Something went wrong. Try again.
Monorepo for Tangled
Something went wrong. Try again.
7.8 kB · 256 lines
Go
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257package xrpc
import ( "bytes" "encoding/json" "errors" "log/slog" "net/http" "os" "path/filepath" "strings"
"github.com/bluesky-social/indigo/atproto/syntax" securejoin "github.com/cyphar/filepath-securejoin" "github.com/go-chi/chi/v5" "tangled.org/core/api/tangled" "tangled.org/core/gitutil" "tangled.org/core/idresolver" "tangled.org/core/knotserver/config" "tangled.org/core/knotserver/db" "tangled.org/core/knotserver/sandbox" "tangled.org/core/notifier" "tangled.org/core/rbac" "tangled.org/core/repoident" xrpcerr "tangled.org/core/xrpc/errors" "tangled.org/core/xrpc/serviceauth")
const ActorDid = serviceauth.ActorDid
type DidIngester interface { AddDid(did string) RemoveDid(did string)}
type Xrpc struct { Config *config.Config Db *db.DB Ingester DidIngester Enforcer *rbac.Enforcer Logger *slog.Logger Notifier *notifier.Notifier Resolver *idresolver.Resolver ServiceAuth *serviceauth.ServiceAuth Sandbox sandbox.Backend}
func (x *Xrpc) Router() http.Handler { r := chi.NewRouter()
r.Group(func(r chi.Router) { r.Use(x.ServiceAuth.VerifyServiceAuth)
r.Post("/"+tangled.GitKeepCommitNSID, x.KeepCommit) r.Post("/"+tangled.GitMergeCommitNSID, x.MergeCommit) r.Post("/"+tangled.RepoSetDefaultBranchNSID, x.SetDefaultBranch) r.Post("/"+tangled.RepoDeleteBranchNSID, x.DeleteBranch) r.Post("/"+tangled.RepoCreateNSID, x.CreateRepo) r.Post("/"+tangled.RepoDeleteNSID, x.DeleteRepo) r.Post("/"+tangled.RepoForkSyncNSID, x.ForkSync) r.Post("/"+tangled.RepoHiddenRefNSID, x.HiddenRef) r.Post("/"+tangled.RepoMergeNSID, x.Merge) r.Post("/"+tangled.KnotAddMemberNSID, x.AddMember) r.Post("/"+tangled.KnotRemoveMemberNSID, x.RemoveMember) r.Post("/"+tangled.RepoAddCollaboratorNSID, x.AddCollaborator) r.Post("/"+tangled.RepoRemoveCollaboratorNSID, x.RemoveCollaborator) })
// merge check is an open endpoint // // TODO: should we constrain this more? // - we can calculate on PR submit/resubmit/gitRefUpdate etc. // - use ETags on clients to keep requests to a minimum r.Post("/"+tangled.RepoMergeCheckNSID, x.MergeCheck) r.Post("/"+tangled.GitMergeCheckNSID, x.GitMergeCheck)
// repo query endpoints (no auth required) r.Get("/"+tangled.RepoTreeNSID, x.RepoTree) r.Get("/"+tangled.RepoLogNSID, x.RepoLog) r.Get("/"+tangled.RepoBranchesNSID, x.RepoBranches) r.Get("/"+tangled.RepoTagsNSID, x.RepoTags) r.Get("/"+tangled.RepoTagNSID, x.RepoTag) r.Get("/"+tangled.RepoBlobNSID, x.RepoBlob) r.Get("/"+tangled.RepoDiffNSID, x.RepoDiff) r.Get("/"+tangled.RepoCompareNSID, x.RepoCompare) r.Get("/"+tangled.RepoGetDefaultBranchNSID, x.RepoGetDefaultBranch) r.Get("/"+tangled.RepoDescribeRepoNSID, x.RepoDescribeRepo) r.Get("/"+tangled.RepoBranchNSID, x.RepoBranch) r.Get("/"+tangled.RepoArchiveNSID, x.RepoArchive) r.Get("/"+tangled.RepoLanguagesNSID, x.RepoLanguages) r.Get("/"+tangled.RepoListCollaboratorsNSID, x.ListCollaborators) r.Get("/"+tangled.RepoCheckPushAllowedNSID, x.CheckPushAllowed)
// knot query endpoints (no auth required) r.Get("/"+tangled.KnotListKeysNSID, x.ListKeys) r.Get("/"+tangled.KnotListMembersNSID, x.ListMembers) r.Get("/"+tangled.KnotVersionNSID, x.Version)
// service query endpoints (no auth required) r.Get("/"+tangled.OwnerNSID, x.Owner)
return r}
type resolvedRepo struct { path string name gitutil.RepoName}
func (x *Xrpc) parseRepoParam(repo string) (string, error) { resolved, err := x.resolveRepo(repo) return resolved.path, err}
func (x *Xrpc) resolveRepo(repo string) (resolvedRepo, error) { if repo == "" || !strings.HasPrefix(repo, "did:") { return resolvedRepo{}, xrpcerr.NewXrpcError( xrpcerr.WithTag("InvalidRequest"), xrpcerr.WithMessage("missing or invalid repo parameter, expected a repo DID"), ) }
if !strings.Contains(repo, "/") { repoPath, _, repoName, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repo) if err != nil { return resolvedRepo{}, xrpcerr.RepoNotFoundError } return resolvedRepo{path: repoPath, name: gitutil.RepoName(repoName)}, nil }
parts := strings.SplitN(repo, "/", 2) ownerDid, repoName := parts[0], parts[1]
repoDid, err := x.Db.GetRepoDid(ownerDid, repoName) if err == nil { repoPath, _, _, resolveErr := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid) if resolveErr == nil { return resolvedRepo{path: repoPath, name: gitutil.RepoName(repoName)}, nil } }
repoPath, joinErr := securejoin.SecureJoin(x.Config.Repo.ScanPath, filepath.Join(ownerDid, repoName)) if joinErr != nil { return resolvedRepo{}, xrpcerr.RepoNotFoundError } if _, statErr := os.Stat(repoPath); statErr != nil { return resolvedRepo{}, xrpcerr.RepoNotFoundError } return resolvedRepo{path: repoPath, name: gitutil.RepoName(repoName)}, nil}
type resolvedRepoDID struct { did repoident.RepoDid path string owner repoident.OwnerDid}
func (x *Xrpc) resolveRepoDID(repo string) (resolvedRepoDID, error) { repoDid, err := repoident.NewRepoDid(repo) if err != nil { return resolvedRepoDID{}, err }
repoPath, storedOwner, _, err := x.Db.ResolveRepoDIDOnDisk(x.Config.Repo.ScanPath, repoDid.String()) if err != nil { return resolvedRepoDID{}, err } ownerDid, err := repoident.NewOwnerDid(storedOwner) if err != nil { return resolvedRepoDID{}, err } return resolvedRepoDID{did: repoDid, path: repoPath, owner: ownerDid}, nil}
type failure struct { err xrpcerr.XrpcError status int}
func (f *failure) send(l *slog.Logger, w http.ResponseWriter) { l.Error("failed", "kind", f.err.Tag, "error", f.err.Message) writeError(w, f.err, f.status)}
func badRequest(e xrpcerr.XrpcError) *failure { return &failure{err: e, status: http.StatusBadRequest}}
func unauthorized(e xrpcerr.XrpcError) *failure { return &failure{err: e, status: http.StatusUnauthorized}}
func conflicted(e xrpcerr.XrpcError) *failure { return &failure{err: e, status: http.StatusConflict}}
func serverError(e xrpcerr.XrpcError) *failure { return &failure{err: e, status: http.StatusInternalServerError}}
func (x *Xrpc) pushableRepoDID(actor syntax.DID, repo string) (resolvedRepoDID, *failure) { resolved, err := x.resolveRepoDID(repo) if err != nil { return resolvedRepoDID{}, badRequest(xrpcerr.RepoNotFoundError) } if ok, err := x.Enforcer.IsPushAllowed(actor.String(), rbac.ThisServer, resolved.did.String()); !ok || err != nil { return resolvedRepoDID{}, unauthorized(xrpcerr.AccessControlError(actor.String())) } return resolved, nil}
func writeError(w http.ResponseWriter, e xrpcerr.XrpcError, status int) { w.Header().Set("Content-Type", "application/json") w.WriteHeader(status) json.NewEncoder(w).Encode(e)}
type limitWriter struct { buf bytes.Buffer limit int written int}
var errResponseTooLarge = errors.New("response too large")
func (lw *limitWriter) Write(p []byte) (int, error) { if lw.written+len(p) > lw.limit { return 0, errResponseTooLarge } n, err := lw.buf.Write(p) lw.written += n return n, err}
func (x *Xrpc) writeJson(w http.ResponseWriter, response any) { lw := &limitWriter{limit: x.Config.Server.MaxResponseKB * 1024} if err := json.NewEncoder(lw).Encode(response); err != nil { if errors.Is(err, errResponseTooLarge) { writeError(w, xrpcerr.RequestTooLargeError, http.StatusRequestEntityTooLarge) } else { writeError(w, xrpcerr.GenericError(err), http.StatusInternalServerError) } return } w.Header().Set("Content-Type", "application/json") w.Write(lw.buf.Bytes())}
func writeJson(w http.ResponseWriter, status int, response any) error { w.Header().Set("Content-Type", "application/json") w.WriteHeader(status) if err := json.NewEncoder(w).Encode(response); err != nil { return err } return nil}