Spindle will listen to `sh.tangled.git.refUpdate` event from knot
stream and sync its local git repo instead. Spindle's git repo will
sparse-checkout only `/.tangled/workflows` directory.

Spindle now requires git version >=2.49 for `--revision` flag in `git
clone` command.

Signed-off-by: Seongmin Lee <git@boltless.me>

spindle-tap will collect/stream record events from:
- users dynamically added by spindle (spindle members | collaborators of
repos using spindle)
- any users with `sh.tangled.repo.pull` collection

It might be bit inefficient considering it will also stream repo
creation events from PR authors due to second rule, but at least we now
have backfill logic and Sync 1.1 based syncing.

This inefficiency can be fixed later by modifying upstream tap cli or
embedding tap into spindle.

```
+--------- all tangled users --------+
| |
| +-- users known to spindle-tap --+ |
| | (PR author / manually added) | |
| | | |
| | +----------------------------+ | |
| | | users known to spindle | | |
| | | (members / collaborators) | | |
| | +----------------------------+ | |
| +--------------------------------+ |
+------------------------------------+
```

Close: <https://tangled.org/tangled.org/core/issues/341>

Signed-off-by: Seongmin Lee <git@boltless.me>

This new db migration won't migrate existing records in repos table.
Instead, it will simply rename the legacy table to `repos_old` and
create a new one with same name.

repo backfill will be done with tap

Signed-off-by: Seongmin Lee <git@boltless.me>

create new one if it's missing

Signed-off-by: Seongmin Lee <git@boltless.me>

Signed-off-by: Seongmin Lee <git@boltless.me>

This commit includes bare minimum tap client to use tap from spindle.

Signed-off-by: Seongmin Lee <git@boltless.me>

This commit won't work without following spindle rewrite to use tap and
introduce backfill becase repos table is empty yet.

Signed-off-by: Seongmin Lee <git@boltless.me>

- use repo AT-URI as identifier
- use `dom` field rather than `obj` to filter by repository
So now it's "user with role A in repo B can do action D to object C"
where `A,B,C,D` are `sub,dom,obj,act`.

Many parts are missing, but should be enough to test this new RBAC
enforcer package in spindle.

Related issue: <https://tangled.org/tangled.org/core/issues/282>

Signed-off-by: Seongmin Lee <git@boltless.me>

- did-method-plc
- bluesky-jetstream
- bluesky-relay
- tap

Signed-off-by: Seongmin Lee <git@boltless.me>

this will fix nix devshell failing on darwin machine

The fix was introduced on: <https://github.com/NixOS/nix/pull/14778>

Signed-off-by: Seongmin Lee <git@boltless.me>

Signed-off-by: Thomas Karpiniec <tkarpiniec@icloud.com>

Signed-off-by: oppiliappan <me@oppi.li>

Signed-off-by: Evan Jarrett <evan@evanjarrett.com>

Signed-off-by: Thomas Karpiniec <tkarpiniec@icloud.com>

This reverts commit ada8bf645f471d0aff466d4b91beb1d07dc9f4dd.

Signed-off-by: oppiliappan <me@oppi.li>

Signed-off-by: Seongmin Lee <git@boltless.me>

Signed-off-by: Seongmin Lee <git@boltless.me>

this will fix build error on darwin machines

Signed-off-by: Seongmin Lee <git@boltless.me>

fixes https://tangled.org/tangled.org/core/issues/339 .

Signed-off-by: helpimnotdrowning <helpimnotdrowning@gmail.com>