-34

api/tangled/pipelinecancelPipeline.go

··· 1 1 - // Code generated by cmd/lexgen (see Makefile's lexgen); DO NOT EDIT. 2 2 - 3 3 - package tangled 4 4 - 5 5 - // schema: sh.tangled.pipeline.cancelPipeline 6 6 - 7 7 - import ( 8 8 - "context" 9 9 - 10 10 - "github.com/bluesky-social/indigo/lex/util" 11 11 - ) 12 12 - 13 13 - const ( 14 14 - PipelineCancelPipelineNSID = "sh.tangled.pipeline.cancelPipeline" 15 15 - ) 16 16 - 17 17 - // PipelineCancelPipeline_Input is the input argument to a sh.tangled.pipeline.cancelPipeline call. 18 18 - type PipelineCancelPipeline_Input struct { 19 19 - // pipeline: pipeline at-uri 20 20 - Pipeline string `json:"pipeline" cborgen:"pipeline"` 21 21 - // repo: repo at-uri, spindle can't resolve repo from pipeline at-uri yet 22 22 - Repo string `json:"repo" cborgen:"repo"` 23 23 - // workflow: workflow name 24 24 - Workflow string `json:"workflow" cborgen:"workflow"` 25 25 - } 26 26 - 27 27 - // PipelineCancelPipeline calls the XRPC method "sh.tangled.pipeline.cancelPipeline". 28 28 - func PipelineCancelPipeline(ctx context.Context, c util.LexClient, input *PipelineCancelPipeline_Input) error { 29 29 - if err := c.LexDo(ctx, util.Procedure, "application/json", "sh.tangled.pipeline.cancelPipeline", nil, input, nil); err != nil { 30 30 - return err 31 31 - } 32 32 - 33 33 - return nil 34 34 - }

+2

appview/db/follow.go

··· 167 167 if err != nil { 168 168 return nil, err 169 169 } 170 170 + defer rows.Close() 171 171 + 170 172 for rows.Next() { 171 173 var follow models.Follow 172 174 var followedAt string

+1

appview/db/issues.go

··· 452 452 if err != nil { 453 453 return nil, err 454 454 } 455 455 + defer rows.Close() 455 456 456 457 for rows.Next() { 457 458 var comment models.IssueComment

+1 -1

appview/db/language.go

··· 28 28 whereClause, 29 29 ) 30 30 rows, err := e.Query(query, args...) 31 31 - 32 31 if err != nil { 33 32 return nil, fmt.Errorf("failed to execute query: %w ", err) 34 33 } 34 34 + defer rows.Close() 35 35 36 36 var langs []models.RepoLanguage 37 37 for rows.Next() {

+6 -6

appview/db/pipeline.go

··· 6 6 "strings" 7 7 "time" 8 8 9 9 - "github.com/bluesky-social/indigo/atproto/syntax" 10 9 "tangled.org/core/appview/models" 11 10 "tangled.org/core/orm" 12 11 ) ··· 217 216 } 218 217 defer rows.Close() 219 218 220 220 - pipelines := make(map[syntax.ATURI]models.Pipeline) 219 219 + pipelines := make(map[string]models.Pipeline) 221 220 for rows.Next() { 222 221 var p models.Pipeline 223 222 var t models.Trigger ··· 254 253 p.Trigger = &t 255 254 p.Statuses = make(map[string]models.WorkflowStatus) 256 255 257 257 - pipelines[p.AtUri()] = p 256 256 + k := fmt.Sprintf("%s/%s", p.Knot, p.Rkey) 257 257 + pipelines[k] = p 258 258 } 259 259 260 260 // get all statuses ··· 314 314 return nil, fmt.Errorf("invalid status created timestamp %q: %w", created, err) 315 315 } 316 316 317 317 - pipelineAt := ps.PipelineAt() 317 317 + key := fmt.Sprintf("%s/%s", ps.PipelineKnot, ps.PipelineRkey) 318 318 319 319 // extract 320 320 - pipeline, ok := pipelines[pipelineAt] 320 320 + pipeline, ok := pipelines[key] 321 321 if !ok { 322 322 continue 323 323 } ··· 331 331 332 332 // reassign 333 333 pipeline.Statuses[ps.Workflow] = statuses 334 334 - pipelines[pipelineAt] = pipeline 334 334 + pipelines[key] = pipeline 335 335 } 336 336 337 337 var all []models.Pipeline

+5

appview/db/profile.go

··· 230 230 if err != nil { 231 231 return nil, err 232 232 } 233 233 + defer rows.Close() 233 234 234 235 profileMap := make(map[string]*models.Profile) 235 236 for rows.Next() { ··· 270 271 if err != nil { 271 272 return nil, err 272 273 } 274 274 + defer rows.Close() 275 275 + 273 276 idxs := make(map[string]int) 274 277 for did := range profileMap { 275 278 idxs[did] = 0 ··· 290 293 if err != nil { 291 294 return nil, err 292 295 } 296 296 + defer rows.Close() 297 297 + 293 298 idxs = make(map[string]int) 294 299 for did := range profileMap { 295 300 idxs[did] = 0

+1

appview/db/registration.go

··· 38 38 if err != nil { 39 39 return nil, err 40 40 } 41 41 + defer rows.Close() 41 42 42 43 for rows.Next() { 43 44 var createdAt string

+11 -1

appview/db/repos.go

··· 56 56 limitClause, 57 57 ) 58 58 rows, err := e.Query(repoQuery, args...) 59 59 - 60 59 if err != nil { 61 60 return nil, fmt.Errorf("failed to execute repo query: %w ", err) 62 61 } 62 62 + defer rows.Close() 63 63 64 64 for rows.Next() { 65 65 var repo models.Repo ··· 128 128 if err != nil { 129 129 return nil, fmt.Errorf("failed to execute labels query: %w ", err) 130 130 } 131 131 + defer rows.Close() 132 132 + 131 133 for rows.Next() { 132 134 var repoat, labelat string 133 135 if err := rows.Scan(&repoat, &labelat); err != nil { ··· 165 167 if err != nil { 166 168 return nil, fmt.Errorf("failed to execute lang query: %w ", err) 167 169 } 170 170 + defer rows.Close() 171 171 + 168 172 for rows.Next() { 169 173 var repoat, lang string 170 174 if err := rows.Scan(&repoat, &lang); err != nil { ··· 191 195 if err != nil { 192 196 return nil, fmt.Errorf("failed to execute star-count query: %w ", err) 193 197 } 198 198 + defer rows.Close() 199 199 + 194 200 for rows.Next() { 195 201 var repoat string 196 202 var count int ··· 220 226 if err != nil { 221 227 return nil, fmt.Errorf("failed to execute issue-count query: %w ", err) 222 228 } 229 229 + defer rows.Close() 230 230 + 223 231 for rows.Next() { 224 232 var repoat string 225 233 var open, closed int ··· 261 269 if err != nil { 262 270 return nil, fmt.Errorf("failed to execute pulls-count query: %w ", err) 263 271 } 272 272 + defer rows.Close() 273 273 + 264 274 for rows.Next() { 265 275 var repoat string 266 276 var open, merged, closed, deleted int

+1

appview/db/star.go

··· 165 165 if err != nil { 166 166 return nil, err 167 167 } 168 168 + defer rows.Close() 168 169 169 170 starMap := make(map[string][]models.Star) 170 171 for rows.Next() {

-10

appview/models/pipeline.go

··· 1 1 package models 2 2 3 3 import ( 4 4 - "fmt" 5 4 "slices" 6 5 "time" 7 6 8 7 "github.com/bluesky-social/indigo/atproto/syntax" 9 8 "github.com/go-git/go-git/v5/plumbing" 10 10 - "tangled.org/core/api/tangled" 11 9 spindle "tangled.org/core/spindle/models" 12 10 "tangled.org/core/workflow" 13 11 ) ··· 25 23 // populate when querying for reverse mappings 26 24 Trigger *Trigger 27 25 Statuses map[string]WorkflowStatus 28 28 - } 29 29 - 30 30 - func (p *Pipeline) AtUri() syntax.ATURI { 31 31 - return syntax.ATURI(fmt.Sprintf("at://did:web:%s/%s/%s", p.Knot, tangled.PipelineNSID, p.Rkey)) 32 26 } 33 27 34 28 type WorkflowStatus struct { ··· 134 128 Error *string 135 129 ExitCode int 136 130 } 137 137 - 138 138 - func (ps *PipelineStatus) PipelineAt() syntax.ATURI { 139 139 - return syntax.ATURI(fmt.Sprintf("at://did:web:%s/%s/%s", ps.PipelineKnot, tangled.PipelineNSID, ps.PipelineRkey)) 140 140 - }

-1

appview/notify/merged_notifier.go

··· 39 39 v.Call(in) 40 40 }(n) 41 41 } 42 42 - wg.Wait() 43 42 } 44 43 45 44 func (m *mergedNotifier) NewRepo(ctx context.Context, repo *models.Repo) {

+14

appview/pages/markup/extension/atlink.go

··· 36 36 } 37 37 38 38 var atRegexp = regexp.MustCompile(`(^|\s|\()(@)([a-zA-Z0-9.-]+)(\b)`) 39 39 + var markdownLinkRegexp = regexp.MustCompile(`(?ms)\[.*\]\(.*\)`) 39 40 40 41 type atParser struct{} 41 42 ··· 55 56 if m == nil { 56 57 return nil 57 58 } 59 59 + 60 60 + if !util.IsSpaceRune(block.PrecendingCharacter()) { 61 61 + return nil 62 62 + } 63 63 + 64 64 + // Check for all links in the markdown to see if the handle found is inside one 65 65 + linksIndexes := markdownLinkRegexp.FindAllIndex(block.Source(), -1) 66 66 + for _, linkMatch := range linksIndexes { 67 67 + if linkMatch[0] < segment.Start && segment.Start < linkMatch[1] { 68 68 + return nil 69 69 + } 70 70 + } 71 71 + 58 72 atSegment := text.NewSegment(segment.Start, segment.Start+m[1]) 59 73 block.Advance(m[1]) 60 74 node := &AtNode{}

+1 -1

appview/pages/pages.go

··· 640 640 } 641 641 642 642 func (p *Pages) StarBtnFragment(w io.Writer, params StarBtnFragmentParams) error { 643 643 - return p.executePlain("fragments/starBtn", w, params) 643 643 + return p.executePlain("fragments/starBtn-oob", w, params) 644 644 } 645 645 646 646 type RepoIndexParams struct {

+5

appview/pages/templates/fragments/starBtn-oob.html

··· 1 1 + {{ define "fragments/starBtn-oob" }} 2 2 + <div hx-swap-oob='outerHTML:#starBtn[data-star-subject-at="{{ .SubjectAt }}"]'> 3 3 + {{ template "fragments/starBtn" . }} 4 4 + </div> 5 5 + {{ end }}

+1 -3

appview/pages/templates/fragments/starBtn.html

··· 1 1 {{ define "fragments/starBtn" }} 2 2 + {{/* NOTE: this fragment is always replaced with hx-swap-oob */}} 2 3 <button 3 4 id="starBtn" 4 5 class="btn disabled:opacity-50 disabled:cursor-not-allowed flex gap-2 items-center group" ··· 10 11 {{ end }} 11 12 12 13 hx-trigger="click" 13 13 - hx-target="this" 14 14 - hx-swap="outerHTML" 15 15 - hx-swap-oob='outerHTML:#starBtn[data-star-subject-at="{{ .SubjectAt }}"]' 16 14 hx-disabled-elt="#starBtn" 17 15 > 18 16 {{ if .IsStarred }}

+6 -6

appview/pages/templates/repo/fragments/backlinks.html

··· 14 14 <div class="flex gap-2 items-center"> 15 15 {{ if .State.IsClosed }} 16 16 <span class="text-gray-500 dark:text-gray-400"> 17 17 - {{ i "ban" "w-4 h-4" }} 17 17 + {{ i "ban" "size-3" }} 18 18 </span> 19 19 {{ else if eq .Kind.String "issues" }} 20 20 <span class="text-green-600 dark:text-green-500"> 21 21 - {{ i "circle-dot" "w-4 h-4" }} 21 21 + {{ i "circle-dot" "size-3" }} 22 22 </span> 23 23 {{ else if .State.IsOpen }} 24 24 <span class="text-green-600 dark:text-green-500"> 25 25 - {{ i "git-pull-request" "w-4 h-4" }} 25 25 + {{ i "git-pull-request" "size-3" }} 26 26 </span> 27 27 {{ else if .State.IsMerged }} 28 28 <span class="text-purple-600 dark:text-purple-500"> 29 29 - {{ i "git-merge" "w-4 h-4" }} 29 29 + {{ i "git-merge" "size-3" }} 30 30 </span> 31 31 {{ else }} 32 32 <span class="text-gray-600 dark:text-gray-300"> 33 33 - {{ i "git-pull-request-closed" "w-4 h-4" }} 33 33 + {{ i "git-pull-request-closed" "size-3" }} 34 34 </span> 35 35 {{ end }} 36 36 - <a href="{{ . }}"><span class="text-gray-500 dark:text-gray-400">#{{ .SubjectId }}</span> {{ .Title }}</a> 36 36 + <a href="{{ . }}" class="line-clamp-1 text-sm"><span class="text-gray-500 dark:text-gray-400">#{{ .SubjectId }}</span> {{ .Title }}</a> 37 37 </div> 38 38 {{ if not (eq $.RepoInfo.FullName $repoUrl) }} 39 39 <div>

-10

appview/pages/templates/repo/pipelines/workflow.html

··· 12 12 {{ block "sidebar" . }} {{ end }} 13 13 </div> 14 14 <div class="col-span-1 md:col-span-3"> 15 15 - <div class="flex justify-end mb-2"> 16 16 - <button 17 17 - class="btn" 18 18 - hx-post="/{{ $.RepoInfo.FullName }}/pipelines/{{ .Pipeline.Id }}/workflow/{{ .Workflow }}/cancel" 19 19 - hx-swap="none" 20 20 - {{ if (index .Pipeline.Statuses .Workflow).Latest.Status.IsFinish -}} 21 21 - disabled 22 22 - {{- end }} 23 23 - >Cancel</button> 24 24 - </div> 25 15 {{ block "logs" . }} {{ end }} 26 16 </div> 27 17 </section>

+1 -1

appview/pages/templates/strings/string.html

··· 17 17 <span class="select-none">/</span> 18 18 <a href="/strings/{{ $ownerId }}/{{ .String.Rkey }}" class="font-bold">{{ .String.Filename }}</a> 19 19 </div> 20 20 - <div class="flex gap-2 text-base"> 20 20 + <div class="flex gap-2 items-stretch text-base"> 21 21 {{ if and .LoggedInUser (eq .LoggedInUser.Did .String.Did) }} 22 22 <a class="btn flex items-center gap-2 no-underline hover:no-underline p-2 group" 23 23 hx-boost="true"

-82

appview/pipelines/pipelines.go

··· 4 4 "bytes" 5 5 "context" 6 6 "encoding/json" 7 7 - "fmt" 8 7 "log/slog" 9 8 "net/http" 10 9 "strings" 11 10 "time" 12 11 13 13 - "tangled.org/core/api/tangled" 14 12 "tangled.org/core/appview/config" 15 13 "tangled.org/core/appview/db" 16 16 - "tangled.org/core/appview/models" 17 14 "tangled.org/core/appview/oauth" 18 15 "tangled.org/core/appview/pages" 19 16 "tangled.org/core/appview/reporesolver" ··· 44 41 r.Get("/", p.Index) 45 42 r.Get("/{pipeline}/workflow/{workflow}", p.Workflow) 46 43 r.Get("/{pipeline}/workflow/{workflow}/logs", p.Logs) 47 47 - r.Post("/{pipeline}/workflow/{workflow}/cancel", p.Cancel) 48 44 49 45 return r 50 46 } ··· 318 314 } 319 315 } 320 316 } 321 321 - } 322 322 - 323 323 - func (p *Pipelines) Cancel(w http.ResponseWriter, r *http.Request) { 324 324 - l := p.logger.With("handler", "Cancel") 325 325 - 326 326 - var ( 327 327 - pipelineId = chi.URLParam(r, "pipeline") 328 328 - workflow = chi.URLParam(r, "workflow") 329 329 - ) 330 330 - if pipelineId == "" || workflow == "" { 331 331 - http.Error(w, "missing pipeline ID or workflow", http.StatusBadRequest) 332 332 - return 333 333 - } 334 334 - 335 335 - f, err := p.repoResolver.Resolve(r) 336 336 - if err != nil { 337 337 - l.Error("failed to get repo and knot", "err", err) 338 338 - http.Error(w, "bad repo/knot", http.StatusBadRequest) 339 339 - return 340 340 - } 341 341 - 342 342 - pipeline, err := func() (models.Pipeline, error) { 343 343 - ps, err := db.GetPipelineStatuses( 344 344 - p.db, 345 345 - 1, 346 346 - orm.FilterEq("repo_owner", f.Did), 347 347 - orm.FilterEq("repo_name", f.Name), 348 348 - orm.FilterEq("knot", f.Knot), 349 349 - orm.FilterEq("id", pipelineId), 350 350 - ) 351 351 - if err != nil { 352 352 - return models.Pipeline{}, err 353 353 - } 354 354 - if len(ps) != 1 { 355 355 - return models.Pipeline{}, fmt.Errorf("wrong pipeline count %d", len(ps)) 356 356 - } 357 357 - return ps[0], nil 358 358 - }() 359 359 - if err != nil { 360 360 - l.Error("pipeline query failed", "err", err) 361 361 - http.Error(w, "pipeline not found", http.StatusNotFound) 362 362 - } 363 363 - var ( 364 364 - spindle = f.Spindle 365 365 - knot = f.Knot 366 366 - rkey = pipeline.Rkey 367 367 - ) 368 368 - 369 369 - if spindle == "" || knot == "" || rkey == "" { 370 370 - http.Error(w, "invalid repo info", http.StatusBadRequest) 371 371 - return 372 372 - } 373 373 - 374 374 - spindleClient, err := p.oauth.ServiceClient( 375 375 - r, 376 376 - oauth.WithService(f.Spindle), 377 377 - oauth.WithLxm(tangled.PipelineCancelPipelineNSID), 378 378 - oauth.WithExp(60), 379 379 - oauth.WithDev(p.config.Core.Dev), 380 380 - oauth.WithTimeout(time.Second*30), // workflow cleanup usually takes time 381 381 - ) 382 382 - 383 383 - err = tangled.PipelineCancelPipeline( 384 384 - r.Context(), 385 385 - spindleClient, 386 386 - &tangled.PipelineCancelPipeline_Input{ 387 387 - Repo: string(f.RepoAt()), 388 388 - Pipeline: pipeline.AtUri().String(), 389 389 - Workflow: workflow, 390 390 - }, 391 391 - ) 392 392 - errorId := "pipeline-action" 393 393 - if err != nil { 394 394 - l.Error("failed to cancel pipeline", "err", err) 395 395 - p.pages.Notice(w, errorId, "Failed to add secret.") 396 396 - return 397 397 - } 398 398 - l.Debug("canceled pipeline", "uri", pipeline.AtUri()) 399 317 } 400 318 401 319 // either a message or an error

+8

appview/pulls/pulls.go

··· 1366 1366 s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.") 1367 1367 return 1368 1368 } 1369 1369 + 1369 1370 } 1370 1371 1371 1372 if err = tx.Commit(); err != nil { 1372 1373 log.Println("failed to create pull request", err) 1373 1374 s.pages.Notice(w, "pull", "Failed to create pull request. Try again later.") 1374 1375 return 1376 1376 + } 1377 1377 + 1378 1378 + // notify about each pull 1379 1379 + // 1380 1380 + // this is performed after tx.Commit, because it could result in a locked DB otherwise 1381 1381 + for _, p := range stack { 1382 1382 + s.notifier.NewPull(r.Context(), p) 1375 1383 } 1376 1384 1377 1385 ownerSlashRepo := reporesolver.GetBaseRepoPath(r, repo)

+2 -31

flake.nix

··· 91 91 spindle = self.callPackage ./nix/pkgs/spindle.nix {}; 92 92 knot-unwrapped = self.callPackage ./nix/pkgs/knot-unwrapped.nix {}; 93 93 knot = self.callPackage ./nix/pkgs/knot.nix {}; 94 94 - did-method-plc = self.callPackage ./nix/pkgs/did-method-plc.nix {}; 95 95 - bluesky-jetstream = self.callPackage ./nix/pkgs/bluesky-jetstream.nix {}; 96 96 - bluesky-relay = self.callPackage ./nix/pkgs/bluesky-relay.nix {}; 97 97 - tap = self.callPackage ./nix/pkgs/tap.nix {}; 98 94 }); 99 95 in { 100 96 overlays.default = final: prev: { 101 101 - inherit (mkPackageSet final) lexgen goat sqlite-lib spindle knot-unwrapped knot appview did-method-plc bluesky-jetstream bluesky-relay tap; 97 97 + inherit (mkPackageSet final) lexgen goat sqlite-lib spindle knot-unwrapped knot appview; 102 98 }; 103 99 104 100 packages = forAllSystems (system: let ··· 107 103 staticPackages = mkPackageSet pkgs.pkgsStatic; 108 104 crossPackages = mkPackageSet pkgs.pkgsCross.gnu64.pkgsStatic; 109 105 in { 110 110 - inherit (packages) appview appview-static-files lexgen goat spindle knot knot-unwrapped sqlite-lib did-method-plc bluesky-jetstream bluesky-relay tap; 106 106 + inherit (packages) appview appview-static-files lexgen goat spindle knot knot-unwrapped sqlite-lib; 111 107 112 108 pkgsStatic-appview = staticPackages.appview; 113 109 pkgsStatic-knot = staticPackages.knot; ··· 306 302 imports = [./nix/modules/spindle.nix]; 307 303 308 304 services.tangled.spindle.package = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.spindle; 309 309 - services.tangled.spindle.tap-package = lib.mkDefault self.packages.${pkgs.system}.tap; 310 310 - }; 311 311 - nixosModules.did-method-plc = { 312 312 - lib, 313 313 - pkgs, 314 314 - ... 315 315 - }: { 316 316 - imports = [./nix/modules/did-method-plc.nix]; 317 317 - services.did-method-plc.package = lib.mkDefault self.packages.${pkgs.system}.did-method-plc; 318 318 - }; 319 319 - nixosModules.bluesky-relay = { 320 320 - lib, 321 321 - pkgs, 322 322 - ... 323 323 - }: { 324 324 - imports = [./nix/modules/bluesky-relay.nix]; 325 325 - services.bluesky-relay.package = lib.mkDefault self.packages.${pkgs.system}.bluesky-relay; 326 326 - }; 327 327 - nixosModules.bluesky-jetstream = { 328 328 - lib, 329 329 - pkgs, 330 330 - ... 331 331 - }: { 332 332 - imports = [./nix/modules/bluesky-jetstream.nix]; 333 333 - services.bluesky-jetstream.package = lib.mkDefault self.packages.${pkgs.system}.bluesky-jetstream; 334 305 }; 335 306 }; 336 307 }

-1

go.mod

··· 131 131 github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect 132 132 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect 133 133 github.com/hashicorp/go-sockaddr v1.0.7 // indirect 134 134 - github.com/hashicorp/go-version v1.8.0 // indirect 135 134 github.com/hashicorp/golang-lru v1.0.2 // indirect 136 135 github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect 137 136 github.com/hashicorp/hcl v1.0.1-vault-7 // indirect

-2

go.sum

··· 264 264 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4= 265 265 github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw= 266 266 github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw= 267 267 - github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4= 268 268 - github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= 269 267 github.com/hashicorp/golang-lru v1.0.2 h1:dV3g9Z/unq5DpblPpw+Oqcv4dU/1omnb4Ok8iPY6p1c= 270 268 github.com/hashicorp/golang-lru v1.0.2/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4= 271 269 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=

-33

lexicons/pipeline/cancelPipeline.json

··· 1 1 - { 2 2 - "lexicon": 1, 3 3 - "id": "sh.tangled.pipeline.cancelPipeline", 4 4 - "defs": { 5 5 - "main": { 6 6 - "type": "procedure", 7 7 - "description": "Cancel a running pipeline", 8 8 - "input": { 9 9 - "encoding": "application/json", 10 10 - "schema": { 11 11 - "type": "object", 12 12 - "required": ["repo", "pipeline", "workflow"], 13 13 - "properties": { 14 14 - "repo": { 15 15 - "type": "string", 16 16 - "format": "at-uri", 17 17 - "description": "repo at-uri, spindle can't resolve repo from pipeline at-uri yet" 18 18 - }, 19 19 - "pipeline": { 20 20 - "type": "string", 21 21 - "format": "at-uri", 22 22 - "description": "pipeline at-uri" 23 23 - }, 24 24 - "workflow": { 25 25 - "type": "string", 26 26 - "description": "workflow name" 27 27 - } 28 28 - } 29 29 - } 30 30 - } 31 31 - } 32 32 - } 33 33 - }

-3

nix/gomod2nix.toml

··· 304 304 [mod."github.com/hashicorp/go-sockaddr"] 305 305 version = "v1.0.7" 306 306 hash = "sha256-p6eDOrGzN1jMmT/F/f/VJMq0cKNFhUcEuVVwTE6vSrs=" 307 307 - [mod."github.com/hashicorp/go-version"] 308 308 - version = "v1.8.0" 309 309 - hash = "sha256-KXtqERmYrWdpqPCViWcHbe6jnuH7k16bvBIcuJuevj8=" 310 307 [mod."github.com/hashicorp/golang-lru"] 311 308 version = "v1.0.2" 312 309 hash = "sha256-yy+5botc6T5wXgOe2mfNXJP3wr+MkVlUZ2JBkmmrA48="

-64

nix/modules/bluesky-jetstream.nix

··· 1 1 - { 2 2 - config, 3 3 - pkgs, 4 4 - lib, 5 5 - ... 6 6 - }: let 7 7 - cfg = config.services.bluesky-jetstream; 8 8 - in 9 9 - with lib; { 10 10 - options.services.bluesky-jetstream = { 11 11 - enable = mkEnableOption "jetstream server"; 12 12 - package = mkPackageOption pkgs "bluesky-jetstream" {}; 13 13 - 14 14 - # dataDir = mkOption { 15 15 - # type = types.str; 16 16 - # default = "/var/lib/jetstream"; 17 17 - # description = "directory to store data (pebbleDB)"; 18 18 - # }; 19 19 - livenessTtl = mkOption { 20 20 - type = types.int; 21 21 - default = 15; 22 22 - description = "time to restart when no event detected (seconds)"; 23 23 - }; 24 24 - websocketUrl = mkOption { 25 25 - type = types.str; 26 26 - default = "wss://bsky.network/xrpc/com.atproto.sync.subscribeRepos"; 27 27 - description = "full websocket path to the ATProto SubscribeRepos XRPC endpoint"; 28 28 - }; 29 29 - }; 30 30 - config = mkIf cfg.enable { 31 31 - systemd.services.bluesky-jetstream = { 32 32 - description = "bluesky jetstream"; 33 33 - after = ["network.target" "pds.service"]; 34 34 - wantedBy = ["multi-user.target"]; 35 35 - 36 36 - serviceConfig = { 37 37 - User = "jetstream"; 38 38 - Group = "jetstream"; 39 39 - StateDirectory = "jetstream"; 40 40 - StateDirectoryMode = "0755"; 41 41 - # preStart = '' 42 42 - # mkdir -p "${cfg.dataDir}" 43 43 - # chown -R jetstream:jetstream "${cfg.dataDir}" 44 44 - # ''; 45 45 - # WorkingDirectory = cfg.dataDir; 46 46 - Environment = [ 47 47 - "JETSTREAM_DATA_DIR=/var/lib/jetstream/data" 48 48 - "JETSTREAM_LIVENESS_TTL=${toString cfg.livenessTtl}s" 49 49 - "JETSTREAM_WS_URL=${cfg.websocketUrl}" 50 50 - ]; 51 51 - ExecStart = getExe cfg.package; 52 52 - Restart = "always"; 53 53 - RestartSec = 5; 54 54 - }; 55 55 - }; 56 56 - users = { 57 57 - users.jetstream = { 58 58 - group = "jetstream"; 59 59 - isSystemUser = true; 60 60 - }; 61 61 - groups.jetstream = {}; 62 62 - }; 63 63 - }; 64 64 - }

-48

nix/modules/bluesky-relay.nix

··· 1 1 - { 2 2 - config, 3 3 - pkgs, 4 4 - lib, 5 5 - ... 6 6 - }: let 7 7 - cfg = config.services.bluesky-relay; 8 8 - in 9 9 - with lib; { 10 10 - options.services.bluesky-relay = { 11 11 - enable = mkEnableOption "relay server"; 12 12 - package = mkPackageOption pkgs "bluesky-relay" {}; 13 13 - }; 14 14 - config = mkIf cfg.enable { 15 15 - systemd.services.bluesky-relay = { 16 16 - description = "bluesky relay"; 17 17 - after = ["network.target" "pds.service"]; 18 18 - wantedBy = ["multi-user.target"]; 19 19 - 20 20 - serviceConfig = { 21 21 - User = "relay"; 22 22 - Group = "relay"; 23 23 - StateDirectory = "relay"; 24 24 - StateDirectoryMode = "0755"; 25 25 - Environment = [ 26 26 - "RELAY_ADMIN_PASSWORD=password" 27 27 - "RELAY_PLC_HOST=https://plc.tngl.boltless.dev" 28 28 - "DATABASE_URL=sqlite:///var/lib/relay/relay.sqlite" 29 29 - "RELAY_IP_BIND=:2470" 30 30 - "RELAY_PERSIST_DIR=/var/lib/relay" 31 31 - "RELAY_DISABLE_REQUEST_CRAWL=0" 32 32 - "RELAY_INITIAL_SEQ_NUMBER=1" 33 33 - "RELAY_ALLOW_INSECURE_HOSTS=1" 34 34 - ]; 35 35 - ExecStart = "${getExe cfg.package} serve"; 36 36 - Restart = "always"; 37 37 - RestartSec = 5; 38 38 - }; 39 39 - }; 40 40 - users = { 41 41 - users.relay = { 42 42 - group = "relay"; 43 43 - isSystemUser = true; 44 44 - }; 45 45 - groups.relay = {}; 46 46 - }; 47 47 - }; 48 48 - }

-76

nix/modules/did-method-plc.nix

··· 1 1 - { 2 2 - config, 3 3 - pkgs, 4 4 - lib, 5 5 - ... 6 6 - }: let 7 7 - cfg = config.services.did-method-plc; 8 8 - in 9 9 - with lib; { 10 10 - options.services.did-method-plc = { 11 11 - enable = mkEnableOption "did-method-plc server"; 12 12 - package = mkPackageOption pkgs "did-method-plc" {}; 13 13 - }; 14 14 - config = mkIf cfg.enable { 15 15 - services.postgresql = { 16 16 - enable = true; 17 17 - package = pkgs.postgresql_14; 18 18 - ensureDatabases = ["plc"]; 19 19 - ensureUsers = [ 20 20 - { 21 21 - name = "pg"; 22 22 - # ensurePermissions."DATABASE plc" = "ALL PRIVILEGES"; 23 23 - } 24 24 - ]; 25 25 - authentication = '' 26 26 - local all all trust 27 27 - host all all 127.0.0.1/32 trust 28 28 - ''; 29 29 - }; 30 30 - systemd.services.did-method-plc = { 31 31 - description = "did-method-plc"; 32 32 - 33 33 - after = ["postgresql.service"]; 34 34 - wants = ["postgresql.service"]; 35 35 - wantedBy = ["multi-user.target"]; 36 36 - 37 37 - environment = let 38 38 - db_creds_json = builtins.toJSON { 39 39 - username = "pg"; 40 40 - password = ""; 41 41 - host = "127.0.0.1"; 42 42 - port = 5432; 43 43 - }; 44 44 - in { 45 45 - # TODO: inherit from config 46 46 - DEBUG_MODE = "1"; 47 47 - LOG_ENABLED = "true"; 48 48 - LOG_LEVEL = "debug"; 49 49 - LOG_DESTINATION = "1"; 50 50 - ENABLE_MIGRATIONS = "true"; 51 51 - DB_CREDS_JSON = db_creds_json; 52 52 - DB_MIGRATE_CREDS_JSON = db_creds_json; 53 53 - PLC_VERSION = "0.0.1"; 54 54 - PORT = "8080"; 55 55 - }; 56 56 - 57 57 - serviceConfig = { 58 58 - ExecStart = getExe cfg.package; 59 59 - User = "plc"; 60 60 - Group = "plc"; 61 61 - StateDirectory = "plc"; 62 62 - StateDirectoryMode = "0755"; 63 63 - Restart = "always"; 64 64 - 65 65 - # Hardening 66 66 - }; 67 67 - }; 68 68 - users = { 69 69 - users.plc = { 70 70 - group = "plc"; 71 71 - isSystemUser = true; 72 72 - }; 73 73 - groups.plc = {}; 74 74 - }; 75 75 - }; 76 76 - }

-35

nix/modules/spindle.nix

··· 1 1 { 2 2 config, 3 3 - pkgs, 4 3 lib, 5 4 ... 6 5 }: let ··· 17 16 package = mkOption { 18 17 type = types.package; 19 18 description = "Package to use for the spindle"; 20 20 - }; 21 21 - tap-package = mkOption { 22 22 - type = types.package; 23 23 - description = "Package to use for the spindle"; 24 24 - }; 25 25 - 26 26 - atpRelayUrl = mkOption { 27 27 - type = types.str; 28 28 - default = "https://relay1.us-east.bsky.network"; 29 29 - description = "atproto relay"; 30 19 }; 31 20 32 21 server = { ··· 125 114 config = mkIf cfg.enable { 126 115 virtualisation.docker.enable = true; 127 116 128 128 - systemd.services.spindle-tap = { 129 129 - description = "spindle tap service"; 130 130 - after = ["network.target" "docker.service"]; 131 131 - wantedBy = ["multi-user.target"]; 132 132 - serviceConfig = { 133 133 - LogsDirectory = "spindle-tap"; 134 134 - StateDirectory = "spindle-tap"; 135 135 - Environment = [ 136 136 - "TAP_BIND=:2480" 137 137 - "TAP_PLC_URL=${cfg.server.plcUrl}" 138 138 - "TAP_RELAY_URL=${cfg.atpRelayUrl}" 139 139 - "TAP_COLLECTION_FILTERS=${concatStringsSep "," [ 140 140 - "sh.tangled.repo" 141 141 - "sh.tangled.repo.collaborator" 142 142 - "sh.tangled.spindle.member" 143 143 - ]}" 144 144 - ]; 145 145 - ExecStart = "${getExe cfg.tap-package} run"; 146 146 - }; 147 147 - }; 148 148 - 149 117 systemd.services.spindle = { 150 118 description = "spindle service"; 151 119 after = ["network.target" "docker.service"]; 152 120 wantedBy = ["multi-user.target"]; 153 153 - path = [ 154 154 - pkgs.git 155 155 - ]; 156 121 serviceConfig = { 157 122 LogsDirectory = "spindle"; 158 123 StateDirectory = "spindle";

-20

nix/pkgs/bluesky-jetstream.nix

··· 1 1 - { 2 2 - buildGoModule, 3 3 - fetchFromGitHub, 4 4 - }: 5 5 - buildGoModule { 6 6 - pname = "bluesky-jetstream"; 7 7 - version = "0.1.0"; 8 8 - src = fetchFromGitHub { 9 9 - owner = "bluesky-social"; 10 10 - repo = "jetstream"; 11 11 - rev = "7d7efa58d7f14101a80ccc4f1085953948b7d5de"; 12 12 - sha256 = "sha256-1e9SL/8gaDPMA4YZed51ffzgpkptbMd0VTbTTDbPTFw="; 13 13 - }; 14 14 - subPackages = ["cmd/jetstream"]; 15 15 - vendorHash = "sha256-/21XJQH6fo9uPzlABUAbdBwt1O90odmppH6gXu2wkiQ="; 16 16 - doCheck = false; 17 17 - meta = { 18 18 - mainProgram = "jetstream"; 19 19 - }; 20 20 - }

-20

nix/pkgs/bluesky-relay.nix

··· 1 1 - { 2 2 - buildGoModule, 3 3 - fetchFromGitHub, 4 4 - }: 5 5 - buildGoModule { 6 6 - pname = "bluesky-relay"; 7 7 - version = "0.1.0"; 8 8 - src = fetchFromGitHub { 9 9 - owner = "boltlessengineer"; 10 10 - repo = "indigo"; 11 11 - rev = "b769ea60b7dde5e2bd0b8ee3ce8462a0c0e596fe"; 12 12 - sha256 = "sha256-jHRY825TBYaH1WkKFUoNbo4UlMSyuHvCGjYPiBnKo44="; 13 13 - }; 14 14 - subPackages = ["cmd/relay"]; 15 15 - vendorHash = "sha256-UOedwNYnM8Jx6B7Y9tFcZX8IeUBESAFAPTRYk7n0yo8="; 16 16 - doCheck = false; 17 17 - meta = { 18 18 - mainProgram = "relay"; 19 19 - }; 20 20 - }

-65

nix/pkgs/did-method-plc.nix

··· 1 1 - # inspired by https://github.com/NixOS/nixpkgs/blob/333bfb7c258fab089a834555ea1c435674c459b4/pkgs/by-name/ga/gatsby-cli/package.nix 2 2 - { 3 3 - lib, 4 4 - stdenv, 5 5 - fetchFromGitHub, 6 6 - fetchYarnDeps, 7 7 - yarnConfigHook, 8 8 - yarnBuildHook, 9 9 - nodejs, 10 10 - makeBinaryWrapper, 11 11 - }: 12 12 - stdenv.mkDerivation (finalAttrs: { 13 13 - pname = "did-method-plc"; 14 14 - version = "0.0.1"; 15 15 - 16 16 - src = fetchFromGitHub { 17 17 - owner = "did-method-plc"; 18 18 - repo = "did-method-plc"; 19 19 - rev = "158ba5535ac3da4fd4309954bde41deab0b45972"; 20 20 - sha256 = "sha256-O5smubbrnTDMCvL6iRyMXkddr5G7YHxkQRVMRULHanQ="; 21 21 - }; 22 22 - postPatch = '' 23 23 - # remove dd-trace dependency 24 24 - sed -i '3d' packages/server/service/index.js 25 25 - ''; 26 26 - 27 27 - yarnOfflineCache = fetchYarnDeps { 28 28 - yarnLock = finalAttrs.src + "/yarn.lock"; 29 29 - hash = "sha256-g8GzaAbWSnWwbQjJMV2DL5/ZlWCCX0sRkjjvX3tqU4Y="; 30 30 - }; 31 31 - 32 32 - nativeBuildInputs = [ 33 33 - yarnConfigHook 34 34 - yarnBuildHook 35 35 - nodejs 36 36 - makeBinaryWrapper 37 37 - ]; 38 38 - yarnBuildScript = "lerna"; 39 39 - yarnBuildFlags = [ 40 40 - "run" 41 41 - "build" 42 42 - "--scope" 43 43 - "@did-plc/server" 44 44 - "--include-dependencies" 45 45 - ]; 46 46 - 47 47 - installPhase = '' 48 48 - runHook preInstall 49 49 - 50 50 - mkdir -p $out/lib/node_modules/ 51 51 - mv packages/ $out/lib/packages/ 52 52 - mv node_modules/* $out/lib/node_modules/ 53 53 - 54 54 - makeWrapper ${lib.getExe nodejs} $out/bin/plc \ 55 55 - --add-flags $out/lib/packages/server/service/index.js \ 56 56 - --add-flags --enable-source-maps \ 57 57 - --set NODE_PATH $out/lib/node_modules 58 58 - 59 59 - runHook postInstall 60 60 - ''; 61 61 - 62 62 - meta = { 63 63 - mainProgram = "plc"; 64 64 - }; 65 65 - })

-20

nix/pkgs/tap.nix

··· 1 1 - { 2 2 - buildGoModule, 3 3 - fetchFromGitHub, 4 4 - }: 5 5 - buildGoModule { 6 6 - pname = "tap"; 7 7 - version = "0.1.0"; 8 8 - src = fetchFromGitHub { 9 9 - owner = "bluesky-social"; 10 10 - repo = "indigo"; 11 11 - rev = "f92cb29224fcc60f666b20ee3514e431a58ff811"; 12 12 - sha256 = "sha256-35ltXnq0SJeo3j33D7Nndbcnw5XWBJLRrmZ+nCmZVQw="; 13 13 - }; 14 14 - subPackages = ["cmd/tap"]; 15 15 - vendorHash = "sha256-UOedwNYnM8Jx6B7Y9tFcZX8IeUBESAFAPTRYk7n0yo8="; 16 16 - doCheck = false; 17 17 - meta = { 18 18 - mainProgram = "tap"; 19 19 - }; 20 20 - }

-2

nix/vm.nix

··· 19 19 20 20 plcUrl = envVarOr "TANGLED_VM_PLC_URL" "https://plc.directory"; 21 21 jetstream = envVarOr "TANGLED_VM_JETSTREAM_ENDPOINT" "wss://jetstream1.us-west.bsky.network/subscribe"; 22 22 - relayUrl = envVarOr "TANGLED_VM_RELAY_URL" "https://relay1.us-east.bsky.network"; 23 22 in 24 23 nixpkgs.lib.nixosSystem { 25 24 inherit system; ··· 96 95 }; 97 96 services.tangled.spindle = { 98 97 enable = true; 99 99 - atpRelayUrl = relayUrl; 100 98 server = { 101 99 owner = envVar "TANGLED_VM_SPINDLE_OWNER"; 102 100 hostname = envVarOr "TANGLED_VM_SPINDLE_HOST" "localhost:6555";

-10

orm/orm.go

··· 20 20 } 21 21 defer tx.Rollback() 22 22 23 23 - _, err = tx.Exec(` 24 24 - create table if not exists migrations ( 25 25 - id integer primary key autoincrement, 26 26 - name text unique 27 27 - ); 28 28 - `) 29 29 - if err != nil { 30 30 - return fmt.Errorf("creating migrations table: %w", err) 31 31 - } 32 32 - 33 23 var exists bool 34 24 err = tx.QueryRow("select exists (select 1 from migrations where name = ?)", name).Scan(&exists) 35 25 if err != nil {

-144

rbac2/rbac2.go

··· 1 1 - package rbac2 2 2 - 3 3 - import ( 4 4 - "database/sql" 5 5 - "fmt" 6 6 - 7 7 - adapter "github.com/Blank-Xu/sql-adapter" 8 8 - "github.com/bluesky-social/indigo/atproto/syntax" 9 9 - "github.com/casbin/casbin/v2" 10 10 - "github.com/casbin/casbin/v2/model" 11 11 - "github.com/casbin/casbin/v2/util" 12 12 - "tangled.org/core/api/tangled" 13 13 - ) 14 14 - 15 15 - const ( 16 16 - Model = ` 17 17 - [request_definition] 18 18 - r = sub, dom, obj, act 19 19 - 20 20 - [policy_definition] 21 21 - p = sub, dom, obj, act 22 22 - 23 23 - [role_definition] 24 24 - g = _, _, _ 25 25 - 26 26 - [policy_effect] 27 27 - e = some(where (p.eft == allow)) 28 28 - 29 29 - [matchers] 30 30 - m = g(r.sub, p.sub, r.dom) && keyMatch4(r.dom, p.dom) && r.obj == p.obj && r.act == p.act 31 31 - ` 32 32 - ) 33 33 - 34 34 - type Enforcer struct { 35 35 - e *casbin.Enforcer 36 36 - } 37 37 - 38 38 - func NewEnforcer(path string) (*Enforcer, error) { 39 39 - m, err := model.NewModelFromString(Model) 40 40 - if err != nil { 41 41 - return nil, err 42 42 - } 43 43 - 44 44 - db, err := sql.Open("sqlite3", path+"?_foreign_keys=1") 45 45 - if err != nil { 46 46 - return nil, err 47 47 - } 48 48 - 49 49 - a, err := adapter.NewAdapter(db, "sqlite3", "acl") 50 50 - if err != nil { 51 51 - return nil, err 52 52 - } 53 53 - 54 54 - e, err := casbin.NewEnforcer(m, a) 55 55 - if err != nil { 56 56 - return nil, err 57 57 - } 58 58 - 59 59 - if err := seedTangledPolicies(e); err != nil { 60 60 - return nil, err 61 61 - } 62 62 - 63 63 - return &Enforcer{e}, nil 64 64 - } 65 65 - 66 66 - func seedTangledPolicies(e *casbin.Enforcer) error { 67 67 - // policies 68 68 - aturi := func(nsid string) string { 69 69 - return fmt.Sprintf("at://{did}/%s/{rkey}", nsid) 70 70 - } 71 71 - 72 72 - _, err := e.AddPoliciesEx([][]string{ 73 73 - // sub | dom | obj | act 74 74 - {"repo:owner", aturi(tangled.RepoNSID), "/", "write"}, 75 75 - {"repo:owner", aturi(tangled.RepoNSID), "/collaborator", "write"}, // invite 76 76 - {"repo:collaborator", aturi(tangled.RepoNSID), "/settings", "write"}, 77 77 - {"repo:collaborator", aturi(tangled.RepoNSID), "/git", "write"}, // git push 78 78 - 79 79 - {"server:owner", "/knot/{did}", "/member", "write"}, // invite 80 80 - {"server:member", "/knot/{did}", "/git", "write"}, 81 81 - 82 82 - {"server:owner", "/spindle/{did}", "/member", "write"}, // invite 83 83 - }) 84 84 - if err != nil { 85 85 - return err 86 86 - } 87 87 - 88 88 - // grouping policies 89 89 - // TODO(boltless): define our own matcher to replace keyMatch4 90 90 - e.AddNamedDomainMatchingFunc("g", "keyMatch4", util.KeyMatch4) 91 91 - _, err = e.AddGroupingPoliciesEx([][]string{ 92 92 - // sub | role | dom 93 93 - {"repo:owner", "repo:collaborator", aturi(tangled.RepoNSID)}, 94 94 - 95 95 - // using '/knot/' prefix here because knot/spindle identifiers don't 96 96 - // include the collection type 97 97 - {"server:owner", "server:member", "/knot/{did}"}, 98 98 - {"server:owner", "server:member", "/spindle/{did}"}, 99 99 - }) 100 100 - return err 101 101 - } 102 102 - 103 103 - func (e *Enforcer) hasImplicitRoleForUser(name string, role string, domain ...string) (bool, error) { 104 104 - roles, err := e.e.GetImplicitRolesForUser(name, domain...) 105 105 - if err != nil { 106 106 - return false, err 107 107 - } 108 108 - for _, r := range roles { 109 109 - if r == role { 110 110 - return true, nil 111 111 - } 112 112 - } 113 113 - return false, nil 114 114 - } 115 115 - 116 116 - // setRoleForUser sets single user role for specified domain. 117 117 - // All existing users with that role will be removed. 118 118 - func (e *Enforcer) setRoleForUser(name string, role string, domain ...string) error { 119 119 - currentUsers, err := e.e.GetUsersForRole(role, domain...) 120 120 - if err != nil { 121 121 - return err 122 122 - } 123 123 - 124 124 - for _, oldUser := range currentUsers { 125 125 - _, err = e.e.DeleteRoleForUser(oldUser, role, domain...) 126 126 - if err != nil { 127 127 - return err 128 128 - } 129 129 - } 130 130 - 131 131 - _, err = e.e.AddRoleForUser(name, role, domain...) 132 132 - return err 133 133 - } 134 134 - 135 135 - // validateAtUri enforeces AT-URI to have valid did as authority and match collection NSID. 136 136 - func validateAtUri(uri syntax.ATURI, expected string) error { 137 137 - if !uri.Authority().IsDID() { 138 138 - return fmt.Errorf("expected at-uri with did") 139 139 - } 140 140 - if expected != "" && uri.Collection().String() != expected { 141 141 - return fmt.Errorf("incorrect repo at-uri collection nsid '%s' (expected '%s')", uri.Collection(), expected) 142 142 - } 143 143 - return nil 144 144 - }

-115

rbac2/rbac2_test.go

··· 1 1 - package rbac2_test 2 2 - 3 3 - import ( 4 4 - "testing" 5 5 - 6 6 - "github.com/bluesky-social/indigo/atproto/syntax" 7 7 - _ "github.com/mattn/go-sqlite3" 8 8 - "github.com/stretchr/testify/assert" 9 9 - "tangled.org/core/rbac2" 10 10 - ) 11 11 - 12 12 - func setup(t *testing.T) *rbac2.Enforcer { 13 13 - enforcer, err := rbac2.NewEnforcer(":memory:") 14 14 - assert.NoError(t, err) 15 15 - 16 16 - return enforcer 17 17 - } 18 18 - 19 19 - func TestRepoOwnerPermissions(t *testing.T) { 20 20 - var ( 21 21 - e = setup(t) 22 22 - ok bool 23 23 - err error 24 24 - fooRepo = syntax.ATURI("at://did:plc:foo/sh.tangled.repo/reporkey") 25 25 - fooUser = syntax.DID("did:plc:foo") 26 26 - ) 27 27 - 28 28 - assert.NoError(t, e.AddRepo(fooRepo)) 29 29 - 30 30 - ok, err = e.IsRepoOwner(fooUser, fooRepo) 31 31 - assert.NoError(t, err) 32 32 - assert.True(t, ok, "repo author should be repo owner") 33 33 - 34 34 - ok, err = e.IsRepoWriteAllowed(fooUser, fooRepo) 35 35 - assert.NoError(t, err) 36 36 - assert.True(t, ok, "repo owner should be able to modify the repo itself") 37 37 - 38 38 - ok, err = e.IsRepoCollaborator(fooUser, fooRepo) 39 39 - assert.NoError(t, err) 40 40 - assert.True(t, ok, "repo owner should inherit role role:collaborator") 41 41 - 42 42 - ok, err = e.IsRepoSettingsWriteAllowed(fooUser, fooRepo) 43 43 - assert.NoError(t, err) 44 44 - assert.True(t, ok, "repo owner should inherit collaborator permissions") 45 45 - } 46 46 - 47 47 - func TestRepoCollaboratorPermissions(t *testing.T) { 48 48 - var ( 49 49 - e = setup(t) 50 50 - ok bool 51 51 - err error 52 52 - fooRepo = syntax.ATURI("at://did:plc:foo/sh.tangled.repo/reporkey") 53 53 - barUser = syntax.DID("did:plc:bar") 54 54 - ) 55 55 - 56 56 - assert.NoError(t, e.AddRepo(fooRepo)) 57 57 - assert.NoError(t, e.AddRepoCollaborator(barUser, fooRepo)) 58 58 - 59 59 - ok, err = e.IsRepoCollaborator(barUser, fooRepo) 60 60 - assert.NoError(t, err) 61 61 - assert.True(t, ok, "should set repo collaborator") 62 62 - 63 63 - ok, err = e.IsRepoSettingsWriteAllowed(barUser, fooRepo) 64 64 - assert.NoError(t, err) 65 65 - assert.True(t, ok, "repo collaborator should be able to edit repo settings") 66 66 - 67 67 - ok, err = e.IsRepoWriteAllowed(barUser, fooRepo) 68 68 - assert.NoError(t, err) 69 69 - assert.False(t, ok, "repo collaborator shouldn't be able to modify the repo itself") 70 70 - } 71 71 - 72 72 - func TestGetByRole(t *testing.T) { 73 73 - var ( 74 74 - e = setup(t) 75 75 - err error 76 76 - fooRepo = syntax.ATURI("at://did:plc:foo/sh.tangled.repo/reporkey") 77 77 - owner = syntax.DID("did:plc:foo") 78 78 - collaborator1 = syntax.DID("did:plc:bar") 79 79 - collaborator2 = syntax.DID("did:plc:baz") 80 80 - ) 81 81 - 82 82 - assert.NoError(t, e.AddRepo(fooRepo)) 83 83 - assert.NoError(t, e.AddRepoCollaborator(collaborator1, fooRepo)) 84 84 - assert.NoError(t, e.AddRepoCollaborator(collaborator2, fooRepo)) 85 85 - 86 86 - collaborators, err := e.GetRepoCollaborators(fooRepo) 87 87 - assert.NoError(t, err) 88 88 - assert.ElementsMatch(t, []syntax.DID{ 89 89 - owner, 90 90 - collaborator1, 91 91 - collaborator2, 92 92 - }, collaborators) 93 93 - } 94 94 - 95 95 - func TestSpindleOwnerPermissions(t *testing.T) { 96 96 - var ( 97 97 - e = setup(t) 98 98 - ok bool 99 99 - err error 100 100 - spindle = syntax.DID("did:web:spindle.example.com") 101 101 - owner = syntax.DID("did:plc:foo") 102 102 - member = syntax.DID("did:plc:bar") 103 103 - ) 104 104 - 105 105 - assert.NoError(t, e.SetSpindleOwner(owner, spindle)) 106 106 - assert.NoError(t, e.AddSpindleMember(member, spindle)) 107 107 - 108 108 - ok, err = e.IsSpindleMemberInviteAllowed(owner, spindle) 109 109 - assert.NoError(t, err) 110 110 - assert.True(t, ok, "spindle owner can invite members") 111 111 - 112 112 - ok, err = e.IsSpindleMemberInviteAllowed(member, spindle) 113 113 - assert.NoError(t, err) 114 114 - assert.False(t, ok, "spindle member cannot invite members") 115 115 - }

-91

rbac2/repo.go

··· 1 1 - package rbac2 2 2 - 3 3 - import ( 4 4 - "slices" 5 5 - "strings" 6 6 - 7 7 - "github.com/bluesky-social/indigo/atproto/syntax" 8 8 - "tangled.org/core/api/tangled" 9 9 - ) 10 10 - 11 11 - // AddRepo adds new repo with its owner to rbac enforcer 12 12 - func (e *Enforcer) AddRepo(repo syntax.ATURI) error { 13 13 - if err := validateAtUri(repo, tangled.RepoNSID); err != nil { 14 14 - return err 15 15 - } 16 16 - user := repo.Authority() 17 17 - 18 18 - return e.setRoleForUser(user.String(), "repo:owner", repo.String()) 19 19 - } 20 20 - 21 21 - // DeleteRepo deletes all policies related to the repo 22 22 - func (e *Enforcer) DeleteRepo(repo syntax.ATURI) error { 23 23 - if err := validateAtUri(repo, tangled.RepoNSID); err != nil { 24 24 - return err 25 25 - } 26 26 - 27 27 - _, err := e.e.DeleteDomains(repo.String()) 28 28 - return err 29 29 - } 30 30 - 31 31 - // AddRepoCollaborator adds new collaborator to the repo 32 32 - func (e *Enforcer) AddRepoCollaborator(user syntax.DID, repo syntax.ATURI) error { 33 33 - if err := validateAtUri(repo, tangled.RepoNSID); err != nil { 34 34 - return err 35 35 - } 36 36 - 37 37 - _, err := e.e.AddRoleForUser(user.String(), "repo:collaborator", repo.String()) 38 38 - return err 39 39 - } 40 40 - 41 41 - // RemoveRepoCollaborator removes the collaborator from the repo. 42 42 - // This won't remove inherited roles like repository owner. 43 43 - func (e *Enforcer) RemoveRepoCollaborator(user syntax.DID, repo syntax.ATURI) error { 44 44 - if err := validateAtUri(repo, tangled.RepoNSID); err != nil { 45 45 - return err 46 46 - } 47 47 - 48 48 - _, err := e.e.DeleteRoleForUser(user.String(), "repo:collaborator", repo.String()) 49 49 - return err 50 50 - } 51 51 - 52 52 - func (e *Enforcer) GetRepoCollaborators(repo syntax.ATURI) ([]syntax.DID, error) { 53 53 - var collaborators []syntax.DID 54 54 - members, err := e.e.GetImplicitUsersForRole("repo:collaborator", repo.String()) 55 55 - if err != nil { 56 56 - return nil, err 57 57 - } 58 58 - for _, m := range members { 59 59 - if !strings.HasPrefix(m, "did:") { // skip non-user subjects like 'repo:owner' 60 60 - continue 61 61 - } 62 62 - collaborators = append(collaborators, syntax.DID(m)) 63 63 - } 64 64 - 65 65 - slices.Sort(collaborators) 66 66 - return slices.Compact(collaborators), nil 67 67 - } 68 68 - 69 69 - func (e *Enforcer) IsRepoOwner(user syntax.DID, repo syntax.ATURI) (bool, error) { 70 70 - return e.e.HasRoleForUser(user.String(), "repo:owner", repo.String()) 71 71 - } 72 72 - 73 73 - func (e *Enforcer) IsRepoCollaborator(user syntax.DID, repo syntax.ATURI) (bool, error) { 74 74 - return e.hasImplicitRoleForUser(user.String(), "repo:collaborator", repo.String()) 75 75 - } 76 76 - 77 77 - func (e *Enforcer) IsRepoWriteAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) { 78 78 - return e.e.Enforce(user.String(), repo.String(), "#/", "write") 79 79 - } 80 80 - 81 81 - func (e *Enforcer) IsRepoSettingsWriteAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) { 82 82 - return e.e.Enforce(user.String(), repo.String(), "#/settings", "write") 83 83 - } 84 84 - 85 85 - func (e *Enforcer) IsRepoCollaboratorInviteAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) { 86 86 - return e.e.Enforce(user.String(), repo.String(), "#/collaborator", "write") 87 87 - } 88 88 - 89 89 - func (e *Enforcer) IsRepoGitPushAllowed(user syntax.DID, repo syntax.ATURI) (bool, error) { 90 90 - return e.e.Enforce(user.String(), repo.String(), "#/git", "write") 91 91 - }

-29

rbac2/spindle.go

··· 1 1 - package rbac2 2 2 - 3 3 - import "github.com/bluesky-social/indigo/atproto/syntax" 4 4 - 5 5 - func (e *Enforcer) SetSpindleOwner(user syntax.DID, spindle syntax.DID) error { 6 6 - return e.setRoleForUser(user.String(), "server:owner", intoSpindle(spindle)) 7 7 - } 8 8 - 9 9 - func (e *Enforcer) IsSpindleMember(user syntax.DID, spindle syntax.DID) (bool, error) { 10 10 - return e.e.HasRoleForUser(user.String(), "server:member", spindle.String()) 11 11 - } 12 12 - 13 13 - func (e *Enforcer) AddSpindleMember(user syntax.DID, spindle syntax.DID) error { 14 14 - _, err := e.e.AddRoleForUser(user.String(), "server:member", intoSpindle(spindle)) 15 15 - return err 16 16 - } 17 17 - 18 18 - func (e *Enforcer) RemoveSpindleMember(user syntax.DID, spindle syntax.DID) error { 19 19 - _, err := e.e.DeleteRoleForUser(user.String(), "server:member", intoSpindle(spindle)) 20 20 - return err 21 21 - } 22 22 - 23 23 - func (e *Enforcer) IsSpindleMemberInviteAllowed(user syntax.DID, spindle syntax.DID) (bool, error) { 24 24 - return e.e.Enforce(user.String(), intoSpindle(spindle), "#/member", "write") 25 25 - } 26 26 - 27 27 - func intoSpindle(did syntax.DID) string { 28 28 - return "/spindle/" + did.String() 29 29 - }

+11 -18

spindle/config/config.go

··· 3 3 import ( 4 4 "context" 5 5 "fmt" 6 6 - "path" 7 6 8 7 "github.com/bluesky-social/indigo/atproto/syntax" 9 8 "github.com/sethvargo/go-envconfig" 10 9 ) 11 10 12 11 type Server struct { 13 13 - ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"` 14 14 - DBPath string `env:"DB_PATH, default=spindle.db"` 15 15 - Hostname string `env:"HOSTNAME, required"` 16 16 - JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"` 17 17 - TapUrl string `env:"TAP_URL, required"` 18 18 - PlcUrl string `env:"PLC_URL, default=https://plc.directory"` 19 19 - Dev bool `env:"DEV, default=false"` 20 20 - Owner syntax.DID `env:"OWNER, required"` 21 21 - Secrets Secrets `env:",prefix=SECRETS_"` 22 22 - LogDir string `env:"LOG_DIR, default=/var/log/spindle"` 23 23 - DataDir string `env:"REPO_DIR, default=/var/lib/spindle"` 24 24 - QueueSize int `env:"QUEUE_SIZE, default=100"` 25 25 - MaxJobCount int `env:"MAX_JOB_COUNT, default=2"` // max number of jobs that run at a time 12 12 + ListenAddr string `env:"LISTEN_ADDR, default=0.0.0.0:6555"` 13 13 + DBPath string `env:"DB_PATH, default=spindle.db"` 14 14 + Hostname string `env:"HOSTNAME, required"` 15 15 + JetstreamEndpoint string `env:"JETSTREAM_ENDPOINT, default=wss://jetstream1.us-west.bsky.network/subscribe"` 16 16 + PlcUrl string `env:"PLC_URL, default=https://plc.directory"` 17 17 + Dev bool `env:"DEV, default=false"` 18 18 + Owner string `env:"OWNER, required"` 19 19 + Secrets Secrets `env:",prefix=SECRETS_"` 20 20 + LogDir string `env:"LOG_DIR, default=/var/log/spindle"` 21 21 + QueueSize int `env:"QUEUE_SIZE, default=100"` 22 22 + MaxJobCount int `env:"MAX_JOB_COUNT, default=2"` // max number of jobs that run at a time 26 23 } 27 24 28 25 func (s Server) Did() syntax.DID { 29 26 return syntax.DID(fmt.Sprintf("did:web:%s", s.Hostname)) 30 30 - } 31 31 - 32 32 - func (s Server) RepoDir() string { 33 33 - return path.Join(s.DataDir, "repos") 34 27 } 35 28 36 29 type Secrets struct {

+18 -59

spindle/db/db.go

··· 1 1 package db 2 2 3 3 import ( 4 4 - "context" 5 4 "database/sql" 6 5 "strings" 7 6 8 8 - "github.com/bluesky-social/indigo/atproto/syntax" 9 7 _ "github.com/mattn/go-sqlite3" 10 10 - "tangled.org/core/log" 11 11 - "tangled.org/core/orm" 12 8 ) 13 9 14 10 type DB struct { 15 11 *sql.DB 16 12 } 17 13 18 18 - func Make(ctx context.Context, dbPath string) (*DB, error) { 14 14 + func Make(dbPath string) (*DB, error) { 19 15 // https://github.com/mattn/go-sqlite3#connection-string 20 16 opts := []string{ 21 17 "_foreign_keys=1", ··· 23 19 "_synchronous=NORMAL", 24 20 "_auto_vacuum=incremental", 25 21 } 26 26 - 27 27 - logger := log.FromContext(ctx) 28 28 - logger = log.SubLogger(logger, "db") 29 22 30 23 db, err := sql.Open("sqlite3", dbPath+"?"+strings.Join(opts, "&")) 31 24 if err != nil { 32 25 return nil, err 33 26 } 34 27 35 35 - conn, err := db.Conn(ctx) 36 36 - if err != nil { 37 37 - return nil, err 38 38 - } 39 39 - defer conn.Close() 28 28 + // NOTE: If any other migration is added here, you MUST 29 29 + // copy the pattern in appview: use a single sql.Conn 30 30 + // for every migration. 40 31 41 32 _, err = db.Exec(` 42 33 create table if not exists _jetstream ( ··· 85 76 return nil, err 86 77 } 87 78 88 88 - // run migrations 79 79 + return &DB{db}, nil 80 80 + } 89 81 90 90 - // NOTE: this won't migrate existing records 91 91 - // they will be fetched again with tap instead 92 92 - orm.RunMigration(conn, logger, "add-rkey-to-repos", func(tx *sql.Tx) error { 93 93 - // archive legacy repos (just in case) 94 94 - _, err = tx.Exec(`alter table repos rename to repos_old`) 95 95 - if err != nil { 96 96 - return err 97 97 - } 98 98 - 99 99 - _, err := tx.Exec(` 100 100 - create table repos_new ( 101 101 - -- identifiers 102 102 - id integer primary key autoincrement, 103 103 - did text not null, 104 104 - rkey text not null, 105 105 - at_uri text generated always as ('at://' || did || '/' || 'sh.tangled.repo' || '/' || rkey) stored, 106 106 - 107 107 - name text not null, 108 108 - knot text not null, 109 109 - 110 110 - addedAt text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')), 111 111 - unique(did, rkey) 112 112 - ); 113 113 - `) 114 114 - if err != nil { 115 115 - return err 116 116 - } 117 117 - 118 118 - return nil 119 119 - }) 120 120 - 121 121 - return &DB{db}, nil 82 82 + func (d *DB) SaveLastTimeUs(lastTimeUs int64) error { 83 83 + _, err := d.Exec(` 84 84 + insert into _jetstream (id, last_time_us) 85 85 + values (1, ?) 86 86 + on conflict(id) do update set last_time_us = excluded.last_time_us 87 87 + `, lastTimeUs) 88 88 + return err 122 89 } 123 90 124 124 - func (d *DB) IsKnownDid(did syntax.DID) (bool, error) { 125 125 - // is spindle member / repo collaborator 126 126 - var exists bool 127 127 - err := d.QueryRow( 128 128 - `select exists ( 129 129 - select 1 from repo_collaborators where did = ? 130 130 - union all 131 131 - select 1 from spindle_members where did = ? 132 132 - )`, 133 133 - did, 134 134 - did, 135 135 - ).Scan(&exists) 136 136 - return exists, err 91 91 + func (d *DB) GetLastTimeUs() (int64, error) { 92 92 + var lastTimeUs int64 93 93 + row := d.QueryRow(`select last_time_us from _jetstream where id = 1;`) 94 94 + err := row.Scan(&lastTimeUs) 95 95 + return lastTimeUs, err 137 96 }

+18 -6

spindle/db/events.go

··· 18 18 EventJson string `json:"event"` 19 19 } 20 20 21 21 - func (d *DB) insertEvent(event Event, notifier *notifier.Notifier) error { 21 21 + func (d *DB) InsertEvent(event Event, notifier *notifier.Notifier) error { 22 22 _, err := d.Exec( 23 23 `insert into events (rkey, nsid, event, created) values (?, ?, ?, ?)`, 24 24 event.Rkey, ··· 70 70 return evts, nil 71 71 } 72 72 73 73 + func (d *DB) CreateStatusEvent(rkey string, s tangled.PipelineStatus, n *notifier.Notifier) error { 74 74 + eventJson, err := json.Marshal(s) 75 75 + if err != nil { 76 76 + return err 77 77 + } 78 78 + 79 79 + event := Event{ 80 80 + Rkey: rkey, 81 81 + Nsid: tangled.PipelineStatusNSID, 82 82 + Created: time.Now().UnixNano(), 83 83 + EventJson: string(eventJson), 84 84 + } 85 85 + 86 86 + return d.InsertEvent(event, n) 87 87 + } 88 88 + 73 89 func (d *DB) createStatusEvent( 74 90 workflowId models.WorkflowId, 75 91 statusKind models.StatusKind, ··· 100 116 EventJson: string(eventJson), 101 117 } 102 118 103 103 - return d.insertEvent(event, n) 119 119 + return d.InsertEvent(event, n) 104 120 105 121 } 106 122 ··· 148 164 149 165 func (d *DB) StatusFailed(workflowId models.WorkflowId, workflowError string, exitCode int64, n *notifier.Notifier) error { 150 166 return d.createStatusEvent(workflowId, models.StatusKindFailed, &workflowError, &exitCode, n) 151 151 - } 152 152 - 153 153 - func (d *DB) StatusCancelled(workflowId models.WorkflowId, workflowError string, exitCode int64, n *notifier.Notifier) error { 154 154 - return d.createStatusEvent(workflowId, models.StatusKindCancelled, &workflowError, &exitCode, n) 155 167 } 156 168 157 169 func (d *DB) StatusSuccess(workflowId models.WorkflowId, n *notifier.Notifier) error {

+44

spindle/db/known_dids.go

··· 1 1 + package db 2 2 + 3 3 + func (d *DB) AddDid(did string) error { 4 4 + _, err := d.Exec(`insert or ignore into known_dids (did) values (?)`, did) 5 5 + return err 6 6 + } 7 7 + 8 8 + func (d *DB) RemoveDid(did string) error { 9 9 + _, err := d.Exec(`delete from known_dids where did = ?`, did) 10 10 + return err 11 11 + } 12 12 + 13 13 + func (d *DB) GetAllDids() ([]string, error) { 14 14 + var dids []string 15 15 + 16 16 + rows, err := d.Query(`select did from known_dids`) 17 17 + if err != nil { 18 18 + return nil, err 19 19 + } 20 20 + defer rows.Close() 21 21 + 22 22 + for rows.Next() { 23 23 + var did string 24 24 + if err := rows.Scan(&did); err != nil { 25 25 + return nil, err 26 26 + } 27 27 + dids = append(dids, did) 28 28 + } 29 29 + 30 30 + if err := rows.Err(); err != nil { 31 31 + return nil, err 32 32 + } 33 33 + 34 34 + return dids, nil 35 35 + } 36 36 + 37 37 + func (d *DB) HasKnownDids() bool { 38 38 + var count int 39 39 + err := d.QueryRow(`select count(*) from known_dids`).Scan(&count) 40 40 + if err != nil { 41 41 + return false 42 42 + } 43 43 + return count > 0 44 44 + }

+12 -120

spindle/db/repos.go

··· 1 1 package db 2 2 3 3 - import "github.com/bluesky-social/indigo/atproto/syntax" 4 4 - 5 3 type Repo struct { 6 6 - Did syntax.DID 7 7 - Rkey syntax.RecordKey 8 8 - Name string 9 9 - Knot string 4 4 + Knot string 5 5 + Owner string 6 6 + Name string 10 7 } 11 8 12 12 - type RepoCollaborator struct { 13 13 - Did syntax.DID 14 14 - Rkey syntax.RecordKey 15 15 - Repo syntax.ATURI 16 16 - Subject syntax.DID 17 17 - } 18 18 - 19 19 - func (d *DB) PutRepo(repo *Repo) error { 20 20 - _, err := d.Exec( 21 21 - `insert or ignore into repos (did, rkey, name, knot) 22 22 - values (?, ?, ?, ?) 23 23 - on conflict(did, rkey) do update set 24 24 - name = excluded.name 25 25 - knot = excluded.knot`, 26 26 - repo.Did, 27 27 - repo.Rkey, 28 28 - repo.Name, 29 29 - repo.Knot, 30 30 - ) 31 31 - return err 32 32 - } 33 33 - 34 34 - func (d *DB) DeleteRepo(did syntax.DID, rkey syntax.RecordKey) error { 35 35 - _, err := d.Exec( 36 36 - `delete from repos where did = ? and rkey = ?`, 37 37 - did, 38 38 - rkey, 39 39 - ) 9 9 + func (d *DB) AddRepo(knot, owner, name string) error { 10 10 + _, err := d.Exec(`insert or ignore into repos (knot, owner, name) values (?, ?, ?)`, knot, owner, name) 40 11 return err 41 12 } 42 13 ··· 45 16 if err != nil { 46 17 return nil, err 47 18 } 19 19 + defer rows.Close() 48 20 49 21 var knots []string 50 22 for rows.Next() { ··· 62 34 return knots, nil 63 35 } 64 36 65 65 - func (d *DB) GetRepo(did syntax.DID, rkey syntax.RecordKey) (*Repo, error) { 37 37 + func (d *DB) GetRepo(knot, owner, name string) (*Repo, error) { 66 38 var repo Repo 67 67 - err := d.DB.QueryRow( 68 68 - `select 69 69 - did, 70 70 - rkey, 71 71 - name, 72 72 - knot 73 73 - from repos where did = ? and rkey = ?`, 74 74 - did, 75 75 - rkey, 76 76 - ).Scan( 77 77 - &repo.Did, 78 78 - &repo.Rkey, 79 79 - &repo.Name, 80 80 - &repo.Knot, 81 81 - ) 82 82 - if err != nil { 83 83 - return nil, err 84 84 - } 85 85 - return &repo, nil 86 86 - } 87 39 88 88 - func (d *DB) GetRepoWithName(did syntax.DID, name string) (*Repo, error) { 89 89 - var repo Repo 90 90 - err := d.DB.QueryRow( 91 91 - `select 92 92 - did, 93 93 - rkey, 94 94 - name, 95 95 - knot 96 96 - from repos where did = ? and name = ?`, 97 97 - did, 98 98 - name, 99 99 - ).Scan( 100 100 - &repo.Did, 101 101 - &repo.Rkey, 102 102 - &repo.Name, 103 103 - &repo.Knot, 104 104 - ) 105 105 - if err != nil { 106 106 - return nil, err 107 107 - } 108 108 - return &repo, nil 109 109 - } 110 110 - 111 111 - func (d *DB) PutRepoCollaborator(collaborator *RepoCollaborator) error { 112 112 - _, err := d.Exec( 113 113 - `insert into repo_collaborators (did, rkey, repo, subject) 114 114 - values (?, ?, ?, ?) 115 115 - on conflict(did, rkey) do update set 116 116 - repo = excluded.repo 117 117 - subject = excluded.subject`, 118 118 - collaborator.Did, 119 119 - collaborator.Rkey, 120 120 - collaborator.Repo, 121 121 - collaborator.Subject, 122 122 - ) 123 123 - return err 124 124 - } 40 40 + query := "select knot, owner, name from repos where knot = ? and owner = ? and name = ?" 41 41 + err := d.DB.QueryRow(query, knot, owner, name). 42 42 + Scan(&repo.Knot, &repo.Owner, &repo.Name) 125 43 126 126 - func (d *DB) RemoveRepoCollaborator(did syntax.DID, rkey syntax.RecordKey) error { 127 127 - _, err := d.Exec( 128 128 - `delete from repo_collaborators where did = ? and rkey = ?`, 129 129 - did, 130 130 - rkey, 131 131 - ) 132 132 - return err 133 133 - } 134 134 - 135 135 - func (d *DB) GetRepoCollaborator(did syntax.DID, rkey syntax.RecordKey) (*RepoCollaborator, error) { 136 136 - var collaborator RepoCollaborator 137 137 - err := d.DB.QueryRow( 138 138 - `select 139 139 - did, 140 140 - rkey, 141 141 - repo, 142 142 - subject 143 143 - from repo_collaborators 144 144 - where did = ? and rkey = ?`, 145 145 - did, 146 146 - rkey, 147 147 - ).Scan( 148 148 - &collaborator.Did, 149 149 - &collaborator.Rkey, 150 150 - &collaborator.Repo, 151 151 - &collaborator.Subject, 152 152 - ) 153 44 if err != nil { 154 45 return nil, err 155 46 } 156 156 - return &collaborator, nil 47 47 + 48 48 + return &repo, nil 157 49 }

+10 -24

spindle/engines/nixery/engine.go

··· 179 179 return err 180 180 } 181 181 e.registerCleanup(wid, func(ctx context.Context) error { 182 182 - err := e.docker.NetworkRemove(ctx, networkName(wid)) 183 183 - if err != nil { 184 184 - return fmt.Errorf("removing network: %w", err) 185 185 - } 186 186 - return nil 182 182 + return e.docker.NetworkRemove(ctx, networkName(wid)) 187 183 }) 188 184 189 185 addl := wf.Data.(addlFields) ··· 233 229 return fmt.Errorf("creating container: %w", err) 234 230 } 235 231 e.registerCleanup(wid, func(ctx context.Context) error { 236 236 - err := e.docker.ContainerStop(ctx, resp.ID, container.StopOptions{}) 232 232 + err = e.docker.ContainerStop(ctx, resp.ID, container.StopOptions{}) 237 233 if err != nil { 238 238 - return fmt.Errorf("stopping container: %w", err) 234 234 + return err 239 235 } 240 236 241 241 - err = e.docker.ContainerRemove(ctx, resp.ID, container.RemoveOptions{ 237 237 + return e.docker.ContainerRemove(ctx, resp.ID, container.RemoveOptions{ 242 238 RemoveVolumes: true, 243 239 RemoveLinks: false, 244 240 Force: false, 245 241 }) 246 246 - if err != nil { 247 247 - return fmt.Errorf("removing container: %w", err) 248 248 - } 249 249 - return nil 250 242 }) 251 243 252 244 err = e.docker.ContainerStart(ctx, resp.ID, container.StartOptions{}) ··· 402 394 } 403 395 404 396 func (e *Engine) DestroyWorkflow(ctx context.Context, wid models.WorkflowId) error { 405 405 - fns := e.drainCleanups(wid) 397 397 + e.cleanupMu.Lock() 398 398 + key := wid.String() 399 399 + 400 400 + fns := e.cleanup[key] 401 401 + delete(e.cleanup, key) 402 402 + e.cleanupMu.Unlock() 406 403 407 404 for _, fn := range fns { 408 405 if err := fn(ctx); err != nil { ··· 418 415 419 416 key := wid.String() 420 417 e.cleanup[key] = append(e.cleanup[key], fn) 421 421 - } 422 422 - 423 423 - func (e *Engine) drainCleanups(wid models.WorkflowId) []cleanupFunc { 424 424 - e.cleanupMu.Lock() 425 425 - key := wid.String() 426 426 - 427 427 - fns := e.cleanup[key] 428 428 - delete(e.cleanup, key) 429 429 - e.cleanupMu.Unlock() 430 430 - 431 431 - return fns 432 418 } 433 419 434 420 func networkName(wid models.WorkflowId) string {

+300

spindle/ingester.go

··· 1 1 + package spindle 2 2 + 3 3 + import ( 4 4 + "context" 5 5 + "encoding/json" 6 6 + "errors" 7 7 + "fmt" 8 8 + "time" 9 9 + 10 10 + "tangled.org/core/api/tangled" 11 11 + "tangled.org/core/eventconsumer" 12 12 + "tangled.org/core/rbac" 13 13 + "tangled.org/core/spindle/db" 14 14 + 15 15 + comatproto "github.com/bluesky-social/indigo/api/atproto" 16 16 + "github.com/bluesky-social/indigo/atproto/identity" 17 17 + "github.com/bluesky-social/indigo/atproto/syntax" 18 18 + "github.com/bluesky-social/indigo/xrpc" 19 19 + "github.com/bluesky-social/jetstream/pkg/models" 20 20 + securejoin "github.com/cyphar/filepath-securejoin" 21 21 + ) 22 22 + 23 23 + type Ingester func(ctx context.Context, e *models.Event) error 24 24 + 25 25 + func (s *Spindle) ingest() Ingester { 26 26 + return func(ctx context.Context, e *models.Event) error { 27 27 + var err error 28 28 + defer func() { 29 29 + eventTime := e.TimeUS 30 30 + lastTimeUs := eventTime + 1 31 31 + if err := s.db.SaveLastTimeUs(lastTimeUs); err != nil { 32 32 + err = fmt.Errorf("(deferred) failed to save last time us: %w", err) 33 33 + } 34 34 + }() 35 35 + 36 36 + if e.Kind != models.EventKindCommit { 37 37 + return nil 38 38 + } 39 39 + 40 40 + switch e.Commit.Collection { 41 41 + case tangled.SpindleMemberNSID: 42 42 + err = s.ingestMember(ctx, e) 43 43 + case tangled.RepoNSID: 44 44 + err = s.ingestRepo(ctx, e) 45 45 + case tangled.RepoCollaboratorNSID: 46 46 + err = s.ingestCollaborator(ctx, e) 47 47 + } 48 48 + 49 49 + if err != nil { 50 50 + s.l.Debug("failed to process message", "nsid", e.Commit.Collection, "err", err) 51 51 + } 52 52 + 53 53 + return nil 54 54 + } 55 55 + } 56 56 + 57 57 + func (s *Spindle) ingestMember(_ context.Context, e *models.Event) error { 58 58 + var err error 59 59 + did := e.Did 60 60 + rkey := e.Commit.RKey 61 61 + 62 62 + l := s.l.With("component", "ingester", "record", tangled.SpindleMemberNSID) 63 63 + 64 64 + switch e.Commit.Operation { 65 65 + case models.CommitOperationCreate, models.CommitOperationUpdate: 66 66 + raw := e.Commit.Record 67 67 + record := tangled.SpindleMember{} 68 68 + err = json.Unmarshal(raw, &record) 69 69 + if err != nil { 70 70 + l.Error("invalid record", "error", err) 71 71 + return err 72 72 + } 73 73 + 74 74 + domain := s.cfg.Server.Hostname 75 75 + recordInstance := record.Instance 76 76 + 77 77 + if recordInstance != domain { 78 78 + l.Error("domain mismatch", "domain", recordInstance, "expected", domain) 79 79 + return fmt.Errorf("domain mismatch: %s != %s", record.Instance, domain) 80 80 + } 81 81 + 82 82 + ok, err := s.e.IsSpindleInviteAllowed(did, rbacDomain) 83 83 + if err != nil || !ok { 84 84 + l.Error("failed to add member", "did", did, "error", err) 85 85 + return fmt.Errorf("failed to enforce permissions: %w", err) 86 86 + } 87 87 + 88 88 + if err := db.AddSpindleMember(s.db, db.SpindleMember{ 89 89 + Did: syntax.DID(did), 90 90 + Rkey: rkey, 91 91 + Instance: recordInstance, 92 92 + Subject: syntax.DID(record.Subject), 93 93 + Created: time.Now(), 94 94 + }); err != nil { 95 95 + l.Error("failed to add member", "error", err) 96 96 + return fmt.Errorf("failed to add member: %w", err) 97 97 + } 98 98 + 99 99 + if err := s.e.AddSpindleMember(rbacDomain, record.Subject); err != nil { 100 100 + l.Error("failed to add member", "error", err) 101 101 + return fmt.Errorf("failed to add member: %w", err) 102 102 + } 103 103 + l.Info("added member from firehose", "member", record.Subject) 104 104 + 105 105 + if err := s.db.AddDid(record.Subject); err != nil { 106 106 + l.Error("failed to add did", "error", err) 107 107 + return fmt.Errorf("failed to add did: %w", err) 108 108 + } 109 109 + s.jc.AddDid(record.Subject) 110 110 + 111 111 + return nil 112 112 + 113 113 + case models.CommitOperationDelete: 114 114 + record, err := db.GetSpindleMember(s.db, did, rkey) 115 115 + if err != nil { 116 116 + l.Error("failed to find member", "error", err) 117 117 + return fmt.Errorf("failed to find member: %w", err) 118 118 + } 119 119 + 120 120 + if err := db.RemoveSpindleMember(s.db, did, rkey); err != nil { 121 121 + l.Error("failed to remove member", "error", err) 122 122 + return fmt.Errorf("failed to remove member: %w", err) 123 123 + } 124 124 + 125 125 + if err := s.e.RemoveSpindleMember(rbacDomain, record.Subject.String()); err != nil { 126 126 + l.Error("failed to add member", "error", err) 127 127 + return fmt.Errorf("failed to add member: %w", err) 128 128 + } 129 129 + l.Info("added member from firehose", "member", record.Subject) 130 130 + 131 131 + if err := s.db.RemoveDid(record.Subject.String()); err != nil { 132 132 + l.Error("failed to add did", "error", err) 133 133 + return fmt.Errorf("failed to add did: %w", err) 134 134 + } 135 135 + s.jc.RemoveDid(record.Subject.String()) 136 136 + 137 137 + } 138 138 + return nil 139 139 + } 140 140 + 141 141 + func (s *Spindle) ingestRepo(ctx context.Context, e *models.Event) error { 142 142 + var err error 143 143 + did := e.Did 144 144 + 145 145 + l := s.l.With("component", "ingester", "record", tangled.RepoNSID) 146 146 + 147 147 + l.Info("ingesting repo record", "did", did) 148 148 + 149 149 + switch e.Commit.Operation { 150 150 + case models.CommitOperationCreate, models.CommitOperationUpdate: 151 151 + raw := e.Commit.Record 152 152 + record := tangled.Repo{} 153 153 + err = json.Unmarshal(raw, &record) 154 154 + if err != nil { 155 155 + l.Error("invalid record", "error", err) 156 156 + return err 157 157 + } 158 158 + 159 159 + domain := s.cfg.Server.Hostname 160 160 + 161 161 + // no spindle configured for this repo 162 162 + if record.Spindle == nil { 163 163 + l.Info("no spindle configured", "name", record.Name) 164 164 + return nil 165 165 + } 166 166 + 167 167 + // this repo did not want this spindle 168 168 + if *record.Spindle != domain { 169 169 + l.Info("different spindle configured", "name", record.Name, "spindle", *record.Spindle, "domain", domain) 170 170 + return nil 171 171 + } 172 172 + 173 173 + // add this repo to the watch list 174 174 + if err := s.db.AddRepo(record.Knot, did, record.Name); err != nil { 175 175 + l.Error("failed to add repo", "error", err) 176 176 + return fmt.Errorf("failed to add repo: %w", err) 177 177 + } 178 178 + 179 179 + didSlashRepo, err := securejoin.SecureJoin(did, record.Name) 180 180 + if err != nil { 181 181 + return err 182 182 + } 183 183 + 184 184 + // add repo to rbac 185 185 + if err := s.e.AddRepo(did, rbac.ThisServer, didSlashRepo); err != nil { 186 186 + l.Error("failed to add repo to enforcer", "error", err) 187 187 + return fmt.Errorf("failed to add repo: %w", err) 188 188 + } 189 189 + 190 190 + // add collaborators to rbac 191 191 + owner, err := s.res.ResolveIdent(ctx, did) 192 192 + if err != nil || owner.Handle.IsInvalidHandle() { 193 193 + return err 194 194 + } 195 195 + if err := s.fetchAndAddCollaborators(ctx, owner, didSlashRepo); err != nil { 196 196 + return err 197 197 + } 198 198 + 199 199 + // add this knot to the event consumer 200 200 + src := eventconsumer.NewKnotSource(record.Knot) 201 201 + s.ks.AddSource(context.Background(), src) 202 202 + 203 203 + return nil 204 204 + 205 205 + } 206 206 + return nil 207 207 + } 208 208 + 209 209 + func (s *Spindle) ingestCollaborator(ctx context.Context, e *models.Event) error { 210 210 + var err error 211 211 + 212 212 + l := s.l.With("component", "ingester", "record", tangled.RepoCollaboratorNSID, "did", e.Did) 213 213 + 214 214 + l.Info("ingesting collaborator record") 215 215 + 216 216 + switch e.Commit.Operation { 217 217 + case models.CommitOperationCreate, models.CommitOperationUpdate: 218 218 + raw := e.Commit.Record 219 219 + record := tangled.RepoCollaborator{} 220 220 + err = json.Unmarshal(raw, &record) 221 221 + if err != nil { 222 222 + l.Error("invalid record", "error", err) 223 223 + return err 224 224 + } 225 225 + 226 226 + subjectId, err := s.res.ResolveIdent(ctx, record.Subject) 227 227 + if err != nil || subjectId.Handle.IsInvalidHandle() { 228 228 + return err 229 229 + } 230 230 + 231 231 + repoAt, err := syntax.ParseATURI(record.Repo) 232 232 + if err != nil { 233 233 + l.Info("rejecting record, invalid repoAt", "repoAt", record.Repo) 234 234 + return nil 235 235 + } 236 236 + 237 237 + // TODO: get rid of this entirely 238 238 + // resolve this aturi to extract the repo record 239 239 + owner, err := s.res.ResolveIdent(ctx, repoAt.Authority().String()) 240 240 + if err != nil || owner.Handle.IsInvalidHandle() { 241 241 + return fmt.Errorf("failed to resolve handle: %w", err) 242 242 + } 243 243 + 244 244 + xrpcc := xrpc.Client{ 245 245 + Host: owner.PDSEndpoint(), 246 246 + } 247 247 + 248 248 + resp, err := comatproto.RepoGetRecord(ctx, &xrpcc, "", tangled.RepoNSID, repoAt.Authority().String(), repoAt.RecordKey().String()) 249 249 + if err != nil { 250 250 + return err 251 251 + } 252 252 + 253 253 + repo := resp.Value.Val.(*tangled.Repo) 254 254 + didSlashRepo, _ := securejoin.SecureJoin(owner.DID.String(), repo.Name) 255 255 + 256 256 + // check perms for this user 257 257 + if ok, err := s.e.IsCollaboratorInviteAllowed(owner.DID.String(), rbac.ThisServer, didSlashRepo); !ok || err != nil { 258 258 + return fmt.Errorf("insufficient permissions: %w", err) 259 259 + } 260 260 + 261 261 + // add collaborator to rbac 262 262 + if err := s.e.AddCollaborator(record.Subject, rbac.ThisServer, didSlashRepo); err != nil { 263 263 + l.Error("failed to add repo to enforcer", "error", err) 264 264 + return fmt.Errorf("failed to add repo: %w", err) 265 265 + } 266 266 + 267 267 + return nil 268 268 + } 269 269 + return nil 270 270 + } 271 271 + 272 272 + func (s *Spindle) fetchAndAddCollaborators(ctx context.Context, owner *identity.Identity, didSlashRepo string) error { 273 273 + l := s.l.With("component", "ingester", "handler", "fetchAndAddCollaborators") 274 274 + 275 275 + l.Info("fetching and adding existing collaborators") 276 276 + 277 277 + xrpcc := xrpc.Client{ 278 278 + Host: owner.PDSEndpoint(), 279 279 + } 280 280 + 281 281 + resp, err := comatproto.RepoListRecords(ctx, &xrpcc, tangled.RepoCollaboratorNSID, "", 50, owner.DID.String(), false) 282 282 + if err != nil { 283 283 + return err 284 284 + } 285 285 + 286 286 + var errs error 287 287 + for _, r := range resp.Records { 288 288 + if r == nil { 289 289 + continue 290 290 + } 291 291 + record := r.Value.Val.(*tangled.RepoCollaborator) 292 292 + 293 293 + if err := s.e.AddCollaborator(record.Subject, rbac.ThisServer, didSlashRepo); err != nil { 294 294 + l.Error("failed to add repo to enforcer", "error", err) 295 295 + errors.Join(errs, fmt.Errorf("failed to add repo: %w", err)) 296 296 + } 297 297 + } 298 298 + 299 299 + return errs 300 300 + }

+1 -1

spindle/models/pipeline_env.go

··· 20 20 // Standard CI environment variable 21 21 env["CI"] = "true" 22 22 23 23 - env["TANGLED_PIPELINE_ID"] = pipelineId.AtUri().String() 23 23 + env["TANGLED_PIPELINE_ID"] = pipelineId.Rkey 24 24 25 25 // Repo info 26 26 if tr.Repo != nil {

+70 -133

spindle/server.go

··· 1 1 package spindle 2 2 3 3 import ( 4 4 - "bytes" 5 4 "context" 6 5 _ "embed" 7 6 "encoding/json" ··· 9 8 "log/slog" 10 9 "maps" 11 10 "net/http" 12 12 - "os" 13 13 - "os/exec" 14 14 - "path" 15 15 - "strings" 16 11 17 17 - "github.com/bluesky-social/indigo/atproto/syntax" 18 12 "github.com/go-chi/chi/v5" 19 19 - "github.com/hashicorp/go-version" 20 13 "tangled.org/core/api/tangled" 21 14 "tangled.org/core/eventconsumer" 22 15 "tangled.org/core/eventconsumer/cursor" 23 16 "tangled.org/core/idresolver" 17 17 + "tangled.org/core/jetstream" 24 18 "tangled.org/core/log" 25 19 "tangled.org/core/notifier" 26 26 - "tangled.org/core/rbac2" 20 20 + "tangled.org/core/rbac" 27 21 "tangled.org/core/spindle/config" 28 22 "tangled.org/core/spindle/db" 29 23 "tangled.org/core/spindle/engine" ··· 32 26 "tangled.org/core/spindle/queue" 33 27 "tangled.org/core/spindle/secrets" 34 28 "tangled.org/core/spindle/xrpc" 35 35 - "tangled.org/core/tap" 36 29 "tangled.org/core/xrpc/serviceauth" 37 30 ) 38 31 39 32 //go:embed motd 40 33 var motd []byte 41 34 35 35 + const ( 36 36 + rbacDomain = "thisserver" 37 37 + ) 38 38 + 42 39 type Spindle struct { 43 43 - tap *tap.Client 40 40 + jc *jetstream.JetstreamClient 44 41 db *db.DB 45 45 - e *rbac2.Enforcer 42 42 + e *rbac.Enforcer 46 43 l *slog.Logger 47 44 n *notifier.Notifier 48 45 engs map[string]models.Engine ··· 57 54 func New(ctx context.Context, cfg *config.Config, engines map[string]models.Engine) (*Spindle, error) { 58 55 logger := log.FromContext(ctx) 59 56 60 60 - if err := ensureGitVersion(); err != nil { 61 61 - return nil, fmt.Errorf("ensuring git version: %w", err) 62 62 - } 63 63 - 64 64 - d, err := db.Make(ctx, cfg.Server.DBPath) 57 57 + d, err := db.Make(cfg.Server.DBPath) 65 58 if err != nil { 66 59 return nil, fmt.Errorf("failed to setup db: %w", err) 67 60 } 68 61 69 69 - e, err := rbac2.NewEnforcer(cfg.Server.DBPath) 62 62 + e, err := rbac.NewEnforcer(cfg.Server.DBPath) 70 63 if err != nil { 71 64 return nil, fmt.Errorf("failed to setup rbac enforcer: %w", err) 72 65 } 66 66 + e.E.EnableAutoSave(true) 73 67 74 68 n := notifier.New() 75 69 ··· 101 95 jq := queue.NewQueue(cfg.Server.QueueSize, cfg.Server.MaxJobCount) 102 96 logger.Info("initialized queue", "queueSize", cfg.Server.QueueSize, "numWorkers", cfg.Server.MaxJobCount) 103 97 104 104 - tap := tap.NewClient(cfg.Server.TapUrl, "") 98 98 + collections := []string{ 99 99 + tangled.SpindleMemberNSID, 100 100 + tangled.RepoNSID, 101 101 + tangled.RepoCollaboratorNSID, 102 102 + } 103 103 + jc, err := jetstream.NewJetstreamClient(cfg.Server.JetstreamEndpoint, "spindle", collections, nil, log.SubLogger(logger, "jetstream"), d, true, true) 104 104 + if err != nil { 105 105 + return nil, fmt.Errorf("failed to setup jetstream client: %w", err) 106 106 + } 107 107 + jc.AddDid(cfg.Server.Owner) 108 108 + 109 109 + // Check if the spindle knows about any Dids; 110 110 + dids, err := d.GetAllDids() 111 111 + if err != nil { 112 112 + return nil, fmt.Errorf("failed to get all dids: %w", err) 113 113 + } 114 114 + for _, d := range dids { 115 115 + jc.AddDid(d) 116 116 + } 105 117 106 118 resolver := idresolver.DefaultResolver(cfg.Server.PlcUrl) 107 119 108 120 spindle := &Spindle{ 109 109 - tap: &tap, 121 121 + jc: jc, 110 122 e: e, 111 123 db: d, 112 124 l: logger, ··· 118 130 vault: vault, 119 131 } 120 132 121 121 - err = e.SetSpindleOwner(spindle.cfg.Server.Owner, spindle.cfg.Server.Did()) 133 133 + err = e.AddSpindle(rbacDomain) 134 134 + if err != nil { 135 135 + return nil, fmt.Errorf("failed to set rbac domain: %w", err) 136 136 + } 137 137 + err = spindle.configureOwner() 122 138 if err != nil { 123 139 return nil, err 124 140 } ··· 127 143 cursorStore, err := cursor.NewSQLiteStore(cfg.Server.DBPath) 128 144 if err != nil { 129 145 return nil, fmt.Errorf("failed to setup sqlite3 cursor store: %w", err) 146 146 + } 147 147 + 148 148 + err = jc.StartJetstream(ctx, spindle.ingest()) 149 149 + if err != nil { 150 150 + return nil, fmt.Errorf("failed to start jetstream consumer: %w", err) 130 151 } 131 152 132 153 // for each incoming sh.tangled.pipeline, we execute ··· 176 197 } 177 198 178 199 // Enforcer returns the RBAC enforcer instance. 179 179 - func (s *Spindle) Enforcer() *rbac2.Enforcer { 200 200 + func (s *Spindle) Enforcer() *rbac.Enforcer { 180 201 return s.e 181 202 } 182 203 ··· 196 217 s.ks.Start(ctx) 197 218 }() 198 219 199 199 - go func() { 200 200 - s.l.Info("starting tap stream consumer") 201 201 - s.tap.Connect(ctx, &tap.SimpleIndexer{ 202 202 - EventHandler: s.processEvent, 203 203 - }) 204 204 - }() 205 205 - 206 220 s.l.Info("starting spindle server", "address", s.cfg.Server.ListenAddr) 207 221 return http.ListenAndServe(s.cfg.Server.ListenAddr, s.Router()) 208 222 } ··· 254 268 Config: s.cfg, 255 269 Resolver: s.res, 256 270 Vault: s.vault, 257 257 - Notifier: s.Notifier(), 258 271 ServiceAuth: serviceAuth, 259 272 } 260 273 ··· 262 275 } 263 276 264 277 func (s *Spindle) processPipeline(ctx context.Context, src eventconsumer.Source, msg eventconsumer.Message) error { 265 265 - l := log.FromContext(ctx).With("handler", "processKnotStream") 266 266 - l = l.With("src", src.Key(), "msg.Nsid", msg.Nsid, "msg.Rkey", msg.Rkey) 267 278 if msg.Nsid == tangled.PipelineNSID { 268 268 - return nil 269 279 tpl := tangled.Pipeline{} 270 280 err := json.Unmarshal(msg.EventJson, &tpl) 271 281 if err != nil { ··· 286 296 } 287 297 288 298 // filter by repos 289 289 - _, err = s.db.GetRepoWithName( 290 290 - syntax.DID(tpl.TriggerMetadata.Repo.Did), 299 299 + _, err = s.db.GetRepo( 300 300 + tpl.TriggerMetadata.Repo.Knot, 301 301 + tpl.TriggerMetadata.Repo.Did, 291 302 tpl.TriggerMetadata.Repo.Repo, 292 303 ) 293 304 if err != nil { 294 294 - return fmt.Errorf("failed to get repo: %w", err) 305 305 + return err 295 306 } 296 307 297 308 pipelineId := models.PipelineId{ ··· 312 323 Name: w.Name, 313 324 }, fmt.Sprintf("unknown engine %#v", w.Engine), -1, s.n) 314 325 if err != nil { 315 315 - return fmt.Errorf("db.StatusFailed: %w", err) 326 326 + return err 316 327 } 317 328 318 329 continue ··· 326 337 327 338 ewf, err := s.engs[w.Engine].InitWorkflow(*w, tpl) 328 339 if err != nil { 329 329 - return fmt.Errorf("init workflow: %w", err) 340 340 + return err 330 341 } 331 342 332 343 // inject TANGLED_* env vars after InitWorkflow ··· 343 354 Name: w.Name, 344 355 }, s.n) 345 356 if err != nil { 346 346 - return fmt.Errorf("db.StatusPending: %w", err) 357 357 + return err 347 358 } 348 359 } 349 360 } ··· 366 377 } else { 367 378 s.l.Error("failed to enqueue pipeline: queue is full") 368 379 } 369 369 - } else if msg.Nsid == tangled.GitRefUpdateNSID { 370 370 - event := tangled.GitRefUpdate{} 371 371 - if err := json.Unmarshal(msg.EventJson, &event); err != nil { 372 372 - l.Error("error unmarshalling", "err", err) 373 373 - return err 374 374 - } 375 375 - l = l.With("repoDid", event.RepoDid, "repoName", event.RepoName) 376 376 - 377 377 - // use event.RepoAt 378 378 - // sync git repos in {data}/repos/{did}/sh.tangled.repo/{rkey} 379 379 - // if it's nil, don't run pipeline. knot needs upgrade 380 380 - // we will leave sh.tangled.pipeline.trigger for backward compatibility 381 381 - 382 382 - // NOTE: we are blindly trusting the knot that it will return only repos it own 383 383 - repoCloneUri := s.newRepoCloneUrl(src.Key(), event.RepoDid, event.RepoName) 384 384 - repoPath := s.newRepoPath(event.RepoDid, event.RepoName) 385 385 - err := sparseSyncGitRepo(ctx, repoCloneUri, repoPath, event.NewSha) 386 386 - if err != nil { 387 387 - l.Error("failed to sync git repo", "err", err) 388 388 - return fmt.Errorf("sync git repo: %w", err) 389 389 - } 390 390 - l.Info("synced git repo") 391 391 - 392 392 - // TODO: plan the pipeline 393 380 } 394 381 395 382 return nil 396 383 } 397 384 398 398 - func (s *Spindle) newRepoPath(did, name string) string { 399 399 - return path.Join(s.cfg.Server.RepoDir(), did, name) 400 400 - } 401 401 - 402 402 - func (s *Spindle) newRepoCloneUrl(knot, did, name string) string { 403 403 - scheme := "https://" 404 404 - if s.cfg.Server.Dev { 405 405 - scheme = "http://" 406 406 - } 407 407 - return fmt.Sprintf("%s%s/%s/%s", scheme, knot, did, name) 408 408 - } 385 385 + func (s *Spindle) configureOwner() error { 386 386 + cfgOwner := s.cfg.Server.Owner 409 387 410 410 - const RequiredVersion = "2.49.0" 411 411 - 412 412 - func ensureGitVersion() error { 413 413 - v, err := gitVersion() 388 388 + existing, err := s.e.GetSpindleUsersByRole("server:owner", rbacDomain) 414 389 if err != nil { 415 415 - return fmt.Errorf("fetching git version: %w", err) 390 390 + return err 416 391 } 417 417 - if v.LessThan(version.Must(version.NewVersion(RequiredVersion))) { 418 418 - return fmt.Errorf("installed git version %q is not supported, Spindle requires git version >= %q", v, RequiredVersion) 419 419 - } 420 420 - return nil 421 421 - } 422 392 423 423 - // TODO: move to "git" module shared between knot, appview & spindle 424 424 - func gitVersion() (*version.Version, error) { 425 425 - var buf bytes.Buffer 426 426 - cmd := exec.Command("git", "version") 427 427 - cmd.Stdout = &buf 428 428 - cmd.Stderr = os.Stderr 429 429 - err := cmd.Run() 430 430 - if err != nil { 431 431 - return nil, err 432 432 - } 433 433 - fields := strings.Fields(buf.String()) 434 434 - if len(fields) < 3 { 435 435 - return nil, fmt.Errorf("invalid git version: %s", buf) 436 436 - } 393 393 + switch len(existing) { 394 394 + case 0: 395 395 + // no owner configured, continue 396 396 + case 1: 397 397 + // find existing owner 398 398 + existingOwner := existing[0] 437 399 438 438 - // version string is like: "git version 2.29.3" or "git version 2.29.3.windows.1" 439 439 - versionString := fields[2] 440 440 - if pos := strings.Index(versionString, "windows"); pos >= 1 { 441 441 - versionString = versionString[:pos-1] 442 442 - } 443 443 - return version.NewVersion(versionString) 444 444 - } 445 445 - 446 446 - func sparseSyncGitRepo(ctx context.Context, cloneUri, path, rev string) error { 447 447 - exist, err := isDir(path) 448 448 - if err != nil { 449 449 - return err 450 450 - } 451 451 - if !exist { 452 452 - if err := exec.Command("git", "clone", "--no-checkout", "--depth=1", "--filter=tree:0", "--revision="+rev, cloneUri, path).Run(); err != nil { 453 453 - return fmt.Errorf("git clone: %w", err) 454 454 - } 455 455 - if err := exec.Command("git", "-C", path, "sparse-checkout", "set", "--no-cone", `'/.tangled/workflows'`).Run(); err != nil { 456 456 - return fmt.Errorf("git sparse-checkout set: %w", err) 457 457 - } 458 458 - if err := exec.Command("git", "-C", path, "checkout", rev).Run(); err != nil { 459 459 - return fmt.Errorf("git checkout: %w", err) 400 400 + // no ownership change, this is okay 401 401 + if existingOwner == s.cfg.Server.Owner { 402 402 + break 460 403 } 461 461 - } else { 462 462 - if err := exec.Command("git", "-C", path, "pull", "origin", rev).Run(); err != nil { 463 463 - return fmt.Errorf("git pull: %w", err) 404 404 + 405 405 + // remove existing owner 406 406 + err = s.e.RemoveSpindleOwner(rbacDomain, existingOwner) 407 407 + if err != nil { 408 408 + return nil 464 409 } 410 410 + default: 411 411 + return fmt.Errorf("more than one owner in DB, try deleting %q and starting over", s.cfg.Server.DBPath) 465 412 } 466 466 - return nil 467 467 - } 468 413 469 469 - func isDir(path string) (bool, error) { 470 470 - info, err := os.Stat(path) 471 471 - if err == nil && info.IsDir() { 472 472 - return true, nil 473 473 - } 474 474 - if os.IsNotExist(err) { 475 475 - return false, nil 476 476 - } 477 477 - return false, err 414 414 + return s.e.AddSpindleOwner(rbacDomain, cfgOwner) 478 415 }

-281

spindle/tap.go

··· 1 1 - package spindle 2 2 - 3 3 - import ( 4 4 - "context" 5 5 - "encoding/json" 6 6 - "fmt" 7 7 - "time" 8 8 - 9 9 - "github.com/bluesky-social/indigo/atproto/syntax" 10 10 - "tangled.org/core/api/tangled" 11 11 - "tangled.org/core/eventconsumer" 12 12 - "tangled.org/core/spindle/db" 13 13 - "tangled.org/core/tap" 14 14 - ) 15 15 - 16 16 - func (s *Spindle) processEvent(ctx context.Context, evt tap.Event) error { 17 17 - l := s.l.With("component", "tapIndexer") 18 18 - 19 19 - var err error 20 20 - switch evt.Type { 21 21 - case tap.EvtRecord: 22 22 - switch evt.Record.Collection.String() { 23 23 - case tangled.SpindleMemberNSID: 24 24 - err = s.processMember(ctx, evt) 25 25 - case tangled.RepoNSID: 26 26 - err = s.processRepo(ctx, evt) 27 27 - case tangled.RepoCollaboratorNSID: 28 28 - err = s.processCollaborator(ctx, evt) 29 29 - case tangled.RepoPullNSID: 30 30 - err = s.processPull(ctx, evt) 31 31 - } 32 32 - case tap.EvtIdentity: 33 33 - // no-op 34 34 - } 35 35 - 36 36 - if err != nil { 37 37 - l.Error("failed to process message. will retry later", "event.ID", evt.ID, "err", err) 38 38 - return err 39 39 - } 40 40 - return nil 41 41 - } 42 42 - 43 43 - // NOTE: make sure to return nil if we don't need to retry (e.g. forbidden, unrelated) 44 44 - 45 45 - func (s *Spindle) processMember(ctx context.Context, evt tap.Event) error { 46 46 - l := s.l.With("component", "tapIndexer", "record", evt.Record.AtUri()) 47 47 - 48 48 - l.Info("processing spindle.member record") 49 49 - 50 50 - // check perms for this user 51 51 - if ok, err := s.e.IsSpindleMemberInviteAllowed(evt.Record.Did, s.cfg.Server.Did()); !ok || err != nil { 52 52 - l.Warn("forbidden request", "did", evt.Record.Did, "error", err) 53 53 - return nil 54 54 - } 55 55 - 56 56 - switch evt.Record.Action { 57 57 - case tap.RecordCreateAction, tap.RecordUpdateAction: 58 58 - record := tangled.SpindleMember{} 59 59 - if err := json.Unmarshal(evt.Record.Record, &record); err != nil { 60 60 - return fmt.Errorf("parsing record: %w", err) 61 61 - } 62 62 - 63 63 - domain := s.cfg.Server.Hostname 64 64 - if record.Instance != domain { 65 65 - l.Info("domain mismatch", "domain", record.Instance, "expected", domain) 66 66 - return nil 67 67 - } 68 68 - 69 69 - created, err := time.Parse(record.CreatedAt, time.RFC3339) 70 70 - if err != nil { 71 71 - created = time.Now() 72 72 - } 73 73 - if err := db.AddSpindleMember(s.db, db.SpindleMember{ 74 74 - Did: evt.Record.Did, 75 75 - Rkey: evt.Record.Rkey.String(), 76 76 - Instance: record.Instance, 77 77 - Subject: syntax.DID(record.Subject), 78 78 - Created: created, 79 79 - }); err != nil { 80 80 - l.Error("failed to add member", "error", err) 81 81 - return fmt.Errorf("adding member to db: %w", err) 82 82 - } 83 83 - if err := s.e.AddSpindleMember(syntax.DID(record.Subject), s.cfg.Server.Did()); err != nil { 84 84 - return fmt.Errorf("adding member to rbac: %w", err) 85 85 - } 86 86 - if err := s.tap.AddRepos(ctx, []syntax.DID{syntax.DID(record.Subject)}); err != nil { 87 87 - return fmt.Errorf("adding did to tap", err) 88 88 - } 89 89 - 90 90 - l.Info("added member", "member", record.Subject) 91 91 - return nil 92 92 - 93 93 - case tap.RecordDeleteAction: 94 94 - var ( 95 95 - did = evt.Record.Did.String() 96 96 - rkey = evt.Record.Rkey.String() 97 97 - ) 98 98 - member, err := db.GetSpindleMember(s.db, did, rkey) 99 99 - if err != nil { 100 100 - return fmt.Errorf("finding member: %w", err) 101 101 - } 102 102 - 103 103 - if err := db.RemoveSpindleMember(s.db, did, rkey); err != nil { 104 104 - return fmt.Errorf("removing member from db: %w", err) 105 105 - } 106 106 - if err := s.e.RemoveSpindleMember(member.Subject, s.cfg.Server.Did()); err != nil { 107 107 - return fmt.Errorf("removing member from rbac: %w", err) 108 108 - } 109 109 - if err := s.tapSafeRemoveDid(ctx, member.Subject); err != nil { 110 110 - return fmt.Errorf("removing did from tap: %w", err) 111 111 - } 112 112 - 113 113 - l.Info("removed member", "member", member.Subject) 114 114 - return nil 115 115 - } 116 116 - return nil 117 117 - } 118 118 - 119 119 - func (s *Spindle) processCollaborator(ctx context.Context, evt tap.Event) error { 120 120 - l := s.l.With("component", "tapIndexer", "record", evt.Record.AtUri()) 121 121 - 122 122 - l.Info("processing collaborator record") 123 123 - switch evt.Record.Action { 124 124 - case tap.RecordCreateAction, tap.RecordUpdateAction: 125 125 - record := tangled.RepoCollaborator{} 126 126 - if err := json.Unmarshal(evt.Record.Record, &record); err != nil { 127 127 - l.Error("invalid record", "err", err) 128 128 - return fmt.Errorf("parsing record: %w", err) 129 129 - } 130 130 - 131 131 - // check perms for this user 132 132 - if ok, err := s.e.IsRepoCollaboratorInviteAllowed(evt.Record.Did, syntax.ATURI(record.Repo)); !ok || err != nil { 133 133 - l.Warn("forbidden request", "did", evt.Record.Did, "err", err) 134 134 - return nil 135 135 - } 136 136 - 137 137 - if err := s.db.PutRepoCollaborator(&db.RepoCollaborator{ 138 138 - Did: evt.Record.Did, 139 139 - Rkey: evt.Record.Rkey, 140 140 - Repo: syntax.ATURI(record.Repo), 141 141 - Subject: syntax.DID(record.Subject), 142 142 - }); err != nil { 143 143 - return fmt.Errorf("adding collaborator to db: %w", err) 144 144 - } 145 145 - if err := s.e.AddRepoCollaborator(syntax.DID(record.Subject), syntax.ATURI(record.Repo)); err != nil { 146 146 - return fmt.Errorf("adding collaborator to rbac: %w", err) 147 147 - } 148 148 - if err := s.tap.AddRepos(ctx, []syntax.DID{syntax.DID(record.Subject)}); err != nil { 149 149 - return fmt.Errorf("adding did to tap: %w", err) 150 150 - } 151 151 - 152 152 - l.Info("add repo collaborator", "subejct", record.Subject, "repo", record.Repo) 153 153 - return nil 154 154 - 155 155 - case tap.RecordDeleteAction: 156 156 - // get existing collaborator 157 157 - collaborator, err := s.db.GetRepoCollaborator(evt.Record.Did, evt.Record.Rkey) 158 158 - if err != nil { 159 159 - return fmt.Errorf("failed to get existing collaborator info: %w", err) 160 160 - } 161 161 - 162 162 - // check perms for this user 163 163 - if ok, err := s.e.IsRepoCollaboratorInviteAllowed(evt.Record.Did, collaborator.Repo); !ok || err != nil { 164 164 - l.Warn("forbidden request", "did", evt.Record.Did, "err", err) 165 165 - return nil 166 166 - } 167 167 - 168 168 - if err := s.db.RemoveRepoCollaborator(collaborator.Subject, collaborator.Rkey); err != nil { 169 169 - return fmt.Errorf("removing collaborator from db: %w", err) 170 170 - } 171 171 - if err := s.e.RemoveRepoCollaborator(collaborator.Subject, collaborator.Repo); err != nil { 172 172 - return fmt.Errorf("removing collaborator from rbac: %w", err) 173 173 - } 174 174 - if err := s.tapSafeRemoveDid(ctx, collaborator.Subject); err != nil { 175 175 - return fmt.Errorf("removing did from tap: %w", err) 176 176 - } 177 177 - 178 178 - l.Info("removed repo collaborator", "subejct", collaborator.Subject, "repo", collaborator.Repo) 179 179 - return nil 180 180 - } 181 181 - return nil 182 182 - } 183 183 - 184 184 - func (s *Spindle) processRepo(ctx context.Context, evt tap.Event) error { 185 185 - l := s.l.With("component", "tapIndexer", "record", evt.Record.AtUri()) 186 186 - 187 187 - l.Info("processing repo record") 188 188 - 189 189 - // check perms for this user 190 190 - if ok, err := s.e.IsSpindleMember(evt.Record.Did, s.cfg.Server.Did()); !ok || err != nil { 191 191 - l.Warn("forbidden request", "did", evt.Record.Did, "err", err) 192 192 - return nil 193 193 - } 194 194 - 195 195 - switch evt.Record.Action { 196 196 - case tap.RecordCreateAction, tap.RecordUpdateAction: 197 197 - record := tangled.Repo{} 198 198 - if err := json.Unmarshal(evt.Record.Record, &record); err != nil { 199 199 - return fmt.Errorf("parsing record: %w", err) 200 200 - } 201 201 - 202 202 - domain := s.cfg.Server.Hostname 203 203 - if record.Spindle == nil || *record.Spindle != domain { 204 204 - if record.Spindle == nil { 205 205 - l.Info("spindle isn't configured", "name", record.Name) 206 206 - } else { 207 207 - l.Info("different spindle configured", "name", record.Name, "spindle", *record.Spindle, "domain", domain) 208 208 - } 209 209 - if err := s.db.DeleteRepo(evt.Record.Did, evt.Record.Rkey); err != nil { 210 210 - return fmt.Errorf("deleting repo from db: %w", err) 211 211 - } 212 212 - return nil 213 213 - } 214 214 - 215 215 - if err := s.db.PutRepo(&db.Repo{ 216 216 - Did: evt.Record.Did, 217 217 - Rkey: evt.Record.Rkey, 218 218 - Name: record.Name, 219 219 - Knot: record.Knot, 220 220 - }); err != nil { 221 221 - return fmt.Errorf("adding repo to db: %w", err) 222 222 - } 223 223 - 224 224 - if err := s.e.AddRepo(evt.Record.AtUri()); err != nil { 225 225 - return fmt.Errorf("adding repo to rbac") 226 226 - } 227 227 - 228 228 - // add this knot to the event consumer 229 229 - src := eventconsumer.NewKnotSource(record.Knot) 230 230 - s.ks.AddSource(context.Background(), src) 231 231 - 232 232 - l.Info("added repo", "repo", evt.Record.AtUri()) 233 233 - return nil 234 234 - 235 235 - case tap.RecordDeleteAction: 236 236 - // check perms for this user 237 237 - if ok, err := s.e.IsRepoOwner(evt.Record.Did, evt.Record.AtUri()); !ok || err != nil { 238 238 - l.Warn("forbidden request", "did", evt.Record.Did, "err", err) 239 239 - return nil 240 240 - } 241 241 - 242 242 - if err := s.db.DeleteRepo(evt.Record.Did, evt.Record.Rkey); err != nil { 243 243 - return fmt.Errorf("deleting repo from db: %w", err) 244 244 - } 245 245 - 246 246 - if err := s.e.DeleteRepo(evt.Record.AtUri()); err != nil { 247 247 - return fmt.Errorf("deleting repo from rbac: %w", err) 248 248 - } 249 249 - 250 250 - l.Info("deleted repo", "repo", evt.Record.AtUri()) 251 251 - return nil 252 252 - } 253 253 - return nil 254 254 - } 255 255 - 256 256 - func (s *Spindle) processPull(ctx context.Context, evt tap.Event) error { 257 257 - l := s.l.With("component", "tapIndexer", "record", evt.Record.AtUri()) 258 258 - 259 259 - l.Info("processing pull record") 260 260 - 261 261 - switch evt.Record.Action { 262 262 - case tap.RecordCreateAction, tap.RecordUpdateAction: 263 263 - // TODO 264 264 - case tap.RecordDeleteAction: 265 265 - // TODO 266 266 - } 267 267 - return nil 268 268 - } 269 269 - 270 270 - func (s *Spindle) tapSafeRemoveDid(ctx context.Context, did syntax.DID) error { 271 271 - known, err := s.db.IsKnownDid(syntax.DID(did)) 272 272 - if err != nil { 273 273 - return fmt.Errorf("ensuring did known state: %w", err) 274 274 - } 275 275 - if !known { 276 276 - if err := s.tap.RemoveRepos(ctx, []syntax.DID{did}); err != nil { 277 277 - return fmt.Errorf("removing did from tap: %w", err) 278 278 - } 279 279 - } 280 280 - return nil 281 281 - }

+2 -1

spindle/xrpc/add_secret.go

··· 11 11 "github.com/bluesky-social/indigo/xrpc" 12 12 securejoin "github.com/cyphar/filepath-securejoin" 13 13 "tangled.org/core/api/tangled" 14 14 + "tangled.org/core/rbac" 14 15 "tangled.org/core/spindle/secrets" 15 16 xrpcerr "tangled.org/core/xrpc/errors" 16 17 ) ··· 67 68 return 68 69 } 69 70 70 70 - if ok, err := x.Enforcer.IsRepoSettingsWriteAllowed(actorDid, repoAt); !ok || err != nil { 71 71 + if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { 71 72 l.Error("insufficent permissions", "did", actorDid.String()) 72 73 writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized) 73 74 return

+2 -1

spindle/xrpc/list_secrets.go

··· 11 11 "github.com/bluesky-social/indigo/xrpc" 12 12 securejoin "github.com/cyphar/filepath-securejoin" 13 13 "tangled.org/core/api/tangled" 14 14 + "tangled.org/core/rbac" 14 15 "tangled.org/core/spindle/secrets" 15 16 xrpcerr "tangled.org/core/xrpc/errors" 16 17 ) ··· 62 63 return 63 64 } 64 65 65 65 - if ok, err := x.Enforcer.IsRepoSettingsWriteAllowed(actorDid, repoAt); !ok || err != nil { 66 66 + if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { 66 67 l.Error("insufficent permissions", "did", actorDid.String()) 67 68 writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized) 68 69 return

+1 -1

spindle/xrpc/owner.go

··· 9 9 ) 10 10 11 11 func (x *Xrpc) Owner(w http.ResponseWriter, r *http.Request) { 12 12 - owner := x.Config.Server.Owner.String() 12 12 + owner := x.Config.Server.Owner 13 13 if owner == "" { 14 14 writeError(w, xrpcerr.OwnerNotFoundError, http.StatusInternalServerError) 15 15 return

-72

spindle/xrpc/pipeline_cancelPipeline.go

··· 1 1 - package xrpc 2 2 - 3 3 - import ( 4 4 - "encoding/json" 5 5 - "fmt" 6 6 - "net/http" 7 7 - "strings" 8 8 - 9 9 - "github.com/bluesky-social/indigo/atproto/syntax" 10 10 - "tangled.org/core/api/tangled" 11 11 - "tangled.org/core/spindle/models" 12 12 - xrpcerr "tangled.org/core/xrpc/errors" 13 13 - ) 14 14 - 15 15 - func (x *Xrpc) CancelPipeline(w http.ResponseWriter, r *http.Request) { 16 16 - l := x.Logger 17 17 - fail := func(e xrpcerr.XrpcError) { 18 18 - l.Error("failed", "kind", e.Tag, "error", e.Message) 19 19 - writeError(w, e, http.StatusBadRequest) 20 20 - } 21 21 - l.Debug("cancel pipeline") 22 22 - 23 23 - actorDid, ok := r.Context().Value(ActorDid).(syntax.DID) 24 24 - if !ok { 25 25 - fail(xrpcerr.MissingActorDidError) 26 26 - return 27 27 - } 28 28 - 29 29 - var input tangled.PipelineCancelPipeline_Input 30 30 - if err := json.NewDecoder(r.Body).Decode(&input); err != nil { 31 31 - fail(xrpcerr.GenericError(err)) 32 32 - return 33 33 - } 34 34 - 35 35 - aturi := syntax.ATURI(input.Pipeline) 36 36 - wid := models.WorkflowId{ 37 37 - PipelineId: models.PipelineId{ 38 38 - Knot: strings.TrimPrefix(aturi.Authority().String(), "did:web:"), 39 39 - Rkey: aturi.RecordKey().String(), 40 40 - }, 41 41 - Name: input.Workflow, 42 42 - } 43 43 - l.Debug("cancel pipeline", "wid", wid) 44 44 - 45 45 - // unfortunately we have to resolve repo-at here 46 46 - repoAt, err := syntax.ParseATURI(input.Repo) 47 47 - if err != nil { 48 48 - fail(xrpcerr.InvalidRepoError(input.Repo)) 49 49 - return 50 50 - } 51 51 - 52 52 - isRepoOwner, err := x.Enforcer.IsRepoOwner(actorDid, repoAt) 53 53 - if err != nil || !isRepoOwner { 54 54 - fail(xrpcerr.AccessControlError(actorDid.String())) 55 55 - return 56 56 - } 57 57 - for _, engine := range x.Engines { 58 58 - l.Debug("destorying workflow", "wid", wid) 59 59 - err = engine.DestroyWorkflow(r.Context(), wid) 60 60 - if err != nil { 61 61 - fail(xrpcerr.GenericError(fmt.Errorf("dailed to destroy workflow: %w", err))) 62 62 - return 63 63 - } 64 64 - err = x.Db.StatusCancelled(wid, "User canceled the workflow", -1, x.Notifier) 65 65 - if err != nil { 66 66 - fail(xrpcerr.GenericError(fmt.Errorf("dailed to emit status failed: %w", err))) 67 67 - return 68 68 - } 69 69 - } 70 70 - 71 71 - w.WriteHeader(http.StatusOK) 72 72 - }

+2 -1

spindle/xrpc/remove_secret.go

··· 10 10 "github.com/bluesky-social/indigo/xrpc" 11 11 securejoin "github.com/cyphar/filepath-securejoin" 12 12 "tangled.org/core/api/tangled" 13 13 + "tangled.org/core/rbac" 13 14 "tangled.org/core/spindle/secrets" 14 15 xrpcerr "tangled.org/core/xrpc/errors" 15 16 ) ··· 61 62 return 62 63 } 63 64 64 64 - if ok, err := x.Enforcer.IsRepoSettingsWriteAllowed(actorDid, repoAt); !ok || err != nil { 65 65 + if ok, err := x.Enforcer.IsSettingsAllowed(actorDid.String(), rbac.ThisServer, didPath); !ok || err != nil { 65 66 l.Error("insufficent permissions", "did", actorDid.String()) 66 67 writeError(w, xrpcerr.AccessControlError(actorDid.String()), http.StatusUnauthorized) 67 68 return

+2 -5

spindle/xrpc/xrpc.go

··· 10 10 11 11 "tangled.org/core/api/tangled" 12 12 "tangled.org/core/idresolver" 13 13 - "tangled.org/core/notifier" 14 14 - "tangled.org/core/rbac2" 13 13 + "tangled.org/core/rbac" 15 14 "tangled.org/core/spindle/config" 16 15 "tangled.org/core/spindle/db" 17 16 "tangled.org/core/spindle/models" ··· 25 24 type Xrpc struct { 26 25 Logger *slog.Logger 27 26 Db *db.DB 28 28 - Enforcer *rbac2.Enforcer 27 27 + Enforcer *rbac.Enforcer 29 28 Engines map[string]models.Engine 30 29 Config *config.Config 31 30 Resolver *idresolver.Resolver 32 31 Vault secrets.Manager 33 33 - Notifier *notifier.Notifier 34 32 ServiceAuth *serviceauth.ServiceAuth 35 33 } 36 34 ··· 43 41 r.Post("/"+tangled.RepoAddSecretNSID, x.AddSecret) 44 42 r.Post("/"+tangled.RepoRemoveSecretNSID, x.RemoveSecret) 45 43 r.Get("/"+tangled.RepoListSecretsNSID, x.ListSecrets) 46 46 - r.Post("/"+tangled.PipelineCancelPipelineNSID, x.CancelPipeline) 47 44 }) 48 45 49 46 // service query endpoints (no auth required)

-18

tap/simpleIndexer.go

··· 1 1 - package tap 2 2 - 3 3 - import "context" 4 4 - 5 5 - type SimpleIndexer struct { 6 6 - EventHandler func(ctx context.Context, evt Event) error 7 7 - ErrorHandler func(ctx context.Context, err error) 8 8 - } 9 9 - 10 10 - var _ Handler = (*SimpleIndexer)(nil) 11 11 - 12 12 - func (i *SimpleIndexer) OnEvent(ctx context.Context, evt Event) error { 13 13 - return i.EventHandler(ctx, evt) 14 14 - } 15 15 - 16 16 - func (i *SimpleIndexer) OnError(ctx context.Context, err error) { 17 17 - i.ErrorHandler(ctx, err) 18 18 - }

-169

tap/tap.go

··· 1 1 - /// heavily inspired by <https://github.com/bluesky-social/atproto/blob/c7f5a868837d3e9b3289f988fee2267789327b06/packages/tap/README.md> 2 2 - 3 3 - package tap 4 4 - 5 5 - import ( 6 6 - "bytes" 7 7 - "context" 8 8 - "encoding/json" 9 9 - "fmt" 10 10 - "net/http" 11 11 - "net/url" 12 12 - 13 13 - "github.com/bluesky-social/indigo/atproto/syntax" 14 14 - "github.com/gorilla/websocket" 15 15 - "tangled.org/core/log" 16 16 - ) 17 17 - 18 18 - // type WebsocketOptions struct { 19 19 - // maxReconnectSeconds int 20 20 - // heartbeatIntervalMs int 21 21 - // // onReconnectError 22 22 - // } 23 23 - 24 24 - type Handler interface { 25 25 - OnEvent(ctx context.Context, evt Event) error 26 26 - OnError(ctx context.Context, err error) 27 27 - } 28 28 - 29 29 - type Client struct { 30 30 - Url string 31 31 - AdminPassword string 32 32 - HTTPClient *http.Client 33 33 - } 34 34 - 35 35 - func NewClient(url, adminPassword string) Client { 36 36 - return Client{ 37 37 - Url: url, 38 38 - AdminPassword: adminPassword, 39 39 - HTTPClient: &http.Client{}, 40 40 - } 41 41 - } 42 42 - 43 43 - func (c *Client) AddRepos(ctx context.Context, dids []syntax.DID) error { 44 44 - body, err := json.Marshal(map[string][]syntax.DID{"dids": dids}) 45 45 - if err != nil { 46 46 - return err 47 47 - } 48 48 - req, err := http.NewRequestWithContext(ctx, "POST", c.Url+"/repos/add", bytes.NewReader(body)) 49 49 - if err != nil { 50 50 - return err 51 51 - } 52 52 - req.SetBasicAuth("admin", c.AdminPassword) 53 53 - req.Header.Set("Content-Type", "application/json") 54 54 - 55 55 - resp, err := c.HTTPClient.Do(req) 56 56 - if err != nil { 57 57 - return err 58 58 - } 59 59 - defer resp.Body.Close() 60 60 - if resp.StatusCode != http.StatusOK { 61 61 - return fmt.Errorf("tap: /repos/add failed with status %d", resp.StatusCode) 62 62 - } 63 63 - return nil 64 64 - } 65 65 - 66 66 - func (c *Client) RemoveRepos(ctx context.Context, dids []syntax.DID) error { 67 67 - body, err := json.Marshal(map[string][]syntax.DID{"dids": dids}) 68 68 - if err != nil { 69 69 - return err 70 70 - } 71 71 - req, err := http.NewRequestWithContext(ctx, "POST", c.Url+"/repos/remove", bytes.NewReader(body)) 72 72 - if err != nil { 73 73 - return err 74 74 - } 75 75 - req.SetBasicAuth("admin", c.AdminPassword) 76 76 - req.Header.Set("Content-Type", "application/json") 77 77 - 78 78 - resp, err := c.HTTPClient.Do(req) 79 79 - if err != nil { 80 80 - return err 81 81 - } 82 82 - defer resp.Body.Close() 83 83 - if resp.StatusCode != http.StatusOK { 84 84 - return fmt.Errorf("tap: /repos/remove failed with status %d", resp.StatusCode) 85 85 - } 86 86 - return nil 87 87 - } 88 88 - 89 89 - func (c *Client) Connect(ctx context.Context, handler Handler) error { 90 90 - l := log.FromContext(ctx) 91 91 - 92 92 - u, err := url.Parse(c.Url) 93 93 - if err != nil { 94 94 - return err 95 95 - } 96 96 - if u.Scheme == "https" { 97 97 - u.Scheme = "wss" 98 98 - } else { 99 99 - u.Scheme = "ws" 100 100 - } 101 101 - u.Path = "/channel" 102 102 - 103 103 - // TODO: set auth on dial 104 104 - 105 105 - url := u.String() 106 106 - 107 107 - // var backoff int 108 108 - // for { 109 109 - // select { 110 110 - // case <-ctx.Done(): 111 111 - // return ctx.Err() 112 112 - // default: 113 113 - // } 114 114 - // 115 115 - // header := http.Header{ 116 116 - // "Authorization": []string{""}, 117 117 - // } 118 118 - // conn, res, err := websocket.DefaultDialer.DialContext(ctx, url, header) 119 119 - // if err != nil { 120 120 - // l.Warn("dialing failed", "url", url, "err", err, "backoff", backoff) 121 121 - // time.Sleep(time.Duration(5+backoff) * time.Second) 122 122 - // backoff++ 123 123 - // 124 124 - // continue 125 125 - // } else { 126 126 - // backoff = 0 127 127 - // } 128 128 - // 129 129 - // l.Info("event subscription response", "code", res.StatusCode) 130 130 - // } 131 131 - 132 132 - // TODO: keep websocket connection alive 133 133 - conn, _, err := websocket.DefaultDialer.DialContext(ctx, url, nil) 134 134 - if err != nil { 135 135 - return err 136 136 - } 137 137 - defer conn.Close() 138 138 - 139 139 - for { 140 140 - select { 141 141 - case <-ctx.Done(): 142 142 - return ctx.Err() 143 143 - default: 144 144 - } 145 145 - _, message, err := conn.ReadMessage() 146 146 - if err != nil { 147 147 - return err 148 148 - } 149 149 - 150 150 - var ev Event 151 151 - if err := json.Unmarshal(message, &ev); err != nil { 152 152 - handler.OnError(ctx, fmt.Errorf("failed to parse message: %w", err)) 153 153 - continue 154 154 - } 155 155 - if err := handler.OnEvent(ctx, ev); err != nil { 156 156 - handler.OnError(ctx, fmt.Errorf("failed to process event %d: %w", ev.ID, err)) 157 157 - continue 158 158 - } 159 159 - 160 160 - ack := map[string]any{ 161 161 - "type": "ack", 162 162 - "id": ev.ID, 163 163 - } 164 164 - if err := conn.WriteJSON(ack); err != nil { 165 165 - l.Warn("failed to send ack", "err", err) 166 166 - continue 167 167 - } 168 168 - } 169 169 - }

-62

tap/types.go

··· 1 1 - package tap 2 2 - 3 3 - import ( 4 4 - "encoding/json" 5 5 - "fmt" 6 6 - 7 7 - "github.com/bluesky-social/indigo/atproto/syntax" 8 8 - ) 9 9 - 10 10 - type EventType string 11 11 - 12 12 - const ( 13 13 - EvtRecord EventType = "record" 14 14 - EvtIdentity EventType = "identity" 15 15 - ) 16 16 - 17 17 - type Event struct { 18 18 - ID int64 `json:"id"` 19 19 - Type EventType `json:"type"` 20 20 - Record *RecordEventData `json:"record,omitempty"` 21 21 - Identity *IdentityEventData `json:"identity,omitempty"` 22 22 - } 23 23 - 24 24 - type RecordEventData struct { 25 25 - Live bool `json:"live"` 26 26 - Did syntax.DID `json:"did"` 27 27 - Rev string `json:"rev"` 28 28 - Collection syntax.NSID `json:"collection"` 29 29 - Rkey syntax.RecordKey `json:"rkey"` 30 30 - Action RecordAction `json:"action"` 31 31 - Record json.RawMessage `json:"record,omitempty"` 32 32 - CID *syntax.CID `json:"cid,omitempty"` 33 33 - } 34 34 - 35 35 - func (r *RecordEventData) AtUri() syntax.ATURI { 36 36 - return syntax.ATURI(fmt.Sprintf("at://%s/%s/%s", r.Did, r.Collection, r.Rkey)) 37 37 - } 38 38 - 39 39 - type RecordAction string 40 40 - 41 41 - const ( 42 42 - RecordCreateAction RecordAction = "create" 43 43 - RecordUpdateAction RecordAction = "update" 44 44 - RecordDeleteAction RecordAction = "delete" 45 45 - ) 46 46 - 47 47 - type IdentityEventData struct { 48 48 - DID syntax.DID `json:"did"` 49 49 - Handle string `json:"handle"` 50 50 - IsActive bool `json:"is_active"` 51 51 - Status RepoStatus `json:"status"` 52 52 - } 53 53 - 54 54 - type RepoStatus string 55 55 - 56 56 - const ( 57 57 - RepoStatusActive RepoStatus = "active" 58 58 - RepoStatusTakendown RepoStatus = "takendown" 59 59 - RepoStatusSuspended RepoStatus = "suspended" 60 60 - RepoStatusDeactivated RepoStatus = "deactivated" 61 61 - RepoStatusDeleted RepoStatus = "deleted" 62 62 - )