rbac2: rbac enforcer rewrite

- use repo AT-URI as identifier
- use `dom` field rather than `obj` to filter by repository
So now it's "user with role A in repo B can do action D to object C"
where `A,B,C,D` are `sub,dom,obj,act`.

Many parts are missing, but should be enough to test this new RBAC
enforcer package in spindle.

Related issue: <https://tangled.org/tangled.org/core/issues/282>

Signed-off-by: Seongmin Lee <[e-mail]>

appview/db/follow.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var follow models.Follow
 		var followedAt string

appview/db/issues.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	for rows.Next() {
 		var comment models.IssueComment

appview/db/language.go

···
 		whereClause,
 	)
 	rows, err := e.Query(query, args...)
-
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute query: %w ", err)
 	}
+	defer rows.Close()
 
 	var langs []models.RepoLanguage
 	for rows.Next() {

appview/db/profile.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	profileMap := make(map[string]*models.Profile)
 	for rows.Next() {
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	idxs := make(map[string]int)
 	for did := range profileMap {
 		idxs[did] = 0
···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
+
 	idxs = make(map[string]int)
 	for did := range profileMap {
 		idxs[did] = 0

appview/db/registration.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	for rows.Next() {
 		var createdAt string

appview/db/repos.go

···
 		limitClause,
 	)
 	rows, err := e.Query(repoQuery, args...)
-
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute repo query: %w ", err)
 	}
+	defer rows.Close()
 
 	for rows.Next() {
 		var repo models.Repo
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute labels query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat, labelat string
 		if err := rows.Scan(&repoat, &labelat); err != nil {
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute lang query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat, lang string
 		if err := rows.Scan(&repoat, &lang); err != nil {
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute star-count query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat string
 		var count int
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute issue-count query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat string
 		var open, closed int
···
 	if err != nil {
 		return nil, fmt.Errorf("failed to execute pulls-count query: %w ", err)
 	}
+	defer rows.Close()
+
 	for rows.Next() {
 		var repoat string
 		var open, merged, closed, deleted int

appview/db/star.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	starMap := make(map[string][]models.Star)
 	for rows.Next() {

appview/notify/merged_notifier.go

···
 			v.Call(in)
 		}(n)
 	}
-	wg.Wait()
 }
 
 func (m *mergedNotifier) NewRepo(ctx context.Context, repo *models.Repo) {

appview/pages/funcmap.go

···
 	"github.com/dustin/go-humanize"
 	"github.com/go-enry/go-enry/v2"
 	"github.com/yuin/goldmark"
+	emoji "github.com/yuin/goldmark-emoji"
 	"tangled.org/core/appview/filetree"
 	"tangled.org/core/appview/models"
 	"tangled.org/core/appview/pages/markup"
···
 		},
 		"description": func(text string) template.HTML {
 			p.rctx.RendererType = markup.RendererTypeDefault
-			htmlString := p.rctx.RenderMarkdownWith(text, goldmark.New())
+			htmlString := p.rctx.RenderMarkdownWith(text, goldmark.New(
+				goldmark.WithExtensions(
+					emoji.Emoji,
+				),
+			))
 			sanitized := p.rctx.SanitizeDescription(htmlString)
 			return template.HTML(sanitized)
 		},

appview/pages/markup/markdown.go

···
 	chromahtml "github.com/alecthomas/chroma/v2/formatters/html"
 	"github.com/alecthomas/chroma/v2/styles"
 	"github.com/yuin/goldmark"
+	"github.com/yuin/goldmark-emoji"
 	highlighting "github.com/yuin/goldmark-highlighting/v2"
 	"github.com/yuin/goldmark/ast"
 	"github.com/yuin/goldmark/extension"
···
 			),
 			callout.CalloutExtention,
 			textension.AtExt,
+			emoji.Emoji,
 		),
 		goldmark.WithParserOptions(
 			parser.WithAutoHeadingID(),

appview/pages/pages.go

···
 }
 
 func (p *Pages) StarBtnFragment(w io.Writer, params StarBtnFragmentParams) error {
-	return p.executePlain("fragments/starBtn", w, params)
+	return p.executePlain("fragments/starBtn-oob", w, params)
 }
 
 type RepoIndexParams struct {

appview/pages/templates/fragments/starBtn-oob.html

···
+{{ define "fragments/starBtn-oob" }}
+  <div hx-swap-oob='outerHTML:#starBtn[data-star-subject-at="{{ .SubjectAt }}"]'>
+    {{ template "fragments/starBtn" . }}
+  </div>
+{{ end }}

appview/pages/templates/fragments/starBtn.html

···
 {{ define "fragments/starBtn" }}
+    {{/* NOTE: this fragment is always replaced with hx-swap-oob */}}
     <button
         id="starBtn"
         class="btn disabled:opacity-50 disabled:cursor-not-allowed flex gap-2 items-center group"
···
         {{ end }}
 
         hx-trigger="click"
-        hx-target="this"
-        hx-swap="outerHTML"
-        hx-swap-oob='outerHTML:#starBtn[data-star-subject-at="{{ .SubjectAt }}"]'
         hx-disabled-elt="#starBtn"
     >
         {{ if .IsStarred }}

appview/pages/templates/knots/index.html

···
 {{ define "docsButton" }}
 <a
 class="btn flex items-center gap-2"
-href="https://tangled.org/@tangled.org/core/blob/master/docs/spindle/hosting.md">
+href="https://tangled.org/@tangled.org/core/blob/master/docs/knot-hosting.md">
 {{ i "book" "size-4" }}
 docs
 </a>

appview/pages/templates/repo/empty.html

···
     {{ else if (and .LoggedInUser (eq .LoggedInUser.Did .RepoInfo.OwnerDid)) }}
       {{ $knot := .RepoInfo.Knot }}
       {{ if eq $knot "knot1.tangled.sh" }}
-          {{ $knot = "tangled.sh" }}
+          {{ $knot = "tangled.org" }}
       {{ end }}
       <div class="w-full flex place-content-center">
         <div class="py-6 w-fit flex flex-col gap-4">

appview/pages/templates/repo/fragments/backlinks.html

···
           <div class="flex gap-2 items-center">
             {{ if .State.IsClosed }}
               <span class="text-gray-500 dark:text-gray-400">
-                {{ i "ban" "w-4 h-4" }}
+                {{ i "ban" "size-3" }}
               </span>
             {{ else if eq .Kind.String "issues" }}
               <span class="text-green-600 dark:text-green-500">
-                {{ i "circle-dot" "w-4 h-4" }}
+                {{ i "circle-dot" "size-3" }}
               </span>
             {{ else if .State.IsOpen }}
               <span class="text-green-600 dark:text-green-500">
-                {{ i "git-pull-request" "w-4 h-4" }}
+                {{ i "git-pull-request" "size-3" }}
               </span>
             {{ else if .State.IsMerged }}
               <span class="text-purple-600 dark:text-purple-500">
-                {{ i "git-merge" "w-4 h-4" }}
+                {{ i "git-merge" "size-3" }}
               </span>
             {{ else }}
               <span class="text-gray-600 dark:text-gray-300">
-                {{ i "git-pull-request-closed" "w-4 h-4" }}
+                {{ i "git-pull-request-closed" "size-3" }}
               </span>
             {{ end }}
-            <a href="{{ . }}"><span class="text-gray-500 dark:text-gray-400">#{{ .SubjectId }}</span> {{ .Title }}</a>
+            <a href="{{ . }}" class="line-clamp-1 text-sm"><span class="text-gray-500 dark:text-gray-400">#{{ .SubjectId }}</span> {{ .Title }}</a>
           </div>
           {{ if not (eq $.RepoInfo.FullName $repoUrl) }}
           <div>

appview/pages/templates/strings/string.html

···
         <span class="select-none">/</span>
         <a href="/strings/{{ $ownerId }}/{{ .String.Rkey }}" class="font-bold">{{ .String.Filename }}</a>
       </div>
-      <div class="flex gap-2 text-base">
+      <div class="flex gap-2 items-stretch text-base">
         {{ if and .LoggedInUser (eq .LoggedInUser.Did .String.Did) }}
           <a class="btn flex items-center gap-2 no-underline hover:no-underline p-2 group"
              hx-boost="true"

appview/pages/templates/user/fragments/followCard.html

···
       <img class="object-cover rounded-full p-2" src="{{ fullAvatar $userIdent }}" alt="{{ $userIdent }}" />
     </div>
 
-    <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-2 w-full">
+    <div class="flex flex-col md:flex-row md:items-center md:justify-between gap-2 w-full min-w-0">
       <div class="flex-1 min-h-0 justify-around flex flex-col">
         <a href="/{{ $userIdent }}">
           <span class="font-bold dark:text-white overflow-hidden text-ellipsis whitespace-nowrap max-w-full">{{ $userIdent | truncateAt30 }}</span>
         </a>
         {{ with .Profile }}
-        <p class="text-sm pb-2 md:pb-2">{{.Description}}</p>
+        <p class="text-sm pb-2 md:pb-2 break-words">{{.Description}}</p>
         {{ end }}
         <div class="text-sm flex items-center gap-2 my-2 overflow-hidden text-ellipsis whitespace-nowrap max-w-full">
           <span class="flex-shrink-0">{{ i "users" "size-4" }}</span>

appview/pulls/pulls.go

···
 			s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.")
 			return
 		}
+
 	}
 
 	if err = tx.Commit(); err != nil {
 		log.Println("failed to create pull request", err)
 		s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.")
 		return
+	}
+
+	// notify about each pull
+	//
+	// this is performed after tx.Commit, because it could result in a locked DB otherwise
+	for _, p := range stack {
+		s.notifier.NewPull(r.Context(), p)
 	}
 
 	ownerSlashRepo := reporesolver.GetBaseRepoPath(r, repo)

flake.lock

···
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1694529238,
-        "narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
···
         ]
       },
       "locked": {
-        "lastModified": 1754078208,
-        "narHash": "sha256-YVoIFDCDpYuU3riaDEJ3xiGdPOtsx4sR5eTzHTytPV8=",
+        "lastModified": 1763982521,
+        "narHash": "sha256-ur4QIAHwgFc0vXiaxn5No/FuZicxBr2p0gmT54xZkUQ=",
         "owner": "nix-community",
         "repo": "gomod2nix",
-        "rev": "7f963246a71626c7fc70b431a315c4388a0c95cf",
+        "rev": "02e63a239d6eabd595db56852535992c898eba72",
         "type": "github"
       },
       "original": {
···
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1765186076,
-        "narHash": "sha256-hM20uyap1a0M9d344I692r+ik4gTMyj60cQWO+hAYP8=",
+        "lastModified": 1766070988,
+        "narHash": "sha256-G/WVghka6c4bAzMhTwT2vjLccg/awmHkdKSd2JrycLc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "addf7cf5f383a3101ecfba091b98d0a1263dc9b8",
+        "rev": "c6245e83d836d0433170a16eb185cefe0572f8b8",
         "type": "github"
       },
       "original": {

flake.nix

···
         spindle = self.callPackage ./nix/pkgs/spindle.nix {};
         knot-unwrapped = self.callPackage ./nix/pkgs/knot-unwrapped.nix {};
         knot = self.callPackage ./nix/pkgs/knot.nix {};
+        did-method-plc = self.callPackage ./nix/pkgs/did-method-plc.nix {};
+        bluesky-jetstream = self.callPackage ./nix/pkgs/bluesky-jetstream.nix {};
+        bluesky-relay = self.callPackage ./nix/pkgs/bluesky-relay.nix {};
+        tap = self.callPackage ./nix/pkgs/tap.nix {};
       });
   in {
     overlays.default = final: prev: {
-      inherit (mkPackageSet final) lexgen goat sqlite-lib spindle knot-unwrapped knot appview;
+      inherit (mkPackageSet final) lexgen goat sqlite-lib spindle knot-unwrapped knot appview did-method-plc bluesky-jetstream bluesky-relay tap;
     };
 
     packages = forAllSystems (system: let
···
       staticPackages = mkPackageSet pkgs.pkgsStatic;
       crossPackages = mkPackageSet pkgs.pkgsCross.gnu64.pkgsStatic;
     in {
-      inherit (packages) appview appview-static-files lexgen goat spindle knot knot-unwrapped sqlite-lib;
+      inherit (packages) appview appview-static-files lexgen goat spindle knot knot-unwrapped sqlite-lib did-method-plc bluesky-jetstream bluesky-relay tap;
 
       pkgsStatic-appview = staticPackages.appview;
       pkgsStatic-knot = staticPackages.knot;
···
       imports = [./nix/modules/spindle.nix];
 
       services.tangled.spindle.package = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.spindle;
+    };
+    nixosModules.did-method-plc = {
+      lib,
+      pkgs,
+      ...
+    }: {
+      imports = [./nix/modules/did-method-plc.nix];
+      services.did-method-plc.package = lib.mkDefault self.packages.${pkgs.system}.did-method-plc;
+    };
+    nixosModules.bluesky-relay = {
+      lib,
+      pkgs,
+      ...
+    }: {
+      imports = [./nix/modules/bluesky-relay.nix];
+      services.bluesky-relay.package = lib.mkDefault self.packages.${pkgs.system}.bluesky-relay;
+    };
+    nixosModules.bluesky-jetstream = {
+      lib,
+      pkgs,
+      ...
+    }: {
+      imports = [./nix/modules/bluesky-jetstream.nix];
+      services.bluesky-jetstream.package = lib.mkDefault self.packages.${pkgs.system}.bluesky-jetstream;
     };
   };
 }

go.mod

···
 	github.com/urfave/cli/v3 v3.3.3
 	github.com/whyrusleeping/cbor-gen v0.3.1
 	github.com/yuin/goldmark v1.7.13
+	github.com/yuin/goldmark-emoji v1.0.6
 	github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc
 	gitlab.com/staticnoise/goldmark-callout v0.0.0-20240609120641-6366b799e4ab
 	golang.org/x/crypto v0.40.0
 	golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
 	golang.org/x/image v0.31.0
 	golang.org/x/net v0.42.0
-	golang.org/x/sync v0.17.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
 	gopkg.in/yaml.v3 v3.0.1
 )
···
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
 	golang.org/x/sys v0.34.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
 	golang.org/x/time v0.12.0 // indirect

go.sum

···
 github.com/yuin/goldmark v1.4.15/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/goldmark v1.7.13 h1:GPddIs617DnBLFFVJFgpo1aBfe/4xcvMc3SB5t/D0pA=
 github.com/yuin/goldmark v1.7.13/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
+github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs=
+github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc h1:+IAOyRda+RLrxa1WC7umKOZRsGq4QrFFMYApOeHzQwQ=
 github.com/yuin/goldmark-highlighting/v2 v2.0.0-20230729083705-37449abec8cc/go.mod h1:ovIvrum6DQJA4QsJSovrkC4saKHQVs7TvcaeO8AIl5I=
 gitlab.com/staticnoise/goldmark-callout v0.0.0-20240609120641-6366b799e4ab h1:gK9tS6QJw5F0SIhYJnGG2P83kuabOdmWBbSmZhJkz2A=

nix/gomod2nix.toml

···
   [mod."github.com/yuin/goldmark"]
     version = "v1.7.13"
     hash = "sha256-vBCxZrPYPc8x/nvAAv3Au59dCCyfS80Vw3/a9EXK7TE="
+  [mod."github.com/yuin/goldmark-emoji"]
+    version = "v1.0.6"
+    hash = "sha256-+d6bZzOPE+JSFsZbQNZMCWE+n3jgcQnkPETVk47mxSY="
   [mod."github.com/yuin/goldmark-highlighting/v2"]
     version = "v2.0.0-20230729083705-37449abec8cc"
     hash = "sha256-HpiwU7jIeDUAg2zOpTIiviQir8dpRPuXYh2nqFFccpg="

nix/modules/bluesky-jetstream.nix

···
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.services.bluesky-jetstream;
+in
+  with lib; {
+    options.services.bluesky-jetstream = {
+      enable = mkEnableOption "jetstream server";
+      package = mkPackageOption pkgs "bluesky-jetstream" {};
+
+      # dataDir = mkOption {
+      #   type = types.str;
+      #   default = "/var/lib/jetstream";
+      #   description = "directory to store data (pebbleDB)";
+      # };
+      livenessTtl = mkOption {
+        type = types.int;
+        default = 15;
+        description = "time to restart when no event detected (seconds)";
+      };
+      websocketUrl = mkOption {
+        type = types.str;
+        default = "wss://bsky.network/xrpc/com.atproto.sync.subscribeRepos";
+        description = "full websocket path to the ATProto SubscribeRepos XRPC endpoint";
+      };
+    };
+    config = mkIf cfg.enable {
+      systemd.services.bluesky-jetstream = {
+        description = "bluesky jetstream";
+        after = ["network.target" "pds.service"];
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig = {
+          User = "jetstream";
+          Group = "jetstream";
+          StateDirectory = "jetstream";
+          StateDirectoryMode = "0755";
+          # preStart = ''
+          #   mkdir -p "${cfg.dataDir}"
+          #   chown -R jetstream:jetstream "${cfg.dataDir}"
+          # '';
+          # WorkingDirectory = cfg.dataDir;
+          Environment = [
+            "JETSTREAM_DATA_DIR=/var/lib/jetstream/data"
+            "JETSTREAM_LIVENESS_TTL=${toString cfg.livenessTtl}s"
+            "JETSTREAM_WS_URL=${cfg.websocketUrl}"
+          ];
+          ExecStart = getExe cfg.package;
+          Restart = "always";
+          RestartSec = 5;
+        };
+      };
+      users = {
+        users.jetstream = {
+          group = "jetstream";
+          isSystemUser = true;
+        };
+        groups.jetstream = {};
+      };
+    };
+  }

nix/modules/bluesky-relay.nix

···
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.services.bluesky-relay;
+in
+  with lib; {
+    options.services.bluesky-relay = {
+      enable = mkEnableOption "relay server";
+      package = mkPackageOption pkgs "bluesky-relay" {};
+    };
+    config = mkIf cfg.enable {
+      systemd.services.bluesky-relay = {
+        description = "bluesky relay";
+        after = ["network.target" "pds.service"];
+        wantedBy = ["multi-user.target"];
+
+        serviceConfig = {
+          User = "relay";
+          Group = "relay";
+          StateDirectory = "relay";
+          StateDirectoryMode = "0755";
+          Environment = [
+            "RELAY_ADMIN_PASSWORD=password"
+            "RELAY_PLC_HOST=https://plc.tngl.boltless.dev"
+            "DATABASE_URL=sqlite:///var/lib/relay/relay.sqlite"
+            "RELAY_IP_BIND=:2470"
+            "RELAY_PERSIST_DIR=/var/lib/relay"
+            "RELAY_DISABLE_REQUEST_CRAWL=0"
+            "RELAY_INITIAL_SEQ_NUMBER=1"
+            "RELAY_ALLOW_INSECURE_HOSTS=1"
+          ];
+          ExecStart = "${getExe cfg.package} serve";
+          Restart = "always";
+          RestartSec = 5;
+        };
+      };
+      users = {
+        users.relay = {
+          group = "relay";
+          isSystemUser = true;
+        };
+        groups.relay = {};
+      };
+    };
+  }

nix/modules/did-method-plc.nix

···
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  cfg = config.services.did-method-plc;
+in
+  with lib; {
+    options.services.did-method-plc = {
+      enable = mkEnableOption "did-method-plc server";
+      package = mkPackageOption pkgs "did-method-plc" {};
+    };
+    config = mkIf cfg.enable {
+      services.postgresql = {
+        enable = true;
+        package = pkgs.postgresql_14;
+        ensureDatabases = ["plc"];
+        ensureUsers = [
+          {
+            name = "pg";
+            # ensurePermissions."DATABASE plc" = "ALL PRIVILEGES";
+          }
+        ];
+        authentication = ''
+          local all all trust
+          host  all all 127.0.0.1/32 trust
+        '';
+      };
+      systemd.services.did-method-plc = {
+        description = "did-method-plc";
+
+        after = ["postgresql.service"];
+        wants = ["postgresql.service"];
+        wantedBy = ["multi-user.target"];
+
+        environment = let
+          db_creds_json = builtins.toJSON {
+            username = "pg";
+            password = "";
+            host = "127.0.0.1";
+            port = 5432;
+          };
+        in {
+          # TODO: inherit from config
+          DEBUG_MODE = "1";
+          LOG_ENABLED = "true";
+          LOG_LEVEL = "debug";
+          LOG_DESTINATION = "1";
+          ENABLE_MIGRATIONS = "true";
+          DB_CREDS_JSON = db_creds_json;
+          DB_MIGRATE_CREDS_JSON = db_creds_json;
+          PLC_VERSION = "0.0.1";
+          PORT = "8080";
+        };
+
+        serviceConfig = {
+          ExecStart = getExe cfg.package;
+          User = "plc";
+          Group = "plc";
+          StateDirectory = "plc";
+          StateDirectoryMode = "0755";
+          Restart = "always";
+
+          # Hardening
+        };
+      };
+      users = {
+        users.plc = {
+          group = "plc";
+          isSystemUser = true;
+        };
+        groups.plc = {};
+      };
+    };
+  }

nix/pkgs/bluesky-jetstream.nix

···
+{
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule {
+  pname = "bluesky-jetstream";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "bluesky-social";
+    repo = "jetstream";
+    rev = "7d7efa58d7f14101a80ccc4f1085953948b7d5de";
+    sha256 = "sha256-1e9SL/8gaDPMA4YZed51ffzgpkptbMd0VTbTTDbPTFw=";
+  };
+  subPackages = ["cmd/jetstream"];
+  vendorHash = "sha256-/21XJQH6fo9uPzlABUAbdBwt1O90odmppH6gXu2wkiQ=";
+  doCheck = false;
+  meta = {
+    mainProgram = "jetstream";
+  };
+}

nix/pkgs/bluesky-relay.nix

···
+{
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule {
+  pname = "bluesky-relay";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "boltlessengineer";
+    repo = "indigo";
+    rev = "b769ea60b7dde5e2bd0b8ee3ce8462a0c0e596fe";
+    sha256 = "sha256-jHRY825TBYaH1WkKFUoNbo4UlMSyuHvCGjYPiBnKo44=";
+  };
+  subPackages = ["cmd/relay"];
+  vendorHash = "sha256-UOedwNYnM8Jx6B7Y9tFcZX8IeUBESAFAPTRYk7n0yo8=";
+  doCheck = false;
+  meta = {
+    mainProgram = "relay";
+  };
+}

nix/pkgs/did-method-plc.nix

···
+# inspired by https://github.com/NixOS/nixpkgs/blob/333bfb7c258fab089a834555ea1c435674c459b4/pkgs/by-name/ga/gatsby-cli/package.nix
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  makeBinaryWrapper,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "did-method-plc";
+  version = "0.0.1";
+
+  src = fetchFromGitHub {
+    owner = "did-method-plc";
+    repo = "did-method-plc";
+    rev = "158ba5535ac3da4fd4309954bde41deab0b45972";
+    sha256 = "sha256-O5smubbrnTDMCvL6iRyMXkddr5G7YHxkQRVMRULHanQ=";
+  };
+  postPatch = ''
+    # remove dd-trace dependency
+    sed -i '3d' packages/server/service/index.js
+  '';
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-g8GzaAbWSnWwbQjJMV2DL5/ZlWCCX0sRkjjvX3tqU4Y=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+    makeBinaryWrapper
+  ];
+  yarnBuildScript = "lerna";
+  yarnBuildFlags = [
+    "run"
+    "build"
+    "--scope"
+    "@did-plc/server"
+    "--include-dependencies"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/
+    mv packages/ $out/lib/packages/
+    mv node_modules/* $out/lib/node_modules/
+
+    makeWrapper ${lib.getExe nodejs} $out/bin/plc \
+      --add-flags $out/lib/packages/server/service/index.js \
+      --add-flags --enable-source-maps \
+      --set NODE_PATH $out/lib/node_modules
+
+    runHook postInstall
+  '';
+
+  meta = {
+    mainProgram = "plc";
+  };
+})

nix/pkgs/tap.nix

···
+{
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule {
+  pname = "tap";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "bluesky-social";
+    repo = "indigo";
+    rev = "f92cb29224fcc60f666b20ee3514e431a58ff811";
+    sha256 = "sha256-35ltXnq0SJeo3j33D7Nndbcnw5XWBJLRrmZ+nCmZVQw=";
+  };
+  subPackages = ["cmd/tap"];
+  vendorHash = "sha256-UOedwNYnM8Jx6B7Y9tFcZX8IeUBESAFAPTRYk7n0yo8=";
+  doCheck = false;
+  meta = {
+    mainProgram = "tap";
+  };
+}

rbac2/rbac2.go

···
+package rbac2
+
+import (
+	"database/sql"
+	"fmt"
+
+	adapter "github.com/Blank-Xu/sql-adapter"
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"github.com/casbin/casbin/v2"
+	"github.com/casbin/casbin/v2/model"
+	"github.com/casbin/casbin/v2/util"
+	"tangled.org/core/api/tangled"
+)
+
+const (
+	Model = `
+[request_definition]
+r = sub, dom, obj, act
+
+[policy_definition]
+p = sub, dom, obj, act
+
+[role_definition]
+g = _, _, _
+
+[policy_effect]
+e = some(where (p.eft == allow))
+
+[matchers]
+m = g(r.sub, p.sub, r.dom) && keyMatch4(r.dom, p.dom) && r.obj == p.obj && r.act == p.act
+`
+)
+
+type Enforcer struct {
+	e *casbin.Enforcer
+}
+
+func NewEnforcer(path string) (*Enforcer, error) {
+	m, err := model.NewModelFromString(Model)
+	if err != nil {
+		return nil, err
+	}
+
+	db, err := sql.Open("sqlite3", path+"?_foreign_keys=1")
+	if err != nil {
+		return nil, err
+	}
+
+	a, err := adapter.NewAdapter(db, "sqlite3", "acl")
+	if err != nil {
+		return nil, err
+	}
+
+	e, err := casbin.NewEnforcer(m, a)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := seedTangledPolicies(e); err != nil {
+		return nil, err
+	}
+
+	return &Enforcer{e}, nil
+}
+
+func seedTangledPolicies(e *casbin.Enforcer) error {
+	// policies
+	aturi := func(nsid string) string {
+		return fmt.Sprintf("at://{did}/%s/{rkey}", nsid)
+	}
+
+	_, err := e.AddPoliciesEx([][]string{
+		// sub | dom | obj | act
+		{"repo:owner", aturi(tangled.RepoNSID), "/", "write"},
+		{"repo:owner", aturi(tangled.RepoNSID), "/collaborator", "write"}, // invite
+		{"repo:collaborator", aturi(tangled.RepoNSID), "/settings", "write"},
+		{"repo:collaborator", aturi(tangled.RepoNSID), "/git", "write"}, // git push
+
+		{"server:owner", "/knot/{did}", "/member", "write"}, // invite
+		{"server:member", "/knot/{did}", "/git", "write"},
+
+		{"server:owner", "/spindle/{did}", "/member", "write"}, // invite
+	})
+	if err != nil {
+		return err
+	}
+
+	// grouping policies
+	// TODO(boltless): define our own matcher to replace keyMatch4
+	e.AddNamedDomainMatchingFunc("g", "keyMatch4", util.KeyMatch4)
+	_, err = e.AddGroupingPoliciesEx([][]string{
+		// sub | role | dom
+		{"repo:owner", "repo:collaborator", aturi(tangled.RepoNSID)},
+
+		// using '/knot/' prefix here because knot/spindle identifiers don't
+		// include the collection type
+		{"server:owner", "server:member", "/knot/{did}"},
+		{"server:owner", "server:member", "/spindle/{did}"},
+	})
+	return err
+}
+
+func (e *Enforcer) hasImplicitRoleForUser(name string, role string, domain ...string) (bool, error) {
+	roles, err := e.e.GetImplicitRolesForUser(name, domain...)
+	if err != nil {
+		return false, err
+	}
+	for _, r := range roles {
+		if r == role {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// setRoleForUser sets single user role for specified domain.
+// All existing users with that role will be removed.
+func (e *Enforcer) setRoleForUser(name string, role string, domain ...string) error {
+	currentUsers, err := e.e.GetUsersForRole(role, domain...)
+	if err != nil {
+		return err
+	}
+
+	for _, oldUser := range currentUsers {
+		_, err = e.e.DeleteRoleForUser(oldUser, role, domain...)
+		if err != nil {
+			return err
+		}
+	}
+
+	_, err = e.e.AddRoleForUser(name, role, domain...)
+	return err
+}
+
+// validateAtUri enforeces AT-URI to have valid did as authority and match collection NSID.
+func validateAtUri(uri syntax.ATURI, expected string) error {
+	if !uri.Authority().IsDID() {
+		return fmt.Errorf("expected at-uri with did")
+	}
+	if expected != "" && uri.Collection().String() != expected {
+		return fmt.Errorf("incorrect repo at-uri collection nsid '%s' (expected '%s')", uri.Collection(), expected)
+	}
+	return nil
+}

rbac2/rbac2_test.go

···
+package rbac2_test
+
+import (
+	"testing"
+
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	_ "github.com/mattn/go-sqlite3"
+	"github.com/stretchr/testify/assert"
+	"tangled.org/core/rbac2"
+)
+
+func setup(t *testing.T) *rbac2.Enforcer {
+	enforcer, err := rbac2.NewEnforcer(":memory:")
+	assert.NoError(t, err)
+
+	return enforcer
+}
+
+func TestRepoOwnerPermissions(t *testing.T) {
+	var (
+		e       = setup(t)
+		ok      bool
+		err     error
+		fooRepo = syntax.ATURI("at://did:plc:foo/sh.tangled.repo/reporkey")
+		fooUser = syntax.DID("did:plc:foo")
+	)
+
+	assert.NoError(t, e.AddRepo(fooRepo))
+
+	ok, err = e.IsRepoOwner(fooUser, fooRepo)
+	assert.NoError(t, err)
+	assert.True(t, ok, "repo author should be repo owner")
+
+	ok, err = e.IsRepoWriteAllowed(fooUser, fooRepo)
+	assert.NoError(t, err)
+	assert.True(t, ok, "repo owner should be able to modify the repo itself")
+
+	ok, err = e.IsRepoCollaborator(fooUser, fooRepo)
+	assert.NoError(t, err)
+	assert.True(t, ok, "repo owner should inherit role role:collaborator")
+
+	ok, err = e.IsRepoSettingsWriteAllowed(fooUser, fooRepo)
+	assert.NoError(t, err)
+	assert.True(t, ok, "repo owner should inherit collaborator permissions")
+}
+
+func TestRepoCollaboratorPermissions(t *testing.T) {
+	var (
+		e       = setup(t)
+		ok      bool
+		err     error
+		fooRepo = syntax.ATURI("at://did:plc:foo/sh.tangled.repo/reporkey")
+		barUser = syntax.DID("did:plc:bar")
+	)
+
+	assert.NoError(t, e.AddRepo(fooRepo))
+	assert.NoError(t, e.AddRepoCollaborator(barUser, fooRepo))
+
+	ok, err = e.IsRepoCollaborator(barUser, fooRepo)
+	assert.NoError(t, err)
+	assert.True(t, ok, "should set repo collaborator")
+
+	ok, err = e.IsRepoSettingsWriteAllowed(barUser, fooRepo)
+	assert.NoError(t, err)
+	assert.True(t, ok, "repo collaborator should be able to edit repo settings")
+
+	ok, err = e.IsRepoWriteAllowed(barUser, fooRepo)
+	assert.NoError(t, err)
+	assert.False(t, ok, "repo collaborator shouldn't be able to modify the repo itself")
+}
+
+func TestGetByRole(t *testing.T) {
+	var (
+		e             = setup(t)
+		err           error
+		fooRepo       = syntax.ATURI("at://did:plc:foo/sh.tangled.repo/reporkey")
+		owner         = syntax.DID("did:plc:foo")
+		collaborator1 = syntax.DID("did:plc:bar")
+		collaborator2 = syntax.DID("did:plc:baz")
+	)
+
+	assert.NoError(t, e.AddRepo(fooRepo))
+	assert.NoError(t, e.AddRepoCollaborator(collaborator1, fooRepo))
+	assert.NoError(t, e.AddRepoCollaborator(collaborator2, fooRepo))
+
+	collaborators, err := e.GetRepoCollaborators(fooRepo)
+	assert.NoError(t, err)
+	assert.ElementsMatch(t, []syntax.DID{
+		owner,
+		collaborator1,
+		collaborator2,
+	}, collaborators)
+}
+
+func TestSpindleOwnerPermissions(t *testing.T) {
+	var (
+		e       = setup(t)
+		ok      bool
+		err     error
+		spindle = syntax.DID("did:web:spindle.example.com")
+		owner   = syntax.DID("did:plc:foo")
+		member  = syntax.DID("did:plc:bar")
+	)
+
+	assert.NoError(t, e.SetSpindleOwner(owner, spindle))
+	assert.NoError(t, e.AddSpindleMember(member, spindle))
+
+	ok, err = e.IsSpindleMemberInviteAllowed(owner, spindle)
+	assert.NoError(t, err)
+	assert.True(t, ok, "spindle owner can invite members")
+
+	ok, err = e.IsSpindleMemberInviteAllowed(member, spindle)
+	assert.NoError(t, err)
+	assert.False(t, ok, "spindle member cannot invite members")
+}

rbac2/repo.go

···
+package rbac2
+
+import (
+	"slices"
+	"strings"
+
+	"github.com/bluesky-social/indigo/atproto/syntax"
+	"tangled.org/core/api/tangled"
+)
+
+// AddRepo adds new repo with its owner to rbac enforcer
+func (e *Enforcer) AddRepo(repo syntax.ATURI) error {
+	if err := validateAtUri(repo, tangled.RepoNSID); err != nil {
+		return err
+	}
+	user := repo.Authority()
+
+	return e.setRoleForUser(user.String(), "repo:owner", repo.String())
+}
+
+// DeleteRepo deletes all policies related to the repo
+func (e *Enforcer) DeleteRepo(repo syntax.ATURI) error {
+	if err := validateAtUri(repo, tangled.RepoNSID); err != nil {
+		return err
+	}
+
+	_, err := e.e.DeleteDomains(repo.String())
+	return err
+}
+
+// AddRepoCollaborator adds new collaborator to the repo
+func (e *Enforcer) AddRepoCollaborator(user syntax.DID, repo syntax.ATURI) error {
+	if err := validateAtUri(repo, tangled.RepoNSID); err != nil {
+		return err
+	}
+
+	_, err := e.e.AddRoleForUser(user.String(), "repo:collaborator", repo.String())
+	return err
+}
+
+// RemoveRepoCollaborator removes the collaborator from the repo.
+// This won't remove inherited roles like repository owner.
+func (e *Enforcer) RemoveRepoCollaborator(user syntax.DID, repo syntax.ATURI) error {
+	if err := validateAtUri(repo, tangled.RepoNSID); err != nil {
+		return err
+	}
+
+	_, err := e.e.DeleteRoleForUser(user.String(), "repo:collaborator", repo.String())
+	return err
+}
+
+func (e *Enforcer) GetRepoCollaborators(repo syntax.ATURI) ([]syntax.DID, error) {
+	var collaborators []syntax.DID
+	members, err := e.e.GetImplicitUsersForRole("repo:collaborator", repo.String())
+	if err != nil {
+		return nil, err
+	}
+	for _, m := range members {
+		if !strings.HasPrefix(m, "did:") { // skip non-user subjects like 'repo:owner'
+			continue
+		}
+		collaborators = append(collaborators, syntax.DID(m))
+	}
+
+	slices.Sort(collaborators)
+	return slices.Compact(collaborators), nil
+}
+
+func (e *Enforcer) IsRepoOwner(user syntax.DID, repo syntax.ATURI) (bool, error) {
+	return e.e.HasRoleForUser(user.String(), "repo:owner", repo.String())
+}
+
+func (e *Enforcer) IsRepoCollaborator(user syntax.DID, repo syntax.ATURI) (bool, error) {
+	return e.hasImplicitRoleForUser(user.String(), "repo:collaborator", repo.String())
+}
+
+func (e *Enforcer) IsRepoWriteAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) {
+	return e.e.Enforce(user.String(), repo.String(), "#/", "write")
+}
+
+func (e *Enforcer) IsRepoSettingsWriteAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) {
+	return e.e.Enforce(user.String(), repo.String(), "#/settings", "write")
+}
+
+func (e *Enforcer) IsRepoCollaboratorInviteAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) {
+	return e.e.Enforce(user.String(), repo.String(), "#/collaborator", "write")
+}
+
+func (e *Enforcer) IsRepoGitPushAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) {
+	return e.e.Enforce(user.String(), repo.String(), "#/git", "write")
+}

rbac2/spindle.go

···
+package rbac2
+
+import "github.com/bluesky-social/indigo/atproto/syntax"
+
+func (e *Enforcer) SetSpindleOwner(user syntax.DID, spindle syntax.DID) error {
+	return e.setRoleForUser(user.String(), "server:owner", intoSpindle(spindle))
+}
+
+func (e *Enforcer) IsSpindleMember(user syntax.DID, spindle syntax.DID) (bool, error) {
+	return e.e.HasRoleForUser(user.String(), "server:member", spindle.String())
+}
+
+func (e *Enforcer) AddSpindleMember(user syntax.DID, spindle syntax.DID) error {
+	_, err := e.e.AddRoleForUser(user.String(), "server:member", intoSpindle(spindle))
+	return err
+}
+
+func (e *Enforcer) RemoveSpindleMember(user syntax.DID, spindle syntax.DID) error {
+	_, err := e.e.DeleteRoleForUser(user.String(), "server:member", intoSpindle(spindle))
+	return err
+}
+
+func (e *Enforcer) IsSpindleMemberInviteAllowed(user syntax.DID, spindle syntax.DID) (bool, error) {
+	return e.e.Enforce(user.String(), intoSpindle(spindle), "#/member", "write")
+}
+
+func intoSpindle(did syntax.DID) string {
+	return "/spindle/" + did.String()
+}

spindle/db/repos.go

···
 	if err != nil {
 		return nil, err
 	}
+	defer rows.Close()
 
 	var knots []string
 	for rows.Next() {

spindle/engine/engine.go

···
 				}
 				defer eng.DestroyWorkflow(ctx, wid)
 
-				wfLogger, err := models.NewWorkflowLogger(cfg.Server.LogDir, wid)
+				secretValues := make([]string, len(allSecrets))
+				for i, s := range allSecrets {
+					secretValues[i] = s.Value
+				}
+				wfLogger, err := models.NewWorkflowLogger(cfg.Server.LogDir, wid, secretValues)
 				if err != nil {
 					l.Warn("failed to setup step logger; logs will not be persisted", "error", err)
 					wfLogger = nil

spindle/models/logger.go

···
 type WorkflowLogger struct {
 	file    *os.File
 	encoder *json.Encoder
+	mask    *SecretMask
 }
 
-func NewWorkflowLogger(baseDir string, wid WorkflowId) (*WorkflowLogger, error) {
+func NewWorkflowLogger(baseDir string, wid WorkflowId, secretValues []string) (*WorkflowLogger, error) {
 	path := LogFilePath(baseDir, wid)
 
 	file, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
···
 	return &WorkflowLogger{
 		file:    file,
 		encoder: json.NewEncoder(file),
+		mask:    NewSecretMask(secretValues),
 	}, nil
 }
 
···
 
 func (w *dataWriter) Write(p []byte) (int, error) {
 	line := strings.TrimRight(string(p), "\r\n")
+	if w.logger.mask != nil {
+		line = w.logger.mask.Mask(line)
+	}
 	entry := NewDataLogLine(w.idx, line, w.stream)
 	if err := w.logger.encoder.Encode(entry); err != nil {
 		return 0, err

spindle/models/secret_mask.go

···
+package models
+
+import (
+	"encoding/base64"
+	"strings"
+)
+
+// SecretMask replaces secret values in strings with "***".
+type SecretMask struct {
+	replacer *strings.Replacer
+}
+
+// NewSecretMask creates a mask for the given secret values.
+// Also registers base64-encoded variants of each secret.
+func NewSecretMask(values []string) *SecretMask {
+	var pairs []string
+
+	for _, value := range values {
+		if value == "" {
+			continue
+		}
+
+		pairs = append(pairs, value, "***")
+
+		b64 := base64.StdEncoding.EncodeToString([]byte(value))
+		if b64 != value {
+			pairs = append(pairs, b64, "***")
+		}
+
+		b64NoPad := strings.TrimRight(b64, "=")
+		if b64NoPad != b64 && b64NoPad != value {
+			pairs = append(pairs, b64NoPad, "***")
+		}
+	}
+
+	if len(pairs) == 0 {
+		return nil
+	}
+
+	return &SecretMask{
+		replacer: strings.NewReplacer(pairs...),
+	}
+}
+
+// Mask replaces all registered secret values with "***".
+func (m *SecretMask) Mask(input string) string {
+	if m == nil || m.replacer == nil {
+		return input
+	}
+	return m.replacer.Replace(input)
+}

spindle/models/secret_mask_test.go

···
+package models
+
+import (
+	"encoding/base64"
+	"testing"
+)
+
+func TestSecretMask_BasicMasking(t *testing.T) {
+	mask := NewSecretMask([]string{"mysecret123"})
+
+	input := "The password is mysecret123 in this log"
+	expected := "The password is *** in this log"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_Base64Encoded(t *testing.T) {
+	secret := "mysecret123"
+	mask := NewSecretMask([]string{secret})
+
+	b64 := base64.StdEncoding.EncodeToString([]byte(secret))
+	input := "Encoded: " + b64
+	expected := "Encoded: ***"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_Base64NoPadding(t *testing.T) {
+	// "test" encodes to "dGVzdA==" with padding
+	secret := "test"
+	mask := NewSecretMask([]string{secret})
+
+	b64NoPad := "dGVzdA" // base64 without padding
+	input := "Token: " + b64NoPad
+	expected := "Token: ***"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_MultipleSecrets(t *testing.T) {
+	mask := NewSecretMask([]string{"password1", "apikey123"})
+
+	input := "Using password1 and apikey123 for auth"
+	expected := "Using *** and *** for auth"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_MultipleOccurrences(t *testing.T) {
+	mask := NewSecretMask([]string{"secret"})
+
+	input := "secret appears twice: secret"
+	expected := "*** appears twice: ***"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_ShortValues(t *testing.T) {
+	mask := NewSecretMask([]string{"abc", "xy", ""})
+
+	if mask == nil {
+		t.Fatal("expected non-nil mask")
+	}
+
+	input := "abc xy test"
+	expected := "*** *** test"
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}
+
+func TestSecretMask_NilMask(t *testing.T) {
+	var mask *SecretMask
+
+	input := "some input text"
+	result := mask.Mask(input)
+	if result != input {
+		t.Errorf("expected %q, got %q", input, result)
+	}
+}
+
+func TestSecretMask_EmptyInput(t *testing.T) {
+	mask := NewSecretMask([]string{"secret"})
+
+	result := mask.Mask("")
+	if result != "" {
+		t.Errorf("expected empty string, got %q", result)
+	}
+}
+
+func TestSecretMask_NoMatch(t *testing.T) {
+	mask := NewSecretMask([]string{"secretvalue"})
+
+	input := "nothing to mask here"
+	result := mask.Mask(input)
+	if result != input {
+		t.Errorf("expected %q, got %q", input, result)
+	}
+}
+
+func TestSecretMask_EmptySecretsList(t *testing.T) {
+	mask := NewSecretMask([]string{})
+
+	if mask != nil {
+		t.Error("expected nil mask for empty secrets list")
+	}
+}
+
+func TestSecretMask_EmptySecretsFiltered(t *testing.T) {
+	mask := NewSecretMask([]string{"ab", "validpassword", "", "xyz"})
+
+	input := "Using validpassword here"
+	expected := "Using *** here"
+
+	result := mask.Mask(input)
+	if result != expected {
+		t.Errorf("expected %q, got %q", expected, result)
+	}
+}