+1

.gitignore

··· 14 14 .DS_Store 15 15 .env 16 16 *.rdb 17 17 + .envrc

+242 -2

api/tangled/cbor_gen.go

··· 3923 3923 } 3924 3924 3925 3925 cw := cbg.NewCborWriter(w) 3926 3926 - fieldCount := 3 3926 3926 + fieldCount := 4 3927 3927 3928 3928 if t.Environment == nil { 3929 3929 + fieldCount-- 3930 3930 + } 3931 3931 + 3932 3932 + if t.Oidcs_tokens == nil { 3929 3933 fieldCount-- 3930 3934 } 3931 3935 ··· 4007 4011 4008 4012 } 4009 4013 } 4014 4014 + 4015 4015 + // t.Oidcs_tokens ([]*tangled.Pipeline_Step_Oidcs_tokens_Elem) (slice) 4016 4016 + if t.Oidcs_tokens != nil { 4017 4017 + 4018 4018 + if len("oidcs_tokens") > 1000000 { 4019 4019 + return xerrors.Errorf("Value in field \"oidcs_tokens\" was too long") 4020 4020 + } 4021 4021 + 4022 4022 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("oidcs_tokens"))); err != nil { 4023 4023 + return err 4024 4024 + } 4025 4025 + if _, err := cw.WriteString(string("oidcs_tokens")); err != nil { 4026 4026 + return err 4027 4027 + } 4028 4028 + 4029 4029 + if len(t.Oidcs_tokens) > 8192 { 4030 4030 + return xerrors.Errorf("Slice value in field t.Oidcs_tokens was too long") 4031 4031 + } 4032 4032 + 4033 4033 + if err := cw.WriteMajorTypeHeader(cbg.MajArray, uint64(len(t.Oidcs_tokens))); err != nil { 4034 4034 + return err 4035 4035 + } 4036 4036 + for _, v := range t.Oidcs_tokens { 4037 4037 + if err := v.MarshalCBOR(cw); err != nil { 4038 4038 + return err 4039 4039 + } 4040 4040 + 4041 4041 + } 4042 4042 + } 4010 4043 return nil 4011 4044 } 4012 4045 ··· 4035 4068 4036 4069 n := extra 4037 4070 4038 4038 - nameBuf := make([]byte, 11) 4071 4071 + nameBuf := make([]byte, 12) 4039 4072 for i := uint64(0); i < n; i++ { 4040 4073 nameLen, ok, err := cbg.ReadFullStringIntoBuf(cr, nameBuf, 1000000) 4041 4074 if err != nil { ··· 4121 4154 } 4122 4155 4123 4156 } 4157 4157 + } 4158 4158 + // t.Oidcs_tokens ([]*tangled.Pipeline_Step_Oidcs_tokens_Elem) (slice) 4159 4159 + case "oidcs_tokens": 4160 4160 + 4161 4161 + maj, extra, err = cr.ReadHeader() 4162 4162 + if err != nil { 4163 4163 + return err 4164 4164 + } 4165 4165 + 4166 4166 + if extra > 8192 { 4167 4167 + return fmt.Errorf("t.Oidcs_tokens: array too large (%d)", extra) 4168 4168 + } 4169 4169 + 4170 4170 + if maj != cbg.MajArray { 4171 4171 + return fmt.Errorf("expected cbor array") 4172 4172 + } 4173 4173 + 4174 4174 + if extra > 0 { 4175 4175 + t.Oidcs_tokens = make([]*Pipeline_Step_Oidcs_tokens_Elem, extra) 4176 4176 + } 4177 4177 + 4178 4178 + for i := 0; i < int(extra); i++ { 4179 4179 + { 4180 4180 + var maj byte 4181 4181 + var extra uint64 4182 4182 + var err error 4183 4183 + _ = maj 4184 4184 + _ = extra 4185 4185 + _ = err 4186 4186 + 4187 4187 + { 4188 4188 + 4189 4189 + b, err := cr.ReadByte() 4190 4190 + if err != nil { 4191 4191 + return err 4192 4192 + } 4193 4193 + if b != cbg.CborNull[0] { 4194 4194 + if err := cr.UnreadByte(); err != nil { 4195 4195 + return err 4196 4196 + } 4197 4197 + t.Oidcs_tokens[i] = new(Pipeline_Step_Oidcs_tokens_Elem) 4198 4198 + if err := t.Oidcs_tokens[i].UnmarshalCBOR(cr); err != nil { 4199 4199 + return xerrors.Errorf("unmarshaling t.Oidcs_tokens[i] pointer: %w", err) 4200 4200 + } 4201 4201 + } 4202 4202 + 4203 4203 + } 4204 4204 + 4205 4205 + } 4206 4206 + } 4207 4207 + 4208 4208 + default: 4209 4209 + // Field doesn't exist on this type, so ignore it 4210 4210 + if err := cbg.ScanForLinks(r, func(cid.Cid) {}); err != nil { 4211 4211 + return err 4212 4212 + } 4213 4213 + } 4214 4214 + } 4215 4215 + 4216 4216 + return nil 4217 4217 + } 4218 4218 + func (t *Pipeline_Step_Oidcs_tokens_Elem) MarshalCBOR(w io.Writer) error { 4219 4219 + if t == nil { 4220 4220 + _, err := w.Write(cbg.CborNull) 4221 4221 + return err 4222 4222 + } 4223 4223 + 4224 4224 + cw := cbg.NewCborWriter(w) 4225 4225 + fieldCount := 2 4226 4226 + 4227 4227 + if t.Aud == nil { 4228 4228 + fieldCount-- 4229 4229 + } 4230 4230 + 4231 4231 + if _, err := cw.Write(cbg.CborEncodeMajorType(cbg.MajMap, uint64(fieldCount))); err != nil { 4232 4232 + return err 4233 4233 + } 4234 4234 + 4235 4235 + // t.Aud (string) (string) 4236 4236 + if t.Aud != nil { 4237 4237 + 4238 4238 + if len("aud") > 1000000 { 4239 4239 + return xerrors.Errorf("Value in field \"aud\" was too long") 4240 4240 + } 4241 4241 + 4242 4242 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("aud"))); err != nil { 4243 4243 + return err 4244 4244 + } 4245 4245 + if _, err := cw.WriteString(string("aud")); err != nil { 4246 4246 + return err 4247 4247 + } 4248 4248 + 4249 4249 + if t.Aud == nil { 4250 4250 + if _, err := cw.Write(cbg.CborNull); err != nil { 4251 4251 + return err 4252 4252 + } 4253 4253 + } else { 4254 4254 + if len(*t.Aud) > 1000000 { 4255 4255 + return xerrors.Errorf("Value in field t.Aud was too long") 4256 4256 + } 4257 4257 + 4258 4258 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(*t.Aud))); err != nil { 4259 4259 + return err 4260 4260 + } 4261 4261 + if _, err := cw.WriteString(string(*t.Aud)); err != nil { 4262 4262 + return err 4263 4263 + } 4264 4264 + } 4265 4265 + } 4266 4266 + 4267 4267 + // t.Name (string) (string) 4268 4268 + if len("name") > 1000000 { 4269 4269 + return xerrors.Errorf("Value in field \"name\" was too long") 4270 4270 + } 4271 4271 + 4272 4272 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len("name"))); err != nil { 4273 4273 + return err 4274 4274 + } 4275 4275 + if _, err := cw.WriteString(string("name")); err != nil { 4276 4276 + return err 4277 4277 + } 4278 4278 + 4279 4279 + if len(t.Name) > 1000000 { 4280 4280 + return xerrors.Errorf("Value in field t.Name was too long") 4281 4281 + } 4282 4282 + 4283 4283 + if err := cw.WriteMajorTypeHeader(cbg.MajTextString, uint64(len(t.Name))); err != nil { 4284 4284 + return err 4285 4285 + } 4286 4286 + if _, err := cw.WriteString(string(t.Name)); err != nil { 4287 4287 + return err 4288 4288 + } 4289 4289 + return nil 4290 4290 + } 4291 4291 + 4292 4292 + func (t *Pipeline_Step_Oidcs_tokens_Elem) UnmarshalCBOR(r io.Reader) (err error) { 4293 4293 + *t = Pipeline_Step_Oidcs_tokens_Elem{} 4294 4294 + 4295 4295 + cr := cbg.NewCborReader(r) 4296 4296 + 4297 4297 + maj, extra, err := cr.ReadHeader() 4298 4298 + if err != nil { 4299 4299 + return err 4300 4300 + } 4301 4301 + defer func() { 4302 4302 + if err == io.EOF { 4303 4303 + err = io.ErrUnexpectedEOF 4304 4304 + } 4305 4305 + }() 4306 4306 + 4307 4307 + if maj != cbg.MajMap { 4308 4308 + return fmt.Errorf("cbor input should be of type map") 4309 4309 + } 4310 4310 + 4311 4311 + if extra > cbg.MaxLength { 4312 4312 + return fmt.Errorf("Pipeline_Step_Oidcs_tokens_Elem: map struct too large (%d)", extra) 4313 4313 + } 4314 4314 + 4315 4315 + n := extra 4316 4316 + 4317 4317 + nameBuf := make([]byte, 4) 4318 4318 + for i := uint64(0); i < n; i++ { 4319 4319 + nameLen, ok, err := cbg.ReadFullStringIntoBuf(cr, nameBuf, 1000000) 4320 4320 + if err != nil { 4321 4321 + return err 4322 4322 + } 4323 4323 + 4324 4324 + if !ok { 4325 4325 + // Field doesn't exist on this type, so ignore it 4326 4326 + if err := cbg.ScanForLinks(cr, func(cid.Cid) {}); err != nil { 4327 4327 + return err 4328 4328 + } 4329 4329 + continue 4330 4330 + } 4331 4331 + 4332 4332 + switch string(nameBuf[:nameLen]) { 4333 4333 + // t.Aud (string) (string) 4334 4334 + case "aud": 4335 4335 + 4336 4336 + { 4337 4337 + b, err := cr.ReadByte() 4338 4338 + if err != nil { 4339 4339 + return err 4340 4340 + } 4341 4341 + if b != cbg.CborNull[0] { 4342 4342 + if err := cr.UnreadByte(); err != nil { 4343 4343 + return err 4344 4344 + } 4345 4345 + 4346 4346 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 4347 4347 + if err != nil { 4348 4348 + return err 4349 4349 + } 4350 4350 + 4351 4351 + t.Aud = (*string)(&sval) 4352 4352 + } 4353 4353 + } 4354 4354 + // t.Name (string) (string) 4355 4355 + case "name": 4356 4356 + 4357 4357 + { 4358 4358 + sval, err := cbg.ReadStringWithMax(cr, 1000000) 4359 4359 + if err != nil { 4360 4360 + return err 4361 4361 + } 4362 4362 + 4363 4363 + t.Name = string(sval) 4124 4364 } 4125 4365 4126 4366 default:

+9 -3

api/tangled/tangledpipeline.go

··· 63 63 64 64 // Pipeline_Step is a "step" in the sh.tangled.pipeline schema. 65 65 type Pipeline_Step struct { 66 66 - Command string `json:"command" cborgen:"command"` 67 67 - Environment []*Pipeline_Pair `json:"environment,omitempty" cborgen:"environment,omitempty"` 68 68 - Name string `json:"name" cborgen:"name"` 66 66 + Command string `json:"command" cborgen:"command"` 67 67 + Environment []*Pipeline_Pair `json:"environment,omitempty" cborgen:"environment,omitempty"` 68 68 + Name string `json:"name" cborgen:"name"` 69 69 + Oidcs_tokens []*Pipeline_Step_Oidcs_tokens_Elem `json:"oidcs_tokens,omitempty" cborgen:"oidcs_tokens,omitempty"` 70 70 + } 71 71 + 72 72 + type Pipeline_Step_Oidcs_tokens_Elem struct { 73 73 + Aud *string `json:"aud,omitempty" cborgen:"aud,omitempty"` 74 74 + Name string `json:"name" cborgen:"name"` 69 75 } 70 76 71 77 // Pipeline_TriggerMetadata is a "triggerMetadata" in the sh.tangled.pipeline schema.

+3

appview/config/config.go

··· 16 16 AppviewHost string `env:"APPVIEW_HOST, default=https://tangled.sh"` 17 17 Dev bool `env:"DEV, default=false"` 18 18 DisallowedNicknamesFile string `env:"DISALLOWED_NICKNAMES_FILE"` 19 19 + 20 20 + // temporarily, to add users to default spindle 21 21 + AppPassword string `env:"APP_PASSWORD"` 19 22 } 20 23 21 24 type OAuthConfig struct {

+2 -2

appview/db/db.go

··· 728 728 kind := rv.Kind() 729 729 730 730 // if we have `FilterIn(k, [1, 2, 3])`, compile it down to `k in (?, ?, ?)` 731 731 - if kind == reflect.Slice || kind == reflect.Array { 731 731 + if (kind == reflect.Slice && rv.Type().Elem().Kind() != reflect.Uint8) || kind == reflect.Array { 732 732 if rv.Len() == 0 { 733 733 // always false 734 734 return "1 = 0" ··· 748 748 func (f filter) Arg() []any { 749 749 rv := reflect.ValueOf(f.arg) 750 750 kind := rv.Kind() 751 751 - if kind == reflect.Slice || kind == reflect.Array { 751 751 + if (kind == reflect.Slice && rv.Type().Elem().Kind() != reflect.Uint8) || kind == reflect.Array { 752 752 if rv.Len() == 0 { 753 753 return nil 754 754 }

+2 -2

appview/db/repos.go

··· 391 391 var description, spindle sql.NullString 392 392 393 393 row := e.QueryRow(` 394 394 - select did, name, knot, created, at_uri, description, spindle 394 394 + select did, name, knot, created, at_uri, description, spindle 395 395 from repos 396 396 where did = ? and name = ? 397 397 `, ··· 556 556 return err 557 557 } 558 558 559 559 - func UpdateSpindle(e Execer, repoAt, spindle string) error { 559 559 + func UpdateSpindle(e Execer, repoAt string, spindle *string) error { 560 560 _, err := e.Exec( 561 561 `update repos set spindle = ? where at_uri = ?`, spindle, repoAt) 562 562 return err

+4

appview/ingester.go

··· 387 387 if err != nil { 388 388 return fmt.Errorf("failed to update ACLs: %w", err) 389 389 } 390 390 + 391 391 + l.Info("added spindle member") 390 392 case models.CommitOperationDelete: 391 393 rkey := e.Commit.RKey 392 394 ··· 433 435 if err = i.Enforcer.E.SavePolicy(); err != nil { 434 436 return fmt.Errorf("failed to save ACLs: %w", err) 435 437 } 438 438 + 439 439 + l.Info("removed spindle member") 436 440 } 437 441 438 442 return nil

+141

appview/oauth/handler/handler.go

··· 1 1 package oauth 2 2 3 3 import ( 4 4 + "bytes" 5 5 + "context" 4 6 "encoding/json" 5 7 "fmt" 6 8 "log" 7 9 "net/http" 8 10 "net/url" 9 11 "strings" 12 12 + "time" 10 13 11 14 "github.com/go-chi/chi/v5" 12 15 "github.com/gorilla/sessions" 13 16 "github.com/lestrrat-go/jwx/v2/jwk" 14 17 "github.com/posthog/posthog-go" 15 18 "tangled.sh/icyphox.sh/atproto-oauth/helpers" 19 19 + tangled "tangled.sh/tangled.sh/core/api/tangled" 16 20 sessioncache "tangled.sh/tangled.sh/core/appview/cache/session" 17 21 "tangled.sh/tangled.sh/core/appview/config" 18 22 "tangled.sh/tangled.sh/core/appview/db" ··· 23 27 "tangled.sh/tangled.sh/core/idresolver" 24 28 "tangled.sh/tangled.sh/core/knotclient" 25 29 "tangled.sh/tangled.sh/core/rbac" 30 30 + "tangled.sh/tangled.sh/core/tid" 26 31 ) 27 32 28 33 const ( ··· 294 299 295 300 log.Println("session saved successfully") 296 301 go o.addToDefaultKnot(oauthRequest.Did) 302 302 + go o.addToDefaultSpindle(oauthRequest.Did) 297 303 298 304 if !o.config.Core.Dev { 299 305 err = o.posthog.Enqueue(posthog.Capture{ ··· 330 336 return nil, err 331 337 } 332 338 return pubKey, nil 339 339 + } 340 340 + 341 341 + func (o *OAuthHandler) addToDefaultSpindle(did string) { 342 342 + // use the tangled.sh app password to get an accessJwt 343 343 + // and create an sh.tangled.spindle.member record with that 344 344 + 345 345 + defaultSpindle := "spindle.tangled.sh" 346 346 + appPassword := o.config.Core.AppPassword 347 347 + 348 348 + spindleMembers, err := db.GetSpindleMembers( 349 349 + o.db, 350 350 + db.FilterEq("instance", "spindle.tangled.sh"), 351 351 + db.FilterEq("subject", did), 352 352 + ) 353 353 + if err != nil { 354 354 + log.Printf("failed to get spindle members for did %s: %v", did, err) 355 355 + return 356 356 + } 357 357 + 358 358 + if len(spindleMembers) != 0 { 359 359 + log.Printf("did %s is already a member of the default spindle", did) 360 360 + return 361 361 + } 362 362 + 363 363 + // TODO: hardcoded tangled handle and did for now 364 364 + tangledHandle := "tangled.sh" 365 365 + tangledDid := "did:plc:wshs7t2adsemcrrd4snkeqli" 366 366 + 367 367 + if appPassword == "" { 368 368 + log.Println("no app password configured, skipping spindle member addition") 369 369 + return 370 370 + } 371 371 + 372 372 + log.Printf("adding %s to default spindle", did) 373 373 + 374 374 + resolved, err := o.idResolver.ResolveIdent(context.Background(), tangledDid) 375 375 + if err != nil { 376 376 + log.Printf("failed to resolve tangled.sh DID %s: %v", tangledDid, err) 377 377 + return 378 378 + } 379 379 + 380 380 + pdsEndpoint := resolved.PDSEndpoint() 381 381 + if pdsEndpoint == "" { 382 382 + log.Printf("no PDS endpoint found for tangled.sh DID %s", tangledDid) 383 383 + return 384 384 + } 385 385 + 386 386 + sessionPayload := map[string]string{ 387 387 + "identifier": tangledHandle, 388 388 + "password": appPassword, 389 389 + } 390 390 + sessionBytes, err := json.Marshal(sessionPayload) 391 391 + if err != nil { 392 392 + log.Printf("failed to marshal session payload: %v", err) 393 393 + return 394 394 + } 395 395 + 396 396 + sessionURL := pdsEndpoint + "/xrpc/com.atproto.server.createSession" 397 397 + sessionReq, err := http.NewRequestWithContext(context.Background(), "POST", sessionURL, bytes.NewBuffer(sessionBytes)) 398 398 + if err != nil { 399 399 + log.Printf("failed to create session request: %v", err) 400 400 + return 401 401 + } 402 402 + sessionReq.Header.Set("Content-Type", "application/json") 403 403 + 404 404 + client := &http.Client{Timeout: 30 * time.Second} 405 405 + sessionResp, err := client.Do(sessionReq) 406 406 + if err != nil { 407 407 + log.Printf("failed to create session: %v", err) 408 408 + return 409 409 + } 410 410 + defer sessionResp.Body.Close() 411 411 + 412 412 + if sessionResp.StatusCode != http.StatusOK { 413 413 + log.Printf("failed to create session: HTTP %d", sessionResp.StatusCode) 414 414 + return 415 415 + } 416 416 + 417 417 + var session struct { 418 418 + AccessJwt string `json:"accessJwt"` 419 419 + } 420 420 + if err := json.NewDecoder(sessionResp.Body).Decode(&session); err != nil { 421 421 + log.Printf("failed to decode session response: %v", err) 422 422 + return 423 423 + } 424 424 + 425 425 + record := tangled.SpindleMember{ 426 426 + LexiconTypeID: "sh.tangled.spindle.member", 427 427 + Subject: did, 428 428 + Instance: defaultSpindle, 429 429 + CreatedAt: time.Now().Format(time.RFC3339), 430 430 + } 431 431 + 432 432 + recordBytes, err := json.Marshal(record) 433 433 + if err != nil { 434 434 + log.Printf("failed to marshal spindle member record: %v", err) 435 435 + return 436 436 + } 437 437 + 438 438 + payload := map[string]interface{}{ 439 439 + "repo": tangledDid, 440 440 + "collection": tangled.SpindleMemberNSID, 441 441 + "rkey": tid.TID(), 442 442 + "record": json.RawMessage(recordBytes), 443 443 + } 444 444 + 445 445 + payloadBytes, err := json.Marshal(payload) 446 446 + if err != nil { 447 447 + log.Printf("failed to marshal request payload: %v", err) 448 448 + return 449 449 + } 450 450 + 451 451 + url := pdsEndpoint + "/xrpc/com.atproto.repo.putRecord" 452 452 + req, err := http.NewRequestWithContext(context.Background(), "POST", url, bytes.NewBuffer(payloadBytes)) 453 453 + if err != nil { 454 454 + log.Printf("failed to create HTTP request: %v", err) 455 455 + return 456 456 + } 457 457 + 458 458 + req.Header.Set("Content-Type", "application/json") 459 459 + req.Header.Set("Authorization", "Bearer "+session.AccessJwt) 460 460 + 461 461 + resp, err := client.Do(req) 462 462 + if err != nil { 463 463 + log.Printf("failed to add user to default spindle: %v", err) 464 464 + return 465 465 + } 466 466 + defer resp.Body.Close() 467 467 + 468 468 + if resp.StatusCode != http.StatusOK { 469 469 + log.Printf("failed to add user to default spindle: HTTP %d", resp.StatusCode) 470 470 + return 471 471 + } 472 472 + 473 473 + log.Printf("successfully added %s to default spindle", did) 333 474 } 334 475 335 476 func (o *OAuthHandler) addToDefaultKnot(did string) {

-1

appview/pages/pages.go

··· 416 416 UserDid string 417 417 UserHandle string 418 418 FollowStatus db.FollowStatus 419 419 - AvatarUri string 420 419 Followers int 421 420 Following int 422 421

+20 -3

appview/pages/templates/layouts/topbar.html

··· 9 9 10 10 <div id="right-items" class="flex items-center gap-2"> 11 11 {{ with .LoggedInUser }} 12 12 - <a href="/repo/new" hx-boost="true" class="btn-create hover:no-underline hover:text-white"> 13 13 - {{ i "plus" "w-4 h-4" }} 14 14 - </a> 12 12 + {{ block "newButton" . }} {{ end }} 15 13 {{ block "dropDown" . }} {{ end }} 16 14 {{ else }} 17 15 <a href="/login">login</a> ··· 25 23 </nav> 26 24 {{ end }} 27 25 26 26 + {{ define "newButton" }} 27 27 + <details class="relative inline-block text-left"> 28 28 + <summary class="btn-create py-0 cursor-pointer list-none flex items-center gap-2"> 29 29 + {{ i "plus" "w-4 h-4" }} new 30 30 + </summary> 31 31 + <div class="absolute flex flex-col right-0 mt-4 p-4 rounded w-48 bg-white dark:bg-gray-800 dark:text-white border border-gray-200 dark:border-gray-700"> 32 32 + <a href="/repo/new" class="flex items-center gap-2"> 33 33 + {{ i "book-plus" "w-4 h-4" }} 34 34 + new repository 35 35 + </a> 36 36 + <a href="/strings/new" class="flex items-center gap-2"> 37 37 + {{ i "line-squiggle" "w-4 h-4" }} 38 38 + new string 39 39 + </a> 40 40 + </div> 41 41 + </details> 42 42 + {{ end }} 43 43 + 28 44 {{ define "dropDown" }} 29 45 <details class="relative inline-block text-left"> 30 46 <summary ··· 38 54 > 39 55 <a href="/{{ $user }}">profile</a> 40 56 <a href="/{{ $user }}?tab=repos">repositories</a> 57 57 + <a href="/strings/{{ $user }}">strings</a> 41 58 <a href="/knots">knots</a> 42 59 <a href="/spindles">spindles</a> 43 60 <a href="/settings">settings</a>

+4 -2

appview/pages/templates/repo/empty.html

··· 32 32 <div class="py-6 w-fit flex flex-col gap-4"> 33 33 <p>This is an empty repository. To get started:</p> 34 34 {{ $bullet := "mx-2 text-xs bg-gray-200 dark:bg-gray-600 rounded-full size-5 flex items-center justify-center font-mono inline-flex align-middle" }} 35 35 - <p><span class="{{$bullet}}">1</span>Add a public key to your account from the <a href="/settings" class="underline">settings</a> page</p> 36 36 - <p><span class="{{$bullet}}">2</span>Configure your remote to <span class="font-mono p-1 rounded bg-gray-100 dark:bg-gray-700 ">git@{{ $knot }}:{{ .RepoInfo.OwnerHandle }}/{{ .RepoInfo.Name }}<span></p> 35 35 + <p><span class="{{$bullet}}">1</span>Add an SSH public key to your account from the <a href="/settings" class="underline">settings</a> page. 36 36 + If you don't have one, you can generate a new SSH key pair using the following command: <code>ssh-keygen -t ed25519 -C "you@example.com"</code> 37 37 + </p> 38 38 + <p><span class="{{$bullet}}">2</span>Configure your remote to <code>git@{{ $knot }}:{{ .RepoInfo.OwnerHandle }}/{{ .RepoInfo.Name }}</code></p> 37 39 <p><span class="{{$bullet}}">3</span>Push!</p> 38 40 </div> 39 41 </div>

+5 -1

appview/pages/templates/repo/pipelines/workflow.html

··· 19 19 20 20 {{ define "sidebar" }} 21 21 {{ $active := .Workflow }} 22 22 + 23 23 + {{ $activeTab := "bg-white dark:bg-gray-700 drop-shadow-sm" }} 24 24 + {{ $inactiveTab := "bg-gray-100 dark:bg-gray-800" }} 25 25 + 22 26 {{ with .Pipeline }} 23 27 {{ $id := .Id }} 24 28 <div class="sticky top-2 grid grid-cols-1 rounded border border-gray-200 dark:border-gray-700 divide-y divide-gray-200 dark:divide-gray-700"> 25 29 {{ range $name, $all := .Statuses }} 26 30 <a href="/{{ $.RepoInfo.FullName }}/pipelines/{{ $id }}/workflow/{{ $name }}" class="no-underline hover:no-underline hover:bg-gray-100/25 hover:dark:bg-gray-700/25"> 27 31 <div 28 28 - class="flex gap-2 items-center justify-between p-2 {{ if eq $name $active }}bg-gray-100/50 dark:bg-gray-700/50{{ end }}"> 32 32 + class="flex gap-2 items-center justify-between p-2 {{ if eq $name $active }} {{ $activeTab }} {{ else }} {{ $inactiveTab }} {{ end }}"> 29 33 {{ $lastStatus := $all.Latest }} 30 34 {{ $kind := $lastStatus.Status.String }} 31 35

+9 -4

appview/pages/templates/repo/settings/pipelines.html

··· 34 34 {{ else }} 35 35 <form hx-post="/{{ $.RepoInfo.FullName }}/settings/spindle" class="col-span-1 md:col-span-1 md:justify-self-end group flex gap-2 items-stretch"> 36 36 <select 37 37 - id="spindle" 37 37 + id="spindle" 38 38 name="spindle" 39 39 - required 39 39 + required 40 40 class="p-1 max-w-64 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 41 41 - <option value="" disabled> 41 41 + {{/* For some reason, we can't use an empty string in a <select> in all scenarios unless it is preceded by a disabled select?? No idea, could just be a Firefox thing? */}} 42 42 + <option value="[[none]]" class="py-1" {{ if not $.CurrentSpindle }}selected{{ end }}> 43 43 + {{ if not $.CurrentSpindle }} 42 44 Choose a spindle 45 45 + {{ else }} 46 46 + Disable pipelines 47 47 + {{ end }} 43 48 </option> 44 49 {{ range $.Spindles }} 45 50 <option value="{{ . }}" class="py-1" {{ if eq . $.CurrentSpindle }}selected{{ end }}> ··· 82 87 {{ end }} 83 88 84 89 {{ define "addSecretButton" }} 85 85 - <button 90 90 + <button 86 91 class="btn flex items-center gap-2" 87 92 popovertarget="add-secret-modal" 88 93 popovertargetaction="toggle">

-168

appview/pages/templates/repo/settings.html

··· 1 1 - {{ define "title" }}settings &middot; {{ .RepoInfo.FullName }}{{ end }} 2 2 - 3 3 - {{ define "repoContent" }} 4 4 - {{ template "collaboratorSettings" . }} 5 5 - {{ template "branchSettings" . }} 6 6 - {{ template "dangerZone" . }} 7 7 - {{ template "spindleSelector" . }} 8 8 - {{ template "spindleSecrets" . }} 9 9 - {{ end }} 10 10 - 11 11 - {{ define "collaboratorSettings" }} 12 12 - <header class="font-bold text-sm mb-4 uppercase dark:text-white"> 13 13 - Collaborators 14 14 - </header> 15 15 - 16 16 - <div id="collaborator-list" class="flex flex-col gap-2 mb-2"> 17 17 - {{ range .Collaborators }} 18 18 - <div id="collaborator" class="mb-2"> 19 19 - <a 20 20 - href="/{{ didOrHandle .Did .Handle }}" 21 21 - class="no-underline hover:underline text-black dark:text-white" 22 22 - > 23 23 - {{ didOrHandle .Did .Handle }} 24 24 - </a> 25 25 - <div> 26 26 - <span class="text-sm text-gray-500 dark:text-gray-400"> 27 27 - {{ .Role }} 28 28 - </span> 29 29 - </div> 30 30 - </div> 31 31 - {{ end }} 32 32 - </div> 33 33 - 34 34 - {{ if .RepoInfo.Roles.CollaboratorInviteAllowed }} 35 35 - <form 36 36 - hx-put="/{{ $.RepoInfo.FullName }}/settings/collaborator" 37 37 - class="group" 38 38 - > 39 39 - <label for="collaborator" class="dark:text-white"> 40 40 - add collaborator 41 41 - </label> 42 42 - <input 43 43 - type="text" 44 44 - id="collaborator" 45 45 - name="collaborator" 46 46 - required 47 47 - class="dark:bg-gray-700 dark:text-white" 48 48 - placeholder="enter did or handle"> 49 49 - <button class="btn my-2 flex gap-2 items-center dark:text-white dark:hover:bg-gray-700" type="text"> 50 50 - <span>add</span> 51 51 - {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 52 52 - </button> 53 53 - </form> 54 54 - {{ end }} 55 55 - {{ end }} 56 56 - 57 57 - {{ define "dangerZone" }} 58 58 - {{ if .RepoInfo.Roles.RepoDeleteAllowed }} 59 59 - <form 60 60 - hx-confirm="Are you sure you want to delete this repository?" 61 61 - hx-delete="/{{ $.RepoInfo.FullName }}/settings/delete" 62 62 - class="mt-6" 63 63 - hx-indicator="#delete-repo-spinner"> 64 64 - <label for="branch">delete repository</label> 65 65 - <button class="btn my-2 flex items-center" type="text"> 66 66 - <span>delete</span> 67 67 - <span id="delete-repo-spinner" class="group"> 68 68 - {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 69 69 - </span> 70 70 - </button> 71 71 - <span> 72 72 - Deleting a repository is irreversible and permanent. 73 73 - </span> 74 74 - </form> 75 75 - {{ end }} 76 76 - {{ end }} 77 77 - 78 78 - {{ define "branchSettings" }} 79 79 - <form hx-put="/{{ $.RepoInfo.FullName }}/settings/branches/default" class="mt-6 group"> 80 80 - <label for="branch">default branch</label> 81 81 - <div class="flex gap-2 items-center"> 82 82 - <select id="branch" name="branch" required class="p-1 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 83 83 - <option value="" disabled selected > 84 84 - Choose a default branch 85 85 - </option> 86 86 - {{ range .Branches }} 87 87 - <option value="{{ .Name }}" class="py-1" {{ if .IsDefault }}selected{{ end }} > 88 88 - {{ .Name }} 89 89 - </option> 90 90 - {{ end }} 91 91 - </select> 92 92 - <button class="btn my-2 flex gap-2 items-center" type="submit"> 93 93 - <span>save</span> 94 94 - {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 95 95 - </button> 96 96 - </div> 97 97 - </form> 98 98 - {{ end }} 99 99 - 100 100 - {{ define "spindleSelector" }} 101 101 - {{ if .RepoInfo.Roles.IsOwner }} 102 102 - <form hx-post="/{{ $.RepoInfo.FullName }}/settings/spindle" class="mt-6 group" > 103 103 - <label for="spindle">spindle</label> 104 104 - <div class="flex gap-2 items-center"> 105 105 - <select id="spindle" name="spindle" required class="p-1 border border-gray-200 bg-white dark:bg-gray-800 dark:text-white dark:border-gray-700"> 106 106 - <option value="" selected > 107 107 - None 108 108 - </option> 109 109 - {{ range .Spindles }} 110 110 - <option value="{{ . }}" class="py-1" {{ if eq . $.CurrentSpindle }}selected{{ end }}> 111 111 - {{ . }} 112 112 - </option> 113 113 - {{ end }} 114 114 - </select> 115 115 - <button class="btn my-2 flex gap-2 items-center" type="submit"> 116 116 - <span>save</span> 117 117 - {{ i "loader-circle" "w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 118 118 - </button> 119 119 - </div> 120 120 - </form> 121 121 - {{ end }} 122 122 - {{ end }} 123 123 - 124 124 - {{ define "spindleSecrets" }} 125 125 - {{ if $.CurrentSpindle }} 126 126 - <header class="font-bold text-sm mb-4 uppercase dark:text-white"> 127 127 - Secrets 128 128 - </header> 129 129 - 130 130 - <div id="secret-list" class="flex flex-col gap-2 mb-2"> 131 131 - {{ range $idx, $secret := .Secrets }} 132 132 - {{ with $secret }} 133 133 - <div id="secret-{{$idx}}" class="mb-2"> 134 134 - {{ .Key }} created on {{ .CreatedAt }} by {{ .CreatedBy }} 135 135 - </div> 136 136 - {{ end }} 137 137 - {{ end }} 138 138 - </div> 139 139 - <form 140 140 - hx-put="/{{ $.RepoInfo.FullName }}/settings/secrets" 141 141 - class="mt-6" 142 142 - hx-indicator="#add-secret-spinner"> 143 143 - <label for="key">secret key</label> 144 144 - <input 145 145 - type="text" 146 146 - id="key" 147 147 - name="key" 148 148 - required 149 149 - class="dark:bg-gray-700 dark:text-white" 150 150 - placeholder="SECRET_KEY" /> 151 151 - <label for="value">secret value</label> 152 152 - <input 153 153 - type="text" 154 154 - id="value" 155 155 - name="value" 156 156 - required 157 157 - class="dark:bg-gray-700 dark:text-white" 158 158 - placeholder="SECRET VALUE" /> 159 159 - 160 160 - <button class="btn my-2 flex items-center" type="text"> 161 161 - <span>add</span> 162 162 - <span id="add-secret-spinner" class="group"> 163 163 - {{ i "loader-circle" "ml-2 w-4 h-4 animate-spin hidden group-[.htmx-request]:inline" }} 164 164 - </span> 165 165 - </button> 166 166 - </form> 167 167 - {{ end }} 168 168 - {{ end }}

+3 -2

appview/pages/templates/repo/tree.html

··· 61 61 62 62 {{ if .IsFile }} 63 63 {{ $icon = "file" }} 64 64 - {{ $iconStyle = "size-4" }} 64 64 + {{ $iconStyle = "flex-shrink-0 size-4" }} 65 65 {{ end }} 66 66 <a href="{{ $link }}" class="{{ $linkstyle }}"> 67 67 <div class="flex items-center gap-2"> 68 68 - {{ i $icon $iconStyle }}{{ .Name }} 68 68 + {{ i $icon $iconStyle }} 69 69 + <span class="truncate">{{ .Name }}</span> 69 70 </div> 70 71 </a> 71 72 </div>

+57

appview/pages/templates/strings/dashboard.html

··· 1 1 + {{ define "title" }}strings by {{ or .Card.UserHandle .Card.UserDid }}{{ end }} 2 2 + 3 3 + {{ define "extrameta" }} 4 4 + <meta property="og:title" content="{{ or .Card.UserHandle .Card.UserDid }}" /> 5 5 + <meta property="og:type" content="profile" /> 6 6 + <meta property="og:url" content="https://tangled.sh/{{ or .Card.UserHandle .Card.UserDid }}" /> 7 7 + <meta property="og:description" content="{{ or .Card.Profile.Description .Card.UserHandle .Card.UserDid }}" /> 8 8 + {{ end }} 9 9 + 10 10 + 11 11 + {{ define "content" }} 12 12 + <div class="grid grid-cols-1 md:grid-cols-11 gap-4"> 13 13 + <div class="md:col-span-3 order-1 md:order-1"> 14 14 + {{ template "user/fragments/profileCard" .Card }} 15 15 + </div> 16 16 + <div id="all-strings" class="md:col-span-8 order-2 md:order-2"> 17 17 + {{ block "allStrings" . }}{{ end }} 18 18 + </div> 19 19 + </div> 20 20 + {{ end }} 21 21 + 22 22 + {{ define "allStrings" }} 23 23 + <p class="text-sm font-bold p-2 dark:text-white">ALL STRINGS</p> 24 24 + <div id="strings" class="grid grid-cols-1 gap-4 mb-6"> 25 25 + {{ range .Strings }} 26 26 + {{ template "singleString" (list $ .) }} 27 27 + {{ else }} 28 28 + <p class="px-6 dark:text-white">This user does not have any strings yet.</p> 29 29 + {{ end }} 30 30 + </div> 31 31 + {{ end }} 32 32 + 33 33 + {{ define "singleString" }} 34 34 + {{ $root := index . 0 }} 35 35 + {{ $s := index . 1 }} 36 36 + <div class="py-4 px-6 drop-shadow-sm rounded bg-white dark:bg-gray-800"> 37 37 + <div class="font-medium dark:text-white flex gap-2 items-center"> 38 38 + <a href="/strings/{{ or $root.Card.UserHandle $root.Card.UserDid }}/{{ $s.Rkey }}">{{ $s.Filename }}</a> 39 39 + </div> 40 40 + {{ with $s.Description }} 41 41 + <div class="text-gray-600 dark:text-gray-300 text-sm"> 42 42 + {{ . }} 43 43 + </div> 44 44 + {{ end }} 45 45 + 46 46 + {{ $stat := $s.Stats }} 47 47 + <div class="text-gray-400 pt-4 text-sm font-mono inline-flex gap-2 mt-auto"> 48 48 + <span>{{ $stat.LineCount }} line{{if ne $stat.LineCount 1}}s{{end}}</span> 49 49 + <span class="select-none [&:before]:content-['·']"></span> 50 50 + {{ with $s.Edited }} 51 51 + <span>edited {{ template "repo/fragments/shortTimeAgo" . }}</span> 52 52 + {{ else }} 53 53 + {{ template "repo/fragments/shortTimeAgo" $s.Created }} 54 54 + {{ end }} 55 55 + </div> 56 56 + </div> 57 57 + {{ end }}

+1 -3

appview/pages/templates/user/fragments/profileCard.html

··· 2 2 <div class="bg-white dark:bg-gray-800 px-6 py-4 rounded drop-shadow-sm max-h-fit"> 3 3 <div class="grid grid-cols-3 md:grid-cols-1 gap-1 items-center"> 4 4 <div id="avatar" class="col-span-1 flex justify-center items-center"> 5 5 - {{ if .AvatarUri }} 6 5 <div class="w-3/4 aspect-square relative"> 7 7 - <img class="absolute inset-0 w-full h-full object-cover rounded-full p-2" src="{{ .AvatarUri }}" /> 6 6 + <img class="absolute inset-0 w-full h-full object-cover rounded-full p-2" src="{{ fullAvatar .UserDid }}" /> 8 7 </div> 9 9 - {{ end }} 10 8 </div> 11 9 <div class="col-span-2"> 12 10 <p title="{{ didOrHandle .UserDid .UserHandle }}"

+5 -4

appview/pages/templates/user/fragments/repoCard.html

··· 28 28 {{ define "repoStats" }} 29 29 <div class="text-gray-400 pt-4 text-sm font-mono inline-flex gap-4 mt-auto"> 30 30 {{ with .Language }} 31 31 - <div class="flex gap-2 items-center text-sm"> 32 32 - <div class="size-2 rounded-full" style="background-color: {{ langColor . }};"></div> 33 33 - <span>{{ . }}</span> 34 34 - </div> 31 31 + <div class="flex gap-2 items-center text-sm"> 32 32 + <div class="size-2 rounded-full" 33 33 + style="background: radial-gradient(circle at 35% 35%, color-mix(in srgb, {{ langColor . }} 70%, white), {{ langColor . }} 30%, color-mix(in srgb, {{ langColor . }} 85%, black));"></div> 34 34 + <span>{{ . }}</span> 35 35 + </div> 35 36 {{ end }} 36 37 {{ with .StarCount }} 37 38 <div class="flex gap-1 items-center text-sm">

+28 -15

appview/repo/repo.go

··· 657 657 } 658 658 659 659 newSpindle := r.FormValue("spindle") 660 660 + removingSpindle := newSpindle == "[[none]]" // see pages/templates/repo/settings/pipelines.html for more info on why we use this value 660 661 client, err := rp.oauth.AuthorizedClient(r) 661 662 if err != nil { 662 663 fail("Failed to authorize. Try again later.", err) 663 664 return 664 665 } 665 666 666 666 - // ensure that this is a valid spindle for this user 667 667 - validSpindles, err := rp.enforcer.GetSpindlesForUser(user.Did) 668 668 - if err != nil { 669 669 - fail("Failed to find spindles. Try again later.", err) 670 670 - return 667 667 + if !removingSpindle { 668 668 + // ensure that this is a valid spindle for this user 669 669 + validSpindles, err := rp.enforcer.GetSpindlesForUser(user.Did) 670 670 + if err != nil { 671 671 + fail("Failed to find spindles. Try again later.", err) 672 672 + return 673 673 + } 674 674 + 675 675 + if !slices.Contains(validSpindles, newSpindle) { 676 676 + fail("Failed to configure spindle.", fmt.Errorf("%s is not a valid spindle: %q", newSpindle, validSpindles)) 677 677 + return 678 678 + } 671 679 } 672 680 673 673 - if !slices.Contains(validSpindles, newSpindle) { 674 674 - fail("Failed to configure spindle.", fmt.Errorf("%s is not a valid spindle: %q", newSpindle, validSpindles)) 675 675 - return 681 681 + spindlePtr := &newSpindle 682 682 + if removingSpindle { 683 683 + spindlePtr = nil 676 684 } 677 685 678 686 // optimistic update 679 679 - err = db.UpdateSpindle(rp.db, string(repoAt), newSpindle) 687 687 + err = db.UpdateSpindle(rp.db, string(repoAt), spindlePtr) 680 688 if err != nil { 681 689 fail("Failed to update spindle. Try again later.", err) 682 690 return ··· 699 707 Owner: user.Did, 700 708 CreatedAt: f.CreatedAt, 701 709 Description: &f.Description, 702 702 - Spindle: &newSpindle, 710 710 + Spindle: spindlePtr, 703 711 }, 704 712 }, 705 713 }) ··· 709 717 return 710 718 } 711 719 712 712 - // add this spindle to spindle stream 713 713 - rp.spindlestream.AddSource( 714 714 - context.Background(), 715 715 - eventconsumer.NewSpindleSource(newSpindle), 716 716 - ) 720 720 + if !removingSpindle { 721 721 + // add this spindle to spindle stream 722 722 + rp.spindlestream.AddSource( 723 723 + context.Background(), 724 724 + eventconsumer.NewSpindleSource(newSpindle), 725 725 + ) 726 726 + } 717 727 718 728 rp.pages.HxRefresh(w) 719 729 } ··· 741 751 fail("Invalid form.", nil) 742 752 return 743 753 } 754 754 + 755 755 + // remove a single leading `@`, to make @handle work with ResolveIdent 756 756 + collaborator = strings.TrimPrefix(collaborator, "@") 744 757 745 758 collaboratorIdent, err := rp.idResolver.ResolveIdent(r.Context(), collaborator) 746 759 if err != nil {

+1 -1

appview/signup/signup.go

··· 219 219 err = s.cf.CreateDNSRecord(r.Context(), dns.Record{ 220 220 Type: "TXT", 221 221 Name: "_atproto." + username, 222 222 - Content: "did=" + did, 222 222 + Content: fmt.Sprintf(`"did=%s"`, did), 223 223 TTL: 6400, 224 224 Proxied: false, 225 225 })

+4 -4

appview/spindles/spindles.go

··· 619 619 620 620 if string(spindles[0].Owner) != user.Did { 621 621 l.Error("unauthorized", "user", user.Did, "owner", spindles[0].Owner) 622 622 - s.Pages.Notice(w, noticeId, "Failed to add member, unauthorized attempt.") 622 622 + s.Pages.Notice(w, noticeId, "Failed to remove member, unauthorized attempt.") 623 623 return 624 624 } 625 625 626 626 member := r.FormValue("member") 627 627 if member == "" { 628 628 l.Error("empty member") 629 629 - s.Pages.Notice(w, noticeId, "Failed to add member, empty form.") 629 629 + s.Pages.Notice(w, noticeId, "Failed to remove member, empty form.") 630 630 return 631 631 } 632 632 l = l.With("member", member) ··· 634 634 memberId, err := s.IdResolver.ResolveIdent(r.Context(), member) 635 635 if err != nil { 636 636 l.Error("failed to resolve member identity to handle", "err", err) 637 637 - s.Pages.Notice(w, noticeId, "Failed to add member, identity resolution failed.") 637 637 + s.Pages.Notice(w, noticeId, "Failed to remove member, identity resolution failed.") 638 638 return 639 639 } 640 640 if memberId.Handle.IsInvalidHandle() { 641 641 l.Error("failed to resolve member identity to handle") 642 642 - s.Pages.Notice(w, noticeId, "Failed to add member, identity resolution failed.") 642 642 + s.Pages.Notice(w, noticeId, "Failed to remove member, identity resolution failed.") 643 643 return 644 644 } 645 645

-16

appview/state/profile.go

··· 1 1 package state 2 2 3 3 import ( 4 4 - "crypto/hmac" 5 5 - "crypto/sha256" 6 6 - "encoding/hex" 7 4 "fmt" 8 5 "log" 9 6 "net/http" ··· 142 139 log.Println("failed to get punchcard for did", "did", ident.DID.String(), "err", err) 143 140 } 144 141 145 145 - profileAvatarUri := s.GetAvatarUri(ident.Handle.String()) 146 142 s.pages.ProfilePage(w, pages.ProfilePageParams{ 147 143 LoggedInUser: loggedInUser, 148 144 Repos: pinnedRepos, ··· 151 147 Card: pages.ProfileCard{ 152 148 UserDid: ident.DID.String(), 153 149 UserHandle: ident.Handle.String(), 154 154 - AvatarUri: profileAvatarUri, 155 150 Profile: profile, 156 151 FollowStatus: followStatus, 157 152 Followers: followers, ··· 194 189 log.Printf("getting follow stats repos for %s: %s", ident.DID.String(), err) 195 190 } 196 191 197 197 - profileAvatarUri := s.GetAvatarUri(ident.Handle.String()) 198 198 - 199 192 s.pages.ReposPage(w, pages.ReposPageParams{ 200 193 LoggedInUser: loggedInUser, 201 194 Repos: repos, ··· 203 196 Card: pages.ProfileCard{ 204 197 UserDid: ident.DID.String(), 205 198 UserHandle: ident.Handle.String(), 206 206 - AvatarUri: profileAvatarUri, 207 199 Profile: profile, 208 200 FollowStatus: followStatus, 209 201 Followers: followers, 210 202 Following: following, 211 203 }, 212 204 }) 213 213 - } 214 214 - 215 215 - func (s *State) GetAvatarUri(handle string) string { 216 216 - secret := s.config.Avatar.SharedSecret 217 217 - h := hmac.New(sha256.New, []byte(secret)) 218 218 - h.Write([]byte(handle)) 219 219 - signature := hex.EncodeToString(h.Sum(nil)) 220 220 - return fmt.Sprintf("%s/%s/%s", s.config.Avatar.Host, signature, handle) 221 205 } 222 206 223 207 func (s *State) UpdateProfileBio(w http.ResponseWriter, r *http.Request) {

+5

appview/strings/strings.go

··· 99 99 w.WriteHeader(http.StatusInternalServerError) 100 100 return 101 101 } 102 102 + if len(strings) < 1 { 103 103 + l.Error("string not found") 104 104 + s.Pages.Error404(w) 105 105 + return 106 106 + } 102 107 if len(strings) != 1 { 103 108 l.Error("incorrect number of records returned", "len(strings)", len(strings)) 104 109 w.WriteHeader(http.StatusInternalServerError)

+1

cmd/gen.go

··· 34 34 tangled.Pipeline_PushTriggerData{}, 35 35 tangled.PipelineStatus{}, 36 36 tangled.Pipeline_Step{}, 37 37 + tangled.Pipeline_Step_Oidcs_tokens_Elem{}, 37 38 tangled.Pipeline_TriggerMetadata{}, 38 39 tangled.Pipeline_TriggerRepo{}, 39 40 tangled.Pipeline_Workflow{},

+9 -10

docs/hacking.md

··· 56 56 `nixosConfiguration` to do so. 57 57 58 58 To begin, head to `http://localhost:3000/knots` in the browser 59 59 - and generate a knot secret. Replace the existing secret in 60 60 - `nix/vm.nix` (`KNOT_SERVER_SECRET`) with the newly generated 61 61 - secret. 59 59 + and generate a knot secret. Set `$TANGLED_KNOT_SECRET` to it, 60 60 + ideally in a `.envrc` with [direnv](https://direnv.net) so you 61 61 + don't lose it. 62 62 63 63 You can now start a lightweight NixOS VM using 64 64 `nixos-shell` like so: ··· 91 91 92 92 ## running a spindle 93 93 94 94 - Be sure to change the `owner` field for the spindle in 95 95 - `nix/vm.nix` to your own DID. The above VM should already 96 96 - be running a spindle on `localhost:6555`. You can head to 97 97 - the spindle dashboard on `http://localhost:3000/spindles`, 98 98 - and register a spindle with hostname `localhost:6555`. It 99 99 - should instantly be verified. You can then configure each 100 100 - repository to use this spindle and run CI jobs. 94 94 + Be sure to set `$TANGLED_SPINDLE_OWNER` to your own DID. 95 95 + The above VM should already be running a spindle on `localhost:6555`. 96 96 + You can head to the spindle dashboard on `http://localhost:3000/spindles`, 97 97 + and register a spindle with hostname `localhost:6555`. It should instantly 98 98 + be verified. You can then configure each repository to use this spindle 99 99 + and run CI jobs. 101 100 102 101 Of interest when debugging spindles: 103 102

+1 -1

docs/knot-hosting.md

··· 89 89 systemctl start knotserver 90 90 ``` 91 91 92 92 - The last step is to configure a reverse proxy like Nginx or Caddy to front yourself 92 92 + The last step is to configure a reverse proxy like Nginx or Caddy to front your 93 93 knot. Here's an example configuration for Nginx: 94 94 95 95 ```

+1 -1

docs/spindle/openbao.md

··· 114 114 ROLE_ID=$(bao read -field=role_id auth/approle/role/spindle/role-id) 115 115 116 116 # Generate secret ID 117 117 - SECRET_ID=$(bao write -field=secret_id auth/approle/role/spindle/secret-id) 117 117 + SECRET_ID=$(bao write -f -field=secret_id auth/approle/role/spindle/secret-id) 118 118 119 119 echo "Role ID: $ROLE_ID" 120 120 echo "Secret ID: $SECRET_ID"

+7 -28

flake.lock

··· 1 1 { 2 2 "nodes": { 3 3 - "gitignore": { 4 4 - "inputs": { 5 5 - "nixpkgs": [ 6 6 - "nixpkgs" 7 7 - ] 8 8 - }, 9 9 - "locked": { 10 10 - "lastModified": 1709087332, 11 11 - "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", 12 12 - "owner": "hercules-ci", 13 13 - "repo": "gitignore.nix", 14 14 - "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", 15 15 - "type": "github" 16 16 - }, 17 17 - "original": { 18 18 - "owner": "hercules-ci", 19 19 - "repo": "gitignore.nix", 20 20 - "type": "github" 21 21 - } 22 22 - }, 23 3 "flake-utils": { 24 4 "inputs": { 25 5 "systems": "systems" ··· 99 79 "indigo": { 100 80 "flake": false, 101 81 "locked": { 102 102 - "lastModified": 1745333930, 103 103 - "narHash": "sha256-83fIHqDE+dfnZ88HaNuwfKFO+R0RKAM1WxMfNh/Matk=", 82 82 + "lastModified": 1753693716, 83 83 + "narHash": "sha256-DMIKnCJRODQXEHUxA+7mLzRALmnZhkkbHlFT2rCQYrE=", 104 84 "owner": "oppiliappan", 105 85 "repo": "indigo", 106 106 - "rev": "e4e59280737b8676611fc077a228d47b3e8e9491", 86 86 + "rev": "5f170569da9360f57add450a278d73538092d8ca", 107 87 "type": "github" 108 88 }, 109 89 "original": { ··· 128 108 "lucide-src": { 129 109 "flake": false, 130 110 "locked": { 131 131 - "lastModified": 1742302029, 132 132 - "narHash": "sha256-OyPVtpnC4/AAmPq84Wt1r1Gcs48d9KG+UBCtZK87e9k=", 111 111 + "lastModified": 1754044466, 112 112 + "narHash": "sha256-+exBR2OToB1iv7ZQI2S4B0lXA/QRvC9n6U99UxGpJGs=", 133 113 "type": "tarball", 134 134 - "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip" 114 114 + "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip" 135 115 }, 136 116 "original": { 137 117 "type": "tarball", 138 138 - "url": "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip" 118 118 + "url": "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip" 139 119 } 140 120 }, 141 121 "nixpkgs": { ··· 156 136 }, 157 137 "root": { 158 138 "inputs": { 159 159 - "gitignore": "gitignore", 160 139 "gomod2nix": "gomod2nix", 161 140 "htmx-src": "htmx-src", 162 141 "htmx-ws-src": "htmx-ws-src",

+75 -27

flake.nix

··· 22 22 flake = false; 23 23 }; 24 24 lucide-src = { 25 25 - url = "https://github.com/lucide-icons/lucide/releases/download/0.483.0/lucide-icons-0.483.0.zip"; 25 25 + url = "https://github.com/lucide-icons/lucide/releases/download/0.536.0/lucide-icons-0.536.0.zip"; 26 26 flake = false; 27 27 }; 28 28 inter-fonts-src = { ··· 37 37 url = "https://sqlite.org/2024/sqlite-amalgamation-3450100.zip"; 38 38 flake = false; 39 39 }; 40 40 - gitignore = { 41 41 - url = "github:hercules-ci/gitignore.nix"; 42 42 - inputs.nixpkgs.follows = "nixpkgs"; 43 43 - }; 44 40 }; 45 41 46 42 outputs = { ··· 51 47 htmx-src, 52 48 htmx-ws-src, 53 49 lucide-src, 54 54 - gitignore, 55 50 inter-fonts-src, 56 51 sqlite-lib-src, 57 52 ibm-plex-mono-src, ··· 62 57 63 58 mkPackageSet = pkgs: 64 59 pkgs.lib.makeScope pkgs.newScope (self: { 65 65 - inherit (gitignore.lib) gitignoreSource; 60 60 + src = let 61 61 + fs = pkgs.lib.fileset; 62 62 + in 63 63 + fs.toSource { 64 64 + root = ./.; 65 65 + fileset = fs.difference (fs.intersection (fs.gitTracked ./.) (fs.fileFilter (file: !(file.hasExt "nix")) ./.)) (fs.maybeMissing ./.jj); 66 66 + }; 66 67 buildGoApplication = 67 68 (self.callPackage "${gomod2nix}/builder" { 68 69 gomod2nix = gomod2nix.legacyPackages.${pkgs.system}.gomod2nix; ··· 74 75 }; 75 76 genjwks = self.callPackage ./nix/pkgs/genjwks.nix {}; 76 77 lexgen = self.callPackage ./nix/pkgs/lexgen.nix {inherit indigo;}; 77 77 - appview = self.callPackage ./nix/pkgs/appview.nix { 78 78 + appview-static-files = self.callPackage ./nix/pkgs/appview-static-files.nix { 78 79 inherit htmx-src htmx-ws-src lucide-src inter-fonts-src ibm-plex-mono-src; 79 80 }; 81 81 + appview = self.callPackage ./nix/pkgs/appview.nix {}; 80 82 spindle = self.callPackage ./nix/pkgs/spindle.nix {}; 81 83 knot-unwrapped = self.callPackage ./nix/pkgs/knot-unwrapped.nix {}; 82 84 knot = self.callPackage ./nix/pkgs/knot.nix {}; ··· 92 94 staticPackages = mkPackageSet pkgs.pkgsStatic; 93 95 crossPackages = mkPackageSet pkgs.pkgsCross.gnu64.pkgsStatic; 94 96 in { 95 95 - appview = packages.appview; 96 96 - lexgen = packages.lexgen; 97 97 - knot = packages.knot; 98 98 - knot-unwrapped = packages.knot-unwrapped; 99 99 - spindle = packages.spindle; 100 100 - genjwks = packages.genjwks; 101 101 - sqlite-lib = packages.sqlite-lib; 97 97 + inherit (packages) appview appview-static-files lexgen genjwks spindle knot knot-unwrapped sqlite-lib; 102 98 103 99 pkgsStatic-appview = staticPackages.appview; 104 100 pkgsStatic-knot = staticPackages.knot; ··· 120 116 stdenv = pkgs.pkgsStatic.stdenv; 121 117 }; 122 118 in { 123 123 - default = staticShell { 119 119 + default = pkgs.mkShell { 124 120 nativeBuildInputs = [ 125 121 pkgs.go 126 122 pkgs.air ··· 131 127 pkgs.tailwindcss 132 128 pkgs.nixos-shell 133 129 pkgs.redis 130 130 + pkgs.coreutils # for those of us who are on systems that use busybox (alpine) 134 131 packages'.lexgen 135 132 ]; 136 133 shellHook = '' 137 137 - mkdir -p appview/pages/static/{fonts,icons} 138 138 - cp -f ${htmx-src} appview/pages/static/htmx.min.js 139 139 - cp -f ${htmx-ws-src} appview/pages/static/htmx-ext-ws.min.js 140 140 - cp -rf ${lucide-src}/*.svg appview/pages/static/icons/ 141 141 - cp -f ${inter-fonts-src}/web/InterVariable*.woff2 appview/pages/static/fonts/ 142 142 - cp -f ${inter-fonts-src}/web/InterDisplay*.woff2 appview/pages/static/fonts/ 143 143 - cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono-Regular.woff2 appview/pages/static/fonts/ 134 134 + mkdir -p appview/pages/static 135 135 + # no preserve is needed because watch-tailwind will want to be able to overwrite 136 136 + cp -fr --no-preserve=ownership ${packages'.appview-static-files}/* appview/pages/static 144 137 export TANGLED_OAUTH_JWKS="$(${packages'.genjwks}/bin/genjwks)" 145 138 ''; 146 139 env.CGO_ENABLED = 1; ··· 148 141 }); 149 142 apps = forAllSystems (system: let 150 143 pkgs = nixpkgsFor."${system}"; 144 144 + packages' = self.packages.${system}; 151 145 air-watcher = name: arg: 152 146 pkgs.writeShellScriptBin "run" 153 147 '' ··· 166 160 in { 167 161 watch-appview = { 168 162 type = "app"; 169 169 - program = ''${air-watcher "appview" ""}/bin/run''; 163 163 + program = toString (pkgs.writeShellScript "watch-appview" '' 164 164 + echo "copying static files to appview/pages/static..." 165 165 + ${pkgs.coreutils}/bin/cp -fr --no-preserve=ownership ${packages'.appview-static-files}/* appview/pages/static 166 166 + ${air-watcher "appview" ""}/bin/run 167 167 + ''); 170 168 }; 171 169 watch-knot = { 172 170 type = "app"; ··· 176 174 type = "app"; 177 175 program = ''${tailwind-watcher}/bin/run''; 178 176 }; 179 179 - vm = { 177 177 + vm = let 178 178 + system = 179 179 + if pkgs.stdenv.hostPlatform.isAarch64 180 180 + then "aarch64" 181 181 + else "x86_64"; 182 182 + 183 183 + nixos-shell = pkgs.nixos-shell.overrideAttrs (old: { 184 184 + patches = 185 185 + (old.patches or []) 186 186 + ++ [ 187 187 + # https://github.com/Mic92/nixos-shell/pull/94 188 188 + (pkgs.fetchpatch { 189 189 + name = "fix-foreign-vm.patch"; 190 190 + url = "https://github.com/Mic92/nixos-shell/commit/113e4cc55ae236b5b0b1fbd8b321e9b67c77580e.patch"; 191 191 + hash = "sha256-eauetBK0wXAOcd9PYbExokNCiwz2QyFnZ4FnwGi9VCo="; 192 192 + }) 193 193 + ]; 194 194 + }); 195 195 + in { 180 196 type = "app"; 181 197 program = toString (pkgs.writeShellScript "vm" '' 182 182 - ${pkgs.nixos-shell}/bin/nixos-shell --flake .#vm 198 198 + ${nixos-shell}/bin/nixos-shell --flake .#vm-${system} --guest-system ${system}-linux 183 199 ''); 184 200 }; 185 201 gomod2nix = { ··· 188 204 ${gomod2nix.legacyPackages.${system}.gomod2nix}/bin/gomod2nix generate --outdir ./nix 189 205 ''); 190 206 }; 207 207 + lexgen = { 208 208 + type = "app"; 209 209 + program = 210 210 + (pkgs.writeShellApplication { 211 211 + name = "lexgen"; 212 212 + text = '' 213 213 + if ! command -v lexgen > /dev/null; then 214 214 + echo "error: must be executed from devshell" 215 215 + exit 1 216 216 + fi 217 217 + 218 218 + rootDir=$(jj --ignore-working-copy root || git rev-parse --show-toplevel) || (echo "error: can't find repo root?"; exit 1) 219 219 + cd "$rootDir" 220 220 + 221 221 + rm api/tangled/* 222 222 + lexgen --build-file lexicon-build-config.json lexicons 223 223 + sed -i.bak 's/\tutil/\/\/\tutil/' api/tangled/* 224 224 + ${pkgs.gotools}/bin/goimports -w api/tangled/* 225 225 + go run cmd/gen.go 226 226 + lexgen --build-file lexicon-build-config.json lexicons 227 227 + rm api/tangled/*.bak 228 228 + ''; 229 229 + }) 230 230 + + /bin/lexgen; 231 231 + }; 191 232 }); 192 233 193 234 nixosModules.appview = { ··· 217 258 218 259 services.tangled-spindle.package = lib.mkDefault self.packages.${pkgs.system}.spindle; 219 260 }; 220 220 - nixosConfigurations.vm = import ./nix/vm.nix {inherit self nixpkgs;}; 261 261 + nixosConfigurations.vm-x86_64 = import ./nix/vm.nix { 262 262 + inherit self nixpkgs; 263 263 + system = "x86_64-linux"; 264 264 + }; 265 265 + nixosConfigurations.vm-aarch64 = import ./nix/vm.nix { 266 266 + inherit self nixpkgs; 267 267 + system = "aarch64-linux"; 268 268 + }; 221 269 }; 222 270 }

+4

input.css

··· 70 70 details summary::-webkit-details-marker { 71 71 display: none; 72 72 } 73 73 + 74 74 + code { 75 75 + @apply font-mono p-1 rounded bg-gray-100 dark:bg-gray-700; 76 76 + } 73 77 } 74 78 75 79 @layer components {

+19 -12

knotserver/git/post_receive.go

··· 3 3 import ( 4 4 "bufio" 5 5 "context" 6 6 + "errors" 6 7 "fmt" 7 8 "io" 8 9 "strings" ··· 57 58 ByEmail map[string]int 58 59 } 59 60 60 60 - func (g *GitRepo) RefUpdateMeta(line PostReceiveLine) RefUpdateMeta { 61 61 + func (g *GitRepo) RefUpdateMeta(line PostReceiveLine) (RefUpdateMeta, error) { 62 62 + var errs error 63 63 + 61 64 commitCount, err := g.newCommitCount(line) 62 62 - if err != nil { 63 63 - // TODO: log this 64 64 - } 65 65 + errors.Join(errs, err) 65 66 66 67 isDefaultRef, err := g.isDefaultBranch(line) 67 67 - if err != nil { 68 68 - // TODO: log this 69 69 - } 68 68 + errors.Join(errs, err) 70 69 71 70 ctx, cancel := context.WithTimeout(context.Background(), time.Second*2) 72 71 defer cancel() 73 72 breakdown, err := g.AnalyzeLanguages(ctx) 74 74 - if err != nil { 75 75 - // TODO: log this 76 76 - } 73 73 + errors.Join(errs, err) 77 74 78 75 return RefUpdateMeta{ 79 76 CommitCount: commitCount, 80 77 IsDefaultRef: isDefaultRef, 81 78 LangBreakdown: breakdown, 82 82 - } 79 79 + }, errs 83 80 } 84 81 85 82 func (g *GitRepo) newCommitCount(line PostReceiveLine) (CommitCount, error) { ··· 95 92 args := []string{fmt.Sprintf("--max-count=%d", 100)} 96 93 97 94 if line.OldSha.IsZero() { 98 98 - // just git rev-list <newsha> 95 95 + // git rev-list <newsha> ^other-branches --not ^this-branch 99 96 args = append(args, line.NewSha.String()) 97 97 + 98 98 + branches, _ := g.Branches() 99 99 + for _, b := range branches { 100 100 + if !strings.Contains(line.Ref, b.Name) { 101 101 + args = append(args, fmt.Sprintf("^%s", b.Name)) 102 102 + } 103 103 + } 104 104 + 105 105 + args = append(args, "--not") 106 106 + args = append(args, fmt.Sprintf("^%s", line.Ref)) 100 107 } else { 101 108 // git rev-list <oldsha>..<newsha> 102 109 args = append(args, fmt.Sprintf("%s..%s", line.OldSha.String(), line.NewSha.String()))

+5 -2

knotserver/internal.go

··· 3 3 import ( 4 4 "context" 5 5 "encoding/json" 6 6 + "errors" 6 7 "fmt" 7 8 "log/slog" 8 9 "net/http" ··· 145 146 return fmt.Errorf("failed to open git repo at ref %s: %w", line.Ref, err) 146 147 } 147 148 148 148 - meta := gr.RefUpdateMeta(line) 149 149 + var errs error 150 150 + meta, err := gr.RefUpdateMeta(line) 151 151 + errors.Join(errs, err) 149 152 150 153 metaRecord := meta.AsRecord() 151 154 ··· 169 172 EventJson: string(eventJson), 170 173 } 171 174 172 172 - return h.db.InsertEvent(event, h.n) 175 175 + return errors.Join(errs, h.db.InsertEvent(event, h.n)) 173 176 } 174 177 175 178 func (h *InternalHandle) triggerPipeline(clientMsgs *[]string, line git.PostReceiveLine, gitUserDid, repoDid, repoName string, pushOptions PushOptions) error {

+17

lexicons/pipeline/pipeline.json

··· 241 241 "type": "ref", 242 242 "ref": "#pair" 243 243 } 244 244 + }, 245 245 + "oidcs_tokens": { 246 246 + "type": "array", 247 247 + "items": { 248 248 + "type": "object", 249 249 + "required": [ 250 250 + "name" 251 251 + ], 252 252 + "properties": { 253 253 + "name": { 254 254 + "type": "string" 255 255 + }, 256 256 + "aud": { 257 257 + "type": "string" 258 258 + } 259 259 + } 260 260 + } 244 261 } 245 262 } 246 263 },

+6

nix/gomod2nix.toml

··· 66 66 [mod."github.com/cloudflare/circl"] 67 67 version = "v1.6.2-0.20250618153321-aa837fd1539d" 68 68 hash = "sha256-0s/i/XmMcuvPQ+qK9OIU5KxwYZyLVXRtdlYvIXRJT3Y=" 69 69 + [mod."github.com/cloudflare/cloudflare-go"] 70 70 + version = "v0.115.0" 71 71 + hash = "sha256-jezmDs6IsHA4rag7DzcHDfDgde0vU4iKgCN9+0XDViw=" 69 72 [mod."github.com/containerd/errdefs"] 70 73 version = "v1.0.0" 71 74 hash = "sha256-wMZGoeqvRhuovYCJx0Js4P3qFCNTZ/6Atea/kNYoPMI=" ··· 169 172 [mod."github.com/golang/mock"] 170 173 version = "v1.6.0" 171 174 hash = "sha256-fWdnMQisRbiRzGT3ISrUHovquzLRHWvcv1JEsJFZRno=" 175 175 + [mod."github.com/google/go-querystring"] 176 176 + version = "v1.1.0" 177 177 + hash = "sha256-itsKgKghuX26czU79cK6C2n+lc27jm5Dw1XbIRgwZJY=" 172 178 [mod."github.com/google/uuid"] 173 179 version = "v1.6.0" 174 180 hash = "sha256-VWl9sqUzdOuhW0KzQlv0gwwUQClYkmZwSydHG2sALYw="

+22

nix/modules/spindle.nix

··· 54 54 example = "did:plc:qfpnj4og54vl56wngdriaxug"; 55 55 description = "DID of owner (required)"; 56 56 }; 57 57 + 58 58 + secrets = { 59 59 + provider = mkOption { 60 60 + type = types.str; 61 61 + default = "sqlite"; 62 62 + description = "Backend to use for secret management, valid options are 'sqlite', and 'openbao'."; 63 63 + }; 64 64 + 65 65 + openbao = { 66 66 + proxyAddr = mkOption { 67 67 + type = types.str; 68 68 + default = "http://127.0.0.1:8200"; 69 69 + }; 70 70 + mount = mkOption { 71 71 + type = types.str; 72 72 + default = "spindle"; 73 73 + }; 74 74 + }; 75 75 + }; 57 76 }; 58 77 59 78 pipelines = { ··· 89 108 "SPINDLE_SERVER_JETSTREAM=${cfg.server.jetstreamEndpoint}" 90 109 "SPINDLE_SERVER_DEV=${lib.boolToString cfg.server.dev}" 91 110 "SPINDLE_SERVER_OWNER=${cfg.server.owner}" 111 111 + "SPINDLE_SERVER_SECRETS_PROVIDER=${cfg.server.secrets.provider}" 112 112 + "SPINDLE_SERVER_SECRETS_OPENBAO_PROXY_ADDR=${cfg.server.secrets.openbao.proxyAddr}" 113 113 + "SPINDLE_SERVER_SECRETS_OPENBAO_MOUNT=${cfg.server.secrets.openbao.mount}" 92 114 "SPINDLE_PIPELINES_NIXERY=${cfg.pipelines.nixery}" 93 115 "SPINDLE_PIPELINES_WORKFLOW_TIMEOUT=${cfg.pipelines.workflowTimeout}" 94 116 ];

+23

nix/pkgs/appview-static-files.nix

··· 1 1 + { 2 2 + runCommandLocal, 3 3 + htmx-src, 4 4 + htmx-ws-src, 5 5 + lucide-src, 6 6 + inter-fonts-src, 7 7 + ibm-plex-mono-src, 8 8 + sqlite-lib, 9 9 + tailwindcss, 10 10 + src, 11 11 + }: 12 12 + runCommandLocal "appview-static-files" {} '' 13 13 + mkdir -p $out/{fonts,icons} && cd $out 14 14 + cp -f ${htmx-src} htmx.min.js 15 15 + cp -f ${htmx-ws-src} htmx-ext-ws.min.js 16 16 + cp -rf ${lucide-src}/*.svg icons/ 17 17 + cp -f ${inter-fonts-src}/web/InterVariable*.woff2 fonts/ 18 18 + cp -f ${inter-fonts-src}/web/InterDisplay*.woff2 fonts/ 19 19 + cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono-Regular.woff2 fonts/ 20 20 + # tailwindcss -c $src/tailwind.config.js -i $src/input.css -o tw.css won't work 21 21 + # for whatever reason (produces broken css), so we are doing this instead 22 22 + cd ${src} && ${tailwindcss}/bin/tailwindcss -i input.css -o $out/tw.css 23 23 + ''

+5 -17

nix/pkgs/appview.nix

··· 1 1 { 2 2 buildGoApplication, 3 3 modules, 4 4 - htmx-src, 5 5 - htmx-ws-src, 6 6 - lucide-src, 7 7 - inter-fonts-src, 8 8 - ibm-plex-mono-src, 9 9 - tailwindcss, 4 4 + appview-static-files, 10 5 sqlite-lib, 11 11 - gitignoreSource, 6 6 + src, 12 7 }: 13 8 buildGoApplication { 14 9 pname = "appview"; 15 10 version = "0.1.0"; 16 16 - src = gitignoreSource ../..; 17 17 - inherit modules; 11 11 + inherit src modules; 18 12 19 13 postUnpack = '' 20 14 pushd source 21 21 - mkdir -p appview/pages/static/{fonts,icons} 22 22 - cp -f ${htmx-src} appview/pages/static/htmx.min.js 23 23 - cp -f ${htmx-ws-src} appview/pages/static/htmx-ext-ws.min.js 24 24 - cp -rf ${lucide-src}/*.svg appview/pages/static/icons/ 25 25 - cp -f ${inter-fonts-src}/web/InterVariable*.woff2 appview/pages/static/fonts/ 26 26 - cp -f ${inter-fonts-src}/web/InterDisplay*.woff2 appview/pages/static/fonts/ 27 27 - cp -f ${ibm-plex-mono-src}/fonts/complete/woff2/IBMPlexMono-Regular.woff2 appview/pages/static/fonts/ 28 28 - ${tailwindcss}/bin/tailwindcss -i input.css -o appview/pages/static/tw.css 15 15 + mkdir -p appview/pages/static 16 16 + cp -frv ${appview-static-files}/* appview/pages/static 29 17 popd 30 18 ''; 31 19

+2 -3

nix/pkgs/genjwks.nix

··· 1 1 { 2 2 - gitignoreSource, 2 2 + src, 3 3 buildGoApplication, 4 4 modules, 5 5 }: 6 6 buildGoApplication { 7 7 pname = "genjwks"; 8 8 version = "0.1.0"; 9 9 - src = gitignoreSource ../..; 10 10 - inherit modules; 9 9 + inherit src modules; 11 10 subPackages = ["cmd/genjwks"]; 12 11 doCheck = false; 13 12 CGO_ENABLED = 0;

+2 -3

nix/pkgs/knot-unwrapped.nix

··· 2 2 buildGoApplication, 3 3 modules, 4 4 sqlite-lib, 5 5 - gitignoreSource, 5 5 + src, 6 6 }: 7 7 buildGoApplication { 8 8 pname = "knot"; 9 9 version = "0.1.0"; 10 10 - src = gitignoreSource ../..; 11 11 - inherit modules; 10 10 + inherit src modules; 12 11 13 12 doCheck = false; 14 13

+1 -1

nix/pkgs/lexgen.nix

··· 7 7 version = "0.1.0"; 8 8 src = indigo; 9 9 subPackages = ["cmd/lexgen"]; 10 10 - vendorHash = "sha256-pGc29fgJFq8LP7n/pY1cv6ExZl88PAeFqIbFEhB3xXs="; 10 10 + vendorHash = "sha256-VbDrcN4r5b7utRFQzVsKgDsVgdQLSXl7oZ5kdPA/huw="; 11 11 doCheck = false; 12 12 }

+2 -3

nix/pkgs/spindle.nix

··· 2 2 buildGoApplication, 3 3 modules, 4 4 sqlite-lib, 5 5 - gitignoreSource, 5 5 + src, 6 6 }: 7 7 buildGoApplication { 8 8 pname = "spindle"; 9 9 version = "0.1.0"; 10 10 - src = gitignoreSource ../..; 11 11 - inherit modules; 10 10 + inherit src modules; 12 11 13 12 doCheck = false; 14 13

+81 -63

nix/vm.nix

··· 1 1 { 2 2 nixpkgs, 3 3 + system, 3 4 self, 4 4 - }: 5 5 - nixpkgs.lib.nixosSystem { 6 6 - system = "x86_64-linux"; 7 7 - modules = [ 8 8 - self.nixosModules.knot 9 9 - self.nixosModules.spindle 10 10 - ({ 11 11 - config, 12 12 - pkgs, 13 13 - ... 14 14 - }: { 15 15 - virtualisation = { 16 16 - memorySize = 2048; 17 17 - diskSize = 10 * 1024; 18 18 - cores = 2; 19 19 - forwardPorts = [ 20 20 - # ssh 21 21 - { 22 22 - from = "host"; 23 23 - host.port = 2222; 24 24 - guest.port = 22; 25 25 - } 26 26 - # knot 27 27 - { 28 28 - from = "host"; 29 29 - host.port = 6000; 30 30 - guest.port = 6000; 31 31 - } 32 32 - # spindle 33 33 - { 34 34 - from = "host"; 35 35 - host.port = 6555; 36 36 - guest.port = 6555; 37 37 - } 5 5 + }: let 6 6 + envVar = name: let 7 7 + var = builtins.getEnv name; 8 8 + in 9 9 + if var == "" 10 10 + then throw "\$${name} must be defined, see docs/hacking.md for more details" 11 11 + else var; 12 12 + in 13 13 + nixpkgs.lib.nixosSystem { 14 14 + inherit system; 15 15 + modules = [ 16 16 + self.nixosModules.knot 17 17 + self.nixosModules.spindle 18 18 + ({ 19 19 + config, 20 20 + pkgs, 21 21 + ... 22 22 + }: { 23 23 + nixos-shell = { 24 24 + inheritPath = false; 25 25 + mounts = { 26 26 + mountHome = false; 27 27 + mountNixProfile = false; 28 28 + }; 29 29 + }; 30 30 + virtualisation = { 31 31 + memorySize = 2048; 32 32 + diskSize = 10 * 1024; 33 33 + cores = 2; 34 34 + forwardPorts = [ 35 35 + # ssh 36 36 + { 37 37 + from = "host"; 38 38 + host.port = 2222; 39 39 + guest.port = 22; 40 40 + } 41 41 + # knot 42 42 + { 43 43 + from = "host"; 44 44 + host.port = 6000; 45 45 + guest.port = 6000; 46 46 + } 47 47 + # spindle 48 48 + { 49 49 + from = "host"; 50 50 + host.port = 6555; 51 51 + guest.port = 6555; 52 52 + } 53 53 + ]; 54 54 + }; 55 55 + services.getty.autologinUser = "root"; 56 56 + environment.systemPackages = with pkgs; [curl vim git sqlite litecli]; 57 57 + systemd.tmpfiles.rules = let 58 58 + u = config.services.tangled-knot.gitUser; 59 59 + g = config.services.tangled-knot.gitUser; 60 60 + in [ 61 61 + "d /var/lib/knot 0770 ${u} ${g} - -" # Create the directory first 62 62 + "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=${envVar "TANGLED_VM_KNOT_SECRET"}" 38 63 ]; 39 39 - }; 40 40 - services.getty.autologinUser = "root"; 41 41 - environment.systemPackages = with pkgs; [curl vim git]; 42 42 - systemd.tmpfiles.rules = let 43 43 - u = config.services.tangled-knot.gitUser; 44 44 - g = config.services.tangled-knot.gitUser; 45 45 - in [ 46 46 - "d /var/lib/knot 0770 ${u} ${g} - -" # Create the directory first 47 47 - "f+ /var/lib/knot/secret 0660 ${u} ${g} - KNOT_SERVER_SECRET=168c426fa6d9829fcbe85c96bdf144e800fb9737d6ca87f21acc543b1aa3e440" 48 48 - ]; 49 49 - services.tangled-knot = { 50 50 - enable = true; 51 51 - motd = "Welcome to the development knot!\n"; 52 52 - server = { 53 53 - secretFile = "/var/lib/knot/secret"; 54 54 - hostname = "localhost:6000"; 55 55 - listenAddr = "0.0.0.0:6000"; 64 64 + services.tangled-knot = { 65 65 + enable = true; 66 66 + motd = "Welcome to the development knot!\n"; 67 67 + server = { 68 68 + secretFile = "/var/lib/knot/secret"; 69 69 + hostname = "localhost:6000"; 70 70 + listenAddr = "0.0.0.0:6000"; 71 71 + }; 56 72 }; 57 57 - }; 58 58 - services.tangled-spindle = { 59 59 - enable = true; 60 60 - server = { 61 61 - owner = "did:plc:qfpnj4og54vl56wngdriaxug"; 62 62 - hostname = "localhost:6555"; 63 63 - listenAddr = "0.0.0.0:6555"; 64 64 - dev = true; 73 73 + services.tangled-spindle = { 74 74 + enable = true; 75 75 + server = { 76 76 + owner = envVar "TANGLED_VM_SPINDLE_OWNER"; 77 77 + hostname = "localhost:6555"; 78 78 + listenAddr = "0.0.0.0:6555"; 79 79 + dev = true; 80 80 + secrets = { 81 81 + provider = "sqlite"; 82 82 + }; 83 83 + }; 65 84 }; 66 66 - }; 67 67 - }) 68 68 - ]; 69 69 - } 85 85 + }) 86 86 + ]; 87 87 + }

+15

spindle/db/db.go

··· 45 45 unique(owner, name) 46 46 ); 47 47 48 48 + create table if not exists spindle_members ( 49 49 + -- identifiers for the record 50 50 + id integer primary key autoincrement, 51 51 + did text not null, 52 52 + rkey text not null, 53 53 + 54 54 + -- data 55 55 + instance text not null, 56 56 + subject text not null, 57 57 + created text not null default (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')), 58 58 + 59 59 + -- constraints 60 60 + unique (did, instance, subject) 61 61 + ); 62 62 + 48 63 -- status event for a single workflow 49 64 create table if not exists events ( 50 65 rkey text not null,

+59

spindle/db/member.go

··· 1 1 + package db 2 2 + 3 3 + import ( 4 4 + "time" 5 5 + 6 6 + "github.com/bluesky-social/indigo/atproto/syntax" 7 7 + ) 8 8 + 9 9 + type SpindleMember struct { 10 10 + Id int 11 11 + Did syntax.DID // owner of the record 12 12 + Rkey string // rkey of the record 13 13 + Instance string 14 14 + Subject syntax.DID // the member being added 15 15 + Created time.Time 16 16 + } 17 17 + 18 18 + func AddSpindleMember(db *DB, member SpindleMember) error { 19 19 + _, err := db.Exec( 20 20 + `insert or ignore into spindle_members (did, rkey, instance, subject) values (?, ?, ?, ?)`, 21 21 + member.Did, 22 22 + member.Rkey, 23 23 + member.Instance, 24 24 + member.Subject, 25 25 + ) 26 26 + return err 27 27 + } 28 28 + 29 29 + func RemoveSpindleMember(db *DB, owner_did, rkey string) error { 30 30 + _, err := db.Exec( 31 31 + "delete from spindle_members where did = ? and rkey = ?", 32 32 + owner_did, 33 33 + rkey, 34 34 + ) 35 35 + return err 36 36 + } 37 37 + 38 38 + func GetSpindleMember(db *DB, did, rkey string) (*SpindleMember, error) { 39 39 + query := 40 40 + `select id, did, rkey, instance, subject, created 41 41 + from spindle_members 42 42 + where did = ? and rkey = ?` 43 43 + 44 44 + var member SpindleMember 45 45 + var createdAt string 46 46 + err := db.QueryRow(query, did, rkey).Scan( 47 47 + &member.Id, 48 48 + &member.Did, 49 49 + &member.Rkey, 50 50 + &member.Instance, 51 51 + &member.Subject, 52 52 + &createdAt, 53 53 + ) 54 54 + if err != nil { 55 55 + return nil, err 56 56 + } 57 57 + 58 58 + return &member, nil 59 59 + }

+15 -3

spindle/engine/engine.go

··· 25 25 "tangled.sh/tangled.sh/core/spindle/config" 26 26 "tangled.sh/tangled.sh/core/spindle/db" 27 27 "tangled.sh/tangled.sh/core/spindle/models" 28 28 + "tangled.sh/tangled.sh/core/spindle/oidc" 28 29 "tangled.sh/tangled.sh/core/spindle/secrets" 29 30 ) 30 31 ··· 41 42 n *notifier.Notifier 42 43 cfg *config.Config 43 44 vault secrets.Manager 45 45 + oidc oidc.OidcTokenGenerator 44 46 45 47 cleanupMu sync.Mutex 46 48 cleanup map[string][]cleanupFunc 47 49 } 48 50 49 49 - func New(ctx context.Context, cfg *config.Config, db *db.DB, n *notifier.Notifier, vault secrets.Manager) (*Engine, error) { 51 51 + func New(ctx context.Context, cfg *config.Config, db *db.DB, n *notifier.Notifier, vault secrets.Manager, oidc *oidc.OidcTokenGenerator) (*Engine, error) { 50 52 dcli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation()) 51 53 if err != nil { 52 54 return nil, err ··· 61 63 n: n, 62 64 cfg: cfg, 63 65 vault: vault, 66 66 + oidc: *oidc, 64 67 } 65 68 66 69 e.cleanup = make(map[string][]cleanupFunc) ··· 124 127 ctx, cancel := context.WithTimeout(ctx, workflowTimeout) 125 128 defer cancel() 126 129 127 127 - err = e.StartSteps(ctx, wid, w, allSecrets) 130 130 + err = e.StartSteps(ctx, wid, w, allSecrets, pipeline, pipelineId) 128 131 if err != nil { 129 132 if errors.Is(err, ErrTimedOut) { 130 133 dbErr := e.db.StatusTimeout(wid, e.n) ··· 202 205 // ONLY marks pipeline as failed if container's exit code is non-zero. 203 206 // All other errors are bubbled up. 204 207 // Fixed version of the step execution logic 205 205 - func (e *Engine) StartSteps(ctx context.Context, wid models.WorkflowId, w models.Workflow, secrets []secrets.UnlockedSecret) error { 208 208 + func (e *Engine) StartSteps(ctx context.Context, wid models.WorkflowId, w models.Workflow, secrets []secrets.UnlockedSecret, pipeline *models.Pipeline, pipelineId models.PipelineId) error { 206 209 workflowEnvs := ConstructEnvs(w.Environment) 207 210 for _, s := range secrets { 208 211 workflowEnvs.AddEnv(s.Key, s.Value) ··· 221 224 } 222 225 envs.AddEnv("HOME", workspaceDir) 223 226 e.l.Debug("envs for step", "step", step.Name, "envs", envs.Slice()) 227 227 + 228 228 + for _, t := range step.OidcTokens { 229 229 + token, err := e.oidc.CreateToken(t, pipelineId, pipeline.RepoOwner, pipeline.RepoName) 230 230 + if err != nil { 231 231 + e.l.Error("failed to get OIDC token", "error", err, "token", t.Name) 232 232 + return fmt.Errorf("getting OIDC token: %w", err) 233 233 + } 234 234 + envs.AddEnv(t.Name, token) 235 235 + } 224 236 225 237 hostConfig := hostConfig(wid) 226 238 resp, err := e.docker.ContainerCreate(ctx, &container.Config{

+39 -4

spindle/ingester.go

··· 5 5 "encoding/json" 6 6 "errors" 7 7 "fmt" 8 8 + "time" 8 9 9 10 "tangled.sh/tangled.sh/core/api/tangled" 10 11 "tangled.sh/tangled.sh/core/eventconsumer" 11 12 "tangled.sh/tangled.sh/core/idresolver" 12 13 "tangled.sh/tangled.sh/core/rbac" 14 14 + "tangled.sh/tangled.sh/core/spindle/db" 13 15 14 16 comatproto "github.com/bluesky-social/indigo/api/atproto" 15 17 "github.com/bluesky-social/indigo/atproto/identity" ··· 50 52 } 51 53 52 54 func (s *Spindle) ingestMember(_ context.Context, e *models.Event) error { 55 55 + var err error 53 56 did := e.Did 54 54 - var err error 57 57 + rkey := e.Commit.RKey 55 58 56 59 l := s.l.With("component", "ingester", "record", tangled.SpindleMemberNSID) 57 60 ··· 66 69 } 67 70 68 71 domain := s.cfg.Server.Hostname 69 69 - if s.cfg.Server.Dev { 70 70 - domain = s.cfg.Server.ListenAddr 71 71 - } 72 72 recordInstance := record.Instance 73 73 74 74 if recordInstance != domain { ··· 82 82 return fmt.Errorf("failed to enforce permissions: %w", err) 83 83 } 84 84 85 85 + if err := db.AddSpindleMember(s.db, db.SpindleMember{ 86 86 + Did: syntax.DID(did), 87 87 + Rkey: rkey, 88 88 + Instance: recordInstance, 89 89 + Subject: syntax.DID(record.Subject), 90 90 + Created: time.Now(), 91 91 + }); err != nil { 92 92 + l.Error("failed to add member", "error", err) 93 93 + return fmt.Errorf("failed to add member: %w", err) 94 94 + } 95 95 + 85 96 if err := s.e.AddSpindleMember(rbacDomain, record.Subject); err != nil { 86 97 l.Error("failed to add member", "error", err) 87 98 return fmt.Errorf("failed to add member: %w", err) ··· 95 106 s.jc.AddDid(record.Subject) 96 107 97 108 return nil 109 109 + 110 110 + case models.CommitOperationDelete: 111 111 + record, err := db.GetSpindleMember(s.db, did, rkey) 112 112 + if err != nil { 113 113 + l.Error("failed to find member", "error", err) 114 114 + return fmt.Errorf("failed to find member: %w", err) 115 115 + } 116 116 + 117 117 + if err := db.RemoveSpindleMember(s.db, did, rkey); err != nil { 118 118 + l.Error("failed to remove member", "error", err) 119 119 + return fmt.Errorf("failed to remove member: %w", err) 120 120 + } 121 121 + 122 122 + if err := s.e.RemoveSpindleMember(rbacDomain, record.Subject.String()); err != nil { 123 123 + l.Error("failed to add member", "error", err) 124 124 + return fmt.Errorf("failed to add member: %w", err) 125 125 + } 126 126 + l.Info("added member from firehose", "member", record.Subject) 127 127 + 128 128 + if err := s.db.RemoveDid(record.Subject.String()); err != nil { 129 129 + l.Error("failed to add did", "error", err) 130 130 + return fmt.Errorf("failed to add did: %w", err) 131 131 + } 132 132 + s.jc.RemoveDid(record.Subject.String()) 98 133 99 134 } 100 135 return nil

+14

spindle/models/pipeline.go

··· 18 18 Name string 19 19 Environment map[string]string 20 20 Kind StepKind 21 21 + OidcTokens []OidcToken 21 22 } 22 23 23 24 type StepKind int ··· 28 29 // steps defined by the user in the original pipeline 29 30 StepKindUser 30 31 ) 32 32 + 33 33 + type OidcToken struct { 34 34 + Name string 35 35 + Aud *string 36 36 + } 31 37 32 38 type Workflow struct { 33 39 Steps []Step ··· 60 66 sstep.Name = tstep.Name 61 67 sstep.Kind = StepKindUser 62 68 swf.Steps = append(swf.Steps, sstep) 69 69 + 70 70 + sstep.OidcTokens = make([]OidcToken, 0, len(tstep.Oidcs_tokens)) 71 71 + for _, ttoken := range tstep.Oidcs_tokens { 72 72 + sstep.OidcTokens = append(sstep.OidcTokens, OidcToken{ 73 73 + Name: ttoken.Name, 74 74 + Aud: ttoken.Aud, 75 75 + }) 76 76 + } 63 77 } 64 78 swf.Name = twf.Name 65 79 swf.Environment = workflowEnvToMap(twf.Environment)

+320

spindle/oidc/oidc.go

··· 1 1 + package oidc 2 2 + 3 3 + import ( 4 4 + "crypto/ecdsa" 5 5 + "crypto/elliptic" 6 6 + "crypto/rand" 7 7 + "encoding/json" 8 8 + "fmt" 9 9 + "log/slog" 10 10 + "net/http" 11 11 + "reflect" 12 12 + "time" 13 13 + 14 14 + "github.com/lestrrat-go/jwx/v2/jwa" 15 15 + "github.com/lestrrat-go/jwx/v2/jwk" 16 16 + "github.com/lestrrat-go/jwx/v2/jwt" 17 17 + "tangled.sh/tangled.sh/core/spindle/models" 18 18 + ) 19 19 + 20 20 + const JWKSPath = "/.well-known/jwks.json" 21 21 + const WebFingerPath = "/.well-known/webfinger" 22 22 + 23 23 + // OidcKeyPair represents an OIDC key pair with both private and public keys 24 24 + type OidcKeyPair struct { 25 25 + privateKey *ecdsa.PrivateKey 26 26 + publicKey *ecdsa.PublicKey 27 27 + keyID string 28 28 + jwkKey jwk.Key 29 29 + } 30 30 + 31 31 + // OidcTokenGenerator handles OIDC token generation and key management with rotation 32 32 + type OidcTokenGenerator struct { 33 33 + currentKeyPair OidcKeyPair 34 34 + nextKeyPair *OidcKeyPair 35 35 + l *slog.Logger 36 36 + issuer string 37 37 + claimsSupported []string 38 38 + } 39 39 + 40 40 + // NewOidcTokenGenerator creates a new OIDC token generator with in-memory key management 41 41 + func NewOidcTokenGenerator(issuer string) (*OidcTokenGenerator, error) { 42 42 + // Create new keys 43 43 + currentKeyPair, err := NewOidcKeyPair() 44 44 + if err != nil { 45 45 + return nil, fmt.Errorf("failed to generate initial current key pair: %w", err) 46 46 + } 47 47 + 48 48 + // Use reflection to get claim field names from OidcClaims 49 49 + var claimsSupported []string 50 50 + claimsType := reflect.TypeOf(OidcClaims{}) 51 51 + for i := 0; i < claimsType.NumField(); i++ { 52 52 + tag := claimsType.Field(i).Tag.Get("json") 53 53 + if tag != "" { 54 54 + claimsSupported = append(claimsSupported, tag) 55 55 + } 56 56 + } 57 57 + 58 58 + return &OidcTokenGenerator{ 59 59 + issuer: issuer, 60 60 + currentKeyPair: *currentKeyPair, 61 61 + claimsSupported: claimsSupported, 62 62 + }, nil 63 63 + } 64 64 + 65 65 + // NewOidcKeyPair generates a new ECDSA key pair for OIDC token signing 66 66 + func NewOidcKeyPair() (*OidcKeyPair, error) { 67 67 + privKey, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) 68 68 + if err != nil { 69 69 + return nil, fmt.Errorf("failed to generate ECDSA key: %w", err) 70 70 + } 71 71 + 72 72 + keyID := fmt.Sprintf("spindle-%d", time.Now().Unix()) 73 73 + 74 74 + // Create JWK from the private key 75 75 + jwkKey, err := jwk.FromRaw(privKey) 76 76 + if err != nil { 77 77 + return nil, fmt.Errorf("failed to create JWK from private key: %w", err) 78 78 + } 79 79 + 80 80 + // Set the key ID 81 81 + if err := jwkKey.Set(jwk.KeyIDKey, keyID); err != nil { 82 82 + return nil, fmt.Errorf("failed to set key ID: %w", err) 83 83 + } 84 84 + 85 85 + // Set algorithm 86 86 + if err := jwkKey.Set(jwk.AlgorithmKey, jwa.ES256); err != nil { 87 87 + return nil, fmt.Errorf("failed to set algorithm: %w", err) 88 88 + } 89 89 + 90 90 + // Set usage 91 91 + if err := jwkKey.Set(jwk.KeyUsageKey, "sig"); err != nil { 92 92 + return nil, fmt.Errorf("failed to set key usage: %w", err) 93 93 + } 94 94 + 95 95 + return &OidcKeyPair{ 96 96 + privateKey: privKey, 97 97 + publicKey: &privKey.PublicKey, 98 98 + keyID: keyID, 99 99 + jwkKey: jwkKey, 100 100 + }, nil 101 101 + } 102 102 + 103 103 + func (k *OidcKeyPair) GetKeyID() string { 104 104 + return k.keyID 105 105 + } 106 106 + 107 107 + // RotateKeys performs key rotation: generates new next key, moves next to current 108 108 + func (g *OidcTokenGenerator) RotateKeys() error { 109 109 + // Generate a new key pair for the next key 110 110 + newNextKeyPair, err := NewOidcKeyPair() 111 111 + if err != nil { 112 112 + return fmt.Errorf("failed to generate new next key pair: %w", err) 113 113 + } 114 114 + 115 115 + // Perform rotation: next becomes current, new key becomes next 116 116 + g.currentKeyPair = *g.nextKeyPair 117 117 + g.nextKeyPair = newNextKeyPair 118 118 + 119 119 + return nil 120 120 + } 121 121 + 122 122 + // OidcClaims represents the claims in an OIDC token 123 123 + type OidcClaims struct { 124 124 + // Standard JWT claims 125 125 + Issuer string `json:"iss"` 126 126 + Subject string `json:"sub"` 127 127 + Audience string `json:"aud"` 128 128 + ExpiresAt int64 `json:"exp"` 129 129 + NotBefore int64 `json:"nbf"` 130 130 + IssuedAt int64 `json:"iat"` 131 131 + JWTID string `json:"jti"` 132 132 + } 133 133 + 134 134 + // CreateToken creates a signed JWT token for the given OidcToken and pipeline context 135 135 + func (g *OidcTokenGenerator) CreateToken( 136 136 + oidcToken models.OidcToken, 137 137 + pipelineId models.PipelineId, 138 138 + repoOwner, repoName string, 139 139 + ) (string, error) { 140 140 + now := time.Now() 141 141 + exp := now.Add(5 * time.Minute) 142 142 + 143 143 + // Determine audience - use the provided audience or default to issuer 144 144 + audience := g.issuer 145 145 + if oidcToken.Aud != nil && *oidcToken.Aud != "" { 146 146 + audience = *oidcToken.Aud 147 147 + } 148 148 + 149 149 + pipelineUri := pipelineId.AtUri() 150 150 + 151 151 + // Create claims 152 152 + claims := OidcClaims{ 153 153 + Issuer: g.issuer, 154 154 + // Hardcode the did as did:web of the issuer. At some point knots will have their own DIDs which will be used here 155 155 + Subject: pipelineUri.String(), 156 156 + Audience: audience, 157 157 + ExpiresAt: exp.Unix(), 158 158 + NotBefore: now.Unix(), 159 159 + IssuedAt: now.Unix(), 160 160 + // Repo owner, name, and id should be global unique but we add timestamp to ensure uniqueness 161 161 + JWTID: fmt.Sprintf("%s/%s-%s-%d", repoOwner, repoName, pipelineUri.RecordKey(), now.Unix()), 162 162 + } 163 163 + 164 164 + // Create JWT token 165 165 + token := jwt.New() 166 166 + 167 167 + // Set all claims 168 168 + if err := token.Set(jwt.IssuerKey, claims.Issuer); err != nil { 169 169 + return "", fmt.Errorf("failed to set issuer: %w", err) 170 170 + } 171 171 + if err := token.Set(jwt.SubjectKey, claims.Subject); err != nil { 172 172 + return "", fmt.Errorf("failed to set subject: %w", err) 173 173 + } 174 174 + if err := token.Set(jwt.AudienceKey, claims.Audience); err != nil { 175 175 + return "", fmt.Errorf("failed to set audience: %w", err) 176 176 + } 177 177 + if err := token.Set(jwt.ExpirationKey, claims.ExpiresAt); err != nil { 178 178 + return "", fmt.Errorf("failed to set expiration: %w", err) 179 179 + } 180 180 + if err := token.Set(jwt.NotBeforeKey, claims.NotBefore); err != nil { 181 181 + return "", fmt.Errorf("failed to set not before: %w", err) 182 182 + } 183 183 + if err := token.Set(jwt.IssuedAtKey, claims.IssuedAt); err != nil { 184 184 + return "", fmt.Errorf("failed to set issued at: %w", err) 185 185 + } 186 186 + if err := token.Set(jwt.JwtIDKey, claims.JWTID); err != nil { 187 187 + return "", fmt.Errorf("failed to set JWT ID: %w", err) 188 188 + } 189 189 + 190 190 + // Sign the token with the current key 191 191 + signedToken, err := jwt.Sign(token, jwt.WithKey(jwa.ES256, g.currentKeyPair.jwkKey)) 192 192 + if err != nil { 193 193 + return "", fmt.Errorf("failed to sign token: %w", err) 194 194 + } 195 195 + 196 196 + return string(signedToken), nil 197 197 + } 198 198 + 199 199 + // JWKSHandler serves the JWKS endpoint (const JWKSPath) 200 200 + func (g *OidcTokenGenerator) JWKSHandler(w http.ResponseWriter, r *http.Request) { 201 201 + pubJWK, err := jwk.PublicKeyOf(g.currentKeyPair.jwkKey) 202 202 + if err != nil { 203 203 + http.Error(w, fmt.Sprintf("failed to extract current public key from JWK: %v", err), http.StatusInternalServerError) 204 204 + return 205 205 + } 206 206 + var keys []jwk.Key 207 207 + keys = append(keys, pubJWK) 208 208 + 209 209 + // Add next key if available 210 210 + if g.nextKeyPair != nil { 211 211 + pubJWK, err := jwk.PublicKeyOf(g.nextKeyPair.jwkKey) 212 212 + if err != nil { 213 213 + http.Error(w, fmt.Sprintf("failed to extract next public key from JWK: %v", err), http.StatusInternalServerError) 214 214 + return 215 215 + } 216 216 + keys = append(keys, pubJWK) 217 217 + } 218 218 + 219 219 + if len(keys) == 0 { 220 220 + http.Error(w, "no keys available for JWKS", http.StatusInternalServerError) 221 221 + return 222 222 + } 223 223 + 224 224 + jwks := map[string]interface{}{ 225 225 + "keys": keys, 226 226 + } 227 227 + 228 228 + w.Header().Set("Content-Type", "application/json") 229 229 + if err := json.NewEncoder(w).Encode(jwks); err != nil { 230 230 + http.Error(w, fmt.Sprintf("failed to encode JWKS: %v", err), http.StatusInternalServerError) 231 231 + } 232 232 + } 233 233 + 234 234 + // DiscoveryHandler serves the OIDC discovery endpoint (/.well-known/openid-configuration) 235 235 + func (g *OidcTokenGenerator) DiscoveryHandler(w http.ResponseWriter, r *http.Request) { 236 236 + 237 237 + responseTypesSupported := []string{ 238 238 + "id_token", 239 239 + } 240 240 + 241 241 + subjectTypesSupported := []string{ 242 242 + "public", 243 243 + } 244 244 + 245 245 + idTokenSigningAlgValuesSupported := []string{ 246 246 + jwa.RS256.String(), 247 247 + } 248 248 + 249 249 + scopesSupported := []string{ 250 250 + "openid", 251 251 + } 252 252 + 253 253 + discovery := map[string]interface{}{ 254 254 + "issuer": g.issuer, 255 255 + "jwks_uri": fmt.Sprintf("%s%s", g.issuer, JWKSPath), 256 256 + "claims_supported": g.claimsSupported, 257 257 + "response_types_supported": responseTypesSupported, 258 258 + "subject_types_supported": subjectTypesSupported, 259 259 + "id_token_signing_alg_values_supported": idTokenSigningAlgValuesSupported, 260 260 + "scopes_supported": scopesSupported, 261 261 + } 262 262 + w.Header().Set("Content-Type", "application/json") 263 263 + if err := json.NewEncoder(w).Encode(discovery); err != nil { 264 264 + http.Error(w, fmt.Sprintf("failed to encode discovery document: %v", err), http.StatusInternalServerError) 265 265 + } 266 266 + } 267 267 + 268 268 + // WebFingerResponse represents the WebFinger response format 269 269 + type WebFingerResponse struct { 270 270 + Subject string `json:"subject"` 271 271 + Links []WebFingerLink `json:"links"` 272 272 + } 273 273 + 274 274 + // WebFingerLink represents a link in the WebFinger response 275 275 + type WebFingerLink struct { 276 276 + Rel string `json:"rel"` 277 277 + Href string `json:"href"` 278 278 + } 279 279 + 280 280 + // WebFingerHandler serves the WebFinger endpoint for issuer discovery (/.well-known/webfinger) 281 281 + // This implements OpenID Connect Discovery 1.0 Section 2 - OpenID Provider Issuer Discovery 282 282 + func (g *OidcTokenGenerator) WebFingerHandler(w http.ResponseWriter, r *http.Request) { 283 283 + // Parse query parameters 284 284 + resource := r.URL.Query().Get("resource") 285 285 + rel := r.URL.Query().Get("rel") 286 286 + 287 287 + // Check if this is an OpenID Connect issuer discovery request 288 288 + expectedRel := "http://openid.net/specs/connect/1.0/issuer" 289 289 + if rel != "" && rel != expectedRel { 290 290 + http.Error(w, "unsupported rel parameter", http.StatusBadRequest) 291 291 + return 292 292 + } 293 293 + 294 294 + if resource == "" { 295 295 + http.Error(w, "resource parameter is required", http.StatusBadRequest) 296 296 + return 297 297 + } 298 298 + 299 299 + // Check if the resource matches the issuer 300 300 + if resource != g.issuer { 301 301 + http.Error(w, "issuer not found", http.StatusNotFound) 302 302 + return 303 303 + } 304 304 + 305 305 + // Create the WebFinger response 306 306 + response := WebFingerResponse{ 307 307 + Subject: resource, 308 308 + Links: []WebFingerLink{ 309 309 + { 310 310 + Rel: expectedRel, 311 311 + Href: g.issuer, 312 312 + }, 313 313 + }, 314 314 + } 315 315 + 316 316 + w.Header().Set("Content-Type", "application/jrd+json") 317 317 + if err := json.NewEncoder(w).Encode(response); err != nil { 318 318 + http.Error(w, fmt.Sprintf("failed to encode WebFinger response: %v", err), http.StatusInternalServerError) 319 319 + } 320 320 + }

+1 -1

spindle/secrets/openbao.go

··· 132 132 return ErrKeyNotFound 133 133 } 134 134 135 135 - err = v.client.KVv2(v.mountPath).Delete(ctx, secretPath) 135 135 + err = v.client.KVv2(v.mountPath).DeleteMetadata(ctx, secretPath) 136 136 if err != nil { 137 137 return fmt.Errorf("failed to delete secret from openbao: %w", err) 138 138 }

+26 -4

spindle/server.go

··· 21 21 "tangled.sh/tangled.sh/core/spindle/db" 22 22 "tangled.sh/tangled.sh/core/spindle/engine" 23 23 "tangled.sh/tangled.sh/core/spindle/models" 24 24 + "tangled.sh/tangled.sh/core/spindle/oidc" 24 25 "tangled.sh/tangled.sh/core/spindle/queue" 25 26 "tangled.sh/tangled.sh/core/spindle/secrets" 26 27 "tangled.sh/tangled.sh/core/spindle/xrpc" ··· 93 94 return fmt.Errorf("unknown secrets provider: %s", cfg.Server.Secrets.Provider) 94 95 } 95 96 96 96 - eng, err := engine.New(ctx, cfg, d, &n, vault) 97 97 + oidc, err := oidc.NewOidcTokenGenerator(fmt.Sprintf("https://%s", cfg.Server.Hostname)) 98 98 + if err != nil { 99 99 + return fmt.Errorf("failed to create OIDC token generator: %w", err) 100 100 + } 101 101 + 102 102 + eng, err := engine.New(ctx, cfg, d, &n, vault, oidc) 97 103 if err != nil { 98 104 return err 99 105 } 100 106 101 101 - jq := queue.NewQueue(100, 2) 107 107 + jq := queue.NewQueue(100, 5) 102 108 103 109 collections := []string{ 104 110 tangled.SpindleMemberNSID, ··· 111 117 } 112 118 jc.AddDid(cfg.Server.Owner) 113 119 120 120 + // Check if the spindle knows about any Dids; 121 121 + dids, err := d.GetAllDids() 122 122 + if err != nil { 123 123 + return fmt.Errorf("failed to get all dids: %w", err) 124 124 + } 125 125 + for _, d := range dids { 126 126 + jc.AddDid(d) 127 127 + } 128 128 + 114 129 resolver := idresolver.DefaultResolver() 115 130 116 131 spindle := Spindle{ ··· 179 194 }() 180 195 181 196 logger.Info("starting spindle server", "address", cfg.Server.ListenAddr) 182 182 - logger.Error("server error", "error", http.ListenAndServe(cfg.Server.ListenAddr, spindle.Router())) 197 197 + logger.Error("server error", "error", http.ListenAndServe(cfg.Server.ListenAddr, spindle.Router(oidc))) 183 198 184 199 return nil 185 200 } 186 201 187 187 - func (s *Spindle) Router() http.Handler { 202 202 + func (s *Spindle) Router(oidcg *oidc.OidcTokenGenerator) http.Handler { 188 203 mux := chi.NewRouter() 189 204 190 205 mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { ··· 195 210 w.Write([]byte(s.cfg.Server.Owner)) 196 211 }) 197 212 mux.HandleFunc("/logs/{knot}/{rkey}/{name}", s.Logs) 213 213 + mux.HandleFunc(oidc.JWKSPath, oidcg.JWKSHandler) 214 214 + mux.HandleFunc("/.well-known/oidc-configuration", oidcg.DiscoveryHandler) 215 215 + mux.HandleFunc(oidc.WebFingerPath, oidcg.WebFingerHandler) 198 216 199 217 mux.Mount("/xrpc", s.XrpcRouter()) 200 218 return mux ··· 231 249 232 250 if tpl.TriggerMetadata.Repo == nil { 233 251 return fmt.Errorf("no repo data found") 252 252 + } 253 253 + 254 254 + if src.Key() != tpl.TriggerMetadata.Repo.Knot { 255 255 + return fmt.Errorf("repo knot does not match event source: %s != %s", src.Key(), tpl.TriggerMetadata.Repo.Knot) 234 256 } 235 257 236 258 // filter by repos