Coverage / src/cli/approve.rs 24.8%

fn to_hex(b: &[u8]) -> String {

    b.iter().map(|x| format!("{x:02x}")).collect()

}

fn oref(v: &Value, key: &str) -> Result<ObjectRef> {

    v.get(key)

        .and_then(Value::as_str)

        .and_then(ObjectRef::from_hex)

        .ok_or_else(|| anyhow!("the hub's statement has no valid {key}"))

}

pub fn seal(url: &str, job: &str, reject: bool, as_json: bool) -> Result<i32> {

    let repo = open()?;

    let (base, slug, number, repo_url) = run_url(url)?;

    let options = repo.options_for_url(&repo_url);

    let api = format!("{base}/api/v1/repos/{slug}/flow/runs/{number}/jobs/{job}/approval");

    let body = oxy_core::protocol::http_get(&api, &options).map_err(|e| anyhow!("{e}"))?;

    let v: Value = serde_json::from_slice(&body).context("the hub did not answer with JSON")?;

    let repo_hex = v.get("repo").and_then(Value::as_str).unwrap_or("");

    let mine = to_hex(&repo.id()?);

    if repo_hex != mine {

        bail!("run #{number} belongs to repository {repo_hex}, not this checkout's ({mine}): run oxy seal --flow from a checkout of {slug}");

    }

    let mut repo_id = [0u8; 16];

    for (i, b) in repo_id.iter_mut().enumerate() {

        *b = u8::from_str_radix(&repo_hex[i * 2..i * 2 + 2], 16)?;

    let inputs = v

        .get("inputs")

        .and_then(Value::as_array)

        .map(|a| {

            a.iter()

                .filter_map(|x| x.as_str().and_then(ObjectRef::from_hex))

                .collect::<Vec<_>>()

        })

        .unwrap_or_default();

    let statement = Statement {

        repo: repo_id,

        run: v

            .get("run")

            .and_then(Value::as_str)

            .unwrap_or(url)

            .to_string(),

        job: job.to_string(),

        job_hash: oref(&v, "job_hash")?,

        state: oref(&v, "state")?,

        inputs,

        environment: v

            .get("environment")

            .and_then(Value::as_str)

            .unwrap_or("")

            .to_string(),

        approve: !reject,

    let (key, sk) = repo

        .secret_key()?

        .ok_or_else(|| anyhow!("no signing key: create one with `oxy identity new`"))?;

    let me = repo.identity(&key)?;

    let signed = SignedApproval::sign(&statement, &me, &sk);

    let post = format!("{base}/api/v1/repos/{slug}/flow/runs/{number}/jobs/{job}/seal");

    let payload = serde_json::json!({ "signed": to_hex(&signed.encode()) }).to_string();

    let (code, answer) = oxy_core::protocol::http_json("POST", &post, Some(&payload), &options)

        .map_err(|e| anyhow!("{e}"))?;

    if !(200..300).contains(&code) {

        let why = serde_json::from_str::<Value>(&answer)

            .ok()

            .and_then(|v| v.get("error").and_then(Value::as_str).map(String::from));

        bail!(

            why.unwrap_or(answer)

    }

    if as_json {

        println!("{answer}");

    } else {

        let verb = if reject { "Rejected" } else { "Approved" };

        println!(

            ui::done(verb),

            &key.to_hex()[..12]

        println!(

            &statement.state.to_hex()[..12],

            &statement.job_hash.to_hex()[..12]

        for i in &statement.inputs {

            println!("  takes {}", &i.to_hex()[..12]);

        }

        if !statement.environment.is_empty() {

            println!("  for environment {}", statement.environment);

        }

    Ok(0)

}