appview: ingester: gate artifact ingestion to repo:push

thanks @cinny.bun.how on bluesky.

appview/db/repos.go

···
 	"time"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"tangled.sh/tangled.sh/core/api/tangled"
 )
 
···
 
 func (r Repo) RepoAt() syntax.ATURI {
 	return syntax.ATURI(fmt.Sprintf("at://%s/%s/%s", r.Did, tangled.RepoNSID, r.Rkey))
+}
+
+func (r Repo) DidSlashRepo() string {
+	p, _ := securejoin.SecureJoin(r.Did, r.Name)
+	return p
 }
 
 func GetAllRepos(e Execer, limit int) ([]Repo, error) {

appview/ingester.go

···
 	"github.com/ipfs/go-cid"
 	"tangled.sh/tangled.sh/core/api/tangled"
 	"tangled.sh/tangled.sh/core/appview/db"
+	"tangled.sh/tangled.sh/core/rbac"
 )
 
 type Ingester func(ctx context.Context, e *models.Event) error
 
-func Ingest(d db.DbWrapper) Ingester {
+func Ingest(d db.DbWrapper, enforcer *rbac.Enforcer) Ingester {
 	return func(ctx context.Context, e *models.Event) error {
 		var err error
 		defer func() {
···
 		case tangled.PublicKeyNSID:
 			ingestPublicKey(&d, e)
 		case tangled.RepoArtifactNSID:
-			ingestArtifact(&d, e)
+			ingestArtifact(&d, e, enforcer)
 		case tangled.ActorProfileNSID:
 			ingestProfile(&d, e)
 		}
···
 	return nil
 }
 
-func ingestArtifact(d *db.DbWrapper, e *models.Event) error {
+func ingestArtifact(d *db.DbWrapper, e *models.Event, enforcer *rbac.Enforcer) error {
 	did := e.Did
 	var err error
 
···
 
 		repoAt, err := syntax.ParseATURI(record.Repo)
 		if err != nil {
+			return err
+		}
+
+		repo, err := db.GetRepoByAtUri(d, repoAt.String())
+		if err != nil {
+			return err
+		}
+
+		ok, err := enforcer.E.Enforce(did, repo.Knot, repo.DidSlashRepo(), "repo:push")
+		if err != nil || !ok {
 			return err
 		}
 

appview/state/state.go

···
 	if err != nil {
 		return nil, fmt.Errorf("failed to create jetstream client: %w", err)
 	}
-	err = jc.StartJetstream(context.Background(), appview.Ingest(wrapper))
+	err = jc.StartJetstream(context.Background(), appview.Ingest(wrapper, enforcer))
 	if err != nil {
 		return nil, fmt.Errorf("failed to start jetstream watcher: %w", err)
 	}