Terraform state: reading one needs the write role bb018142cca7

async fn who(app: &Shared, headers: &HeaderMap, row: &db::repos::RepoRow) -> Result<Who, ApiError> {

    let token = token_of(headers).ok_or_else(|| {

    })?;

    let hash = crate::auth::token_hash(&token);

    if token.starts_with(crate::flow::JOB_TOKEN_PREFIX) {

        }

        return Ok(Who::Job { name: sub.to_string() });

    };

    }

    let slug = row.slug();

    if !token.covers(&slug) {

    let role = crate::auth::roles::role_for(&app.db, Some(&account), row)

        .await

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?;

    match role {

        Some(r) if crate::auth::roles::allows(Some(r), Access::Read) => Ok(Who::Person { account: Box::new(account), role: r }),

        _ => Err(err(StatusCode::NOT_FOUND, "no such repository")),

        .map_err(|e| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string()))?

        .ok_or_else(|| err(StatusCode::NOT_FOUND, "no such repository"))?;

    let who = who(&app, &headers, &row).await?;

    }

    let db_err = |e: sqlx::Error| err(StatusCode::INTERNAL_SERVER_ERROR, e.to_string());

    let current = db::terraform::get(&app.db, row.id, &state).await.map_err(db_err)?;

        send("GET", "/api/v1/repos/andy/infra/terraform/state/..x".into(), Some(basic.clone()), "").await.0,

        StatusCode::BAD_REQUEST

    );

    // The site token is no person's: refused.

    let (st, _) = send("GET", path.into(), Some("Bearer site".into()), "").await;

    assert_eq!(st, StatusCode::UNAUTHORIZED, "the site token is not a person's token");

    let elsewhere = issuer.mint_for(h.app.config.base_url(), "repo:andy/infra:bookmark:main", "sts.amazonaws.com", now, 600);

    assert_eq!(send("GET", path.into(), Some(format!("Bearer {elsewhere}")), "").await.0, StatusCode::UNAUTHORIZED);

    // Its page under Artifacts (#254) lists the state and the backend block.

    assert_eq!(st, StatusCode::OK, "{page}");

    assert!(page.contains("<strong>prod</strong>") && page.contains("/api/v1/repos/andy/infra/terraform/state/NAME"), "{page}");

    assert!(page.contains("allow "") || page.contains("allow \""), "the egress line names the hub");

**Who may use it:**

- a job, with an identity token of this hub's for the audience `{base_url}/terraform` (its pipeline's `identity` block) or with its runner's job token, for its own repository only;

The token goes as the bearer or as Basic auth's password, which is what the backend sends (`TF_HTTP_PASSWORD`).

<h2>From a pipeline</h2>

<p>A job uses it with an identity token of this hub's, so it needs no cloud credential for the state. Give the job <code>identity "{{ shell.base_url }}/terraform" {% raw %}{{% endraw %} mount-path "/run/secrets/tf" {% raw %}}{% endraw %}</code>, run <code>export TF_HTTP_PASSWORD=$(cat /run/secrets/tf)</code> before <code>tofu init</code>, and let its sandbox reach this hub (<code>network "egress" {% raw %}{{% endraw %} allow "{{ shell.base_url|host }}" {% raw %}}{% endraw %}</code>, beside whatever else it reaches).</p>

<h2>From your machine</h2>

<h2>States</h2>

<div class="table"><table>

<tr><th>State</th><th>Serial</th><th>Last written</th><th>Lock</th><th>Versions kept</th></tr>

{% for (s, n) in tf_states %}<tr><td><strong>{{ s.name }}</strong></td><td>{{ s.serial }}</td><td class="small">{% if s.updated_by.is_empty() %}<span class="mute">never</span>{% else %}by {{ s.updated_by }} <time title="{{ s.updated_ms|when_i }}">{{ s.updated_ms|ago_i }}</time>{% endif %}</td><td class="small">{% if s.lock_id.is_empty() %}<span class="mute">free</span>{% else %}held by {{ s.locked_by }}{% if let Some(t) = s.locked_ms %} <time title="{{ t|when_i }}">{{ t|ago_i }}</time>{% endif %}{% endif %}</td><td>{{ n }}</td></tr>{% endfor %}