> 49 49 + <span class="select-none [&:before]:content-['·']"></span> 50 50 + {{ with $s.Edited }} 51 51 + <span>edited {{ template "repo/fragments/shortTimeAgo" . }}</span> 52 52 + {{ else }} 53 53 + {{ template "repo/fragments/shortTimeAgo" $s.Created }} 54 54 + {{ end }} 55 55 + </div> 56 56 + </div> 57 57 + {{ end }}

+89

appview/pages/templates/strings/fragments/form.html

··· 1 1 + {{ define "strings/fragments/form" }} 2 2 + <form 3 3 + {{ if eq .Action "new" }} 4 4 + hx-post="/strings/new" 5 5 + {{ else }} 6 6 + hx-post="/strings/{{.String.Did}}/{{.String.Rkey}}/edit" 7 7 + {{ end }} 8 8 + hx-indicator="#new-button" 9 9 + class="p-6 pb-4 dark:text-white flex flex-col gap-2 bg-white dark:bg-gray-800 drop-shadow-sm rounded" 10 10 + hx-swap="none"> 11 11 + <div class="flex flex-col md:flex-row md:items-center gap-2"> 12 12 + <input 13 13 + type="text" 14 14 + id="filename" 15 15 + name="filename" 16 16 + placeholder="Filename with extension" 17 17 + required 18 18 + value="{{ .String.Filename }}" 19 19 + class="md:max-w-64 dark:bg-gray-700 dark:text-white dark:border-gray-600 dark:placeholder-gray-400 px-3 py-2 border rounded" 20 20 + > 21 21 + <input 22 22 + type="text" 23 23 + id="description" 24 24 + name="description" 25 25 + value="{{ .String.Description }}" 26 26 + placeholder="Description ..." 27 27 + class="flex-1 dark:bg-gray-700 dark:text-white dark:border-gray-600 dark:placeholder-gray-400 px-3 py-2 border rounded" 28 28 + > 29 29 + </div> 30 30 + <textarea 31 31 + name="content" 32 32 + id="content-textarea" 33 33 + wrap="off" 34 34 + class="w-full dark:bg-gray-700 dark:text-white dark:border-gray-600 dark:placeholder-gray-400" 35 35 + rows="20" 36 36 + placeholder="Paste your string here!" 37 37 + required>{{ .String.Contents }}</textarea> 38 38 + <div class="flex justify-between items-center"> 39 39 + <div id="content-stats" class="text-sm text-gray-500 dark:text-gray-400"> 40 40 + <span id="line-count">0 lines</span> 41 41 + <span class="select-none px-1 [&:before]:content-['·']"></span> 42 42 + <span id="byte-count">0 bytes</span> 43 43 + </div> 44 44 + <div id="actions" class="flex gap-2 items-center"> 45 45 + {{ if eq .Action "edit" }} 46 46 + <a class="btn flex items-center gap-2 no-underline hover:no-underline p-2 group text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300 " 47 47 + href="/strings/{{ .String.Did }}/{{ .String.Rkey }}"> 48 48 + {{ i "x" "size-4" }} 49 49 + <span class="hidden md:inline">cancel</span> 50 50 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 51 51 + </a> 52 52 + {{ end }} 53 53 + <button 54 54 + type="submit" 55 55 + id="new-button" 56 56 + class="w-fit btn-create rounded flex items-center py-0 dark:bg-gray-700 dark:text-white dark:hover:bg-gray-600 group" 57 57 + > 58 58 + <span class="inline-flex items-center gap-2"> 59 59 + {{ i "arrow-up" "w-4 h-4" }} 60 60 + publish 61 61 + </span> 62 62 + <span class="pl-2 hidden group-[.htmx-request]:inline"> 63 63 + {{ i "loader-circle" "w-4 h-4 animate-spin" }} 64 64 + </span> 65 65 + </button> 66 66 + </div> 67 67 + </div> 68 68 + <script> 69 69 + (function() { 70 70 + const textarea = document.getElementById('content-textarea'); 71 71 + const lineCount = document.getElementById('line-count'); 72 72 + const byteCount = document.getElementById('byte-count'); 73 73 + function updateStats() { 74 74 + const content = textarea.value; 75 75 + const lines = content === '' ? 0 : content.split('\n').length; 76 76 + const bytes = new TextEncoder().encode(content).length; 77 77 + lineCount.textContent = `${lines} line${lines !== 1 ? 's' : ''}`; 78 78 + byteCount.textContent = `${bytes} byte${bytes !== 1 ? 's' : ''}`; 79 79 + } 80 80 + textarea.addEventListener('input', updateStats); 81 81 + textarea.addEventListener('paste', () => { 82 82 + setTimeout(updateStats, 0); 83 83 + }); 84 84 + updateStats(); 85 85 + })(); 86 86 + </script> 87 87 + <div id="error" class="error dark:text-red-400"></div> 88 88 + </form> 89 89 + {{ end }}

+17

appview/pages/templates/strings/put.html

··· 1 1 + {{ define "title" }}publish a new string{{ end }} 2 2 + 3 3 + {{ define "topbar" }} 4 4 + {{ template "layouts/topbar" $ }} 5 5 + {{ end }} 6 6 + 7 7 + {{ define "content" }} 8 8 + <div class="px-6 py-2 mb-4"> 9 9 + {{ if eq .Action "new" }} 10 10 + <p class="text-xl font-bold dark:text-white">Create a new string</p> 11 11 + <p class="">Store and share code snippets with ease.</p> 12 12 + {{ else }} 13 13 + <p class="text-xl font-bold dark:text-white">Edit string</p> 14 14 + {{ end }} 15 15 + </div> 16 16 + {{ template "strings/fragments/form" . }} 17 17 + {{ end }}

+85

appview/pages/templates/strings/string.html

··· 1 1 + {{ define "title" }}{{ .String.Filename }} · by {{ didOrHandle .Owner.DID.String .Owner.Handle.String }}{{ end }} 2 2 + 3 3 + {{ define "extrameta" }} 4 4 + {{ $ownerId := didOrHandle .Owner.DID.String .Owner.Handle.String }} 5 5 + <meta property="og:title" content="{{ .String.Filename }} · by {{ $ownerId }}" /> 6 6 + <meta property="og:type" content="object" /> 7 7 + <meta property="og:url" content="https://tangled.sh/strings/{{ $ownerId }}/{{ .String.Rkey }}" /> 8 8 + <meta property="og:description" content="{{ .String.Description }}" /> 9 9 + {{ end }} 10 10 + 11 11 + {{ define "topbar" }} 12 12 + {{ template "layouts/topbar" $ }} 13 13 + {{ end }} 14 14 + 15 15 + {{ define "content" }} 16 16 + {{ $ownerId := didOrHandle .Owner.DID.String .Owner.Handle.String }} 17 17 + <section id="string-header" class="mb-4 py-2 px-6 dark:text-white"> 18 18 + <div class="text-lg flex items-center justify-between"> 19 19 + <div> 20 20 + <a href="/strings/{{ $ownerId }}">{{ $ownerId }}</a> 21 21 + <span class="select-none">/</span> 22 22 + <a href="/{{ $ownerId }}/{{ .String.Rkey }}" class="font-bold">{{ .String.Filename }}</a> 23 23 + </div> 24 24 + {{ if and .LoggedInUser (eq .LoggedInUser.Did .String.Did) }} 25 25 + <div class="flex gap-2 text-base"> 26 26 + <a class="btn flex items-center gap-2 no-underline hover:no-underline p-2 group" 27 27 + hx-boost="true" 28 28 + href="/strings/{{ .String.Did }}/{{ .String.Rkey }}/edit"> 29 29 + {{ i "pencil" "size-4" }} 30 30 + <span class="hidden md:inline">edit</span> 31 31 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 32 32 + </a> 33 33 + <button 34 34 + class="btn text-red-500 hover:text-red-700 dark:text-red-400 dark:hover:text-red-300 gap-2 group p-2" 35 35 + title="Delete string" 36 36 + hx-delete="/strings/{{ .String.Did }}/{{ .String.Rkey }}/" 37 37 + hx-swap="none" 38 38 + hx-confirm="Are you sure you want to delete the gist `{{ .String.Filename }}`?" 39 39 + > 40 40 + {{ i "trash-2" "size-4" }} 41 41 + <span class="hidden md:inline">delete</span> 42 42 + {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 43 43 + </button> 44 44 + </div> 45 45 + {{ end }} 46 46 + </div> 47 47 + <span class="flex items-center"> 48 48 + {{ with .String.Description }} 49 49 + {{ . }} 50 50 + <span class="select-none px-1 md:px-2 [&:before]:content-['·']"></span> 51 51 + {{ end }} 52 52 + 53 53 + {{ with .String.Edited }} 54 54 + <span>edited {{ template "repo/fragments/shortTimeAgo" . }}</span> 55 55 + {{ else }} 56 56 + {{ template "repo/fragments/shortTimeAgo" .String.Created }} 57 57 + {{ end }} 58 58 + </span> 59 59 + </section> 60 60 + <section class="bg-white dark:bg-gray-800 px-6 py-4 rounded relative w-full dark:text-white"> 61 61 + <div class="flex justify-between items-center text-gray-500 dark:text-gray-400 text-sm md:text-base pb-2 mb-3 text-base border-b border-gray-200 dark:border-gray-700"> 62 62 + <span>{{ .String.Filename }}</span> 63 63 + <div> 64 64 + <span>{{ .Stats.LineCount }} lines</span> 65 65 + <span class="select-none px-1 md:px-2 [&:before]:content-['·']"></span> 66 66 + <span>{{ byteFmt .Stats.ByteCount }}</span> 67 67 + <span class="select-none px-1 md:px-2 [&:before]:content-['·']"></span> 68 68 + <a href="/strings/{{ $ownerId }}/{{ .String.Rkey }}/raw">view raw</a> 69 69 + {{ if .RenderToggle }} 70 70 + <span class="select-none px-1 md:px-2 [&:before]:content-['·']"></span> 71 71 + <a href="?code={{ .ShowRendered }}" hx-boost="true"> 72 72 + view {{ if .ShowRendered }}code{{ else }}rendered{{ end }} 73 73 + </a> 74 74 + {{ end }} 75 75 + </div> 76 76 + </div> 77 77 + <div class="overflow-auto relative"> 78 78 + {{ if .ShowRendered }} 79 79 + <div id="blob-contents" class="prose dark:prose-invert">{{ .RenderedContents }}</div> 80 80 + {{ else }} 81 81 + <div id="blob-contents" class="whitespace-pre peer-target:bg-yellow-200 dark:peer-target:bg-yellow-900">{{ .String.Contents | escapeHtml }}</div> 82 82 + {{ end }} 83 83 + </div> 84 84 + </section> 85 85 + {{ end }}

+2 -2

appview/pages/templates/timeline.html

··· 34 34 </p> 35 35 36 36 <div class="flex gap-6 items-center"> 37 37 - <a href="/login" class="no-underline hover:no-underline "> 38 38 - <button class="btn flex gap-2 px-4 items-center"> 37 37 + <a href="/signup" class="no-underline hover:no-underline "> 38 38 + <button class="btn-create flex gap-2 px-4 items-center"> 39 39 join now {{ i "arrow-right" "size-4" }} 40 40 </button> 41 41 </a>

+104

appview/pages/templates/user/completeSignup.html

··· 1 1 + {{ define "user/completeSignup" }} 2 2 + <!doctype html> 3 3 + <html lang="en" class="dark:bg-gray-900"> 4 4 + <head> 5 5 + <meta charset="UTF-8" /> 6 6 + <meta 7 7 + name="viewport" 8 8 + content="width=device-width, initial-scale=1.0" 9 9 + /> 10 10 + <meta 11 11 + property="og:title" 12 12 + content="complete signup · tangled" 13 13 + /> 14 14 + <meta 15 15 + property="og:url" 16 16 + content="https://tangled.sh/complete-signup" 17 17 + /> 18 18 + <meta 19 19 + property="og:description" 20 20 + content="complete your signup for tangled" 21 21 + /> 22 22 + <script src="/static/htmx.min.js"></script> 23 23 + <link 24 24 + rel="stylesheet" 25 25 + href="/static/tw.css?{{ cssContentHash }}" 26 26 + type="text/css" 27 27 + /> 28 28 + <title>complete signup &middot; tangled</title> 29 29 + </head> 30 30 + <body class="flex items-center justify-center min-h-screen"> 31 31 + <main class="max-w-md px-6 -mt-4"> 32 32 + <h1 33 33 + class="text-center text-2xl font-semibold italic dark:text-white" 34 34 + > 35 35 + tangled 36 36 + </h1> 37 37 + <h2 class="text-center text-xl italic dark:text-white"> 38 38 + tightly-knit social coding. 39 39 + </h2> 40 40 + <form 41 41 + class="mt-4 max-w-sm mx-auto flex flex-col gap-4" 42 42 + hx-post="/signup/complete" 43 43 + hx-swap="none" 44 44 + hx-disabled-elt="#complete-signup-button" 45 45 + > 46 46 + <div class="flex flex-col"> 47 47 + <label for="code">verification code</label> 48 48 + <input 49 49 + type="text" 50 50 + id="code" 51 51 + name="code" 52 52 + tabindex="1" 53 53 + required 54 54 + placeholder="tngl-sh-foo-bar" 55 55 + /> 56 56 + <span class="text-sm text-gray-500 mt-1"> 57 57 + Enter the code sent to your email. 58 58 + </span> 59 59 + </div> 60 60 + 61 61 + <div class="flex flex-col"> 62 62 + <label for="username">username</label> 63 63 + <input 64 64 + type="text" 65 65 + id="username" 66 66 + name="username" 67 67 + tabindex="2" 68 68 + required 69 69 + placeholder="jason" 70 70 + /> 71 71 + <span class="text-sm text-gray-500 mt-1"> 72 72 + Your complete handle will be of the form <code>user.tngl.sh</code>. 73 73 + </span> 74 74 + </div> 75 75 + 76 76 + <div class="flex flex-col"> 77 77 + <label for="password">password</label> 78 78 + <input 79 79 + type="password" 80 80 + id="password" 81 81 + name="password" 82 82 + tabindex="3" 83 83 + required 84 84 + /> 85 85 + <span class="text-sm text-gray-500 mt-1"> 86 86 + Choose a strong password for your account. 87 87 + </span> 88 88 + </div> 89 89 + 90 90 + <button 91 91 + class="btn-create w-full my-2 mt-6 text-base" 92 92 + type="submit" 93 93 + id="complete-signup-button" 94 94 + tabindex="4" 95 95 + > 96 96 + <span>complete signup</span> 97 97 + </button> 98 98 + </form> 99 99 + <p id="signup-error" class="error w-full"></p> 100 100 + <p id="signup-msg" class="dark:text-white w-full"></p> 101 101 + </main> 102 102 + </body> 103 103 + </html> 104 104 + {{ end }}

+1 -3

appview/pages/templates/user/fragments/profileCard.html

··· 2 2 <div class="bg-white dark:bg-gray-800 px-6 py-4 rounded drop-shadow-sm max-h-fit"> 3 3 <div class="grid grid-cols-3 md:grid-cols-1 gap-1 items-center"> 4 4 <div id="avatar" class="col-span-1 flex justify-center items-center"> 5 5 - {{ if .AvatarUri }} 6 5 <div class="w-3/4 aspect-square relative"> 7 7 - <img class="absolute inset-0 w-full h-full object-cover rounded-full p-2" src="{{ .AvatarUri }}" /> 6 6 + <img class="absolute inset-0 w-full h-full object-cover rounded-full p-2" src="{{ fullAvatar .UserDid }}" /> 8 7 </div> 9 9 - {{ end }} 10 8 </div> 11 9 <div class="col-span-2"> 12 10 <p title="{{ didOrHandle .UserDid .UserHandle }}"

+13 -34

appview/pages/templates/user/login.html

··· 3 3 <html lang="en" class="dark:bg-gray-900"> 4 4 <head> 5 5 <meta charset="UTF-8" /> 6 6 - <meta 7 7 - name="viewport" 8 8 - content="width=device-width, initial-scale=1.0" 9 9 - /> 10 10 - <meta 11 11 - property="og:title" 12 12 - content="login · tangled" 13 13 - /> 14 14 - <meta 15 15 - property="og:url" 16 16 - content="https://tangled.sh/login" 17 17 - /> 18 18 - <meta 19 19 - property="og:description" 20 20 - content="login to tangled" 21 21 - /> 6 6 + <meta name="viewport" content="width=device-width, initial-scale=1.0" /> 7 7 + <meta property="og:title" content="login · tangled" /> 8 8 + <meta property="og:url" content="https://tangled.sh/login" /> 9 9 + <meta property="og:description" content="login to for tangled" /> 22 10 <script src="/static/htmx.min.js"></script> 23 23 - <link 24 24 - rel="stylesheet" 25 25 - href="/static/tw.css?{{ cssContentHash }}" 26 26 - type="text/css" 27 27 - /> 11 11 + <link rel="stylesheet" href="/static/tw.css?{{ cssContentHash }}" type="text/css" /> 28 12 <title>login &middot; tangled</title> 29 13 </head> 30 14 <body class="flex items-center justify-center min-h-screen"> 31 15 <main class="max-w-md px-6 -mt-4"> 32 32 - <h1 33 33 - class="text-center text-2xl font-semibold italic dark:text-white" 34 34 - > 16 16 + <h1 class="text-center text-2xl font-semibold italic dark:text-white" > 35 17 tangled 36 18 </h1> 37 19 <h2 class="text-center text-xl italic dark:text-white"> ··· 51 33 name="handle" 52 34 tabindex="1" 53 35 required 36 36 + placeholder="akshay.tngl.sh" 54 37 /> 55 38 <span class="text-sm text-gray-500 mt-1"> 56 56 - Use your 57 57 - <a href="https://bsky.app">Bluesky</a> handle to log 58 58 - in. You will then be redirected to your PDS to 59 59 - complete authentication. 39 39 + Use your <a href="https://atproto.com">ATProto</a> 40 40 + handle to log in. If you're unsure, this is likely 41 41 + your Tangled (<code>.tngl.sh</code>) or <a href="https://bsky.app">Bluesky</a> (<code>.bsky.social</code>) account. 60 42 </span> 61 43 </div> 62 44 63 45 <button 64 64 - class="btn w-full my-2 mt-6" 46 46 + class="btn w-full my-2 mt-6 text-base " 65 47 type="submit" 66 48 id="login-button" 67 49 tabindex="3" ··· 70 52 </button> 71 53 </form> 72 54 <p class="text-sm text-gray-500"> 73 73 - Join our <a href="https://chat.tangled.sh">Discord</a> or 74 74 - IRC channel: 75 75 - <a href="https://web.libera.chat/#tangled" 76 76 - ><code>#tangled</code> on Libera Chat</a 77 77 - >. 55 55 + Don't have an account? <a href="/signup" class="underline">Create an account</a> on Tangled now! 78 56 </p> 57 57 + 79 58 <p id="login-msg" class="error w-full"></p> 80 59 </main> 81 60 </body>

+53

appview/pages/templates/user/signup.html

··· 1 1 + {{ define "user/signup" }} 2 2 + <!doctype html> 3 3 + <html lang="en" class="dark:bg-gray-900"> 4 4 + <head> 5 5 + <meta charset="UTF-8" /> 6 6 + <meta name="viewport" content="width=device-width, initial-scale=1.0" /> 7 7 + <meta property="og:title" content="signup · tangled" /> 8 8 + <meta property="og:url" content="https://tangled.sh/signup" /> 9 9 + <meta property="og:description" content="sign up for tangled" /> 10 10 + <script src="/static/htmx.min.js"></script> 11 11 + <link rel="stylesheet" href="/static/tw.css?{{ cssContentHash }}" type="text/css" /> 12 12 + <title>sign up &middot; tangled</title> 13 13 + </head> 14 14 + <body class="flex items-center justify-center min-h-screen"> 15 15 + <main class="max-w-md px-6 -mt-4"> 16 16 + <h1 class="text-center text-2xl font-semibold italic dark:text-white" >tangled</h1> 17 17 + <h2 class="text-center text-xl italic dark:text-white">tightly-knit social coding.</h2> 18 18 + <form 19 19 + class="mt-4 max-w-sm mx-auto" 20 20 + hx-post="/signup" 21 21 + hx-swap="none" 22 22 + hx-disabled-elt="#signup-button" 23 23 + > 24 24 + <div class="flex flex-col mt-2"> 25 25 + <label for="email">email</label> 26 26 + <input 27 27 + type="email" 28 28 + id="email" 29 29 + name="email" 30 30 + tabindex="4" 31 31 + required 32 32 + placeholder="jason@bourne.co" 33 33 + /> 34 34 + </div> 35 35 + <span class="text-sm text-gray-500 mt-1"> 36 36 + You will receive an email with an invite code. Enter your 37 37 + invite code, desired username, and password in the next 38 38 + page to complete your registration. 39 39 + </span> 40 40 + <button class="btn text-base w-full my-2 mt-6" type="submit" id="signup-button" tabindex="7" > 41 41 + <span>join now</span> 42 42 + </button> 43 43 + </form> 44 44 + <p class="text-sm text-gray-500"> 45 45 + Already have an account? <a href="/login" class="underline">Login to Tangled</a>. 46 46 + </p> 47 47 + 48 48 + <p id="signup-msg" class="error w-full"></p> 49 49 + </main> 50 50 + </body> 51 51 + </html> 52 52 + {{ end }} 53 53 +

+21

appview/pulls/pulls.go

··· 555 555 556 556 // we want to group all stacked PRs into just one list 557 557 stacks := make(map[string]db.Stack) 558 558 + var shas []string 558 559 n := 0 559 560 for _, p := range pulls { 561 561 + // store the sha for later 562 562 + shas = append(shas, p.LatestSha()) 560 563 // this PR is stacked 561 564 if p.StackId != "" { 562 565 // we have already seen this PR stack ··· 575 578 } 576 579 pulls = pulls[:n] 577 580 581 581 + repoInfo := f.RepoInfo(user) 582 582 + ps, err := db.GetPipelineStatuses( 583 583 + s.db, 584 584 + db.FilterEq("repo_owner", repoInfo.OwnerDid), 585 585 + db.FilterEq("repo_name", repoInfo.Name), 586 586 + db.FilterEq("knot", repoInfo.Knot), 587 587 + db.FilterIn("sha", shas), 588 588 + ) 589 589 + if err != nil { 590 590 + log.Printf("failed to fetch pipeline statuses: %s", err) 591 591 + // non-fatal 592 592 + } 593 593 + m := make(map[string]db.Pipeline) 594 594 + for _, p := range ps { 595 595 + m[p.Sha] = p 596 596 + } 597 597 + 578 598 identsToResolve := make([]string, len(pulls)) 579 599 for i, pull := range pulls { 580 600 identsToResolve[i] = pull.OwnerDid ··· 596 616 DidHandleMap: didHandleMap, 597 617 FilteringBy: state, 598 618 Stacks: stacks, 619 619 + Pipelines: m, 599 620 }) 600 621 } 601 622

+399 -85

appview/repo/repo.go

··· 8 8 "fmt" 9 9 "io" 10 10 "log" 11 11 + "log/slog" 11 12 "net/http" 12 13 "net/url" 14 14 + "path/filepath" 13 15 "slices" 14 16 "strconv" 15 17 "strings" ··· 37 39 "github.com/go-git/go-git/v5/plumbing" 38 40 39 41 comatproto "github.com/bluesky-social/indigo/api/atproto" 42 42 + "github.com/bluesky-social/indigo/atproto/syntax" 40 43 lexutil "github.com/bluesky-social/indigo/lex/util" 41 44 ) 42 45 ··· 50 53 db *db.DB 51 54 enforcer *rbac.Enforcer 52 55 notifier notify.Notifier 56 56 + logger *slog.Logger 53 57 } 54 58 55 59 func New( ··· 62 66 config *config.Config, 63 67 notifier notify.Notifier, 64 68 enforcer *rbac.Enforcer, 69 69 + logger *slog.Logger, 65 70 ) *Repo { 66 71 return &Repo{oauth: oauth, 67 72 repoResolver: repoResolver, ··· 72 77 db: db, 73 78 notifier: notifier, 74 79 enforcer: enforcer, 80 80 + logger: logger, 75 81 } 76 82 } 77 83 ··· 532 538 showRendered = r.URL.Query().Get("code") != "true" 533 539 } 534 540 541 541 + var unsupported bool 542 542 + var isImage bool 543 543 + var isVideo bool 544 544 + var contentSrc string 545 545 + 546 546 + if result.IsBinary { 547 547 + ext := strings.ToLower(filepath.Ext(result.Path)) 548 548 + switch ext { 549 549 + case ".jpg", ".jpeg", ".png", ".gif", ".svg", ".webp": 550 550 + isImage = true 551 551 + case ".mp4", ".webm", ".ogg", ".mov", ".avi": 552 552 + isVideo = true 553 553 + default: 554 554 + unsupported = true 555 555 + } 556 556 + 557 557 + // fetch the actual binary content like in RepoBlobRaw 558 558 + 559 559 + blobURL := fmt.Sprintf("%s://%s/%s/%s/raw/%s/%s", protocol, f.Knot, f.OwnerDid(), f.RepoName, ref, filePath) 560 560 + contentSrc = blobURL 561 561 + if !rp.config.Core.Dev { 562 562 + contentSrc = markup.GenerateCamoURL(rp.config.Camo.Host, rp.config.Camo.SharedSecret, blobURL) 563 563 + } 564 564 + } 565 565 + 535 566 user := rp.oauth.GetUser(r) 536 567 rp.pages.RepoBlob(w, pages.RepoBlobParams{ 537 568 LoggedInUser: user, ··· 540 571 BreadCrumbs: breadcrumbs, 541 572 ShowRendered: showRendered, 542 573 RenderToggle: renderToggle, 574 574 + Unsupported: unsupported, 575 575 + IsImage: isImage, 576 576 + IsVideo: isVideo, 577 577 + ContentSrc: contentSrc, 543 578 }) 544 579 } 545 580 ··· 547 582 f, err := rp.repoResolver.Resolve(r) 548 583 if err != nil { 549 584 log.Println("failed to get repo and knot", err) 585 585 + w.WriteHeader(http.StatusBadRequest) 550 586 return 551 587 } 552 588 ··· 557 593 if !rp.config.Core.Dev { 558 594 protocol = "https" 559 595 } 560 560 - resp, err := http.Get(fmt.Sprintf("%s://%s/%s/%s/blob/%s/%s", protocol, f.Knot, f.OwnerDid(), f.RepoName, ref, filePath)) 596 596 + blobURL := fmt.Sprintf("%s://%s/%s/%s/raw/%s/%s", protocol, f.Knot, f.OwnerDid(), f.RepoName, ref, filePath) 597 597 + resp, err := http.Get(blobURL) 561 598 if err != nil { 562 562 - log.Println("failed to reach knotserver", err) 599 599 + log.Println("failed to reach knotserver:", err) 600 600 + rp.pages.Error503(w) 563 601 return 564 602 } 603 603 + defer resp.Body.Close() 565 604 566 566 - body, err := io.ReadAll(resp.Body) 567 567 - if err != nil { 568 568 - log.Printf("Error reading response body: %v", err) 605 605 + if resp.StatusCode != http.StatusOK { 606 606 + log.Printf("knotserver returned non-OK status for raw blob %s: %d", blobURL, resp.StatusCode) 607 607 + w.WriteHeader(resp.StatusCode) 608 608 + _, _ = io.Copy(w, resp.Body) 569 609 return 570 610 } 571 611 572 572 - var result types.RepoBlobResponse 573 573 - err = json.Unmarshal(body, &result) 612 612 + contentType := resp.Header.Get("Content-Type") 613 613 + body, err := io.ReadAll(resp.Body) 574 614 if err != nil { 575 575 - log.Println("failed to parse response:", err) 615 615 + log.Printf("error reading response body from knotserver: %v", err) 616 616 + w.WriteHeader(http.StatusInternalServerError) 576 617 return 577 618 } 578 619 579 579 - if result.IsBinary { 580 580 - w.Header().Set("Content-Type", "application/octet-stream") 620 620 + if strings.Contains(contentType, "text/plain") { 621 621 + w.Header().Set("Content-Type", "text/plain; charset=utf-8") 622 622 + w.Write(body) 623 623 + } else if strings.HasPrefix(contentType, "image/") || strings.HasPrefix(contentType, "video/") { 624 624 + w.Header().Set("Content-Type", contentType) 581 625 w.Write(body) 626 626 + } else { 627 627 + w.WriteHeader(http.StatusUnsupportedMediaType) 628 628 + w.Write([]byte("unsupported content type")) 582 629 return 583 630 } 584 584 - 585 585 - w.Header().Set("Content-Type", "text/plain; charset=utf-8") 586 586 - w.Write([]byte(result.Contents)) 587 631 } 588 632 589 633 // modify the spindle configured for this repo 590 634 func (rp *Repo) EditSpindle(w http.ResponseWriter, r *http.Request) { 635 635 + user := rp.oauth.GetUser(r) 636 636 + l := rp.logger.With("handler", "EditSpindle") 637 637 + l = l.With("did", user.Did) 638 638 + l = l.With("handle", user.Handle) 639 639 + 640 640 + errorId := "operation-error" 641 641 + fail := func(msg string, err error) { 642 642 + l.Error(msg, "err", err) 643 643 + rp.pages.Notice(w, errorId, msg) 644 644 + } 645 645 + 591 646 f, err := rp.repoResolver.Resolve(r) 592 647 if err != nil { 593 593 - log.Println("failed to get repo and knot", err) 594 594 - w.WriteHeader(http.StatusBadRequest) 648 648 + fail("Failed to resolve repo. Try again later", err) 595 649 return 596 650 } 597 651 598 652 repoAt := f.RepoAt 599 653 rkey := repoAt.RecordKey().String() 600 654 if rkey == "" { 601 601 - log.Println("invalid aturi for repo", err) 602 602 - w.WriteHeader(http.StatusInternalServerError) 655 655 + fail("Failed to resolve repo. Try again later", err) 603 656 return 604 657 } 605 605 - 606 606 - user := rp.oauth.GetUser(r) 607 658 608 659 newSpindle := r.FormValue("spindle") 609 660 client, err := rp.oauth.AuthorizedClient(r) 610 661 if err != nil { 611 611 - log.Println("failed to get client") 612 612 - rp.pages.Notice(w, "repo-notice", "Failed to configure spindle, try again later.") 662 662 + fail("Failed to authorize. Try again later.", err) 613 663 return 614 664 } 615 665 616 666 // ensure that this is a valid spindle for this user 617 667 validSpindles, err := rp.enforcer.GetSpindlesForUser(user.Did) 618 668 if err != nil { 619 619 - log.Println("failed to get valid spindles") 620 620 - rp.pages.Notice(w, "repo-notice", "Failed to configure spindle, try again later.") 669 669 + fail("Failed to find spindles. Try again later.", err) 621 670 return 622 671 } 623 672 624 673 if !slices.Contains(validSpindles, newSpindle) { 625 625 - log.Println("newSpindle not present in validSpindles", "newSpindle", newSpindle, "validSpindles", validSpindles) 626 626 - rp.pages.Notice(w, "repo-notice", "Failed to configure spindle, try again later.") 674 674 + fail("Failed to configure spindle.", fmt.Errorf("%s is not a valid spindle: %q", newSpindle, validSpindles)) 627 675 return 628 676 } 629 677 630 678 // optimistic update 631 679 err = db.UpdateSpindle(rp.db, string(repoAt), newSpindle) 632 680 if err != nil { 633 633 - log.Println("failed to perform update-spindle query", err) 634 634 - rp.pages.Notice(w, "repo-notice", "Failed to configure spindle, try again later.") 681 681 + fail("Failed to update spindle. Try again later.", err) 635 682 return 636 683 } 637 684 638 685 ex, err := client.RepoGetRecord(r.Context(), "", tangled.RepoNSID, user.Did, rkey) 639 686 if err != nil { 640 640 - // failed to get record 641 641 - rp.pages.Notice(w, "repo-notice", "Failed to configure spindle, no record found on PDS.") 687 687 + fail("Failed to update spindle, no record found on PDS.", err) 642 688 return 643 689 } 644 690 _, err = client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ ··· 659 705 }) 660 706 661 707 if err != nil { 662 662 - log.Println("failed to perform update-spindle query", err) 663 663 - // failed to get record 664 664 - rp.pages.Notice(w, "repo-notice", "Failed to configure spindle, unable to save to PDS.") 708 708 + fail("Failed to update spindle, unable to save to PDS.", err) 665 709 return 666 710 } 667 711 ··· 671 715 eventconsumer.NewSpindleSource(newSpindle), 672 716 ) 673 717 674 674 - w.Write(fmt.Append(nil, "spindle set to: ", newSpindle)) 718 718 + rp.pages.HxRefresh(w) 675 719 } 676 720 677 721 func (rp *Repo) AddCollaborator(w http.ResponseWriter, r *http.Request) { 722 722 + user := rp.oauth.GetUser(r) 723 723 + l := rp.logger.With("handler", "AddCollaborator") 724 724 + l = l.With("did", user.Did) 725 725 + l = l.With("handle", user.Handle) 726 726 + 678 727 f, err := rp.repoResolver.Resolve(r) 679 728 if err != nil { 680 680 - log.Println("failed to get repo and knot", err) 729 729 + l.Error("failed to get repo and knot", "err", err) 681 730 return 682 731 } 683 732 733 733 + errorId := "add-collaborator-error" 734 734 + fail := func(msg string, err error) { 735 735 + l.Error(msg, "err", err) 736 736 + rp.pages.Notice(w, errorId, msg) 737 737 + } 738 738 + 684 739 collaborator := r.FormValue("collaborator") 685 740 if collaborator == "" { 686 686 - http.Error(w, "malformed form", http.StatusBadRequest) 741 741 + fail("Invalid form.", nil) 687 742 return 688 743 } 689 744 690 745 collaboratorIdent, err := rp.idResolver.ResolveIdent(r.Context(), collaborator) 691 746 if err != nil { 692 692 - w.Write([]byte("failed to resolve collaborator did to a handle")) 747 747 + fail(fmt.Sprintf("'%s' is not a valid DID/handle.", collaborator), err) 748 748 + return 749 749 + } 750 750 + 751 751 + if collaboratorIdent.DID.String() == user.Did { 752 752 + fail("You seem to be adding yourself as a collaborator.", nil) 753 753 + return 754 754 + } 755 755 + l = l.With("collaborator", collaboratorIdent.Handle) 756 756 + l = l.With("knot", f.Knot) 757 757 + 758 758 + // announce this relation into the firehose, store into owners' pds 759 759 + client, err := rp.oauth.AuthorizedClient(r) 760 760 + if err != nil { 761 761 + fail("Failed to write to PDS.", err) 693 762 return 694 763 } 695 695 - log.Printf("adding %s to %s\n", collaboratorIdent.Handle.String(), f.Knot) 696 764 697 697 - // TODO: create an atproto record for this 765 765 + // emit a record 766 766 + currentUser := rp.oauth.GetUser(r) 767 767 + rkey := tid.TID() 768 768 + createdAt := time.Now() 769 769 + resp, err := client.RepoPutRecord(r.Context(), &comatproto.RepoPutRecord_Input{ 770 770 + Collection: tangled.RepoCollaboratorNSID, 771 771 + Repo: currentUser.Did, 772 772 + Rkey: rkey, 773 773 + Record: &lexutil.LexiconTypeDecoder{ 774 774 + Val: &tangled.RepoCollaborator{ 775 775 + Subject: collaboratorIdent.DID.String(), 776 776 + Repo: string(f.RepoAt), 777 777 + CreatedAt: createdAt.Format(time.RFC3339), 778 778 + }}, 779 779 + }) 780 780 + // invalid record 781 781 + if err != nil { 782 782 + fail("Failed to write record to PDS.", err) 783 783 + return 784 784 + } 785 785 + l = l.With("at-uri", resp.Uri) 786 786 + l.Info("wrote record to PDS") 698 787 788 788 + l.Info("adding to knot") 699 789 secret, err := db.GetRegistrationKey(rp.db, f.Knot) 700 790 if err != nil { 701 701 - log.Printf("no key found for domain %s: %s\n", f.Knot, err) 791 791 + fail("Failed to add to knot.", err) 702 792 return 703 793 } 704 794 705 795 ksClient, err := knotclient.NewSignedClient(f.Knot, secret, rp.config.Core.Dev) 706 796 if err != nil { 707 707 - log.Println("failed to create client to ", f.Knot) 797 797 + fail("Failed to add to knot.", err) 708 798 return 709 799 } 710 800 711 801 ksResp, err := ksClient.AddCollaborator(f.OwnerDid(), f.RepoName, collaboratorIdent.DID.String()) 712 802 if err != nil { 713 713 - log.Printf("failed to make request to %s: %s", f.Knot, err) 803 803 + fail("Knot was unreachable.", err) 714 804 return 715 805 } 716 806 717 807 if ksResp.StatusCode != http.StatusNoContent { 718 718 - w.Write(fmt.Append(nil, "knotserver failed to add collaborator: ", err)) 808 808 + fail(fmt.Sprintf("Knot returned unexpected status code: %d.", ksResp.StatusCode), nil) 719 809 return 720 810 } 721 811 722 812 tx, err := rp.db.BeginTx(r.Context(), nil) 723 813 if err != nil { 724 724 - log.Println("failed to start tx") 725 725 - w.Write(fmt.Append(nil, "failed to add collaborator: ", err)) 814 814 + fail("Failed to add collaborator.", err) 726 815 return 727 816 } 728 817 defer func() { 729 818 tx.Rollback() 730 819 err = rp.enforcer.E.LoadPolicy() 731 820 if err != nil { 732 732 - log.Println("failed to rollback policies") 821 821 + fail("Failed to add collaborator.", err) 733 822 } 734 823 }() 735 824 736 825 err = rp.enforcer.AddCollaborator(collaboratorIdent.DID.String(), f.Knot, f.DidSlashRepo()) 737 826 if err != nil { 738 738 - w.Write(fmt.Append(nil, "failed to add collaborator: ", err)) 827 827 + fail("Failed to add collaborator permissions.", err) 739 828 return 740 829 } 741 830 742 742 - err = db.AddCollaborator(rp.db, collaboratorIdent.DID.String(), f.OwnerDid(), f.RepoName, f.Knot) 831 831 + err = db.AddCollaborator(rp.db, db.Collaborator{ 832 832 + Did: syntax.DID(currentUser.Did), 833 833 + Rkey: rkey, 834 834 + SubjectDid: collaboratorIdent.DID, 835 835 + RepoAt: f.RepoAt, 836 836 + Created: createdAt, 837 837 + }) 743 838 if err != nil { 744 744 - w.Write(fmt.Append(nil, "failed to add collaborator: ", err)) 839 839 + fail("Failed to add collaborator.", err) 745 840 return 746 841 } 747 842 748 843 err = tx.Commit() 749 844 if err != nil { 750 750 - log.Println("failed to commit changes", err) 751 751 - http.Error(w, err.Error(), http.StatusInternalServerError) 845 845 + fail("Failed to add collaborator.", err) 752 846 return 753 847 } 754 848 755 849 err = rp.enforcer.E.SavePolicy() 756 850 if err != nil { 757 757 - log.Println("failed to update ACLs", err) 758 758 - http.Error(w, err.Error(), http.StatusInternalServerError) 851 851 + fail("Failed to update collaborator permissions.", err) 759 852 return 760 853 } 761 854 762 762 - w.Write(fmt.Append(nil, "added collaborator: ", collaboratorIdent.Handle.String())) 763 763 - 855 855 + rp.pages.HxRefresh(w) 764 856 } 765 857 766 858 func (rp *Repo) DeleteRepo(w http.ResponseWriter, r *http.Request) { ··· 912 1004 w.Write(fmt.Append(nil, "default branch set to: ", branch)) 913 1005 } 914 1006 915 915 - func (rp *Repo) RepoSettings(w http.ResponseWriter, r *http.Request) { 1007 1007 + func (rp *Repo) Secrets(w http.ResponseWriter, r *http.Request) { 1008 1008 + user := rp.oauth.GetUser(r) 1009 1009 + l := rp.logger.With("handler", "Secrets") 1010 1010 + l = l.With("handle", user.Handle) 1011 1011 + l = l.With("did", user.Did) 1012 1012 + 916 1013 f, err := rp.repoResolver.Resolve(r) 917 1014 if err != nil { 918 1015 log.Println("failed to get repo and knot", err) 919 1016 return 920 1017 } 921 1018 1019 1019 + if f.Spindle == "" { 1020 1020 + log.Println("empty spindle cannot add/rm secret", err) 1021 1021 + return 1022 1022 + } 1023 1023 + 1024 1024 + lxm := tangled.RepoAddSecretNSID 1025 1025 + if r.Method == http.MethodDelete { 1026 1026 + lxm = tangled.RepoRemoveSecretNSID 1027 1027 + } 1028 1028 + 1029 1029 + spindleClient, err := rp.oauth.ServiceClient( 1030 1030 + r, 1031 1031 + oauth.WithService(f.Spindle), 1032 1032 + oauth.WithLxm(lxm), 1033 1033 + oauth.WithDev(rp.config.Core.Dev), 1034 1034 + ) 1035 1035 + if err != nil { 1036 1036 + log.Println("failed to create spindle client", err) 1037 1037 + return 1038 1038 + } 1039 1039 + 1040 1040 + key := r.FormValue("key") 1041 1041 + if key == "" { 1042 1042 + w.WriteHeader(http.StatusBadRequest) 1043 1043 + return 1044 1044 + } 1045 1045 + 922 1046 switch r.Method { 923 923 - case http.MethodGet: 924 924 - // for now, this is just pubkeys 925 925 - user := rp.oauth.GetUser(r) 926 926 - repoCollaborators, err := f.Collaborators(r.Context()) 927 927 - if err != nil { 928 928 - log.Println("failed to get collaborators", err) 929 929 - } 1047 1047 + case http.MethodPut: 1048 1048 + errorId := "add-secret-error" 930 1049 931 931 - isCollaboratorInviteAllowed := false 932 932 - if user != nil { 933 933 - ok, err := rp.enforcer.IsCollaboratorInviteAllowed(user.Did, f.Knot, f.DidSlashRepo()) 934 934 - if err == nil && ok { 935 935 - isCollaboratorInviteAllowed = true 936 936 - } 1050 1050 + value := r.FormValue("value") 1051 1051 + if value == "" { 1052 1052 + w.WriteHeader(http.StatusBadRequest) 1053 1053 + return 937 1054 } 938 1055 939 939 - us, err := knotclient.NewUnsignedClient(f.Knot, rp.config.Core.Dev) 1056 1056 + err = tangled.RepoAddSecret( 1057 1057 + r.Context(), 1058 1058 + spindleClient, 1059 1059 + &tangled.RepoAddSecret_Input{ 1060 1060 + Repo: f.RepoAt.String(), 1061 1061 + Key: key, 1062 1062 + Value: value, 1063 1063 + }, 1064 1064 + ) 940 1065 if err != nil { 941 941 - log.Println("failed to create unsigned client", err) 1066 1066 + l.Error("Failed to add secret.", "err", err) 1067 1067 + rp.pages.Notice(w, errorId, "Failed to add secret.") 942 1068 return 943 1069 } 944 1070 945 945 - result, err := us.Branches(f.OwnerDid(), f.RepoName) 1071 1071 + case http.MethodDelete: 1072 1072 + errorId := "operation-error" 1073 1073 + 1074 1074 + err = tangled.RepoRemoveSecret( 1075 1075 + r.Context(), 1076 1076 + spindleClient, 1077 1077 + &tangled.RepoRemoveSecret_Input{ 1078 1078 + Repo: f.RepoAt.String(), 1079 1079 + Key: key, 1080 1080 + }, 1081 1081 + ) 946 1082 if err != nil { 947 947 - log.Println("failed to reach knotserver", err) 1083 1083 + l.Error("Failed to delete secret.", "err", err) 1084 1084 + rp.pages.Notice(w, errorId, "Failed to delete secret.") 948 1085 return 949 1086 } 1087 1087 + } 950 1088 951 951 - // all spindles that this user is a member of 952 952 - spindles, err := rp.enforcer.GetSpindlesForUser(user.Did) 953 953 - if err != nil { 954 954 - log.Println("failed to fetch spindles", err) 955 955 - return 1089 1089 + rp.pages.HxRefresh(w) 1090 1090 + } 1091 1091 + 1092 1092 + type tab = map[string]any 1093 1093 + 1094 1094 + var ( 1095 1095 + // would be great to have ordered maps right about now 1096 1096 + settingsTabs []tab = []tab{ 1097 1097 + {"Name": "general", "Icon": "sliders-horizontal"}, 1098 1098 + {"Name": "access", "Icon": "users"}, 1099 1099 + {"Name": "pipelines", "Icon": "layers-2"}, 1100 1100 + } 1101 1101 + ) 1102 1102 + 1103 1103 + func (rp *Repo) RepoSettings(w http.ResponseWriter, r *http.Request) { 1104 1104 + tabVal := r.URL.Query().Get("tab") 1105 1105 + if tabVal == "" { 1106 1106 + tabVal = "general" 1107 1107 + } 1108 1108 + 1109 1109 + switch tabVal { 1110 1110 + case "general": 1111 1111 + rp.generalSettings(w, r) 1112 1112 + 1113 1113 + case "access": 1114 1114 + rp.accessSettings(w, r) 1115 1115 + 1116 1116 + case "pipelines": 1117 1117 + rp.pipelineSettings(w, r) 1118 1118 + } 1119 1119 + 1120 1120 + // user := rp.oauth.GetUser(r) 1121 1121 + // repoCollaborators, err := f.Collaborators(r.Context()) 1122 1122 + // if err != nil { 1123 1123 + // log.Println("failed to get collaborators", err) 1124 1124 + // } 1125 1125 + 1126 1126 + // isCollaboratorInviteAllowed := false 1127 1127 + // if user != nil { 1128 1128 + // ok, err := rp.enforcer.IsCollaboratorInviteAllowed(user.Did, f.Knot, f.DidSlashRepo()) 1129 1129 + // if err == nil && ok { 1130 1130 + // isCollaboratorInviteAllowed = true 1131 1131 + // } 1132 1132 + // } 1133 1133 + 1134 1134 + // us, err := knotclient.NewUnsignedClient(f.Knot, rp.config.Core.Dev) 1135 1135 + // if err != nil { 1136 1136 + // log.Println("failed to create unsigned client", err) 1137 1137 + // return 1138 1138 + // } 1139 1139 + 1140 1140 + // result, err := us.Branches(f.OwnerDid(), f.RepoName) 1141 1141 + // if err != nil { 1142 1142 + // log.Println("failed to reach knotserver", err) 1143 1143 + // return 1144 1144 + // } 1145 1145 + 1146 1146 + // // all spindles that this user is a member of 1147 1147 + // spindles, err := rp.enforcer.GetSpindlesForUser(user.Did) 1148 1148 + // if err != nil { 1149 1149 + // log.Println("failed to fetch spindles", err) 1150 1150 + // return 1151 1151 + // } 1152 1152 + 1153 1153 + // var secrets []*tangled.RepoListSecrets_Secret 1154 1154 + // if f.Spindle != "" { 1155 1155 + // if spindleClient, err := rp.oauth.ServiceClient( 1156 1156 + // r, 1157 1157 + // oauth.WithService(f.Spindle), 1158 1158 + // oauth.WithLxm(tangled.RepoListSecretsNSID), 1159 1159 + // oauth.WithDev(rp.config.Core.Dev), 1160 1160 + // ); err != nil { 1161 1161 + // log.Println("failed to create spindle client", err) 1162 1162 + // } else if resp, err := tangled.RepoListSecrets(r.Context(), spindleClient, f.RepoAt.String()); err != nil { 1163 1163 + // log.Println("failed to fetch secrets", err) 1164 1164 + // } else { 1165 1165 + // secrets = resp.Secrets 1166 1166 + // } 1167 1167 + // } 1168 1168 + 1169 1169 + // rp.pages.RepoSettings(w, pages.RepoSettingsParams{ 1170 1170 + // LoggedInUser: user, 1171 1171 + // RepoInfo: f.RepoInfo(user), 1172 1172 + // Collaborators: repoCollaborators, 1173 1173 + // IsCollaboratorInviteAllowed: isCollaboratorInviteAllowed, 1174 1174 + // Branches: result.Branches, 1175 1175 + // Spindles: spindles, 1176 1176 + // CurrentSpindle: f.Spindle, 1177 1177 + // Secrets: secrets, 1178 1178 + // }) 1179 1179 + } 1180 1180 + 1181 1181 + func (rp *Repo) generalSettings(w http.ResponseWriter, r *http.Request) { 1182 1182 + f, err := rp.repoResolver.Resolve(r) 1183 1183 + user := rp.oauth.GetUser(r) 1184 1184 + 1185 1185 + us, err := knotclient.NewUnsignedClient(f.Knot, rp.config.Core.Dev) 1186 1186 + if err != nil { 1187 1187 + log.Println("failed to create unsigned client", err) 1188 1188 + return 1189 1189 + } 1190 1190 + 1191 1191 + result, err := us.Branches(f.OwnerDid(), f.RepoName) 1192 1192 + if err != nil { 1193 1193 + log.Println("failed to reach knotserver", err) 1194 1194 + return 1195 1195 + } 1196 1196 + 1197 1197 + rp.pages.RepoGeneralSettings(w, pages.RepoGeneralSettingsParams{ 1198 1198 + LoggedInUser: user, 1199 1199 + RepoInfo: f.RepoInfo(user), 1200 1200 + Branches: result.Branches, 1201 1201 + Tabs: settingsTabs, 1202 1202 + Tab: "general", 1203 1203 + }) 1204 1204 + } 1205 1205 + 1206 1206 + func (rp *Repo) accessSettings(w http.ResponseWriter, r *http.Request) { 1207 1207 + f, err := rp.repoResolver.Resolve(r) 1208 1208 + user := rp.oauth.GetUser(r) 1209 1209 + 1210 1210 + repoCollaborators, err := f.Collaborators(r.Context()) 1211 1211 + if err != nil { 1212 1212 + log.Println("failed to get collaborators", err) 1213 1213 + } 1214 1214 + 1215 1215 + rp.pages.RepoAccessSettings(w, pages.RepoAccessSettingsParams{ 1216 1216 + LoggedInUser: user, 1217 1217 + RepoInfo: f.RepoInfo(user), 1218 1218 + Tabs: settingsTabs, 1219 1219 + Tab: "access", 1220 1220 + Collaborators: repoCollaborators, 1221 1221 + }) 1222 1222 + } 1223 1223 + 1224 1224 + func (rp *Repo) pipelineSettings(w http.ResponseWriter, r *http.Request) { 1225 1225 + f, err := rp.repoResolver.Resolve(r) 1226 1226 + user := rp.oauth.GetUser(r) 1227 1227 + 1228 1228 + // all spindles that the repo owner is a member of 1229 1229 + spindles, err := rp.enforcer.GetSpindlesForUser(f.OwnerDid()) 1230 1230 + if err != nil { 1231 1231 + log.Println("failed to fetch spindles", err) 1232 1232 + return 1233 1233 + } 1234 1234 + 1235 1235 + var secrets []*tangled.RepoListSecrets_Secret 1236 1236 + if f.Spindle != "" { 1237 1237 + if spindleClient, err := rp.oauth.ServiceClient( 1238 1238 + r, 1239 1239 + oauth.WithService(f.Spindle), 1240 1240 + oauth.WithLxm(tangled.RepoListSecretsNSID), 1241 1241 + oauth.WithDev(rp.config.Core.Dev), 1242 1242 + ); err != nil { 1243 1243 + log.Println("failed to create spindle client", err) 1244 1244 + } else if resp, err := tangled.RepoListSecrets(r.Context(), spindleClient, f.RepoAt.String()); err != nil { 1245 1245 + log.Println("failed to fetch secrets", err) 1246 1246 + } else { 1247 1247 + secrets = resp.Secrets 956 1248 } 1249 1249 + } 957 1250 958 958 - rp.pages.RepoSettings(w, pages.RepoSettingsParams{ 959 959 - LoggedInUser: user, 960 960 - RepoInfo: f.RepoInfo(user), 961 961 - Collaborators: repoCollaborators, 962 962 - IsCollaboratorInviteAllowed: isCollaboratorInviteAllowed, 963 963 - Branches: result.Branches, 964 964 - Spindles: spindles, 965 965 - CurrentSpindle: f.Spindle, 1251 1251 + slices.SortFunc(secrets, func(a, b *tangled.RepoListSecrets_Secret) int { 1252 1252 + return strings.Compare(a.Key, b.Key) 1253 1253 + }) 1254 1254 + 1255 1255 + var dids []string 1256 1256 + for _, s := range secrets { 1257 1257 + dids = append(dids, s.CreatedBy) 1258 1258 + } 1259 1259 + resolvedIdents := rp.idResolver.ResolveIdents(r.Context(), dids) 1260 1260 + 1261 1261 + // convert to a more manageable form 1262 1262 + var niceSecret []map[string]any 1263 1263 + for id, s := range secrets { 1264 1264 + when, _ := time.Parse(time.RFC3339, s.CreatedAt) 1265 1265 + niceSecret = append(niceSecret, map[string]any{ 1266 1266 + "Id": id, 1267 1267 + "Key": s.Key, 1268 1268 + "CreatedAt": when, 1269 1269 + "CreatedBy": resolvedIdents[id].Handle.String(), 966 1270 }) 967 1271 } 1272 1272 + 1273 1273 + rp.pages.RepoPipelineSettings(w, pages.RepoPipelineSettingsParams{ 1274 1274 + LoggedInUser: user, 1275 1275 + RepoInfo: f.RepoInfo(user), 1276 1276 + Tabs: settingsTabs, 1277 1277 + Tab: "pipelines", 1278 1278 + Spindles: spindles, 1279 1279 + CurrentSpindle: f.Spindle, 1280 1280 + Secrets: niceSecret, 1281 1281 + }) 968 1282 } 969 1283 970 1284 func (rp *Repo) SyncRepoFork(w http.ResponseWriter, r *http.Request) {

+2

appview/repo/router.go

··· 74 74 r.With(mw.RepoPermissionMiddleware("repo:invite")).Put("/collaborator", rp.AddCollaborator) 75 75 r.With(mw.RepoPermissionMiddleware("repo:delete")).Delete("/delete", rp.DeleteRepo) 76 76 r.Put("/branches/default", rp.SetDefaultBranch) 77 77 + r.Put("/secrets", rp.Secrets) 78 78 + r.Delete("/secrets", rp.Secrets) 77 79 }) 78 80 }) 79 81

+4 -3

appview/reporesolver/resolver.go

··· 149 149 for _, item := range repoCollaborators { 150 150 // currently only two roles: owner and member 151 151 var role string 152 152 - if item[3] == "repo:owner" { 152 152 + switch item[3] { 153 153 + case "repo:owner": 153 154 role = "owner" 154 154 - } else if item[3] == "repo:collaborator" { 155 155 + case "repo:collaborator": 155 156 role = "collaborator" 156 156 - } else { 157 157 + default: 157 158 continue 158 159 } 159 160

+104

appview/signup/requests.go

··· 1 1 + package signup 2 2 + 3 3 + // We have this extra code here for now since the xrpcclient package 4 4 + // only supports OAuth'd requests; these are unauthenticated or use PDS admin auth. 5 5 + 6 6 + import ( 7 7 + "bytes" 8 8 + "encoding/json" 9 9 + "fmt" 10 10 + "io" 11 11 + "net/http" 12 12 + "net/url" 13 13 + ) 14 14 + 15 15 + // makePdsRequest is a helper method to make requests to the PDS service 16 16 + func (s *Signup) makePdsRequest(method, endpoint string, body interface{}, useAuth bool) (*http.Response, error) { 17 17 + jsonData, err := json.Marshal(body) 18 18 + if err != nil { 19 19 + return nil, err 20 20 + } 21 21 + 22 22 + url := fmt.Sprintf("%s/xrpc/%s", s.config.Pds.Host, endpoint) 23 23 + req, err := http.NewRequest(method, url, bytes.NewBuffer(jsonData)) 24 24 + if err != nil { 25 25 + return nil, err 26 26 + } 27 27 + 28 28 + req.Header.Set("Content-Type", "application/json") 29 29 + 30 30 + if useAuth { 31 31 + req.SetBasicAuth("admin", s.config.Pds.AdminSecret) 32 32 + } 33 33 + 34 34 + return http.DefaultClient.Do(req) 35 35 + } 36 36 + 37 37 + // handlePdsError processes error responses from the PDS service 38 38 + func (s *Signup) handlePdsError(resp *http.Response, action string) error { 39 39 + var errorResp struct { 40 40 + Error string `json:"error"` 41 41 + Message string `json:"message"` 42 42 + } 43 43 + 44 44 + respBody, _ := io.ReadAll(resp.Body) 45 45 + if err := json.Unmarshal(respBody, &errorResp); err == nil && errorResp.Message != "" { 46 46 + return fmt.Errorf("Failed to %s: %s - %s.", action, errorResp.Error, errorResp.Message) 47 47 + } 48 48 + 49 49 + // Fallback if we couldn't parse the error 50 50 + return fmt.Errorf("failed to %s, status code: %d", action, resp.StatusCode) 51 51 + } 52 52 + 53 53 + func (s *Signup) inviteCodeRequest() (string, error) { 54 54 + body := map[string]any{"useCount": 1} 55 55 + 56 56 + resp, err := s.makePdsRequest("POST", "com.atproto.server.createInviteCode", body, true) 57 57 + if err != nil { 58 58 + return "", err 59 59 + } 60 60 + defer resp.Body.Close() 61 61 + 62 62 + if resp.StatusCode != http.StatusOK { 63 63 + return "", s.handlePdsError(resp, "create invite code") 64 64 + } 65 65 + 66 66 + var result map[string]string 67 67 + json.NewDecoder(resp.Body).Decode(&result) 68 68 + return result["code"], nil 69 69 + } 70 70 + 71 71 + func (s *Signup) createAccountRequest(username, password, email, code string) (string, error) { 72 72 + parsedURL, err := url.Parse(s.config.Pds.Host) 73 73 + if err != nil { 74 74 + return "", fmt.Errorf("invalid PDS host URL: %w", err) 75 75 + } 76 76 + 77 77 + pdsDomain := parsedURL.Hostname() 78 78 + 79 79 + body := map[string]string{ 80 80 + "email": email, 81 81 + "handle": fmt.Sprintf("%s.%s", username, pdsDomain), 82 82 + "password": password, 83 83 + "inviteCode": code, 84 84 + } 85 85 + 86 86 + resp, err := s.makePdsRequest("POST", "com.atproto.server.createAccount", body, false) 87 87 + if err != nil { 88 88 + return "", err 89 89 + } 90 90 + defer resp.Body.Close() 91 91 + 92 92 + if resp.StatusCode != http.StatusOK { 93 93 + return "", s.handlePdsError(resp, "create account") 94 94 + } 95 95 + 96 96 + var result struct { 97 97 + DID string `json:"did"` 98 98 + } 99 99 + if err := json.NewDecoder(resp.Body).Decode(&result); err != nil { 100 100 + return "", fmt.Errorf("failed to decode create account response: %w", err) 101 101 + } 102 102 + 103 103 + return result.DID, nil 104 104 + }

+256

appview/signup/signup.go

··· 1 1 + package signup 2 2 + 3 3 + import ( 4 4 + "bufio" 5 5 + "fmt" 6 6 + "log/slog" 7 7 + "net/http" 8 8 + "os" 9 9 + "strings" 10 10 + 11 11 + "github.com/go-chi/chi/v5" 12 12 + "github.com/posthog/posthog-go" 13 13 + "tangled.sh/tangled.sh/core/appview/config" 14 14 + "tangled.sh/tangled.sh/core/appview/db" 15 15 + "tangled.sh/tangled.sh/core/appview/dns" 16 16 + "tangled.sh/tangled.sh/core/appview/email" 17 17 + "tangled.sh/tangled.sh/core/appview/pages" 18 18 + "tangled.sh/tangled.sh/core/appview/state/userutil" 19 19 + "tangled.sh/tangled.sh/core/appview/xrpcclient" 20 20 + "tangled.sh/tangled.sh/core/idresolver" 21 21 + ) 22 22 + 23 23 + type Signup struct { 24 24 + config *config.Config 25 25 + db *db.DB 26 26 + cf *dns.Cloudflare 27 27 + posthog posthog.Client 28 28 + xrpc *xrpcclient.Client 29 29 + idResolver *idresolver.Resolver 30 30 + pages *pages.Pages 31 31 + l *slog.Logger 32 32 + disallowedNicknames map[string]bool 33 33 + } 34 34 + 35 35 + func New(cfg *config.Config, database *db.DB, pc posthog.Client, idResolver *idresolver.Resolver, pages *pages.Pages, l *slog.Logger) *Signup { 36 36 + var cf *dns.Cloudflare 37 37 + if cfg.Cloudflare.ApiToken != "" && cfg.Cloudflare.ZoneId != "" { 38 38 + var err error 39 39 + cf, err = dns.NewCloudflare(cfg) 40 40 + if err != nil { 41 41 + l.Warn("failed to create cloudflare client, signup will be disabled", "error", err) 42 42 + } 43 43 + } 44 44 + 45 45 + disallowedNicknames := loadDisallowedNicknames(cfg.Core.DisallowedNicknamesFile, l) 46 46 + 47 47 + return &Signup{ 48 48 + config: cfg, 49 49 + db: database, 50 50 + posthog: pc, 51 51 + idResolver: idResolver, 52 52 + cf: cf, 53 53 + pages: pages, 54 54 + l: l, 55 55 + disallowedNicknames: disallowedNicknames, 56 56 + } 57 57 + } 58 58 + 59 59 + func loadDisallowedNicknames(filepath string, logger *slog.Logger) map[string]bool { 60 60 + disallowed := make(map[string]bool) 61 61 + 62 62 + if filepath == "" { 63 63 + logger.Debug("no disallowed nicknames file configured") 64 64 + return disallowed 65 65 + } 66 66 + 67 67 + file, err := os.Open(filepath) 68 68 + if err != nil { 69 69 + logger.Warn("failed to open disallowed nicknames file", "file", filepath, "error", err) 70 70 + return disallowed 71 71 + } 72 72 + defer file.Close() 73 73 + 74 74 + scanner := bufio.NewScanner(file) 75 75 + lineNum := 0 76 76 + for scanner.Scan() { 77 77 + lineNum++ 78 78 + line := strings.TrimSpace(scanner.Text()) 79 79 + if line == "" || strings.HasPrefix(line, "#") { 80 80 + continue // skip empty lines and comments 81 81 + } 82 82 + 83 83 + nickname := strings.ToLower(line) 84 84 + if userutil.IsValidSubdomain(nickname) { 85 85 + disallowed[nickname] = true 86 86 + } else { 87 87 + logger.Warn("invalid nickname format in disallowed nicknames file", 88 88 + "file", filepath, "line", lineNum, "nickname", nickname) 89 89 + } 90 90 + } 91 91 + 92 92 + if err := scanner.Err(); err != nil { 93 93 + logger.Error("error reading disallowed nicknames file", "file", filepath, "error", err) 94 94 + } 95 95 + 96 96 + logger.Info("loaded disallowed nicknames", "count", len(disallowed), "file", filepath) 97 97 + return disallowed 98 98 + } 99 99 + 100 100 + // isNicknameAllowed checks if a nickname is allowed (not in the disallowed list) 101 101 + func (s *Signup) isNicknameAllowed(nickname string) bool { 102 102 + return !s.disallowedNicknames[strings.ToLower(nickname)] 103 103 + } 104 104 + 105 105 + func (s *Signup) Router() http.Handler { 106 106 + r := chi.NewRouter() 107 107 + r.Get("/", s.signup) 108 108 + r.Post("/", s.signup) 109 109 + r.Get("/complete", s.complete) 110 110 + r.Post("/complete", s.complete) 111 111 + 112 112 + return r 113 113 + } 114 114 + 115 115 + func (s *Signup) signup(w http.ResponseWriter, r *http.Request) { 116 116 + switch r.Method { 117 117 + case http.MethodGet: 118 118 + s.pages.Signup(w) 119 119 + case http.MethodPost: 120 120 + if s.cf == nil { 121 121 + http.Error(w, "signup is disabled", http.StatusFailedDependency) 122 122 + } 123 123 + emailId := r.FormValue("email") 124 124 + 125 125 + noticeId := "signup-msg" 126 126 + if !email.IsValidEmail(emailId) { 127 127 + s.pages.Notice(w, noticeId, "Invalid email address.") 128 128 + return 129 129 + } 130 130 + 131 131 + exists, err := db.CheckEmailExistsAtAll(s.db, emailId) 132 132 + if err != nil { 133 133 + s.l.Error("failed to check email existence", "error", err) 134 134 + s.pages.Notice(w, noticeId, "Failed to complete signup. Try again later.") 135 135 + return 136 136 + } 137 137 + if exists { 138 138 + s.pages.Notice(w, noticeId, "Email already exists.") 139 139 + return 140 140 + } 141 141 + 142 142 + code, err := s.inviteCodeRequest() 143 143 + if err != nil { 144 144 + s.l.Error("failed to create invite code", "error", err) 145 145 + s.pages.Notice(w, noticeId, "Failed to create invite code.") 146 146 + return 147 147 + } 148 148 + 149 149 + em := email.Email{ 150 150 + APIKey: s.config.Resend.ApiKey, 151 151 + From: s.config.Resend.SentFrom, 152 152 + To: emailId, 153 153 + Subject: "Verify your Tangled account", 154 154 + Text: `Copy and paste this code below to verify your account on Tangled. 155 155 + ` + code, 156 156 + Html: `<p>Copy and paste this code below to verify your account on Tangled.</p> 157 157 + <p><code>` + code + `</code></p>`, 158 158 + } 159 159 + 160 160 + err = email.SendEmail(em) 161 161 + if err != nil { 162 162 + s.l.Error("failed to send email", "error", err) 163 163 + s.pages.Notice(w, noticeId, "Failed to send email.") 164 164 + return 165 165 + } 166 166 + err = db.AddInflightSignup(s.db, db.InflightSignup{ 167 167 + Email: emailId, 168 168 + InviteCode: code, 169 169 + }) 170 170 + if err != nil { 171 171 + s.l.Error("failed to add inflight signup", "error", err) 172 172 + s.pages.Notice(w, noticeId, "Failed to complete sign up. Try again later.") 173 173 + return 174 174 + } 175 175 + 176 176 + s.pages.HxRedirect(w, "/signup/complete") 177 177 + } 178 178 + } 179 179 + 180 180 + func (s *Signup) complete(w http.ResponseWriter, r *http.Request) { 181 181 + switch r.Method { 182 182 + case http.MethodGet: 183 183 + s.pages.CompleteSignup(w) 184 184 + case http.MethodPost: 185 185 + username := r.FormValue("username") 186 186 + password := r.FormValue("password") 187 187 + code := r.FormValue("code") 188 188 + 189 189 + if !userutil.IsValidSubdomain(username) { 190 190 + s.pages.Notice(w, "signup-error", "Invalid username. Username must be 4–63 characters, lowercase letters, digits, or hyphens, and can't start or end with a hyphen.") 191 191 + return 192 192 + } 193 193 + 194 194 + if !s.isNicknameAllowed(username) { 195 195 + s.pages.Notice(w, "signup-error", "This username is not available. Please choose a different one.") 196 196 + return 197 197 + } 198 198 + 199 199 + email, err := db.GetEmailForCode(s.db, code) 200 200 + if err != nil { 201 201 + s.l.Error("failed to get email for code", "error", err) 202 202 + s.pages.Notice(w, "signup-error", "Failed to complete sign up. Try again later.") 203 203 + return 204 204 + } 205 205 + 206 206 + did, err := s.createAccountRequest(username, password, email, code) 207 207 + if err != nil { 208 208 + s.l.Error("failed to create account", "error", err) 209 209 + s.pages.Notice(w, "signup-error", err.Error()) 210 210 + return 211 211 + } 212 212 + 213 213 + if s.cf == nil { 214 214 + s.l.Error("cloudflare client is nil", "error", "Cloudflare integration is not enabled in configuration") 215 215 + s.pages.Notice(w, "signup-error", "Account signup is currently disabled. DNS record creation is not available. Please contact support.") 216 216 + return 217 217 + } 218 218 + 219 219 + err = s.cf.CreateDNSRecord(r.Context(), dns.Record{ 220 220 + Type: "TXT", 221 221 + Name: "_atproto." + username, 222 222 + Content: "did=" + did, 223 223 + TTL: 6400, 224 224 + Proxied: false, 225 225 + }) 226 226 + if err != nil { 227 227 + s.l.Error("failed to create DNS record", "error", err) 228 228 + s.pages.Notice(w, "signup-error", "Failed to create DNS record for your handle. Please contact support.") 229 229 + return 230 230 + } 231 231 + 232 232 + err = db.AddEmail(s.db, db.Email{ 233 233 + Did: did, 234 234 + Address: email, 235 235 + Verified: true, 236 236 + Primary: true, 237 237 + }) 238 238 + if err != nil { 239 239 + s.l.Error("failed to add email", "error", err) 240 240 + s.pages.Notice(w, "signup-error", "Failed to complete sign up. Try again later.") 241 241 + return 242 242 + } 243 243 + 244 244 + s.pages.Notice(w, "signup-msg", fmt.Sprintf(`Account created successfully. You can now 245 245 + <a class="underline text-black dark:text-white" href="/login">login</a> 246 246 + with <code>%s.tngl.sh</code>.`, username)) 247 247 + 248 248 + go func() { 249 249 + err := db.DeleteInflightSignup(s.db, email) 250 250 + if err != nil { 251 251 + s.l.Error("failed to delete inflight signup", "error", err) 252 252 + } 253 253 + }() 254 254 + return 255 255 + } 256 256 + }

+12

appview/spindles/spindles.go

··· 303 303 s.Enforcer.E.LoadPolicy() 304 304 }() 305 305 306 306 + // remove spindle members first 307 307 + err = db.RemoveSpindleMember( 308 308 + tx, 309 309 + db.FilterEq("did", user.Did), 310 310 + db.FilterEq("instance", instance), 311 311 + ) 312 312 + if err != nil { 313 313 + l.Error("failed to remove spindle members", "err", err) 314 314 + fail() 315 315 + return 316 316 + } 317 317 + 306 318 err = db.DeleteSpindle( 307 319 tx, 308 320 db.FilterEq("owner", user.Did),

-16

appview/state/profile.go

··· 1 1 package state 2 2 3 3 import ( 4 4 - "crypto/hmac" 5 5 - "crypto/sha256" 6 6 - "encoding/hex" 7 4 "fmt" 8 5 "log" 9 6 "net/http" ··· 142 139 log.Println("failed to get punchcard for did", "did", ident.DID.String(), "err", err) 143 140 } 144 141 145 145 - profileAvatarUri := s.GetAvatarUri(ident.Handle.String()) 146 142 s.pages.ProfilePage(w, pages.ProfilePageParams{ 147 143 LoggedInUser: loggedInUser, 148 144 Repos: pinnedRepos, ··· 151 147 Card: pages.ProfileCard{ 152 148 UserDid: ident.DID.String(), 153 149 UserHandle: ident.Handle.String(), 154 154 - AvatarUri: profileAvatarUri, 155 150 Profile: profile, 156 151 FollowStatus: followStatus, 157 152 Followers: followers, ··· 194 189 log.Printf("getting follow stats repos for %s: %s", ident.DID.String(), err) 195 190 } 196 191 197 197 - profileAvatarUri := s.GetAvatarUri(ident.Handle.String()) 198 198 - 199 192 s.pages.ReposPage(w, pages.ReposPageParams{ 200 193 LoggedInUser: loggedInUser, 201 194 Repos: repos, ··· 203 196 Card: pages.ProfileCard{ 204 197 UserDid: ident.DID.String(), 205 198 UserHandle: ident.Handle.String(), 206 206 - AvatarUri: profileAvatarUri, 207 199 Profile: profile, 208 200 FollowStatus: followStatus, 209 201 Followers: followers, 210 202 Following: following, 211 203 }, 212 204 }) 213 213 - } 214 214 - 215 215 - func (s *State) GetAvatarUri(handle string) string { 216 216 - secret := s.config.Avatar.SharedSecret 217 217 - h := hmac.New(sha256.New, []byte(secret)) 218 218 - h.Write([]byte(handle)) 219 219 - signature := hex.EncodeToString(h.Sum(nil)) 220 220 - return fmt.Sprintf("%s/%s/%s", s.config.Avatar.Host, signature, handle) 221 205 } 222 206 223 207 func (s *State) UpdateProfileBio(w http.ResponseWriter, r *http.Request) {

+32 -4

appview/state/router.go

··· 14 14 "tangled.sh/tangled.sh/core/appview/pulls" 15 15 "tangled.sh/tangled.sh/core/appview/repo" 16 16 "tangled.sh/tangled.sh/core/appview/settings" 17 17 + "tangled.sh/tangled.sh/core/appview/signup" 17 18 "tangled.sh/tangled.sh/core/appview/spindles" 18 19 "tangled.sh/tangled.sh/core/appview/state/userutil" 20 20 + avstrings "tangled.sh/tangled.sh/core/appview/strings" 19 21 "tangled.sh/tangled.sh/core/log" 20 22 ) 21 23 ··· 65 67 66 68 func (s *State) UserRouter(mw *middleware.Middleware) http.Handler { 67 69 r := chi.NewRouter() 68 68 - 69 69 - // strip @ from user 70 70 - r.Use(middleware.StripLeadingAt) 71 70 72 71 r.With(mw.ResolveIdent()).Route("/{user}", func(r chi.Router) { 73 72 r.Get("/", s.Profile) ··· 135 134 }) 136 135 137 136 r.Mount("/settings", s.SettingsRouter()) 137 137 + r.Mount("/strings", s.StringsRouter(mw)) 138 138 r.Mount("/knots", s.KnotsRouter(mw)) 139 139 r.Mount("/spindles", s.SpindlesRouter()) 140 140 + r.Mount("/signup", s.SignupRouter()) 140 141 r.Mount("/", s.OAuthRouter()) 141 142 142 143 r.Get("/keys/{user}", s.Keys) 144 144 + r.Get("/terms", s.TermsOfService) 145 145 + r.Get("/privacy", s.PrivacyPolicy) 143 146 144 147 r.NotFound(func(w http.ResponseWriter, r *http.Request) { 145 148 s.pages.Error404(w) ··· 197 200 return knots.Router(mw) 198 201 } 199 202 203 203 + func (s *State) StringsRouter(mw *middleware.Middleware) http.Handler { 204 204 + logger := log.New("strings") 205 205 + 206 206 + strs := &avstrings.Strings{ 207 207 + Db: s.db, 208 208 + OAuth: s.oauth, 209 209 + Pages: s.pages, 210 210 + Config: s.config, 211 211 + Enforcer: s.enforcer, 212 212 + IdResolver: s.idResolver, 213 213 + Knotstream: s.knotstream, 214 214 + Logger: logger, 215 215 + } 216 216 + 217 217 + return strs.Router(mw) 218 218 + } 219 219 + 200 220 func (s *State) IssuesRouter(mw *middleware.Middleware) http.Handler { 201 221 issues := issues.New(s.oauth, s.repoResolver, s.pages, s.idResolver, s.db, s.config, s.notifier) 202 222 return issues.Router(mw) ··· 208 228 } 209 229 210 230 func (s *State) RepoRouter(mw *middleware.Middleware) http.Handler { 211 211 - repo := repo.New(s.oauth, s.repoResolver, s.pages, s.spindlestream, s.idResolver, s.db, s.config, s.notifier, s.enforcer) 231 231 + logger := log.New("repo") 232 232 + repo := repo.New(s.oauth, s.repoResolver, s.pages, s.spindlestream, s.idResolver, s.db, s.config, s.notifier, s.enforcer, logger) 212 233 return repo.Router(mw) 213 234 } 214 235 ··· 216 237 pipes := pipelines.New(s.oauth, s.repoResolver, s.pages, s.spindlestream, s.idResolver, s.db, s.config, s.enforcer) 217 238 return pipes.Router(mw) 218 239 } 240 240 + 241 241 + func (s *State) SignupRouter() http.Handler { 242 242 + logger := log.New("signup") 243 243 + 244 244 + sig := signup.New(s.config, s.db, s.posthog, s.idResolver, s.pages, logger) 245 245 + return sig.Router() 246 246 + }

+17 -2

appview/state/state.go

··· 23 23 "tangled.sh/tangled.sh/core/appview/notify" 24 24 "tangled.sh/tangled.sh/core/appview/oauth" 25 25 "tangled.sh/tangled.sh/core/appview/pages" 26 26 - posthog_service "tangled.sh/tangled.sh/core/appview/posthog" 26 26 + posthogService "tangled.sh/tangled.sh/core/appview/posthog" 27 27 "tangled.sh/tangled.sh/core/appview/reporesolver" 28 28 "tangled.sh/tangled.sh/core/eventconsumer" 29 29 "tangled.sh/tangled.sh/core/idresolver" ··· 93 93 tangled.ActorProfileNSID, 94 94 tangled.SpindleMemberNSID, 95 95 tangled.SpindleNSID, 96 96 + tangled.StringNSID, 96 97 }, 97 98 nil, 98 99 slog.Default(), ··· 133 134 134 135 var notifiers []notify.Notifier 135 136 if !config.Core.Dev { 136 136 - notifiers = append(notifiers, posthog_service.NewPosthogNotifier(posthog)) 137 137 + notifiers = append(notifiers, posthogService.NewPosthogNotifier(posthog)) 137 138 } 138 139 notifier := notify.NewMergedNotifier(notifiers...) 139 140 ··· 154 155 } 155 156 156 157 return state, nil 158 158 + } 159 159 + 160 160 + func (s *State) TermsOfService(w http.ResponseWriter, r *http.Request) { 161 161 + user := s.oauth.GetUser(r) 162 162 + s.pages.TermsOfService(w, pages.TermsOfServiceParams{ 163 163 + LoggedInUser: user, 164 164 + }) 165 165 + } 166 166 + 167 167 + func (s *State) PrivacyPolicy(w http.ResponseWriter, r *http.Request) { 168 168 + user := s.oauth.GetUser(r) 169 169 + s.pages.PrivacyPolicy(w, pages.PrivacyPolicyParams{ 170 170 + LoggedInUser: user, 171 171 + }) 157 172 } 158 173 159 174 func (s *State) Timeline(w http.ResponseWriter, r *http.Request) {

+6

appview/state/userutil/userutil.go

··· 51 51 func IsDid(s string) bool { 52 52 return didRegex.MatchString(s) 53 53 } 54 54 + 55 55 + var subdomainRegex = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{2,61}[a-z0-9])?$`) 56 56 + 57 57 + func IsValidSubdomain(name string) bool { 58 58 + return len(name) >= 4 && len(name) <= 63 && subdomainRegex.MatchString(name) 59 59 + }

+449

appview/strings/strings.go

··· 1 1 + package strings 2 2 + 3 3 + import ( 4 4 + "fmt" 5 5 + "log/slog" 6 6 + "net/http" 7 7 + "path" 8 8 + "slices" 9 9 + "strconv" 10 10 + "strings" 11 11 + "time" 12 12 + 13 13 + "tangled.sh/tangled.sh/core/api/tangled" 14 14 + "tangled.sh/tangled.sh/core/appview/config" 15 15 + "tangled.sh/tangled.sh/core/appview/db" 16 16 + "tangled.sh/tangled.sh/core/appview/middleware" 17 17 + "tangled.sh/tangled.sh/core/appview/oauth" 18 18 + "tangled.sh/tangled.sh/core/appview/pages" 19 19 + "tangled.sh/tangled.sh/core/appview/pages/markup" 20 20 + "tangled.sh/tangled.sh/core/eventconsumer" 21 21 + "tangled.sh/tangled.sh/core/idresolver" 22 22 + "tangled.sh/tangled.sh/core/rbac" 23 23 + "tangled.sh/tangled.sh/core/tid" 24 24 + 25 25 + "github.com/bluesky-social/indigo/api/atproto" 26 26 + "github.com/bluesky-social/indigo/atproto/identity" 27 27 + "github.com/bluesky-social/indigo/atproto/syntax" 28 28 + lexutil "github.com/bluesky-social/indigo/lex/util" 29 29 + "github.com/go-chi/chi/v5" 30 30 + ) 31 31 + 32 32 + type Strings struct { 33 33 + Db *db.DB 34 34 + OAuth *oauth.OAuth 35 35 + Pages *pages.Pages 36 36 + Config *config.Config 37 37 + Enforcer *rbac.Enforcer 38 38 + IdResolver *idresolver.Resolver 39 39 + Logger *slog.Logger 40 40 + Knotstream *eventconsumer.Consumer 41 41 + } 42 42 + 43 43 + func (s *Strings) Router(mw *middleware.Middleware) http.Handler { 44 44 + r := chi.NewRouter() 45 45 + 46 46 + r. 47 47 + With(mw.ResolveIdent()). 48 48 + Route("/{user}", func(r chi.Router) { 49 49 + r.Get("/", s.dashboard) 50 50 + 51 51 + r.Route("/{rkey}", func(r chi.Router) { 52 52 + r.Get("/", s.contents) 53 53 + r.Delete("/", s.delete) 54 54 + r.Get("/raw", s.contents) 55 55 + r.Get("/edit", s.edit) 56 56 + r.Post("/edit", s.edit) 57 57 + r. 58 58 + With(middleware.AuthMiddleware(s.OAuth)). 59 59 + Post("/comment", s.comment) 60 60 + }) 61 61 + }) 62 62 + 63 63 + r. 64 64 + With(middleware.AuthMiddleware(s.OAuth)). 65 65 + Route("/new", func(r chi.Router) { 66 66 + r.Get("/", s.create) 67 67 + r.Post("/", s.create) 68 68 + }) 69 69 + 70 70 + return r 71 71 + } 72 72 + 73 73 + func (s *Strings) contents(w http.ResponseWriter, r *http.Request) { 74 74 + l := s.Logger.With("handler", "contents") 75 75 + 76 76 + id, ok := r.Context().Value("resolvedId").(identity.Identity) 77 77 + if !ok { 78 78 + l.Error("malformed middleware") 79 79 + w.WriteHeader(http.StatusInternalServerError) 80 80 + return 81 81 + } 82 82 + l = l.With("did", id.DID, "handle", id.Handle) 83 83 + 84 84 + rkey := chi.URLParam(r, "rkey") 85 85 + if rkey == "" { 86 86 + l.Error("malformed url, empty rkey") 87 87 + w.WriteHeader(http.StatusBadRequest) 88 88 + return 89 89 + } 90 90 + l = l.With("rkey", rkey) 91 91 + 92 92 + strings, err := db.GetStrings( 93 93 + s.Db, 94 94 + db.FilterEq("did", id.DID), 95 95 + db.FilterEq("rkey", rkey), 96 96 + ) 97 97 + if err != nil { 98 98 + l.Error("failed to fetch string", "err", err) 99 99 + w.WriteHeader(http.StatusInternalServerError) 100 100 + return 101 101 + } 102 102 + if len(strings) != 1 { 103 103 + l.Error("incorrect number of records returned", "len(strings)", len(strings)) 104 104 + w.WriteHeader(http.StatusInternalServerError) 105 105 + return 106 106 + } 107 107 + string := strings[0] 108 108 + 109 109 + if path.Base(r.URL.Path) == "raw" { 110 110 + w.Header().Set("Content-Type", "text/plain; charset=utf-8") 111 111 + if string.Filename != "" { 112 112 + w.Header().Set("Content-Disposition", fmt.Sprintf("inline; filename=%q", string.Filename)) 113 113 + } 114 114 + w.Header().Set("Content-Length", strconv.Itoa(len(string.Contents))) 115 115 + 116 116 + _, err = w.Write([]byte(string.Contents)) 117 117 + if err != nil { 118 118 + l.Error("failed to write raw response", "err", err) 119 119 + } 120 120 + return 121 121 + } 122 122 + 123 123 + var showRendered, renderToggle bool 124 124 + if markup.GetFormat(string.Filename) == markup.FormatMarkdown { 125 125 + renderToggle = true 126 126 + showRendered = r.URL.Query().Get("code") != "true" 127 127 + } 128 128 + 129 129 + s.Pages.SingleString(w, pages.SingleStringParams{ 130 130 + LoggedInUser: s.OAuth.GetUser(r), 131 131 + RenderToggle: renderToggle, 132 132 + ShowRendered: showRendered, 133 133 + String: string, 134 134 + Stats: string.Stats(), 135 135 + Owner: id, 136 136 + }) 137 137 + } 138 138 + 139 139 + func (s *Strings) dashboard(w http.ResponseWriter, r *http.Request) { 140 140 + l := s.Logger.With("handler", "dashboard") 141 141 + 142 142 + id, ok := r.Context().Value("resolvedId").(identity.Identity) 143 143 + if !ok { 144 144 + l.Error("malformed middleware") 145 145 + w.WriteHeader(http.StatusInternalServerError) 146 146 + return 147 147 + } 148 148 + l = l.With("did", id.DID, "handle", id.Handle) 149 149 + 150 150 + all, err := db.GetStrings( 151 151 + s.Db, 152 152 + db.FilterEq("did", id.DID), 153 153 + ) 154 154 + if err != nil { 155 155 + l.Error("failed to fetch strings", "err", err) 156 156 + w.WriteHeader(http.StatusInternalServerError) 157 157 + return 158 158 + } 159 159 + 160 160 + slices.SortFunc(all, func(a, b db.String) int { 161 161 + if a.Created.After(b.Created) { 162 162 + return -1 163 163 + } else { 164 164 + return 1 165 165 + } 166 166 + }) 167 167 + 168 168 + profile, err := db.GetProfile(s.Db, id.DID.String()) 169 169 + if err != nil { 170 170 + l.Error("failed to fetch user profile", "err", err) 171 171 + w.WriteHeader(http.StatusInternalServerError) 172 172 + return 173 173 + } 174 174 + loggedInUser := s.OAuth.GetUser(r) 175 175 + followStatus := db.IsNotFollowing 176 176 + if loggedInUser != nil { 177 177 + followStatus = db.GetFollowStatus(s.Db, loggedInUser.Did, id.DID.String()) 178 178 + } 179 179 + 180 180 + followers, following, err := db.GetFollowerFollowing(s.Db, id.DID.String()) 181 181 + if err != nil { 182 182 + l.Error("failed to get follow stats", "err", err) 183 183 + } 184 184 + 185 185 + s.Pages.StringsDashboard(w, pages.StringsDashboardParams{ 186 186 + LoggedInUser: s.OAuth.GetUser(r), 187 187 + Card: pages.ProfileCard{ 188 188 + UserDid: id.DID.String(), 189 189 + UserHandle: id.Handle.String(), 190 190 + Profile: profile, 191 191 + FollowStatus: followStatus, 192 192 + Followers: followers, 193 193 + Following: following, 194 194 + }, 195 195 + Strings: all, 196 196 + }) 197 197 + } 198 198 + 199 199 + func (s *Strings) edit(w http.ResponseWriter, r *http.Request) { 200 200 + l := s.Logger.With("handler", "edit") 201 201 + 202 202 + user := s.OAuth.GetUser(r) 203 203 + 204 204 + id, ok := r.Context().Value("resolvedId").(identity.Identity) 205 205 + if !ok { 206 206 + l.Error("malformed middleware") 207 207 + w.WriteHeader(http.StatusInternalServerError) 208 208 + return 209 209 + } 210 210 + l = l.With("did", id.DID, "handle", id.Handle) 211 211 + 212 212 + rkey := chi.URLParam(r, "rkey") 213 213 + if rkey == "" { 214 214 + l.Error("malformed url, empty rkey") 215 215 + w.WriteHeader(http.StatusBadRequest) 216 216 + return 217 217 + } 218 218 + l = l.With("rkey", rkey) 219 219 + 220 220 + // get the string currently being edited 221 221 + all, err := db.GetStrings( 222 222 + s.Db, 223 223 + db.FilterEq("did", id.DID), 224 224 + db.FilterEq("rkey", rkey), 225 225 + ) 226 226 + if err != nil { 227 227 + l.Error("failed to fetch string", "err", err) 228 228 + w.WriteHeader(http.StatusInternalServerError) 229 229 + return 230 230 + } 231 231 + if len(all) != 1 { 232 232 + l.Error("incorrect number of records returned", "len(strings)", len(all)) 233 233 + w.WriteHeader(http.StatusInternalServerError) 234 234 + return 235 235 + } 236 236 + first := all[0] 237 237 + 238 238 + // verify that the logged in user owns this string 239 239 + if user.Did != id.DID.String() { 240 240 + l.Error("unauthorized request", "expected", id.DID, "got", user.Did) 241 241 + w.WriteHeader(http.StatusUnauthorized) 242 242 + return 243 243 + } 244 244 + 245 245 + switch r.Method { 246 246 + case http.MethodGet: 247 247 + // return the form with prefilled fields 248 248 + s.Pages.PutString(w, pages.PutStringParams{ 249 249 + LoggedInUser: s.OAuth.GetUser(r), 250 250 + Action: "edit", 251 251 + String: first, 252 252 + }) 253 253 + case http.MethodPost: 254 254 + fail := func(msg string, err error) { 255 255 + l.Error(msg, "err", err) 256 256 + s.Pages.Notice(w, "error", msg) 257 257 + } 258 258 + 259 259 + filename := r.FormValue("filename") 260 260 + if filename == "" { 261 261 + fail("Empty filename.", nil) 262 262 + return 263 263 + } 264 264 + if !strings.Contains(filename, ".") { 265 265 + // TODO: make this a htmx form validation 266 266 + fail("No extension provided for filename.", nil) 267 267 + return 268 268 + } 269 269 + 270 270 + content := r.FormValue("content") 271 271 + if content == "" { 272 272 + fail("Empty contents.", nil) 273 273 + return 274 274 + } 275 275 + 276 276 + description := r.FormValue("description") 277 277 + 278 278 + // construct new string from form values 279 279 + entry := db.String{ 280 280 + Did: first.Did, 281 281 + Rkey: first.Rkey, 282 282 + Filename: filename, 283 283 + Description: description, 284 284 + Contents: content, 285 285 + Created: first.Created, 286 286 + } 287 287 + 288 288 + record := entry.AsRecord() 289 289 + 290 290 + client, err := s.OAuth.AuthorizedClient(r) 291 291 + if err != nil { 292 292 + fail("Failed to create record.", err) 293 293 + return 294 294 + } 295 295 + 296 296 + // first replace the existing record in the PDS 297 297 + ex, err := client.RepoGetRecord(r.Context(), "", tangled.StringNSID, entry.Did.String(), entry.Rkey) 298 298 + if err != nil { 299 299 + fail("Failed to updated existing record.", err) 300 300 + return 301 301 + } 302 302 + resp, err := client.RepoPutRecord(r.Context(), &atproto.RepoPutRecord_Input{ 303 303 + Collection: tangled.StringNSID, 304 304 + Repo: entry.Did.String(), 305 305 + Rkey: entry.Rkey, 306 306 + SwapRecord: ex.Cid, 307 307 + Record: &lexutil.LexiconTypeDecoder{ 308 308 + Val: &record, 309 309 + }, 310 310 + }) 311 311 + if err != nil { 312 312 + fail("Failed to updated existing record.", err) 313 313 + return 314 314 + } 315 315 + l := l.With("aturi", resp.Uri) 316 316 + l.Info("edited string") 317 317 + 318 318 + // if that went okay, updated the db 319 319 + if err = db.AddString(s.Db, entry); err != nil { 320 320 + fail("Failed to update string.", err) 321 321 + return 322 322 + } 323 323 + 324 324 + // if that went okay, redir to the string 325 325 + s.Pages.HxRedirect(w, "/strings/"+user.Handle+"/"+entry.Rkey) 326 326 + } 327 327 + 328 328 + } 329 329 + 330 330 + func (s *Strings) create(w http.ResponseWriter, r *http.Request) { 331 331 + l := s.Logger.With("handler", "create") 332 332 + user := s.OAuth.GetUser(r) 333 333 + 334 334 + switch r.Method { 335 335 + case http.MethodGet: 336 336 + s.Pages.PutString(w, pages.PutStringParams{ 337 337 + LoggedInUser: s.OAuth.GetUser(r), 338 338 + Action: "new", 339 339 + }) 340 340 + case http.MethodPost: 341 341 + fail := func(msg string, err error) { 342 342 + l.Error(msg, "err", err) 343 343 + s.Pages.Notice(w, "error", msg) 344 344 + } 345 345 + 346 346 + filename := r.FormValue("filename") 347 347 + if filename == "" { 348 348 + fail("Empty filename.", nil) 349 349 + return 350 350 + } 351 351 + if !strings.Contains(filename, ".") { 352 352 + // TODO: make this a htmx form validation 353 353 + fail("No extension provided for filename.", nil) 354 354 + return 355 355 + } 356 356 + 357 357 + content := r.FormValue("content") 358 358 + if content == "" { 359 359 + fail("Empty contents.", nil) 360 360 + return 361 361 + } 362 362 + 363 363 + description := r.FormValue("description") 364 364 + 365 365 + string := db.String{ 366 366 + Did: syntax.DID(user.Did), 367 367 + Rkey: tid.TID(), 368 368 + Filename: filename, 369 369 + Description: description, 370 370 + Contents: content, 371 371 + Created: time.Now(), 372 372 + } 373 373 + 374 374 + record := string.AsRecord() 375 375 + 376 376 + client, err := s.OAuth.AuthorizedClient(r) 377 377 + if err != nil { 378 378 + fail("Failed to create record.", err) 379 379 + return 380 380 + } 381 381 + 382 382 + resp, err := client.RepoPutRecord(r.Context(), &atproto.RepoPutRecord_Input{ 383 383 + Collection: tangled.StringNSID, 384 384 + Repo: user.Did, 385 385 + Rkey: string.Rkey, 386 386 + Record: &lexutil.LexiconTypeDecoder{ 387 387 + Val: &record, 388 388 + }, 389 389 + }) 390 390 + if err != nil { 391 391 + fail("Failed to create record.", err) 392 392 + return 393 393 + } 394 394 + l := l.With("aturi", resp.Uri) 395 395 + l.Info("created record") 396 396 + 397 397 + // insert into DB 398 398 + if err = db.AddString(s.Db, string); err != nil { 399 399 + fail("Failed to create string.", err) 400 400 + return 401 401 + } 402 402 + 403 403 + // successful 404 404 + s.Pages.HxRedirect(w, "/strings/"+user.Handle+"/"+string.Rkey) 405 405 + } 406 406 + } 407 407 + 408 408 + func (s *Strings) delete(w http.ResponseWriter, r *http.Request) { 409 409 + l := s.Logger.With("handler", "create") 410 410 + user := s.OAuth.GetUser(r) 411 411 + fail := func(msg string, err error) { 412 412 + l.Error(msg, "err", err) 413 413 + s.Pages.Notice(w, "error", msg) 414 414 + } 415 415 + 416 416 + id, ok := r.Context().Value("resolvedId").(identity.Identity) 417 417 + if !ok { 418 418 + l.Error("malformed middleware") 419 419 + w.WriteHeader(http.StatusInternalServerError) 420 420 + return 421 421 + } 422 422 + l = l.With("did", id.DID, "handle", id.Handle) 423 423 + 424 424 + rkey := chi.URLParam(r, "rkey") 425 425 + if rkey == "" { 426 426 + l.Error("malformed url, empty rkey") 427 427 + w.WriteHeader(http.StatusBadRequest) 428 428 + return 429 429 + } 430 430 + 431 431 + if user.Did != id.DID.String() { 432 432 + fail("You cannot delete this gist", fmt.Errorf("unauthorized deletion, %s != %s", user.Did, id.DID.String())) 433 433 + return 434 434 + } 435 435 + 436 436 + if err := db.DeleteString( 437 437 + s.Db, 438 438 + db.FilterEq("did", user.Did), 439 439 + db.FilterEq("rkey", rkey), 440 440 + ); err != nil { 441 441 + fail("Failed to delete string.", err) 442 442 + return 443 443 + } 444 444 + 445 445 + s.Pages.HxRedirect(w, "/strings/"+user.Handle) 446 446 + } 447 447 + 448 448 + func (s *Strings) comment(w http.ResponseWriter, r *http.Request) { 449 449 + }

+2

cmd/gen.go

··· 40 40 tangled.PublicKey{}, 41 41 tangled.Repo{}, 42 42 tangled.RepoArtifact{}, 43 43 + tangled.RepoCollaborator{}, 43 44 tangled.RepoIssue{}, 44 45 tangled.RepoIssueComment{}, 45 46 tangled.RepoIssueState{}, ··· 49 50 tangled.RepoPullStatus{}, 50 51 tangled.Spindle{}, 51 52 tangled.SpindleMember{}, 53 53 + tangled.String{}, 52 54 ); err != nil { 53 55 panic(err) 54 56 }

+12

docs/knot-hosting.md

··· 191 191 ``` 192 192 193 193 Make sure to restart your SSH server! 194 194 + 195 195 + #### MOTD (message of the day) 196 196 + 197 197 + To configure the MOTD used ("Welcome to this knot!" by default), edit the 198 198 + `/home/git/motd` file: 199 199 + 200 200 + ``` 201 201 + printf "Hi from this knot!\n" > /home/git/motd 202 202 + ``` 203 203 + 204 204 + Note that you should add a newline at the end if setting a non-empty message 205 205 + since the knot won't do this for you.

+285

docs/spindle/openbao.md

··· 1 1 + # spindle secrets with openbao 2 2 + 3 3 + This document covers setting up Spindle to use OpenBao for secrets 4 4 + management via OpenBao Proxy instead of the default SQLite backend. 5 5 + 6 6 + ## overview 7 7 + 8 8 + Spindle now uses OpenBao Proxy for secrets management. The proxy handles 9 9 + authentication automatically using AppRole credentials, while Spindle 10 10 + connects to the local proxy instead of directly to the OpenBao server. 11 11 + 12 12 + This approach provides better security, automatic token renewal, and 13 13 + simplified application code. 14 14 + 15 15 + ## installation 16 16 + 17 17 + Install OpenBao from nixpkgs: 18 18 + 19 19 + ```bash 20 20 + nix shell nixpkgs#openbao # for a local server 21 21 + ``` 22 22 + 23 23 + ## setup 24 24 + 25 25 + The setup process can is documented for both local development and production. 26 26 + 27 27 + ### local development 28 28 + 29 29 + Start OpenBao in dev mode: 30 30 + 31 31 + ```bash 32 32 + bao server -dev -dev-root-token-id="root" -dev-listen-address=127.0.0.1:8201 33 33 + ``` 34 34 + 35 35 + This starts OpenBao on `http://localhost:8201` with a root token. 36 36 + 37 37 + Set up environment for bao CLI: 38 38 + 39 39 + ```bash 40 40 + export BAO_ADDR=http://localhost:8200 41 41 + export BAO_TOKEN=root 42 42 + ``` 43 43 + 44 44 + ### production 45 45 + 46 46 + You would typically use a systemd service with a configuration file. Refer to 47 47 + [@tangled.sh/infra](https://tangled.sh/@tangled.sh/infra) for how this can be 48 48 + achieved using Nix. 49 49 + 50 50 + Then, initialize the bao server: 51 51 + ```bash 52 52 + bao operator init -key-shares=1 -key-threshold=1 53 53 + ``` 54 54 + 55 55 + This will print out an unseal key and a root key. Save them somewhere (like a password manager). Then unseal the vault to begin setting it up: 56 56 + ```bash 57 57 + bao operator unseal <unseal_key> 58 58 + ``` 59 59 + 60 60 + All steps below remain the same across both dev and production setups. 61 61 + 62 62 + ### configure openbao server 63 63 + 64 64 + Create the spindle KV mount: 65 65 + 66 66 + ```bash 67 67 + bao secrets enable -path=spindle -version=2 kv 68 68 + ``` 69 69 + 70 70 + Set up AppRole authentication and policy: 71 71 + 72 72 + Create a policy file `spindle-policy.hcl`: 73 73 + 74 74 + ```hcl 75 75 + # Full access to spindle KV v2 data 76 76 + path "spindle/data/*" { 77 77 + capabilities = ["create", "read", "update", "delete"] 78 78 + } 79 79 + 80 80 + # Access to metadata for listing and management 81 81 + path "spindle/metadata/*" { 82 82 + capabilities = ["list", "read", "delete", "update"] 83 83 + } 84 84 + 85 85 + # Allow listing at root level 86 86 + path "spindle/" { 87 87 + capabilities = ["list"] 88 88 + } 89 89 + 90 90 + # Required for connection testing and health checks 91 91 + path "auth/token/lookup-self" { 92 92 + capabilities = ["read"] 93 93 + } 94 94 + ``` 95 95 + 96 96 + Apply the policy and create an AppRole: 97 97 + 98 98 + ```bash 99 99 + bao policy write spindle-policy spindle-policy.hcl 100 100 + bao auth enable approle 101 101 + bao write auth/approle/role/spindle \ 102 102 + token_policies="spindle-policy" \ 103 103 + token_ttl=1h \ 104 104 + token_max_ttl=4h \ 105 105 + bind_secret_id=true \ 106 106 + secret_id_ttl=0 \ 107 107 + secret_id_num_uses=0 108 108 + ``` 109 109 + 110 110 + Get the credentials: 111 111 + 112 112 + ```bash 113 113 + # Get role ID (static) 114 114 + ROLE_ID=$(bao read -field=role_id auth/approle/role/spindle/role-id) 115 115 + 116 116 + # Generate secret ID 117 117 + SECRET_ID=$(bao write -field=secret_id auth/approle/role/spindle/secret-id) 118 118 + 119 119 + echo "Role ID: $ROLE_ID" 120 120 + echo "Secret ID: $SECRET_ID" 121 121 + ``` 122 122 + 123 123 + ### create proxy configuration 124 124 + 125 125 + Create the credential files: 126 126 + 127 127 + ```bash 128 128 + # Create directory for OpenBao files 129 129 + mkdir -p /tmp/openbao 130 130 + 131 131 + # Save credentials 132 132 + echo "$ROLE_ID" > /tmp/openbao/role-id 133 133 + echo "$SECRET_ID" > /tmp/openbao/secret-id 134 134 + chmod 600 /tmp/openbao/role-id /tmp/openbao/secret-id 135 135 + ``` 136 136 + 137 137 + Create a proxy configuration file `/tmp/openbao/proxy.hcl`: 138 138 + 139 139 + ```hcl 140 140 + # OpenBao server connection 141 141 + vault { 142 142 + address = "http://localhost:8200" 143 143 + } 144 144 + 145 145 + # Auto-Auth using AppRole 146 146 + auto_auth { 147 147 + method "approle" { 148 148 + mount_path = "auth/approle" 149 149 + config = { 150 150 + role_id_file_path = "/tmp/openbao/role-id" 151 151 + secret_id_file_path = "/tmp/openbao/secret-id" 152 152 + } 153 153 + } 154 154 + 155 155 + # Optional: write token to file for debugging 156 156 + sink "file" { 157 157 + config = { 158 158 + path = "/tmp/openbao/token" 159 159 + mode = 0640 160 160 + } 161 161 + } 162 162 + } 163 163 + 164 164 + # Proxy listener for Spindle 165 165 + listener "tcp" { 166 166 + address = "127.0.0.1:8201" 167 167 + tls_disable = true 168 168 + } 169 169 + 170 170 + # Enable API proxy with auto-auth token 171 171 + api_proxy { 172 172 + use_auto_auth_token = true 173 173 + } 174 174 + 175 175 + # Enable response caching 176 176 + cache { 177 177 + use_auto_auth_token = true 178 178 + } 179 179 + 180 180 + # Logging 181 181 + log_level = "info" 182 182 + ``` 183 183 + 184 184 + ### start the proxy 185 185 + 186 186 + Start OpenBao Proxy: 187 187 + 188 188 + ```bash 189 189 + bao proxy -config=/tmp/openbao/proxy.hcl 190 190 + ``` 191 191 + 192 192 + The proxy will authenticate with OpenBao and start listening on 193 193 + `127.0.0.1:8201`. 194 194 + 195 195 + ### configure spindle 196 196 + 197 197 + Set these environment variables for Spindle: 198 198 + 199 199 + ```bash 200 200 + export SPINDLE_SERVER_SECRETS_PROVIDER=openbao 201 201 + export SPINDLE_SERVER_SECRETS_OPENBAO_PROXY_ADDR=http://127.0.0.1:8201 202 202 + export SPINDLE_SERVER_SECRETS_OPENBAO_MOUNT=spindle 203 203 + ``` 204 204 + 205 205 + Start Spindle: 206 206 + 207 207 + Spindle will now connect to the local proxy, which handles all 208 208 + authentication automatically. 209 209 + 210 210 + ## production setup for proxy 211 211 + 212 212 + For production, you'll want to run the proxy as a service: 213 213 + 214 214 + Place your production configuration in `/etc/openbao/proxy.hcl` with 215 215 + proper TLS settings for the vault connection. 216 216 + 217 217 + ## verifying setup 218 218 + 219 219 + Test the proxy directly: 220 220 + 221 221 + ```bash 222 222 + # Check proxy health 223 223 + curl -H "X-Vault-Request: true" http://127.0.0.1:8201/v1/sys/health 224 224 + 225 225 + # Test token lookup through proxy 226 226 + curl -H "X-Vault-Request: true" http://127.0.0.1:8201/v1/auth/token/lookup-self 227 227 + ``` 228 228 + 229 229 + Test OpenBao operations through the server: 230 230 + 231 231 + ```bash 232 232 + # List all secrets 233 233 + bao kv list spindle/ 234 234 + 235 235 + # Add a test secret via Spindle API, then check it exists 236 236 + bao kv list spindle/repos/ 237 237 + 238 238 + # Get a specific secret 239 239 + bao kv get spindle/repos/your_repo_path/SECRET_NAME 240 240 + ``` 241 241 + 242 242 + ## how it works 243 243 + 244 244 + - Spindle connects to OpenBao Proxy on localhost (typically port 8200 or 8201) 245 245 + - The proxy authenticates with OpenBao using AppRole credentials 246 246 + - All Spindle requests go through the proxy, which injects authentication tokens 247 247 + - Secrets are stored at `spindle/repos/{sanitized_repo_path}/{secret_key}` 248 248 + - Repository paths like `did:plc:alice/myrepo` become `did_plc_alice_myrepo` 249 249 + - The proxy handles all token renewal automatically 250 250 + - Spindle no longer manages tokens or authentication directly 251 251 + 252 252 + ## troubleshooting 253 253 + 254 254 + **Connection refused**: Check that the OpenBao Proxy is running and 255 255 + listening on the configured address. 256 256 + 257 257 + **403 errors**: Verify the AppRole credentials are correct and the policy 258 258 + has the necessary permissions. 259 259 + 260 260 + **404 route errors**: The spindle KV mount probably doesn't exist - run 261 261 + the mount creation step again. 262 262 + 263 263 + **Proxy authentication failures**: Check the proxy logs and verify the 264 264 + role-id and secret-id files are readable and contain valid credentials. 265 265 + 266 266 + **Secret not found after writing**: This can indicate policy permission 267 267 + issues. Verify the policy includes both `spindle/data/*` and 268 268 + `spindle/metadata/*` paths with appropriate capabilities. 269 269 + 270 270 + Check proxy logs: 271 271 + 272 272 + ```bash 273 273 + # If running as systemd service 274 274 + journalctl -u openbao-proxy -f 275 275 + 276 276 + # If running directly, check the console output 277 277 + ``` 278 278 + 279 279 + Test AppRole authentication manually: 280 280 + 281 281 + ```bash 282 282 + bao write auth/approle/login \ 283 283 + role_id="$(cat /tmp/openbao/role-id)" \ 284 284 + secret_id="$(cat /tmp/openbao/secret-id)" 285 285 + ```

+22 -22

flake.lock

··· 1 1 { 2 2 "nodes": { 3 3 + "flake-utils": { 4 4 + "inputs": { 5 5 + "systems": "systems" 6 6 + }, 7 7 + "locked": { 8 8 + "lastModified": 1694529238, 9 9 + "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", 10 10 + "owner": "numtide", 11 11 + "repo": "flake-utils", 12 12 + "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", 13 13 + "type": "github" 14 14 + }, 15 15 + "original": { 16 16 + "owner": "numtide", 17 17 + "repo": "flake-utils", 18 18 + "type": "github" 19 19 + } 20 20 + }, 3 21 "gitignore": { 4 22 "inputs": { 5 23 "nixpkgs": [ ··· 17 35 "original": { 18 36 "owner": "hercules-ci", 19 37 "repo": "gitignore.nix", 20 20 - "type": "github" 21 21 - } 22 22 - }, 23 23 - "flake-utils": { 24 24 - "inputs": { 25 25 - "systems": "systems" 26 26 - }, 27 27 - "locked": { 28 28 - "lastModified": 1694529238, 29 29 - "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=", 30 30 - "owner": "numtide", 31 31 - "repo": "flake-utils", 32 32 - "rev": "ff7b65b44d01cf9ba6a71320833626af21126384", 33 33 - "type": "github" 34 34 - }, 35 35 - "original": { 36 36 - "owner": "numtide", 37 37 - "repo": "flake-utils", 38 38 "type": "github" 39 39 } 40 40 }, ··· 128 128 "lucide-src": { 129 129 "flake": false, 130 130 "locked": { 131 131 - "lastModified": 1742302029, 132 132 - "narHash": "sha256-OyPVtpnC4/AAmPq84Wt1r1Gcs48d9KG+UBCtZK87e9k=", 131 131 + "lastModified": 1754044466, 132 132 + "narHash": "sha256-+exBR2OToB1iv7ZQI2S4B0lXA/QRvC9n6U99UxGpJGs=", 133 133 "type": "tarball", 134 134 - "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip" 134 134 + "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip" 135 135 }, 136 136 "original": { 137 137 "type": "tarball", 138 138 - "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip" 138 138 + "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip" 139 139 } 140 140 }, 141 141 "nixpkgs": {

+1 -1

flake.nix

··· 22 22 flake = false; 23 23 }; 24 24 lucide-src = { 25 25 - url = "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"; 25 25 + url = "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip"; 26 26 flake = false; 27 27 }; 28 28 inter-fonts-src = {

+33 -13

go.mod

··· 1 1 module tangled.sh/tangled.sh/core 2 2 3 3 - go 1.24.0 4 4 - 5 5 - toolchain go1.24.3 3 3 + go 1.24.4 6 4 7 5 require ( 8 6 github.com/Blank-Xu/sql-adapter v1.1.1 7 7 + github.com/alecthomas/assert/v2 v2.11.0 9 8 github.com/alecthomas/chroma/v2 v2.15.0 10 9 github.com/avast/retry-go/v4 v4.6.1 11 10 github.com/bluekeyes/go-gitdiff v0.8.1 ··· 13 12 github.com/bluesky-social/jetstream v0.0.0-20241210005130-ea96859b93d1 14 13 github.com/carlmjohnson/versioninfo v0.22.5 15 14 github.com/casbin/casbin/v2 v2.103.0 15 15 + github.com/cloudflare/cloudflare-go v0.115.0 16 16 github.com/cyphar/filepath-securejoin v0.4.1 17 17 github.com/dgraph-io/ristretto v0.2.0 18 18 github.com/docker/docker v28.2.2+incompatible ··· 23 23 github.com/go-git/go-git/v5 v5.14.0 24 24 github.com/google/uuid v1.6.0 25 25 github.com/gorilla/sessions v1.4.0 26 26 - github.com/gorilla/websocket v1.5.3 26 26 + github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 27 27 github.com/hiddeco/sshsig v0.2.0 28 28 github.com/hpcloud/tail v1.0.0 29 29 github.com/ipfs/go-cid v0.5.0 30 30 github.com/lestrrat-go/jwx/v2 v2.1.6 31 31 github.com/mattn/go-sqlite3 v1.14.24 32 32 github.com/microcosm-cc/bluemonday v1.0.27 33 33 + github.com/openbao/openbao/api/v2 v2.3.0 33 34 github.com/posthog/posthog-go v1.5.5 34 34 - github.com/redis/go-redis/v9 v9.3.0 35 35 + github.com/redis/go-redis/v9 v9.7.3 35 36 github.com/resend/resend-go/v2 v2.15.0 36 37 github.com/sethvargo/go-envconfig v1.1.0 37 38 github.com/stretchr/testify v1.10.0 ··· 39 40 github.com/whyrusleeping/cbor-gen v0.3.1 40 41 github.com/yuin/goldmark v1.4.13 41 42 golang.org/x/crypto v0.40.0 42 42 - golang.org/x/net v0.41.0 43 43 + golang.org/x/net v0.42.0 44 44 + golang.org/x/sync v0.16.0 43 45 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da 44 46 gopkg.in/yaml.v3 v3.0.1 45 47 tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250724194903-28e660378cb1 ··· 48 50 require ( 49 51 dario.cat/mergo v1.0.1 // indirect 50 52 github.com/Microsoft/go-winio v0.6.2 // indirect 51 51 - github.com/ProtonMail/go-crypto v1.2.0 // indirect 53 53 + github.com/ProtonMail/go-crypto v1.3.0 // indirect 54 54 + github.com/alecthomas/repr v0.4.0 // indirect 52 55 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be // indirect 53 56 github.com/aymerick/douceur v0.2.0 // indirect 54 57 github.com/beorn7/perks v1.0.1 // indirect 55 58 github.com/bmatcuk/doublestar/v4 v4.7.1 // indirect 56 59 github.com/casbin/govaluate v1.3.0 // indirect 60 60 + github.com/cenkalti/backoff/v4 v4.3.0 // indirect 57 61 github.com/cespare/xxhash/v2 v2.3.0 // indirect 58 58 - github.com/cloudflare/circl v1.6.0 // indirect 62 62 + github.com/cloudflare/circl v1.6.2-0.20250618153321-aa837fd1539d // indirect 59 63 github.com/containerd/errdefs v1.0.0 // indirect 60 64 github.com/containerd/errdefs/pkg v0.3.0 // indirect 61 65 github.com/containerd/log v0.1.0 // indirect ··· 68 72 github.com/docker/go-units v0.5.0 // indirect 69 73 github.com/emirpasic/gods v1.18.1 // indirect 70 74 github.com/felixge/httpsnoop v1.0.4 // indirect 75 75 + github.com/fsnotify/fsnotify v1.6.0 // indirect 71 76 github.com/go-enry/go-oniguruma v1.2.1 // indirect 72 77 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect 73 78 github.com/go-git/go-billy/v5 v5.6.2 // indirect 79 79 + github.com/go-jose/go-jose/v3 v3.0.4 // indirect 74 80 github.com/go-logr/logr v1.4.3 // indirect 75 81 github.com/go-logr/stdr v1.2.2 // indirect 76 82 github.com/go-redis/cache/v9 v9.0.0 // indirect 83 83 + github.com/go-test/deep v1.1.1 // indirect 77 84 github.com/goccy/go-json v0.10.5 // indirect 78 85 github.com/gogo/protobuf v1.3.2 // indirect 79 86 github.com/golang-jwt/jwt/v5 v5.2.3 // indirect 80 87 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect 88 88 + github.com/golang/mock v1.6.0 // indirect 89 89 + github.com/google/go-querystring v1.1.0 // indirect 81 90 github.com/gorilla/css v1.0.1 // indirect 82 91 github.com/gorilla/securecookie v1.1.2 // indirect 92 92 + github.com/hashicorp/errwrap v1.1.0 // indirect 83 93 github.com/hashicorp/go-cleanhttp v0.5.2 // indirect 94 94 + github.com/hashicorp/go-multierror v1.1.1 // indirect 84 95 github.com/hashicorp/go-retryablehttp v0.7.8 // indirect 96 96 + github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect 97 97 + github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect 98 98 + github.com/hashicorp/go-sockaddr v1.0.7 // indirect 85 99 github.com/hashicorp/golang-lru v1.0.2 // indirect 86 100 github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect 101 101 + github.com/hashicorp/hcl v1.0.1-vault-7 // indirect 102 102 + github.com/hexops/gotextdiff v1.0.3 // indirect 87 103 github.com/ipfs/bbloom v0.0.4 // indirect 88 104 github.com/ipfs/boxo v0.33.0 // indirect 89 105 github.com/ipfs/go-block-format v0.2.2 // indirect ··· 105 121 github.com/lestrrat-go/option v1.0.1 // indirect 106 122 github.com/mattn/go-isatty v0.0.20 // indirect 107 123 github.com/minio/sha256-simd v1.0.1 // indirect 124 124 + github.com/mitchellh/mapstructure v1.5.0 // indirect 108 125 github.com/moby/docker-image-spec v1.3.1 // indirect 109 126 github.com/moby/sys/atomicwriter v0.1.0 // indirect 110 127 github.com/moby/term v0.5.2 // indirect ··· 116 133 github.com/multiformats/go-multihash v0.2.3 // indirect 117 134 github.com/multiformats/go-varint v0.0.7 // indirect 118 135 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect 136 136 + github.com/onsi/gomega v1.37.0 // indirect 119 137 github.com/opencontainers/go-digest v1.0.0 // indirect 120 138 github.com/opencontainers/image-spec v1.1.1 // indirect 121 121 - github.com/opentracing/opentracing-go v1.2.0 // indirect 139 139 + github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b // indirect 122 140 github.com/pjbgf/sha1cd v0.3.2 // indirect 123 141 github.com/pkg/errors v0.9.1 // indirect 124 142 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect ··· 127 145 github.com/prometheus/client_model v0.6.2 // indirect 128 146 github.com/prometheus/common v0.64.0 // indirect 129 147 github.com/prometheus/procfs v0.16.1 // indirect 148 148 + github.com/ryanuber/go-glob v1.0.0 // indirect 130 149 github.com/segmentio/asm v1.2.0 // indirect 131 150 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect 132 151 github.com/spaolacci/murmur3 v1.1.0 // indirect ··· 138 157 go.opentelemetry.io/auto/sdk v1.1.0 // indirect 139 158 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect 140 159 go.opentelemetry.io/otel v1.37.0 // indirect 160 160 + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 // indirect 141 161 go.opentelemetry.io/otel/metric v1.37.0 // indirect 142 162 go.opentelemetry.io/otel/trace v1.37.0 // indirect 143 163 go.opentelemetry.io/proto/otlp v1.6.0 // indirect ··· 145 165 go.uber.org/multierr v1.11.0 // indirect 146 166 go.uber.org/zap v1.27.0 // indirect 147 167 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect 148 148 - golang.org/x/sync v0.15.0 // indirect 149 168 golang.org/x/sys v0.34.0 // indirect 169 169 + golang.org/x/text v0.27.0 // indirect 150 170 golang.org/x/time v0.12.0 // indirect 151 151 - google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 // indirect 152 152 - google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 // indirect 153 153 - google.golang.org/grpc v1.72.1 // indirect 171 171 + google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect 172 172 + google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect 173 173 + google.golang.org/grpc v1.73.0 // indirect 154 174 google.golang.org/protobuf v1.36.6 // indirect 155 175 gopkg.in/fsnotify.v1 v1.4.7 // indirect 156 176 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect

+85 -96

go.sum

··· 7 7 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= 8 8 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= 9 9 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= 10 10 - github.com/ProtonMail/go-crypto v1.2.0 h1:+PhXXn4SPGd+qk76TlEePBfOfivE0zkWFenhGhFLzWs= 11 11 - github.com/ProtonMail/go-crypto v1.2.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE= 10 10 + github.com/ProtonMail/go-crypto v1.3.0 h1:ILq8+Sf5If5DCpHQp4PbZdS1J7HDFRXz/+xKBiRGFrw= 11 11 + github.com/ProtonMail/go-crypto v1.3.0/go.mod h1:9whxjD8Rbs29b4XWbB8irEcE8KHMqaR2e7GWU1R+/PE= 12 12 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0= 13 13 github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k= 14 14 github.com/alecthomas/repr v0.4.0 h1:GhI2A8MACjfegCPVq9f1FLvIBS+DrQ2KQBFZP1iFzXc= ··· 23 23 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4= 24 24 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= 25 25 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= 26 26 - github.com/bluesky-social/indigo v0.0.0-20250520232546-236dd575c91e h1:DVD+HxQsDCVJtAkjfIKZVaBNc3kayHaU+A2TJZkFdp4= 27 27 - github.com/bluesky-social/indigo v0.0.0-20250520232546-236dd575c91e/go.mod h1:ovyxp8AMO1Hoe838vMJUbqHTZaAR8ABM3g3TXu+A5Ng= 28 26 github.com/bluesky-social/indigo v0.0.0-20250724221105-5827c8fb61bb h1:BqMNDZMfXwiRTJ6NvQotJ0qInn37JH5U8E+TF01CFHQ= 29 27 github.com/bluesky-social/indigo v0.0.0-20250724221105-5827c8fb61bb/go.mod h1:0XUyOCRtL4/OiyeqMTmr6RlVHQMDgw3LS7CfibuZR5Q= 30 28 github.com/bluesky-social/jetstream v0.0.0-20241210005130-ea96859b93d1 h1:CFvRtYNSnWRAi/98M3O466t9dYuwtesNbu6FVPymRrA= ··· 53 51 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI= 54 52 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI= 55 53 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU= 56 56 - github.com/cloudflare/circl v1.6.0 h1:cr5JKic4HI+LkINy2lg3W2jF8sHCVTBncJr5gIIq7qk= 57 57 - github.com/cloudflare/circl v1.6.0/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= 54 54 + github.com/cloudflare/circl v1.6.2-0.20250618153321-aa837fd1539d h1:IiIprFGH6SqstblP0Y9NIo3eaUJGkI/YDOFVSL64Uq4= 55 55 + github.com/cloudflare/circl v1.6.2-0.20250618153321-aa837fd1539d/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= 56 56 + github.com/cloudflare/cloudflare-go v0.115.0 h1:84/dxeeXweCc0PN5Cto44iTA8AkG1fyT11yPO5ZB7sM= 57 57 + github.com/cloudflare/cloudflare-go v0.115.0/go.mod h1:Ds6urDwn/TF2uIU24mu7H91xkKP8gSAHxQ44DSZgVmU= 58 58 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= 59 59 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M= 60 60 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE= ··· 93 93 github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= 94 94 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= 95 95 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= 96 96 - github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= 97 97 - github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= 96 96 + github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= 97 97 + github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= 98 98 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= 99 99 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= 100 100 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo= 101 101 - github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4= 102 101 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ= 102 102 + github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= 103 103 + github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= 103 104 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= 104 105 github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= 105 106 github.com/go-chi/chi/v5 v5.2.0 h1:Aj1EtB0qR2Rdo2dG4O94RIU35w2lvQSj6BRA4+qwFL0= ··· 116 117 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= 117 118 github.com/go-git/go-git-fixtures/v5 v5.0.0-20241203230421-0753e18f8f03 h1:LumE+tQdnYW24a9RoO08w64LHTzkNkdUqBD/0QPtlEY= 118 119 github.com/go-git/go-git-fixtures/v5 v5.0.0-20241203230421-0753e18f8f03/go.mod h1:hMKrMnUE4W0SJ7bFyM00dyz/HoknZoptGWzrj6M+dEM= 120 120 + github.com/go-jose/go-jose/v3 v3.0.4 h1:Wp5HA7bLQcKnf6YYao/4kpRpVMp/yf6+pJKV8WFSaNY= 121 121 + github.com/go-jose/go-jose/v3 v3.0.4/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ= 119 122 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= 120 123 github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= 121 121 - github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY= 122 122 - github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= 123 124 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= 124 125 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= 125 126 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= ··· 127 128 github.com/go-redis/cache/v9 v9.0.0 h1:0thdtFo0xJi0/WXbRVu8B066z8OvVymXTJGaXrVWnN0= 128 129 github.com/go-redis/cache/v9 v9.0.0/go.mod h1:cMwi1N8ASBOufbIvk7cdXe2PbPjK/WMRL95FFHWsSgI= 129 130 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE= 131 131 + github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U= 132 132 + github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= 130 133 github.com/go-yaml/yaml v2.1.0+incompatible/go.mod h1:w2MrLa16VYP0jy6N7M5kHaCkaLENm+P+Tv+MfurjSw0= 131 134 github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4= 132 135 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M= 133 136 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= 134 137 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= 135 135 - github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY= 136 136 - github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8= 137 137 - github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= 138 138 github.com/golang-jwt/jwt/v5 v5.2.3 h1:kkGXqQOBSDDWRhWNXTFpqGSCMyh/PLnqUvMGJPDJDs0= 139 139 github.com/golang-jwt/jwt/v5 v5.2.3/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk= 140 140 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= 141 141 github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= 142 142 - github.com/golang/mock v1.4.4 h1:l75CXGRSwbaYNpl/Z2X1XIIAMSCquvXgpVZDhwEIJsc= 143 142 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4= 143 143 + github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc= 144 144 + github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs= 144 145 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U= 145 146 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8= 146 147 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA= ··· 153 154 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= 154 155 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU= 155 156 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= 157 157 + github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= 156 158 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= 157 159 github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= 158 160 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= 159 161 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= 160 162 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= 163 163 + github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8= 164 164 + github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= 161 165 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0= 162 166 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= 163 167 github.com/google/pprof v0.0.0-20210407192527-94a9f03dee38/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE= ··· 173 177 github.com/gorilla/securecookie v1.1.2/go.mod h1:NfCASbcHqRSY+3a8tlWJwsQap2VX5pwzwo4h3eOamfo= 174 178 github.com/gorilla/sessions v1.4.0 h1:kpIYOp/oi6MG/p5PgxApU8srsSw9tuFbt46Lt7auzqQ= 175 179 github.com/gorilla/sessions v1.4.0/go.mod h1:FLWm50oby91+hl7p/wRxDth9bWSuk0qVL2emc7lT5ik= 176 176 - github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= 177 177 - github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= 180 180 + github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo= 181 181 + github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA= 178 182 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 h1:5ZPtiqj0JL5oKWmcsq4VMaAW5ukBEgSGXEN89zeH1Jo= 179 183 github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3/go.mod h1:ndYquD05frm2vACXE1nsccT4oJzjhw2arTS2cpUD1PI= 184 184 + github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= 185 185 + github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= 186 186 + github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= 180 187 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= 181 188 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48= 182 189 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k= 183 190 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= 184 184 - github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU= 185 185 - github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk= 191 191 + github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= 192 192 + github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= 186 193 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48= 187 194 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw= 195 195 + github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM= 196 196 + github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0= 197 197 + github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts= 198 198 + github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4= 199 199 + github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw= 200 200 + github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw= 188 201 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c= 189 202 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4= 190 203 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= 191 204 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= 205 205 + github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I= 206 206 + github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM= 192 207 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= 193 208 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg= 194 209 github.com/hiddeco/sshsig v0.2.0 h1:gMWllgKCITXdydVkDL+Zro0PU96QI55LwUwebSwNTSw= ··· 198 213 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc= 199 214 github.com/ipfs/bbloom v0.0.4 h1:Gi+8EGJ2y5qiD5FbsbpX/TMNcJw8gSqr7eyjHa4Fhvs= 200 215 github.com/ipfs/bbloom v0.0.4/go.mod h1:cS9YprKXpoZ9lT0n/Mw/a6/aFV6DTjTLYHeA+gyqMG0= 201 201 - github.com/ipfs/boxo v0.30.0 h1:7afsoxPGGqfoH7Dum/wOTGUB9M5fb8HyKPMlLfBvIEQ= 202 202 - github.com/ipfs/boxo v0.30.0/go.mod h1:BPqgGGyHB9rZZcPSzah2Dc9C+5Or3U1aQe7EH1H7370= 203 216 github.com/ipfs/boxo v0.33.0 h1:9ow3chwkDzMj0Deq4AWRUEI7WnIIV7SZhPTzzG2mmfw= 204 217 github.com/ipfs/boxo v0.33.0/go.mod h1:3IPh7YFcCIcKp6o02mCHovrPntoT5Pctj/7j4syh/RM= 205 205 - github.com/ipfs/go-block-format v0.2.1 h1:96kW71XGNNa+mZw/MTzJrCpMhBWCrd9kBLoKm9Iip/Q= 206 206 - github.com/ipfs/go-block-format v0.2.1/go.mod h1:frtvXHMQhM6zn7HvEQu+Qz5wSTj+04oEH/I+NjDgEjk= 207 218 github.com/ipfs/go-block-format v0.2.2 h1:uecCTgRwDIXyZPgYspaLXoMiMmxQpSx2aq34eNc4YvQ= 208 219 github.com/ipfs/go-block-format v0.2.2/go.mod h1:vmuefuWU6b+9kIU0vZJgpiJt1yicQz9baHXE8qR+KB8= 209 220 github.com/ipfs/go-cid v0.5.0 h1:goEKKhaGm0ul11IHA7I6p1GmKz8kEYniqFopaB5Otwg= ··· 218 229 github.com/ipfs/go-ipfs-ds-help v1.1.1/go.mod h1:75vrVCkSdSFidJscs8n4W+77AtTpCIAdDGAwjitJMIo= 219 230 github.com/ipfs/go-ipfs-util v0.0.3 h1:2RFdGez6bu2ZlZdI+rWfIdbQb1KudQp3VGwPtdNCmE0= 220 231 github.com/ipfs/go-ipfs-util v0.0.3/go.mod h1:LHzG1a0Ig4G+iZ26UUOMjHd+lfM84LZCrn17xAKWBvs= 221 221 - github.com/ipfs/go-ipld-cbor v0.2.0 h1:VHIW3HVIjcMd8m4ZLZbrYpwjzqlVUfjLM7oK4T5/YF0= 222 222 - github.com/ipfs/go-ipld-cbor v0.2.0/go.mod h1:Cp8T7w1NKcu4AQJLqK0tWpd1nkgTxEVB5C6kVpLW6/0= 223 232 github.com/ipfs/go-ipld-cbor v0.2.1 h1:H05yEJbK/hxg0uf2AJhyerBDbjOuHX4yi+1U/ogRa7E= 224 233 github.com/ipfs/go-ipld-cbor v0.2.1/go.mod h1:x9Zbeq8CoE5R2WicYgBMcr/9mnkQ0lHddYWJP2sMV3A= 225 225 - github.com/ipfs/go-ipld-format v0.6.1 h1:lQLmBM/HHbrXvjIkrydRXkn+gc0DE5xO5fqelsCKYOQ= 226 226 - github.com/ipfs/go-ipld-format v0.6.1/go.mod h1:8TOH1Hj+LFyqM2PjSqI2/ZnyO0KlfhHbJLkbxFa61hs= 227 234 github.com/ipfs/go-ipld-format v0.6.2 h1:bPZQ+A05ol0b3lsJSl0bLvwbuQ+HQbSsdGTy4xtYUkU= 228 235 github.com/ipfs/go-ipld-format v0.6.2/go.mod h1:nni2xFdHKx5lxvXJ6brt/pndtGxKAE+FPR1rg4jTkyk= 229 236 github.com/ipfs/go-log v1.0.5 h1:2dOuUCB1Z7uoczMWgAyDck5JLb72zHzrMnGnCNNbvY8= ··· 233 240 github.com/ipfs/go-log/v2 v2.6.0/go.mod h1:p+Efr3qaY5YXpx9TX7MoLCSEZX5boSWj9wh86P5HJa8= 234 241 github.com/ipfs/go-metrics-interface v0.3.0 h1:YwG7/Cy4R94mYDUuwsBfeziJCVm9pBMJ6q/JR9V40TU= 235 242 github.com/ipfs/go-metrics-interface v0.3.0/go.mod h1:OxxQjZDGocXVdyTPocns6cOLwHieqej/jos7H4POwoY= 236 236 - github.com/ipfs/go-test v0.2.1 h1:/D/a8xZ2JzkYqcVcV/7HYlCnc7bv/pKHQiX5TdClkPE= 237 237 - github.com/ipfs/go-test v0.2.1/go.mod h1:dzu+KB9cmWjuJnXFDYJwC25T3j1GcN57byN+ixmK39M= 238 238 - github.com/ipfs/go-test v0.2.2 h1:1yjYyfbdt1w93lVzde6JZ2einh3DIV40at4rVoyEcE8= 239 243 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= 240 244 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= 241 245 github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo= ··· 247 251 github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk= 248 252 github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= 249 253 github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= 250 250 - github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE= 251 251 - github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= 252 254 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= 253 255 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= 254 256 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= ··· 259 261 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= 260 262 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= 261 263 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= 262 262 - github.com/lestrrat-go/blackmagic v1.0.3 h1:94HXkVLxkZO9vJI/w2u1T0DAoprShFd13xtnSINtDWs= 263 263 - github.com/lestrrat-go/blackmagic v1.0.3/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= 264 264 github.com/lestrrat-go/blackmagic v1.0.4 h1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA= 265 265 github.com/lestrrat-go/blackmagic v1.0.4/go.mod h1:6AWFyKNNj0zEXQYfTMPfZrAXUWUfTIZ5ECEUEJaijtw= 266 266 github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE= ··· 273 273 github.com/lestrrat-go/jwx/v2 v2.1.6/go.mod h1:Y722kU5r/8mV7fYDifjug0r8FK8mZdw0K0GpJw/l8pU= 274 274 github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU= 275 275 github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I= 276 276 - github.com/libp2p/go-buffer-pool v0.1.0 h1:oK4mSFcQz7cTQIfqbe4MIj9gLW+mnanjyFtc6cdF0Y8= 277 277 - github.com/libp2p/go-buffer-pool v0.1.0/go.mod h1:N+vh8gMqimBzdKkSMVuydVDq+UV5QTWy5HSiZacSbPg= 278 278 - github.com/libp2p/go-libp2p v0.41.1 h1:8ecNQVT5ev/jqALTvisSJeVNvXYJyK4NhQx1nNRXQZE= 279 279 - github.com/libp2p/go-libp2p v0.41.1/go.mod h1:DcGTovJzQl/I7HMrby5ZRjeD0kQkGiy+9w6aEkSZpRI= 280 280 - github.com/libp2p/go-libp2p v0.42.0 h1:A8foZk+ZEhZTv0Jb++7xUFlrFhBDv4j2Vh/uq4YX+KE= 281 281 - github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= 282 282 - github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= 276 276 + github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= 277 277 + github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= 283 278 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= 284 279 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= 285 280 github.com/mattn/go-sqlite3 v1.14.24 h1:tpSp2G2KyMnnQu99ngJ47EIkWVmliIizyZBfPrBWDRM= ··· 288 283 github.com/microcosm-cc/bluemonday v1.0.27/go.mod h1:jFi9vgW+H7c3V0lb6nR74Ib/DIB5OBs92Dimizgw2cA= 289 284 github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM= 290 285 github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8= 286 286 + github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= 287 287 + github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= 291 288 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0= 292 289 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= 293 290 github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= ··· 304 301 github.com/multiformats/go-base32 v0.1.0/go.mod h1:Kj3tFY6zNr+ABYMqeUNeGvkIC/UYgtWibDcT0rExnbI= 305 302 github.com/multiformats/go-base36 v0.2.0 h1:lFsAbNOGeKtuKozrtBsAkSVhv1p9D0/qedU9rQyccr0= 306 303 github.com/multiformats/go-base36 v0.2.0/go.mod h1:qvnKE++v+2MWCfePClUEjE78Z7P2a1UV0xHgWc0hkp4= 307 307 - github.com/multiformats/go-multiaddr v0.15.0 h1:zB/HeaI/apcZiTDwhY5YqMvNVl/oQYvs3XySU+qeAVo= 308 308 - github.com/multiformats/go-multiaddr v0.15.0/go.mod h1:JSVUmXDjsVFiW7RjIFMP7+Ev+h1DTbiJgVeTV/tcmP0= 309 309 - github.com/multiformats/go-multiaddr v0.16.0 h1:oGWEVKioVQcdIOBlYM8BH1rZDWOGJSqr9/BKl6zQ4qc= 310 304 github.com/multiformats/go-multibase v0.2.0 h1:isdYCVLvksgWlMW9OZRYJEa9pZETFivncJHmHnnd87g= 311 305 github.com/multiformats/go-multibase v0.2.0/go.mod h1:bFBZX4lKCA/2lyOFSAoKH5SS6oPyjtnzK/XTFDPkNuk= 312 312 - github.com/multiformats/go-multicodec v0.9.0 h1:pb/dlPnzee/Sxv/j4PmkDRxCOi3hXTz3IbPKOXWJkmg= 313 313 - github.com/multiformats/go-multicodec v0.9.0/go.mod h1:L3QTQvMIaVBkXOXXtVmYE+LI16i14xuaojr/H7Ai54k= 314 314 - github.com/multiformats/go-multicodec v0.9.2 h1:YrlXCuqxjqm3bXl+vBq5LKz5pz4mvAsugdqy78k0pXQ= 315 306 github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U= 316 307 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM= 317 308 github.com/multiformats/go-varint v0.0.7 h1:sWSGR+f/eu5ABZA2ZpYKBILXTTs9JWpdEM/nEGOHFS8= ··· 343 334 github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg= 344 335 github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM= 345 336 github.com/onsi/gomega v1.25.0/go.mod h1:r+zV744Re+DiYCIPRlYOTxn0YkOLcAnW8k1xXdMPGhM= 346 346 - github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k= 347 347 - github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY= 337 337 + github.com/onsi/gomega v1.37.0 h1:CdEG8g0S133B4OswTDC/5XPSzE1OeP29QOioj2PID2Y= 338 338 + github.com/onsi/gomega v1.37.0/go.mod h1:8D9+Txp43QWKhM24yyOBEdpkzN8FvJyAwecBgsU4KU0= 339 339 + github.com/openbao/openbao/api/v2 v2.3.0 h1:61FO3ILtpKoxbD9kTWeGaCq8pz1sdt4dv2cmTXsiaAc= 340 340 + github.com/openbao/openbao/api/v2 v2.3.0/go.mod h1:T47WKHb7DqHa3Ms3xicQtl5EiPE+U8diKjb9888okWs= 348 341 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= 349 342 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= 350 343 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= 351 344 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= 352 352 - github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs= 353 345 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= 346 346 + github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b h1:FfH+VrHHk6Lxt9HdVS0PXzSXFyS2NbZKXv33FYPol0A= 347 347 + github.com/opentracing/opentracing-go v1.2.1-0.20220228012449-10b1cf09e00b/go.mod h1:AC62GU6hc0BrNm+9RK9VSiwa/EUe1bkIeFORAMcHvJU= 354 348 github.com/oppiliappan/chroma/v2 v2.19.0 h1:PN7/pb+6JRKCva30NPTtRJMlrOyzgpPpIroNzy4ekHU= 355 349 github.com/oppiliappan/chroma/v2 v2.19.0/go.mod h1:RVX6AvYm4VfYe/zsk7mjHueLDZor3aWCNE14TFlepBk= 356 350 github.com/oppiliappan/go-git/v5 v5.17.0 h1:CuJnpcIDxr0oiNaSHMconovSWnowHznVDG+AhjGuSEo= ··· 371 365 github.com/prometheus/client_golang v1.22.0/go.mod h1:R7ljNsLXhuQXYZYtw6GAE9AZg8Y7vEW5scdCXrWRXC0= 372 366 github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= 373 367 github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= 374 374 - github.com/prometheus/common v0.63.0 h1:YR/EIY1o3mEFP/kZCD7iDMnLPlGyuU2Gb3HIcXnA98k= 375 375 - github.com/prometheus/common v0.63.0/go.mod h1:VVFF/fBIoToEnWRVkYoXEkq3R3paCoxG9PXP74SnV18= 376 368 github.com/prometheus/common v0.64.0 h1:pdZeA+g617P7oGv1CzdTzyeShxAGrTBsolKNOLQPGO4= 377 369 github.com/prometheus/common v0.64.0/go.mod h1:0gZns+BLRQ3V6NdaerOhMbwwRbNh9hkGINtQAsP5GS8= 378 370 github.com/prometheus/procfs v0.16.1 h1:hZ15bTNuirocR6u0JZ6BAHHmwS1p8B4P6MRqxtzMyRg= 379 371 github.com/prometheus/procfs v0.16.1/go.mod h1:teAbpZRB1iIAJYREa1LsoWUXykVXA1KlTmWl8x/U+Is= 380 372 github.com/redis/go-redis/v9 v9.0.0-rc.4/go.mod h1:Vo3EsyWnicKnSKCA7HhgnvnyA74wOA69Cd2Meli5mmA= 381 381 - github.com/redis/go-redis/v9 v9.3.0 h1:RiVDjmig62jIWp7Kk4XVLs0hzV6pI3PyTnnL0cnn0u0= 382 382 - github.com/redis/go-redis/v9 v9.3.0/go.mod h1:hdY0cQFCN4fnSYT6TkisLufl/4W5UIXyv0b/CLO2V2M= 373 373 + github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM= 374 374 + github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA= 383 375 github.com/resend/resend-go/v2 v2.15.0 h1:B6oMEPf8IEQwn2Ovx/9yymkESLDSeNfLFaNMw+mzHhE= 384 376 github.com/resend/resend-go/v2 v2.15.0/go.mod h1:3YCb8c8+pLiqhtRFXTyFwlLvfjQtluxOr9HEh2BwCkQ= 385 377 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4= ··· 387 379 github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= 388 380 github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= 389 381 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= 382 382 + github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= 383 383 + github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= 390 384 github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys= 391 385 github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs= 392 386 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0= ··· 431 425 github.com/whyrusleeping/cbor-gen v0.3.1/go.mod h1:pM99HXyEbSQHcosHc0iW7YFmwnscr+t9Te4ibko05so= 432 426 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= 433 427 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= 428 428 + github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= 434 429 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k= 435 430 github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE= 436 431 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= ··· 440 435 gitlab.com/yawning/tuplehash v0.0.0-20230713102510-df83abbf9a02/go.mod h1:JTnUj0mpYiAsuZLmKjTx/ex3AtMowcCgnE7YNyCEP0I= 441 436 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= 442 437 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= 443 443 - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= 444 444 - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= 445 438 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 h1:Hf9xI/XLML9ElpiHVDNwvqI0hIFlzV8dgIr35kV1kRU= 446 439 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0/go.mod h1:NfchwuyNoMcZ5MLHwPrODwUF1HWCXWrL31s8gSAdIKY= 447 447 - go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg= 448 448 - go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E= 449 440 go.opentelemetry.io/otel v1.37.0 h1:9zhNfelUvx0KBfu/gb+ZgeAfAgtWrfHJZcAqFC228wQ= 450 441 go.opentelemetry.io/otel v1.37.0/go.mod h1:ehE/umFRLnuLa/vSccNq9oS1ErUlkkK71gMcN34UG8I= 451 451 - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0 h1:K0XaT3DwHAcV4nKLzcQvwAgSyisUghWoY20I7huthMk= 452 452 - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0/go.mod h1:B5Ki776z/MBnVha1Nzwp5arlzBbE3+1jk+pGmaP5HME= 442 442 + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0 h1:Vh5HayB/0HHfOQA7Ctx69E/Y/DcQSMPpKANYVMQ7fBA= 443 443 + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.33.0/go.mod h1:cpgtDBaqD/6ok/UG0jT15/uKjAY8mRA53diogHBg3UI= 453 444 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0 h1:lUsI2TYsQw2r1IASwoROaCnjdj2cvC2+Jbxvk6nHnWU= 454 445 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0/go.mod h1:2HpZxxQurfGxJlJDblybejHB6RX6pmExPNe517hREw4= 455 455 - go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE= 456 456 - go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs= 457 446 go.opentelemetry.io/otel/metric v1.37.0 h1:mvwbQS5m0tbmqML4NqK+e3aDiO02vsf/WgbsdpcPoZE= 458 447 go.opentelemetry.io/otel/metric v1.37.0/go.mod h1:04wGrZurHYKOc+RKeye86GwKiTb9FKm1WHtO+4EVr2E= 459 459 - go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs= 460 460 - go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY= 461 448 go.opentelemetry.io/otel/sdk v1.37.0 h1:ItB0QUqnjesGRvNcmAcU0LyvkVyGJ2xftD29bWdDvKI= 462 462 - go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis= 463 463 - go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4= 449 449 + go.opentelemetry.io/otel/sdk v1.37.0/go.mod h1:VredYzxUvuo2q3WRcDnKDjbdvmO0sCzOvVAiY+yUkAg= 464 450 go.opentelemetry.io/otel/sdk/metric v1.37.0 h1:90lI228XrB9jCMuSdA0673aubgRobVZFhbjxHHspCPc= 465 465 - go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w= 466 466 - go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA= 451 451 + go.opentelemetry.io/otel/sdk/metric v1.37.0/go.mod h1:cNen4ZWfiD37l5NhS+Keb5RXVWZWpRE+9WyVCpbo5ps= 467 452 go.opentelemetry.io/otel/trace v1.37.0 h1:HLdcFNbRQBE2imdSEgm/kwqmQj1Or1l/7bW6mxVK7z4= 468 453 go.opentelemetry.io/otel/trace v1.37.0/go.mod h1:TlgrlQ+PtQO5XFerSPUYG0JSgGyryXewPGyayAWSBS0= 469 454 go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI= ··· 488 473 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= 489 474 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= 490 475 golang.org/x/crypto v0.1.0/go.mod h1:RecgLatLF4+eUMCP1PoPZQb+cVrJcOPbHkTkbkB9sbw= 491 491 - golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8= 492 492 - golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw= 476 476 + golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= 493 477 golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM= 494 478 golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY= 495 495 - golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0 h1:R84qjqJb5nVJMxqWYb3np9L5ZsaDtB+a39EqjV0JSUM= 496 496 - golang.org/x/exp v0.0.0-20250408133849-7e4ce0ab07d0/go.mod h1:S9Xr4PYopiDyqSyp5NjCrhFrqg6A5zA2E/iPHPhqnS8= 497 479 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b h1:M2rDM6z3Fhozi9O7NWsxAkg/yqS/lQJ6PmkyIV3YP+o= 498 480 golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b/go.mod h1:3//PLf8L/X+8b4vuAfHzxeRUl04Adcb341+IGKfnqS8= 499 481 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= 500 482 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc= 501 483 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= 502 484 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= 485 485 + golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= 503 486 golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY= 504 487 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= 505 488 golang.org/x/mod v0.6.0/go.mod h1:4mET923SAdbXp2ki8ey+zGs1SLqsuM2Y0uvdZR/fUNI= 506 489 golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= 490 490 + golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= 507 491 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= 508 492 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= 509 493 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= ··· 512 496 golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= 513 497 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= 514 498 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= 499 499 + golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= 515 500 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk= 516 501 golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= 517 502 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= ··· 521 506 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY= 522 507 golang.org/x/net v0.3.0/go.mod h1:MBQ8lrhLObU/6UmLb4fmbmk5OcyYmqtbGd/9yIeKjEE= 523 508 golang.org/x/net v0.5.0/go.mod h1:DivGGAXEgPSlEBzxGzZI+ZLohi+xUj054jfeKui00ws= 524 524 - golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY= 525 525 - golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds= 526 526 - golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw= 527 527 - golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA= 509 509 + golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= 510 510 + golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= 511 511 + golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs= 512 512 + golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8= 528 513 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 529 514 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 530 515 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= ··· 532 517 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 533 518 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 534 519 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= 535 535 - golang.org/x/sync v0.14.0 h1:woo0S4Yywslg6hp4eUFjTVOyKt0RookbpAHG4c1HmhQ= 536 536 - golang.org/x/sync v0.14.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= 537 537 - golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8= 538 538 - golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= 520 520 + golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= 521 521 + golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= 539 522 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= 540 523 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= 541 524 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= ··· 547 530 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 548 531 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 549 532 golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 533 533 + golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 550 534 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= 535 535 + golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 551 536 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 552 537 golang.org/x/sys v0.0.0-20211019181941-9d821ace8654/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 553 538 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= ··· 555 540 golang.org/x/sys v0.0.0-20220422013727-9388b58f7150/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 556 541 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 557 542 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 543 543 + golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 558 544 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 559 545 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 560 546 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 561 547 golang.org/x/sys v0.4.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 548 548 + golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 562 549 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 563 563 - golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw= 564 564 - golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= 550 550 + golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= 551 551 + golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= 565 552 golang.org/x/sys v0.34.0 h1:H5Y5sJ2L2JRdyv7ROF1he/lPdvFsd0mJHFw2ThKHxLA= 566 553 golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= 567 554 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= ··· 570 557 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc= 571 558 golang.org/x/term v0.3.0/go.mod h1:q750SLmJuPmVoN1blW3UFBPREJfb1KmY3vwxfr+nFDA= 572 559 golang.org/x/term v0.4.0/go.mod h1:9P2UbLfCdcvo3p/nzKvsmas4TnlujnuoV9hGgYzW1lQ= 573 573 - golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg= 574 574 - golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ= 560 560 + golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= 561 561 + golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= 562 562 + golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= 575 563 golang.org/x/term v0.33.0 h1:NuFncQrRcaRvVmgRkvM3j/F00gWIAlcmlB8ACEKmGIg= 564 564 + golang.org/x/term v0.33.0/go.mod h1:s18+ql9tYWp1IfpV9DmCtQDDSRBUjKaw9M1eAv5UeF0= 576 565 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= 577 566 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= 578 567 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= ··· 580 569 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= 581 570 golang.org/x/text v0.5.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= 582 571 golang.org/x/text v0.6.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= 583 583 - golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4= 584 584 - golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA= 572 572 + golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= 573 573 + golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= 574 574 + golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= 585 575 golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4= 586 586 - golang.org/x/time v0.8.0 h1:9i3RxcPv3PZnitoVGMPDKZSq1xW1gK1Xy3ArNOGZfEg= 587 587 - golang.org/x/time v0.8.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM= 576 576 + golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU= 588 577 golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= 589 578 golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= 590 579 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= ··· 598 587 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= 599 588 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= 600 589 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= 590 590 + golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= 601 591 golang.org/x/tools v0.1.10/go.mod h1:Uh6Zz+xoGYZom868N8YTex3t7RhtHDBrE8Gzo9bV56E= 602 592 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= 603 593 golang.org/x/tools v0.2.0/go.mod h1:y4OqIKeOV/fWJetJ8bXPU1sEVniLMIyDAZWeHdV+NTA= 604 594 golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ= 595 595 + golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= 605 596 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 606 597 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 607 598 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 608 599 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= 609 600 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da h1:noIWHXmPHxILtqtCOPIhSt0ABwskkZKjD3bXGnZGpNY= 610 601 golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90= 611 611 - google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237 h1:Kog3KlB4xevJlAcbbbzPfRG0+X9fdoGM+UBRKVz6Wr0= 612 612 - google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237/go.mod h1:ezi0AVyMKDWy5xAncvjLWH7UcLBB5n7y2fQ8MzjJcto= 613 613 - google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237 h1:cJfm9zPbe1e873mHJzmQ1nwVEeRDU/T1wXDK2kUSU34= 614 614 - google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A= 615 615 - google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA= 616 616 - google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM= 602 602 + google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 h1:oWVWY3NzT7KJppx2UKhKmzPq4SRe0LdCijVRwvGeikY= 603 603 + google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822/go.mod h1:h3c4v36UTKzUiuaOKQ6gr3S+0hovBtUrXzTG/i3+XEc= 604 604 + google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 h1:fc6jSaCT0vBduLYZHYrBBNY4dsWuvgyff9noRNDdBeE= 605 605 + google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A= 606 606 + google.golang.org/grpc v1.73.0 h1:VIWSmpI2MegBtTuFt5/JWy2oXxtjJ/e89Z70ImfD2ok= 607 607 + google.golang.org/grpc v1.73.0/go.mod h1:50sbHOUqWoCQGI8V2HQLJM0B+LMlIUjNSZmow7EVBQc= 617 608 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= 618 609 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= 619 610 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= ··· 650 641 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg= 651 642 lukechampine.com/blake3 v1.4.1 h1:I3Smz7gso8w4/TunLKec6K2fn+kyKtDxr/xcQEN84Wg= 652 643 lukechampine.com/blake3 v1.4.1/go.mod h1:QFosUxmjB8mnrWFSNwKmvxHpfY72bmD2tQ0kBMM3kwo= 653 653 - tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250526154904-3906c5336421 h1:ZQNKE1HKWjfQBizxDb2XLhrJcgZqE0MLFIU1iggaF90= 654 654 - tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250526154904-3906c5336421/go.mod h1:Wad0H70uyyY4qZryU/1Ic+QZyw41YxN5QfzNAEBaXkQ= 655 644 tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250724194903-28e660378cb1 h1:z1os1aRIqeo5e8d0Tx7hk+LH8OdZZeIOY0zw9VB/ZoU= 656 645 tangled.sh/icyphox.sh/atproto-oauth v0.0.0-20250724194903-28e660378cb1/go.mod h1:+oQi9S6IIDll0nxLZVhuzOPX8WKLCYEnE6M5kUKupDg= 657 646 tangled.sh/oppi.li/go-gitdiff v0.8.2 h1:pASJJNWaFn6EmEIUNNjHZQ3stRu6BqTO2YyjKvTcxIc=

+19 -3

guard/guard.go

··· 2 2 3 3 import ( 4 4 "context" 5 5 + "errors" 5 6 "fmt" 7 7 + "io" 6 8 "log/slog" 7 9 "net/http" 8 10 "net/url" ··· 43 45 Usage: "internal API endpoint", 44 46 Value: "http://localhost:5444", 45 47 }, 48 48 + &cli.StringFlag{ 49 49 + Name: "motd-file", 50 50 + Usage: "path to message of the day file", 51 51 + Value: "/home/git/motd", 52 52 + }, 46 53 }, 47 54 } 48 55 } ··· 54 61 gitDir := cmd.String("git-dir") 55 62 logPath := cmd.String("log-path") 56 63 endpoint := cmd.String("internal-api") 64 64 + motdFile := cmd.String("motd-file") 57 65 58 66 logFile, err := os.OpenFile(logPath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) 59 67 if err != nil { ··· 149 157 "fullPath", fullPath, 150 158 "client", clientIP) 151 159 152 152 - if gitCommand == "git-upload-pack" { 153 153 - fmt.Fprintf(os.Stderr, "\x02%s\n", "Welcome to this knot!") 160 160 + var motdReader io.Reader 161 161 + if reader, err := os.Open(motdFile); err != nil { 162 162 + if !errors.Is(err, os.ErrNotExist) { 163 163 + l.Error("failed to read motd file", "error", err) 164 164 + } 165 165 + motdReader = strings.NewReader("Welcome to this knot!\n") 154 166 } else { 155 155 - fmt.Fprintf(os.Stderr, "%s\n", "Welcome to this knot!") 167 167 + motdReader = reader 168 168 + } 169 169 + if gitCommand == "git-upload-pack" { 170 170 + io.WriteString(os.Stderr, "\x02") 156 171 } 172 172 + io.Copy(os.Stderr, motdReader) 157 173 158 174 gitCmd := exec.Command(gitCommand, fullPath) 159 175 gitCmd.Stdout = os.Stdout

+1 -2

input.css

··· 100 100 101 101 .prose img { 102 102 display: inline; 103 103 - margin-left: 0; 104 104 - margin-right: 0; 103 103 + margin: 0; 105 104 vertical-align: middle; 106 105 } 107 106 }

+13

jetstream/jetstream.go

··· 52 52 j.mu.Unlock() 53 53 } 54 54 55 55 + func (j *JetstreamClient) RemoveDid(did string) { 56 56 + if did == "" { 57 57 + return 58 58 + } 59 59 + 60 60 + if j.logDids { 61 61 + j.l.Info("removing did from in-memory filter", "did", did) 62 62 + } 63 63 + j.mu.Lock() 64 64 + delete(j.wantedDids, did) 65 65 + j.mu.Unlock() 66 66 + } 67 67 + 55 68 type processor func(context.Context, *models.Event) error 56 69 57 70 func (j *JetstreamClient) withDidFilter(processFunc processor) processor {

-8

knotserver/file.go

··· 10 10 "tangled.sh/tangled.sh/core/types" 11 11 ) 12 12 13 13 - func (h *Handle) listFiles(files []types.NiceTree, data map[string]any, w http.ResponseWriter) { 14 14 - data["files"] = files 15 15 - 16 16 - writeJSON(w, data) 17 17 - return 18 18 - } 19 19 - 20 13 func countLines(r io.Reader) (int, error) { 21 14 buf := make([]byte, 32*1024) 22 15 bufLen := 0 ··· 52 45 53 46 resp.Lines = lc 54 47 writeJSON(w, resp) 55 55 - return 56 48 }

+61 -1

knotserver/ingester.go

··· 213 213 return h.db.InsertEvent(event, h.n) 214 214 } 215 215 216 216 + // duplicated from add collaborator 217 217 + func (h *Handle) processCollaborator(ctx context.Context, did string, record tangled.RepoCollaborator) error { 218 218 + repoAt, err := syntax.ParseATURI(record.Repo) 219 219 + if err != nil { 220 220 + return err 221 221 + } 222 222 + 223 223 + resolver := idresolver.DefaultResolver() 224 224 + 225 225 + subjectId, err := resolver.ResolveIdent(ctx, record.Subject) 226 226 + if err != nil || subjectId.Handle.IsInvalidHandle() { 227 227 + return err 228 228 + } 229 229 + 230 230 + // TODO: fix this for good, we need to fetch the record here unfortunately 231 231 + // resolve this aturi to extract the repo record 232 232 + owner, err := resolver.ResolveIdent(ctx, repoAt.Authority().String()) 233 233 + if err != nil || owner.Handle.IsInvalidHandle() { 234 234 + return fmt.Errorf("failed to resolve handle: %w", err) 235 235 + } 236 236 + 237 237 + xrpcc := xrpc.Client{ 238 238 + Host: owner.PDSEndpoint(), 239 239 + } 240 240 + 241 241 + resp, err := comatproto.RepoGetRecord(ctx, &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String()) 242 242 + if err != nil { 243 243 + return err 244 244 + } 245 245 + 246 246 + repo := resp.Value.Val.(*tangled.Repo) 247 247 + didSlashRepo, _ := securejoin.SecureJoin(owner.DID.String(), repo.Name) 248 248 + 249 249 + // check perms for this user 250 250 + if ok, err := h.e.IsCollaboratorInviteAllowed(owner.DID.String(), rbac.ThisServer, didSlashRepo); !ok || err != nil { 251 251 + return fmt.Errorf("insufficient permissions: %w", err) 252 252 + } 253 253 + 254 254 + if err := h.db.AddDid(subjectId.DID.String()); err != nil { 255 255 + return err 256 256 + } 257 257 + h.jc.AddDid(subjectId.DID.String()) 258 258 + 259 259 + if err := h.e.AddCollaborator(subjectId.DID.String(), rbac.ThisServer, didSlashRepo); err != nil { 260 260 + return err 261 261 + } 262 262 + 263 263 + return h.fetchAndAddKeys(ctx, subjectId.DID.String()) 264 264 + } 265 265 + 216 266 func (h *Handle) fetchAndAddKeys(ctx context.Context, did string) error { 217 267 l := log.FromContext(ctx) 218 268 ··· 266 316 defer func() { 267 317 eventTime := event.TimeUS 268 318 lastTimeUs := eventTime + 1 269 269 - fmt.Println("lastTimeUs", lastTimeUs) 270 319 if err := h.db.SaveLastTimeUs(lastTimeUs); err != nil { 271 320 err = fmt.Errorf("(deferred) failed to save last time us: %w", err) 272 321 } ··· 292 341 if err := h.processKnotMember(ctx, did, record); err != nil { 293 342 return fmt.Errorf("failed to process knot member: %w", err) 294 343 } 344 344 + 295 345 case tangled.RepoPullNSID: 296 346 var record tangled.RepoPull 297 347 if err := json.Unmarshal(raw, &record); err != nil { ··· 300 350 if err := h.processPull(ctx, did, record); err != nil { 301 351 return fmt.Errorf("failed to process knot member: %w", err) 302 352 } 353 353 + 354 354 + case tangled.RepoCollaboratorNSID: 355 355 + var record tangled.RepoCollaborator 356 356 + if err := json.Unmarshal(raw, &record); err != nil { 357 357 + return fmt.Errorf("failed to unmarshal record: %w", err) 358 358 + } 359 359 + if err := h.processCollaborator(ctx, did, record); err != nil { 360 360 + return fmt.Errorf("failed to process knot member: %w", err) 361 361 + } 362 362 + 303 363 } 304 364 305 365 return err

+11 -3

knotserver/routes.go

··· 286 286 mimeType = "image/svg+xml" 287 287 } 288 288 289 289 - if !strings.HasPrefix(mimeType, "image/") && !strings.HasPrefix(mimeType, "video/") { 290 290 - l.Error("attempted to serve non-image/video file", "mimetype", mimeType) 291 291 - writeError(w, "only image and video files can be accessed directly", http.StatusForbidden) 289 289 + // allow image, video, and text/plain files to be served directly 290 290 + switch { 291 291 + case strings.HasPrefix(mimeType, "image/"): 292 292 + // allowed 293 293 + case strings.HasPrefix(mimeType, "video/"): 294 294 + // allowed 295 295 + case strings.HasPrefix(mimeType, "text/plain"): 296 296 + // allowed 297 297 + default: 298 298 + l.Error("attempted to serve disallowed file type", "mimetype", mimeType) 299 299 + writeError(w, "only image, video, and text files can be accessed directly", http.StatusForbidden) 292 300 return 293 301 } 294 302

+1

knotserver/server.go

··· 76 76 tangled.PublicKeyNSID, 77 77 tangled.KnotMemberNSID, 78 78 tangled.RepoPullNSID, 79 79 + tangled.RepoCollaboratorNSID, 79 80 }, nil, logger, db, true, c.Server.LogDids) 80 81 if err != nil { 81 82 logger.Error("failed to setup jetstream", "error", err)

+1 -1

knotserver/xrpc/router.go

··· 134 134 135 135 func GenericError(err error) XrpcError { 136 136 return NewXrpcError( 137 137 - WithTag("InvalidRepo"), 137 137 + WithTag("Generic"), 138 138 WithError(err), 139 139 ) 140 140 }

+2 -2

knotserver/xrpc/set_default_branch.go

··· 23 23 writeError(w, e, http.StatusBadRequest) 24 24 } 25 25 26 26 - actorDid, ok := r.Context().Value(ActorDid).(*syntax.DID) 26 26 + actorDid, ok := r.Context().Value(ActorDid).(syntax.DID) 27 27 if !ok { 28 28 fail(MissingActorDidError) 29 29 return ··· 83 83 return 84 84 } 85 85 86 86 - w.WriteHeader(http.StatusNoContent) 86 86 + w.WriteHeader(http.StatusOK) 87 87 }

-37

lexicons/addSecret.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.repo.addSecret", 4 4 - "defs": { 5 5 - "main": { 6 6 - "type": "procedure", 7 7 - "description": "Add a CI secret", 8 8 - "input": { 9 9 - "encoding": "application/json", 10 10 - "schema": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "repo", 14 14 - "key", 15 15 - "value" 16 16 - ], 17 17 - "properties": { 18 18 - "repo": { 19 19 - "type": "string", 20 20 - "format": "at-uri" 21 21 - }, 22 22 - "key": { 23 23 - "type": "string", 24 24 - "maxLength": 50, 25 25 - "minLength": 1 26 26 - }, 27 27 - "value": { 28 28 - "type": "string", 29 29 - "maxLength": 200, 30 30 - "minLength": 1 31 31 - } 32 32 - } 33 33 - } 34 34 - } 35 35 - } 36 36 - } 37 37 - }

-52

lexicons/artifact.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.repo.artifact", 4 4 - "needsCbor": true, 5 5 - "needsType": true, 6 6 - "defs": { 7 7 - "main": { 8 8 - "type": "record", 9 9 - "key": "tid", 10 10 - "record": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "name", 14 14 - "repo", 15 15 - "tag", 16 16 - "createdAt", 17 17 - "artifact" 18 18 - ], 19 19 - "properties": { 20 20 - "name": { 21 21 - "type": "string", 22 22 - "description": "name of the artifact" 23 23 - }, 24 24 - "repo": { 25 25 - "type": "string", 26 26 - "format": "at-uri", 27 27 - "description": "repo that this artifact is being uploaded to" 28 28 - }, 29 29 - "tag": { 30 30 - "type": "bytes", 31 31 - "description": "hash of the tag object that this artifact is attached to (only annotated tags are supported)", 32 32 - "minLength": 20, 33 33 - "maxLength": 20 34 34 - }, 35 35 - "createdAt": { 36 36 - "type": "string", 37 37 - "format": "datetime", 38 38 - "description": "time of creation of this artifact" 39 39 - }, 40 40 - "artifact": { 41 41 - "type": "blob", 42 42 - "description": "the artifact", 43 43 - "accept": [ 44 44 - "*/*" 45 45 - ], 46 46 - "maxSize": 52428800 47 47 - } 48 48 - } 49 49 - } 50 50 - } 51 51 - } 52 52 - }

-29

lexicons/defaultBranch.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.repo.setDefaultBranch", 4 4 - "defs": { 5 5 - "main": { 6 6 - "type": "procedure", 7 7 - "description": "Set the default branch for a repository", 8 8 - "input": { 9 9 - "encoding": "application/json", 10 10 - "schema": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "repo", 14 14 - "defaultBranch" 15 15 - ], 16 16 - "properties": { 17 17 - "repo": { 18 18 - "type": "string", 19 19 - "format": "at-uri" 20 20 - }, 21 21 - "defaultBranch": { 22 22 - "type": "string" 23 23 - } 24 24 - } 25 25 - } 26 26 - } 27 27 - } 28 28 - } 29 29 - }

-67

lexicons/listSecrets.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.repo.listSecrets", 4 4 - "defs": { 5 5 - "main": { 6 6 - "type": "query", 7 7 - "parameters": { 8 8 - "type": "params", 9 9 - "required": [ 10 10 - "repo" 11 11 - ], 12 12 - "properties": { 13 13 - "repo": { 14 14 - "type": "string", 15 15 - "format": "at-uri" 16 16 - } 17 17 - } 18 18 - }, 19 19 - "output": { 20 20 - "encoding": "application/json", 21 21 - "schema": { 22 22 - "type": "object", 23 23 - "required": [ 24 24 - "secrets" 25 25 - ], 26 26 - "properties": { 27 27 - "secrets": { 28 28 - "type": "array", 29 29 - "items": { 30 30 - "type": "ref", 31 31 - "ref": "#secret" 32 32 - } 33 33 - } 34 34 - } 35 35 - } 36 36 - } 37 37 - }, 38 38 - "secret": { 39 39 - "type": "object", 40 40 - "required": [ 41 41 - "repo", 42 42 - "key", 43 43 - "createdAt", 44 44 - "createdBy" 45 45 - ], 46 46 - "properties": { 47 47 - "repo": { 48 48 - "type": "string", 49 49 - "format": "at-uri" 50 50 - }, 51 51 - "key": { 52 52 - "type": "string", 53 53 - "maxLength": 50, 54 54 - "minLength": 1 55 55 - }, 56 56 - "createdAt": { 57 57 - "type": "string", 58 58 - "format": "datetime" 59 59 - }, 60 60 - "createdBy": { 61 61 - "type": "string", 62 62 - "format": "did" 63 63 - } 64 64 - } 65 65 - } 66 66 - } 67 67 - }

+263

lexicons/pipeline/pipeline.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.pipeline", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "tid", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "triggerMetadata", 14 14 + "workflows" 15 15 + ], 16 16 + "properties": { 17 17 + "triggerMetadata": { 18 18 + "type": "ref", 19 19 + "ref": "#triggerMetadata" 20 20 + }, 21 21 + "workflows": { 22 22 + "type": "array", 23 23 + "items": { 24 24 + "type": "ref", 25 25 + "ref": "#workflow" 26 26 + } 27 27 + } 28 28 + } 29 29 + } 30 30 + }, 31 31 + "triggerMetadata": { 32 32 + "type": "object", 33 33 + "required": [ 34 34 + "kind", 35 35 + "repo" 36 36 + ], 37 37 + "properties": { 38 38 + "kind": { 39 39 + "type": "string", 40 40 + "enum": [ 41 41 + "push", 42 42 + "pull_request", 43 43 + "manual" 44 44 + ] 45 45 + }, 46 46 + "repo": { 47 47 + "type": "ref", 48 48 + "ref": "#triggerRepo" 49 49 + }, 50 50 + "push": { 51 51 + "type": "ref", 52 52 + "ref": "#pushTriggerData" 53 53 + }, 54 54 + "pullRequest": { 55 55 + "type": "ref", 56 56 + "ref": "#pullRequestTriggerData" 57 57 + }, 58 58 + "manual": { 59 59 + "type": "ref", 60 60 + "ref": "#manualTriggerData" 61 61 + } 62 62 + } 63 63 + }, 64 64 + "triggerRepo": { 65 65 + "type": "object", 66 66 + "required": [ 67 67 + "knot", 68 68 + "did", 69 69 + "repo", 70 70 + "defaultBranch" 71 71 + ], 72 72 + "properties": { 73 73 + "knot": { 74 74 + "type": "string" 75 75 + }, 76 76 + "did": { 77 77 + "type": "string", 78 78 + "format": "did" 79 79 + }, 80 80 + "repo": { 81 81 + "type": "string" 82 82 + }, 83 83 + "defaultBranch": { 84 84 + "type": "string" 85 85 + } 86 86 + } 87 87 + }, 88 88 + "pushTriggerData": { 89 89 + "type": "object", 90 90 + "required": [ 91 91 + "ref", 92 92 + "newSha", 93 93 + "oldSha" 94 94 + ], 95 95 + "properties": { 96 96 + "ref": { 97 97 + "type": "string" 98 98 + }, 99 99 + "newSha": { 100 100 + "type": "string", 101 101 + "minLength": 40, 102 102 + "maxLength": 40 103 103 + }, 104 104 + "oldSha": { 105 105 + "type": "string", 106 106 + "minLength": 40, 107 107 + "maxLength": 40 108 108 + } 109 109 + } 110 110 + }, 111 111 + "pullRequestTriggerData": { 112 112 + "type": "object", 113 113 + "required": [ 114 114 + "sourceBranch", 115 115 + "targetBranch", 116 116 + "sourceSha", 117 117 + "action" 118 118 + ], 119 119 + "properties": { 120 120 + "sourceBranch": { 121 121 + "type": "string" 122 122 + }, 123 123 + "targetBranch": { 124 124 + "type": "string" 125 125 + }, 126 126 + "sourceSha": { 127 127 + "type": "string", 128 128 + "minLength": 40, 129 129 + "maxLength": 40 130 130 + }, 131 131 + "action": { 132 132 + "type": "string" 133 133 + } 134 134 + } 135 135 + }, 136 136 + "manualTriggerData": { 137 137 + "type": "object", 138 138 + "properties": { 139 139 + "inputs": { 140 140 + "type": "array", 141 141 + "items": { 142 142 + "type": "ref", 143 143 + "ref": "#pair" 144 144 + } 145 145 + } 146 146 + } 147 147 + }, 148 148 + "workflow": { 149 149 + "type": "object", 150 150 + "required": [ 151 151 + "name", 152 152 + "dependencies", 153 153 + "steps", 154 154 + "environment", 155 155 + "clone" 156 156 + ], 157 157 + "properties": { 158 158 + "name": { 159 159 + "type": "string" 160 160 + }, 161 161 + "dependencies": { 162 162 + "type": "array", 163 163 + "items": { 164 164 + "type": "ref", 165 165 + "ref": "#dependency" 166 166 + } 167 167 + }, 168 168 + "steps": { 169 169 + "type": "array", 170 170 + "items": { 171 171 + "type": "ref", 172 172 + "ref": "#step" 173 173 + } 174 174 + }, 175 175 + "environment": { 176 176 + "type": "array", 177 177 + "items": { 178 178 + "type": "ref", 179 179 + "ref": "#pair" 180 180 + } 181 181 + }, 182 182 + "clone": { 183 183 + "type": "ref", 184 184 + "ref": "#cloneOpts" 185 185 + } 186 186 + } 187 187 + }, 188 188 + "dependency": { 189 189 + "type": "object", 190 190 + "required": [ 191 191 + "registry", 192 192 + "packages" 193 193 + ], 194 194 + "properties": { 195 195 + "registry": { 196 196 + "type": "string" 197 197 + }, 198 198 + "packages": { 199 199 + "type": "array", 200 200 + "items": { 201 201 + "type": "string" 202 202 + } 203 203 + } 204 204 + } 205 205 + }, 206 206 + "cloneOpts": { 207 207 + "type": "object", 208 208 + "required": [ 209 209 + "skip", 210 210 + "depth", 211 211 + "submodules" 212 212 + ], 213 213 + "properties": { 214 214 + "skip": { 215 215 + "type": "boolean" 216 216 + }, 217 217 + "depth": { 218 218 + "type": "integer" 219 219 + }, 220 220 + "submodules": { 221 221 + "type": "boolean" 222 222 + } 223 223 + } 224 224 + }, 225 225 + "step": { 226 226 + "type": "object", 227 227 + "required": [ 228 228 + "name", 229 229 + "command" 230 230 + ], 231 231 + "properties": { 232 232 + "name": { 233 233 + "type": "string" 234 234 + }, 235 235 + "command": { 236 236 + "type": "string" 237 237 + }, 238 238 + "environment": { 239 239 + "type": "array", 240 240 + "items": { 241 241 + "type": "ref", 242 242 + "ref": "#pair" 243 243 + } 244 244 + } 245 245 + } 246 246 + }, 247 247 + "pair": { 248 248 + "type": "object", 249 249 + "required": [ 250 250 + "key", 251 251 + "value" 252 252 + ], 253 253 + "properties": { 254 254 + "key": { 255 255 + "type": "string" 256 256 + }, 257 257 + "value": { 258 258 + "type": "string" 259 259 + } 260 260 + } 261 261 + } 262 262 + } 263 263 + }

-263

lexicons/pipeline.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.pipeline", 4 4 - "needsCbor": true, 5 5 - "needsType": true, 6 6 - "defs": { 7 7 - "main": { 8 8 - "type": "record", 9 9 - "key": "tid", 10 10 - "record": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "triggerMetadata", 14 14 - "workflows" 15 15 - ], 16 16 - "properties": { 17 17 - "triggerMetadata": { 18 18 - "type": "ref", 19 19 - "ref": "#triggerMetadata" 20 20 - }, 21 21 - "workflows": { 22 22 - "type": "array", 23 23 - "items": { 24 24 - "type": "ref", 25 25 - "ref": "#workflow" 26 26 - } 27 27 - } 28 28 - } 29 29 - } 30 30 - }, 31 31 - "triggerMetadata": { 32 32 - "type": "object", 33 33 - "required": [ 34 34 - "kind", 35 35 - "repo" 36 36 - ], 37 37 - "properties": { 38 38 - "kind": { 39 39 - "type": "string", 40 40 - "enum": [ 41 41 - "push", 42 42 - "pull_request", 43 43 - "manual" 44 44 - ] 45 45 - }, 46 46 - "repo": { 47 47 - "type": "ref", 48 48 - "ref": "#triggerRepo" 49 49 - }, 50 50 - "push": { 51 51 - "type": "ref", 52 52 - "ref": "#pushTriggerData" 53 53 - }, 54 54 - "pullRequest": { 55 55 - "type": "ref", 56 56 - "ref": "#pullRequestTriggerData" 57 57 - }, 58 58 - "manual": { 59 59 - "type": "ref", 60 60 - "ref": "#manualTriggerData" 61 61 - } 62 62 - } 63 63 - }, 64 64 - "triggerRepo": { 65 65 - "type": "object", 66 66 - "required": [ 67 67 - "knot", 68 68 - "did", 69 69 - "repo", 70 70 - "defaultBranch" 71 71 - ], 72 72 - "properties": { 73 73 - "knot": { 74 74 - "type": "string" 75 75 - }, 76 76 - "did": { 77 77 - "type": "string", 78 78 - "format": "did" 79 79 - }, 80 80 - "repo": { 81 81 - "type": "string" 82 82 - }, 83 83 - "defaultBranch": { 84 84 - "type": "string" 85 85 - } 86 86 - } 87 87 - }, 88 88 - "pushTriggerData": { 89 89 - "type": "object", 90 90 - "required": [ 91 91 - "ref", 92 92 - "newSha", 93 93 - "oldSha" 94 94 - ], 95 95 - "properties": { 96 96 - "ref": { 97 97 - "type": "string" 98 98 - }, 99 99 - "newSha": { 100 100 - "type": "string", 101 101 - "minLength": 40, 102 102 - "maxLength": 40 103 103 - }, 104 104 - "oldSha": { 105 105 - "type": "string", 106 106 - "minLength": 40, 107 107 - "maxLength": 40 108 108 - } 109 109 - } 110 110 - }, 111 111 - "pullRequestTriggerData": { 112 112 - "type": "object", 113 113 - "required": [ 114 114 - "sourceBranch", 115 115 - "targetBranch", 116 116 - "sourceSha", 117 117 - "action" 118 118 - ], 119 119 - "properties": { 120 120 - "sourceBranch": { 121 121 - "type": "string" 122 122 - }, 123 123 - "targetBranch": { 124 124 - "type": "string" 125 125 - }, 126 126 - "sourceSha": { 127 127 - "type": "string", 128 128 - "minLength": 40, 129 129 - "maxLength": 40 130 130 - }, 131 131 - "action": { 132 132 - "type": "string" 133 133 - } 134 134 - } 135 135 - }, 136 136 - "manualTriggerData": { 137 137 - "type": "object", 138 138 - "properties": { 139 139 - "inputs": { 140 140 - "type": "array", 141 141 - "items": { 142 142 - "type": "ref", 143 143 - "ref": "#pair" 144 144 - } 145 145 - } 146 146 - } 147 147 - }, 148 148 - "workflow": { 149 149 - "type": "object", 150 150 - "required": [ 151 151 - "name", 152 152 - "dependencies", 153 153 - "steps", 154 154 - "environment", 155 155 - "clone" 156 156 - ], 157 157 - "properties": { 158 158 - "name": { 159 159 - "type": "string" 160 160 - }, 161 161 - "dependencies": { 162 162 - "type": "array", 163 163 - "items": { 164 164 - "type": "ref", 165 165 - "ref": "#dependency" 166 166 - } 167 167 - }, 168 168 - "steps": { 169 169 - "type": "array", 170 170 - "items": { 171 171 - "type": "ref", 172 172 - "ref": "#step" 173 173 - } 174 174 - }, 175 175 - "environment": { 176 176 - "type": "array", 177 177 - "items": { 178 178 - "type": "ref", 179 179 - "ref": "#pair" 180 180 - } 181 181 - }, 182 182 - "clone": { 183 183 - "type": "ref", 184 184 - "ref": "#cloneOpts" 185 185 - } 186 186 - } 187 187 - }, 188 188 - "dependency": { 189 189 - "type": "object", 190 190 - "required": [ 191 191 - "registry", 192 192 - "packages" 193 193 - ], 194 194 - "properties": { 195 195 - "registry": { 196 196 - "type": "string" 197 197 - }, 198 198 - "packages": { 199 199 - "type": "array", 200 200 - "items": { 201 201 - "type": "string" 202 202 - } 203 203 - } 204 204 - } 205 205 - }, 206 206 - "cloneOpts": { 207 207 - "type": "object", 208 208 - "required": [ 209 209 - "skip", 210 210 - "depth", 211 211 - "submodules" 212 212 - ], 213 213 - "properties": { 214 214 - "skip": { 215 215 - "type": "boolean" 216 216 - }, 217 217 - "depth": { 218 218 - "type": "integer" 219 219 - }, 220 220 - "submodules": { 221 221 - "type": "boolean" 222 222 - } 223 223 - } 224 224 - }, 225 225 - "step": { 226 226 - "type": "object", 227 227 - "required": [ 228 228 - "name", 229 229 - "command" 230 230 - ], 231 231 - "properties": { 232 232 - "name": { 233 233 - "type": "string" 234 234 - }, 235 235 - "command": { 236 236 - "type": "string" 237 237 - }, 238 238 - "environment": { 239 239 - "type": "array", 240 240 - "items": { 241 241 - "type": "ref", 242 242 - "ref": "#pair" 243 243 - } 244 244 - } 245 245 - } 246 246 - }, 247 247 - "pair": { 248 248 - "type": "object", 249 249 - "required": [ 250 250 - "key", 251 251 - "value" 252 252 - ], 253 253 - "properties": { 254 254 - "key": { 255 255 - "type": "string" 256 256 - }, 257 257 - "value": { 258 258 - "type": "string" 259 259 - } 260 260 - } 261 261 - } 262 262 - } 263 263 - }

-31

lexicons/removeSecret.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.repo.removeSecret", 4 4 - "defs": { 5 5 - "main": { 6 6 - "type": "procedure", 7 7 - "description": "Remove a CI secret", 8 8 - "input": { 9 9 - "encoding": "application/json", 10 10 - "schema": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "repo", 14 14 - "key" 15 15 - ], 16 16 - "properties": { 17 17 - "repo": { 18 18 - "type": "string", 19 19 - "format": "at-uri" 20 20 - }, 21 21 - "key": { 22 22 - "type": "string", 23 23 - "maxLength": 50, 24 24 - "minLength": 1 25 25 - } 26 26 - } 27 27 - } 28 28 - } 29 29 - } 30 30 - } 31 31 - }

+37

lexicons/repo/addSecret.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo.addSecret", 4 4 + "defs": { 5 5 + "main": { 6 6 + "type": "procedure", 7 7 + "description": "Add a CI secret", 8 8 + "input": { 9 9 + "encoding": "application/json", 10 10 + "schema": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "repo", 14 14 + "key", 15 15 + "value" 16 16 + ], 17 17 + "properties": { 18 18 + "repo": { 19 19 + "type": "string", 20 20 + "format": "at-uri" 21 21 + }, 22 22 + "key": { 23 23 + "type": "string", 24 24 + "maxLength": 50, 25 25 + "minLength": 1 26 26 + }, 27 27 + "value": { 28 28 + "type": "string", 29 29 + "maxLength": 200, 30 30 + "minLength": 1 31 31 + } 32 32 + } 33 33 + } 34 34 + } 35 35 + } 36 36 + } 37 37 + }

+52

lexicons/repo/artifact.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo.artifact", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "tid", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "name", 14 14 + "repo", 15 15 + "tag", 16 16 + "createdAt", 17 17 + "artifact" 18 18 + ], 19 19 + "properties": { 20 20 + "name": { 21 21 + "type": "string", 22 22 + "description": "name of the artifact" 23 23 + }, 24 24 + "repo": { 25 25 + "type": "string", 26 26 + "format": "at-uri", 27 27 + "description": "repo that this artifact is being uploaded to" 28 28 + }, 29 29 + "tag": { 30 30 + "type": "bytes", 31 31 + "description": "hash of the tag object that this artifact is attached to (only annotated tags are supported)", 32 32 + "minLength": 20, 33 33 + "maxLength": 20 34 34 + }, 35 35 + "createdAt": { 36 36 + "type": "string", 37 37 + "format": "datetime", 38 38 + "description": "time of creation of this artifact" 39 39 + }, 40 40 + "artifact": { 41 41 + "type": "blob", 42 42 + "description": "the artifact", 43 43 + "accept": [ 44 44 + "*/*" 45 45 + ], 46 46 + "maxSize": 52428800 47 47 + } 48 48 + } 49 49 + } 50 50 + } 51 51 + } 52 52 + }

+36

lexicons/repo/collaborator.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo.collaborator", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "tid", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "subject", 14 14 + "repo", 15 15 + "createdAt" 16 16 + ], 17 17 + "properties": { 18 18 + "subject": { 19 19 + "type": "string", 20 20 + "format": "did" 21 21 + }, 22 22 + "repo": { 23 23 + "type": "string", 24 24 + "description": "repo to add this user to", 25 25 + "format": "at-uri" 26 26 + }, 27 27 + "createdAt": { 28 28 + "type": "string", 29 29 + "format": "datetime" 30 30 + } 31 31 + } 32 32 + } 33 33 + } 34 34 + } 35 35 + } 36 36 +

+29

lexicons/repo/defaultBranch.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo.setDefaultBranch", 4 4 + "defs": { 5 5 + "main": { 6 6 + "type": "procedure", 7 7 + "description": "Set the default branch for a repository", 8 8 + "input": { 9 9 + "encoding": "application/json", 10 10 + "schema": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "repo", 14 14 + "defaultBranch" 15 15 + ], 16 16 + "properties": { 17 17 + "repo": { 18 18 + "type": "string", 19 19 + "format": "at-uri" 20 20 + }, 21 21 + "defaultBranch": { 22 22 + "type": "string" 23 23 + } 24 24 + } 25 25 + } 26 26 + } 27 27 + } 28 28 + } 29 29 + }

+67

lexicons/repo/listSecrets.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo.listSecrets", 4 4 + "defs": { 5 5 + "main": { 6 6 + "type": "query", 7 7 + "parameters": { 8 8 + "type": "params", 9 9 + "required": [ 10 10 + "repo" 11 11 + ], 12 12 + "properties": { 13 13 + "repo": { 14 14 + "type": "string", 15 15 + "format": "at-uri" 16 16 + } 17 17 + } 18 18 + }, 19 19 + "output": { 20 20 + "encoding": "application/json", 21 21 + "schema": { 22 22 + "type": "object", 23 23 + "required": [ 24 24 + "secrets" 25 25 + ], 26 26 + "properties": { 27 27 + "secrets": { 28 28 + "type": "array", 29 29 + "items": { 30 30 + "type": "ref", 31 31 + "ref": "#secret" 32 32 + } 33 33 + } 34 34 + } 35 35 + } 36 36 + } 37 37 + }, 38 38 + "secret": { 39 39 + "type": "object", 40 40 + "required": [ 41 41 + "repo", 42 42 + "key", 43 43 + "createdAt", 44 44 + "createdBy" 45 45 + ], 46 46 + "properties": { 47 47 + "repo": { 48 48 + "type": "string", 49 49 + "format": "at-uri" 50 50 + }, 51 51 + "key": { 52 52 + "type": "string", 53 53 + "maxLength": 50, 54 54 + "minLength": 1 55 55 + }, 56 56 + "createdAt": { 57 57 + "type": "string", 58 58 + "format": "datetime" 59 59 + }, 60 60 + "createdBy": { 61 61 + "type": "string", 62 62 + "format": "did" 63 63 + } 64 64 + } 65 65 + } 66 66 + } 67 67 + }

+31

lexicons/repo/removeSecret.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo.removeSecret", 4 4 + "defs": { 5 5 + "main": { 6 6 + "type": "procedure", 7 7 + "description": "Remove a CI secret", 8 8 + "input": { 9 9 + "encoding": "application/json", 10 10 + "schema": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "repo", 14 14 + "key" 15 15 + ], 16 16 + "properties": { 17 17 + "repo": { 18 18 + "type": "string", 19 19 + "format": "at-uri" 20 20 + }, 21 21 + "key": { 22 22 + "type": "string", 23 23 + "maxLength": 50, 24 24 + "minLength": 1 25 25 + } 26 26 + } 27 27 + } 28 28 + } 29 29 + } 30 30 + } 31 31 + }

+54

lexicons/repo/repo.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.repo", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "tid", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "name", 14 14 + "knot", 15 15 + "owner", 16 16 + "createdAt" 17 17 + ], 18 18 + "properties": { 19 19 + "name": { 20 20 + "type": "string", 21 21 + "description": "name of the repo" 22 22 + }, 23 23 + "owner": { 24 24 + "type": "string", 25 25 + "format": "did" 26 26 + }, 27 27 + "knot": { 28 28 + "type": "string", 29 29 + "description": "knot where the repo was created" 30 30 + }, 31 31 + "spindle": { 32 32 + "type": "string", 33 33 + "description": "CI runner to send jobs to and receive results from" 34 34 + }, 35 35 + "description": { 36 36 + "type": "string", 37 37 + "format": "datetime", 38 38 + "minGraphemes": 1, 39 39 + "maxGraphemes": 140 40 40 + }, 41 41 + "source": { 42 42 + "type": "string", 43 43 + "format": "uri", 44 44 + "description": "source of the repo" 45 45 + }, 46 46 + "createdAt": { 47 47 + "type": "string", 48 48 + "format": "datetime" 49 49 + } 50 50 + } 51 51 + } 52 52 + } 53 53 + } 54 54 + }

-54

lexicons/repo.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.repo", 4 4 - "needsCbor": true, 5 5 - "needsType": true, 6 6 - "defs": { 7 7 - "main": { 8 8 - "type": "record", 9 9 - "key": "tid", 10 10 - "record": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "name", 14 14 - "knot", 15 15 - "owner", 16 16 - "createdAt" 17 17 - ], 18 18 - "properties": { 19 19 - "name": { 20 20 - "type": "string", 21 21 - "description": "name of the repo" 22 22 - }, 23 23 - "owner": { 24 24 - "type": "string", 25 25 - "format": "did" 26 26 - }, 27 27 - "knot": { 28 28 - "type": "string", 29 29 - "description": "knot where the repo was created" 30 30 - }, 31 31 - "spindle": { 32 32 - "type": "string", 33 33 - "description": "CI runner to send jobs to and receive results from" 34 34 - }, 35 35 - "description": { 36 36 - "type": "string", 37 37 - "format": "datetime", 38 38 - "minGraphemes": 1, 39 39 - "maxGraphemes": 140 40 40 - }, 41 41 - "source": { 42 42 - "type": "string", 43 43 - "format": "uri", 44 44 - "description": "source of the repo" 45 45 - }, 46 46 - "createdAt": { 47 47 - "type": "string", 48 48 - "format": "datetime" 49 49 - } 50 50 - } 51 51 - } 52 52 - } 53 53 - } 54 54 - }

+25

lexicons/spindle/spindle.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.spindle", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "any", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "createdAt" 14 14 + ], 15 15 + "properties": { 16 16 + "createdAt": { 17 17 + "type": "string", 18 18 + "format": "datetime" 19 19 + } 20 20 + } 21 21 + } 22 22 + } 23 23 + } 24 24 + } 25 25 +

-25

lexicons/spindle.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.spindle", 4 4 - "needsCbor": true, 5 5 - "needsType": true, 6 6 - "defs": { 7 7 - "main": { 8 8 - "type": "record", 9 9 - "key": "any", 10 10 - "record": { 11 11 - "type": "object", 12 12 - "required": [ 13 13 - "createdAt" 14 14 - ], 15 15 - "properties": { 16 16 - "createdAt": { 17 17 - "type": "string", 18 18 - "format": "datetime" 19 19 - } 20 20 - } 21 21 - } 22 22 - } 23 23 - } 24 24 - } 25 25 -

+40

lexicons/string/string.json

··· 1 1 + { 2 2 + "lexicon": 1, 3 3 + "id": "sh.tangled.string", 4 4 + "needsCbor": true, 5 5 + "needsType": true, 6 6 + "defs": { 7 7 + "main": { 8 8 + "type": "record", 9 9 + "key": "tid", 10 10 + "record": { 11 11 + "type": "object", 12 12 + "required": [ 13 13 + "filename", 14 14 + "description", 15 15 + "createdAt", 16 16 + "contents" 17 17 + ], 18 18 + "properties": { 19 19 + "filename": { 20 20 + "type": "string", 21 21 + "maxGraphemes": 140, 22 22 + "minGraphemes": 1 23 23 + }, 24 24 + "description": { 25 25 + "type": "string", 26 26 + "maxGraphemes": 280 27 27 + }, 28 28 + "createdAt": { 29 29 + "type": "string", 30 30 + "format": "datetime" 31 31 + }, 32 32 + "contents": { 33 33 + "type": "string", 34 34 + "minGraphemes": 1 35 35 + } 36 36 + } 37 37 + } 38 38 + } 39 39 + } 40 40 + }

+119 -59

nix/gomod2nix.toml

··· 11 11 version = "v0.6.2" 12 12 hash = "sha256-tVNWDUMILZbJvarcl/E7tpSnkn7urqgSHa2Eaka5vSU=" 13 13 [mod."github.com/ProtonMail/go-crypto"] 14 14 - version = "v1.2.0" 15 15 - hash = "sha256-5fKgWUz6BoyFNNZ1OD9QjhBrhNEBCuVfO2WqH+X59oo=" 14 14 + version = "v1.3.0" 15 15 + hash = "sha256-TUG+C4MyeWglOmiwiW2/NUVurFHXLgEPRd3X9uQ1NGI=" 16 16 + [mod."github.com/alecthomas/assert/v2"] 17 17 + version = "v2.11.0" 18 18 + hash = "sha256-tDJCDKZ0R4qNA7hgMKWrpDyogt1802LCJDBCExxdqaU=" 16 19 [mod."github.com/alecthomas/chroma/v2"] 17 20 version = "v2.19.0" 18 21 hash = "sha256-dxsu43a+PvHg2jYR0Tfys6a8x6IVR+9oCGAh+fvL3SM=" 19 22 replaced = "github.com/oppiliappan/chroma/v2" 23 23 + [mod."github.com/alecthomas/repr"] 24 24 + version = "v0.4.0" 25 25 + hash = "sha256-CyAzMSTfLGHDtfGXi91y7XMVpPUDNOKjsznb+osl9dU=" 20 26 [mod."github.com/anmitsu/go-shlex"] 21 27 version = "v0.0.0-20200514113438-38f4b401e2be" 22 28 hash = "sha256-L3Ak4X2z7WXq7vMKuiHCOJ29nlpajUQ08Sfb9T0yP54=" ··· 34 40 hash = "sha256-GWm5i1ukuBukV0GMF1rffpbOSSXZdfg6/0pABMiGzLQ=" 35 41 replaced = "tangled.sh/oppi.li/go-gitdiff" 36 42 [mod."github.com/bluesky-social/indigo"] 37 37 - version = "v0.0.0-20250520232546-236dd575c91e" 38 38 - hash = "sha256-SmwhGkAKcB/oGwYP68U5192fAUhui6D0GWYiJOeB1/0=" 43 43 + version = "v0.0.0-20250724221105-5827c8fb61bb" 44 44 + hash = "sha256-uDYmzP4/mT7xP62LIL4QIOlkaKWS/IT1uho+udyVOAI=" 39 45 [mod."github.com/bluesky-social/jetstream"] 40 46 version = "v0.0.0-20241210005130-ea96859b93d1" 41 47 hash = "sha256-AiapbrkjXboIKc5QNiWH0KyNs0zKnn6UlGwWFlkUfm0=" ··· 51 57 [mod."github.com/casbin/govaluate"] 52 58 version = "v1.3.0" 53 59 hash = "sha256-vDUFEGt8oL4n/PHwlMZPjmaLvcpGTN4HEIRGl2FPxUA=" 60 60 + [mod."github.com/cenkalti/backoff/v4"] 61 61 + version = "v4.3.0" 62 62 + hash = "sha256-wfVjNZsGG1WoNC5aL+kdcy6QXPgZo4THAevZ1787md8=" 54 63 [mod."github.com/cespare/xxhash/v2"] 55 64 version = "v2.3.0" 56 65 hash = "sha256-7hRlwSR+fos1kx4VZmJ/7snR7zHh8ZFKX+qqqqGcQpY=" 57 66 [mod."github.com/cloudflare/circl"] 58 58 - version = "v1.6.0" 59 59 - hash = "sha256-a+SVfnHYC8Fb+NQLboNg5P9sry+WutzuNetVHFVAAo0=" 67 67 + version = "v1.6.2-0.20250618153321-aa837fd1539d" 68 68 + hash = "sha256-0s/i/XmMcuvPQ+qK9OIU5KxwYZyLVXRtdlYvIXRJT3Y=" 60 69 [mod."github.com/containerd/errdefs"] 61 70 version = "v1.0.0" 62 71 hash = "sha256-wMZGoeqvRhuovYCJx0Js4P3qFCNTZ/6Atea/kNYoPMI=" ··· 105 114 [mod."github.com/felixge/httpsnoop"] 106 115 version = "v1.0.4" 107 116 hash = "sha256-c1JKoRSndwwOyOxq9ddCe+8qn7mG9uRq2o/822x5O/c=" 117 117 + [mod."github.com/fsnotify/fsnotify"] 118 118 + version = "v1.6.0" 119 119 + hash = "sha256-DQesOCweQPEwmAn6s7DCP/Dwy8IypC+osbpfsvpkdP0=" 108 120 [mod."github.com/gliderlabs/ssh"] 109 121 version = "v0.3.8" 110 122 hash = "sha256-FW+91qCB3rfTm0I1VmqfwA7o+2kDys2JHOudKKyxWwc=" ··· 127 139 version = "v5.17.0" 128 140 hash = "sha256-gya68abB6GtejUqr60DyU7NIGtNzHQVCAeDTYKk1evQ=" 129 141 replaced = "github.com/oppiliappan/go-git/v5" 142 142 + [mod."github.com/go-jose/go-jose/v3"] 143 143 + version = "v3.0.4" 144 144 + hash = "sha256-RrLHCu9l6k0XVobdZQJ9Sx/VTQcWjrdLR5BEG7yXTEQ=" 130 145 [mod."github.com/go-logr/logr"] 131 131 - version = "v1.4.2" 132 132 - hash = "sha256-/W6qGilFlZNTb9Uq48xGZ4IbsVeSwJiAMLw4wiNYHLI=" 146 146 + version = "v1.4.3" 147 147 + hash = "sha256-Nnp/dEVNMxLp3RSPDHZzGbI8BkSNuZMX0I0cjWKXXLA=" 133 148 [mod."github.com/go-logr/stdr"] 134 149 version = "v1.2.2" 135 150 hash = "sha256-rRweAP7XIb4egtT1f2gkz4sYOu7LDHmcJ5iNsJUd0sE=" 136 151 [mod."github.com/go-redis/cache/v9"] 137 152 version = "v9.0.0" 138 153 hash = "sha256-b4S3K4KoZhF0otw6FRIOq/PTdHGrb/LumB4GKo4khsY=" 154 154 + [mod."github.com/go-test/deep"] 155 155 + version = "v1.1.1" 156 156 + hash = "sha256-WvPrTvUPmbQb4R6DrvSB9O3zm0IOk+n14YpnSl2deR8=" 139 157 [mod."github.com/goccy/go-json"] 140 158 version = "v0.10.5" 141 159 hash = "sha256-/EtlGihP0/7oInzMC5E0InZ4b5Ad3s4xOpqotloi3xw=" ··· 143 161 version = "v1.3.2" 144 162 hash = "sha256-pogILFrrk+cAtb0ulqn9+gRZJ7sGnnLLdtqITvxvG6c=" 145 163 [mod."github.com/golang-jwt/jwt/v5"] 146 146 - version = "v5.2.2" 147 147 - hash = "sha256-C0MhDguxWR6dQUrNVQ5xaFUReSV6CVEBAijG3b4wnX4=" 164 164 + version = "v5.2.3" 165 165 + hash = "sha256-dY2avNPPS3xokn5E+VCLxXcQk7DsM7err2QGrG0nXKo=" 148 166 [mod."github.com/golang/groupcache"] 149 167 version = "v0.0.0-20241129210726-2c02b8208cf8" 150 168 hash = "sha256-AdLZ3dJLe/yduoNvZiXugZxNfmwJjNQyQGsIdzYzH74=" 169 169 + [mod."github.com/golang/mock"] 170 170 + version = "v1.6.0" 171 171 + hash = "sha256-fWdnMQisRbiRzGT3ISrUHovquzLRHWvcv1JEsJFZRno=" 151 172 [mod."github.com/google/uuid"] 152 173 version = "v1.6.0" 153 174 hash = "sha256-VWl9sqUzdOuhW0KzQlv0gwwUQClYkmZwSydHG2sALYw=" ··· 161 182 version = "v1.4.0" 162 183 hash = "sha256-cLK2z1uOEz7Wah/LclF65ptYMqzuvaRnfIGYqtn3b7g=" 163 184 [mod."github.com/gorilla/websocket"] 164 164 - version = "v1.5.3" 165 165 - hash = "sha256-vTIGEFMEi+30ZdO6ffMNJ/kId6pZs5bbyqov8xe9BM0=" 185 185 + version = "v1.5.4-0.20250319132907-e064f32e3674" 186 186 + hash = "sha256-a8n6oe20JDpwThClgAyVhJDi6QVaS0qzT4PvRxlQ9to=" 187 187 + [mod."github.com/hashicorp/errwrap"] 188 188 + version = "v1.1.0" 189 189 + hash = "sha256-6lwuMQOfBq+McrViN3maJTIeh4f8jbEqvLy2c9FvvFw=" 166 190 [mod."github.com/hashicorp/go-cleanhttp"] 167 191 version = "v0.5.2" 168 192 hash = "sha256-N9GOKYo7tK6XQUFhvhImtL7PZW/mr4C4Manx/yPVvcQ=" 193 193 + [mod."github.com/hashicorp/go-multierror"] 194 194 + version = "v1.1.1" 195 195 + hash = "sha256-ANzPEUJIZIlToxR89Mn7Db73d9LGI51ssy7eNnUgmlA=" 169 196 [mod."github.com/hashicorp/go-retryablehttp"] 170 170 - version = "v0.7.7" 171 171 - hash = "sha256-XZjxncyLPwy6YBHR3DF5bEl1y72or0JDUncTIsb/eIU=" 197 197 + version = "v0.7.8" 198 198 + hash = "sha256-4LZwKaFBbpKi9lSq5y6lOlYHU6WMnQdGNMxTd33rN80=" 199 199 + [mod."github.com/hashicorp/go-secure-stdlib/parseutil"] 200 200 + version = "v0.2.0" 201 201 + hash = "sha256-mb27ZKw5VDTmNj1QJvxHVR0GyY7UdacLJ0jWDV3nQd8=" 202 202 + [mod."github.com/hashicorp/go-secure-stdlib/strutil"] 203 203 + version = "v0.1.2" 204 204 + hash = "sha256-UmCMzjamCW1d9KNvNzELqKf1ElHOXPz+ZtdJkI+DV0A=" 205 205 + [mod."github.com/hashicorp/go-sockaddr"] 206 206 + version = "v1.0.7" 207 207 + hash = "sha256-p6eDOrGzN1jMmT/F/f/VJMq0cKNFhUcEuVVwTE6vSrs=" 172 208 [mod."github.com/hashicorp/golang-lru"] 173 209 version = "v1.0.2" 174 210 hash = "sha256-yy+5botc6T5wXgOe2mfNXJP3wr+MkVlUZ2JBkmmrA48=" 175 211 [mod."github.com/hashicorp/golang-lru/v2"] 176 212 version = "v2.0.7" 177 213 hash = "sha256-t1bcXLgrQNOYUVyYEZ0knxcXpsTk4IuJZDjKvyJX75g=" 214 214 + [mod."github.com/hashicorp/hcl"] 215 215 + version = "v1.0.1-vault-7" 216 216 + hash = "sha256-xqYtjCJQVsg04Yj2Uy2Q5bi6X6cDRYhJD/SUEWaHMDM=" 217 217 + [mod."github.com/hexops/gotextdiff"] 218 218 + version = "v1.0.3" 219 219 + hash = "sha256-wVs5uJs2KHU1HnDCDdSe0vIgNZylvs8oNidDxwA3+O0=" 178 220 [mod."github.com/hiddeco/sshsig"] 179 221 version = "v0.2.0" 180 222 hash = "sha256-Yc8Ip4XxrL5plb7Lq0ziYFznteVDZnskoyOZDIMsWOU=" ··· 185 227 version = "v0.0.4" 186 228 hash = "sha256-4k778kBlNul2Rc4xuNQ9WA4kT0V7x5X9odZrT+2xjTU=" 187 229 [mod."github.com/ipfs/boxo"] 188 188 - version = "v0.30.0" 189 189 - hash = "sha256-PWH+nlIZZlqB/PuiBX9X4McLZF4gKR1MEnjvutKT848=" 230 230 + version = "v0.33.0" 231 231 + hash = "sha256-C85D/TjyoWNKvRFvl2A9hBjpDPhC//hGB2jRoDmXM38=" 190 232 [mod."github.com/ipfs/go-block-format"] 191 191 - version = "v0.2.1" 192 192 - hash = "sha256-npEV0Axe6zJlzN00/GwiegE9HKsuDR6RhsAfPyphOl8=" 233 233 + version = "v0.2.2" 234 234 + hash = "sha256-kz87tlGneqEARGnjA1Lb0K5CqD1lgxhBD68rfmzZZGU=" 193 235 [mod."github.com/ipfs/go-cid"] 194 236 version = "v0.5.0" 195 237 hash = "sha256-BuZKkcBXrnx7mM1c9SP4LdzZoaAoai9U49vITGrYJQk=" ··· 203 245 version = "v1.1.1" 204 246 hash = "sha256-cpEohOsf4afYRGTdsWh84TCVGIDzJo2hSjWy7NtNtvY=" 205 247 [mod."github.com/ipfs/go-ipld-cbor"] 206 206 - version = "v0.2.0" 207 207 - hash = "sha256-bvHFCIQqim3/+xzl1bld3NxKY8WoeCO3HpdTfUsXvlc=" 248 248 + version = "v0.2.1" 249 249 + hash = "sha256-ONBX/YO/knnmp+12fC13KsKVeo/vdWOI3SDyqCBxRE4=" 208 250 [mod."github.com/ipfs/go-ipld-format"] 209 209 - version = "v0.6.1" 210 210 - hash = "sha256-v1zLYYGaoDxsgOW5joQGWHEHZoJjIXc6tLVgTomZ2z4=" 251 251 + version = "v0.6.2" 252 252 + hash = "sha256-nGLM/n/hy+0q1VIzQUvF4D3aKvL238ALIEziQQhVMkU=" 211 253 [mod."github.com/ipfs/go-log"] 212 254 version = "v1.0.5" 213 255 hash = "sha256-WQarHZo2y/rH6ixLsOlN5fFZeLUqsOTMnvdxszP2Qj4=" ··· 224 266 version = "v1.18.0" 225 267 hash = "sha256-jc5pMU/HCBFOShMcngVwNMhz9wolxjOb579868LtOuk=" 226 268 [mod."github.com/klauspost/cpuid/v2"] 227 227 - version = "v2.2.10" 228 228 - hash = "sha256-o21Tk5sD7WhhLUoqSkymnjLbzxl0mDJCTC1ApfZJrC0=" 269 269 + version = "v2.3.0" 270 270 + hash = "sha256-50JhbQyT67BK38HIdJihPtjV7orYp96HknI2VP7A9Yc=" 229 271 [mod."github.com/lestrrat-go/blackmagic"] 230 230 - version = "v1.0.3" 231 231 - hash = "sha256-1wyfD6fPopJF/UmzfAEa0N1zuUzVuHIpdcxks1kqxxw=" 272 272 + version = "v1.0.4" 273 273 + hash = "sha256-HmWOpwoPDNMwLdOi7onNn3Sb+ZsAa3Ai3gVBbXmQ0e8=" 232 274 [mod."github.com/lestrrat-go/httpcc"] 233 275 version = "v1.0.1" 234 276 hash = "sha256-SMRSwJpqDIs/xL0l2e8vP0W65qtCHX2wigcOeqPJmos=" ··· 256 298 [mod."github.com/minio/sha256-simd"] 257 299 version = "v1.0.1" 258 300 hash = "sha256-4hfGDIQaWq8fvtGzHDhoK9v2IocXnJY7OAL6saMJbmA=" 301 301 + [mod."github.com/mitchellh/mapstructure"] 302 302 + version = "v1.5.0" 303 303 + hash = "sha256-ztVhGQXs67MF8UadVvG72G3ly0ypQW0IRDdOOkjYwoE=" 259 304 [mod."github.com/moby/docker-image-spec"] 260 305 version = "v1.3.1" 261 306 hash = "sha256-xwSNLmMagzywdGJIuhrWl1r7cIWBYCOMNYbuDDT6Jhs=" ··· 289 334 [mod."github.com/munnerz/goautoneg"] 290 335 version = "v0.0.0-20191010083416-a7dc8b61c822" 291 336 hash = "sha256-79URDDFenmGc9JZu+5AXHToMrtTREHb3BC84b/gym9Q=" 337 337 + [mod."github.com/onsi/gomega"] 338 338 + version = "v1.37.0" 339 339 + hash = "sha256-PfHFYp365MwBo+CUZs+mN5QEk3Kqe9xrBX+twWfIc9o=" 340 340 + [mod."github.com/openbao/openbao/api/v2"] 341 341 + version = "v2.3.0" 342 342 + hash = "sha256-1bIyvL3GdzPUfsM+gxuKMaH5jKxMaucZQgL6/DfbmDM=" 292 343 [mod."github.com/opencontainers/go-digest"] 293 344 version = "v1.0.0" 294 345 hash = "sha256-cfVDjHyWItmUGZ2dzQhCHgmOmou8v7N+itDkLZVkqkQ=" ··· 296 347 version = "v1.1.1" 297 348 hash = "sha256-bxBjtl+6846Ed3QHwdssOrNvlHV6b+Dn17zPISSQGP8=" 298 349 [mod."github.com/opentracing/opentracing-go"] 299 299 - version = "v1.2.0" 300 300 - hash = "sha256-kKTKFGXOsCF6QdVzI++GgaRzv2W+kWq5uDXOJChvLxM=" 350 350 + version = "v1.2.1-0.20220228012449-10b1cf09e00b" 351 351 + hash = "sha256-77oWcDviIoGWHVAotbgmGRpLGpH5AUy+pM15pl3vRrw=" 301 352 [mod."github.com/pjbgf/sha1cd"] 302 353 version = "v0.3.2" 303 354 hash = "sha256-jdbiRhU8xc1C5c8m7BSCj71PUXHY3f7TWFfxDKKpUMk=" ··· 320 371 version = "v0.6.2" 321 372 hash = "sha256-q6Fh6v8iNJN9ypD47LjWmx66YITa3FyRjZMRsuRTFeQ=" 322 373 [mod."github.com/prometheus/common"] 323 323 - version = "v0.63.0" 324 324 - hash = "sha256-TbUZNkN4ZA7eC/MlL1v2V5OL28QRnftSuaWQZ944zBE=" 374 374 + version = "v0.64.0" 375 375 + hash = "sha256-uy3KO60F2Cvhamz3fWQALGSsy13JiTk3NfpXgRuwqtI=" 325 376 [mod."github.com/prometheus/procfs"] 326 377 version = "v0.16.1" 327 378 hash = "sha256-OBCvKlLW2obct35p0L9Q+1ZrxZjpTmbgHMP2rng9hpo=" 328 379 [mod."github.com/redis/go-redis/v9"] 329 329 - version = "v9.3.0" 330 330 - hash = "sha256-PNXDX3BH92d2jL/AkdK0eWMorh387Y6duwYNhsqNe+w=" 380 380 + version = "v9.7.3" 381 381 + hash = "sha256-7ip5Ns/NEnFmVLr5iN8m3gS4RrzVAYJ7pmJeeaTmjjo=" 331 382 [mod."github.com/resend/resend-go/v2"] 332 383 version = "v2.15.0" 333 384 hash = "sha256-1lMoxuMLQXaNWFKadS6rpztAKwvIl3/LWMXqw7f5WYg=" 385 385 + [mod."github.com/ryanuber/go-glob"] 386 386 + version = "v1.0.0" 387 387 + hash = "sha256-YkMl1utwUhi3E0sHK23ISpAsPyj4+KeXyXKoFYGXGVY=" 334 388 [mod."github.com/segmentio/asm"] 335 389 version = "v1.2.0" 336 390 hash = "sha256-zbNuKxNrUDUc6IlmRQNuJQzVe5Ol/mqp7srDg9IMMqs=" ··· 375 429 version = "v1.1.0" 376 430 hash = "sha256-cA9qCCu8P1NSJRxgmpfkfa5rKyn9X+Y/9FSmSd5xjyo=" 377 431 [mod."go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"] 378 378 - version = "v0.61.0" 379 379 - hash = "sha256-4pfXD7ErXhexSynXiEEQSAkWoPwHd7PEDE3M1Zi5gLM=" 432 432 + version = "v0.62.0" 433 433 + hash = "sha256-WcDogpsvFxGOVqc+/ljlZ10nrOU2q0rPteukGyWWmfc=" 380 434 [mod."go.opentelemetry.io/otel"] 381 381 - version = "v1.36.0" 382 382 - hash = "sha256-j8wojdCtKal3LKojanHA8KXXQ0FkbWONpO8tUxpJDko=" 435 435 + version = "v1.37.0" 436 436 + hash = "sha256-zWpyp9K8/Te86uhNjamchZctTdAnmHhoVw9m4ACfSoo=" 437 437 + [mod."go.opentelemetry.io/otel/exporters/otlp/otlptrace"] 438 438 + version = "v1.33.0" 439 439 + hash = "sha256-D5BMzmtN1d3pRnxIcvDOyQrjerK1JoavtYjJLhPKv/I=" 383 440 [mod."go.opentelemetry.io/otel/metric"] 384 384 - version = "v1.36.0" 385 385 - hash = "sha256-z6Uqi4HhUljWIYd58svKK5MqcGbpcac+/M8JeTrUtJ8=" 441 441 + version = "v1.37.0" 442 442 + hash = "sha256-BWnkdldA3xzGhnaConzMAuQzOnugytIvrP6GjkZVAYg=" 386 443 [mod."go.opentelemetry.io/otel/trace"] 387 387 - version = "v1.36.0" 388 388 - hash = "sha256-owWD9x1lp8aIJqYt058BXPUsIMHdk3RI0escso0BxwA=" 444 444 + version = "v1.37.0" 445 445 + hash = "sha256-FBeLOb5qmIiE9VmbgCf1l/xpndBqHkRiaPt1PvoKrVY=" 389 446 [mod."go.opentelemetry.io/proto/otlp"] 390 447 version = "v1.6.0" 391 448 hash = "sha256-1kjkJ9cqkvx3ib6ytLcw+Adp4xqD3ShF97lpzt/BeCg=" ··· 399 456 version = "v1.27.0" 400 457 hash = "sha256-8655KDrulc4Das3VRduO9MjCn8ZYD5WkULjCvruaYsU=" 401 458 [mod."golang.org/x/crypto"] 402 402 - version = "v0.38.0" 403 403 - hash = "sha256-5tTXlXQBlfW1sSNDAIalOpsERbTJlZqbwCIiih4T4rY=" 459 459 + version = "v0.40.0" 460 460 + hash = "sha256-I6p2fqvz63P9MwAuoQrljI7IUbfZQvCem0ii4Q2zZng=" 404 461 [mod."golang.org/x/exp"] 405 405 - version = "v0.0.0-20250408133849-7e4ce0ab07d0" 406 406 - hash = "sha256-Lw/WupSM8gcq0JzPSAaBqj9l1uZ68ANhaIaQzPhRpy8=" 462 462 + version = "v0.0.0-20250620022241-b7579e27df2b" 463 463 + hash = "sha256-IsDTeuWLj4UkPO4NhWTvFeZ22WNtlxjoWiyAJh6zdig=" 407 464 [mod."golang.org/x/net"] 408 408 - version = "v0.40.0" 409 409 - hash = "sha256-BhDOHTP8RekXDQDf9HlORSmI2aPacLo53fRXtTgCUH8=" 465 465 + version = "v0.42.0" 466 466 + hash = "sha256-YxileisIIez+kcAI+21kY5yk0iRuEqti2YdmS8jvP2s=" 410 467 [mod."golang.org/x/sync"] 411 411 - version = "v0.14.0" 412 412 - hash = "sha256-YNQLeFMeXN9y0z4OyXV/LJ4hA54q+ljm1ytcy80O6r4=" 468 468 + version = "v0.16.0" 469 469 + hash = "sha256-sqKDRESeMzLe0jWGWltLZL/JIgrn0XaIeBWCzVN3Bks=" 413 470 [mod."golang.org/x/sys"] 414 414 - version = "v0.33.0" 415 415 - hash = "sha256-wlOzIOUgAiGAtdzhW/KPl/yUVSH/lvFZfs5XOuJ9LOQ=" 471 471 + version = "v0.34.0" 472 472 + hash = "sha256-5rZ7p8IaGli5X1sJbfIKOcOEwY4c0yQhinJPh2EtK50=" 473 473 + [mod."golang.org/x/text"] 474 474 + version = "v0.27.0" 475 475 + hash = "sha256-VX0rOh6L3qIvquKSGjfZQFU8URNtGvkNvxE7OZtboW8=" 416 476 [mod."golang.org/x/time"] 417 417 - version = "v0.8.0" 418 418 - hash = "sha256-EA+qRisDJDPQ2g4pcfP4RyQaB7CJKkAn68EbNfBzXdQ=" 477 477 + version = "v0.12.0" 478 478 + hash = "sha256-Cp3oxrCMH2wyxjzr5SHVmyhgaoUuSl56Uy00Q7DYEpw=" 419 479 [mod."golang.org/x/xerrors"] 420 480 version = "v0.0.0-20240903120638-7835f813f4da" 421 481 hash = "sha256-bE7CcrnAvryNvM26ieJGXqbAtuLwHaGcmtVMsVnksqo=" 422 482 [mod."google.golang.org/genproto/googleapis/api"] 423 423 - version = "v0.0.0-20250519155744-55703ea1f237" 424 424 - hash = "sha256-ivktx8ipWgWZgchh4FjKoWL7kU8kl/TtIavtZq/F5SQ=" 483 483 + version = "v0.0.0-20250603155806-513f23925822" 484 484 + hash = "sha256-0CS432v9zVhkVLqFpZtxBX8rvVqP67lb7qQ3es7RqIU=" 425 485 [mod."google.golang.org/genproto/googleapis/rpc"] 426 426 - version = "v0.0.0-20250519155744-55703ea1f237" 486 486 + version = "v0.0.0-20250603155806-513f23925822" 427 487 hash = "sha256-WK7iDtAhH19NPe3TywTQlGjDawNaDKWnxhFL9PgVUwM=" 428 488 [mod."google.golang.org/grpc"] 429 429 - version = "v1.72.1" 430 430 - hash = "sha256-5JczomNvroKWtIYKDgXwaIaEfuNEK//MHPhJQiaxMXs=" 489 489 + version = "v1.73.0" 490 490 + hash = "sha256-LfVlwip++q2DX70RU6CxoXglx1+r5l48DwlFD05G11c=" 431 491 [mod."google.golang.org/protobuf"] 432 492 version = "v1.36.6" 433 493 hash = "sha256-lT5qnefI5FDJnowz9PEkAGylH3+fE+A3DJDkAyy9RMc=" ··· 450 510 version = "v1.4.1" 451 511 hash = "sha256-HaZGo9L44ptPsgxIhvKy3+0KZZm1+xt+cZC1rDQA9Yc=" 452 512 [mod."tangled.sh/icyphox.sh/atproto-oauth"] 453 453 - version = "v0.0.0-20250526154904-3906c5336421" 454 454 - hash = "sha256-CvR8jic0YZfj0a8ubPj06FiMMR/1K9kHoZhLQw1LItM=" 513 513 + version = "v0.0.0-20250724194903-28e660378cb1" 514 514 + hash = "sha256-z7huwCTTHqLb1hxQW62lz9GQ3Orqt4URfeOVhQVd1f8="

+32 -1

nix/modules/knot.nix

··· 58 58 }; 59 59 }; 60 60 61 61 + motd = mkOption { 62 62 + type = types.nullOr types.str; 63 63 + default = null; 64 64 + description = '' 65 65 + Message of the day 66 66 + 67 67 + The contents are shown as-is; eg. you will want to add a newline if 68 68 + setting a non-empty message since the knot won't do this for you. 69 69 + ''; 70 70 + }; 71 71 + 72 72 + motdFile = mkOption { 73 73 + type = types.nullOr types.path; 74 74 + default = null; 75 75 + description = '' 76 76 + File containing message of the day 77 77 + 78 78 + The contents are shown as-is; eg. you will want to add a newline if 79 79 + setting a non-empty message since the knot won't do this for you. 80 80 + ''; 81 81 + }; 82 82 + 61 83 server = { 62 84 listenAddr = mkOption { 63 85 type = types.str; ··· 104 126 cfg.package 105 127 ]; 106 128 107 107 - system.activationScripts.gitConfig = '' 129 129 + system.activationScripts.gitConfig = let 130 130 + setMotd = 131 131 + if cfg.motdFile != null && cfg.motd != null 132 132 + then throw "motdFile and motd cannot be both set" 133 133 + else '' 134 134 + ${optionalString (cfg.motdFile != null) "cat ${cfg.motdFile} > ${cfg.stateDir}/motd"} 135 135 + ${optionalString (cfg.motd != null) ''printf "${cfg.motd}" > ${cfg.stateDir}/motd''} 136 136 + ''; 137 137 + in '' 108 138 mkdir -p "${cfg.repo.scanPath}" 109 139 chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.repo.scanPath}" 110 140 ··· 116 146 [receive] 117 147 advertisePushOptions = true 118 148 EOF 149 149 + ${setMotd} 119 150 chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.stateDir}" 120 151 ''; 121 152

+1

nix/vm.nix

··· 48 48 ]; 49 49 services.tangled-knot = { 50 50 enable = true; 51 51 + motd = "Welcome to the development knot!\n"; 51 52 server = { 52 53 secretFile = "/var/lib/knot/secret"; 53 54 hostname = "localhost:6000";

+23 -6

spindle/config/config.go

··· 2 2 3 3 import ( 4 4 "context" 5 5 + "fmt" 5 6 7 7 + "github.com/bluesky-social/indigo/atproto/syntax" 6 8 "github.com/sethvargo/go-envconfig" 7 9 ) 8 10 9 11 type Server struct { 10 10 - ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"` 11 11 - DBPath string `env:"DB_PATH, default=spindle.db"` 12 12 - Hostname string `env:"HOSTNAME, required"` 13 13 - JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"` 14 14 - Dev bool `env:"DEV, default=false"` 15 15 - Owner string `env:"OWNER, required"` 12 12 + ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"` 13 13 + DBPath string `env:"DB_PATH, default=spindle.db"` 14 14 + Hostname string `env:"HOSTNAME, required"` 15 15 + JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"` 16 16 + Dev bool `env:"DEV, default=false"` 17 17 + Owner string `env:"OWNER, required"` 18 18 + Secrets Secrets `env:",prefix=SECRETS_"` 19 19 + } 20 20 + 21 21 + func (s Server) Did() syntax.DID { 22 22 + return syntax.DID(fmt.Sprintf("did:web:%s", s.Hostname)) 23 23 + } 24 24 + 25 25 + type Secrets struct { 26 26 + Provider string `env:"PROVIDER, default=sqlite"` 27 27 + OpenBao OpenBaoConfig `env:",prefix=OPENBAO_"` 28 28 + } 29 29 + 30 30 + type OpenBaoConfig struct { 31 31 + ProxyAddr string `env:"PROXY_ADDR, default=http://127.0.0.1:8200"` 32 32 + Mount string `env:"MOUNT, default=spindle"` 16 33 } 17 34 18 35 type Pipelines struct {

+42 -19

spindle/engine/engine.go

··· 11 11 "sync" 12 12 "time" 13 13 14 14 + securejoin "github.com/cyphar/filepath-securejoin" 14 15 "github.com/docker/docker/api/types/container" 15 16 "github.com/docker/docker/api/types/image" 16 17 "github.com/docker/docker/api/types/mount" ··· 18 19 "github.com/docker/docker/api/types/volume" 19 20 "github.com/docker/docker/client" 20 21 "github.com/docker/docker/pkg/stdcopy" 22 22 + "golang.org/x/sync/errgroup" 21 23 "tangled.sh/tangled.sh/core/log" 22 24 "tangled.sh/tangled.sh/core/notifier" 23 25 "tangled.sh/tangled.sh/core/spindle/config" 24 26 "tangled.sh/tangled.sh/core/spindle/db" 25 27 "tangled.sh/tangled.sh/core/spindle/models" 28 28 + "tangled.sh/tangled.sh/core/spindle/secrets" 26 29 ) 27 30 28 31 const ( ··· 37 40 db *db.DB 38 41 n *notifier.Notifier 39 42 cfg *config.Config 43 43 + vault secrets.Manager 40 44 41 45 cleanupMu sync.Mutex 42 46 cleanup map[string][]cleanupFunc 43 47 } 44 48 45 45 - func New(ctx context.Context, cfg *config.Config, db *db.DB, n *notifier.Notifier) (*Engine, error) { 49 49 + func New(ctx context.Context, cfg *config.Config, db *db.DB, n *notifier.Notifier, vault secrets.Manager) (*Engine, error) { 46 50 dcli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation()) 47 51 if err != nil { 48 52 return nil, err ··· 56 60 db: db, 57 61 n: n, 58 62 cfg: cfg, 63 63 + vault: vault, 59 64 } 60 65 61 66 e.cleanup = make(map[string][]cleanupFunc) ··· 66 71 func (e *Engine) StartWorkflows(ctx context.Context, pipeline *models.Pipeline, pipelineId models.PipelineId) { 67 72 e.l.Info("starting all workflows in parallel", "pipeline", pipelineId) 68 73 69 69 - wg := sync.WaitGroup{} 74 74 + // extract secrets 75 75 + var allSecrets []secrets.UnlockedSecret 76 76 + if didSlashRepo, err := securejoin.SecureJoin(pipeline.RepoOwner, pipeline.RepoName); err == nil { 77 77 + if res, err := e.vault.GetSecretsUnlocked(ctx, secrets.DidSlashRepo(didSlashRepo)); err == nil { 78 78 + allSecrets = res 79 79 + } 80 80 + } 81 81 + 82 82 + workflowTimeoutStr := e.cfg.Pipelines.WorkflowTimeout 83 83 + workflowTimeout, err := time.ParseDuration(workflowTimeoutStr) 84 84 + if err != nil { 85 85 + e.l.Error("failed to parse workflow timeout", "error", err, "timeout", workflowTimeoutStr) 86 86 + workflowTimeout = 5 * time.Minute 87 87 + } 88 88 + e.l.Info("using workflow timeout", "timeout", workflowTimeout) 89 89 + 90 90 + eg, ctx := errgroup.WithContext(ctx) 70 91 for _, w := range pipeline.Workflows { 71 71 - wg.Add(1) 72 72 - go func() error { 73 73 - defer wg.Done() 92 92 + eg.Go(func() error { 74 93 wid := models.WorkflowId{ 75 94 PipelineId: pipelineId, 76 95 Name: w.Name, ··· 102 121 defer reader.Close() 103 122 io.Copy(os.Stdout, reader) 104 123 105 105 - workflowTimeoutStr := e.cfg.Pipelines.WorkflowTimeout 106 106 - workflowTimeout, err := time.ParseDuration(workflowTimeoutStr) 107 107 - if err != nil { 108 108 - e.l.Error("failed to parse workflow timeout", "error", err, "timeout", workflowTimeoutStr) 109 109 - workflowTimeout = 5 * time.Minute 110 110 - } 111 111 - e.l.Info("using workflow timeout", "timeout", workflowTimeout) 112 124 ctx, cancel := context.WithTimeout(ctx, workflowTimeout) 113 125 defer cancel() 114 126 115 115 - err = e.StartSteps(ctx, w.Steps, wid, w.Image) 127 127 + err = e.StartSteps(ctx, wid, w, allSecrets) 116 128 if err != nil { 117 129 if errors.Is(err, ErrTimedOut) { 118 130 dbErr := e.db.StatusTimeout(wid, e.n) ··· 135 147 } 136 148 137 149 return nil 138 138 - }() 150 150 + }) 139 151 } 140 152 141 141 - wg.Wait() 153 153 + if err = eg.Wait(); err != nil { 154 154 + e.l.Error("failed to run one or more workflows", "err", err) 155 155 + } else { 156 156 + e.l.Error("successfully ran full pipeline") 157 157 + } 142 158 } 143 159 144 160 // SetupWorkflow sets up a new network for the workflow and volumes for ··· 186 202 // ONLY marks pipeline as failed if container's exit code is non-zero. 187 203 // All other errors are bubbled up. 188 204 // Fixed version of the step execution logic 189 189 - func (e *Engine) StartSteps(ctx context.Context, steps []models.Step, wid models.WorkflowId, image string) error { 205 205 + func (e *Engine) StartSteps(ctx context.Context, wid models.WorkflowId, w models.Workflow, secrets []secrets.UnlockedSecret) error { 206 206 + workflowEnvs := ConstructEnvs(w.Environment) 207 207 + for _, s := range secrets { 208 208 + workflowEnvs.AddEnv(s.Key, s.Value) 209 209 + } 190 210 191 191 - for stepIdx, step := range steps { 211 211 + for stepIdx, step := range w.Steps { 192 212 select { 193 213 case <-ctx.Done(): 194 214 return ctx.Err() 195 215 default: 196 216 } 197 217 198 198 - envs := ConstructEnvs(step.Environment) 218 218 + envs := append(EnvVars(nil), workflowEnvs...) 219 219 + for k, v := range step.Environment { 220 220 + envs.AddEnv(k, v) 221 221 + } 199 222 envs.AddEnv("HOME", workspaceDir) 200 223 e.l.Debug("envs for step", "step", step.Name, "envs", envs.Slice()) 201 224 202 225 hostConfig := hostConfig(wid) 203 226 resp, err := e.docker.ContainerCreate(ctx, &container.Config{ 204 204 - Image: image, 227 227 + Image: w.Image, 205 228 Cmd: []string{"bash", "-c", step.Command}, 206 229 WorkingDir: workspaceDir, 207 230 Tty: false,

+129 -2

spindle/ingester.go

··· 3 3 import ( 4 4 "context" 5 5 "encoding/json" 6 6 + "errors" 6 7 "fmt" 7 8 8 9 "tangled.sh/tangled.sh/core/api/tangled" 9 10 "tangled.sh/tangled.sh/core/eventconsumer" 11 11 + "tangled.sh/tangled.sh/core/idresolver" 12 12 + "tangled.sh/tangled.sh/core/rbac" 10 13 14 14 + comatproto "github.com/bluesky-social/indigo/api/atproto" 15 15 + "github.com/bluesky-social/indigo/atproto/identity" 16 16 + "github.com/bluesky-social/indigo/atproto/syntax" 17 17 + "github.com/bluesky-social/indigo/xrpc" 11 18 "github.com/bluesky-social/jetstream/pkg/models" 19 19 + securejoin "github.com/cyphar/filepath-securejoin" 12 20 ) 13 21 14 22 type Ingester func(ctx context.Context, e *models.Event) error ··· 33 41 s.ingestMember(ctx, e) 34 42 case tangled.RepoNSID: 35 43 s.ingestRepo(ctx, e) 44 44 + case tangled.RepoCollaboratorNSID: 45 45 + s.ingestCollaborator(ctx, e) 36 46 } 37 47 38 48 return err ··· 72 82 return fmt.Errorf("failed to enforce permissions: %w", err) 73 83 } 74 84 75 75 - if err := s.e.AddKnotMember(rbacDomain, record.Subject); err != nil { 85 85 + if err := s.e.AddSpindleMember(rbacDomain, record.Subject); err != nil { 76 86 l.Error("failed to add member", "error", err) 77 87 return fmt.Errorf("failed to add member: %w", err) 78 88 } ··· 90 100 return nil 91 101 } 92 102 93 93 - func (s *Spindle) ingestRepo(_ context.Context, e *models.Event) error { 103 103 + func (s *Spindle) ingestRepo(ctx context.Context, e *models.Event) error { 94 104 var err error 105 105 + did := e.Did 106 106 + resolver := idresolver.DefaultResolver() 95 107 96 108 l := s.l.With("component", "ingester", "record", tangled.RepoNSID) 97 109 ··· 127 139 return fmt.Errorf("failed to add repo: %w", err) 128 140 } 129 141 142 142 + didSlashRepo, err := securejoin.SecureJoin(record.Owner, record.Name) 143 143 + if err != nil { 144 144 + return err 145 145 + } 146 146 + 147 147 + // add repo to rbac 148 148 + if err := s.e.AddRepo(record.Owner, rbac.ThisServer, didSlashRepo); err != nil { 149 149 + l.Error("failed to add repo to enforcer", "error", err) 150 150 + return fmt.Errorf("failed to add repo: %w", err) 151 151 + } 152 152 + 153 153 + // add collaborators to rbac 154 154 + owner, err := resolver.ResolveIdent(ctx, did) 155 155 + if err != nil || owner.Handle.IsInvalidHandle() { 156 156 + return err 157 157 + } 158 158 + if err := s.fetchAndAddCollaborators(ctx, owner, didSlashRepo); err != nil { 159 159 + return err 160 160 + } 161 161 + 130 162 // add this knot to the event consumer 131 163 src := eventconsumer.NewKnotSource(record.Knot) 132 164 s.ks.AddSource(context.Background(), src) ··· 136 168 } 137 169 return nil 138 170 } 171 171 + 172 172 + func (s *Spindle) ingestCollaborator(ctx context.Context, e *models.Event) error { 173 173 + var err error 174 174 + 175 175 + l := s.l.With("component", "ingester", "record", tangled.RepoCollaboratorNSID, "did", e.Did) 176 176 + 177 177 + l.Info("ingesting collaborator record") 178 178 + 179 179 + switch e.Commit.Operation { 180 180 + case models.CommitOperationCreate, models.CommitOperationUpdate: 181 181 + raw := e.Commit.Record 182 182 + record := tangled.RepoCollaborator{} 183 183 + err = json.Unmarshal(raw, &record) 184 184 + if err != nil { 185 185 + l.Error("invalid record", "error", err) 186 186 + return err 187 187 + } 188 188 + 189 189 + resolver := idresolver.DefaultResolver() 190 190 + 191 191 + subjectId, err := resolver.ResolveIdent(ctx, record.Subject) 192 192 + if err != nil || subjectId.Handle.IsInvalidHandle() { 193 193 + return err 194 194 + } 195 195 + 196 196 + repoAt, err := syntax.ParseATURI(record.Repo) 197 197 + if err != nil { 198 198 + l.Info("rejecting record, invalid repoAt", "repoAt", record.Repo) 199 199 + return nil 200 200 + } 201 201 + 202 202 + // TODO: get rid of this entirely 203 203 + // resolve this aturi to extract the repo record 204 204 + owner, err := resolver.ResolveIdent(ctx, repoAt.Authority().String()) 205 205 + if err != nil || owner.Handle.IsInvalidHandle() { 206 206 + return fmt.Errorf("failed to resolve handle: %w", err) 207 207 + } 208 208 + 209 209 + xrpcc := xrpc.Client{ 210 210 + Host: owner.PDSEndpoint(), 211 211 + } 212 212 + 213 213 + resp, err := comatproto.RepoGetRecord(ctx, &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String()) 214 214 + if err != nil { 215 215 + return err 216 216 + } 217 217 + 218 218 + repo := resp.Value.Val.(*tangled.Repo) 219 219 + didSlashRepo, _ := securejoin.SecureJoin(owner.DID.String(), repo.Name) 220 220 + 221 221 + // check perms for this user 222 222 + if ok, err := s.e.IsCollaboratorInviteAllowed(owner.DID.String(), rbac.ThisServer, didSlashRepo); !ok || err != nil { 223 223 + return fmt.Errorf("insufficient permissions: %w", err) 224 224 + } 225 225 + 226 226 + // add collaborator to rbac 227 227 + if err := s.e.AddCollaborator(record.Subject, rbac.ThisServer, didSlashRepo); err != nil { 228 228 + l.Error("failed to add repo to enforcer", "error", err) 229 229 + return fmt.Errorf("failed to add repo: %w", err) 230 230 + } 231 231 + 232 232 + return nil 233 233 + } 234 234 + return nil 235 235 + } 236 236 + 237 237 + func (s *Spindle) fetchAndAddCollaborators(ctx context.Context, owner *identity.Identity, didSlashRepo string) error { 238 238 + l := s.l.With("component", "ingester", "handler", "fetchAndAddCollaborators") 239 239 + 240 240 + l.Info("fetching and adding existing collaborators") 241 241 + 242 242 + xrpcc := xrpc.Client{ 243 243 + Host: owner.PDSEndpoint(), 244 244 + } 245 245 + 246 246 + resp, err := comatproto.RepoListRecords(ctx, &xrpcc, tangled.RepoCollaboratorNSID, "", 50, owner.DID.String(), false) 247 247 + if err != nil { 248 248 + return err 249 249 + } 250 250 + 251 251 + var errs error 252 252 + for _, r := range resp.Records { 253 253 + if r == nil { 254 254 + continue 255 255 + } 256 256 + record := r.Value.Val.(*tangled.RepoCollaborator) 257 257 + 258 258 + if err := s.e.AddCollaborator(record.Subject, rbac.ThisServer, didSlashRepo); err != nil { 259 259 + l.Error("failed to add repo to enforcer", "error", err) 260 260 + errors.Join(errs, fmt.Errorf("failed to add repo: %w", err)) 261 261 + } 262 262 + } 263 263 + 264 264 + return errs 265 265 + }

+9 -12

spindle/models/pipeline.go

··· 8 8 ) 9 9 10 10 type Pipeline struct { 11 11 + RepoOwner string 12 12 + RepoName string 11 13 Workflows []Workflow 12 14 } 13 15 ··· 63 65 swf.Environment = workflowEnvToMap(twf.Environment) 64 66 swf.Image = workflowImage(twf.Dependencies, cfg.Pipelines.Nixery) 65 67 66 66 - swf.addNixProfileToPath() 67 67 - swf.setGlobalEnvs() 68 68 setup := &setupSteps{} 69 69 70 70 setup.addStep(nixConfStep()) ··· 79 79 80 80 workflows = append(workflows, *swf) 81 81 } 82 82 - return &Pipeline{Workflows: workflows} 82 82 + repoOwner := pl.TriggerMetadata.Repo.Did 83 83 + repoName := pl.TriggerMetadata.Repo.Repo 84 84 + return &Pipeline{ 85 85 + RepoOwner: repoOwner, 86 86 + RepoName: repoName, 87 87 + Workflows: workflows, 88 88 + } 83 89 } 84 90 85 91 func workflowEnvToMap(envs []*tangled.Pipeline_Pair) map[string]string { ··· 115 121 116 122 return path.Join(nixery, dependencies) 117 123 } 118 118 - 119 119 - func (wf *Workflow) addNixProfileToPath() { 120 120 - wf.Environment["PATH"] = "$PATH:/.nix-profile/bin" 121 121 - } 122 122 - 123 123 - func (wf *Workflow) setGlobalEnvs() { 124 124 - wf.Environment["NIX_CONFIG"] = "experimental-features = nix-command flakes" 125 125 - wf.Environment["HOME"] = "/tangled/workspace" 126 126 - }

+3

spindle/models/setup_steps.go

··· 102 102 continue 103 103 } 104 104 105 105 + if len(packages) == 0 { 106 106 + customPackages = append(customPackages, registry) 107 107 + } 105 108 // collect packages from custom registries 106 109 for _, pkg := range packages { 107 110 customPackages = append(customPackages, fmt.Sprintf("'%s#%s'", registry, pkg))

+25

spindle/motd

··· 1 1 + **** 2 2 + *** *** 3 3 + *** ** ****** ** 4 4 + ** * ***** 5 5 + * ** ** 6 6 + * * * *************** 7 7 + ** ** *# ** 8 8 + * ** ** *** ** 9 9 + * * ** ** * ****** 10 10 + * ** ** * ** * * 11 11 + ** ** *** ** ** * 12 12 + ** ** * ** * * 13 13 + ** **** ** * * 14 14 + ** *** ** ** ** 15 15 + *** ** ***** 16 16 + ******************** 17 17 + ** 18 18 + * 19 19 + #************** 20 20 + ** 21 21 + ******** 22 22 + 23 23 + This is a spindle server. More info at https://tangled.sh/@tangled.sh/core/tree/master/docs/spindle 24 24 + 25 25 + Most API routes are under /xrpc/

+11 -4

spindle/secrets/manager.go

··· 1 1 package secrets 2 2 3 3 import ( 4 4 + "context" 4 5 "errors" 5 6 "regexp" 6 7 "time" ··· 26 27 type UnlockedSecret = Secret[string] 27 28 28 29 type Manager interface { 29 29 - AddSecret(secret UnlockedSecret) error 30 30 - RemoveSecret(secret Secret[any]) error 31 31 - GetSecretsLocked(repo DidSlashRepo) ([]LockedSecret, error) 32 32 - GetSecretsUnlocked(repo DidSlashRepo) ([]UnlockedSecret, error) 30 30 + AddSecret(ctx context.Context, secret UnlockedSecret) error 31 31 + RemoveSecret(ctx context.Context, secret Secret[any]) error 32 32 + GetSecretsLocked(ctx context.Context, repo DidSlashRepo) ([]LockedSecret, error) 33 33 + GetSecretsUnlocked(ctx context.Context, repo DidSlashRepo) ([]UnlockedSecret, error) 34 34 + } 35 35 + 36 36 + // stopper interface for managers that need cleanup 37 37 + type Stopper interface { 38 38 + Stop() 33 39 } 34 40 35 41 var ErrKeyAlreadyPresent = errors.New("key already present") ··· 40 46 var ( 41 47 _ = []Manager{ 42 48 &SqliteManager{}, 49 49 + &OpenBaoManager{}, 43 50 } 44 51 ) 45 52

+313

spindle/secrets/openbao.go

··· 1 1 + package secrets 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "fmt" 6 6 + "log/slog" 7 7 + "path" 8 8 + "strings" 9 9 + "time" 10 10 + 11 11 + "github.com/bluesky-social/indigo/atproto/syntax" 12 12 + vault "github.com/openbao/openbao/api/v2" 13 13 + ) 14 14 + 15 15 + type OpenBaoManager struct { 16 16 + client *vault.Client 17 17 + mountPath string 18 18 + logger *slog.Logger 19 19 + } 20 20 + 21 21 + type OpenBaoManagerOpt func(*OpenBaoManager) 22 22 + 23 23 + func WithMountPath(mountPath string) OpenBaoManagerOpt { 24 24 + return func(v *OpenBaoManager) { 25 25 + v.mountPath = mountPath 26 26 + } 27 27 + } 28 28 + 29 29 + // NewOpenBaoManager creates a new OpenBao manager that connects to a Bao Proxy 30 30 + // The proxyAddress should point to the local Bao Proxy (e.g., "http://127.0.0.1:8200") 31 31 + // The proxy handles all authentication automatically via Auto-Auth 32 32 + func NewOpenBaoManager(proxyAddress string, logger *slog.Logger, opts ...OpenBaoManagerOpt) (*OpenBaoManager, error) { 33 33 + if proxyAddress == "" { 34 34 + return nil, fmt.Errorf("proxy address cannot be empty") 35 35 + } 36 36 + 37 37 + config := vault.DefaultConfig() 38 38 + config.Address = proxyAddress 39 39 + 40 40 + client, err := vault.NewClient(config) 41 41 + if err != nil { 42 42 + return nil, fmt.Errorf("failed to create openbao client: %w", err) 43 43 + } 44 44 + 45 45 + manager := &OpenBaoManager{ 46 46 + client: client, 47 47 + mountPath: "spindle", // default KV v2 mount path 48 48 + logger: logger, 49 49 + } 50 50 + 51 51 + for _, opt := range opts { 52 52 + opt(manager) 53 53 + } 54 54 + 55 55 + if err := manager.testConnection(); err != nil { 56 56 + return nil, fmt.Errorf("failed to connect to bao proxy: %w", err) 57 57 + } 58 58 + 59 59 + logger.Info("successfully connected to bao proxy", "address", proxyAddress) 60 60 + return manager, nil 61 61 + } 62 62 + 63 63 + // testConnection verifies that we can connect to the proxy 64 64 + func (v *OpenBaoManager) testConnection() error { 65 65 + ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) 66 66 + defer cancel() 67 67 + 68 68 + // try token self-lookup as a quick way to verify proxy works 69 69 + // and is authenticated 70 70 + _, err := v.client.Auth().Token().LookupSelfWithContext(ctx) 71 71 + if err != nil { 72 72 + return fmt.Errorf("proxy connection test failed: %w", err) 73 73 + } 74 74 + 75 75 + return nil 76 76 + } 77 77 + 78 78 + func (v *OpenBaoManager) AddSecret(ctx context.Context, secret UnlockedSecret) error { 79 79 + if err := ValidateKey(secret.Key); err != nil { 80 80 + return err 81 81 + } 82 82 + 83 83 + secretPath := v.buildSecretPath(secret.Repo, secret.Key) 84 84 + v.logger.Debug("adding secret", "repo", secret.Repo, "key", secret.Key, "path", secretPath) 85 85 + 86 86 + // Check if secret already exists 87 87 + existing, err := v.client.KVv2(v.mountPath).Get(ctx, secretPath) 88 88 + if err == nil && existing != nil { 89 89 + v.logger.Debug("secret already exists", "path", secretPath) 90 90 + return ErrKeyAlreadyPresent 91 91 + } 92 92 + 93 93 + secretData := map[string]interface{}{ 94 94 + "value": secret.Value, 95 95 + "repo": string(secret.Repo), 96 96 + "key": secret.Key, 97 97 + "created_at": secret.CreatedAt.Format(time.RFC3339), 98 98 + "created_by": secret.CreatedBy.String(), 99 99 + } 100 100 + 101 101 + v.logger.Debug("writing secret to openbao", "path", secretPath, "mount", v.mountPath) 102 102 + resp, err := v.client.KVv2(v.mountPath).Put(ctx, secretPath, secretData) 103 103 + if err != nil { 104 104 + v.logger.Error("failed to write secret", "path", secretPath, "error", err) 105 105 + return fmt.Errorf("failed to store secret in openbao: %w", err) 106 106 + } 107 107 + 108 108 + v.logger.Debug("secret write response", "version", resp.VersionMetadata.Version, "created_time", resp.VersionMetadata.CreatedTime) 109 109 + 110 110 + v.logger.Debug("verifying secret was written", "path", secretPath) 111 111 + readBack, err := v.client.KVv2(v.mountPath).Get(ctx, secretPath) 112 112 + if err != nil { 113 113 + v.logger.Error("failed to verify secret after write", "path", secretPath, "error", err) 114 114 + return fmt.Errorf("secret not found after writing to %s/%s: %w", v.mountPath, secretPath, err) 115 115 + } 116 116 + 117 117 + if readBack == nil || readBack.Data == nil { 118 118 + v.logger.Error("secret verification returned empty data", "path", secretPath) 119 119 + return fmt.Errorf("secret verification failed: empty data returned for %s/%s", v.mountPath, secretPath) 120 120 + } 121 121 + 122 122 + v.logger.Info("secret added and verified successfully", "repo", secret.Repo, "key", secret.Key, "version", readBack.VersionMetadata.Version) 123 123 + return nil 124 124 + } 125 125 + 126 126 + func (v *OpenBaoManager) RemoveSecret(ctx context.Context, secret Secret[any]) error { 127 127 + secretPath := v.buildSecretPath(secret.Repo, secret.Key) 128 128 + 129 129 + // check if secret exists 130 130 + existing, err := v.client.KVv2(v.mountPath).Get(ctx, secretPath) 131 131 + if err != nil || existing == nil { 132 132 + return ErrKeyNotFound 133 133 + } 134 134 + 135 135 + err = v.client.KVv2(v.mountPath).Delete(ctx, secretPath) 136 136 + if err != nil { 137 137 + return fmt.Errorf("failed to delete secret from openbao: %w", err) 138 138 + } 139 139 + 140 140 + v.logger.Debug("secret removed successfully", "repo", secret.Repo, "key", secret.Key) 141 141 + return nil 142 142 + } 143 143 + 144 144 + func (v *OpenBaoManager) GetSecretsLocked(ctx context.Context, repo DidSlashRepo) ([]LockedSecret, error) { 145 145 + repoPath := v.buildRepoPath(repo) 146 146 + 147 147 + secretsList, err := v.client.Logical().ListWithContext(ctx, fmt.Sprintf("%s/metadata/%s", v.mountPath, repoPath)) 148 148 + if err != nil { 149 149 + if strings.Contains(err.Error(), "no secret found") || strings.Contains(err.Error(), "no handler for route") { 150 150 + return []LockedSecret{}, nil 151 151 + } 152 152 + return nil, fmt.Errorf("failed to list secrets: %w", err) 153 153 + } 154 154 + 155 155 + if secretsList == nil || secretsList.Data == nil { 156 156 + return []LockedSecret{}, nil 157 157 + } 158 158 + 159 159 + keys, ok := secretsList.Data["keys"].([]interface{}) 160 160 + if !ok { 161 161 + return []LockedSecret{}, nil 162 162 + } 163 163 + 164 164 + var secrets []LockedSecret 165 165 + 166 166 + for _, keyInterface := range keys { 167 167 + key, ok := keyInterface.(string) 168 168 + if !ok { 169 169 + continue 170 170 + } 171 171 + 172 172 + secretPath := fmt.Sprintf("%s/%s", repoPath, key) 173 173 + secretData, err := v.client.KVv2(v.mountPath).Get(ctx, secretPath) 174 174 + if err != nil { 175 175 + v.logger.Warn("failed to read secret metadata", "path", secretPath, "error", err) 176 176 + continue 177 177 + } 178 178 + 179 179 + if secretData == nil || secretData.Data == nil { 180 180 + continue 181 181 + } 182 182 + 183 183 + data := secretData.Data 184 184 + 185 185 + createdAtStr, ok := data["created_at"].(string) 186 186 + if !ok { 187 187 + createdAtStr = time.Now().Format(time.RFC3339) 188 188 + } 189 189 + 190 190 + createdAt, err := time.Parse(time.RFC3339, createdAtStr) 191 191 + if err != nil { 192 192 + createdAt = time.Now() 193 193 + } 194 194 + 195 195 + createdByStr, ok := data["created_by"].(string) 196 196 + if !ok { 197 197 + createdByStr = "" 198 198 + } 199 199 + 200 200 + keyStr, ok := data["key"].(string) 201 201 + if !ok { 202 202 + keyStr = key 203 203 + } 204 204 + 205 205 + secret := LockedSecret{ 206 206 + Key: keyStr, 207 207 + Repo: repo, 208 208 + CreatedAt: createdAt, 209 209 + CreatedBy: syntax.DID(createdByStr), 210 210 + } 211 211 + 212 212 + secrets = append(secrets, secret) 213 213 + } 214 214 + 215 215 + v.logger.Debug("retrieved locked secrets", "repo", repo, "count", len(secrets)) 216 216 + return secrets, nil 217 217 + } 218 218 + 219 219 + func (v *OpenBaoManager) GetSecretsUnlocked(ctx context.Context, repo DidSlashRepo) ([]UnlockedSecret, error) { 220 220 + repoPath := v.buildRepoPath(repo) 221 221 + 222 222 + secretsList, err := v.client.Logical().ListWithContext(ctx, fmt.Sprintf("%s/metadata/%s", v.mountPath, repoPath)) 223 223 + if err != nil { 224 224 + if strings.Contains(err.Error(), "no secret found") || strings.Contains(err.Error(), "no handler for route") { 225 225 + return []UnlockedSecret{}, nil 226 226 + } 227 227 + return nil, fmt.Errorf("failed to list secrets: %w", err) 228 228 + } 229 229 + 230 230 + if secretsList == nil || secretsList.Data == nil { 231 231 + return []UnlockedSecret{}, nil 232 232 + } 233 233 + 234 234 + keys, ok := secretsList.Data["keys"].([]interface{}) 235 235 + if !ok { 236 236 + return []UnlockedSecret{}, nil 237 237 + } 238 238 + 239 239 + var secrets []UnlockedSecret 240 240 + 241 241 + for _, keyInterface := range keys { 242 242 + key, ok := keyInterface.(string) 243 243 + if !ok { 244 244 + continue 245 245 + } 246 246 + 247 247 + secretPath := fmt.Sprintf("%s/%s", repoPath, key) 248 248 + secretData, err := v.client.KVv2(v.mountPath).Get(ctx, secretPath) 249 249 + if err != nil { 250 250 + v.logger.Warn("failed to read secret", "path", secretPath, "error", err) 251 251 + continue 252 252 + } 253 253 + 254 254 + if secretData == nil || secretData.Data == nil { 255 255 + continue 256 256 + } 257 257 + 258 258 + data := secretData.Data 259 259 + 260 260 + valueStr, ok := data["value"].(string) 261 261 + if !ok { 262 262 + v.logger.Warn("secret missing value", "path", secretPath) 263 263 + continue 264 264 + } 265 265 + 266 266 + createdAtStr, ok := data["created_at"].(string) 267 267 + if !ok { 268 268 + createdAtStr = time.Now().Format(time.RFC3339) 269 269 + } 270 270 + 271 271 + createdAt, err := time.Parse(time.RFC3339, createdAtStr) 272 272 + if err != nil { 273 273 + createdAt = time.Now() 274 274 + } 275 275 + 276 276 + createdByStr, ok := data["created_by"].(string) 277 277 + if !ok { 278 278 + createdByStr = "" 279 279 + } 280 280 + 281 281 + keyStr, ok := data["key"].(string) 282 282 + if !ok { 283 283 + keyStr = key 284 284 + } 285 285 + 286 286 + secret := UnlockedSecret{ 287 287 + Key: keyStr, 288 288 + Value: valueStr, 289 289 + Repo: repo, 290 290 + CreatedAt: createdAt, 291 291 + CreatedBy: syntax.DID(createdByStr), 292 292 + } 293 293 + 294 294 + secrets = append(secrets, secret) 295 295 + } 296 296 + 297 297 + v.logger.Debug("retrieved unlocked secrets", "repo", repo, "count", len(secrets)) 298 298 + return secrets, nil 299 299 + } 300 300 + 301 301 + // buildRepoPath creates a safe path for a repository 302 302 + func (v *OpenBaoManager) buildRepoPath(repo DidSlashRepo) string { 303 303 + // convert DidSlashRepo to a safe path by replacing special characters 304 304 + repoPath := strings.ReplaceAll(string(repo), "/", "_") 305 305 + repoPath = strings.ReplaceAll(repoPath, ":", "_") 306 306 + repoPath = strings.ReplaceAll(repoPath, ".", "_") 307 307 + return fmt.Sprintf("repos/%s", repoPath) 308 308 + } 309 309 + 310 310 + // buildSecretPath creates a path for a specific secret 311 311 + func (v *OpenBaoManager) buildSecretPath(repo DidSlashRepo, key string) string { 312 312 + return path.Join(v.buildRepoPath(repo), key) 313 313 + }

+605

spindle/secrets/openbao_test.go

··· 1 1 + package secrets 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "log/slog" 6 6 + "os" 7 7 + "testing" 8 8 + "time" 9 9 + 10 10 + "github.com/bluesky-social/indigo/atproto/syntax" 11 11 + "github.com/stretchr/testify/assert" 12 12 + ) 13 13 + 14 14 + // MockOpenBaoManager is a mock implementation of Manager interface for testing 15 15 + type MockOpenBaoManager struct { 16 16 + secrets map[string]UnlockedSecret // key: repo_key format 17 17 + shouldError bool 18 18 + errorToReturn error 19 19 + } 20 20 + 21 21 + func NewMockOpenBaoManager() *MockOpenBaoManager { 22 22 + return &MockOpenBaoManager{secrets: make(map[string]UnlockedSecret)} 23 23 + } 24 24 + 25 25 + func (m *MockOpenBaoManager) SetError(err error) { 26 26 + m.shouldError = true 27 27 + m.errorToReturn = err 28 28 + } 29 29 + 30 30 + func (m *MockOpenBaoManager) ClearError() { 31 31 + m.shouldError = false 32 32 + m.errorToReturn = nil 33 33 + } 34 34 + 35 35 + func (m *MockOpenBaoManager) buildKey(repo DidSlashRepo, key string) string { 36 36 + return string(repo) + "_" + key 37 37 + } 38 38 + 39 39 + func (m *MockOpenBaoManager) AddSecret(ctx context.Context, secret UnlockedSecret) error { 40 40 + if m.shouldError { 41 41 + return m.errorToReturn 42 42 + } 43 43 + 44 44 + key := m.buildKey(secret.Repo, secret.Key) 45 45 + if _, exists := m.secrets[key]; exists { 46 46 + return ErrKeyAlreadyPresent 47 47 + } 48 48 + 49 49 + m.secrets[key] = secret 50 50 + return nil 51 51 + } 52 52 + 53 53 + func (m *MockOpenBaoManager) RemoveSecret(ctx context.Context, secret Secret[any]) error { 54 54 + if m.shouldError { 55 55 + return m.errorToReturn 56 56 + } 57 57 + 58 58 + key := m.buildKey(secret.Repo, secret.Key) 59 59 + if _, exists := m.secrets[key]; !exists { 60 60 + return ErrKeyNotFound 61 61 + } 62 62 + 63 63 + delete(m.secrets, key) 64 64 + return nil 65 65 + } 66 66 + 67 67 + func (m *MockOpenBaoManager) GetSecretsLocked(ctx context.Context, repo DidSlashRepo) ([]LockedSecret, error) { 68 68 + if m.shouldError { 69 69 + return nil, m.errorToReturn 70 70 + } 71 71 + 72 72 + var result []LockedSecret 73 73 + for _, secret := range m.secrets { 74 74 + if secret.Repo == repo { 75 75 + result = append(result, LockedSecret{ 76 76 + Key: secret.Key, 77 77 + Repo: secret.Repo, 78 78 + CreatedAt: secret.CreatedAt, 79 79 + CreatedBy: secret.CreatedBy, 80 80 + }) 81 81 + } 82 82 + } 83 83 + 84 84 + return result, nil 85 85 + } 86 86 + 87 87 + func (m *MockOpenBaoManager) GetSecretsUnlocked(ctx context.Context, repo DidSlashRepo) ([]UnlockedSecret, error) { 88 88 + if m.shouldError { 89 89 + return nil, m.errorToReturn 90 90 + } 91 91 + 92 92 + var result []UnlockedSecret 93 93 + for _, secret := range m.secrets { 94 94 + if secret.Repo == repo { 95 95 + result = append(result, secret) 96 96 + } 97 97 + } 98 98 + 99 99 + return result, nil 100 100 + } 101 101 + 102 102 + func createTestSecretForOpenBao(repo, key, value, createdBy string) UnlockedSecret { 103 103 + return UnlockedSecret{ 104 104 + Key: key, 105 105 + Value: value, 106 106 + Repo: DidSlashRepo(repo), 107 107 + CreatedAt: time.Now(), 108 108 + CreatedBy: syntax.DID(createdBy), 109 109 + } 110 110 + } 111 111 + 112 112 + // Test MockOpenBaoManager interface compliance 113 113 + func TestMockOpenBaoManagerInterface(t *testing.T) { 114 114 + var _ Manager = (*MockOpenBaoManager)(nil) 115 115 + } 116 116 + 117 117 + func TestOpenBaoManagerInterface(t *testing.T) { 118 118 + var _ Manager = (*OpenBaoManager)(nil) 119 119 + } 120 120 + 121 121 + func TestNewOpenBaoManager(t *testing.T) { 122 122 + tests := []struct { 123 123 + name string 124 124 + proxyAddr string 125 125 + opts []OpenBaoManagerOpt 126 126 + expectError bool 127 127 + errorContains string 128 128 + }{ 129 129 + { 130 130 + name: "empty proxy address", 131 131 + proxyAddr: "", 132 132 + opts: nil, 133 133 + expectError: true, 134 134 + errorContains: "proxy address cannot be empty", 135 135 + }, 136 136 + { 137 137 + name: "valid proxy address", 138 138 + proxyAddr: "http://localhost:8200", 139 139 + opts: nil, 140 140 + expectError: true, // Will fail because no real proxy is running 141 141 + errorContains: "failed to connect to bao proxy", 142 142 + }, 143 143 + { 144 144 + name: "with mount path option", 145 145 + proxyAddr: "http://localhost:8200", 146 146 + opts: []OpenBaoManagerOpt{WithMountPath("custom-mount")}, 147 147 + expectError: true, // Will fail because no real proxy is running 148 148 + errorContains: "failed to connect to bao proxy", 149 149 + }, 150 150 + } 151 151 + 152 152 + for _, tt := range tests { 153 153 + t.Run(tt.name, func(t *testing.T) { 154 154 + logger := slog.New(slog.NewTextHandler(os.Stderr, nil)) 155 155 + manager, err := NewOpenBaoManager(tt.proxyAddr, logger, tt.opts...) 156 156 + 157 157 + if tt.expectError { 158 158 + assert.Error(t, err) 159 159 + assert.Nil(t, manager) 160 160 + assert.Contains(t, err.Error(), tt.errorContains) 161 161 + } else { 162 162 + assert.NoError(t, err) 163 163 + assert.NotNil(t, manager) 164 164 + } 165 165 + }) 166 166 + } 167 167 + } 168 168 + 169 169 + func TestOpenBaoManager_PathBuilding(t *testing.T) { 170 170 + manager := &OpenBaoManager{mountPath: "secret"} 171 171 + 172 172 + tests := []struct { 173 173 + name string 174 174 + repo DidSlashRepo 175 175 + key string 176 176 + expected string 177 177 + }{ 178 178 + { 179 179 + name: "simple repo path", 180 180 + repo: DidSlashRepo("did:plc:foo/repo"), 181 181 + key: "api_key", 182 182 + expected: "repos/did_plc_foo_repo/api_key", 183 183 + }, 184 184 + { 185 185 + name: "complex repo path with dots", 186 186 + repo: DidSlashRepo("did:web:example.com/my-repo"), 187 187 + key: "secret_key", 188 188 + expected: "repos/did_web_example_com_my-repo/secret_key", 189 189 + }, 190 190 + } 191 191 + 192 192 + for _, tt := range tests { 193 193 + t.Run(tt.name, func(t *testing.T) { 194 194 + result := manager.buildSecretPath(tt.repo, tt.key) 195 195 + assert.Equal(t, tt.expected, result) 196 196 + }) 197 197 + } 198 198 + } 199 199 + 200 200 + func TestOpenBaoManager_buildRepoPath(t *testing.T) { 201 201 + manager := &OpenBaoManager{mountPath: "test"} 202 202 + 203 203 + tests := []struct { 204 204 + name string 205 205 + repo DidSlashRepo 206 206 + expected string 207 207 + }{ 208 208 + { 209 209 + name: "simple repo", 210 210 + repo: "did:plc:test/myrepo", 211 211 + expected: "repos/did_plc_test_myrepo", 212 212 + }, 213 213 + { 214 214 + name: "repo with dots", 215 215 + repo: "did:plc:example.com/my.repo", 216 216 + expected: "repos/did_plc_example_com_my_repo", 217 217 + }, 218 218 + { 219 219 + name: "complex repo", 220 220 + repo: "did:web:example.com:8080/path/to/repo", 221 221 + expected: "repos/did_web_example_com_8080_path_to_repo", 222 222 + }, 223 223 + } 224 224 + 225 225 + for _, tt := range tests { 226 226 + t.Run(tt.name, func(t *testing.T) { 227 227 + result := manager.buildRepoPath(tt.repo) 228 228 + assert.Equal(t, tt.expected, result) 229 229 + }) 230 230 + } 231 231 + } 232 232 + 233 233 + func TestWithMountPath(t *testing.T) { 234 234 + manager := &OpenBaoManager{mountPath: "default"} 235 235 + 236 236 + opt := WithMountPath("custom-mount") 237 237 + opt(manager) 238 238 + 239 239 + assert.Equal(t, "custom-mount", manager.mountPath) 240 240 + } 241 241 + 242 242 + func TestMockOpenBaoManager_AddSecret(t *testing.T) { 243 243 + tests := []struct { 244 244 + name string 245 245 + secrets []UnlockedSecret 246 246 + expectError bool 247 247 + }{ 248 248 + { 249 249 + name: "add single secret", 250 250 + secrets: []UnlockedSecret{ 251 251 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator"), 252 252 + }, 253 253 + expectError: false, 254 254 + }, 255 255 + { 256 256 + name: "add multiple secrets", 257 257 + secrets: []UnlockedSecret{ 258 258 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator"), 259 259 + createTestSecretForOpenBao("did:plc:test/repo1", "DB_PASSWORD", "dbpass456", "did:plc:creator"), 260 260 + }, 261 261 + expectError: false, 262 262 + }, 263 263 + { 264 264 + name: "add duplicate secret", 265 265 + secrets: []UnlockedSecret{ 266 266 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator"), 267 267 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "newsecret", "did:plc:creator"), 268 268 + }, 269 269 + expectError: true, 270 270 + }, 271 271 + } 272 272 + 273 273 + for _, tt := range tests { 274 274 + t.Run(tt.name, func(t *testing.T) { 275 275 + mock := NewMockOpenBaoManager() 276 276 + ctx := context.Background() 277 277 + var err error 278 278 + 279 279 + for i, secret := range tt.secrets { 280 280 + err = mock.AddSecret(ctx, secret) 281 281 + if tt.expectError && i == 1 { // Second secret should fail for duplicate test 282 282 + assert.Equal(t, ErrKeyAlreadyPresent, err) 283 283 + return 284 284 + } 285 285 + if !tt.expectError { 286 286 + assert.NoError(t, err) 287 287 + } 288 288 + } 289 289 + 290 290 + if !tt.expectError { 291 291 + assert.NoError(t, err) 292 292 + } 293 293 + }) 294 294 + } 295 295 + } 296 296 + 297 297 + func TestMockOpenBaoManager_RemoveSecret(t *testing.T) { 298 298 + tests := []struct { 299 299 + name string 300 300 + setupSecrets []UnlockedSecret 301 301 + removeSecret Secret[any] 302 302 + expectError bool 303 303 + }{ 304 304 + { 305 305 + name: "remove existing secret", 306 306 + setupSecrets: []UnlockedSecret{ 307 307 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator"), 308 308 + }, 309 309 + removeSecret: Secret[any]{ 310 310 + Key: "API_KEY", 311 311 + Repo: DidSlashRepo("did:plc:test/repo1"), 312 312 + }, 313 313 + expectError: false, 314 314 + }, 315 315 + { 316 316 + name: "remove non-existent secret", 317 317 + setupSecrets: []UnlockedSecret{}, 318 318 + removeSecret: Secret[any]{ 319 319 + Key: "API_KEY", 320 320 + Repo: DidSlashRepo("did:plc:test/repo1"), 321 321 + }, 322 322 + expectError: true, 323 323 + }, 324 324 + } 325 325 + 326 326 + for _, tt := range tests { 327 327 + t.Run(tt.name, func(t *testing.T) { 328 328 + mock := NewMockOpenBaoManager() 329 329 + ctx := context.Background() 330 330 + 331 331 + // Setup secrets 332 332 + for _, secret := range tt.setupSecrets { 333 333 + err := mock.AddSecret(ctx, secret) 334 334 + assert.NoError(t, err) 335 335 + } 336 336 + 337 337 + // Remove secret 338 338 + err := mock.RemoveSecret(ctx, tt.removeSecret) 339 339 + 340 340 + if tt.expectError { 341 341 + assert.Equal(t, ErrKeyNotFound, err) 342 342 + } else { 343 343 + assert.NoError(t, err) 344 344 + } 345 345 + }) 346 346 + } 347 347 + } 348 348 + 349 349 + func TestMockOpenBaoManager_GetSecretsLocked(t *testing.T) { 350 350 + tests := []struct { 351 351 + name string 352 352 + setupSecrets []UnlockedSecret 353 353 + queryRepo DidSlashRepo 354 354 + expectedCount int 355 355 + expectedKeys []string 356 356 + expectError bool 357 357 + }{ 358 358 + { 359 359 + name: "get secrets from repo with secrets", 360 360 + setupSecrets: []UnlockedSecret{ 361 361 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator"), 362 362 + createTestSecretForOpenBao("did:plc:test/repo1", "DB_PASSWORD", "dbpass456", "did:plc:creator"), 363 363 + createTestSecretForOpenBao("did:plc:test/repo2", "OTHER_KEY", "other789", "did:plc:creator"), 364 364 + }, 365 365 + queryRepo: DidSlashRepo("did:plc:test/repo1"), 366 366 + expectedCount: 2, 367 367 + expectedKeys: []string{"API_KEY", "DB_PASSWORD"}, 368 368 + expectError: false, 369 369 + }, 370 370 + { 371 371 + name: "get secrets from empty repo", 372 372 + setupSecrets: []UnlockedSecret{}, 373 373 + queryRepo: DidSlashRepo("did:plc:test/empty"), 374 374 + expectedCount: 0, 375 375 + expectedKeys: []string{}, 376 376 + expectError: false, 377 377 + }, 378 378 + } 379 379 + 380 380 + for _, tt := range tests { 381 381 + t.Run(tt.name, func(t *testing.T) { 382 382 + mock := NewMockOpenBaoManager() 383 383 + ctx := context.Background() 384 384 + 385 385 + // Setup 386 386 + for _, secret := range tt.setupSecrets { 387 387 + err := mock.AddSecret(ctx, secret) 388 388 + assert.NoError(t, err) 389 389 + } 390 390 + 391 391 + // Test 392 392 + secrets, err := mock.GetSecretsLocked(ctx, tt.queryRepo) 393 393 + 394 394 + if tt.expectError { 395 395 + assert.Error(t, err) 396 396 + } else { 397 397 + assert.NoError(t, err) 398 398 + assert.Len(t, secrets, tt.expectedCount) 399 399 + 400 400 + // Check keys 401 401 + actualKeys := make([]string, len(secrets)) 402 402 + for i, secret := range secrets { 403 403 + actualKeys[i] = secret.Key 404 404 + } 405 405 + 406 406 + for _, expectedKey := range tt.expectedKeys { 407 407 + assert.Contains(t, actualKeys, expectedKey) 408 408 + } 409 409 + } 410 410 + }) 411 411 + } 412 412 + } 413 413 + 414 414 + func TestMockOpenBaoManager_GetSecretsUnlocked(t *testing.T) { 415 415 + tests := []struct { 416 416 + name string 417 417 + setupSecrets []UnlockedSecret 418 418 + queryRepo DidSlashRepo 419 419 + expectedCount int 420 420 + expectedSecrets map[string]string // key -> value 421 421 + expectError bool 422 422 + }{ 423 423 + { 424 424 + name: "get unlocked secrets from repo", 425 425 + setupSecrets: []UnlockedSecret{ 426 426 + createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator"), 427 427 + createTestSecretForOpenBao("did:plc:test/repo1", "DB_PASSWORD", "dbpass456", "did:plc:creator"), 428 428 + createTestSecretForOpenBao("did:plc:test/repo2", "OTHER_KEY", "other789", "did:plc:creator"), 429 429 + }, 430 430 + queryRepo: DidSlashRepo("did:plc:test/repo1"), 431 431 + expectedCount: 2, 432 432 + expectedSecrets: map[string]string{ 433 433 + "API_KEY": "secret123", 434 434 + "DB_PASSWORD": "dbpass456", 435 435 + }, 436 436 + expectError: false, 437 437 + }, 438 438 + { 439 439 + name: "get secrets from empty repo", 440 440 + setupSecrets: []UnlockedSecret{}, 441 441 + queryRepo: DidSlashRepo("did:plc:test/empty"), 442 442 + expectedCount: 0, 443 443 + expectedSecrets: map[string]string{}, 444 444 + expectError: false, 445 445 + }, 446 446 + } 447 447 + 448 448 + for _, tt := range tests { 449 449 + t.Run(tt.name, func(t *testing.T) { 450 450 + mock := NewMockOpenBaoManager() 451 451 + ctx := context.Background() 452 452 + 453 453 + // Setup 454 454 + for _, secret := range tt.setupSecrets { 455 455 + err := mock.AddSecret(ctx, secret) 456 456 + assert.NoError(t, err) 457 457 + } 458 458 + 459 459 + // Test 460 460 + secrets, err := mock.GetSecretsUnlocked(ctx, tt.queryRepo) 461 461 + 462 462 + if tt.expectError { 463 463 + assert.Error(t, err) 464 464 + } else { 465 465 + assert.NoError(t, err) 466 466 + assert.Len(t, secrets, tt.expectedCount) 467 467 + 468 468 + // Check key-value pairs 469 469 + actualSecrets := make(map[string]string) 470 470 + for _, secret := range secrets { 471 471 + actualSecrets[secret.Key] = secret.Value 472 472 + } 473 473 + 474 474 + for expectedKey, expectedValue := range tt.expectedSecrets { 475 475 + actualValue, exists := actualSecrets[expectedKey] 476 476 + assert.True(t, exists, "Expected key %s not found", expectedKey) 477 477 + assert.Equal(t, expectedValue, actualValue) 478 478 + } 479 479 + } 480 480 + }) 481 481 + } 482 482 + } 483 483 + 484 484 + func TestMockOpenBaoManager_ErrorHandling(t *testing.T) { 485 485 + mock := NewMockOpenBaoManager() 486 486 + ctx := context.Background() 487 487 + testError := assert.AnError 488 488 + 489 489 + // Test error injection 490 490 + mock.SetError(testError) 491 491 + 492 492 + secret := createTestSecretForOpenBao("did:plc:test/repo1", "API_KEY", "secret123", "did:plc:creator") 493 493 + 494 494 + // All operations should return the injected error 495 495 + err := mock.AddSecret(ctx, secret) 496 496 + assert.Equal(t, testError, err) 497 497 + 498 498 + _, err = mock.GetSecretsLocked(ctx, "did:plc:test/repo1") 499 499 + assert.Equal(t, testError, err) 500 500 + 501 501 + _, err = mock.GetSecretsUnlocked(ctx, "did:plc:test/repo1") 502 502 + assert.Equal(t, testError, err) 503 503 + 504 504 + err = mock.RemoveSecret(ctx, Secret[any]{Key: "API_KEY", Repo: "did:plc:test/repo1"}) 505 505 + assert.Equal(t, testError, err) 506 506 + 507 507 + // Clear error and test normal operation 508 508 + mock.ClearError() 509 509 + err = mock.AddSecret(ctx, secret) 510 510 + assert.NoError(t, err) 511 511 + } 512 512 + 513 513 + func TestMockOpenBaoManager_Integration(t *testing.T) { 514 514 + tests := []struct { 515 515 + name string 516 516 + scenario func(t *testing.T, mock *MockOpenBaoManager) 517 517 + }{ 518 518 + { 519 519 + name: "complete workflow", 520 520 + scenario: func(t *testing.T, mock *MockOpenBaoManager) { 521 521 + ctx := context.Background() 522 522 + repo := DidSlashRepo("did:plc:test/integration") 523 523 + 524 524 + // Start with empty repo 525 525 + secrets, err := mock.GetSecretsLocked(ctx, repo) 526 526 + assert.NoError(t, err) 527 527 + assert.Empty(t, secrets) 528 528 + 529 529 + // Add some secrets 530 530 + secret1 := createTestSecretForOpenBao(string(repo), "API_KEY", "secret123", "did:plc:creator") 531 531 + secret2 := createTestSecretForOpenBao(string(repo), "DB_PASSWORD", "dbpass456", "did:plc:creator") 532 532 + 533 533 + err = mock.AddSecret(ctx, secret1) 534 534 + assert.NoError(t, err) 535 535 + 536 536 + err = mock.AddSecret(ctx, secret2) 537 537 + assert.NoError(t, err) 538 538 + 539 539 + // Verify secrets exist 540 540 + secrets, err = mock.GetSecretsLocked(ctx, repo) 541 541 + assert.NoError(t, err) 542 542 + assert.Len(t, secrets, 2) 543 543 + 544 544 + unlockedSecrets, err := mock.GetSecretsUnlocked(ctx, repo) 545 545 + assert.NoError(t, err) 546 546 + assert.Len(t, unlockedSecrets, 2) 547 547 + 548 548 + // Remove one secret 549 549 + err = mock.RemoveSecret(ctx, Secret[any]{Key: "API_KEY", Repo: repo}) 550 550 + assert.NoError(t, err) 551 551 + 552 552 + // Verify only one secret remains 553 553 + secrets, err = mock.GetSecretsLocked(ctx, repo) 554 554 + assert.NoError(t, err) 555 555 + assert.Len(t, secrets, 1) 556 556 + assert.Equal(t, "DB_PASSWORD", secrets[0].Key) 557 557 + }, 558 558 + }, 559 559 + } 560 560 + 561 561 + for _, tt := range tests { 562 562 + t.Run(tt.name, func(t *testing.T) { 563 563 + mock := NewMockOpenBaoManager() 564 564 + tt.scenario(t, mock) 565 565 + }) 566 566 + } 567 567 + } 568 568 + 569 569 + func TestOpenBaoManager_ProxyConfiguration(t *testing.T) { 570 570 + tests := []struct { 571 571 + name string 572 572 + proxyAddr string 573 573 + description string 574 574 + }{ 575 575 + { 576 576 + name: "default_localhost", 577 577 + proxyAddr: "http://127.0.0.1:8200", 578 578 + description: "Should connect to default localhost proxy", 579 579 + }, 580 580 + { 581 581 + name: "custom_host", 582 582 + proxyAddr: "http://bao-proxy:8200", 583 583 + description: "Should connect to custom proxy host", 584 584 + }, 585 585 + { 586 586 + name: "https_proxy", 587 587 + proxyAddr: "https://127.0.0.1:8200", 588 588 + description: "Should connect to HTTPS proxy", 589 589 + }, 590 590 + } 591 591 + 592 592 + for _, tt := range tests { 593 593 + t.Run(tt.name, func(t *testing.T) { 594 594 + t.Log("Testing scenario:", tt.description) 595 595 + logger := slog.New(slog.NewTextHandler(os.Stderr, nil)) 596 596 + 597 597 + // All these will fail because no real proxy is running 598 598 + // but we can test that the configuration is properly accepted 599 599 + manager, err := NewOpenBaoManager(tt.proxyAddr, logger) 600 600 + assert.Error(t, err) // Expected because no real proxy 601 601 + assert.Nil(t, manager) 602 602 + assert.Contains(t, err.Error(), "failed to connect to bao proxy") 603 603 + }) 604 604 + } 605 605 + }

+22

spindle/secrets/policy.hcl

··· 1 1 + # Allow full access to the spindle KV mount 2 2 + path "spindle/*" { 3 3 + capabilities = ["create", "read", "update", "delete", "list"] 4 4 + } 5 5 + 6 6 + path "spindle/data/*" { 7 7 + capabilities = ["create", "read", "update", "delete"] 8 8 + } 9 9 + 10 10 + path "spindle/metadata/*" { 11 11 + capabilities = ["list", "read", "delete"] 12 12 + } 13 13 + 14 14 + # Allow listing mounts (for connection testing) 15 15 + path "sys/mounts" { 16 16 + capabilities = ["read"] 17 17 + } 18 18 + 19 19 + # Allow token self-lookup (for health checks) 20 20 + path "auth/token/lookup-self" { 21 21 + capabilities = ["read"] 22 22 + }

+9 -8

spindle/secrets/sqlite.go

··· 2 2 package secrets 3 3 4 4 import ( 5 5 + "context" 5 6 "database/sql" 6 7 "fmt" 7 8 "time" ··· 61 62 return err 62 63 } 63 64 64 64 - func (s *SqliteManager) AddSecret(secret UnlockedSecret) error { 65 65 + func (s *SqliteManager) AddSecret(ctx context.Context, secret UnlockedSecret) error { 65 66 query := fmt.Sprintf(` 66 67 insert or ignore into %s (repo, key, value, created_by) 67 68 values (?, ?, ?, ?); 68 69 `, s.tableName) 69 70 70 70 - res, err := s.db.Exec(query, secret.Repo, secret.Key, secret.Value, secret.CreatedBy) 71 71 + res, err := s.db.ExecContext(ctx, query, secret.Repo, secret.Key, secret.Value, secret.CreatedBy) 71 72 if err != nil { 72 73 return err 73 74 } ··· 84 85 return nil 85 86 } 86 87 87 87 - func (s *SqliteManager) RemoveSecret(secret Secret[any]) error { 88 88 + func (s *SqliteManager) RemoveSecret(ctx context.Context, secret Secret[any]) error { 88 89 query := fmt.Sprintf(` 89 90 delete from %s where repo = ? and key = ?; 90 91 `, s.tableName) 91 92 92 92 - res, err := s.db.Exec(query, secret.Repo, secret.Key) 93 93 + res, err := s.db.ExecContext(ctx, query, secret.Repo, secret.Key) 93 94 if err != nil { 94 95 return err 95 96 } ··· 106 107 return nil 107 108 } 108 109 109 109 - func (s *SqliteManager) GetSecretsLocked(didSlashRepo DidSlashRepo) ([]LockedSecret, error) { 110 110 + func (s *SqliteManager) GetSecretsLocked(ctx context.Context, didSlashRepo DidSlashRepo) ([]LockedSecret, error) { 110 111 query := fmt.Sprintf(` 111 112 select repo, key, created_at, created_by from %s where repo = ?; 112 113 `, s.tableName) 113 114 114 114 - rows, err := s.db.Query(query, didSlashRepo) 115 115 + rows, err := s.db.QueryContext(ctx, query, didSlashRepo) 115 116 if err != nil { 116 117 return nil, err 117 118 } ··· 138 139 return ls, nil 139 140 } 140 141 141 141 - func (s *SqliteManager) GetSecretsUnlocked(didSlashRepo DidSlashRepo) ([]UnlockedSecret, error) { 142 142 + func (s *SqliteManager) GetSecretsUnlocked(ctx context.Context, didSlashRepo DidSlashRepo) ([]UnlockedSecret, error) { 142 143 query := fmt.Sprintf(` 143 144 select repo, key, value, created_at, created_by from %s where repo = ?; 144 145 `, s.tableName) 145 146 146 146 - rows, err := s.db.Query(query, didSlashRepo) 147 147 + rows, err := s.db.QueryContext(ctx, query, didSlashRepo) 147 148 if err != nil { 148 149 return nil, err 149 150 }

+31 -21

spindle/secrets/sqlite_test.go

··· 1 1 package secrets 2 2 3 3 import ( 4 4 + "context" 4 5 "testing" 5 6 "time" 6 7 8 8 + "github.com/alecthomas/assert/v2" 7 9 "github.com/bluesky-social/indigo/atproto/syntax" 8 10 ) 9 11 ··· 122 124 defer manager.db.Close() 123 125 124 126 for i, secret := range tt.secrets { 125 125 - err := manager.AddSecret(secret) 127 127 + err := manager.AddSecret(context.Background(), secret) 126 128 if err != tt.expectError[i] { 127 129 t.Errorf("Secret %d: expected error %v, got %v", i, tt.expectError[i], err) 128 130 } ··· 189 191 190 192 // Setup secrets 191 193 for _, secret := range tt.setupSecrets { 192 192 - if err := manager.AddSecret(secret); err != nil { 194 194 + if err := manager.AddSecret(context.Background(), secret); err != nil { 193 195 t.Fatalf("Failed to setup secret: %v", err) 194 196 } 195 197 } 196 198 197 199 // Test removal 198 198 - err := manager.RemoveSecret(tt.removeSecret) 200 200 + err := manager.RemoveSecret(context.Background(), tt.removeSecret) 199 201 if err != tt.expectError { 200 202 t.Errorf("Expected error %v, got %v", tt.expectError, err) 201 203 } ··· 262 264 263 265 // Setup secrets 264 266 for _, secret := range tt.setupSecrets { 265 265 - if err := manager.AddSecret(secret); err != nil { 267 267 + if err := manager.AddSecret(context.Background(), secret); err != nil { 266 268 t.Fatalf("Failed to setup secret: %v", err) 267 269 } 268 270 } 269 271 270 272 // Test getting locked secrets 271 271 - lockedSecrets, err := manager.GetSecretsLocked(tt.queryRepo) 273 273 + lockedSecrets, err := manager.GetSecretsLocked(context.Background(), tt.queryRepo) 272 274 if tt.expectError && err == nil { 273 275 t.Error("Expected error but got none") 274 276 return ··· 369 371 370 372 // Setup secrets 371 373 for _, secret := range tt.setupSecrets { 372 372 - if err := manager.AddSecret(secret); err != nil { 374 374 + if err := manager.AddSecret(context.Background(), secret); err != nil { 373 375 t.Fatalf("Failed to setup secret: %v", err) 374 376 } 375 377 } 376 378 377 379 // Test getting unlocked secrets 378 378 - unlockedSecrets, err := manager.GetSecretsUnlocked(tt.queryRepo) 380 380 + unlockedSecrets, err := manager.GetSecretsUnlocked(context.Background(), tt.queryRepo) 379 381 if tt.expectError && err == nil { 380 382 t.Error("Expected error but got none") 381 383 return ··· 424 426 operations: []func(Manager) error{ 425 427 func(m Manager) error { 426 428 secret := createTestSecret("interface.test/repo", "test_key", "test_value", "did:plc:user") 427 427 - return m.AddSecret(secret) 429 429 + return m.AddSecret(context.Background(), secret) 428 430 }, 429 431 func(m Manager) error { 430 430 - _, err := m.GetSecretsLocked(DidSlashRepo("interface.test/repo")) 432 432 + _, err := m.GetSecretsLocked(context.Background(), DidSlashRepo("interface.test/repo")) 431 433 return err 432 434 }, 433 435 func(m Manager) error { 434 434 - _, err := m.GetSecretsUnlocked(DidSlashRepo("interface.test/repo")) 436 436 + _, err := m.GetSecretsUnlocked(context.Background(), DidSlashRepo("interface.test/repo")) 435 437 return err 436 438 }, 437 439 func(m Manager) error { ··· 439 441 Key: "test_key", 440 442 Repo: DidSlashRepo("interface.test/repo"), 441 443 } 442 442 - return m.RemoveSecret(secret) 444 444 + return m.RemoveSecret(context.Background(), secret) 443 445 }, 444 446 }, 445 447 expectError: false, ··· 449 451 operations: []func(Manager) error{ 450 452 func(m Manager) error { 451 453 secret := createTestSecret("interface.test/repo", "dup_key", "value1", "did:plc:user") 452 452 - return m.AddSecret(secret) 454 454 + return m.AddSecret(context.Background(), secret) 453 455 }, 454 456 func(m Manager) error { 455 457 secret := createTestSecret("interface.test/repo", "dup_key", "value2", "did:plc:user") 456 456 - return m.AddSecret(secret) // Should return ErrKeyAlreadyPresent 458 458 + return m.AddSecret(context.Background(), secret) // Should return ErrKeyAlreadyPresent 457 459 }, 458 460 }, 459 461 expectError: true, ··· 507 509 508 510 // Add all secrets 509 511 for _, secret := range secrets { 510 510 - if err := manager.AddSecret(secret); err != nil { 512 512 + if err := manager.AddSecret(context.Background(), secret); err != nil { 511 513 t.Fatalf("Failed to add secret %s: %v", secret.Key, err) 512 514 } 513 515 } 514 516 515 517 // Verify counts 516 516 - locked1, _ := manager.GetSecretsLocked(repo1) 517 517 - locked2, _ := manager.GetSecretsLocked(repo2) 518 518 + locked1, _ := manager.GetSecretsLocked(context.Background(), repo1) 519 519 + locked2, _ := manager.GetSecretsLocked(context.Background(), repo2) 518 520 519 521 if len(locked1) != 2 { 520 522 t.Errorf("Expected 2 secrets for repo1, got %d", len(locked1)) ··· 525 527 526 528 // Remove and verify 527 529 secretToRemove := Secret[any]{Key: "db_password", Repo: repo1} 528 528 - if err := manager.RemoveSecret(secretToRemove); err != nil { 530 530 + if err := manager.RemoveSecret(context.Background(), secretToRemove); err != nil { 529 531 t.Fatalf("Failed to remove secret: %v", err) 530 532 } 531 533 532 532 - locked1After, _ := manager.GetSecretsLocked(repo1) 534 534 + locked1After, _ := manager.GetSecretsLocked(context.Background(), repo1) 533 535 if len(locked1After) != 1 { 534 536 t.Errorf("Expected 1 secret for repo1 after removal, got %d", len(locked1After)) 535 537 } ··· 544 546 repo := DidSlashRepo("empty.test/repo") 545 547 546 548 // Operations on empty database should not error 547 547 - locked, err := manager.GetSecretsLocked(repo) 549 549 + locked, err := manager.GetSecretsLocked(context.Background(), repo) 548 550 if err != nil { 549 551 t.Errorf("GetSecretsLocked on empty DB failed: %v", err) 550 552 } ··· 552 554 t.Errorf("Expected 0 secrets, got %d", len(locked)) 553 555 } 554 556 555 555 - unlocked, err := manager.GetSecretsUnlocked(repo) 557 557 + unlocked, err := manager.GetSecretsUnlocked(context.Background(), repo) 556 558 if err != nil { 557 559 t.Errorf("GetSecretsUnlocked on empty DB failed: %v", err) 558 560 } ··· 562 564 563 565 // Remove from empty should return ErrKeyNotFound 564 566 nonExistent := Secret[any]{Key: "none", Repo: repo} 565 565 - err = manager.RemoveSecret(nonExistent) 567 567 + err = manager.RemoveSecret(context.Background(), nonExistent) 566 568 if err != ErrKeyNotFound { 567 569 t.Errorf("Expected ErrKeyNotFound, got %v", err) 568 570 } ··· 578 580 }) 579 581 } 580 582 } 583 583 + 584 584 + func TestSqliteManager_StopperInterface(t *testing.T) { 585 585 + manager := &SqliteManager{} 586 586 + 587 587 + // Verify that SqliteManager does NOT implement the Stopper interface 588 588 + _, ok := interface{}(manager).(Stopper) 589 589 + assert.False(t, ok, "SqliteManager should NOT implement Stopper interface") 590 590 + }

+81 -42

spindle/server.go

··· 2 2 3 3 import ( 4 4 "context" 5 5 + _ "embed" 5 6 "encoding/json" 6 7 "fmt" 7 8 "log/slog" ··· 11 12 "tangled.sh/tangled.sh/core/api/tangled" 12 13 "tangled.sh/tangled.sh/core/eventconsumer" 13 14 "tangled.sh/tangled.sh/core/eventconsumer/cursor" 15 15 + "tangled.sh/tangled.sh/core/idresolver" 14 16 "tangled.sh/tangled.sh/core/jetstream" 15 17 "tangled.sh/tangled.sh/core/log" 16 18 "tangled.sh/tangled.sh/core/notifier" ··· 20 22 "tangled.sh/tangled.sh/core/spindle/engine" 21 23 "tangled.sh/tangled.sh/core/spindle/models" 22 24 "tangled.sh/tangled.sh/core/spindle/queue" 25 25 + "tangled.sh/tangled.sh/core/spindle/secrets" 26 26 + "tangled.sh/tangled.sh/core/spindle/xrpc" 23 27 ) 24 28 29 29 + //go:embed motd 30 30 + var motd []byte 31 31 + 25 32 const ( 26 33 rbacDomain = "thisserver" 27 34 ) 28 35 29 36 type Spindle struct { 30 30 - jc *jetstream.JetstreamClient 31 31 - db *db.DB 32 32 - e *rbac.Enforcer 33 33 - l *slog.Logger 34 34 - n *notifier.Notifier 35 35 - eng *engine.Engine 36 36 - jq *queue.Queue 37 37 - cfg *config.Config 38 38 - ks *eventconsumer.Consumer 37 37 + jc *jetstream.JetstreamClient 38 38 + db *db.DB 39 39 + e *rbac.Enforcer 40 40 + l *slog.Logger 41 41 + n *notifier.Notifier 42 42 + eng *engine.Engine 43 43 + jq *queue.Queue 44 44 + cfg *config.Config 45 45 + ks *eventconsumer.Consumer 46 46 + res *idresolver.Resolver 47 47 + vault secrets.Manager 39 48 } 40 49 41 50 func Run(ctx context.Context) error { ··· 59 68 60 69 n := notifier.New() 61 70 62 62 - eng, err := engine.New(ctx, cfg, d, &n) 71 71 + var vault secrets.Manager 72 72 + switch cfg.Server.Secrets.Provider { 73 73 + case "openbao": 74 74 + if cfg.Server.Secrets.OpenBao.ProxyAddr == "" { 75 75 + return fmt.Errorf("openbao proxy address is required when using openbao secrets provider") 76 76 + } 77 77 + vault, err = secrets.NewOpenBaoManager( 78 78 + cfg.Server.Secrets.OpenBao.ProxyAddr, 79 79 + logger, 80 80 + secrets.WithMountPath(cfg.Server.Secrets.OpenBao.Mount), 81 81 + ) 82 82 + if err != nil { 83 83 + return fmt.Errorf("failed to setup openbao secrets provider: %w", err) 84 84 + } 85 85 + logger.Info("using openbao secrets provider", "proxy_address", cfg.Server.Secrets.OpenBao.ProxyAddr, "mount", cfg.Server.Secrets.OpenBao.Mount) 86 86 + case "sqlite", "": 87 87 + vault, err = secrets.NewSQLiteManager(cfg.Server.DBPath, secrets.WithTableName("secrets")) 88 88 + if err != nil { 89 89 + return fmt.Errorf("failed to setup sqlite secrets provider: %w", err) 90 90 + } 91 91 + logger.Info("using sqlite secrets provider", "path", cfg.Server.DBPath) 92 92 + default: 93 93 + return fmt.Errorf("unknown secrets provider: %s", cfg.Server.Secrets.Provider) 94 94 + } 95 95 + 96 96 + eng, err := engine.New(ctx, cfg, d, &n, vault) 63 97 if err != nil { 64 98 return err 65 99 } ··· 69 103 collections := []string{ 70 104 tangled.SpindleMemberNSID, 71 105 tangled.RepoNSID, 106 106 + tangled.RepoCollaboratorNSID, 72 107 } 73 108 jc, err := jetstream.NewJetstreamClient(cfg.Server.JetstreamEndpoint, "spindle", collections, nil, logger, d, true, true) 74 109 if err != nil { ··· 76 111 } 77 112 jc.AddDid(cfg.Server.Owner) 78 113 114 114 + resolver := idresolver.DefaultResolver() 115 115 + 79 116 spindle := Spindle{ 80 80 - jc: jc, 81 81 - e: e, 82 82 - db: d, 83 83 - l: logger, 84 84 - n: &n, 85 85 - eng: eng, 86 86 - jq: jq, 87 87 - cfg: cfg, 117 117 + jc: jc, 118 118 + e: e, 119 119 + db: d, 120 120 + l: logger, 121 121 + n: &n, 122 122 + eng: eng, 123 123 + jq: jq, 124 124 + cfg: cfg, 125 125 + res: resolver, 126 126 + vault: vault, 88 127 } 89 128 90 129 err = e.AddSpindle(rbacDomain) ··· 100 139 // starts a job queue runner in the background 101 140 jq.Start() 102 141 defer jq.Stop() 142 142 + 143 143 + // Stop vault token renewal if it implements Stopper 144 144 + if stopper, ok := vault.(secrets.Stopper); ok { 145 145 + defer stopper.Stop() 146 146 + } 103 147 104 148 cursorStore, err := cursor.NewSQLiteStore(cfg.Server.DBPath) 105 149 if err != nil { ··· 144 188 mux := chi.NewRouter() 145 189 146 190 mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { 147 147 - w.Write([]byte( 148 148 - ` **** 149 149 - *** *** 150 150 - *** ** ****** ** 151 151 - ** * ***** 152 152 - * ** ** 153 153 - * * * *************** 154 154 - ** ** *# ** 155 155 - * ** ** *** ** 156 156 - * * ** ** * ****** 157 157 - * ** ** * ** * * 158 158 - ** ** *** ** ** * 159 159 - ** ** * ** * * 160 160 - ** **** ** * * 161 161 - ** *** ** ** ** 162 162 - *** ** ***** 163 163 - ******************** 164 164 - ** 165 165 - * 166 166 - #************** 167 167 - ** 168 168 - ******** 169 169 - 170 170 - This is a spindle server. More info at https://tangled.sh/@tangled.sh/core/tree/master/docs/spindle`)) 191 191 + w.Write(motd) 171 192 }) 172 193 mux.HandleFunc("/events", s.Events) 173 194 mux.HandleFunc("/owner", func(w http.ResponseWriter, r *http.Request) { 174 195 w.Write([]byte(s.cfg.Server.Owner)) 175 196 }) 176 197 mux.HandleFunc("/logs/{knot}/{rkey}/{name}", s.Logs) 198 198 + 199 199 + mux.Mount("/xrpc", s.XrpcRouter()) 177 200 return mux 201 201 + } 202 202 + 203 203 + func (s *Spindle) XrpcRouter() http.Handler { 204 204 + logger := s.l.With("route", "xrpc") 205 205 + 206 206 + x := xrpc.Xrpc{ 207 207 + Logger: logger, 208 208 + Db: s.db, 209 209 + Enforcer: s.e, 210 210 + Engine: s.eng, 211 211 + Config: s.cfg, 212 212 + Resolver: s.res, 213 213 + Vault: s.vault, 214 214 + } 215 215 + 216 216 + return x.Router() 178 217 } 179 218 180 219 func (s *Spindle) processPipeline(ctx context.Context, src eventconsumer.Source, msg eventconsumer.Message) error {

+91

spindle/xrpc/add_secret.go

··· 1 1 + package xrpc 2 2 + 3 3 + import ( 4 4 + "encoding/json" 5 5 + "fmt" 6 6 + "net/http" 7 7 + "time" 8 8 + 9 9 + "github.com/bluesky-social/indigo/api/atproto" 10 10 + "github.com/bluesky-social/indigo/atproto/syntax" 11 11 + "github.com/bluesky-social/indigo/xrpc" 12 12 + securejoin "github.com/cyphar/filepath-securejoin" 13 13 + "tangled.sh/tangled.sh/core/api/tangled" 14 14 + "tangled.sh/tangled.sh/core/rbac" 15 15 + "tangled.sh/tangled.sh/core/spindle/secrets" 16 16 + ) 17 17 + 18 18 + func (x *Xrpc) AddSecret(w http.ResponseWriter, r *http.Request) { 19 19 + l := x.Logger 20 20 + fail := func(e XrpcError) { 21 21 + l.Error("failed", "kind", e.Tag, "error", e.Message) 22 22 + writeError(w, e, http.StatusBadRequest) 23 23 + } 24 24 + 25 25 + actorDid, ok := r.Context().Value(ActorDid).(syntax.DID) 26 26 + if !ok { 27 27 + fail(MissingActorDidError) 28 28 + return 29 29 + } 30 30 + 31 31 + var data tangled.RepoAddSecret_Input 32 32 + if err := json.NewDecoder(r.Body).Decode(&data); err != nil { 33 33 + fail(GenericError(err)) 34 34 + return 35 35 + } 36 36 + 37 37 + if err := secrets.ValidateKey(data.Key); err != nil { 38 38 + fail(GenericError(err)) 39 39 + return 40 40 + } 41 41 + 42 42 + // unfortunately we have to resolve repo-at here 43 43 + repoAt, err := syntax.ParseATURI(data.Repo) 44 44 + if err != nil { 45 45 + fail(InvalidRepoError(data.Repo)) 46 46 + return 47 47 + } 48 48 + 49 49 + // resolve this aturi to extract the repo record 50 50 + ident, err := x.Resolver.ResolveIdent(r.Context(), repoAt.Authority().String()) 51 51 + if err != nil || ident.Handle.IsInvalidHandle() { 52 52 + fail(GenericError(fmt.Errorf("failed to resolve handle: %w", err))) 53 53 + return 54 54 + } 55 55 + 56 56 + xrpcc := xrpc.Client{Host: ident.PDSEndpoint()} 57 57 + resp, err := atproto.RepoGetRecord(r.Context(), &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String()) 58 58 + if err != nil { 59 59 + fail(GenericError(err)) 60 60 + return 61 61 + } 62 62 + 63 63 + repo := resp.Value.Val.(*tangled.Repo) 64 64 + didPath, err := securejoin.SecureJoin(repo.Owner, repo.Name) 65 65 + if err != nil { 66 66 + fail(GenericError(err)) 67 67 + return 68 68 + } 69 69 + 70 70 + if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { 71 71 + l.Error("insufficent permissions", "did", actorDid.String()) 72 72 + writeError(w, AccessControlError(actorDid.String()), http.StatusUnauthorized) 73 73 + return 74 74 + } 75 75 + 76 76 + secret := secrets.UnlockedSecret{ 77 77 + Repo: secrets.DidSlashRepo(didPath), 78 78 + Key: data.Key, 79 79 + Value: data.Value, 80 80 + CreatedAt: time.Now(), 81 81 + CreatedBy: actorDid, 82 82 + } 83 83 + err = x.Vault.AddSecret(r.Context(), secret) 84 84 + if err != nil { 85 85 + l.Error("failed to add secret to vault", "did", actorDid.String(), "err", err) 86 86 + writeError(w, GenericError(err), http.StatusInternalServerError) 87 87 + return 88 88 + } 89 89 + 90 90 + w.WriteHeader(http.StatusOK) 91 91 + }

+91

spindle/xrpc/list_secrets.go

··· 1 1 + package xrpc 2 2 + 3 3 + import ( 4 4 + "encoding/json" 5 5 + "fmt" 6 6 + "net/http" 7 7 + "time" 8 8 + 9 9 + "github.com/bluesky-social/indigo/api/atproto" 10 10 + "github.com/bluesky-social/indigo/atproto/syntax" 11 11 + "github.com/bluesky-social/indigo/xrpc" 12 12 + securejoin "github.com/cyphar/filepath-securejoin" 13 13 + "tangled.sh/tangled.sh/core/api/tangled" 14 14 + "tangled.sh/tangled.sh/core/rbac" 15 15 + "tangled.sh/tangled.sh/core/spindle/secrets" 16 16 + ) 17 17 + 18 18 + func (x *Xrpc) ListSecrets(w http.ResponseWriter, r *http.Request) { 19 19 + l := x.Logger 20 20 + fail := func(e XrpcError) { 21 21 + l.Error("failed", "kind", e.Tag, "error", e.Message) 22 22 + writeError(w, e, http.StatusBadRequest) 23 23 + } 24 24 + 25 25 + actorDid, ok := r.Context().Value(ActorDid).(syntax.DID) 26 26 + if !ok { 27 27 + fail(MissingActorDidError) 28 28 + return 29 29 + } 30 30 + 31 31 + repoParam := r.URL.Query().Get("repo") 32 32 + if repoParam == "" { 33 33 + fail(GenericError(fmt.Errorf("empty params"))) 34 34 + return 35 35 + } 36 36 + 37 37 + // unfortunately we have to resolve repo-at here 38 38 + repoAt, err := syntax.ParseATURI(repoParam) 39 39 + if err != nil { 40 40 + fail(InvalidRepoError(repoParam)) 41 41 + return 42 42 + } 43 43 + 44 44 + // resolve this aturi to extract the repo record 45 45 + ident, err := x.Resolver.ResolveIdent(r.Context(), repoAt.Authority().String()) 46 46 + if err != nil || ident.Handle.IsInvalidHandle() { 47 47 + fail(GenericError(fmt.Errorf("failed to resolve handle: %w", err))) 48 48 + return 49 49 + } 50 50 + 51 51 + xrpcc := xrpc.Client{Host: ident.PDSEndpoint()} 52 52 + resp, err := atproto.RepoGetRecord(r.Context(), &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String()) 53 53 + if err != nil { 54 54 + fail(GenericError(err)) 55 55 + return 56 56 + } 57 57 + 58 58 + repo := resp.Value.Val.(*tangled.Repo) 59 59 + didPath, err := securejoin.SecureJoin(repo.Owner, repo.Name) 60 60 + if err != nil { 61 61 + fail(GenericError(err)) 62 62 + return 63 63 + } 64 64 + 65 65 + if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { 66 66 + l.Error("insufficent permissions", "did", actorDid.String()) 67 67 + writeError(w, AccessControlError(actorDid.String()), http.StatusUnauthorized) 68 68 + return 69 69 + } 70 70 + 71 71 + ls, err := x.Vault.GetSecretsLocked(r.Context(), secrets.DidSlashRepo(didPath)) 72 72 + if err != nil { 73 73 + l.Error("failed to get secret from vault", "did", actorDid.String(), "err", err) 74 74 + writeError(w, GenericError(err), http.StatusInternalServerError) 75 75 + return 76 76 + } 77 77 + 78 78 + var out tangled.RepoListSecrets_Output 79 79 + for _, l := range ls { 80 80 + out.Secrets = append(out.Secrets, &tangled.RepoListSecrets_Secret{ 81 81 + Repo: repoAt.String(), 82 82 + Key: l.Key, 83 83 + CreatedAt: l.CreatedAt.Format(time.RFC3339), 84 84 + CreatedBy: l.CreatedBy.String(), 85 85 + }) 86 86 + } 87 87 + 88 88 + w.Header().Set("Content-Type", "application/json") 89 89 + w.WriteHeader(http.StatusOK) 90 90 + json.NewEncoder(w).Encode(out) 91 91 + }

+82

spindle/xrpc/remove_secret.go

··· 1 1 + package xrpc 2 2 + 3 3 + import ( 4 4 + "encoding/json" 5 5 + "fmt" 6 6 + "net/http" 7 7 + 8 8 + "github.com/bluesky-social/indigo/api/atproto" 9 9 + "github.com/bluesky-social/indigo/atproto/syntax" 10 10 + "github.com/bluesky-social/indigo/xrpc" 11 11 + securejoin "github.com/cyphar/filepath-securejoin" 12 12 + "tangled.sh/tangled.sh/core/api/tangled" 13 13 + "tangled.sh/tangled.sh/core/rbac" 14 14 + "tangled.sh/tangled.sh/core/spindle/secrets" 15 15 + ) 16 16 + 17 17 + func (x *Xrpc) RemoveSecret(w http.ResponseWriter, r *http.Request) { 18 18 + l := x.Logger 19 19 + fail := func(e XrpcError) { 20 20 + l.Error("failed", "kind", e.Tag, "error", e.Message) 21 21 + writeError(w, e, http.StatusBadRequest) 22 22 + } 23 23 + 24 24 + actorDid, ok := r.Context().Value(ActorDid).(syntax.DID) 25 25 + if !ok { 26 26 + fail(MissingActorDidError) 27 27 + return 28 28 + } 29 29 + 30 30 + var data tangled.RepoRemoveSecret_Input 31 31 + if err := json.NewDecoder(r.Body).Decode(&data); err != nil { 32 32 + fail(GenericError(err)) 33 33 + return 34 34 + } 35 35 + 36 36 + // unfortunately we have to resolve repo-at here 37 37 + repoAt, err := syntax.ParseATURI(data.Repo) 38 38 + if err != nil { 39 39 + fail(InvalidRepoError(data.Repo)) 40 40 + return 41 41 + } 42 42 + 43 43 + // resolve this aturi to extract the repo record 44 44 + ident, err := x.Resolver.ResolveIdent(r.Context(), repoAt.Authority().String()) 45 45 + if err != nil || ident.Handle.IsInvalidHandle() { 46 46 + fail(GenericError(fmt.Errorf("failed to resolve handle: %w", err))) 47 47 + return 48 48 + } 49 49 + 50 50 + xrpcc := xrpc.Client{Host: ident.PDSEndpoint()} 51 51 + resp, err := atproto.RepoGetRecord(r.Context(), &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String()) 52 52 + if err != nil { 53 53 + fail(GenericError(err)) 54 54 + return 55 55 + } 56 56 + 57 57 + repo := resp.Value.Val.(*tangled.Repo) 58 58 + didPath, err := securejoin.SecureJoin(repo.Owner, repo.Name) 59 59 + if err != nil { 60 60 + fail(GenericError(err)) 61 61 + return 62 62 + } 63 63 + 64 64 + if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { 65 65 + l.Error("insufficent permissions", "did", actorDid.String()) 66 66 + writeError(w, AccessControlError(actorDid.String()), http.StatusUnauthorized) 67 67 + return 68 68 + } 69 69 + 70 70 + secret := secrets.Secret[any]{ 71 71 + Repo: secrets.DidSlashRepo(didPath), 72 72 + Key: data.Key, 73 73 + } 74 74 + err = x.Vault.RemoveSecret(r.Context(), secret) 75 75 + if err != nil { 76 76 + l.Error("failed to remove secret from vault", "did", actorDid.String(), "err", err) 77 77 + writeError(w, GenericError(err), http.StatusInternalServerError) 78 78 + return 79 79 + } 80 80 + 81 81 + w.WriteHeader(http.StatusOK) 82 82 + }

+147

spindle/xrpc/xrpc.go

··· 1 1 + package xrpc 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + _ "embed" 6 6 + "encoding/json" 7 7 + "fmt" 8 8 + "log/slog" 9 9 + "net/http" 10 10 + "strings" 11 11 + 12 12 + "github.com/bluesky-social/indigo/atproto/auth" 13 13 + "github.com/go-chi/chi/v5" 14 14 + 15 15 + "tangled.sh/tangled.sh/core/api/tangled" 16 16 + "tangled.sh/tangled.sh/core/idresolver" 17 17 + "tangled.sh/tangled.sh/core/rbac" 18 18 + "tangled.sh/tangled.sh/core/spindle/config" 19 19 + "tangled.sh/tangled.sh/core/spindle/db" 20 20 + "tangled.sh/tangled.sh/core/spindle/engine" 21 21 + "tangled.sh/tangled.sh/core/spindle/secrets" 22 22 + ) 23 23 + 24 24 + const ActorDid string = "ActorDid" 25 25 + 26 26 + type Xrpc struct { 27 27 + Logger *slog.Logger 28 28 + Db *db.DB 29 29 + Enforcer *rbac.Enforcer 30 30 + Engine *engine.Engine 31 31 + Config *config.Config 32 32 + Resolver *idresolver.Resolver 33 33 + Vault secrets.Manager 34 34 + } 35 35 + 36 36 + func (x *Xrpc) Router() http.Handler { 37 37 + r := chi.NewRouter() 38 38 + 39 39 + r.With(x.VerifyServiceAuth).Post("/"+tangled.RepoAddSecretNSID, x.AddSecret) 40 40 + r.With(x.VerifyServiceAuth).Post("/"+tangled.RepoRemoveSecretNSID, x.RemoveSecret) 41 41 + r.With(x.VerifyServiceAuth).Get("/"+tangled.RepoListSecretsNSID, x.ListSecrets) 42 42 + 43 43 + return r 44 44 + } 45 45 + 46 46 + func (x *Xrpc) VerifyServiceAuth(next http.Handler) http.Handler { 47 47 + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { 48 48 + l := x.Logger.With("url", r.URL) 49 49 + 50 50 + token := r.Header.Get("Authorization") 51 51 + token = strings.TrimPrefix(token, "Bearer ") 52 52 + 53 53 + s := auth.ServiceAuthValidator{ 54 54 + Audience: x.Config.Server.Did().String(), 55 55 + Dir: x.Resolver.Directory(), 56 56 + } 57 57 + 58 58 + did, err := s.Validate(r.Context(), token, nil) 59 59 + if err != nil { 60 60 + l.Error("signature verification failed", "err", err) 61 61 + writeError(w, AuthError(err), http.StatusForbidden) 62 62 + return 63 63 + } 64 64 + 65 65 + r = r.WithContext( 66 66 + context.WithValue(r.Context(), ActorDid, did), 67 67 + ) 68 68 + 69 69 + next.ServeHTTP(w, r) 70 70 + }) 71 71 + } 72 72 + 73 73 + type XrpcError struct { 74 74 + Tag string `json:"error"` 75 75 + Message string `json:"message"` 76 76 + } 77 77 + 78 78 + func NewXrpcError(opts ...ErrOpt) XrpcError { 79 79 + x := XrpcError{} 80 80 + for _, o := range opts { 81 81 + o(&x) 82 82 + } 83 83 + 84 84 + return x 85 85 + } 86 86 + 87 87 + type ErrOpt = func(xerr *XrpcError) 88 88 + 89 89 + func WithTag(tag string) ErrOpt { 90 90 + return func(xerr *XrpcError) { 91 91 + xerr.Tag = tag 92 92 + } 93 93 + } 94 94 + 95 95 + func WithMessage[S ~string](s S) ErrOpt { 96 96 + return func(xerr *XrpcError) { 97 97 + xerr.Message = string(s) 98 98 + } 99 99 + } 100 100 + 101 101 + func WithError(e error) ErrOpt { 102 102 + return func(xerr *XrpcError) { 103 103 + xerr.Message = e.Error() 104 104 + } 105 105 + } 106 106 + 107 107 + var MissingActorDidError = NewXrpcError( 108 108 + WithTag("MissingActorDid"), 109 109 + WithMessage("actor DID not supplied"), 110 110 + ) 111 111 + 112 112 + var AuthError = func(err error) XrpcError { 113 113 + return NewXrpcError( 114 114 + WithTag("Auth"), 115 115 + WithError(fmt.Errorf("signature verification failed: %w", err)), 116 116 + ) 117 117 + } 118 118 + 119 119 + var InvalidRepoError = func(r string) XrpcError { 120 120 + return NewXrpcError( 121 121 + WithTag("InvalidRepo"), 122 122 + WithError(fmt.Errorf("supplied at-uri is not a repo: %s", r)), 123 123 + ) 124 124 + } 125 125 + 126 126 + func GenericError(err error) XrpcError { 127 127 + return NewXrpcError( 128 128 + WithTag("Generic"), 129 129 + WithError(err), 130 130 + ) 131 131 + } 132 132 + 133 133 + var AccessControlError = func(d string) XrpcError { 134 134 + return NewXrpcError( 135 135 + WithTag("AccessControl"), 136 136 + WithError(fmt.Errorf("DID does not have sufficent access permissions for this operation: %s", d)), 137 137 + ) 138 138 + } 139 139 + 140 140 + // this is slightly different from http_util::write_error to follow the spec: 141 141 + // 142 142 + // the json object returned must include an "error" and a "message" 143 143 + func writeError(w http.ResponseWriter, e XrpcError, status int) { 144 144 + w.Header().Set("Content-Type", "application/json") 145 145 + w.WriteHeader(status) 146 146 + json.NewEncoder(w).Encode(e) 147 147 + }